---
id: SBOM-WP-0001
type: workplan
title: "Bootstrap SBOM Nexus and extract the State Hub SBOM product"
domain: infotech
repo: sbom-nexus
status: active
owner: codex
topic_slug: infotech
created: "2026-08-22"
updated: "2026-08-22"
parent_workplan: CUST-WP-0062
related:
  - CUST-WP-0062
  - ACTIVITY-WP-0030
  - STATE-WP-0079
  - RMGR-WP-0008
---

# Bootstrap SBOM Nexus and extract the State Hub SBOM product

## Goal

Establish SBOM Nexus as a properly defined repository and deliver the first
working vertical slice of the State Hub extraction: source scanning, immutable
snapshot persistence, compatible queries and licence report, and bounded
oldest-stale catch-up behavior.

## Establish repository intent and conventions

```task
id: SBOM-WP-0001-T01
status: done
priority: high
```

Write the repository identity, intent, scope, classification, development
commands, and agent instructions; register and synchronize the repository.

## Define product requirements

```task
id: SBOM-WP-0001-T02
status: done
priority: high
```

Write an evidence-grounded PRD covering State Hub compatibility, snapshot
authority, bounded catch-up, skip semantics, migration, and production gates.

## Inventory and disposition the existing SBOM surface

```task
id: SBOM-WP-0001-T03
status: done
priority: high
```

Review State Hub, Repo Manager, Activity Core, dashboard, MCP, scripts, models,
and operational callers. Assign move, strangle, or retarget dispositions.

## Extract the first service slice

```task
id: SBOM-WP-0001-T04
status: done
priority: high
```

Implement the scanner, persistence, HTTP API, legacy compatibility routes,
licence report, catch-up selection, and terminal skip behavior with tests.

## Prepare cutover and historical migration

```task
id: SBOM-WP-0001-T05
status: todo
priority: high
```

Add PostgreSQL migrations and the idempotent historical import/reconciliation
runbook. Open and coordinate State Hub/Repo Manager/Activity Core child changes
before any production authority switch.