deliverable D12Shared Control
AI Supply-Chain SBOM Scanner
Shared consumers: All 3 Projects
What it is
AI Supply-Chain SBOM Scanner (shared pipeline consumer). Produce a project manifest covering application dependencies, lockfiles, container image, model/runtime, tokenizer/config, and downloaded artifacts. The shared scanner checks known vulnerabilities, suspicious/misspelled packages, pinning, hashes, provenance, and license/policy metadata.
Build & integration days
4Hardening & final verification days
15- 79Run Project 1 release candidate suiteW14D1D8D11D12R28 R31 R42
- 82Review model/embedding/reranker provenanceW14M1M2D12R11 R12 R37
- 84Run Project 2 release candidate suiteW14D5D6D8D12R14 R15 R28
- 89Create a unified attack taxonomy across projectsW15S1S8D1D2D3D4D5D6D7D8D9D10D11D12R05 R39 R41
- 91Authorization & Isolation Red TeamingW16S0S4M1D2D3D4D5D7D10D11D12R02 R03 R05 R11 R13 R21 R24 R37
- 93Prioritize findings by impact and exploitabilityW16S8S11D8D11D12R31 R42
- 95Drill 1: Compromised Credential / Delegated TokenW16S6M1D7D8D11D12R11 R22 R23 R37
- 100Build a third-party inventoryW17S11M1D12R36 R37 R43 R44
- 101Enterprise Audit & Retention PolicyW17S11M8D8D11D12R27 R31 R38 R42
- 103Revisit the weakest model supply-chain controlW18M1D12R11 R12 R36 R37
- 105Multimodal Conflict HardeningW18M3M4D2D5D12R04 R05 R25 R26 R45
- 108Project 1 Clean-Room RunW18D1D4D5D6D8D10D11D12R01 R04 R05 R09 R13 R14 R15 R28
- 109Run the complete Project 3 agentW19D2D3D7D8D9D11D12R21 R22 R24 R33
- 110Prepare one architecture and threat-model package per projectW19D1D2D3D4D5D6D7D8D9D10D11D12R02 R31 R39
- 111Consolidated Security PortfolioW19S10S12D1D2D3D4D5D6D7D8D9D10D11D12R28 R31 R34 R35 R42
Every day that names D12
19- 15Study embeddings, semantic similarity, chunking, and vector…W3S4M1D12R11 R13
- 16Study model serialization risksW3M1D12R11 R12
- 17Artifact Pinning & Hash GateW3S4M1D12R12 R13 R37 R39
- 49Add container scanning and model-artifact inventory to the…W9M1M8D12R25 R36 R37
- 79Run Project 1 release candidate suiteW14D1D8D11D12R28 R31 R42
- 82Review model/embedding/reranker provenanceW14M1M2D12R11 R12 R37
- 84Run Project 2 release candidate suiteW14D5D6D8D12R14 R15 R28
- 89Create a unified attack taxonomy across projectsW15S1S8D1D2D3D4D5D6D7D8D9D10D11D12R05 R39 R41
- 91Authorization & Isolation Red TeamingW16S0S4M1D2D3D4D5D7D10D11D12R02 R03 R05 R11 R13 R21 R24 R37
- 93Prioritize findings by impact and exploitabilityW16S8S11D8D11D12R31 R42
- 95Drill 1: Compromised Credential / Delegated TokenW16S6M1D7D8D11D12R11 R22 R23 R37
- 100Build a third-party inventoryW17S11M1D12R36 R37 R43 R44
- 101Enterprise Audit & Retention PolicyW17S11M8D8D11D12R27 R31 R38 R42
- 103Revisit the weakest model supply-chain controlW18M1D12R11 R12 R36 R37
- 105Multimodal Conflict HardeningW18M3M4D2D5D12R04 R05 R25 R26 R45
- 108Project 1 Clean-Room RunW18D1D4D5D6D8D10D11D12R01 R04 R05 R09 R13 R14 R15 R28
- 109Run the complete Project 3 agentW19D2D3D7D8D9D11D12R21 R22 R24 R33
- 110Prepare one architecture and threat-model package per projectW19D1D2D3D4D5D6D7D8D9D10D11D12R02 R31 R39
- 111Consolidated Security PortfolioW19S10S12D1D2D3D4D5D6D7D8D9D10D11D12R28 R31 R34 R35 R42