Governor risk-sized autonomy for GitLab Duo agents

Every change an agent makes gets autonomy sized to its risk: low-risk changes ship on their own, risky ones get fewer privileges and more verification.

T0 docs T1 low T2 elevated T3 high (restricted agent, dark launch) T4 refused

Hash chain verified: 230 entries

Add GET /items/{item_id} endpoint

-stopped: delivery flow never started, 4 requests (passed in #5)

issue #4 · 12 Oct 01:03:03 to 12 Oct 08:43:03 (7 h 40 min) · 12 ledger entries · raw JSON

Owner notes

Owner note: Flows API 404 (fixed in run 2)
A person's annotation, not data the governor recorded. By arnavgupta2004, signed by mr.guptarnav@gmail.com (Sigstore), appended 12 Oct 20:49:53 as L178-5517e762e556; about L4-ea750d1b2cad, L6-066eb355e818, L8-1905ab327bab, L10-7079134b599e, L12-171b5c4113a1.
Cause of this stop, from the runbook diagnosis: the Flows API returned 404 Not Found when issue_id was sent together with workflow_definition developer/v1; the same request without issue_id returned 201. The governor's client then dropped the error body, so the ledger records only the repeated delivery requests. Fixed before Gate 3 run 2 (issue #5): no flow is sent issue_id, and a failed step records its HTTP status. Source: runbook.

Run timeline

Issue

01:03:03

Triage

01:03:03
4 min 02 s

Delivery

01:04:06
3 min 00 s

Pipeline

skipped

Canary

skipped

Promote / roll back

skipped

Close

08:43:03

GitLab DevSecOps stages this run touched

Create

not touched

Verify

not touched

Package

not touched

Secure

not touched

Release

not touched

Configure

not touched

Monitor

not touched

Govern

not touched

Tier and evidence

No tier decision recorded for this run.

Human actions

None. No person acted on this run after it started.

Ledger entries

TimeEntryKindWhat happened
Issue
01:03:03L0-14f591569954issue_seenissue opened: Add GET /items/{item_id} endpoint
Triage
01:03:03L1-fb0845eb532dflow_requestedtriage flow requested
01:03:05L2-dee48573e978flow_startedsession 9303882 started; session privileges [1,2,3,4,5,6,7]
01:04:06L3-08c44f86644cprior_tierprior tier T1 from triage labels area::app, type::feature
Delivery
01:04:06L4-ea750d1b2cadflow_requesteddelivery flow requested, tier T1
Triage
01:05:05L5-1df8de2d924bprior_tierprior tier T1 from triage labels area::app, type::feature
Delivery
01:05:06L6-066eb355e818flow_requesteddelivery flow requested, tier T1
Triage
01:06:05L7-f7de02613957prior_tierprior tier T1 from triage labels area::app, type::feature
Delivery
01:06:06L8-1905ab327babflow_requesteddelivery flow requested, tier T1
Triage
01:07:05L9-e3c29cd3321eprior_tierprior tier T1 from triage labels area::app, type::feature
Delivery
01:07:06L10-7079134b599eflow_requesteddelivery flow requested, tier T1
Close
08:43:03L12-171b5c4113a1issue_closedissue closed by someone else at stage triaging