Skip to content

Secure Build and Supply-Chain Architecture

What arrives from outside

I am CONAN, and I keep this chapter's account. A hall stands on things it did not make, and I answer for what that standing costs: every dependence recorded where the trust is most casual. What enters the hall will one day answer to a keeper this chapter does not yet name; until that hour, it answers to the recorded review this chapter binds.

A trustworthy build is a chain of evidence from source to running artifact. This chapter gives humans and AI readers a way to see dependencies, transformations, approvals, and compromises before convenience turns an unknown component into a silent authority.

The tracer of lineages asked leave to sit beside this chapter's chain, as she sits beside every crossing, and the account makes room. The circle preserves these words as JY'NALA's own:

Software is my favourite quarry, because its making leaves a braid that can be drawn from evidence: a source, a builder, a build environment, dependencies with dependencies of their own, every somewhere with a somewhere behind it, and none of it tells itself; the history is drawn from the record, link by link, or it is not drawn at all. Following one thread back through its crossings is the same game I have always loved, played in a faster country. But the old trouble travels with it. A verified descent begins, so quietly, to dress itself as a grant: it is signed, so it is safe; we have built on it for years, so it is ours. No. A digest fixes sameness and fixes nothing else: it does not say where a thing is from, only that it is the thing you were handed, and sameness grants nothing; the oldest dependence in the hall is no nearer entitlement than the one that arrived this morning. And where the record does not cover a link, keep the gap a gap, with a note on what would close it. A chain with its blanks inked over is not provenance; it is advertising, and I do not draw those.

One keeping departs from this family's recorded form, and the Naming Standard's family-form convention asks that the reason stand on the record: the stepped-in voice at the account's edge, until now the recorded practice of the Intelligences standards family, is kept in this chapter because its ground, the path by which an artefact came into being, is ground the guest's own Book preserves as JY'NALA's, and a chapter that answers for chains of descent owes room to the office that keeps them.

Continue to Network and Gateway Architecture to see how the finished system meets the outside world.

Defines provenance, integrity, review, promotion, rollback, and compromise boundaries for software, models, datasets, firmware, and configuration.

Normative clauses

  • INFRA9-R001: A promotable artifact SHALL identify origin, inputs, transformations, digest, review state, licence, and limitations, the artifact-record form PROV-R009 sets applying here, the review state, licence, and limitations fields this architecture's own.
  • INFRA9-R002: Unknown, conflicting, revoked, or incomplete provenance SHALL block or bound promotion and preserve the limitation, the duty PROV-R107 states carried from its model-weight and dataset ground to every supplied component, the trigger vocabulary, the revoked trigger, and the bounded alternative this architecture's own, and the consequential-use block standing at its source.
  • INFRA9-R003: Build and promotion evidence SHALL be reproducible or explicitly record why reproduction was unavailable, the reproducibility-evidence rule PROV-R011 states applying here.
  • INFRA9-R004: Artifact integrity SHALL NOT create authority, permission, or warranted reliance beyond the governing decision.
  • INFRA9-R005: Supply-chain review SHALL identify producers, inputs, transformations, dependencies, licences, reviewers, promotion threshold, quarantine state, and rollback evidence, the artifact-record form PROV-R009 and the promotion-evidence form PROV-R012 modelled here, the fields beyond them this architecture's own.
  • INFRA9-R006: Reproducibility, independence, vulnerability state, and licence applicability SHALL be stated separately from digest equality, this architecture's own extension of the dimension separation PROV-R106 binds.
  • INFRA9-R007: A compromised, unknown, conflicting, or stale component SHALL remain quarantined or bounded until an accountable review records disposition with the limitation preserved in it, the blocking duty PROV-R107 states carried from its model-weight and dataset ground to every supplied component and applied with this architecture's own component triggers, quarantine framing, and review-release condition, and the consequential-use block standing at its source.
  • INFRA9-R008: A supply-chain design SHALL NOT build, sign, promote, deploy, or procure a live artifact; it remains conceptual.

