See the impact. Before you merge.

Aroxion traces flight-software changes across mission forks,
showing what lands, what diverges, and where to look next.

Explore the pilot See a sample report

C/C+++GitRuns locallyRead-only

Sample reportBaselineSCN-07

Synthetic data View CLI output

Mission impact

8 missions3 flagged5 take the change

KESTREL

PROVEN

Silent override

This mission owns its implementation.

comms/uhf.c:41uhf_beacon

38/**39 * Emit the periodic health beacon.40 */41int uhf_beacon(void)42{43    int rc = FSW_OK;44    uint8_t frame[32];4546    rc = pkt_encode(frame, (uint16_t)sizeof(frame), frame);47    if (rc != FSW_OK) {48        return rc;49    }50    rc = reg_write32(HW_REG_BASE + 0x144u, (uint32_t)UHF_BEACON_PERIOD_S);51    if (rc != FSW_OK) {52        return rc;53    }5455    return rc;56}

The patch also edits a shared header.
Review the additional exposure.

Read the evidence

Illustrative report viewer · synthetic mission data

Follow one baseline change

SCN-07 / UHF beacon retry

Changed symbol: uhf_beacon
File: comms/uhf.c

Satellite mission software

VIREO Change lands INFERRED
CINDER Config differs PROVEN
KESTREL Function overridden PROVEN

3 of 8 mission forks shown · synthetic data

KESTREL / SILENT OVERRIDE

PROVEN

uhf_beacon
comms/uhf.c:41
Override since 47e1b5d233f6

The change to this function will not take effect here.

Shared-header exposure still requires review.

A clean merge can still miss a mission.

KESTREL runs its own version of the function. Aroxion shows where the baseline change stops and why.

Explore the finding

Four outcomes

Every mission is a fork. Every fork drifts.

You fix a bug in the baseline. Which missions does the fix actually reach? Checking means comparing every fork by hand, on every change, so it rarely gets done.

SCN-07 / UHF beacon retry

NIMBUSbranched at r11:LandsINFERRED
VIREObranched at r10:LandsINFERRED
CINDERbranched at r9:Config divergencePROVEN
TESSERAbranched at r7:LandsINFERRED
MERIDIANbranched at r6:LandsINFERRED
HALCYONbranched at r4:Call reachINFERRED
KESTRELbranched at r3:Silent overridePROVEN
AURORAbranched at r2:LandsINFERRED

One baseline, r0 to r11. Eight mission forks, each branched at a different commit. One proposed change, four different answers. Synthetic data

It lands

The fork still runs the baseline’s version, so the change takes effect.

5 of 8AURORA, MERIDIAN, NIMBUS,
TESSERA, VIREO
Silent override

The fork wrote its own version long ago, so the change does nothing there.

1 of 8KESTREL
Config divergence

Same code, different defines. The change runs with values nobody tested it against.

1 of 8CINDER
Call reach

The fork never touches the changed function, but code it does run depends on it.

1 of 8HALCYON

Only the first is what everyone assumes. The second looks exactly like success.

How it works

Point it at your repos. Get a verdict per mission.

C/C++ flight software in Git, with history.
Runs from the command line.

01

Find each fork’s branch point.

Every verdict is measured from where that mission branched, not from today’s baseline tip.

KESTREL branched at r3HALCYON branched at r4CINDER branched at r9
02

Model every copy.

Each function, each define, and which files pull in which.

fn uhf_beacondefine UHF_BEACON_PERIOD_Sinclude config/mission_config.h
03

Trace the proposed change.

Into each fork, then sort it into one of the four outcomes.

HALCYON 1 hopsched_tick -> uhf_beaconcore/scheduler.c:74
04

Report, and say how sure it is.

Each finding is proven or inferred, and anything it can’t see is listed.

[+] PROVEN KESTREL[:] inferred HALCYONCOVERAGE LIMIT

What a verdict means for the reviewer

Synthetic data

Verdict	What it means	What the reviewer does	In SCN-07
Lands	Runs the baseline’s version, so the change takes effect.	Normal review.	5 missions
Silent override	Has its own version; the patch does nothing there.	Decide whether the fix is needed in the fork’s own version.	KESTREL
Config divergence	Same code, different define values.	Check the change against this mission’s values.	CINDER
Call reach	Doesn’t touch the changed function, but reaches it through calls or includes.	Review the indirect path.	HALCYON
Exposure	Has its own version, but it depends on a header this change also edits.	Look by hand. The tool won’t promise either way.	KESTREL

Know what’s proven. See what still needs review.

PROVEN/Source evidence
INFERRED/Reachability-dependent
COVERAGE LIMIT/Review required

Your reviewers stay in control. Your source stays on your machine.

