PavePath

A copilot with a clear decision boundary

An engineer preparing a production change needs more than a reassuring answer. They need to know which evidence is missing, which rule produced the result, and who can resolve an exception.

PavePath is a small, implemented change-readiness application built on Cloudflare Workers. A user describes a change and supplies explicit facts: environment, affected systems, test evidence, rollback readiness, feature flags, and owner approval. Deterministic TypeScript rules return allow, needs-approval, or block. Workers AI explains that result.

The application records a review decision; it does not execute a deployment.

Follow one review

Consider a production application change that has tests and a rollback path but no code-owner approval. The policy evaluator emits finding DEP-004 and returns needs-approval. An explanation describes the missing evidence, and a durable workflow waits for a human decision.

If the same change is a production database migration without a rollback path, finding DEP-001 is a blocker. Correcting the input evidence and running another review is the route forward; the exception workflow is reserved for the needs-approval result.

That distinction is visible in code and in the UI. A fluent model answer cannot rewrite the structured policy result.

Architecture

Browser: description + confirmed change facts
  -> Worker: validate and route request
  -> ReviewSession Durable Object
       -> redact secret-shaped text
       -> evaluate versioned policy
       -> persist review in SQLite
       -> request a Workers AI explanation

needs-approval
  -> ReviewWorkflow waits for an operator event
  -> approve, reject, or expire
  -> record the decision against the original review

The Worker provides the API boundary and serves a small static frontend. A Durable Object owns each session’s messages and reviews. Cloudflare Workflows handles the wait for an operator, including a 24-hour expiration and retries when recording the result.

Decisions that matter

Facts are explicit inputs. The model does not infer that tests passed or a rollback exists because the description sounds confident. The selected environment and evidence flags are inputs to the policy function. They are user assertions in this prototype; a production integration would need to verify them against CI and change records.

The policy result survives an AI outage. The rule evaluator runs first. If the model is unavailable or returns an unusable response, the application provides a deterministic explanation containing the findings and next action. The decision path does not depend on language generation.

A human decision belongs to one review. The application stores the workflow ID with the review, checks for a pending workflow in the session, and records the final decision with its rationale. A new review does not silently inherit an earlier approval.

Review memory is bounded. Descriptions and rationales have size limits, and the implementation caps reviews per demo session. Secret-pattern redaction runs before storing the submitted description or sending it to the model. Pattern matching is a limited filter, so the demo uses synthetic change descriptions.

Verification and operating limits

The project contains deterministic tests for allowed staging changes, production rollback blockers, missing-owner review gates, secret-shaped input, verification bypass requests, and operator-rationale validation. It also includes a local fallback mode that exercises the flow without calling Workers AI.

The implemented scope is a prototype with a chat interface, policy evaluator, persisted review history, and a durable exception path. Production use would require authenticated operators, authorization on every session and approval, rate limits, stronger audit retention, and evidence from trusted systems. A browser session ID currently selects state; it does not prove the caller’s identity.

What this project demonstrates

AI can make a policy result easier to act on while the surrounding program keeps ownership of the state transition. PavePath makes that boundary concrete through typed results, persisted evidence, and an explicit human step.

Read the engineering note: policy decisions and AI explanations