Vallum
A hands-off release guardian on the GitLab Duo Agent Platform and Google Cloud.
Vallum ships a requested feature to production by itself, but only if the feature keeps its promises, and only
as boldly as its mistake allowance permits. Agents write code, promises and explanations; code decides what ships.
Vallum was built for the GitLab Transcend "Life After Code" hackathon (Path A, Hands-off).
Demo and presentation
About this repository
This GitHub repository is a copy of the
GitLab project on which Vallum
ran live and was judged. The hackathon group was archived after the submission deadline, so that project is now a
read-only archive: nothing has run there since 27 October 2026, and no one, including the owner, can trigger it.
| Objective | Where to go |
|---|
| Review the recorded runs | Browse or clone the archive of every real run: pipelines, merge requests built by agents, incident #5 and its learned promise, and the Ledger. The deployed app and control room remain available through the judging period (ending 14 November 2026) and at least until 20 January 2027; their state is frozen as of 27 October 2026. |
| Run it locally (about five minutes) | Run it locally: the 231 tests, the app and the control room, with no cloud services required. |
| Run the full loop live | SETUP.md: this now requires your own GitLab project (with the Duo Agent Platform) and your own Google Cloud project. |
Live resources
- The app, a small link shortener on Google Cloud Run: https://vallum-256944994567.us-central1.run.app/
- The control room, Vallum's status site, deployed as a separate Cloud Run service:
https://vallum-status-256944994567.us-central1.run.app/. It has one page per topic:
releases, with a live lane for the release
being test-driven; features, shown as cards
with their promises; the mistake allowance;
security; and
rules and code, which holds read-only copies of
the Rulebook, the policy and the code map.
- The Ledger, Vallum's state, rewritten by code:
issue #3
- Pipelines, every run public:
pipelines
Project status
At the end of the hackathon (27 October 2026), all four layers were built and running live. Layers 1 to 3
passed their live tests between 21 and 25 October, and the final end-to-end run shipped issue #20 with zero
human steps.
| Layer | Scope |
|---|
| 1 | The safe skeleton: promise checker, Gatekeeper, Merge Desk, deploy provenance gate, test drive on Cloud Run, state store, Notifier, Watchdog and visitor simulation |
| 2 | The agents: GitLab Duo flows published from this repository, with code still deciding what ships |
| 3 | Judgment: mistake allowances and modes, scoped freezes, @vallum commands, needs-human escalation, and project context that works for any codebase |
| 4 | The public status page with a live release lane, image scanning judged before release, security triage and kill switches |
How it works
%%{init: {'themeVariables': {'lineColor': '#64748B'}}}%%
flowchart TD
P["Member: a plain-English issue,<br/>moved to In progress"]:::human --> S["Ship flow<br/>Director · Planner · guardians<br/>Builder · Reviewer"]:::agent
S --> M["Merge request<br/>code + Feature Card + promises"]:::gitlab
M --> C["MR pipeline<br/>promise checker · fail-first<br/>SAST · secrets · Gatekeeper report"]:::code
C --> D["Merge Desk<br/>12 Gatekeeper rules"]:::code
I["Inspector<br/>code-built evidence only"]:::agent --> D
D -->|"merge pinned to the SHA"| B["main pipeline<br/>provenance gate · build · image scan"]:::code
B --> T["Test drive on Cloud Run<br/>step 0 → 1% → 10% → 50% → 100%"]:::code
T -->|"every promise kept"| L["Production"]:::cloud
T -->|"broken or unclear"| R["Rollback in seconds"]:::stop
R --> K["Incident Commander<br/>postmortem · learned promise · fix issue"]:::agent
K -->|"Door C"| S
L --> W["Live Patrol<br/>live checks · allowances · modes<br/>security triage · commands"]:::code
W -->|"a Red tier pauses risky work"| S
W --> G["Ledger · status page · owner alerts"]:::gitlab
classDef human fill:#FEF3C7,stroke:#B45309,color:#78350F
classDef agent fill:#EDE9FE,stroke:#6D28D9,color:#4C1D95
classDef code fill:#E0F2FE,stroke:#0369A1,color:#0C4A6E
classDef gitlab fill:#FFEDD5,stroke:#C2410C,color:#7C2D12
classDef cloud fill:#DCFCE7,stroke:#15803D,color:#14532D
classDef stop fill:#FEE2E2,stroke:#B91C1C,color:#7F1D1D
linkStyle default stroke:#64748B
以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗
