> ## Documentation Index
> Fetch the complete documentation index at: https://docs.patch.gg/llms.txt
> Use this file to discover all available pages before exploring further.

# Review

> How a release gets from submitted to live: file checks, a test on your PC, your agent's review and Patch's review.

Every release is reviewed before players get it, and almost all of it is automatic. Follow a release with `GET /projects/{owner}/{slug}/releases/{version}/review`: it returns the release's status, a sentence on what happens next, every check with its findings, and its newest test.

**1. File checks**

When you submit, Patch checks your files: no secrets (keys, tokens, `.env` files), sizes and file types, and for a browser game, nothing loaded from or sent to another host.

**2. A test on your PC (browser games)**

Start a test with `POST .../releases/{version}/tests`. Patch Desktop on your PC plays the game as players get it, twice, in a window of its own, without touching your mouse or keyboard, and records a frame every 2 seconds.

**3. Your agent's review**

Your coding agent looks at the recording and says whether the game starts and can be played, whether it does anything harmful, and which moments it saw.

**4. Patch's review**

Patch reviews it on its side. A browser game that passes goes live by itself. A mod then waits for a person at Patch to approve it.

## Statuses

| `status` | Means |
| - | - |
| `draft` | Created; upload its files and submit it |
| `checking` | Its files are being checked |
| `testing` | A browser game waiting for a test on your PC to pass |
| `cloud_review` | Patch is reviewing it |
| `in_review` | A mod waiting for a staff member |
| `published` | Live |
| `rejected` | Something blocked it. Its findings say what to fix; submit a new version. |

## Findings

Each finding has a `rule_id`, a `severity` (`blocking`, `warning` or `info`), the `path` it's about, a `message`, and a `suggestion` saying what to change. Any blocking finding rejects the release.

| Rule | What it catches |
| - | - |
| `PA-110` | A browser game over 500 MB |
| `PA-111` | A native program (`.exe`, `.dll`…) in a browser game |
| `PA-120` | A file that holds secrets by its nature, such as `.env`, an SSH key or a `.git` folder |
| `PA-121` | A key or token pasted into a file |
| `PA-122` | A path in a zip to unpack that would land outside its folder |
| `PA-123` | A component to unpack that isn't a zip that opens |
| `PA-130` | A browser game loading from or sending to another host |
| `PA-140` | A mapping that places nothing from its zip, such as a folder written without its `/` |
| `PA-201` | A check that failed while the game was tested on your PC |
| `PA-210` | Your agent's review didn't pass it |
| `PA-211` | Your agent's review found it does something harmful |

## The test

A test has 2 runs of the recipe's `test.minutes` (1 minute unless your [recipe](https://docs.patch.gg/recipe.md) says otherwise). Each run checks that the files scan clean with Windows Defender, the page loads, it throws no errors, the picture isn't blank, it keeps responding to input, it reaches no other host, and it's still running at the end. If your recipe lists `test.checks`, your game reports each one: Patch opens it with `?patch-test=1`, and it logs `pass <name>` or `fail <name>: why` on the console.

Patch Desktop records each run as contact sheets: JPEGs of frames, each labelled with its run time. `GET /tests/{id}/footage` lists them.

## The review

Send it with `POST /tests/{id}/review` once the test is `recorded`:

```json theme={null}
{
  "verdict": "pass",
  "plays": true,
  "harmful": false,
  "summary": "A square follows the mouse around a dark field; it starts at once and keeps up.",
  "moments": [
    { "run": 1, "at": "00:04", "saw": "The square appears in the middle" },
    { "run": 2, "at": "00:31", "saw": "The square follows the pointer to the corner" }
  ]
}
```

Cite at least two moments, at least one from every run, each with the time on a frame you looked at. A review that doesn't is refused with `review_refused` and the details of what to fix, and the test waits for another.

`harmful` means it sends players' data elsewhere, mines cryptocurrency, phishes or collects credentials, misleads players, or shows content Patch doesn't allow.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.