INSPECT THE WORK · REVIEWED 17 OCTOBER 2026
Proof you can follow.
Source code, native GitLab Duo audit and repair, and before/after CI. Each link shows a specific result and its limits.
01 / SOURCE
Open code. Original history.
TrustBridge extends the MIT-licensed ContextFirewall project. The GitLab repository retains the original commits and distinguishes the new context, policy and review code.
Read the public GitLab source ↗02 / GITLAB CI
Checks that actually ran.
The main-branch pipeline at commit fb8ec45 passed 94 Python tests, 24 Node tests, security scan, lint, context auditing and policy enforcement. All eight jobs succeeded, including container packaging. These are advisory application checks; they grant no permission to merge or deploy.
03 / A REAL FAILURE CASE
Make the unsafe change visible.
Draft MR !1 deliberately removes the required security scan from the candidate release policy. CI still contains the security job and the enforcement code. The context audit retained one accepted policy and one excluded stale observation. The policy gates then rejected the candidate with MANDATORY_CHECK_MISSING and saved a minimal repair proposal. Tests and the security scan passed; policy enforcement remained blocked.
This is a controlled demonstration on an unmerged branch, prepared by Codex. It is not a Duo-generated repair or a record of human approval.
Inspect the demonstration MR ↗04 / BUILT AND TESTED
A runnable container.
GitLab built the actual non-root image and exercised its HTTP service with a read-only filesystem and no external network. All twelve scenario variants passed, and health matched the built commit. The image archive, digest and smoke receipt are retained for inspection. This package has not been authorized for production release.
Read the container smoke receipt ↗05 / NATIVE DUO
A repair that actually ran.
In the provisioned Transcend workspace, native session 9283652 audited MR !1 at ab388031, excluded the stale synthetic observation, and identified the missing security scan. After the user's task authorization was relayed through three native approval controls by Codex, fixed reviewed commands previewed the one-file repair, ran six checks, and published a23837e to the existing MR branch. The separate CI pipeline passed all seven jobs. The MR remains unmerged.
The context fixture is synthetic; the native execution, commit and CI are real. This is a bounded fixed-command repair, not freely generated code. No direct human browser click or approval of unseen output is claimed.
Inspect the native session ↗06 / HOSTING
Public hosting with a separate receipt.
The live Cloudflare reviewer reads public GitLab APIs without asking for a token. A separate human-authorized Firebase Hosting deployment is archived in the Showcase source. The sample scenarios are precomputed, explicitly synthetic outputs. Inspect the public deployment code.
Hosting the app does not prove a controller-authorized release. The hackathon rules offer up to 0.2 points for demonstrable Google Cloud deployment, but do not explicitly confirm Firebase eligibility. No bonus award is claimed.
07 / STILL TO PROVE
The release boundary stays explicit.
Decision branches
The native approve path ran. Reject and modify outcomes still need executed evidence.
Independent verification
The separately permissioned hosted controller has one effective human owner and protected main. All four boundary cases passed: unsafe policy and deleted application CI were rejected; the native repair and reviewed Firebase source were verified. Exact artifacts were checked against GitLab identities. A green rejection job is not candidate approval.
The native controller access test received HTTP 403 for both starting the controller pipeline and creating a branch. Its exact command output was correlated with native job 17077543146 and service account 43224086. This proves those two GitLab operations were denied; it does not prove cloud IAM enforcement.
Release authority
Firebase is a separate human-authorized hosting deployment. No controller-authorized cloud release, cloud IAM enforcement or automatic merge is claimed.
The Devpost entry records the submission separately. Submission status does not establish a controller-authorized release or complete decision-branch evidence. No autonomous release or production safety certification is claimed.
Try the public reviewer.
Audit an MR ↗Or explore clearly labeled sample scenarios.