supply-chain-binary-provenance

Use when designing CI/CD or deployment controls, artifact signing, or insider-threat defenses, or when asked how to know the production binary matches reviewed code. Deployment must cryptographically verify binary provenance, not rely on social code review.