Mistake Clinic

Module-Specific Mistake Radar

Mistake	Signal	Repair
SBOM equals assurance	No source or runtime link	Trace artifact and reachability
Lockfile equals integrity	Registry substitution possible	Verify source and artifact
CI is trusted by default	Untrusted PR has secrets	Isolate and minimize identity
Signature without policy	Any valid signer accepted	Bind signer, source, builder, and claims
Exception has no expiry	Risk becomes permanent	Owner, compensating control, deadline

Practice Mistake Checks

Verify inventory, provenance, reproducibility, identity, signing, admission, secrets, isolation, drift, tenant boundaries, disclosure, scope, and exception expiry.

Required evidence

Submit authorized pipeline configuration, inventory, artifact and provenance identifiers, verification output, injected failure, policy decision, remediation, and residual risk. A green build without trustworthy identity and traceability does not pass.

Oral defense

Trace source to runtime, explain which claim each artifact proves, demonstrate rejection of a substitution, and state the response when trust material is revoked.

Source backbone

Use SLSA, NIST SSDF, in-toto, and Sigstore.