coulomb/the-custodian
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

docs: select controlled SBOM source contract
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
This commit is contained in:
codex 2026-08-22 23:57:53 +02:00
parent 6171607710
commit cb62de1b7e
3 changed files with 202 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

18
workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md
View file

@ -44,7 +44,7 @@ the deployment package owns the runtime/network boundary.
```task
id: CUST-WP-0064-T01
status: progress
status: done
priority: high
state_hub_task_id: "02ac7278-8536-5ce8-9027-39345aab0539"
```
@ -58,20 +58,25 @@ behavior, cleanup, and the boundary between preview and authoritative ingest.
Done when the four owning repos have one reviewable contract and rollback; do
not enable source transfer from a prose-only assumption.
**Started (2026-08-22):** live verification confirmed the private Nexus pod
**Done (2026-08-22):** live verification confirmed the private Nexus pod
cannot reach projected workstation checkout paths and that queue fairness is
therefore advancing through `no-checkout` outcomes. The Custodian fixed the
non-negotiable boundary—revision-pinned input, no workstation mount, bounded
credentials/egress/time/size, provenance, cleanup, and rollback—and routed
owner participation to SBOM Nexus (`95c1b226`), Repo Manager (`075e21de`),
Activity Core (`7233d2d1`), and the package owner (`e0af24b1`). Selection of
the concrete transfer mechanism remains in progress.
the concrete transfer mechanism is recorded in
`docs/sbom-controlled-scan-input-contract-v1.md`: a public Coulomb Forgejo
archive addressed by a full commit SHA, fetched and safely scanned by Nexus
from a bounded ephemeral volume. A live full-SHA archive fetch succeeded; v1
therefore needs no source credential and explicitly forbids reuse of the
Forgejo administrator PAT.
## Implement the Nexus-owned authoritative scan path
```task
id: CUST-WP-0064-T02
status: wait
status: progress
priority: high
state_hub_task_id: "2029e525-0573-5fea-881c-d3a418b91c9d"
```
@ -81,6 +86,11 @@ consume the selected input, scan at a pinned revision, persist provenance, and
remove temporary source material. Preserve Nexus as the only snapshot writer
and enforce `CUST-IN-0013` operation idempotency on the mutation boundary.
**Started (2026-08-22):** the selected v1 contract fixes the application and
package changes, additive skip reasons, safety limits, durable replay rule,
and rollback sequence. Implementation handoffs now carry one shared contract
instead of separate mechanism proposals.
## Retarget bounded catch-up without widening it
```task