Verification only protects you if it runs on every change — including the ones nobody re-verified. polygate wires the Polygraph gates into your CI/CD pipeline: every merge request is replayed, model-checked, and compatibility-gated before it can touch a protected branch, with no API key anywhere near the merge path.
What goes in, the stages it runs, what it leaves behind. Step through the stages to trace the run.
Three jobs, one trust boundary. The gates that block a merge are deterministic and keyless — the single job that calls a model is manual, protected, and the only place a credential lives.
polygraph-check — on every merge requestKeyless and deterministic. A content-hash staleness check catches code that changed without re-verification, then exhaustive model checking and trace replay run against the committed artifacts. No credentials, no model call, no way to skip it.
regenerate-specs — manual, protected branch onlyThe one job that bears organizational keys, triggered deliberately by a maintainer via masked variables. Specification generation is the only step that costs a model call — everything that gates a merge stays free.
push-artifacts — keyless publicationWhitelisted hashes and verdicts are pushed to the control plane, so every downstream consumer can prove what was verified, when, and against which exact bytes.
A gate is only as good as its failure modes. polygate is designed so the cheap paths are the trusted ones.