Review delivery and supply chain
Assess one repository, a repository group, or an existing fleet evidence bundle. Trace how source and dependencies become trusted, reproducible, releasable artifacts.
Run the lens
- Read the standalone lens protocol completely and prepare the supplied scope with lens ID
delivery-supply-chain.
- Read the delivery and supply-chain checks completely. Apply every check family relevant to the build, package, container, CI, and release paths.
- Trace source, dependency, workflow, artifact, and promotion trust boundaries. Classify supported outcomes as strengths or findings; distinguish configured controls from controls evidenced on the exact commit.
- Follow the protocol to account for every contract-registered check family, validate the result, ingest it, and hand back the canonical artifact path.
For raw collection, build or scanner execution, or network refresh, read and follow the safety model. Use only pinned, allowlisted deep-mode adapters.
Read the review basis when applying SSDF, SLSA, OpenSSF, or vulnerability guidance. Read scanner adapters before interpreting tool output.
Boundary
Own build and artifact integrity. Route application exploit paths to application security, component support age to technology lifecycle, test adequacy to test quality, and organizational policy ownership to governance.
Completion
Complete when: every in-scope repository has an exact commit or explicit unavailable state, every applicable check family is accounted for, every claim has bounded sanitized evidence at an appropriate confidence, gaps remain visible in unknowns and coverage, and the shared result validator succeeds.
1---2name: review-delivery-supply-chain3description: Delivery and supply-chain review for CI/CD, reproducible builds, pinning, provenance, SBOMs, artifact and container integrity, licences, and release controls. Use for pipeline, artifact, SLSA, or software-supply-chain questions.4---56# Review delivery and supply chain78Assess one repository, a repository group, or an existing fleet evidence bundle. Trace how source and dependencies become trusted, reproducible, releasable artifacts.910## Run the lens11121. Read the [standalone lens protocol](../audit-software-fleet/references/standalone-lens.md) completely and prepare the supplied scope with lens ID `delivery-supply-chain`.132. Read [the delivery and supply-chain checks](references/checks.md) completely. Apply every check family relevant to the build, package, container, CI, and release paths.143. Trace source, dependency, workflow, artifact, and promotion trust boundaries. Classify supported outcomes as strengths or findings; distinguish configured controls from controls evidenced on the exact commit.154. Follow the protocol to account for every contract-registered check family, validate the result, ingest it, and hand back the canonical artifact path.1617For raw collection, build or scanner execution, or network refresh, read and follow the [safety model](../audit-software-fleet/references/safety-model.md). Use only pinned, allowlisted deep-mode adapters.1819Read the [review basis](../audit-software-fleet/references/research-basis.md) when applying SSDF, SLSA, OpenSSF, or vulnerability guidance. Read [scanner adapters](../audit-software-fleet/references/scanner-adapters.md) before interpreting tool output.2021## Boundary2223Own build and artifact integrity. Route application exploit paths to application security, component support age to technology lifecycle, test adequacy to test quality, and organizational policy ownership to governance.2425## Completion2627**Complete when:** every in-scope repository has an exact commit or explicit unavailable state, every applicable check family is accounted for, every claim has bounded sanitized evidence at an appropriate confidence, gaps remain visible in unknowns and coverage, and the shared result validator succeeds.
kenlck