feat(registrar): verify full empty-projection rebuild

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

tests/test_registrar_reconcile.py

@@ -3,6 +3,8 @@ from __future__ import annotations
 import subprocess
 from pathlib import Path
 
+import pytest
+
 from repo_manager.commands import registrar_reconcile as rr
 
 
@@ -185,3 +187,94 @@ def test_repairs_an_already_identified_workplan_projection(tmp_path: Path, monke
     assert result.evidence["repair_projection_id"] == "11111111-1111-4111-8111-111111111111"
     assert result.evidence["restored_generated_paths"] == [".custodian-brief.md"]
     assert brief.read_text(encoding="utf-8") == "authoritative local brief\n"
+
+
+def test_bootstraps_and_verifies_a_completely_empty_projection(tmp_path: Path, monkeypatch) -> None:
+    repo = _fixture(tmp_path)
+    workplan = repo / "workplans" / "DEMO-WP-0001.md"
+    text = workplan.read_text(encoding="utf-8")
+    text = text.replace(
+        "status: active\n---",
+        'status: active\nstate_hub_workstream_id: "11111111-1111-4111-8111-111111111111"\n---',
+    )
+    text = text.replace(
+        "priority: high\n```",
+        'priority: high\nstate_hub_task_id: "22222222-2222-4222-8222-222222222222"\n```',
+    )
+    workplan.write_text(text, encoding="utf-8")
+    _git(repo, "add", ".")
+    _git(repo, "commit", "-m", "add authoritative identifiers")
+    _git(repo, "push")
+
+    monkeypatch.setattr(
+        rr,
+        "_check_primary",
+        lambda _api: ({"status": "ok", "db": "connected"}, None),
+    )
+    monkeypatch.setattr(
+        rr,
+        "_check_empty_repo_projection",
+        lambda _api, _slug: ({"repo_id": "repo-1", "workplan_count": 0}, None),
+    )
+    monkeypatch.setattr(
+        rr,
+        "_verify_full_projection",
+        lambda _api, workplans, tasks: (
+            {
+                "expected_workplans": len(workplans),
+                "expected_tasks": len(tasks),
+                "missing_workplans": [],
+                "missing_tasks": [],
+            },
+            None,
+        ),
+    )
+
+    def fake_run(command, *, env):
+        assert command[-1] == "--bootstrap-empty-projection"
+        assert env["STATEHUB_REGISTRAR"] == "1"
+        return subprocess.CompletedProcess(command, 2, "bootstrap warnings", "")
+
+    monkeypatch.setattr(rr, "_run_statehub", fake_run)
+
+    result = rr.registrar_reconcile(
+        repo,
+        statehub_bin="statehub",
+        confirm_primary=True,
+        bootstrap_empty_projection=True,
+    )
+
+    assert result.status == "applied"
+    assert result.evidence["bootstrap_source"] == {"workplans": 1, "tasks": 1}
+    assert result.evidence["bootstrap_projection_verified"] is True
+
+
+def test_empty_projection_bootstrap_refuses_existing_rows(tmp_path: Path, monkeypatch) -> None:
+    repo = _fixture(tmp_path)
+    monkeypatch.setattr(
+        rr,
+        "_check_primary",
+        lambda _api: ({"status": "ok", "db": "connected"}, None),
+    )
+    monkeypatch.setattr(
+        rr,
+        "_check_empty_repo_projection",
+        lambda _api, _slug: (
+            {"repo_id": "repo-1", "workplan_count": 1},
+            "target repository projection is not empty",
+        ),
+    )
+    monkeypatch.setattr(
+        rr,
+        "_run_statehub",
+        lambda *_args, **_kwargs: pytest.fail("non-empty bootstrap must not run State Hub"),
+    )
+
+    result = rr.registrar_reconcile(
+        repo,
+        confirm_primary=True,
+        bootstrap_empty_projection=True,
+    )
+
+    assert result.status == "rejected"
+    assert result.error and result.error["code"] == "bootstrap_precondition_failed"