26 AI Supply-Chain Integrity and Lifecycle Provenance

26.1 Chapter status

Field	Value
Chapter ID	`ai-supply-chain-integrity-and-lifecycle-provenance`
Part	Part I - Foundations, Alignment, and Governance
Status	conceptual
Last updated	2026-08-02
Manuscript maturity	v0.3 semantically reviewed proof-contract draft
Primary source records	eleven reviewed mappings: NIST C-SCRM; SLSA; OpenSSF Model Signing; SPDX AI; W3C PROV-O; MLCommons Croissant; in-toto; OWASP Agentic; and three local-project implementation-context notes
Claim label	Design rationale
Evidence level	argument
Source loading state	source notes: `ext_nist_cscrm_2022`, `deterministic_capability_compilation`, `platonic_world_model`, `ext_slsa_build_track_1_2`, `ext_openssf_model_signing_spec_2025`, `ext_spdx_ai_profile_3_0_1`, `cca_project`, `moecot_manifest_project`, `corbens_trainer_project`, `ext_w3c_prov_o_2013`, `ext_mlcommons_croissant_1_1_2026`, `ext_in_toto_2019`, `ext_owasp_agentic_top_10_2026`, `ext_proof_of_learning_2021`, `ext_c2pa_specification_2_3_2025`
Test state	Exact finite boundary: one quarantined three-project affected-path record, ten rejecting fixture mutations, eleven independently encoded lifecycle controls with exact state preservation, all 24 permutations of a four-component inventory, five rejected event kinds after revocation, and 34 Lean declarations under six manifest targets. The consumer recompiles the module, checks clean admit/revoke and critical-advisory quarantine runs, and distinguishes exact component identity from equal-cardinality substitutions. No real artifact/content verification, dataset, supplier, build/training execution, signature, advisory feed, dependency discovery, propagation/restoration effect, recipient notice, sanitization, privacy/rights, availability, or security metric was exercised.

26.2 Drafting guardrail

Supply-chain integrity is traceability and routing discipline, not a certificate of security or quality. A model can have a well-formed BOM, a valid signature, and a recorded build lineage while remaining unsuitable, compromised through an unrecorded path, unsafe, illegally distributed, or unauthorized for deployment.

26.3 Human Reading Path

Concrete lens. The BOM baseline records the vulnerable component but misses an indirect build-image descendant. The affected-path controller follows exact lineage and blocks all three consumers.

An AI system is assembled from models, datasets, tokenizers, libraries, training jobs, cloud services, policy files, and derivatives. A familiar name does not reveal which ingredient changed, who supplied it, or whether an upstream warning applies to a downstream release.

Supply-chain integrity records those relationships. It identifies the exact artifact, upstream inputs and processes, checked provenance statements, components and suppliers in scope, and downstream descendants affected by an advisory or revocation. Missing lineage, stale inventory, and unresolved warnings become conditions instead of surprises discovered during an incident.

Metadata can be true and insufficient. A signature may show that bytes have not changed since signing without showing that training data was fit, the objective was sound, or the use is permitted. Each question needs its own evidence and owner.

Start with an artifact and requested use, walk backward through data, code, build, training, supplier, and signer relationships, then change one upstream fact and walk forward through every derivative, custody decision, and release. Integrity holds only when the affected closure, response owner, and evidence limits survive both directions without metadata becoming authority.

26.4 Problem

Model-Weight Custody can govern a known artifact’s bounded load while the artifact’s wider production and reliance chain remains wrong. Data and rights, code, prompts and policies, tokenizers, dependencies, containers, hardware and firmware, build and training environments, evaluation packages, suppliers and services, signers, advisories, transformations, recipients, descendants, incidents, and retirement obligations can all change independently. A valid custody record over one digest can therefore protect the wrong or materially incomplete supply-chain subject.

This is an open-world and cross-organizational problem. Some dependencies are declared by producers, some are discovered by consumers, some are visible only to vendors, and some appear after an incident. One consumer may need exact build inputs, another data-rights lineage, another firmware provenance, and another only a bounded vulnerability decision. “Complete AI BOM” is inadmissible without a named consumer, requested use, required relation classes, discovery method, coverage grade, materiality threshold, and explicit unknowns.

Metadata also differs from observed effect. A provenance statement can say which inputs were declared; it does not show that those bytes were used. A signature can authenticate a statement or bundle; it does not establish issuer honesty or artifact fitness. A quarantine row can record intent; it does not show that every affected service stopped or later restored correctly. The operational task is to bind scoped assertions to exact subjects, independent- enough verification and observation, relation-specific downstream consequences, and terminal ownership without pretending to discover every physical or organizational path.

26.5 Why existing approaches are insufficient

NIST’s cybersecurity supply-chain risk-management guidance supplies the broad lifecycle comparator. It treats supply chains as linked resources and processes across acquisition, development, delivery, operations, and disposal, and it links risk framing, assessment, response, and monitoring to organizational context. That framing is useful because it resists the idea that procurement or an inventory export finishes the security task. It is not an AI-specific local implementation, supplier assessment, or integrity result.

SLSA supplies a narrower build-provenance comparator. Its build track describes what provenance can say about a builder, process, and top-level inputs, and why unsigned or lower-assurance provenance has limited resistance to tampering. The limit matters as much as the mechanism: build provenance cannot establish the correctness or fitness of a training dataset, the behavior of a model, or the authority to deploy an artifact.

OpenSSF Model Signing makes the AI-artifact case more concrete. It describes signed bundles of weights, configuration, tokenizers, and datasets and names verification points across an artifact lifecycle. Its own non-guarantees are essential: a signature is not a proof of model quality, fairness, privacy, secure development, access control, or safe use. SPDX provides the companion interoperability model for AI, datasets, build information, supplier identity, provenance, integrity, relationships, and lifecycle metadata. A well-formed BOM still can omit a relevant relationship or be stale.

The ASI Stack already has layers that hold pieces of this story. Artifact Graphs record provenance and replay; Data Engines controls learning-data admission and deletion mechanics; Model-Weight Custody controls a known artifact’s loading conditions; Security Kernel controls runtime secrets and authority; Readiness Gates control bounded admission. The missing owner is the policy that relates their upstream AI-supply-chain artifacts, detects a material gap or change, and routes every affected downstream path to the appropriate existing owner.

