Withhold automatic fixes when repairs exceed the recorded draft

Repair can change files beyond the candidate's draft edits while the manifest still verifies. Comparing the applied draft hashes against the final manifest now demotes the result to ready_with_gaps, so SARIF and other auto-apply consumers never offer a fix that omits verified changes.
yoni-at-strix · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026
commit be1c2e4767a8e6661cd826396115e82efd85290d
diff --git a/strix/fix/prepare.py b/strix/fix/prepare.py
@@ -306,6 +306,29 @@ async def build_git_manifest(
     return entries, summary.decode(errors="replace").strip(), None
 
 
+def _applied_hashes(workspace: Path, candidate: FixCandidateV1) -> dict[Path, str]:
+    """Content hashes of each edited file, captured right after the draft is applied."""
+    applied: dict[Path, str] = {}
+    for edit in candidate.draft_edits:
+        path = (workspace / edit.file).resolve()
+        applied[path] = hashlib.sha256(path.read_bytes()).hexdigest()
+    return applied
+
+
+def _change_extends_draft(
+    workspace: Path,
+    applied_sha256: dict[Path, str],
+    manifest: list[FileManifestEntry],
+) -> bool:
+    """Whether the verified change set differs from the applied draft edits."""
+    final_changes = {
+        (workspace / entry.path).resolve(): entry.resulting_sha256 for entry in manifest
+    }
+    return set(final_changes) != set(applied_sha256) or any(
+        resulting != applied_sha256[resolved] for resolved, resulting in final_changes.items()
+    )
+
+
 async def _verify_source(context: PreparationContext) -> bool:
     identity = context.candidate.source_identity
     if identity is None:
@@ -429,6 +452,7 @@ async def execute() -> FixPreparationResultV1:  # noqa: PLR0911, PLR0912
             )
         context.candidate = anchored
         _apply_edits(workspace, context.candidate)
+        applied_sha256 = _applied_hashes(workspace, context.candidate)
 
         checks: list[CheckResult] = []
         reproduction: CheckResult | None = None
@@ -474,6 +498,8 @@ async def execute() -> FixPreparationResultV1:  # noqa: PLR0911, PLR0912
             for result in checks
             if not result.required and result.status is not CheckStatus.PASSED
         )
+        if _change_extends_draft(workspace, applied_sha256, manifest):
+            gaps.append("The verified change extends beyond the recorded draft edits.")
         if reproduction is None and not verifier.reproduction_executed:
             gaps.append("No executable security reproduction was available.")
         elif reproduction is not None and reproduction.status is CheckStatus.UNAVAILABLE:

diff --git a/tests/test_fix_preparation.py b/tests/test_fix_preparation.py
@@ -244,6 +244,30 @@ async def test_prepare_fix_returns_ready_with_manifest(tmp_path: Path) -> None:
     assert (workspace / "app.py").read_text(encoding="utf-8").endswith("return 'safe'\n")
 
 
+@pytest.mark.asyncio
+async def test_prepare_fix_demotes_ready_when_repair_exceeds_draft(
+    tmp_path: Path,
+) -> None:
+    workspace, commit = _workspace(tmp_path)
+
+    async def widening_repair(
+        _context: PreparationContext,
+        _checks: list[CheckResult],
+    ) -> None:
+        (workspace / "hardening.py").write_text("HELPER = True\n", encoding="utf-8")
+
+    result = await prepare_fix(
+        _request(_candidate(commit)),
+        workspace,
+        repair=widening_repair,
+        verify=_verified,
+    )
+
+    assert result.state is PreparationState.READY_WITH_GAPS
+    assert any("beyond the recorded draft edits" in gap for gap in result.gaps)
+    assert result.candidate.digest() == result.candidate_digest
+
+
 @pytest.mark.asyncio
 async def test_prepare_fix_retries_failed_checks(tmp_path: Path) -> None:
     workspace, commit = _workspace(tmp_path)