Close daily SBOM catch-up workplan

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

docs/evidence/ACTIVITY-WP-0030-daily-sbom-catchup-2026-08-22.md

@@ -0,0 +1,56 @@
+# ACTIVITY-WP-0030 daily bounded SBOM catch-up evidence
+
+Date: 2026-08-22
+
+Environment: railiance01, namespace `activity-core`
+
+SBOM authority: `http://sbom-nexus.sbom-nexus.svc.cluster.local:8010`
+
+## Delivered contract
+
+- `GET /sbom/catch-up?limit=3` is the single ranked selection call.
+- `params.apply: true` is an explicit side-effect marker and manual runs require
+  operator confirmation.
+- The response is truncated before writes, so a fire cannot process more than
+  its declared limit.
+- Missing checkouts use the terminal Nexus skip route directly. Ingest failures
+  are recorded as terminal `ingest-error` skips.
+- The definition has no rule block and therefore cannot emit per-repository
+  tasks or Forgejo issues.
+
+The Activity Core implementation commits are `8e8c74b` (bounded executor),
+`91ae8dc` (production service URL), and `c2f797f` (enabled Railiance projection).
+The deployment package commit `94742b6` admits the `activity-core` namespace to
+the otherwise private SBOM Nexus runtime.
+
+## Verification
+
+- Focused implementation suite: 20 passed.
+- Enabled projection suite: 21 passed.
+- SBOM deployment package suite: 5 passed.
+- Live worker read-only probe returned exactly three ranked repositories and
+  confirmed the in-cluster Nexus URL.
+- SBOM Nexus deployment and migration verification remained healthy after the
+  NetworkPolicy change.
+
+## Production fires
+
+| Fire | Activity run | Selected repositories | Outcome | Tasks |
+| --- | --- | --- | --- | ---: |
+| 1 | `82379bc0-7d88-573d-a06f-0ef5fc43cf84` | `adaptive-pricing`, `agent-harness`, `agentic-resources` | 3 `no-checkout` skips | 0 |
+| 2 | `512a8570-2c33-51d6-afd8-5879c85a235d` | `artifact-store`, `audit-core`, `binky-control` | 3 `no-checkout` skips | 0 |
+
+State Hub progress IDs are `a9e8acea-a6e2-4b51-b2ed-f1769403ca73` and
+`f8b59633-692d-447c-8015-4778c9f27fd5`. Each event contains selected and skipped
+repositories, the skip reason, fleet counters, and the Activity Core run ID.
+The second fire selected a different batch; `never_count` moved from 101 to 98,
+proving that recorded skips advance queue fairness without claiming a scan
+success.
+
+## Schedule posture
+
+- `daily-sbom-catchup`: enabled, Temporal schedule active, weekdays at 09:15
+  Europe/Berlin, limit 3.
+- `weekly-sbom-staleness`: disabled, Temporal schedule paused; its last fire was
+  2026-08-17 and it must not be re-enabled.
+- Next normal daily window after enablement: Monday 2026-08-24 at 09:15 Europe/Berlin.

docs/runbook.md

@@ -591,10 +591,14 @@ export FORGEJO_TOKEN=$(bao kv get -field=API_TOKEN platform/workloads/forgejo/fo
 ./tools/cmd/forgejo-package-prune --apply --live-images-file docs/evidence/live-images-all.txt
 ```
 
-`weekly-sbom-staleness` is the canonical rule-only weekly maintenance schedule.
-It runs Mondays at 09:00 Europe/Berlin, resolves State Hub SBOM status for all
-repos, and emits one automated task per stale repo through explicit
-`for_each: context.repos.repos`.
+`weekly-sbom-staleness` is emergency-paused in source and production. Its
+fleet-wide `for_each: context.repos.repos` emitted 75 tasks on 2026-08-17 and
+must not be re-enabled. The bounded replacement is `daily-sbom-catchup`, active
+weekdays at 09:15 Europe/Berlin. It makes one ranked sbom-nexus request,
+processes at most three terminal ingest/skip outcomes, and emits no tasks. Two
+production proof fires on 2026-08-22 processed six distinct repositories as
+documented `no-checkout` skips with zero task spawns; see
+`docs/evidence/ACTIVITY-WP-0030-daily-sbom-catchup-2026-08-22.md`.
 
 `weekly-coding-retro` follows the same cron -> context resolver -> per-repo task
 pattern for coding-session retrospection. It runs Saturdays at 19:00