feat(identifiers): verify batch projections

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

interfaces/state-hub-sealed-projection-repair-v1.yaml

@@ -0,0 +1,62 @@
+apiVersion: helixforge.repo-manager/v1
+kind: OwnerTaskInterface
+metadata:
+  id: helixforge.identifiers.state-hub-sealed-projection-repair.v1
+  title: Repair an absent pre-derivation projection from a sealed migration unit
+source:
+  repo: repo-manager
+  workplan_task: RMGR-WP-0005-T04
+target:
+  repo: state-hub
+  owner_agent: state-hub
+  suggested_work_record: STATE-WP-0079 follow-up task or owner-selected workplan task
+approval:
+  dispositions: [approved, amended, rejected]
+  record_in: State Hub file-backed workplan task or decision
+task:
+  title: Add sealed repair for absent pre-derivation projection rows
+  priority: high
+  objective: >-
+    Allow an authoritative random UUID that predates deterministic derivation to
+    be restored into one partial projection only when a sealed Repo Manager
+    migration unit proves the exact repository, record identity, old UUID, and
+    derived target, so both projections can enter the existing transactional
+    cutover with matching source rows.
+  inputs:
+    - ref: repo-manager/docs/work-record-uuid-derivation_v1.md
+      authority: repo-manager
+    - ref: repo-manager/src/repo_manager/commands/registrar_reconcile.py
+      authority: repo-manager
+    - ref: state-hub/api/services/work_record_identifier_migration.py
+      authority: state-hub
+  deliverables:
+    - >-
+      Add an explicit registrar-only repair mode scoped to one canonical
+      workplan and one sealed repository migration unit; never widen ordinary
+      consistency repair for arbitrary random stale UUIDs.
+    - >-
+      Reconstruct the absent workplan and its mapped tasks with their exact old
+      UUIDs from the clean, synchronized authoritative file and existing
+      repository/topic projection, then verify exact API visibility.
+    - >-
+      Emit a non-secret receipt containing repository, canonical ids, old UUIDs,
+      plan seal, source Git revision, projection identity, and canonical UTC
+      observation time.
+    - Make retry idempotent and reject partial presence, target presence, source drift, or UUID conflict.
+  constraints:
+    - The normal C-03 random stale-reference refusal remains unchanged.
+    - Repair requires explicit primary confirmation and an exact sealed plan hash.
+    - Do not infer a repository, topic, canonical id, or UUID from path strings alone.
+    - Do not mutate the authoritative workplan file during projection repair.
+    - A failed repair must leave no partially created workplan or task rows.
+  acceptance:
+    - >-
+      A fixture with the old row present on one hub and absent on another repairs
+      only the absent projection and then passes current UUID=200 and derived UUID=404 preflight.
+    - A random stale UUID outside the sealed unit remains non-fixable C-03.
+    - Repeating the same repair returns a verified no-op receipt.
+    - A dirty or unsynchronized source, mismatched plan hash, or partially present unit is rejected.
+    - Existing empty-projection bootstrap and derived-row repair behavior remain unchanged.
+  verification:
+    - uv run pytest -q tests/test_consistency_check.py tests/test_work_record_identifier_migration.py
+    - make test