1 — Your checker, your machine
You write the check; we never see it. It runs where the secret already lives, and it is handed the commit and the path to your policy. What it looks for is yours.
THE GUARD
Prove the rules ran. Never hand them over.
Every policy-as-code tool runs the check inside your CI. That works because they assume the rule is publishable. Point one at a rule that is itself confidential and the assumption inverts: to enforce it you must ship it to the runner, and the rule is the thing you were protecting.
So we sign a statement instead of shipping the secret.
FOUR MOVES
2 — The receipt is earned
On commit and on merge, the check re-runs against the finished object and only then signs scheme commit=<sha> policy=<hash> into a git note. Bypassing the hooks does not buy a receipt — the re-check is the earning.
3 — Refused at the gate
Every commit in a push must carry a receipt, not just the branch tip. In CI we verify the signature against public keys committed in your repo and a hash of the approved policy. A public key and a hash disclose nothing.
4 — Silence is never a pass
A machine that does not hold the policy signs "I did not check" — a bound, unforgeable claim. Honest abstention beats a missing receipt, and it beats an exemption by branch name, which anyone can forge.
WHAT IT COSTS YOUR TEAM
Your engineers install nothing.
You enrol the repository, not the person. A developer who installs nothing is simply refused at the pull request, with a message telling them exactly how to comply — the same pattern as a signed-commit or contributor-agreement gate. Nobody provisions a laptop.
hooksoptional — make it automatic
CI checkthe chokepoint
branch protectionmakes it non-optional
your historyexempt before the cutoff
Adoption is incremental by date. Everything committed before the day you enrol is exempt; everything after must carry a receipt. No flag day, no rewritten history, no migration.
THE LIMITS, IN THE SAME VOICE AS THE CLAIMS
It proves the rules ran — not that the rules are good.
It is a process control, not a proof about content. Someone holding a trusted key who bypasses the hooks can still sign. It closes the gap that actually bites — a clone that never installed anything, an agent reaching for a skip flag — and no more.
Receipt quality is bounded by rule quality. A weak check, faithfully enforced and cryptographically attested, is still a weak check. We can prove yours ran on every commit. We cannot make it a good one.
It does not say secure. It does not say certified. It does not say bug-free. It says: on this commit, your rules ran, and here is the signature you can check yourself.
A guard that overclaims on its own page has already failed the standard it sells.