Auto-remediation

Each stage is a recorded event on the case, with its own clock. The pipeline rail on the AI incidents case detail draws the journey from those records, so what you see is what happened, not a diagram of what should have.

  sense (repo)  ----+
                    +--> triage --> scope --> build --> verify --> APPROVE --> ship --> learn
  sense (prod)  ----+                                              (you)

• Sense, twice. Repo findings come from the detectors that already watch your sessions and config. Production errors arrive through a Sentry connection with its own credentialed flow: the token lives in your local data directory, never in the first-run intake, and a fresh connect backfills 30 days. Repeated sightings of one issue fold into one case rather than opening hundreds.
• Triage. A case opens by rule, carries a severity, and traces its causal chain (deploy, commit, session, author) with the confidence band that produced each hop.
• Scope. The scoper writes a build brief for cents: root cause, the files to touch, what done means, what is out of scope, and the estimated cost. A finding it cannot ground gets a recorded decline with the reason, never a guess.
• Build. An agent session takes the brief as its whole contract and opens a pull request on its own branch, auto-merge off. The PR body carries the case, the chain, the brief, and the drafted lesson, so a reviewer needs no other tab.
• Verify. The five-check bar below. A fix that misses a check goes back to the builder once with the failure attached, then stops loudly and lands on Today as a finding with its attempts.
• Approve. The only stage a human owns. Covered in full on the approval queue.
• Ship and learn. Approval squash-merges the PR, writes the lesson from the brief's done-means, and arms the guard that blocks the introducing mistake. The prevention ledger counts what the guard catches from then on, and the shipped card says so only when a catch is actually recorded.

The builder's contract is the brief's done-means and nothing else. At dispatch, the brief's named files are frozen onto the build record. At verify, a changed file passes only when the brief named it or it is a new test file; anything else fails verification with the files named in the reason. That is what keeps an agentic builder from quietly widening a one-line fix into a refactor.

The brief also carries what the fix cannot do. An out-of-repo step (rotating a leaked key, replaying dropped webhook events) is named as yours on the approval card, never implied handled.

• Builds, in a throwaway worktree on the PR's branch.
• Tests pass, in the same worktree.
• A new regression test, proved both ways. It passes on the fix and fails when grafted onto the introducing commit. A test that only passes proves nothing about the bug.
• The guard replays against the introducing commit and blocks it.
• The PR's own CI is green, read from the checks API. Pending CI defers the verdict rather than spending the one retry on a clock.

Every Session Signals detector family enters this loop like a production error, and its identity travels the whole way: the case, the brief, the PR body, and the approval card all carry the detector family and its OWASP LLM Top 10 category, read from the one coverage matrix the Session Signals page describes. Where two cures exist, the approval card offers the one that fails closed, and says so. A category the detectors do not cover at your capture tier is named on the Today rail and the first-run handoff, never implied clean.

• Nothing merges on its own. Approve is a person, every time. There is no setting that changes this.
• Builds start from the policy's bounds, not from ambition. Sense, triage and scope always run at cents. Build spend is bounded by a severity floor and a daily dollar cap, and today a build starts from your explicit Build-it or Scope-only click, or from the build routine working already-dispatched jobs.
• Until Sentry is connected, the loop runs on repo findings alone, and the queue says so. An empty production lane is not a claim that production is clean.
• A fix that fails twice stops. It lands on Today as a finding with both attempts attached, never a silent retry loop.

• Approval queue: the human gate, the policy that bounds unattended work, and what approve and reject each do.
• AI incident response: the case lifecycle and playbooks this loop builds on.
• Today: the queue the loop reports to.
• Security: the trust boundaries and the detector families behind the sense stage.