GitLab Duo · Supervised recovery
Checking the before-and-after receipt evidence…
For mobile teams supporting older apps and offline purchases.
Before and after Duo’s repair · same retry
Both client suites passed on both sources. The recovery probe caught what those tests missed.
Loading the receipt observations…
Separate local runs of the saved sources. Receipt identities are compared within each run. All orders are synthetic; no payments occurred.
Each run began with two intentional purchases in each of two accounts. The repaired retry kept all four original orders distinct. This witness shows the first retry; the full recovery probe and thirteen hosted recovery/HTTP requirements have separate evidence.
The downloadable slice retains receipt observations and a hash identifying the original local report. Consistency checks do not authenticate execution origin.
Download receipt observations →Public GitLab execution · 27 October 2026
Loading the source-bound evidence…
The repair branch cannot change the independently pinned checks. The approval job requires the allowlisted owner.
Both client suites passed. First activation of the seeded backend changed the receipt returned after rollback. The independent recovery gate blocked it.
Inspect the failed gate →In api/orders.py on the existing branch, Duo preserved account-scoped purchase identities and made the migration atomic. The newer feature stayed intact.
Check a separately dated semantic sample, then remove a fulfillment. Recomputing its hash must not hide that contradiction.
Try the evidence check →Download all six public cases →Loading the separately verified human decision…
Inspect the combined report →Guardian protects accepted purchases. The owner controls the release decision.
Five controlled faults ended with all eleven recovery and two HTTP requirements passing, alongside the client and backend tests. Only the principal repair above was approved and merged.
Inspect every source, flow and outcome →The first proposal still lost older accepted receipts. The second preserved them, but could not complete recovery after intentional key retirement. The unchanged gate rejected both. A third reviewed repair completed and passed all thirteen requirements.
This is a separate rollback evaluation. Its passing repair remains unapproved and unmerged; it is not covered by the principal approval above.
A declared older client supplies no stable operation identifier. A retry and another intentional purchase can look identical. Duo's read-only assessment recommended no safe backend repair; the branch stayed unchanged.
Inspect the unchanged branch and assessment →Client 0.9 is a declared profile, not an executable native fixture. The retained model answer also misread an expected self-test message; its verification note corrects that explanation. Signed origin passed. Missing identity is the actual blocker.
Approval belongs to the checked candidate, not its later merge commit. Evaluation repairs have separate human gates. Repository and policy administrators retain control of the enforcement configuration.
The local replay and semantic sample are separate observations. The public evidence verifier checks retained consistency; it does not independently authenticate archived GitLab signatures offline.
Actual GitLab executions and separately identified local observations. Editing cuts omit waits; each film retains its source and date.
From the project source or portable review archive, use installed Python 3.10+ and Bash:
bash scripts/guardian.sh
Open http://127.0.0.1:8790. The receipt check above executes the exact public source pair with Python and fresh temporary databases. The broader Swift experiments under Explore additionally require Swift 6 and loopback/process permission.
Verify the downloaded public evidence ZIP with Python only:
python3 scripts/verify-public-evidence.py guardian-public-evidence.zip
Expected ZIP SHA-256:Evidence identity loading…
The complete application source and current scenario evidence are public. Download the evidence ZIP and Python-only verifier below to check the retained identities and outcomes without credentials. The repaired backend is separate from this review service.
The included adapter targets this synthetic Python/SQLite API. Another service needs its own schema, startup, migration and rollback integration; changing three settings is not sufficient.
Integration and trust requirements →Two safe controls passed. Two boundary faults escaped the existing gate; separate new HTTP checks detected them. Other incomplete recovery attempts remain visible. This dated scorecard retains its original local results. The later header-fault Duo trial has separate evidence above.
Go deeper: Compare recovery routes · Explore accepted-work experiments
Live consistency check
Recompute the recorded observations. Then try the altered example.
The altered copy has one missing fulfillment and a recomputed payload hash. The checker should reject it.
Checking verifier availability…
Runs the consistency checker now on recorded data. It does not rerun the purchase experiment or call a model.
