Who hurts
Teams of 5–50 engineers drowning in Dependabot PRs nobody reviews.
The problem
Automated upgrade PRs are noise because they carry no risk information. So they queue up, get merged in bulk without reading, and the org is one bad minor version from an outage.
What you build
For each upgrade, trace which of your own call sites touch the changed API surface, check which of those are covered by tests, and open a PR whose description is a ranked risk list rather than a changelog dump.
Why now
Tree-sitter plus a model that can read a diff makes call-site tracing cheap for the first time. It used to need per-language static analysis nobody could staff.
Validate it this week
Post one hand-written blast-radius report on a busy open-source repo's stale upgrade PR. Watch whether maintainers ask for more.
Why you'd keep winning
Accuracy per ecosystem. Being excellent at TypeScript and Python beats being mediocre at nine languages, and the ranking heuristics improve with every merged PR.
The honest risk
A false 'safe' rating burns trust permanently. Bias hard toward flagging risk, and accept the resulting noise complaints.
The prompt is written to make an AI argue with you before it writes code — that first round of pushback is worth more than the scaffold.