🤓 Latest Submissions
.png&w=828&q=75)
ContractGuard: Bob API Drift Auditor
ContractGuard is an IBM Bob-built API governance proof of concept that helps enterprise teams catch API contract drift before it becomes a production outage. Modern companies rely on OpenAPI specs as the source of truth between backend teams, consumer services, QA, security, and compliance. But in real development, implementation and specification drift apart: a required field disappears, a numeric amount becomes a string, an undocumented admin endpoint ships, or enum values no longer match. These small changes can break downstream services, create security gaps, and cause expensive incident response. ContractGuard demonstrates how IBM Bob can accelerate the full software development lifecycle around this problem. Bob was used to analyze the repository and OpenAPI contract, identify drift scenarios, classify severity, reason about downstream consumer impact, generate fixes, build validation tests, and produce governance-ready reports. The repository includes exported Bob task history as proof of usage and as an audit trail of the development workflow. The demo uses a FastAPI payment API, an OpenAPI specification, a consumer service, automated pytest contract checks, JSON audit findings, Markdown governance reports, and a static dashboard. It shows a complete lifecycle: detect drift, quantify risk, fix the implementation, validate behavior, and communicate the release decision clearly. ContractGuard is designed for enterprise API teams that need more than code completion. It turns IBM Bob into an AI-assisted API governance partner that can reduce manual review time, prevent breaking changes, and help teams ship safer APIs with auditable evidence.
17 May 2026
IaC SecFix Multi Agent
IaC-SecFix is a scanner-verified Infrastructure-as-Code remediation prototype for Terraform and Kubernetes. It combines an agentic remediation loop with deterministic security validation: the system ingests an IaC file, runs Checkov to identify misconfigurations, retrieves policy context, generates a Qwen-based patch, validates the patched file again, and routes the result through safety and human approval gates. The application is designed for trustworthy cloud security workflows. It does not apply infrastructure changes automatically. Instead, it produces reviewable patches, explains what changed, shows findings before and after remediation, and rejects or flags results when unresolved issues remain. The Hugging Face Space supports reliable demo playback from persisted benchmark artifacts, with optional live Qwen/vLLM inference when GPU access is available. The project demonstrates typed Pydantic contracts, structured agent outputs, scanner-backed validation, parser checks, traceable decisions, and a conservative safety posture for AI-assisted DevSecOps.
10 May 2026
