RetireSafe

Verified Retirement Receipt — 9/9 proof, GitLab Duo MR !10, Cloud Run verification
Real GitLab Duo cleanup — MR !10 created after SAFE_TO_RETIRE evidence

Inspiration

Temporary release code rarely disappears when it should. Feature flags, fallback paths, rollout switches, and compatibility branches often remain in production because deleting them feels riskier than leaving them behind.

But a developer looking at a 100% rollout still cannot confidently answer a more important question: is the legacy path actually safe to remove?

We built RetireSafe around one principle:

AI cleans. Evidence decides. Proof verifies.

What it does

RetireSafe turns release-code retirement into a verifiable DevSecOps lifecycle.

It first evaluates deterministic production evidence:

rollout must be 100%

legacy usage must be zero

production must be healthy

there must be no open blocking incidents

If those requirements are not satisfied, RetireSafe returns RETIREMENT_BLOCKED and the AI cleanup must stop.

When the evidence reaches SAFE_TO_RETIRE, our GitLab Duo Custom Flow can inspect the repository, remove the obsolete release machinery, create a branch, run verification, and open a Merge Request.

The cleanup is then checked by our deterministic Proof Engine using nine behavioral scenarios and shadow retirement.

Only after the proof succeeds can RetireSafe issue RETIREMENT_VERIFIED and generate a Retirement Receipt containing the production evidence, proof result, GitLab Duo automation metadata, deployment metadata, and a SHA-256 integrity hash.

How we built it

The backend is built with FastAPI and Python. A React/Vite dashboard provides live visibility into evidence, proof results, GitLab Duo cleanup, telemetry, and the final Retirement Receipt.

We created a GitLab Duo Custom Flow called RetireSafe Retirement Flow.

We tested the safety boundary with two real Duo executions.

In the blocked run, legacy traffic was still present. The flow correctly stopped without modifying files, creating a branch, or opening an MR.

In the safe run, the evidence passed and GitLab Duo autonomously inspected the repository, removed the legacy checkout fallback machinery, created the retire/new-checkout-legacy-fallback branch, ran tests, and opened MR !10.

The resulting changes passed our GitLab CI pipeline, including tests, GitLab SAST, Bandit, pip-audit, and a Docker image build.

The full application is deployed on Google Cloud Run as a single production container serving both the React frontend and FastAPI backend.

A real failure caught by the Proof Engine

One of the most important moments during development happened after the retirement evidence was already safe.

Our Proof Engine still rejected the retirement because zero and negative checkout amounts were incorrectly accepted by the application.

Instead of weakening the proof, we fixed the shared checkout validation.

After the fix, all nine deterministic scenarios passed.

This demonstrated exactly why RetireSafe separates eligibility from proof: production evidence can say that code is ready to be retired, while behavioral verification can still stop an unsafe retirement

Challenges we ran into

The hardest challenge was preventing AI automation from becoming the source of truth.

We wanted GitLab Duo to perform meaningful autonomous work without allowing an agent to decide for itself whether production code was safe to remove.

That led us to separate the system into deterministic evidence, AI cleanup, shadow verification, and final audit evidence.

We also had to make the Duo execution environment reproducible, integrate security and container verification into GitLab CI, preserve a compatibility implementation only for proof simulation, and package the React and FastAPI applications into one Cloud Run deployment.

Accomplishments that we're proud of

RetireSafe is not a mock automation.

We demonstrated a real blocked GitLab Duo execution, a real successful Duo cleanup, a real generated branch and Merge Request, a real CI/security pipeline, a deterministic 9/9 proof suite, a live Google Cloud deployment, post-deploy verification, and a cryptographically identifiable Retirement Receipt.

Most importantly, our Proof Engine found a real application bug during development and prevented us from claiming a safe retirement until the underlying behavior was fixed.

What we learned

Agentic automation becomes much more useful when it is surrounded by deterministic boundaries.

LLMs are good at understanding a repository and performing cleanup, but production safety should not depend only on an AI judgment.

The combination of evidence gates, GitLab Duo automation, deterministic proof, CI/security controls, deployment verification, and an auditable receipt gave us a much stronger workflow than any one component alone.

What's next for RetireSafe

RetireSafe currently demonstrates the lifecycle using new_checkout, but the same model could be extended to feature flags, migration guards, compatibility layers, experimental code, and stale configuration across larger repositories.

Future work could connect real observability providers, incident systems, feature-flag platforms, and repository history so that RetireSafe can continuously discover retirement candidates and prepare evidence-backed cleanup proposals across production systems.

Explain how your project meets the main technology requirement

RetireSafe uses the GitLab Duo Agent Platform through a real GitLab Duo Custom Flow named RetireSafe Retirement Flow.

The flow is governed by an explicit evidence contract. If the retirement state is unsafe, the Duo flow must stop without modifying files, creating a branch, or opening a Merge Request. We demonstrated this with a real blocked execution.

When the evidence reached SAFE_TO_RETIRE, GitLab Duo inspected the repository, removed the legacy checkout fallback machinery, created the retire/new-checkout-legacy-fallback branch, ran verification, and opened MR !10.

The generated cleanup then moved through GitLab CI/CD with automated testing, SAST, Python security checks, and Docker build verification before merge.

RetireSafe therefore uses GitLab Duo as an actual post-code automation component inside an end-to-end DevSecOps workflow rather than as a standalone chat or code-generation demo.

Testing instructions for application

No credentials are required.

Open the live RetireSafe dashboard.

Use the Blocked preset or inject legacy traffic and evaluate the gates. RetireSafe should return RETIREMENT_BLOCKED.

Reset the environment and select the Safe state. The dashboard should show 100% rollout, zero legacy traffic, healthy production, zero incidents, and SAFE_TO_RETIRE.

Run the Proof Engine. The live proof suite should complete with 9/9 scenarios passed and display SUITE PASSED.

Open the GitLab Duo AI Cleanup tab to inspect the recorded real Duo cleanup and MR !10.

Open the Retirement Receipt tab. It should show RETIREMENT_VERIFIED, the 9/9 proof result, GitLab Duo automation metadata, Google Cloud Run deployment metadata, post-deploy verification, and the SHA-256 receipt integrity value.

The application requires no login and can be tested directly from the deployed dashboard.