docs: close stale repo manager work
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c
This commit is contained in:
parent
a2c9d7fbeb
commit
d63f8b27e7
7 changed files with 126 additions and 18 deletions
|
|
@ -18,7 +18,7 @@
|
|||
| workplan | RMGR-WP-0008 | finished | — | workplans/RMGR-WP-0008-work-record-and-register-receiving-surface.md |
|
||||
| workplan | RMGR-WP-0009 | finished | — | workplans/RMGR-WP-0009-coding-assistant-commit-provenance.md |
|
||||
| workplan | RMGR-WP-0010 | finished | — | workplans/RMGR-WP-0010-authoritative-workload-references.md |
|
||||
| workplan | RMGR-WP-0011 | active | — | workplans/RMGR-WP-0011-sbom-nexus-production-client.md |
|
||||
| workplan | RMGR-WP-0011 | finished | — | workplans/RMGR-WP-0011-sbom-nexus-production-client.md |
|
||||
| workplan | RMGR-WP-0012 | finished | — | workplans/RMGR-WP-0012-fast-work-record-mutation-and-projection.md |
|
||||
| task | RMGR-WP-0001-T01 | done | — | workplans/RMGR-WP-0001-foundation.md |
|
||||
| task | RMGR-WP-0001-T02 | done | — | workplans/RMGR-WP-0001-foundation.md |
|
||||
|
|
@ -45,17 +45,17 @@
|
|||
| task | RMGR-WP-0004-T08 | done | — | workplans/RMGR-WP-0004-repository-standards-conformance.md |
|
||||
| task | RMGR-WP-0004-T09 | done | — | workplans/RMGR-WP-0004-repository-standards-conformance.md |
|
||||
| task | RMGR-WP-0005-T01 | done | — | workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md |
|
||||
| task | RMGR-WP-0005-T02 | wait | — | workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md |
|
||||
| task | RMGR-WP-0005-T02 | cancel | — | workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md |
|
||||
| task | RMGR-WP-0005-T03 | done | — | workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md |
|
||||
| task | RMGR-WP-0005-T04 | progress | — | workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md |
|
||||
| task | RMGR-WP-0005-T05 | wait | — | workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md |
|
||||
| task | RMGR-WP-0005-T06 | done | — | workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md |
|
||||
| task | RMGR-WP-0005-T07 | progress | — | workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md |
|
||||
| task | RMGR-WP-0005-T07 | done | — | workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md |
|
||||
| task | RMGR-WP-0005-T08 | done | — | workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md |
|
||||
| task | RMGR-WP-0005-T09 | done | — | workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md |
|
||||
| task | RMGR-WP-0005-T10 | done | — | workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md |
|
||||
| task | RMGR-WP-0005-T11 | done | — | workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md |
|
||||
| task | RMGR-WP-0005-T12 | wait | — | workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md |
|
||||
| task | RMGR-WP-0005-T12 | cancel | — | workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md |
|
||||
| task | RMGR-WP-0006-T01 | done | — | workplans/RMGR-WP-0006-railiance-app-wrapper-setup.md |
|
||||
| task | RMGR-WP-0006-T02 | done | — | workplans/RMGR-WP-0006-railiance-app-wrapper-setup.md |
|
||||
| task | RMGR-WP-0006-T03 | done | — | workplans/RMGR-WP-0006-railiance-app-wrapper-setup.md |
|
||||
|
|
@ -92,7 +92,7 @@
|
|||
| task | RMGR-WP-0011-T01 | done | — | workplans/RMGR-WP-0011-sbom-nexus-production-client.md |
|
||||
| task | RMGR-WP-0011-T02 | done | — | workplans/RMGR-WP-0011-sbom-nexus-production-client.md |
|
||||
| task | RMGR-WP-0011-T03 | done | — | workplans/RMGR-WP-0011-sbom-nexus-production-client.md |
|
||||
| task | RMGR-WP-0011-T04 | progress | — | workplans/RMGR-WP-0011-sbom-nexus-production-client.md |
|
||||
| task | RMGR-WP-0011-T04 | done | — | workplans/RMGR-WP-0011-sbom-nexus-production-client.md |
|
||||
| task | RMGR-WP-0012-T01 | done | — | workplans/RMGR-WP-0012-fast-work-record-mutation-and-projection.md |
|
||||
| task | RMGR-WP-0012-T02 | done | — | workplans/RMGR-WP-0012-fast-work-record-mutation-and-projection.md |
|
||||
| task | RMGR-WP-0012-T03 | done | — | workplans/RMGR-WP-0012-fast-work-record-mutation-and-projection.md |
|
||||
|
|
|
|||
|
|
@ -0,0 +1,28 @@
|
|||
# RMGR-WP-0005 cache and hub-native centralization evidence
|
||||
|
||||
Date: 2026-08-31
|
||||
|
||||
The workstation no longer runs a State Hub API. `127.0.0.1:8000` is the
|
||||
operator's SSH relay to the sole `railliance01` primary, whose health reports
|
||||
`instance_role: primary`, `instance_label: railiance01`, and a current schema.
