From 28696b323898c58c5e3a0b5ca4c944549d595e1c Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 22 Aug 2026 21:06:01 +0200 Subject: [PATCH] Close daily SBOM catch-up workplan Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834 --- ...Y-WP-0030-daily-sbom-catchup-2026-08-22.md | 56 +++++++++++++++++++ docs/runbook.md | 12 ++-- .../ACTIVITY-WP-0030-daily-sbom-catchup.md | 38 +++++++++---- 3 files changed, 92 insertions(+), 14 deletions(-) create mode 100644 docs/evidence/ACTIVITY-WP-0030-daily-sbom-catchup-2026-08-22.md diff --git a/docs/evidence/ACTIVITY-WP-0030-daily-sbom-catchup-2026-08-22.md b/docs/evidence/ACTIVITY-WP-0030-daily-sbom-catchup-2026-08-22.md new file mode 100644 index 0000000..a9bfe51 --- /dev/null +++ b/docs/evidence/ACTIVITY-WP-0030-daily-sbom-catchup-2026-08-22.md @@ -0,0 +1,56 @@ +# ACTIVITY-WP-0030 daily bounded SBOM catch-up evidence + +Date: 2026-08-22 + +Environment: railiance01, namespace `activity-core` + +SBOM authority: `http://sbom-nexus.sbom-nexus.svc.cluster.local:8010` + +## Delivered contract + +- `GET /sbom/catch-up?limit=3` is the single ranked selection call. +- `params.apply: true` is an explicit side-effect marker and manual runs require + operator confirmation. +- The response is truncated before writes, so a fire cannot process more than + its declared limit. +- Missing checkouts use the terminal Nexus skip route directly. Ingest failures + are recorded as terminal `ingest-error` skips. +- The definition has no rule block and therefore cannot emit per-repository + tasks or Forgejo issues. + +The Activity Core implementation commits are `8e8c74b` (bounded executor), +`91ae8dc` (production service URL), and `c2f797f` (enabled Railiance projection). +The deployment package commit `94742b6` admits the `activity-core` namespace to +the otherwise private SBOM Nexus runtime. + +## Verification + +- Focused implementation suite: 20 passed. +- Enabled projection suite: 21 passed. +- SBOM deployment package suite: 5 passed. +- Live worker read-only probe returned exactly three ranked repositories and + confirmed the in-cluster Nexus URL. +- SBOM Nexus deployment and migration verification remained healthy after the + NetworkPolicy change. + +## Production fires + +| Fire | Activity run | Selected repositories | Outcome | Tasks | +| --- | --- | --- | --- | ---: | +| 1 | `82379bc0-7d88-573d-a06f-0ef5fc43cf84` | `adaptive-pricing`, `agent-harness`, `agentic-resources` | 3 `no-checkout` skips | 0 | +| 2 | `512a8570-2c33-51d6-afd8-5879c85a235d` | `artifact-store`, `audit-core`, `binky-control` | 3 `no-checkout` skips | 0 | + +State Hub progress IDs are `a9e8acea-a6e2-4b51-b2ed-f1769403ca73` and +`f8b59633-692d-447c-8015-4778c9f27fd5`. Each event contains selected and skipped +repositories, the skip reason, fleet counters, and the Activity Core run ID. +The second fire selected a different batch; `never_count` moved from 101 to 98, +proving that recorded skips advance queue fairness without claiming a scan +success. + +## Schedule posture + +- `daily-sbom-catchup`: enabled, Temporal schedule active, weekdays at 09:15 + Europe/Berlin, limit 3. +- `weekly-sbom-staleness`: disabled, Temporal schedule paused; its last fire was + 2026-08-17 and it must not be re-enabled. +- Next normal daily window after enablement: Monday 2026-08-24 at 09:15 Europe/Berlin. diff --git a/docs/runbook.md b/docs/runbook.md index 6aae6d2..d24a876 100644 --- a/docs/runbook.md +++ b/docs/runbook.md @@ -591,10 +591,14 @@ export FORGEJO_TOKEN=$(bao kv get -field=API_TOKEN platform/workloads/forgejo/fo ./tools/cmd/forgejo-package-prune --apply --live-images-file docs/evidence/live-images-all.txt ``` -`weekly-sbom-staleness` is the canonical rule-only weekly maintenance schedule. -It runs Mondays at 09:00 Europe/Berlin, resolves State Hub SBOM status for all -repos, and emits one automated task per stale repo through explicit -`for_each: context.repos.repos`. +`weekly-sbom-staleness` is emergency-paused in source and production. Its +fleet-wide `for_each: context.repos.repos` emitted 75 tasks on 2026-08-17 and +must not be re-enabled. The bounded replacement is `daily-sbom-catchup`, active +weekdays at 09:15 Europe/Berlin. It makes one ranked sbom-nexus request, +processes at most three terminal ingest/skip outcomes, and emits no tasks. Two +production proof fires on 2026-08-22 processed six distinct repositories as +documented `no-checkout` skips with zero task spawns; see +`docs/evidence/ACTIVITY-WP-0030-daily-sbom-catchup-2026-08-22.md`. `weekly-coding-retro` follows the same cron -> context resolver -> per-repo task pattern for coding-session retrospection. It runs Saturdays at 19:00 diff --git a/workplans/ACTIVITY-WP-0030-daily-sbom-catchup.md b/workplans/ACTIVITY-WP-0030-daily-sbom-catchup.md index cffa087..1c80eea 100644 --- a/workplans/ACTIVITY-WP-0030-daily-sbom-catchup.md +++ b/workplans/ACTIVITY-WP-0030-daily-sbom-catchup.md @@ -4,11 +4,11 @@ type: workplan title: "Daily bounded SBOM catch-up via sbom-nexus" domain: infotech repo: activity-core -status: active +status: done owner: grok topic_slug: infotech created: "2026-08-18" -updated: "2026-08-21" +updated: "2026-08-22" parent_workplan: CUST-WP-0062 related: - CUST-WP-0062 @@ -96,7 +96,7 @@ there is no live nexus yet and the definition stays `enabled: false`: ```task id: ACTIVITY-WP-0030-T02 -status: wait +status: done priority: high state_hub_task_id: "0d09c0d3-74bd-4f4d-8b27-5006ba010fa3" ``` @@ -108,11 +108,17 @@ in the run artefact and progress event. Do not spawn Forgejo issues (ACTIVITY-WP-0022). Do not retry a recorded skip as if it were still the oldest never-scanned repo. +Done 2026-08-22 after SBOM-WP-0002 delivered the live Nexus contracts. The +resolver truncates before writes, uses explicit `apply: true`, records +`no-checkout` directly, and turns ingest/transport failures into terminal +`ingest-error` skips. Focused coverage proves read-only default behavior, +success, skip, error, and at-most-N processing. + ### Retire weekly task flood ```task id: ACTIVITY-WP-0030-T03 -status: progress +status: done priority: high state_hub_task_id: "18bcfc21-616a-48a2-aac3-cdcef7579913" ``` @@ -124,11 +130,15 @@ if it no longer emits one task per repo. After the daily job is proven on railiance01, update the runbook / playbook and prove one Monday window with zero SBOM task spawns and a successful daily catch-up the same week. +Done 2026-08-22: production inventory shows `weekly-sbom-staleness` disabled +and its Temporal schedule paused while `daily-sbom-catchup` is enabled and +active. Both production proof fires spawned zero tasks. + ### Prod enable and evidence ```task id: ACTIVITY-WP-0030-T04 -status: wait +status: done priority: medium state_hub_task_id: "f09144f6-c7f9-41d4-b466-d8a6288e6a21" ``` @@ -138,10 +148,18 @@ and capture prod evidence via `./scripts/prod_automation_status.sh` plus the `sbom_catchup` progress event. Confirm `tasks_spawned` is 0 and N updates (or documented skips) appear per fire. +Done 2026-08-22. The Railiance ConfigMap projection is enabled with limit 3, +`SBOM_NEXUS_URL` points to the in-cluster service, and the Nexus NetworkPolicy +admits only the declared Activity Core caller in addition to State Hub. Two +manual production fires processed six distinct repositories as terminal +`no-checkout` skips, emitted two `sbom_catchup` progress events, and spawned +zero tasks. See +`docs/evidence/ACTIVITY-WP-0030-daily-sbom-catchup-2026-08-22.md`. + ## Acceptance -- [ ] Daily definition exists; weekly flood is off -- [ ] Evaluation is one sbom-nexus catch-up call -- [ ] Each fire updates at most N repos (default 3) -- [ ] Progress names the repos and skip reasons -- [ ] Railiance01 evidence for at least two successful daily fires +- [x] Daily definition exists; weekly flood is off +- [x] Evaluation is one sbom-nexus catch-up call +- [x] Each fire updates at most N repos (default 3) +- [x] Progress names the repos and skip reasons +- [x] Railiance01 evidence for at least two successful daily fires