checkStatusCode upper bound exclusive
GOtests passed: merged
Thirty upstream bug fixes from the 2.x line, each undone on main by reverting its code (its regression tests stay), chosen by a rule
+that was committed and tagged reintro-sealed before the first merge request. Each went through the live pipeline.
+Merge-when-tests-pass stopped 1; Second Key flagged 17, 16 of them with every test green. A reviewer picking changes at random at Second Key's review rate would flag that many with probability 0.012.
16 deliberately broken merge requests and 12 clean ones went through the live pipeline. Switch between the rule most projects use and Second Key's verdict. The usual rule stops 4 of 16 of the broken ones and never bothers a clean change, so it is a fair @@ -159,42 +166,42 @@ baseline; Second Key flags 15 of 16, and its price is review load.
0/12clean changes held upThe current policy replayed on the 28 recorded MRs at every GO threshold. Blockers do not depend on it; the curves show what the score buys. These MRs calibrated the policy once, so this describes the trade-off rather than testing it.
Every held-out upstream PR that applies to 2.5.7 was replayed through the live pipeline; whether it was later reverted or fixed was hidden from the gate. On the sealed held-out backtest (history and diff signals only) it flagged 1 of 4 later-bad PRs and sent 113 of 229 good ones to review.
Six steps, all running on gitlab.com. Agents read, explain and propose; the verdict is code; the key is a person's note naming the commit. -Anyone can start a flow, so a flow's approval never counts as the key.
-Evidence runs in CI: only the tests the change can reach, mutation, fuzzing, scans.
Deterministic code reads the evidence: GO, NEEDS_REVIEW or BLOCK, signed for this commit.
A Duo flow writes the Evidence Note and asks the maintainer. It cannot change the verdict.
A key holder turns the second key for exactly this commit.
On merge, every merge since the last release is re-verified: signature, diff, key.
Only then a release, and a deploy of the image that pipeline signed.
Six steps, on gitlab.com and Google Cloud. Agents read, explain and propose fixes; the verdict is code; the key is a person's note naming the commit. +On !87 the gate blocked a removed login check, the flow opened !88 restoring that line, and the same gate gave the fix GO.
+Evidence runs in CI: only the tests the change can reach, mutation, fuzzing, scans.
Deterministic code reads the evidence: GO, NEEDS_REVIEW or BLOCK, signed for this commit.
A Duo flow writes the Evidence Note. On BLOCK it files the issue and opens a fix MR, judged by the same gate.
A key holder turns the second key for exactly this commit, after its evidence is signed.
On merge, every merge since the last release is re-verified: signature, diff, key.
Cloud Run: 5%, 25%, 100%, each step held only inside the SLO; a breach restores the recorded revision.
The same six commits run twice: risk-proportional evidence (blue) and the full suite (grey), measured per job with Eco CI. -491.3 J against 3468.72 J, the same decisions.
+491.3 J against 3468.72 J.