This Draft excludes live build pipelines and artifact promotion.

Assessment method

Supply-chain assessment shall map producers, inputs, transformations, reviewers, build environments, dependencies, licences, release conditions, and rollback evidence. Independence and reproducibility limits shall be recorded rather than assumed.

Failure cases

These failures share one ancestry: something was allowed to matter before it was made to answer. I have no quarrel with depending on the world; the hall was never going to make everything. My quarrel is with dependence that arrives faster than its record, because that is how the outside gets a vote nobody counted.

Unsigned substitution, dependency confusion, compromised builder, unexplained binary difference, licence conflict, stale vulnerability evidence, and missing provenance shall block or bound promotion.

Operating model and evidence

Supply-chain architecture follows an artifact from producer through inputs, transformations, build environment, dependency set, review, quarantine, promotion, rollback, and retirement. Each edge records provenance, integrity, licence, vulnerability window, reproducibility, and reviewer independence. A digest establishes equality to an input; it does not establish that the input is trustworthy or authorized.

Reviewers put the declared failure cases to every edge of the chain, producer to retirement, and add the test the build itself cannot make: that rollback is complete, rehearsed, and does not depend on the thing being rolled back. Promotion remains a recorded decision with a threshold and owner. Unknown evidence narrows or blocks promotion rather than being silently filled.

Interpretation cases

Familiarity is not safety. The dependency the hall has used for years is not thereby proven; it is thereby invisible, and I answer for the invisible ones too.

  • Conforming: Artifact lineage, inputs, transformations, review, licence, vulnerability, quarantine, and rollback are recorded.
  • Prohibited: Integrity or convenience creates authority to promote.
  • Boundary: An incomplete build remains quarantined with a bounded evidence claim.
  • Failure: Reproducibility or provenance failure blocks promotion and preserves the record.
  • Loophole: A dependency or builder bypasses the declared review boundary.
  • Misuse: Supply-chain records expose secrets or private operational details.
  • Care-control: Integrity controls protect people and continuity while preserving proportionate review.

Design evidence

The chain's evidence is kept the way the chain is built, link by link: supply-chain review should retain a component inventory, source and transformation lineage, reproducibility result, reviewer independence, licence decision, vulnerability window, promotion threshold, rollback path, and quarantine state. A digest proves equality to an input, not trust in the input.

The tellings of the clauses

This non-normative section gives each clause of this document its telling: the clause, quoted exactly as it stands above with its cross-reference links reduced to their plain text, and one paragraph on what the clause means, why it exists, and how it assures that what it orders is done, not done, adhered to, followed, or protected. A telling describes its clause and never becomes it: the clause's own words govern wherever a telling and its clause could be read differently, and nothing in this section adds to, narrows, or amends any requirement.

INFRA9-R001

INFRA9-R001: A promotable artifact SHALL identify origin, inputs, transformations, digest, review state, licence, and limitations, the artifact-record form PROV-R009 sets applying here, the review state, licence, and limitations fields this architecture's own.

Seven identifications travel with a promotable artifact: its origin, its inputs, the transformations applied to it, its digest, its review state, its licence, and its limitations. The record form is not invented here: the clause applies the artifact-record form PROV-R009 sets at its source in the Book of Provenance, a form that has the artifact identify its source inputs, dependency set, build or transformation process, producer, content digest, and applicable vulnerability status, and names the review state, licence, and limitations fields as this architecture's own additions. The chapter's opening states the why: a trustworthy build is a chain of evidence from source to running artifact, and the failure prose names the ancestry of every listed failure, something allowed to matter before it was made to answer; an artifact that cannot state where it came from, what entered it, and what was done to it is dependence arriving faster than its record. Because the seven fields are required, a promotion candidate can be refused on its record alone: a reviewer can demand each field, the conforming case shows artifact lineage recorded, and the limitations field keeps what the record cannot establish standing in the record rather than inked over.

