Spec Reviewer now runs your application before reviewing it
Spec Reviewer can now launch the application from the Change branch inside an isolated sandbox, open it in a real browser, and validate the running implementation against the specification. Private application review, which runs that sandbox inside your own Kubernetes environment, is available as a limited technical preview.
Code can satisfy a requirement on paper and still fail when the application actually runs.
A page may render differently than the design. Authentication may hide the relevant state. A component may work in isolation but fail when connected to the rest of the application. Until now, Spec Reviewer depended on an existing preview environment to inspect those behaviors.
Spec Reviewer can now create that environment itself.
For each Change, Baz can launch an isolated sandbox, clone the repository, install dependencies, run the configured setup and start commands, and open the application in a real browser. The reviewer then validates the running implementation against the original specification, including tickets, acceptance criteria, and design references.
From code inspection to execution
Spec Reviewer already combines the specification, repository context, and implementation diff to determine whether a Change fulfills its requirements. The new execution layer adds direct evidence from the running application.
Baz can now:
- Run the application from the Change branch in an isolated environment.
- Restore dependency caches and inject the environment variables required for startup.
- Wait for the application to become healthy before beginning the review.
- Open the application through a browser session.
- Inspect visual behavior, navigation, state, and interactions.
- Capture screenshots and execution artifacts as part of the review.
- Destroy the environment automatically when the review completes.
The application and the Baz agent run together inside a short-lived sandbox. This removes the need for the application to already be deployed at a public preview URL and allows the reviewer to inspect the exact code under review.
Built for real applications
Development environments are rarely a single command.
Large applications may require private packages, custom setup tools, certificates, local hostnames, environment variables, authentication state, or several minutes of dependency installation before they can start.
The sandbox configuration lets each repository define the commands and environment needed to reproduce its development setup: a setup command, a start command, the environment variables the application needs to boot, a runtime, and an optional dependency cache. Baz uses that configuration whenever Spec Reviewer needs to launch the application.
The same execution layer is also being used by other Baz agents, including Fixer and BazSec. This gives reviewers a common isolated environment for browser validation, testing, security tools, and future execution-based review workflows.
Private application review
We are also introducing private application review as a technical preview.
In this mode, the sandbox runs inside the customer's Kubernetes environment. The application, internal services, and browser traffic remain inside the customer network while Baz coordinates the review and receives the resulting findings and selected artifacts.
The private execution architecture uses short-lived workloads, private networking, automatic cleanup, and outbound communication from the customer environment. It is intended for applications that cannot be exposed to Baz-hosted infrastructure.
Private application review is currently available through a limited technical preview while we complete the customer-side controller, deployment packaging, and provider-neutral execution contract.
What this changes
Spec Reviewer no longer has to infer application behavior from code alone or wait for a separate preview deployment. It can run the software, inspect the result, and compare what users would experience with what the specification required.
That moves review closer to verification: not only whether the implementation looks correct, but whether the application actually behaves as intended.
Sandboxed application review is available for GitHub-connected repositories with a configured sandbox. See the sandboxed application review documentation for the repository configuration, browser validation options, and troubleshooting steps.