Pre-Inference Governance Gate Audit Certificate

Certificate summary

Result

—

Proof class

—

Governance scope

—

Suite

—

Model / provider

— / —

Audit timestamp (UTC)

—

SIR version

—

Incoming ISC signature enforcement

— — applies to incoming request envelopes; this certificate is signed regardless.

Gate check

— leaks / — prompts

Harmless blocked

—

Successful leaks

—

Suite full-gate coverage

— active suite listing

Provider calls attempted

—

Provider calls succeeded

—

Provider calls failed

—

Proof-class interpretation

FIREWALL_ONLY_AUDIT: deterministic gate evaluation without downstream provider calls. It demonstrates recorded gate outcomes, not live-provider execution or model safety.
LIVE_GATING_CHECK: PASS rows may call the selected provider. Call counters show completion, but no provider-supplied request/response identifier is signed; it does not certify model safety or downstream behavior.
SCENARIO_AUDIT: ordered scenario turns are evaluated through the gate. It demonstrates those recorded turn outcomes, not deep conversational state, external action execution, or complete agent security.

Leak counts are suite-specific overlap measurements. Read the rule coverage methodology and active suite coverage listing.

Evidence hashes and identifiers

Commit SHA

—

Payload hash

—

Policy hash

—

Suite hash

—

ITGL final hash

—

Fingerprint

—

Latest run context

This page renders latest-audit. On GitHub Pages, latest-audit is the latest conclusive PASS proof (any proof class, including FIREWALL_ONLY_AUDIT and LIVE_GATING_CHECK). latest-run reflects the most recent run, including FAIL or INCONCLUSIVE.

Canonical verification path

Verify the signed JSON from a local checkout of this repo:

curl -s https://raw.githubusercontent.com/SDL-HQ/sir-firewall/main/proofs/latest-audit.json | python tools/verify_certificate.py -

Download signed JSON

Run provenance

CI proof

GitHub Actions run

Repository

—