How Patchline works

1 · Detect: normalize what providers publish

• sources

  Three artifact types per provider

  Published changelogs (parsed entry by entry), OpenAPI specification snapshots (structurally diffed — removals, type changes, newly-required fields, narrowed enums), and SDK release feeds. Stripe, OpenAI, and Anthropic today.

• classify

  Breaking, behavioral, or additive

  Rule-based classification: anything that removes or restricts an existing contract is breaking; changed defaults and semantics are behavioral; new surface is additive. Every event keeps a link to its upstream evidence.

• dedup

  One event, once

  Events are content-hashed on provider, source, surface, title, and classification — a re-announced or re-ingested change collapses into the event that already exists. Our frozen corpus holds 1,070 unique events; see the research article for what's in it.

2 · Match: compute your blast radius

• index

  Binding-aware call-site indexing

  Your repo's tarball is extracted to a temporary directory, scanned for provider dependencies (npm and PyPI manifests), and statically indexed: TypeScript via the compiler's own bindings, Python via tree-sitter. The working copy is deleted when indexing finishes — only the index is stored, never your source.

• score

  Confidence, tiered by evidence

  An exact endpoint match between a spec-diff event and a call site scores 0.95. Token overlap between surfaces lands 0.6–0.9. An SDK release for an ecosystem you use is 0.5; merely depending on the provider floors at 0.2. Reports sort severity first, so a 0.9 breaking change outranks a 0.95 behavioral one.

Anatomy of a report

Reports are delivered as labeled GitHub issues on the affected repo. This is the actual output of our golden-fixture test (abridged) — the same renderer that produces customer reports:

# Patchline blast-radius report

**Repo:** fixtures/consumer-repos/ts-app
**Scanned:** 2026-08-01T12:00:00.000Z

## Tracked dependencies

| Provider  | Package            | Version | Declared in  |
| stripe    | stripe             | 16.8.0  | package.json |
| openai    | openai             | 4.104.3 | package.json |
| anthropic | @anthropic-ai/sdk  | 0.62.1  | package.json |

## Applicable changes (1 breaking, 1 behavioral, 1 additive)

### ✖ breaking stripe — POST /v1/payment_intents: 3 spec changes (2 breaking)

Confidence 0.90 — surface 'POST /v1/payment_intents' matches 1 call site.
Upstream evidence: stripe/openapi spec3.json

| Call site         | Surface               |
| src/billing.ts:6  | paymentIntents.create |

### + additive anthropic — anthropic-sdk-typescript v0.63.0

Confidence 0.50 — repo uses the anthropic TypeScript SDK (0.62.1).
…

Every claim in a report is traceable: the classification links its upstream evidence, each match names its call site as file:line plus the API surface, and the confidence line states why the score is what it is. File paths and line numbers only — never your code.

3 · Patch: the opt-in migration agent

• generate

  The minimal diff

  For repos that explicitly opt in, the agent drafts the smallest code change that satisfies the upstream change, scoped to the affected call sites.

• validate

  Your tests, in a sealed room

  The patch is applied to a working copy and your own test suite runs against it in a network-isolated sandbox. Two hard gates: the patch must apply cleanly and the tests must pass. Fail either, and the PR is downgraded to a migration report — whatever the confidence score says.

• deliver

  A PR with provenance, never auto-merged

  The pull request carries the upstream evidence, the affected call sites, the validation output, and the confidence math. You review and merge it like any teammate's PR — auto-merge does not exist in Patchline, by hard rule.

Onboarding: ten minutes, two decisions

Install the Patchline GitHub App, choose only select repositories, and pick the repos with external API usage — indexing starts automatically, and reports arrive when a relevant upstream change lands. Optionally, add a Slack incoming webhook for a periodic digest (quiet weeks send nothing). The migration agent stays off until you opt a repository in.