GitLab Life After Code · Path B · Hands-off

BABYDOV
Release Sentinel

An autonomous release authority that does not ask “did CI pass?” It asks “can this release be proven safe enough to ship, and can I prove I can undo it?”

evidence-firstfail-closedrollback proven before prodtamper-evident audit

Risk score

5.3

Decision confidence

100.0%

Autonomy budget

90.4

Evidence coverage

100%

Post-code evidence graph

canary-smokePASS

dependency-scanPASS

provenancePASS

rollback-rehearsalPASS

sastPASS

sbomPASS

secret-scanPASS

synthetic-fleetPASS

unit-testsPASS

evidence-integrityPASS

Release blockers

No release blockers.

Promotion outcome: GO

Open GitLab pipeline ↗

Synthetic fleet

2,000,000

deterministic release-agent episodes

Unsafe GO: 0
Missed rollback: 0
Threshold violations: 0

Duo authority contract

PENDING

Deterministic governor verdict: UNKNOWN

GitLab Duo orchestrates evidence; the fail-closed kernel remains authoritative.

What the agent proves before it acts

1. Evidence is complete. Missing tests, security, provenance, SBOM, canary or rollback proof becomes a blocker.

2. Tool output is data, not authority. Prompt-like instructions inside logs are isolated and cannot change policy.

3. Rollback exists before production. The previous artifact is restored byte-for-byte and smoke-tested during rehearsal.

4. Autonomy is earned. The agent spends an explicit autonomy budget derived from risk, confidence, blast radius and evidence.

Tamper-evident release receipt

Evidence ledger root

72f02e4118bb4dfa5008fd01aa5ac933f3e286bc022bcad92ecbafc7aa92a7ff

Attestation bundle root

fad400fdd6dd32abd4f9572aaea67daba147525761c03382dec0f562022e8c63