Guardian Gate — CI/CD Gate & Baseline Manager

dotnet add package CipherShift365.Guardian

<PackageReference Include="CipherShift365.Guardian" Version="1.0.0" />

using CipherShift365.Guardian;
using CipherShift365.Core.Runtime;
using CipherShift365.Core.Analysis;

// Bootstrap dependencies
var signer = new HmacSigner(signingKey);
var verifier = new HmacVerifier(signingKey);
var identity = new IdentityService();
var riskModel = new RiskModel();
var kb = new SignedKnowledgeBase(content);
var analysisEngine = new AnalysisEngine(riskModel);
var policyEngine = new PolicyEngine(riskModel);

// Create the gate
var gate = new GuardianGate(analysisEngine, policyEngine, kb, identity, verifier);
var ciGate = new CiGate(gate);

// Run the gate
int exitCode = await ciGate.RunAsync(
    projectPath: ".",
    mode: PolicyMode.BaselineAware,
    signedBaseline: loadedBaseline);

Environment.Exit(exitCode);

- task: DotNetCoreCLI@2
  displayName: 'PQC Guardian Gate'
  inputs:
    command: run
    arguments: '--project ./src --mode BaselineAware --baseline ./baseline.csb'
  condition: always()

- name: PQC Guardian Gate
  run: dotnet run --project ./tools/Gate -- ./src --mode BaselineAware --baseline ./baseline.csb

stage('PQC Guardian Gate') {
    steps {
        sh 'dotnet run --project ./tools/Gate -- ./src --mode Absolute'
    }
    post {
        failure {
            emailext subject: "PQC Gate failed", body: "Violations detected. See logs."
        }
    }
}

// Step 1: Run analysis to discover findings
var context = new AnalysisContext(".", kb, identity);
var analysis = await analysisEngine.AnalyzeAsync(context);

// Step 2: Review findings and accept the ones you're comfortable with
var acceptedFindings = analysis.Findings.Where(f => /* your review logic */).ToList();

// Step 3: Create the baseline
var baseline = new Baseline(kb.Version, DateTimeOffset.UtcNow, acceptedFindings.AsReadOnly(),
    Description: "Initial PQC baseline for my-service v2.1");

// Step 4: Sign it
var manager = new BaselineManager(signer, verifier);
var signedBaseline = manager.ApproveAndSign(baseline, "security-architect", kb.Version,
    approvedBy: "alice@example.com");

// Step 5: Export for distribution (to other teams/pipelines)
byte[] distributable = manager.ExportForDistribution(signedBaseline);
File.WriteAllBytes("baseline.csb", distributable);

// Load from distribution
byte[] data = File.ReadAllBytes("baseline.csb");
var sb = BaselineManager.ImportFromDistribution(data, verifier);

if (sb is null)
{
    Console.WriteLine("BASELINE REJECTED: signature invalid or tampered.");
    return;
}

Console.WriteLine($"Baseline v{sb.BaselineVersion} verified. Signed by {sb.SignerId}.");

PASS (exit 0): All findings are QuantumSafe, OR all new findings match the baseline.
VIOLATION (exit 1): One or more violations found. Review the GateResult for details.
ERROR (exit 2): Analysis failed, baseline tampered, or system error. Do NOT proceed.

GuardianGate
  ├── Constructor: IAnalysisEngine, IPolicyEngine, IKnowledgeBase, IIdentityService, IVerifier?
  ├── EvaluateAsync() → GateResult
  └── (private) GateFailure()

CiGate
  ├── Constructor: GuardianGate
  ├── RunAsync() → int (exit code)
  └── Constants: ExitPass=0, ExitViolation=1, ExitError=2

GateResult
  ├── Passed : bool
  ├── Verdict : PolicyVerdict
  └── Analysis : AnalysisResult?

BaselineManager
  ├── ApproveAndSign() → SignedBaseline
  ├── GetCurrent() / GetVersion()
  ├── VerifySignature() → VerificationResult
  ├── LoadAndVerify() → (bool Valid, string? Error)
  ├── ExportForDistribution() → byte[]
  └── ImportFromDistribution() → SignedBaseline?

