ChangeGate ReleaseProof

Turn GitLab CI results into a reviewable release-evidence report showing what passed, what failed, and what still needs human approval.

Comment

Inspiration

A successful CI job answers only part of a release question. A reviewer still needs to know whether the evidence belongs to the intended source, which checks completed, what findings remain, and what action was authorized.

ChangeGate ReleaseProof makes those distinctions visible through a working evidence checker, a bounded GitLab Duo workflow and an inspectable human handoff.

What it does

The browser application opens supported GitLab QC receipts, compares project and source identities with expected values, displays command outcomes and downloads a review. Wrong-source evidence is rejected, unresolved audit findings stay visible, and editing inputs clears stale conclusions. Receipt review happens locally in the browser; opening the site does not invoke a model or start a pipeline.

A separate reusable GitLab Duo Agent Platform flow performs actual post-code work: inspect an identified checkout, propose a fixed preservation action, pause at a Human Input gate and retain the outcome. In the accepted v1.2.0 executions:

Reject stopped without executing the preservation action. Modify returned to a second gate while retaining the original inspection. Approve then restored the original inspection in fresh CI and produced PRESERVATION_PASSED, exit 0.

These controls were operated by Codex under the owner's authorization. We do not claim independent manual owner clicks or autonomous release authority. The application does not deploy, promote or roll back a release.

GitLab and AI after code

This entry follows Path B: Bring Your Own — Assisted. GitLab provides source history, native validation pipelines and the real Duo workflow. Deterministic browser comparisons are distinct from the recorded model executions.

The accepted Reject session is 9774493. The accepted Modify/Approve session is 9774658, with preservation job 17328025110 in pipeline 2969094592. Earlier recorded Duo analyses remain available with their original inputs, dates and human-review caveats. Historical session 9402921 interpreted real transferred QC evidence; the separate synthetic example retains a warning about invented identifiers in recommended lookups.

The work touches verification, security-evidence review and governed action approval. Release-related review means evidence preparation for a human decision; it is not a claim of an executed release or rollback.

What we added for Path B

The original MIT-licensed ChangeGate project is a browser-local synthetic refund/authority simulator: https://github.com/febert0001-tech/changegate-webmcp

The October work adds ReleaseProof reporting and labelled failure demonstrations, GitLab-native QC receipts, the working evidence checker, retained real Duo interpretation, the reusable approval/action flow with fresh-workspace restoration, and a separately verified public deployment. Original attribution and historical execution identities remain intact. The repository's change memo documents the new work.

How we built and checked it

The application uses Next.js, React, TypeScript and Node.js. GitLab CI produces execution evidence; Duo supplies the separate agent workflow. Codex assisted implementation, tests, provider operations and documentation within owner-authorized scope.

CI activation and security repairs are merged in MRs !9 and !10. Repair source d05b2e68b455b7cb5180419038efbed902c2ac7a was merged as 96dd1c0097e39a1d8e8a4a2fc870b539b56a8421. Native MR pipeline 2985074982 and main push pipeline 2985079095 passed. Their required SAST, historic secret detection and full/production dependency audits have complete coverage and zero untriaged findings after a documented, rule-specific SAST false-positive review. Unsafe static controls separately verify that the filesystem and dynamic-regex rules remain active. No global rule or assessment verdict was relaxed. Zod is pinned to 4.6.6 and Vitest/@vitest/mocker to 4.1.12. Current CI runs all 1,133 ReleaseProof regression tests in addition to the application checks. Successful pipelines are now required before merge; skipped pipelines are not accepted.

The live judge preview still has verified upload source 02deb058f206fd19661db2229e5c2c232f1e9b9a. It is not a deployment of the later repaired repository tree. Its recorded security example intentionally preserves the historical audit's five High development-package records and zero production records. That historical result remains distinct from today's repaired repository audit, which reports zero. Earlier validation source 6f53b0e8bfb4bbb163440ddafc1d0b1f9ae023d4 and pipeline 2969620924 retain their original scope; new CI does not rewrite them or rerun the accepted Duo flow. The earlier exact, expiring dependency-mitigation policy remains historical and cannot be inherited by the changed current checkout.

