Relay — Autonomous Post-Code Delivery

Post-code lifecycle automation on a trust ladder — 21 CI/CD jobs, 3-level dynamic gating, and ISO carbon accounting powered by GitLab Duo Agent Platform.

Comment

Inspiration

A four-line bug fix takes minutes to write, but two days to reach production. Almost none of that time is spent coding. It is spent waiting on reviews, running security scanners, approving promotions, verifying health checks, and filing compliance reports.

We built Relay around one core insight:

The automation layer is the product. The service is the subject.

Instead of another feature demo, Relay takes an unremarkable MIT service (a webhook delivery microservice) and wraps it in a complete post-code lifecycle engine that earns trust as it advances up an autonomy ladder.

What it does

  1. The Autonomy Ladder: Governed by agents/policy.yml, the pipeline resolves who owns which gate at runtime:
    • Assisted: Agent diffs and proposes; human approves all 5 gates (review, CVE remediation, merge, staging, prod).
    • Supervised: Agent fixes, tests, merges, and deploys to staging; human approves production only.
    • Hands-off: End-to-end loop from issue to production without human intervention.
  2. 21-Job Lifecycle CI/CD: Covers all 7 stages (verify, secure, package, gate, release, deploy, observe) leveraging GitLab's native SAST, Secret Detection, Dependency Scanning, Container Scanning, License Scanning, CycloneDX SBOM generation, and automatic postmortems.
  3. Hard Stops with a Floor: Regardless of level, agents are strictly forbidden from modifying .gitlab-ci.yml, deleting main, rotating secrets, or deploying on a Friday afternoon.
  4. Transparent Carbon Accounting (SCI): Computes pipeline energy consumption in gCO₂e per run (ISO/IEC 21031) from actual runner execution time.
  5. Single-Service Control Room: A fast React 18 dashboard baked into the Docker image and served directly by FastAPI, displaying live gate ownership, pipeline progress, and carbon metrics.

How we built it

  • GitLab Duo Agent Platform: Ambient custom flows (agents/flows/release.yml, review.yml, remediate.yml) with planner, implementer, shipper, and validator components.
  • GitLab CI/CD: 21 declarative jobs with fail-closed policy gating (carbon/policy_gate.py).
  • FastAPI + SQLite: Lightweight, zero-dependency persistence.
  • React 18 + Vite: Clean warm-neutral UI built in a multi-stage Docker build.
  • Security & IaC Compliance: Checkov Kubernetes IaC scanner + Semgrep SAST + CycloneDX.

Challenges we ran into

Enforcing fail-closed autonomy without hardcoding pipeline logic. We solved this by treating the approval policy purely as data (agents/policy.yml). The policy gate evaluates runtime environment variables and prevents unapproved promotions from proceeding.

Accomplishments that we're proud of

  • Achieving 90% test coverage with automated unit tests across the entire HTTP and policy surface.
  • Ensuring zero drift between CI and the UI dashboard by driving both from the exact same policy and carbon math modules.
  • Delivering honest, derivation-backed carbon accounting rather than unverified estimates.
  • Running a live 100% green 19-job pipeline with automated GitLab Releases and Container Registry publishing.

What we learned

Building for agents changes how pipelines should be written: instead of treating CI as a dumb test runner, it becomes an active compliance boundary and trust floor for autonomous systems.

What's next for Relay

  • Multi-region progressive rollouts with automated canary traffic shifting.
  • Direct bidirectional streaming between the GitLab Duo Agent chat and the local Control Room.

Built With

Share this project:

Updates

Submission history