|
||||
The retired production sweep remains disabled and has no checkout or SSH
|
||||
hostPath mount.
|
||||
|
||||
Repo Manager's advisory file cache was rebuilt from the current checkout at
|
||||
commit `e8e2747313f1f041062980a962466a7a39daa98d`. It contains 96 records,
|
||||
reports `stale: false`, and its indexed/current source fingerprint is
|
||||
`b9cee3bce4ca7d1a28cadb5f9204774a0451a6456efbc3d02f9e556a27b8d6b9`.
|
||||
|
||||
The earlier workstation database had recorded 35 progress events linked to
|
||||
`RMGR-WP-0005` and 13 messages to/from `repo-manager`, while the then-primary
|
||||
had 2 and 0. On 2026-08-31 the central primary contains 10 linked progress
|
||||
events and one direct Repo Manager message. A read-only query of the remaining
|
||||
local PostgreSQL service found an empty replacement database: zero matching
|
||||
progress events and zero matching messages. The old local-only rows therefore
|
||||
cannot now be migrated; the infrastructure cutover has dispositioned them as
|
||||
discarded cache history. Their counts and the material implementation outcomes
|
||||
remain in the 2026-08-22 evidence and this workplan.
|
||||
|
||||
This is a limitation, not a reconstructed-history claim. New hub-native writes
|
||||
have one owner, the central primary; local work remains file-first and the
|
||||
advisory cache is disposable/rebuildable.
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
# RMGR-WP-0011 production SBOM Nexus client proof
|
||||
|
||||
Date: 2026-08-31
|
||||
|
||||
The owning coordination workplan `CUST-WP-0064` is finished. Production SBOM
|
||||
Nexus is healthy on immutable digest
|
||||
`sha256:1da0f4f008643a0dec3f00bbad15f287103aa4b469577b78cfe1d67f8b3cbe31`
|
||||
with migration `0002`; controlled `forgejo-archive-v1` scans and an unassisted
|
||||
scheduled authoritative snapshot are evidenced by that plan.
|
||||
|
||||
Against a temporary operator-only port-forward to the internal Nexus Service,
|
||||
Repo Manager's own command completed successfully:
|
||||
|
||||
```text
|
||||
SBOM_NEXUS_URL=http://127.0.0.1:18010 uv run rmgr sbom source-ref \
|
||||
--path . --slug repo-manager --project --confirm-authoritative
|
||||
```
|
||||
|
||||
It resolved `coulomb/repo-manager` at exact public Forge revision
|
||||
`e8e2747313f1f041062980a962466a7a39daa98d`, projected
|
||||
`kind: forgejo-archive-v1` with `checkout_path: null`, and Nexus echoed the
|
||||
structured source reference unchanged. The response was explicitly
|
||||
`mode: authoritative-service`, `authoritative: true`,
|
||||
`product_owner: sbom-nexus`, and `writes_state: true`.
|
||||
|
||||
The same production client read the latest-snapshot and licence-report routes.
|
||||
Both returned the authoritative-service context; the fleet licence report had
|
||||
19 groups and 4 direct copyleft production findings. Repo Manager's own
|
||||
repository currently has no persisted snapshot (`snapshot_id: null`, zero
|
||||
entries), which is truthful Nexus state rather than a local preview.
|
||||
|
||||
Source inspection finds SBOM behavior only in the bounded Nexus client,
|
||||
controlled source-reference resolver, and deprecated local-preview delegate.
