tegwick
5a212525a0
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f
79 lines
3.3 KiB
Markdown
79 lines
3.3 KiB
Markdown
---
|
|
id: ACTIVITY-WP-0034
|
|
type: workplan
|
|
title: "Freeze controlled SBOM source references across retries"
|
|
domain: infotech
|
|
repo: activity-core
|
|
status: active
|
|
owner: codex
|
|
topic_slug: infotech
|
|
created: "2026-08-22"
|
|
updated: "2026-08-23"
|
|
quality_dor: DoR-Ok
|
|
quality_dor_at: "2026-08-22"
|
|
quality_dor_by: codex
|
|
quality_dor_note: "CUST-WP-0064 selected a reviewable full-SHA source_ref contract; Nexus owns fetch/scan, Activity Core retains the existing bounded target and stable operation identity, and rollout waits on the new Nexus/package digest."
|
|
parent_workplan: CUST-WP-0064
|
|
related:
|
|
- SBOM-WP-0003
|
|
- ACTIVITY-WP-0033
|
|
state_hub_workstream_id: "409c06c0-65df-5eaf-8099-9b4e70185f19"
|
|
---
|
|
|
|
# Freeze controlled SBOM source references across retries
|
|
|
|
## Carry the immutable source reference
|
|
|
|
```task
|
|
id: ACTIVITY-WP-0034-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "8d9818f3-c995-5352-8116-f5d4f1ba488b"
|
|
```
|
|
|
|
Validate and retain Nexus's `forgejo-archive-v1` source reference in the
|
|
ranked selection, send it on ingest, reuse it with the existing stable
|
|
operation key, and report additive source failure outcomes without selecting a
|
|
replacement target.
|
|
|
|
Completed in the resolver/apply adapter and daily definition with focused
|
|
tests for normalization, POST payload, retry identity, and terminal reasons.
|
|
|
|
## Promote after the Nexus dark canary
|
|
|
|
```task
|
|
id: ACTIVITY-WP-0034-T02
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "036de401-18de-5a94-8f0d-18d60b64c56a"
|
|
```
|
|
|
|
After `SBOM-WP-0003` and `RAPP-SBOM-NEXUS-WP-0002` migrate and pass the
|
|
attended one-repository canary, project this revision to Railiance, sync the
|
|
existing schedule without widening its limit, and capture the first normal
|
|
scheduled controlled-source result.
|
|
|
|
Production source `01ee87d` contains the source-reference contract. The live
|
|
schedule reconcile upserted `Daily SBOM Catch-up` unchanged at limit 3 with
|
|
zero errors. Repo Manager projected exact references for the current oldest
|
|
three, and an operator-trigger of the existing unpaused Temporal schedule
|
|
processed exactly that frozen set, spawned zero tasks, and produced three
|
|
provenance-bearing `no-manifest` snapshots. `never_count` advanced 94 to 91.
|
|
Keep open for the first unassisted weekday fire and sustainable projection of
|
|
each newly exposed oldest-N batch.
|
|
|
|
Preflight 2026-08-23: after the controlled batch advanced, the newly exposed
|
|
oldest three (`citation-work`, `clay-borg`, `config-atlas`) each carried a
|
|
matching `forgejo-archive-v1` reference and a 40-character revision, confirming
|
|
projection is not limited to the attended batch. The deterministic catch-up
|
|
report now retains only the allowlisted kind/repository/revision fields and a
|
|
`controlled_source_count`, so the first unassisted fire can prove provenance
|
|
directly in State Hub without copying Nexus payloads or archive URLs.
|
|
|
|
Deployed 2026-08-23 from commit `34867d7`; API, worker, and event-router run
|
|
image config `sha256:9c611a394c117c8ccfe2fd813c0dda1943ea8a7444aa4bd4742d83712b2cf559`.
|
|
An in-worker, read-only report probe against the live selection returned
|
|
`selected_count=3` and `controlled_source_count=3` with the exact allowlisted
|
|
references. The existing schedule was not manually fired. Verification before
|
|
deploy: 61 focused tests and 435 repository tests passed, with one live
|
|
integration test skipped.
|