# SBOM-WP-0002 T05 — Repo Manager scanner handoff evidence

Date: 2026-08-22

Repo Manager commit `ad0ba6f` removes its duplicate SBOM scanner and leaves
SBOM Nexus as the single scanner/snapshot product owner.

Changes:

- deleted `src/repo_manager/sbom.py` (326 lines of parser, source detection,
  licence triage, and snapshot rendering);
- replaced parser-specific tests with compatibility-delegation tests;
- retained `rmgr sbom scan` and `rmgr sbom licence-report` as thin aliases;
- invokes `sbom-nexus` directly with `shell=False`, discovered on `PATH` or via
  `SBOM_NEXUS_CLI`;
- preserved scan output-file refusal and `--force` behavior;
- pinned authority in JSON with `schema=sbom-nexus.snapshot.v1`,
  `product_owner=sbom-nexus`, and `delegated_by=repo-manager`;
- corrected Repo Manager's earlier interim-scanner workplan/evidence and placed
  the direct `sbom-nexus scan` command first in operator documentation.

Verification:

- Repo Manager Ruff: passed;
- Repo Manager complete test suite: 87 passed;
- real `rmgr sbom scan` delegation: 39 entries, Git revision present, no errors;
- real `rmgr sbom licence-report` without an environment override: 39 entries,
  copyleft direct count 0, no errors;
- the local SBOM Nexus package was installed as an operator tool so the
  compatibility aliases work on the default PATH.

Repo Manager retains file-backed `sbom-inventory` register representation as a
repository concern, but it no longer evaluates sources or owns product
snapshots. Detailed owner-side evidence is in
`repo-manager/docs/evidence/RMGR-WP-0008-sbom-authority-handoff-2026-08-22.md`.