Ripple

Renaming price_minor to amount_minor can break checkout and invoices while the producer stays healthy. Ripple connects that migration to two declared consumers in TypeScript and Python. In the recorded run, GitLab Duo repaired both, nine candidate jobs passed, and a separate owner-side controller merged the candidate, checked the merged SHA and verified five live endpoints. The loop needed no intermediate human action. It delivered a controlled HTTP fixture with sandbox invoices, using an off-CI controller and an unprotected isolated target.

The mechanism connects a declared contract migration, a dependency map and real consumer tests to native GitLab Duo execution. Opening a migration MR starts the flow through GitLab's MR-created trigger. Impact waits for actual failed checkout and invoice jobs, then identifies the affected scope. Compatibility uses structured edit tools to repair the TypeScript and Python consumers and their unit tests. Verification runs fixed checks, commits the narrow repair and pushes it in a standalone successful command. A separate remote-ref readback binds the pushed branch to the recorded repair SHA. Golden monetary assertions, producer v2 and the native edit allowlist remain unchanged.

The fresh 24 October episode is native session 9998438 and MR !20, with candidate 91b15a18d93b3ec02be5034f8bc513b052be81a1. All nine required jobs in candidate pipeline 2984083435 passed before the owner-side controller authorized integration. The controller independently checked native execution, real red consumer evidence, allowed source history, permissions and hard-green CI. It merged only into ripple/delivery-20261024-2 as 89841f1612d3b4d2fdc072de7267e5207c0f568d, then required both jobs in pipeline 2984087975 on that actual merged SHA. The completed receipt records no intermediate human decision, source correction or restart.

Delivery used the existing Render service and an exact-source provider Docker build, deployment dep-dbe5v66i0phs73epd0g0. Five live checks verified health and application SHA, the catalog product, actual bundled TypeScript checkout, Python sandbox invoice and baked build identity. All matched the merged source and immutable business values. The dated public delivery record maps the MR, native executor, candidate and merged pipelines, deployment identity and sanitized evidence. A model's success message, a green candidate pipeline or an attractive screen alone cannot satisfy those gates.

The boundaries matter. The controller ran off CI under the owner's local identity. Monitoring and control share that owner; the Duo service executor is separate. The isolated target is unprotected and inherited Developer grants remain disclosed. Application and native repair jobs did not receive deployment credentials. This is a real deployed HTTP contract fixture with sandbox invoices, not a payment system or customer outage. Package evidence includes the candidate source bundle and provider source build; no OCI registry release is claimed.

Earlier attempts, including stopped MR !18, remain separate history and receive no credit for this completed delivery. Judges can inspect the public repository, dated proof and read-only live endpoints without starting another migration. Ripple's value is the closed connection between a cross-language contract change, constrained native repair and measured deployed behavior.

Ripple closes the declared migration across two languages and checks the deployed sandbox against fixed business values. Duo supplied the consumer repair; a separate owner-side controller handled integration and delivery. Codex supported engineering and evidence assembly, Claude reviewed read-only, and the film combines real-run captures with retained Deepgram narration. The off-CI controller, shared owner identity and unprotected isolated target remain disclosed.