fix(identifiers): reject unproven assignments

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

tests/test_identifiers.py

@@ -7,6 +7,7 @@ import httpx
 import pytest
 
 from repo_manager.identifiers import (
+    _projection_migration_preflight,
     derive_work_record_uuid,
     load_fleet_namespace,
     migrate_repository_identifier_files,
@@ -22,6 +23,21 @@ def test_declared_fleet_namespace_is_helixforge() -> None:
     assert load_fleet_namespace() == "helixforge"
 
 
+def test_projection_preflight_rejects_unproven_assignment() -> None:
+    result = _projection_migration_preflight(
+        [{"action": "assign", "record_id": "ONE-WP-0001"}],
+        ["http://hub.test"],
+    )
+
+    assert result["ok"] is False
+    assert result["errors"] == [
+        {
+            "scope": "ONE-WP-0001",
+            "reason": "projection-aware approval does not yet support UUID assignments",
+        }
+    ]
+
+
 def _workplan(path: Path, identifier: str, status: str, task_status: str = "todo") -> None:
     path.parent.mkdir(parents=True, exist_ok=True)
     path.write_text(