# PostgreSQL and State Hub history rehearsal — 2026-08-22

## Scope

Evidence for `SBOM-WP-0001-T05`. No production SBOM authority or State Hub rows
were changed. PostgreSQL and Nexus history targets were disposable.

## PostgreSQL migration/runtime proof

A disposable `postgres:16-alpine` instance received:

1. `alembic upgrade head` from an empty database;
2. the PostgreSQL API contract test (health, repository upsert, manual ingest,
   current view, and licence report); and
3. `alembic downgrade base`.

All three completed successfully. The container was stopped and removed after
the test.

The production `Containerfile` also built as `sbom-nexus:test`; a disposable
container started as uid 10001 and returned a successful `/state/health`
response using its writable `/data` SQLite development default.

## Live State Hub history baseline

Read-only source: workstation State Hub at `127.0.0.1:8000`.

| Measure | Value |
| --- | ---: |
| Repositories with history | 18 |
| Historical snapshots | 22 |
| Historical entries | 3,123 |
| Oldest snapshot | 2026-03-01T15:12:54.862697Z |
| Newest snapshot | 2026-07-08T20:37:48.255925Z |

## Disposable import result

The first import created all 22 snapshots in a temporary Nexus SQLite database.
Snapshot reconciliation succeeded immediately:

- expected/matched snapshots: 22/22;
- expected/target imported entries: 3,123/3,123;
- missing legacy ids: 0;
- snapshot field mismatches: 0.

The initial licence comparison reported a mismatch solely because the two APIs
returned equal groups in different orders. Group ordering is not contractual;
the importer was corrected to compare normalized groups keyed by licence.

The second run then proved both correctness and idempotence:

- `already_present`: 22;
- snapshot reconciliation: pass;
- licence groups: exact normalized match;
- source/target direct-production copyleft count: 4/4;
- overall result: pass.

## Production gate retained

This is migration-mechanism evidence, not authority cutover approval. Production
still requires a managed PostgreSQL service, backup/restore evidence, deployment
health, State Hub façade and projection changes, Repo Manager retargeting,
Activity Core bounded-ingest activation, and a stabilization window.

## Consumer handoffs

State Hub coordination messages were sent from `sbom-nexus` with the cutover
plan and explicit ownership boundaries:

| Consumer | Message id | Requested child slice |
| --- | --- | --- |
| State Hub | `5a28a4e8-476a-4766-8e11-9c8b4f4cf57a` | reversible compatibility façade and caller retargeting |
| Repo Manager | `62d3bd49-9050-458f-9aa9-b6af348f9eb0` | retarget scanner/report interface and remove competing authority |
| Activity Core | `3420be55-d0ad-4eb7-93b2-42ac4281c61d` | unblock bounded ingest while retaining deployment gates |