Who Broke It?

One repo. Humans. AI agents. Zero excuses.

The open-source coordination layer for AI-native engineering teams.

Investigate an incident → View on GitHub
INTERACTIVE DEMO · SIMULATED INCIDENT NOT A LIVE AGENT

A short simulated investigation

about 35 seconds · three commands · every output here is simulated

PRODUCTION INCIDENT

Something broke. Nobody knows who did it.

MayaDid you change payments?

SamNo.

MayaClaude changed it.

SamWhich Claude?

Let's find out.

simulated · shop-checkout
$ wbi status
12 tasks · 4 agents · 2 blocked

⚠ TASK-003  PaymentStatus API
  CONTRACT CONFLICT

First, see what's happening across the repo.

simulated · shop-checkout
$ wbi task TASK-003
TASK-003
Update PaymentStatus API

Owner:       Sam
Executor:    Claude Code
Contract:    PaymentStatus
Downstream:  TASK-010, TASK-014

Then see what the agent was actually supposed to do.

simulated · shop-checkout
$ wbi blame src/api/payment.ts
PaymentStatus
Changed by:  Claude Code · TASK-003 · commit a91f2c7
⚠ Undeclared: src/auth/payment-token.ts

simplified for the demo: real wbi blame <path> prints who changed a path, under which task and agent, from commit trailers. The "undeclared" line stands in for what wbi verify / wbi check report: files outside a task's allowed paths.

src/auth/payment-token.ts

There it is.

CONTRACTPaymentStatus TASK-010 Billing API Reconciliation
One change. Three things at risk.

That's what Who Broke It? is for.

Enter or Next to advance

WBI connects what you're building, who is building it, why they're changing it, and what that change can break.

Agents can already write the code. Nobody coordinates it.

01

They collide

Two agents edit the same area. A merge conflict is the good outcome: the bad one is both being "right".

02

Changes break strangers

One agent bumps a type. Three other tasks, built against the old one, find out in CI. Or production.

03

"Done" means "I said so"

The agent reports success. Nothing checks scope, contracts, rules, or whether anyone asked for this.

04

Nobody remembers why

Six weeks later: why does this code exist, who wrote it, and which requirement was it for?

How it works

The repo carries its own engineering context. Any agent that can run a shell command can play. Five are proven end to end.

    The Engineering Graph

    Goal → requirements → tasks → contracts → agents → commits → PRs, as plain files in your repo. This is a real plan, generated by wbi plan for a SaaS app. Click a task. Or break a contract.

    Break a contract:

    Click a task to trace what it depends on (blue) and what depends on it (red). Break a contract to see its blast radius. We'll tell you who to apologise to.

    Many agents, one repository

    Each agent works in its own isolated worktree on its own task branch. They declare intent before touching code, and wbi checks the declaration against everyone else.

    🤖 claude@mayaTASK-007 · Billing APIwbi/TASK-007
    🤖 codex@devbTASK-010 · Analytics APIwbi/TASK-010
    🤖 cursor@devcTASK-003 · Web app shellwbi/TASK-003
    🧑 aliceTASK-001 · Architecturewbi/TASK-001
    🧑 bobTASK-002 · Databasewbi/TASK-002

    Two laptops. One task. Git decides.

    No server, no account. Teammates on separate machines share state through the git remote you already have. A push to a ref is an atomic compare-and-swap, so exactly one claim wins.

    💻 Alice
    claude
    TASK-003: free
    ☁ git remote
    refs/wbi/sync
    log: empty
    💻 Bob
    codex
    TASK-003: free

    Signed batches · team allow-list · offline-tolerant · compaction · verified against real GitHub

    The agent says it's done.

    "Done" is a claim. The Agent Judge checks it against scope, contracts, your constitution, tests and acceptance criteria. Risky changes (migrations, security, public API) wait for a human. Criteria only a person can sign are never attested by an agent.

    ⚖Objection: the agent says it's done.

