Termivance

Termivance Control Room shows the deterministic BLOCKED verdict, three independent claims, and an auditable evidence chain.
Real GitLab Duo Custom Flow investigates Issue #5 and identifies a surviving create-pages job that could republish the site.
Retirement Obligation Graph links the CI redeployment risk to unresolved requirements and the BLOCKED decision.
Real GitLab Pages test site serving its unique marker. Publication is observed; retirement and absence are not claimed.
Bounded repair guidance and a 900-second evidence limit prevent stale or incomplete proof from authorizing retirement.

Inspiration — Deleting Code Is Not Retiring Software

Software has a deployment lifecycle, but its retirement is often reduced to a checklist: stop a service, remove a deployment, close a project, and assume it is gone.

That assumption can be dangerous.

A forgotten CI/CD job, scheduled trigger, automation token, or surviving deployment configuration may bring supposedly retired software back online. A resource that appears unavailable may still be published elsewhere. A temporary HTTP 404 or an inaccessible administration API is not proof of deletion.

For SREs, platform engineers, and security teams, this creates a difficult question:

How can we safely retire software—and prove exactly what has and has not been retired?

We built Termivance, a Proof-Bounded Software Retirement Protocol, to answer that question with verifiable evidence instead of assumptions.

What It Does

Termivance turns software retirement into a supervised, evidence-bound lifecycle:

Discover → Analyze → Authorize → Retire → Prove → Watch

Its central innovation is separating three claims that conventional decommissioning processes often confuse:

SAFE_TO_RETIRE: Have all deterministic retirement prerequisites been satisfied?
OBSERVED_ABSENT: Has the resource actually disappeared, as independently observed after an authorized action?
RESURRECTION_CONTROLLED: Are surviving mechanisms that could recreate the resource demonstrably controlled?

Each claim requires distinct evidence. None can be granted simply because an AI agent recommends an action or an API returns an error.

Termivance introduces three complementary mechanisms:

1. Retirement Obligation Graph (ROG). A deterministic graph connecting resource identities, deployment dependencies, required permissions, operator authorizations, unresolved work, and redeployment risks. Retirement is blocked whenever necessary obligations remain violated, unknown, or unverified.

2. Bounded Absence. An absence claim is restricted to an exact target, independently checked provider surfaces, timestamps, and evidence freshness. Termivance never claims universal or perpetual absence.

3. Retirement Reversal Control. A resource can reappear after being unpublished. Termivance detects surviving redeployment mechanisms, distinguishes potential resurrection from observed reappearance, and refuses to claim future control without adequate evidence.

How We Built It — GitLab Duo and Deterministic Python

Termivance is a new GitLab-native project developed for the October 2026 GitLab Transcend hackathon under Path A: Start Fresh / Supervised.

Its architecture combines one genuine GitLab Duo Custom Flow agent with a deterministic Python execution and verification engine.

The GitLab Duo agent, Termivance Retirement Analyst (Catalog Item 1018562), autonomously investigates retirement requests submitted through GitLab issues. It reads repository trees and configuration files, discovers relevant dependencies, and publishes structured candidate findings.

The demonstrated investigation is recorded in GitLab Issue #5, Duo Session 9710085.

The agent independently discovered an important risk in disposable target project 87785099: its .gitlab-ci.yml contains a create-pages job with pages: true. A subsequent pipeline execution could republish the site after an attempted unpublication.

Termivance's Python engine then independently evaluates the candidates against GitLab provider evidence. The seven Duo claims produced:

4 corroborated findings
2 unresolved findings
1 contextual-only finding

Crucially, AI text cannot create authority. The deterministic engine alone controls target selection, provider verification, eligibility, mutation permissions, and final verdicts.

The supervised continuation is operator/CI-initiated: a genuine Duo investigation contributes candidate findings, followed by independently executed deterministic steps. We do not claim an unsupported, fully autonomous end-to-end handoff.

The Real Demonstration — Retirement Correctly BLOCKED

Our demonstration uses a real, isolated, disposable GitLab Pages project rather than an invented resource or a simulated provider.

Target project: 87785099
Published Pages target: https://termivance-b3-disposable-pages-demo-42a1a9.gitlab.io/

The Pages site was genuinely published and independently observed serving a distinctive content marker over HTTP 200.

However, the retirement request could not safely proceed.

