Supply chain
Model supply chain
Nothing serves that was not scanned, described and signed. A model arrives from Hugging Face, NGC, an open-source repo, your own team or an air-gapped mirror, and it has to earn its way to an endpoint.
- Ingest
Pull from any source, trusted or not
Hugging Face, NVIDIA NGC, open-source repos, customer-supplied weights and air-gapped mirrors all land in the same intake zone. The origin is recorded, not trusted.
Ingestintake.pull src=hf://meta-llama/Llama-3.1-8B bytes=16.1G sha256:9f2c…a417
- Malware scan
Every file checked before it is unpacked
Every object in the artifact is scanned for malware. Anything suspicious is quarantined and the intake fails closed. There is no partial promotion.
Malware scanscan.malware objects=412 infected=0 verdict=CLEAN
- Serialization
Unsafe pickles and known CVEs
Checkpoint analysis catches pickle opcodes that can run arbitrary code, and dependency scanning raises CVEs against the packaged runtime. Safetensors are preferred; pickle is blocked by policy.
Serializationscan.serialize format=safetensors pickle_opcodes=0 cve[high]=0 PASS
- ML-BOM
A bill of materials for the model itself
Kronos generates the ML-BOM: weights, base model, datasets, licences and dependencies. The scan results attach to it as an in-toto attestation, so the evidence travels with the artifact.
ML-BOMmlbom.build components=138 datasets=3 licence=llama-3.1 attest=in-toto/v0.1
- Sign
Sigstore and Cosign, keyless
The artifact and its ML-BOM are signed with a workload identity and logged to a transparency log. From here, any consumer can verify provenance without holding a key.
Signsign.cosign identity=fulcio-oidc rekor=#884126 SIGNED
- Register
MLflow and Harbor, with lineage
The model gets a versioned registry entry with lineage back to its source, datasets and training run. Registration is a catalogue action, not an approval.
Registerregistry.put mlflow://models/llama-3.1-8b/v7 stage=candidate
- Promotion gate
OPA decides. Signed and scanned only.
The one hard boundary in this band. An OPA policy admits only artifacts that are signed, scanned and carry an ML-BOM. Everything else stops here with a written reason.
Promotion gateopa.eval policy=kronos.promote.v3 signed=true scanned=true allow
- Serve
KServe, with guardrails already attached
The endpoint comes up with its runtime guardrails bound at creation. A model can't be served without its runtime policy.
Servekserve.deploy isvc/llama-31-8b gpu=A100 MIG 3g.40gb ×2 state=READY