competition-supply-chain

1# Competition Supply Chain
2 
3Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4 
5Use this skill when the challenge is really about provenance, dependency drift, build output, release flow, or what runtime artifact actually got shipped.
6 
7Reply in Simplified Chinese unless the user explicitly requests English.
8 
9## Quick Start
10 
111. Split the problem into source, dependency resolution, build, packaging, publish, and runtime consumption.
122. Decide where the first divergence occurs between intended artifact and runtime artifact.
133. Keep provenance as a compact chain, not a scattered set of observations.
144. Reproduce the smallest possible build or package path that still shows the issue.
155. Separate checked-in intent from what the pipeline actually emitted.
16 
17## Workflow
18 
19### 1. Trace Provenance End-To-End
20 
21- Map source checkout, lockfiles, dependency fetch, pre/post-install steps, build scripts, packaging, publish target, and runtime consumer.
22- Compare declared version, resolved version, and shipped artifact.
23- Note registry, cache, mirror, or CI environment differences.
24 
25### 2. Reconcile Build-Time And Runtime
26 
27- Compare manifests with image layers, mounted secrets, generated files, and runtime hooks.
28…