# Scope

## One-liner

SBOM Nexus captures, preserves, evaluates, and operationally refreshes
software-bill-of-materials evidence for managed repositories.

## In scope

- repository-source detection and parsing;
- immutable SBOM snapshots, entries, provenance, and history;
- latest-inventory and snapshot query APIs;
- licence inventory and qualified copyleft triage signals;
- freshness evaluation and bounded oldest-first catch-up;
- State Hub-compatible SBOM routes during migration;
- historical State Hub SBOM import and reconciliation;
- operator CLI, service packaging, tests, and operational documentation.

## Out of scope

- repository lifecycle and checkout control (Repo Manager);
- recurring scheduling (Activity Core);
- general work coordination (State Hub/hub-core/issue-core);
- artifact blob storage (Artifact Store);
- authentication policy ownership (Flex Auth);
- legal advice or a general vulnerability intelligence database;
- non-SBOM State Hub extraction.

## Current state

The initial extraction milestone `SBOM-WP-0001` provides State Hub
compatibility, SQLite development, PostgreSQL runtime/migrations, and a proven
history importer. `SBOM-WP-0002` owns deployment, external caller cutover, and
production stabilization.