Turn one finding into a reviewable diff

Understand the change before proposing a fix

“Change behind this finding” shows the reviewed change that triggered the finding, with the before and reviewed revisions. Removed and added lines describe that original change. “Proposed fix” is a separate diff generated only after you request a patch.

Inline evidence is saved during new reviews when a verified text excerpt is available. Older reviews, unsupported changes, and excerpts exceeding capture limits keep their Open cause link and explain that the inline diff is unavailable.

Request, inspect, and deliver a fix

1. 1

   Open the finding

   Open the current run and locate an accepted finding with a source location.
2. 2

   Select Propose fix

   Code Voucher records one durable proposal for that finding and queues execution. Repeated requests reuse the same proposal.
3. 3

   Wait for completion

   The patch worker edits an isolated copy of the exact reviewed snapshot. The run page refreshes active patch status automatically. The worker has no Git provider or Slack publishing credentials.
4. 4

   Review the evidence

   Expand Patch evidence to inspect the unified diff, source path, patch hash, clean-application result, and deterministic structural second pass.
5. 5

   Create a draft remediation MR

   For an eligible validated patch, select Create draft remediation MR. This explicit action queues one idempotent publication on a separate branch targeting the contributor branch; it does not modify the contributor branch and does not auto-merge.
6. 6

   Apply deliberately

   Review the draft MR and run the repository's normal tests, or keep the private diff as a proposal and apply it yourself. Patch completion alone never publishes anything.

Create draft remediation MR

Repository delivery is a separate, manager-triggered action after patch validation. It requires GitLab, an active API write credential, the Codex dogfood backend, operator risk acknowledgement, exact repository allowlist membership, and both repository remediation switches. The configured branch prefix must be a safe Git ref prefix.

1. 1

   Re-check the evidence

   Confirm the current run, reviewed source SHA, approved scope, patch hash, and open finding still match. A changed patch or superseded run must be reviewed again.
2. 2

   Choose Create draft remediation MR

   Code Voucher queues an idempotent publisher job; a failed publication can be retried without creating duplicate branches or merge requests.
3. 3

   Inspect the separate branch

   The branch is named <prefix>/<proposal-id>-<patch-hash>. The draft MR targets the contributor's source branch and never commits to or rewrites that branch.

Publication is rejected if the merge request is closed, comes from a fork, changes source SHA or source project, or no longer matches the recorded target branch. Recovery reconciles an existing matching branch or MR before creating provider resources.

What validation means

Code Voucher verifies that the patch changes only files in the approved remediation scope, which must include the finding's source file and may contain at most five files. It then checks that the patch applies cleanly to the reviewed source snapshot and passes a second structural inspection tied to the same patch hash. The current second pass is deterministic. It is not an independent model review and does not prove application correctness.

Current limitations

• No automatic patch publication, contributor-branch modification, or merge
• Draft remediation MR delivery is limited to current, validated patches in explicitly enabled and acknowledged internal GitLab repositories
• No independent model review of the generated patch yet
• No VM-based targeted test execution yet
• A superseded run or resolved finding invalidates completion

Review the security boundaries before enabling the Codex dogfood backend.