sbom-nexus/workplans/SBOM-WP-0001-bootstrap-and-state-hub-extraction.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	parent_workplan	related	state_hub_workstream_id
SBOM-WP-0001	workplan	Bootstrap SBOM Nexus and extract the State Hub SBOM product	infotech	sbom-nexus	finished	codex	infotech	2026-08-22	2026-08-22	CUST-WP-0062	CUST-WP-0062 ACTIVITY-WP-0030 STATE-WP-0079 RMGR-WP-0008	cde7446f-42b1-54ad-9b22-fdc3d49f10a2

Bootstrap SBOM Nexus and extract the State Hub SBOM product

Goal

Establish SBOM Nexus as a properly defined repository and deliver the first working vertical slice of the State Hub extraction: source scanning, immutable snapshot persistence, compatible queries and licence report, and bounded oldest-stale catch-up behavior.

Establish repository intent and conventions

id: SBOM-WP-0001-T01
status: done
priority: high
state_hub_task_id: "6c0cceb4-7572-5d9e-ad43-c0e0ef7022da"

Write the repository identity, intent, scope, classification, development commands, and agent instructions; register and synchronize the repository.

Define product requirements

id: SBOM-WP-0001-T02
status: done
priority: high
state_hub_task_id: "8922fbe0-b249-50fc-8c80-a0578235b94e"

Write an evidence-grounded PRD covering State Hub compatibility, snapshot authority, bounded catch-up, skip semantics, migration, and production gates.

Inventory and disposition the existing SBOM surface

id: SBOM-WP-0001-T03
status: done
priority: high
state_hub_task_id: "3657640a-26cc-5e31-a715-2d5df8867504"

Review State Hub, Repo Manager, Activity Core, dashboard, MCP, scripts, models, and operational callers. Assign move, strangle, or retarget dispositions.

Extract the first service slice

id: SBOM-WP-0001-T04
status: done
priority: high
state_hub_task_id: "c4263ec7-c234-53ac-9b64-b4198691f717"

Implement the scanner, persistence, HTTP API, legacy compatibility routes, licence report, catch-up selection, and terminal skip behavior with tests.

Prepare cutover and historical migration

id: SBOM-WP-0001-T05
status: done
priority: high
state_hub_task_id: "5e281ac9-400d-5a38-b82a-b3c2198a5e7c"

Add PostgreSQL migrations and the idempotent historical import/reconciliation runbook. Open and coordinate State Hub/Repo Manager/Activity Core child changes before any production authority switch.

Completed with a SQLAlchemy SQLite/PostgreSQL store, Alembic baseline and disposable PostgreSQL upgrade/runtime/downgrade proof. A live disposable import reconciled 22 snapshots, 3,123 entries, all licence groups, and copyleft count; the second run was 22/22 idempotent. Production residuals moved to SBOM-WP-0002 and were routed to the three consumer owners.