tegwick
d103955217
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d
40 lines
1.8 KiB
Markdown
40 lines
1.8 KiB
Markdown
# RMGR-WP-0008 SBOM receiving and cutover evidence — 2026-08-21
|
|
|
|
Repo Manager now derives an SBOM snapshot from repository-owned lockfiles and
|
|
the reviewed `sbom-tools.yaml` escape hatch. The snapshot includes source path
|
|
and SHA-256 provenance, Git revision, canonical UTC generation time, ecosystem,
|
|
direct/development flags, licence grouping, and direct production copyleft
|
|
findings.
|
|
|
|
## Live projection reconciliation
|
|
|
|
The workstation State Hub held 22 historical snapshots for 18 repositories.
|
|
For migration planning, only the newest snapshot per repository was compared
|
|
with a fresh Repo Manager scan of its registered local path:
|
|
|
|
- 18 repositories scanned; 0 parse failures;
|
|
- 9 entry counts matched exactly;
|
|
- newest State Hub projections totalled 2,659 entries;
|
|
- current authoritative lockfiles produce 1,565 entries.
|
|
|
|
The differing counts are expected evidence of source drift, not rows to copy:
|
|
the stored snapshots date from March through July 2026, while the rescan reads
|
|
the current checked-out lockfiles. Copying the 2,659 cached rows into repository
|
|
records would reverse the authority boundary. Cutover therefore rebuilds each
|
|
repository snapshot from its current lockfiles and retains the old State Hub
|
|
snapshot ids/timestamps as historical provenance until the retirement retention
|
|
gate permits deletion.
|
|
|
|
## Compatibility contract
|
|
|
|
State Hub's retirement adapter calls `rmgr sbom scan --path <repo> --slug
|
|
<slug>` and receives `repo-manager.sbom-snapshot.v1` JSON. Route-level tests
|
|
pin that invocation and response shape. The adapter is read/derive-only: it
|
|
does not commit, push, or mutate a register file.
|
|
|
|
## Verification
|
|
|
|
- `uv run ruff check src tests`
|
|
- focused SBOM and compatibility-adapter tests
|
|
- live `repo-manager` scan: 39 entries, no parse errors, canonical `Z`
|
|
timestamp, Git revision present, and no direct production copyleft finding
|