Agent CI/CD

Agent CI/CD is where agent output meets the merge button — and where pipelines start containing agents as stages: review, triage, fix generation. One rule organizes the entire topic, and it deserves engraving before anything else in this lesson: agents produce evidence; deterministic checks decide. A model may write the code, propose the fix, draft the review, grade the output — and the thing that gates the merge must be a test suite, a type checker, a schema validator, an eval threshold: something that returns the same verdict for the same input every time. This lesson is that rule, the reasons it exists, and the machinery that makes agent throughput safe to merge.

Why a model cannot be the gate

A gate has one job: its verdict must mean something. Ask a model "should this merge?" twice on the identical commit and you can get different answers — not a defect, just what sampling is. The damage arrives culturally before it arrives technically, and it follows a schedule you can predict: a red that goes green on retry teaches everyone that red might mean nothing; within weeks, retry is muscle memory; within a quarter, red means "run it again," and you have kept the pipeline's entire cost while deleting its entire information content. Teams don't decide this; it happens to them, one reasonable-seeming retry at a time.

You've met this distinction before — it's lesson 15's advice/enforcement line, promoted to pipeline law: judgement advises; determinism decides. The compositional form: an agent stage writes its findings as an artifact — review comments, a triage report, a proposed patch — and is configured so it cannot fail the build. A deterministic stage reads the artifact where needed and issues the verdict. Structure it in the pipeline config — a stage that structurally can't block — not in a comment asking the agent to consider itself advisory. Configuration is enforcement; comments are hope (lesson 8's caveat, in CI clothing).

Gating agent-written code

The honest premise: agent code arrives faster than humans deeply review, from a source whose failure modes differ from a human's — models produce plausible wrong code: compiles, reads idiomatically, subtly misunderstands the spec. The gates, in the order they earn their keep:

The classical floor, non-negotiable. Types, lint, tests — plus your hook-enforced invariants re-checked in CI (lesson 15's rules must hold even for commits produced outside your harness: CI is where "no migrations edits" gets verified for every path into the repo, not just your agent's).

Eval gates for judgement-shaped output (lesson 21). Where the product is behavior no unit test pins — extraction quality, triage accuracy, summarization fidelity — the suite score is the test. Two mechanics turn a score into a real gate rather than theater:

1. The threshold is a committed baseline — a number in the repo, versioned, so moving it is a reviewable diff with a name attached, not a quiet edit under deadline pressure.
2. The score travels with the suite's identity (lesson 21's versioning), and a run against a changed suite fails as incomparable — even if the number went up. The cheapest way to game any gate is to edit the yardstick; versioning the yardstick closes the shop.

Human review, budgeted honestly. At agent throughput you cannot deep-review everything, so spend attention where machine gates are weakest: security-sensitive paths, public interfaces, migrations, anything irreversible. Let the deterministic floor carry the rest — that is what it's for.

Running agents inside CI

CI is the least attended place there is, so every unattended-agent discipline applies at full strength, plus one CI-specific multiplier:

• Narrow grants and turn caps (lesson 18): the fix-agent gets the test command, not Bash(*); --max-turns always.
• Budgets refused up front, caps at the provider (lesson 5) — with the multiplier written on the wall: CI runs on every push, and per-push × runaway is the canonical invoice story. A pipeline that spends tokens must know its per-run budget and decline to start a run it can't afford.
• Propose, never dispose (lessons 17, 26): the CI fix-agent opens a PR; it does not push to main. Its output enters the same gates as everyone else's — which is the whole point.
• Artifacts retained (lesson 18): transcripts and structured outputs kept, so an odd action is traceable to the input that caused it (lesson 26's transcript-review defense, institutional).

The payoff that makes the ceremony worth it

Here is the inversion that ties the course's whole second half together: once the gates are trustworthy, they don't merely check agent work — they enable it. A repo where merging requires passing types, tests, enforced invariants, and a versioned eval threshold is a repo where you can hand an agent real tasks and sleep, because wrongness is caught by machinery rather than vigilance. Autonomy isn't granted to the agent; it's underwritten by the gates (lesson 16's thesis, now with hardware). Which explains the pattern you'll notice everywhere once you look: the teams running the most autonomous agents are — not despite but because — the teams with the strictest CI. The gates are not the tax on autonomy. They are the collateral that purchases it.