Submission type
UiPath for Coding Agents
Name
Nick Sudh
Industry category in which use case would best fit in (Select up to 2 industries)
Compliance
Information technology and services
Complexity level
Advanced
Summary (abstract)
AURORA - Autonomous UiPath RPA Operations & Reasoning Agency - is a 19-agent coding-agent swarm that runs an entire UiPath Center of Excellence end-to-end. Three concurrent fleets (Discovery, Build, Operate) coordinated by a Conductor build, test, deploy, monitor, and self-heal automations - with the human approving exactly two things along the way. The demo target is an Open-Source Supply-Chain Defender: a Maestro process that monitors a GitHub organization’s dependency lockfiles against NVD/OSV/Advisory feeds, triages findings against a DMN severity matrix, and ships patches with HITL gates. Every UiPath product that matters collaborates in a single process. Built end-to-end with Claude Code!
Detailed problem statement
Every enterprise UiPath automation today needs a small army to ship: a business analyst to spot the friction, a solution architect to pick the pattern, an RPA developer for XAML, a backend developer for coded automations, a UI specialist for selectors, a QA engineer for test cases, a peer reviewer to enforce REFramework discipline, an SRE for the 3am page on a broken bot, a governance officer to track drift and licenses, and a program manager to consolidate near-duplicates. The talent is expensive, the cycle time is months per automation, and the operating cost only grows as the fleet grows.
At the same time, the supply-chain risk surface (Log4Shell 2021, xz-utils 2024) is unowned in most enterprises’ public repos - there’s no team chartered to scan lockfiles against NVD/OSV/Scorecard, triage by severity, and ship patches with appropriate human review.
AURORA tackles both problems at once: it models the entire CoE as software, and exercises that software on a real CTO-level problem (supply-chain defense) so the architecture is grounded in a meaningful use case rather than a toy demo.
Detailed solution
AURORA is a 19-agent swarm structured into three concurrent fleets plus a Conductor:
• Discovery fleet (5): Scout reads configured friction-signal sources (Slack/Jira/email fixtures). Curator deduplicates. Analyst writes a PDD with calibrated ambiguity scoring. Interviewer asks sharp questions via Action Center when ambiguity is high. Strategist runs quarterly consolidation/deprecation reviews.
• Build fleet (8): Architect picks the UiPath pattern (Sequence / REFramework / Coded Workflow / Coded Agent / Maestro / Action Center / API Workflow / Document Understanding) and writes an ADR. Cartographer captures strict selectors. Four Forgers - forger-rpa (XAML), forger-coded (C#), forger-agent (Python LangGraph / OpenAI Agents SDK), forger-maestro (BPMN 2.0 + DMN) - run in parallel git worktrees. Reviewer enforces REFramework discipline. Tester links test cases to Test Manager via the Select-Automation flow.
• Operate fleet (5): Sentry polls Orchestrator via the UiPath-python SDK and emits structured events. Diagnostician fingerprints failures into stable clusters. Surgeon opens self-healing PRs (and rotates Orchestrator assets directly when the cluster’s prior remediation is known). Auditor checks drift and license utilization. Concierge bridges all HITL flow to UiPath Action Center.
• Conductor (meta): schedules, enforces five HITL gates declared in policy.yaml, runs the nightly compost step.
Two distinctive patterns:
-
POLICY AS CODE. The user writes policy.yaml (gates, scoring weights, model routing, fleet enable/disable). It is schema-validated, CI-friendly, and live-probed against the real tenant (Orchestrator +
GitHub + Action Center catalog reachability). -
SELF-EVOLVING SKILLS via the nightly compost step. Every agent writes one-line learnings as it works. The Conductor’s compost step reads the day’s learnings JSONL, filters for ≥3 occurrences across ≥2
projects with consistent rationale, and opens a real GitHub PR (gh pr create --draft) against the swarm’s own skills//SKILL.md files. HITL-gated, never auto-merged. The skills get measurably better
with use, under human supervision.
