coulomb/repo-manager
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: harden work-record and SBOM client contracts

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d
This commit is contained in:
tegwick 2026-08-22 23:19:36 +02:00
parent 2577379e36
commit 84952c5212
16 changed files with 605 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/repository-registers_v0.1.md
View file

@ -74,6 +74,10 @@ SBOM Nexus is the sole scanner and snapshot product owner. Repo Manager retains
these aliases only so existing repository workflows do not break; set
`SBOM_NEXUS_CLI` when `sbom-nexus` is not on `PATH`. Their JSON includes
`product_owner: sbom-nexus` and the Nexus `sbom-nexus.snapshot.v1` schema.
They also carry `repo_manager_context.mode: local-preview` with explicit false
values for authority, persistence, attempt/success advancement, and snapshot
history creation. See `docs/sbom-nexus-client-contract_v1.md` for the pinned
preview and production-service boundary.
Detection covers `uv.lock`, `requirements.txt`, `package-lock.json`,
`yarn.lock`, `Cargo.lock`, `go.sum`, `.terraform.lock.hcl`, Ansible requirements