AI Code Needs More Than Static Analysis — Verifying Intent Is the

The proposal. Sonar's Guitar is a code verification agent for teams overwhelmed by AI-generated PRs. The workshop demo uses a Python ticketing API (orders.py, checkin.py) across three scenarios: out-of-the-box review catches that a buyer can refund a ticket after transferring it to a friend—a business logic error. Then business rules enforce an all-in pricing policy via .gitar/review files. Finally, auto-merge is enabled after Guitar diagnoses a CI test failure (ticket scanned twice returns 200).

Why now. AI coding agents create a review bottleneck and more incidents. Guitar analyzes diffs, PR descriptions, CI logs, and project conventions stored in .gitar directories. In the demo, the refund bug was invisible in the diff—it required knowing how cancellations work elsewhere. The presenters argue that only context-aware tools can keep up with agentic volume.

The trade-off. Guitar's effectiveness depends on teams writing and maintaining project-specific rules. The pricing rule required a .gitar/rules file that flags customer-facing price fields. Without such setup, out-of-the-box reviews catch generic issues but miss business intent. Auto-fix and auto-merge grant write access to the repo, which carries risk if the tool's diagnosis is wrong or introduces side effects.

What's missing. The demo runs on a clean toy app with deterministic CI. Real-world failures involve flaky tests, infrastructure noise, and multi-repo dependencies. Cross-repo and cross-PR analysis are name-dropped but not demonstrated. The knowledge feature learns from reviewer feedback weighted by seniority, which could reinforce team blind spots.

The take for leaders. Evaluate Guitar as an automation layer for well-defined rules and common edge cases, not a human review replacement. Auto-merge should wait until your test suite is reliable and you have observed Guitar's output on real PRs. A 14-day trial on a non-critical repo is the right starting point.