tegwick
ba535e1f8f
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
74 lines
2.8 KiB
Markdown
74 lines
2.8 KiB
Markdown
# PostgreSQL and State Hub history rehearsal — 2026-08-22
|
|
|
|
## Scope
|
|
|
|
Evidence for `SBOM-WP-0001-T05`. No production SBOM authority or State Hub rows
|
|
were changed. PostgreSQL and Nexus history targets were disposable.
|
|
|
|
## PostgreSQL migration/runtime proof
|
|
|
|
A disposable `postgres:16-alpine` instance received:
|
|
|
|
1. `alembic upgrade head` from an empty database;
|
|
2. the PostgreSQL API contract test (health, repository upsert, manual ingest,
|
|
current view, and licence report); and
|
|
3. `alembic downgrade base`.
|
|
|
|
All three completed successfully. The container was stopped and removed after
|
|
the test.
|
|
|
|
The production `Containerfile` also built as `sbom-nexus:test`; a disposable
|
|
container started as uid 10001 and returned a successful `/state/health`
|
|
response using its writable `/data` SQLite development default.
|
|
|
|
## Live State Hub history baseline
|
|
|
|
Read-only source: workstation State Hub at `127.0.0.1:8000`.
|
|
|
|
| Measure | Value |
|
|
| --- | ---: |
|
|
| Repositories with history | 18 |
|
|
| Historical snapshots | 22 |
|
|
| Historical entries | 3,123 |
|
|
| Oldest snapshot | 2026-03-01T15:12:54.862697Z |
|
|
| Newest snapshot | 2026-07-08T20:37:48.255925Z |
|
|
|
|
## Disposable import result
|
|
|
|
The first import created all 22 snapshots in a temporary Nexus SQLite database.
|
|
Snapshot reconciliation succeeded immediately:
|
|
|
|
- expected/matched snapshots: 22/22;
|
|
- expected/target imported entries: 3,123/3,123;
|
|
- missing legacy ids: 0;
|
|
- snapshot field mismatches: 0.
|
|
|
|
The initial licence comparison reported a mismatch solely because the two APIs
|
|
returned equal groups in different orders. Group ordering is not contractual;
|
|
the importer was corrected to compare normalized groups keyed by licence.
|
|
|
|
The second run then proved both correctness and idempotence:
|
|
|
|
- `already_present`: 22;
|
|
- snapshot reconciliation: pass;
|
|
- licence groups: exact normalized match;
|
|
- source/target direct-production copyleft count: 4/4;
|
|
- overall result: pass.
|
|
|
|
## Production gate retained
|
|
|
|
This is migration-mechanism evidence, not authority cutover approval. Production
|
|
still requires a managed PostgreSQL service, backup/restore evidence, deployment
|
|
health, State Hub façade and projection changes, Repo Manager retargeting,
|
|
Activity Core bounded-ingest activation, and a stabilization window.
|
|
|
|
## Consumer handoffs
|
|
|
|
State Hub coordination messages were sent from `sbom-nexus` with the cutover
|
|
plan and explicit ownership boundaries:
|
|
|
|
| Consumer | Message id | Requested child slice |
|
|
| --- | --- | --- |
|
|
| State Hub | `5a28a4e8-476a-4766-8e11-9c8b4f4cf57a` | reversible compatibility façade and caller retargeting |
|
|
| Repo Manager | `62d3bd49-9050-458f-9aa9-b6af348f9eb0` | retarget scanner/report interface and remove competing authority |
|
|
| Activity Core | `3420be55-d0ad-4eb7-93b2-42ac4281c61d` | unblock bounded ingest while retaining deployment gates |
|