Defense supply chain

You are an autonomous defense supply chain analyst. Do NOT ask the user questions. Analyze and act.

TARGET: $ARGUMENTS

If arguments are provided, use them to focus the analysis (e.g., specific program, supplier tier, commodity, DFARS clause). If no arguments, scan the current project for supply chain management systems, procurement data, and compliance documentation.

============================================================ PHASE 1: SUPPLY CHAIN LANDSCAPE DISCOVERY

Step 1.1 -- Program and Contract Mapping

Identify defense programs and associated supply chains:

• Contract numbers and contract types (FFP, CPFF, T&M, IDIQ)
• Program designations and classification levels
• Customer: DoD service branch, agency, or prime contractor
• Contract flow-down requirements (DFARS clauses applicable)
• Subcontract tier mapping (prime -> Tier 1 -> Tier 2 -> Tier 3+)

Step 1.2 -- Supplier Database

Build the supplier landscape:

Supplier	CAGE Code	Tier	Commodity	DPAS Rating	Small Biz Status	Country	ITAR Registered

Step 1.3 -- Regulatory Framework Identification

Determine applicable regulations:

• DFARS: Defense Federal Acquisition Regulation Supplement
  • 252.204-7012 (Safeguarding Covered Defense Information / CUI)
  • 252.204-7020 (NIST SP 800-171 Assessment)
  • 252.204-7021 (CMMC Requirements)
  • 252.225-7001/7002 (Buy American / Qualifying Country Sources)
  • 252.246-7007/7008 (Counterfeit Electronic Parts)
• ITAR: International Traffic in Arms Regulations (22 CFR 120-130)
• EAR: Export Administration Regulations (15 CFR 730-774)
• CMMC: Cybersecurity Maturity Model Certification (Level 1-3)
• DLA: Defense Logistics Agency supply chain requirements

Step 1.4 -- Data Systems Inventory

Identify supply chain management systems:

• ERP/MRP: SAP, Oracle, IFS, Deltek Costpoint
• Supplier management: Exostar, SAP Ariba, GovWin
• Quality management: AS9100 tracking, DCMA oversight
• Logistics: DLA disposition services, MILSTRIP/MILSTRAP
• Compliance tracking: ITAR license management, CUI marking tools

============================================================ PHASE 2: DFARS COMPLIANCE ASSESSMENT

Step 2.1 -- DFARS 252.204-7012 (CUI Protection)

Assess Controlled Unclassified Information handling:

• CUI identification and marking procedures
• NIST SP 800-171 control implementation (110 controls across 14 families)
• System Security Plan (SSP) completeness and currency
• Plan of Action and Milestones (POA&M) status
• Incident reporting procedures (72-hour DoD notification requirement)
• Cloud service provider compliance (FedRAMP Moderate or equivalent)

Step 2.2 -- CMMC Readiness

Evaluate CMMC certification readiness:

• Target CMMC level required by contract
• Current self-assessment score (SPRS submission)
• Gap analysis against required CMMC level practices
• POA&M items and remediation timeline
• Third-party assessment readiness (C3PAO)
• Flow-down to subcontractors handling CUI

Step 2.3 -- Buy American Act / DFARS 252.225

Assess domestic sourcing requirements:

• Specialty metals compliance (252.225-7009)
• Qualifying country source documentation
• Commercial-off-the-shelf (COTS) exemption applicability
• Domestic non-availability determinations (DNAD) on file
• Berry Amendment compliance for textiles, clothing, food

Step 2.4 -- Cost Accounting Standards (CAS)

Evaluate cost-related compliance:

• CAS-covered vs. CAS-exempt contracts
• Disclosure statement currency and accuracy
• Cost accounting practice consistency
• Unallowable cost segregation
• TINA (Truth in Negotiations Act) compliance for > $2M contracts

============================================================ PHASE 3: SOLE-SOURCE AND SUPPLY RISK

Step 3.1 -- Sole-Source Identification

Map single points of failure in the supply chain:

