{
"decision": {
"commit_sha": "81aadcf643f3375046c79c4ff611096923cd93a0",
"decision": "DENY",
"evidence_digest": "b681ac2e3cc24e6215a6206a801004a3e25cb81f6996f00fb3bce0c1ef4d380a",
"execution_authorized": false,
"gate": "eligibility",
"next_gate": null,
"policy_version": "releasegate-policy-v2",
"reasons": [
"SECURITY_HIGH"
],
"target": "staging"
},
"duo": {
"authority": "ADVISORY_ONLY; no human identity or execution authorization",
"available": true,
"ingestion": "OFFLINE_REFERENCE_ONLY",
"review": {
"correction": {
"actor": "Codex",
"reference": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43343080/showcase/-/commit/d05e8bb205a0411c5f7b5bc5c6fc68b0b367a7cf",
"sha": "d05e8bb205a0411c5f7b5bc5c6fc68b0b367a7cf"
},
"finding": "git is unavailable in the slim CI image.",
"finding_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43343080/showcase/-/merge_requests/1#note_4012466889",
"limitations": [
"Historical session reviewed the recorded earlier SHA, not the final merged or Phase 4 candidate.",
"Finding/reference rechecked through GitLab REST and session GraphQL on 2026-10-24 Pacific/Auckland.",
"Duo supplied the recommendation; Codex implemented the subsequent correction.",
"Offline ingestion is reference-only and cannot authenticate a live session or human approval.",
"No proof that Duo read CI artifacts; no new Flow was invoked in this milestone."
],
"mr_iid": 1,
"project_id": "87602765",
"project_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43343080/showcase",
"recommendation": "Use validated CI_COMMIT_SHA in CI.",
"review_source": "gitlab-duo-code-review",
"review_timestamp": "2026-10-14T12:35:37.799Z",
"reviewed_sha": "4182deb55678382c0a99f7b1fd8e2232d17a0611",
"schema_version": 1,
"session_id": "9451709",
"session_url": "https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43343080/showcase/-/automate/agent-sessions/9451709",
"verification_reference": "docs/phase4/00-baseline-audit.md",
"verification_status": "HISTORICAL_EVIDENCE"
},
"reviewed_candidate": false,
"status": "HISTORICAL_EVIDENCE"
},
"evidence_revalidated": true,
"evidence_status": "LOCAL_TESTED",
"hosted_verification": "NOT_VERIFIED",
"human_authorization_boundary": "ALLOW is eligibility only. Final production approval is required. execution_authorized=false. release remains DENY / exit 3.",
"limitations": [
"Hashes establish local integrity, not runner attestation or artifact authenticity.",
"CI context in a file is not independently verified hosted execution.",
"Duo references are offline evidence; ingestion does not authenticate a GitLab session.",
"No authenticated human approval adapter or release executor is configured."
],
"mandatory_tests": {
"complete": true,
"missing": [],
"present": 139,
"required": 139
},
"pipeline_references": [],
"provenance": {
"security": {
"commit_sha": "81aadcf643f3375046c79c4ff611096923cd93a0",
"context": {
"origin": "local-working-tree",
"pipeline_id": "",
"project_id": "",
"source_digest": "3a4183016ef5ed8cfde6a0c2aedee38a24f5ea0ce0e9dc7a035d11251039c4d0"
},
"exit_code": 1,
"raw_file": "security.bandit.json",
"raw_sha256": "3026a94068a25f94cd9ee4287c9576ebd82530da3fde53fd4ca59356722cd447",
"tool": "bandit",
"tool_version": "1.8.6"
},
"tests": {
"commit_sha": "81aadcf643f3375046c79c4ff611096923cd93a0",
"context": {
"origin": "local-working-tree",
"pipeline_id": "",
"project_id": "",
"source_digest": "3a4183016ef5ed8cfde6a0c2aedee38a24f5ea0ce0e9dc7a035d11251039c4d0"
},
"exit_code": 0,
"raw_file": "tests.junit.xml",
"raw_sha256": "2c98a973f54ea7a032847f943954355dc0151e2e11e075921a88f8e5e1ab8dc6",
