feat: prepare postgres sbom cutover

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

workplans/SBOM-WP-0001-bootstrap-and-state-hub-extraction.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Bootstrap SBOM Nexus and extract the State Hub SBOM product"
 domain: infotech
 repo: sbom-nexus
-status: active
+status: finished
 owner: codex
 topic_slug: infotech
 created: "2026-08-22"
@@ -79,7 +79,7 @@ licence report, catch-up selection, and terminal skip behavior with tests.
 
 ```task
 id: SBOM-WP-0001-T05
-status: todo
+status: done
 priority: high
 state_hub_task_id: "5e281ac9-400d-5a38-b82a-b3c2198a5e7c"
 ```
@@ -87,3 +87,9 @@ state_hub_task_id: "5e281ac9-400d-5a38-b82a-b3c2198a5e7c"
 Add PostgreSQL migrations and the idempotent historical import/reconciliation
 runbook. Open and coordinate State Hub/Repo Manager/Activity Core child changes
 before any production authority switch.
+
+Completed with a SQLAlchemy SQLite/PostgreSQL store, Alembic baseline and
+disposable PostgreSQL upgrade/runtime/downgrade proof. A live disposable import
+reconciled 22 snapshots, 3,123 entries, all licence groups, and copyleft count;
+the second run was 22/22 idempotent. Production residuals moved to
+`SBOM-WP-0002` and were routed to the three consumer owners.

workplans/SBOM-WP-0002-production-cutover.md

@@ -0,0 +1,105 @@
+---
+id: SBOM-WP-0002
+type: workplan
+title: "Deploy and cut over SBOM Nexus production authority"
+domain: infotech
+repo: sbom-nexus
+status: ready
+owner: codex
+topic_slug: infotech
+created: "2026-08-22"
+updated: "2026-08-22"
+parent_workplan: CUST-WP-0062
+related:
+  - SBOM-WP-0001
+  - CUST-WP-0062
+  - ACTIVITY-WP-0030
+  - STATE-WP-0079
+  - RMGR-WP-0008
+---
+
+# Deploy and cut over SBOM Nexus production authority
+
+## Goal
+
+Deploy SBOM Nexus with managed PostgreSQL, import and reconcile State Hub
+history, move callers through reversible compatibility stages, and prove the
+bounded daily catch-up before retiring State Hub SBOM ownership.
+
+## Deploy dark with managed PostgreSQL
+
+```task
+id: SBOM-WP-0002-T01
+status: todo
+priority: high
+```
+
+Provision database credentials through the governed route, migrate schema,
+deploy the API without callers, and capture health plus backup/restore evidence.
+
+## Synchronize repository projections
+
+```task
+id: SBOM-WP-0002-T02
+status: todo
+priority: high
+```
+
+Populate active repository identity and host checkout paths from Repo Manager.
+Verify fleet totals and catch-up ordering without performing ingest.
+
+## Import and reconcile State Hub history
+
+```task
+id: SBOM-WP-0002-T03
+status: wait
+priority: high
+```
+
+Depends on T01/T02. Back up the empty target, run the idempotent importer, and
+retain an exact reconciliation report before any caller switch.
+
+## Cut over State Hub compatibility façade
+
+```task
+id: SBOM-WP-0002-T04
+status: wait
+priority: high
+```
+
+Depends on T03 and the State Hub child change. Move reads then writes behind
+reversible flags; retarget dashboard, MCP, CLI, summary, DoI, and onboarding.
+
+## Retarget Repo Manager scanner interface
+
+```task
+id: SBOM-WP-0002-T05
+status: wait
+priority: medium
+```
+
+Depends on dark deployment. Preserve CLI usability while removing competing
+SBOM product authority and pinning the Nexus contract.
+
+## Enable bounded Activity Core ingest
+
+```task
+id: SBOM-WP-0002-T06
+status: wait
+priority: high
+```
+
+Depends on T03/T04 and `ACTIVITY-WP-0030`. Enable no more than N ingests/skips
+per fire with zero spawned catch-up tasks.
+
+## Stabilize and retire legacy ownership
+
+```task
+id: SBOM-WP-0002-T07
+status: wait
+priority: medium
+```
+
+Capture two successful daily fires and a zero-flood Monday window. Record the
+retention decision, then retire State Hub SBOM ownership after the stabilization
+window without deleting historical data implicitly.