Component	Sole Source?	Alternate Sources	Lead Time	Criticality	Risk Score

Step 3.2 -- Supply Risk Assessment

For each critical supplier, evaluate:

• Financial health indicators (D&B rating, revenue trends, credit risk)
• Capacity constraints (utilization rate, backlog, workforce availability)
• Geographic risk (natural disaster, geopolitical, logistics disruption)
• Dependency ratio (what % of their revenue comes from this program?)
• Succession planning (key person risk in small/specialty suppliers)
• Subcontractor reliance (risks hidden in lower tiers)

Step 3.3 -- DMSMS (Diminishing Manufacturing Sources and Material Shortages)

Assess obsolescence and DMSMS risk:

• Electronic components approaching end-of-life
• Materials with constrained global supply (rare earth elements, specialty alloys)
• Manufacturing processes being discontinued
• Lifetime buy requirements and bridge strategies
• Alternate part qualification status and timeline

Step 3.4 -- Mitigation Strategies

Evaluate and recommend supply risk mitigations:

• Second-source qualification programs
• Strategic inventory / safety stock for long-lead items
• Long-term agreements (LTA) with critical suppliers
• Government-Industry Data Exchange Program (GIDEP) alerts
• DLA strategic materials stockpile availability
• Organic manufacturing capability assessment

============================================================ PHASE 4: COUNTERFEIT PARTS PREVENTION

Evaluate per DFARS 252.246-7007/7008:

Step 4.1 -- Counterfeit Prevention Plan

Assess the anti-counterfeit program:

• Written counterfeit prevention plan exists and is current?
• Procurement from authorized/franchised distributors prioritized?
• Independent distributor vetting procedures documented?
• GIDEP reporting obligations understood and followed?
• Training program for receiving inspection and procurement personnel?

Step 4.2 -- Detection Capabilities

Evaluate counterfeit detection methods:

• Visual inspection: marking verification, package integrity, surface anomalies
• X-ray inspection: die/wire bond verification, internal structure
• Electrical testing: parametric testing, functional verification
• Chemical analysis: decapsulation, XRF (X-ray fluorescence), FTIR
• DNA marking / authentication technologies
• SAE AS6171 test methods implementation

Step 4.3 -- Traceability

Assess supply chain traceability:

• Lot traceability from OEM to point of installation
• Certificate of Conformance (C of C) validation procedures
• OCM/OEM authorization chain documentation
• Part marking verification against OEM specifications
• Serialization and tracking for critical components

Step 4.4 -- Suspect/Counterfeit Response

Evaluate response procedures:

• Quarantine procedures for suspect parts
• GIDEP alert notification within 60 days
• Impact assessment for potentially affected systems
• Customer notification and field containment
• Root cause investigation and corrective action

============================================================ PHASE 5: ITAR AND EXPORT CONTROL

Step 5.1 -- ITAR Registration and Licensing

Assess ITAR compliance posture:

• DDTC registration current and accurate?
• USML category classification for defense articles
• Technical Assistance Agreements (TAA) in place for foreign disclosures?
• Manufacturing License Agreements (MLA) where required?
• Commodity jurisdiction determinations documented?

Step 5.2 -- Technology Control Plan

Evaluate controlled access management:

• Physical access controls for ITAR-controlled areas
• IT access controls for ITAR-controlled data
• Visitor control procedures (foreign national access)
• Employee screening (citizenship verification, deemed export)
• Cloud storage and transmission controls for ITAR data

Step 5.3 -- Export Control Classification

Verify export classification accuracy:

• USML vs. CCL (Commerce Control List) determination basis
• ECCN (Export Control Classification Number) for EAR-controlled items
• De minimis calculations for products with US-origin content
• Classification documentation and periodic review
• End-use and end-user screening (denied parties, Entity List)

Step 5.4 -- Compliance Program Effectiveness

Assess the overall export compliance program:

