The README makes claims. This file backs them up.
Autonomous multi-platform bug reporting for AI agents. Successfully validated on 2026-02-07 with 2 real bugs filed to Fedora Bugzilla: Bug #2437503 (maliit-keyboard crash) and Bug #2437504 (xwaylandvideobridge error).
This is achieved through six submitters (GitHub, GitLab, Bitbucket, Codeberg, Bugzilla, Email), fuzzy deduplication (Levenshtein distance), and an Idris2-verified contract spec (src/abi/FeedbackOTron/Contract.idr) mirrored at runtime by the Elixir validation boundary (FormValidator). Full FFI enforcement (the Zig bridge) is not built — the contract is a proof-carrying spec, not a boundary the payload physically crosses.
Location: elixir-mcp/lib/feedback_a_tron/submitter.ex and elixir-mcp/lib/feedback_a_tron/channels/bugzilla.ex
How verified: The Bugzilla submitter (in the above file) uses the Bugzilla REST API endpoint (/rest/bug) to create bugs. README (§Production Status) claims "Bugzilla REST API: Full product/component/version support" and provides a real-world example: --repo "Fedora" --component "maliit-keyboard" --version "43" successfully filed Bug #2437503. The submitter validates that component exists before submitting (via GET /rest/product/{product}/valid_field_values?field=component), rejects invalid versions, and includes full stack traces in the body.
Caveat: Component validation is API-based (not local); if the Bugzilla instance changes its components, validation may fail silently.
Location: elixir-mcp/lib/feedback_a_tron/deduplicator.ex (Elixir deduplication)
How verified: The deduplicator implements three strategies: SHA-256 hash (exact match), Levenshtein distance (typos/minor rewording), and fuzzy match (substring matching). README (§Key Features) claims "Prevents duplicate submissions using fuzzy matching (Levenshtein distance)." The module is tested in elixir-mcp/test/deduplicator_test.exs which verifies: identical reports are caught, reports differing by <10% edit distance are flagged as similar, and unrelated reports pass through. As of the Synthesis Engine branch the dedup is wired end-to-end: Submitter calls Deduplicator.record/3 after each successful submission and check/1 before dispatch, and Synthesis.Research consults check/1 during research mode.
Caveat: Fuzzy matching threshold (10%) is empirical, not formally justified. May have false positives/negatives.
Follows the hyperpolymath ABI/FFI repo layout (Idris2 spec + Zig bridge). To be precise about what that means here: the Idris2 side is a real, proof-carrying contract spec (Contract.idr), the Elixir FormValidator enforces the same rules at runtime, and the Zig FFI bridge is a stub — the Submitter does not call Idris2-compiled code or proven types at any FFI boundary.
Also integrates with boj-server (cartridge system) — but feedback-o-tron is not a cartridge itself. The engine is wrapped by the bug-filing-mcp cartridge in boj-server-cartridges, which forwards requests over the engine’s localhost HTTP intake (127.0.0.1:7722). The similarly named feedback-mcp cartridge is an unrelated sentiment counter that merely shares the name (see docs/AUTONOMOUS-BUG-PIPELINE.adoc §5).
| Path | What’s There |
|---|---|
|
CLI entry point: escript with submit, --mcp-server, --version, --help commands |
|
Submitter module: dispatch to platform channels; validates |
|
Platform channel adapters (GitHub, GitLab, Bitbucket, Codeberg, Bugzilla, Email, and more) |
|
Fuzzy deduplication: SHA-256, Levenshtein distance, substring matching |
|
Environment variables + CLI config auto-detection (gh, glab) |
|
JSON-lines audit trail; records all submissions (success, failure, dry-run) |
|
Network checks: latency, DNS, TLS, DNSSEC, BGP/RPKI (opt-in via Hydrator |
|
Synthesis Engine: TemplateFetcher/Cache, IntentClassifier, Hydrator, Research, Synthesizer, FormValidator, FormRenderer |
|
Optional localhost HTTP intake ( |
|
Idris2-verified contract spec for form validation (total, proof-carrying; mirrored by FormValidator) |
|
Zig FFI bridge — currently a stub; no FFI enforcement |
|
Deduplicator tests: exact, fuzzy, substring matching |
|
Submitter tests for each platform (mocked HTTP) |
|
Network verifier tests (DNS, TLS, DNSSEC) |
|
Synthesis Engine tests (classifier, hydrator, research, synthesizer, validator, renderer, fetcher) |
-
Bugzilla REST API:
elixir-mcp/test/submitter_test.exs— mock Bugzilla API, verify product/component/version handling -
Deduplication:
elixir-mcp/test/deduplicator_test.exs— test hash, Levenshtein, and fuzzy matching with edge cases -
Credential loading:
elixir-mcp/test/credentials_test.exs— verify env vars, gh, glab configs are loaded in priority order -
Audit logging:
elixir-mcp/test/audit_log_test.exs— verify all submissions recorded, JSON-lines format valid -
Integration:
elixir-mcp/test/integration/andelixir-mcp/test/e2e_test.exs— end-to-end flows in dry-run mode -
Network verification:
elixir-mcp/test/network_verifier_test.exs— mock DNS/TLS, verify latency, DNSSEC, route checks -
Synthesis Engine:
elixir-mcp/test/synthesis/— classifier gate (salvage/reject/open-questions), hydration, research, form validation/rendering