Attested Pipelines

Inspiration

Anthropic’s recent Scion engineering report documented AI agents driving merge volume from 2,500/day to over 30,000/day, reaching an unmistakable conclusion: the bottleneck is developer infrastructure built for human scale.

Merge queues, manual reviews, and passive pipeline green checks break down when code moves at agent velocity. Test results, SAST reports, and SBOMs pile up unverified and unconnected. We asked: What if every DevSecOps lifecycle stage required a declared claim before work started, and computed cryptographic proof before anything was allowed to advance?

What It Does

Attested Pipelines is a native claims-and-attestations layer built directly on top of GitLab objects across all 9 DevSecOps lifecycle stages:

Claim Before Work (GitLab Issues): Before an agent touches code, it declares its intent via a native GitLab Issue (claim::), defining paths, symbols, rationale, and a renewable lease. Semantic overlap detection rejects colliding claims in one clear sentence before two agents clobber a shared module. Computed Evidence, Never Asserted (CI Midway): Verification happens inside the agent's working loop. Producers compute real evidence (JUnit XML, SARIF SAST findings, CycloneDX SBOM, Weave semantic merge verdicts, Cloud Run deployment receipts) and emit signed HMAC-SHA256 attestations bound to the exact commit SHA and evidence hash. Policy-as-MR & The Autonomy Dial: .gitlab/attestation-policy.json governs stage advancement across three dial settings: Assisted: Human signs every step (/attest ). Supervised: Agent attests; human approves the outcome (MR approval). Hands-off: Auto-advances based purely on computed metric thresholds. Changing the autonomy dial is itself an attested Merge Request (Policy-as-MR). Machine-Checked 5-Guard Gate (Z3 Proven): Advancing any stage requires all 5 guards to hold (claimOk, attestationOk, evidenceHashOk, policyOk, casOk). We proved in Z3 that each guard is individually necessary, validated with a 32-combination differential test suite. Bi-Temporal Transparency Log & Epistemic Memory: Records transaction time separately from valid time. Corrections supersede without deleting past beliefs. Instructive resolutions crystallize into committed .gitlab/learnings/.

How We Built It

Language & Runtime: TypeScript / Node.js 22, Hono, Web Crypto API. Formal Verification: z3-solver proving guard necessity across all 25=32 2 5 =32 state combinations. GitLab Native Surfaces: Native GitLab Issues with claim templates, scoped labels, GitLab CI artifacts (reports: junit, reports: sast, reports: cyclonedx), MR approval rules, and GitLab Duo Agent Platform (.gitlab/duo/flow.yml, agent-config.yml, mcp.json). Semantic Entity Merge: Integrated Ataraxy-Labs Weave (v0.5.4) for entity-level merge classification (PROVEN, VERIFIED, REFUSED) with a deterministic plain-git fallback. Production Deployment: Fully automated continuous deployment to Google Cloud Run in us-central1 directly from .gitlab-ci.yml.

Challenges We Overcame

The "Asserted vs Computed" Seam: Avoiding mock pass flags. Every attestation in this system computes actual SHA-256 hashes of real parser outputs (JUnit XML, SARIF, SBOMs, Cloud Run HTTP 200 receipts). If a check didn't run, there is no attestation. Guard Combinations: Ensuring that fast-moving agents cannot race target branches. Guard 5 enforces Compare-And-Swap (CAS) on the mainline reference. Bi-Temporal Auditing: Modeling supersession chains so the system can answer what it believed at 2 PM yesterday without losing the ability to record new security scan findings. Accomplishments That We're Proud Of A working, zero-rerun Autonomy Dial Dashboard: flipping between Assisted, Supervised, and Hands-off dynamically re-evaluates all 9 stages against the exact same evidence in real-time. Mathematical rigor: Z3 solver proofs backing the 5-guard gate logic. True GitLab native alignment: no external database or proprietary black-box coordinator; state lives on GitLab Issues, MRs, and repo-versioned policy files.

What We Learned

Multi-agent collaboration fails at the coordination layer before it fails at code generation. Claiming paths and symbols before writing code prevents 90% of merge conflicts before they happen. Curated, in-repo markdown rules beat massive unstructured RAG stores for agent memory.

What's Next for Attested Pipelines

Deeper integration with GitLab Duo Workflow native triggers. Expansion of the Weave entity-level resolver with automated two-agent quorum arbitration for REFUSED AST conflicts.

Built With

• crypto
• hono
• typescript-/-node.js-22
• web