Pathly — Life After Code

Supervised GitLab Duo agents that review, verify, secure and release a real POPIA-sensitive career-guidance app — one human approval from production.

Comment

Path B: what we added during the submission period

The Pathly product existed before 5 October 2026: an Angular 21 learner app and a .NET 10 API, both now MIT-licensed on GitHub. The application features were not invented for the hackathon. The automation around them was.

Everything below is new work built during the Transcend submission period:

  • Imported the product into the public GitLab project on 16 October 2026.
  • Wrote two custom GitLab Duo flows — Pathly Lifecycle Guardian (seven agents plus the human approval gate) and Pathly Incident Sentinel.
  • Added four project-level Agent Skills (pathly-verify, pathly-popia-guard, pathly-entitlements, pathly-release), AGENTS.md and .gitlab/duo/agent-config.yml, so the agents load the repository's real rules instead of generic advice.
  • Built the deterministic lifecycle: verify (Vitest, Angular build, .NET build, xUnit), secure (SAST, secret detection, dependency scanning, POPIA and entitlement audits), package, gated release, post-deploy smoke tests and governance checks.
  • Added the supervised release gate: the production deploy does not run without an explicit human approval.
  • Hardened the Free / Standard / Premium model on the server, fixed the entitlement inversion and the unlimited-quota bug found during the period, and added the secure:entitlements audit so the server-side gate cannot be silently removed.
  • Deployed the live product at https://pathly-ai.netlify.app.

Inspiration

Pathly helps South African learners who have no career counsellor turn their matric results into a career plan. It also processes the personal data of minors, which makes the work after the code is written unusually high-stakes. Our small team cannot manually re-check tenant isolation, POPIA handling and plan entitlements on every merge request — and "looks fine" is not evidence.

The Transcend brief reframed the problem for us: code generation is not the bottleneck. Review, verification, security, release and incident response are. So we built the automation we actually needed around the product we actually run.

What it does

Every merge request triggers a supervised agent chain:

  1. Triage reads the diff and the linked issue, and names the risk areas.
  2. Quality runs the Angular tests and build, the .NET build and the xUnit suite, and checks that new behaviour has a test.
  3. Privacy applies a POPIA and tenant-isolation checklist: owner identity from the JWT, scoped queries, no PII in logs, bounded uploads, complete deletion/export paths.
  4. Entitlements verifies the Free/Standard/Premium matrix on the server — psychometrics and combined reports must return 402 premium_required for non-Premium plans, and unlimited quotas must stay unlimited.
  5. Fixer prepares the fix on the MR branch. The flow is instructed not to commit; the operator applies the verified output, so the commit is a human decision.
  6. Verifier re-runs everything and returns READY / NOT READY.
  7. A single human approval gates production.
  8. After approval, the release stage is designed to deploy the API first, then the web app, run smoke checks and post the release note.

A second flow, Incident Sentinel, turns a failed pipeline into a diagnosed incident and a fix MR by reading the failing job logs.

How we built it

  • GitLab Duo Agent Platform: two custom ambient flows, agent prompts with local templates, a HumanInputComponent approval gate, and pipeline/merge request triggers.
  • Project-level Agent Skills: pathly-verify, pathly-popia-guard, pathly-entitlements, pathly-release encode the repository's actual rules. Duo loads them automatically when the task matches, so every agent uses the same definition of "done".
  • AGENTS.md carries the layout, commands and non-negotiable rules.
  • agent-config.yml provisions Node 24 + .NET 10 and caches dependencies so flows can build and test both halves of the app.
  • GitLab CI/CD provides the independent deterministic evidence: Vitest, Angular build, .NET build and tests, SAST, secret detection, dependency scanning, custom POPIA and entitlement audits, container packaging, gated deploys and post-deploy smoke tests.
  • The app itself: Angular 21 (SSR, signals) and .NET 10 (EF Core, SQL Server, JWT with refresh rotation, Tesseract OCR, Groq-backed analysis, hosted Paystack checkout).

Challenges we ran into

  • Two stacks, one lifecycle. Angular and .NET have different toolchains and failure modes. The flow image and agent-config.yml had to provide both, and the quality agent had to run the same commands as CI.
  • Entitlement drift. The UI and API disagreed about what "premium" meant after we introduced Standard. We fixed it by deriving the tier from the active subscription's entitlements on the server and normalising plan codes on the client.
  • A silent billing bug. The usage endpoint coalesced a null (unlimited) quota to the Free allowance, so Premium looked capped. Found during a browser QA pass; fixed and covered by the entitlement audit.
  • Privacy as a review dimension, not a vibe. Turning POPIA into concrete, checkable rules (owner from token, scoped queries, no PII in logs, delete and export paths) is what made the privacy agent useful.
  • Migration drift. The model had AspNetUsers columns that no migration created; a fresh database failed at registration. Documented in the runbook.
  • The gate outlived its session. The flow paused correctly for human approval, but resuming the expired session after the CI job's one-hour window hit a platform KeyError. All agent work and the approval decision were already complete; the final deploy was not performed by the flow. The fix is to persist the gate token instead of holding it in a job-scoped session.

Accomplishments we are proud of

  • Two custom flows designed to cover nine DevSecOps stages: plan, create, verify, package, secure, release, configure, monitor, govern. Lifecycle Guardian was exercised end-to-end to the human gate.
  • A supervised gate that is genuinely one decision, not a rubber stamp: the production release will not run without an explicit approval.
  • Project skills that make the agents' behaviour auditable and reviewable in the repository, not hidden in a UI prompt box.
  • Real fixes found by the automation and the QA pass, including the unlimited quota bug and the entitlement inversion.
  • A public, MIT-licensed monorepo that builds and tests both halves of the product with one pipeline.

What we learned

  • Agents are most useful when the repository already contains the rules they must enforce. Prompts alone drift; skills and AGENTS.md do not.
  • Deterministic gates and agentic review are complementary. The agent explains and fixes; CI proves.
  • A single, well-placed human gate beats approving every tool call. Supervised autonomy is the useful middle.
  • Privacy work is testable. "No PII in logs", "owner from the token" and "premium returns 402" are static checks, not opinions.
  • A gate must survive the session that created it. Persist the approval token.

What's next

  • Persist the release-gate token so an expired session can resume safely.
  • Add a Google Cloud deployment path and a second release target.
  • Expand the incident sentinel to watch live error budgets, not only pipelines.
  • Add accessibility and performance budgets to the verifier.
  • Let the release agent open a rollback MR automatically when smoke fails twice.
  • Move the remaining manual QA checklist into the flow as a reporting agent.

Built With

Share this project:

Updates

Submission history