EmojiBot AI

AI emojiBot chat on Cloud Run with an autonomous 9-stage DevSecOps pipeline using GitLab Duo flows, MCP client probes, and keyless OIDC supervised deployment

Comment

Inspiration

Modern chat applications are static, while standalone AI chatbots remain isolated, one-on-one experiences. We wanted to build a social, real-time communication platform where AI acts as an active, context-aware family or friend member within group conversations—communicating through the universal, expressive visual language of emojis.

However, shipping real-time foundation model applications to production introduces serious operational overhead: coordinating schema contracts, blocking secret leaks, validating latency Service Level Objectives (SLOs), managing cloud infrastructure costs, and verifying environmental footprints. Manual gatekeeping slows delivery to a crawl, while uncontrolled automation risks hallucinated code, broken pipelines, or prompt injections.

We were inspired to build an end-to-end Supervised Post-Code Lifecycle Guardian using the GitLab Duo Agent Platform and Model Context Protocol (MCP). Our goal was to prove that autonomous agents can orchestrate all nine DevSecOps stages—from initial issue planning to zero-trust Google Cloud deployment—while keeping the human engineer firmly in the loop to review and approve production releases.

What it does

EmojiGroup Chat is an interactive, real-time social application backed by an autonomous 9-stage post-code lifecycle delivery engine:

  1. 🔑 5-Digit PIN Group Rooms: Users can create private group rooms, generate a random 5-digit PIN, and share it with friends and family to join instant WebSocket-synchronized chat sessions.
  2. 🤖 Context-Aware AI Group Member: Powered by Google Cloud Vertex AI (gemini-2.5-flash), the AI participates directly inside the group chat. It maintains a rolling buffer of conversation history, recognizes active participants by handle, asks engaging follow-up questions, and drives group consensus.
  3. ✨ Dual-Directional Emoji Translation: Every message sent by a user is translated into a sequence of semantic emojis in real time, while the AI responds in both expressive emoji strings and natural conversational prose.
  4. 🎮 Interactive Stone-Paper-Scissors Arena (🪨📄✂️): A visual mini-game modal that users can launch from the navigation header or trigger via chat keywords to challenge the AI with live win/loss tracking.
  5. ⌨️ Categorical Virtual Emoji Keypad: An on-screen keypad switcher allowing users to toggle between standard hardware keyboard input and dedicated emoji category palettes (Smileys, Gestures, Activities, Nature).
  6. 🛡️ Supervised 9-Stage Post-Code Automation: When a new capability is planned via a GitLab Issue, GitLab Duo Agents and Multi-Agent Flows write the FastAPI endpoints, generate Tailwind UI components, and author Pytest test suites. The pipeline executes automated tests, runs security and secret scans, generates CycloneDX SBOMs, deploys an isolated preview revision to Google Cloud Run Staging, verifies live latency via a custom MCP client, and posts a comprehensive governance certificate on the Merge Request awaiting final human supervisor sign-off for Production.

How we built it

1. Application Core & AI Engine

  • Backend: Built with asynchronous Python (FastAPI) and WebSockets for low-latency concurrent message broadcasting.
  • AI & Cloud Foundation: Connected to Google Cloud Vertex AI using the google-genai SDK and the gemini-2.5-flash model, configured with strict JSON output schemas for sub-second emoji and conversational inference.
  • Frontend: Single-page reactive interface crafted with HTML5, vanilla JavaScript, and Tailwind CSS.

2. GitLab Duo Agent Platform & Custom Flows

  • GitLab Duo Developer Flow: Utilized to translate GitLab Issues into working branches, implementing endpoints (/api/stats, /api/game/rps, /api/groups/create), updating templates, and authoring unit tests in tests/test_app.py.
  • Custom Multi-Agent Flow (devsecops-9stage-guardian): Built on the GitLab Flow Registry (version: "v1", environment: ambient) implementing a Least-Privilege Agent Tool Governance pattern:
    • Agent 1 (analyze): Granted read-only tools (get_merge_request, list_merge_request_diffs, find_files) to inspect diffs and unit test coverage while stripping prompt-injection attempts.
    • Agent 2 (report): Granted write-only tools (create_merge_request_note) to consume Agent 1's sanitized summary and post the final DevSecOps audit checklist directly on the Merge Request.
  • Custom Agent (gcp-cloudrun-release-governor): Audits code changes for Vertex AI exception safety, test coverage, and cloud cost guardrails.

3. Model Context Protocol (MCP) Integration

  • Configured via .gitlab/duo/mcp.json and implemented in mcp_server/cloudrun_ops_mcp.py using standard JSON-RPC 2.0 over stdio.
  • Exposes tools to query live deployment telemetry (check_cloud_run_slo) and evaluate FinOps token cost and Green Software Carbon Intensity (get_finops_and_sci_audit).
  • Executed by an automated client runner (mcp_server/mcp_client_runner.py) during pipeline execution.

