diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 4f2833f..a4b2ead 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -407,9 +407,9 @@ | task | CUST-WP-0063-T04 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md | | task | CUST-WP-0063-T05 | done | — | workplans/CUST-WP-0063-inbox-governance-packets.md | | task | CUST-WP-0064-T01 | done | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | -| task | CUST-WP-0064-T02 | progress | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | -| task | CUST-WP-0064-T03 | wait | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | -| task | CUST-WP-0064-T04 | wait | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | +| task | CUST-WP-0064-T02 | done | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | +| task | CUST-WP-0064-T03 | progress | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | +| task | CUST-WP-0064-T04 | progress | — | workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md | | intake | CUST-IN-0001 | closed | green | intake-legacy-suggestions-migration.md | | intake | CUST-IN-0002 | closed | green | intake-legacy-suggestions-migration.md | | intake | CUST-IN-0003 | closed | green | intake-legacy-suggestions-migration.md | diff --git a/intakes.md b/intakes.md index 98bb2ea..381fc43 100644 --- a/intakes.md +++ b/intakes.md @@ -47,7 +47,7 @@ priority: high owner: sbom-nexus origin: residual origin_ref: CUST-WP-0062 -notes: "Activity Core completed ACTIVITY-WP-0033 and now sends a stable Idempotency-Key plus X-Activity-Core-Operation-ID for each workflow-run/repository pair. SBOM Nexus must durably enforce that identity on both POST /sbom/{slug}/ingest and POST /sbom/{slug}/skip and replay the original terminal response. This closes the crash window where Nexus commits but the worker dies before its heartbeat. Source handoff: State Hub message bc5caa49-25eb-4942-9deb-411b6080d0bb." +notes: "Activity Core completed ACTIVITY-WP-0033 and now sends a stable Idempotency-Key plus X-Activity-Core-Operation-ID for each workflow-run/repository pair. SBOM Nexus durably enforces that identity on both POST /sbom/{slug}/ingest and POST /sbom/{slug}/skip and replays the original terminal response. Live attended evidence on 2026-08-23 returned the same snapshot 04f5c0ba-d073-4577-ba2d-0854346ac7be for two requests with the same operation key and exact source reference. Scheduled Activity Core proof remains under CUST-WP-0064. Source handoff: State Hub message bc5caa49-25eb-4942-9deb-411b6080d0bb." state_hub_intake_id: "01a02b44-89a9-7e94-820b-3d86340117ff" ``` @@ -63,5 +63,5 @@ priority: high owner: sbom-nexus origin: residual origin_ref: CUST-WP-0062 -notes: "Live review after cutover found the Ready SBOM Nexus pod at restartCount 9 in under five hours. The last container ran exactly 30 minutes, then readiness/liveness returned HTTP 500 because PostgreSQL rejected the expired v-token-sbom-nex-* credential; Kubernetes restarted the process and it recovered. ESO continues updating the mounted runtime Secret, but the process/SQLAlchemy engine does not adopt the new credential before expiry. Implement a value-safe rotation path that rereads the mounted credential and disposes/rebuilds the pool, or an explicitly coordinated rollout on Secret revision; prove lease rotation without recurring liveness-driven restarts and without logging credential values. Evidence observed 2026-08-22: last termination Completed at 20:43:45Z after start 20:13:45Z, current pod Ready, prior log psycopg password authentication failure." +notes: "Live review after cutover found the Ready SBOM Nexus pod at restartCount 9 in under five hours. The last container ran exactly 30 minutes, then readiness/liveness returned HTTP 500 because PostgreSQL rejected the expired v-token-sbom-nex-* credential; Kubernetes restarted the process and it recovered. The corrected runtime deployed on 2026-08-23 rereads the mounted URL for every new connection, recycles the pool every five minutes, keeps credentials out of the engine URL, and separates process liveness from database readiness. Initial migration 0002, health, repository reads, and attended canary pass with zero pod restarts. Keep open through one complete lease window and confirm no credential values in logs." ``` diff --git a/workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md b/workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md index 0067955..2b98554 100644 --- a/workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md +++ b/workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md @@ -76,7 +76,7 @@ Forgejo administrator PAT. ```task id: CUST-WP-0064-T02 -status: progress +status: done priority: high state_hub_task_id: "2029e525-0573-5fea-881c-d3a418b91c9d" ``` @@ -111,11 +111,20 @@ projects the full-SHA reference, verifies Nexus returns it unchanged, and projects no workstation path. T03 therefore waits only on the Nexus/package dark canary rather than new Repo Manager implementation. +**Done (2026-08-23):** corrected application digest +`sha256:1da0f4f008643a0dec3f00bbad15f287103aa4b469577b78cfe1d67f8b3cbe31` +is live at migration `0002 (head)`. The package enforces migration-before- +runtime ordering, Forgejo-only egress, bounded ephemeral storage, and a dark +feature default. The first promotion exposed an Alembic `SET ROLE` outer- +transaction rollback; the runtime was restored immediately, the defect gained +a regression test, and the corrected migration committed before retry rollout. +Process/database health, repository reads, and zero-restarter startup all pass. + ## Retarget bounded catch-up without widening it ```task id: CUST-WP-0064-T03 -status: wait +status: progress priority: high state_hub_task_id: "6c645778-be59-57b1-bf44-d974a3a1e49f" ``` @@ -126,11 +135,16 @@ than `catch_up_limit`, reuse the same targets and operation ids across retries, and record terminal unsupported/failed inputs without advancing into a second batch. +Repo Manager projected `sbom-nexus` with `checkout_path: null` and exact +`forgejo-archive-v1` revision +`b1fd3ec131666e5300aa98abcdddd46219303edb`; Nexus returned it unchanged. +Activity Core's bounded scheduled invocation remains to be proved live. + ## Prove real daily freshness improvement ```task id: CUST-WP-0064-T04 -status: wait +status: progress priority: medium state_hub_task_id: "664d90b0-1169-58fa-9a77-df53e739f957" ``` @@ -141,11 +155,18 @@ id, and licence summary; zero spawned tasks; cleanup of transient source; and truthful `last_success_at` / State Hub compatibility projection. Record the remaining `never_count` and operator disable/rollback controls. +The attended operation created snapshot +`04f5c0ba-d073-4577-ba2d-0854346ac7be` with 33 entries, exact revision and +archive provenance, zero errors, identical replay for the same durable key, +and an empty transient directory before and after. The feature was returned +dark without deleting the snapshot. A normal scheduled fire and fleet summary +remain the final proof. + ## Acceptance -- [ ] Production scans consume a controlled, revision-pinned source input -- [ ] No workstation filesystem is mounted or implicitly trusted -- [ ] Nexus remains the only authoritative snapshot writer +- [x] Production scans consume a controlled, revision-pinned source input +- [x] No workstation filesystem is mounted or implicitly trusted +- [x] Nexus remains the only authoritative snapshot writer - [ ] One fire remains bounded to its original N targets across retries - [ ] At least one normal scheduled fire produces real ingested snapshots - [ ] Source cleanup, provenance, failure evidence, and rollback are verified