Verification only protects you if it runs on every change — including the ones nobody re-verified. polygate wires the Polygraph gates into your CI/CD pipeline: every merge request is replayed, model-checked, and compatibility-gated before it can touch a protected branch, with no API key anywhere near the merge path.
Three jobs, one trust boundary. The gates that block a merge are deterministic and keyless — the single job that calls a model is manual, protected, and the only place a credential lives.
polygraph-check — on every merge requestKeyless and deterministic. A content-hash staleness check catches code that changed without re-verification, then exhaustive model checking and trace replay run against the committed artifacts. No credentials, no model call, no way to skip it.
regenerate-specs — manual, protected branch onlyThe one job that bears organizational keys, triggered deliberately by a maintainer via masked variables. Specification generation is the only step that costs a model call — everything that gates a merge stays free.
push-artifacts — keyless publicationWhitelisted hashes and verdicts are pushed to the control plane, so every downstream consumer can prove what was verified, when, and against which exact bytes.
A gate is only as good as its failure modes. polygate is designed so the cheap paths are the trusted ones.