SignedBaseline
  ├── Baseline, BaselineVersion, SignerId, SignedAt, Signature, KbVersion, ApprovedBy
  ├── Create() (static factory with signing)
  └── Verify() (static signature verification)

// 1. Add enum member
public enum PolicyMode { Absolute, BaselineAware, Custom }

// 2. Add case in PolicyEngine.Evaluate()
case PolicyMode.Custom => EvaluateCustom(findings, baseline);

// 3. Guardian Gate passes it through automatically
var result = await gate.EvaluateAsync(".", PolicyMode.Custom, baseline: myBaseline);

var gate = new GuardianGate(analysisEngine, policyEngine, kb, identity);
var result = await gate.EvaluateAsync("./src/MyApp", PolicyMode.Absolute);

if (!result.Passed)
{
    Console.WriteLine($"FAILED: {result.Verdict.Summary}");
    foreach (var v in result.Verdict.Violations)
        Console.WriteLine($"  - {v.Algorithm} ({v.Role}): {v.Risk}");
}

var verifier = new HmacVerifier(loadSigningKey());
var gate = new GuardianGate(analysisEngine, policyEngine, kb, identity, verifier);

var signedBaseline = SignedBaseline.Create(myBaseline, 1, "admin", kb.Version, signer);

var result = await gate.EvaluateAsync(
    projectPath: "./src/MyApp",
    mode: PolicyMode.BaselineAware,
    signedBaseline: signedBaseline);

Console.WriteLine(result.Passed ? "PASS" : "FAIL");
Console.WriteLine(result.Verdict.Summary);
Console.WriteLine($"System risk score: {result.Verdict.SystemScore:F2}");

var manager = new BaselineManager(signer, verifier);

// Architect approves and signs a baseline
var signed = manager.ApproveAndSign(baseline, "architect@corp", kbV2,
    approvedBy: "jane@corp");

Console.WriteLine($"Baseline v{signed.BaselineVersion} created, signed at {signed.SignedAt}");

// Export to a file for distribution
byte[] exported = manager.ExportForDistribution(signed);
File.WriteAllBytes(@"\\shared\pqc-baselines\my-service-v3.csb", exported);

// Pipeline agent imports and verifies
byte[] imported = File.ReadAllBytes(@"\\shared\pqc-baselines\my-service-v3.csb");
var verified = BaselineManager.ImportFromDistribution(imported, verifier);

if (verified is null)
    throw new SecurityException("Baseline tampered or unsigned. Build aborted.");

// Use the verified baseline in the gate
var result = await gate.EvaluateAsync(".", PolicyMode.BaselineAware,
    signedBaseline: verified);

// Complete console program for CI/CD use
public static async Task<int> Main(string[] args)
{
    if (args.Length < 2)
    {
        Console.Error.WriteLine("Usage: gate <project-path> <Absolute|BaselineAware> [baseline-path]");
        return 2; // Error
    }

    var projectPath = args[0];
    var mode = Enum.Parse<PolicyMode>(args[1], ignoreCase: true);
    SignedBaseline? baseline = args.Length >= 3
        ? BaselineManager.ImportFromDistribution(File.ReadAllBytes(args[2]), _verifier)
        : null;

    var ciGate = new CiGate(_gate);
    var exitCode = await ciGate.RunAsync(projectPath, mode, signedBaseline: baseline);

    Console.WriteLine(exitCode == 0 ? "PASS" : exitCode == 1 ? "VIOLATION" : "ERROR");
    return exitCode;
}

Q: "Is the codebase using any non-approved cryptography?"
A: "We ran a manual review 6 months ago. Probably fine."
Risk: HIGH — no enforcement, no audit trail, no tamper protection

Q: "Is the codebase using any non-approved cryptography?"
A: "Gate passed on commit a3f2b1e. Baseline v12 signed by security-architect@corp.
    0 violations. Analysis took 1.2 seconds."
Risk: LOW — automated, cryptographically enforced, reproducible