workplans: record sbom runtime residuals

WORK-RECORDS.md

@@ -62,7 +62,7 @@
 | workplan | CUST-WP-0061 | finished | — | workplans/CUST-WP-0061-work-record-stage3-intake-promotion-index.md |
 | workplan | CUST-WP-0062 | finished | — | workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md |
 | workplan | CUST-WP-0063 | finished | — | workplans/CUST-WP-0063-inbox-governance-packets.md |
-| workplan | CUST-WP-0064 | ready | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md |
+| workplan | CUST-WP-0064 | active | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md |
 | task | ADHOC-2026-05-02-T01 | done | — | workplans/ADHOC-2026-05-02.md |
 | task | ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
 | task | CUST-WP-0001-T01 | done | — | workplans/CUST-WP-0001-custodian-agent-runtime.md |
@@ -406,7 +406,7 @@
 | task | CUST-WP-0063-T03 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md |
 | task | CUST-WP-0063-T04 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md |
 | task | CUST-WP-0063-T05 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md |
-| task | CUST-WP-0064-T01 | todo | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md |
+| task | CUST-WP-0064-T01 | progress | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md |
 | task | CUST-WP-0064-T02 | wait | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md |
 | task | CUST-WP-0064-T03 | wait | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md |
 | task | CUST-WP-0064-T04 | wait | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md |
@@ -423,3 +423,4 @@
 | intake | CUST-IN-0011 | routed | red | intakes.md |
 | intake | CUST-IN-0012 | open | green | intakes.md |
 | intake | CUST-IN-0013 | open | blue | intakes.md |
+| intake | CUST-IN-0014 | open | blue | intakes.md |

intakes.md

@@ -50,3 +50,18 @@ origin_ref: CUST-WP-0062
 notes: "Activity Core completed ACTIVITY-WP-0033 and now sends a stable Idempotency-Key plus X-Activity-Core-Operation-ID for each workflow-run/repository pair. SBOM Nexus must durably enforce that identity on both POST /sbom/{slug}/ingest and POST /sbom/{slug}/skip and replay the original terminal response. This closes the crash window where Nexus commits but the worker dies before its heartbeat. Source handoff: State Hub message bc5caa49-25eb-4942-9deb-411b6080d0bb."
 state_hub_intake_id: "01a02b44-89a9-7e94-820b-3d86340117ff"
 ```
+
+## CUST-IN-0014 — Stop SBOM Nexus restarts on database lease rotation
+
+```yaml
+id: CUST-IN-0014
+kind: intake
+title: "Stop SBOM Nexus restarts on database lease rotation"
+status: open
+lane: blue
+priority: high
+owner: sbom-nexus
+origin: residual
+origin_ref: CUST-WP-0062
+notes: "Live review after cutover found the Ready SBOM Nexus pod at restartCount 9 in under five hours. The last container ran exactly 30 minutes, then readiness/liveness returned HTTP 500 because PostgreSQL rejected the expired v-token-sbom-nex-* credential; Kubernetes restarted the process and it recovered. ESO continues updating the mounted runtime Secret, but the process/SQLAlchemy engine does not adopt the new credential before expiry. Implement a value-safe rotation path that rereads the mounted credential and disposes/rebuilds the pool, or an explicitly coordinated rollout on Secret revision; prove lease rotation without recurring liveness-driven restarts and without logging credential values. Evidence observed 2026-08-22: last termination Completed at 20:43:45Z after start 20:13:45Z, current pod Ready, prior log psycopg password authentication failure."
+```

workplans/CUST-WP-0062-sbom-nexus-daily-catchup.md

@@ -252,6 +252,8 @@ Actionable leftovers are live before closure:
   create real authoritative SBOMs rather than only terminal `no-checkout`
   outcomes;
 - `CUST-IN-0013` routes durable operation-id replay to SBOM Nexus;
+- `CUST-IN-0014` routes the observed 30-minute database-lease restart cycle to
+  SBOM Nexus for credential reread/pool-rotation repair and live proof;
 - `RMGR-WP-0011` remains ready for the authoritative Repo Manager HTTP client
   and explicit non-authoritative preview semantics.
 

workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md

@@ -4,13 +4,17 @@ type: workplan
 title: "Controlled scan inputs for authoritative daily SBOM catch-up"
 domain: infotech
 repo: the-custodian
-status: ready
+status: active
 owner: codex
 topic_slug: custodian
 planning_priority: high
 planning_order: 64
 created: "2026-08-22"
 updated: "2026-08-22"
+quality_dor: DoR-Ok
+quality_dor_at: "2026-08-22"
+quality_dor_by: codex
+quality_dor_note: "Current no-checkout production evidence, owner boundaries, trust decisions, dependencies, acceptance evidence, and rollback requirements were reviewed against SBOM-WP-0002 and ACTIVITY-WP-0030/0033."
 origin: residual
 origin_ref: CUST-WP-0062
 related:
@@ -40,7 +44,7 @@ the deployment package owns the runtime/network boundary.
 
 ```task
 id: CUST-WP-0064-T01
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "02ac7278-8536-5ce8-9027-39345aab0539"
 ```
@@ -54,6 +58,15 @@ behavior, cleanup, and the boundary between preview and authoritative ingest.
 Done when the four owning repos have one reviewable contract and rollback; do
 not enable source transfer from a prose-only assumption.
 
+**Started (2026-08-22):** live verification confirmed the private Nexus pod
+cannot reach projected workstation checkout paths and that queue fairness is
+therefore advancing through `no-checkout` outcomes. The Custodian fixed the
+non-negotiable boundary—revision-pinned input, no workstation mount, bounded
+credentials/egress/time/size, provenance, cleanup, and rollback—and routed
+owner participation to SBOM Nexus (`95c1b226`), Repo Manager (`075e21de`),
+Activity Core (`7233d2d1`), and the package owner (`e0af24b1`). Selection of
+the concrete transfer mechanism remains in progress.
+
 ## Implement the Nexus-owned authoritative scan path
 
 ```task