CLI outputSCN-07-uhf-beacon-retry.patch

Synthetic data

fsw-analyse review --baseline repos/root-fsw --forks repos/fork-* \ --patch scenarios/SCN-07-uhf-beacon-retry.patch --manifest fleet-manifest.json

BLAST RADIUS  SCN-07-uhf-beacon-retry.patch
==============================================================================
1 MISSION BLOCKS uhf_beacon   (exposed: header also edited)
3 of 8 mission branches flagged   4 vehicles declared   (3 operational, 1 commissioning)
5 take the change cleanly   0 out of scope   2 PROVEN / 8 inferred findings
1 mission carries a second mechanism (1 additional finding)

Changed symbol   uhf_beacon
Config changed   UHF_BEACON_PERIOD_S

  [+] PROVEN    decidable from the source and the build files
  [:] inferred  depends on reachability, which rests on the entry-point set

[+] PROVEN    OVERRIDE - the change to this symbol will not take effect here  (1)
  [+] PROVEN   KESTREL   rev 16cab22
  [+]          deliberate since 47e1b5d233f6
  [+]          Confirm whether this override is affected by the rest of the
  [+]          change: it includes config/mission_config.h, which this patch
  [+]          edits. The change to uhf_beacon itself does not reach this
  [+]          mission, but that is not the same as the patch having no effect
  [+]          here.
  [+]          COVERAGE LIMIT - this tool does not analyse what a changed
  [+]          header or helper does to a fork's own definition; it reports
  [+]          only that the patch touched one
  [+]          comms/uhf.c:41
  [+]          also 1 finding on this mission:
  [+]            [:] config: UHF_BEACON_PERIOD_S pinned at 10 here, baseline 30

[:] inferred  DIVERGED CALLER - the change lands near code this mission owns  (1)
  [:] inferred HALCYON   rev 033ba79
  [:]          1 hop: sched_tick -> uhf_beacon
  [:]          core/scheduler.c:74

[+] PROVEN    CONFIG DIVERGENCE - the code lands, the value differs  (1)
  [+] PROVEN   CINDER    rev 079241f
  [+]          override_blocks_change: this mission pins the key
  [+]            UHF_BEACON_PERIOD_S is 60 here, baseline 30
  [+]          config/mission_config.h:8
  [+]          uhf_beacon takes the change here

[:] inferred  TAKES THE CHANGE CLEANLY  (5)
    AURORA, MERIDIAN, NIMBUS, TESSERA, VIREO
    The change lands and applies. Behaviour on these missions does change.

DECLARED   what an engineer recorded, not what this tool checked
  declared by engineer@operator.example on 2026-09-12T04:00:00Z
  KESTREL   rev 16cab22   release-12u   UHF-rev-B
            Kestrel-2A (NWA-12U-2020-0512, operational)
            Kestrel-2B (NWA-12U-2021-0559, commissioning)
  HALCYON   rev 033ba79   release-6u   THM-rev-B
            Halcyon-3 (NWA-6U-2021-0631, operational)
  CINDER    rev 079241f   release-3u   EPS-rev-D
            Cinder-1 (NWA-3U-2023-0801, operational)

5 finding(s) have a full explanation. Add --detail.

Synthetic data. The pilot is where it meets yours.

What you get back

Real output from our test codebase: a synthetic baseline, eight mission forks, answers planted in advance.

PROVEN
Certain, not guessing. The code plainly shows it.
deliberate since
The fork chose this. It isn’t just out of date.
COVERAGE LIMIT
Where it can’t see, it says so.
DECLARED
What an engineer recorded, not what this tool checked.

Why you can trust it

It shows its working.

It doesn’t decide anything. It tells your reviewers exactly where to look.

Proven or inferred.

Every finding says which. A verdict that rests on reachability is never dressed up as a certainty.
Blind spots listed.

If it can’t analyse something, the report says so, on the finding it affects.
Tested against planted answers.

Including decoys built to catch it over-flagging.
Runs on your machine.

Your source never leaves your network. It reads only, and never writes to your repositories.
Reads code, not the spacecraft.

It works on source before merge, nowhere near the command path.
No migration.

It sits beside your Git workflow. Try it on one change, drop it any time.

01Your baseline and mission forks
02A few recent code changes
03A report of what we caught, missed and why

Start with your satellite software.

A focused three-week pilot on your own repositories.

Book a 30-minute call

Validated on synthetic code so far. The pilot is where it meets yours.

We’re taking on a small number of spacecraft teams as pilot partners. Fixed scope, fixed fee, three weeks.

You give

A clone of your baseline and mission forks, with history, on a machine you control.
A few recent baseline changes.
An hour with whoever owns flight-software configuration.

You get

A per-mission impact report on those changes.
A readout of what it caught, what it missed, and why.
A real say in what gets built next.

Next on the roadmap

Sign-off routed to each affected mission’s owner.
A run on every merge request in GitLab or GitHub.

Three straight answers

Has it run on real flight software?: Not yet. That’s what the pilot is for.
Where does our code go?: Nowhere. It runs on your machine.
What does it need?: C/C++ in Git, with history back to where each fork branched.

About

Who’s building this

Aroxion was founded by Felix Cherrey, in Australia, following extensive conversations with spacecraft operators and manufacturers.

AroxionAustralia

Founder: Felix Cherrey
Email: felix@aroxion.com
LinkedIn: LinkedIn

Book a 30-minute call

See the impact. Before you merge.

Mission impact

Silent override

Follow one baseline change

KESTREL / SILENT OVERRIDE

A clean merge can still miss a mission.

It lands

Silent override

Config divergence

Call reach

Find each fork’s branch point.

Model every copy.

Trace the proposed change.

Report, and say how sure it is.

What a verdict means for the reviewer

Know what’s proven. See what still needs review.

What you get back

Proven or inferred.

Blind spots listed.

Tested against planted answers.

Runs on your machine.

Reads code, not the spacecraft.

No migration.

Start with your satellite software.

You give

You get

Next on the roadmap

Three straight answers

Who’s building this