Pushgate.devDocs Open Pushgate.dev

Identity and keys

Evidence, policies, activation, pushes, decisions, and delivery observations are different acts with different authority.

On this page
Purpose-separated identities and signatures Evidence production, policy signing, policy activation, Git push signing, policy decisions, and delivery observation are six distinct acts. Each points only to the artifact or event it authorizes. ROLEWHAT THAT ACT ESTABLISHES ROLEEvidence producerSIGNED ARTIFACTExact evidence bytes and subjects ROLEPolicy artifact signerSIGNED ARTIFACTExact policy bytes ROLEPolicy activation actorAPPROVED EVENTExact repository assignment ROLEPush signerSIGNED REQUESTProposed ref update ROLEPlatform verifierSIGNED DECISIONBound policy outcome (VSA) ROLEDelivery observerOBSERVATIONValidated terminal GitHub result
Roles may belong to the same organization, but their signatures and approvals remain distinct.
Mermaid source
flowchart TB
    E[Evidence producer] -->|evidence signature| ES[Signed evidence]
    A[Policy artifact signer] -->|policy signature| PS[Signed policy]
    H[Activation actor] -->|repository assignment| RA[Exact assignment]
    P[Push signer] -->|Git push certificate| GP[Proposed update]
    V[Platform verifier] -->|VSA signature| VS[Policy decision]
    D[Delivery observer] -->|delivery record| DR[GitHub result]

Role contract

RoleWhat its proof establishesWhat it never establishes
Evidence producerWho signed an exact attestation predicate and its subjects.Policy authorship or activation.
Observed agent contextProcess, tool, model, and sandbox details visible to the attestor.Authenticated agent identity or policy satisfaction.
Policy artifact signerAuthorship of the exact signed policy bytes.Assignment to a repository.
Activation actorApproval of an exact repository policy assignment.Authorship of the policy artifact.
Push signerThe identity that sent the proposed ref update.Authorship of every commit in the pack.
Platform verifierA bounded policy decision over exact evidence and push context.That GitHub applied the refs.
Delivery observerThe validated terminal response Pushgate received from GitHub.Direct observation of GitHub’s internal state.

Keyless evidence signing

An approved OIDC identity is exchanged for a short-lived Fulcio certificate. CI/lock signs the DSSE envelope with the corresponding ephemeral key and obtains an RFC 3161 timestamp. Verifiers can therefore check the identity and exact bytes at signing time after the short-lived certificate expires, without distributing a long-lived evidence-signing key to the agent.

For deployment guidance, including native macOS boundaries and a Linux container, see Sandbox coding agents.

Purpose-separated service credentials

Pushgate’s platform calls use separate audiences and exact scopes. The policy evaluator accepts policy:evaluate for the policy audience; GitHub delivery-token minting accepts push-token:mint for the Pushgate audience. Repository and immutable repository ID bindings travel with the service identity. Neither grant is a general platform session. This is the role-aligned least-privilege model described by the CNCF supply-chain guidance.

Security boundary

Git commit signing, Git push signing, attestation signing, policy signing, policy activation, and platform service federation are separate ceremonies. Never mount or expose a human or service signing capability inside an agent sandbox merely because the agent needs to run tests.