checkStatusCode upper bound exclusive
GOtests passed: merged
A bad change can pass every test. Second Key checks every merge request with evidence, decides with code, not a model, and leaves one decision to a human: turning the second key for that exact commit.
Thirty upstream bug fixes from the 2.x line, each undone on main by reverting its code (its regression tests stay), chosen by a rule
that was committed and tagged reintro-sealed before the first merge request. Each went through the live pipeline.
Merge-when-tests-pass stopped 1 (4 with every test re-run); Second Key flagged 17, 16 of them with every test green. A reviewer picking changes at random at Second Key's review rate would flag that many with probability 0.012.
16 deliberately broken merge requests and 12 clean ones went through the live pipeline. Switch between the rule most projects use and Second Key's verdict. The usual rule stops 4 of 16 of the broken ones and never bothers a clean change, so it is a fair baseline; Second Key flags 15 of 16, and its price is review load.
The current policy replayed on the 28 recorded MRs at every GO threshold. Blockers do not depend on it; the curves show what the score buys. These MRs calibrated the policy once, so this describes the trade-off rather than testing it.
Every held-out upstream PR that applies to 2.5.7 was replayed through the live pipeline; whether it was later reverted or fixed was hidden from the gate. On the sealed held-out backtest (history and diff signals only) it flagged 1 of 4 later-bad PRs and sent 113 of 229 good ones to review.
Six steps, on gitlab.com and Google Cloud. Agents read, explain and propose fixes; the verdict is code; the key is a person's note naming the commit. On !87 the gate blocked a removed login check, the flow opened !88 restoring that line, and the same gate gave the fix GO.
Evidence runs in CI: only the tests the change can reach, mutation, fuzzing, scans.
Deterministic code reads the evidence: GO, NEEDS_REVIEW or BLOCK, signed for this commit.
A Duo flow writes the Evidence Note. On BLOCK it files the issue and opens a fix MR, judged by the same gate.
A key holder turns the second key for exactly this commit, after its evidence is signed.
On merge, every merge since the last release is re-verified: signature, diff, key.
Cloud Run: 5%, 25%, 100%, each step held only inside the SLO; a breach restores the recorded revision.
The same six commits run twice: risk-proportional evidence (blue) and the full suite (grey), measured per job with Eco CI. 491.3 J against 3468.72 J.