26.5.1 Strongest-neighbor comparison

Neighbor	Strongest contribution	Boundary that survives	Chapter delta
NIST C-SCRM	Organization-wide framing across acquisition, development, delivery, operation, monitoring, response, and disposal.	Broad risk practice does not identify the exact graph closure or consumer route for one changed AI artifact.	Bind lifecycle risk decisions to typed AI nodes, edges, affected consumers, and append-only re-review events.
SLSA Build Track	Builder, process, input, provenance, signing, and verification requirements with graduated assurance.	Build provenance does not cover semantic dataset fitness, training objective, derivative release, supplier truth, or model behavior.	Join build evidence to training, data, model, and derivative lineage without allowing a SLSA level to become a model-security verdict.
OpenSSF Model Signing	Signed AI artifact bundles, hashes, metadata, and lifecycle verification points with explicit non-guarantees.	Authenticity and integrity of the signed bundle do not prove completeness, confidentiality, quality, safety, or permitted use.	Make the signed subject and policy scope one bounded edge in the graph and propagate signer revocation to every declared consumer.
SPDX AI Profile and dataset metadata	Interoperable model, dataset, supplier, build, provenance, integrity, and relationship descriptions.	Interoperability can faithfully exchange stale, incomplete, or incorrect declarations.	Attach freshness, source, unresolved gaps, verifier, residual owner, and decision consequence to exchanged descriptions.
in-toto	Signed owner layout, authorized functionaries, material/product links, thresholds, and client verification of the declared chain.	A correct layout can omit a relevant AI relation; key and threshold quality plus last-mile freshness remain deployment-specific.	Treat layout/link evidence as a declared subgraph, test closure across AI derivatives, and retain omissions as explicit residuals.

This layer is not a universal superset of these mechanisms. Its distinct job is policy composition at the AI lifecycle boundary: it says which bounded records must agree for one requested use, what happens when they do not, and how a later invalidation reaches declared downstream decisions without rewriting history.

26.6 Core Claim

[ai-supply-chain-integrity-and-lifecycle-provenance.core, label: Design rationale, support: argument] Every governed AI supply-chain decision should bind a prospectively frozen consumer, requested use, threat and assurance model, materiality policy, and relation-specific asset closure to exact subject/content and lineage identity; typed data, code, model, prompt/policy, dependency, build/training/evaluation, environment, hardware/firmware, supplier/service, signer, advisory, transformation, release, recipient, descendant, retention, and retirement state; issuer, verifier, policy, freshness, trust and dependency boundaries; observed artifact and lifecycle effects; append-only invalidation and acknowledged affected-path propagation; restoration, compensation, disclosure, privacy/rights, availability, cost, and terminal residual ownership. Missing, inconsistent, stale, unverifiable, revoked, compromised, materially incomplete, or unresolved-critical predicates should route each affected consumer to a named non-ordinary state, while no graph, BOM, checksum, signature, provenance statement, SLSA level, layout, supplier claim, advisory, quarantine, conformance result, or finite proof by itself establishes world-complete lineage, assertion truth, artifact correctness, absence of compromise, data fitness or rights, model safety, legal compliance, readiness, release merit, or deployment authority.

Reader claim. Provenance matters only if a compromised ancestor can find and stop every affected descendant; a signed bill of materials that cannot drive response is documentation, not control.

Operational rule. Bind every artifact to exact lineage and consumer scope, append invalidations rather than overwriting history, compute relation-specific descendant closure, and require acknowledgment from each response owner. Stale inventories, incomplete closure, or ordinary use after revocation force quarantine.

26.6.1 Worked revocation: one component reaches three projects

A critical advisory revokes one dependency used by three projects. The current component inventory identifies the exact artifact digest and its three affected paths. The supply-chain controller appends the advisory and revocation, moves all three consumers out of ordinary use, assigns response owners, and keeps them quarantined until rebuilt, replaced, retired, or explicitly residualized. One project cannot clear the incident merely because its direct package list omits the dependency; lineage through a build image still counts.

The local affected-path harness preserves one quarantined three-project record. It rejects ten fixture mutations and eleven lifecycle controls, checks 24 component-inventory permutations, and refuses five event kinds after revocation. Removing a descendant, substituting the digest, overwriting history, admitting a stale bill of materials, or recording custody after invalidation all fail without changing accepted state. These checks show finite propagation behavior, not world-complete lineage, signature truth, absence of compromise, model safety, or legal compliance.

This composite proposition remains at argument. It is refuted for a frozen scope by any ordinary-use route that violates the declared identity, closure, assertion, verification, inheritance, applicability, propagation, restoration, privacy/rights, availability, cost, or residual rule. Its proposed advantage fails when a simpler matched baseline produces every frozen effect at lower joint cost.

26.7 Mechanism

The contract has sixteen owned mechanisms grouped into four phases.

Phase	Owned mechanisms
Freeze	Declare the consumer/use, criticality, threat and assurance model, properties, relation classes, materiality, disclosure, availability/recovery, evidence gates, authority, and residuals; define consumer-relative asset/relation closure and discovery coverage.
Identify and verify	Type lifecycle nodes and edges; bind exact subjects, content, representations, issuers, verifiers, policies, freshness, trust dependencies, and observed verification; separate assertions from artifact/content effects, replay, reproducibility, fitness, and authority.
Propagate and respond	Type property inheritance; adjudicate advisory applicability; append invalidations; compute relation-specific declared affected closure; obtain acknowledgements; govern quarantine, repair, narrowed use, restoration, exceptions, compensation, transfer, retirement, and disposal.
Measure and retain	Minimize cross-organizational disclosure; measure security, discovery, applicability, propagation, restoration, usefulness, availability, privacy/rights, labor, benefit, and cost jointly; retain negative, null, disputed, missed-edge, false-quarantine, and irreversible outcomes as regression memory.

The first object is a typed supply-chain graph. Its nodes identify models, datasets, code dependencies, build and training runs, configuration artifacts, prompts and policies, evaluation packages, containers, environments, hardware/firmware, signers and verifiers, suppliers and services, distributors, advisories, transformations, recipients, descendants, incidents, releases, retention, and disposal events. Edges state limited semantics such as trained-from, built-from, evaluated-with, packaged-with, depends-on, signed-by, supplied-by, served-by, distributed-to, derived-from, affected-by, revokes, or retired-by. Each node and edge binds an exact subject or content identity, representation, issuer, holder, source, policy scope, time, freshness, consumers, and residuals.

The graph carries a separate closure record. It freezes the consumer, use, required node and relation classes, property-inheritance rules, discovery method, coverage grade, external jurisdictions, excluded classes, inaccessible supplier/recipient state, and unknown edges. This prevents graph size or schema conformance from becoming a completeness claim.

