RepoDoctor runs an unfamiliar repo in a throwaway sandbox, reads the real errors, and asks GPT-6 Astra for the smallest safe fix. A policy gate decides. It retries the command that failed, then ships a Dockerfile only after a fresh image passes.