Governor risk-sized autonomy for GitLab Duo agents

Every change an agent makes gets autonomy sized to its risk: low-risk changes ship on their own, risky ones get fewer privileges and more verification.

T0 docs T1 low T2 elevated T3 high (restricted agent, dark launch) T4 refused

Hash chain verified: 230 entries

fix(telemetry): start a new trace per request instead of Cloud Run's

T2live

commit e6202d02 · 12 Oct 18:23:06 to 12 Oct 18:33:10 (10 min 04 s) · 7 ledger entries · raw JSON

Run timeline

Issue

skipped

Triage

skipped

Delivery

skipped

Pipeline

18:23:06

Canary

18:23:07
10 min 01 s

Promoted

18:33:08
2 s

Close

not reached

GitLab DevSecOps stages this run touched

Tier and evidence

Tier T2, 4 points. A signal's floor sets a minimum tier; points add to it. No LLM is in this decision.

SignalDetailPointsFloor
touched_line_coverageunknown, +1 (no coverage data yet, so the scorer assumes worse)1
track_recordpenalty 3 from rollbacks/reverts on these paths3

Human actions

None. No person acted on this run after it started.

Ledger entries

TimeEntryKindWhat happened
Pipeline
18:23:06L151-9c0f007b2ce1tier_computedtier T2 (4 points, scorer v1)
Canary
18:23:07L152-b18c46feb875traffic_shift10% of traffic to app-00072-vat, soak 10 min
18:33:08L153-6fe843924fbcslo_checkSLO ok: 110 samples, 0 errors, p95 167.9 ms at 10%
Promote / roll back
18:33:08L154-3a2965f42e9atraffic_shift100% of traffic to app-00072-vat
18:33:10L155-63a4a30a80b8slo_checkSLO insufficient: 10 samples, 0 errors, p95 163.8 ms at 100%
18:33:10L156-db4f74bd22b4promotedapp-00072-vat promoted to 100% (flag off)
18:33:10L157-e062eacb0c84release_outcomerelease outcome: clean_release