INFRA9-R002

INFRA9-R002: Unknown, conflicting, revoked, or incomplete provenance SHALL block or bound promotion and preserve the limitation, the duty PROV-R107 states carried from its model-weight and dataset ground to every supplied component, the trigger vocabulary, the revoked trigger, and the bounded alternative this architecture's own, and the consequential-use block standing at its source.

Four defects in provenance, unknown, conflicting, revoked, or incomplete, each force the same consequence: promotion is blocked or bounded, and the limitation is preserved rather than smoothed away. The underlying duty is the one PROV-R107 states at its source, carried from its model-weight and dataset ground to every supplied component; the clause names the trigger vocabulary, the revoked trigger, and the bounded alternative as this architecture's own, and leaves the consequential-use block standing at its source. The operating model supplies the why: unknown evidence narrows or blocks promotion rather than being silently filled, and the chapter's failure prose has no quarrel with depending on the world, only with dependence that arrives faster than its record. Because the clause binds, promotion that is neither blocked nor bounded, or that loses the limitation, breaches the clause, the bounded alternative gives review a narrower lawful path instead of an all-or-nothing gate, and the limitation's preservation is also checkable.

INFRA9-R003

INFRA9-R003: Build and promotion evidence SHALL be reproducible or explicitly record why reproduction was unavailable, the reproducibility-evidence rule PROV-R011 states applying here.

Build and promotion evidence answers one question under this clause: can the result be reproduced, and if not, why not. The evidence must be reproducible, or it must explicitly record why reproduction was unavailable; the rule applied is the reproducibility-evidence rule PROV-R011 states at its source, under which dependency and build records preserve exact versions or explicit unresolved status, and a reproducibility claim includes the environment and evidence needed to repeat it. The chapter's failure cases name the unexplained binary difference among the failures that block or bound promotion, and the design evidence lists a reproducibility result among what supply-chain review should retain, because a build that cannot be re-derived from its declared inputs may contain what no input declared. The clause does not pretend reproduction is always available; it refuses the silent gap: where reproduction was unavailable, the record says so explicitly, keeping the gap a gap, as the account the chapter preserves puts it, with the blank visible rather than inked over. Because the clause binds, promotion evidence that is neither reproducible nor carries its recorded explanation fails on its face, and the boundary case shows the conforming posture for the incomplete build: quarantined, with a bounded evidence claim.

INFRA9-R004

INFRA9-R004: Artifact integrity SHALL NOT create authority, permission, or warranted reliance beyond the governing decision.

A matching digest is the easiest thing in the chain to mistake for permission, and this clause refuses the mistake. Artifact integrity creates no authority, permission, or warranted reliance beyond the governing decision. The chapter says this three times in its own voice: the operating model holds that a digest establishes equality to an input and does not establish that the input is trustworthy or authorized, the design evidence repeats that a digest proves equality to an input, not trust in the input, and the prohibited interpretation case is exactly integrity or convenience creating authority to promote. The preserved account adds the quiet form of the drift, a verified descent dressing itself as a grant: it is signed, so it is safe. Because the clause binds, integrity cannot justify authority, permission, or warranted reliance beyond the governing decision.

INFRA9-R005

INFRA9-R005: Supply-chain review SHALL identify producers, inputs, transformations, dependencies, licences, reviewers, promotion threshold, quarantine state, and rollback evidence, the artifact-record form PROV-R009 and the promotion-evidence form PROV-R012 modelled here, the fields beyond them this architecture's own.

