HOLDPATCHCINCINNATI, OHIO · DRAFT PATCHES, HUMAN DEPLOYS
$49 per service / month
Sheet 01 · one incident, already handled up to the gate
The fix is ready. Waiting for Maya.
Holdpatch finds what broke and writes the smallest fix it can prove with tests. Then it stops: nothing ships until your named maintainer says so. Invented sample data; the decision works.
IncidentPOST /checkout returning 500 since 09:14 ET. 3.1% of orders, only when the coupon field is left blank.
Cause, in one lineA blank coupon arrives as an empty string, and applyCoupon() reads a property of the discount it never finds.
--- src/checkout/coupon.ts - const total = applyCoupon(cart, req.body.coupon); + const coupon = (req.body.coupon ?? "").trim(); + const total = coupon ? applyCoupon(cart, coupon) : cart.total;
Deal through the sheets below: how it got here, what stays Maya's, what access it needs, and the incident it refused to guess at.
Sheet 02 · evidence before opinion
Every patch arrives with its chain of evidence.
A maintainer should not have to take a diagnosis on faith. Each prepared fix links the failing event to the exact line it proposes to change, and the reproduction test is written before the fix, so the red-to-green run is part of what you approve.
In every evidence pack
- The failing event, with the request shape that triggers it.
- A reproduction test that fails before the patch and passes after.
- Blast radius: which routes and how many requests the change can touch.
What you will never get
- A patch with no reproduction. If it cannot fail on purpose, it is not prepared.
- A rewrite. Patches are capped small; anything bigger is filed as a proposal for a human.
- Confidence theater. Weak evidence is labeled weak, on sheet five.
Sheet 03 · the gate
Preparation is ours. The release decision stays yours.
Your maintainer decides
- Ship, send back, or kill it. Every prepared patch waits for a named person, never a timer.
- Canary size. Approvals deploy to 5% first by default; your team sets the ladder.
- Who may approve. Name one maintainer per service, or require two for billing and auth.
Holdpatch never does
- Deploy without an approval on record. There is no auto-approve setting to find later.
- Touch database schemas, secrets, or payment amounts. Those stay human-written, always.
- Close an incident. It proposes; your on-call closes.
After an approval
The canary watches the same error that started the incident. If it does not fall, or a new one rises, the deploy rolls itself back and the patch returns to the gate marked failed, with the canary evidence attached. Try it on sheet one: approve, then roll back, and the sample returns to awaiting Maya, untouched.
"I approve most patches from my phone in about a minute, because the repro test is right there. The ones I send back come back better. The point is they wait. My pager got quieter and my name is still on every release."
Invented for this fictional site: Dana K., maintainer of a five-person store platform in Columbus, Ohio
Sheet 04 · access, read first
It reads your signals. It writes only drafts.
Read access it asks for
- Logs and traces for the services you connect, nothing outside them.
- Deploy history, so a break can be tied to the change that shipped before it.
- The repository, read-only, to find the line a trace points at.
The one write it gets
- Draft pull requests on a holdpatch branch, labeled and never merged by us.
- Your existing protections still rule: required reviews, status checks, CODEOWNERS.
- Disconnect a service and its drafts close. $49 covers that service, connected or paused.
Fits and does not fit
Built for small web-product teams running services with tests worth trusting. If a service has no test suite, Holdpatch can still diagnose, but it will say plainly that it cannot prepare a proven fix, and it will not pretend otherwise. Monorepos are fine; a service is whatever you deploy as one thing.
Sheet 05 · the honest failure
Sometimes the prepared thing is: nothing. On purpose.
A second sample from the same invented morning. Not every incident earns a patch, and a tool that always produces one will eventually produce a confident wrong one.
IncidentThumbnail jobs timing out since 08:52 ET. Two plausible causes fit the traces: a slow storage region, or a deploy at 08:47 that raised image quality.
Why no patchThe reproduction passes either way, so a fix would be a guess wearing a test's clothes. Holdpatch paged Maya with both hypotheses and the one graph that separates them, instead of preparing a change.
When a diagnosis is wrong
Your revision reason is kept with the incident. The same wrong guess on the same service gets flagged to us before it reaches your gate twice.
When a patch fails the canary
It rolls back on its own and cannot be re-approved unchanged. Something must be different before it asks again.
Sheet 06 · the whole price
One unit. No per-incident meter running.
per monitored service, per month. Draft patches included, however many the month brings. A service is one deployable thing: an API, a worker, a storefront.
Starting takes an afternoon
- Connect logs and the repo, read-only.
- Name the maintainer who holds the gate.
- First week runs in shadow: patches prepared, nothing at the gate, so you can judge the quality cold.
Plain terms
- Month to month. Pause a service and its $49 stops.
- Your code and logs are never used to train anything shared.
- Export every incident, patch and decision any time.