{"slug": "proof-carrying-pipelines-attest-local-gate-runs-so-ci-can-skip-re-execution", "title": "Proof-Carrying Pipelines: attest local gate runs so CI can skip re-execution", "summary": "Proof-Carrying Pipelines (PCP), an open-source architectural pattern for CI/CD, lets pipeline gates run on untrusted local machines and cryptographically attest their verdicts so the pipeline can skip redundant re-execution in seconds. The pattern, specified in SPEC v1, binds git tree hash, tool digests, rules digest, identity, and timestamp under an org-held KMS/HSM key, and fails closed if any proof is missing or invalid. It treats autonomous coding agents as first-class untrusted producers and includes a reference implementation with a demo and protocol conformance suite.", "body_md": "**An architectural pattern for CI/CD in which pipeline gates execute on\nuntrusted-but-identified machines and their verdict travels with the commit as a\ncryptographic attestation — bound to the exact content, tool digests and rule-set version,\nsigned under organizational key custody — so the pipeline can verify in seconds, skip\nredundant re-execution, and fall back closed. The pattern's core exchange is specified as\nthe attest-and-skip protocol ( SPEC v1).**\n\nThe commit carries the evidence; the checker stays cheap.\n\n(A deliberate homage to Proof-Carrying Code, Necula 1996.)\n\n**Producer-agnostic by design, agent-ready by specification:** the threat model (A5′,\nreward hacking), identity rules (O7: per-agent identities, ephemeral single-use\nenvironments) and gate recommendations (mutation-score gates for agent-authored tests)\ntreat autonomous coding agents as first-class — untrusted — producers. See\n[ docs/agent-loop.md](/JackCid89/proof-carrying-pipelines/blob/main/docs/agent-loop.md).\n\nModern pipelines re-run the same hermetic gates (lint, static analysis, policy checks,\ncompilation, unit tests) on shared cloud runners for every push — work the developer's idle,\nalready-paid-for machine just did. PCP makes the local run *count*:\n\n**Pin**— a local bundle locks gate tooling to the org's sources of truth (tool image digests + rule-set digest + revisions).** Execute**— gates run locally, in the same pinned containers the pipeline uses.** Bind & sign**— on PASS, a canonical payload binds`content (git tree hash) × tool digests × rules digest × identity × timestamp`\n\n, signed by an**org-held KMS/HSM key** the machine can invoke but never possess.**Attest-and-skip gate**— the pipeline verifies signature, enrolled identity, exact content, approved digests, current rules and freshness — in seconds — and elides the redundant gates.**Fail closed**— any missing/stale/drifted/invalid proof ⇒ the full pipeline runs. PCP can never be less safe than classic CI.** Drift lock**— a drifted or stale local bundle refuses to sign until it self-updates; bumping approved digests at the verifier instantly invalidates every outstanding proof.\n\n**What you get:** minutes of queued runner time → one signature check; compute shifted to the\nedge; contracts/rules still enforced centrally, with audit logs and per-identity revocation.\n**What it is not:** a TEE. A malicious *enrolled* producer is bounded (pinned digests, audit\nlogs, sampled re-verification, revocation), not eliminated — see the threat model in the\n[paper](/JackCid89/proof-carrying-pipelines/blob/main/paper/proof-carrying-pipelines.md) and the normative [SPEC](/JackCid89/proof-carrying-pipelines/blob/main/spec/SPEC.md).