$3.50 was the price of a missed business rule and three pull requests were the test harness Taylor Luttrell-Williams and Kilian Carlsen-Phelan used on AI Engineer to show Sonar's Gitar verifying AI-generated code. The pair ran a browser-only workshop, with a 14-day free trial of Gitar per Luttrell-Williams and three staged PRs per Carlsen-Phelan against a Python ticketing API, to argue that review must handle intent, not just syntax. No pricing, false-positive rate or fix rate was disclosed in the session. Not financial advice. Markets move fast.
The point was intent, not syntax.
Luttrell-Williams said teams face a fixed headcount and a rising volume of agent-written changes, which creates a review bottleneck and, she argued, more production incidents when agents ignore architecture and standards. She positioned Gitar as a code change verification agent that minimizes false positives to improve fix rate and cut token expense, diagnoses CI failures separately from flaky infrastructure noise, iterates until changes pass CI, and surfaces analytics for speed and quality. She said it complements SonarQube by using PR diffs, comments, CI logs and project-specific instructions and rules, and lets teams choose levels of automation including auto-fix and auto-merge.
Carlsen-Phelan walked through Box Office, a sample Python app with orders.py for purchase and cancel and checkin.py for QR entry, where tests run on every PR. The first PR added transfer-a-ticket logic with validation and green tests, but Gitar flagged that a buyer could still refund and void a ticket after giving it away, an edge case in orders.py not visible in the diff. He said a reviewer would need working knowledge of cancellation logic to spot it, and that static analysis like SonarQube can trace a SQL injection across 20 files yet cannot infer business intent from titles and descriptions. The fix ships via an Apply fix button or a Guitar fix comment, he said, with Gitar adding a commit and reverifying blindly at no extra cost per PR.
The second PR added a $3.50 service fee per Luttrell-Williams, which violated an all-in pricing rule stored in .gitar/review and enforced by .gitar/rules that fire when pricing files change. Carlsen-Phelan said users can load any number of markdown files into a review directory for steering and can define rules that trigger on criteria, for example checking a Slack link pasted in a PR description against the code. Gitar surfaced the rule violation alongside the engineering finding, he showed, and the third exercise enabled full pipeline automation through GitHub Apps, branch rule sets and required status checks for test before auto-merge.
Gitar is a Sonar product that can be purchased separately and sits after Sonar Vortex in the Agent Centric Development Cycle, where teams start with the agentic loop for Vortex then move to CI verification and maintenance loops, according to Sonar docs. That places Gitar beside SonarQube for deterministic security and reliability checks and beside Vortex for agent-side guidance, rather than as a standalone reviewer. The session gave no token cost per review, no latency for iterative fixes, and no comparative false-positive data against human reviewers or other AI reviewers. A disclosed fix rate and time to green would change the read. The open question the numbers leave is whether context-heavy verification can scale at agentic volume without reintroducing the noise and cost it claims to remove.
