Project Patchwerk: orchestrating AI agents at scale
How we started orchestrating existing coding agents to clear technical debt, patch vulnerabilities and review code across thousands of repositories — without building a model of our own.
The AI Powered Engineering team built Patchwerk — publicly, Project Coral — to do something deliberately unglamorous: find issues across the bank's codebases using the tools we already run, and orchestrate existing coding agents to fix them. Technical debt, security patches, missing tests, reviews. The point was never a clever model. It was getting proven agents to do real work, at scale, inside a bank.
Orchestrate, don't build
The decision that mattered most came first: we didn't build a proprietary model or a bespoke agent. We orchestrated the ones that already exist — old and new, whichever suited the job — so we could swap them as the landscape moved, which it does, monthly. The value isn't in the model. It's in the orchestration around it: the context we feed it, the workflow we wrap it in, and the controls we hold it to.
One inbox for every issue
Issues live in a dozen places, so the first real problem was bringing them into one. Patchwerk pulls code-quality issues from SonarQube and vulnerabilities from Snyk — with logs, bugs and coverage gaps to follow — and syncs them into GitHub Issues, where engineers already work, each with its location, its detail, and an audit trail. Before any agent does anything, the issue is captured, prioritised and accounted for. Unglamorous, and the foundation everything else stands on.
CBA-flavoured workflows, and a crew of agents
On top of that we built workflows around the way we actually plan, code, test and review, and a set of specialised agents to run them — each with one job and the authority for that job alone.
Not one clever agent — a crew of narrow ones, each with a defined job and the authority for that job alone.
Takes code-quality issues from SonarQube, learns the architecture patterns of the repo it's working in, and generates targeted fixes that improve maintainability without changing behaviour.
House knowledge, on tap
A general coding agent doesn't know our standards, our libraries, or the way we do things here. So our agents draw on the same MCP server our engineers already use — the CBA Engineering Bot — for that house context. It's the difference between code that merely compiles and code that looks like it belongs in the repo it landed in.
Built to move
The other deliberate choice was to make Patchwerk fast to change. New agent types and workflows can be prototyped, deployed and tested quickly, and the same system runs on a laptop or in the cloud. In a field that resets every few months, being able to try a new agent on Monday and have it in the flow by Friday is worth more than any single agent we could have perfected.
That was the start. A year on, the numbers got large and the lessons got sharper — what scaled, what broke, and why trust turned out to matter more than capability. That's the follow-up.
Adapted from the original Project Coral post on the CommBank Technology blog. Opinions are our own, not the Group's.