docs: close production deployment and import gates

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

docs/evidence/SBOM-WP-0002-T02-repository-projection-rehearsal-2026-08-22.md

@@ -39,6 +39,15 @@ never-attempted repositories, ordered deterministically by slug:
 Production apply remains gated on the dark PostgreSQL runtime in
 `SBOM-WP-0002-T01`.
 
+## Production result
+
+After T01 became healthy, the same path synchronized all 120 projections into
+the private PostgreSQL-backed runtime: 120 matched, with zero missing,
+mismatched, or extra rows. The snapshot count remained zero. The bounded query
+again selected exactly three of 116 active repositories. Full production and
+history-import evidence is recorded in
+`SBOM-WP-0002-T03-production-history-import-2026-08-22.md`.
+
 ## Verification
 
 - `uv run ruff check src tests scripts`: pass

docs/evidence/SBOM-WP-0002-T03-production-history-import-2026-08-22.md

@@ -0,0 +1,76 @@
+# SBOM-WP-0002 T01–T03 production evidence — 2026-08-22
+
+## Dark runtime
+
+SBOM Nexus is deployed privately in namespace `sbom-nexus` with no Ingress and
+no admitted caller namespace. The live image is:
+
+`forgejo.coulomb.social/coulomb/sbom-nexus@sha256:62929abc91bd7ef2b141f6801171b4d5edae81b625ded4a133196f5da14228f4`
+
+Both runtime and migration ExternalSecrets report `SecretSynced=True`, Alembic
+revision `0001` is at head, and `/state/health` reports connected PostgreSQL.
+`rapp-sbom-nexus make verify-live` confirmed the digest, health, migration head,
+and that no secret values were observed.
+
+The first deployment exposed a migration-ownership defect: objects were owned
+by an expiring migration login, so runtime health failed with PostgreSQL
+`permission denied for table repositories`. Because the target was new and had
+no SBOM snapshots, the four objects were reassigned to the durable
+`sbom_nexus_owner`, existing runtime grants were reconciled, and the product was
+changed to issue `SET ROLE sbom_nexus_owner` before all future PostgreSQL
+migrations. Nineteen tests pass with one conditional PostgreSQL skip. The fixed
+image and package were published and redeployed before projection or history
+data was loaded.
+
+During the attended OIDC operation, the first OpenBao CLI invocation printed a
+platform-admin token despite the intended metadata-only flow. That token was
+immediately revoked with `bao token revoke -self` before provisioning. A second
+login used `-no-print`; only its `platform-admin`, renewable, and TTL metadata
+was verified. No token value is retained in Git, State Hub, or this evidence.
+
+Database-owner receipt `6779250b-15a2-4a28-a5fa-7f1e37a97f73` confirms:
+
+- `platform-pg-2` 1/1 Ready with continuous archiving healthy;
+- post-migration backup ID `20260822T160352` completed at WAL
+  `00000001000000000000000C`;
+- scratch restore became Ready in 51 seconds and matched production schema
+  owner, all four relation owners, runtime SELECT privileges, Alembic revision,
+  row counts, statement timeout, idle transaction timeout, and search path;
+- the actual dynamic runtime lease passed SELECT and denied CREATE TABLE with
+  SQLSTATE `42501`;
+- the scratch namespace and copied credential were deleted after proof.
+
+## Repository projection
+
+The production projection-only sync selected explicit host id `bnt-lap001` and
+reconciled exactly:
+
+| Measure | Result |
+| --- | ---: |
+| Source/target repositories | 120 / 120 |
+| Active / inactive | 116 / 4 |
+| Missing / mismatched / extra | 0 / 0 / 0 |
+| Snapshots after projection sync | 0 |
+
+The production `limit=3` catch-up query selected exactly three repositories in
+slug order. Checkout availability is false inside the cluster because the
+workstation paths are projections and are not mounted into the private runtime;
+future scanners must submit evidence or run where the checkout exists.
+
+## Historical import and reconciliation
+
+An empty-target backup existed before import. The read-only preview found 22
+snapshots across 18 repositories with 3,123 entries. The production import then
+reported:
+
+- 22 imported snapshots;
+- 22/22 legacy snapshot identifiers matched;
+- 3,123/3,123 entries matched;
+- zero missing or mismatched snapshots;
+- all 19 licence groups matched;
+- direct-production copyleft count 4 on both source and target.
+
+The importer was run a second time and returned `already_present=22` with the
+same exact reconciliation, proving production idempotency. Sampled repository
+views for `activity-core`, `markitect-tool`, and `railiance-cluster` returned
+their imported latest snapshots. No caller route was switched during T01–T03.

