Proof-Carrying Pipelines: attest local gate runs so CI can skip re-execution

An architectural pattern for CI/CD in which pipeline gates execute on untrusted-but-identified machines and their verdict travels with the commit as a cryptographic attestation — bound to the exact content, tool digests and rule-set version, signed under organizational key custody — so the pipeline can verify in seconds, skip redundant re-execution, and fall back closed. The pattern's core exchange is specified as the attest-and-skip protocol ( SPEC v1).

The commit carries the evidence; the checker stays cheap.

(A deliberate homage to Proof-Carrying Code, Necula 1996.)

Producer-agnostic by design, agent-ready by specification: the threat model (A5′, reward hacking), identity rules (O7: per-agent identities, ephemeral single-use environments) and gate recommendations (mutation-score gates for agent-authored tests) treat autonomous coding agents as first-class — untrusted — producers. See docs/agent-loop.md.

Modern pipelines re-run the same hermetic gates (lint, static analysis, policy checks, compilation, unit tests) on shared cloud runners for every push — work the developer's idle, already-paid-for machine just did. PCP makes the local run count:

Pin— a local bundle locks gate tooling to the org's sources of truth (tool image digests + rule-set digest + revisions).** Execute**— gates run locally, in the same pinned containers the pipeline uses.** Bind & sign**— on PASS, a canonical payload bindscontent (git tree hash) × tool digests × rules digest × identity × timestamp

, signed by anorg-held KMS/HSM key the machine can invoke but never possess.Attest-and-skip gate— the pipeline verifies signature, enrolled identity, exact content, approved digests, current rules and freshness — in seconds — and elides the redundant gates.Fail closed— any missing/stale/drifted/invalid proof ⇒ the full pipeline runs. PCP can never be less safe than classic CI.** Drift lock**— a drifted or stale local bundle refuses to sign until it self-updates; bumping approved digests at the verifier instantly invalidates every outstanding proof.

What you get: minutes of queued runner time → one signature check; compute shifted to the edge; contracts/rules still enforced centrally, with audit logs and per-identity revocation. What it is not: a TEE. A malicious enrolled producer is bounded (pinned digests, audit logs, sampled re-verification, revocation), not eliminated — see the threat model in the paper and the normative SPEC.

pip install cryptography pytest pyyaml
reference/demo/run_demo.sh          # e2e: attest → SKIP · impersonation → P5 reject · tamper → fail-closed
python3 -m pytest reference/tests/  # protocol conformance suite (pure, no docker needed)

The demo creates a tiny repo, runs two gates, signs an attestation (local Ed25519 stand-in for KMS), verifies it (VERDICT: SKIP), then tampers with the content and shows the fail-closed fallback (VERDICT: RUN FULL PIPELINE).

docs/architecture.md

docs/agent-loop.md

docs/use-cases.md

diagrams/

spec/SPEC.md

reference/pcp_core/

= executable formalization of the SPEC's P/V rules;domain.py

= boundary Protocols;ports.py

= attest/verify orchestrationservice.py

reference/tests/

python3 -m pytest reference/tests/

)reference/pcp.py

keygen · attest · verify

(git, Ed25519 demo backend, Google Cloud KMS backend)ROADMAP.md

reference/demo/

.github/workflows/attest-and-skip.yml

examples/

GitHub Actions(verifier job + conditional heavy gates + sampled re-verify) andGitLab CI(dynamic child-pipeline pattern + script-guard variant)in-toto signs supply-chain step execution (verified end-of-chain, not for eliding CI work) · SLSA / sigstore / GitHub Artifact Attestations sign provenance · TEE approaches (Attestable Builds '25; Castillo et al. '26) get stronger guarantees with hardware PCP deliberately doesn't require · Nix/Trustix trust via determinism · build caches (Bazel/Nx/ Turbo) skip by hash but trust cache ACLs · Basecamp's gh-signoff

is the cultural demand signal — self-attestation with none of the binding. PCP names the missing middle: identity- signed, content-bound, drift-locked, fail-closed gate elision. Full comparison in §2 of the paper.

v1.3 draft — actively seeking review and collaborators: threat-model attacks, pipeline pilots, agent-loop pilots and roadmap items are the highest-value contributions — see CONTRIBUTING.md and

. If you use or discuss the pattern, cite via

ROADMAP.md

.

CITATION.cff

Apache-2.0 © 2026 Jack Andrés Cid