VELQIRIS Evidence Control Flow

Inspiration

As autonomous AI agents write, test, and ship code directly into production repositories, traditional code review becomes a bottleneck and a security risk. Speculative claims, unverified mock tests, and fabricated benchmarks slip past human review. VELQIRIS Evidence Control Flow was inspired by the need for an automated, fail-closed governance agent that validates evidence and security invariants inside GitLab CI/CD pipelines before any code reaches production.

What it does

• GitLab Duo Flow Integration: Operates as a native GitLab Duo agentic flow to inspect diffs and pull requests.
• Invariant Enforcement: Verifies that no production-reachable code violates defined security and settlement laws (e.g., fail-closed error handling, strict cryptographic verification, zero fabricated prices).
• Automated Evidence Accounting: Ingests CI test artifacts and asserts that every declared claim is backed by executable, deterministic test proofs.
• Fail-Closed Governance: Automatically blocks merge requests if assertions lack reproducible runtime evidence.

How we built it

• Architecture: Python 3.12 deterministic audit engine (agentic_flow.py) paired with GitLab CI/CD pipeline definitions (.gitlab-ci.yml).
• Context Governance: Custom AGENTS.md operating specification defining explicit rules of engagement and evidence thresholds.
• Public GitLab Repository: Hosted openly at https://gitlab.com/velqiris-workspace/velqiris-gitlab-evidence-control-flow with public pipeline executions.

Challenges we ran into

Enforcing strict invariant boundaries without generating noisy false positives required designing a multi-stage evidence matrix that distinguishes between speculative drafts and production-bound artifacts.

Accomplishments that we are proud of

• 100% deterministic local and CI verification across all invariant checks.
• Zero external dependencies beyond standard Python libraries, ensuring ultra-fast CI pipeline execution (< 10 seconds).
• Seamless integration with GitLab Duo agent flow definitions.

What we learned

Agentic systems require continuous verification at the CI level. Automated governance cannot rely on conversational memory alone—it must be anchored in immutable repository artifacts.

What is next

Expanding the invariant engine to support real-time multi-agent consensus verification and automated remediation suggestions directly in GitLab Merge Request comments.

Built With

• agentic
• devsecops
• gitlab-ci
• python
• security