IG
IGRIS
GitLab "Life After Code" Hackathon • Zero-Trust Triage

AI bug reports are G1 guilty until reproduced.

Forty AI-written security reports arrive overnight. Most name functions that do not exist. IGRIS stands at the gate—refusing hallucinated reports in 3.6ms, bisecting real crashes in 142.3ms, and keeping every AI agent on probation.

3.61 ms
Fake symbol refusal
142.3 ms
Automated git bisect
5 / 5
SHA-256 receipts
OPTICAL FOCUS HIERARCHY GATE 1 // 3.61ms

Unverified AI noise stays blurred in the background. Only reproduced proof snaps into focus.

Step 01 // How IGRIS Works

Four ordered gates. Cheapest check runs first.

Every incoming bug report or AI merge request must pass four hardware checks in order. Fake reports are dropped in milliseconds before a container or AI model is ever booted.

GATE 0 0.82 ms

1. Schema Filter

Verifies the report names a real file path, a specific function symbol, and a reproduction script.

g0_schema.ts Pass → G1
GATE 1 • KEY GATE 3.61 ms

2. AST Symbol Scan

Scans the real syntax tree. If the function the AI report blames does not exist, IGRIS refuses it immediately.

g1_reachability.ts Stops Slop
GATE 2 3.82 ms

3. Locked Sandbox

Blocks shell traps (rm -rf, $CI_JOB_TOKEN) and runs the repro with zero network access. Only the exit code counts.

g2_sandbox.ts Exit Code 0/1
GATE 3 142.3 ms

4. Git Bisect (#989)

When Gate 2 proves a real crash, IGRIS binary-searches git history to find the exact commit that broke the build.

g3_bisect.ts Finds Culprit
Step 02 // Why Maintainers Need This

The 15-Second Split-Screen

On January 31, 2026, curl shut down its bug bounty after valid submissions dropped below 5%. Here is the difference when an AI-generated report hits your inbox:

Without IGRIS • Naive Inbox 45 MIN LOST

Maintainer Chases a Function That Does Not Exist

Issue #412: Critical RCE in parseChunkHeader()
"Crafted chunked encoding header triggers heap overflow in src/http_parser.c..."
  1. Maintainer stops deep work and boots a local debug container.
  2. Searches 2,000 lines of C code looking for parseChunkHeader().
  3. Realizes the LLM invented the function name from thin air.
OUTCOME: MAINTAINER BURNOUT 45 MINUTES WASTED
With IGRIS • Gate 1 Intercept 3.61 MILLISECONDS

Refused at the Gate with a Signed Receipt

Verdict: PHANTOM_SYMBOL (Exit Code 1)
"Symbol parseChunkHeader not found in AST of src/http_parser.c. Container boot aborted."
  1. Gate 0 (0.82ms): Checks required report fields.
  2. Gate 1 (2.79ms): Scans the syntax tree of src/http_parser.c and spots the fake function.
  3. Zero Compute Burned: Seals a SHA-256 refusal receipt before booting any runner.
OUTCOME: VERIFIED REFUSAL 0.00 MB CPU BURNED
Step 03 // What Happens After the Gate

Pinpoints real bugs. Keeps AI agents on probation.

Solves GitLab Community Issue #989 (Open Since 2017)

Automated Git Bisection in 142.3ms

When a report is genuine and crashes inside the Gate 2 sandbox, IGRIS automatically runs git bisect run across commit history in a clean temporary worktree to hand you the exact breaking commit.

Culprit Commit Locked: a4f81c9e 16 commits searched
The GitLab Security Standard v1.0 (Oct 6, 2026)

Earned Autonomy & Instant Demotion

Every AI agent starts at Level 1 (Probation). It earns promotion through verified passes. If an agent tries to make CI green by deleting a test assertion (DELETED_TEST), IGRIS demotes its approval level immediately.

L1 Suggest → L2 Propose → L3 Act Zero-Trust Diff Audit
1-Click Verification Sandbox

Test all 3 scenarios and agent demotion live in your browser.

Sandbox Runner v16.9 • Isolated Mode

IGRIS Interactive Console

Step 1 — Select a Test Scenario Click any scenario to load its payload
Step 2 — Input Incoming Bug Report
ID: CURL-SLOP-89
Untrusted Input
Step 3 — Execution 4-Gate Hardware Pipeline
Status: Standby
GATE 0
Schema
READY
GATE 1
AST Scan
READY
GATE 2
Sandbox
READY
GATE 3
Git Bisect
STANDBY
Runner Output
Elapsed: 0.00ms 
// Click 'Run 4-Gate Verification' to stream gate execution...
Next: Audit AI Merge Request diffs and verify repository hashes