Self-Heal Guardian

Self-Heal Guardian
The DevSecOps Receipt
The Planner in action
Security remediation
Successful CI/CD pipeline
Live application and API

Inspiration

Open-source projects can remain useful long after their original maintainers stop maintaining them. We started with the FastAPI RealWorld example application, whose upstream development dates back to August 2022. After importing it into GitLab on October 11, 2026, its old CI setup failed during installation before tests could run.

The bigger problem was not just broken code. The work after a code change—debugging, security review, compliance, deployment, release documentation, and incident response—was fragmented and largely manual. We wanted to automate that lifecycle without handing control of production to AI.

What it does

Self-Heal Guardian is a supervised DevSecOps automation system built with the GitLab Duo Agent Platform. One supervisor coordinates eight specialist agents:

Planner: Turns an issue into an implementation plan, testable acceptance criteria, and actionable tasks. It raises questions instead of guessing.
Pipeline Fixer: Diagnoses failing tests and commits repairs to the merge-request branch.
Security Remediator: Combines security scanner findings with agent review to identify and remediate vulnerabilities and leaked secrets.
Code Reviewer: Posts severity-rated inline review comments.
Compliance Officer: Checks requirements such as issue links, protected paths, dependencies, tests, secrets, and licensing.
Release Manager: Documents human-approved production releases.
Deployment Monitor: Diagnoses failed deployments and opens incidents.
Deployment Reporter: Provides read-only deployment diagnoses on merge requests.

The supervisor coordinates their work and posts one DevSecOps Receipt that consolidates evidence across all nine lifecycle stages: Plan, Create, Verify, Package, Secure, Release, Configure, Monitor, and Govern.

How we built it

The automation uses a custom GitLab Duo flow in .gitlab/duo/flows/guardian.yaml, shared rules in AGENTS.md, and native GitLab triggers for issue mentions and pipeline events.

A GitLab CI/CD pipeline runs tests, enforces 100% test coverage, performs SAST and Secret Detection, packages the application into a container image, and deploys to staging. The live application runs on Render with Neon PostgreSQL.

We added version-verified smoke tests: each built image carries its commit identifier, and the smoke test waits for /api/version to report the expected version. This verifies that the intended release is running, rather than merely checking that an endpoint responds.

We also improved the visitor experience with a clean, typographic landing page, clearer API documentation, and links to the live release and source project.

Safety is enforced by capabilities, not just prompts. Agents cannot merge, approve, or perform the human-controlled production deployment. GitLab permissions protect the main branch, production secrets are protected, logs and issue content are treated as untrusted input, and a loop guard prevents agent-triggered pipelines from repeatedly retriggering the agents.

Challenges

Reviving an older codebase exposed dependency and CI compatibility issues, including legacy Poetry behavior and warnings that caused installation or test jobs to fail. Another challenge was that static analysis alone did not identify every security problem, so we combined scanner results with independent agent review.

We also refined the autonomy model. The initial approach opened separate fix merge requests for failures; the supervised workflow now lets agents work on the relevant merge-request branch while leaving the final merge and production decision to a human.

Accomplishments

Fixed a hidden authentication regression that caused 56 tests to fail across five files. The recorded run took approximately 2 minutes and 31 seconds from merge-request opening to the fix.
Identified and remediated an SQL-injection issue that static analysis had missed.
Removed a leaked token and flagged the need for rotation.
Generated an implementation plan and three tasks from an issue in approximately 83 seconds.
Had the Guardian review its own configuration, identify real flaws, and help correct them.
Demonstrated all nine DevSecOps lifecycle stages, version-verified deployment, release notes, and incident reporting.
Kept production deployment behind a human approval gate.

These results come from recorded project runs rather than hypothetical demonstrations.

What we learned

Security scanners are necessary, but they are not sufficient. Independent reviewers can catch problems that a single tool misses. We also learned that the strongest guardrail is often a missing capability: an agent cannot misuse a production action if it does not have the tool or permission to perform that action.

Self-Heal Guardian shows how GitLab Duo can automate the repetitive work after code is written while leaving critical production decisions with the people responsible for the software.

Built during the submission period

The upstream application existed before the hackathon. The GitLab import, CI/CD modernization, Docker changes, custom agent flow, specialist agents, shared agent rules, deployment setup, version endpoint, and the surrounding automation were developed during the submission period beginning October 5, 2026. The import took place on October 11, 2026.

Original project: https://github.com/nsidnev/fastapi-realworld-example-app