Morning brief and night shift
Overnight, Averil reviews code that changed, proves problems with a failing test, opens fixes, and tells you in one short message.
Early access
What arrives when
| When | What |
|---|---|
| Each night, at a time set for your workspace, in your time zone | The night shift reviews repositories. By default it picks up to three a night: ones that changed since their last review first, then the ones reviewed longest ago. |
| Each morning, at a time you choose | One message: what was reviewed, what was proven, and the pull requests opened. Each item has its own thread with what, why it matters, the proof, the fix and the case buttons. |
| Once a week | A check-in in the case channel: what Averil watched, what happened to cases, what still needs someone, and what it cannot see. |
How the night shift proves a problem
- 1Averil takes a snapshot of the repository at the head of the default branch. Its hash pins every later step to that commit.
- 2A reviewer agent reads the code, recent changes, past cases and confirmed facts, and lists candidate problems with file, lines and how each is exploited.
- 3For up to three candidates per repository, a prover agent writes a test that exploits the problem and a fix, and runs both in an isolated sandbox. The tests run with no network access.
- 4Code, not a model, re-runs everything. A finding is proven only if the test fails on your code, passes with the fix, and your full suite still passes.
- 5A proven finding becomes a case with one planned step: open a pull request with the fix and the test.
Quiet nights
A night with nothing proven sends nothing. Problems that look risky but cannot be proven are mentioned in a thread, not reported as findings. The weekly check-in still says the reviews happened.
Letting Averil open pull requests on its own
By default, opening a pull request waits for approval like any other plan. Your account owner can choose a higher autonomy level for that one action.
| Level | Meaning |
|---|---|
| Observe | Averil watches and records. |
| Recommend | Averil suggests a plan. |
| Approve (default) | Every plan waits for a person. |
| Auto low | Low-risk, reversible plans run without a click. |
| Auto | Low and medium-risk plans run without a click. |
Opening a pull request is low risk and easy to undo: close it and delete the branch. With Auto low set for it, Averil opens fixes on its own. The executor checks the level in its own policy too, and the action log records who set it.
What still needs a person
- Merging. Merges stay with your team and your branch protection.
- Every change to running systems, such as keys, cloud settings or user access.
- Fixes that touch CI files, CODEOWNERS, dependency manifests or lockfiles, or that add code which starts processes, reaches the network or reads the environment. Averil refuses to open those and leaves them for a person to write.
When you merge, Averil re-runs the proof test on the default branch. The case closes only when it passes. If the pull request is closed without merging, the case goes back to its owner.
Coming soon
The same review on pull requests your team opens during the day, with the failing test and fix as a review comment. Later: probing a running staging app, warnings in the Companion while a coding agent writes a vulnerable line, and infrastructure reviews of Terraform.
Stuck? Email averil@averil.ai or ask me in Slack.