sbom-nexus/workplans/SBOM-WP-0002-production-cutover.md

---
id: SBOM-WP-0002
type: workplan
title: "Deploy and cut over SBOM Nexus production authority"
domain: infotech
repo: sbom-nexus
status: finished
owner: codex
topic_slug: infotech
created: "2026-08-22"
updated: "2026-08-22"
quality_dor: DoR-Ok
quality_dor_at: "2026-08-22"
quality_dor_by: codex
quality_dor_note: "Goal, ownership boundaries, staged dependencies, production safety gates, reconciliation evidence, rollback paths, and cross-repository handoffs were reviewed against the implemented Nexus contract and current State Hub history."
quality_dod: DoD-Ok
quality_dod_at: "2026-08-22"
quality_dod_by: codex
quality_dod_note: "Production authority, migration reconciliation, reversible caller cutovers, scanner handoff, bounded automation, retention decision, clean verification, evidence, and owner-directed retirement were reviewed. The scheduled Monday observation was explicitly waived rather than claimed; legacy history remains retained and no destructive cleanup was performed."
parent_workplan: CUST-WP-0062
related:
  - SBOM-WP-0001
  - CUST-WP-0062
  - ACTIVITY-WP-0030
  - STATE-WP-0079
  - RMGR-WP-0008
state_hub_workstream_id: "7729a4bd-c1c4-50b9-a3b6-1faa51fff97d"
---

# Deploy and cut over SBOM Nexus production authority

## Goal

Deploy SBOM Nexus with managed PostgreSQL, import and reconcile State Hub
history, move callers through reversible compatibility stages, and prove the
bounded daily catch-up before retiring State Hub SBOM ownership.

## Deploy dark with managed PostgreSQL

```task
id: SBOM-WP-0002-T01
status: done
priority: high
state_hub_task_id: "95a520d4-30c2-5c87-8054-6bfe549c2686"
```

Provision database credentials through the governed route, migrate schema,
deploy the API without callers, and capture health plus backup/restore evidence.
Image publication, package rendering, family validation, and server-side dry-run
are complete; see
`docs/evidence/SBOM-WP-0002-T01-dark-deployment-preflight-2026-08-22.md`.
The overflow cell initially failed closed on an S3 `HeadBucket` 403. The
database owner repaired that path under `RAPP-POSTGRES-WP-0005`; no caller was
enabled while the gate was open.

Completed with the private runtime healthy on PostgreSQL at migration head,
dynamic runtime/migration credentials synchronized, a successful governed
backup, 51-second scratch restore, runtime DDL denial, and immutable image
verification. See
`docs/evidence/SBOM-WP-0002-T03-production-history-import-2026-08-22.md`.

## Synchronize repository projections

```task
id: SBOM-WP-0002-T02
status: done
priority: high
state_hub_task_id: "22cbb75f-d82f-5b47-9fef-27bde3b410d5"
```

Populate active repository identity and host checkout paths from Repo Manager.
Verify fleet totals and catch-up ordering without performing ingest.

The projection-only synchronizer and reconciliation contract are implemented.
Its dry-run never contacts the Nexus target and no code path calls an SBOM
ingest route. Production apply and catch-up ordering proof wait for the dark
runtime from T01. The isolated rehearsal reconciled all 120 source projections
and selected exactly the oldest three of 116 active repositories; see
`docs/evidence/SBOM-WP-0002-T02-repository-projection-rehearsal-2026-08-22.md`.

Completed in production with 120/120 projections reconciled and zero snapshots
created by the projection operation.

## Import and reconcile State Hub history

```task
id: SBOM-WP-0002-T03
status: done
priority: high
state_hub_task_id: "49bd74a5-d806-5d8e-9d75-0d465b380171"
```

Depends on T01/T02. Back up the empty target, run the idempotent importer, and
retain an exact reconciliation report before any caller switch.

