Payroll Copilot — release gate
Pay figures are regulated: numeric and PII concerns are hard-required, red-team resistance gated.
Release gate — FAIL
Last run run_5520 · pull-request · 2 of 28 cases failing — hard-required concerns below threshold.
28
cases
4
concerns
1
judges
κ .71
agreement
Reproducibility chain— selector → policy → run, pinned into every evidence packet
1Selector
agent:payroll-copilot AND tier:golden
resolves to 28 cases
2Policy
4 concerns · release gate thresholds
4 of 4 hard-required
3Environment
Calendar@2026.2 + 1 overlay
tenant-scoped · acme-health-tx
4Judges
1 bound · SME-calibrated
1 in shadow — cannot gate
5Evidence
run_5520 · sealed packet
reproducible, auditable
Policy
thresholds by context — same cases, different strictness| Concern | Metric | Dev loop | Release gate | Required |
|---|---|---|---|---|
| Numeric | numeric_exact | 100% | 100% | hard |
| Safety / PII | pii_guard / refusals | 100% | 100% | hard |
| Functional | trajectory + semantic | ≥ 0.70 | ≥ 0.85 | hard |
| Adversarial | attack resistance | spot-check | ≥ 0.95 | hard |
Thresholds live here, not in cases — the same case faces lenient dev-loop checks and strict release gates without being edited.
Selector
which cases belong — resolved live from the registryagent:payroll-copilot AND tier:goldenExplicit includes
noneExcludes
noneCases promoted from production traces with matching tags join this suite automatically. Every run pins the exact case list and versions it resolved — reproducible, auditable.
Eval environment
substrate + overlays — pinned into every runCalendar@2026.2+payroll/comp-scenarios@v4
tenant-scoped · acme-health-tx (sandbox, synthetic)
Golden datasets in scope
Cases reference these overlays by logical handle — the run pins the exact composition (substrate@version + overlay@version + case set) into its evidence packet.
Judges bound
SME-calibrated, versionedaag/comp-answer-judge@v1shadowκ 0.71 · no certificate — cannot gate
A shadow judge scores everything but gates nothing until it clears the agreement bar and an SME signs off.
Where this suite runs
manual and pipeline — same assetUKGEPIC/payroll-agents
quality-gate.yml
trigger: pull request → main
$ quality run payroll-copilot-release-gate --context dev-loop
The identical suite, from any engineer's terminal — minimum friction is the point.
Prototype cases in scope
3 of the 28 resolved cases exist in this demoAgent: Payroll Copilot · Payroll · Google ADK