\n\n```\npip install cryptography pytest pyyaml\nreference/demo/run_demo.sh          # e2e: attest → SKIP · impersonation → P5 reject · tamper → fail-closed\npython3 -m pytest reference/tests/  # protocol conformance suite (pure, no docker needed)\n```\n\nThe demo creates a tiny repo, runs two gates, signs an attestation (local Ed25519 stand-in\nfor KMS), verifies it (**VERDICT: SKIP**), then tampers with the content and shows the\nfail-closed fallback (**VERDICT: RUN FULL PIPELINE**).\n\n| Path | Contents |\n|---|---|\n`paper/proof-carrying-pipelines.md` |\n\n`docs/architecture.md`\n\n`docs/agent-loop.md`\n\n`docs/use-cases.md`\n\n`diagrams/`\n\n`spec/SPEC.md`\n\n`reference/pcp_core/`\n\n[= executable formalization of the SPEC's P/V rules;](/JackCid89/proof-carrying-pipelines/blob/main/reference/pcp_core/domain.py)`domain.py`\n\n[= boundary Protocols;](/JackCid89/proof-carrying-pipelines/blob/main/reference/pcp_core/ports.py)`ports.py`\n\n[= attest/verify orchestration](/JackCid89/proof-carrying-pipelines/blob/main/reference/pcp_core/service.py)`service.py`\n\n`reference/tests/`\n\n`python3 -m pytest reference/tests/`\n\n)`reference/pcp.py`\n\n`keygen · attest · verify`\n\n(git, Ed25519 demo backend, Google Cloud KMS backend)`ROADMAP.md`\n\n`reference/demo/`\n\n`.github/workflows/attest-and-skip.yml`\n\n`examples/`\n\n[GitHub Actions](/JackCid89/proof-carrying-pipelines/blob/main/examples/github-actions.yml)(verifier job + conditional heavy gates + sampled re-verify) and[GitLab CI](/JackCid89/proof-carrying-pipelines/blob/main/examples/gitlab-ci.yml)(dynamic child-pipeline pattern + script-guard variant)in-toto signs supply-chain step execution (verified end-of-chain, not for eliding CI work) ·\nSLSA / sigstore / GitHub Artifact Attestations sign *provenance* · TEE approaches\n(Attestable Builds '25; Castillo et al. '26) get stronger guarantees with hardware PCP\ndeliberately doesn't require · Nix/Trustix trust via determinism · build caches (Bazel/Nx/\nTurbo) skip by hash but trust cache ACLs · Basecamp's `gh-signoff`\n\nis the cultural demand\nsignal — self-attestation with none of the binding. PCP names the missing middle: identity-\nsigned, content-bound, drift-locked, fail-closed **gate elision**. Full comparison in §2 of\nthe paper.\n\nv1.3 draft — actively seeking review and collaborators: threat-model attacks, pipeline\npilots, agent-loop pilots and roadmap items are the highest-value contributions — see\n[ CONTRIBUTING.md](/JackCid89/proof-carrying-pipelines/blob/main/CONTRIBUTING.md) and\n\n[. If you use or discuss the pattern, cite via](/JackCid89/proof-carrying-pipelines/blob/main/ROADMAP.md)\n\n`ROADMAP.md`\n\n[.](/JackCid89/proof-carrying-pipelines/blob/main/CITATION.cff)\n\n`CITATION.cff`\n\nApache-2.0 © 2026 Jack Andrés Cid", "url": "https://wpnews.pro/news/proof-carrying-pipelines-attest-local-gate-runs-so-ci-can-skip-re-execution", "canonical_source": "https://github.com/JackCid89/proof-carrying-pipelines", "published_at": "2026-08-19 01:39:07+00:00", "updated_at": "2026-08-19 02:10:56.994193+00:00", "lang": "en", "topics": ["developer-tools", "ai-agents", "ai-safety"], "entities": ["Proof-Carrying Pipelines", "JackCid89", "GitHub Actions", "Google Cloud KMS", "Ed25519"], "alternates": {"html": "https://wpnews.pro/news/proof-carrying-pipelines-attest-local-gate-runs-so-ci-can-skip-re-execution", "markdown": "https://wpnews.pro/news/proof-carrying-pipelines-attest-local-gate-runs-so-ci-can-skip-re-execution.md", "text": "https://wpnews.pro/news/proof-carrying-pipelines-attest-local-gate-runs-so-ci-can-skip-re-execution.txt", "jsonld": "https://wpnews.pro/news/proof-carrying-pipelines-attest-local-gate-runs-so-ci-can-skip-re-execution.jsonld"}}