TONARI

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for TONARI

Inspiration

TONARI is an app I built on my own. It makes waiting at live shows more fun and spreads out the crowd on the way home. Every time I updated it, I had the same question: before releasing, what should I check, and can I check it the same way every time and keep the results? I wanted a setup where GitLab handles the checking and a person makes the final call with everything in front of them.

What it does

• Automatic checks on every change. Sending a change to GitLab runs a 10-job pipeline: plan:flow-contract, create:source-integrity, verify:protocol (runs the app's test suite), semgrep-sast, secret_detection, package:pages, secure:repository, release:manifest, configure:fail-closed and govern:audit. In pipeline 2972464080, all 10/10 jobs passed.
• App behavior tests. In a separate run, the app's npm test suite passed 238/238.
• Security scans. SAST ran across the whole app. It pointed out 2 spots in the file added in this change; a person reviewed each one and confirmed both are written safely. GitLab secret detection: 0 reported.
• GitLab Duo summary. A GitLab Duo flow writes a summary of the situation and the next items to check, based on information a person provides. Duo writes text proposals only; a person chooses what to adopt. Keeping decisions with people is the safer design.
• One release record. The app version and scan results are gathered into one record file, and a dedicated checker program confirms that all required items are present. Before release, a person looks at this record and decides.
• File-change (tamper) check. Adding one line to a saved copy of the record makes the check fail; restoring it makes it pass again (PASS → FAIL → PASS).

How we built it

• Imported the existing TONARI source (MIT) into a GitLab project and built the post-code automation around it in .gitlab-ci.yml, with stages covering plan, create, verify, secure, package, release, configure and govern.
• verify:protocol runs the Node.js test suite (npm test).
• Security: GitLab SAST (Semgrep analyzer) and GitLab Secret Detection templates in the pipeline.
• GitLab Duo Agent Platform: a proposal-only flow (no tools that change code), triggered by a person with the facts to summarize.
• Release record: a Node.js tool (tools/release-evidence.mjs) that writes the record and a checker that confirms every required item, plus a hash-based file-change check.
• Demo video narrated in English and Japanese, under 3 minutes.

Challenges we ran into

• Keeping the AI role clear: we designed the Duo flow so it can only write proposals, which kept every release decision with a person.
• Making results easy to act on: many check results are hard to read all at once, so we combined the Duo summary with one record file that a person can review quickly.
• Making the record trustworthy: we added a checker for required items and a file-change check so the record can be relied on later.

Accomplishments that we're proud of

• 10/10 pipeline jobs passed in pipeline 2972464080.
• 238/238 app tests passed (separate run).
• SAST across the whole app; both new spots in this change reviewed and confirmed safe. GitLab secret detection: 0 reported.
• Duo summaries that help a person grasp the situation quickly and decide calmly.
• A single record that answers "Did you really check?", with a tamper check demonstrated PASS → FAIL → PASS.

What we learned

• Running the same checks automatically on every change prevents the oversights that tend to happen with manual work, and keeps the results.
• AI is most useful here as a writer of clear proposals, with people making the decisions.
• Putting the version, scan results and proposals into one checked record makes reviews faster and easier to explain later.

What's next for TONARI

• Move from Assisted toward Supervised: let Duo agents carry out more steps (for example opening merge requests) with a person approving the outcome.
• Publish the app to a public deployment from the pipeline and add a monitoring stage.
• Run the file-change check inside GitLab on every release, and measure TONARI's crowd-spreading effect at real live shows.

Path: B — Bring Your Own (existing MIT-licensed TONARI app, imported to GitLab). Autonomy level: Assisted — Duo writes text proposals; a person decides.

Credits: inunanba

Built With

• gitlab
• gitlab-ci
• gitlab-duo
• gitlab-duo-agent-platform
• gitlab-pages
• gitlab-sast
• gitlab-secret-detection
• javascript
• node.js
• npm
• semgrep