Orbit-powered merge governance
RivenblocksunsafeAI-writtencode.
Riven turns GitLab Orbit's code graph into an enforceable merge contract: changed definitions, impacted callers, verification plan, risk score, and CI gate.
Riven turns GitLab Orbit's code graph into an enforceable merge contract: changed definitions, impacted callers, verification plan, risk score, and CI gate.
Riven is not a reviewer comment. It is a CI-facing control plane that turns Orbit static graph evidence into a required GitLab merge status.
Open the live contractRiven resolves the GitLab merge request base and head refs, then maps changed lines to Orbit definitions instead of guessing from prose.
change intakeIt walks inbound static CALLS edges through gl_edge to find graph-proven impacted callers and transitive risk.
static impactThe result is risk-contract.yaml: changed symbols, impacted sites, verification jobs, owners, risk factors, and unmet gate conditions.
machine policyIf the contract fails, the CI job exits non-zero. GitLab keeps the merge button blocked until the risk is handled.
merge controlRiven lets autonomous agents move fast without turning code review into vibes. The graph produces the contract; GitLab enforces it.
Riven uses Orbit Local tables like gl_definition and gl_edge to find graph-proven static call/reference impact for an MR.
Every run emits risk-contract.yaml with changed definitions, impacted symbols, verification plan, owners, limits, and explainable risk factors.
The GitLab CI job fails when required gate conditions are unmet, so the merge button stays blocked by policy, not persuasion.
AI can draft remediation and candidate patches, but Riven validates patch plans and verifies diffs in a temporary worktree before trust.
Agents can consume the same contract through MCP tools for analysis, explanation, remediation planning, patch generation, and evidence recording.
Run init, doctor, gitlab-bootstrap, and gitlab-gate to plug Riven into a GitLab repo without a bespoke dashboard or hardcoded project path.
Riven ships as repository infrastructure: scaffold the policy, verify readiness, bootstrap GitLab settings, then let CI enforce every risk contract.
AI may draft the fix, but Riven keeps the control with GitLab: the contract must be satisfied before the merge can move.