Flowchart · 04 of 10 · CI/CD validation loop

CI/CD as a validation loop the agent can retry against

Every probabilistic step has a deterministic gate behind it. The gates are fast and return structured failures, so the agent can converge without a human, and humans sit on the loop at the risk tiers that need them.

CI/CD as a validation loop the agent can retry against Flowchart of an agent-authored pull request passing static and supply-chain gates and an ephemeral environment verify step; a failure returns a structured rule id and fix hint for up to three retries, while a pass routes by risk tier to auto-merge or human approval, then to a progressive rollout with automatic rollback. YESNORETRY ≤ 3T1T2Agent opens PRStatic gatesschema · policy · tests · signEphemeral envdeploy + verify contractGates pass?Structured failurerule id · file · fix hintRisk tier?Auto-mergeT1 · reversible · auditedHuman approvalT2 · prod-affectingRollout + auto-rollbackFast, deterministic,and machine-readable.LEGENDDecision gateStepStart · endRetry / failPass

Requirement

Turn CI/CD into a validation loop: fast deterministic gates an agent can retry against until it passes, with humans on the loop rather than in it.

Design choices

  • Failures are structured (rule id, file, line, fix hint), never a log wall.
  • Retry budget of three, then a page with the evidence attached.
  • Promotion is tier-aware; provenance is checked at admission, not only in CI.

Evidence and gap

Built in Hangar: Tekton and Pipelines-as-Code, a releaseGuardrails registry, tier-aware promotion in Glidepath, cosign plus Rekor verification. Real bugs found: a fail-open sast check and an index-lag race. Proposal only: the agent-facing failure schema.

Hangar · reference architecture