"tool": "pytest",
"tool_version": "8.4.2"
}
},
"report_type": "releasegate-human-review-v1",
"required_next_action": "Resolve every denial reason and collect fresh evidence.",
"schema_version": 1,
"security": {
"findings": [
{
"file": "src\\releasegate\\evidence.py",
"id": "B404",
"line": 7,
"severity": "LOW"
},
{
"file": "src\\releasegate\\evidence.py",
"id": "B603",
"line": 239,
"severity": "LOW"
},
{
"file": "src\\unsafe_scanner_fixture.py",
"id": "B404",
"line": 1,
"severity": "LOW"
},
{
"file": "src\\unsafe_scanner_fixture.py",
"id": "B602",
"line": 4,
"severity": "HIGH"
}
],
"scanned_files": 8
},
"tests": {
"case_ids": [
"tests.test_advisory::test_advisory_rejects_unsupported_values[schema_version-True]",
"tests.test_advisory::test_advisory_rejects_unsupported_values[review_source-invented]",
"tests.test_advisory::test_advisory_rejects_unsupported_values[project_id-87602765]",
"tests.test_advisory::test_advisory_rejects_unsupported_values[project_url-https://user:secret@gitlab.com/a/b]",
"tests.test_advisory::test_advisory_rejects_unsupported_values[mr_iid-True]",
"tests.test_advisory::test_advisory_rejects_unsupported_values[session_url-https://other.example/9451709]",
"tests.test_advisory::test_advisory_rejects_unsupported_values[reviewed_sha-main]",
"tests.test_advisory::test_advisory_rejects_unsupported_values[review_timestamp-2026-10-14]",
"tests.test_advisory::test_advisory_rejects_unsupported_values[finding-]",
"tests.test_advisory::test_advisory_rejects_unsupported_values[finding_url-https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43343080/showcase/-/merge_requests/2#note_4012466889]",
"tests.test_advisory::test_advisory_rejects_unsupported_values[verification_status-VERIFIED]",
"tests.test_advisory::test_advisory_rejects_unsupported_values[verification_reference-docs/../secret.md]",
"tests.test_advisory::test_advisory_rejects_unsupported_values[limitations-value12]",
"tests.test_advisory::test_advisory_rejects_unsupported_values[correction-value13]",
"tests.test_advisory::test_advisory_cannot_supply_authority[approval]",
"tests.test_advisory::test_advisory_cannot_supply_authority[verified_human]",
"tests.test_advisory::test_advisory_cannot_supply_authority[execution_authorized]",
"tests.test_advisory::test_advisory_cannot_supply_authority[token]",
"tests.test_advisory::test_historical_revision_and_correction_actor_are_preserved",
"tests.test_advisory::test_advisory_rejects_ambiguous_json[{\"schema_version\":1,\"schema_version\":1}]",
"tests.test_advisory::test_advisory_rejects_ambiguous_json[{\"x\":NaN}]",
"tests.test_advisory::test_advisory_rejects_ambiguous_json[[]]",
"tests.test_advisory::test_advisory_bounds_and_credentials",
"tests.test_advisory::test_advisory_input_cannot_escape_workspace",
"tests.test_advisory::test_historical_session_cannot_be_relabelled[reviewed_sha-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa]",
"tests.test_advisory::test_historical_session_cannot_be_relabelled[session_id-99999]",
"tests.test_advisory::test_historical_session_cannot_be_relabelled[review_timestamp-2026-10-24T00:00:00Z]",
"tests.test_cli::test_release_remains_closed_without_runtime",
"tests.test_cli::test_missing_reports_emit_durable_deny",
"tests.test_configuration::test_ci_preserves_failed_artifacts_and_blocking_review",
"tests.test_configuration::test_duo_flow_uses_documented_read_only_configuration",
"tests.test_configuration::test_research_and_reports_supplement_required_checks",
"tests.test_evidence::test_realistic_junit_counts",
