feat: publish repository classification projections

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c

workplans/RMGR-WP-0013-repository-classification-publisher.md

@@ -0,0 +1,119 @@
+---
+id: RMGR-WP-0013
+type: workplan
+title: "Repository classification projection publisher"
+domain: infotech
+repo: repo-manager
+status: active
+owner: codex
+topic_slug: infotech
+created: "2026-09-01"
+updated: "2026-09-01"
+parent_project: prj-state-hub-retirement
+parent_workplan: STATE-WP-0079
+related:
+  - HUB-WP-0006
+  - RMGR-WP-0008
+---
+
+# Repository classification projection publisher
+
+## Goal
+
+Publish Repo Manager's validated fleet classification view through the frozen
+`helixforge.repository-classification-projection` 1.0.0 `port.repo` contract,
+including registrar UUIDs, atomic snapshot provenance, and safe paging, so
+hub-core can rebuild repository navigation without reading State Hub tables.
+
+## Freeze the publisher mapping
+
+```task
+id: RMGR-WP-0013-T01
+status: done
+priority: high
+```
+
+Map repository registry identity, lifecycle, checkout observation, classification
+authority, revision provenance, diagnostics, and the exact hub-core envelope.
+Keep host paths and credentials outside the published contract.
+
+**Result (2026-09-01):** the mapping pins registrar UUID, canonical slug,
+lifecycle, validated file classification, Git HEAD, classification-file SHA-256,
+and canonical UTC observation time. The closed envelope excludes local paths,
+remotes, work records, source bodies, and credentials.
+
+## Implement registry-backed snapshot publication
+
+```task
+id: RMGR-WP-0013-T02
+status: done
+priority: high
+```
+
+Build deterministic full snapshots from an operator-owned local repository
+registry, validate every classification at observation time, and publish stable
+registrar UUID identities with source fingerprints and Git revisions.
+
+**Result (2026-09-01):** `repository_publisher.py` loads a strict private
+operator registry, rejects duplicate identity and unsupported lifecycle, and
+builds full UUID-ordered snapshots. The primary-State-Hub bootstrap uses
+bounded direct identity reads with retries and never trusts remote host paths.
+
+## Implement the HTTP port and paging integrity
+
+```task
+id: RMGR-WP-0013-T03
+status: done
+priority: high
+```
+
+Expose a read-only FastAPI `port.repo` route. Bind opaque cursors to the exact
+snapshot and page size with an HMAC, retain bounded in-flight snapshots, and
+fail closed on expired, malformed, or mismatched cursors.
+
+**Result (2026-09-01):** the read-only FastAPI runtime exposes health,
+readiness, and `GET /ports/repositories/classifications`. Cursors are
+HMAC-SHA256-bound to snapshot, offset, and page size; in-flight snapshots are
+bounded; optional bearer authentication is constant-time checked.
+
+## Prove cross-repository conformance
+
+```task
+id: RMGR-WP-0013-T04
+status: done
+priority: high
+```
+
+Exercise single- and multi-page transfers through hub-core's frozen consumer,
+including stable ordering, provenance, malformed registry state, invalid
+classification, cursor tampering, and preservation of the last good generation.
+
+**Result (2026-09-01):** unit and cross-repository tests pass. A live five-page
+transfer carried all 123 registered classified checkouts into hub-core and was
+accepted as one current generation. Evidence:
+`docs/evidence/RMGR-WP-0013-live-conformance-2026-09-01.md`.
+
+## Package and hand off deployment
+
+```task
+id: RMGR-WP-0013-T05
+status: wait
+priority: medium
+```
+
+Package the publisher runtime, document registry bootstrap and refresh, record
+evidence, and hand the concrete endpoint/configuration to HUB-WP-0006-T06.
+
+Implementation and operating documentation are complete. Deployment remains
+waiting on an explicit placement/network owner: the public Core Hub cluster
+cannot read the host-local Repo Manager checkout registry, and mounting a broad
+home directory or reintroducing State Hub as the live classification source is
+not an acceptable implicit choice.
+
+## Acceptance
+
+- [x] Every published repository is keyed by its registrar UUID
+- [x] The output validates as contract 1.0.0 without hub-core coercion
+- [x] Pages cannot be mixed across snapshots or page sizes
+- [x] Invalid source state cannot replace hub-core's last accepted generation
+- [ ] Runtime and deployment handoff are documented and reproducible