A new build-time control model is trying to spot suspicious behavior where software is assembled, not just in the code that eventually ships.