feat(state-hub): v0.3 schema — contributions + sbom_entries migrations, models, schemas, routers

Migrations (chain: b1c2d3e4f5a6 → c2d3e4f5a6b7 → d3e4f5a6b7c8):
- c2d3e4f5a6b7: contributions table (contributiontype BR/FR/EP/UPR enum,
  contributionstatus 7-state lifecycle, FKs to topics/workstreams)
- d3e4f5a6b7c8: sbom_entries table (ecosystem enum, snapshot-based replacement),
  + sbom_source + last_sbom_at columns on managed_repos

New models: Contribution (ContributionType, ContributionStatus), SBOMEntry (Ecosystem)
Modified: ManagedRepo (sbom_source, last_sbom_at columns)

New routers:
- /contributions/ — CRUD + lifecycle-guarded PATCH /status + soft-delete (withdrawn)
- /sbom/ — ingest (replace snapshot), list, per-repo view, licence report

Modified:
- /state/summary now includes contribution_counts and licence_risk_count
- main.py: registers contributions + sbom routers; bumps version to 0.6.0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/models/__init__.py

@@ -9,6 +9,8 @@ from api.models.progress_event import ProgressEvent
 from api.models.extension_point import ExtensionPoint, EPStatus
 from api.models.technical_debt import TechnicalDebt, TDStatus
 from api.models.managed_repo import ManagedRepo
+from api.models.contribution import Contribution, ContributionType, ContributionStatus
+from api.models.sbom_entry import SBOMEntry, Ecosystem
 
 __all__ = [
     "Base",
@@ -22,4 +24,6 @@ __all__ = [
     "ExtensionPoint", "EPStatus",
     "TechnicalDebt", "TDStatus",
     "ManagedRepo",
+    "Contribution", "ContributionType", "ContributionStatus",
+    "SBOMEntry", "Ecosystem",
 ]

api/models/contribution.py

@@ -0,0 +1,62 @@
+import enum
+import uuid
+from datetime import datetime
+
+from sqlalchemy import Boolean, DateTime, Enum, ForeignKey, String, Text
+from sqlalchemy.dialects.postgresql import UUID
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from api.models.base import Base, TimestampMixin, new_uuid
+
+
+class ContributionType(str, enum.Enum):
+    br = "br"
+    fr = "fr"
+    ep = "ep"
+    upr = "upr"
+
+
+class ContributionStatus(str, enum.Enum):
+    draft = "draft"
+    submitted = "submitted"
+    acknowledged = "acknowledged"
+    accepted = "accepted"
+    rejected = "rejected"
+    merged = "merged"
+    withdrawn = "withdrawn"
+
+
+class Contribution(Base, TimestampMixin):
+    __tablename__ = "contributions"
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), primary_key=True, default=new_uuid
+    )
+    type: Mapped[ContributionType] = mapped_column(
+        Enum(ContributionType, name="contributiontype"), nullable=False
+    )
+    target_org: Mapped[str | None] = mapped_column(String(200), nullable=True)
+    target_repo: Mapped[str | None] = mapped_column(String(200), nullable=True)
+    slug: Mapped[str | None] = mapped_column(String(200), nullable=True)
+    title: Mapped[str] = mapped_column(String(500), nullable=False)
+    status: Mapped[ContributionStatus] = mapped_column(
+        Enum(ContributionStatus, name="contributionstatus"),
+        nullable=False, default=ContributionStatus.draft,
+    )
+    body_path: Mapped[str | None] = mapped_column(Text, nullable=True)
+    related_topic_id: Mapped[uuid.UUID | None] = mapped_column(
+        UUID(as_uuid=True), ForeignKey("topics.id", ondelete="SET NULL"), nullable=True
+    )
+    related_workstream_id: Mapped[uuid.UUID | None] = mapped_column(
+        UUID(as_uuid=True), ForeignKey("workstreams.id", ondelete="SET NULL"), nullable=True
+    )
+    submitted_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+    resolved_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+    notes: Mapped[str | None] = mapped_column(Text, nullable=True)
+
+    topic: Mapped["Topic"] = relationship("Topic", lazy="selectin")  # noqa: F821
+    workstream: Mapped["Workstream"] = relationship("Workstream", lazy="selectin")  # noqa: F821

api/models/managed_repo.py

@@ -1,6 +1,7 @@
 import uuid
+from datetime import datetime
 
-from sqlalchemy import ForeignKey, String, Text
+from sqlalchemy import DateTime, ForeignKey, String, Text
 from sqlalchemy.dialects.postgresql import UUID
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
@@ -25,6 +26,10 @@ class ManagedRepo(Base, TimestampMixin):
     topic_id: Mapped[uuid.UUID | None] = mapped_column(
         UUID(as_uuid=True), ForeignKey("topics.id", ondelete="SET NULL"), nullable=True
     )
+    sbom_source: Mapped[str | None] = mapped_column(Text, nullable=True)
+    last_sbom_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
 
     domain: Mapped["Domain"] = relationship(  # noqa: F821
         "Domain", back_populates="repos", lazy="selectin"

api/models/sbom_entry.py

@@ -0,0 +1,47 @@
+import enum
+import uuid
+from datetime import datetime
+
+from sqlalchemy import Boolean, DateTime, Enum, ForeignKey, String
+from sqlalchemy.dialects.postgresql import UUID
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from api.models.base import Base, new_uuid
+
+
+class Ecosystem(str, enum.Enum):
+    python = "python"
+    node = "node"
+    rust = "rust"
+    go = "go"
+    java = "java"
+    other = "other"
+
+
+class SBOMEntry(Base):
+    """Snapshot-based SBOM entry — no updated_at; new ingest replaces old rows."""
+    __tablename__ = "sbom_entries"
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), primary_key=True, default=new_uuid
+    )
+    repo_id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), ForeignKey("managed_repos.id", ondelete="RESTRICT"),
+        nullable=False, index=True,
+    )
+    package_name: Mapped[str] = mapped_column(String(300), nullable=False)
+    package_version: Mapped[str | None] = mapped_column(String(100), nullable=True)
+    ecosystem: Mapped[Ecosystem] = mapped_column(
+        Enum(Ecosystem, name="ecosystem"), nullable=False
+    )
+    license_spdx: Mapped[str | None] = mapped_column(String(100), nullable=True)
+    is_direct: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
+    is_dev: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
+    snapshot_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False
+    )
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False
+    )
+
+    repo: Mapped["ManagedRepo"] = relationship("ManagedRepo", lazy="selectin")  # noqa: F821