Inspiration
A change can pass code review and still ship slower and dirtier. Teams find out weeks later, on a dashboard and a cloud bill, with no link back to the merge request that caused it. We wanted that answered by a measurement, not by a reviewer's guess.
What it does
SloSentry is a fail-closed release gate with supervised autonomy. Every merge request pipeline builds the image once, pins its digest, scans that exact digest, load-tests it with tracing, reconciles every request with its trace, and evaluates the p95 latency and error budgets in slo.yaml. The same run estimates Software Carbon Intensity (GSF SCI v1.1.0) and compares it with the default-branch baseline. Missing or partial evidence fails the gate. A passing decision promotes the same digest to staging; a failing one records the rollback and refuses promotion.
A custom GitLab Duo flow, triggered by pipeline events, then reads only that pipeline's evidence, checks every identity, writes a review (GATE: PASS or FAIL, measurements, evidence limits) and stops for a person. The approval acts: on a failed gate the flow records the decision, marks the merge request as a draft and opens the breach issue for its author with the offending traces, labelled needs-fix. It has no merge, commit or deploy tools.
In the demo, a one-line regression went from p95 0.8 ms to 801.9 ms against a 300 ms budget and from 12.8 to 231.8 gCO2e per million requests (modelled), about 80 kg CO2e a year more at one million requests a day (projection). It never reached staging.
How we built it (lifecycle stages)
Plan: breach issues, issue template, assignment, milestone. Create: MR pipelines, Duo Code Review, AGENTS.md rules. Verify: 57 unit tests, load smoke, SLO gate, evidence reconciliation. Package: build once, immutable digest. Secure: SAST, Secret Detection, Dependency Scanning, Container Scanning of the candidate digest. Release: final release decision, same-digest promotion, GitLab Release with evidence on tags. Configure: agent-config.yml, policy as YAML, Cloud Run jobs. Monitor: traces and metrics, MR metrics report, SCI baseline comparison. Govern: fail-closed gate, CODEOWNERS, pipelines-must-succeed, recorded human decision.
Challenges
Making the agent honest about state: evaluation, registry promotion, hosted deployment and recovery are separate states, and the flow must never present a proposal as approval. Carbon numbers had to be defensible, so every coefficient is sourced and baselines only compare when method, grid, workload and runner match.
What's next
Carbon in enforce mode after repeated baselines on one runner class, and the reusable CI component in the catalog for other services.
Provenance
Built during the submission period. Development history (MRs, Duo sessions, pipelines) lives in https://gitlab.com/gtm-labs-group/slosentry from 23 October 2026; this submission copy was created in the provisioned workspace on 26 October after that namespace ran out of compute minutes.
Log in or sign up for Devpost to join the conversation.