Try the working app

The approved simple interface is available without an account: https://changegate-releaseproof-contest-20261020-hm8v03ex6.vercel.app/releaseproof

Select Run recorded example. The historical security audit returns Needs attention. Select View evidence. Inspect the recorded full-audit exit 1, production-audit exit 0, command arguments, source identity and decision trace. While still in View evidence, select Save result. The exported review keeps release_authorized and deployment_authorized false. Then return to summary. Open Change example or use your own file. Select the contracts or hosted record and run the review. For the bundled historical receipts, retain expected project 87476475 and source b22333d3b432a252f1f75966eb529ad509767d21. Change only the expected source to forty lowercase a characters. The old result clears; the next review reports a source mismatch. Select Compare versions. Try Different versions, Missing source, Matching values and Different targets. These are labelled synthetic examples. Matching values still require human review. Open AI recordings to inspect the original recorded analysis, supplied inputs and human-review caveats.

The approved simple interface was introduced in b66cea68c4cd634d92f059aaf273f93ed35722db. The documentation/license correction e9ca19f0236dad1c4b76f8fa73fce0909b7a8095 is included in merged MR !6. The one-line keyboard-focus repair 02deb058f206fd19661db2229e5c2c232f1e9b9a is included in merged MR !7. The current judge-documentation correction is merged MR !8: https://gitlab.com/midtown-intelligence-labs-group1/midtown-intelligence-labs-project/-/merge_requests/8

The current preview source was checked against all 251 files of reviewed 02 source before upload: 250 were unchanged from e9 and only the focus repair differed. Independent QA Wolf Chromium checks on this exact preview verified keyboard focus across audit and comparison mode switches, explicit and repeated runs, inspector entry and return. Earlier e9 verification recorded 28 anonymous successful responses, 22 source-byte-matched public assets and the completed 771-byte audit-review download, with release_authorized and deployment_authorized false. Those earlier export and asset checks remain historical observations; no new export or full QA rerun is claimed for 02. These are bounded checks, not full cross-browser or accessibility acceptance. Earlier skipped MR pipelines remain historical. The separately identified October 24 repair and main application pipelines passed; they do not establish a new deployment of this preview or a new Assisted Duo run.

Accessibility improvements

We simplified the interface to reduce visual clutter and make the review sequence easier to follow. We also improved keyboard navigation: running a review moves focus to its result heading, switching between audit and comparison modes keeps focus on the selected mode button, and opening or leaving the evidence inspector moves focus to the relevant heading. These changes help people who navigate without a mouse keep their place. Independent QA Wolf Chromium testing verified these specific focus paths on the current judge preview. Full screen-reader testing and broader accessibility conformance have not been established.

The original ChangeGate WebMCP use case supplies the design foundation for explicit agent and human authority boundaries. This ReleaseProof recorded-example button runs a local deterministic evidence check; it does not invoke WebMCP, start Duo, authorize a release or execute a deployment.

Public GitLab source and run instructions: https://gitlab.com/midtown-intelligence-labs-group1/midtown-intelligence-labs-project

Current verified repaired-main pipeline: https://gitlab.com/midtown-intelligence-labs-group1/midtown-intelligence-labs-project/-/pipelines/2985079095

Bundled receipts describe historical executions, not the current repository or a fresh run caused by opening the app.

Challenges and what we learned

Wrong-source packets, incomplete records and stale results are meaningful failures when they stay visible. A passed process, retained finding and human authorization are different facts. Preserving those differences makes the handoff useful.

A local receipt does not authenticate its provider or verify every referenced artifact/log byte. The accepted session/job result was observed, but the original producer record files and child stdout bytes for that Duo run were not acquired. Replay protection is per workspace. Matching supplied values is not signed source attestation or proof of a live deployment.

Draft readiness

The approved interface and focus repair are hosted, MRs !6 through !10 are merged, current application CI is active and passing, and the saved project link and Path B deployed-project answer point to the tested 02 preview. The later dependency/security repair is not yet deployed at that preview URL. The owner's contribution-rights confirmation is recorded. Final asset-use review, truthful owner declarations, the required public demo video and the final entry freeze remain unfinished. Direct historical artifact access limitations remain disclosed. Video remains the final production step. This project portfolio is public; the Life After Code contest entry remains a draft.

Built With

Share this project:

Updates