Record milestone 0.8 status: pipeline complete, green-on-main pending Gitea runner

PHASE0_PLAN 0.8 marked in progress with the remaining exit check;
ARCHITECTURE 9.3 and the plan's CI-provider question resolved to Gitea
Actions; YPMS-POAM-042 to in progress; status handoff gets 0.8 details,
runner-registration steps, local gate commands, and the accumulated
upstream-to-OWC list.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

POAM.md

@@ -93,7 +93,7 @@ These four items are the tailorings recorded in the SSP Appendix D and control-m
 |---|---|---|---|---|---|---|---|
 | **YPMS-POAM-040** | High | Architecture & tech-stack decision recorded | NIST PL-8 / SA-3 | DOES CIO | ✅ Stack decision closed 2026-09-30: Python 3.12 / FastAPI / SQLAlchemy / Postgres on Azure Government (OWC alignment). ✅ Architecture document v0.1 drafted 2026-09-30 (`ypms/ARCHITECTURE.md`). ✅ Phase 0 plan drafted 2026-09-30 (`ypms/PHASE0_PLAN.md`). M1: DC OCTO security architecture review — 45 days. | 2026-11-15 | 🟡 In Progress |
 | **YPMS-POAM-041** | High | Azure Government tenant + non-prod environments provisioned | NIST CM-2 / CM-6 | DOES CIO + DC OCTO | M1: subscription request — 30 days. M2: dev + test environments — 60 days. M3: CIS Azure Foundations baseline applied — 90 days. | 2027-01-15 | 🔴 Open |
-| **YPMS-POAM-042** | High | CI/CD pipeline with SAST, SCA, secret scanning, SBOM | NIST SA-11 / SR-3 / SR-11 / CM-8 | DOES CIO | M1: pipeline scaffold — 30 days. M2: SAST + SCA gates — 60 days. M3: SBOM generation per release (CycloneDX) — 90 days. | 2027-01-31 | 🔴 Open |
+| **YPMS-POAM-042** | High | CI/CD pipeline with SAST, SCA, secret scanning, SBOM | NIST SA-11 / SR-3 / SR-11 / CM-8 | DOES CIO | M1: pipeline scaffold — 30 days. M2: SAST + SCA gates — 60 days. M3: SBOM generation per release (CycloneDX) — 90 days. **2026-10-01: M1–M3 implemented in `.gitea/workflows/ci.yml` (SBOM per CI run); open until the first green run on `main` (needs a Gitea runner).** | 2027-01-31 | 🟡 In progress |
 | **YPMS-POAM-043** | High | Sentinel integration (DOES OIT ships application + Azure resource logs to DC OCTO Sentinel) | NIST AU-6 / SI-4 | DOES CIO + DC OCTO CISO | M1: log-schema agreement with OCTO SOC — 30 days. M2: Sentinel workspace and ingestion — 60 days. M3: correlation rules and alert playbooks — 120 days. | 2027-02-28 | 🔴 Open |
 | **YPMS-POAM-044** | High | Backup + restore procedure documented and tested | NIST CP-9 / CP-9(1) | DOES CIO + OIT Ops | M1: procedure documented — 30 days. M2: initial restore drill — 60 days. M3: annual drill cadence established — 90 days. | 2027-02-15 | 🔴 Open |
 
@@ -179,6 +179,7 @@ Closures retained for traceability.
 | — | Phase 0 milestone 0.5 shipped (partial closure of YPMS-POAM-040) | 2026-09-30 | Registrant vertical slice: model, schemas, router, migration 0003. SSN app-layer encrypted (AES-256-GCM, column-bound AAD) and masked in the serializer (C.5.7.50 / SC-28). `pii_read` audit on every read path (C.5.6.9 #5 / AU-14). Audit + version-history snapshots redact ciphertext via `__audit_redact__`. Portal-only roles limited to own row. 98 tests passing, 94.83% coverage. Evidence trace at `docs/coverage/registrant.md`. |
 | — | Phase 0 milestone 0.6 shipped (partial closure of YPMS-POAM-040) | 2026-09-30 | 501-stub routers for 26 entities; every route enforces RBAC and writes an audit row before returning 501 (source RFP C.5.7.27; NIST AC-3, AU-12). Matrix-driven test sweep covers every entity × role × action. Permission-matrix review items recorded in PHASE0_STATUS.md. 138 tests passing, 95.05% coverage. |
 | — | Phase 0 milestone 0.7 shipped (partial closure of YPMS-POAM-040) | 2026-10-01 | Retention scaffold (NIST AU-11, SI-12; source RFP C.5.7.42): every table carries a policy; PIA §9 interim periods encoded but unapproved; report-only nightly job logs eligible counts and audits each run. Implementation is ready to consume the signed schedule from YPMS-POAM-054 (flip `approved`, cite authority). 156 tests passing, 95.91% coverage. |
+| — | Phase 0 milestone 0.8 pipeline complete (partial closure of YPMS-POAM-040; advances YPMS-POAM-042) | 2026-10-01 | Gitea Actions workflow with lint, strict types, tests + coverage floor, migration drift test, SAST, SCA on runtime deps, full-history secret scan, CycloneDX SBOM. All gates pass locally; green-on-main pending runner registration. Removed `ecdsa` (PYSEC-2026-1325) by moving JWT to PyJWT; enforced 32-byte JWT secret (RFC 7518). 158 tests passing, 95.83% coverage. |
 
 ---