Agents in CI that fix what an update broke

Why updates are late

Keeping dependencies current is easy to automate until an update breaks the build. Then the pull request sits red, someone has to read the changelog and adapt the code, and the fixes for real vulnerabilities wait behind it. Most teams end up months behind, and an advisory finds them there.

A steady flow of updates

Renovate keeps a few living pull requests per repository, grouped by kind: security fixes, major versions, everything else, and lockfile upkeep. Only security fixes merge themselves, and only where tests and a vulnerability scan pass first. Everything else waits for a person.

An agent where the build failed

When an update breaks the build or the tests, an agent starts inside that same CI run. It sees the failure, adapts the code to the new version, checks the step that failed, and proposes the change on the pull request with a report: the cause, what changed, what it verified, and what a person still has to decide.

Guarantees that do not depend on the model

• A sandbox with nowhere to go. The agent has no network, no write access to the repository and no model credential of its own.
• No keys to steal. Access to the model is bound to the identity of one workflow; nothing is stored or rotated.
• Only code, never the rules. Its change is checked before it lands: it may not touch CI, dependency manifests, build files or the agents' own instructions, may not add or delete files, and may not switch off a test or a lint rule.
• A fixed number of attempts, then a person. A pull request an agent touched is never merged automatically.
• Signed and attributable. Every change is a signed commit by a separate identity, with its report next to it.

It knows your product

The CI agents start from what the operations agents have learned about your system: its services, conventions, past incidents and the lessons drawn from them. They read that knowledge and cannot change it. What fails in CI becomes material for the operations agents to learn from. That is why it is one product, not two.