What cilock is

The tool that turns "the tests passed" from a claim into evidence.

What it records

cilock wraps a command and attests what actually happened: the exact command, the exit code, the git commit it ran against, and the environment it ran in.

$ cilock run -- npm test

That produces an attestation — a structured, machine-readable record — for the exact commit you are about to push. No attestation, no evidence; running the tests outside cilock proves nothing to anyone but you.

Why the gate believes it

The attestation is signed keylessly: cilock obtains a short-lived certificate from the TestifySec platform's certificate authority (Fulcio), tied to the identity that ran it, and the signature is timestamped by the platform's timestamp authority — so the evidence stays verifiable long after the certificate expires. The signed record is stored in your tenant's evidence store (Archivista).

When a push arrives, the gate asks the evidence store: is there a signed, passing test attestation for exactly this commit? The answer is cryptographically checkable — not an HTTP header the pusher could set.

What stops an agent from lying

An agent cannot forge the platform's signature, cannot reuse another commit's attestation (the commit digest is inside the signed record), and cannot backdate one (the timestamp is from the authority, not the agent's clock). What it says ran and exited zero, ran and exited zero — under the identity that signed it.

Install

$ curl -fsSL https://cilock.dev/install.sh | sh

The installer verifies the binary's signature against the TestifySec platform before placing it. Docs at docs.cilock.dev.

The loop your agent runs

make changes
git commit
cilock run -- <your tests>     # produces the evidence
git push                        # the gate checks it