Completed in production: 22 snapshots, 18 repositories, and 3,123 entries
reconciled exactly; licence groups and direct copyleft count matched; the second
run returned `already_present=22`. No caller was switched.

## Cut over State Hub compatibility façade

```task
id: SBOM-WP-0002-T04
status: done
priority: high
state_hub_task_id: "e7681dce-e3b6-52d1-bf13-92595b082b09"
```

Depends on T03 and the State Hub child change. Move reads then writes behind
reversible flags; retarget dashboard, MCP, CLI, summary, DoI, and onboarding.

Completed in production with independent `SBOM_NEXUS_READ_MODE` and
`SBOM_NEXUS_WRITE_MODE` flags set to `nexus`. The State Hub façade preserves
legacy response models and repository UUIDs, projects Nexus `last_attempt_at`
as `last_sbom_at`, routes future ingest only to Nexus, and sources dashboard
and summary SBOM metrics from Nexus. Helm ConfigMap checksums make one-value
read or write rollback trigger a real pod rollout. See
`docs/evidence/SBOM-WP-0002-T04-state-hub-facade-cutover-2026-08-22.md`.

## Retarget Repo Manager scanner interface

```task
id: SBOM-WP-0002-T05
status: done
priority: medium
state_hub_task_id: "59f83f01-13bc-5a63-bb0b-bf527047762e"
```

Depends on dark deployment. Preserve CLI usability while removing competing
SBOM product authority and pinning the Nexus contract.

Completed: Repo Manager's 326-line duplicate scanner was removed. Its existing
`rmgr sbom scan|licence-report` commands are deprecated, shell-free delegates
to the installed `sbom-nexus` CLI, emit `sbom-nexus.snapshot.v1`, and identify
`product_owner=sbom-nexus`. The full Repo Manager suite passed (87 tests), lint
passed, and both aliases succeeded against the actual Nexus executable. See
`docs/evidence/SBOM-WP-0002-T05-repo-manager-handoff-2026-08-22.md`.

## Enable bounded Activity Core ingest

```task
id: SBOM-WP-0002-T06
status: done
priority: high
state_hub_task_id: "dad4577d-5dcf-5452-b65e-d72299f432be"
```

Depends on T03/T04 and `ACTIVITY-WP-0030`. Enable no more than N ingests/skips
per fire with zero spawned catch-up tasks.

Completed in production. Activity Core performs one ranked oldest-N read,
truncates before writes, and records at most three terminal outcomes per fire.
Two operator-confirmed fires processed six distinct repositories as
`no-checkout` skips, spawned zero tasks, persisted linked progress evidence,
and demonstrated queue advancement (`never_count` 101 to 98). The weekday
09:15 Europe/Berlin schedule is active and the legacy weekly flood schedule is
disabled and paused. See
`docs/evidence/SBOM-WP-0002-T06-activity-core-bounded-ingest-2026-08-22.md`.

## Stabilize and retire legacy ownership

```task
id: SBOM-WP-0002-T07
status: done
priority: medium
state_hub_task_id: "bb1ff087-f204-5fd0-9295-3bd10bf0d38a"
```

Capture two successful daily fires and a zero-flood Monday window. Record the
retention decision, then retire State Hub SBOM ownership after the stabilization
window without deleting historical data implicitly.

Retired by explicit owner direction on 2026-08-22 after the Hall of Helix entry
was published. The already-proven conditions are recorded exactly: two bounded
production fires, six distinct terminal outcomes, zero spawned tasks, an active
daily schedule, and the legacy weekly schedule disabled and paused. The owner
waived waiting for the next Monday observation; this record does not claim that
window occurred.

Retention decision: keep State Hub's 22 historical snapshots and compatibility
surface read-only as rollback evidence. New reads and writes remain owned by
SBOM Nexus. Do not delete the retained rows, remove rollback flags, or tear out
the façade as part of this retirement. See
`docs/evidence/SBOM-WP-0002-T07-retirement-2026-08-22.md`.