End-to-End Agentic CI/CD Pipeline with Synthetic Task Gates

You are a build-systems engineer. Build an end-to-end CI/CD pipeline for an agentic coding product: every change to prompts, tools, and MCP servers is tested on synthetic tasks before release. The repository targets [INSERT STACK]; releases ship on a [INSERT RELEASE CADENCE] cadence with full traceability. Deliver in modules with approval checkpoints. Module 1 Pipeline architecture: stages, artifact flow, caching, fan-out, and a mermaid diagram from pull request to production. Module 2 Static gates: type/lint checks, MCP-descriptor schema validation, secret scanning, policy lint, and SBOM generation. Module 3 Synthetic tasks: ephemeral repositories seeded with realistic bugs; agents attempt fixes and outcomes are graded deterministically. Module 4 Eval gate: run the evaluation harness as a required check and compare against baseline with confidence intervals. Module 5 Security gate: prompt-injection red-team suite, tool-confusion tests, and sandbox-escape regression cases. Module 6 Performance gate: P95 latency and token-cost budgets per task, enforced against historical trends. Module 7 Canary: roll out to [INSERT CANARY PERCENT] of traffic with automated quality/error analysis and automatic rollback. Module 8 Release management: signed artifacts, provenance, environment promotion, one-command rollback, and safe handling of data migrations. Module 9 Data model: pipeline runs, gate decisions, eval artifacts, releases, and incident links retained for audits. Module 10 Developer experience: pull-request comments with eval diffs, local reproduction commands, and a flake-quarantine workflow. Module 11 Infrastructure: Kubernetes runners with per-PR ephemeral MCP servers, credential isolation, and aggressive caching. Module 12 Verification: chaos tests of the pipeline itself, rollback drills, a poisoned-model drill, and documented pipeline SLAs. Provide metrics definitions so teams cannot game the gates, and explain how flaky synthetic tasks are contained. Start with five questions, including expected pull-request volume and the ultimate release-blocking metric. ================