Module Reference
Evidence checklist: dependency inventory, reachability, lock policy, SBOM/VEX, reproducible build, signed artifact, provenance, SLSA target, CI identity and isolation, policy gates, admission, workload identity, drift, disclosure, exceptions, and assurance review.
Required evidence
Submit authorized pipeline configuration, inventory, artifact and provenance identifiers, verification output, injected failure, policy decision, remediation, and residual risk. A green build without trustworthy identity and traceability does not pass.
Oral defense
Trace source to runtime, explain which claim each artifact proves, demonstrate rejection of a substitution, and state the response when trust material is revoked.