Risk-Adaptive Delivery Governor

Inspiration

AI can write code quickly, but shipping that code safely requires reliable evidence, risk assessment, and human accountability.

Traditional CI/CD pipelines often treat every change similarly. At the other extreme, autonomous AI workflows can create risks if they merge or deploy code without sufficient verification.

Risk-Adaptive Delivery Governor explores a safer approach: combining deterministic software delivery policies with supervised GitLab Duo workflows.

What it does

Risk-Adaptive Delivery Governor is a human-supervised, fail-closed delivery governance prototype.

The system is designed to:

Analyze merge-request changes and classify delivery risks.
Identify required verification gates.
Collect and validate GitLab CI/CD evidence.
Bind evidence to specific commits and merge requests.
Produce explainable diagnostic results.
Block release decisions when essential evidence is incomplete.

The prototype does not grant autonomous merge, release, or deployment authority.

How we built it

The project uses TypeScript, Node.js, GitLab APIs, GitLab CI/CD, and a supervised GitLab Duo Custom Flow.

The architecture includes a deterministic risk engine, change-context analysis, evidence collection, governance policies, and diagnostic validation.

Verified engineering results:

717 automated tests passed.
ESLint passed with no reported errors.
TypeScript type checking passed.
Six GitLab CI jobs passed in pipeline 2958136057.
Public source code and an MIT license are available on the implementation branch.

Challenges we faced

The greatest challenge was maintaining trustworthy execution boundaries between GitLab Duo automation, runner environments, and human release decisions.

During a controlled GitLab Duo execution, a diagnostic detected 11 untracked environment and editor configuration entries.

The system identified GIT_WORKTREE_DIRTY and stopped with exit code 1.

The resulting governance state remained conservative:

Release verdict: BLOCK
Permitted scope: NONE
Trust level: LOCAL_UNATTESTED

The system did not delete the files, bypass the safety check, or authorize a release.

The full live integration was not completed because the preflight blocked further execution. This is a documented limitation, not a successful production deployment.

What we learned

Trustworthy AI-assisted software delivery depends on reproducible evidence, deterministic rules, explicit trust boundaries, and human oversight.

A safe BLOCK decision can be more valuable than an unjustified success.

What's next

Future work includes resolving the runner-environment discrepancy, completing further controlled live validation, strengthening evidence attestation, and verifying wider runtime compatibility.