SafeRules

GitLab Duo agents guard the safety rules of a skincare checker after the code is written: they triage every rule change, block risky wording and run 415 tests before a human merges.

Comment

Inspiration

I spent twenty years working in community pharmacies, at the counter where people ask "can I use this with my medicine?". I built a skincare checker (Counter Check) that compares a product label with a person's skin, medicines and allergies. Then I realised the code is not the risky part. The risky part comes after: someone edits a safety rule, a warning gets weaker, a word like "safe" or "cure" slips in, and nobody notices. SafeRules is about that life after code.

What it does

SafeRules is a governed rule engine. Every change to a safety rule follows the same path on GitLab:

  1. A person opens a change request (an issue).
  2. SafeRules triage, a GitLab Duo flow, reads the issue and the code, assigns a rule area and a risk class (HIGH / MEDIUM / LOW), adds labels and posts a note with the questions the author must answer.
  3. SafeRules safety review, a second Duo flow, reviews the merge request: forbidden wording, weakened warnings, missing source, missing tests. It can request changes but never approves or merges.
  4. The pipeline runs typecheck, build, 415 automated tests (including clinical rule cases), SAST, secret detection, dependency audit, SBOM and a container image build.
  5. Only then does a human merge.

A governance dashboard in the live app shows all of this with real data from the public GitLab API: a catalogue of 107 rules (38 high, 52 medium, 17 low risk), change requests with the labels set by the triage agent, safety review verdicts, pipeline health and an audit timeline from request to human merge. The product check itself still works in demo mode, so judges can see the rules in action.

Demo only. Not medical advice.

How we built it

  • Built with an AI coding agent (Claude Code), directed and tested by me step by step.
  • Path B: SafeRules is a demo-mode copy of my MIT-licensed project Counter Check, with the camera and AI APIs removed, so the rules are the whole product.
  • GitLab Duo Agent Platform: custom flows written in YAML, triggered by mention only, using GitLab API tools (get_issue, create_issue_note, update_issue, repository reads).
  • GitLab CI/CD with stages for verify, secure, package and release; SAST and secret detection templates; manual, human-approved deploy jobs.
  • TanStack Start + TypeScript; deployed on Vercel (free tier) in demo mode.

Challenges we ran into

  • My first flow ran with no tools and gave a generic bug checklist. The fix was an API-only toolset and putting our rule areas and risk classes directly into the prompt.
  • The security scan templates expected a "test" stage our pipeline did not have, so the first pipeline was rejected.
  • The draft-change flow (flow 2) still does not get its tools after three attempts. It is documented honestly as not working yet.

Accomplishments that we're proud of

  • Two agents that do real work on a real project: the triage agent labelled a test request MEDIUM and spotted that the change was already covered; the safety agent caught "safe" and "cure" in a bad merge request and requested changes.
  • 415 of 415 tests passing, with security scans green on main.
  • Nothing is invented: the dashboard reads live data and falls back to a labelled snapshot.

What we learned

Agents are most useful when their job is narrow and their limits are written down: they triage and review, people decide. I also learned to treat a safety rule like a medicine label: every word counts.

What's next for SafeRules

  • Get the draft-change flow working, so a rule change can go from request to a reviewed merge request.
  • Scheduled probe and recall jobs that watch the live app and can roll back a bad rule.
  • Deploy on Google Cloud Run.

Built With

Share this project:

Updates

Submission history