The second object is an assertion and verification packet. BOMs, checksums, provenance, signatures, SLSA levels, in-toto layouts and links, dataset metadata, supplier declarations, advisories, and conformance results retain distinct issuers, verifiers, trust roots, policies, dependencies, evidence, observations, limitations, expiry, conflicts, and consumers. A statement about declared build inputs remains separate from observation of actual bytes, parameter-changing training, replay, reproducibility, semantic equivalence, data fitness, or model behavior.

The third object is a supply-chain admission record. Before a downstream artifact can move to weight custody or readiness review, the record names its consumer and use, identity/content, closure version, lineage, supplier/service scope, build/training/evaluation receipts, signature/provenance/BOM requirements, dataset and rights handoffs, advisory applicability, revocation and incident path, disclosure limits, restoration conditions, residual owner, and evidence gates. Missing lineage may require repair; stale or conflicting assertions may require review; required unverified evidence, material incompleteness, or an applicable unresolved-critical event can quarantine the affected path.

The fourth object is a change and incident propagation record. A new advisory, revoked signer, compromised supplier, altered dependency, discovered derivative, changed dataset/right, invalidated evaluation, recipient incident, or retirement does not overwrite an old node. It appends an event, evaluates exact subject and version applicability, computes relation-specific declared affected closure, and routes every member to one acknowledged owned non-ordinary response. Hidden copies and unknown edges remain residuals rather than being counted unaffected.

The fifth object is closure of the response. Quarantine or denial must name a fallback, priority, owner, deadline, escalation, restoration condition, availability impact, compensation, exception authority/expiry, and terminal disposition. Restoration creates a new lineage event and requires observed effects. Retirement distinguishes removal from ordinary service, access revocation, notice, retention, archive, legal hold, sanitization, disposal, recipient recall, and world erasure.

The final object is a disclosure-minimized evidence projection. Cross- organization consumers receive enough identity, policy, observation, denominator, dependency, failure, conflict, cost, and residual information to contest a decision without automatically receiving controlled artifacts, personal data, trade secrets, contractual material, or exploitable weaknesses.

flowchart LR
  U["Consumer, use, threat/property model, relation classes"] --> C["Consumer-relative closure and discovery grade"]
  N["Typed data, code, model, environment, supplier, recipient nodes"] --> G["Versioned node/edge graph"]
  C --> G
  S["Assertions: BOM, provenance, signature, supplier, advisory"] --> V["Independent-enough verification, policy, freshness, dependencies"]
  G --> A["Exact artifact-path admission"]
  V --> A
  A --> D{"All required scoped predicates current and reconciled?"}
  D -->|"no"| Q["Repair, review, quarantine, narrow use, or retire"]
  D -->|"yes"| H["Typed handoff to custody/readiness; no broader authority"]
  I["New advisory, compromise, edge, rights defect, or retirement"] --> P["Append invalidation and relation-specific affected closure"]
  P --> Q
  Q --> O["Acknowledged effects, restoration, compensation, terminal residual"]
  H --> O
  O --> E["Disclosure-minimized evidence and regression memory"]

What the supply-chain flow shows: a graph and its assertions are separate from their verification and from downstream effects. Closure is relative to a consumer and use. A favorable path supports only a typed handoff; a later event appends rather than rewrites history and remains incomplete until affected responses and terminal residuals are acknowledged.

26.7.1 Append-only invalidation and affected-path closure

The historical-project lineage sharpens the propagation step. CCA contributes append-only supersession and invalidation: a new warning becomes a distinct event linked to the prior decision rather than an edit that erases what was previously believed. MoECOT Manifest contributes digest-bound artifacts, attestation scope, and revocable records: a valid statement must name the exact subject and policy scope it covers. Corben’s Trainer contributes quarantine and revocable promotion: when upstream evidence is invalidated, downstream claims and candidates cannot remain green merely because their own rows did not change. These are design inputs from one local lineage, not independent replications or evidence that any historical implementation enforced the rule.

For a bounded graph, an invalidation event names one subject node. The affected closure is that node plus every declared downstream node reachable through the typed edges. Each member receives exactly one owned repair, review, quarantine, or retirement route, and no member retains ordinary use while the invalidation is active. This makes a newly revoked dependency operationally different from a free-floating advisory note: the record identifies which training run, model, derivative, and release must be reconsidered.

The typed input is a digest-bound graph, scoped assurance references, one append-only invalidation event, and a requested artifact admission. The typed output is the exact declared affected closure, one owned response per member, a custody/readiness admission result, and lifecycle closure containing residual, retention, disposal, and re-review ownership. Hidden copies and undeclared edges remain outside the computed closure and therefore remain explicit residuals.

The strongest objection is that exact propagation over a declared graph can create false confidence in an incomplete graph. That objection holds. Closure correctness is conditional on recorded identities and edges; it does not show that the inventory is complete, the advisory is accurate, the signer is honest, or the artifact is uncompromised. The mechanism improves response accountability after a known change. It cannot guarantee discovery of unknown relationships.

26.7.2 Neural and semantic artifacts in the lifecycle graph

Deterministic Capability Compilation adds Neural Capability Objects and link receipts to the governed supply chain. An NCO’s identity includes its capability field, compatible base, parameter ownership, neural ABI, dependencies, applicability, training receipt, verifier, incidents, lifecycle state, and recovery path. A linked composite is a new artifact with conflict analysis, adapter and router bindings, validation scope, and densification lineage; it cannot inherit the trust of its inputs by checksum or ancestry alone.

The Platonic World Model adds semantic-basis dependencies. Form versions, relation schemas, contexts, grounding adapters, proof rules, mappings, packets, and semantic migrations are versioned lifecycle nodes. Revoking a recognizer, mapping, or Form version can invalidate plans, proofs, policies, packets, and linked capabilities even when their bytes do not change. Provenance makes that affected closure inspectable, but an incomplete dependency graph remains an explicit residual rather than a completeness claim.

26.8 Interfaces

The supply-chain layer governs the integrity policy across lifecycle artifacts. It must remain downstream of neither a raw provenance graph nor a custody token: the first stores and replays records, while the second controls a bounded load. The layer creates a narrow affected-path result that can be consumed by other owners without rewriting their distinct approval criteria.

