Abhiverse — Life After Code

Abhiverse — Life After Code: Duo agents around a real device ecosystem

The problem. You are in the market. Your laptop is at home. You need a file from it, or to see its screen. The existing answers are closed gardens (Apple Continuity, Phone Link), subscriptions (AnyDesk, TeamViewer), or same-Wi-Fi-only tools (LocalSend). Nothing open, cross-device, anywhere, without an account.

The project. Abhiverse is an open-source personal device ecosystem: an Android controller app (Flutter), a Windows laptop agent (Rust), and a Rust/Axum coordination API. Devices identify by Ed25519 keys, never passwords. Pairing needs approval on the target device. Revocation is instant and kills live sessions. No trackers, no account, no subscription. It existed before this hackathon (v0.5.4, MIT, https://github.com/MSAbhishek22/AbhiVerse) with GitHub CI across Rust, Windows, Flutter, and Android.

What GitLab Duo changed (built 26 Oct 2026, inside the submission period). Before, everything after the code was manual: planning sat in issues, review depended on whoever was awake, broken pipelines waited for a human to read logs, security findings waited for triage, releases were hand-written notes, config drifted silently, and nobody re-checked production. After, five Duo flows carry it, at Supervised autonomy — agents propose and open merge requests, humans merge and deploy, always:

Plan: a new issue becomes a scoped plan that respects the security invariants.
Review: every merge request is reviewed against per-path rules; its one question is whether a change can weaken a security invariant (unsigned requests, pairing without approval, revocation that does not end sessions, new permissions, telemetry).
Fix: a failed pipeline becomes the smallest fix merge request — never by weakening a security test.
Secure: secret-detection, semgrep, cargo-audit, and trivy findings are triaged by reachability; nothing is dismissed by the agent.
Release: after deploy, the live service is checked (/health plus a nonsense path) and a release summary is posted; drift and 6-hourly monitor checks keep watch after that.

The deterministic pipeline (12 jobs, 7 stages) is configured with free tooling only; the deploy job is manual on purpose. The project website is live at https://msabhishek22.github.io/AbhiVerse/ ; the coordination API itself is not yet deployed (Cloud Run deploy pending GCP setup). Pipeline execution itself is currently blocked by GitLab account identity verification — the pipeline record showing this block is public on the repo.

Stages covered. Plan, create, verify, package, secure, release, configure, monitor, govern.

Honest limits. No live API deployment is claimed (the website above is live; the API is not). Duo flow execution needs AI Catalog access; on a plain free account the flows are defined, validated, and ready, and the pipeline configuration is the evidence — its jobs cannot execute until GitLab account identity verification completes. The real-device run (WebRTC media on physical hardware) is still pending, as documented in the repo — nothing here claims otherwise. Contributor registration: reactivated 26 Oct 2026 via onboarding issue #4948, approval pending at submission time; repo public MIT regardless.