workplans: record sbom runtime residuals

workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md

@@ -252,6 +252,8 @@ Actionable leftovers are live before closure:
   create real authoritative SBOMs rather than only terminal `no-checkout`
   outcomes;
 - `CUST-IN-0013` routes durable operation-id replay to SBOM Nexus;
+- `CUST-IN-0014` routes the observed 30-minute database-lease restart cycle to
+  SBOM Nexus for credential reread/pool-rotation repair and live proof;
 - `RMGR-WP-0011` remains ready for the authoritative Repo Manager HTTP client
   and explicit non-authoritative preview semantics.
 

workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md

@@ -4,13 +4,17 @@ type: workplan
 title: "Controlled scan inputs for authoritative daily SBOM catch-up"
 domain: infotech
 repo: the-custodian
-status: ready
+status: active
 owner: codex
 topic_slug: custodian
 planning_priority: high
 planning_order: 64
 created: "2026-08-22"
 updated: "2026-08-22"
+quality_dor: DoR-Ok
+quality_dor_at: "2026-08-22"
+quality_dor_by: codex
+quality_dor_note: "Current no-checkout production evidence, owner boundaries, trust decisions, dependencies, acceptance evidence, and rollback requirements were reviewed against SBOM-WP-0002 and ACTIVITY-WP-0030/0033."
 origin: residual
 origin_ref: CUST-WP-0062
 related:
@@ -40,7 +44,7 @@ the deployment package owns the runtime/network boundary.
 
 ```task
 id: CUST-WP-0064-T01
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "02ac7278-8536-5ce8-9027-39345aab0539"
 ```
@@ -54,6 +58,15 @@ behavior, cleanup, and the boundary between preview and authoritative ingest.
 Done when the four owning repos have one reviewable contract and rollback; do
 not enable source transfer from a prose-only assumption.
 
+**Started (2026-08-22):** live verification confirmed the private Nexus pod
+cannot reach projected workstation checkout paths and that queue fairness is
+therefore advancing through `no-checkout` outcomes. The Custodian fixed the
+non-negotiable boundary—revision-pinned input, no workstation mount, bounded
+credentials/egress/time/size, provenance, cleanup, and rollback—and routed
+owner participation to SBOM Nexus (`95c1b226`), Repo Manager (`075e21de`),
+Activity Core (`7233d2d1`), and the package owner (`e0af24b1`). Selection of
+the concrete transfer mechanism remains in progress.
+
 ## Implement the Nexus-owned authoritative scan path
 
 ```task