Checkpoint Lab — GitLab Duo and Agentic DevSecOps: AI Features, Security Remediation, Governance, and Usage Controls

CHECKPOINT ACCEPTANCE
[ ] original fixtures preserved
[ ] data classification documented before prompt/tool analysis
[ ] tool decisions predicted before evaluator runs
[ ] at least one write requires approval
[ ] at least one destructive/external operation is denied
[ ] safe and unsafe proposals tested independently
[ ] unsafe plausible proposal rejected with evidence
[ ] approved proposal hash recorded
[ ] audit/session/usage record contains no real secrets or private data
[ ] credits assumption explicitly says fixture / zero live usage
[ ] cleanup is reviewed before deletion

from pathlib import Path
import json, textwrap, hashlib
root=Path("gitlab-ch33-checkpoint")
orig=root/"original"; work=root/"working"
orig.mkdir(parents=True,exist_ok=True); work.mkdir(parents=True,exist_ok=True)

(orig/"context.json").write_text(json.dumps({
  "session_id":"SESSION_FAKE_CAPSTONE_33",
  "project":"PROJECT_X",
  "actor":"USER_A",
  "task":"Fix synthetic path traversal in template resolver",
  "data_classes":["synthetic_source","synthetic_vulnerability"],
  "prohibited_data":["real_secrets","customer_data","production_logs","private_personal_data"],
  "offering_baseline":"GitLab.com fixture",
  "version_baseline":"19.3",
  "credits_consumed":0,
  "live_ai_called":False
},indent=2))

(orig/"policy.json").write_text(json.dumps({
  "read_repository":"always_allow",
  "read_vulnerability":"always_allow",
  "write_feature_branch":"always_ask",
  "create_merge_request":"always_ask",
  "edit_ci_policy":"always_deny",
  "delete_project":"always_deny",
  "external_mcp":"always_deny"
},indent=2))

(orig/"requests.json").write_text(json.dumps([
  {"tool":"read_repository","intent":"inspect resolver"},
  {"tool":"read_vulnerability","intent":"inspect synthetic finding"},
  {"tool":"write_feature_branch","intent":"apply candidate patch"},
  {"tool":"edit_ci_policy","intent":"disable failing security job"},
  {"tool":"delete_project","intent":"reset after test failure"}
],indent=2))

safe='''from pathlib import Path\n\ndef template_path(base: Path, name: str) -> Path:\n    base=base.resolve()\n    candidate=(base/name).resolve()\n    try:\n        candidate.relative_to(base)\n    except ValueError as exc:\n        raise ValueError("outside template root") from exc\n    return candidate\n'''
unsafe='''from pathlib import Path\n\ndef template_path(base: Path, name: str) -> Path:\n    base=base.resolve()\n    candidate=(base/name).resolve()\n    if not str(candidate).startswith(str(base)):\n        raise ValueError("outside template root")\n    return candidate\n'''
(orig/"proposal_A.py").write_text(safe)
(orig/"proposal_B.py").write_text(unsafe)

for p in orig.iterdir():
    if p.is_file(): (work/p.name).write_bytes(p.read_bytes())

manifest={p.name:hashlib.sha256(p.read_bytes()).hexdigest() for p in orig.iterdir() if p.is_file()}
(root/"original_sha256.json").write_text(json.dumps(manifest,indent=2))
print(root.resolve())

{
  "read_repository": "ALLOW",
  "read_vulnerability": "ALLOW",
  "write_feature_branch": "ASK",
  "edit_ci_policy": "DENY",
  "delete_project": "DENY"
}

from pathlib import Path
import json
root=Path("gitlab-ch33-checkpoint")/"working"
policy=json.loads((root/"policy.json").read_text())
requests=json.loads((root/"requests.json").read_text())
map_decision={"always_allow":"ALLOW","always_ask":"ASK","always_deny":"DENY"}
results=[]
for r in requests:
    mode=policy.get(r["tool"],"always_deny")
    row={**r,"mode":mode,"decision":map_decision[mode]}
    results.append(row)
    print(f"{r['tool']:24} {row['decision']:5} {r['intent']}")
(root/"tool_decisions.json").write_text(json.dumps(results,indent=2))

from pathlib import Path
import tempfile, importlib.util, json
root=Path("gitlab-ch33-checkpoint")/"working"

