## Summary Phase 1 of [MR Risk Classification & Tiered Review Routing](https://gitlab.com/groups/gitlab-org/-/work_items/21610) (see the [phased implementation proposal](https://gitlab.com/groups/gitlab-org/-/work_items/21610#note_3647849128)). Ships a read-only, shadow-mode risk assessment for every eligible merge request: a deterministic score, a derived tier, matched risk domains, and a plain-language rationale - computed once, at MR open or ready-for-review time, in parallel with base Duo Code Review. Nothing is gated on the result yet, and there is no way for a human to correct a classification yet - break-glass overrides are deferred to Phase 6 so this phase can ship the smallest possible foundation first. ## Deliverable Every eligible MR gets a computed, visible risk assessment. No merge blocking, no required extra approvals, no re-scoring on push. ## Scope - Data model for assessments and outcomes (**not** overrides - see Phase 6) - Deterministic scoring: domain gates, diff-based signals, a versioned scoring function - A `risk_classification/v1` Duo Agent Platform flow (gitlab-ai-gateway) that answers a fixed set of categorical claims about a change, with evidence, and never emits a score or confidence value itself - A GraphQL write path for the flow to submit its claims, and a read path for the merge request widget - Feature-flagged, license-gated rollout, wired into MR create and draft-to-ready - Frontend surfacing on the merge request ## Explicitly out of scope for this phase - Break-glass override of a tier (Phase 6) - Any per-namespace configuration of domains or thresholds (Phase 4) - Any consumer other than the merge request view itself (Phase 5) - Outcome signals beyond what this phase's data model can hold (Phase 3) ## Open questions to resolve during this phase - **Trigger point:** MR opened vs. moved to ready-for-review vs. reusing the trigger being built for suggested reviewers, vs. a manual "run" button as the initial fallback. - **Widget UX:** the full risk widget (as spiked) vs. a lighter "fast-track" affordance that only surfaces for low-risk MRs and says nothing otherwise.