    Handoff → pull request → merge gate

    wbi pr opens a PR whose body is built from the handoff. The GitHub Action then enforces the graph on the diff. These are the real findings from the public demo repo.

    TASK-001: architecture notesclean
    • ✓ in scope
    • ✓ handoff record present
    • ✓ constitution
    wbi check · PASS
    TASK-003: web shellscope + constitution
    • ✗ SCOPE_RESTRICTED src/api/billing/steal.ts
    • ✗ CONSTITUTION C6: all billing mutations go through BillingService src/web/shell/pay.ts
    • ! NO_HANDOFF
    wbi check · FAIL
    TASK-010: analyticscontract tampering
    • ✗ CONTRACT_NOT_OWNED BillingStatus is owned by TASK-007 but changed by TASK-010
    • ! UNMERGED_DEPENDENCY
    wbi check · FAIL
    TASK-002: databasehigh-impact
    • ✗ NEEDS_APPROVAL a migration needs a human reviewer
    • ! UNMERGED_DEPENDENCY
    wbi check · FAIL until approved

    A dashboard that is just a file

    wbi dashboard writes one self-contained HTML file: no server, no network calls. Open it, commit it, host it anywhere static.

    The Who Broke It dashboard showing a task graph with the BillingStatus contract's blast radius highlightedOpen the live demo dashboard →

    The real CLI REAL OUTPUT

    Not simulated. Captured by scripts/site-data.py from real runs of the project's demo scripts on a throwaway repo, with the agents' coding scripted.

    What's proven, and what isn't

    Open-source tools lie by omission. Here is the whole truth. (Full evidence and how to re-run it)

    ✓ Verified

    • Claude Code, OpenAI Codex CLI, Cursor Agent, OpenCode and Google Antigravity each run end to end over MCP and the CLI protocol, judged from the recorded state, not the agent's word. Those runs found real problems (a sandbox that blocks .git, missing attribution over MCP) that we fixed or documented.
    • Linux, macOS and Windows CI, including a 24-process database stress test.
    • Sync run against real GitHub and gitlab.com with two clones each: signed batches, a forged batch rejected, the team allow-list, --force-with-lease compaction, and concurrent claim races with exactly one winner every time (17/17 checks on each host).
    • The merge gate on real pull requests, installable via curl, Homebrew and go install.
    • Every transcript in the "Real CLI" and "How it works" sections is captured from a real run.
    • The incident at the top of the page is a fictional, simulated demo.

    ◌ Not proven

    • Other versions of these agent tools: only the versions recorded in the adapter docs were tested, and each needs its documented settings.
    • Windows for any agent.
    • Bitbucket and self-hosted git for sync: untested.
    • Slack and Discord notifications: tested against local webhook mocks, not the real services.
    • Linear and Jira sync: not built (generic webhooks are).
    • Authorized teammates are trusted with each other: signatures stop outsiders and forgery, not insiders.

    Install it in 30 seconds

    curl -fsSL https://raw.githubusercontent.com/shriyashish-mishra/who-broke-it/main/install.sh | sh

    Verifies the SHA-256 checksum and refuses to install on a mismatch.

    Your first five minutes

    # in any git repo with one commit
wbi init
wbi plan "Build a SaaS dashboard with auth, billing and analytics"
wbi simulate --approve            # waves, critical path, conflicts
git add .wbi && git commit -m "chore: engineering graph"

wbi adapters install claude       # teach your agent the protocol
wbi status                        # mission control
wbi start TASK-001 --worktree     # an isolated branch + the full work packet

    Read the README Browse the demo repo

    Install WBI ⭐ Star it on GitHub

    One repo. Humans. AI agents. Zero excuses.

    WHO BUILT IT?

    Hi, I'm Shriyashish.

    I'm a product manager building AI products, with a background in growth and engagement. I built WBI after watching how quickly a repo gets confusing once several AI agents are working in it at the same time. It's one of a handful of things I've built, and you can see the rest in my portfolio.

    See my portfolio →