FOR APPS PEOPLE CAN'T AFFORD TO GET WRONG
One shake fixes it.
Margaret is 78 and takes five prescriptions. Her pharmacy app charges her $24 for a $12 copay. Reporting that today takes steps to reproduce, a screenshot, an app version and someone who believes her. So she calls her daughter, or she quietly stops using the app.
With ShakeFix she shakes her phone. That is the whole bug report. GitLab Duo agents reproduce it, fix it, prove the fix changed only what it should, and ship it. Then her phone asks: “Fixed ✓. Is it working for you now?”
One bug, two ways
| Today | With ShakeFix | |
|---|---|---|
| Report | Margaret calls her daughter, who emails support: “the app charged Mum twice” | She shakes. The app already kept her last 30 taps, the error and a redacted screenshot |
| Reproduce | “Cannot reproduce.” 17% of bug reports end there | Agents turn her taps into a test that fails on today's app. No failing test, no fix |
| Fix | Waits in a queue for a developer | The smallest change that makes the test pass, checked against production behaviour before it merges |
| Done | A ticket closes. Nobody asks her | Her phone asks. Her 👍 closes it, 👎 reopens it, and it reopens by itself if it ever breaks again |
| Everyone else | Pays twice until someone else complains | Gets the same fix minutes after the first shake |
Done means the person it hurt says it's fixed. Not a green pipeline.
If you have three minutes
Path A (Start Fresh) · Hands-off: a shake reaches production with no person in between. Dosing code is Supervised by policy, not by the agent's choice.
Judging criteria and the evidence
Each row is one criterion: what we claim, and the link that proves it.
Live proof: signed certificates
Every closed case gets a certificate signed by the intake on Cloud Run (HMAC-SHA256, key in Secret Manager). This page fetches each one now and asks the intake's public endpoint to verify the signature. “Touches” is the certificate's own count, and we don't edit it.
Limits, said plainly
- Few hands-off runs. Each certificate counts 1 touch. On #14 and #16 that touch was our own intake's note, miscounted by a webhook race we fixed afterwards; on #15 we rebased after breaking
main; on #17 a person merged by design. - CareRx is a demo app with synthetic data. Its four bugs are seeded, each modelled on a documented real failure.
- Reproduction needs her words. Taps show what she did; her one-line note says what was wrong. From taps alone, 3 of 10 seeded bugs reproduce.
- Triggers need a human token. GitLab flow triggers ignore bot users, so the intake files issues as the maintainer.
- What runs where. The four agents are one GitLab Duo flow. Second Opinion's optional labeller calls Claude from CI and can only make a verdict stricter.