Inspiration
AI coding is making code generation dramatically faster, but release trust is not scaling at the same rate. The bottleneck moves downstream: teams can produce changes faster than humans can safely validate, secure, deploy, and recover them.
We built BABYDOV Release Sentinel around one question: what would a truly hands-off release agent need to prove before it is allowed to touch production?
What it does
Release Sentinel takes over the post-code DevSecOps path inside GitLab. It gathers and verifies release evidence, calculates risk, confidence, blast radius, and an explicit autonomy budget, then chooses one of three outcomes:
- GO — required evidence is intact and the release is safe enough for autonomous promotion.
- HOLD — evidence, safety, or autonomy requirements are not satisfied.
- ROLLBACK — production verification failed and the previously proven release must be restored.
A release cannot GO if mandatory evidence is missing, the evidence ledger is corrupt, the canary is unhealthy, or rollback has not already been proven.
Path B provenance
This is a Bring Your Own / Hands-off submission built around the pre-existing MIT-licensed open-source project PlugShip Preflight:
Original MIT project: https://github.com/williamleewilliam1-star/plugship-preflight
The imported snapshot is commit 630c12d233351e4d76faabb1fb3dc42d8b39896e from September 28, 2026, before the Life After Code submission period. The provenance is machine-readable in path_b_origin.json and documented in docs/PATH_B_PROVENANCE.md.
The new work created for Life After Code is the GitLab/Duo post-code automation layer, deterministic release authority, evidence pipeline, canary, rollback rehearsal, adversarial safety fleet, production promotion/recovery, attestation, and public deployment.
Deployed application: https://babydov-release-sentinel-e52f53.gitlab.io/app/
GitLab Duo Agent Platform
The repository defines a GitLab Duo Agent Platform custom Flow Registry v1 flow at .gitlab/duo/flows/release-sentinel.yml.
The flow separates agentic reasoning from release authority:
- Evidence Inspector runs the real release workflow and adversarial safety fleet.
- Independent Release Governor executes
scripts/duo_verify_release.py; its deterministic JSON and exit code are authoritative. - Release Receipt Reporter presents the verified decision and evidence.
AGENTS.md and the project Agent Skill constrain the agentic layer. A model can inspect, coordinate, and explain evidence, but it cannot talk itself into shipping after a failed security, canary, integrity, or rollback check.
Live GitLab Duo evidence run
GitLab contributor onboarding is approved and the live custom flow is provisioned as BABYDOV Release Sentinel v1.1.0 with mention/assignment triggers.
For judge evidence, the real GitLab Duo Agent Platform flow ran against main in session 9064174 and finished successfully:
The live session:
- ran
./scripts/local_demo.sh; - ran the 2,000,000-episode adversarial safety fleet;
- read the real release report, promotion state, fleet evidence, and attestation;
- independently executed
python scripts/duo_verify_release.py; - returned deterministic GO with authority PASS;
- verified unsafe_go=0, missed_rollback=0, threshold_violations=0;
- verified the SHA-256 evidence ledger and healthy production outcome;
- modified no source code, thresholds, policy, or evidence.
This is the live Agent Platform execution of the same fail-closed contract described in the repository—not a mocked screenshot or an offline-only design.
How it works
GitLab is the control plane for the complete post-code workflow:
tests → provenance → SAST → secret scan → dependency inventory → SBOM → build → canary → rollback rehearsal → 2M adversarial stress → release decision → autonomous promotion → production verification → attestation → GitLab Pages evidence dashboard
The implementation directly touches seven validated DevSecOps lifecycle stages: verify, package, secure, release, configure, monitor, and govern.
GitLab CI/CD DAG dependencies carry evidence across the graph, artifacts preserve proofs, environments expose canary/production state, resource_group serializes production writes, and GitLab Pages publishes the public receipt.
Why it is different
Most CI systems answer: did the pipeline pass?
Release Sentinel asks: is the whole release sufficiently evidenced for autonomous action, and can I prove recovery before I ship?
Key ideas:
- autonomy as a measurable budget, not a binary switch;
- rollback proof as a prerequisite, not an incident-time hope;
- tamper-evident SHA-256 evidence attached to every autonomous decision;
- prompt-injection isolation at the DevSecOps tool boundary;
- automatic restore if post-deploy verification fails;
- an independent deterministic authority beneath the agent layer;
- a public judge-facing evidence dashboard.
Safety validation
The current repository passes 19/19 deterministic safety, integrity, provenance, and Duo-flow tests.
We also ran a deterministic adversarial fleet of 2,000,000 release-agent episodes:
- 0 unsafe GO decisions
- 0 missed rollbacks
- 0 threshold violations
- 1,497,341 autonomous HOLD decisions
- 500,013 autonomous ROLLBACK decisions
The final GitLab pipeline is green end-to-end. A separate judge-triggerable rollback drill forces a production verification failure, requires the system to return ROLLBACK, restores the previous artifact byte-for-byte, smoke-tests it, and finishes healthy.
Challenges
The hardest design problem was avoiding the common trap where a “hands-off” agent simply becomes an agent that always acts. We needed autonomy to be conditional, auditable, reversible, and impossible for an LLM or untrusted tool output to override.
The second challenge was proving rollback before production instead of merely implementing a rollback command. Release Sentinel rehearses the promotion-and-restore path before real promotion is authorized.
Accomplishments
- 19/19 deterministic tests passing
- 2,000,000 adversarial release-agent episodes
- 0 unsafe GO / 0 missed rollback / 0 threshold violations
- fully green GitLab post-code pipeline
- successful judge-triggerable rollback drill
- live deployed Path B application
- public evidence dashboard
- SHA-256 evidence ledger and final attestation bundle
- GitLab Duo custom flow with an independent fail-closed governor
- automatic production verification and recovery
What we learned
Hands-off automation should not mean removing judgment. It means turning judgment into explicit policy and evidence so the agent can act safely without waiting for a human on every routine release.
Judge links
GitLab repository: https://gitlab.com/babydov-life-after-code/babydov-release-sentinel
Live evidence dashboard: https://babydov-release-sentinel-e52f53.gitlab.io/
Deployed application: https://babydov-release-sentinel-e52f53.gitlab.io/app/
Original MIT project: https://github.com/williamleewilliam1-star/plugship-preflight
Final green pipeline: https://gitlab.com/babydov-life-after-code/babydov-release-sentinel/-/pipelines/2916658299
Rollback drill: https://gitlab.com/babydov-life-after-code/babydov-release-sentinel/-/jobs/16960503368
58-second demo: https://youtu.be/6d7QBKYO29I
What's next
Next we would add deployment-provider adapters, richer SLSA-style provenance, policy profiles per environment, historical calibration of the autonomy budget, and additional Duo triggers for issue- and merge-request-driven releases.
Built With
- agentic-devsecops
- ai-agents
- automation
- cyclonedx
- devops
- gitlab
- gitlab-ci/cd
- gitlab-duo-agent-platform
- gitlab-duo-flow
- gitlab-pages
- python
- security
- sha-256
Log in or sign up for Devpost to join the conversation.