coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
activity-core/workplans/ACTIVITY-WP-0034-sbom-controlled-source-reference.md
repo-manager caed3d2ab9
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
chore(registrar): assign State Hub identifiers 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b22-9638-76d2-bbff-b7ea1770b118
2026-08-23 00:02:10 +02:00

1.7 KiB
Raw Blame History

id type title domain repo status owner topic_slug created updated quality_dor quality_dor_at quality_dor_by quality_dor_note parent_workplan related state_hub_workstream_id
ACTIVITY-WP-0034 workplan Freeze controlled SBOM source references across retries infotech activity-core active codex infotech 2026-08-22 2026-08-22 DoR-Ok 2026-08-22 codex CUST-WP-0064 selected a reviewable full-SHA source_ref contract; Nexus owns fetch/scan, Activity Core retains the existing bounded target and stable operation identity, and rollout waits on the new Nexus/package digest. CUST-WP-0064
SBOM-WP-0003
ACTIVITY-WP-0033
409c06c0-65df-5eaf-8099-9b4e70185f19

Freeze controlled SBOM source references across retries

Carry the immutable source reference

id: ACTIVITY-WP-0034-T01
status: done
priority: high
state_hub_task_id: "8d9818f3-c995-5352-8116-f5d4f1ba488b"

Validate and retain Nexus's forgejo-archive-v1 source reference in the ranked selection, send it on ingest, reuse it with the existing stable operation key, and report additive source failure outcomes without selecting a replacement target.

Completed in the resolver/apply adapter and daily definition with focused tests for normalization, POST payload, retry identity, and terminal reasons.

Promote after the Nexus dark canary

id: ACTIVITY-WP-0034-T02
status: wait
priority: high
state_hub_task_id: "036de401-18de-5a94-8f0d-18d60b64c56a"

After SBOM-WP-0003 and RAPP-SBOM-NEXUS-WP-0002 migrate and pass the attended one-repository canary, project this revision to Railiance, sync the existing schedule without widening its limit, and capture the first normal scheduled controlled-source result.