# Supply chain

One governs the complete path from authored meaning and source to tools,
providers, artifacts, releases, and later revocation. Supply-chain trust is a
set of scoped claims, not a single trusted badge.

## Lock every input that can change the result

The exact project lock identifies reachable semantic packages, implementation
packages, source-language tools, mappings, provider catalog evidence, and
other resolved inputs for each root. Build actions additionally lock source
closures, toolchains, targets, configuration, environment, network policy, and
declared secret requirements.

Machine-local bindings and credential values remain outside authored project
meaning. Their owner-qualified revisions enter the applicable plan or action
evidence without being copied into source.

## Admit claims, not brands

A package or tool can claim schemas, language support, provider behavior,
targets, security properties, conformance, compatibility, cost, or lifecycle.
Governed admission validates each claim for its exact revision, configuration,
environment, issuer, freshness, and policy.

First-party and third-party work cross the same boundary. Repository presence,
installation, signature, or a passing happy-path test does not activate a
provider or prove every claim.

## Build from an exact action graph

Build consumes the physical selection without choosing again. Each action
declares inputs, outputs, tools, environment, resource limits, network access,
secrets, hermeticity, cache policy, and expected evidence.

Artifacts retain content identity, complete closure, SBOM, provenance,
signatures, toolchain and target evidence, and the canonical realized Build
report. Artifact bytes alone are not Build evidence.

Generated code, schemas, manifests, Dockerfiles, workflow definitions, and
other operational projections use owner-aligned typed projections. Receipts
record source contracts, profile, exact output, and every loss. Generated
outputs remain disposable caches where their source and receipt are retained.

## Publish through governed ownership

Semantic distributions, language tools, providers, adapters, and artifacts
publish to typed namespaces and catalogs under explicit owner authority.
Publication request, submission, observation, admission, and activation are
separate records.

Consumers select exact revisions through the ordinary project and lock
lifecycle. Registry availability cannot change an already locked root.

## Revoke with bounded impact

A vulnerability, compromised key, invalid conformance result, malicious tool,
or provider defect revokes the exact evidence dimensions it invalidates.
Causal proof edges identify affected packages, locks, actions, artifacts,
releases, bindings, grants, data, and effect windows.

Response can quarantine, revalidate, rotate, rebuild, replan, repair, notify,
or compensate. A revocation does not rewrite what earlier reviewers knew; it
adds new evidence and changes what can be trusted now.

## Example

Illustrative commands retain Build and admission as distinct evidence:

```console
one build --root AcmeShipmentProvider
one plan --root AcmeShipmentPublication
one apply plan:revision:sha256:…
one invoke one.providers#RevokeClaim@1 revoke-claim.json
```

Follow [Sign, admit, publish, and revoke](/one/examples/supply-chain).

Canonical owners:
[Build](https://github.com/muijf/one/blob/main/systems/build/AGENTS.md),
[Providers](https://github.com/muijf/one/blob/main/systems/providers/AGENTS.md),
and [Authority](https://github.com/muijf/one/blob/main/systems/authority/AGENTS.md).