4. Complete 9-Stage DevSecOps Pipeline (.gitlab-ci.yml)

  1. Plan: Validates architecture specifications and outputs plan_manifest.json.
  2. Create: Verifies Python Abstract Syntax Trees (AST) and generates OpenAPI 3.1 contracts (openapi.json).
  3. Verify: Runs automated unit tests with pytest and httpx, publishing JUnit XML test reports.
  4. Secure: Executes GitLab SAST (semgrep-sast), GitLab Secret Detection, and pip-audit package vulnerability assessments.
  5. Package: Builds container images, pushes to the GitLab Container Registry, and outputs a CycloneDX Software Bill of Materials (sbom-cyclonedx.json).
  6. Release: Compiles semantic release notes and version manifests (RELEASE_NOTES.md).
  7. Configure: Uses Zero-Trust Keyless OIDC Workload Identity Federation to authenticate directly with Google Cloud without static keys. Feature branches deploy to Cloud Run Staging (--no-traffic --tag staging), while merged changes on main deploy to Cloud Run Production.
  8. Monitor: Runs mcp_client_runner.py to probe live /healthz endpoints and assert latency SLOs (<500ms).
  9. Govern: Synthesizes security status, FinOps metrics, and Green SCI calculations into a formal governance_certificate.json.

Challenges we ran into

  1. Managing Organizational Key Constraints on Google Cloud: Our GCP organization had constraints/iam.disableServiceAccountKeyCreation enforced, blocking traditional downloaded JSON service account keys. Rather than working around this constraint with insecure exceptions, we elevated our pipeline security by implementing Keyless OIDC Workload Identity Federation (WIF). Configuring GitLab's OIDC tokens (aud: https://gitlab.com) with GCP STS and custom attribute conditions established a zero-trust deployment bridge.
  2. Lazy Initialization for CI Environments: When running headless linting and OpenAPI schema extraction in early CI stages (create), importing the Vertex AI client caused immediate crashes due to absent GCP application credentials in Docker containers. We resolved this by refactoring app/client/vertex_client.py with lazy-loaded singleton initialization, allowing test runners and schema generators to execute offline while preserving live cloud authentication in staging and production.
  3. YAML Literal Block Parsing in CI Scripts: Combining inline JSON objects, bash curl pipes, and variable expansions inside .gitlab-ci.yml caused YAML mapping errors. We solved this systematically by wrapping all multiline automation routines into literal block scalars (- |), ensuring resilient execution across runners.
  4. Agent Prompt Injection & Least-Privilege Governance: When designing agents that review untrusted code diffs and write to repository records, there is a distinct risk of prompt manipulation. We addressed this by enforcing a two-agent architecture in our custom flow: the analysis agent possesses read-only access to diffs, while the reporting agent only receives structured, sanitized summaries before writing Merge Request notes.

Accomplishments that we're proud of

  • Seamless 9/9 DevSecOps Lifecycle Automation: Achieved 100% green execution across every single lifecycle stage specified by GitLab, generating verifiable artifacts at every milestone.
  • Genuine Supervised Autonomy in Practice: GitLab Duo agents can take an issue, write the full-stack code, write unit tests, verify builds, deploy to an isolated Staging URL, and present an actionable audit summary—leaving only the final deployment approval to the human supervisor.
  • Zero-Trust Keyless Cloud Run Deployment: Successfully integrated Google Cloud Workload Identity Federation with GitLab CI, deploying containerized microservices to Google Cloud Run without storing a single long-lived secret or static JSON credential.
  • Custom MCP Client & Server Implementation: Built and verified a working JSON-RPC 2.0 MCP server and automated client that bridge live Google Cloud operational telemetry directly into the GitLab agent workflow.
  • Quantified Green Software Carbon Intensity (SCI): Embedded explicit environmental metrics into Stage 9 (govern) based on the Green Software Foundation formula:

$$\text{SCI} = \frac{(E \times I) + M}{R}$$

By pairing serverless scale-to-zero compute (minScale: 0 on Cloud Run) with the energy-efficient Gemini 2.5 Flash model, we attained an ultra-low operational rating of ~0.0038 gCO2eq per chat interaction and an estimated cost of $0.015 per 1,000 requests.

What we learned

  • The Power of Standardized Agent Interfaces: Utilizing the Model Context Protocol (MCP) dramatically simplifies how AI agents access operational tools. Instead of writing proprietary agent wrappers for each cloud API, standardized JSON-RPC schemas enable modular, reusable operational tooling.
  • Separation of Staging vs. Production in Agentic Lifecycles: Uncontrolled agents deploying straight to production is an unacceptable enterprise risk. Splitting Stage 7 into isolated Staging tags (--no-traffic --tag staging) on merge request branches enables agent autonomy to run free without threatening live user traffic.
  • Collaborative Human-in-the-Loop Workflows: GitLab Duo’s ambient flows and developer prompts do not replace software engineers; they eliminate repetitive post-code scaffolding, allowing developers to focus on higher-level architectural decisions and release sign-offs.

What's next for EmojiBot AI

  • Direct Voice-to-Emoji Audio Streaming: Integrating Google Cloud Text-to-Speech and Speech-to-Text APIs to enable hands-free voice conversations that translate spoken dialog into live animated emojis.
  • Persistent Cloud SQL Session Storage: Transitioning in-memory room management to a Google Cloud SQL (PostgreSQL) backend with Redis caching for cross-region multi-room clustering.
  • Autonomous Rollback Flows: Extending our GitLab Duo MCP integration so that if post-deploy monitoring detects an SLO degradation or latency spike within 5 minutes of release, an agent automatically issues a traffic shift command to roll back Cloud Run to the previous healthy revision.

Built With

  • cloud-run
  • gitlab
  • gitlab-duo
  • google-gemini
  • python
Share this project:

Updates

Submission history