safe-upgrade is a dependency upgrade agent combining Jev for typed probabilistic decisions, LangGraph for durable workflow control, and Tenuo for task-scoped authorization. The system interprets release evidence and repository context to decide upgrade steps while keeping judgment, control flow, and authority architecturally separate.