The contract exposes ten typed handoffs:

An Assurance Request and Consumer-Relative Closure Record freezes consumer/use, criticality, threat and property model, relation classes, materiality, discovery/coverage grade, exclusions, disclosure, availability/recovery, evidence gates, and residual acceptance.
A Typed AI Supply-Chain Node and Edge Record binds subject/content identity, representation, lineage, relation semantics, issuer/holder, source, scope, policy, time, freshness, consumers, and residuals.
An Assertion, Verification, and Dependency Packet separates BOM, provenance, signature, attestation, supplier, dataset, advisory, and conformance predicates from their issuers, verifiers, trust roots, policies, evidence, observations, conflicts, limitations, expiry, and consumers.
A Build, Training, Evaluation, and Transformation Receipt binds declared and observed inputs/outputs, runner or builder, environment, parameters and randomness, execution, logs, reproducibility grade, semantic-equivalence limits, and downstream relations.
A Dataset and Rights Lineage Packet links acquisition, consent/license/purpose, curation, contamination, quality, representativeness, retention, deletion, and derivative duties to Data Engines and Privacy/Rights without deciding their outcomes.
An Advisory Applicability and Affected-Path Record binds exact subject/version, severity, exploitability/applicability, confidence, source/conflict, relation-specific closure, observed exposure, required action, consumers, and unknowns.
An Invalidation, Response, Restoration, and Compensation Record preserves prior state, appended event, acknowledgements, non-ordinary routes, exceptions, fallback, deadlines, restoration evidence, compensation, and terminal disposition.
A Retirement and Disposal Record distinguishes service removal, revocation, notice, retention, archive, legal hold, sanitization, disposal, surviving copies/recipients, historical lineage, and terminal residuals.
A typed cross-layer handoff lets Artifact Graphs, Data Engines, Model-Weight Custody, Security Kernel, Runtime Adapters, Readiness, Privacy/Rights, Incident Response, and Evidence States consume only their exact predicate. No supply-chain record grants broader support or authority.
A Public-Safe Supply-Chain Evidence Projection exposes independently checkable identities, policies, observations, counts, denominators, dependencies, costs, failures, conflicts, and residuals while minimizing controlled, personal, contractual, and exploitable information.

26.9 Invariants

No ordinary route is admitted without a frozen consumer/use, assurance and threat model, exact subject/content and lineage identity, required relation classes, materiality policy, time, affected decision, authority, and residual owner.
Completeness is consumer- and use-relative. Discovery coverage, exclusions, inaccessible state, unknown edges, and external copies remain visible; no finite graph is labeled world-complete.
Every assertion remains bound to its subject, representation, issuer, verifier, policy, scope, freshness/expiry, trust/dependency graph, observed verification, limitations, and permitted consumers.
A BOM, checksum, signature, provenance statement, SLSA level, layout, supplier declaration, dataset record, advisory, quarantine, or conformance result is non-transitive and cannot silently establish another predicate or authority.
Declared build/training/evaluation inputs, execution, environment, and outputs remain distinct from observed replay, reproducibility, semantic equivalence, artifact fitness, and model behavior.
Dataset identity and metadata remain distinct from content integrity, contamination, quality, representativeness, consent/license/purpose, deletion, unlearning, and lawful or legitimate use.
Supplier, signer, builder, service, distributor, Verifier, advisory, and recipient roles retain dependency and compromise state; an authorized or well-known actor is not presumed honest or independent.
Transformation edges name which security, rights, advisory, revocation, retention, and retirement properties inherit. Unknown inheritance remains non-ordinary or an owned residual.
An advisory or invalidation is scoped by exact subject/version, applicability, confidence, source/conflict, relation policy, affected use, and observed exposure; missing evidence is proof of neither compromise nor safety.
Invalidation and correction append rather than overwrite history. Every declared affected member receives one acknowledged owned non-ordinary response until restoration, transfer, retirement, or residual acceptance reaches terminal state.
Quarantine and denial preserve restoration conditions, fallback, deadline, escalation, availability impact, compensation, and exception expiry. An override neither erases the defect nor counts as repair.
Retirement, access revocation, notice, retention, archive, sanitization, disposal, recipient recall, and world erasure remain distinct observed claims.
Cross-organization evidence obeys privacy, rights, security, contractual, retention, and disclosure-minimization limits while remaining contestable and lineage-preserving.
Security findings remain paired with affected-path precision/recall, false quarantine, useful-service loss, restoration, availability, operator labor, privacy/rights, benefit, and total cost.
Finite records, one declared graph, 34 theorem declarations, ten fixture mutations, eleven lifecycle controls, 24 inventory permutations, five terminal-state event checks, or zero observed compromise establish only their exact scope—not inventory completeness, assertion truth, artifact integrity, supplier trust, effective control, safety, compliance, or transfer.

These rules make a supply-chain record honest about what it knows and what it does not. The record can state that an expected field is missing, a verifier did not accept a declared bundle, an advisory remains unresolved, or a derivative relationship requires re-review. It cannot turn an exhaustive-looking graph into evidence that the world outside the graph is complete or benign.

The guarantees weaken at every observation boundary. An omitted edge narrows the computed closure; a stale verifier weakens an assurance reference; a hidden copy defeats local revocation; and an unowned route turns quarantine into an orphaned label. Those conditions do not silently relax admission. They remain blockers or residuals until a new scoped record resolves them.

26.10 Non-obvious consequences

26.10.1 Completeness is consumer-relative

A graph sufficient to reproduce a package may be inadequate for a data-rights review, contamination inquiry, custody load, or open-release decision. The admission record therefore names the consumer and required relation classes. “Complete BOM” without that scope is not a stable proposition.

26.10.2 Invalidation is monotone even when belief is not

New evidence may reverse a former conclusion, but the event history should only grow. The prior admission, its evidence, the invalidating event, the affected closure, and each repair disposition remain addressable. This lets a reviewer ask what was known at the time without treating an obsolete decision as current.

26.10.3 A derivative is defined by policy, not filename similarity

A quantized model, adapter, merged checkpoint, distilled model, exported runtime, or regenerated dataset may preserve different properties of its source. One generic derived-from edge is insufficient for every incident. Propagation policy must name which relation kinds carry which advisories, license duties, contamination findings, signer revocations, or retirement requirements. Unknown inheritance remains a residual rather than defaulting to unaffected.

26.10.4 Quarantine without service restoration is incomplete governance

Blocking an affected path can prevent propagation while still imposing severe availability and operator costs. Every non-ordinary route needs a repair owner, priority, expiry or re-review trigger, and an explicit fallback. Otherwise the system optimizes for the number of quarantines rather than safe useful service.

