coulomb/sbom-nexus
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
sbom-nexus/SCOPE.md
tegwick 2c10d9754e Adopt staged WORK-RECORDS generation and catch the index up. 
SBOM-WP-0005 finished in 5a1fe3f without the generated index. The opt-in
lets the pre-commit hook rebuild WORK-RECORDS.md in the same commit as
the workplan it indexes.

Assistant: grok
Assistant-Session: 01a17f77-a02b-7372-b1da-d7f74c0bad78
2026-10-27 23:40:48 +01:00

2.2 KiB
Raw Blame History

Scope

One-liner

SBOM Nexus captures, preserves, evaluates, and operationally refreshes software-bill-of-materials evidence for managed repositories.

In scope

  • repository-source detection and parsing;
  • immutable SBOM snapshots, entries, provenance, and history;
  • latest-inventory and snapshot query APIs;
  • licence inventory and qualified copyleft triage signals;
  • freshness evaluation and bounded oldest-first catch-up;
  • State Hub-compatible SBOM routes during migration;
  • historical State Hub SBOM import and reconciliation;
  • operator CLI, service packaging, tests, and operational documentation.

Out of scope

  • repository lifecycle and checkout control (Repo Manager);
  • recurring scheduling (Activity Core);
  • general work coordination (State Hub/hub-core/issue-core);
  • artifact blob storage (Artifact Store);
  • authentication policy ownership (Flex Auth);
  • legal advice or a general vulnerability intelligence database;
  • non-SBOM State Hub extraction.

Current state

The initial extraction milestone SBOM-WP-0001 provides State Hub compatibility, SQLite development, PostgreSQL runtime/migrations, and a proven history importer. SBOM-WP-0002 owns deployment, external caller cutover, and production stabilization.

Generated work-record index

This repository opts into staged-source WORK-RECORDS.md generation through .generated-work-records.json and the isolated .generated-work-records.mk recipe. make generated-work-records reuses the State Hub renderer through the Custodian adapter; make generated-work-records-check verifies byte-exact agreement with staged Markdown. The pre-commit hook uses the isolated recipe, preserves unstaged index edits by refusing them, and retains the generated-only commit guard. It does not contact the hub, alter workplan statuses, or grant deployment authority. This consumes shared tooling; it does not make this repository the provider of the generator capability.

Local orientation brief policy — 2026-10-21

.custodian-brief.md is a local, ignored State Hub orientation snapshot. Refreshing it does not require a Git commit. Authored workplans and the generated WORK-RECORDS index keep their existing source and staged-generation contracts.