Shadow Fleet — WORM-Sealed Agentic GitLab Orbit Intelligence

Shadow Fleet deploys 9 sovereign agents through GitLab Orbit. Dead repos resurrected. Every AI decision WORM-sealed, SHA-256 signed, Ed25519 immutable. We don't encrypt. We resurrect.

Comment 2

Shadow Fleet is an Orbit-powered agent fleet. GitLab Orbit provides the repository intelligence layer; Shadow Fleet agents consume that intelligence, analyze abandoned repos, propose recovery actions, and WORM-seal every decision.

It discovers stale repositories, analyzes dependencies and architecture, assigns specialized agents to propose restoration work, and WORM-seals every recommendation with SHA-256 hash chaining and Ed25519 signatures.

The result: autonomous repo recovery with a verifiable chain of custody.

Open source software powers much of the modern internet, yet millions of repositories are abandoned, unmaintained, or silently decaying. These projects often remain dependencies for active systems, creating hidden operational and security risks.

At the same time, AI coding agents face a fundamental trust problem. They can analyze code, generate fixes, and recommend changes, but users have limited visibility into how conclusions were reached. Findings are often difficult to audit, reproduce, or verify independently.

We asked a simple question:

What if AI agents could not only analyze and repair software, but also produce a verifiable chain of evidence for every decision they make?

Shadow Fleet was built to answer that question.

What It Does

Shadow Fleet is a multi-agent software recovery platform designed to identify, analyze, and repair aging or abandoned code repositories.

Using structured repository intelligence from GitLab Orbit, agents build a semantic understanding of a codebase before proposing changes.

Every action taken by the system is recorded to a cryptographically verifiable append-only ledger, creating a complete chain of custody from discovery to recommendation.

The result is a system that provides:

• Repository analysis • Dependency and architecture discovery • Repair recommendations • Multi-agent review workflows • Cryptographically verifiable audit trails

How We Built It

The platform operates as a specialized agent swarm consisting of nine independent agents.

Each agent has a clearly defined responsibility and cannot act outside its assigned domain.

Key components include:

Repository Intelligence Layer

GitLab Orbit provides semantic codebase context including dependency relationships, symbol graphs, and structural metadata.

Multi-Agent Review Layer

  • AHMAD-BOT discovers candidate repositories
  • EDUALC performs restoration analysis
  • BIFROST translates findings across multiple languages and verification systems
  • METRIC-STREAM performs large-scale auditing
  • BOB synthesizes conclusions and coordinates reasoning
  • ERRANT validates actions through constitutional logic rules

Cryptographic Accountability Layer

Every event is written to an append-only WORM ledger.

Each entry contains:

  • Timestamp
  • Event payload
  • Previous hash
  • Current hash
  • Digital signature

The ledger creates a tamper-evident history of all agent activity.

Verification Layer

Ed25519 signatures ensure authenticity.

Hash chaining ensures integrity.

Runtime validation ensures that modifications cannot occur without detection.

Challenges We Ran Into

Prompt Injection in Source Code

Repositories contain comments, documentation, commit messages, and generated content that can influence AI systems.

We developed a preprocessing layer that identifies and isolates instruction-like content before it enters the reasoning pipeline.

Maintaining Auditability at Scale

Repository analysis can involve thousands of files.

Maintaining cryptographic verification while preserving responsiveness required careful optimization of ledger writes and validation procedures.

Agent Governance

Coordinating multiple agents without allowing unrestricted autonomy required a policy enforcement layer.

We implemented constitutional validation rules that evaluate proposed actions before they become part of the permanent record.

What We Learned

AI systems interacting with software infrastructure require stronger accountability guarantees than traditional consumer AI applications.

The most important output is not simply a recommendation.

The most important output is a recommendation that can be independently verified.

By combining structured repository intelligence with cryptographic provenance, Shadow Fleet transforms AI-assisted software recovery into a transparent and auditable process.

Impact

Shadow Fleet demonstrates a practical framework for trustworthy AI-assisted software maintenance.

Instead of asking users to trust autonomous agents, the system produces evidence that can be inspected, validated, and reproduced.

Structured repository intelligence in.

Verifiable decisions out.

Every finding has provenance.

Every action has a history.

Every recommendation leaves a trail. GitHub (governance layer): https://github.com/SNAPKITTYWEST/grisp-shadow-fleet GitLab (sovereign node): https://gitlab.com/ahmad-parr-dev1-group/shadow-orchestrator Crawl layer: https://github.com/SNAPKITTYWEST/agentic-arena Live page: https://snapkittywest.github.io/grisp-shadow-fleet/

GRISP: Governance · Resurrection · ICP · Shadow · Prolog. Two platforms. One WORM chain. Three models. The graveyard remembers.

Fleet scope: 34 total sovereign agents across the broader Shadow Fleet. 9 active agents are used in this GitLab Orbit recovery workflow.

GitLab Orbit ↓ Repository intelligence ↓ 9-agent review layer ↓ Prompt-injection preprocessing ↓ Constitutional validation ↓ WORM ledger: SHA-256 + Ed25519 ↓ Verifiable repair recommendation

Built With

Share this project:

Updates