What Novix checks before you see a fix

The drafting stage only patches files it has actually opened. A change to a file nobody read is dropped before anyone sees it, and the drop is on the task’s trace with the paths named.

The security review

One pass over the lines the patch adds or changes, asking the question none of the other checks ask: does this fix introduce a hole. A weakness already in the file is out of scope. It reports and repairs in the same call, and a correction is thrown away unless it parses, touches no new files and still applies.

It never refuses a pull request. A finding raises the risk rating, which means the pull request opens as a draft for a person, because a security check that quietly turns the loop off is worse than no check at all.

The fix review

A second pass judges the diff itself: are the changed files inside the diagnosed scope, does it touch sensitive paths like auth, payments, migrations, CI or secrets, how big is the blast radius, and does the diff even parse. It reads your repository while it judges, so a concern about code it cannot see is checked or dropped rather than reported.

Blocked means no pull request, and it also skips the build. A block that comes with no stated reason says exactly that rather than borrowing an unrelated reassurance.

Your own rules

Add your own sensitive paths and free-text guidance in settings. A path you mark sensitive always forces at least medium risk and a human-review note, even when the review would otherwise say low. Your rules always hold.

Your build and your tests

Novix clones the routed repository into a throwaway container, applies the patch, and runs your own build and test suite against it. This always runs. There is no per-team switch, because a check a workspace can quietly disable is not a check the product can promise.

• A failing build or test triggers one repair attempt and a re-run, before you see the fix.
• A missing toolchain is reported as exactly that, never as a failed build. A suite that collected no tests is never called a pass or a fail.
• A passing build can start the app in the same container and hand you a live preview link. That part is opt in, because it keeps a container alive past the verdict.