Shopify built a shared foundation for many kinds of software agents. River is the visible agent in Slack. When Shopify described the architecture in May 2026, Aquifer was still rolling out underneath River, profile by profile. It is designed to keep sessions, tools, sandboxes, credentials, and activity records on one shared foundation. Roast turns repeatable work into checked workflows. The reusable idea is the platform around the model.
What are Shopify River and Aquifer?
Shopify describes River as an internal coding agent that works in public company Slack channels. An employee mentions River, and it can read code, run tests, query the data warehouse, inspect production traces, and open a pull request. Other employees can join the thread with a constraint or correction while the work is still running.
Shopify reported in May 2026 that River coauthored one in eight merged pull requests. That is a company self-report about participation. It does not mean River independently designed, approved, or merged one eighth of Shopify's software.
Aquifer is the internal platform Shopify was rolling out beneath River. Shopify separates three parts:
- The session is the durable record of the work. It keeps an append-only history even when a process stops.
- The harness is the agent loop that reads the history, chooses a next action, and calls the model.
- The sandbox is the temporary workspace where code, commands, builds, and tests run.
This separation lets a session survive a failed or replaced sandbox. It also keeps model decisions observable outside the place where code executes.
Why did Shopify prepare the codebase first?
Shopify moved its software into a monorepo called World and standardized development, continuous integration, and production environments with Nix. The company says those decisions gave agents one navigable codebase and a reproducible environment.
That foundation matters to a product team because an agent needs more than source code. It needs to know which commands are valid, which systems depend on a change, how to reproduce a failure, and whether a result passed the same checks people use. Shopify stores written operating knowledge as skills that can be loaded when relevant.
As that rollout progresses, Aquifer is designed to support several modes on the same foundation. River is an interactive profile with a person present. Pull-request review is an automated profile woken by an outside event. Batch and continuous-integration work can run as temporary jobs. Shopify describes each profile as configuration for its prompt, skills, extensions, sandbox policy, and model defaults rather than a new platform.
What is Shopify Roast?
Roast is Shopify's open-source framework for structured AI workflows. A workflow can alternate ordinary commands with model or coding-agent steps, share context between steps, run work in parallel, branch, retry, and save a session for replay.
Shopify's Boba workflow shows why this hybrid design is useful. Deterministic commands clean a Ruby file and run Sorbet's automatic fixes. A coding agent then handles the remaining type errors, reruns tests, and continues until the declared checks pass. Ordinary software owns the predictable operations. The agent handles the part that requires interpretation.
Shopify says internal Roast workflows have analyzed thousands of test files and improved tests and type coverage. The public article does not provide a controlled comparison, a failure rate, or a defect series for those uses.
How does Shopify prove security findings before asking for review?
Shopify's application-security team built a separate factory line called Dispatch. Its July 2026 account describes parallel hunter agents that search bounded code partitions, a verifier that must demonstrate a finding with a real test, and remediation agents that prepare a branch and draft pull request.
Candidate findings are not treated as confirmed simply because a model sounds confident. The verifier must use the application's existing integration or functional test tools to demonstrate real impact. Findings that cannot meet the proof rule are rejected or downgraded. Deterministic software, rather than an agent, controls credentials, Git operations, and stored results.
Shopify reported complete scans of more than 80 applications, thousands of scans in roughly six weeks, and more than 300 findings. It valued those findings at more than $400,000 in equivalent bug-bounty payouts. These figures are Shopify's own operating estimates, not an independent security audit or a measurement of River as a whole.
What can a product team copy?
Build one dependable agent platform before creating many named agents. Keep the work record outside the disposable execution environment. Give every profile the same identity, credential, observability, and sandbox boundaries. Put predictable steps in ordinary code and reserve agent judgment for the uncertain middle. Require a complete evidence package before a result reaches a human approval gate.
Shopify's strongest evidence is architectural and operational. River, Aquifer, and Dispatch remain internal, while Roast is open source. Public material does not disclose company-wide acceptance rates, defects, review time, or the customer impact of agent-assisted changes.