# RMGR-WP-0008 SBOM authority handoff — 2026-08-22

Repo Manager no longer contains or claims an SBOM scanner implementation.
`src/repo_manager/sbom.py` and its parser-specific tests were removed after the
production State Hub façade moved read/write authority to SBOM Nexus.

Existing operator commands remain usable as deprecated compatibility aliases:

```text
rmgr sbom scan --path <checkout> --slug <slug>
rmgr sbom licence-report --path <checkout> --slug <slug>
```

Both invoke the `sbom-nexus` executable directly with `shell=False`. The command
is discovered on `PATH` or supplied through `SBOM_NEXUS_CLI`. Scan JSON now uses
`sbom-nexus.snapshot.v1` and adds:

```json
{
  "delegated_by": "repo-manager",
  "product_owner": "sbom-nexus"
}
```

The `licence-report` alias derives only the legacy report-shaped view from the
Nexus snapshot response; it contains no parser or licence-evaluation logic.
Output refusal/`--force` behavior remains in Repo Manager for CLI compatibility.

Verification:

- `uv run ruff check src tests`: passed;
- complete Repo Manager suite: 87 passed;
- end-to-end alias using the real Nexus CLI: `ok=true`, Nexus schema,
  `product_owner=sbom-nexus`, 39 entries, Git revision present, zero errors;
- source search found no remaining `repo_manager.sbom`,
  `repo-manager.sbom-snapshot.v1`, `scan_repository`, or `detect_sources`
  implementation reference outside the new delegation adapter/test names.

The direct command is now documented first:

```text
sbom-nexus scan . --output sbom-snapshot.json
```

This preserves operator continuity without leaving competing permanent product
authority in Repo Manager.