workplans: close sbom extraction coordination

workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md

@@ -0,0 +1,103 @@
+---
+id: CUST-WP-0064
+type: workplan
+title: "Controlled scan inputs for authoritative daily SBOM catch-up"
+domain: infotech
+repo: the-custodian
+status: ready
+owner: codex
+topic_slug: custodian
+planning_priority: high
+planning_order: 64
+created: "2026-08-22"
+updated: "2026-08-22"
+origin: residual
+origin_ref: CUST-WP-0062
+related:
+  - SBOM-WP-0002
+  - ACTIVITY-WP-0030
+  - ACTIVITY-WP-0033
+  - RMGR-WP-0011
+---
+
+# Controlled scan inputs for authoritative daily SBOM catch-up
+
+## Goal
+
+Give the private SBOM Nexus production plane a controlled, revision-pinned
+source input so bounded daily catch-up can produce authoritative ingested
+snapshots. Current scheduling, ranking, fairness, and zero-task behavior are
+proven, but production attempts are `no-checkout` because workstation paths
+are not reachable inside the cluster.
+
+This is a coordination workplan. SBOM Nexus owns scan semantics and durable
+history; Repo Manager owns repository identity, active status, and source-path
+projection; Activity Core owns recurrence and the at-most-N workflow bound;
+the deployment package owns the runtime/network boundary.
+
+## Select the source-transfer and trust-boundary contract
+
+```task
+id: CUST-WP-0064-T01
+status: todo
+priority: high
+```
+
+Choose one controlled input shape—such as a revision-pinned Forgejo clone in a
+short-lived scanner job or a content-addressed source artifact—without mounting
+operator workstations into the cluster. Define repository/revision identity,
+authentication custody, size/time limits, egress, provenance, unsupported repo
+behavior, cleanup, and the boundary between preview and authoritative ingest.
+
+Done when the four owning repos have one reviewable contract and rollback; do
+not enable source transfer from a prose-only assumption.
+
+## Implement the Nexus-owned authoritative scan path
+
+```task
+id: CUST-WP-0064-T02
+status: wait
+priority: high
+```
+
+Depends on T01. Open and execute the SBOM Nexus/package child work needed to
+consume the selected input, scan at a pinned revision, persist provenance, and
+remove temporary source material. Preserve Nexus as the only snapshot writer
+and enforce `CUST-IN-0013` operation idempotency on the mutation boundary.
+
+## Retarget bounded catch-up without widening it
+
+```task
+id: CUST-WP-0064-T03
+status: wait
+priority: high
+```
+
+Depends on T02 and `RMGR-WP-0011`. Supply the controlled input reference for
+the already-fixed oldest-N target set. Activity Core must still process no more
+than `catch_up_limit`, reuse the same targets and operation ids across retries,
+and record terminal unsupported/failed inputs without advancing into a second
+batch.
+
+## Prove real daily freshness improvement
+
+```task
+id: CUST-WP-0064-T04
+status: wait
+priority: medium
+```
+
+Run an attended bounded proof, then observe a normal scheduled fire. Require at
+least one `ingested` outcome with repository slug, immutable revision, snapshot
+id, and licence summary; zero spawned tasks; cleanup of transient source; and
+truthful `last_success_at` / State Hub compatibility projection. Record the
+remaining `never_count` and operator disable/rollback controls.
+
+## Acceptance
+
+- [ ] Production scans consume a controlled, revision-pinned source input
+- [ ] No workstation filesystem is mounted or implicitly trusted
+- [ ] Nexus remains the only authoritative snapshot writer
+- [ ] One fire remains bounded to its original N targets across retries
+- [ ] At least one normal scheduled fire produces real ingested snapshots
+- [ ] Source cleanup, provenance, failure evidence, and rollback are verified