tegwick
01fb7ecdda
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
122 lines
3.5 KiB
Markdown
122 lines
3.5 KiB
Markdown
---
|
|
id: SBOM-WP-0002
|
|
type: workplan
|
|
title: "Deploy and cut over SBOM Nexus production authority"
|
|
domain: infotech
|
|
repo: sbom-nexus
|
|
status: active
|
|
owner: codex
|
|
topic_slug: infotech
|
|
created: "2026-08-22"
|
|
updated: "2026-08-22"
|
|
quality_dor: DoR-Ok
|
|
quality_dor_at: "2026-08-22"
|
|
quality_dor_by: codex
|
|
quality_dor_note: "Goal, ownership boundaries, staged dependencies, production safety gates, reconciliation evidence, rollback paths, and cross-repository handoffs were reviewed against the implemented Nexus contract and current State Hub history."
|
|
parent_workplan: CUST-WP-0062
|
|
related:
|
|
- SBOM-WP-0001
|
|
- CUST-WP-0062
|
|
- ACTIVITY-WP-0030
|
|
- STATE-WP-0079
|
|
- RMGR-WP-0008
|
|
state_hub_workstream_id: "7729a4bd-c1c4-50b9-a3b6-1faa51fff97d"
|
|
---
|
|
|
|
# Deploy and cut over SBOM Nexus production authority
|
|
|
|
## Goal
|
|
|
|
Deploy SBOM Nexus with managed PostgreSQL, import and reconcile State Hub
|
|
history, move callers through reversible compatibility stages, and prove the
|
|
bounded daily catch-up before retiring State Hub SBOM ownership.
|
|
|
|
## Deploy dark with managed PostgreSQL
|
|
|
|
```task
|
|
id: SBOM-WP-0002-T01
|
|
status: progress
|
|
priority: high
|
|
needs_human: true
|
|
intervention_note: "Warden requires operator OIDC/MFA for first rapp-sbom-nexus Forgejo repository creation and one-time secret provisioning for platform-pg-2/OpenBao."
|
|
state_hub_task_id: "95a520d4-30c2-5c87-8054-6bfe549c2686"
|
|
```
|
|
|
|
Provision database credentials through the governed route, migrate schema,
|
|
deploy the API without callers, and capture health plus backup/restore evidence.
|
|
Image publication, package rendering, family validation, and server-side dry-run
|
|
are complete; see
|
|
`docs/evidence/SBOM-WP-0002-T01-dark-deployment-preflight-2026-08-22.md`.
|
|
|
|
## Synchronize repository projections
|
|
|
|
```task
|
|
id: SBOM-WP-0002-T02
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "22cbb75f-d82f-5b47-9fef-27bde3b410d5"
|
|
```
|
|
|
|
Populate active repository identity and host checkout paths from Repo Manager.
|
|
Verify fleet totals and catch-up ordering without performing ingest.
|
|
|
|
## Import and reconcile State Hub history
|
|
|
|
```task
|
|
id: SBOM-WP-0002-T03
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "49bd74a5-d806-5d8e-9d75-0d465b380171"
|
|
```
|
|
|
|
Depends on T01/T02. Back up the empty target, run the idempotent importer, and
|
|
retain an exact reconciliation report before any caller switch.
|
|
|
|
## Cut over State Hub compatibility façade
|
|
|
|
```task
|
|
id: SBOM-WP-0002-T04
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "e7681dce-e3b6-52d1-bf13-92595b082b09"
|
|
```
|
|
|
|
Depends on T03 and the State Hub child change. Move reads then writes behind
|
|
reversible flags; retarget dashboard, MCP, CLI, summary, DoI, and onboarding.
|
|
|
|
## Retarget Repo Manager scanner interface
|
|
|
|
```task
|
|
id: SBOM-WP-0002-T05
|
|
status: wait
|
|
priority: medium
|
|
state_hub_task_id: "59f83f01-13bc-5a63-bb0b-bf527047762e"
|
|
```
|
|
|
|
Depends on dark deployment. Preserve CLI usability while removing competing
|
|
SBOM product authority and pinning the Nexus contract.
|
|
|
|
## Enable bounded Activity Core ingest
|
|
|
|
```task
|
|
id: SBOM-WP-0002-T06
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "dad4577d-5dcf-5452-b65e-d72299f432be"
|
|
```
|
|
|
|
Depends on T03/T04 and `ACTIVITY-WP-0030`. Enable no more than N ingests/skips
|
|
per fire with zero spawned catch-up tasks.
|
|
|
|
## Stabilize and retire legacy ownership
|
|
|
|
```task
|
|
id: SBOM-WP-0002-T07
|
|
status: wait
|
|
priority: medium
|
|
state_hub_task_id: "bb1ff087-f204-5fd0-9295-3bd10bf0d38a"
|
|
```
|
|
|
|
Capture two successful daily fires and a zero-flood Monday window. Record the
|
|
retention decision, then retire State Hub SBOM ownership after the stabilization
|
|
window without deleting historical data implicitly.
|