PISTA: Autonomous DevSecOps Autopilot

Autonomous GitLab Duo agent automating 9 DevSecOps stages—CI diagnosis, HMAC audits, Cloud Run staging & human approval gate for payment intelligence.

Comment

Inspiration

Code generation is largely solved. But what happens after the code is written—the critical "Life After Code"—is where engineering friction explodes: cryptic CI/CD pipeline breaks, razor-thin latency regressions, subtle cryptographic discrepancies in payment webhooks, container build mismatches, and risky production deployments.

We were inspired to build PISTA: Autonomous DevSecOps Autopilot to prove that autonomous AI agents shouldn't just write code—they should master the entire post-commit software lifecycle. By integrating the GitLab Duo Agent Platform via Model Context Protocol (MCP) into PISTA (Payment Intelligence and Security Telemetry Architecture), we created a system with Supervised Autonomy capable of orchestrating, debugging, securing, and deploying mission-critical fintech infrastructure across all 9 DevSecOps stages.

What it does

PISTA Autopilot monitors code pushes and acts as an autonomous site reliability and security engineer:

  1. Automated Pipeline Diagnosis & Self-Healing: When CI fails, the Duo Agent parses tracebacks, analyzes git blame, synthesizes surgical code patches, runs the test suite, and commits verified fixes.
  2. Cryptographic & Secret Auditing: Continuously scans for leaked credentials and executes cryptographic invariant suites (verifying HMAC-SHA256 signatures for payment webhooks like Razorpay).
  3. Multi-Stage Container Packaging: Packages production-hardened Docker containers for both the FastAPI ML inference backend and Next.js frontend.
  4. Google Cloud Run Deployment (+0.2 Bonus): Automatically deploys staging release candidates to Google Cloud Run and validates zero-downtime health probes.
  5. Real-Time Telemetry & Drift Monitoring: Measures p50/p99 inference latencies (<10ms) and computes Population Stability Index (PSI) drift metrics.
  6. Supervised Approval Gate: Rather than uncontrolled autonomous promotion, the agent presents a comprehensive audit trail and awaits human supervisor sign-off before production release.

How we built it

  • Autonomous Agent Engine: Built with GitLab Duo Agent Platform utilizing custom Model Context Protocol (MCP) servers (.gitlab/duo/mcp/pista_mcp_server.py) exposing diagnostic and deployment tools.
  • Full-Lifecycle GitLab CI/CD: Engineered a 9-stage, 13-job pipeline covering Plan, Create, Verify, Package, Secure, Release, Configure, Monitor, and Govern.
  • ML Inference & Backend Core: Python 3.11, FastAPI, and LightGBM champion fraud detection models scoring IEEE-CIS transaction features in under 10ms.
  • Spatial Frontend UI: Next.js 16, React 19, Tailwind CSS, and Framer Motion providing real-time signal networks and decision analytics.
  • Production Deployments: Deployed to Google Cloud Run staging and Vercel high-availability edge serverless architecture.

Challenges we ran into

  • Decoupling CI Environments from Serverless Bundles: Serverless edge platforms enforce strict uncompressed slug limits (250MB), requiring aggressive runtime pruning, while CI runners require full testing harnesses (pytest, pytest-cov, pytest-asyncio). We engineered self-sufficient containerized stages in .gitlab-ci.yml that guarantee dependencies regardless of edge-pruning.
  • Cryptographic Invariants in Payment Webhooks: Ensuring zero false positives in HMAC signature validation while maintaining microsecond-level webhook ingestion required dedicated automated crypto audit stages in CI.
  • True Supervised Autonomy Balance: Designing the workflow so the agent operates with maximum efficiency on tedious tasks (trace parsing, linting, regression testing) while strictly reserving final production promotion for human sign-off.

Accomplishments that we're proud of

  • 100% Green CI/CD Pipeline Across All 9 Stages: All 13 jobs passing cleanly on GitLab CI (#2936502773).
  • Sub-10ms Fraud Inference: Real-time LightGBM champion model scoring transactions with calibrated confidence and explainability.
  • Zero-Downtime Multi-Cloud Deployments: Live frontend on Vercel and staging manifests for Google Cloud Run.
  • Strict Human-in-the-Loop Governance: Successfully demonstrating true Supervised Autonomy where AI acts as a trusted junior partner under human supervision.

What we learned

  • Autonomous agents provide the greatest value when given strict diagnostic boundaries and empirical validation steps—code generated by agents must always be verified by deterministic test runners before merging.
  • Integrating custom MCP servers with GitLab Duo opens enormous possibilities for enterprise workflows beyond simple chat.

What's next for PISTA: Autonomous DevSecOps Autopilot

  • Adding automated rollbacks based on post-deployment real-time anomaly detection.
  • Expanding Duo MCP integrations to support multi-region canary deployments and automated canary analysis (ACA).
  • Extending the drift detection engine to trigger automated continuous retraining workflows on Google Cloud Vertex AI.

Built With

Share this project:

Updates

Submission history