AD-06 · ADR

Software supply chain

Decision: Build once, certify progressively with attestations, scan at defined stages.
Outcome: Prohibited rebuild-per-environment.

Reusable principle

Promotion should advance evidence around one artifact, not create new artifacts.

Published without institution identifiers or exploitable implementation detail, per the portfolio publication rule.