Inspiration
A green pipeline answers whether tests passed. A solo maintainer still has to connect package identity, operating procedures and approvals before making a release decision. Release Steward makes that evidence inspectable in one merge-request report.
What it does
Two GitLab Duo agents perform a supervised post-code audit. The collector reads the current MR head, authenticated CI trace, package checksum and operating definitions. The auditor runs a deterministic standard-library Python gate and posts the packet-derived report. The human retains the release decision.
How we built it
A custom GitLab Duo Agent Platform flow routes evidence_collector to release_auditor. The collector has seven tools and the auditor three. GitLab CI runs 18 Python and YAML contract tests and packages the source. Package binding rechecks the head and pipeline; unavailable evidence stays unknown. Stage counts and blockers come directly from the deterministic packet.
Published source
The public MIT project now opens on main with the validated implementation and judge quick start. Release MR !2 published the recorded source; documentation revision a1e26a86601c6c209b6f1b8ccd7b5f9a259afe94 clarifies fresh-audit setup. Main pipeline 2928741087 passed all 18 tests and packaging. GitLab automatically marked recorded MR !1 merged when its commits reached main. Its original source branch, reports and sessions remain available as historical evidence; use a new disposable draft MR for a fresh audit. Code publication does not change the recorded blocked production-readiness result.
Current validation
Source f5a62345 includes authenticated CI-log collection and a judge quick start. Pipeline 2927942332 passed verify and package at that exact head: 18 tests, including four FlowContractTest tests.
Managed flow 1016218 v1.4.0 completed session 9219598 with 12 collector and 4 auditor actions from only “Audit this MR at its current head.” It independently retrieved the authenticated CI trace using its existing runtime identity. No pasted observer evidence, dependency installation or test rerun was needed. Its generated report reports 5/6 checks passing and production_ready=false, with evidence digest 414b6e10a5b7ff0e94b3a376f4aaaf3b550aeb6ff8b6e7a3e25993841db4f8d1.
Approval endpoints returned 403 insufficient_scope. Approval observation is unavailable; count zero is a conservative blocking input, not an observed zero. The gate does not invent approval. Release and monitor checks examine runbook definitions; they do not establish deployment, executed rollback, live health or delivered alerts. These six policy checks are separate from competition lifecycle-stage coverage.
Fresh setup acceptance
A fresh private flow, Release Steward Setup Check 1016338 v1.0.0, was created from the published configuration; its full saved YAML was verified. A temporary Developer service account with only the Mention trigger completed session 9220810 on its first attempt, with 11 collector and 3 auditor actions. It independently read authenticated CI evidence for the same current head and published note 3980488836: 5/6 passing, production_ready=false, evidence digest 7f46e40e84c2f7808f6013d00a5362938cb9191d9c4bf67217ce1270ecffa2cd. Gate exit 2 is distinct from the shell wrapper exit 0. Approval retrieval remained unavailable, correctly blocking readiness. The temporary flow was then disabled, with provider readback confirming no active trigger. This proves fresh configuration/account setup in the existing event project; setup in a separate new project has not been demonstrated.
Recorded demonstration
The Unlisted 2:48 demo uses Kokoro Heart narration and actual GitLab UI evidence from completed fresh setup session 9220810 at source revision f5a623450bde5f8c635072f0a38b264599710209. It shows the normal audit request, executed authenticated CI collection, 18 passing tests, deterministic gate exit 2, published report note 3980488836, and temporary-flow cleanup. The report correctly blocks readiness while approval evidence is unavailable. This is an edited walkthrough of actual completed execution states, not a continuous recording of every action. The readability edition enlarges the recorded UI and adds editorial headings; select 1080p for detailed evidence text.
Challenges and what we learned
Exact-head package binding repaired initial artifact retrieval. Packet-derived rendering repaired blocker counts. Authenticated trace retrieval removed reliance on evidence pasted by an observer. The flow uses the supported ambient runtime without collector installation retries. A historical pre-agent startup failure recovered on one unchanged retry; its cause remains tracked in issue #3. Successful later runs do not establish platform reliability improvement. Provenance is unsigned source/history, and package archive bytes were not independently rehashed.
Testing access
The public MIT source and CI are inspectable without credentials. The private managed flow is visible to authorized event-project members and the relevant organizer owners. An existing organizer viewing route was verified; testing from a judge account has not been performed. Anonymous session access is unavailable. Use an existing authorized organizer account to inspect AI > Flows > Release Steward v1.4.0 and the linked sessions. The README includes prerequisites, configuration import, Mention enablement and acceptance checks. For a fresh audit use a disposable MR with current CI and real evidence. An unavailable approval observation must block readiness.
Entry and next steps
Individual entrant; Path A / Start Fresh; Supervised. The project was created after the October 5 start. No Google Cloud bonus is claimed. Solo entry does not require a separate team member to review the MR. The current demo and evidence package are ready for the entrant's final submission handoff. Production actions remain human-controlled.
Built With
- gitlab
- python
Log in or sign up for Devpost to join the conversation.