UiPath integration is broad and deep - every UiPath surface that matters is exercised in the demo target’s single Maestro process. RPA XAML for the license-drift check. Six Coded Workflows in C# (Octokit-backed) for the GitHub integration paths. Two Coded Agents in Python (one LangGraph for vuln lookup, one OpenAI Agents SDK for maintainer health). Action Center Form Tasks for HITL approvals. Test Manager linkage via the documented Select-Automation flow. Live-verified end-to-end: the 5-stage Surgeon self-heal flow rotates a real Orchestrator Credential asset (GITHUB_TOKEN) against the live tenant in under 4 seconds.
Built end-to-end with Claude Code (claude-opus-4-7 for high-stakes architecture/review, claude-sonnet-4-6 for mid-stakes Build agents, claude-haiku-4-5 for continuous Operate daemons).
Narrated video link (sample: https://bit.ly/4pvuNEL)
Expected impact of this automation
At enterprise scale, a CoE shipping ~30 automations a year typically spends 6-8 specialist FTEs (BA + architect + 2 RPA devs + UI specialist + QA + reviewer + on-call). AURORA targets meaningful leverage on every one of those roles:
• CYCLE TIME: 60-80% reduction per automation. From-Slack-to-deployed shrinks from weeks to hours, because Discovery, Build, and Operate are concurrent loops rather than sequential phases. The Forger sub-fleet’s parallel worktrees ship 4 forgers’ worth of artifacts in one window.
• OPERATIONS COST: continuous Surgeon self-heal eliminates the 3am page for known fingerprint clusters. The F5 receipt rotates a real Credential asset in 4 seconds - no human input, no escalation. Estimated 40-60% reduction in P2 incidents touched by SRE.
• GOVERNANCE: every risky action routes through one of five declarative HITL gates (prod_publish, emergency_patch, deprecation, large_fix, skill_compost_pr). Auditability is built-in via Action Center; nothing bypasses policy.yaml.
• COMPLIANCE: the Defender demo target gives every CTO a working answer to “do we have unowned supply-chain risk?”. Continuous lockfile scanning against NVD/OSV/Advisory + DMN-driven severity routing + HITL emergency approvals.
• PORTFOLIO HYGIENE: Strategist’s quarterly retrospective + Auditor’s drift checks surface consolidation and deprecation candidates the swarm would otherwise let drift forever.
• PLATFORM LEARNING: the compost step turns operational experience into versioned skill improvements that compound across the fleet. The skills the swarm uses tomorrow are better than the ones it used yesterday - under human supervision.
UiPath products used (select up to 4 items)
UiPath Action Center
UiPath Coded Agents
UiPath Maestro
UiPath Orchestrator
Automation Applications
GitHub (Octokit-backed Coded Workflows for repo enumeration, lockfile resolution, PR open/comment, label apply). Slack (Discovery fixture source for friction signals). NVD (National Vulnerability Database — public REST). OSV (Open Source Vulnerabilities — public REST). GitHub Advisory Database. OpenSSF Scorecard. ClearlyDefined.io (license metadata).
Integration with external technologies
Claude (Anthropic) via Claude Code subscription OAuth - no API key. OpenAI Agents SDK (for the MaintainerHealth Coded Agent). LangGraph (for the VulnLookup Coded Agent). FastAPI (the GitHub check_run.completed webhook bridging back into Maestro via correlation message). Cloudflare Tunnel (public webhook ingress). Octokit (.NET GitHub SDK in the Coded Workflows). uv (Python package manager). MIT-licensed open source.
TO-BE workflow/architecture diagram (file size up to 4 MB)
Other resources
Includes: 19 agent definitions under agents/, 10 custom AURORA skills under skills/ (on top of all 7 official UiPath skills), the OSS Supply-Chain Defender demo target under examples/oss-supply-chain-defender/ (BPMN + bindings.json + 6 Coded Workflows + 2 Coded Agents + 1 XAML), full test suite (100 unit + 6 xUnit + 5 live-tenant integration), policy.yaml (declarative gates and scoring), and a complete demo runbook in docs/demo-recording-plan.md.