docs(10_Wiki): Topic_Business/General/Graphic/Programming을 Topics/ 하위로 이동
최상위 10_Wiki/Topic_*였던 4개 카테고리 폴더를 10_Wiki/Topics/Topic_* 로 재배치. 콘텐츠 변경 없음(순수 폴더 이동) — Topics/ 하위 나머지 폴더는 이미 지난 커밋에서 전부 정리된 상태(잔존 항목은 에이전트 운영 상태 및 사용자가 보존을 요청한 업데이트0615/무제 3.canvas 뿐).
This commit is contained in:
Antigravity Agent
@@ -0,0 +1,198 @@
|
||||
---
|
||||
id: wiki-2026-0508-supply-chain
|
||||
title: Supply Chain
|
||||
category: 10_Wiki/Topics
|
||||
status: verified
|
||||
canonical_id: self
|
||||
aliases: [SCM, Supply Chain Management, 공급망]
|
||||
duplicate_of: none
|
||||
source_trust_level: A
|
||||
confidence_score: 0.9
|
||||
verification_status: applied
|
||||
tags: [supply-chain, logistics, security, sbom, ai-optimization]
|
||||
raw_sources: []
|
||||
last_reinforced: 2026-05-10
|
||||
github_commit: pending
|
||||
tech_stack:
|
||||
language: python
|
||||
framework: ortools
|
||||
---
|
||||
|
||||
# Supply Chain
|
||||
|
||||
## 매 한 줄
|
||||
> **"매 supply chain 의 end-to-end network — raw material부터 end customer까지의 flow"**. 매 2026 supply chain 의 두 축: AI-driven optimization (demand forecast, route, inventory) 와 security (SBOM, supply chain attack defense). 매 SolarWinds·xz-utils 사건 이후 software supply chain 의 first-class 보안 concern.
|
||||
|
||||
## 매 핵심
|
||||
|
||||
### 매 5 components
|
||||
- **Plan**: demand forecast, capacity planning, S&OP.
|
||||
- **Source**: supplier selection, contract, procurement.
|
||||
- **Make**: production, quality, scheduling.
|
||||
- **Deliver**: warehousing, transportation, last-mile.
|
||||
- **Return**: reverse logistics, recycling, RMA.
|
||||
|
||||
### 매 AI 적용 영역
|
||||
- **Demand forecasting**: Transformer-based time series (TimesFM, Chronos), LSTM 의 retire.
|
||||
- **Route optimization**: OR-Tools VRP + RL hybrid.
|
||||
- **Inventory**: (s,S) policy + safety stock dynamic adjustment.
|
||||
- **Anomaly detection**: shipment delay prediction, fraud.
|
||||
- **Supplier risk**: graph neural network on supplier dependency graph.
|
||||
|
||||
### 매 software supply chain security
|
||||
- **SBOM** (Software Bill of Materials): SPDX, CycloneDX format.
|
||||
- **Sigstore**: keyless signing, transparency log.
|
||||
- **SLSA** (Supply-chain Levels for Software Artifacts): level 1-4 framework.
|
||||
- **Attack surface**: dependency confusion, typosquatting, malicious maintainer.
|
||||
|
||||
### 매 응용
|
||||
1. **E-commerce**: Amazon FBA — AI demand forecast → DC pre-positioning.
|
||||
2. **Manufacturing**: Toyota JIT 의 AI evolve — predictive lead time.
|
||||
3. **Software security**: GitHub Dependabot + Sigstore + SLSA Level 3.
|
||||
|
||||
## 💻 패턴
|
||||
|
||||
### 1. Demand forecast (Chronos)
|
||||
```python
|
||||
from chronos import ChronosPipeline
|
||||
import torch
|
||||
import pandas as pd
|
||||
|
||||
pipe = ChronosPipeline.from_pretrained(
|
||||
"amazon/chronos-bolt-base", torch_dtype=torch.bfloat16
|
||||
)
|
||||
|
||||
# historical daily sales
|
||||
ts = pd.read_csv("sales.csv")["units"].values
|
||||
context = torch.tensor(ts[-365:])
|
||||
|
||||
forecast = pipe.predict(context, prediction_length=30, num_samples=100)
|
||||
median = forecast.median(dim=1).values # 30-day median forecast
|
||||
p90 = forecast.quantile(0.9, dim=1) # safety stock upper bound
|
||||
```
|
||||
|
||||
### 2. VRP (Vehicle Routing Problem)
|
||||
```python
|
||||
from ortools.constraint_solver import pywrapcp, routing_enums_pb2
|
||||
|
||||
def solve_vrp(distance_matrix, num_vehicles, depot):
|
||||
manager = pywrapcp.RoutingIndexManager(
|
||||
len(distance_matrix), num_vehicles, depot
|
||||
)
|
||||
routing = pywrapcp.RoutingModel(manager)
|
||||
|
||||
def dist_cb(i, j):
|
||||
return distance_matrix[manager.IndexToNode(i)][manager.IndexToNode(j)]
|
||||
|
||||
transit_idx = routing.RegisterTransitCallback(dist_cb)
|
||||
routing.SetArcCostEvaluatorOfAllVehicles(transit_idx)
|
||||
|
||||
