Self-healing
Maintenance mode — when a production flow starts failing the same way repeatedly, Keel diagnoses it against the real payload and drafts the fix.
Upstream services change shape. A field renames, a date format shifts, and a workflow that ran for months starts failing every delivery. Maintenance mode is a per-workflow opt-in (Settings pane) that puts Keel on call for exactly this.
How it works
- The failure watcher counts same-fingerprint failures — 3 within 30 minutes trips it, so a one-off blip never does.
- Keel opens (or reuses) the flow's single maintenance conversation and is instructed with the house discipline: diagnose from that run, test against the exact payload that failed, propose only what you proved.
- The fix lands on the draft. Production keeps running the published version untouched — publish remains a human's click (an auto-publish sub-toggle exists but is deliberately not honored yet, and says so).
The guardrails
- Circuit breaker: at most 3 fixes per flow per day — a fix that does not hold must not loop.
- Taint containment: the failing payload is untrusted external data by definition, so anything production-affecting from such a turn is always a card, never silently applied.
- Not user-instructed: a system-initiated turn can never perform destructive acts, at any autonomy level.
- Every triggered heal is written to the audit log, and the maintenance conversation is a normal chat you can read, join, or take over.
What it looks like
A webhook producer changes {"amount": "12.50"} to {"total": "12.50 EUR"}. Three deliveries fail with the same parse error. Keel wakes, reads the failing run, tests the parsing step against that exact body, and drafts the adaptation — the diff waiting for you names precisely what changed and why. You review, apply if it hasn't auto-applied to the draft, and publish when satisfied.