Inspiration
Inspiration
I kept noticing that once a merge request is merged, a lot of important DevSecOps work still remains — security review, verification, release decisions, monitoring setup, and compliance notes. These steps are often rushed or skipped. I wanted to build a system that treats the post-code stage as a first-class process instead of an afterthought.
What it does
Lifecycle Guardian is a multi-agent system that activates after a merge request is merged in GitLab. Five specialized agents work in sequence:
- Security Agent checks for vulnerabilities and decides whether to block the change
- Verification Agent reviews pipeline health and test results
- Release Agent decides if the change is safe to promote and suggests a version
- Monitoring Agent recommends what should be watched after deployment
- Governance Agent produces an executive summary and compliance notes
The system generates a clear final report and can handle both successful and blocked scenarios.
How we built it
The project is built in Python with a modular multi-agent architecture. An orchestrator runs the agents in order, shares context between them, and stops the pipeline when a critical gate fails. A simple demo mode allows anyone to run the full system without needing real GitLab credentials.
Challenges we ran into
The biggest challenge was designing clean hand-offs between agents. Each agent needed structured outputs so the next one could make reliable decisions. Balancing realism with simplicity so judges could easily run and understand the project was also important.
Accomplishments that we're proud of
- A working multi-agent pipeline that covers five DevSecOps stages
- Clear gating logic that blocks unsafe releases
- A clean demo mode that shows both success and failure cases
- A professional final report that is easy for humans to read
What we learned
I learned how powerful a focused multi-agent system can be when each agent has a clear responsibility. Keeping the design modular made testing, improvement, and demonstration much easier.
What's next for Lifecycle Guardian
Next steps include connecting it to real GitLab webhooks in production, adding more advanced policy controls, and exploring deeper integration with GitLab Duo Agent Platform features
Built With
- automation
- devsecop
- fastapi
- python
