Every backport, proven by the bug’s own test

Merge a bug fix once. A GitLab Duo agent carries it to every release branch you name. A script, not the model, accepts each backport only if the fix’s regression test fails before it, passes after it, and nothing that passed before breaks.

Real upstream project

marshmallow’s own code, tests and release tags.

!1 merged on main Fix handling data_key in ValidationErrors raised in schema validators

release/3.25fails beforepasses afterProven, adaptedv3.25.2
release/3.23fails beforepasses afterProven, adaptedv3.23.4
release/3.21fails beforepasses afterProven, adaptedv3.21.4

3 branches
3 proven

The proofLive from gitlab-ai-hackathon/transcend-october-2026/38599834/marshmallow-backports

Open a row to see each step.

release/3.25Bug reproducedFixed in v3.25.21223/1223Proven, adapted

Probe
Bug reproduced AssertionError: assert {'fooKey': ['..._schema str']} == {'fooKey': ['...schema dict']} CI re-probe
Pick
Fix adapted to this branch: src/marshmallow/decorators.py, src/marshmallow/schema.py, src/marshmallow/types.py, tests/test_decorators.py, CHANGELOG.rst
Adapt
Resolved conflicts: dropped 3.26 changelog/RenderModule/noqa bits, kept SchemaValidator protocol type and used ma_fields.Field annotation; fix logic unchanged.
Integrity check: unchanged, test unchanged.
What the agent changed: the fix as merged on main, and its port to this branch
Compare on GitLab: the fix, !1 and the port, !2.
Judge
Final judge: proven-adapted, existing tests 1223/1223
Attempts and their feedback: not recorded (this proof note predates that record).
CI checks
!2, pipeline 2986621297
- bp:repro Bug reproduced before backport (expected) success
- bp:verify Regression test passes, existing tests still pass success
- bp:integrity Test unchanged or a valid mechanical port success
- SAST Static analysis of the backport success
- Secret detection No secrets in the backport success
Release
Tagged v3.25.2

release/3.23Bug reproducedFixed in v3.23.41231/1231Proven, adapted

Probe
Bug reproduced AssertionError: assert {'fooKey': ['..._schema str']} == {'fooKey': ['...schema dict']} CI re-probe
Pick
Fix adapted to this branch: src/marshmallow/decorators.py, src/marshmallow/schema.py, src/marshmallow/types.py, tests/test_decorators.py, CHANGELOG.rst
Adapt
Resolved conflicts: dropped unrelated 3.26 changelog/RenderModule/noqa bits, kept SchemaValidator protocol type, added 3.23.4 changelog entry; fix logic unchanged.
Integrity check: unchanged, test unchanged.
What the agent changed: the fix as merged on main, and its port to this branch
Compare on GitLab: the fix, !1 and the port, !3.
Judge
Final judge: proven-adapted, existing tests 1231/1231
Attempts and their feedback: not recorded (this proof note predates that record).
CI checks
!3, pipeline 2986621627
- bp:repro Bug reproduced before backport (expected) success
- bp:verify Regression test passes, existing tests still pass success
- bp:integrity Test unchanged or a valid mechanical port success
- SAST Static analysis of the backport success
- Secret detection No secrets in the backport success
Release
Tagged v3.23.4

release/3.21Bug reproducedFixed in v3.21.41229/1229Proven, adapted

Probe
Bug reproduced AssertionError: assert {'fooKey': ['..._schema str']} == {'fooKey': ['...schema dict']} CI re-probe
Pick
Fix adapted to this branch: src/marshmallow/decorators.py, src/marshmallow/schema.py, src/marshmallow/types.py, tests/test_decorators.py, CHANGELOG.rst
Adapt
Resolved conflicts: kept 3.21's decorators imports (no defaultdict), dropped unrelated 3.26 changelog/RenderModule/noqa bits, kept SchemaValidator protocol type, added 3.21.4 changelog entry.
Integrity check: unchanged, test unchanged.
What the agent changed: the fix as merged on main, and its port to this branch
Compare on GitLab: the fix, !1 and the port, !4.
Judge
Final judge: proven-adapted, existing tests 1229/1229
Attempts and their feedback: not recorded (this proof note predates that record).
CI checks
!4, pipeline 2986621984
- bp:repro Bug reproduced before backport (expected) success
- bp:verify Regression test passes, existing tests still pass success
- bp:integrity Test unchanged or a valid mechanical port success
- SAST Static analysis of the backport success
- Secret detection No secrets in the backport success
Release
Tagged v3.21.4

