execution evidence for code review
The runtime reviewfor your PRs
AI is creating more PRs, but reviewers still only see the code changes, not what happened when the code ran.
Garnet records what ran during execution and attaches that record directly to the PR you already review.
Review faster. Trust your PRs. Merge with confidence.
D
dev-sarah pushed 1 commit 12 minutes agoAdd rate limiter to /api/auth
c91fa03
coding-agent pushed 1 commit 3 minutes ago
Update dependency lockfile
Verifiede7b42d1
garnetbotcommented 2 min ago
coding-agent introduced a new outbound connection in the
build-and-test workflow at 4f7a2c1.47 processes · 4 connections · 123 files
PROCESS LINEAGE
Runner.Worker
└─ bash
├─ bash
│ └─ curl
+ │ scan.aquasecurtiy.org
├─ entrypoint.sh
│ └─ trivy
+ │ check.trivy.dev
└─ python3.12
+ boundary.dfinity.network
+ td tqy-oyaaa-aaaaa-af2dq-cai.raw.icp0.io
How it works
One step. Record and review every run.
Your existing code review, now with execution context from every job — no new tools, no dashboards.
- 01
Add Garnet
One workflow step attaches our eBPF sensor to the runner, recording every process, connection, and file.
No GitHub Actions? Install the Garnet GitHub App — no workflow edits→+3 −0.github/workflows/ci.yml
steps:- uses: actions/checkout@v4+ - uses: garnet-org/action@v2+ with:+ api_token: ${{ secrets.GARNET_API_TOKEN }} - 02
Run normally
Your tests, builds, installs, publish jobs, and agent workflows run as usual.
Ddev-sarah pushed to feat/rate-limiterSome checks pending
2 in progress, 1 successful
- build-and-test4m 02s
- Garnet Runtime Review
- publish
≤2% CPU · no proxy · no code change
- 03
Review the Run Profile
Each run becomes a Run Profile — what ran, what it touched, where it connected. Surfaced as pass, attention, or fail in GitHub, Slack, and where you work.
garnetbotcommented just nowattentionRun Profile ready on build-and-test #4823 — 1 new egress flagged
5 runtime checks passedView Run Profile →one record · same context on every surface
“There are a lot of tools that process security advisory data, but Garnet is the first I’ve seen that goes a step further, applying behavioral analysis to find issues before they get reported to an advisory database. This is the kind of thing we’d always wanted to do at npm, Inc., but never got around to.”
Isaac Z. SchlueterCreator of npmThe primitive
A record of what ran.
A Run Profile turns each CI job or agent session into a structured, deterministic record of execution: what ran, what touched files, what connected out, and what changed.
codex agent · run 26240047565per-run behavioral record
Runner.Worker:1
bash:12
xargs:48
docker:63
ghcr.io
codex:30
api.openai.com
garnet-labs/garnet-agentic-harness-poc · codex · 2026-05-21
Lineage
Process lineage
Which step spawned which binary, down to the syscall.
Network
Network egress
Every outbound connection, attributed to the process that made it.
Files
File access
What was read, what was written, and which process touched it.
Checks
Runtime checks
What matched baseline, what changed, and what deserves review.
evidence from real runs
Click any card to view the full profile.
A new runtime sensor, built from ground up
Kernel-level evidence, for modern development
npmpipai
ci · harness · k8s
jibril · recording
linux kernel
- What you runyour code · dependencies · agents
- Where it runsGitHub Actions · agent harness · K8s
- Garnetrecords every process, file touch, and connection
- Kernelground truth
Overhead
Under 2% CPU
No sidecars, no proxies, no build-time dependencies.
Capture
Deep context, in-kernel
Process ancestry, network egress, and file access, all at the syscall boundary.
Output
One profile per run
A run-bounded record. Not a firehose of events.
Built for ephemeral CI and agentic engineering.
Making execution observable
For modern teams and agentic software.
Supply chain
Dependencies pulled by agents and CI.
Process-level attribution for every postinstall script and transitive dependency.
postinstall · npm · actions · transitive depsCI execution
Every workflow. Every run.
A Run Profile on every pipeline that holds a credential or touches production.
build · test · release · publishAgentic workflows
Harnesses you can’t see inside.
The transcript says intent. The Run Profile says what happened.
agent harnesses · MCP · sandboxesIR evidence
Minutes, not weeks.
Records already tied to the commit, actor, and workflow.
incident response · forensics · auditRecord every run.Merge with confidence.
One primitive, everywhere your code runs. Start with GitHub Actions. Review your next run before you merge.