feat: prepare postgres sbom cutover

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

docs/evidence/SBOM-WP-0001-postgres-and-history-rehearsal-2026-08-22.md

@@ -0,0 +1,74 @@
+# PostgreSQL and State Hub history rehearsal — 2026-08-22
+
+## Scope
+
+Evidence for `SBOM-WP-0001-T05`. No production SBOM authority or State Hub rows
+were changed. PostgreSQL and Nexus history targets were disposable.
+
+## PostgreSQL migration/runtime proof
+
+A disposable `postgres:16-alpine` instance received:
+
+1. `alembic upgrade head` from an empty database;
+2. the PostgreSQL API contract test (health, repository upsert, manual ingest,
+   current view, and licence report); and
+3. `alembic downgrade base`.
+
+All three completed successfully. The container was stopped and removed after
+the test.
+
+The production `Containerfile` also built as `sbom-nexus:test`; a disposable
+container started as uid 10001 and returned a successful `/state/health`
+response using its writable `/data` SQLite development default.
+
+## Live State Hub history baseline
+
+Read-only source: workstation State Hub at `127.0.0.1:8000`.
+
+| Measure | Value |
+| --- | ---: |
+| Repositories with history | 18 |
+| Historical snapshots | 22 |
+| Historical entries | 3,123 |
+| Oldest snapshot | 2026-03-01T15:12:54.862697Z |
+| Newest snapshot | 2026-07-08T20:37:48.255925Z |
+
+## Disposable import result
+
+The first import created all 22 snapshots in a temporary Nexus SQLite database.
+Snapshot reconciliation succeeded immediately:
+
+- expected/matched snapshots: 22/22;
+- expected/target imported entries: 3,123/3,123;
+- missing legacy ids: 0;
+- snapshot field mismatches: 0.
+
+The initial licence comparison reported a mismatch solely because the two APIs
+returned equal groups in different orders. Group ordering is not contractual;
+the importer was corrected to compare normalized groups keyed by licence.
+
+The second run then proved both correctness and idempotence:
+
+- `already_present`: 22;
+- snapshot reconciliation: pass;
+- licence groups: exact normalized match;
+- source/target direct-production copyleft count: 4/4;
+- overall result: pass.
+
+## Production gate retained
+
+This is migration-mechanism evidence, not authority cutover approval. Production
+still requires a managed PostgreSQL service, backup/restore evidence, deployment
+health, State Hub façade and projection changes, Repo Manager retargeting,
+Activity Core bounded-ingest activation, and a stabilization window.
+
+## Consumer handoffs
+
+State Hub coordination messages were sent from `sbom-nexus` with the cutover
+plan and explicit ownership boundaries:
+
+| Consumer | Message id | Requested child slice |
+| --- | --- | --- |
+| State Hub | `5a28a4e8-476a-4766-8e11-9c8b4f4cf57a` | reversible compatibility façade and caller retargeting |
+| Repo Manager | `62d3bd49-9050-458f-9aa9-b6af348f9eb0` | retarget scanner/report interface and remove competing authority |
+| Activity Core | `3420be55-d0ad-4eb7-93b2-42ac4281c61d` | unblock bounded ingest while retaining deployment gates |