Proofwork

DriftFix, powered by Proofwork: detect supported API-breaking changes and produce a verifiable repair handoff without modifying the repository.

API providers change. Changelogs are easy to miss, search-only codemods can silently change behavior, and giving an unknown agent write access to a repository is a hard sell.

DriftFix starts with a narrower contract: scan locally, identify only supported provider-drift exposures, bind the result into a tamper-detectable assessment, and hand confirmed work to Proofwork's verification and human-approval boundary.

Current release: v0.6.0 is an alpha-quality detection and verification-handoff release. It does not automatically repair code or open pull requests.

Thirty-second demo

Requires Node.js 22.15.0 or newer.

git clone https://github.com/adididitagain/proofwork.git
cd proofwork
npm ci
npm run build

node dist/cli.js driftfix scan fixtures/driftfix-stripe/repository \
  --out .proofwork/driftfix-demo

Expected result:

Issued immutable DriftFix assessment: dfa1_...
Decision: proofwork_task_ready
Findings: 2

The generated report.md identifies two confirmed exposures in the fixture:

PaymentIntent.charges was removed                 src/billing.ts:8:10
Legacy subscription proration parameters removed src/billing.ts:14:5

Inspect the content-addressed assessment later:

node dist/cli.js driftfix inspect \
  .proofwork/driftfix-demo/assessment.json

What happens

local repository
      |
      v
DriftFix provider pack
      |
      v
content-addressed assessment
      |
      v
Proofwork verification handoff
      |
      v
human approval before publication

For the frozen Stripe provider pack, DriftFix:

• Requires a declared stripe npm dependency.
• Locates explicit Stripe API-version evidence and fails closed when it is missing or ambiguous.
• Scans bounded JavaScript and TypeScript source files locally.
• Records package metadata, digests, rule IDs, and exact file/line locations—not source snippets.
• Issues an immutable dfa1_... assessment ID that fails validation after tampering.
• Requires existing tests, a typecheck or build, a target-version contract, a held-out behavior probe, and human approval in the Proofwork handoff.

Supported Stripe exposures

The first provider pack targets the frozen 2026-02-25.clover API version and intentionally recognizes only three high-confidence historical changes:

Rule	Effective version
Removed PaymentIntent.charges access	2022-11-15
Removed legacy subscription prorate parameters	2020-08-27
Removed direct subscription source updates	2018-07-27

This explicit rule boundary is a feature. A clean result means no supported exposure was detected; it is not a general compatibility or safety certificate.

Safety boundary

DriftFix does not:

• Read Stripe credentials or call Stripe.
• Upload repository source.
• Modify scanned files.
• Create a branch or pull request.
• Merge code automatically.
• Claim that a complete application is safe to upgrade.

The broader Proofwork engine in this repository adds bounded outcome contracts, offline Docker verification, held-out checks, candidate security gates, evidence receipts, approval-gated draft-PR publication, and deterministic benchmark tooling. Those components are available for experimentation, but the public product wedge in this release is DriftFix.

Development

npm ci
npm run check
npm test
npm run build

The full test suite covers DriftFix, outcome contracts, the verifier, evaluation harnesses, the local exchange, privacy boundaries, and GitHub intake/publication controls. Live Docker tests skip when the required image is unavailable.

Roadmap

The next useful milestone is not a larger dashboard. It is one end-to-end public proof:

1. Confirm a real exposure in a public repository with maintainer consent.
2. Generate candidate repairs against the frozen provider contract.
3. Run the candidates through the existing Proofwork checks.
4. Deliver the winner as a human-reviewed draft PR.

After that: expand the Stripe rule pack, add more providers, sign assessment receipts, and harden hosted execution.

Contributing and security

See CONTRIBUTING.md for development and pull-request expectations. Please report security issues privately as described in SECURITY.md.

Proofwork is licensed under Apache-2.0.

Stripe is a trademark of Stripe, Inc. Proofwork is an independent project and is not affiliated with or endorsed by Stripe.