sbom-nexus/intakes/intakes.md

Intake records

SBOM-IN-0001 — flex-auth → access-engine repository rename: re-ingest the canonical checkout

id: SBOM-IN-0001
kind: intake
title: "flex-auth → access-engine repository rename: re-ingest the canonical checkout"
status: open
origin: cross-repo
origin_ref: FLEX-WP-0020
priority: low
owner: sbom-nexus
requested_by: flex-auth
description: >-
  flex-auth is renaming its repository coordinates to access-engine (old slug
  flex-auth, new slug access-engine; repository UUID
  fda8ad85-a7d7-4055-8f21-902a533e59df and Forge ID 42 unchanged; runtime and
  product names stay flex-auth per FLEX-DEC-2026-013). Required change here:
  re-ingest the new canonical checkout; existing snapshots remain related to the repository UUID. The live rename (FLEX-WP-0020-T06) has not happened; do the change
  after flex-auth announces that access-engine resolves, and record completion
  evidence here. Request message: 08540a29-ecd4-47bc-a87c-7eecf80f166a.
state_hub_intake_id: "01a0f267-b25a-7681-8d41-9627aa0b78ce"

Progress 2026-09-30: rename landed (access-engine resolves; Forge ID 42; new canonical checkout ~/access-engine at head b943d9a). No source file here names flex-auth (only this intake and the generated brief), so the owner-side change is the re-ingest itself: POST /sbom/access-engine/ingest with a forgejo-archive-v1 source_ref pinned to the full SHA, through the normal authenticated automation path, with an Idempotency-Key. That is a live write to the production service and needs its service credential, so it was not run from this session; the intake stays open until that ingest is done and the snapshots are confirmed related to repository UUID fda8ad85-a7d7-4055-8f21-902a533e59df.

Plan 2026-09-30: no manual ingest. repo-manager now registers access-engine (RMGR-IN-0004 closed), so the next scheduled catch-up should ingest it with a frozen source_ref. Close this intake when GET /sbom/catch-up or the snapshot list shows an access-engine snapshot related to the repository UUID; if the next catch-up skips it, run the pinned POST /sbom/access-engine/ingest described above.