Product

Everything the gate can do.

Deterministic secret scan across the tree, the PR diff, and git history. Muse triages after a failure. Muse cannot clear the check.

The gate

No LLM on the critical path. Offline rules decide Pass or Fail.

Scans current files for known secret shapes before they ever reach a PR.

Three-dot diff scan. A secret introduced on the branch fails the check.

Deleted keys still count. Removed lines and commit messages are in scope.

Base64 and friends, plus id+secret pairs that only look live together.

.sentinelignore can quiet a path, a rule, or a rule on a path — never a silent pass.

Shallow clones and git errors fail the gate. fetch-depth: 0 is required in CI.

At most two calls after a fail: Spark labels, Wonder explains live and unclear hits.

likely_live, likely_example, likely_fixture, or unclear — after the gate already failed.

why_live, blast radius, revoke runbook, redacted fix patch, filter-repo purge hint.

Only for samples and fixtures. Live and unclear hits never get an ignore line.

At most two model calls. Contributor models refused. Masked input only.

Same rules wherever you run them.

This site. Public repo, PR, or commit → Pass or Fail.

Scan the GitHub tab you already have open.

node src/cli.js — exit 1 means the merge should stop.

Fails the check and updates one PR comment.

Same gate locally. Muse off by default.

Advisory authorship notes. Never blocks the merge.