Prove that your new update
is just as safe as your last update.
The release gate for fleets.
Pin a policy. Canary a few machines. Promote, pause, or roll back on real signals. You keep your OTA.
- Watch the canary
- Keep your OTA
- You're in control
Pin a policy. Ship canary. Watch the gate trip.
Dry run: same story as a real gate, but you hold the switch. Nothing executes on a real fleet.
How a rollout works
Rule in. Canary out. Gate watches. Decide. Prove it for expand day.
- 1Pin the policy
YAML or English draft. What must not happen.
- 2Pick the canary
A few devices. Not the whole fleet.
- 3Watch the gate
Signals trip or they don’t. Shadow dry run first.
- 4Decide
Promote, pause, or roll back.
- 5Prove it
Evidence for the expand day.
One product. Every team that ships to the field.
Patchling is a firewall for bad updates on robots. A release gate that proves your new update is just as safe as your last one. Same product whether you pin the policy, own the expansion date, run the stack, or sign the go.
Fleet eng
You pin the policy. We hold the line.
Stop living in charts when an update ships. A small package on the device (or beside your promote path) watches the canary in real time. Pinned tripwires (YAML or drafted in plain English, then fixed). Deterministic promote or rollback. The rest of the fleet never sees a bad build.
- e-stop rate climbs → pause
- Canary only until it proves out
- Every decision is logged
Shadow mode
A dry run on real fleet data. Pinned policy yields promote, pause, or roll back. You still hold the switch. Nothing executes yet.
Then earn autonomy
Flip a rule when the pack is boring and right. Per rule, per market. Not all at once.
On your OTA
On-device package. Pinned policy. Canary. Fail closed. First market free forever.
Built for fleets that can't afford a bad canary.
Start with a dry run.
Shadow mode runs your pinned policy on real fleet data and records what the gate would promote, pause, or roll back. without touching the fleet. Package on the device when you're ready; it does not wrap inference or sit on the GPU path. You hold the switch until a rule earns live.