reverse-skills-max: initial public release (restored, redacted, hardened)

reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-supply-chain/references/supply-chain.md

@@ -0,0 +1,26 @@
+# Supply Chain And CI Checklist
+
+## Provenance Chain
+
+Track this order explicitly:
+
+1. Source checkout
+2. Dependency declaration
+3. Lockfile or resolver result
+4. Build step
+5. Packaging or signing step
+6. Publish target
+7. Runtime consumer
+
+## High-Value Evidence
+
+- Version drift between source, lockfile, and fetched artifact
+- Registry or mirror pulls that differ from expected origin
+- Build scripts with preinstall, prepare, postinstall, or codegen steps
+- Signed or packaged artifact hash compared to runtime-loaded artifact
+
+## Common Pitfalls
+
+- Stopping at lockfile drift without proving runtime consumption
+- Treating checked-in manifests as equivalent to live pipeline behavior
+- Losing the earliest divergence point inside a wall of CI logs