{
  "format": "agent-article-v0",
  "article_id": "EA-104",
  "canonical_url": "/tools/ea-104-ai-supply-chain-security",
  "page_type": "reference",
  "claim_ids": [],
  "evidence_ids": [
    "EVD-EA-104-URL-BFAC836A083D",
    "EVD-EA-104-URL-3382974F730F",
    "EVD-EA-104-URL-9719D15362F8",
    "EA-104-R11-RESEARCH",
    "EA-104-R11-WEB-READBACK"
  ],
  "unknown_ids": [
    "EA-104-UNKNOWN-01",
    "EA-104-UNKNOWN-CURRENTNESS"
  ],
  "operational_object_ids": [],
  "provider": [],
  "models": [],
  "plans": [],
  "surfaces": [],
  "regions": [],
  "current_status": "UNKNOWN",
  "observation_status": "SPEC_ONLY",
  "freshness": "UNKNOWN",
  "last_verified": null,
  "supersedes": [],
  "superseded_by": [],
  "provenance": [
    "COMM-039-EA0104",
    "SRC-EA-104-URL-BFAC836A083D",
    "SRC-EA-104-URL-3382974F730F",
    "SRC-EA-104-URL-9719D15362F8",
    "WEBBODY-EA0104-R8-B3BA4A49"
  ],
  "article_sources": [
    {
      "id": "EVD-EA-104-URL-BFAC836A083D",
      "evidence_class": "RESEARCH",
      "title": "1) source class: supply-chain specification; exact title: SLSA specification; author/org: SLSA / OpenSSF ecosystem; canonical URL:",
      "href": "https://slsa.dev/spec/v1.2/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-104-URL-BFAC836A083D"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "1) source class: supply-chain specification; exact title: SLSA specification; author/org: SLSA / OpenSSF ecosystem; canonical URL: https://slsa.dev/spec/v1.2/"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-104-URL-3382974F730F",
      "evidence_class": "RESEARCH",
      "title": "2) source class: government secure-development framework; exact title: Secure Software Development Framework (SSDF) Version 1.1; author/org: NIST, Murugiah Souppaya, Karen Scarfone",
      "href": "https://csrc.nist.gov/pubs/sp/800/218/final",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-104-URL-3382974F730F"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "2) source class: government secure-development framework; exact title: Secure Software Development Framework (SSDF) Version 1.1; author/org: NIST, Murugiah Souppaya, Karen Scarfone, Donna Dodson; canonical URL: https://csrc.nist.gov/pubs/sp/800/218/final"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-104-URL-9719D15362F8",
      "evidence_class": "RESEARCH",
      "title": "3) source class: author-maintained OSS implementation; exact title: OpenSSF Scorecard; author/org: OpenSSF; canonical URL:",
      "href": "https://github.com/ossf/scorecard",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-104-URL-9719D15362F8"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "3) source class: author-maintained OSS implementation; exact title: OpenSSF Scorecard; author/org: OpenSSF; canonical URL: https://github.com/ossf/scorecard"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EA-104-R11-RESEARCH",
      "evidence_class": "RESEARCH",
      "title": "EA-104 監査済みresearch / canonical revision binding",
      "supports": [
        "SLSAはprovenance/attestationと段階的なsecurity guaranteeを表現し、SSDFはsecure software developmentの推奨枠組み、ScorecardはOSS repositoryの具体的check群を提供する。AI supply chainではsource→build→artifact→distribution→runtimeを別証跡にし、model weights/MCP/Skillにも同じ出所・hash・署名・権限審査を適用するのが妥当。ただしこれは設計推論であり、3資料がAI固有の安全を保証するわけではない。"
      ],
      "limit": "canonical監査・revision bindingの存在を示す。外部ソースcurrentnessが本文またはcontrol-planeで確定していない場合は、currentnessをUNKNOWNのまま保持する。",
      "origin_class": "AUDITED_CANONICAL_RESEARCH_PACKET",
      "source_or_experiment_ids": [
        "COMM-039-EA0104"
      ],
      "supporting_locators": [
        "COMM-039-EA0104",
        "EA-104-R5-LEGACY-MIGRATION-20261008-R1",
        "content/staging/EA-104.md"
      ],
      "scope": "監査済みEA本文・canonical revision・既存Source Graph relationの範囲。欠損currentnessは推測で閉じない。",
      "provenance_status": "AUDIT_PASS_CANONICAL_BINDING"
    },
    {
      "id": "EA-104-R11-WEB-READBACK",
      "evidence_class": "IMPL",
      "title": "EA-104 Web body identity / canonical readback",
      "supports": [
        "canonical staging bodyのSHA-256一致とR9 canonical ledger readbackをProduction projectionの入力として検証する。"
      ],
      "limit": "body identity/readbackは本文claim自体の真偽や外部ソースの最新性を追加保証しない。",
      "checked_at": null,
      "origin_class": "IMPLEMENTATION_READBACK",
      "source_or_experiment_ids": [
        "WEBBODY-EA0104-R8-B3BA4A49"
      ],
      "supporting_locators": [
        "WEBBODY-EA0104-R8-B3BA4A49",
        "content/staging/EA-104.md",
        "EA-104-R5-LEGACY-MIGRATION-20261008-R1"
      ],
      "scope": "R9/R10 canonical readback後のProduction生成時body identity。",
