feat: establish sbom nexus extraction slice

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

SCOPE.md

@@ -0,0 +1,33 @@
+# Scope
+
+## One-liner
+
+SBOM Nexus captures, preserves, evaluates, and operationally refreshes
+software-bill-of-materials evidence for managed repositories.
+
+## In scope
+
+- repository-source detection and parsing;
+- immutable SBOM snapshots, entries, provenance, and history;
+- latest-inventory and snapshot query APIs;
+- licence inventory and qualified copyleft triage signals;
+- freshness evaluation and bounded oldest-first catch-up;
+- State Hub-compatible SBOM routes during migration;
+- historical State Hub SBOM import and reconciliation;
+- operator CLI, service packaging, tests, and operational documentation.
+
+## Out of scope
+
+- repository lifecycle and checkout control (Repo Manager);
+- recurring scheduling (Activity Core);
+- general work coordination (State Hub/hub-core/issue-core);
+- artifact blob storage (Artifact Store);
+- authentication policy ownership (Flex Auth);
+- legal advice or a general vulnerability intelligence database;
+- non-SBOM State Hub extraction.
+
+## Current state
+
+The repo is in its initial extraction milestone under `CUST-WP-0062` and
+`SBOM-WP-0001`. State Hub compatibility and local SQLite operation are the first
+vertical slice; PostgreSQL migration and production cutover remain gated work.