Deterministic Security Governance for CI/CD Decisions
Nono-Gate is a lightweight governance layer designed to make security decisions in CI/CD pipelines verifiable, reproducible, and independent from CI logs.
Instead of relying on pipeline logs as proof, Nono-Gate produces deterministic artifacts that can be independently validated.
Most CI pipelines generate security reports, but those reports are not proof.
Logs can be modified, pipelines can be misconfigured, and results can change depending on execution context.
Nono-Gate introduces a different model:
Security decisions must produce verifiable artifacts.
Those artifacts can later be validated without re-running the entire pipeline.
Nono-Gate acts as a governance layer between security scanners and release workflows.
It performs the following steps:
- Parse scanner results (SARIF input)
- Evaluate findings through a consensus engine
- Produce a deterministic security decision
- Generate an evidence root
- Append a transparency log entry
- Allow independent verification of the decision
This allows security decisions to be treated as verifiable records rather than ephemeral pipeline output.
Scanner Results
↓
Security Evaluation
↓
Deterministic Decision
↓
Evidence Root + Ledger
↓
Independent Verification
Nono-Gate sits between detection tooling and release governance.
Clone the repository:
git clone https://github.com/88nonog-dev/nono-gate
cd nono-gate/demo
Generate decision artifacts:
.\RUN_PROOF_DEMO.ps1
Run independent verification:
.\VERIFY_ONLY.ps1
Expected output:
NONO-GATE PROOF DEMO START
PASS
BLOCK
EVIDENCE_ROOT_GENERATED
NONO-GATE: VDR GENERATED
NONO-GATE: LEDGER MERKLE ROOT COMPUTED
TRANSPARENCY_LOG_UPDATED
NONO-GATE PROOF DEMO COMPLETE
NONO-GATE INDEPENDENT VERIFICATION
DETERMINISTIC_DECISION_VERIFIED
EVIDENCE_ROOT_PRESENT
LEDGER_INTEGRITY_OK
VERIFICATION_COMPLETE
Nono-Gate explores a governance model where:
Security decisions become verifiable artifacts.
CI pipelines become reproducible decision environments.
Security logs are replaced with deterministic proof records.
demo/ RUN_PROOF_DEMO.ps1 VERIFY_ONLY.ps1 ci-demo/ signals/ decision/ transparency/
scripts/ examples/ tests/
Prototype demonstration of a deterministic governance model for CI/CD security decisions.
MIT License