coulomb/the-custodian
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

workplans: record controlled SBOM implementation checkpoint
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
This commit is contained in:
codex 2026-08-23 00:05:56 +02:00
parent cb62de1b7e
commit d2705f1769
1 changed files with 21 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

22
workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md
View file

@ -10,7 +10,7 @@ topic_slug: custodian
planning_priority: high planning_priority: high
planning_order: 64 planning_order: 64
created: "2026-08-22" created: "2026-08-22"
updated: "2026-08-22" updated: "2026-08-23"
quality_dor: DoR-Ok quality_dor: DoR-Ok
quality_dor_at: "2026-08-22" quality_dor_at: "2026-08-22"
quality_dor_by: codex quality_dor_by: codex
@ -91,6 +91,26 @@ package changes, additive skip reasons, safety limits, durable replay rule,
and rollback sequence. Implementation handoffs now carry one shared contract and rollback sequence. Implementation handoffs now carry one shared contract
instead of separate mechanism proposals. instead of separate mechanism proposals.
**Implementation checkpoint (2026-08-23):** three indexed child workplans are
now committed and pushed. `SBOM-WP-0003` (`dc07cc14`) implements migration
`0002`, durable operation receipts/replay, controlled full-SHA fetch and safe
extraction, provenance, source projection, and additive outcomes at application
revision `879012c` (25 tests passed, one conditional PostgreSQL skip; Ruff
clean; real archive scan returned 33 entries and zero errors).
`RAPP-SBOM-NEXUS-WP-0002` (`63ba3813`) stages the feature dark with a 768 MiB
ephemeral volume and Forgejo-only egress at package revision `7d8f76e` (6 tests
passed; server-side cluster admission dry-run passed). `ACTIVITY-WP-0034`
(`409c06c0`) freezes and submits the exact source reference across retries and
accepts the new terminal outcomes at revision `e690170` (434 tests passed, one
conditional integration skip; 28 focused tests passed). No production digest,
migration, feature flag, or schedule was changed. Remaining T02 work is the
reviewed image build/pin, migration `0002`, dark verification, and attended
one-repository canary. Repo Manager subsequently reported its direct producer
interface ready at revision `e6cc18b`: `rmgr sbom source-ref` resolves and
projects the full-SHA reference, verifies Nexus returns it unchanged, and
projects no workstation path. T03 therefore waits only on the Nexus/package
dark canary rather than new Repo Manager implementation.
## Retarget bounded catch-up without widening it ## Retarget bounded catch-up without widening it
```task ```task