Overview

Malenia investigates failed CI runs and produces bounded, replayable, evidence-first diagnosis reports. It reproduces a failure, compares revisions when possible, localizes relevant changes, records evidence, and classifies the result deterministically as reproducible, flaky, resolved, or unavailable.

Deterministic diagnosis is the default and primary product. Optional model-assisted analysis and repair are separately opt-in. Environment adapters exist for Go, Node.js, Python, Rust and Bazel.

Quick start

Confirm the failing command runs in your repository:

go test ./...

Then diagnose it:

go run ./cmd/malenia diagnose --repo . --command "go test ./..."

Repair is a separate command and is explicitly opt-in.

Diagnosis workflow

Every diagnosis follows the same bounded sequence.

1. 01Check out the target revision in an isolated git worktree.
2. 02Run the command repeatedly.
3. 03Classify the result as reproducible, flaky, resolved, or unavailable.
4. 04Compare head with the base revision.
5. 05Localize files, stack frames and commits.
6. 06Build a bounded evidence bundle with stable IDs and digests.
7. 07Validate diagnosis claims against evidence references.
8. 08Persist the report, events, artifacts and checksums.

Model-assisted analysis and repair

Model assistance is opt-in and kept separate from diagnosis. The model never becomes the source of truth for diagnosis or verification.

• It can propose; it never executes, modifies, or decides.
• Analysis and repair are each enabled separately.
• Deterministic diagnosis remains the authoritative result.

GitHub Actions integration

The reusable workflow ci-diagnose.yml diagnoses a failed run and publishes the report.

Setting agent: true enables a separate, trusted model-analysis job. That job only receives the bounded diagnosis artifact — never the repository or credentials.

Patch safety and execution boundary

Execution

• Runs in isolated git worktrees with allowlisted commands.
• Optional Docker executor: read-only root, no network by default, dropped capabilities, resource limits.

Patches

• Parsed patch operations are validated before execution.
• Traversal, binary and symlink patches are rejected.
• Change limits are enforced and git apply --check runs first.
• It never silently modifies a repo, opens PRs, merges, or deploys.

Configuration

Configure Malenia with a .malenia.yml file at the repository root.

command: go test ./...
attempts: 3
timeout: 10m
executor: docker
image: golang:1.26

Current limitations

• No automatic PR changes or deployment.
• No unrestricted network for executed code.
• No universal root-cause proof.
• No autonomous, unrestricted agents.