coulomb/sbom-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
sbom-nexus/docs/evidence/SBOM-WP-0001-postgres-and-history-rehearsal-2026-08-22.md
tegwick ba535e1f8f feat: prepare postgres sbom cutover 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
2026-08-22 13:14:24 +02:00

2.8 KiB
Raw Blame History

PostgreSQL and State Hub history rehearsal — 2026-08-22

Scope

Evidence for SBOM-WP-0001-T05. No production SBOM authority or State Hub rows were changed. PostgreSQL and Nexus history targets were disposable.

PostgreSQL migration/runtime proof

A disposable postgres:16-alpine instance received:

  1. alembic upgrade head from an empty database;
  2. the PostgreSQL API contract test (health, repository upsert, manual ingest, current view, and licence report); and
  3. alembic downgrade base.

All three completed successfully. The container was stopped and removed after the test.

The production Containerfile also built as sbom-nexus:test; a disposable container started as uid 10001 and returned a successful /state/health response using its writable /data SQLite development default.

Live State Hub history baseline

Read-only source: workstation State Hub at 127.0.0.1:8000.

Measure Value
Repositories with history 18
Historical snapshots 22
Historical entries 3,123
Oldest snapshot 2026-03-01T15:12:54.862697Z
Newest snapshot 2026-07-08T20:37:48.255925Z

Disposable import result

The first import created all 22 snapshots in a temporary Nexus SQLite database. Snapshot reconciliation succeeded immediately:

  • expected/matched snapshots: 22/22;
  • expected/target imported entries: 3,123/3,123;
  • missing legacy ids: 0;
  • snapshot field mismatches: 0.

The initial licence comparison reported a mismatch solely because the two APIs returned equal groups in different orders. Group ordering is not contractual; the importer was corrected to compare normalized groups keyed by licence.

The second run then proved both correctness and idempotence:

  • already_present: 22;
  • snapshot reconciliation: pass;
  • licence groups: exact normalized match;
  • source/target direct-production copyleft count: 4/4;
  • overall result: pass.

Production gate retained

This is migration-mechanism evidence, not authority cutover approval. Production still requires a managed PostgreSQL service, backup/restore evidence, deployment health, State Hub façade and projection changes, Repo Manager retargeting, Activity Core bounded-ingest activation, and a stabilization window.

Consumer handoffs

State Hub coordination messages were sent from sbom-nexus with the cutover plan and explicit ownership boundaries:

Consumer Message id Requested child slice
State Hub 5a28a4e8-476a-4766-8e11-9c8b4f4cf57a reversible compatibility façade and caller retargeting
Repo Manager 62d3bd49-9050-458f-9aa9-b6af348f9eb0 retarget scanner/report interface and remove competing authority
Activity Core 3420be55-d0ad-4eb7-93b2-42ac4281c61d unblock bounded ingest while retaining deployment gates