GitLab Transcend · Life After Code

Nightjar

Incident rollback and risk-gated fix on GitLab.

A probe catches a production bug. Nightjar rolls back first, GitLab Duo fixes it with a test that proves it, and a risk gate decides who merges. Built for teams without a night shift.

Problem

A small cleanup reaches production.

A customer can no longer use a coupon. Someone gets paged, rolls back by hand, writes a test, fixes, redeploys and writes the postmortem the next morning.

Coding agents can write the fix in minutes. What they cannot give you is trust: did the agent fix the bug, or bend a test until it passed?

Solution

Rollback first. Prove the fix. Let a gate decide.

Measured in the real run on 26 Oct 2026.

How it works

probe → rollback → incident → Duo fix → proof → risk gate → release → postmortem

The new test must fail on the old code and pass on the new code. The gate runs the tooling of the target branch, so a merge request cannot loosen its own gate.

The gate says no, too

Tax rates go to Finance, not to an auto-merge.

MR !4 has a proven test and a score of 24, but it touches a protected path. The gate requests a human instead.

What is next

Beyond synthetic probes.

• More signal sources than synthetic probes (GitLab Observability, error tracking).
• Risk policies per team, learned from past incidents.
• Enforced approvals through protected branches and CODEOWNERS rules (not available to this project's role).

Built solo. About