feat: establish sbom nexus extraction slice

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

workplans/SBOM-WP-0001-bootstrap-and-state-hub-extraction.md

@@ -0,0 +1,83 @@
+---
+id: SBOM-WP-0001
+type: workplan
+title: "Bootstrap SBOM Nexus and extract the State Hub SBOM product"
+domain: infotech
+repo: sbom-nexus
+status: active
+owner: codex
+topic_slug: infotech
+created: "2026-08-22"
+updated: "2026-08-22"
+parent_workplan: CUST-WP-0062
+related:
+  - CUST-WP-0062
+  - ACTIVITY-WP-0030
+  - STATE-WP-0079
+  - RMGR-WP-0008
+---
+
+# Bootstrap SBOM Nexus and extract the State Hub SBOM product
+
+## Goal
+
+Establish SBOM Nexus as a properly defined repository and deliver the first
+working vertical slice of the State Hub extraction: source scanning, immutable
+snapshot persistence, compatible queries and licence report, and bounded
+oldest-stale catch-up behavior.
+
+## Establish repository intent and conventions
+
+```task
+id: SBOM-WP-0001-T01
+status: done
+priority: high
+```
+
+Write the repository identity, intent, scope, classification, development
+commands, and agent instructions; register and synchronize the repository.
+
+## Define product requirements
+
+```task
+id: SBOM-WP-0001-T02
+status: done
+priority: high
+```
+
+Write an evidence-grounded PRD covering State Hub compatibility, snapshot
+authority, bounded catch-up, skip semantics, migration, and production gates.
+
+## Inventory and disposition the existing SBOM surface
+
+```task
+id: SBOM-WP-0001-T03
+status: done
+priority: high
+```
+
+Review State Hub, Repo Manager, Activity Core, dashboard, MCP, scripts, models,
+and operational callers. Assign move, strangle, or retarget dispositions.
+
+## Extract the first service slice
+
+```task
+id: SBOM-WP-0001-T04
+status: done
+priority: high
+```
+
+Implement the scanner, persistence, HTTP API, legacy compatibility routes,
+licence report, catch-up selection, and terminal skip behavior with tests.
+
+## Prepare cutover and historical migration
+
+```task
+id: SBOM-WP-0001-T05
+status: todo
+priority: high
+```
+
+Add PostgreSQL migrations and the idempotent historical import/reconciliation
+runbook. Open and coordinate State Hub/Repo Manager/Activity Core child changes
+before any production authority switch.