Constitutional Sentinel

Inspiration

AI coding assistants can generate merge requests quickly, but they do not understand an organization's security rules, compliance boundaries, or separation-of-duties policies. That creates a governance gap inside GitLab workflows.

What it does

Constitutional Sentinel is a GitLab merge request governance agent powered by ACGS-Lite. It validates AI-assisted code and workflow actions against constitutional rules before they take effect. It inspects diffs, flags violating lines inline, generates a governance summary with risk score and constitutional hash, blocks unsafe merges, and preserves tamper-evident audit records.

Key features

• MACI separation of powers: Proposer, Validator, Executor
• Optional Rust/PyO3 fast path for performance-sensitive validation
• 9 regulatory frameworks covered with 125 checklist items, 72 auto-populated
• 5-tier escalation and context-aware risk scoring
• 11 integration surfaces across GitLab, CI/CD, MCP, and deployment paths
• Tamper-evident constitutional hash: 608508a9bd224290

How we built it

We built the project on ACGS-Lite, a Python governance engine with an optional Rust/PyO3 validation path. Rules are defined in portable YAML constitutions with IDs, severities, categories, keywords, and optional regex patterns. The GitLab-facing layer handles merge request events, diff extraction, per-line validation, inline comments, governance summaries, and merge or pipeline gating. The demo is packaged as a stateless container for Google Cloud Run with optional Cloud Logging export.

Challenges

The hardest parts were balancing precision with speed, mapping findings back to exact diff lines for inline comments, and keeping constitutional hashing reproducible so governance decisions can be audited later.

What we learned

Governance for AI-generated code works best when it is structural, not advisory. Inline MR feedback is more useful than detached reports, and separation of powers matters for agent workflows just as much as it does for human institutions.

Validation

• python -m pytest packages/acgs-lite/tests/test_hackathon_evals.py -v --import-mode=importlib
• 30/30 hackathon evals passed

Why it matters

AI systems are increasingly writing code, making decisions, and triggering workflows without understanding compliance boundaries. Constitutional Sentinel adds the missing governance layer so risky behavior can be constrained, audited, and reviewed before it reaches production.

Built With

• acgs-lite
• gitlab-api
• gitlab-ci-cd
• google-cloud-logging
• google-cloud-run
• mcp
• pyo3
• python-3.11+
• rust
• starlette
• uvicorn
• yaml