IGRIS: Post-Code Gatekeeper for GitLab Duo

When AI writes code, human review is the bottleneck. IGRIS tests AI bug reports and PRs in a safe sandbox, stopping fake issues and unsafe scripts before they waste developer time.

Comment

💡 Inspiration

A maintainer opens their repository inbox on a Monday morning. Forty security and bug reports arrived over the weekend. Every single one is written with the confident, polished tone of a senior engineer—yet most of them reference functions that do not even exist.

This isn't a hypothetical future; it is already happening:

  • On January 31, 2026, Daniel Stenberg officially shut down curl's seven-year bug bounty program after valid reports collapsed below 5% under an avalanche of AI-hallucinated submissions.
  • GitLab’s 2026 AI Accountability Report (surveying 1,528 developers and tech buyers) revealed that 85% agree AI has shifted the development bottleneck from writing code to reviewing and validating it.

Humans cannot read code 10x faster. If autonomous AI agents are going to write code and submit bug fixes, maintainers need an automated gatekeeper that checks claims first, refuses fake work instantly, and produces verifiable proof before a single human minute or cloud runner dollar is wasted.

That is why we built IGRIS.

🛡️ What It Does

IGRIS operates on one simple, unshakeable principle: AI-written bug reports and code patches are guilty until reproduced in a clean room.

Before any AI suggestion reaches a maintainer or triggers an expensive CI/CD pipeline, it must pass through four mechanical defense gates:

  1. Gate 0: Sanity Check (< 1 ms): Is the issue or pull request complete, valid JSON, and well-structured?
  2. Gate 1: Code Reality Check (~7 ms): Does the file or function named in the AI report actually exist in the repository? If an agent hallucinated a fake symbol, the run dies right here—costing zero model tokens and zero cloud compute.
  3. Gate 2: Isolated Sandbox Reproduction (~180 ms): The reproduction test is executed inside a disposable container with hard memory caps and zero internet access. We ignore what the AI claims happened; only the deterministic exit code (0 for clean, non-zero for crash) counts.
  4. Gate 3: Automated History Bisect (~140 ms): If a real bug is confirmed, IGRIS binary-searches the Git commit tree to isolate the exact commit that introduced the regression, turning hours of manual debugging into a sub-second answer.

Earned Trust: The Probation System

Checking one pull request isn't enough—an agent that behaves five times and slips in a malicious command on the sixth is a security disaster.

Following The GitLab Security Standard v1.0, IGRIS enforces earned autonomy:

  • Level 1 (Suggest): The agent can only post comments. It cannot open merge requests.
  • Level 2 (Propose): After 2 verified clean runs, it can open a Merge Request, but requires human approval.
  • Level 3 (Act): After 5 clean runs and maintainer sign-off, it can merge low-risk fixes autonomously.
  • The Trap: If an agent tries to delete a test assertion (- expect(...)) to fake a passing test, IGRIS catches the deletion in the diff, aborts the pipeline, resets its streak to zero, and demotes the agent back on the spot.

Every run outputs a tamper-proof cryptographic receipt (previousHash $\to$ tamperProofHash) so maintainers have undeniable proof of what happened.

⚙️ How We Built It

  • Core Engine: Written in TypeScript/Node.js, built around strict deterministic verification with 19/19 passing automated tests and zero mocks.
  • GitLab Duo Integration: Connects directly via the Model Context Protocol (MCP), allowing GitLab Duo workflows to call IGRIS as a post-code verification gate.
  • Sandbox Runtime: Ephemeral execution environment with strict resource quotas (CPU limits, memory ceilings, disabled networking) to safely execute untrusted test scripts.
  • Interactive Cockpit & Adversarial Arena: A lightweight, high-density web dashboard built with vanilla web standards and CSS variables, allowing maintainers to test real edge cases and hostile shell payloads live.
  • Demo Video & Motion Design: Produced using Remotion and React, rendered frame-by-frame with custom ElevenLabs voiceover and synchronized telemetry captions.

🧗 Challenges We Ran Into

  • The Self-Grading Trap: Our biggest architectural challenge was preventing LLMs from grading their own homework. If an LLM writes code and an LLM reviews it, hallucinations reinforce each other. We solved this by strictly separating roles: AI generates proposals, but deterministic code (AST parsers, container exit codes, Git history bisection) decides what passes.
  • Sub-Second Bisection: Running a traditional git bisect in full CI environments often takes 15–40 minutes. By constraining the bisection to lightweight in-memory commit trees and running targeted tests, we brought full 16-commit bisection down to under 200 milliseconds.
  • Safely Handling Malicious Inputs: In the Adversarial Arena, we had to ensure that injected shell attacks (like ; rm -rf / ; cat /etc/passwd) were caught at the AST layer before any subprocess or shell execution could even spawn.

🏆 Accomplishments That We're Proud Of

  • 19/19 Passing Verification Tests: Every claim made in our documentation is backed by automated tests with clean exit code 0.
  • Real GitLab Issue #989 Answered: Successfully reproduced and bisected a real regression test case matching real-world GitLab workflows in 142ms.
  • Zero-Dollar Security Defense: Demonstrating that 90%+ of bad AI pull requests (phantom functions, syntax errors, and hostile injections) can be stopped in under 10 milliseconds without spinning up expensive GPU runners.

📚 What We Learned

We learned that in the era of autonomous coding agents, the best defense is not more AI—it is deterministic discipline. Fast, mechanical checks (syntax trees, exit codes, and hash-chained audit trails) give engineering teams the confidence to let AI move at full speed without fearing pipeline compromise.

🚀 What's Next for IGRIS

  • Native GitLab CI Component: Publishing IGRIS as a drop-in GitLab CI/CD catalog template (include: component: gitlab.com/igris/gatekeeper).
  • Multi-Repo Fleet Telemetry: Aggregating reputation scores across agent fleets to identify systematically hallucinating models before they submit PRs to shared open-source repositories.
  • Wasm-Based Local Sandboxing: Enabling client-side WebAssembly test execution directly in the browser cockpit.

Built With

Share this project:

Updates

Submission history