Inspiration

Documentation-only changes can repeat optional CI work. Giving an agent unrestricted authority to suppress checks creates a trust problem. We wanted a narrow alternative: real agent advice with an expiry, deterministic execution rules, and evidence that can be replayed.

What it does

The governor can defer only the internal benchmark and demo_snapshot demonstration payloads. unit_tests and policy_guard remain mandatory under the accepted CI configuration. Deferral requires documentation-only changes, exact base/head identities, matching non-documentation inputs, and verified successful completion of both prior payloads less than 24 hours earlier. Advice expires within one hour. Missing, malformed, mismatched or expired advice restores full execution. Deferred outputs do not refresh success history. All six jobs still run; expiry does not schedule a later pipeline.

How we built it

This Path A / Assisted project was built from scratch in the assigned GitLab workspace. Its Python standard-library governor, Git-based context/history adapters, offline auditor and HTML/CSS viewer run with GitLab CI/CD. Actual GitLab Duo Agent Platform Agentic Chat session 9629879 returned a 269-byte recommendation. Its original text was manually Base64-transferred into a typed input in the same push pipeline. This human bridge is explicit; there is no custom automatic Flow. The consumer binds raw text to the parsed proposal and saves each job's execution-time context for replay.

Challenges we ran into

We had to distinguish completed payload history from deferred results, recheck expiry at execution time, and reject malformed or altered advice. The typed-input interface rejected an oversized response during development; we preserved that failure and requested a fresh compact response instead of silently truncating it. Synthetic fixtures remain separate from real Duo and CI evidence.

Accomplishments that we're proud of

R3 baseline pipeline 2957488201 completed both optional payloads. Documentation-only pipeline 2957492739 passed all six jobs and 112 tests using real Duo advice: both optional jobs validated inputs, while their two internal payloads were deferred. Exact-input receipts passed offline consistency replay; an intentionally modified local copy failed. Separately, current revision a9d3d369bf2ebe9976e9d4d25abe02e249c4f7ec passed six jobs and 118 tests in pipeline 2959052998 with empty advice and both payloads completed. That later validation is not another Duo invocation or deferral run.

What we learned

Agent advice and execution authority need different boundaries. Offline PASS establishes consistency of saved data, not a signature or renewed GitLab authentication. These small payloads demonstrate behavior; no CO2, energy, cost or net resource savings have been measured. Repository owners can still edit CI or cancel/skip pipelines outside this governor's boundary.

What's next for Expiry-Bounded CI Governor

Future work could evaluate realistic optional workloads and measure end-to-end overhead before making efficiency claims. Any new live deferral needs fresh real context and a new unexpired Duo response; the historical proposal cannot be reused. Custom automation and scheduling are possibilities, not implemented features.

The repository is now public and original contest source is MIT-licensed, with third-party README notices retained. The approximately 151-second Unlisted video combines local viewer operation with saved R3 evidence. Its PRIVATE PREVIEW / NOT FINAL ENTRY labels describe the recording-time state. The released copy has four localized visual masks; the original video is preserved. Stock af_heart synthetic narration and English/Chinese subtitles are included. Separate narration/model/encoder tools retain their own licenses and are not bundled with the source.

Built With

Share this project:

Updates

Submission history