When CI goes red or a prod alert fires, someone has to read the stack trace, find the bug, write a fix, and hope it's right. That's slow, and handing the job to an AI agent outright is risky: a headless agent given free rein can read secrets, hit the network, or edit the failing test to fake a green build. Sentinel closes that gap. An agent proposes the fix, but nothing ships on the agent's word alone: - **Fail-to-pass gate** — the agent must write a new test that reproduces the bug, watch it fail on the base commit, then fix `src/` until it (and the full suite) pass. No new failing test in the diff, no PR. - **Agent firewall** — policy hooks block the agent from touching existing tests, secrets, protected paths, or the network, regardless of what the agent decides to try. - **Diff guards** — every write is scanned for leaked secrets before it lands, on top of the gate.
Category tags: