Privacy-Focused Agentic AI Workflow with Locally Deployable Language Models for Technical Debt Remediation in Software Systems
620.35 KB
avoin
Julkaisu on tekijänoikeussäännösten alainen. Teosta voi lukea ja tulostaa henkilökohtaista käyttöä varten. Käyttö kaupallisiin tarkoituksiin on kielletty.
Lataukset1
Pysyvä osoite
Verkkojulkaisu
DOI
Tiivistelmä
Recent advances in large language models, particularly within agentic frameworks for software development and maintenance, have made it possible to work through a backlog of technical debt. However, the frontier models that can do this are third-party cloud services, which carry recurring API costs and raise concerns over data privacy and intellectual property. For organizations that are bounded by these constraints, alternative solutions are needed.
This thesis explores that alternative by designing, building and evaluating a privacy-focused multi-agent pipeline that remediates static analysis findings entirely on a locally served open-weight model. Following Design Science Research, the artifact integrates SonarQube for detection, tree-sitter for language-aware code editing, Git and the GitHub API for version control and Ollama for serving a relatively small Qwen3.5-27B language model. It delivers its fixes as a conventional, reviewable pull request. To test its capabilities, it is evaluated on a stratified sample of 100 newly found SonarQube issues from Mermaid.js, a large-scale open-source project, using a three-layer evaluation that combines the pipeline’s own verdict, an independent LLM-as-judge and a post-remediation static analysis scan.
Together, these layers report a true remediation rate of 53%, rising to 57% once correctly assessed false positives are included. However, its changes were not always clean as it introduced new issues in 25% of the files it touched. The entire run used under half the memory of a single H100 NVL GPU, with each issue taking around seven to eight minutes to process.
Even though the system remains behind cloud frontier models on raw capability and remediation rate, recovering more than half of the flagged debt from a large-scale mainstream codebase with a comparatively small model is notable in itself. It shows that local open-weight remediation is a viable alternative on cost, data privacy and workflow fit, and can serve as an automated backlog-clearance tool, provided a human remains the final decision-maker on its output.