Insurixa: insurance against breaking changes

At a glance

The five things judges look for, and where to see each one.

Technological implementation

A real pipeline, not a demo script

27 jobs across all nine stages, an upgrade radar, a code quality gate, a reusable CI/CD component with its own image, three custom Duo flows, a custom agent with MCP, and 17 tests.

.gitlab-ci.yml · .gitlab/duo

Design

One complete loop

Production opens the issue, agents write or repair the change, nine stages ship it, monitor heals production, and governance audits and closes the issue.

How it works · 7 runs · try it live

Potential impact

Real breakage, real audience

For platform teams. It found three published Prometheus charts that fail to install and a GitLab pipeline the linter passes with an empty password.

Case studies · Estimator

Innovation

Code decides, agents judge

Upstream's own data routes only judgement to agents. Safe fixes cost zero credits; all agent work this month, a six-case evaluation included, used 93 of 500 GitLab Credits.

The agents

Presentation

Every claim is a link

A 4K video of the loop running end to end, a live playground that runs the real packs in your browser, this site, and a README with a three-minute judge path. Issues, merge requests and pipelines are public.

Video · Repository

The problem

Upstream retires things on a schedule. Nothing errors until it breaks.

Each of these is a real example from our case studies. The old thing keeps working until an upgrade, or keeps "working" with the wrong meaning, and no test fails.

Kubernetes

Charts that fail `helm install`

policy/v1beta1 PodDisruptionBudget was removed in 1.25. Prometheus community charts published today still use it, so the install fails the day a team turns on a disruption budget.

GitLab CI/CD

Pipelines with an empty password

$CI_BUILD_TOKEN was removed in 16.0. A pipeline that still logs in with it sends an empty password, and GitLab's own CI linter passes it without a warning.

OpenTelemetry

Dashboards that go quiet

db.client.connections.wait_time was renamed and moved from milliseconds to seconds. Dashboards on the new name go dark, or read values 1,000 times off.

Life after code

Code generation is solved. It writes what upstream already retired.

Models write what they learned. We measured it for one ecosystem in the Semconv Drift benchmark: 17 AI models, graded in code against 26 releases of the OpenTelemetry spec.

16/17

models wrote retired names, 357 times. 83% of them had been retired for more than a year.

12/13

wrote names they had correctly replaced when asked directly. Knowing is not doing.

7/17

"fixed" a metric by converting its unit and keeping its retired name: broken both ways, while the diff looks like a fix.

So the fix cannot come from a model's memory either. Code decides what is retired, from each upstream project's own published data. Agents judge only what needs judgement. The pipeline and production prove the result.

How it works

One loop, from noticing to auditing, entirely on GitLab.

Three things start Insurixa: something production emits, a developer's merge request, or a production regression. Code decides, Duo flows judge, and every fix ships through all nine stages.

Insurixa architecture: three triggers, three GitLab Duo flows, three packs of code that decides, and the nine DevSecOps stages

01Planproduction opens the issue

02CreateDuo flows and safe-fix write the change

03Verify3 packs, contract, strict schema

04Packageimages in the registry

05SecureSAST and secret detection

06Releasenotes for dashboard owners

07Configureenv as code, staged deploy

08Monitorself-heal and incident

09Governpolicy, audit, close

Stage	What runs	Where
Plan	A scheduled pipeline drives the live service, reads what it emits, and opens one issue when anything is retired.	`semconv-watch`
Create	The Insurixa upgrade flow writes the merge request. On any failing merge request, `insurixa-safe-fix` first commits what code can prove; the pipeline repair flow fixes what needs judgement.	`.gitlab/duo/flows/`
Verify	Unit tests; the three packs through the `insurixa` CI/CD component; a telemetry contract that runs the service; kubeconform in strict mode against Kubernetes 1.33.	`insurixa-*-scan`, `kubernetes-schema`
Package	The service image and the gate image are pushed to the GitLab container registry.	`build-image`, `gate-image`
Secure	GitLab SAST and secret detection, on merge requests and on main.	GitLab templates
Release	A GitLab release that tells dashboard owners what stops being emitted, what replaces it, and which units changed.	`release-notes`
Configure	Environment config as code, applied to staging and production; deploy staging, validate it against what CI verified, then promote.	`configure-`, `deploy-`
Monitor	After every deploy and every 6 hours. On regression it restores the previous config or deploy and opens an incident for the incident flow.	`monitor-production`
Govern	`insurixa-policy.yml` is checked rule by rule; the audit is posted on the originating issue, which is then closed.	`governance`

The agents

Code decides. Agents judge. Credits go only where judgement does.

Every pack decides, per finding, whether a change is safe: one replacement, always applies, same meaning. Safe changes are committed by code at zero credit cost. Only changes of shape or meaning reach an agent, with the reason attached.

