# RMGR-WP-0011 production SBOM Nexus client proof

Date: 2026-08-31

The owning coordination workplan `CUST-WP-0064` is finished. Production SBOM
Nexus is healthy on immutable digest
`sha256:1da0f4f008643a0dec3f00bbad15f287103aa4b469577b78cfe1d67f8b3cbe31`
with migration `0002`; controlled `forgejo-archive-v1` scans and an unassisted
scheduled authoritative snapshot are evidenced by that plan.

Against a temporary operator-only port-forward to the internal Nexus Service,
Repo Manager's own command completed successfully:

```text
SBOM_NEXUS_URL=http://127.0.0.1:18010 uv run rmgr sbom source-ref \
  --path . --slug repo-manager --project --confirm-authoritative
```

It resolved `coulomb/repo-manager` at exact public Forge revision
`e8e2747313f1f041062980a962466a7a39daa98d`, projected
`kind: forgejo-archive-v1` with `checkout_path: null`, and Nexus echoed the
structured source reference unchanged. The response was explicitly
`mode: authoritative-service`, `authoritative: true`,
`product_owner: sbom-nexus`, and `writes_state: true`.

The same production client read the latest-snapshot and licence-report routes.
Both returned the authoritative-service context; the fleet licence report had
19 groups and 4 direct copyleft production findings. Repo Manager's own
repository currently has no persisted snapshot (`snapshot_id: null`, zero
entries), which is truthful Nexus state rather than a local preview.

Source inspection finds SBOM behavior only in the bounded Nexus client,
controlled source-reference resolver, and deprecated local-preview delegate.
Repo Manager contains no scanner, snapshot store, freshness/catch-up policy, or
licence classifier. The temporary port-forward was stopped after the proof.