BOLT PostCode Control Plane

Inspiration

AI post-code automation should accelerate releases without taking production authority away from humans. BOLT PostCode Control Plane is a standalone seven-stage supervised GitLab CI prototype.

What it does

This project models seven DevSecOps stages: verify → package → secure → release → configure → monitor → govern. The configuration uses a manually gated production authorization stage: a release cannot pass through that boundary automatically. A Node.js policy classifier marks production deployment, destructive operations, secrets and credential changes for review.

Unlike the separate BOLT Release Guardian entry (a release risk-verdict and audit-report utility), PostCode focuses on the multi-stage CI lifecycle with a manual production gate and downstream monitoring/governance evidence.

How it was built

Created from scratch during the GitLab Life After Code competition using GitLab CI/CD, Node.js and a custom GitLab Duo flow configuration in .gitlab/duo/flows/release-guardian.yml. The repository includes source, GitLab CI configuration, evidence fixtures, MIT license, README and tests. The current pipeline has passed the initial automated stages; its overall Blocked status is expected because the production authorization gate is manual and has not been approved.

Verification

Public GitLab code: https://gitlab.com/hello1645/bolt-postcode-control-plane

Local reproduction:

• npm test — 5 policy tests passed.
• npm run evidence — generates the deterministic workflow evidence JSON.
• The GitLab CI pipeline defines the seven stages and the manual production approval boundary.
• No secrets, protected Unfire BOLT source code or live production deployment are included.

Challenges and limitations

Separating mechanical pipeline automation from consequential approval is the central design problem. This prototype does not claim production certification or a successful autonomous deployment. The custom Duo flow is configured in source; any richer autonomous session execution is future work, not claimed as demonstrated here.

Next steps

Add live security feeds, stronger artifact provenance, authenticated approval records, and expanded GitLab Duo workflow integration.

Path: Start Fresh. Autonomy: Supervised. Author: Omar Baró / Unfire.

PostCode-specific live demo

Watch this seven-stage project running in a 54-second recording. The recording shows five passing policy tests, generated workflow evidence and the public GitLab pipeline. The production approval gate remains intentionally manual.

Built With

• ai-agents
• automation
• ci/cd
• devsecops
• gitlab
• gitlab-duo
• governance
• node.js