GitLab Duo flow

Insurixa upgrade

assessupgradeship

Turns an upgrade issue into a verified merge request that converts values when units change, and merges itself when every gate passes.

Trigger: work item created, by production or by the upgrade radar
Proven: run 1: #3 → !1; run 7: #7 → !7

GitLab Duo flow

Insurixa pipeline repair

diagnoserepair

Reads the failing job logs and pushes a fix to the same branch. It may change only application code, Kubernetes manifests and flagged pipeline lines, and must keep every value.

Trigger: pipeline failed
Proven: run 2 (!2, OpenTelemetry), run 5 (!5, Kubernetes), run 6 (!6, GitLab CI/CD)

GitLab Duo flow

Insurixa incident response

investigateremediateship

After monitor has made production safe, finds the commit and line that caused a regression, explains why CI could not see it, and fixes the cause for good.

Trigger: incident created
Proven: run 3: #5 → !3; it also called a false alarm (#6) correctly

Custom agent

Insurixa Steward

8 GitLab toolsContext7 MCP

Answers "what replaced X, is it safe, and why did my pipeline fail" from the same data the gates decide with, quoting current upstream docs.

Guards: every flow's first agent answers SKIP for events that are not its job, so triggers on every event cost a fraction of a credit

Retired	Why find-and-replace is wrong	What has to happen	Handled by
`batch/v1beta1` CronJob	It isn't: same object, new version	bump the apiVersion	code
`$CI_BUILD_REF_SLUG`	It isn't: GitLab documents an identical replacement	`$CI_COMMIT_REF_SLUG`	code
`autoscaling/v2beta1` HPA	the target changed shape; the API server rejects the bumped object	move each target into `target: {...}`	agent
`CI_JOB_JWT_V2`	there is no drop-in variable	declare `id_tokens:` with an `aud`	agent
`db.client.connections.wait_time`	the unit changed from ms to s	rename and divide values by 1000	agent
`policy/v1beta1` PodSecurityPolicy	no successor exists	redesign with Pod Security Admission	person

Who	Runs	What it did	Result
Insurixa upgrade flow	runs 1, 7	planned 7 retired names and caught a 1000x unit error (!1); chose which specific retry reasons a deploy job needs before GitLab 20.0 (!7)	merged itself #3 closed by audit
Pipeline repair flow	runs 2, 5, 6	4 fixes pushed to developers' branches: 4 names, a ms-to-s conversion, a Kubernetes field change, `CI_JOB_JWT_V2` to `id_tokens`	all gates green every value kept
Incident response flow	run 3	found the config commit and line, wrote !3; later called incident #6 a false positive	merged itself #5 closed by audit
Pipeline repair flow, evaluated	6 real files	Argo CD, kubernetes/examples and go-redis files copied unchanged into !8 to !13: selectors that must match the pod template (one a trap), five CRDs to a structural v1 schema, ms to s, and a PodSecurityPolicy with no replacement	6 / 6 graded by code; refused the one it should
insurixa-safe-fix (code)	run 4	3 safe fixes across Kubernetes and GitLab CI/CD on !4	0 credits no agent needed

All agent work in October, including every SKIP guard on every pipeline and issue event: 93 of the workspace's 500 monthly GitLab Credits; the six-case evaluation took about 30 of them.

The packs

Three upgrade cliffs. One rule. Upstream's own data.

Each pack reads its upstream project's published removal data, pinned so every result is reproducible. Adding the next one, for Helm, Terraform or a language runtime, is a table and a few verdict rules.

insurixa/k8s.py

Kubernetes APIs

From the Deprecated API Migration Guide. SAFE_BUMP SCHEMA_CHANGE NO_REPLACEMENT and STALE_FIELD for what a find-and-replace leaves behind. Skips Helm branches that only render the old API on clusters that still serve it.

insurixa/gitlab_ci.py

GitLab CI/CD

From GitLab's own removals page, pinned to a commit. Checks every pipeline against the GitLab version it runs on: removed features fail, and removals still ahead warn a release early.

insurixa/semconv.py

OpenTelemetry

From 26 releases of the semantic conventions, with unit changes and span-kind rules. Proven in production by a telemetry contract that reads what the running service emits.

# one command runs all three packs; the CI/CD component runs them as gates
$ python -m insurixa check . --gitlab "$CI_SERVER_VERSION" --kubernetes 1.33
Insurixa check
  OpenTelemetry names       0 retired   0 safe to rename
  Kubernetes 1.33           2 removed   {'SAFE_BUMP': 2}
  GitLab CI 19.6            1 removed   {'SAFE_RENAME': 1}

Proof

Seven real runs. Every step is a link you can open.

I played the developer and the teammate. Developers merge their own merge requests as usual; Insurixa's own merge requests merge themselves, and no Insurixa step waits for a person.

