Custodeon
2025A GitLab-native autonomous DevSecOps agent that converts dependency vulnerability reports into validated, human-review merge requests — no external hosting, no webhooks.
- Designed a multi-stage remediation pipeline: GitLab dependency scan → Claude CVE analysis → Pydantic validation → file patch → GitLab MR creation
- Implemented patch safety guardrails enforcing semver downgrade blocking, file allowlist checks, regex-validated semver, and one retry on malformed AI output before fail-fast
- Separated AI reasoning from application logic via a structured JSON output contract: Claude produces a
RemediationModelthat is validated before any file is touched - Configured GitLab Duo Agent and Flow YAML definitions for native platform integration, eliminating external hosting requirements
Architecture: Claude produces a structured RemediationModel (Pydantic) → patch_validator.py enforces semver safety rules → gitlab_client.py creates a remediation branch, commits the patched package.json, and opens an MR with full security context for human review.