RaceProof

Inspiration

Concurrency and idempotency bugs are difficult to judge from a plausible-looking patch. A repair can pass happy-path tests while still duplicating a durable booking after restart, overselling capacity, or hiding failure by rejecting legitimate work. RaceProof separates the agent that changes code from the authority that decides whether the change is correct.

What it does

RaceProof is a GitLab-based agentic repair workflow for a deliberately defective FastAPI/PostgreSQL booking service. A reproducible witness exposes the defect, GitLab Duo proposes a minimal product-code repair, and a frozen deterministic verifier checks the exact candidate against both API behavior and durable database effects.

The contract defines eight properties, P1-P8, covering capacity, operation identity/idempotency, incompatible reuse, restart persistence, lost responses, principal isolation, liveness, and response/effect correspondence. The approval gate accepts only complete PASS evidence.

How we built it

The project uses GitLab Duo Agent Platform, GitLab CI/CD, Python, FastAPI and PostgreSQL. Protected-path rules prevent a repair candidate from changing the contract, frozen oracle, verifier, or CI controls. The CI lifecycle runs guard, verify, secure, package, release, configure, monitor and govern stages.

For real Developer Flow session 9527753, the prepared defect failed P4 because an application restart created a different booking for the same committed operation. GitLab Duo diagnosed startup truncation of the durable operations table, changed only app/main.py, created commit d8b7292 and pushed its repair branch. GitLab pipeline 2950625610 then independently ran the frozen oracle: P1-P8 all PASS and the approval gate returned APPROVED. MR !1 preserves the exact one-file repair delta for review.

Challenges we ran into

The main challenge was making the evidence independent of the AI that produced the patch. Duo could inspect and repair product code, but it was not allowed to weaken the oracle. We also adapted the PostgreSQL-backed verifier to GitLab runners and retained negative controls so incomplete evidence or reject-all behavior cannot be mistaken for success.

Accomplishments that we're proud of

• Two real GitLab Duo runs with preserved provenance.
• A direct-push Duo candidate independently verified by GitLab CI.
• P1-P8 deterministic checks against PostgreSQL effects.
• Visible CI/CD evidence across eight post-code lifecycle stages.
• Public MIT-licensed GitLab repository and a 2:07 public demo.

What we learned

Agentic repair becomes much more trustworthy when generation and acceptance have different authorities. The most useful AI output is not a claim that a fix works, but an exact candidate revision that deterministic infrastructure can independently prove or reject.

What's next for RaceProof

RaceProof can be extended with additional failure contracts, richer services, and deployment-stage evidence while keeping the same core rule: the agent may propose the change, but reproducible evidence decides whether it ships.

Built With

• ci
• docker
• duo
• fastapi
• gitlab
• postgresql
• python