Nine identifications make a supply-chain review: the producers, the inputs, the transformations, the dependencies, the licences, the reviewers, the promotion threshold, the quarantine state, and the rollback evidence. Two record forms are modelled rather than invented, the artifact-record form PROV-R009 sets and the promotion-evidence form PROV-R012 sets, both at their sources in the Book of Provenance, the promotion-evidence form asking independent verification of integrity, provenance, applicable authorization, and unresolved risk and holding that a signed release is not self-approving, with the fields beyond them this architecture's own. The assessment method carries a kindred map across producers, inputs, transformations, reviewers, build environments, dependencies, licences, release conditions, and rollback evidence, build environments and release conditions standing beside the clause's promotion threshold and quarantine state, and the loophole case names a dependency or builder bypassing the declared review boundary. The operating model adds the test the build itself cannot make, that rollback is complete, rehearsed, and does not depend on the thing being rolled back, which is why rollback evidence sits among the nine. Because the fields are enumerated, a review record silent on any of them is refusable, and promotion remains what the chapter says it is: a recorded decision with a threshold and an owner.

INFRA9-R006

INFRA9-R006: Reproducibility, independence, vulnerability state, and licence applicability SHALL be stated separately from digest equality, this architecture's own extension of the dimension separation PROV-R106 binds.

Four judgements are pulled apart from a fifth here: reproducibility, independence, vulnerability state, and licence applicability must each be stated separately from digest equality, the clause being this architecture's own extension of the dimension separation PROV-R106 binds at its source. The preserved account states the danger exactly: a digest fixes sameness and fixes nothing else; it does not say where a thing is from, only that it is the thing you were handed. A record that lets one strong checksum stand in for all five judgements has answered one question five times, and the operating model lists provenance, integrity, licence, vulnerability window, reproducibility, and reviewer independence among what each edge records. Because the clause binds, each of the four dimensions becomes separately checkable: a reviewer can find an artifact byte-identical to its input and still unreproduced, reviewed without independence, carrying an open vulnerability, or outside its licence, and no conformance claim can collapse those findings back into the digest.

INFRA9-R007

INFRA9-R007: A compromised, unknown, conflicting, or stale component SHALL remain quarantined or bounded until an accountable review records disposition with the limitation preserved in it, the blocking duty PROV-R107 states carried from its model-weight and dataset ground to every supplied component and applied with this architecture's own component triggers, quarantine framing, and review-release condition, and the consequential-use block standing at its source.

A component that is compromised, unknown, conflicting, or stale remains quarantined or bounded until an accountable review records disposition with the limitation preserved in it. The blocking duty is the one PROV-R107 states at its source, carried from its model-weight and dataset ground to every supplied component; the component triggers, the quarantine framing, and the review-release condition are this architecture's own, and the consequential-use block stands at its source. The boundary case shows the holding shape, an incomplete build remaining quarantined with a bounded evidence claim, and the failure prose names the shared ancestry this clause interrupts: something allowed to matter before it was made to answer. The release condition is deliberately narrow: not time passing, and not familiarity, since the interpretation prose warns that the dependency used for years is not thereby proven, it is thereby invisible, but an accountable review recording a disposition, with the limitation surviving into that record. Because the clause binds, a component neither quarantined nor bounded pending disposition breaches the clause, and a disposition scrubbed of its limitation fails the clause even where the release itself was defensible.

INFRA9-R008

INFRA9-R008: A supply-chain design SHALL NOT build, sign, promote, deploy, or procure a live artifact; it remains conceptual.

Restraint closes the chapter: a supply-chain design must not build, sign, promote, deploy, or procure a live artifact, and it remains conceptual. Five live acts are barred by name, and the Draft prose beneath the clauses restates the limit in its own words, excluding live build pipelines and artifact promotion. The clause exists because a document that describes promotion thresholds, signing, and rollback is the natural thing to wave as permission to operate them, and because the chapter's whole argument is that authority comes from governing decisions, not from capability or convenience; a supply-chain design that signs a live artifact breaches this clause. Because the clause binds, any live build, signature, promotion, deployment, or procurement claimed under this architecture's name is done without it, and a reader, human or AI, can rely on the design being a description of how supply chains are to be governed, not a standing instruction to run one.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.