TasteFit

Inspiration

Qloo already knows what a neighborhood's audience actually loves. The missing piece is the lease: pin a Chicago block, see who already eats there, and walk away with a written GO / ADJUST / NO-GO before anyone signs.

Opening a restaurant usually starts with a lease, and the lease is signed before anyone checks whether the neighborhood wants that kind of food. TasteFit is the written first answer. The taste graph is Qloo. The survival coin is Chicago licences. We keep those two apart on purpose.

TasteFit started on GitHub as an MIT project with no CI, no tests and no post-deploy check (last pre-GitLab commit 8c465c1). People act on its verdict with real money, and nobody on the team does DevOps full time. So we also asked: can agents look after the project when something happens, while a person still decides what gets merged?

What it does

The product. A founder or broker pins a Chicago unit and types a concept. TasteFit calls Qloo Taste AI — find_tags, recommend, and area_taste — at most 25 times. The map shows the named places that audience already loves (Antique Taco, Piece Pizzeria, The Wormhole Coffee on a Wicker Park pin). Next to that exhibit sit Census ACS figures for the tract, Chicago business licences, and a harvest-matched affine rent. Print memo is that pin's report: Qloo loves, census tables, the plugged-in maths, landlord and founder voices, and a Limits section. The pin is a cell to scout, not a vetted address. Write [email protected].

Qloo is taste, not survival. On nine Chicago areas, Qloo's top 3 caught 29% of surviving catalog openings. A citywide baseline caught 68%. The 90% interval for Qloo minus that baseline is −66 to −4 points. No measurable gain as a predictor of who stays open. That result is on /evidence, committed, and printed in every memo's Limits. Brokers still get a taste exhibit they can show a landlord. Founders still get a coin they can see.

The survival coin. A 2000-draw Chicago-calibrated runway (κ=0, local hazard = 1) sits next to the taste graph. Rent is affine, R = b + α G, with b harvest-matched so 80% of draws still open at a joint-venture share. Expected shortfall, Merton distance-to-default, Kelly, and Vasicek ρ=0.12 are in the memo with an "in English" column. No discounting and no interest.

Try it. Live demo: https://tastefit-776637567140.us-central1.run.app — pin a Chicago block. 60-second walkthrough: https://tastefit-776637567140.us-central1.run.app/walkthrough.

The factory. GitLab Duo flows run Plan → Create → Review → Verify → Release on every issue, merge request and pipeline. Pipeline Medic opened a fix merge request within two minutes of every real failure so far. Domain Reviewer has answered NO-GO on our own merge requests. A person still merges.

How we built it

The app is a standard-library Python HTTP server that streams agent steps to a single-page front end; agent.py holds the LLM tool loop (any OpenAI-compatible endpoint with tool calling), qloo.py wraps qloo exec (Qloo Taste AI hackathon harness: find_tags / recommend / area_taste), geo.py the site maths, census.py Census Reporter ACS. It ships as a Docker image. Qloo responses are used within a request and never persisted. Only a concept and a place name go to Qloo.

Pipeline (.gitlab-ci.yml): 7 stages, 15 jobs: unit-tests, lint, flows-lint, image-build, semgrep-sast, secret_detection, dependency-scanning, container_scanning, cve-gate, sbom, sign-image, verify-signature, deploy-render, smoke-test, release. All 15 passed on main pipeline 2935652252. A daily 06:00 UTC schedule rebuilds, rescans and checks that production is up. Live production is Google Cloud Run, commit-verified at https://tastefit-776637567140.us-central1.run.app.
Flows (.gitlab/duo/flows/): published in the AI Catalog with event triggers; rules shared between humans and agents in AGENTS.md and skills/tastefit-guardrails/.

The loop, measured. Time from a failed job to the Medic fix MR, on every real failure so far:

Failure	Fix MR	Delay
smoke-test on `main`	!1	1 min 39 s
release on `main`	!9	1 min 56 s
lint on a research branch	!10	1 min 48 s
lint on `main`	!11	1 min 10 s

Each got a Domain Reviewer GO and was merged by a person.

Seeded benchmark. We opened eight merge requests through the API, each with one planted problem and no hint in its title or description, and recorded what the agents did without stepping in. All seven planted problems were flagged (six NO-GO, one ADJUST) and the harmless change got GO; every verdict arrived within a minute. All three Medic fixes (!24, !25, !26) were correct and minimal; none edited a test to make it pass. On the duo/ branch that edited AGENTS.md, policy-guard went red and Medic correctly opened no fix.

Plan to production. Issue Planner planned #15 within 90 seconds of its creation and asked for decisions; a person answered and implemented it in !12; Domain Reviewer answered ADJUST (5 findings), then GO after the fix; it was merged, deployed, released as v1.96, and Release Scribe noted the shipment on #15.

Autonomy level: Supervised. Flows start on events, decide what to do, open MRs and issues, and avoid duplicates and loops by themselves. A person merges every change (and assigns the reviewer bot on bot-created MRs). We chose that on purpose: people act on TasteFit's memo with money.

Challenges we ran into

A false failure in our own smoke test. curl ... | grep -q failed in CI with curl exit 23: grep -q closed the pipe under pipefail. Pipeline Medic diagnosed it and opened a one-line fix 1 min 39 s later.
A container image full of CVEs. Release Scribe's first notes reported 338 container findings (5 Critical, 67 High) and filed a grouped security issue (#2). The Alpine rebuild (!3) brought the image GitLab builds from the deployed commit to 0.
A tool that rejected our calls. create_vulnerability_issue rejected our calls, so Release Scribe groups findings in one issue instead.
Trigger edges. Bot-created MRs do not fire the MR-created trigger, so a person assigns Domain Reviewer on them.
Our own policy had a gap. The benchmark showed the Reviewer answering only ADJUST on a memo told to give an exact street address, exactly as its rubric said. See below.
Qloo as judge, not as oracle. The Chicago 2023–2024 backtest did not let us claim Qloo predicts survival. Publishing that on /evidence and in every memo's Limits was the honest product decision.

Accomplishments that we're proud of

Four real failures, four fix MRs opened by Pipeline Medic in under 2 minutes each, without being asked.
The reviewer said no to us, twice. It answered NO-GO when we skipped security jobs on docs-only commits (!5, rule 8), and NO-GO on a real bug: the Chicago rent ceiling was fitted under the Paris rent share; after the fix the restaurant ceiling went from $5,970 to $3,230 (!14).
The benchmark found a policy gap, and a human closed it. We made rule 6 blocking in !27 (reviewed GO by the Reviewer itself), published the flow as 1.2.0, re-ran it, and the verdict became NO-GO.
From 338 container findings to 0, and an image 141 MB → 100 MB compressed (−29%).
Before vs after: no tests, no CI, no scans → 164 unit tests, a 7-stage signed and scanned pipeline, commit-verified deploys, and GitLab Releases with image digest and SBOM.
A pin-specific Print memo that a broker can hand a landlord: Qloo loves, Census ACS, affine rent, ES / Merton / Kelly, and Limits — in English next to the formulae. Contact on the site and the memo: [email protected].

What we learned

Event triggers are the difference between an assistant and a teammate: the value came from flows starting on their own when a pipeline failed or passed.
Small, explicit toolsets keep agents safe. Leaving out a merge tool was the simplest way to keep a person in charge.
A seeded benchmark tests the policy, not just the agent: the Reviewer followed its rubric exactly, and the rubric was what needed fixing.
Be precise about what you scanned: GitLab scans and signs the image it builds; production on Cloud Run is the live demo. Qloo is the taste exhibit; Chicago licences are the survival coin. Mixing those two would have been a prettier lie.

What's next for TasteFit

Triage the three Medium SAST findings (SSRF, CWE-918) and the 4 High dependency findings tracked in #12, and clear the stale Vulnerability Report records for the old Debian image (#9).
Make bot-created MRs get a Domain Reviewer automatically, removing the last manual step before the merge.
Run the exact image GitLab scans and signs on Google Cloud Run, so the scanned bytes are the ones that serve users.
Calibrate the rent ceiling for more cities with official survival data.
Keep Qloo as the taste exhibit and keep publishing the Chicago backtest so a founder can prove us wrong.