coulomb/sbom-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: close production deployment and import gates

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
This commit is contained in:
tegwick 2026-08-22 18:24:44 +02:00
parent 4143f7c004
commit e83c875150
3 changed files with 106 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

31
workplans/SBOM-WP-0002-production-cutover.md
View file

@ -35,10 +35,8 @@ bounded daily catch-up before retiring State Hub SBOM ownership.
```task
id: SBOM-WP-0002-T01
status: progress
status: done
priority: high
needs_human: true
intervention_note: "Warden requires an attended founder act for the first platform-pg-2 OpenBao database connection, SBOM Nexus dynamic roles/policies, and renewable External Secrets parent token. The database owner must also repair the governed backup credential/policy after a live S3 HeadBucket 403."
state_hub_task_id: "95a520d4-30c2-5c87-8054-6bfe549c2686"
```
@ -47,15 +45,21 @@ deploy the API without callers, and capture health plus backup/restore evidence.
Image publication, package rendering, family validation, and server-side dry-run
are complete; see
`docs/evidence/SBOM-WP-0002-T01-dark-deployment-preflight-2026-08-22.md`.
The overflow cell is now 1/1 Ready, but continuous archiving and its first base
backup fail closed on an S3 `HeadBucket` 403. Database-owner work is tracked by
`RAPP-POSTGRES-WP-0005`; no caller or Nexus runtime has been enabled.
The overflow cell initially failed closed on an S3 `HeadBucket` 403. The
database owner repaired that path under `RAPP-POSTGRES-WP-0005`; no caller was
enabled while the gate was open.
Completed with the private runtime healthy on PostgreSQL at migration head,
dynamic runtime/migration credentials synchronized, a successful governed
backup, 51-second scratch restore, runtime DDL denial, and immutable image
verification. See
`docs/evidence/SBOM-WP-0002-T03-production-history-import-2026-08-22.md`.
## Synchronize repository projections
```task
id: SBOM-WP-0002-T02
status: progress
status: done
priority: high
state_hub_task_id: "22cbb75f-d82f-5b47-9fef-27bde3b410d5"
```
@ -70,11 +74,14 @@ runtime from T01. The isolated rehearsal reconciled all 120 source projections
and selected exactly the oldest three of 116 active repositories; see
`docs/evidence/SBOM-WP-0002-T02-repository-projection-rehearsal-2026-08-22.md`.
Completed in production with 120/120 projections reconciled and zero snapshots
created by the projection operation.
## Import and reconcile State Hub history
```task
id: SBOM-WP-0002-T03
status: wait
status: done
priority: high
state_hub_task_id: "49bd74a5-d806-5d8e-9d75-0d465b380171"
```
@ -82,11 +89,15 @@ state_hub_task_id: "49bd74a5-d806-5d8e-9d75-0d465b380171"
Depends on T01/T02. Back up the empty target, run the idempotent importer, and
retain an exact reconciliation report before any caller switch.
Completed in production: 22 snapshots, 18 repositories, and 3,123 entries
reconciled exactly; licence groups and direct copyleft count matched; the second
run returned `already_present=22`. No caller was switched.
## Cut over State Hub compatibility façade
```task
id: SBOM-WP-0002-T04
status: wait
status: todo
priority: high
state_hub_task_id: "e7681dce-e3b6-52d1-bf13-92595b082b09"
```
@ -98,7 +109,7 @@ reversible flags; retarget dashboard, MCP, CLI, summary, DoI, and onboarding.
```task
id: SBOM-WP-0002-T05
status: wait
status: todo
priority: medium
state_hub_task_id: "59f83f01-13bc-5a63-bb0b-bf527047762e"
```