Proof-Carrying Pipelines: attest local gate runs so CI can skip re-execution

Proof-Carrying Pipelines (PCP), an open-source architectural pattern for CI/CD, lets pipeline gates run on untrusted local machines and cryptographically attest their verdicts so the pipeline can skip redundant re-execution in seconds. The pattern, specified in SPEC v1, binds git tree hash, tool digests, rules digest, identity, and timestamp under an org-held KMS/HSM key, and fails closed if any proof is missing or invalid. It treats autonomous coding agents as first-class untrusted producers and includes a reference implementation with a demo and protocol conformance suite.

An architectural pattern for CI/CD in which pipeline gates execute on untrusted-but-identified machines and their verdict travels with the commit as a cryptographic attestation — bound to the exact content, tool digests and rule-set version, signed under organizational key custody — so the pipeline can verify in seconds, skip redundant re-execution, and fall back closed. The pattern's core exchange is specified as the attest-and-skip protocol SPEC v1 . The commit carries the evidence; the checker stays cheap. A deliberate homage to Proof-Carrying Code, Necula 1996. Producer-agnostic by design, agent-ready by specification: the threat model A5′, reward hacking , identity rules O7: per-agent identities, ephemeral single-use environments and gate recommendations mutation-score gates for agent-authored tests treat autonomous coding agents as first-class — untrusted — producers. See docs/agent-loop.md /JackCid89/proof-carrying-pipelines/blob/main/docs/agent-loop.md . Modern pipelines re-run the same hermetic gates lint, static analysis, policy checks, compilation, unit tests on shared cloud runners for every push — work the developer's idle, already-paid-for machine just did. PCP makes the local run count : Pin — a local bundle locks gate tooling to the org's sources of truth tool image digests + rule-set digest + revisions . Execute — gates run locally, in the same pinned containers the pipeline uses. Bind & sign — on PASS, a canonical payload binds content git tree hash × tool digests × rules digest × identity × timestamp , signed by an org-held KMS/HSM key the machine can invoke but never possess. Attest-and-skip gate — the pipeline verifies signature, enrolled identity, exact content, approved digests, current rules and freshness — in seconds — and elides the redundant gates. Fail closed — any missing/stale/drifted/invalid proof ⇒ the full pipeline runs. PCP can never be less safe than classic CI. Drift lock — a drifted or stale local bundle refuses to sign until it self-updates; bumping approved digests at the verifier instantly invalidates every outstanding proof. What you get: minutes of queued runner time → one signature check; compute shifted to the edge; contracts/rules still enforced centrally, with audit logs and per-identity revocation. What it is not: a TEE. A malicious enrolled producer is bounded pinned digests, audit logs, sampled re-verification, revocation , not eliminated — see the threat model in the paper /JackCid89/proof-carrying-pipelines/blob/main/paper/proof-carrying-pipelines.md and the normative SPEC /JackCid89/proof-carrying-pipelines/blob/main/spec/SPEC.md . pip install cryptography pytest pyyaml reference/demo/run demo.sh e2e: attest → SKIP · impersonation → P5 reject · tamper → fail-closed python3 -m pytest reference/tests/ protocol conformance suite pure, no docker needed The demo creates a tiny repo, runs two gates, signs an attestation local Ed25519 stand-in for KMS , verifies it VERDICT: SKIP , then tampers with the content and shows the fail-closed fallback VERDICT: RUN FULL PIPELINE . | Path | Contents | |---|---| paper/proof-carrying-pipelines.md | docs/architecture.md docs/agent-loop.md docs/use-cases.md diagrams/ spec/SPEC.md reference/pcp core/ = executable formalization of the SPEC's P/V rules; /JackCid89/proof-carrying-pipelines/blob/main/reference/pcp core/domain.py domain.py = boundary Protocols; /JackCid89/proof-carrying-pipelines/blob/main/reference/pcp core/ports.py ports.py = attest/verify orchestration /JackCid89/proof-carrying-pipelines/blob/main/reference/pcp core/service.py service.py reference/tests/ python3 -m pytest reference/tests/ reference/pcp.py keygen · attest · verify git, Ed25519 demo backend, Google Cloud KMS backend ROADMAP.md reference/demo/ .github/workflows/attest-and-skip.yml examples/ GitHub Actions /JackCid89/proof-carrying-pipelines/blob/main/examples/github-actions.yml verifier job + conditional heavy gates + sampled re-verify and GitLab CI /JackCid89/proof-carrying-pipelines/blob/main/examples/gitlab-ci.yml dynamic child-pipeline pattern + script-guard variant in-toto signs supply-chain step execution verified end-of-chain, not for eliding CI work · SLSA / sigstore / GitHub Artifact Attestations sign provenance · TEE approaches Attestable Builds '25; Castillo et al. '26 get stronger guarantees with hardware PCP deliberately doesn't require · Nix/Trustix trust via determinism · build caches Bazel/Nx/ Turbo skip by hash but trust cache ACLs · Basecamp's gh-signoff is the cultural demand signal — self-attestation with none of the binding. PCP names the missing middle: identity- signed, content-bound, drift-locked, fail-closed gate elision . Full comparison in §2 of the paper. v1.3 draft — actively seeking review and collaborators: threat-model attacks, pipeline pilots, agent-loop pilots and roadmap items are the highest-value contributions — see CONTRIBUTING.md /JackCid89/proof-carrying-pipelines/blob/main/CONTRIBUTING.md and . If you use or discuss the pattern, cite via /JackCid89/proof-carrying-pipelines/blob/main/ROADMAP.md ROADMAP.md . /JackCid89/proof-carrying-pipelines/blob/main/CITATION.cff CITATION.cff Apache-2.0 © 2026 Jack Andrés Cid