workplans/SBOM-WP-0002-production-cutover.md

@@ -35,10 +35,8 @@ bounded daily catch-up before retiring State Hub SBOM ownership.
 
 ```task
 id: SBOM-WP-0002-T01
-status: progress
+status: done
 priority: high
-needs_human: true
-intervention_note: "Warden requires an attended founder act for the first platform-pg-2 OpenBao database connection, SBOM Nexus dynamic roles/policies, and renewable External Secrets parent token. The database owner must also repair the governed backup credential/policy after a live S3 HeadBucket 403."
 state_hub_task_id: "95a520d4-30c2-5c87-8054-6bfe549c2686"
 ```
 
@@ -47,15 +45,21 @@ deploy the API without callers, and capture health plus backup/restore evidence.
 Image publication, package rendering, family validation, and server-side dry-run
 are complete; see
 `docs/evidence/SBOM-WP-0002-T01-dark-deployment-preflight-2026-08-22.md`.
-The overflow cell is now 1/1 Ready, but continuous archiving and its first base
-backup fail closed on an S3 `HeadBucket` 403. Database-owner work is tracked by
-`RAPP-POSTGRES-WP-0005`; no caller or Nexus runtime has been enabled.
+The overflow cell initially failed closed on an S3 `HeadBucket` 403. The
+database owner repaired that path under `RAPP-POSTGRES-WP-0005`; no caller was
+enabled while the gate was open.
+
+Completed with the private runtime healthy on PostgreSQL at migration head,
+dynamic runtime/migration credentials synchronized, a successful governed
+backup, 51-second scratch restore, runtime DDL denial, and immutable image
+verification. See
+`docs/evidence/SBOM-WP-0002-T03-production-history-import-2026-08-22.md`.
 
 ## Synchronize repository projections
 
 ```task
 id: SBOM-WP-0002-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "22cbb75f-d82f-5b47-9fef-27bde3b410d5"
 ```
@@ -70,11 +74,14 @@ runtime from T01. The isolated rehearsal reconciled all 120 source projections
 and selected exactly the oldest three of 116 active repositories; see
 `docs/evidence/SBOM-WP-0002-T02-repository-projection-rehearsal-2026-08-22.md`.
 
+Completed in production with 120/120 projections reconciled and zero snapshots
+created by the projection operation.
+
 ## Import and reconcile State Hub history
 
 ```task
 id: SBOM-WP-0002-T03
-status: wait
+status: done
 priority: high
 state_hub_task_id: "49bd74a5-d806-5d8e-9d75-0d465b380171"
 ```
@@ -82,11 +89,15 @@ state_hub_task_id: "49bd74a5-d806-5d8e-9d75-0d465b380171"
 Depends on T01/T02. Back up the empty target, run the idempotent importer, and
 retain an exact reconciliation report before any caller switch.
 
+Completed in production: 22 snapshots, 18 repositories, and 3,123 entries
+reconciled exactly; licence groups and direct copyleft count matched; the second
+run returned `already_present=22`. No caller was switched.
+
 ## Cut over State Hub compatibility façade
 
 ```task
 id: SBOM-WP-0002-T04
-status: wait
+status: todo
 priority: high
 state_hub_task_id: "e7681dce-e3b6-52d1-bf13-92595b082b09"
 ```
@@ -98,7 +109,7 @@ reversible flags; retarget dashboard, MCP, CLI, summary, DoI, and onboarding.
 
 ```task
 id: SBOM-WP-0002-T05
-status: wait
+status: todo
 priority: medium
 state_hub_task_id: "59f83f01-13bc-5a63-bb0b-bf527047762e"
 ```