26.11 Strongest objections and surviving residuals

26.11.1 “The graph can never be complete”

Agreed. The mechanism proves no world completeness. It makes a declared closure testable, records excluded relation classes, and prevents an incomplete graph from being described as exhaustive. Discovery controls, supplier challenge, artifact scanning, and independent rebuilds can reduce uncertainty but cannot eliminate hidden copies, undisclosed inputs, or malicious omissions.

26.11.2 “Signed metadata just moves compromise to keys and authorized actors”

Signatures answer who vouched for which bytes or statement under which key. They do not answer whether the functionary was honest or uncompromised. The response is threshold design, role separation, revocation, independent evidence, and exact subject binding, not trust by syntax. The residual includes stolen keys, coerced suppliers, compromised builders, and colluding functionaries.

26.11.3 “Continuous propagation will cause alert storms and permanent quarantine”

Unbounded fan-out is a real operational failure. Events need severity, relation-specific propagation, affected-use scope, deduplication, repair state, and rate-limited escalation. But suppressing an event for convenience cannot leave an affected path ordinary without an owned exception and residual. The unrun empirical question is whether the added governance cost produces net useful risk reduction on natural lifecycle work.

26.11.4 “Existing artifact graphs already do this”

Generic provenance storage is the substrate, not the decision policy. This chapter adds AI-specific admission requirements, affected-path semantics, consumer-bound completeness, append-only invalidation, non-ordinary response ownership, and cross-layer handoffs. If an artifact graph implementation already provides those contracts, it can satisfy the supply-chain boundary without a second graph.

26.11.5 “A valid supply chain can still produce a dangerous model”

Correct, and this is the decisive boundary. Integrity can show that the declared process and artifact relation held. It cannot validate the objective, dataset fitness, evaluations, behavior, rights, or deployment decision. Those claims remain with their owning chapters even when every supply-chain check passes.

26.12 Failure modes

Identity substitution: a name, digest, version, tokenizer, dataset, dependency, model, configuration, policy, environment, build, package, signer, supplier, or recipient changes after approval or behind a familiar label.
BOM or graph theater: a well-formed inventory is incomplete, stale, inaccessible, consumer-mismatched, or unverified but reported as world- complete integrity.
Predicate laundering: a signature, provenance statement, SLSA level, layout, checksum, dataset record, supplier claim, advisory, or conformance result becomes artifact correctness, data fitness/rights, safe behavior, compliance, or authority.
Self-ratifying assertion: issuer, Verifier, policy author, trust root, supplier, builder, signer, advisory source, and consumer share one captured dependency path.
Build or training theater: declared inputs or successful orchestration diverge from actual bytes, code snapshot, environment, randomness, parameter updates, outputs, replay, or semantic equivalence.
Data-lineage theater: identifiers, checksums, declarations, or reproducible generator splits become content verification, decontamination, representativeness, consent, license, deletion, or fitness.
Supplier or service capture: concentration, substitution, coercion, compromised keys, insiders, offboarding failure, or undisclosed subcontractors defeat challenge and incident paths.
Relation-semantic error: policy over-propagates an irrelevant event or under-propagates a relevant security, rights, contamination, signer, supplier, release, retention, or retirement obligation.
Advisory error: stale ranges, false positives/negatives, conflict, delayed feeds, wrong severity, inapplicability, or exploitability errors create unsafe ordinary use or unnecessary quarantine.
Propagation loss: an affected custody, readiness, service, release, recipient, derivative, descendant, public claim, or external reliance stays ordinary.
Partial closure: a direct component is quarantined while a declared descendant remains ordinary, or unknown edges are counted unaffected.
History overwrite: identity reuse, mutable reports, missing acknowledgements, or stale dashboards erase the evidence and policy behind the prior decision.
Quarantine theater: blocking lacks restoration criteria, owner, fallback, deadline, escalation, compensation, or terminal disposition and causes paralysis or informal bypass.
Restoration or exception laundering: ordinary use resumes without a new lineage event, observed repair, override expiry, updated affected closure, or preserved residual.
Retirement/disposal theater: service removal, key revocation, deletion, or one sanitized store becomes recipient recall, all-copy deletion, rights closure, or world erasure.
Evidence harm: exchange exposes controlled artifacts, personal data, trade secrets, exploitable weaknesses, supplier-sensitive facts, or rights- restricted material, or becomes a surveillance/tampering surface.
Externalized cost: detection counts omit denominators or shift false quarantine, availability loss, restoration delay, operator/supplier labor, privacy/rights harm, compensation, or irreversible cost elsewhere.

The repair path depends on the error. Identity or lineage gaps need discovery and correction; a stale inventory needs a scoped refresh; a failed signature needs verifier or artifact investigation; an unresolved critical advisory needs quarantine or review; and an unowned residual needs a named owner before a downstream path can be considered. No one outcome is a generic verdict about the artifact itself.

26.13 Proof of training and downstream content provenance

A signed final checkpoint identifies an artifact but says little about how it was produced. Proof-of-learning protocols instead ask a claimant to commit to an ordered training trace whose selected transitions can be checked later [@ext_proof_of_learning_2021]. In stack terms, this is a training-lineage witness: it binds code, data-lease identities, objective, optimizer and scheduler state, checkpoint sequence, sampling rule, verifier challenge, tolerances, and the claimed run. It belongs beside build provenance, not above it.

The witness is useful because it makes some fabricated histories more expensive and lets downstream consumers distinguish “weights received” from “training process partially audited.” It also has sharp limits. A plausible state sequence does not prove that the data were lawful, the objective was appropriate, hidden computation was absent, the run is exactly reproducible, or the model is safe. Compression, nondeterminism, verifier sampling, collusion, and omitted preprocessing can create convincing but incomplete histories. The supply-chain ledger therefore records both the verified slice and the unobserved remainder.

Provenance continues after a model generates media. C2PA Content Credentials provide an interoperable structure for signed assertions about asset creation and modification [@ext_c2pa_specification_2_3_2025]. Lifecycle provenance preserves a cross-layer link from model and policy version to generation receipt, content manifest, edits, publication channel, and any later revocation. But provenance is not truth: a faithfully signed synthetic image can still be deceptive, and authentic media may have no credential or may lose one in transit. The explicit nonclaim is that neither a proof-of-training transcript nor a signed content manifest establishes semantic correctness, harmlessness, authorship legitimacy, or release authority.

26.14 Minimum Viable Implementation

Incident closure and restoration semantics.

