fix(identifier): verify migration per repository unit

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d
This commit is contained in:
tegwick 2026-08-22 00:02:48 +02:00
parent 956efbb7ae
commit 887943108e
6 changed files with 49 additions and 19 deletions

View file

@ -43,6 +43,7 @@ rmgr identifier derive --record-id RMGR-WP-0005
rmgr identifier preflight --root /path/to/fleet
rmgr identifier migration-plan --root /path/to/fleet --output uuid-migration.json
rmgr identifier migration-verify --plan uuid-migration.json
rmgr identifier migration-verify --plan uuid-migration.json --repo repo-manager
```
`migration-plan` is non-mutating. Its versioned JSON output preserves every
@ -53,8 +54,12 @@ output files are not replaced unless `--force` is explicit.
Plans carry a canonical UTC creation time, SHA-256 integrity seal, and per-repo
Git HEAD/source fingerprints. `migration-verify` rejects a modified plan, a
namespace mismatch, an ineligible repository, or any source/HEAD change after
planning. A new plan is required after any such drift.
namespace mismatch, an ineligible repository, or authoritative-source drift.
HEAD movement is reported but is not a hard failure when the source fingerprint
is unchanged; otherwise committing the plan itself would invalidate its own
repository. `--repo` verifies one atomic apply unit, so unrelated fleet churn
does not invalidate a stable repository. A new plan is required for each unit
whose authoritative source drifts.
Activation and applying a bulk migration remain separate governed steps.
Publishing or planning this function does not retroactively rewrite existing