workplans: close sbom extraction coordination
This commit is contained in:
codex
parent
01e7c7b4e4
commit
c1756de260
4 changed files with 220 additions and 27 deletions
|
|
@ -4,13 +4,13 @@ type: workplan
|
|||
title: "Extract sbom-nexus and bound daily SBOM catch-up"
|
||||
domain: infotech
|
||||
repo: the-custodian
|
||||
status: proposed
|
||||
owner: grok
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: custodian
|
||||
planning_priority: high
|
||||
planning_order: 62
|
||||
created: "2026-08-18"
|
||||
updated: "2026-08-18"
|
||||
updated: "2026-08-22"
|
||||
related:
|
||||
- CUST-WP-0002
|
||||
- CUST-WP-0013
|
||||
|
|
@ -92,7 +92,7 @@ hard-coded constant in the nexus API.
|
|||
|
||||
```task
|
||||
id: CUST-WP-0062-T01
|
||||
status: todo
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "b593aeab-c435-47d1-9775-bbfbcf4cf4ab"
|
||||
```
|
||||
|
|
@ -105,11 +105,18 @@ Tag each as *move to sbom-nexus*, *strangle in state-hub*, or *retarget
|
|||
caller*. Open the state-hub child workplan (next `STATE-WP`) from this
|
||||
inventory.
|
||||
|
||||
**Done (2026-08-22):** `SBOM-WP-0001-T03` produced the complete disposition
|
||||
in `sbom-nexus/docs/state-hub-sbom-extraction-review.md`, covering State Hub
|
||||
models/routes/scripts/MCP/dashboard, Repo Manager, Activity Core, repository
|
||||
freshness projection, and migration. State Hub implementation joined its
|
||||
existing retirement workplan `STATE-WP-0079` rather than creating a competing
|
||||
strangler.
|
||||
|
||||
## Stand up sbom-nexus and extract
|
||||
|
||||
```task
|
||||
id: CUST-WP-0062-T02
|
||||
status: todo
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "eaf08a83-9b25-4e5e-beeb-d24fa696a626"
|
||||
```
|
||||
|
|
@ -119,11 +126,18 @@ register it, and move the SBOM product into it: store, ingest, HTTP API,
|
|||
operator docs. State Hub routes keep working via proxy or dual-write until
|
||||
T04. Preserve snapshot history; do not start from an empty store.
|
||||
|
||||
**Done (2026-08-22):** `sbom-nexus` is registered as the product repository.
|
||||
`SBOM-WP-0001` delivered the service and `SBOM-WP-0002` deployed it on managed
|
||||
PostgreSQL, imported 22 snapshots / 3,123 entries exactly, and reconciled the
|
||||
second import idempotently. The private production deployment is Ready on
|
||||
immutable digest `sha256:62929abc…`; backup and a 51-second scratch restore are
|
||||
recorded in the child evidence.
|
||||
|
||||
## Efficient catch-up API
|
||||
|
||||
```task
|
||||
id: CUST-WP-0062-T03
|
||||
status: todo
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "936d6554-dbd9-4a24-a223-3858b49d30c3"
|
||||
```
|
||||
|
|
@ -139,11 +153,19 @@ strangle):
|
|||
Prove with fixtures that limit=3 returns the three oldest (null first) and
|
||||
that a skip advances queue position.
|
||||
|
||||
**Done (2026-08-22):** Nexus implements one ranked
|
||||
`GET /sbom/catch-up?limit=N` call, bounded ingest/skip routes, null-first
|
||||
ordering, and terminal `no-checkout` / `no-manifest` semantics. Production
|
||||
projection reconciled 120 repositories and selected exactly the oldest three
|
||||
of 116 active repositories without ingest. Two bounded fires advanced
|
||||
`never_count` 101 → 98; a live read at 2026-08-22T20:51Z returned exactly
|
||||
three targets and `never_count: 95`, demonstrating continued queue advance.
|
||||
|
||||
## Strangle State Hub SBOM
|
||||
|
||||
```task
|
||||
id: CUST-WP-0062-T04
|
||||
status: wait
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "afd45c7f-55d7-4312-a6cf-df511913c998"
|
||||
```
|
||||
|
|
@ -154,11 +176,17 @@ MCP read sbom-nexus (or the façade). `last_sbom_at` on `/repos/` stays
|
|||
correct. Align with STATE-WP-0079 retirement strangler, do not invent a
|
||||
second retirement path.
|
||||
|
||||
**Done (2026-08-22):** `SBOM-WP-0002-T04` and `STATE-WP-0079-T04` moved State
|
||||
Hub reads and writes behind independently reversible Nexus façade flags.
|
||||
Dashboard, summary, DoI, MCP/CLI compatibility, and repository freshness read
|
||||
Nexus authority. State Hub retains its 22 historical snapshots and façade as
|
||||
read-only rollback evidence; new reads and writes remain Nexus-owned.
