coulomb/sbom-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

workplans: record live SBOM canary

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b22-9638-76d2-bbff-b7ea1770b118
This commit is contained in:
tegwick 2026-08-23 00:25:17 +02:00
parent b1fd3ec131
commit 94c4435b66
2 changed files with 16 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
workplans/SBOM-WP-0003-controlled-source-and-replay.md
View file

@ -8,7 +8,7 @@ status: active
owner: codex
topic_slug: infotech
created: "2026-08-22"
updated: "2026-08-22"
updated: "2026-08-23"
quality_dor: DoR-Ok
quality_dor_at: "2026-08-22"
quality_dor_by: codex
@ -82,7 +82,7 @@ available for local/operator compatibility while the production flag is dark.
```task
id: SBOM-WP-0003-T04
status: wait
status: progress
priority: high
state_hub_task_id: "9c8a2b6c-2b99-5dd8-9c1c-b5ba4ad2367b"
```
@ -90,3 +90,11 @@ state_hub_task_id: "9c8a2b6c-2b99-5dd8-9c1c-b5ba4ad2367b"
Coordinate the schema migration, ephemeral volume, Forgejo-only egress, and
feature flag with `rapp-sbom-nexus`; then pass unit/integration tests and the
attended plus scheduled production proof owned by CUST-WP-0064.
The package promoted digest
`sha256:1da0f4f008643a0dec3f00bbad15f287103aa4b469577b78cfe1d67f8b3cbe31`
after migration `0002`. The attended `sbom-nexus` canary produced snapshot
`04f5c0ba-d073-4577-ba2d-0854346ac7be`: 33 entries, exact full-SHA revision,
archive SHA-256/byte provenance, zero errors, identical replay under the same
operation key, and an empty transient directory before and after. The feature
is dark again with snapshot history intact; scheduled proof remains.

7
workplans/SBOM-WP-0004-database-lease-rotation.md
View file

@ -59,10 +59,15 @@ Kubernetes to restart an otherwise healthy process.
```task
id: SBOM-WP-0004-T03
status: wait
status: progress
priority: high
```
Promote the shared new image/package digest, observe at least one complete
database lease rotation, and require continuous process uptime, recovered
readiness, no liveness-driven restart, and no credential values in logs.
The corrected digest is live at migration `0002 (head)` with process and
database health passing, repository reads working, and zero pod restarts. The
first promotion safely proved digest rollback and exposed the now-fixed
migration transaction guard. Keep this task open through one full lease window.