|
||||
Repo Manager contains no scanner, snapshot store, freshness/catch-up policy, or
|
||||
licence classifier. The temporary port-forward was stopped after the proof.
|
||||
|
|
@ -219,8 +219,10 @@ def _check_git(repo: Path) -> tuple[dict[str, Any], str | None]:
|
|||
if blocking:
|
||||
return (
|
||||
{"dirty": dirty, "ignored_generated": generated},
|
||||
"worktree must be clean before registrar reconciliation; "
|
||||
f"blocking: {', '.join(blocking)}",
|
||||
(
|
||||
"worktree must be clean before registrar reconciliation; "
|
||||
f"blocking: {', '.join(blocking)}"
|
||||
),
|
||||
)
|
||||
|
||||
upstream = _git(repo, "rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}")
|
||||
|
|
|
|||
|
|
@ -784,7 +784,9 @@ class TestWorkplanBindings:
|
|||
lambda url, json=None, timeout=None: (sent.update(b=json["bindings"]), R())[1],
|
||||
)
|
||||
rr._sync_workplan_bindings(repo, "http://hub", "demo")
|
||||
legacy = [b for b in sent["b"] if b["workplan_id"].startswith("44444444")][0]
|
||||
legacy = next(
|
||||
b for b in sent["b"] if b["workplan_id"].startswith("44444444")
|
||||
)
|
||||
assert legacy["status"] is None
|
||||
|
||||
def test_binding_failure_never_fails_registration(self, tmp_path, monkeypatch):
|
||||
|
|
|
|||
|
|
@ -236,7 +236,7 @@ credential path that does not mount an operator home or private-key directory.
|
|||
|
||||
```task
|
||||
id: RMGR-WP-0005-T12
|
||||
status: wait
|
||||
status: cancel
|
||||
priority: high
|
||||
state_hub_task_id: "0d69713d-0596-5415-b40c-8f5035641541"
|
||||
```
|
||||
|
|
@ -251,11 +251,17 @@ Coordinate credential custody with the platform owner and keep the schedule
|
|||
disabled until positive allowed-repository and negative unrelated-repository
|
||||
push evidence exist without exposing credential values.
|
||||
|
||||
**Cancelled 2026-08-31.** The host-wide sweep is retired, not awaiting
|
||||
re-enablement. Production continues with `sweep.enabled: false`, no checkout
|
||||
hostPath, and no operator SSH mount. A future scoped sweep would be a new
|
||||
capability with its own workplan and credential route; keeping a conditional
|
||||
task open here incorrectly implies the retired design is on the critical path.
|
||||
|
||||
## Re-register identifiers minted outside the registrar
|
||||
|
||||
```task
|
||||
id: RMGR-WP-0005-T02
|
||||
status: wait
|
||||
status: cancel
|
||||
priority: medium
|
||||
state_hub_task_id: "7892ca86-bd89-537e-9361-d648dff8e4b2"
|
||||
```
|
||||
|
|
@ -329,6 +335,13 @@ and pushed Custodian revision `d792318`. The full historical identity report
|
|||
remained in evidence while `blocking_invalid_identifiers` and
|
||||
`blocking_identity_collisions` were both empty, proving the intended boundary.
|
||||
|
||||
**Superseded 2026-08-31.** T03 and T04 replaced hand re-registration as the
|
||||
governed convergence path. The fresh fleet plan covers every eligible live
|
||||
record as `replace`, `assign`, or `unchanged`; closed pre-derivation UUIDs stay
|
||||
frozen historical evidence. No remaining record should be repaired through the
|
||||
old registrar-minting procedure, so this task is cancelled rather than left in
|
||||
permanent conditional wait.
|
||||
|
||||
## Derive identifiers deterministically
|
||||
|
||||
```task
|
||||
|
|
@ -669,7 +682,7 @@ byte-identical writeback, and neither creates a duplicate record.
|
|||
|
||||
```task
|
||||
id: RMGR-WP-0005-T07
|
||||
status: progress
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "e3c2a791-f632-59f3-9929-b179e45c77d0"
|
||||
```
|
||||
|
|
@ -732,6 +745,17 @@ repeat comparison passes. Evidence and the non-destructive procedure are in
|
|||
`docs/evidence/RMGR-WP-0005-isolated-rebuild-2026-08-22.md` and
|
||||
`docs/cache-rebuild_v1.md`.
