tegwick
d61698ea51
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
83 lines
2 KiB
Markdown
83 lines
2 KiB
Markdown
---
|
|
id: SBOM-WP-0001
|
|
type: workplan
|
|
title: "Bootstrap SBOM Nexus and extract the State Hub SBOM product"
|
|
domain: infotech
|
|
repo: sbom-nexus
|
|
status: active
|
|
owner: codex
|
|
topic_slug: infotech
|
|
created: "2026-08-22"
|
|
updated: "2026-08-22"
|
|
parent_workplan: CUST-WP-0062
|
|
related:
|
|
- CUST-WP-0062
|
|
- ACTIVITY-WP-0030
|
|
- STATE-WP-0079
|
|
- RMGR-WP-0008
|
|
---
|
|
|
|
# Bootstrap SBOM Nexus and extract the State Hub SBOM product
|
|
|
|
## Goal
|
|
|
|
Establish SBOM Nexus as a properly defined repository and deliver the first
|
|
working vertical slice of the State Hub extraction: source scanning, immutable
|
|
snapshot persistence, compatible queries and licence report, and bounded
|
|
oldest-stale catch-up behavior.
|
|
|
|
## Establish repository intent and conventions
|
|
|
|
```task
|
|
id: SBOM-WP-0001-T01
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Write the repository identity, intent, scope, classification, development
|
|
commands, and agent instructions; register and synchronize the repository.
|
|
|
|
## Define product requirements
|
|
|
|
```task
|
|
id: SBOM-WP-0001-T02
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Write an evidence-grounded PRD covering State Hub compatibility, snapshot
|
|
authority, bounded catch-up, skip semantics, migration, and production gates.
|
|
|
|
## Inventory and disposition the existing SBOM surface
|
|
|
|
```task
|
|
id: SBOM-WP-0001-T03
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Review State Hub, Repo Manager, Activity Core, dashboard, MCP, scripts, models,
|
|
and operational callers. Assign move, strangle, or retarget dispositions.
|
|
|
|
## Extract the first service slice
|
|
|
|
```task
|
|
id: SBOM-WP-0001-T04
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Implement the scanner, persistence, HTTP API, legacy compatibility routes,
|
|
licence report, catch-up selection, and terminal skip behavior with tests.
|
|
|
|
## Prepare cutover and historical migration
|
|
|
|
```task
|
|
id: SBOM-WP-0001-T05
|
|
status: todo
|
|
priority: high
|
|
```
|
|
|
|
Add PostgreSQL migrations and the idempotent historical import/reconciliation
|
|
runbook. Open and coordinate State Hub/Repo Manager/Activity Core child changes
|
|
before any production authority switch.
|