nightjar Lifecycle stages, mapped to jobs
Each stage is a real job, file or GitLab feature in one project.
| Stage | Job | What happens |
|---|---|---|
| monitor | probe:production, probe:alert, incident timeline | A schedule runs synthetic checks against production every 10 minutes. A failed check starts an incident; its steps are written to the GitLab incident timeline. |
| mitigate | rollback:production, incident:open | Traffic goes back to the previous Cloud Run revision first. Then an incident issue is opened with the exact failing request, expected vs. actual, and is assigned to the Duo Developer flow. |
| plan | Duo Developer | The agent writes a regression test, makes the smallest fix and opens a merge request (Closes #<incident>). Rules in AGENTS.md. |
| verify | lint, test, proof:fail-before-pass-after, build:image | The new test must fail on the base commit and pass with the fix. Existing tests may not be changed or removed. |
| secure | semgrep-sast, secret_detection, container_scanning | GitLab security scanners. Release waits for them. |
| govern | risk-gate | Scores the change against .gitlab/risk-policy.json: auto-merge, escalate to a human, or block. Only findings the change introduces count. On escalation it also requests the Approval Brief flow as reviewer. The gate runs the tooling and policy of the target branch, so a merge request cannot loosen its own gate. |
| release | deploy:staging, smoke:staging, promote:production, smoke:production, release | A no-traffic revision with a per-commit tag is smoke-tested, then exactly that revision is promoted. A failed production smoke test rolls back. |
| configure | deploy/cloudrun.sh, environments staging and production, feature flag nightjar_auto_merge | Cloud Run service settings, traffic tags and rollback are code in the repository and applied by the pipeline. The auto-merge kill switch is a GitLab feature flag: switched off, the gate never merges and only requests a human. |
| report | postmortem, sci:report | The incident is closed with a timeline, time to mitigate and time to fix, plus a Software Carbon Intensity report for the run. |
One release pipeline
GitLab Duo Agent Platform features used
- A custom flow,
Nightjar Approval Brief(two agents, read-only, started when the gate requests its service account as reviewer). Example brief. - The Developer flow, started by assigning the incident to the Duo service account.
- The Fix CI/CD Pipeline flow, which started on a failing lint job and whose suggested fix was applied in MR !1.