Code and Query Defect Validation and Repair

Validates generated or existing software artifacts before they reach users or production, using static analysis and execution checks to detect defects such as Java resource leaks or failing LLM-generated SQL, then assists with or automates safe repairs to improve reliability and developer productivity.

Business Blueprint

GROUNDED

AI validates and repairs code and query artifacts before they create production reliability or analytics-quality problems.

The Problem

Development and data teams face manual, error-prone validation and repair work when tools flag code defects or users must translate analytical questions into correct, efficient SQL across large data environments.

Software developers

Static-analysis tools identify Java resource leaks, but fixes remain manual, time-consuming, and prone to errors.

Data users and analysts

Finding the right data and translating an analytical problem into correct and efficient SQL is challenging when data is spread across many domains.

Cost of Inaction

Resource leaks can lead to performance degradation, application failures, and inability to handle additional operations due to resource exhaustion.

Process Fit

Software development & delivery

As-Is

Static analysis and analytics tools surface work for technical users: SonarQube reports Java resource leaks with file and line details, while Querybook users ask analytical questions and work with table choices, schemas, and SQL. The remaining validation and correction effort sits with developers or data users.

To-Be

The application turns defect findings or query requests into a checked artifact: it parses the relevant code or retrieves the relevant table context, asks an LLM for a repair or SQL draft, runs validation where available, and routes the result to a human for approval or adjustment before use.

Human Checkpoints

  • Generated code repair is submitted as a pull request for developer review and approval. — Developer or code owner
  • Recommended tables are returned to the user for validation or alteration before SQL generation proceeds. — Data user or analyst

Systems Touched

Static analysis system such as SonarQubeSource code repository and Java codebaseBuild and test pipelinePull request and code review workflowLLM serviceQuerybook or SQL workbenchTable metadata storeVector search store such as OpenSearch

Business Cycle

Upstream

  • A source of defect findings or artifact context must already exist, such as SonarQube reports with file names and line numbers or table schemas from a metadata store.
  • The process needs executable quality gates for code changes, including successful builds, existing tests, and optional recheck with static analysis.
  • For query assistance, table summaries, historical queries, and embeddings must be available so the system can retrieve candidate tables.

Downstream

  • Developers receive a pull request containing the proposed repair instead of manually editing the leaky function from scratch.
  • The code change is checked against build, test, and static-analysis gates before review.
  • Data users see a streamed SQL response and can validate or alter the selected tables used to answer their question.
  • The repair workflow can continue running periodically to generate fixes for newly introduced resource leaks.

Value Evidence

  • Manual effort to repair Java resource leaksREDUCED
  • Developer productivity and code qualityIMPROVED
  • Defect backlog brought into automated validationIMPROVED

    To test FixrLeak, we applied it to 124 resource leaks identified by SonarQube in Uber's Java codebase.

  • Repair eligibility screening before code changeIMPROVED

    After excluding 12 cases in deprecated code, FixrLeak's AST-level analysis processed the remaining 112 leaks

Adoption Journey

  1. LEVEL 1 — QUICK WIN

    Gate: Prove value on one narrow defect class or query workflow where humans already know the expected review criteria.

    Outcome: A quick-win assistant drafts fixes or SQL for a controlled backlog while developers and analysts remain the decision makers.

  2. LEVEL 2 — STANDARD

    Gate: Prove value with production-grade validation gates and explicit human approval before any artifact is accepted.

    Outcome: The organization can use AI-generated repairs or queries in daily workflows without removing developer review or user validation.

  3. LEVEL 3 — ADVANCED

    Gate: Prove value across repeated runs, more repositories or data domains, and stable review throughput.

    Outcome: Defect validation becomes part of the normal software and analytics operating rhythm rather than a one-off remediation effort.

Detailed per-level builds in the solution spectrum below

Risk & Governance

  • AI-generated code changes could introduce regressions if accepted without checks.

    Posture: Run validation before pull request submission: verify the target binary builds, run existing tests, and optionally recheck with SonarQube before developer review.

  • Code ownership and accountability cannot be delegated entirely to the AI.

    Posture: Route each generated repair through a pull request, with developers responsible for review and approval.

  • Some detected leaks may be unsafe to repair automatically because the resource may be passed, returned, or stored elsewhere.

    Posture: Skip functions where the resource is passed as a parameter, returned, or stored in fields, and only apply fixes where the resource is confined to the function scope.

  • Generated SQL can be wrong if the wrong tables are selected.

    Posture: Use metadata retrieval and table-ranking, then return the top tables to the user for validation or alteration before proceeding.

Operating Intelligence

How it works

AI runs the first three steps autonomously.

Humans own every decision.

The system gets smarter each cycle.

Confidence86%
ArchetypeRecommend & Decide
Shape6-step converge
Human gates1
Autonomy
67%AI controls 4 of 6 steps

Who is in control at each step

Each column marks the operating owner for that step. AI-led actions sit above the divider, human decisions and feedback loops sit below it.

Loop shapeconverge

Step 1

Assemble Context

Step 2

Analyze

Step 3

Recommend

Step 4

Human Decision

Step 5

Execute

Step 6

Feedback

AI lead

Autonomous execution

1AI
2AI
3AI
5AI
gate

Human lead

Approval, override, feedback

4Human
6↺ Loop
AI-led step
Human-controlled step
Feedback loop
TL;DR

AI handles assembly, analysis, and execution. The human gate sits at the decision point. Every cycle refines future recommendations.

The Loop

6 steps

1 operating angles mapped

Operational Depth

Technologies

Technologies commonly used in Code and Query Defect Validation and Repair implementations:

Pull request workflowOther
4 mentions
SonarQubeOther
4 mentions
Tree-sitterOther
4 mentions
Build and test validationOther
3 mentions
OpenAI ChatGPT-4oOther
3 mentions
+1 more technologies(sign up to see all)

Key Players

Companies actively working on Code and Query Defect Validation and Repair solutions:

InferFixRLFixer

Real-World Use Cases

FixrLeak automated Java resource leak repair

FixrLeak finds Java code that forgets to close files, streams, or database connections, asks an AI model to rewrite the risky function safely, then opens a pull request for developers to review.

AI-assisted code repair with static-analysis-guided context extraction and guarded autonomous pull request generation.deployed internally at uber and running periodically on the java codebase; currently scoped to resource lifetimes confined to a single function.
10.0

Proposed LLM-Assisted SQL Query Validation

After the AI writes SQL, another validation step would check whether the query is likely to run correctly before the user receives it.

AI-assisted code validation and constrained generationproposed next-step enhancement, not yet implemented in the described system.
10.0

Free access to this report