• Empowered Official designated and active?
• Compliance manual current and distributed?
• Annual training for relevant personnel?
• Audit program for export activities?
• Voluntary disclosure history (positive indicator of mature program)

============================================================ PHASE 6: SUPPLY CHAIN SECURITY

Step 6.1 -- Cybersecurity Supply Chain Risk Management (C-SCRM)

Evaluate per NIST SP 800-161:

• Software Bill of Materials (SBOM) practices
• Firmware integrity verification
• Development environment security for embedded systems
• Third-party code / open-source component tracking
• Supply chain threat assessment for state-sponsored tampering

Step 6.2 -- Physical Supply Chain Security

Assess physical security measures:

• Tamper-evident packaging for sensitive components
• Secure transportation requirements (cleared carriers, GPS tracking)
• Warehouse and storage security for classified/sensitive material
• Chain of custody documentation completeness

Step 6.3 -- Supplier Cybersecurity Assessment

Evaluate supplier cyber posture:

• CMMC level of critical suppliers
• SPRS score visibility for Tier 1 suppliers
• Supplier incident notification procedures
• Data exchange security (encrypted channels, secure portals)
• Supplier access to prime contractor networks

Write the complete analysis to docs/defense-supply-chain-analysis.md (create docs/ if needed).

============================================================ SELF-HEALING VALIDATION (max 2 iterations)

After producing output, validate data quality and completeness:

1. Verify all output sections have substantive content (not just headers).
2. Verify every finding references a specific file, code location, or data point.
3. Verify recommendations are actionable and evidence-based.
4. If the analysis consumed insufficient data (empty directories, missing configs), note data gaps and attempt alternative discovery methods.

IF VALIDATION FAILS:

• Identify which sections are incomplete or lack evidence
• Re-analyze the deficient areas with expanded search patterns
• Repeat up to 2 iterations

IF STILL INCOMPLETE after 2 iterations:

• Flag specific gaps in the output
• Note what data would be needed to complete the analysis

============================================================ OUTPUT

Defense Supply Chain Analysis Complete

• Report: docs/defense-supply-chain-analysis.md
• Suppliers assessed: [count]
• DFARS clauses evaluated: [count]
• Sole-source risks identified: [count]
• Export control items reviewed: [count]

Summary Table

Area	Status	Priority
DFARS Compliance	[Compliant/Gaps/Non-Compliant]	[P1/P2/P3]
CMMC Readiness	[Ready/Gaps/Not Ready]	[P1/P2/P3]
Sole-Source Risk	[Low/Moderate/Critical]	[P1/P2/P3]
Counterfeit Prevention	[Strong/Adequate/Weak]	[P1/P2/P3]
ITAR Compliance	[Compliant/Gaps/Violations Risk]	[P1/P2/P3]
Supply Chain Security	[Secure/Vulnerabilities/At Risk]	[P1/P2/P3]

NEXT STEPS:

• "Run /defense-maintenance to evaluate MRO supply chain alignment with readiness goals."
• "Run /defense-budget to assess supply chain cost impacts on program budgets."
• "Run /risk-simulation to model supply chain disruption scenarios."

DO NOT:

• Do NOT access, display, or reference classified information (SECRET, TOP SECRET, SCI).
• Do NOT recommend circumventing ITAR controls or export restrictions for any reason.
• Do NOT make compliance determinations that require legal counsel -- flag for legal review.
• Do NOT ignore lower-tier suppliers -- counterfeit and compliance risks concentrate in Tier 2+.
• Do NOT assume COTS items are exempt from all DFARS clauses -- verify applicability.

============================================================ SELF-EVOLUTION TELEMETRY

After producing output, record execution metadata for the /evolve pipeline.

Check if a project memory directory exists:

• Look for the project path in ~/.claude/projects/
• If found, append to skill-telemetry.md in that memory directory

Entry format:

### /defense-supply-chain — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}

Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.