EvidenceGateBETA GitLab Transcend
BUILD WITH AUTONOMY. RELEASE WITH PROOF.

AI can ship code.
But should it?

Between “the tests passed” and “production is live” lies one critical decision. EvidenceGate makes that decision visible, repeatable, and human-controlled.

Try the release gate See the architecture

Independent open-source prototype. Interactive scenarios use synthetic data. No live deployment is initiated.

release.assurance / evidencegatev0.1
› assess --target production
✓
Deterministic evidencetests · security · artifact · policy
PASSED
⌁
Exact-state approvalcommit + pipeline + package digest
REQUIRED
⛨
Drift detectionchange state → reject stale approval
BLOCKED
● The default is NO ACTION, not blind automation.
APPROVAL-BOUND · FAIL CLOSED
09DevSecOps stages represented
01Exact-state approval gate
SHA-256Canonical plan fingerprint
00Automatic production actions
THE DESIGN PRINCIPLE 01 / 03

More autonomy.
Less ambiguity.

One readable chain from code changes to a release decision. Each stage has an explicit control boundary; stage names indicate architectural coverage, not proof of a live execution.

↳
Built for the GitLab Duo Agent Platform.A v1 flow separates read-only analysis, human approval and a scoped MR note writer. The browser lab demonstrates deterministic policy behavior; it is not a substitute for an actual GitLab agent run.
INTERACTIVE FAILURE LAB 02 / 03

Break the state.
Watch the gate hold.

Select a situation, inspect the plan fingerprint, and approve the exact planned state. No network requests or real releases occur during the exercise.

INPUT / SYNTHETIC FIXTURE

Release parameters

01

Synthetic values. Commit: 7–64 hex characters. Pipeline: 1–40 letters, digits, “-” or “_”. Artifact: 64 hex characters. Findings: a whole number, 0 or more; an empty field is invalid evidence, not zero findings.

DECISION / DETERMINISTIC POLICY · SYNTHETIC

Release verdict

02
AWAITING APPROVAL
Review the exact proposed state before approving.
PLAN FINGERPRINT · SHA-256Calculating...
Release conditions —

Local illustrative approval only. This interface does not authorize a CI/CD release, authenticate a user, or attest an external pipeline.

REPRODUCIBLE BY DESIGN 03 / 03

Don't trust the badge.
Inspect the evidence.

A build-generated source manifest records reproducible file digests and optional GitLab CI identifiers. Synthetic tests are marked as synthetic; external signatures and live deployment are never implied.

BUILD MANIFEST
Checking evidence…

Loading the local build manifest.

Inspect build-evidence.json ↗
ENGINEERING CONTROLS
Fail closed. Then explain why.

Immutable plan digest, time-limited consent, drift rejection, policy checks and a machine-readable decision receipt.

GitLab Duo custom flows docs ↗
DISCLOSURE
No false assurance.

This demo uses synthetic release metadata. GitLab Duo flow execution and GitLab CI delivery must be independently verified in the public project.

Competition requirements ↗
THE FUTURE NEEDS A RELEASE GATE

Move fast.
Prove first.

Test the decision engine