Repair agent

Plan first. Authorize exact bytes.

Generate bounded repair proposals, bind authorization to source hashes, verify in staging, then publish receipts.

Join findings to a proposal

Repair plans name exact finding codes, files, byte ranges, replacements, expected hashes, and verification commands.

pliego-cssc plan --findings findings.json \
  --proposal proposal.json --source-root .

Dry-run applies the authorized patch inside a staging copy and executes bounded Rust or browser checks without replacing the source tree.

pliego-cssc fix --plan plan.json --findings findings.json \
  --source-root . --dry-run

Test, browser, toolchain, and version subprocesses use explicit deadlines and output limits while the repair lock is held.