Can we open ticket sales?

Not while a rush locks the window. Duo moved the slow check out of that lock. The same test passed. A person still decided when the practice window opened.

What happened

  1. Checkout failed under the rush. Buyers could not finish, because the window held the database lock too long. See the failure
  2. GitLab Duo proposed the repair. Review Duo’s repair
  3. The same test checked the repaired version. Zero lock failures. See the test results
  4. A human authorized the sandbox release. Inspect the recorded release
  5. A matching purchase receipt confirmed recovery. The smoke purchase completed.

On the demo computer the ticket window itself is open. One command starts it: python desk/open_tickets.py then http://127.0.0.1:18000/. This public page cannot sell a ticket. It tells the story and points at the recording.

The recorded rush

Before

461 of 487 checkout tries were locked out.

94.66% of checkout tries failed. Nothing was booked for those tries.

See the failure

After

0 lock failures in 200 tries.

Same kind of rush. The slow check still runs. It no longer holds the lock.

See the test results

Dad pressed the release button. The program did not. The practice window booked order 1 and then stopped. It was a temporary sandbox, not a real box office.

Worth knowing. Semgrep reported 3 Medium findings in scripts/collect_case.py (its SSRF rule on the case collector's GitLab calls) and 1 Info finding in app.py (an assert). The job's success does not mean zero findings. Inert job 17366830472 stayed manual. The repair identity's play command exited 1. The response body was not retained. This is not a demonstrated 403. 16 passed on the released commit, job 17363501023. A later local run passed 19 tests. Those three extra tests are not in the released package.

Technical evidence

Joined outcome: RECOVERED. Pre-release case snapshot: candidate_measured. Written before the release button. This snapshot does not say recovered.

Merge request 1 is open. It has not been merged.

Authorized by holmanholdings. Finished 2026-10-21T21:18:32.056Z. Environment temporary sandbox.

Commit match True. Package match True. The commit, the package digest, and the workload file hash are three different kinds. Each is compared only with its own kind.

The load script does not configure a random seed.

Session 9858493 held pipeline 2969950135. That hold is supported: the pipeline is commit e667705 and its load failed. A further explanation in that session was not taken from the load log, so it is not used.

The pipeline-failed trigger is inactive. It is not a demonstrated automatic repair.

The security report is not a clean report.

StageWhat it isLink
PlanIssue 1, Repair the failed rush. Opened by holmanholdings. A group-reservation feature is not part of this build.Open
CreateMerge request 1 is open, not merged. Duo's commit 3f4448ef moved the eligibility lookup out of the write. Three later commits on this request are human: the release job, the retry fix, and the registry login.Open
VerifyPipeline 2973884947. Test job 17363501023 passed 16 tests. Load job 17363501025 passed the same workload settings.Open
SecureSemgrep job 17363500743 on push pipeline 2973884892, same commit dac28478. The job succeeded with allow_failure. The report lists 4 findings: 3 Medium, 1 Info. This is not a clean report.Open
PackagePackage job 17363501024. Digest sha256:8679f8eaa94e8469e308267b1c7bb1554e7b69f1dff1c3e8d40e68a93b5c20ad. This is a container digest, not the git commit.Open
ReleaseJob 17363501027, played by holmanholdings, finished 2026-10-21T21:18:32.056Z. Temporary sandbox. Smoke passed. Smoke order 1.Open
MonitorThe rush is the check. Before: job 17334102073. After: job 17363501025. This is not a monitoring product.Open
ConfigureThe workload is the committed CI settings: 8 virtual users, 20 seconds, 800 ms lookup, 300 ms lock wait, 500 seats.Open
GovernCase snapshot candidate_measured. Joined outcome RECOVERED only because the receipt matches. Environment sandbox-demo is a temporary sandbox. Release is Dad's button.Open

While the GitLab project is private, those links ask a member to sign in.