Holdline

Inspiration

A merge request can look green even after its head changes. Reviewers need a clear answer to whether the required checks ran on the revision now under review.

What Holdline does

Holdline is a supervised GitLab Duo custom flow for that decision. When mentioned on a merge request, it reads the current head SHA, matching pipeline, and pipeline jobs. A deterministic Python checker returns ACCEPT only when a successful pipeline for that exact SHA contains passed test and fixture_gate jobs. Missing, failed, unfinished, or stale evidence returns HOLD. The flow rechecks the head before posting its decision as a merge-request note. A person still decides whether to merge; Holdline does not approve, merge, deploy, or perform a security review.

How we built it

The public MIT-licensed repository contains the Duo flow definition, a Python 3.10+ checker, a GitLab CI pipeline, unit tests, and three reproducible snapshots. GitLab CI runs test and fixture_gate. The live Duo flow gathers GitLab evidence, passes a JSON snapshot to the checker, and posts the resulting note.

Evidence and challenges

On October 26, a live Duo session in a private trial-group fork completed and posted ACCEPT on a draft merge request at head dd9219210a2c1219392a86c466b988961ad0e8d4. Its matching pipeline passed both required jobs. The public source merge request and pipeline show the same revision and checks. The private Duo session is shown in the demo; its direct links require trial-group access.

Local tests and synthetic fixtures exercise the other branches: a current green snapshot returns ACCEPT, while stale-green and current-failed snapshots return HOLD. Those HOLD cases are fixture results, not claimed live Duo runs. The main challenge was binding a decision to the exact revision and checking again before publishing it, so an old green result cannot clear a new push.

What we learned and what's next

An agent's note is useful when its claim is narrow and reproducible. Holdline currently checks revision-bound CI evidence. Future work could add richer obligation and security checks, plus a live HOLD demonstration, with each new claim backed by its own evidence.

Source and reproduction: https://gitlab.com/instagrim/holdline Public run note: https://gitlab.com/instagrim/holdline/-/blob/main/evidence/first-duo-run.md