-
-
A supervised GitLab Duo repair, exact-source evidence, and a downstream consumer test.
Submitted as Bring Your Own: Supervised. The original MIT project linked for this entry is kevva/decompress; the worked Duo repair and consumer comparison shown here use the separate MIT project jonschlinkert/parse-git-config.
The problem
An abandoned dependency can have a known vulnerability and no fixed upstream release. A green patch in a fork is still not enough for a maintainer: the consuming app must be able to adopt the exact repaired package.
What Revival does
Revival connects the advisory, a GitLab Duo repair, its source and CI evidence, and a downstream consumer comparison. The public showcase makes the adoption decision concrete: run the same security and ordinary-use tests against upstream and the repaired package, then download the exact package and consumer that were tested.
The worked example is parse-git-config. An earlier supervised GitLab Duo repair was merged. In the maintained consumer, upstream fails the hostile-config test but passes ordinary config; the repaired package passes both. The repair source is bound by SHA-256 to the merged Duo source and to the downloadable adoption ZIP. A fresh anonymous download installed with Node.js 22 and passed the same two tests.
GitLab implementation
The project uses a custom GitLab Duo AI Catalog flow, Dependency Scanning, GitLab issue and merge request APIs, GitLab CI, Python and Node.js. The public showcase pipeline verifies both adoption ZIPs. The repository includes an MIT license, runnable instructions and Google Cloud deployment code.
A separate fresh ip dependency scan produced one High finding and its manual trigger opened issue #7. The first supervised run stopped safely because it compared a temporary workload ref with the protected target branch by name. We corrected that guard to compare the issue-pinned source SHA, protected branch HEAD and workload pipeline identity. A supervised retry was created, but its runner job did not execute before the resource window expired. This is not presented as a second completed repair or a hands-off chain.
Original GitLab Duo run evidence
The public evidence bundle includes selected GitLab API records and original test output from the completed 19 October custom-flow session. It links the first repair commit to its three passing jobs, the subsequent Duo review, and the passing merged branch. The documentation-placement adjustment after Duo's review was made by our Revival agent.
Read the original-run evidence and test output.
The original issue, merge request, pipeline history and job logs are now public. Inspect the native GitLab Duo repair history and the original repair pipeline. The selected historical export above remains available; it is not a new Duo execution, and the public verifier checks its hashes and relationships alongside the consumer checks.
What we learned
The useful gate is the consuming application, not a patch that merely looks plausible. The result has to preserve the same failing test, the fixed source, and a package another maintainer can install. Runner and policy failures remain visible rather than being counted as successful automation.
Try it
Open the live showcase and choose From Duo fix to your app. Compare the upstream and fixed outputs, inspect the source and provenance, then download the consumer ZIP. Run npm ci --ignore-scripts --no-audit --no-fund and npm test. The no-finding control is a saved OSV response, not a guarantee that a package is safe. No npm package ownership transfer or upstream publication is claimed.
Live demo: https://revival-568004190078.us-central1.run.app
Public source and CI: https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43463120/showcase
Original MIT project: https://github.com/kevva/decompress by Kevin Mårtensson and contributors. Other package authors and licenses are credited in the showcase.
Log in or sign up for Devpost to join the conversation.