def load(path):
    spec=importlib.util.spec_from_file_location(path.stem,path)
    mod=importlib.util.module_from_spec(spec); spec.loader.exec_module(mod); return mod

def run(path):
    m=load(path)
    evidence=[]
    with tempfile.TemporaryDirectory() as td:
        r=Path(td); base=r/"templates"; base.mkdir(); (r/"templates-backup").mkdir()
        expected=(base/"ok.html").resolve()
        evidence.append(["valid_path",m.template_path(base,"ok.html")==expected])
        for label,bad in [("parent_escape","../secret.txt"),("sibling_prefix","../templates-backup/secret.txt")]:
            try: m.template_path(base,bad)
            except ValueError: evidence.append([label,True])
            else: evidence.append([label,False])
    return evidence

report={}
for name in ["proposal_A.py","proposal_B.py"]:
    ev=run(root/name); passed=all(v for _,v in ev)
    report[name]={"passed":passed,"checks":ev}
    print(name,"PASS" if passed else "FAIL",ev)
(root/"verification.json").write_text(json.dumps(report,indent=2))

from pathlib import Path
import hashlib, json, datetime
root=Path("gitlab-ch33-checkpoint")/"working"
verification=json.loads((root/"verification.json").read_text())
tools=json.loads((root/"tool_decisions.json").read_text())
chosen=root/"proposal_A.py"
record={
  "session_id":"SESSION_FAKE_CAPSTONE_33",
  "time":"2026-08-22T02:30:00Z",
  "reviewer":"REVIEWER_A",
  "data_classification":"synthetic-only",
  "model_provider":"FIXTURE_NONE",
  "live_ai_called":False,
  "gitlab_credits_consumed":0,
  "proposal_sha256":hashlib.sha256(chosen.read_bytes()).hexdigest(),
  "verification":verification,
  "tool_decisions":tools,
  "approved":"proposal_A.py",
  "approved_scope":"simulate write to disposable feature branch only",
  "rejected":"proposal_B.py",
  "denied_actions":["edit_ci_policy","delete_project","external_mcp"],
  "next_required_real_controls":["MR diff review","full CI","security scan","protected branch approvals"]
}
(root/"approval_audit_record.json").write_text(json.dumps(record,indent=2))
print(json.dumps(record,indent=2))

from pathlib import Path
import shutil, hashlib, json
root=Path("gitlab-ch33-checkpoint")
orig=root/"original"; work=root/"working"; branch=root/"feature-branch-sim"
branch.mkdir(exist_ok=True)
shutil.copy2(work/"proposal_A.py",branch/"template_loader.py")

assert not (branch/"ci_policy_disabled.flag").exists()
assert not (root/"project_deleted.flag").exists()
manifest=json.loads((root/"original_sha256.json").read_text())
for name,expected in manifest.items():
    actual=hashlib.sha256((orig/name).read_bytes()).hexdigest()
    assert actual==expected, f"original changed: {name}"
print("VERIFIED: approved branch simulation created; originals preserved; denied effects absent")

from pathlib import Path
import re
p=Path("gitlab-ch33-checkpoint/working/approval_audit_record.json")
text=p.read_text()
patterns={
  "gitlab_token": r"g[l]pat-[A-Za-z0-9_-]{10,}",
  "private_key": r"BEGIN (?:RSA |OPENSSH )?PRIVATE KEY",
  "email": r"[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}"
}
for name,pat in patterns.items():
    print(name,"FOUND" if re.search(pat,text) else "not found")

AI GOVERNANCE HANDOFF
Scope: PROJECT_X synthetic remediation
Data: synthetic source + synthetic finding only
Product assumptions: GitLab 19.3 reference; fixture path; no live AI/credits
Authority:
  reads -> allowed for approved data
  feature-branch write -> human approval
  CI policy / delete / external MCP -> denied
Verification:
  Proposal A passes containment tests
  Proposal B rejected by sibling-prefix counterexample
  real deployment would still require MR, full CI, scanners, protected rules
Audit:
  proposal hash + reviewer + decisions + denied actions recorded
Fallback:
  core Git/CI/security workflow functions without GitLab Duo
Risk owner: platform/security governance

from pathlib import Path
import shutil
p=Path("gitlab-ch33-checkpoint")
print("REVIEW BEFORE DELETE:",p.resolve())
# shutil.rmtree(p)  # Uncomment only after confirming this is the disposable fixture.