The browser checks raw business observations in an exported JSON bundle. The file stays on your device.
An integrated continuity check found a worker identity change across migration that separate suites missed. This seven-case challenge is same-author, not independent or blind.
Three benign controls passed every method. One faulty backend crashed during replay and remains incomplete for both stronger methods. Incomplete cases count as neither detections nor misses. Complete observations are in the linked reports.
The checker tests internal consistency and required coverage. Matching hashes do not establish publisher authenticity or human approval.
The principal public Duo repair passed its exact-commit policy checks on 27 October. The later decision attachment is loading. The hosted policy also verified original-backend recovery, migration and worker retry. The local dataset below is a separate dated observation.
View the Duo proofPublic data is a declared derivative. The public package retains verified approval metadata and its original artifact checksum. Local consistency checks do not independently authenticate GitLab signatures; public pipeline, commit and MR links retain the actual hosted evidence.
Native rehearsal and dated historical evidence retain their original labels.
Supporting experiments
Supporting experiments from the 24–26 October development history. The public 27 October evidence is on Duo repair →
Recovery
Compare the recorded plans against both frozen clients.
Locally authored source, not a Duo repair. The baseline and verifier stayed fixed; separate worker failures remain separate.
Supporting local experiment
A separate local fixture carries orders through migration, recovery and worker retry. Its results are not the hosted Duo run.
Six accepted operations at the boundary, then two new purchases. Compare the durable worker with the deliberately unsafe controls below.
Controls show what a passing order count can miss.
Loading controls…
Old and new clients submit work during migration. A worker is killed after downstream acceptance. The recorded cutover checks the accepted-work boundary, recovery and retry together.
The unchanged Swift clients reload saved operations. Account and operation identity connect the queue, API receipt and fulfillment.
Phone receipts and independently read fulfillment counts have separate provenance. Held result images remain labeled.
Loading recorded evidence…
Recorded synthetic experiments with controlled process failures and a bounded intake pause. They do not establish unlimited online migration or power-loss safety.
The public export is a declared derivative: private path metadata was replaced and payload hashes recomputed. Internal consistency does not authenticate execution origin or approve a release.
Supporting experiment
Compare catch-up, stale snapshots and overlapping old/new requests.
Backfill pauses between committed chunks, then is killed and resumed. Separate admission barriers establish overlapping requests for distinct purchases and account-scoped identities.
Declared traffic ends before final catch-up. These bounded schedules do not establish migration safety under an unlimited stream of writes.
Supporting experiment
A worker crashes after acceptance. Its retry must preserve the original effect.
Separate Python worker and receiver processes persist to independent stores. Counts and receipts are read after the controlled crash and retry.
Missing downstream identity requires refusal. These schedules cover controlled concurrency and SIGKILL, not arbitrary scheduling or power loss; they are separate from native app footage.
First-use review
Five questions about the results, with a record of help and setup problems.
Review the evidence first. Download the result locally; nothing is sent to a server.
This self-recorded check does not verify identity or independence. An independent developer trial remains separate.
Explore compatibility, recovery and replay evidence.
Checking experiment availability…
From the complete project source or portable review archive:
bash scripts/guardian.sh
Open http://127.0.0.1:8790 and choose Explore → Release laboratory.
Requires Python 3.10+, Bash and permission to run local processes on loopback. Swift 6 is also required for the saved Duo repair replays. These experiments make no GitLab or Duo calls and use no GitLab credits.
Registered synthetic fixtures only. No AI call, GitLab write, approval or deployment. Search can exhaust its budget without finding a failure.
Loading recorded journeys…
Executes trusted synthetic fixtures on this Mac. Results are separate from the recorded review above.
Recorded results. No experiment starts when this page opens.
Checks file digests and supported record bindings. Matching bytes do not authenticate GitLab origin or approve a release.
These recorded laboratory and benchmark observations are separate from the 51-case continuity bundle. They preserve their original failures and misses.
Inspect the export index