AIZOYA ReleaseProof

Investigate failed CI with GitLab Duo, inspect proposed corrections, and rerun checks. ReleaseProof helps humans review candidate evidence while preserving failures and unresolved risks.

Comment

Inspiration

A passing pipeline answers whether configured checks passed. Release owners still need to understand which candidate was checked, what failed previously, what changed, and which evidence is missing. ReleaseProof explores how AI-assisted corrections and deterministic evidence checks can support that human decision.

What it does

ReleaseProof combines an assisted GitLab correction demonstration with a local evidence-review prototype. In our actual GitLab demonstration, a deliberately introduced arithmetic regression failed a required test. GitLab Duo investigated that failed pipeline and proposed two targeted suggestions. We inspected and applied them, then launched fresh CI on the corrected commit. All four jobs passed, including 151 Python tests.

The separate local workbench uses synthetic data to demonstrate exact candidate and requirements checks, retained blocked observations, comparisons, and a downloadable non-authorizing review receipt. It does not yet automatically load the live demonstration's CI artifacts. Missing evidence remains visible; ready for review is not production approval.

The public site at https://releaseproof.aizoya.com is a separate browser-only demonstration with synthetic scenarios. It does not ingest live GitLab evidence, record a human approval, certify compliance, or authorize deployment.

The passing pipeline below applies to commit 562d643851fa9f70edf4c542f28869055d64ffd0; it is historical evidence, not a passing result for current main f0858b3464d5a9636e7a46eea0319aa8ec5b1def. The Duo session may require GitLab sign-in.

How we built it

Python implements the evaluator, read-only GitLab evidence collector, local HTTP service and narrow AST scan. SQLite stores review history. HTML, CSS and JavaScript provide the browser workbench. Python unittest and Node.js tests exercise the behavior. GitLab CI prepares artifacts and runs required test/security jobs. GitLab Duo Agent Platform's native Fix CI/CD Pipeline flow performed the live investigation and posted suggestions on the existing merge request. The repository is public and GitLab detects its MIT license.

Challenges

We treated stale, missing, mismatched and unauthenticated evidence as distinct from verified release readiness. We hardened receipt exports and preserved earlier blocked records through local recovery. The native agent sandbox reported additional full-suite failures; we did not count its own summary as proof. Fresh GitLab CI supplied the independent 151-test result. CI artifacts still need a current byte-verified collection into the saved release packet.

Accomplishments

One actual failed-pipeline → native Duo investigation → inspected suggestions → applied correction → fresh passing-CI sequence is retained for inspection. The correction restored only the arithmetic line and matching source digest; tests and CI were unchanged. Public main now contains the source, MIT license and a clean-source launch command. A clean 39-file local copy passed its 38 manifest checks and launched successfully.

What we learned

Agent proposals, passing tests, evidence provenance and human authority are different claims. Keeping them distinct makes failures useful and prevents an attractive success screen from becoming an unsupported release approval. We win or we learn.

What's next

Bind fresh CI artifact bytes into the persisted review packet, add genuine Code Review evidence, and complete the connected user journey. A commercial pilot additionally needs authentication, tenant isolation, operational controls and customer validation. No customer adoption, measured savings or commercial readiness is claimed.

Execution evidence

Built With

Share this project:

Updates

posted an update —

AIZOYA ReleaseProof now has an interactive demo that explores a critical release question: does the evidence belong to the exact commit under review?

The demo shows how mismatched or missing evidence can block review. We also documented a real GitLab Duo investigation of a deliberately introduced pipeline failure, followed by a human-reviewed correction and a passing pipeline on the corrected commit.

The browser demo uses synthetic data and does not record approval or authorize deployment.

Try it: https://releaseproof.aizoya.com

We win or we learn.

Log in or sign up for Devpost to join the conversation.

Submission history