|
||||
|
||||
**Done with explicit disposition 2026-08-31.** The workstation State Hub API is
|
||||
gone; its loopback address is now a relay to the sole `railliance01` primary.
|
||||
Repo Manager's advisory cache rebuilt 96 current records at commit `e8e2747`
|
||||
and immediately reported fresh with matching source fingerprints. The old
|
||||
local-only hub-native rows were not migrated before the local database was
|
||||
replaced: the current local PostgreSQL database contains zero matching progress
|
||||
events or messages. They are therefore dispositioned as discarded cache
|
||||
history, not claimed as reconstructed. Central now exclusively owns new
|
||||
hub-native writes. Exact counts and the limitation are retained in
|
||||
`docs/evidence/RMGR-WP-0005-cache-centralization-2026-08-31.md`.
|
||||
|
||||
## Separate file-derived from hub-native data
|
||||
|
||||
```task
|
||||
|
|
|
|||
|
|
@ -4,12 +4,19 @@ type: workplan
|
|||
title: "SBOM Nexus production client and explicit preview semantics"
|
||||
domain: infotech
|
||||
repo: repo-manager
|
||||
status: active
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: infotech
|
||||
quality_dor: DoR-Ok
|
||||
created: "2026-08-22"
|
||||
updated: "2026-08-22"
|
||||
updated: "2026-08-31"
|
||||
quality_dod: DoD-Ok
|
||||
quality_dod_at: "2026-08-31"
|
||||
quality_dod_by: codex
|
||||
quality_dod_note: >-
|
||||
Contract, failure semantics, explicit preview mode, controlled source
|
||||
projection, and live authoritative Nexus reads are evidenced; durable SBOM
|
||||
ownership remains solely with SBOM Nexus.
|
||||
parent_workplan: SBOM-WP-0002
|
||||
related:
|
||||
- CUST-WP-0062
|
||||
|
|
@ -109,7 +116,7 @@ contract tests carry the same semantics.
|
|||
|
||||
```task
|
||||
id: RMGR-WP-0011-T04
|
||||
status: progress
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "81fed060-3431-5d9b-819b-fcc7d629c364"
|
||||
```
|
||||
|
|
@ -143,13 +150,23 @@ pre-contract service cannot silently discard it. Live read-only proof resolved
|
|||
`refs/heads/main`. Remaining T04 work is the Nexus/package/Activity Core
|
||||
implementation and attended production proof owned through `CUST-WP-0064`.
|
||||
|
||||
**Done 2026-08-31.** `CUST-WP-0064` is finished and production Nexus is
|
||||
healthy on the controlled-source implementation. Repo Manager's own
|
||||
`source-ref --project --confirm-authoritative` command resolved the exact
|
||||
Forgejo `main` revision, projected it with `checkout_path: null`, and received
|
||||
the identical source reference from Nexus. Its production client also consumed
|
||||
the latest-snapshot and licence-report routes with explicit
|
||||
`authoritative-service` context. Source inspection confirms Repo Manager holds
|
||||
no scanner, snapshot store, freshness/catch-up policy, or licence classifier.
|
||||
Evidence: `docs/evidence/RMGR-WP-0011-production-client-proof-2026-08-31.md`.
|
||||
|
||||
## Acceptance
|
||||
|
||||
- Authoritative mode talks to SBOM Nexus and returns its pinned snapshot
|
||||
- [x] Authoritative mode talks to SBOM Nexus and returns its pinned snapshot
|
||||
contract without local persistence.
|
||||
- Preview mode is visibly non-authoritative and cannot be mistaken for an
|
||||
- [x] Preview mode is visibly non-authoritative and cannot be mistaken for an
|
||||
ingest receipt.
|
||||
- Existing `rmgr sbom scan|licence-report` users receive a documented migration
|
||||
- [x] Existing `rmgr sbom scan|licence-report` users receive a documented migration
|
||||
path and deterministic errors.
|
||||
- Repo Manager remains authoritative only for repository identity and paths;
|
||||
- [x] Repo Manager remains authoritative only for repository identity and paths;
|
||||
SBOM Nexus remains the sole durable SBOM owner.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue