I built BOUNDARY Forge to verify AI-generated code before release
AI coding agents are getting very good at diagnosing failures and proposing fixes.
But that creates a second problem:
Who verifies that the fix is actually safe to trust?
That question became the basis for BOUNDARY Forge — Verified Delivery, my submission to GitLab’s Life After Code hackathon.
Forge is a supervised software-delivery verification workbench designed to keep AI-assisted development fast without letting the same agent that changes code also decide whether that code is safe to release.
The core idea
The workflow is:
Issue → AI-assisted repair → exact source candidate → deterministic verification → independent evidence → human release decision
Forge ties every verification result to the exact Git commit and tree being evaluated.
It then combines:
- exact-source verification
- protected-runtime policy checks
- bounded behavioral tests
- evidence binding
- SHA-256 report digests
- human-controlled release authority
The goal is not to ask an AI whether its own work is trustworthy.
The goal is to produce evidence that can be inspected independently.
Three adversarial scenarios
The project includes three judge-facing scenarios:
SAFE
A genuine GitLab Duo repair is verified against the exact source identity and expected behavioral contracts.
Result: PASS
UNSAFE
A protected runtime guard is weakened so it would approve unconditionally.
Forge detects the protected-source change and refuses verification.
Result: HOLD
FORGED
Legitimate source is paired with release evidence claiming a different commit and tree.
Forge detects the mismatch.
Result: HOLD
Built for this hackathon
BOUNDARY Forge is a new product built for the GitLab Transcend hackathon.
Its trusted deterministic verification core selectively reuses MIT-licensed components from the upstream BOUNDARY project, while Forge’s application, Verification Workbench, evidence system, release controls, judge scenarios, and deployment workflow were built for this competition.
GitLab Duo contributed to the preserved repair lineage used as verification evidence.
What I learned
The biggest lesson was simple:
Trust should come from reproducible evidence, not from an agent saying that its own work is correct.
AI-assisted development and deterministic verification work well together when their responsibilities stay separate.
An AI agent can repair code.
Verification can establish what source was actually tested.
Evidence can prove which checks actually ran.
And the final release decision can remain with a human.
Try it
The full project page includes the live demo, GitLab repository, and video:
https://devpost.com/software/boundary-forge-verified-delivery
Built under Null Foundry.
Top comments (0)