tegwick 0f083d4d39 chore: keep generated orientation brief local

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 8340@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c

2026-10-21 12:31:40 +02:00

1.5 KiB

Raw Blame History

Scope

One-liner

SBOM Nexus captures, preserves, evaluates, and operationally refreshes software-bill-of-materials evidence for managed repositories.

In scope

repository-source detection and parsing;
immutable SBOM snapshots, entries, provenance, and history;
latest-inventory and snapshot query APIs;
licence inventory and qualified copyleft triage signals;
freshness evaluation and bounded oldest-first catch-up;
State Hub-compatible SBOM routes during migration;
historical State Hub SBOM import and reconciliation;
operator CLI, service packaging, tests, and operational documentation.

Out of scope

repository lifecycle and checkout control (Repo Manager);
recurring scheduling (Activity Core);
general work coordination (State Hub/hub-core/issue-core);
artifact blob storage (Artifact Store);
authentication policy ownership (Flex Auth);
legal advice or a general vulnerability intelligence database;
non-SBOM State Hub extraction.

Current state

The initial extraction milestone SBOM-WP-0001 provides State Hub compatibility, SQLite development, PostgreSQL runtime/migrations, and a proven history importer. SBOM-WP-0002 owns deployment, external caller cutover, and production stabilization.

Local orientation brief policy — 2026-10-21

.custodian-brief.md is a local, ignored State Hub orientation snapshot. Refreshing it does not require a Git commit. Authored workplans and the generated WORK-RECORDS index keep their existing source and staged-generation contracts.

1.5 KiB Raw Blame History