# SBOM-WP-0002-T02 repository projection rehearsal — 2026-08-22

## Result

The projection-only synchronization path is implemented and rehearsed against
an isolated SBOM Nexus database. It does not scan repositories, invoke an
ingest route, or create snapshots.

## Source and selection

The current Repo Manager compatibility projection was read from State Hub's
`GET /repos/` boundary using explicit host id `bnt-lap001`:

| Measure | Result |
| --- | ---: |
| Source repositories | 120 |
| Active | 116 |
| Inactive | 4 |
| Selected checkout path | 120 |

The dry-run used an intentionally unreachable target URL and still completed,
proving that dry-run does not contact or mutate the Nexus target.

## Apply rehearsal

An ephemeral SQLite-backed Nexus on `127.0.0.1:18010` received the projection:

- 120 upserts;
- 120 exact active/path matches on read-back;
- zero missing, mismatched, or extra target repositories;
- zero SBOM ingest calls and zero snapshots.

The bounded catch-up query with `limit=3` returned exactly three of 116 active,
never-attempted repositories, ordered deterministically by slug:
`activity-core`, `adaptive-pricing`, and `agent-harness`. The response reported
`selected_count=3`, `never_count=116`, `stale_count=116`, and
`total_count=116`.

Production apply remains gated on the dark PostgreSQL runtime in
`SBOM-WP-0002-T01`.

## Verification

- `uv run ruff check src tests scripts`: pass
- `uv run pytest -q`: 15 passed, 1 conditional PostgreSQL skip
- projection dry-run: 120 would-upsert, target not contacted
- projection apply/read-back: 120/120 matched
- bounded catch-up: 3/3 selected in deterministic order