Overview

Helix Patch is a Surface App (com.helix.patch) for vulnerability scanning and remediation.

Roles

Layer	Role
helix-ee	Brain per session — reason, edit, call Patch tools/gates
Helix Patch	Actioner — Trivy, campaign state, bump/PR, verify + actions HTTP
IO	Calendar per session — create/start helix-ee, await-async
Platform	Shell — iframe, Log Center, notification cards

Domain Trivy and product tools stay in Patch — not in the HEE image.

HEE bridge

Patch injects both bindings on IO → helix-ee create:

• Remote verifiers — phase gates (POST /v1/hee/verify)
• Remote actions — tools the brain can call (POST /v1/hee/actions)

Full explanation: Actions and verifiers.