Skip to content

GATE v1.3

Latest
Latest

Choose a tag to compare

View all tags
@andrewjstevens andrewjstevens released this 16 Jun 14:38
· 2 commits to main since this release
v1.3
5e216ef
This commit was signed with the committer’s verified signature.
andrewjstevens Andrew Stevens
SSH Key Fingerprint: Qbxz1X3eIoLT0YDZKI7nLrN7qjDrxSPO5M+iXC5qhHo
Verified
Learn about vigilant mode.

Three new controls extending GATE's scope to cover assumptions that v1.2.8 left implicit.

New controls

C17 Agent Discovery and Shadow AI Detection (Layer 1) - continuous discovery of ungoverned agents, classification, and enrol-or-terminate path feeding C04. Closes the assumption that the C01-C16 control plane has anything to say about agents it has never seen.

C18 Data Quality Gates (Layer 2) - retrieval-time freshness, confidence, and provenance gates at the Memory Gateway. Closes the gap that allowed a well-governed agent to operate on stale, low-confidence, or unverifiable retrieved content.

C19 Model Behaviour Monitoring (Layer 3) - continuous statistical drift detection against a signed baseline. Distinct from C16 adversarial validation: C19 detects gradual distribution drift, C16 detects attacks. Both are required at high-privilege tier; their ledger event types are separate and runbooks for them must not be merged.

Also in v1.3

  • Check16-Check19: four new conformance checks (Unenrolled Workloads Detected and Remediated; Memory Retrievals Pass Quality Gates; Model Behaviour Baselined and Monitored for Drift; Adversarial and Drift Events Emitted as Distinct Types).
  • Six new control plane contract schemas: agent_discovered, agent_remediation_outcome, quality_decision, behavioural_baseline, drift_decision, response_action.
  • Five new resource schemas (previously implicit): agent_state, memory_item, memory_request, memory_response, abom.
  • Three new Rego policy files: c17_discovery.rego, c18_quality.rego, c19_drift_response.rego. No changes to tool_gateway_baseline.rego or invariants_baseline.rego.
  • Three new Python modules: gate.discovery, gate.memory.quality, gate.assurance.behaviour.
  • Three new runbooks: RB-07 (C17 candidate backlog), RB-08 (C18 quality gate outage), RB-09 (C19 drift response).
  • Explicit scope statements for the shadow AI assumption, memory quality boundary, and C16/C19 event type distinction.
  • C04 lifecycle gains a Discovered entry state.
  • GATE namespace replaces DARE throughout contracts.

Companion repositories

Repository Version Notes
gate-contracts v1.1.1 Schemas unchanged from v1.1.0; README cleanup only
gate-policies v1.1.1 Rego unchanged from v1.1.0; README cleanup only
gate-conformance v1.2.0 Check16-19 from v1.1.0 plus the conformance runner CLI
gate-python v1.1.0 gate.discovery, gate.memory.quality, gate.assurance.behaviour

Verification

SHA-256 (Governed Agent Trust Environment (GATE) v1.3.pdf):
  8a31d97577b957cc3de18b213fd0b13ba739570ee12d7d5f69da222776ecd186

SHA-256 (GATE-artifacts-v1.2.zip):
  d29627ccffbaf11a2fea26f37fdf11aa50f57134c17324900c818b45f7c995ea

SHA-256 (gate-contracts-v1.1.1.zip):
  0d7c900aa7d0cc8907764cbea2322f3a21995ba570ac87f7be1e92a2a47086cb

SHA-256 (gate-policies-v1.1.1.zip):
  41b61de9c22a217cd8c88160b791e0daa653cfcf85ee817825574d8fb20d14af

SHA-256 (gate-conformance-v1.2.0.zip):
  352d4f6408dc4d71f7e6f2dc03891230c39eae4f774927605c97f332030277cb

SHA-256 (gate-python-v1.1.0.zip):
  d78d168b413d63e1e8a5d1811ae5f868fb9f1b60845161e6f4d096eb31fa5bc2

Migration from v1.2.8

The existing 16 controls are unchanged in number, layer placement, and intent. v1.3 additions are additive only. Recommended order:

  1. Adopt C17 in observe-only mode and measure the discovered-but-unenrolled population.
  2. Adopt the C08, C10, and Memory flow scope statements (documentation only).
  3. Adopt C18 in flag-only mode after C10 and C13 are at Phase 2 levels. Promote per content class.
  4. Adopt C19 after C13 is at the required coverage level and C16 is operational. Baseline against the current ABOM.

Asset refresh - 2026-06-16

Implementation repos shipped Release Objects on 2026-06-16. The artifacts bundle was rebuilt as GATE-artifacts-v1.2.zip to include the v1.2.0 conformance runner. Per-repo zips refreshed to their current Release versions. Framework paper unchanged.

Assets 8
Loading