D

devsecops

Commento, kept alive by deadhand: a dead man's switch for open source. A written mandate, two keys and a canary let GitLab Duo agents maintain an abandoned project while nobody's at the wheel. Community fork of Commento (MIT), not affiliated with Commento, Inc.

Supervised DevSecOps gate for MCP tool servers: 9-stage GitLab pipeline + GitLab Duo agents + Cloud Run detonation canaries + Gemini on Vertex AI sign-off brief. GitLab Transcend Hackathon.

Supervised DevSecOps gate for MCP tool servers: 9-stage GitLab pipeline + GitLab Duo agents + Cloud Run detonation canaries + Gemini on Vertex AI sign-off brief. GitLab Transcend Hackathon.

Deterministic, format-preserving dependency remediation for GitLab CI — Maven first. A hundred eyes on your dependency graph.

DevSecOps health check for GitLab Self-Managed instances.

Find release-order failures that green MR CI misses. GitLab Duo proposes falsifiable experiments; GitLab CI proves evidence-backed release waves.

Toolchain image for the Coroboros security gates.

A signed, policy-gated channel that lets an agent run one command on a host it cannot reach — hashed results, no socket, no shell.

Skaledheim (SKM) is a modular platform designed to orchestrate distributed services inside a cohesive DevSecOps cluster oriented ecosystem.

deadhand, still running while the submitted repository is frozen for judging. Commento, kept alive by GitLab Duo agents under a renewed mandate (to 30 Nov 2026). File an issue here and watch deadhand handle it: two keys on every change, a canary on Cloud Run, a hash-chained ledger.

Receipted Pipeline: an AI agent runs the full post-code DevSecOps lifecycle (review, security, test, deploy, monitor) hands-off on GitLab, and every stage leaves a verifiable execution receipt (AER-1). GitLab Transcend hackathon Path B entry.

Hunt, Verify, Report. Scope-locked agent fleet on GitLab Duo Agent Platform and the a2a-omega mesh. Path B: Bring Your Own. Hands-off.

Romanian answers that are cited or refused: four gates on every answer, deployed to Google Cloud Run by a GitLab pipeline with candidate checks, automatic rollback and a production monitor. Live: https://ro-cited-210002791432.europe-north1.run.app

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, SARIF output, OWASP CICD-SEC and CWE mappings.

Landing page, ten scenarios, claims ledger and a posture mirror an assessor can check without an account. Guide: https://evidence-factory.gitlab.io/guide/

Chapter 4: a Go binary at report phase. Gaps are published and advisory, so the merge request stays green. Guide: https://evidence-factory.gitlab.io/guide/

Chapter 6: a CI component at enforce phase. A planted off-catalog include stays red: the gate stops it. Guide: https://evidence-factory.gitlab.io/guide/

Chapter 3: the driver. One tool provisions the group, assesses controls, pushes verdicts and exports OSCAL. Guide: https://evidence-factory.gitlab.io/guide/

Chapter 5: a container image at cutover phase. A planted unsigned-image gap stays red: the floor blocks it. Guide: https://evidence-factory.gitlab.io/guide/