Keply

Overview

Dependabot and Renovate bump a version number. Neither fixes the code that the bump breaks, which is the part that costs hours: read the changelog, find the break, write the fix, iterate until the suite is green. Keply does that pass. It reads the changelog and the failing tests, writes the fix, runs the repository's own suite, and iterates until it is green - or until it can show that it cannot be. The difference that matters is not that an agent writes a fix. It is that this one will not open a pull request it cannot stand behind: five verification gates sit between the agent and the PR, and any one of them tripping routes the job to an honest needs_human carrying the diagnosis, rather than to a green that is not real.

Engineering highlights

• Five trust gates a general-purpose coding agent does not have: test files are read-only, configs cannot be materially weakened, the upgraded dependency cannot be silently reverted, a runtime loadability verifier runs after every green suite, and front-end apps get a headless browser smoke test
• 86% safe with zero false-greens across seven real repositories on Node 20 LTS - the trust layer is a measured result, not an aspiration
• The agent never gets a raw shell; it emits a structured submit_fix of analysis, edits and installs that the host applies through validated guards
• No ambient credentials in the sandbox - the model call and its key stay host-side, and every in-VM exec asserts the environment carries no worker secret
• A push to a default or protected branch is impossible by construction: the bot-branch assertion is the first line of every mutating method, and no merge code path exists anywhere in the interface
• Runs each upgrade in a per-job ephemeral microVM with lifecycle scripts disabled by default, at a measured $0.07-$2.53 per upgrade