PR Detonator

PR Detonator is a GitHub App that runs a pull request's npm install in a disposable, kernel-traced sandbox before the merge, then blocks the merge if what the code did doesn't match what the pull request claimed. It records every process, TCP connection and DNS lookup with eBPF. Nineteen deterministic rules set a severity floor. Meta's Muse Spark predicts the expected behavior beforehand and explains the observed behavior afterward. The result is a merge-gating check run plus an inline comment on the exact line responsible, with every piece of evidence verified against the kernel record. It fails closed: anything it couldn't fully observe is "Could not verify," never "Clean."