From 4b497d9e7bb863bb08bd1540440e940d9efadd12 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Sat, 22 Aug 2026 20:24:06 +0200
Subject: [PATCH] docs: close SBOM-WP-0002 T05

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
---
 ...002-T05-repo-manager-handoff-2026-08-22.md | 35 +++++++++++++++++++
 workplans/SBOM-WP-0002-production-cutover.md  |  9 ++++-
 2 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100644 docs/evidence/SBOM-WP-0002-T05-repo-manager-handoff-2026-08-22.md

diff --git a/docs/evidence/SBOM-WP-0002-T05-repo-manager-handoff-2026-08-22.md b/docs/evidence/SBOM-WP-0002-T05-repo-manager-handoff-2026-08-22.md
new file mode 100644
index 0000000..247956c
--- /dev/null
+++ b/docs/evidence/SBOM-WP-0002-T05-repo-manager-handoff-2026-08-22.md
@@ -0,0 +1,35 @@
+# SBOM-WP-0002 T05 — Repo Manager scanner handoff evidence
+
+Date: 2026-08-22
+
+Repo Manager commit `ad0ba6f` removes its duplicate SBOM scanner and leaves
+SBOM Nexus as the single scanner/snapshot product owner.
+
+Changes:
+
+- deleted `src/repo_manager/sbom.py` (326 lines of parser, source detection,
+  licence triage, and snapshot rendering);
+- replaced parser-specific tests with compatibility-delegation tests;
+- retained `rmgr sbom scan` and `rmgr sbom licence-report` as thin aliases;
+- invokes `sbom-nexus` directly with `shell=False`, discovered on `PATH` or via
+  `SBOM_NEXUS_CLI`;
+- preserved scan output-file refusal and `--force` behavior;
+- pinned authority in JSON with `schema=sbom-nexus.snapshot.v1`,
+  `product_owner=sbom-nexus`, and `delegated_by=repo-manager`;
+- corrected Repo Manager's earlier interim-scanner workplan/evidence and placed
+  the direct `sbom-nexus scan` command first in operator documentation.
+
+Verification:
+
+- Repo Manager Ruff: passed;
+- Repo Manager complete test suite: 87 passed;
+- real `rmgr sbom scan` delegation: 39 entries, Git revision present, no errors;
+- real `rmgr sbom licence-report` without an environment override: 39 entries,
+  copyleft direct count 0, no errors;
+- the local SBOM Nexus package was installed as an operator tool so the
+  compatibility aliases work on the default PATH.
+
+Repo Manager retains file-backed `sbom-inventory` register representation as a
+repository concern, but it no longer evaluates sources or owns product
+snapshots. Detailed owner-side evidence is in
+`repo-manager/docs/evidence/RMGR-WP-0008-sbom-authority-handoff-2026-08-22.md`.
diff --git a/workplans/SBOM-WP-0002-production-cutover.md b/workplans/SBOM-WP-0002-production-cutover.md
index 6792d95..e0860b0 100644
--- a/workplans/SBOM-WP-0002-production-cutover.md
+++ b/workplans/SBOM-WP-0002-production-cutover.md
@@ -117,7 +117,7 @@ read or write rollback trigger a real pod rollout. See
 
 ```task
 id: SBOM-WP-0002-T05
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "59f83f01-13bc-5a63-bb0b-bf527047762e"
 ```
@@ -125,6 +125,13 @@ state_hub_task_id: "59f83f01-13bc-5a63-bb0b-bf527047762e"
 Depends on dark deployment. Preserve CLI usability while removing competing
 SBOM product authority and pinning the Nexus contract.
 
+Completed: Repo Manager's 326-line duplicate scanner was removed. Its existing
+`rmgr sbom scan|licence-report` commands are deprecated, shell-free delegates
+to the installed `sbom-nexus` CLI, emit `sbom-nexus.snapshot.v1`, and identify
+`product_owner=sbom-nexus`. The full Repo Manager suite passed (87 tests), lint
+passed, and both aliases succeeded against the actual Nexus executable. See
+`docs/evidence/SBOM-WP-0002-T05-repo-manager-handoff-2026-08-22.md`.
+
 ## Enable bounded Activity Core ingest
 
 ```task