Nexora

The secure, token-efficient coding agent

Comment

Inspiration

Current AI coding assistants suffer from three critical architectural gaps that prevent them from functioning as true autonomous engineering partners:

  1. The "Prompt Bloat" Problem: Tools like Cursor or SWE-Agent naively dump raw files into context windows. This burns tens of thousands of tokens, spikes latency, dilutes model attention, and leads to expensive API waste.
  2. The "Blind Trust" Security Vulnerability: Autonomous agents often run shell scripts or file modifications with zero guardrails, risking accidental filesystem corruption, secret leaks, or arbitrary command execution.
  3. Single-Pass Hallucination: When generated code fails unit tests, standard tools fail silently or require manual copy-pasting of error tracebacks.

We engineered Nexora for the Nebius x NVIDIA Global AI Hackathon to prove a new paradigm: "Code with Evidence."

Our golden mission was to build a deterministic, security-first, and token-efficient autonomous coding agent platform that combines NVIDIA Nemotron reasoning with Nebius Token Factory ultra-low-latency inference.

What it does

Nexora is a complete autonomous software engineering platform featuring an interactive dual-pane IDE, real-time streaming execution, and deterministic sandboxing.

The Golden Strong Points (What Sets Nexora Apart):

  1. AST-Guided Subgraph Compression (65%+ Token Savings): Instead of naive file dumping, Nexora parses source code into Abstract Syntax Trees (AST), scoring symbol importance via topological call-graph depth and query relevance: $$S(v) = \alpha \cdot \text{Relevance}(v, q) + \beta \cdot \text{DepthRank}(v) + \gamma \cdot \text{Degree}(v)$$ Function implementations outside the active focus are dynamically pruned to interfaces and type signatures, mathematically guaranteeing optimal token compression: $$R_{\text{efficiency}} = 1 - \frac{\sum_{i=1}^{k} \text{tokens}(S_i)}{\sum_{j=1}^{N} \text{tokens}(F_j)} \ge 65\%$$

  2. Deterministic 5-Tier Policy Sandbox: Every tool call, filesystem modification, and shell command is intercepted by our deterministic policy validator before touching disk:

    • ALLOW: Read-only, safe operations.
    • MONITOR: Non-destructive writes with audit logs.
    • REQUIRE_APPROVAL: Destructive actions (deletions, network requests) generate interactive inline approval cards requiring human authorization.
    • DENY: Dangerous shell commands (rm -rf, format, credential exfiltration) are instantly terminated.
    • QUARANTINE: Untrusted code execution is isolated.

  3. Closed-Loop Self-Healing Critic: If a generated patch fails unit tests, Nexora captures the stderr traceback, analyzes the failing line numbers, and initiates an autonomous self-healing iteration loop without human intervention until tests pass.

  4. Cryptographic SHA-256 Audit Hash Chain: Every agent state transition, tool execution, and diff is hashed into an immutable cryptographic ledger: $$H_t = \text{SHA-256}(H_{t-1} \parallel \text{EventData}_t \parallel \text{Timestamp})$$ Any post-hoc tampering with logs or history breaks the verification chain immediately.

  5. Adaptive Nemotron Model Routing: Dynamically routes tasks based on AST complexity to the ideal NVIDIA model tier (Nemotron Ultra for complex refactoring, Nemotron Super for standard features, and Nemotron Nano for fast inline queries).

  6. Zero-Build, Pure Vanilla Web IDE: A dual-pane developer workspace with split and unified diff viewers, syntax highlighting, and multi-format file support (ZIP, PDF, DOCX, code files) running on modern ES6 modules with zero npm install or node build steps required.

How we built it

  • AI Inference Core: Powered by NVIDIA Nemotron via Nebius Token Factory OpenAI-compatible APIs, achieving high token throughput and rapid multi-step reasoning.
  • Backend Architecture: Built with Python 3.10+ and FastAPI, backed by an asynchronous embedded SQLite database using SQLAlchemy and aiosqlite managing 18 relational schema entities.
  • State Machine & Orchestrator: Implemented an asynchronous Finite State Machine (FSM) managing task initialization, AST symbol pruning, prompt generation, tool dispatching, test execution, and self-healing loops.
  • Frontend Workspace: Pure HTML5, Vanilla CSS, and modern JavaScript modules featuring Server-Sent Events (SSE) streaming, KaTeX LaTeX math rendering, and accessible Dark/Light design systems.
  • Security & Policy Layer: Declarative YAML policy engine (policies.yaml) with deterministic regex and path validation.

Challenges we ran into

  • Granular AST Parsing Without Bloat: Building a language-agnostic AST visitor that extracts call graphs and strips docstrings/internal logic without breaking syntactic validity required extensive testing across Python, JavaScript, and systems code.
  • Real-Time Visual Diff Alignment: Rendering clean side-by-side Git diffs with synchronized scrolling and line-number gutters without depending on heavy third-party packages required engineering our own lightweight diff reconciliation algorithm.
  • Safe Subprocess Execution: Creating a reliable Windows and Linux process isolation layer that intercepts shell commands and prevents port-locking or zombie processes under heavy testing.

Accomplishments that we're proud of

  • 65%+ Measured Token Reduction: Consistently halved token consumption compared to standard file-dump agents while maintaining 100% accuracy on code synthesis tasks.
  • Autonomous Bug Diagnosis: Demonstrated the critic loop fixing its own unit test assertion errors within 2 self-healing cycles.
  • Turnkey 60-Second Setup: Created a single-click launcher (run_project.bat / shell script) that cleans ports, checks Python virtual environments, migrates the database, seeds Nemotron models, and opens the browser in under 60 seconds.
  • Rock-Solid Test Coverage: Backed by 37 comprehensive frontend unit tests and rigorous backend pytest suites.

What we learned

  • How to harness the deep reasoning of NVIDIA Nemotron models through Nebius Token Factory for reliable multi-step software synthesis.
  • That deterministic sandboxing and policy controls are not just nice-to-haves they are the prerequisite for real-world enterprise AI coding adoption.
  • How topological AST graph pruning radically outperforms generic vector similarity search for code context retrieval.

What's next for Nexora

  • Multi-Agent Swarm Mode: Orchestrating specialized Nemotron agent roles (Lead Architect, Core Coder, Security Auditor, and QA Tester) collaborating in parallel.
  • MicroVM Container Isolation: Integrating Firecracker microVMs and Docker backends for multi-tenant cloud execution.
  • Direct CI/CD Integration: Packaging Nexora as a native GitHub Action / GitLab CI pipeline step that automatically intercepts failing PR tests and pushes self-healed pull requests.

Built With

Share this project:

Updates

Submission history