SENTINEL — Proactive Risk Intelligence for GitLab Repositories

Track

Showcase Track (+ Contribute Track if MRs are merged)

The Problem

Every team has the same blind spots.

A function called by 12 modules with zero test coverage. A pipeline that's been failing silently for nine days. Dead code that three developers are still reviewing, refactoring, and maintaining — not knowing it's called by no one.

These aren't edge cases. They're the hidden risks that live in every active codebase, invisible until something breaks in production.

Existing tools are reactive. They wait for a merge request, then comment. But the worst risks never announce themselves — they accumulate quietly between PRs, in the gaps that no reviewer ever sees.

The developer pain point: Nobody is watching the whole repository, all the time, for the risks that don't show up in a diff.

SENTINEL was built to fix that.

The Solution: SENTINEL

SENTINEL is a proactive AI agent system built on the GitLab Duo Agent Platform, powered by GitLab Orbit.

It runs automatically every Monday at 9am and hunts for hidden risks across your entire codebase — before they become incidents.

Five specialized agents, one weekly flow, zero manual triggers:

sentinel-hunter — finds untested high-dependency functions. If a function is called by many modules and has no test coverage, that's a risk hiding in plain sight.
sentinel-silence — detects abandoned failing pipelines. A pipeline that's been red for days with no owner comment is a signal something is wrong and nobody noticed.
sentinel-ghost — hunts dead code still being actively maintained. Code with zero call sites that developers are still touching wastes review cycles and creates confusion.
sentinel-reporter — compiles all findings into a structured weekly digest, surfaced to the team.
sentinel-router — orchestrates the other agents, routes findings by severity, and ensures nothing is double-counted.

What changes for the developer: Instead of discovering a critical untested function when it breaks in production, they get a Monday morning report. Instead of a failing pipeline rotting for two weeks unnoticed, it gets flagged on day one. Instead of three developers maintaining code nobody calls, the ghost is named.

SENTINEL doesn't replace code review. It watches what code review can't see.

How It Was Built

SENTINEL is built entirely on the GitLab Duo Agent Platform using GitLab Orbit as its source of truth.

GitLab Orbit's structured, queryable knowledge graph is what makes SENTINEL possible. Without Orbit, an agent looking for "untested high-dependency functions" would need to parse raw source files and infer call graphs from scratch. With Orbit, the dependency relationships, call sites, test linkages, and pipeline states are already structured and queryable — SENTINEL's agents can ask precise questions and get precise answers.

Architecture: Architecture: Each agent uses Orbit's Query Graph tool with specific query types:

sentinel-hunter runs an aggregation query on the Definition entity, groups by fqn, counts callers, sorts by caller_count DESC, then traverses File → Definition → caller Definition filtered by test file paths to cross-reference coverage. sentinel-silence runs an aggregation query on the Pipeline entity filtered by status: failed, then traverses Project → Pipeline → Job to surface failure reasons and timestamps. sentinel-ghost runs an aggregation query on Definition filtered to zero callers, then traverses MergeRequest → MergeRequestDiff → MergeRequestDiffFile to find recent maintenance activity on dead code paths. sentinel-reporter receives structured findings from all three agents and applies a deterministic scoring rubric: each untested high-fan-in function adds 15 points, each abandoned pipeline adds 20, each maintained ghost file adds 10. Health score = 100 minus total. Score 0-29 = HEALTHY. 30-59 = AT RISK. 60-100 = CRITICAL. sentinel-router classifies every incoming trigger and dispatches agents in the correct order, preventing duplicate scans and circular loops. Tech stack:

GitLab Duo Agent Platform (agents + flows)
GitLab Orbit (knowledge graph API)
GitLab CI/CD (28 passing tests, green pipeline)
GitLab Pages (live dashboard)
MIT License

Repository: https://gitlab.com/gitlab-hackathon3573825/sentinel
Live dashboard: https://nexus-0ace7a.gitlab.io/

What's Next

Slack / email digest — send the Monday report directly to the team channel
Severity thresholds — configurable rules per repo (e.g. flag any function with 5+ dependents and 0 coverage)
Trend tracking — week-over-week: are risks growing or shrinking?
sentinel-dependency — a sixth agent to flag circular dependencies and version drift
AI Catalog publishing — make SENTINEL available as a reusable agent for any GitLab project

Why SENTINEL Is Different

Every other hackathon submission reacts to merge requests.

SENTINEL runs proactively, on a schedule, watching the whole repository. It uses GitLab Orbit not as a lookup tool but as a reasoning substrate — the agents don't just query for file names, they reason about relationships: which functions matter most, which failures have gone unacknowledged longest, which code is costing the team effort it shouldn't.

The result is a system that catches what no individual reviewer can: the risks that accumulate in the space between pull requests.

Contribution track

As part of the Contribute Track, I submitted a merge request to GitLab Orbit to expand Bash/Shell code graph fixture coverage. The contribution adds additional edge-case tests covering quoted imports, exported functions, aliases, ignored comments, ordinary commands, and heredoc handling.

The merge request experienced pipeline limitations because the fork exhausted its available compute minutes, and the contribution remains under review. The submitted changes focus on improving Bash parser regression coverage and reducing false positives in Orbit's code graph extraction.

MR: https://gitlab.com/gitlab-org/orbit/knowledge-graph/-/merge_requests/1878