Docsferatu: An agent that drafts docs PRs while you sleep

Inngest engineer Linell Bonnette built Docsferatu, an autonomous documentation drafting agent that monitors SDK pull requests and writes documentation updates in a separate repository. As detailed in inngest.com's report, the system automatically decides whether an incoming code change alters public application programming interfaces and requires documentation. When a change qualifies, an agent powered by Claude clones the repositories, writes the edits, runs integration checks inside isolated Linux sandboxes, and submits a pull request without requiring human developers to remember documentation tasks.

This report examines the architectural foundation, security boundaries, rate limiting rules, and failure recovery mechanisms behind Docsferatu. It is written for engineering leaders and platform teams managing fast releases who need to understand how durable execution prevents agent pitfalls like runaway API billing, process crashes, and credential leaks. Readers will see how durable orchestration patterns isolate untrusted community contributions while automating repetitive repository maintenance across distributed developer environments.

An agent that drafts docs PRs while you sleep: what actually changed

Standard webhook architectures break down when coordinating multi-minute artificial intelligence agent runs. In a naive setup, GitHub triggers a webhook, an edge endpoint queries an LLM to evaluate docs needs, and an agent edits repository files before opening a pull request. This approach collapses because drafting runs take minutes and can run up to twenty-five minutes before timing out. Cloudflare Workers cannot keep connections open for half an hour, burst commits trigger racing agents, and mid-run crashes force jobs to restart from zero.

Docsferatu solves these failures by structuring execution as discrete steps managed by Inngest over standard HTTP invocations. Whenever an operation finishes, Inngest saves its step output to a persistent store. If a deploy or GitHub 502 occurs eighteen minutes into drafting, execution resumes at minute eighteen rather than resetting. Cached step results return immediately without re-executing completed operations, ensuring that Anthropic API calls made at minute three are never re-run or billed again. This durability eliminates the need to build custom queues or database tracker tables.

An agent that drafts docs PRs while you sleep: how it works

The system divides workflow logic into two core Inngest functions named triage and draft. The triage function activates when pull requests are opened, synchronized, or marked ready for review. To manage rapid commit sequences, a five-minute debounce pauses execution until repository activity settles before running an assessment. A singleton setting in cancel mode terminates obsolete triage executions whenever newer commits arrive on the pull request. Triage then re-fetches pull request details from GitHub, verifies whether public API files changed, and calls Anthropic Haiku once to classify relevance.

When triage identifies documentation needs or an engineer attaches a docs-sync label, the draft function initiates. The drafting agent operates inside a standalone sandbox rather than within the Cloudflare Worker. Because edge workers cannot idle during long-running tasks, the function invokes step.sleep to persist a timer and terminate the invocation. After sixty seconds, Inngest triggers the Worker again over HTTP to poll sandbox progress, avoiding idle compute charges. The draft function also enforces a singleton rule to kill stale drafts, cancels unmerged pull requests, and throttles starts to ten runs per hour.

An agent that drafts docs PRs while you sleep: why it matters now

Granting autonomous software agents write access to code repositories creates security exposure when processing untrusted community pull requests. Bonnette avoided GitHub Action runners like Anthropic's claude-code-action because shared runner environments place repository write credentials too close to model execution. In a cross-repository workflow where library updates trigger website changes, running agents inside standard runners would require storing sensitive website write tokens directly inside the SDK repository. To eliminate this vulnerability, Docsferatu ensures no GitHub authentication tokens enter execution sandboxes, while public repositories clone anonymously without credentials.

The architecture further safeguards against prompt injection by decoupling content editing from verification testing. The edit sandbox receives exactly one secret, an Anthropic API key, which is never committed to persistent snapshots. Verification checks execute in separate sandboxes stripped of secrets, operating on snapshots keyed to the website lockfile hash containing dependencies and toolchains for Go and Python. Before the agent inspects code, the system deletes potential instruction files like .claude directories, CLAUDE.md, and AGENTS.md from the SDK checkout, preventing malicious pull requests from planting prompt injections.

An agent that drafts docs PRs while you sleep: who is affected

Core SDK maintainers and external open-source contributors experience direct workflow changes under Docsferatu. Developers no longer need to remember secondary documentation chores when publishing library improvements or resolving bug tickets. If an author pushes code modifying public interfaces, triage detects the change and the drafting agent generates a pull request in the documentation repository. When automated checks fail during verification, compiler errors feed directly back into the edit sandbox. The agent retains context across these cycles to correct mistakes independently, attempting up to three remediation passes before failing the run.

Platform engineers and repository administrators also gain explicit guardrails restricting agent activity. The model is stripped of shell command execution and web browsing tools, leaving access only to file reading, editing, globbing, grepping, and four designated skills. A hardcoded default-deny hook inspects every tool call before execution, permitting file edits solely within pages/docs/, snippets/, and a single navigation configuration file. Only when the separate checking container verifies all tests pass does the Cloudflare Worker, which holds the sole write token, commit changes and publish the draft pull request to GitHub.

An agent that drafts docs PRs while you sleep: what to watch

Real-world deployments inevitably encounter protocol mismatches between agent frameworks and custom security boundaries. During Docsferatu's initial production draft on pull request inngest-js#1830, the agent executed successfully but terminated with a "no structured result" error. Investigation revealed that the Anthropic Agent SDK transmits its final output using an internal tool named StructuredOutput. Because the default-deny hook blocked all tools outside the explicit allowlist, it rejected the SDK's completion payload. Bonnette resolved the failure by adding an explicit exception to the hook's switch statement alongside automated regression tests to protect subsequent runs.

Resource lifecycle management and runtime cleanup remain critical areas for engineering teams monitoring autonomous systems. When a pull request receives new commits or closes without merging, Inngest broadcasts cancellation events matching sandbox names by run identifier to destroy active virtual machines immediately. Teams should observe how container snapshot caching scales as documentation repositories incorporate multilingual test environments spanning Go, Python, and Node dependencies. Rebuilding cached snapshots only when lockfiles change keeps checking routines fast, demonstrating how durable orchestration automates developer operations while maintaining strict cost ceilings and security guarantees.