Why we built it
Shipping a beautiful website is not enough. A small business also needs confidence that a change will not break a customer's journey. Morrow Atelier is an original fictional furniture studio designed to demonstrate that post-code checks can be understandable, reproducible and resistant to tampering.
The working application
Visitors select a furniture collection, material finish and width. The app calculates an illustrative estimate in integer cents. A fictional design request is rejected unless consent is explicitly true. With consent it creates a local draft; no personal data, payment or request is transmitted or stored.
The public demo includes real automated browser footage of the working form: changing a collection, calculating €2,965, rejecting missing consent, then creating a fictional draft with consent.
GitLab post-code workflow
Path A: Start Fresh — Assisted. This project was developed during the hackathon with manual approval of each key step.
- Source and MIT license: Public GitLab repository.
- Actual hosted verification: GitLab pipeline #2993623204 completed successfully for commit
0a86c6cc7a726fc0db705dc1a1bd1ec89522e969. - Measured tests: Job #17497938416 ran on a GitLab-hosted Linux runner. 38 of 38 Node tests passed, with TAP logs and a hash-bound receipt retained as artifacts.
- Real GitLab Duo Agent Platform usage: one bounded, read-only Agentic Chat review using OpenAI GPT-5.4-Mini (session
10116077). The agent inspected consent logic, regression coverage, tamper guards and real CI evidence. It identified the lack of cryptographic attestation as an honest limitation. - Human decision gate: passing tests produce
CHECKS_PASSED_REVIEW_REQUIRED; they do not automatically authorize merge or release.
A deliberately unsafe proposal to alter a protected regression test returns HOLD. The guard requires pinned files, hashes and boundaries rather than accepting a self-reported green result.
Earlier repair and what we learned
During local development, ChatGPT corrected a single consent-related source line. The same unchanged business tests moved from 7 passed / 3 failed to 10 passed / 0 failed. This was a local ChatGPT repair, not a GitLab Duo repair. The separate hosted GitLab CI suite later passed 38/38.
We learned to keep three sources of evidence distinct: local red/green testing, externally visible GitLab job execution, and an actual GitLab Duo review. The test receipt is unsigned; the GitLab job log confirms the hosted run but does not turn the receipt into cryptographic Duo-to-CI provenance.
Run and verify
Use Node.js 24. Clone the public repository and run node ci-evidence.mjs from its root. The runner executes the fixed 38-test suite and produces TAP output and a SHA-256 receipt. For the website, serve the checked-out directory using a local static HTTP server and open index.html.
No real customer data, backend service, payment, live deployment, automatic GitLab Duo source repair or production release is claimed.
Video: 96-second jury demonstration, with actual browser interaction, CI logs and Duo review evidence.
Built With
- gitlab
Log in or sign up for Devpost to join the conversation.