Teire
ChangesScanDocsTrust
Teire

When upstream breaks, Teire fixes your code.

teire-dev/teireSystem status
Built on
  • NVIDIA NemotronNVIDIA Nemotron
  • Nebius Token FactoryNebius Token Factory
  • dependabot-coredependabot-core
  • Cloudflare

Product

Scan a repoChangesInstall on GitHubDashboardDemo video

Developers

DocsGitHubCLI and MCPteire.yml schemanpm

Trust

How Teire runsSource code

How Teire runs

live state · where code goes · what it may touch · the rules

Where your code goes

Public repositories and dry runs
Public repositories and dry runs
  1. GitHubtarball, one commit
  3. microVM per commandinstall: open network
  4. network off
  5. Your checksbefore and after
  7. Pull requesta person merges
Private repositories
Private repositories
  1. GitHubfetched by Cloudflare
  3. Containerregistries only, GET
  4. network off
  5. Your checksbefore and after
  7. Pull requesta person merges
What Teire never does
Teire works on its own branch; a person merges; Teire never pushes to the default branch
  1. Teire's branchteire/<change>your push there stops Teire
  3. Pull requestwith its evidence
  5. You mergeor close itTeire never merges or deletes
  6. only you
  7. Default branchTeire never pushes here
The only model that reads codeNVIDIA Nemotron 3 Ultra on Nebius Token Factory; Super steps in while Ultra is down. Every call is on its run's receipt.
Dependency filesDecided by Dependabot's updater under gVisor, behind a proxy with a read-only token for that one repository; a few cases (Go majors, renamed packages) use Teire's own step.
No secrets in a sandboxGitHub tokens and model keys never enter one. The worker process itself never runs repository code.
What is keptA scan deletes its checkout when it ends. Token Factory keeps a run's saved sandbox images of public code for 180 days; after that, untagged ones may be deleted. Teire keeps findings, proposed diffs, run logs and receipts.

What Teire may do on GitHub

May change
  • Contentswrite

    Reads code; pushes only teire/… branches, never the default one.

  • Pull requestswrite

    Opens and updates fix PRs and Configure Teire.

  • Issueswrite

    The Dashboard issue, issues for a person, @teire replies.

  • Checkswrite

    The Teire check, annotating each line a change reaches.

May read
  • Actionsread

    Your CI's logs when it fails on a Teire PR, for one repair.

  • Metadataread

    Names and default branches; every app needs it.

  • Email addressesread

    Names your account at sign-in; never emailed.

Rules every run follows

  • Evidence decides the PR

    Ready only when the same checks pass before and after; else a draft or an issue.

  • Quotes or it didn't happen

    A change is acted on only when its quote matches the fetched page.

  • Offline checks

    Your checks run with the network off, in both sandboxes.

  • Only with write access

    @teire commands need write access to the repository.

  • Private stays private

    A private repository's runs show only to people GitHub lets see it.

  • Reads what you use

    Change pages are read for what watched repositories depend on; rescans daily by default and on pushes.

  • Spending stops itself

    Model work pauses when credits run out or the $10 daily cap is used, and resumes on its own; Ask Teire threads go after 90 days.

Worker running
Worker49 s ago · 1137c11
Model creditsavailable
ModelsNemotron 3 Ultra answering
Missed deliveries100 failed · 100 redelivered
Model spend$1.247 days · $0.04 today · cap $10/day
  • nvidia/Nemotron-3-Ultra-550b-a55b194 · $1.24
Runs, 7 days · 275
  • pre existing failure 8
  • queued 209
  • typecheck only 15
  • regression 2
  • environment mismatch 6
  • failed 31
  • cancelled 1
  • needs live access 3