|
||||
|
||||
## Replace weekly evaluation in activity-core
|
||||
|
||||
```task
|
||||
id: CUST-WP-0062-T05
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "0bdfbc56-3293-4578-a266-e4ca9313aabf"
|
||||
```
|
||||
|
|
@ -168,11 +196,19 @@ resolver against the catch-up API, ingest of N repos (default 3),
|
|||
deterministic progress evidence, retire `weekly-sbom-staleness` task flood.
|
||||
Do not enable the daily job against the old per-repo `/sbom/{slug}` walk.
|
||||
|
||||
**Done (2026-08-22):** `ACTIVITY-WP-0030` is finished. The weekday 09:15
|
||||
Europe/Berlin definition performs one Nexus selection and at most three
|
||||
terminal operations, emits deterministic `sbom_catchup` progress, and has no
|
||||
task-spawning rule. `weekly-sbom-staleness` is disabled and its Temporal
|
||||
schedule paused. `ACTIVITY-WP-0033` subsequently fixed the retry boundary so
|
||||
one workflow retains one target set across retries; Nexus-side durable
|
||||
operation replay remains live as `CUST-IN-0013`.
|
||||
|
||||
## Cutover and catch-up proof
|
||||
|
||||
```task
|
||||
id: CUST-WP-0062-T06
|
||||
status: wait
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "ceb75c3d-945f-4fc2-9399-5df8b5baa10d"
|
||||
```
|
||||
|
|
@ -182,11 +218,42 @@ progress (`stale_count`, `updated`, `skipped`), weekly spawn count goes to
|
|||
zero. After several successful days, `never_count` declines. Document the
|
||||
operator knobs (`catch_up_limit`, disable/enable).
|
||||
|
||||
**Done (2026-08-22):** two operator-confirmed Railiance01 fires processed six
|
||||
distinct repositories as terminal `no-checkout` skips, spawned zero tasks,
|
||||
emitted linked progress events `a9e8acea` and `f8b59633`, and advanced the
|
||||
queue. Production has the daily definition enabled with limit 3 and the
|
||||
legacy weekly definition disabled/paused. The SBOM product owner explicitly
|
||||
waived waiting for the next Monday window; this closure does not claim that a
|
||||
natural Monday fire occurred. The remaining reason all observed outcomes were
|
||||
skips—no controlled checkout inside the Nexus plane—is successor
|
||||
`CUST-WP-0064`, not hidden closure prose.
|
||||
|
||||
## Acceptance
|
||||
|
||||
- [ ] SBOM product lives in `sbom-nexus`; State Hub is not the permanent store
|
||||
- [ ] Catch-up API returns oldest-N in one call (default N=3)
|
||||
- [ ] Daily activity-core job updates those N instead of spawning one task per stale repo
|
||||
- [ ] Weekly SBOM task flood is off
|
||||
- [ ] Skipped repos do not permanently head the queue
|
||||
- [ ] `/repos/` last_sbom_at remains truthful during and after cutover
|
||||
- [x] SBOM product lives in `sbom-nexus`; State Hub is not the permanent store
|
||||
- [x] Catch-up API returns oldest-N in one call (default N=3)
|
||||
- [x] Daily activity-core job updates those N instead of spawning one task per stale repo
|
||||
- [x] Weekly SBOM task flood is off
|
||||
- [x] Skipped repos do not permanently head the queue
|
||||
- [x] `/repos/` last_sbom_at remains truthful during and after cutover
|
||||
|
||||
## Closure Review — 2026-08-22
|
||||
|
||||
The coordination goal is achieved by the finished child workplans
|
||||
`SBOM-WP-0001`, `SBOM-WP-0002`, `ACTIVITY-WP-0030`, and
|
||||
`ACTIVITY-WP-0033`, plus the SBOM disposition slice of `STATE-WP-0079`.
|
||||
Production evidence shows a single Nexus authority, reversible State Hub
|
||||
compatibility, bounded queue advancement, zero task flood, and truthful
|
||||
attempt/success projections.
|
||||
|
||||
Actionable leftovers are live before closure:
|
||||
|
||||
- `CUST-WP-0064` coordinates a controlled scan-input topology so daily runs
|
||||
create real authoritative SBOMs rather than only terminal `no-checkout`
|
||||
outcomes;
|
||||
- `CUST-IN-0013` routes durable operation-id replay to SBOM Nexus;
|
||||
- `RMGR-WP-0011` remains ready for the authoritative Repo Manager HTTP client
|
||||
and explicit non-authoritative preview semantics.
|
||||
|
||||
No legacy State Hub rows were deleted. Their retention and façade rollback
|
||||
role remain governed by `SBOM-WP-0002-T07`.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue