coulomb/sbom-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close SBOM-WP-0002 T06

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
This commit is contained in:
tegwick 2026-08-22 21:09:28 +02:00
parent 33a345b9c1
commit f25f821f69
2 changed files with 54 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

44
docs/evidence/SBOM-WP-0002-T06-activity-core-bounded-ingest-2026-08-22.md Normal file
View file

@ -0,0 +1,44 @@
# SBOM-WP-0002-T06 Activity Core bounded ingest evidence
Date: 2026-08-22
The `ACTIVITY-WP-0030` handoff is implemented, deployed, and enabled on
railiance01. Activity Core owns scheduling and bounded orchestration; SBOM Nexus
remains the only scanner, history, catch-up, and terminal outcome authority.
## Contract and deployment
- Activity Core commit `8e8c74b` implements explicit `apply: true` bounded
execution while preserving a read-only default.
- Commit `91ae8dc` configures the private in-cluster Nexus service.
- Commit `c2f797f` enables and projects the weekday definition.
- Commit `28696b3` closes `ACTIVITY-WP-0030` with detailed production evidence.
- RApp commit `94742b6` admits the `activity-core` namespace without exposing a
public route.
- Focused Activity Core verification: 21 passed. RApp package verification: 5
passed, followed by successful live deployment/migration verification.
## Bounded production proof
Two full Activity Core fires completed:
1. Run `82379bc0-7d88-573d-a06f-0ef5fc43cf84` selected
`adaptive-pricing`, `agent-harness`, and `agentic-resources`.
2. Run `512a8570-2c33-51d6-afd8-5879c85a235d` selected `artifact-store`,
`audit-core`, and `binky-control`.
Each fire recorded three `no-checkout` terminal skips and `tasks_spawned=0`.
State Hub progress IDs `a9e8acea-a6e2-4b51-b2ed-f1769403ca73` and
`f8b59633-692d-447c-8015-4778c9f27fd5` preserve selected/skipped repositories,
reasons, fleet counters, and Activity Core run IDs. The second fire selected a
different batch and reported `never_count=98` after the first reported 101,
proving that a skip advances queue fairness without claiming success.
Production schedule posture after sync:
- `daily-sbom-catchup`: enabled and active, `15 9 * * 1-5`, Europe/Berlin,
limit 3, no rule block;
- `weekly-sbom-staleness`: disabled and paused.
The remaining T07 stabilization gate is intentionally separate: observe the
next Monday window before retiring legacy State Hub ownership.

11
workplans/SBOM-WP-0002-production-cutover.md
View file

@ -136,7 +136,7 @@ passed, and both aliases succeeded against the actual Nexus executable. See
```task
id: SBOM-WP-0002-T06
status: wait
status: done
priority: high
state_hub_task_id: "dad4577d-5dcf-5452-b65e-d72299f432be"
```
@ -144,6 +144,15 @@ state_hub_task_id: "dad4577d-5dcf-5452-b65e-d72299f432be"
Depends on T03/T04 and `ACTIVITY-WP-0030`. Enable no more than N ingests/skips
per fire with zero spawned catch-up tasks.
Completed in production. Activity Core performs one ranked oldest-N read,
truncates before writes, and records at most three terminal outcomes per fire.
Two operator-confirmed fires processed six distinct repositories as
`no-checkout` skips, spawned zero tasks, persisted linked progress evidence,
and demonstrated queue advancement (`never_count` 101 to 98). The weekday
09:15 Europe/Berlin schedule is active and the legacy weekly flood schedule is
disabled and paused. See
`docs/evidence/SBOM-WP-0002-T06-activity-core-bounded-ingest-2026-08-22.md`.
## Stabilize and retire legacy ownership
```task