---
id: SBOM-WP-0003
type: workplan
title: "Controlled Forgejo source ingestion and durable operation replay"
domain: infotech
repo: sbom-nexus
status: finished
owner: codex
topic_slug: infotech
created: "2026-08-22"
updated: "2026-08-23"
quality_dor: DoR-Ok
quality_dor_at: "2026-08-22"
quality_dor_by: codex
quality_dor_note: "CUST-WP-0064 selected a full-SHA public Forgejo archive contract with bounded extraction, explicit provenance, owner handoffs, idempotency, failure semantics, acceptance evidence, and rollback."
parent_workplan: CUST-WP-0064
related:
  - CUST-IN-0013
  - ACTIVITY-WP-0033
  - RMGR-WP-0011
state_hub_workstream_id: "dc07cc14-9a5d-568d-8e19-036661e52120"
---

# Controlled Forgejo source ingestion and durable operation replay

## Implement durable operation receipts

```task
id: SBOM-WP-0003-T01
status: done
priority: high
state_hub_task_id: "ad2b95fd-a7b1-5331-a8c3-1545fdb6db10"
```

Enforce supplied `Idempotency-Key` / `X-Activity-Core-Operation-ID` values on
repository ingest and skip. Persist a request fingerprint and snapshot link in
the same transaction, replay the original terminal outcome, and reject key
reuse for a different operation.

Completed with migration `0002`, transactional operation receipts, early
replay before source work, request-conflict HTTP 409 behavior, and ingest/skip
tests proving one snapshot across duplicate requests.

## Add controlled full-SHA source ingestion

```task
id: SBOM-WP-0003-T02
status: done
priority: high
state_hub_task_id: "3a8734f2-c00e-584f-b5ff-f22370a5ce02"
```

Consume the `forgejo-archive-v1` source reference selected in
`the-custodian/docs/sbom-controlled-scan-input-contract-v1.md`. Validate the
identity, stream and safely extract within fixed limits, pass the explicit
revision into the scanner, persist archive provenance, and always clean up.

Completed with strict Coulomb identity/full-SHA validation, same-host fetches,
streaming compressed limits, safe regular-file-only extraction, one scan slot,
subprocess scan timeout, explicit revision override, archive provenance, and
temporary-directory cleanup. A real Forgejo archive scan produced 33 entries
from one manifest with zero errors.

## Extend repository projection and outcomes

```task
id: SBOM-WP-0003-T03
status: done
priority: high
state_hub_task_id: "5be7b81e-0469-5d74-a28c-8802187a122a"
```

Store and return source references in repository/catch-up projections. Add
terminal `source-unavailable` and `source-rejected` outcomes without changing
oldest-N ranking or success-time semantics.

Completed in the repository projection, API model, storage schema, catch-up
response, and additive skip handling. Legacy checkout scanning remains
available for local/operator compatibility while the production flag is dark.

## Prove package integration and production behavior

```task
id: SBOM-WP-0003-T04
status: done
priority: high
state_hub_task_id: "9c8a2b6c-2b99-5dd8-9c1c-b5ba4ad2367b"
```

Coordinate the schema migration, ephemeral volume, Forgejo-only egress, and
feature flag with `rapp-sbom-nexus`; then pass unit/integration tests and the
attended plus scheduled production proof owned by CUST-WP-0064.

The package promoted digest
`sha256:1da0f4f008643a0dec3f00bbad15f287103aa4b469577b78cfe1d67f8b3cbe31`
after migration `0002`. The attended `sbom-nexus` canary produced snapshot
`04f5c0ba-d073-4577-ba2d-0854346ac7be`: 33 entries, exact full-SHA revision,
archive SHA-256/byte provenance, zero errors, identical replay under the same
operation key, and an empty transient directory before and after. The feature
is dark again with snapshot history intact; scheduled proof remains.

The existing enabled Temporal schedule was then reconciled unchanged and
operator-triggered through its normal schedule action. It froze exactly three
controlled targets, issued three successful Nexus writes, spawned zero tasks,
and created provenance-bearing terminal snapshots
`62f5f596-f644-4992-b356-f06b832eef07`,
`6849b000-d7ac-4d06-a104-51d2610a67df`, and
`526e03bf-a71c-4095-ba8a-31a46a2adfc9`. All three correctly reported
`no-manifest`; `never_count` advanced 94 to 91. The feature is enabled for the
bounded schedule. Unassisted weekday observation and ongoing source-reference
projection remain live in `CUST-WP-0064` / `ACTIVITY-WP-0034`.