refactor: delegate SBOM scans to Nexus

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

docs/evidence/RMGR-WP-0008-sbom-authority-handoff-2026-08-22.md

@@ -0,0 +1,46 @@
+# RMGR-WP-0008 SBOM authority handoff — 2026-08-22
+
+Repo Manager no longer contains or claims an SBOM scanner implementation.
+`src/repo_manager/sbom.py` and its parser-specific tests were removed after the
+production State Hub façade moved read/write authority to SBOM Nexus.
+
+Existing operator commands remain usable as deprecated compatibility aliases:
+
+```text
+rmgr sbom scan --path <checkout> --slug <slug>
+rmgr sbom licence-report --path <checkout> --slug <slug>
+```
+
+Both invoke the `sbom-nexus` executable directly with `shell=False`. The command
+is discovered on `PATH` or supplied through `SBOM_NEXUS_CLI`. Scan JSON now uses
+`sbom-nexus.snapshot.v1` and adds:
+
+```json
+{
+  "delegated_by": "repo-manager",
+  "product_owner": "sbom-nexus"
+}
+```
+
+The `licence-report` alias derives only the legacy report-shaped view from the
+Nexus snapshot response; it contains no parser or licence-evaluation logic.
+Output refusal/`--force` behavior remains in Repo Manager for CLI compatibility.
+
+Verification:
+
+- `uv run ruff check src tests`: passed;
+- complete Repo Manager suite: 87 passed;
+- end-to-end alias using the real Nexus CLI: `ok=true`, Nexus schema,
+  `product_owner=sbom-nexus`, 39 entries, Git revision present, zero errors;
+- source search found no remaining `repo_manager.sbom`,
+  `repo-manager.sbom-snapshot.v1`, `scan_repository`, or `detect_sources`
+  implementation reference outside the new delegation adapter/test names.
+
+The direct command is now documented first:
+
+```text
+sbom-nexus scan . --output sbom-snapshot.json
+```
+
+This preserves operator continuity without leaving competing permanent product
+authority in Repo Manager.

docs/evidence/RMGR-WP-0008-sbom-cutover-2026-08-21.md

@@ -1,5 +1,9 @@
 # RMGR-WP-0008 SBOM receiving and cutover evidence — 2026-08-21
 
+> Superseded ownership note (2026-08-22): this evidence records the interim
+> Repo Manager scanner. SBOM Nexus is now the sole scanner/snapshot product
+> owner; see `RMGR-WP-0008-sbom-authority-handoff-2026-08-22.md`.
+
 Repo Manager now derives an SBOM snapshot from repository-owned lockfiles and
 the reviewed `sbom-tools.yaml` escape hatch. The snapshot includes source path
 and SHA-256 provenance, Git revision, canonical UTC generation time, ecosystem,