Remediation

Finding creation and security scans are read-only. Remediation is a separate, stateful workflow that records the proposal, reviewer decision, draft pull request, verification, and any failure.

1. 01

   Proposal

   The agent writes a fix proposal — SQL, or exact file contents — against the finding. Nothing is written to your database or repository at this stage.
2. 02

   Awaiting approval

   The proposal parks in an approval queue with its diff, its blast radius, and the finding it closes. Sensitive actions cannot skip this queue.
3. 03

   Human approval

   A reviewer on your side approves or rejects. Approval is recorded with who approved it and when.
4. 04

   Draft PR only

   On approval Sentrail opens a draft pull request on its own branch. It re-checks the base commit first and aborts if the branch moved underneath it.
5. 05

   You merge

   Sentrail never merges. Every change lands through your normal review and CI, and the re-verification scan runs after the merge you performed.

• Confirm the proposal is attached to the intended finding and repository.
• Read every proposed file path and full replacement content or diff.
• Check the stated blast radius, risks, and verification plan.
• Verify no credential or secret value appears in the proposed content.
• Confirm the recorded base commit is still the commit you intend to change.
• Reject with a reason when the proposal is incomplete or overly broad.

After approval, Sentrail checks the repository's current default-branch commit against the proposal's base SHA. If they differ, the remediation fails closed and asks for a fresh proposal. If they match, Sentrail creates a dedicated branch, writes the approved files, and opens a draft pull request.

Once your team merges or otherwise applies the fix, run the relevant check again. Verification moves the remediation toward resolved only when the underlying finding is resolved. If the finding remains open, the workflow stays in verification pending.