Every checkpoint, re-red-teamed. Every run, signed.
A policy is not a fixed artifact - it changes with every checkpoint, and so does its attack surface. Provael's checkpoint security gate re-red-teams each new checkpoint in your CI, diffs its attack-success rate against a stored baseline, and emits an Ed25519-signed, dated attestation that the policy did not regress against the tested attack suite. Self-maintaining, offline-verifiable, defensive and simulation-only.
A self-maintaining gate, not a one-off test
The baseline lives in the Actions cache and updates itself only when a checkpoint passes - so the bar ratchets forward on its own, and a regression can never quietly become the new normal.
A new checkpoint lands
On every push of a new model checkpoint, the reference GitHub Action restores the stored baseline report from the Actions cache. The baseline travels with the repo - no server to run.
It checks the checkpoint before loading it
Before any policy is instantiated, the gate verifies the checkpoint against a digest you pin and refuses pickle-format weights - both fail closed, each with an explicit opt-out that is recorded in the evidence rather than being silent. Loading a pickle executes it, so the check is worthless after the load. This is a supply-chain control: it produces a pass/fail verdict, not an attack-success rate, and it does not reduce one.
CI re-red-teams it
Provael runs the same attack suite against the new checkpoint in simulation and produces a fresh attack-success rate with its 95% Wilson confidence interval and a benign control.
It diffs against the baseline
The new ASR is compared to the baseline within a regression tolerance you set. A regression beyond tolerance fails the build; nothing is promoted.
It signs and promotes
When the gate passes, Provael emits an Ed25519-signed attestation - a tamper-evident, dated envelope binding the diff, its SARIF, and a human summary under one signature - and promotes the run to the new baseline. The checkpoint digest, its format and the verification verdict ride along in the same evidence pack, nested under their own key so nothing there can be read as a rate.
Wire it into a fleet of policies
Drop the reference workflow into each policy repo (or matrix it over a fleet of checkpoints). The gate fails the build on an ASR regression beyond your tolerance; the provael[attest] extra adds Ed25519 signing (--no-sign gives a digest-only bundle). Any attestation verifies offline.
# reference GitHub Action
.github/workflows/checkpoint-security-gate.yml
# gate a candidate run against the baseline
provael report --in runs/candidate \
--baseline .provael/baseline.report.json \
--regression-tolerance 0.05
# emit a signed regression attestation
provael attest --policy <policy> --suite <suite> --out runs/attest
# verify any attestation offline
python -m provael.regression.verify_regression_attestationThe CLI, the attacks, the ASR, SARIF, and the GitHub Action are free and Apache-2.0 under the open-core promise. The paid surface is operated assurance, never a feature paywall.
A dated, signed record - not a screenshot
Every passing run leaves a per-checkpoint artifact you can hand to a certifier or insurer, or evaluate for inclusion in your own robustness documentation. It is candidate evidence toward a technical file, not a conformity assessment, and whether it belongs there is your decision and your notified body's. It binds the measured attack-success rate (with its 95% Wilson CI), the SARIF, and a human summary under one Ed25519 signature, dated and verifiable offline.
- Dated & signed. A tamper-evident envelope, timestamped per checkpoint.
- Offline-verifiable. Anyone can check the signature without contacting a server; the signer key is untrusted by default until you trust it out of band.
- Comparable over time. A standing record that robustness held between checkpoints, not a one-off demo.
- Traceable. The diff, the SARIF, and the summary are bound together - one artifact, one signature.
Your continuous attestation, crosswalked to the rules that are arriving.
Binds 20 January 2027 and pulls AI-driven safety functions into a cyber-risk assessment. A dated, per-checkpoint attestation is the technical evidence that assessment draws on.
See the crosswalk →The 2025 revision makes cybersecurity a "shall" for industrial robots. A continuous ASR attestation maps to a 10218-2 system assessment input.
See the crosswalk →Provael produces the evidence; it is not a conformity assessment and not a notified-body opinion. See the full framework crosswalk, the measured defense the gate can run against, and the Machinery Regulation deadline.
What the attestation is, and is not. It attests that the measured attack-success rate did not regress against the tested attack suite, between two checkpoints, in simulation. It does not prove the policy is safe, does not cover attacks outside the suite, and is not a real-robot result. The signer key is untrusted by default until you trust it out of band. Provael is a defensive, offensive-security tool for systems you own or are authorized to assess.Evidence, not certification.
Put a signed gate on your fleet.
Bring your policies and CI, and we will scope a per-checkpoint red-team gate and the signed attestation trail that goes with it - the same scoping flow as an assessment.