Proven, adapted: the agent changed code for this branch; the same test proved it
Bug reproduced: the test fails without the fix
Fixed: the test passes after the backport

Why you can trust it

The agent proposesA Duo agent cherry-picks the fix and adapts code where the branch differs.
bp judge decidesA script with no LLM runs the test before and after, and every test that passed before.
CI re-proves itThe backport MR’s own pipeline runs the same checks again from a clean checkout.

Seven rules hold every time. Open one to see the code that enforces it and the test that checks it.

The agent can't mark its own work proven: publish re-runs the judge and ignores the agent's claims.
Enforced in tools/bp/publish.py, tested by test_agent_claims_are_ignored.
The regression test's asserts and literals never change; a port may only rename identifiers.
Enforced in tools/bp/integrity.py, tested by test_changed_literal_is_invalid.
The agent can't edit tools/, ci/, .gitlab/ or any other test.
Enforced in tools/bp/judge.py, tested by test_editing_tools_or_other_tests_fails.
At most 3 judge attempts per branch and 6 branches per run.
Enforced in tools/bp/judge.py, tested by test_attempts_are_capped_but_final_judge_still_runs.
No backport where the bug was not reproduced: CI fails the MR if the test passes unpatched.
Enforced in tools/bp/ci.py, tested by test_ci_gates_fail_when_the_backport_is_tampered.
A release branch changes only through an MR whose own pipeline re-proves the backport.
Enforced in ci/backport.yml, tested by test_ci_gates_pass_on_a_published_backport.
Commit and MR text is parsed with strict patterns and never becomes instructions to the agent.
Enforced in tools/bp/plan.py, tested by test_parse_rejects_tokens_that_are_not_branches_or_test_ids.

Check your repoThis page reads results from GitLab. It does not run backports.

Try the real-code test: marshmallow-backports.

To install DuoBack on a project:

Enable the DuoBack flow from the AI Catalog.
Add a Pipeline-events trigger: status success, default branch, source push or merge request.
Include ci/backport.yml from the DuoBack project in your .gitlab-ci.yml.
Merge fixes with Backport-to:, Fixes: and Bp-Test: lines in the commit message.

For judges

Technological implementationA flow, a deterministic judge and CI gates: tools/bp/; the adapted backport’s MR pipeline.
DesignOne merge in, proven MRs and releases out: .gitlab/duo/flows/backport.yml.
Potential impactReal marshmallow fix proven on three release lines: docs/validation.md; its proof, live.
InnovationFail-before, pass-after proof per branch: tools/bp/integrity.py; the job that reproduced the bug.
Presentation60-second judge path: README.md; the proof table on the fix MR.

Plan Proof table on the fix MR
Create Backport MR opened by the flow
Verify bp:repro, bp:verify, bp:integrity
Package Each release uploaded to the package registry
Secure SAST and secret detection on every backport
Release Patch tag and GitLab Release from CI
Configure Flow, trigger and CI template
Monitor Coverage issue refreshed on every main pipeline
Govern Human approval on adapted backports, CODEOWNERS

How it differs

Mergify backports and sorenlouv/backport cherry-pick by label and stop at conflicts.
agent-backport resolves conflicts with AI; no test step is documented.
pickman (U-Boot, on GitLab) builds and fixes CI, but doesn’t prove fail-before, pass-after.
Ironic Backport Agent checks that the fix commit is present, not that the bug is gone.

Honest limits

A fix needs a regression test (Bp-Test). No test, no proof.
Python and pytest only in this version.
The showcase history is staged so every outcome appears; the marshmallow fork uses real upstream code and tags.
A person merges every backport (the flow can’t set auto-merge) and approves adapted ones.
Started by a filtered Pipeline-events trigger when the fix’s main pipeline passes, so a fix is ported only after its own pipeline is green.