ProdPermit

ProdPermit

ProdPermit is the earned-authority layer for agentic software delivery. Software agents can already write, review and ship code; the harder question is whether this exact workflow has earned the right to perform this exact operation now.

ProdPermit separates the lifecycle into explicit trust boundaries:

evidence → Release Case → Production Plan → authorization → signed permit → durable admission/fence → staging execution → independent runtime observation → immutable outcome → Passport consequence

A permit is bound to the exact candidate, artifact, non-production target, operation, validity window, one-attempt budget and monotonic fence. PostgreSQL provides durable admission, idempotency and replay resistance. Deployment metadata alone is never treated as application success: a separate credential-free observer verifies the public application against the exact reviewed SHA. Missing or unavailable runtime evidence becomes UNKNOWN and earns no authority.

The terminal path is deliberately conservative. Even a verified one-shot staging result closes the delegation with zero successful-release credit and no authority expansion. Adverse evidence contracts or freezes authority. AI recommendations, green CI labels and model output cannot mint trust by assertion.

GitLab and agentic automation

ProdPermit is a Path A — Start Fresh / Supervised project. GitLab is the evidence and execution substrate: public source and merge history, GitLab CI/CD, protected configuration, environments and deployment records, plus GitLab Duo review/remediation evidence. Duo and ChatGPT Work act as engineering/review agents; deterministic code remains the authority plane.

The automation reaches across the post-code lifecycle through one connected workflow: verification/security evidence produces a bounded release decision; an exact signed permit authorizes one staging action; GitLab executes the canary; independent monitoring verifies the actual application; and the immutable outcome changes future authority.

What is in the repository

• deterministic evidence/Release Case/Production Plan controller;
• Ed25519 operation-specific permits;
• PostgreSQL durable admission, idempotency and monotonic fencing;
• fixed NON_PRODUCTION GitLab staging dispatch and reconciliation;
• exact-SHA credential-free application runtime verification;
• immutable terminal outcome ledger and Passport consequence;
• managed-auth commercial product with onboarding, workspaces, Release Cases, permits, executions, authority views and a labeled Trust Lab;
• Playwright cross-browser acceptance, security/dependency analysis and adversarial tests;
• final evidence index, reproduction instructions and demo runbook.

The public product intentionally separates customer identity/workspace state from operational authority. Browser clients never receive operational database credentials, CI tokens or private signing material. Synthetic/recorded demonstrations remain visibly labeled and never substitute for live evidence.

Reproduce

Use Node 24:

npm ci --ignore-scripts
npm run typecheck
npm test
npm run build
npm run check
sh scripts/verify-foundation.sh
npm run build:console

PostgreSQL integration verification runs only against the isolated CI PostgreSQL service.

Built With

• gitlab-ci/cd
• gitlab-duo
• neon
• next.js
• node.js
• playwright
• postgresql
• typescript
• vercel