Affected-path computation is only the opening move of an incident. Every quarantined consumer needs a restoration condition: replacement artifact, revalidated supplier, patched dependency, compensating control, narrowed use, or explicit retirement. Without that condition, conservative propagation can turn a bounded advisory into permanent operational paralysis. With a weak condition, the organization can restore service before the reason for quarantine is addressed. The condition must therefore be declared with the policy that computed the affected set, not invented after pressure to resume.

Restoration creates a new lineage event. A rebuilt model from the same source data is not the old artifact with a green status; it has a new build identity, environment, dependency set, signatures, evaluations, and affected-path relationship. If a compensating control is used instead, the original defect and the control’s expiry remain visible. An override is neither restoration nor evidence that the advisory was wrong. It is an attributable authority decision with a narrower duration and an owned residual.

Supplier uncertainty needs symmetric treatment. A missing attestation is not proof of compromise, and a valid attestation is not proof of benign behavior. The policy can route missing or conflicting records without converting them into a forensic conclusion. This matters for availability: if every metadata gap is called an attack, operators will learn to ignore the system; if every signed record is treated as truth, authorized compromise becomes invisible.

The service-level evaluation should pair security and recovery outcomes. It should measure seeded affected-path recall and precision, time to quarantine, time to safe restoration, incorrect restoration, unaffected-service loss, revocation fan-out, operator effort, and unresolved descendants. Costs belong beside successful detections because an unusable control invites bypass. The current finite graph and policy routes can test deterministic closure over declared nodes, but they do not establish world-complete lineage, supplier truth, forensic correctness, or production recovery.

Finally, retirement must close authority without deleting history. A retired artifact loses eligibility for named consumers, while its digest, decisions, incidents, derivatives, and replacement links remain queryable under the retention policy. That distinction prevents “removed from service” from being misreported as “erased from every store” and lets future investigations reconstruct which downstream systems once depended on it.

The implemented minimum is much smaller than the expanded contract. The repository includes schemas/supply_chain_affected_path_record.schema.json, one quarantined three-project affected-path record, and ten expected-invalid mutations. The harness rejects digest substitution, incomplete declared downstream closure, missing response ownership, ordinary use during invalidation, overwritten history, a revoked path that avoids quarantine, stale assurance admitted as current, custody after invalidation, missing disposal closure, and support promotion. Thirty-four Lean declarations under six manifest targets preserve the original Boolean admission routes and add a reachable bind, clean-or-critical review, admit-or-quarantine, and revoke lifecycle. Arbitrary accepted finite runs preserve exact artifact/digest/lineage/supplier/build identity, a canonical duplicate-free component-ID inventory, authority ceilings, and zero support or external-effect authority; rejected events preserve exact state, admission and invalidation receipts are explicit, quarantine excludes admission, and exact revocation closure returns active authority to zero and becomes terminal. A same-cardinality substitution witness proves that count-only classification cannot recover component identity. The independent consumer recompiles the exact theorem surface, closes one admit-then-revoke path and one critical-advisory quarantine path, rejects eleven identity, ceiling, non-authority, signature, stage-order, inventory, and revocation controls without state change, checks all 24 four-component permutations, and rejects all five event kinds after revocation.

This establishes one declared graph’s record, route, closure, and mutation semantics. No real AI BOM, artifact/content verification, dataset, supplier, build or training execution, signature, key, Verifier, advisory feed, dependency discovery, reproducible rebuild, relation-specific propagation, quarantine/restoration effect, recipient notice, sanitization, privacy/rights, availability, or security metric has been exercised. It is not an AI BOM service, supplier-assessment program, secure pipeline, signing service, incident operation, or deployment gate.

The next slice must create public-safe effects rather than add Boolean fields. It should use a harmless multi-artifact model/data/code package with seeded substitutions, omitted and extra edges, signed and unsigned statements, conflicting suppliers, stale and inapplicable advisories, transformations, downstream consumers, quarantine acknowledgements, restoration and retirement. Artifact discovery/content verification, assertion verification, applicability, affected-path calculation, and effect observation should be independently implemented enough that one self-authored record cannot certify itself.

26.15 Mature Research Target

The mature endpoint is a lifecycle provenance plane that observes component, data, model, build, training, deployment, derivative, advisory, revocation, and consumer lineage closely enough to measure both false and missing edges.

The proposed beyond-state-of-the-art result is comparative and refutable: the full consumer-relative transaction may improve artifact/edge discovery, substitution and false-assertion detection, advisory applicability, affected-path response, and safe restoration without unacceptable false quarantine, service loss, disclosure harm, operator/supplier burden, or cost. The book does not claim that outcome before the campaign runs.

The campaign must preregister public-safe but effect-bearing artifact families, natural lifecycle work, seeded substitutions, missing and extra edges, compromised or conflicting issuers, stale and inapplicable advisories, transformations, consumers, incidents, restoration, and retirement. Matched baselines are:

inventory-only SPDX/Croissant metadata;
OpenSSF-style signature verification only;
SLSA/in-toto build-chain verification;
conventional C-SCRM plus dependency and vulnerability scanning;
a generic provenance graph without consumer-relative policy; and
the complete proposed transaction.

Separate implementations must own artifact discovery/content verification, provenance and signature verification, supplier challenge, advisory applicability, affected-path computation, downstream acknowledgement, quarantine/restoration, privacy/rights review, and cost evaluation. The frozen joint metrics are discovery and detection precision/recall, tamper/substitution, false-assertion acceptance, affected-path precision/recall, false quarantine, propagation and restoration correctness/latency, unaffected-service loss, availability, useful throughput, disclosure/privacy/rights harm, operator/supplier burden, benefit, and total cost.

Causal ablations remove consumer-relative closure, exact subject binding, assertion/verification separation, observed transformation effects, relation-specific inheritance, applicability adjudication, append-only acknowledged propagation, restoration closure, disclosure minimization, and joint accounting one at a time. Replication and transfer span artifact, model, and data families; transformations; organizations and suppliers; build/training stacks; environments; relation policies; adversaries; incidents; release and retirement modes; and time.

World-complete lineage is not an admissible promotion target. Narrow completeness, integrity, superior-control, effective-revocation, or transfer wording survives only when every frozen joint gate beats strong baselines under independent reproduction. Otherwise the exact proposition is narrowed or refuted, and negative/null outcomes remain visible. Even a positive result would not establish data fitness or rights, supplier honesty outside the tested path, model safety, legal compliance, readiness, release merit, deployment authority, or ASI.

No current result meets this lifecycle-provenance endpoint; support remains argument until observed natural supply chains, adversarial faults, independent reproduction, and transfer pass the joint gates.

