Hunt: The 15-Agent Debugging Pipeline That Makes AI Code Production-Ready

The biggest criticism of AI-generated code is that it is junior-level work. Syntactically correct but riddled with edge cases nobody tested, responsive layouts that break on real devices, security holes that would make a penetration tester weep, and console errors that pile up silently until someone notices the entire checkout flow is broken.

That criticism is valid. Most AI-generated code IS junior-level. Not because the AI models are incapable, but because nobody built the quality assurance layer that a senior engineering team provides.

We did.

Hunt is our fully autonomous debugging pipeline. One command that crawls your entire application, spawns 15 parallel hunter agents to analyze every line of code, tests every interactive element in a real browser across 9 responsive breakpoints, runs active security payloads against every form and endpoint, auto-fixes every issue it finds, verifies the fixes actually work, and delivers a binary GO/NO-GO production verdict.

It is the system that turns AI-generated code from a prototype into production software.

---

Why This Exists

When you run 267 AI agents that produce code across dozens of projects simultaneously, you face a quality problem that no human QA team can solve at that velocity. Code ships fast. Bugs ship faster.

We tried the obvious approaches first. Linting. Type checking. Unit tests. They catch the easy stuff. They miss the stuff that actually breaks in production: the form that works on desktop but overlaps on a 375-pixel phone screen. The button that fires correctly once but creates a duplicate submission on double-click. The API endpoint that returns the right data but leaks a stack trace in the error response. The authentication flow that works perfectly until someone opens it in two browser tabs simultaneously.

The gap between "the code compiles" and "the product works in production" is enormous. Hunt was built to close that gap completely.

---

The Architecture: 11 Steps, 30 Agents, One Verdict

Hunt is not a single tool. It is an 11-step pipeline that orchestrates up to 30 specialized agents, each focused on a specific category of problems that AI-generated code typically produces.

Step 0: Pre-flight

Before anything runs, Hunt registers itself with our Nerve system (the inter-agent communication backbone), detects the project stack by reading package.json and the directory structure, ensures the development server is running, and creates the working directory structure for screenshots, evidence, and reports.

If a Linear ticket ID is provided, Hunt ingests the ticket context: title, description, comments, and all attached screenshots. Those screenshots become the reference baseline. The system knows what the user reported as broken and will verify that specific issue is resolved.

Step 1: Crawl

Most QA tools require you to tell them what to test. Hunt discovers everything on its own.

It reads the route structure from the codebase (Next.js app directory, React Router configs, static HTML), fetches the sitemap and robots.txt, then navigates from the homepage following every internal link recursively up to 10 levels deep. For each discovered page, it catalogs every interactive element: buttons, forms, inputs, links, modals, dropdowns, toggles, tabs.

The output is a complete map of the application: every page, every element, every API endpoint. Nothing is assumed. Everything is discovered.

Step 2: Hunt -- 15 Parallel Code Agents

This is where the system earns its name. Fifteen specialized agents launch simultaneously, each analyzing the entire codebase from a different angle.

The Backend Hunter examines database schemas, authentication logic, and data integrity. It looks for race conditions, N+1 query patterns, missing validation, and authorization bypass opportunities.

The Frontend Hunter scans every page and component for dead buttons, broken forms, hardcoded test data, and missing loading or error states. The kind of issues that work fine during development but fail silently in production.

The API Hunter reviews every endpoint for missing error handling, incorrect HTTP status codes, CORS misconfigurations, and webhook implementation gaps. It checks whether error responses leak internal information.

The Flow Hunter traces complete user journeys end-to-end: signup to first value, purchase to confirmation, settings change to persistence. It tests what happens when users navigate backwards, refresh mid-flow, or open the same flow in multiple tabs.

The Component Hunter analyzes React components for undefined props, null reference crashes, memory leaks from uncleared intervals, stale closures in hooks, and missing key props in lists.

The Quality Hunter searches for type safety violations (any casts, ts-ignore directives), TODO comments left in production code, console.log statements, dead code, and unused dependencies.

The UX Hunter checks visual and design coherence: inconsistent spacing, color palette drift, misaligned components, typography hierarchy violations, dark mode gaps, and missing hover states.

The Architecture Hunter looks at the structural level: orphan pages not linked from navigation, dead routes, broken redirects, missing 404 handling, and route guard gaps.

The Security Hunter identifies XSS vectors, CSRF vulnerabilities, injection opportunities, exposed secrets in client bundles, and insecure HTTP headers.

