--- id: SBOM-WP-0002 type: workplan title: "Deploy and cut over SBOM Nexus production authority" domain: infotech repo: sbom-nexus status: finished owner: codex topic_slug: infotech created: "2026-08-22" updated: "2026-08-22" quality_dor: DoR-Ok quality_dor_at: "2026-08-22" quality_dor_by: codex quality_dor_note: "Goal, ownership boundaries, staged dependencies, production safety gates, reconciliation evidence, rollback paths, and cross-repository handoffs were reviewed against the implemented Nexus contract and current State Hub history." quality_dod: DoD-Ok quality_dod_at: "2026-08-22" quality_dod_by: codex quality_dod_note: "Production authority, migration reconciliation, reversible caller cutovers, scanner handoff, bounded automation, retention decision, clean verification, evidence, and owner-directed retirement were reviewed. The scheduled Monday observation was explicitly waived rather than claimed; legacy history remains retained and no destructive cleanup was performed." parent_workplan: CUST-WP-0062 related: - SBOM-WP-0001 - CUST-WP-0062 - ACTIVITY-WP-0030 - STATE-WP-0079 - RMGR-WP-0008 state_hub_workstream_id: "7729a4bd-c1c4-50b9-a3b6-1faa51fff97d" --- # Deploy and cut over SBOM Nexus production authority ## Goal Deploy SBOM Nexus with managed PostgreSQL, import and reconcile State Hub history, move callers through reversible compatibility stages, and prove the bounded daily catch-up before retiring State Hub SBOM ownership. ## Deploy dark with managed PostgreSQL ```task id: SBOM-WP-0002-T01 status: done priority: high state_hub_task_id: "95a520d4-30c2-5c87-8054-6bfe549c2686" ``` Provision database credentials through the governed route, migrate schema, deploy the API without callers, and capture health plus backup/restore evidence. Image publication, package rendering, family validation, and server-side dry-run are complete; see `docs/evidence/SBOM-WP-0002-T01-dark-deployment-preflight-2026-08-22.md`. The overflow cell initially failed closed on an S3 `HeadBucket` 403. The database owner repaired that path under `RAPP-POSTGRES-WP-0005`; no caller was enabled while the gate was open. Completed with the private runtime healthy on PostgreSQL at migration head, dynamic runtime/migration credentials synchronized, a successful governed backup, 51-second scratch restore, runtime DDL denial, and immutable image verification. See `docs/evidence/SBOM-WP-0002-T03-production-history-import-2026-08-22.md`. ## Synchronize repository projections ```task id: SBOM-WP-0002-T02 status: done priority: high state_hub_task_id: "22cbb75f-d82f-5b47-9fef-27bde3b410d5" ``` Populate active repository identity and host checkout paths from Repo Manager. Verify fleet totals and catch-up ordering without performing ingest. The projection-only synchronizer and reconciliation contract are implemented. Its dry-run never contacts the Nexus target and no code path calls an SBOM ingest route. Production apply and catch-up ordering proof wait for the dark runtime from T01. The isolated rehearsal reconciled all 120 source projections and selected exactly the oldest three of 116 active repositories; see `docs/evidence/SBOM-WP-0002-T02-repository-projection-rehearsal-2026-08-22.md`. Completed in production with 120/120 projections reconciled and zero snapshots created by the projection operation. ## Import and reconcile State Hub history ```task id: SBOM-WP-0002-T03 status: done priority: high state_hub_task_id: "49bd74a5-d806-5d8e-9d75-0d465b380171" ``` Depends on T01/T02. Back up the empty target, run the idempotent importer, and retain an exact reconciliation report before any caller switch. Completed in production: 22 snapshots, 18 repositories, and 3,123 entries reconciled exactly; licence groups and direct copyleft count matched; the second run returned `already_present=22`. No caller was switched. ## Cut over State Hub compatibility façade ```task id: SBOM-WP-0002-T04 status: done priority: high state_hub_task_id: "e7681dce-e3b6-52d1-bf13-92595b082b09" ``` Depends on T03 and the State Hub child change. Move reads then writes behind reversible flags; retarget dashboard, MCP, CLI, summary, DoI, and onboarding. Completed in production with independent `SBOM_NEXUS_READ_MODE` and `SBOM_NEXUS_WRITE_MODE` flags set to `nexus`. The State Hub façade preserves legacy response models and repository UUIDs, projects Nexus `last_attempt_at` as `last_sbom_at`, routes future ingest only to Nexus, and sources dashboard and summary SBOM metrics from Nexus. Helm ConfigMap checksums make one-value read or write rollback trigger a real pod rollout. See `docs/evidence/SBOM-WP-0002-T04-state-hub-facade-cutover-2026-08-22.md`. ## Retarget Repo Manager scanner interface ```task id: SBOM-WP-0002-T05 status: done priority: medium state_hub_task_id: "59f83f01-13bc-5a63-bb0b-bf527047762e" ``` Depends on dark deployment. Preserve CLI usability while removing competing SBOM product authority and pinning the Nexus contract. Completed: Repo Manager's 326-line duplicate scanner was removed. Its existing `rmgr sbom scan|licence-report` commands are deprecated, shell-free delegates to the installed `sbom-nexus` CLI, emit `sbom-nexus.snapshot.v1`, and identify `product_owner=sbom-nexus`. The full Repo Manager suite passed (87 tests), lint passed, and both aliases succeeded against the actual Nexus executable. See `docs/evidence/SBOM-WP-0002-T05-repo-manager-handoff-2026-08-22.md`. ## Enable bounded Activity Core ingest ```task id: SBOM-WP-0002-T06 status: done priority: high state_hub_task_id: "dad4577d-5dcf-5452-b65e-d72299f432be" ``` Depends on T03/T04 and `ACTIVITY-WP-0030`. Enable no more than N ingests/skips per fire with zero spawned catch-up tasks. Completed in production. Activity Core performs one ranked oldest-N read, truncates before writes, and records at most three terminal outcomes per fire. Two operator-confirmed fires processed six distinct repositories as `no-checkout` skips, spawned zero tasks, persisted linked progress evidence, and demonstrated queue advancement (`never_count` 101 to 98). The weekday 09:15 Europe/Berlin schedule is active and the legacy weekly flood schedule is disabled and paused. See `docs/evidence/SBOM-WP-0002-T06-activity-core-bounded-ingest-2026-08-22.md`. ## Stabilize and retire legacy ownership ```task id: SBOM-WP-0002-T07 status: done priority: medium state_hub_task_id: "bb1ff087-f204-5fd0-9295-3bd10bf0d38a" ``` Capture two successful daily fires and a zero-flood Monday window. Record the retention decision, then retire State Hub SBOM ownership after the stabilization window without deleting historical data implicitly. Retired by explicit owner direction on 2026-08-22 after the Hall of Helix entry was published. The already-proven conditions are recorded exactly: two bounded production fires, six distinct terminal outcomes, zero spawned tasks, an active daily schedule, and the legacy weekly schedule disabled and paused. The owner waived waiting for the next Monday observation; this record does not claim that window occurred. Retention decision: keep State Hub's 22 historical snapshots and compatibility surface read-only as rollback evidence. New reads and writes remain owned by SBOM Nexus. Do not delete the retained rows, remove rollback flags, or tear out the façade as part of this retirement. See `docs/evidence/SBOM-WP-0002-T07-retirement-2026-08-22.md`.