      "provenance_status": "CANONICAL_READBACK_BODY_HASH_MATCH"
    }
  ],
  "research_sections": [
    {
      "heading": "WHY_THIS_MATTERS_TO_UPDATE",
      "text": "model、package、container、MCP server、Skillの供給網を「OSSだから安全」「registry掲載だから承認済み」と扱うと、改ざん・出所・依存関係・実行権限の差を落とす。"
    },
    {
      "heading": "SCOPE_ROUTING",
      "text": "Enterprise AI Core / supply-chain security / OSS practice / audit"
    },
    {
      "heading": "CLAIM_OR_RESEARCH_QUESTION",
      "text": "SLSA、NIST SSDF、OpenSSF Scorecardは、AI artifact供給網で何を証明し、何を証明しないか。"
    },
    {
      "heading": "EVIDENCE TABLE",
      "text": "1) source class: supply-chain specification; exact title: SLSA specification; author/org: SLSA / OpenSSF ecosystem; canonical URL: https://slsa.dev/spec/v1.2/; publication/update/access: accessed 2026-09-13; version/release: SLSA v1.2; supporting locator: lines 52, 69-76, 92-101（levels/tracks、artifact traceability、provenance、verification、attestation formats）; evidence label: VERIFIED_SPEC; relation: support / limit。\n2) source class: government secure-development framework; exact title: Secure Software Development Framework (SSDF) Version 1.1; author/org: NIST, Murugiah Souppaya, Karen Scarfone, Donna Dodson; canonical URL: https://csrc.nist.gov/pubs/sp/800/218/final; publication/update/access: 2022-02 / accessed 2026-09-13; version/release: SP 800-218 v1.1; supporting locator: lines 64-74（title, date, authors）; evidence label: VERIFIED_SPEC; relation: support / context。\n3) source class: author-maintained OSS implementation; exact title: OpenSSF Scorecard; author/org: OpenSSF; canonical URL: https://github.com/ossf/scorecard; publication/update/access: current repository accessed 2026-09-13; version/release: repository checks; supporting locator: README lines 598-625（checks）、656-665（weighted aggregate score）; evidence label: OSS_PRACTICE + PRODUCT_VOLATILE; relation: support / limit。"
    },
    {
      "heading": "FINDINGS",
      "text": "SLSAはprovenance/attestationと段階的なsecurity guaranteeを表現し、SSDFはsecure software developmentの推奨枠組み、ScorecardはOSS repositoryの具体的check群を提供する。AI supply chainではsource→build→artifact→distribution→runtimeを別証跡にし、model weights/MCP/Skillにも同じ出所・hash・署名・権限審査を適用するのが妥当。ただしこれは設計推論であり、3資料がAI固有の安全を保証するわけではない。"
    },
    {
      "heading": "LIMITS / COUNTEREVIDENCE / FAILURE ENVELOPE",
      "text": "SLSA provenanceは出所/ビルド性質の証拠で、artifactが無害・高品質とは限らない。Scorecardのscoreは対象repo・実行時点・check設定依存で、全version/全deploymentへ一般化できない。"
    },
    {
      "heading": "AVAILABILITY_GATES",
      "text": "artifact type、source repository、release/tag/commit、digest、builder、provenance、signature/certificate、license、vulnerability、runtime permissions、MCP/Skill tool scope。"
    },
    {
      "heading": "IMPLEMENTATION_STATE",
      "text": "実装状態: allowlist、digest pin、provenance verification、SBOM/license/vulnerability reviewを受入ガード候補として確立。実artifactの検証は未実施。"
    },
    {
      "heading": "BENCHMARK_OR_EVAL",
      "text": "Evaluation: 無認証のfixture repository/artifactで、digest変更、署名不一致、dependency drift、危険なworkflowを検出するTEST_PROFILEを設計。実運用registry変更はしない。"
    },
    {
      "heading": "SECURITY / PRIVACY / AUDIT / COST / OPERABILITY",
      "text": "SECURITY/AUDIT: provenanceとreview resultをartifact IDに紐付け。PRIVACY: model/skill metadataの秘匿範囲を区別。COST: signing/build verificationの工数は未計測。OPERABILITY: allow/deny/exceptionとexpiryを記録。"
    },
    {
      "heading": "SAFE_WORDING_FOR_FUTURE_BOOK",
      "text": "「SLSAはprovenanceとattestationの表現・検証を支えるが、artifactの安全性や品質を単独では保証しない。OpenSSF Scorecardは対象OSS repositoryの時点別check結果であり、全展開の保証ではない。」"
    },
    {
      "heading": "UPDATE_WORK_HANDOFF",
      "text": "本文は供給網をmodel/package/container/MCP/Skillごとに、source・digest・build provenance・signature・license・runtime permissionの列へ分解する。"
    },
    {
      "heading": "OPEN_UNKNOWN",
      "text": "model weight provenance、MCP/Skillの標準的署名・失効、private registry mirror、GPU/containerの実測chain、provider hosted modelの証明範囲。"
    },
    {
      "heading": "STOP_CONDITION",
      "text": "registry掲載、latest、scoreだけで受入承認しない。\nUNIT_CLOSE_STATUS: INDIVIDUAL_BOUNDED_CLOSE / EVIDENCE_RECORDED / UNKNOWN_PRESERVED\n\n---"
    },
    {
      "heading": "AUDITED_CURRENTNESS_BOUNDARY",
      "text": "SLSA v1.2 remains current approved spec; NIST SSDF and OpenSSF Scorecard are distinct evidence classes and Scorecard is not an artifact-safety certificate."
    }
  ],
  "human_url": "/tools/ea-104-ai-supply-chain-security",
  "markdown_url": "/agent/article.md?path=%2Ftools%2Fea-104-ai-supply-chain-security",
  "json_url": "/agent/article.json?path=%2Ftools%2Fea-104-ai-supply-chain-security"
}