Model Artifact Lifecycle Audit

---
name: model-artifact-lifecycle-audit
description: "Audits how model artifacts are accepted, validated, stored, selected, loaded, executed, monitored, and retired. Use when reviewing model registries, loaders, CI/CD pipelines, scanner-to-runtime gaps, or ML supply-chain controls."
metadata:
  portability: universal
  discipline: blue-team
  domain: ai-systems
  tags: [models, artifacts, supply-chain, registries, mlops]
---

# Model artifact lifecycle audit

Trace a model artifact from intake through retirement. The audit focuses on
control and evidence gaps between scanners, registries, selectors, loaders,
runtimes, and downstream consumers; it does not build weaponized models.

## When to Use

- Reviewing model upload, registry, promotion, deployment, or retirement paths.
- Auditing artifact formats, scanners, signatures, provenance, loader behavior,
  CI/CD jobs, scheduled pipelines, or workload identity.
- Investigating whether an accepted artifact could reach a more privileged
  execution context than the intake controls imply.

## When NOT to Use

- Do not create malicious model artifacts or provide payload-building steps.
- Do not load an untrusted artifact to prove a control gap unless a separate,
  isolated validation is explicitly authorized.
- Do not treat a clean scanner result as proof of safe runtime behavior.

## Lifecycle states

Track each state independently: `submitted`, `accepted`, `validated`, `stored`,
`registered`, `selected`, `promoted`, `loaded`, `executed`, `served`,
`monitored`, `revoked`, `deleted`, and `residually-present`. A receipt for one
state does not prove the next.

## Workflow

1. Define the systems, artifact classes, environments, identities, business
   owners, evidence window, and audit boundaries.
2. Inventory every accepted artifact format and packaging layer, including
   archives, configuration, tokenizer or processor files, custom code,
   dependencies, conversion outputs, and generated caches.
3. Map producers, intake endpoints, validators, scanners, registries, object
   stores, promotion gates, selectors, deployment systems, loaders, runtimes,
   serving endpoints, and downstream consumers.
4. Record the identity and privilege at each transition. Include human,
   workload, CI/CD, scheduled-job, registry, and runtime identities.
5. Trace integrity controls: origin, digest, signature, attestation, dependency
   lock, policy decision, quarantine, immutability, approval, and revocation.
6. Compare validator semantics with loader semantics. Identify content the
   loader interprets but the scanner ignores, transformations that invalidate a
   prior decision, and defaults that enable custom or executable behavior.
7. Review selection and activation separately. A stored artifact is not loaded;
   a selected artifact is not executed; a served model does not prove which
   digest is active without runtime evidence.
8. Examine automated consumers. Determine whether CI, evaluation, conversion,
   optimization, deployment, or scheduled jobs load artifacts under identities
   or network access stronger than the submitter's.
9. Check monitoring and response: exact artifact identity in logs, promotion and
   load events, policy failures, anomalous runtime behavior, revocation
   propagation, rollback, deletion, cache eviction, and residual copies.
10. For every gap, state the weakest lifecycle claim supported, affected trust
    transition, plausible consequence, missing evidence, and safe remediation.

## Deliverable

Return the artifact and format inventory, lifecycle and identity map, control
matrix, scanner-versus-loader comparison, automation and privilege findings,
state-specific evidence gaps, revocation and cleanup assessment, and prioritized
remediation. Keep unexecuted hypotheses labeled as hypotheses.

## Rationalizations to reject

- **“The registry accepted it, so the model is approved.”** Intake, validation,
  promotion, and activation are different states.
- **“The scanner supports the format.”** Coverage depends on which fields and
  embedded components the scanner interprets compared with the loader.
- **“The digest matches, so the artifact is safe.”** Integrity proves identity,
  not trustworthiness.
- **“Custom code is disabled by default.”** Verify the effective loader and
  deployment configuration at the actual execution boundary.
- **“The model never reaches production.”** Evaluation and conversion workers
  may hold stronger identity or network access than production serving.
- **“Deletion from the registry removes it.”** Object stores, caches, converted
  artifacts, running workloads, and replicas may persist.