activity-core/workplans/ACTIVITY-WP-0034-sbom-controlled-source-reference.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	quality_dor	quality_dor_at	quality_dor_by	quality_dor_note	parent_workplan	related	state_hub_workstream_id
ACTIVITY-WP-0034	workplan	Freeze controlled SBOM source references across retries	infotech	activity-core	active	codex	infotech	2026-08-22	2026-08-23	DoR-Ok	2026-08-22	codex	CUST-WP-0064 selected a reviewable full-SHA source_ref contract; Nexus owns fetch/scan, Activity Core retains the existing bounded target and stable operation identity, and rollout waits on the new Nexus/package digest.	CUST-WP-0064	SBOM-WP-0003 ACTIVITY-WP-0033	409c06c0-65df-5eaf-8099-9b4e70185f19

Freeze controlled SBOM source references across retries

Carry the immutable source reference

id: ACTIVITY-WP-0034-T01
status: done
priority: high
state_hub_task_id: "8d9818f3-c995-5352-8116-f5d4f1ba488b"

Validate and retain Nexus's forgejo-archive-v1 source reference in the ranked selection, send it on ingest, reuse it with the existing stable operation key, and report additive source failure outcomes without selecting a replacement target.

Completed in the resolver/apply adapter and daily definition with focused tests for normalization, POST payload, retry identity, and terminal reasons.

Promote after the Nexus dark canary

id: ACTIVITY-WP-0034-T02
status: progress
priority: high
state_hub_task_id: "036de401-18de-5a94-8f0d-18d60b64c56a"

After SBOM-WP-0003 and RAPP-SBOM-NEXUS-WP-0002 migrate and pass the attended one-repository canary, project this revision to Railiance, sync the existing schedule without widening its limit, and capture the first normal scheduled controlled-source result.

Production source 01ee87d contains the source-reference contract. The live schedule reconcile upserted Daily SBOM Catch-up unchanged at limit 3 with zero errors. Repo Manager projected exact references for the current oldest three, and an operator-trigger of the existing unpaused Temporal schedule processed exactly that frozen set, spawned zero tasks, and produced three provenance-bearing no-manifest snapshots. never_count advanced 94 to 91. Keep open for the first unassisted weekday fire and sustainable projection of each newly exposed oldest-N batch.

Preflight 2026-08-23: after the controlled batch advanced, the newly exposed oldest three (citation-work, clay-borg, config-atlas) each carried a matching forgejo-archive-v1 reference and a 40-character revision, confirming projection is not limited to the attended batch. The deterministic catch-up report now retains only the allowlisted kind/repository/revision fields and a controlled_source_count, so the first unassisted fire can prove provenance directly in State Hub without copying Nexus payloads or archive URLs.