Killian Carlsen-Phelan of Sonar presents an 18-minute AI Engineer talk on putting project guidance and repeatable code checks inside a coding agent’s working loop.

Give the agent a map before it writes

  • A fresh session must discover the project’s conventions, architecture rules, and approved libraries.
  • Searching the repository costs time and tokens, and copying existing code can repeat existing mistakes.
  • Sonar Vortex supplies project guidelines and a map of code relationships through agent plugins, command-line tools, or MCP, the standard for connecting agents to tools.
  • It reuses context from SonarQube scans already running in continuous integration, the pipeline that builds and checks changes.

Check edits while the agent still owns the task

  • Edit hooks trigger quick checks as files change; a deeper check covers cross-file data flow before the agent finishes.
  • Findings return to the agent so it can repair the change and run the checks again.
  • The recorded example reports six findings: two on newly written lines and four in existing code.
  • Carlsen-Phelan describes requiring fixes to new issues while surfacing older findings for awareness.

A passing test misses the permission rule

  • The task unzips a log into a reusable temporary file and adds a test proving that reuse.
  • The checker flags temporary-file handling with insufficiently explicit permissions.
  • Claude’s first repair still fails the rule, so the loop continues to another repair.
  • Carlsen-Phelan says the first attempt relies on owner-only Java defaults on Mac and Linux; the project’s policy requires explicit permissions.
  • The walkthrough is a paused recording from the previous night, despite the description calling it a live session.

Separate a repeatable check from a safety guarantee

  • SonarQube’s algorithmic checks produce repeatable findings; Carlsen-Phelan positions them alongside AI review and existing pipeline checks.
  • Sonar reports 36% fewer tokens and 44% fewer production outages, without presenting the study design or comparison groups here.
  • His survey figures are 96% lacking full trust in AI-generated code and 48% fully verifying it, from over 1,100 developers.
  • The demonstrated result is a repair loop enforcing one security rule; broad coverage and the reported savings need separate evaluation.

“We want to guide the agent and verify the change.” — Killian Carlsen-Phelan, 8:01