---
id: SBOM-WP-0002
type: workplan
title: "Deploy and cut over SBOM Nexus production authority"
domain: infotech
repo: sbom-nexus
status: active
owner: codex
topic_slug: infotech
created: "2026-08-22"
updated: "2026-08-22"
quality_dor: DoR-Ok
quality_dor_at: "2026-08-22"
quality_dor_by: codex
quality_dor_note: "Goal, ownership boundaries, staged dependencies, production safety gates, reconciliation evidence, rollback paths, and cross-repository handoffs were reviewed against the implemented Nexus contract and current State Hub history."
parent_workplan: CUST-WP-0062
related:
  - SBOM-WP-0001
  - CUST-WP-0062
  - ACTIVITY-WP-0030
  - STATE-WP-0079
  - RMGR-WP-0008
state_hub_workstream_id: "7729a4bd-c1c4-50b9-a3b6-1faa51fff97d"
---

# Deploy and cut over SBOM Nexus production authority

## Goal

Deploy SBOM Nexus with managed PostgreSQL, import and reconcile State Hub
history, move callers through reversible compatibility stages, and prove the
bounded daily catch-up before retiring State Hub SBOM ownership.

## Deploy dark with managed PostgreSQL

```task
id: SBOM-WP-0002-T01
status: progress
priority: high
needs_human: true
intervention_note: "Warden requires operator OIDC/MFA for first rapp-sbom-nexus Forgejo repository creation and one-time secret provisioning for platform-pg-2/OpenBao."
state_hub_task_id: "95a520d4-30c2-5c87-8054-6bfe549c2686"
```

Provision database credentials through the governed route, migrate schema,
deploy the API without callers, and capture health plus backup/restore evidence.
Image publication, package rendering, family validation, and server-side dry-run
are complete; see
`docs/evidence/SBOM-WP-0002-T01-dark-deployment-preflight-2026-08-22.md`.

## Synchronize repository projections

```task
id: SBOM-WP-0002-T02
status: todo
priority: high
state_hub_task_id: "22cbb75f-d82f-5b47-9fef-27bde3b410d5"
```

Populate active repository identity and host checkout paths from Repo Manager.
Verify fleet totals and catch-up ordering without performing ingest.

## Import and reconcile State Hub history

```task
id: SBOM-WP-0002-T03
status: wait
priority: high
state_hub_task_id: "49bd74a5-d806-5d8e-9d75-0d465b380171"
```

Depends on T01/T02. Back up the empty target, run the idempotent importer, and
retain an exact reconciliation report before any caller switch.

## Cut over State Hub compatibility façade

```task
id: SBOM-WP-0002-T04
status: wait
priority: high
state_hub_task_id: "e7681dce-e3b6-52d1-bf13-92595b082b09"
```

Depends on T03 and the State Hub child change. Move reads then writes behind
reversible flags; retarget dashboard, MCP, CLI, summary, DoI, and onboarding.

## Retarget Repo Manager scanner interface

```task
id: SBOM-WP-0002-T05
status: wait
priority: medium
state_hub_task_id: "59f83f01-13bc-5a63-bb0b-bf527047762e"
```

Depends on dark deployment. Preserve CLI usability while removing competing
SBOM product authority and pinning the Nexus contract.

## Enable bounded Activity Core ingest

```task
id: SBOM-WP-0002-T06
status: wait
priority: high
state_hub_task_id: "dad4577d-5dcf-5452-b65e-d72299f432be"
```

Depends on T03/T04 and `ACTIVITY-WP-0030`. Enable no more than N ingests/skips
per fire with zero spawned catch-up tasks.

## Stabilize and retire legacy ownership

```task
id: SBOM-WP-0002-T07
status: wait
priority: medium
state_hub_task_id: "bb1ff087-f204-5fd0-9295-3bd10bf0d38a"
```

Capture two successful daily fires and a zero-flood Monday window. Record the
retention decision, then retire State Hub SBOM ownership after the stabilization
window without deleting historical data implicitly.