coulomb/repo-manager
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
repo-manager/docs/evidence/RMGR-WP-0011-production-client-proof-2026-08-31.md
tegwick d63f8b27e7 docs: close stale repo manager work 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c
2026-08-31 12:14:33 +02:00

1.7 KiB
Raw Blame History

RMGR-WP-0011 production SBOM Nexus client proof

Date: 2026-08-31

The owning coordination workplan CUST-WP-0064 is finished. Production SBOM Nexus is healthy on immutable digest sha256:1da0f4f008643a0dec3f00bbad15f287103aa4b469577b78cfe1d67f8b3cbe31 with migration 0002; controlled forgejo-archive-v1 scans and an unassisted scheduled authoritative snapshot are evidenced by that plan.

Against a temporary operator-only port-forward to the internal Nexus Service, Repo Manager's own command completed successfully:

SBOM_NEXUS_URL=http://127.0.0.1:18010 uv run rmgr sbom source-ref \
  --path . --slug repo-manager --project --confirm-authoritative

It resolved coulomb/repo-manager at exact public Forge revision e8e2747313f1f041062980a962466a7a39daa98d, projected kind: forgejo-archive-v1 with checkout_path: null, and Nexus echoed the structured source reference unchanged. The response was explicitly mode: authoritative-service, authoritative: true, product_owner: sbom-nexus, and writes_state: true.

The same production client read the latest-snapshot and licence-report routes. Both returned the authoritative-service context; the fleet licence report had 19 groups and 4 direct copyleft production findings. Repo Manager's own repository currently has no persisted snapshot (snapshot_id: null, zero entries), which is truthful Nexus state rather than a local preview.

Source inspection finds SBOM behavior only in the bounded Nexus client, controlled source-reference resolver, and deprecated local-preview delegate. Repo Manager contains no scanner, snapshot store, freshness/catch-up policy, or licence classifier. The temporary port-forward was stopped after the proof.