coulomb/repo-manager
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: finish register receiving and authority routing

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d
This commit is contained in:
tegwick 2026-08-21 23:15:48 +02:00
parent 6d134425df
commit d103955217
28 changed files with 970 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

19
docs/repository-registers_v0.1.md
View file

@ -54,3 +54,22 @@ rmgr register defer --kind technical-debt --entry-id TD-001
Mutations use the same expected-HEAD, idempotency, Git commit, optional
push-seal, normalized-event, reindex, and dual-run-meter mechanism as workplan
and task mutations.
## Derived SBOM inventory
SBOM is the exception to ordinary register mutation: recognised lockfiles and a
reviewed root `sbom-tools.yaml` remain authoritative. Repo Manager derives a
replaceable snapshot and licence/copyleft report without copying State Hub rows
back into a new source-of-truth file.
```bash
rmgr sbom scan --path . --output sbom-snapshot.json
rmgr sbom licence-report --path .
```
Detection covers `uv.lock`, `requirements.txt`, `package-lock.json`,
`yarn.lock`, `Cargo.lock`, `go.sum`, `.terraform.lock.hcl`, Ansible requirements
under `ansible/`, and root `sbom-tools.yaml`. Each source carries a SHA-256 and
the snapshot carries the Git revision and canonical UTC generation timestamp.
An output file is optional evidence, never authority, and is not overwritten
without `--force`.