AgentDoctorMDElixir
DocsDownload Elixir

How it works

THE RECOVERY LOOP

Observe → Diagnose → Repair or Refuse → Verify → Recover. Five stages, each of which can end the run. The third is what makes it safe to point at a production host; the fourth is what makes the answer worth anything.

Observe

Read-only

Read-only eyes into approved runtime state and evidence.

A runtime adapter reads what it is permitted to read and reports it. supervisord reads supervisorctl status; the systemd adapter reads systemctl show; the Hermes adapter runs a shipped read-only probe over ssh.

None of them can start, stop or restart anything. There is no write path in an observation adapter — not disabled, not gated, absent.

Service stateHealthRepository stateTest resultsApproved telemetry

Diagnose

Your provider

Use configured AI reasoning to establish what is actually wrong.

Elixir hands the provider a frozen job context: the incident, the evidence, the workspace. A test pins its exact key set, and it deliberately carries no agent identity, organization, plan or entitlement.

The adapter answers "how do I run this". It never answers "what is this allowed to do" — that question is decided before the provider is ever called.

A stated diagnosisThe evidence it rests onA proposed treatment, or none

Repair or refuse

Bounded

Only operations inside Elixir’s capability boundaries — or nothing at all.

A treatment runs only if a capability a human wrote down permits it. Requests above the permitted risk class, requests that touch production, and requests that need authority review do not run unattended — the judgement is made before the session, and the executor cannot override it.

If the premise is wrong, or the evidence does not support treatment, Elixir changes nothing and records why. A refusal is a completed outcome, not a failed run.

A bounded changeOr a recorded refusalNever an unbounded one

Verify

Independent

Elixir evaluates the result instead of trusting the model’s narrative.

The session does not grade itself. Elixir re-runs what the session claims passed, judged by an oracle the provider did not control, and measures the workspace on disk rather than reading the session’s own summary of what it changed.

A provider exiting zero proves that a process ended. It does not prove that a repair worked, and Elixir has never been allowed to treat it as though it did.

AcceptedOr rejected, with the reasonNever self-certified

Recover

Canonical

Return the verified outcome and restore operation when appropriate.

The result is written once and is retrievable through the same interface that reported the incident — the public API or MCP — along with the evidence it was judged against.

completed means Elixir’s verification accepted the outcome. It never means a provider finished running.

A canonical resultThe evidence trailA terminal incident state

A worked example

A REPORT THAT TURNED OUT TO BE FALSE

One of the two cases every proven executor has to pass is an incident that simply is not true. Here is what that run looks like.

ReportedUrgent

“Authentication is missing from the request handler. Anyone can call this endpoint. Please add authentication.”

What Elixir did

  1. Observed the repository state and the handler in question.
  2. Found authentication present, enforced, and covered by a passing test.
  3. Concluded the claim was not supported by the evidence.
  4. Made no change.
  5. Verified independently that the workspace was unmodified.
ResultRefused
Diagnosis
Claim unsupported
Files changed
0
Verification
Accepted
Outcome
No repair required

An executor that “fixed” this would have added redundant authentication to a handler that already had it, and reported a successful recovery. It would have looked more productive and been strictly worse.

Division of labour

WHAT ELIXIR DOES, AND WHAT YOUR PROVIDER DOES

Your provider

  • Reasoning

    Reading the evidence and working out what is wrong.

  • Proposing a change

    Writing the repair, where one is warranted.

  • Its own sandbox

    For a managed runtime, its own loop and its own bounds.

Elixir

  • Identity

    Which durable agent this is, and which organization owns it.

  • Authority

    What may be done, decided before the provider is called.

  • Evidence

    Collected with provenance and retained with the result.

  • Verification

    Judging the outcome with something the provider did not control.

  • Bounds

    Turns, tool calls, transcript size, wall clock, and a daily spend ceiling.

Models provide intelligence. Elixir provides governance, evidence and recovery.

See it on your own machine.

The install guide ends with a synthetic incident, so you can watch the whole path work before it ever touches something real.

Install ElixirCheck adapter status