Signed Artifact Gate. A control boundary that refuses to admit, install, execute, or trust an artifact unless its signature, trust root, provenance, and unsigned-artifact policy satisfy the system's rules.
A signed artifact gate makes the artifact admission decision explicit: verify the signature, check it against a trust root, preserve provenance, and apply the unsigned artifact policy before the artifact is installed, executed, or trusted.
A signed artifact gate depends on an explicit trust root; without that authority anchor, a signature proves only that something signed the artifact, not that the signer should be trusted by this system.
It also depends on an explicit unsigned-artifact policy. If unsigned artifacts are ever allowed, that allowance must be configured as an exception path, not discovered as permissive default behavior during installation.