26.16 Codex test plan

Test	Purpose	Status
Unresolved-critical-advisory route	Ensure a requested artifact with a recorded unresolved critical advisory quarantines rather than reaching custody review.	Implemented as a finite Lean theorem.
Required-but-unverified signature control	Ensure required signing does not become a pass-through when verification is absent or fails.	Implemented as a finite Lean theorem.
Admission completeness routes	Distinguish complete custody handoff from missing lineage, inventory, revocation path, or residual ownership.	Implemented as five additional derived Lean routes.
Reachable lifecycle and exact component revocation	Preserve exact declared artifact/provenance/component identity, authority ceilings, non-authority, trace validity, composition, admission/invalidation receipts, quarantine, exact rejected state, and terminal zero-authority revocation across arbitrary accepted finite event lists; reject duplicate, reordered, and same-count substituted component identities, and show why count-only admission is insufficient.	Implemented as 27 lifecycle declarations beside seven retained routes. The independent consumer recompiles all 34 declarations, closes clean and critical paths, rejects eleven lifecycle controls without state change, checks all 24 inventory permutations, and rejects five event kinds after revocation. Event truth, inventory discovery/completeness, and deployed effects remain outside the model.
Stale BOM and derivative-propagation controls	Route a stale inventory or affected derivative to refresh, repair, or accountable review.	Implemented for one hand-authored graph and deterministic mutations; no inventory service or live propagation ran.
Public-safe supply-chain workload	Exercise synthetic identities, provenance, signing, advisory, revocation, and residual records without real artifacts or supplier data.	Implemented as `python3 scripts/validate_supply_chain_affected_paths.py`: one bounded record and ten expected-invalid mutations; no supply-chain system has run.

26.17 Formalization hooks

Tag	Status	Scope
`lean:ai_supply_chain.unresolved_critical_advisory.quarantines_artifact`	implemented	A finite requested artifact with complete required lineage fields and an unresolved critical advisory routes to quarantine rather than custody review.
`lean:ai_supply_chain.complete_requested_artifact.reaches_custody_review`	implemented	A complete finite requested artifact route reaches custody review without granting load or deployment authority.
`lean:ai_supply_chain.missing_lineage.requires_repair`	implemented	Missing artifact lineage routes to repair.
`lean:ai_supply_chain.missing_component_inventory.requires_review`	implemented	A missing component inventory routes to accountable review.
`lean:ai_supply_chain.missing_revocation_path.requires_repair`	implemented	A missing revocation path routes to lineage repair.
`lean:ai_supply_chain.missing_residual_owner.requires_review`	implemented	A missing residual owner routes to accountable review.

The 34 theorem declarations do not prove that an advisory is accurate, that an artifact is compromised, that inventory is complete, that a signature is genuine, that a supplier is trustworthy, that training data is fit, that a model is safe, or that any release may proceed. They preserve only the modeled route consequences and reachable finite-run invariants when identity, signature, canonical component inventory, independent-review, advisory, revocation, residual-owner, and non-claim fields are already supplied to the transition predicate. The model does not discover or validate those fields, observe a supplier or artifact, or execute quarantine or revocation in a deployed system.

26.18 Source crosswalk

Source	Chapter use	Boundary
`ext_nist_cscrm_2022`	Comparator for lifecycle-wide C-SCRM, supplier/component inventory, risk framing, assessment, response, monitoring, incident communication, and disposal vocabulary.	No local C-SCRM program, supplier assessment, inventory completeness, incident effectiveness, artifact integrity, safety, readiness, authority, or ASI result.
`ext_slsa_build_track_1_2`	Comparator for build provenance, builder/process/input records, verification, signed hosted builds, and graduated assurance limits.	No local SLSA level, provenance statement, secure build platform, reproducible build, artifact correctness, data fitness, safety, readiness, authority, or ASI result.
`ext_openssf_model_signing_spec_2025`	Comparator for signed model/dataset bundles, hashes, provenance metadata, lifecycle verification points, and explicit non-guarantees.	No local signer, verifier, signature, integrity, confidentiality, data fitness, safety, readiness, authority, or ASI result.
`ext_spdx_ai_profile_3_0_1`	Comparator for interoperable AI/model, dataset, build, supplier, provenance, integrity, relationship, and lifecycle BOM metadata.	No local AI BOM, SPDX conformance, complete inventory, artifact security, legal compliance, safety, readiness, authority, or ASI result.
`ext_w3c_prov_o_2013`	Vocabulary comparator for asserted provenance over entities, activities, agents, derivation, attribution, delegation, revision, and invalidation.	No local PROV-O graph or conformance; asserted provenance is not verified truth, completeness, integrity, authority, or safety.
`ext_mlcommons_croissant_1_1_2026`	Dataset-metadata comparator for structured resources, checksums, record fields, provenance, usage conditions, and ML-tool portability.	No local Croissant record or validation; metadata does not establish data integrity, fitness, legality, representativeness, or safe use.
`ext_in_toto_2019`	Primary comparator for owner layouts, functionary link metadata, material/product matching, thresholds, partial key-compromise degradation, and consumer verification.	No local layout or verification; declared-chain success does not establish layout completeness, uncompromised actors, artifact correctness, data/model fitness, or release merit.
`ext_owasp_agentic_top_10_2026`	Supporting taxonomy for agentic supply-chain, identity, tool, memory, code-execution, cascading-failure, and rogue-agent threats.	Taxonomy only; no completeness, local exposure, mitigation, control-efficacy, or safety result.
`cca_project`	Bounded local implementation-reference comparator for typed provenance, append-only supersession/invalidation, pass hashes, trace bundles, source hashes, and closure/lineage discipline.	No local AI BOM, inventory completeness, artifact integrity, supplier trust, signing, verification, revocation, security, compliance, safety, readiness, authority, or ASI result.
`moecot_manifest_project`	Bounded local implementation-reference comparator for provenance packs, SLSA/DSSE-compatible attestations, immutable digests, replay checks, effect logs, obligation bundles, and revocable signed authority records.	No local AI BOM, inventory completeness, artifact integrity, supplier trust, signing/verification effectiveness, revocation effectiveness, security, compliance, safety, readiness, authority, or ASI result.
`corbens_trainer_project`	Bounded local implementation-reference comparator for typed experiment manifests, artifact lineage, content-addressed records, benchmark authenticity, quarantine, claim derivation, and revocable promotion boundaries.	No local AI BOM, complete inventory, supplier trust, signing/verification effectiveness, secure build/training pipeline, transitive revocation, safety, readiness, authority, or ASI result.