"tests.test_evidence::test_unusable_xml_fails_closed[not xml]",
"tests.test_evidence::test_unusable_xml_fails_closed[]",
"tests.test_evidence::test_unusable_xml_fails_closed[]",
"tests.test_evidence::test_unusable_xml_fails_closed[]",
"tests.test_evidence::test_unusable_xml_fails_closed[]",
"tests.test_evidence::test_unusable_xml_fails_closed[]>&x;]",
"tests.test_evidence::test_security_metrics_are_verified",
"tests.test_evidence::test_partial_security_scan_is_unusable",
"tests.test_evidence::test_inconsistent_line_metrics_are_unusable",
"tests.test_evidence::test_unusable_bandit_fails_closed[error]",
"tests.test_evidence::test_unusable_bandit_fails_closed[no_metrics]",
"tests.test_evidence::test_unusable_bandit_fails_closed[mismatched_totals]",
"tests.test_evidence::test_unusable_bandit_fails_closed[zero_loc]",
"tests.test_evidence::test_unusable_bandit_fails_closed[no_results]",
"tests.test_evidence::test_unusable_bandit_fails_closed[bool_count]",
"tests.test_evidence::test_unusable_bandit_fails_closed[bad_file_metric]",
"tests.test_evidence::test_ambiguous_json_rejected[{\"a\":1,\"a\":2}]",
"tests.test_evidence::test_ambiguous_json_rejected[{\"a\":NaN}]",
"tests.test_evidence::test_ambiguous_json_rejected[[]]",
"tests.test_evidence::test_load_verifies_persisted_raw_artifacts",
"tests.test_evidence::test_tampered_evidence_rejected[raw]",
"tests.test_evidence::test_tampered_evidence_rejected[summary]",
"tests.test_evidence::test_tampered_evidence_rejected[path]",
"tests.test_evidence::test_tampered_evidence_rejected[source]",
"tests.test_evidence::test_tampered_evidence_rejected[context]",
"tests.test_evidence::test_duplicate_junit_ids_are_rejected",
"tests.test_evidence::test_missing_mandatory_manifest_fails_closed",
"tests.test_evidence::test_unusable_mandatory_manifest_fails_closed[case_ids0]",
"tests.test_evidence::test_unusable_mandatory_manifest_fails_closed[case_ids1]",
"tests.test_evidence::test_unusable_mandatory_manifest_fails_closed[case_ids2]",
"tests.test_evidence::test_unusable_mandatory_manifest_fails_closed[case]",
"tests.test_policy::test_allow_stops_at_human_gate",
"tests.test_policy::test_missing_required_evidence[tests]",
"tests.test_policy::test_missing_required_evidence[security]",
"tests.test_policy::test_wrong_commit[tests]",
"tests.test_policy::test_wrong_commit[security]",
"tests.test_policy::test_failed_tests[failed]",
"tests.test_policy::test_failed_tests[errors]",
"tests.test_policy::test_test_command_failure_even_when_report_passes[1]",
"tests.test_policy::test_test_command_failure_even_when_report_passes[2]",
"tests.test_policy::test_test_command_failure_even_when_report_passes[3]",
"tests.test_policy::test_test_command_failure_even_when_report_passes[4]",
"tests.test_policy::test_test_command_failure_even_when_report_passes[5]",
"tests.test_policy::test_test_command_failure_even_when_report_passes[-9]",
"tests.test_policy::test_test_command_failure_even_when_report_passes[True]",
"tests.test_policy::test_only_skips_do_not_establish_passing_tests",
"tests.test_policy::test_invalid_test_counts[-1]",
"tests.test_policy::test_invalid_test_counts[True]",
"tests.test_policy::test_invalid_test_counts[2]",
"tests.test_policy::test_invalid_test_counts[1.5]",
"tests.test_policy::test_security_threshold[HIGH-DENY]",
"tests.test_policy::test_security_threshold[CRITICAL-DENY]",
"tests.test_policy::test_security_threshold[LOW-ALLOW]",
"tests.test_policy::test_security_threshold[MEDIUM-ALLOW]",
"tests.test_policy::test_security_threshold[UNDEFINED-DENY]",
