shipsignal

From git tag to evidence-backed launch kit in minutes. AI release marketing you can audit: every claim traces to a commit, every publish passes a human gate.

Comment

Inspiration

Every software release sets off the same scramble: engineering ships the code, then someone hand-writes the blog post, the changelog, the LinkedIn and X posts, the customer email, maybe a demo video — slowly, off-brand, and under deadline. Worse, none of it is traceable: a marketing claim like "now 2× faster" has no link back to the diff that justifies it, so legal and PMM can't trust it, and the brand voice drifts every cycle.

We wanted to automate that grind — but the naive version ("feed the diff to an LLM, get a blog post") is exactly what you can't ship: it hallucinates, it's off-brand, and no human stands behind it. Our team builds agentic-commerce skill plugins (Medusa, Spree, Saleor, Salesforce…) and lives this pain every release. So we set out to build the governed version: turn a release diff into launch content that is provable, human-approved, and gets better every time.

What it does

ShipSignal turns a single GitHub release diff into approved, on-brand, multi-channel launch content — release blog, changelog, social posts, customer email, and a narrated audio + video digest — with three guarantees that make it safe to actually use:

  1. Evidence-backed, never hallucinated. It never writes from a raw diff. It first builds an evidence-backed feature manifest; every generated claim links to the concrete code/PR/issue evidence it came from, viewable as a provenance graph in the database.
  2. Human-governed. Three mandatory approval gates — feature manifest → generated artifacts → skill change — plus Bedrock Guardrails and deterministic PII/secret redaction. Nothing publishes without a human.
  3. Self-improving. Reviewer edits and rejections are mined into a proposed next-version skill; once a human approves it, the system writes better, more on-brand content on the next release. It compounds.

The payoff: diff → governed, traceable, multi-channel content, plus one-click distribution (publishing the demo video straight to YouTube). The whole loop runs on AWS, with Amazon Aurora PostgreSQL as the system of record.

How we built it

  • Database (the heart): Amazon Aurora PostgreSQL (Serverless v2) + pgvector — 38 migrations. The schema is the product: a claim→evidence provenance graph, release_run_id tenancy with cascading deletes (single-delete GDPR erasure), pgvector(1536) + HNSW semantic search, a versioned skills store, capability/agent governance maps, a self-learning ledger, and encrypted OAuth connections (AES-256-GCM, ciphertext only).
  • AI: Amazon Bedrock — Nova clusters evidence into features and writes the artifacts; Titan embeds evidence for pgvector retrieval; Guardrails + deterministic checks screen output; an LLM-as-judge rubric scores each artifact.
  • Orchestration: LangGraph (Python) — four graphs (release-intelligence, content, media, skill-learning) with the three human gates implemented as approval interrupts.
  • App: Next.js (App Router) + React 19 on Vercel — review/approval, provenance views, media preview, one-click YouTube publish, and operator-editable governance, reading Aurora over verified TLS and serving S3 media only via short-lived presigned URLs.
  • Media: ElevenLabs TTS + ffmpeg → S3. Distribution: YouTube Data API via OAuth.
  • CI/CD: GitHub Actions auto-deploys main to Vercel.

Challenges we ran into

  • Bedrock quota, not access. On-demand inference quota was literally 0 for our primary account (every call throttled). We diagnosed it precisely (a quota issue, not permissions) and solved it with a cross-account architecture: Bedrock runs on a second AWS account that has Nova/Titan quota, while Aurora and S3 stay on the main account — split credentials within a single process, with IAM restored after each run.
  • pgvector dimension mismatch. The schema is vector(1536); Titan Embeddings v2 maxes at 1024, so we standardized on Titan v1 (1536) and backfilled real embeddings for 8,877 evidence rows, with verified cosine retrieval.
  • Real OAuth, encrypted at rest. Building a dashboard "Connect Google" flow meant CSRF state, an exact redirect-URI contract, and storing the refresh token encrypted in Aurora (write-only/sensitive handling) — plus debugging a stubborn invalid_client down to the client secret.
  • Staying honest. Redaction before persist, claim-to-evidence linking (no unlinkable claim stored "approved"), and clearly separating what's real vs. demo.
  • Serverless ↔ Aurora over verified TLS, and keeping cost near zero on Serverless v2.

Accomplishments that we're proud of

  • The data model genuinely is the product — a real provenance graph, pgvector with real embeddings, versioned skills, governance-as-data, and encrypted connections across 38 deliberate migrations. Far beyond a CRUD bucket.
  • Real, end-to-end, on real AWS — a live run (OrcaQubits/agentic-commerce-skills-plugins) that goes diff → ~8,100 evidence rows → real Titan embeddings → real Bedrock Nova authoring → 20 claims, all evidence-grounded (provenance) → real ElevenLabs/ffmpeg media → LLM-as-judge eval → published to YouTube with an encrypted OAuth token.
  • The self-learning loop actually fired — reviewer feedback promoted the brand-voice skill to v1.1.0, live, with full provenance.
  • Shipped and deployed — live on Vercel + Aurora + S3, with CI auto-deploy, 485 TypeScript + 420 Python tests green.

What we learned

  • Treat the schema as the product. Encoding tenancy, provenance, governance, and "behaviour-as-data" into Postgres (with pgvector) made the rest of the system fall out naturally — and is what makes the output trustworthy.
  • Bedrock operations are subtle — model access vs. on-demand quota are different problems, model families differ (Nova was available when Claude wasn't), and embedding dimensions must match your schema.
  • Human-in-the-loop is a design pattern, not an afterthought — LangGraph interrupts let us make the three approval gates first-class.
  • Secrets discipline — encrypted-at-rest tokens, write-only env vars, redaction-before-persist, and never trusting model output (everything re-validated).
  • For governed AI, "provable + traceable" beats "fast" — provenance and a learning loop are the moat a static generator can't copy.

What's next for ShipSignal

  • Flip authoring fully live on the primary account once the Bedrock on-demand quota increase lands — it's already one env flag away (proven by the cross-account Nova run).
  • Smarter skill evolution — severity-weighted clustering, cross-run recurrence, and feeding eval-score regressions back into the learning loop (design already drafted).
  • More distribution channels — LinkedIn, X, Slack, and GitHub Releases publishing (already scaffolded), plus scheduled publishing.
  • Outcome loop — UTM/engagement → ROI attribution so the system learns which messaging actually converts, and A/B testing of skill versions.
  • Production hardening — Google OAuth app verification (out of testing mode), AWS Secrets Manager for tokens, and multi-tenant support.

Built With

  • amazon-bedrock-converse-api
  • amazon-web-services
  • elevenlabs-tts
  • github-actions-apis-/-external-services:-github-api-(diff/compare)
  • google
  • guardrails)
  • langgraph-platform-/-deploy-/-ci:-vercel
  • oauth
  • pgvector-aws-/-cloud-services:-amazon-bedrock-(nova-authoring
  • postgresql
  • python
  • react-19
  • sql-database:-amazon-aurora-postgresql-(serverless-v2)
  • titan-embeddings
  • youtube-data-api
Share this project:

Updates