The deterministic engine evaluated eight retirement obligations and identified three violated obligations and one unknown. Its actual decision was:

Independent claim	Demonstrated outcome
SAFE_TO_RETIRE	BLOCKED
OBSERVED_ABSENT	NOT_CLAIMED
RESURRECTION_CONTROLLED	NOT_CLAIMED

The reasons are concrete:

A surviving CI deployment path could recreate the Pages site.
The Pages administration API returned HTTP 403 for the available Developer-level identity.
The hackathon organizers did not grant the requested Maintainer elevation.
No valid, independent, single-use operator authorization was available.

The supervised review ran against live read-only GitLab observations and completed its seven-step review, including six steps executed during the demonstrated run. The actual execution output confirmed VERDICT_CONFIRMED_BLOCKED.

A separate negative-control command attempted to enter the authorized Pages retirement path without the required independent operator trust policy. The executor refused before performing any mutation.

No Pages unpublication occurred. No project was deleted. No observed-absence or resurrection-control verdict was invented.

A correctly blocked unsafe retirement is a successful safety result.

Safety Architecture and Evidence Integrity

Termivance implements explicit protection boundaries:

Immutable target identity and endpoint restrictions.
A protected-resource registry preventing mutation of canonical or shared projects.
A GET-only GitLab provider observation transport.
Operator approval provenance and HMAC verification.
An atomic, durable, single-use authorization ledger.
A narrowly scoped Pages unpublish capability, guarded by deterministic eligibility.
Independent post-action read-back requirements before absence can be claimed.
Tamper-evident Proof Capsules with SHA-256 manifests.
A contractual evidence freshness limit of 900 seconds.
Fail-closed handling of inaccessible, contradictory, missing, or stale evidence.

It also provides bounded candidate repair guidance derived from the obligation graph and an on-demand resurrection monitor that can invalidate unsupported historical conclusions.

The browser-based Termivance Control Room presents the recorded decision, resource portfolio, obligation graph, hypothetical simulations, Duo candidate reconciliation, provider evidence, authorization boundaries, and proof capsule.

Its static interface explicitly identifies historical snapshots and makes no live-provider claims merely because a user opens the page.

Verification and DevSecOps Lifecycle Coverage

Termivance uses real GitLab CI/CD to run:

563 deterministic tests
40 safety-contract assertions
Static checks and CLI verification

A separate, non-canonical GitHub Actions QA observer performs read-only GitLab API checks and records source-revision parity, provider observations, timestamps, and evidence manifests. Its archived observations are time-bounded and do not replace GitLab as the authoritative repository.

The project touches eight DevSecOps lifecycle stages, with clear differences in scope:

Plan: GitLab Duo investigates retirement requests and identifies obligations.
Create: Duo authors structured GitLab issue findings; it does not generate source-code changes or merge requests.
Verify: GitLab CI runs deterministic tests and safety checks; ordinary CI is not presented as agent-driven automation.
Package: The Python core generates tamper-evident Proof Capsules, not GitLab Package Registry packages.
Secure: Deterministic authorization, target protection, and fail-closed mutation controls.
Configure: Read-only inspection of deployment configurations and environments; no configuration changes are claimed.
Monitor: On-demand resurrection checks and separately scheduled external QA observations; not a continuous autonomous GitLab Duo monitor.
Govern: Explicit approval boundaries, deterministic eligibility, audit evidence, and human-controlled outcomes.

Release is intentionally not claimed: the actual Pages retirement action was blocked and never executed.

Challenges and What We Learned

The hardest challenge was not detecting a risky CI job. It was preventing incomplete evidence from becoming a false guarantee.

GitLab's actual authorization boundaries made this particularly important. Our Developer identity could not administer the Pages endpoint, and elevated access was unavailable under the competition conditions.

Rather than bypassing those boundaries or simulating deletion, we preserved them and demonstrated the real refusal.

We also learned that an AI-generated explanation, a successful API request, a published website, and a verified absence are fundamentally different kinds of evidence. Treating them separately makes an automation system safer and more auditable.

Impact and Future Direction

Termivance is intended for platform engineering, SRE, DevSecOps, and compliance teams responsible for retiring services, environments, integrations, and legacy infrastructure.

Its immediate value is preventing unsafe retirement decisions and exposing how software could silently return after decommissioning.

The longer-term direction is authorized retirement across additional providers, stronger independently observed resurrection controls, and reusable audit-grade retirement evidence.

These are future extensions, not claims about the current demonstration.

Termivance does not promise that software is gone when the evidence cannot establish it. It proves what it can, identifies what it cannot, and blocks the rest.

Software retirement, proven within bounds.

Canonical MIT-licensed GitLab repository:
https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/39306908/termivance

Real GitLab Duo investigation:
https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/39306908/termivance/-/issues/5

GitLab CI pipeline:
https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/39306908/termivance/-/pipelines/2973233807