"tests.test_policy::test_security_threshold[high-DENY]",
"tests.test_policy::test_unusable_scanner_exit[1]",
"tests.test_policy::test_unusable_scanner_exit[2]",
"tests.test_policy::test_unusable_scanner_exit[-9]",
"tests.test_policy::test_unusable_scanner_exit[True]",
"tests.test_policy::test_empty_scan",
"tests.test_policy::test_cross_run_evidence[pipeline_id-different]",
"tests.test_policy::test_cross_run_evidence[source_digest-cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc]",
"tests.test_policy::test_missing_production_approval",
"tests.test_policy::test_production_candidate_can_reach_human_gate",
"tests.test_policy::test_llm_recommendation_never_counts_as_approval",
"tests.test_policy::test_approved_policy_still_requires_independent_authorization",
"tests.test_policy::test_stale_or_wrong_approval[change0]",
"tests.test_policy::test_stale_or_wrong_approval[change1]",
"tests.test_policy::test_stale_or_wrong_approval[change2]",
"tests.test_policy::test_unverified_or_rejected_approval[change0]",
"tests.test_policy::test_unverified_or_rejected_approval[change1]",
"tests.test_policy::test_unverified_or_rejected_approval[change2]",
"tests.test_policy::test_unverified_or_rejected_approval[change3]",
"tests.test_policy::test_approval_cannot_override_failed_checks",
"tests.test_policy::test_bad_evidence_denied[None]",
"tests.test_policy::test_bad_evidence_denied[payload1]",
"tests.test_policy::test_bad_evidence_denied[payload2]",
"tests.test_policy::test_bad_evidence_denied[payload3]",
"tests.test_policy::test_bad_evidence_denied[payload4]",
"tests.test_policy::test_bad_evidence_denied[payload5]",
"tests.test_policy::test_unknown_tool_is_not_trusted[tests]",
"tests.test_policy::test_unknown_tool_is_not_trusted[security]",
"tests.test_policy::test_bad_target_gate_and_sha",
"tests.test_policy::test_evidence_digest_changes_on_new_finding",
"tests.test_policy::test_one_pass_and_83_skips_is_denied",
"tests.test_policy::test_missing_mandatory_test_cannot_be_replaced_by_extra_pass",
"tests.test_policy::test_one_unapproved_skip_denies",
"tests.test_policy::test_passing_subset_does_not_replace_mandatory_suite",
"tests.test_policy::test_mandatory_policy_is_not_optional",
"tests.test_policy::test_duplicate_identities_cannot_satisfy_mandatory_suite",
"tests.test_reporting::test_report_preserves_decision_schema_and_deterministic_rendering",
"tests.test_reporting::test_favorable_advisory_cannot_change_denial[tests-TESTS_FAILED]",
"tests.test_reporting::test_favorable_advisory_cannot_change_denial[security-SECURITY_HIGH]",
"tests.test_reporting::test_favorable_advisory_cannot_change_denial[sha-TESTS_COMMIT_MISMATCH]",
"tests.test_reporting::test_favorable_advisory_cannot_change_denial[missing-MISSING_SECURITY_EVIDENCE]",
"tests.test_reporting::test_report_historical_attribution_and_escaping",
"tests.test_reporting::test_missing_evidence_is_visible_and_denied",
"tests.test_reporting::test_report_cli_deny_and_forged_advisory",
"tests.test_reporting::test_advisory_text_never_becomes_human_approval",
"tests.test_reporting::test_report_rejects_traversal[../outside]",
"tests.test_reporting::test_report_rejects_traversal[../../private]",
"tests.test_reporting::test_report_rejects_escaping_symlink",
"tests.test_research::test_research_metrics_count_false_decisions_and_detections",
"tests.test_research::test_snapshot_policy_loads_use_local_context_and_restore_host[False]",
"tests.test_research::test_snapshot_policy_loads_use_local_context_and_restore_host[True]"
],
"errors": 0,
"failed": 0,
"passed": 139,
"skipped": 0,
"total": 139
}
}