--- schema: "swft.publication/v1" id: "company-dropbox-nova" title: "Dropbox Nova: agents propose changes while deterministic systems control proof" description: "How Dropbox Nova uses isolated code snapshots, explicit validation, retry loops, AGENTS.md context, one-branch sessions, and reviewable outputs." summary: "Dropbox gives several coding agents one internal cloud environment. Each session starts from an exact code version, receives explicit checks, and can retry with real failure evidence. The agent edits and investigates, while deterministic systems keep control of continuous integration, branches, publication, and stop rules." canonical: "https://swft.io/companies/dropbox-nova" author: "SWFT Editorial" author_type: "Organization" published: "2026-09-01" modified: "2026-09-02" kind: "case-study" section: "Companies" tags: ["Dropbox Nova", "coding agent platform", "AI test remediation", "validation loop", "background coding agents", "software factory guardrails"] evidence_labels: ["INFERENCE", "SELF-REPORT"] source_ids: ["dropbox-nova"] authorship_disclosure: "AI-drafted from the cited public sources and independently checked by a second AI editorial-review agent (Codex) for source fit, claim boundaries, overlap, and reader utility. SWFT Editorial is responsible for corrections." --- # Dropbox Nova: agents propose changes while deterministic systems control proof Dropbox runs several coding agents through one internal cloud platform, with exact code snapshots, declared checks, bounded retries, one branch, and publication outside the agent. > **Authorship:** AI-drafted from the cited public sources and independently checked by a second AI editorial-review agent (Codex) for source fit, claim boundaries, overlap, and reader utility. SWFT Editorial is responsible for corrections. ## Quick answer Dropbox gives several coding agents one internal cloud environment. Each session starts from an exact code version, receives explicit checks, and can retry with real failure evidence. The agent edits and investigates, while deterministic systems keep control of continuous integration, branches, publication, and stop rules. Dropbox built Nova as a shared cloud service for coding agents rather than a collection of disconnected bots. Nova runs work in an isolated copy of the Dropbox codebase, applies explicit validation commands, and can try again when a check fails. Deterministic systems keep control of publication and continuous integration. ## What is Dropbox Nova? [Dropbox describes Nova](https://dropbox.tech/machine-learning/introducing-nova-our-internal-platform-for-coding-agents) as an internal service for running coding agents in its cloud. Engineers can use a web interface, command line, or API. Internal services can also launch background jobs, and one person can run several sessions in parallel. Every Nova session starts from a specific code commit in an isolated environment. The caller supplies a task and can name the build or test commands that define success. If a command fails, the surrounding workflow returns that evidence to the agent for another attempt. Dropbox summarizes the loop as propose, validate, and continue only when the result holds up. Nova supports more than one agent behind the same interface. Skills, plugins, and Model Context Protocol integrations give those agents access to codebase guidance, logs, and other approved context without rebuilding the execution platform for every use case. ## Which controls stay outside the agent? Dropbox limits a session to one branch and keeps publication outside the agent. Ordinary workflow code decides when to run continuous integration, how to rebase a branch, and whether a result is ready to publish. If a test fails, that workflow can bring the agent back with the failure evidence. This is a useful guardrail. An agent can reason about a failure without also controlling every branch, test selection, and publication decision. The surrounding system keeps a predictable record of which code version entered the isolated workspace, what validation ran, and which branch contains the proposed result. Dropbox also uses repository-local AGENTS.md files, isolated execution, hermetic tests, Bazel caching, observability, prompt evaluation, and feedback collection. Together these provide supplied context and a proof loop around the model. ## How does Dropbox use Nova for flaky tests? Deflaker is one of Nova's clearest operational workflows. Dropbox's Athena system first finds examples of the same test passing and failing. Deflaker sends both sets of logs to Nova, which investigates the likely cause and proposes a fix. The workflow then runs the test at least 100 times in continuous integration, with the exact count adjusted for its failure rate. If the test fails again, the next attempt receives the new logs and notes from the preceding run. The loop stops when a fix holds or after five attempts. This is stronger than asking an agent whether its own patch looks right. A repeatable outside system creates the proof, and failure becomes structured feedback for the next attempt. ## How does Nova support migrations and production failures? Before Nova, Dropbox had a separate Goose-based migrator. It created parallel coding jobs from prompt templates and verification commands, then published the results to branches. Dropbox says it was used across thousands of migration entries, including Enzyme-to-React-Testing-Library conversions and mypy configuration changes. Moving that work onto Nova added interactive recovery, shared guardrails, and one operating model. Migration owners can launch many agents with the same runbook and review their outputs as a coordinated rollout. Nova also works with Renovate so an agent can attempt to repair a dependency update that broke a build. Dropbox reports another live use: when a production crash alert arrives, Nova can recreate the crash in a test, prepare a candidate fix, and route it to the responsible service team. Other ideas, including some scheduled on-call work and multi-agent pull-request review, were still described as experiments in May 2026. ## What evidence is still missing? Dropbox's article gives unusually concrete system and workflow detail. It does not publish Nova's company-wide user count, task count, acceptance or merge rate, total time saved, cost, defect rate, or reviewer burden. The thousands-of-migrations figure belongs partly to Nova's predecessor and should not be reported as a Nova-only result. Nova is internal, and Dropbox links no public source release. Its strongest lesson is the control boundary: agents investigate and edit, while ordinary systems own the exact starting point, validation, publication, and retry budget. ## What can a product team copy? Start with a task whose proof can run repeatedly, such as a flaky test or dependency repair. Pin the starting code version. Let the task brief declare the validation commands and retry limit. Keep one branch per session. Make publication a separate decision. Store failure evidence so another attempt learns from what actually happened rather than starting from a fresh prompt. ## How we know - **First-party report (SELF-REPORT)** Dropbox describes Nova's isolated exact-commit sessions, validation commands, bounded continuation, multi-agent interface, one-branch rule, and publication boundary. Sources: [Introducing Nova, our internal platform for coding agents](https://dropbox.tech/machine-learning/introducing-nova-our-internal-platform-for-coding-agents). - **First-party report (SELF-REPORT)** Dropbox describes Deflaker's passing-and-failing context, 100-or-more CI runs, fresh failure evidence, and current five-attempt limit. Sources: [Introducing Nova, our internal platform for coding agents](https://dropbox.tech/machine-learning/introducing-nova-our-internal-platform-for-coding-agents). - **First-party report (SELF-REPORT)** Dropbox reports migration, dependency, production-crash, and developer-session uses while distinguishing established workflows from emerging experiments. Sources: [Introducing Nova, our internal platform for coding agents](https://dropbox.tech/machine-learning/introducing-nova-our-internal-platform-for-coding-agents). - **Analysis (INFERENCE)** SWFT treats deterministic ownership of validation and publication as Nova's most transferable software-factory control. Sources: [Introducing Nova, our internal platform for coding agents](https://dropbox.tech/machine-learning/introducing-nova-our-internal-platform-for-coding-agents). ## Sources - **First-party report (SELF-REPORT)** [Introducing Nova, our internal platform for coding agents](https://dropbox.tech/machine-learning/introducing-nova-our-internal-platform-for-coding-agents) — Dropbox.Tech; published 2026-05-21; accessed 2026-09-01. Dropbox's account of isolated exact-commit sessions, deterministic validation and retry, one-branch publication boundaries, Deflaker, migrations, and experimental operational workflows. ## Read next - [Spotify Honk: adding an agent to a software factory that already worked](/companies/spotify-honk) - [Ramp Inspect: how a background coding agent became factory infrastructure](/companies/ramp-inspect) - [How an AI software factory works](/software-factory-architecture)