docs(workplans): prepare identifier batch and SBOM client follow-up

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md

@@ -487,6 +487,23 @@ and pre-existing conformance warnings are in
 `docs/evidence/RMGR-WP-0005-batch-0003-markitect-cutover-2026-08-22.md`. T04
 remains in progress for separately sealed and approved fleet batches.
 
+**Batch 0004 prepared (2026-08-22):** `railiance-cluster` is the smallest next
+replacement batch represented in both current projections. Its clean source is
+published and synchronized at `41fdfd9`; the refreshed fleet plan and source
+fingerprint verify without drift. The batch replaces `RCLUSTER-WP-0007` and
+five live task UUIDs. Its two cancelled task UUIDs remain outside the live
+migration plan and follow the replaced parent through the database cascade.
+
+Both projections contain the old six mapped rows and none of the targets. Each
+retains seven child tasks, one decision, and five progress references to mapped
+tasks; workstation and production retain their existing 14 and 12 workplan
+progress events respectively. Every current foreign key into workplans/tasks
+uses `ON UPDATE CASCADE`. The fail-closed batch hash is
+`554c6cbe119e13738efc6e2836254ddae00ea870f1cb99f2b5603336160e308d`.
+`RMGR-DEC-2026-003` is the directly actionable approval interface; no
+identifier mutation has run. Evidence:
+`docs/evidence/RMGR-WP-0005-batch-0004-railiance-cluster-readiness-2026-08-22.md`.
+
 ## Retire the interim rule
 
 ```task

workplans/RMGR-WP-0011-sbom-nexus-production-client.md

@@ -0,0 +1,95 @@
+---
+id: RMGR-WP-0011
+type: workplan
+title: "SBOM Nexus production client and explicit preview semantics"
+domain: infotech
+repo: repo-manager
+status: ready
+owner: codex
+topic_slug: infotech
+created: "2026-08-22"
+updated: "2026-08-22"
+parent_workplan: SBOM-WP-0002
+related:
+  - CUST-WP-0062
+  - RMGR-WP-0008
+---
+
+# SBOM Nexus production client and explicit preview semantics
+
+## Goal
+
+Complete Repo Manager's caller cutover to SBOM Nexus without reintroducing a
+second SBOM product. Repo Manager retains repository identity, active status,
+and checkout-path authority; SBOM Nexus owns `sbom-nexus.snapshot.v1`, ingest
+outcomes, licence evaluation, freshness, and immutable history.
+
+RMGR-WP-0008 already removed Repo Manager's duplicate scanner and changed the
+legacy commands into thin delegates to the Nexus CLI. This workplan addresses
+the remaining production boundary: distinguish a persisted Nexus operation
+from a local, non-authoritative preview and provide a configured service client
+for callers that require authoritative state.
+
+## Pin the consumer contract
+
+```task
+id: RMGR-WP-0011-T01
+status: todo
+priority: high
+```
+
+Document and test the consumed `sbom-nexus.snapshot.v1` fields and the
+authoritative service routes. Treat additive fields as compatible, reject an
+unknown schema, and do not couple Repo Manager to Nexus database tables or
+migration internals.
+
+## Add the authoritative Nexus service client
+
+```task
+id: RMGR-WP-0011-T02
+status: todo
+priority: high
+```
+
+Provide an explicitly configured HTTP client for the Nexus repository
+projection, ingest, latest-snapshot, and licence-report surfaces needed by Repo
+Manager. Preserve bounded timeouts and actionable failures; credentials, when
+introduced through the platform path, must never enter files, output, or logs.
+
+## Make local scanning an explicit preview
+
+```task
+id: RMGR-WP-0011-T03
+status: todo
+priority: high
+```
+
+Keep repository-source scanning usable through the Nexus-owned CLI when the
+service is unavailable, but mark the result unambiguously as local,
+non-authoritative, and not persisted. The compatibility aliases must not imply
+that a preview advanced `last_attempt_at`, `last_success_at`, or snapshot
+history.
+
+## Prove cutover and remove ambiguity
+
+```task
+id: RMGR-WP-0011-T04
+status: todo
+priority: medium
+```
+
+Add contract, failure, and CLI compatibility tests; update operator docs; and
+prove by source inspection that Repo Manager has no scanner implementation,
+snapshot store, freshness evaluation, catch-up policy, or licence classifier.
+Capture the exact production handoff evidence required by SBOM-WP-0002.
+
+## Acceptance
+
+- Authoritative mode talks to SBOM Nexus and returns its pinned snapshot
+  contract without local persistence.
+- Preview mode is visibly non-authoritative and cannot be mistaken for an
+  ingest receipt.
+- Existing `rmgr sbom scan|licence-report` users receive a documented migration
+  path and deterministic errors.
+- Repo Manager remains authoritative only for repository identity and paths;
+  SBOM Nexus remains the sole durable SBOM owner.