Change record, carbon copy for the auditor

Paper Trail: evidence-gated MR pipeline

Shipped and held
Ticket
https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/24678947/showcase/-/work_items/2
Risk
high
Pipeline
https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/24678947/showcase/-/pipelines/2959349570
Commit
e4690cb76b0e96111aebaf8fcaae31c57d7fd096
Filed
2026-10-18T00:41:53.426084Z
By
paper-trail 0.1.0

Paper Trail collects the evidence. Whether it satisfies a control is the auditor's decision.

01Ticket

Title
Paper Trail: evidence-gated MR pipeline
Link
https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/24678947/showcase/-/work_items/2
Requested by
JoeProAI
Opened
2026-10-17T12:27:56.004Z

02Risk score

Level
high
Score
250
Gates
2 review agent(s), rollout [10, 50, 100], watch 900s
  • +40 sensitive_path:pricing app/tax.py
  • +40 sensitive_path:pipeline .gitlab-ci.yml, .gitlab/duo/agent-config.yml, .gitlab/duo/chat-rules.md, .gitlab/duo/flows/README.md, .gitlab/duo/flows/paper-trail-intake.yaml, .gitlab/duo/mr-review-instructions.yaml, .gitlab/duo/prompts/fix-pipeline.md, .gitlab/duo/prompts/incident.md, .gitlab/duo/prompts/release-notes.md, .gitlab/duo/prompts/review-correctness.md, .gitlab/duo/prompts/review-risk.md, .gitlab/duo/prompts/security-triage.md, templates/evidence/template.yml
  • +40 sensitive_path:policy policy/risk-policy.yml
  • +40 sensitive_path:evidence paper_trail/__init__.py, paper_trail/__main__.py, paper_trail/cli.py, paper_trail/controls.py, paper_trail/evidence.py, paper_trail/findings.py, paper_trail/gates.py, paper_trail/html_report.py, paper_trail/monitor.py, paper_trail/policy.py, paper_trail/report.py, paper_trail/risk.py, schema/evidence.schema.json
  • +25 dependency_change pyproject.toml, requirements-dev.txt, requirements.txt
  • +30 infra_change Dockerfile, deploy/__init__.py, deploy/build_examples.py, deploy/cloudrun.sh, deploy/fetch-mr-evidence.sh, deploy/record.sh, infra/main.tf
  • +25 size 5805 lines changed
  • +10 file_count 100 files

03Merge request

Link
https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/24678947/showcase/-/merge_requests/1
Author agent
JoeProAI
Merged
not recorded

04Review agents

  • approveduo-review-correctness

    All five acceptance criteria from issue #2 have meaningful tests and 51 pass; tax math, gates, risk scoring, evidence pack, and monitor logic are correct. One test assertion (must-not-appear) is trivially true but the underlying protection is real and not a correctness bug.

  • approveduo-review-risk

    This is a greenfield initial commit: no auth changes, no data migrations, money math in app/tax.py uses integer-cent rounding correctly, gates and policy are introduced at full strength with no weakening, and the pipeline enforces canary rollout with automated rollback. Traffic rollback fully undoes the change because no schema migrations or persistent state mutations are introduced.

05Tests

green51 passed, 0 failed, 0 errors, 0 skipped.

06Security scans

Findings
0
Unaccepted
critical 0, high 0, medium 0, low 0, info 0, unknown 0

07Package

Image
us-central1-docker.pkg.dev/gen-lang-client-0361116196/paper-trail/app:e4690cb7
Digest
sha256:d47b414fd9405aa1016d438f3785c32ce83125bf8d31206f5d10f379f38a3f75
SBOM
not recorded

08Release

Nothing was filed for this section. An auditor will ask for it; rerun the pipeline job that writes it before closing the change.

09Deployment

Environment
production
Strategy
canary
Revision
paper-trail-00003-cig
Previous
paper-trail-00002-wlz
URL
https://paper-trail-lksx6ajttq-uc.a.run.app
Finished
2026-10-18T00:40:38Z
  1. 10%to paper-trail-00003-cig
  2. 50%to paper-trail-00003-cig
  3. 100%to paper-trail-00003-cig

10Post-deploy check

heldwithin limits at every step

Window
900s, 180 probes
Error rate
0.0
p95
142.6 ms

11Rollback

Performed
no
Restored
not recorded
At
not recorded
Incident
not recorded

drill passedTraffic moved back to paper-trail-00002-wlz and forward to paper-trail-00003-cig in 17s.

Drill at
2026-10-18T00:40:56Z
Served back
f4fea87
Served after
e4690cb7

Controls this record answers