The Performance Hunter finds unoptimized images, bundle bloat, render-blocking operations, missing pagination on large datasets, and lazy loading opportunities.

The Database Hunter checks for orphaned records, missing database indexes, incorrect cascade delete configurations, and schema drift between the ORM definition and the actual database.

The Dependency Hunter traces import graphs looking for circular dependencies, version conflicts between packages, and broken import paths.

The Accessibility Hunter audits WCAG 2.1 AA compliance: missing ARIA labels, insufficient color contrast ratios, keyboard navigation gaps, and focus management issues.

After the code agents finish, a Browser Tester and Mobile Tester take over, running the results through real browser automation to validate findings and discover interaction-level bugs that static analysis misses.

Every bug found is classified by severity (CRITICAL, HIGH, MEDIUM, LOW), categorized by domain, linked to the exact file and line number, and accompanied by a suggested fix.

Step 3: Browser -- Exhaustive Element Interaction

Using the sitemap from Step 1, Hunt navigates to every discovered page in a real browser and interacts with every element it found.

Every button gets clicked. Every form gets filled with valid data and submitted. Then filled with empty data and submitted again to verify validation. Every modal gets opened, every element inside it tested, then the modal gets closed and cleanup is verified. Every dropdown gets opened, every option selected. Every toggle gets toggled.

Beyond basic interaction, Hunt tests edge cases: double-clicking action buttons to check for duplicate submissions, using the browser back button to verify state restoration, refreshing the page mid-flow to check for data loss.

Console errors and network failures are captured per page. Before-screenshots are taken at desktop and mobile widths.

Step 4: Responsive -- 9 Breakpoints

Not three breakpoints. Not five. Nine.

320 pixels (iPhone SE). 375 pixels (iPhone 12 through 14). 425 pixels (large phones). 768 pixels (iPad portrait). 1024 pixels (iPad landscape). 1280 pixels (MacBook Air). 1440 pixels (standard monitor). 1920 pixels (Full HD). 2560 pixels (4K).

Every page gets screenshotted at every breakpoint. Hunt checks for horizontal overflow (the scrollbar that appears when content bleeds), text truncation hiding important content, overlapping elements from z-index or absolute positioning, touch targets smaller than 44 pixels on mobile, text smaller than 14 pixels on mobile, image distortion, sticky headers covering content, hamburger menu functionality, and table responsiveness.

Step 5: Security -- Active Payload Testing

Hunt does not just grep for potential vulnerabilities. It tests them.

Twenty-five XSS payloads injected into URL parameters, form fields, and search boxes: script tags, onerror handlers, SVG onload events, data URIs. SQL injection payloads against every input: UNION SELECT, time-based blind injection, NoSQL operators. CSRF token validation by attempting cross-origin form submissions. Authentication testing for session fixation, privilege escalation, expired token reuse, and brute force rate limiting.

HTTP header audit: Content Security Policy presence and strictness, X-Frame-Options, HSTS, X-Content-Type-Options, Permissions-Policy.

Secret scanning across the entire codebase: API keys, tokens, passwords, private keys, with specific checks for secrets leaked into client-side bundles.

Step 6: Diagnose

All results from steps 2 through 5 are compiled, deduplicated (the same issue found by multiple hunters gets merged into one entry), severity-ranked, and grouped by file for efficient fixing.

This step produces the report: a comprehensive document listing every issue with severity, category, file location, impact description, and suggested fix. The report is saved as both machine-readable JSON and human-readable Markdown.

Step 7: Plan

Hunt hands the report to the Keymaker planning agent, which creates a fix DAG (directed acyclic graph) with proper dependency ordering. Security fixes are always first. Build-breaking errors come second. Backend fixes precede frontend fixes when data model changes are involved. Component fixes precede page fixes when shared components are affected.

Step 8: Fix -- 9 Specialist Fixers

Nine fixer agents execute the plan. Each specializes in a domain: Backend, Frontend, API, Component, UX, Architecture, Security, Performance, and Quality.

Fixers operate in parallel when working on different files. When multiple fixers need to modify the same file, a four-tier conflict resolution system manages the coordination: different files run fully parallel, same file with different sections auto-merge, same file with overlapping lines serialize, and truly unresolvable conflicts escalate to the orchestrator.

Each fix goes through a CI reaction loop: after applying the fix, the system runs a build check. If the build fails, it logs the failure and retries with the error context included. Maximum three retries before escalating.

