How it works
From package.json to a pull request you can trust — and an honest list of what each check does not prove.
1Scanner
Reads package.json and picks the upgrade path (one of 8 supported pairs). Same code as the free check.
2Agent in a sandbox
An AI coding agent clones your repo into an isolated sandbox with limited network access (package registries and GitHub only) and performs the upgrade. It never gets a GitHub token that can push.
3L1
Technical checks in the sandbox plus a deterministic integrity gate.
4L2
An independent review of the diff by a model in a fresh context.
5Pull request
Our backend opens the PR in your repo. You review it, your CI runs, you decide.
Three levels of verification
We call a PR safe to merge only after L1 + L2 + green CI in your repo. We never auto-merge. Merging is always your decision.
Technical verification in the sandbox
- Proves
- Build, tests, type check, lint and starting the app, before and after the change. Plus a deterministic integrity gate that flags shortcuts: deleted, skipped or weakened tests, lint rules switched off or downgraded, new lint-disable comments or type-check suppressions.
- Does not prove
- Behaviour that your tests do not cover.
Semantic verification
- Proves
- A separate model reviews the full diff in a fresh context, without the agent's reasoning, and lists behaviour changes and risks in the PR description.
- Does not prove
- Bugs that only show up in production (real traffic, real data, real configuration).
Your environment
- Proves
- Your own CI on the open pull request, and review by a person on your side.
- Does not prove
- We promise nothing beyond what your CI and your reviewer check.
30-day regression guarantee
A regression is either:
- a test that passed on the PR's base before the change and fails after it, in code changed by the PR, on an unchanged base; or
- a runtime error in a code path changed by the PR, reproducible in our sandbox on the merge commit.
Not covered: your changes after the merge, other dependencies updated independently, configuration outside the repo, errors that only appear under production load.
Process: report it within 30 days of the merge with a link to the commit and a log → we reproduce it in the sandbox within 24 hours → a free fix (a priority fix job) or a refund of the job price within 5 business days. When in doubt, we decide in your favour, up to the job fee.
The guarantee covers regressions detectable at L1 level on an unchanged base. It is not a guarantee of production security.
Recent verified PRs
Opened by our pipeline in public open-source repositories after L1 + L2 verification. Merging is always the maintainer's call.