Least privilege from source capture to pull request
Delta Code can only access repositories selected during GitHub App installation, and generated patches remain drafts until a developer reviews them.
Give the bot enough context to migrate. Never enough authority to decide alone.
Delta Code separates GitHub access, model interpretation, trusted patch policy, sandbox execution, deterministic evidence, and developer approval into explicit boundaries.
Prompt-injection resistance
Provider, repository, and developer text is untrusted data. Model tools are disabled and outputs must match strict schemas.
Bounded model context
Only known source evidence, call sites, selected files, and explicit instructions enter each GPT-4o request.
Fail-closed sandbox
Repository-controlled commands run in a separate executor with deny-by-default networking and explicit enablement.
Human-controlled Git writes
The publisher owns its branch and exact patch, opens a draft PR, and never auto-merges the migration.
Clear trust boundaries
Interpretation, proof, and authority remain separate.
Plans, edits, tests, explanations, and evidence-grounded review recommendations.
Source hashes, call sites, patch validation, sandbox checks, Git artifacts, and audit history.
Approve, revise, snooze, decline, publish, and ultimately merge.