The Global Centre for Risk and Innovation (GCRI)
Factory is the software factory: where code, models and pipelines are built, tested and released with provenance, so that what runs in production is what was reviewed.
Foundry · Factory · Run R-5748
same inputs, versioned
| R-6269 | High-performance,… | v7.2 | 0.48 | Running |
| R-8658 | Data engineering,… | v9.6 | 0.66 | Drift |
| R-9313 | Geospatial information… | v5.2 | 0.67 | Failed test |
| R-3383 | Artificial… | v4.0 | 0.51 | Passed |
Nexus Foundry · Build workspaceBuild workspace, in outline: domain structure with placeholder names and illustrative values, not a record.
Factory Application Generator is the Nexus Foundry system for blueprints turned into tested, signed application releases. It serves 2 platforms, among them Nexus Labs as well as Advanced Industry and Robotics, and its stated limit is that a release passes tests; it is not a certification. Access is through an authorized project with an accountable owner, data terms and a review plan.
Urban demand centres and the hubs that anchor digital and data infrastructure, shown for the United Kingdom and Ireland as an example geography for this subject.
Analytical software used in decisions must be traceable from source to running artifact. Supply-chain integrity practice (signed builds, bills of materials, reproducible builds) ensures that a release is what its reviewers approved.
| Reference | Relevance |
|---|---|
| NIST SSDF (SP 800-218) | Secure software development practices |
| SLSA | Supply-chain integrity levels |
| SPDX | Software bills of materials |
Access requires an authorized project with an accountable owner, data terms and a review plan. Enquiries go to contact@therisk.global.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Software bill of materials | A machine-readable inventory of the components and dependencies in a piece of software, in formats such as SPDX or CycloneDX. |
| Build provenance | A verifiable record of how and from what sources a software artefact was built. |
| Configuration management | Recording and controlling the versions and settings of every component so the system's state is known. |
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.