DeployGuard: Multi-Agent PR Security Gate

DeployGuard turns code review from a human bottleneck into an autonomous, auditable team. When a pull request opens, a GitHub webhook spins up a Band chat room where five specialist AI agents collaborate through @mentions, each with one job: ScanAgent runs lint, tests, and dependency checks; SecurityAgent runs a deep vulnerability and secrets scan; RiskAgent computes a weighted risk score; DeployAgent fires the real deployment only if the change is approved; and ReportAgent posts the full audit trail. A critical finding blocks the deployment, posts a CRITICAL comment with the exact file and line, and escalates to the on-call engineer in the same chat, where they can reply APPROVE or REJECT. This is not one LLM with a long prompt; it is five independent Band identities with their own tools and prompts, handing off like a real review team. The agents also review one another: RiskAgent independently cross-checks SecurityAgent's verdict and, when a security-sensitive change was only passed, challenges it back for a re-scan, so the change must clear a consensus check before it can deploy. What makes it reliable is that every security-critical decision is produced by deterministic code, not the model's judgment. The CRITICAL block comment, the risk score, the audit report, and repository resolution all come from tools, so outcomes stay consistent even on small open-source models. The system fails closed: if it cannot inspect a change, it escalates for manual review instead of approving it. DeployGuard is built on Band for multi-agent orchestration and Featherless for the language models, together with LangGraph, FastAPI, and GitHub Actions, and it is deployed live on Railway so that real pull requests automatically trigger the chain. Remove Band and the chain collapses, because DeployAgent never receives its green light. Next steps include a GitHub App for multi-repository review, richer risk signals, and larger orchestration models.