3.9 KiB
3.9 KiB
Custodian intake records
CUST-IN-0011 — Provision a monitored external security-report Contact URI
id: CUST-IN-0011
kind: intake
title: "Provision a monitored external security-report Contact URI"
status: routed
lane: red
priority: high
owner: policy-nexus
tags: [compliance-relevant]
origin: residual
origin_ref: CUST-WP-0063
selected_contact_uri: "https://security.coulomb.social/"
updated: "2026-08-23"
notes: "The operator selected https://security.coulomb.social/ as the RFC 9116 Contact URI. Policy Nexus owns provisioning and receipt testing before policy.coulomb.social/.well-known/security.txt may publish it. Reports route privately to risk-nexus; the route creates no bounty, response-time, or safe-harbour promise. Acceptance check 2026-08-23: DNS resolves, but the HTTPS server aborts the TLS handshake with alert internal_error before serving a page, so the private receipt test cannot begin. Blocker sent to Policy Nexus as message a111b97c-0561-44eb-b61a-12bcf068b28d. Close only after HTTPS is reachable and a private test report reaches Risk Nexus."
state_hub_intake_id: "01a02b31-f4b0-75e4-a15c-a78e1c276689"
CUST-IN-0012 — Repair the malformed legacy inbox message identity
id: CUST-IN-0012
kind: intake
title: "Repair the malformed legacy inbox message identity"
status: closed
lane: green
priority: low
owner: hub-core
origin: residual
origin_ref: CUST-WP-0063
updated: "2026-08-23"
notes: "Closed 2026-08-23. State Hub now exposes the preserved risk-nexus message with valid stable id 0b8dd0bf-41d1-47da-96ac-40e443c32e47. PATCH /messages/{id}/read succeeded through the supported API, preserving its body and original 2026-08-20 chronology; the Custodian unread inbox is empty. No direct database mutation was used."
state_hub_intake_id: "01a02b32-009b-71bd-a7bf-2ce888164d6a"
CUST-IN-0013 — Enforce durable SBOM catch-up operation idempotency
id: CUST-IN-0013
kind: intake
title: "Enforce durable SBOM catch-up operation idempotency"
status: closed
outcome: absorbed
lane: blue
priority: high
owner: sbom-nexus
origin: residual
origin_ref: CUST-WP-0062
notes: "Activity Core completed ACTIVITY-WP-0033 and now sends a stable Idempotency-Key plus X-Activity-Core-Operation-ID for each workflow-run/repository pair. SBOM Nexus durably enforces that identity on both POST /sbom/{slug}/ingest and POST /sbom/{slug}/skip and replays the original terminal response. Live attended evidence on 2026-08-23 returned the same snapshot 04f5c0ba-d073-4577-ba2d-0854346ac7be for two requests with the same operation key and exact source reference. Scheduled Activity Core proof remains under CUST-WP-0064. Source handoff: State Hub message bc5caa49-25eb-4942-9deb-411b6080d0bb."
state_hub_intake_id: "01a02b44-89a9-7e94-820b-3d86340117ff"
CUST-IN-0014 — Stop SBOM Nexus restarts on database lease rotation
id: CUST-IN-0014
kind: intake
title: "Stop SBOM Nexus restarts on database lease rotation"
status: closed
outcome: absorbed
lane: blue
priority: high
owner: sbom-nexus
origin: residual
origin_ref: CUST-WP-0062
notes: "Live review after cutover found the Ready SBOM Nexus pod at restartCount 9 in under five hours. The last container ran exactly 30 minutes, then readiness/liveness returned HTTP 500 because PostgreSQL rejected the expired v-token-sbom-nex-* credential; Kubernetes restarted the process and it recovered. The corrected runtime deployed on 2026-08-23 rereads the mounted URL for every new connection, recycles the pool every five minutes, keeps credentials out of the engine URL, and separates process liveness from database readiness. Completion evidence at 2026-08-22T23:06:19Z exceeded the old failure point with 30m51s on one pod UID across repeated mounted Secret refreshes: Ready, restart count zero, process/database/repository checks passing, zero health 500s, and zero credential-pattern log matches. Absorbed by finished SBOM-WP-0004 and RAPP-SBOM-NEXUS-WP-0003."