Step 9: Verify

Do not trust the fix. Verify it.

Full build check. Re-navigate all pages expecting zero console errors. Re-test all broken flows expecting them to pass. Re-check all 9 breakpoints, taking after-screenshots. Re-run security payloads expecting them to be blocked. Run a 10-point smoke test.

If any verification fails, Hunt routes back to the appropriate fixer, applies the fix, and verifies again. Maximum three regression loops before escalating with evidence.

Step 10: Verdict

Binary production readiness assessment.

Zero CRITICAL bugs remaining AND zero HIGH bugs remaining: GO. Any CRITICAL or HIGH remaining: NO-GO. More than five unfixed MEDIUM issues: CONDITIONAL. Incomplete page coverage: CONDITIONAL.

Step 11: Report and Notify

The final report includes the complete bug table with severity breakdown by category, browser testing coverage, responsive testing results with before/after screenshots, security audit results, fix application summary, verification results, and the production verdict.

The report is archived for trend analysis. A notification goes out via Telegram with the verdict summary.

---

What This Means for AI Code Quality

The "AI code is junior work" narrative exists because most AI coding workflows have no quality layer. The model generates code. Someone commits it. It ships. Nobody tested the responsive layout on a phone. Nobody ran security payloads against the forms. Nobody traced the user flow from signup to first value to see if the data actually persists.

Hunt exists because we run 267 AI agents producing code at a velocity that would overwhelm any human QA team. The agents are good at writing code. They are not good at testing their own code in the ways that matter for production. No single AI agent can simultaneously think about responsive breakpoints, security payloads, database schema integrity, accessibility compliance, and user flow edge cases.

So we built a system where each concern has its own specialized agent, they all run in parallel, and the results are compiled into a single actionable report that gets auto-fixed and auto-verified.

The result: every project we deliver has been through this pipeline. Every page tested on 9 breakpoints. Every form tested with security payloads. Every user flow traced end-to-end. Every fix verified independently.

That is what separates AI-generated code that works in production from AI-generated code that works in a demo.

---

The Variants

Hunt is the full pipeline, but focused variants exist for specific needs:

• hunt quick -- Steps 0 through 6 only. Hunt and report without fixing. For when you want the audit but will handle fixes yourself.
• hunt responsive -- Focused on the 9-breakpoint responsive testing. Every page, every breakpoint, screenshots and issues.
• hunt security -- The security payload testing pipeline in isolation. XSS, injection, CSRF, auth, headers, secrets.
• hunt performance -- Bundle analysis, image optimization audit, N+1 detection, lazy loading opportunities.
• hunt a11y -- WCAG 2.1 AA compliance audit.
• hunt flows -- Exhaustive user journey tracing with edge case testing.
• hunt console -- Chrome console and network error audit across all pages.
• hunt backend and hunt frontend -- Domain-focused subsets.

Each variant uses the same agent infrastructure. The difference is which steps and which hunters are activated.

---

Integration with the Ecosystem

Hunt does not operate in isolation. It is wired into the broader Agentik OS infrastructure:

• AISB Nerve tracks every Hunt session: agent registration, progress streaming, cost tracking, failure logging. The entire pipeline is observable in real time.
• Planner can trigger Hunt as a verification step after implementing a feature plan. Build, then verify. Automatically.
• Sentinel runs Hunt in continuous regression mode: scheduled hunts that catch issues introduced by ongoing development.
• Linear integration pulls ticket context (descriptions, screenshots, comments) and feeds it to the hunters as priority targets. After fixing, Hunt compares before/after screenshots against what the user reported.

---

The Numbers

A typical full Hunt run on a medium-sized Next.js application:

• Discovers 15 to 40 pages and 200 to 600 interactive elements
• Spawns 15 code analysis agents plus 2 browser testers simultaneously
• Tests 9 breakpoints across every page (135 to 360 responsive checks)
• Runs 25+ security payloads against every form and input
• Finds 30 to 120 issues across all categories
• Fixes 85 to 95 percent of issues automatically
• Completes in 15 to 45 minutes depending on application size
• Delivers a GO/NO-GO verdict backed by comprehensive evidence

---

Further Reading

• AI Super Brain: 12-Agent Orchestration System -- The brain that routes Hunt and every other pipeline
• Planner: Intelligent Execution System -- How we plan before we build
• Multi-Agent Orchestration Production Guide -- Scaling agent systems in production