Ship code you can prove works

Sentinel reviews, tests and verifies every change against the exact commit you intend to merge.

Start free See a verified PR Read the docs ↗

No training on your private code. Cloud or self-hosted.

Actual output · rule-pack 1.1.0

A verdict, not a comment

This is what Sentinel prints. One decision, bound to one commit, every finding anchored to a file and line.

# sentinel review --pr 42 — exit 1 HEAD a3f9c1d (verified: base main@9be201c unchanged since review start) DO NOT SHIP — 2 findings 1. [security] Unauthenticated DELETE route — routes/admin.mjs:41 Rule: auth-required-routes. Evidence: no auth middleware on DELETE /admin/purge. 2. [reliability] Migration without rollback — db/migrate_014.sql Rule: migration-rollback-required. Evidence: no DOWN block. 4 checks passed: secrets-scan, lockfile-consistency, test-status, diff-size.
Maturity: prototype — CLI v0.1 ships free for public repos. The GitHub App, sandbox verification runners and signed receipts are roadmap, not product. Nothing here claims otherwise.
How it works

Reviewed is not verified

Review finds what looks wrong. Verification proves what holds. Only both together earn a verdict — always on the exact HEAD.

Change→Review→Findings→Verification→Evidence→Verdict

Exact-head binding

Every verdict names the commit it verified. A new push invalidates it — exit 2 STALE, never a silent approval of moved code.

Deterministic rules

20-rule pack, versioned and pinned. Same diff plus same pack gives the byte-identical verdict — reproducible in audits.

Machine surfaces

Human, JSON, SARIF 2.1.0 and governance verdict formats. Exit codes gate CI: 0 pass, 1 fail, 2 re-run.

Trust

Read-only by construction

The CLI performs zero writes: no comments, no checks, no commits, no account. Verdicts go to stdout and a local receipt ledger you own.

# local-first: no GitHub needed git diff | sentinel review --diff - --repo myorg/myrepo