Checkout Release Recovery

• 

  Website

Inspiration

A green pipeline can still ship the wrong business result. A $100 order with 20% off and 10% tax should cost $88. Our seeded checkout defect charged $90 while basic checks missed it. Small SaaS teams need a way to catch these semantic failures and review AI repairs with evidence.

What it does

Checkout Release Recovery connects business-rule canaries, custom GitLab Duo flows, draft repair merge requests and an independent verifier. The agent proposes a repair; separate owner-controlled CI challenges the exact commit before a human reviews it.

The public Cloud Run challenge lets judges enter their own checkout and refund inputs, run eight fresh HTTP cases, compare results with independent browser arithmetic and download a receipt. No sign-in is needed. This visitor interaction tests live calculators; it does not launch an agent or mutate a release.

How I built it

Three custom Duo flows investigate isolated incident branches, add regressions, repair one permitted function and publish draft MRs. A separate private GitLab project supplies trusted target policy and validates the actual MR base and head. Each Docker stage uses a fresh read-only source mount, no network, a non-root user and resource limits.

Verification requires a regression that fails before and passes after, preservation of existing tests and contracts, independent cases, source fingerprints and adversarial checks. Those checks include boundaries, fresh random inputs, mathematical relations, determinism and known-answer shortcut detection. Python powers the service and verifier; JavaScript BigInt supplies the separate browser calculator. The application is MIT-licensed and deployed on Google Cloud Run.

The most important result: a real repair was rejected

Duo generated slug MR !9. Its new regression passed after the patch, but slugify(" Hello World", 5) returned "hell" instead of "hello". Independent Docker CI rejected the exact published commit, and a separate isolated probe reproduced the counterexample. The rejected MR is preserved unchanged.

A second and final Duo attempt produced separate MR !10. It passed 131 independent function cases and all nine adversarial groups. The checkout repair passed 131 pricing cases; the refund repair passed 132. Both also passed all nine groups. These are three seeded incident demonstrations, not a general agent success rate.

Challenges and lessons

Fail-before/pass-after alone is insufficient: a patch can satisfy the reported example and remain wrong elsewhere. Candidate tests must not rewrite the next verification stage, and agent-controlled code must not control the acceptance policy. Fresh read-only stages, independent ownership and evidence bound to exact Git SHAs make those boundaries inspectable. Finite testing still cannot prove correctness or compensate for a wrong reference oracle.

What is working and what remains

All 162 local tests passed. Fourteen public demo checks passed. An hourly GitLab canary is active; its first scheduled run passed 55 fresh semantic HTTP probes. All three released flow definitions match the repository.

The project is supervised: no agent repair MR has been merged or deployed. The cloud rollback drill and product deployment were operator actions. Required independent merge enforcement remains unconfigured because it needs a Maintainer; a passing private pipeline does not itself block a merge. Public JSON snapshots expose the relevant results without granting access to the private validator.

Try it and inspect the evidence

Live challenge: https://checkout-release-recovery-16890129443.us-central1.run.app/#challenge Judge guide: https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43176085/showcase/-/blob/submission-source-2026-10-26/docs/judge-guide.md Source and evidence: https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43176085/showcase/-/tree/submission-source-2026-10-26 Accepted repairs: MRs !2, !5 and !10. Actual rejected repair: MR !9.

What is next

Enforce the independent result as a required merge check, validate more independently specified functions, and expand incident coverage before considering production repair promotion.

Built With

• agent
• build
• ci/cd
• css
• docker
• duo
• gitlab
• google-cloud
• googlecloudbuild
• googlecloudregistry
• html
• javascript
• python
• run
• sqlite