OpenTelemetry · hands-off

Issue to production. Nobody touched it.

Plan read production and opened issue #3: seven retired names.
The upgrade flow planned it and caught a 1000x unit error a plain rename would cause.
!1 merged itself; every stage ran; governance closed #3 with an audit.

Main pipeline

OpenTelemetry · repair flow

Retired names from an old wiki, repaired on their branch.

A developer's !2 copied four retired names.
The repair flow fixed them on the developer's own branch.
It then converted a duration recorded in ms to seconds, instead of relabelling it. Green, merged, shipped.

The repair flow's note on merge request 2

Monitor · incident flow

A config change CI never saw, healed in production.

A teammate switched production config to emit old names too. CI stayed green.
Monitor restored the config, redeployed in 30 seconds and opened incident #5.
The incident flow found the commit and the line; !3 merged itself and governance closed the incident.

The incident flow's investigation on incident 5

Kubernetes + GitLab CI/CD · code only

Three fixes, zero agents, zero credits.

A developer's !4 added a CronJob on batch/v1beta1, a PDB on policy/v1beta1 and $CI_BUILD_REF_SLUG.
All three were provably safe, so insurixa-safe-fix committed them and said so on the merge request.
Without it the bundle would have been named manifests-.tgz: a removed variable is an empty string, not an error.

Kubernetes · repair flow

A field that changed shape, fixed with every value kept.

A developer's !5 added an autoscaling/v2beta1 autoscaler on 75% CPU and 200Mi memory.
Safe-fix found nothing safe to change blindly and handed it on. The repair flow moved both targets into the v2 shape.
kubeconform passed in strict mode against Kubernetes 1.33, and the merge request shipped.

The repair flow's note on merge request 5

GitLab CI/CD · repair flow

A removed CI/CD token, replaced the way GitLab documents.

A developer's !6 added a Vault login with $CI_JOB_JWT_V2, removed in GitLab 17.0.
There is no drop-in replacement, so safe-fix handed it on. The repair flow declared id_tokens: with an audience on that job and read the new variable.
It changed nothing else, flagged the Vault role settings to check, and every gate passed.

The repair flow's note on merge request 6

Upgrade radar · upgrade flow · hands-off

Fixed a release before it breaks. Nobody touched it.

A teammate added a retry rule to a deploy job using stuck_or_timeout_failure, which still works but GitLab removes in 20.0.
The upgrade radar in the plan stage opened issue #7. The upgrade flow read what the job does and chose the specific reasons that match it.
Its !7 merged itself, the main pipeline shipped it, and governance posted the audit on #7.

The main pipeline from run 1 across every stage

Main pipeline 2975811502 from run 1: plan, verify, secure, package, release, configure, deploy, monitor, govern.

Case studies on public code

It finds real breakage in software people install today.

Every number is reproducible from the evidence in the repository. Full write-up in docs/case-studies.md.

Kubernetes · 8 CNCF repositories

Three published Prometheus charts fail to install

The pgbouncer, sql and json exporters break on any supported Kubernetes once a disruption budget or autoscaling is turned on. Reproduced on a real 1.32 cluster. insurixa.k8s fix repaired two and they installed. It refused to auto-fix the third, where a plain version swap is rejected by the API server. Most other hits were version-guarded Helm branches or test data, and Insurixa says so.

GitLab CI/CD · 500 most-starred projects

13 pipelines, one that GitLab's own linter passes

8 use features GitLab already removed. 5 very active projects, Wireshark, Graphviz and Buildroot among them, use retry:when values removed in 20.0. gitlab-examples/kubernetes-deploy logs in with $CI_BUILD_TOKEN: the linter says valid, and the password is empty.

$ helm install pgb prometheus-community/prometheus-pgbouncer-exporter --set podDisruptionBudget.enabled=true
Error: INSTALLATION FAILED: ... no matches for kind "PodDisruptionBudget" in version "policy/v1beta1"

$ python -m insurixa.k8s fix charts/ --target 1.33
Safe apiVersion bumps applied: 2
$ helm install pgb ./prometheus-pgbouncer-exporter --set podDisruptionBudget.enabled=true
STATUS: deployed

Why it has to exist

Every platform team pays this tax, on every upgrade.

Today each upgrade, whether a Kubernetes version, a GitLab major release or a conventions bump, is a migration project someone schedules: read the guide, find every use, decide what is safe, edit, review, ship, watch production. Insurixa turns it into a background process that opens, fixes, ships and audits itself.

Upgrades stop being projects

Findings arrive as issues and merge requests, already fixed wherever code can prove it.

A release early

Removals still ahead warn now, while the old feature still works.

Proof, not hope

Contracts, strict schema, nine stages, production monitoring and an audit on every issue.