params = pywrapcp.DefaultRoutingSearchParameters()
|
||||
params.first_solution_strategy = routing_enums_pb2.FirstSolutionStrategy.PATH_CHEAPEST_ARC
|
||||
return routing.SolveWithParameters(params)
|
||||
```
|
||||
|
||||
### 3. (s,S) inventory policy
|
||||
```python
|
||||
import numpy as np
|
||||
|
||||
def reorder(stock, s, S, demand_forecast, lead_time_days):
|
||||
# s = reorder point, S = order-up-to level
|
||||
expected_demand_during_lead = demand_forecast.mean() * lead_time_days
|
||||
safety = 1.65 * demand_forecast.std() * np.sqrt(lead_time_days)
|
||||
s_dynamic = expected_demand_during_lead + safety
|
||||
if stock <= s_dynamic:
|
||||
return S - stock
|
||||
return 0
|
||||
```
|
||||
|
||||
### 4. SBOM generation (CycloneDX)
|
||||
```bash
|
||||
# Python project
|
||||
pip install cyclonedx-bom
|
||||
cyclonedx-py -o sbom.json --format json
|
||||
|
||||
# Node project
|
||||
npx @cyclonedx/cyclonedx-npm --output-file sbom.json
|
||||
|
||||
# Container
|
||||
syft packages docker:myimage:latest -o cyclonedx-json > sbom.json
|
||||
```
|
||||
|
||||
### 5. Sigstore keyless signing
|
||||
```bash
|
||||
# Sign artifact (uses OIDC identity, no long-lived keys)
|
||||
cosign sign-blob --yes ./release.tar.gz \
|
||||
--output-signature release.sig \
|
||||
--output-certificate release.crt
|
||||
|
||||
# Verify
|
||||
cosign verify-blob ./release.tar.gz \
|
||||
--signature release.sig \
|
||||
--certificate release.crt \
|
||||
--certificate-identity user@example.com \
|
||||
--certificate-oidc-issuer https://github.com/login/oauth
|
||||
```
|
||||
|
||||
### 6. SLSA provenance (GitHub Actions)
|
||||
```yaml
|
||||
name: build
|
||||
on: [push]
|
||||
permissions:
|
||||
id-token: write
|
||||
contents: read
|
||||
jobs:
|
||||
build:
|
||||
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
|
||||
with:
|
||||
base64-subjects: ${{ needs.hash.outputs.digests }}
|
||||
```
|
||||
|
||||
### 7. Supplier risk GNN
|
||||
```python
|
||||
import torch
|
||||
from torch_geometric.nn import GraphSAGE
|
||||
|
||||
# nodes = suppliers, edges = dependency
|
||||
model = GraphSAGE(in_channels=16, hidden_channels=64,
|
||||
num_layers=3, out_channels=2) # risk score
|
||||
|
||||
# message passing: tier-1 supplier 의 risk → tier-2 propagation
|
||||
risk_scores = model(node_features, edge_index)
|
||||
```
|
||||
|
||||
## 매 결정 기준
|
||||
| 상황 | Approach |
|
||||
|---|---|
|
||||
| Demand forecast (long horizon) | Chronos / TimesFM |
|
||||
| Route opt (small, hard) | OR-Tools exact |
|
||||
| Route opt (large, soft) | RL + heuristic |
|
||||
| SBOM | CycloneDX (broader) or SPDX |
|
||||
| Signing | Sigstore (keyless, modern) |
|
||||
|
||||
**기본값**: Chronos forecast + OR-Tools VRP + CycloneDX SBOM + Sigstore.
|
||||
|
||||
## 🔗 Graph
|
||||
- 부모: [[Operations-Research]]
|
||||
- 변형: [[SBOM]] · [[SLSA]] · [[Sigstore]]
|
||||
|
||||
## 🤖 LLM 활용
|
||||
**언제**: Demand pattern 의 explain, anomaly 의 root-cause analysis, SBOM 의 vulnerability summary.
|
||||
**언제 X**: Real-time route decision (latency), exact optimization (LLM 의 hallucinate cost).
|
||||
|
||||
## ❌ 안티패턴
|
||||
- **Forecast 없는 inventory**: 매 lead time × demand 의 rough-cut estimate → stockout 의 cycle.
|
||||
- **SBOM 의 build 후 generation**: 매 reproducibility 의 lose. Build 시 generate.
|
||||
- **Long-lived signing keys**: 매 leak 의 catastrophic. Sigstore keyless 의 use.
|
||||
- **Dependency 의 pin without lock**: 매 supply-chain attack vector. lockfile + hash check.
|
||||
- **Tier-1 supplier 의 only monitor**: 매 cascade failure 의 ignore. Multi-tier visibility.
|
||||
|
||||
## 🧪 검증 / 중복
|
||||
- Verified (CSCMP definitions, NIST SSDF SP800-218, SLSA spec v1.0).
|
||||
- 신뢰도 A.
|
||||
|
||||
## 🕓 Changelog
|
||||
| 날짜 | 변경 |
|
||||
|---|---|
|
||||
| 2026-05-08 | Phase 1 |
|
||||
| 2026-05-10 | Manual cleanup — supply chain (logistics + software security) full canonical |
|
||||
Reference in New Issue
Block a user