feat(identifiers): prepare verified cutover batches

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

tests/test_identifiers.py

@@ -10,7 +10,9 @@ from repo_manager.identifiers import (
     load_fleet_namespace,
     migrate_repository_identifier_files,
     plan_identifier_migration,
+    plan_identifier_migration_batch,
     scan_live_identifier_collisions,
+    verify_identifier_migration_batch,
     verify_identifier_migration_plan,
 )
 
@@ -203,3 +205,84 @@ def test_identifier_file_migration_requires_exact_plan_confirmation(tmp_path: Pa
             repo_slug="one",
             confirm_plan_sha256="0" * 64,
         )
+
+
+def _push_fixture_to_upstream(repo: Path, remote: Path) -> None:
+    subprocess.run(["git", "init", "--bare", remote], check=True, capture_output=True)
+    subprocess.run(["git", "remote", "add", "origin", str(remote)], cwd=repo, check=True)
+    subprocess.run(["git", "push", "-u", "origin", "HEAD:main"], cwd=repo, check=True)
+
+
+def test_migration_batch_plan_pins_clean_synchronized_repo(tmp_path: Path) -> None:
+    repo = tmp_path / "one"
+    path = repo / "workplans" / "one.md"
+    _workplan(path, "ONE-WP-0001", "active")
+    subprocess.run(["git", "init"], cwd=repo, check=True, capture_output=True)
+    subprocess.run(["git", "add", "."], cwd=repo, check=True, capture_output=True)
+    subprocess.run(
+        ["git", "-c", "user.name=Test", "-c", "user.email=test@example.com", "commit", "-m", "seed"],
+        cwd=repo,
+        check=True,
+        capture_output=True,
+    )
+    _push_fixture_to_upstream(repo, tmp_path / "remote.git")
+    plan = plan_identifier_migration(tmp_path, "helixforge")
+
+    batch = plan_identifier_migration_batch(plan, repo_slugs=["one"])
+
+    assert batch["ok"] is True
+    assert batch["ready_for_approval"] is True
+    assert batch["apply_authorized"] is False
+    assert batch["approval_required"] is True
+    assert batch["repositories"][0]["git_preflight"]["upstream"] == "origin/main"
+    assert len(batch["batch_sha256"]) == 64
+
+
+def test_migration_batch_plan_rejects_dirty_or_duplicate_scope(tmp_path: Path) -> None:
+    repo = tmp_path / "one"
+    path = repo / "workplans" / "one.md"
+    _workplan(path, "ONE-WP-0001", "active")
+    subprocess.run(["git", "init"], cwd=repo, check=True, capture_output=True)
+    subprocess.run(["git", "add", "."], cwd=repo, check=True, capture_output=True)
+    subprocess.run(
+        ["git", "-c", "user.name=Test", "-c", "user.email=test@example.com", "commit", "-m", "seed"],
+        cwd=repo,
+        check=True,
+        capture_output=True,
+    )
+    _push_fixture_to_upstream(repo, tmp_path / "remote.git")
+    plan = plan_identifier_migration(tmp_path, "helixforge")
+    path.write_text(path.read_text(encoding="utf-8") + "\ndrift\n", encoding="utf-8")
+
+    batch = plan_identifier_migration_batch(plan, repo_slugs=["one", "one"])
+
+    assert batch["ok"] is False
+    assert batch["ready_for_approval"] is False
+    assert any(error["reason"] == "repository list contains duplicates" for error in batch["errors"])
+    assert any(error["reason"] == "worktree is not clean" for error in batch["errors"])
+
+
+def test_migration_batch_verification_repeats_preflight_and_detects_tampering(
+    tmp_path: Path,
+) -> None:
+    repo = tmp_path / "one"
+    path = repo / "workplans" / "one.md"
+    _workplan(path, "ONE-WP-0001", "active")
+    subprocess.run(["git", "init"], cwd=repo, check=True, capture_output=True)
+    subprocess.run(["git", "add", "."], cwd=repo, check=True, capture_output=True)
+    subprocess.run(
+        ["git", "-c", "user.name=Test", "-c", "user.email=test@example.com", "commit", "-m", "seed"],
+        cwd=repo,
+        check=True,
+        capture_output=True,
+    )
+    _push_fixture_to_upstream(repo, tmp_path / "remote.git")
+    plan = plan_identifier_migration(tmp_path, "helixforge")
+    batch = plan_identifier_migration_batch(plan, repo_slugs=["one"])
+
+    assert verify_identifier_migration_batch(batch, plan=plan)["ok"] is True
+
+    batch["totals"]["records"] = 999
+    verification = verify_identifier_migration_batch(batch, plan=plan)
+    assert verification["ok"] is False
+    assert any(error["reason"] == "batch SHA-256 mismatch" for error in verification["errors"])