Agents where they pay off

Safe fixes cost nothing. Agent credits go only to changes of shape and meaning.

Estimate it for your organisation

Example assumptions, not measurements. Change them to your own numbers; nothing here is a claim about any specific company.

Services, charts and pipelines you own

Upstream removals that touch you per year

Share of repos each removal touches (%)

Engineer hours per affected repo

Loaded cost per engineer hour (USD)

Share Insurixa takes off the team (%)

Repos touched per year0

Engineer hours saved per year0

Cost saved per year$0

Not counted: outages avoided, dashboards that silently went dark, and the upgrades teams postpone because they are expensive.

Adopt it

One include line. Three flows to enable.

Add the gates to any GitLab pipeline, then enable the flows in AI › Flows with work-item and pipeline triggers. The component's image is built and self-tested by Insurixa's own pipeline before it is published.

include:
  - component: gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43322398/showcase/insurixa@main
    inputs:
      paths: "src/"
      kubernetes_paths: "deploy/ charts/"   # optional
      kubernetes_version: "1.33"
# the GitLab CI/CD check reads $CI_SERVER_VERSION, no input needed

Security

Built to be trusted

SAST and secret detection on every merge request. Every URL goes through one checked helper. Agents run in a sandbox and may only touch the files their flow allows. Google Cloud deploys are keyless: the pipeline's own OIDC token, exchanged through Workload Identity Federation.

Governance

Policy as code

insurixa-policy.yml is checked rule by rule on every merge request and main pipeline, and the audit is posted where the work started.

Open source

MIT, open source

Insurixa started from an MIT project of mine, vignesh2027/attrition, which supplies the OpenTelemetry dataset. Everything else, from packs to flows to pipeline, is new for this hackathon.

Sustainability

About 2 gCO2e per shipped change

Measured from the pipeline's own runner time with the SCI method. Code-first fixes cut it 16%, and SKIP guards cut irrelevant agent sessions by 75%. Method and limits

FAQ

Questions a judge might ask.

Is it really hands-off?

Yes, for everything Insurixa owns. Its own merge requests merge themselves when every gate passes, production heals itself, and governance closes the issue. In the demo runs I played the developer and the teammate, and developers merge their own merge requests as they normally would.

Why not let the agent do everything?

Because models confidently write retired names, as our benchmark shows. Code applies what upstream data proves safe, which costs nothing and cannot hallucinate. Agents handle only what needs judgement, and the pipeline proves their work.

What stops an agent from cheating the gates?

Each flow may change only specific paths and is told never to edit tests, data, the decision code or the pipeline's jobs. Tests check a frozen legacy fixture, and the telemetry contract and strict schema check what really runs.

How do the agents work without network access?

The agent sandbox has no network, so agents cannot install tools to run tests. They say so in their notes, and the pipeline does the proving, which is why the contract and schema checks exist.

What are the limits today?

The scanners read files, not rendered Helm output. The GitLab survey covers root pipeline files of one ranking of projects on one day. The scanners know only what upstream has published, so a removal announced tomorrow is caught once its data is added to the pack.

Can I use it on my own project?

Yes. Include the CI/CD component with one line and enable the three flows. Everything is MIT licensed.

The five things judges look for, and where to see each one.

A real pipeline, not a demo script

One complete loop

Real breakage, real audience

Code decides, agents judge

Every claim is a link

The whole loop, in under three minutes.

Upstream retires things on a schedule. Nothing errors until it breaks.

Charts that fail helm install

Pipelines with an empty password

Dashboards that go quiet

Code generation is solved. It writes what upstream already retired.

One loop, from noticing to auditing, entirely on GitLab.

Code decides. Agents judge. Credits go only where judgement does.

Insurixa upgrade

Insurixa pipeline repair

Insurixa incident response

Insurixa Steward

Three upgrade cliffs. One rule. Upstream's own data.

Kubernetes APIs

GitLab CI/CD

OpenTelemetry

Seven real runs. Every step is a link you can open.

Issue to production. Nobody touched it.

Retired names from an old wiki, repaired on their branch.

A config change CI never saw, healed in production.

Three fixes, zero agents, zero credits.

A field that changed shape, fixed with every value kept.

A removed CI/CD token, replaced the way GitLab documents.

Fixed a release before it breaks. Nobody touched it.

It finds real breakage in software people install today.

Three published Prometheus charts fail to install

13 pipelines, one that GitLab's own linter passes

Every platform team pays this tax, on every upgrade.

Upgrades stop being projects

A release early

Proof, not hope

Agents where they pay off

Estimate it for your organisation

One include line. Three flows to enable.

Built to be trusted

Policy as code

MIT, open source

About 2 gCO2e per shipped change

Questions a judge might ask.

Upgrades should not be projects.

Charts that fail `helm install`