RigelProductAutopilot
Rigel Autopilot
Rigel supervises every pull request its agents open. It fixes what it can within a cap, merges only when the gates pass, and explains every green PR it holds.
Rigel merges only inside your branch protection. Major upgrades, CI paths and PRs titled [needs-review] always wait for a person. GitHub today.
CI is green, but this PR was not auto-merged.
A human needs to review and merge this PR.
PR Supervisor
A dependency bump, a docs refresh and a bug fix carry different risks. The supervisor knows which of Rigel's flows opened each PR and applies that origin's gates.
Slack thread root posted.
First check after 5 min, up to 45 min.
Up to 4 iterations.
Waits for a real re-review submission.
By origin: semver, path, brake.
Merge, or hold with a reason.
Supervisor log · PR #318
# fix: skip invoices for paused members · origin=bug-triage · head=a7c91e2 t+0:00 event=pr/opened-by-agent pr=318 origin=bug-triage · idempotency=head_sha · slack.root=posted t+0:05 step=wait-ci attempt=1 checks=0/2 → poll 90s t+0:09 step=wait-ci checks=1/2 failure invoice.spec.ts › skips paused (2) t+0:09 step=dispatch-fixer agent=pr-fixer iteration=1/4 budget=$1.00 sandbox=fresh t+0:14 pr-fixer pushed a7c91e2→c41f0aa "handle null paused_until" · .github/** untouched t+0:22 step=wait-ci head=c41f0aa checks=2/2 success t+0:22 step=await-review requested=copilot poll=60s cap=300s t+0:25 copilot review.submitted threads=1 "add a test for the resume date" t+0:25 step=dispatch-fixer agent=pr-fixer iteration=2/4 target=review-threads t+0:29 pr-fixer pushed 3be0d41 · replied + resolved 1/1 threads t+0:33 copilot review.submitted commit=3be0d41 threads=0 · fresh review on head t+0:33 policy=bug-triage · fixer loop + fresh review · pass · auto-merge=never t+0:33 step=decide title∌[needs-review] · pr.state=open · human_merged=false t+0:34 decision=ready · bug-triage PRs never auto-merge · slack=thread updated · a human merges
Illustration · replay of PRs opened by Rigel's own agents · timings compressed
Checks before a decision
decision=ready · a human merges
| Origin | Pull request · Illustration | Gates for this origin | Outcome |
|---|---|---|---|
| Dependency Upgrade Advisor Patch bump |
orders-api #431 chore(deps): bump zod 3.23.7 → 3.23.8 package.json · package-lock.json |
✓ Not a draft · ✓ CI exists and is green · ✓ Semver gate (patch, re-derived from the manifest diff) · ✓ Path gate (manifests and lockfiles only) | ✓ On course · merged |
| Dependency Upgrade Advisor External major |
web-app #219 chore(deps): bump react-router-dom 6.28.0 → 7.1.1 package.json · package-lock.json |
✓ Not a draft · ✓ CI exists and is green · ✗ Semver gate (external major: held for a human) · ✓ Path gate | Off course · held |
| Living Docs refresh Docs refresh |
orders-api #440 docs: refresh living docs (main) generated doc paths only |
✓ Not a draft · – PR Fixer (no fixer for docs) · – Review round-trip (not needed for docs) · ✓ Docs paths only (Repo Guard enforces it, if installed) · ✓ CI green, or no CI in repo (a real CI failure goes to a human) | ✓ On course · merged |
| Jira bug triage Bug-triage fix |
orders-api #445 fix(orders): handle a null shipping address src/orders/address.ts · 2 files |
✓ Not a draft · ✓ CI exists (on a time budget) · ✓ PR Fixer (iteration 1 of 4 fixed a failing test) · ✓ Copilot re-review (requested and waited for on the new head) · ✓ Review threads resolved | ◎ Ready · a human merges |
By default: Rigel doesn't add its own human-approval step, so your branch protection decides. Agents run in a sandbox with permission prompts off; the tool allowlist is the boundary. Major upgrades, CI paths and [needs-review] PRs always wait for a person. The optional "auto-merge on green" for dependency advisors skips the semver and path gates. Leave it off unless you mean it. See every default →
Code-change auto-merge needs GitHub Copilot code review in your GitHub org, a separate GitHub licence. Without it, those PRs wait for a person. Dependency and docs PRs don't need it. Pluggable reviewer (any required GitHub review): Coming soon.
[major].Playbooks
Playbooks are governed agent templates your operators switch on without writing code. Watch one work.
Dependency upgrade · sandbox · orders-api · Illustration
✓ read Dependabot alerts 7 alerts + deep-analysis docs, code graph, release notes ✓ knip · find unused deps, safe to delete 2 removed ✓ npm audit fix · in-range transitive patches 3 fixed ✓ bump direct deps · alerts on what you import 2 bumped ✓ add overrides · for stubborn nested deps 1 override ✓ npx tsc --noEmit · type-check gate pass › commit, push, open one PR · with risk reasoning → supervisor
Library publish Beta · Illustration
@your-org/lib-logger 2.4.0 published consumers found across every onboarded repo, nested manifests included orders-api PR opened bump · lockfile · typecheck and tests · CHANGELOG fixes billing / billing-worker PR opened services/billing-worker/package.json fulfillment PR opened bump · lockfile · typecheck and tests One PR per consumer, each through the supervisor. Illustration.
