From 94c4435b66f9ddd9aa0f1e29374fab187cf512f4 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 23 Aug 2026 00:25:17 +0200 Subject: [PATCH] workplans: record live SBOM canary Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b22-9638-76d2-bbff-b7ea1770b118 --- .../SBOM-WP-0003-controlled-source-and-replay.md | 12 ++++++++++-- workplans/SBOM-WP-0004-database-lease-rotation.md | 7 ++++++- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/workplans/SBOM-WP-0003-controlled-source-and-replay.md b/workplans/SBOM-WP-0003-controlled-source-and-replay.md index 8bb6fa7..83c12a0 100644 --- a/workplans/SBOM-WP-0003-controlled-source-and-replay.md +++ b/workplans/SBOM-WP-0003-controlled-source-and-replay.md @@ -8,7 +8,7 @@ status: active owner: codex topic_slug: infotech created: "2026-08-22" -updated: "2026-08-22" +updated: "2026-08-23" quality_dor: DoR-Ok quality_dor_at: "2026-08-22" quality_dor_by: codex @@ -82,7 +82,7 @@ available for local/operator compatibility while the production flag is dark. ```task id: SBOM-WP-0003-T04 -status: wait +status: progress priority: high state_hub_task_id: "9c8a2b6c-2b99-5dd8-9c1c-b5ba4ad2367b" ``` @@ -90,3 +90,11 @@ state_hub_task_id: "9c8a2b6c-2b99-5dd8-9c1c-b5ba4ad2367b" Coordinate the schema migration, ephemeral volume, Forgejo-only egress, and feature flag with `rapp-sbom-nexus`; then pass unit/integration tests and the attended plus scheduled production proof owned by CUST-WP-0064. + +The package promoted digest +`sha256:1da0f4f008643a0dec3f00bbad15f287103aa4b469577b78cfe1d67f8b3cbe31` +after migration `0002`. The attended `sbom-nexus` canary produced snapshot +`04f5c0ba-d073-4577-ba2d-0854346ac7be`: 33 entries, exact full-SHA revision, +archive SHA-256/byte provenance, zero errors, identical replay under the same +operation key, and an empty transient directory before and after. The feature +is dark again with snapshot history intact; scheduled proof remains. diff --git a/workplans/SBOM-WP-0004-database-lease-rotation.md b/workplans/SBOM-WP-0004-database-lease-rotation.md index f06671f..ff22109 100644 --- a/workplans/SBOM-WP-0004-database-lease-rotation.md +++ b/workplans/SBOM-WP-0004-database-lease-rotation.md @@ -59,10 +59,15 @@ Kubernetes to restart an otherwise healthy process. ```task id: SBOM-WP-0004-T03 -status: wait +status: progress priority: high ``` Promote the shared new image/package digest, observe at least one complete database lease rotation, and require continuous process uptime, recovered readiness, no liveness-driven restart, and no credential values in logs. + +The corrected digest is live at migration `0002 (head)` with process and +database health passing, repository reads working, and zero pod restarts. The +first promotion safely proved digest rollback and exposed the now-fixed +migration transaction guard. Keep this task open through one full lease window.