tegwick
d61698ea51
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
32 lines
1 KiB
Markdown
32 lines
1 KiB
Markdown
# sbom-nexus
|
|
|
|
SBOM Nexus is the dedicated software-bill-of-materials service for the Coulomb
|
|
fleet. It captures dependency evidence from repositories, keeps immutable
|
|
snapshots, evaluates licence risk and freshness, and provides a bounded catch-up
|
|
queue for automation.
|
|
|
|
The product direction is defined in [INTENT.md](INTENT.md). The first delivery
|
|
contract is in [ProductRequirementsDocument.md](ProductRequirementsDocument.md).
|
|
|
|
## Development
|
|
|
|
```bash
|
|
uv sync --dev
|
|
uv run pytest
|
|
uv run ruff check src tests
|
|
uv run sbom-nexus serve --reload
|
|
```
|
|
|
|
The default API listens on `http://127.0.0.1:8010`. Its data location can be
|
|
changed with `SBOM_NEXUS_DATABASE_PATH`.
|
|
|
|
## Initial API surface
|
|
|
|
- `GET /state/health`
|
|
- `PUT /repositories/{repo_slug}`
|
|
- `GET /sbom/catch-up?limit=3`
|
|
- `POST /sbom/{repo_slug}/ingest`
|
|
- State Hub-compatible `/sbom/` snapshot, entry, repository, and licence routes
|
|
|
|
See [docs/state-hub-sbom-extraction-review.md](docs/state-hub-sbom-extraction-review.md)
|
|
for the extraction inventory and cutover dispositions.
|