tegwick
2c10d9754e
SBOM-WP-0005 finished in 5a1fe3f without the generated index. The opt-in
lets the pre-commit hook rebuild WORK-RECORDS.md in the same commit as
the workplan it indexes.
Assistant: grok
Assistant-Session: 01a17f77-a02b-7372-b1da-d7f74c0bad78
52 lines
2.2 KiB
Markdown
52 lines
2.2 KiB
Markdown
# Scope
|
|
|
|
## One-liner
|
|
|
|
SBOM Nexus captures, preserves, evaluates, and operationally refreshes
|
|
software-bill-of-materials evidence for managed repositories.
|
|
|
|
## In scope
|
|
|
|
- repository-source detection and parsing;
|
|
- immutable SBOM snapshots, entries, provenance, and history;
|
|
- latest-inventory and snapshot query APIs;
|
|
- licence inventory and qualified copyleft triage signals;
|
|
- freshness evaluation and bounded oldest-first catch-up;
|
|
- State Hub-compatible SBOM routes during migration;
|
|
- historical State Hub SBOM import and reconciliation;
|
|
- operator CLI, service packaging, tests, and operational documentation.
|
|
|
|
## Out of scope
|
|
|
|
- repository lifecycle and checkout control (Repo Manager);
|
|
- recurring scheduling (Activity Core);
|
|
- general work coordination (State Hub/hub-core/issue-core);
|
|
- artifact blob storage (Artifact Store);
|
|
- authentication policy ownership (Flex Auth);
|
|
- legal advice or a general vulnerability intelligence database;
|
|
- non-SBOM State Hub extraction.
|
|
|
|
## Current state
|
|
|
|
The initial extraction milestone `SBOM-WP-0001` provides State Hub
|
|
compatibility, SQLite development, PostgreSQL runtime/migrations, and a proven
|
|
history importer. `SBOM-WP-0002` owns deployment, external caller cutover, and
|
|
production stabilization.
|
|
|
|
## Generated work-record index
|
|
|
|
This repository opts into staged-source WORK-RECORDS.md generation through
|
|
`.generated-work-records.json` and the isolated `.generated-work-records.mk`
|
|
recipe. `make generated-work-records` reuses the State Hub renderer through
|
|
the Custodian adapter; `make generated-work-records-check` verifies byte-exact
|
|
agreement with staged Markdown. The pre-commit hook uses the isolated recipe,
|
|
preserves unstaged index edits by refusing them, and retains the generated-only
|
|
commit guard. It does not contact the hub, alter workplan statuses, or grant
|
|
deployment authority. This consumes shared tooling; it does not make this
|
|
repository the provider of the generator capability.
|
|
|
|
## Local orientation brief policy — 2026-10-21
|
|
|
|
`.custodian-brief.md` is a local, ignored State Hub orientation snapshot. Refreshing
|
|
it does not require a Git commit. Authored workplans and the generated
|
|
WORK-RECORDS index keep their existing source and staged-generation contracts.
|