coulomb/the-custodian
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

workplans: record controlled SBOM implementation checkpoint
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
This commit is contained in:
codex 2026-08-23 00:05:56 +02:00
parent cb62de1b7e
commit d2705f1769
1 changed files with 21 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

22
workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md
View file

@ -10,7 +10,7 @@ topic_slug: custodian
planning_priority: high
planning_order: 64
created: "2026-08-22"
updated: "2026-08-22"
updated: "2026-08-23"
quality_dor: DoR-Ok
quality_dor_at: "2026-08-22"
quality_dor_by: codex
@ -91,6 +91,26 @@ package changes, additive skip reasons, safety limits, durable replay rule,
and rollback sequence. Implementation handoffs now carry one shared contract
instead of separate mechanism proposals.
**Implementation checkpoint (2026-08-23):** three indexed child workplans are
now committed and pushed. `SBOM-WP-0003` (`dc07cc14`) implements migration
`0002`, durable operation receipts/replay, controlled full-SHA fetch and safe
extraction, provenance, source projection, and additive outcomes at application
revision `879012c` (25 tests passed, one conditional PostgreSQL skip; Ruff
clean; real archive scan returned 33 entries and zero errors).
`RAPP-SBOM-NEXUS-WP-0002` (`63ba3813`) stages the feature dark with a 768 MiB
ephemeral volume and Forgejo-only egress at package revision `7d8f76e` (6 tests
passed; server-side cluster admission dry-run passed). `ACTIVITY-WP-0034`
(`409c06c0`) freezes and submits the exact source reference across retries and
accepts the new terminal outcomes at revision `e690170` (434 tests passed, one
conditional integration skip; 28 focused tests passed). No production digest,
migration, feature flag, or schedule was changed. Remaining T02 work is the
reviewed image build/pin, migration `0002`, dark verification, and attended
one-repository canary. Repo Manager subsequently reported its direct producer
interface ready at revision `e6cc18b`: `rmgr sbom source-ref` resolves and
projects the full-SHA reference, verifies Nexus returns it unchanged, and
projects no workstation path. T03 therefore waits only on the Nexus/package
dark canary rather than new Repo Manager implementation.
## Retarget bounded catch-up without widening it
```task