The primary sources contribute different evidence families: organizational risk, build provenance, model signing, AI BOMs, asserted provenance, dataset metadata, and signed process layouts. OWASP contributes only threat taxonomy; the three local projects are author-lineage implementation context. They must not be counted as eleven independent confirmations of one control’s efficacy.

26.18.1 Publication placement and preserved technical ownership

In the consolidated publication argument, this chapter is the lineage and dependency dossier nested under Model-Weight Custody and Hardware Roots of Trust. It continues to own relation-specific asset closure, supplier and component identity, signed assertions, advisory and revocation state, affected-path propagation, quarantine, restoration, disclosure, and lifecycle residuals. Custody owns possession, key release, attestation appraisal, plaintext load, copy state, sanitization, and retirement for the model-family asset.

The nesting is editorial, not evidentiary. Provenance can authenticate an assertion without making it true, complete, safe, or authorized; custody can control one known artifact without discovering every dependency or descendant. This URL, its local claim, source mappings, proof targets, test plan, and argument-level support ceiling remain independently reviewable.

26.18.2 Manifest source assignment reconciliation

These rows keep AI Supply-Chain Integrity and Lifecycle Provenance’s manifest assignments visible at their recorded review boundary. Passage review does not establish local reproduction, performance, safety, deployment, or support-state movement.

Source	Intake role	Boundary
`deterministic_capability_compilation`	Passage-reviewed Corben architecture source: Deterministic Capability Compilation: A Capability-Preserving Ladder from Executable Scaffolds to Governed Adaptive Agents. Corben-authored July 2026 architecture and research program for compiling executable scaffolds into contract-bound experts and linked Neural Capability Objects while retaining semantic obligation mass balance, candidate-specific translation validation, fallback, residual escrow, authority ceilings, reification, and effect-complete recovery. Existing chapters are upgraded first; no foundry implementation, learned-capability result, preservation result, safety result, SOTA result, AGI, ASI, or support-state promotion is inferred.	No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
`platonic_world_model`	Metadata-first comparator: The Platonic World Model: A Semantic Constitution for Grounded, Proof-Carrying, Self-Editing Artificial Intelligence. Corben-authored July 2026 conceptual architecture and falsifiable research program for semantic continuity through stable Form lineages, immutable semantic versions, typed Essence Contracts, six mutually constraining planes, explicit proposition-attestation-commitment-proof separation, branch-protected world dynamics, qualified grounding, semantic transactions, runtime packet compilation, and federated mappings. Existing chapters are upgraded first; no implemented substrate, benchmark result, philosophical solution to grounding, safety result, SOTA result, AGI, ASI, or support-state promotion is inferred.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
`ext_proof_of_learning_2021`	Passage-reviewed comparator: Proof-of-Learning: Definitions and Practice. Provides a protocol-level comparator for checking that a claimed training process is tied to an ordered sequence of intermediate states.	A proof-of-learning transcript is not proof of data rights, objective validity, absence of hidden computation, reproducibility, model quality, or safety. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
`ext_c2pa_specification_2_3_2025`	Passage-reviewed comparator: C2PA Content Credentials Technical Specification 2.3. Supplies an interoperable content-provenance and authenticity manifest comparator for signed lifecycle assertions.	Signed provenance can be missing, stripped, misleading, compromised, or truthful about harmful content; it does not prove semantic truth. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.

26.19 Summary

AI supply-chain integrity is a consumer-relative assurance transaction, not a large metadata graph. It binds an exact artifact path to the relations and properties one use requires, keeps assertions separate from verification and observed effects, propagates later events through relation-specific declared closure, and owns quarantine, restoration, compensation, retirement, disclosure, and residual consequences.

Its practical value is accountable change: a stale, disputed, compromised, or materially incomplete predicate reaches a named path and affected consumers cannot remain ordinary by dashboard inertia. Its epistemic value is equally important: unknown edges remain unknown, a favorable predicate supports only its typed consumer, and a successful finite route does not become artifact integrity, supplier truth, data fitness/rights, safety, compliance, or authority.

Its practical value is disciplined refusal: unknown or broken lineage stays visible and blocks only the affected consumer path.

26.20 Evidence reconciliation (2026-07-16)

The invariant protocol, field meanings, and inference limits are stated once in Living Book Methodology. This packet contains only the chapter-specific projection; its authoritative per-atom rows are the ai-supply-chain-integrity-and-lifecycle-provenance slice of experiments/claim_family_terminal_coverage/results/result.json.

The core remains blocked after full attempt at argument support. The strongest family attempt was Safety-critical lifecycle consumer trace. Its exact boundary is: Finite local fixture consumer only; no authentic deployment, general alignment, evaluator independence, or broad security claim. Across 69 atoms, the terminal ledger records 69 blocked_after_full_attempt.

Chapter-specific field	Value
Family / atom denominator	`CF-02` / 69 atoms
Terminal dispositions	69 `blocked_after_full_attempt`
Core	`ai-supply-chain-integrity-and-lifecycle-provenance.core`: `blocked_after_full_attempt` at `argument`
Core attempted / missing lanes	`source-synthesis` / `causal`, `empirical`, `executable`, `formal`, `normative`, `transfer`
Attempted local lanes	`source-synthesis`
Missing or unproved lanes	`causal`, `empirical`, `executable`, `formal`, `normative`, `transfer`
Strongest family bundle	Safety-critical lifecycle consumer trace (`end_to_end`): Ten finite lifecycle receipts spanning bounded effects, denials, residual accounting, and safety-critical state transitions.
Negative controls	five explicit denials with residuals; eight rejecting mutations.
Accepted transitions	none
Maximum inference	Finite local fixture consumer only; no authentic deployment, general alignment, evaluator independence, or broad security claim.
Reproduction / next burden	Replay `scripts/validate_safety_critical_lifecycle_consumer_trace.py` and `scripts/validate_claim_family_terminal_program.py`; fill the named atom-specific lanes under a new prospective protocol.

26.21 Handoff

AI Supply-Chain Integrity and Lifecycle Provenance governs how lifecycle artifacts, relationships, provenance, signatures, advisories, and residuals remain traceable before an artifact path reaches custody or readiness review. Recursive Self-Improvement Boundaries now owns proposed changes that alter those data, code, build, training, model, signer, policy, evaluator, or rollback relationships, and must treat such a change as a governed transition with affected-path re-review rather than a private implementation update.