Attested Pipelines (Policy-as-MR)

GitLab runs the pipeline. Attested Pipelines decide whether anything in it was allowed to advance — and can prove why.

Autonomy Dial (.gitlab/attestation-policy.json):
Merge Request !42 — feat(billing): enforce MFA on high-value checkout & parameterize receipt query
commit: a9f4c21e8b3d baseline (CAS): sha_mainline_000 policy SHA: pol_sha_default_2026 Z3 Guard Model: 5/5 Proven (32/32 Differential)
9/9 STAGES ALLOWED TO ADVANCE
Human Sign-Offs:
9 GitLab DevSecOps Lifecycle Stages — Click any stage to inspect its 5 Formal Guards & Computed Evidence Same computed evidence · Zero CI re-runs · Policy dial evaluated at gate time

5-Guard Formal Gate Inspector — Stage: VERIFY evidence: junit

Formal Guard Verdict Z3 Invariant & Computed Verification
Signed StageAttestation Artifact (HMAC-SHA256 Bound to Evidence + Policy SHA) 

      

    


    

      

        

          1. Claim-Before-Work & Collision Prevention (GitLab Issues)
          victim-app/symbols.json
        

        

      


      

        

          7. Govern Stage — Bi-Temporal Transparency Log Replay
          Supersede, Never Overwrite
        

        

          Ask the system what it believed at transaction time T₁ vs T₂: