P3 decision challenge · p3-decision-challenge-v1.0
Supplier Release Decision Assurance
One question. One evidence package. Two rounds. The difference is measured during the session, not asserted.
Synthetic evidence package. Fictional suppliers, identities, releases, lots and VIN populations. No confirmed compromise, and no real manufacturer production, cost or performance figure.
Challenge question
A supplier identity may be compromised. A firmware release created through its accessible build environment is approaching production. Which vehicles and lines require action, what can continue, and where should the pathway be stopped?
Round 1 must answer
- Q1 Is the signal relevant to automotive operations?
- Q2 What trusted pathway is implicated?
- Q3 Which artifact requires verification?
- Q4 What component lots contain it?
- Q5 Which VINs inherit it?
- Q6 What production is approaching exposure?
- Q7 What can be independently cleared?
- Q8 What is the smallest safe action?
- Q9 What remains unproven?
- Q10 Who must decide, and by when?
Evidence package
- Supplier master
- Identity and access
- Build history
- Software releases
- Hashes and signatures
- Component lots
- Shipments
- Physical inventory
- Quality records
- VIN genealogy
- Production schedule
- Historical attack evidence
- Threat signal
- Recovery alternatives
Do not tell participants which records matter. Measure the result without criticising the team — the point is the structural burden of reconciling separate records.