repo-manager/docs/evidence/RMGR-WP-0008-sbom-authority-handoff-2026-08-22.md

RMGR-WP-0008 SBOM authority handoff — 2026-08-22

Repo Manager no longer contains or claims an SBOM scanner implementation. src/repo_manager/sbom.py and its parser-specific tests were removed after the production State Hub façade moved read/write authority to SBOM Nexus.

Existing operator commands remain usable as deprecated compatibility aliases:

rmgr sbom scan --path <checkout> --slug <slug>
rmgr sbom licence-report --path <checkout> --slug <slug>

Both invoke the sbom-nexus executable directly with shell=False. The command is discovered on PATH or supplied through SBOM_NEXUS_CLI. Scan JSON now uses sbom-nexus.snapshot.v1 and adds:

{
  "delegated_by": "repo-manager",
  "product_owner": "sbom-nexus"
}

The licence-report alias derives only the legacy report-shaped view from the Nexus snapshot response; it contains no parser or licence-evaluation logic. Output refusal/--force behavior remains in Repo Manager for CLI compatibility.

Verification:

• uv run ruff check src tests: passed;
• complete Repo Manager suite: 87 passed;
• end-to-end alias using the real Nexus CLI: ok=true, Nexus schema, product_owner=sbom-nexus, 39 entries, Git revision present, zero errors;
• source search found no remaining repo_manager.sbom, repo-manager.sbom-snapshot.v1, scan_repository, or detect_sources implementation reference outside the new delegation adapter/test names.

The direct command is now documented first:

sbom-nexus scan . --output sbom-snapshot.json

This preserves operator continuity without leaving competing permanent product authority in Repo Manager.