The sandbox the advisor runs in
Package managers, knip, git, node and read-only Unix tools. No bash, curl or sudo.
Commands run directly, so pipes, redirects and substitution aren't interpreted.
16 KB output cap, 5-minute per-command cap, 200 commands per sandbox.
.github/** is off limitsRefused at write time, at push time and by a pre-push hook.
A guard-railed workspace on a fresh clone, not a hermetic one: it runs with the server's environment.
| Playbook | What it does | Trigger | Scope |
|---|---|---|---|
| Dependency Upgrade Advisor | Reasons over Dependabot alerts, upgrades in a sandbox, opens one PR | Schedule or on demand | npm ecosystem on GitHub Coming soon Maven/Gradle, pip/Poetry, Go modules |
| Lib Version Bump Advisor | When an internal library publishes, opens an upgrade PR in every consumer repo | On package publish | Beta |
| Jira Bug Triage | Investigates new bugs and opens a fix PR when investigators agree | Jira webhook | Jira Cloud |
| Documentation Drift Check | Diffs the live API surface against the stored OpenAPI spec | Schedule or on demand | Any onboarded repo |
| Daily Deploy Risk Digest | Grades yesterday's merges across a constellation for blast radius | Schedule, e.g. weekdays 08:00 | Needs a GitHub MCP server |
| Chart Health | Flags stale snapshots, missing READMEs and absent OpenAPI specs | Schedule or on demand | Any onboarded repo |
| Release Analyzer | Builds the CAB pack from production vs staging | On demand | AWS release pipelines |
| Staging Alarm Triage | Walks alarms, correlates them with the code graph, proposes a root cause | On demand, or every 5–15 min | AWS |
| Workflow failure triage | Triages failed workflows and gates a fixer PR | Polling | Temporal · Beta |
Jira bug triage
Two read-only investigators work in parallel, reading the chart and the code. A deterministic rule decides whether a fixer writes code.
Screenshot attached.
Read-only · chart + code. Two independent reads.
3 checks: both recommend a fix, agree on the repo, average clears the threshold.
Either way, Rigel posts one Jira comment.
Supervisor: CI + fixer loop. Then → a human merges.
No PR.
Confidence is each investigator's own estimate. It's model-reported, not calibrated. A fix PR opens only if both investigators recommend a fix, agree on the repo and their average clears your threshold (default 0.7). Bug-triage PRs never auto-merge.
Root cause, repo, confidence and the PR link. The fix PR opens ready for review by default, or as a draft. A Slack thread tracks it, and bug-triage PRs never auto-merge.
For production-support teams, triage can skip the fixer. A writer, critic and reviser produce a support write-up and post it to the ticket. No PR is opened.
Flight Log
A Tuesday in the Flight Log: two dependency PRs. One passes the gates and merges. One is held and waits for a person, who knows exactly why.
#platform-agents · in your Slack · Illustration
One thread per PR. One global channel or per-playbook overrides, filtered by event or PR origin. One Slack workspace per deployment.
@rigel keep the old endpoint for one release and mark it deprecated
Rigel 👀 On it. Running the fixer on 3f9c2e1…
✓ Pushed a7d40b9: restored GET /v1/orders/{id} with a deprecation header. Handing back to the supervisor.
On PRs Rigel opened. Org members only, up to 5 mentions per PR in 24 hours. The supervisor waits for review on the new head.
Installed by a person in each repo (template and rollout script provided), because agents can't push to .github/**. Humans are never blocked. Check names illustrative.
Build your own
Rigel drafts the workflow from a chat, you test it without touching production, then it runs on a budget.
v1 limit: wait steps can't sit inside fan-out regions.
A chat that asks before it builds: identity, prompt, tools, data scope, budget, goal caps, success criteria and MCP servers.
Test it in the panel and check the readiness strip before you ship it.
Expose an agent over the open Agent-to-Agent protocol, so other teams' agents can ask it questions under clear rules.
kb-only, readonly-mcp, or a self-hosted host next to a sensitive databasePeer authentication uses shared secrets today.
Accountability
Autonomy you can explain to an auditor, because every limit is in code and every outcome leaves a trace.
Every agent run has a USD budget and a turn cap. Fix loops stop at 4 iterations, in code.
Built-in edit, write, shell, web and sub-agent tools are banned for every playbook.
An agent gets only what its template declares and the operator allows.
Trigger, status, cost, tokens, tool calls, findings and deliveries.
A decision comment that names the gate. A Slack alert with the reason.
Every admin read across users is recorded.
Replace any prompt, or add a repo-scoped supplement, from Settings.
One unified, exportable trail.
Next · Security review
Rigel MCP: give your own coding agents the chart, read-only.
What ships today →Shipped, Beta and Coming soon, feature by feature.
Security review →Every default: sandbox, gates, fail-closed critics.
Book a technical walkthrough →Bring one repo. We'll show which PRs would merge and which would wait.
Bring one repo. We'll show which of its PRs would merge, and which would wait.