The maintenance agent that pushes the boring buttons.
ArtiDezi is a self-hosted tool which lets coding agents do routine maintenance on your repositories, without giving them your repo credentials.
Point it at pull requests from an updater such as Renovate, or describe a task yourself. A coding agent (Codex or Pi) does the work, and you get one of these on your forge (Forgejo or GitHub):
- ✅ Merge as is: the change is fine as-is, and ArtiDezi auto-merges it
- 🔧 Adaptation: the change needs more work, so ArtiDezi proposes a PR for you to review
- 🙋 Needs a human: ArtiDezi stops and tells you why
ArtiDezi has 2 parts, so that the untrusted worker agent doesn't get near your forge credentials or be allowed to merge stuff by itself:
- The orchestrator is trusted. It holds the forge credentials and is the only part that publishes anything.
- The worker is not. It runs the coding agent on an expendable machine, and only hands back its verdict and changes.
You decide what the agent may touch in each project. A compromised worker can lie about what it did, so human review remains the safeguard.
Warning
For simplicity, the worker isn't a sandbox yet: it's reused from task to task. A rogue agent can read the harness credentials stored on it.
Tip
Give each worker a machine and credentials you can afford to lose, and use separate pools for projects that shouldn't mix.
Here are 2 real examples from the matrix-docker-ansible-deploy project, where Renovate proposes updates for dozens of services:
- ✅ A scary upgrade, merged as is. Mjolnir v1 to v2 deleted a whole mode of operation. ArtiDezi read the upstream diff, confirmed that the playbook only uses the mode that stayed, published its evidence along with what it hadn't tested, and merged the PR about 2 minutes after picking it up.
- 🔧 A green PR that would have broken things. matrix-user-verification-service v4 was a one-line bump with passing CI, but upstream had quietly stopped reading the
.envfile, without a word in its changelog. The service would have started healthy while ignoring its configuration, leaving its API without authentication and denying Matrix logins to Jitsi. ArtiDezi proposed an adaptation PR that passes the configuration through Docker, and a maintainer merged that instead.
With Docker Compose v2, Python 3.11+ and just:
git clone https://github.com/devture/artidezi.git
cd artidezi
just services-start
just services-credentialsOpen http://artidezi.127.0.0.1.nip.io:3080: a private Forgejo, the orchestrator and a scripted worker, with no model calls. See the local stack.
The orchestrator is a container image, ghcr.io/devture/artidezi.
The worker is the same program as a static binary, attached to each GitHub release.
See Installing.
To deploy with Ansible, use the orchestrator and worker roles, or mash-playbook, which wires them up for you.
Start at the documentation index, or go straight to a topic:
- 📦 Installing: the orchestrator, the worker and their first run
- 🗂️ Projects and instances: what to group, and preparing a repository's CI
- 📝 Tasks and reviews: requesting work, reading evidence, asking for revisions
- 📥 Incoming changes: assessing pull requests from updaters and people
- 🐙 GitHub enrollment: the GitHub App, dry runs and publication
- ⚙️ Configuration and operation: settings, accounts, backups, troubleshooting
- 🏛️ Architecture: the design, and what each boundary does and doesn't guarantee
- 🧑💻 Development: building, test layers and the local stack
The name ArtiDezi comes from Artificial Desmond: an AI that's pushing the boring buttons for you.