# Proof-Carrying Pipelines: attest local gate runs so CI can skip re-execution > Source: > Published: 2026-08-19 01:39:07+00:00 **An architectural pattern for CI/CD in which pipeline gates execute on untrusted-but-identified machines and their verdict travels with the commit as a cryptographic attestation — bound to the exact content, tool digests and rule-set version, signed under organizational key custody — so the pipeline can verify in seconds, skip redundant re-execution, and fall back closed. The pattern's core exchange is specified as the attest-and-skip protocol ( SPEC v1).** The commit carries the evidence; the checker stays cheap. (A deliberate homage to Proof-Carrying Code, Necula 1996.) **Producer-agnostic by design, agent-ready by specification:** the threat model (A5′, reward hacking), identity rules (O7: per-agent identities, ephemeral single-use environments) and gate recommendations (mutation-score gates for agent-authored tests) treat autonomous coding agents as first-class — untrusted — producers. See [ docs/agent-loop.md](/JackCid89/proof-carrying-pipelines/blob/main/docs/agent-loop.md). Modern pipelines re-run the same hermetic gates (lint, static analysis, policy checks, compilation, unit tests) on shared cloud runners for every push — work the developer's idle, already-paid-for machine just did. PCP makes the local run *count*: **Pin**— a local bundle locks gate tooling to the org's sources of truth (tool image digests + rule-set digest + revisions).** Execute**— gates run locally, in the same pinned containers the pipeline uses.** Bind & sign**— on PASS, a canonical payload binds`content (git tree hash) × tool digests × rules digest × identity × timestamp` , signed by an**org-held KMS/HSM key** the machine can invoke but never possess.**Attest-and-skip gate**— the pipeline verifies signature, enrolled identity, exact content, approved digests, current rules and freshness — in seconds — and elides the redundant gates.**Fail closed**— any missing/stale/drifted/invalid proof ⇒ the full pipeline runs. PCP can never be less safe than classic CI.** Drift lock**— a drifted or stale local bundle refuses to sign until it self-updates; bumping approved digests at the verifier instantly invalidates every outstanding proof. **What you get:** minutes of queued runner time → one signature check; compute shifted to the edge; contracts/rules still enforced centrally, with audit logs and per-identity revocation. **What it is not:** a TEE. A malicious *enrolled* producer is bounded (pinned digests, audit logs, sampled re-verification, revocation), not eliminated — see the threat model in the [paper](/JackCid89/proof-carrying-pipelines/blob/main/paper/proof-carrying-pipelines.md) and the normative [SPEC](/JackCid89/proof-carrying-pipelines/blob/main/spec/SPEC.md). ``` pip install cryptography pytest pyyaml reference/demo/run_demo.sh # e2e: attest → SKIP · impersonation → P5 reject · tamper → fail-closed python3 -m pytest reference/tests/ # protocol conformance suite (pure, no docker needed) ``` The demo creates a tiny repo, runs two gates, signs an attestation (local Ed25519 stand-in for KMS), verifies it (**VERDICT: SKIP**), then tampers with the content and shows the fail-closed fallback (**VERDICT: RUN FULL PIPELINE**). | Path | Contents | |---|---| `paper/proof-carrying-pipelines.md` | `docs/architecture.md` `docs/agent-loop.md` `docs/use-cases.md` `diagrams/` `spec/SPEC.md` `reference/pcp_core/` [= executable formalization of the SPEC's P/V rules;](/JackCid89/proof-carrying-pipelines/blob/main/reference/pcp_core/domain.py)`domain.py` [= boundary Protocols;](/JackCid89/proof-carrying-pipelines/blob/main/reference/pcp_core/ports.py)`ports.py` [= attest/verify orchestration](/JackCid89/proof-carrying-pipelines/blob/main/reference/pcp_core/service.py)`service.py` `reference/tests/` `python3 -m pytest reference/tests/` )`reference/pcp.py` `keygen · attest · verify` (git, Ed25519 demo backend, Google Cloud KMS backend)`ROADMAP.md` `reference/demo/` `.github/workflows/attest-and-skip.yml` `examples/` [GitHub Actions](/JackCid89/proof-carrying-pipelines/blob/main/examples/github-actions.yml)(verifier job + conditional heavy gates + sampled re-verify) and[GitLab CI](/JackCid89/proof-carrying-pipelines/blob/main/examples/gitlab-ci.yml)(dynamic child-pipeline pattern + script-guard variant)in-toto signs supply-chain step execution (verified end-of-chain, not for eliding CI work) · SLSA / sigstore / GitHub Artifact Attestations sign *provenance* · TEE approaches (Attestable Builds '25; Castillo et al. '26) get stronger guarantees with hardware PCP deliberately doesn't require · Nix/Trustix trust via determinism · build caches (Bazel/Nx/ Turbo) skip by hash but trust cache ACLs · Basecamp's `gh-signoff` is the cultural demand signal — self-attestation with none of the binding. PCP names the missing middle: identity- signed, content-bound, drift-locked, fail-closed **gate elision**. Full comparison in §2 of the paper. v1.3 draft — actively seeking review and collaborators: threat-model attacks, pipeline pilots, agent-loop pilots and roadmap items are the highest-value contributions — see [ CONTRIBUTING.md](/JackCid89/proof-carrying-pipelines/blob/main/CONTRIBUTING.md) and [. If you use or discuss the pattern, cite via](/JackCid89/proof-carrying-pipelines/blob/main/ROADMAP.md) `ROADMAP.md` [.](/JackCid89/proof-carrying-pipelines/blob/main/CITATION.cff) `CITATION.cff` Apache-2.0 © 2026 Jack Andrés Cid