coulomb/repo-manager
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
repo-manager/docs/evidence/RMGR-WP-0008-sbom-cutover-2026-08-21.md
tegwick d103955217 feat: finish register receiving and authority routing 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d
2026-08-21 23:15:48 +02:00

1.8 KiB
Raw Blame History

RMGR-WP-0008 SBOM receiving and cutover evidence — 2026-08-21

Repo Manager now derives an SBOM snapshot from repository-owned lockfiles and the reviewed sbom-tools.yaml escape hatch. The snapshot includes source path and SHA-256 provenance, Git revision, canonical UTC generation time, ecosystem, direct/development flags, licence grouping, and direct production copyleft findings.

Live projection reconciliation

The workstation State Hub held 22 historical snapshots for 18 repositories. For migration planning, only the newest snapshot per repository was compared with a fresh Repo Manager scan of its registered local path:

  • 18 repositories scanned; 0 parse failures;
  • 9 entry counts matched exactly;
  • newest State Hub projections totalled 2,659 entries;
  • current authoritative lockfiles produce 1,565 entries.

The differing counts are expected evidence of source drift, not rows to copy: the stored snapshots date from March through July 2026, while the rescan reads the current checked-out lockfiles. Copying the 2,659 cached rows into repository records would reverse the authority boundary. Cutover therefore rebuilds each repository snapshot from its current lockfiles and retains the old State Hub snapshot ids/timestamps as historical provenance until the retirement retention gate permits deletion.

Compatibility contract

State Hub's retirement adapter calls rmgr sbom scan --path <repo> --slug <slug> and receives repo-manager.sbom-snapshot.v1 JSON. Route-level tests pin that invocation and response shape. The adapter is read/derive-only: it does not commit, push, or mutate a register file.

Verification

  • uv run ruff check src tests
  • focused SBOM and compatibility-adapter tests
  • live repo-manager scan: 39 entries, no parse errors, canonical Z timestamp, Git revision present, and no direct production copyleft finding