# RMGR-WP-0008 SBOM receiving and cutover evidence — 2026-08-21

Repo Manager now derives an SBOM snapshot from repository-owned lockfiles and
the reviewed `sbom-tools.yaml` escape hatch. The snapshot includes source path
and SHA-256 provenance, Git revision, canonical UTC generation time, ecosystem,
direct/development flags, licence grouping, and direct production copyleft
findings.

## Live projection reconciliation

The workstation State Hub held 22 historical snapshots for 18 repositories.
For migration planning, only the newest snapshot per repository was compared
with a fresh Repo Manager scan of its registered local path:

- 18 repositories scanned; 0 parse failures;
- 9 entry counts matched exactly;
- newest State Hub projections totalled 2,659 entries;
- current authoritative lockfiles produce 1,565 entries.

The differing counts are expected evidence of source drift, not rows to copy:
the stored snapshots date from March through July 2026, while the rescan reads
the current checked-out lockfiles. Copying the 2,659 cached rows into repository
records would reverse the authority boundary. Cutover therefore rebuilds each
repository snapshot from its current lockfiles and retains the old State Hub
snapshot ids/timestamps as historical provenance until the retirement retention
gate permits deletion.

## Compatibility contract

State Hub's retirement adapter calls `rmgr sbom scan --path <repo> --slug
<slug>` and receives `repo-manager.sbom-snapshot.v1` JSON. Route-level tests
pin that invocation and response shape. The adapter is read/derive-only: it
does not commit, push, or mutate a register file.

## Verification

- `uv run ruff check src tests`
- focused SBOM and compatibility-adapter tests
- live `repo-manager` scan: 39 entries, no parse errors, canonical `Z`
  timestamp, Git revision present, and no direct production copyleft finding