Governor risk-sized autonomy for GitLab Duo agents

Every change an agent makes gets autonomy sized to its risk: low-risk changes ship on their own, risky ones get fewer privileges and more verification.

T0 docs T1 low T2 elevated T3 high (restricted agent, dark launch) T4 refused

Hash chain verified: 230 entries

fix(telemetry): export spans before the last response byte

T2live

commit 3650aa17 · 12 Oct 18:02:07 to 12 Oct 18:13:08 (11 min 01 s) · 7 ledger entries · raw JSON

Run timeline

Issue

skipped

Triage

skipped

Delivery

skipped

Pipeline

18:02:07

Canary

18:02:08
10 min 59 s

Promoted

18:13:08

Close

not reached

GitLab DevSecOps stages this run touched

Tier and evidence

Tier T2, 5 points. A signal's floor sets a minimum tier; points add to it. No LLM is in this decision.

SignalDetailPointsFloor
lines_changed144 lines1
touched_line_coverageunknown, +1 (no coverage data yet, so the scorer assumes worse)1
track_recordpenalty 3.5 from rollbacks/reverts on these paths3

Human actions

None. No person acted on this run after it started.

Ledger entries

TimeEntryKindWhat happened
Pipeline
18:02:07L144-a9afb097dee8tier_computedtier T2 (5 points, scorer v1)
Canary
18:02:08L145-6affab13b595traffic_shift10% of traffic to app-00069-cag, soak 10 min
18:13:07L146-87ff8051f8ffslo_checkSLO ok: 120 samples, 0 errors, p95 119.9 ms at 10%
Promote / roll back
18:13:08L147-1e62577bd8detraffic_shift100% of traffic to app-00069-cag
18:13:08L148-9e55eca0a92bslo_checkSLO insufficient: 10 samples, 0 errors, p95 47.7 ms at 100%
18:13:08L149-8b10da86a434promotedapp-00069-cag promoted to 100% (flag off)
18:13:08L150-aaea9db130c5release_outcomerelease outcome: clean_release