Operations
Current limits
What the MVP deliberately supports—and where it stops.
Supported
- npm package version discovery
- Registry-aware public npm opportunity discovery for up to 40 root dependencies per inspection
- Hosted npm watch for enrolled pilot repos (queues operator review; does not auto-launch)
- GitHub repositories, pull requests, labels, comments, and Checks
- Cursor cloud migration agents
- Node-oriented automatic local setup plus custom setup commands
- Concurrent migrations in one process, with state writes serialized by a mutex and an advisory lock file
- Diff-scope policy on agent pull requests, including a default ban on editing CI definitions
Not yet supported
- Python, Go, Java, or other registry watchers
- Private registry version discovery or private registry credentials
- GitLab or Bitbucket
- Unattended multi-tenant auto-launch from registry watches
- Automatic merge
- Guaranteed structured API diffs for arbitrary npm packages
- Self-service billing, dashboards, SSO, and organization-wide audit export
- A generally available PatchFlow-hosted execution sandbox for customer test code
Design rule
Important
When PatchFlow lacks structured evidence, it says inferred. When setup fails, the gate fails. When a required check is missing, the gate waits and fails. Uncertainty should stay visible.