Governor risk-sized autonomy for GitLab Duo agents

Every change an agent makes gets autonomy sized to its risk: low-risk changes ship on their own, risky ones get fewer privileges and more verification.

T0 docs T1 low T2 elevated T3 high (restricted agent, dark launch) T4 refused

Hash chain verified: 230 entries

Incident: SLO breach on app-00063-suh (e0574f5a)

T3live, issue closed

issue #11 · 12 Oct 17:23:07 to 12 Oct 17:55:07 (32 min 00 s) · 17 ledger entries · raw JSON · related: commit e0574f5a

Run timeline

Issue

17:23:07

Triage

skipped

Delivery

17:23:14
1 min 32 s

Pipeline

17:24:50
7 min 26 s

Canary

17:33:06
20 min 01 s

Promoted

17:53:08

Close

17:55:07

Tier and evidence

Tier T3, 5 points. A signal's floor sets a minimum tier; points add to it. No LLM is in this decision.

SignalDetailPointsFloor
auth_or_secretsapp/tests/test_login_dark_launch.py, app/users.py0T3
touched_line_coverageunknown, +1 (no coverage data yet, so the scorer assumes worse)1
track_recordpenalty 4 from rollbacks/reverts on these paths4

Human actions

None. No person acted on this run after it started.

Ledger entries

TimeEntryKindWhat happened
Issue
17:23:07L126-05bcc33330f2incident_openedincident #11 opened for e0574f5a, fix tier T3
Delivery
17:23:14L128-e44d6da117b0flow_requesteddelivery flow requested, tier T3
17:23:15L129-803b56b0072dflow_startedsession 9339123 started; session privileges [1,2,3,4,5,6,7]
17:24:45L130-b2289f970a12mr_openedMR !5 opened on t3/issue-11-1
Pipeline
17:24:50L131-b0e567cb0691tier_computedtier T3 (5 points, scorer v1)
17:25:10L132-0073f7754343pipeline_startedpipeline 2939644020 started: RISK_TIER=T3
17:26:59L133-d8c494b3f81bpipeline_finishedpipeline 2939644020 finished: success
17:27:09L134-ac0db5cf4d59mergedMR !5 merged as 699cca68
17:32:16L135-ab553ee9ffd5deployedrevision app-00066-buq deployed with no traffic (pipeline 2939647960)
Canary
17:33:06L136-38867a39c47eflag_not_usedflag t3_dark_launch kept off: the change removes flag-gated code; the flag stays off so the stable revision's gated path stays dark, and the canary does not read the flag
17:33:07L137-eaba6ff1dc3atraffic_shift1% of traffic to app-00066-buq, soak 20 min
17:53:08L138-5b76b509c22eslo_checkSLO ok: 200 samples, 0 errors, p95 77.5 ms at 1%
Promote / roll back
17:53:08L139-22124b961d5ftraffic_shift100% of traffic to app-00066-buq
17:53:08L140-1d5e583ba0dcslo_checkSLO insufficient: 10 samples, 0 errors, p95 72.0 ms at 100%
17:53:09L141-19075c1f7397promotedapp-00066-buq promoted to 100% (flag off)
17:53:09L142-6e59ad0f4817release_outcomerelease outcome: clean_release
Close
17:55:07L143-9a14fec880bbissue_closed_by_governorissue #11 closed by the governor after app-00066-buq went live