tegwick
94c4435b66
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b22-9638-76d2-bbff-b7ea1770b118
100 lines
3.6 KiB
Markdown
100 lines
3.6 KiB
Markdown
---
|
|
id: SBOM-WP-0003
|
|
type: workplan
|
|
title: "Controlled Forgejo source ingestion and durable operation replay"
|
|
domain: infotech
|
|
repo: sbom-nexus
|
|
status: active
|
|
owner: codex
|
|
topic_slug: infotech
|
|
created: "2026-08-22"
|
|
updated: "2026-08-23"
|
|
quality_dor: DoR-Ok
|
|
quality_dor_at: "2026-08-22"
|
|
quality_dor_by: codex
|
|
quality_dor_note: "CUST-WP-0064 selected a full-SHA public Forgejo archive contract with bounded extraction, explicit provenance, owner handoffs, idempotency, failure semantics, acceptance evidence, and rollback."
|
|
parent_workplan: CUST-WP-0064
|
|
related:
|
|
- CUST-IN-0013
|
|
- ACTIVITY-WP-0033
|
|
- RMGR-WP-0011
|
|
state_hub_workstream_id: "dc07cc14-9a5d-568d-8e19-036661e52120"
|
|
---
|
|
|
|
# Controlled Forgejo source ingestion and durable operation replay
|
|
|
|
## Implement durable operation receipts
|
|
|
|
```task
|
|
id: SBOM-WP-0003-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "ad2b95fd-a7b1-5331-a8c3-1545fdb6db10"
|
|
```
|
|
|
|
Enforce supplied `Idempotency-Key` / `X-Activity-Core-Operation-ID` values on
|
|
repository ingest and skip. Persist a request fingerprint and snapshot link in
|
|
the same transaction, replay the original terminal outcome, and reject key
|
|
reuse for a different operation.
|
|
|
|
Completed with migration `0002`, transactional operation receipts, early
|
|
replay before source work, request-conflict HTTP 409 behavior, and ingest/skip
|
|
tests proving one snapshot across duplicate requests.
|
|
|
|
## Add controlled full-SHA source ingestion
|
|
|
|
```task
|
|
id: SBOM-WP-0003-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "3a8734f2-c00e-584f-b5ff-f22370a5ce02"
|
|
```
|
|
|
|
Consume the `forgejo-archive-v1` source reference selected in
|
|
`the-custodian/docs/sbom-controlled-scan-input-contract-v1.md`. Validate the
|
|
identity, stream and safely extract within fixed limits, pass the explicit
|
|
revision into the scanner, persist archive provenance, and always clean up.
|
|
|
|
Completed with strict Coulomb identity/full-SHA validation, same-host fetches,
|
|
streaming compressed limits, safe regular-file-only extraction, one scan slot,
|
|
subprocess scan timeout, explicit revision override, archive provenance, and
|
|
temporary-directory cleanup. A real Forgejo archive scan produced 33 entries
|
|
from one manifest with zero errors.
|
|
|
|
## Extend repository projection and outcomes
|
|
|
|
```task
|
|
id: SBOM-WP-0003-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "5be7b81e-0469-5d74-a28c-8802187a122a"
|
|
```
|
|
|
|
Store and return source references in repository/catch-up projections. Add
|
|
terminal `source-unavailable` and `source-rejected` outcomes without changing
|
|
oldest-N ranking or success-time semantics.
|
|
|
|
Completed in the repository projection, API model, storage schema, catch-up
|
|
response, and additive skip handling. Legacy checkout scanning remains
|
|
available for local/operator compatibility while the production flag is dark.
|
|
|
|
## Prove package integration and production behavior
|
|
|
|
```task
|
|
id: SBOM-WP-0003-T04
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "9c8a2b6c-2b99-5dd8-9c1c-b5ba4ad2367b"
|
|
```
|
|
|
|
Coordinate the schema migration, ephemeral volume, Forgejo-only egress, and
|
|
feature flag with `rapp-sbom-nexus`; then pass unit/integration tests and the
|
|
attended plus scheduled production proof owned by CUST-WP-0064.
|
|
|
|
The package promoted digest
|
|
`sha256:1da0f4f008643a0dec3f00bbad15f287103aa4b469577b78cfe1d67f8b3cbe31`
|
|
after migration `0002`. The attended `sbom-nexus` canary produced snapshot
|
|
`04f5c0ba-d073-4577-ba2d-0854346ac7be`: 33 entries, exact full-SHA revision,
|
|
archive SHA-256/byte provenance, zero errors, identical replay under the same
|
|
operation key, and an empty transient directory before and after. The feature
|
|
is dark again with snapshot history intact; scheduled proof remains.
|