feat(identifier): declare helixforge fleet namespace

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

docs/evidence/RMGR-WP-0005-helixforge-migration-readiness-2026-08-21.md

@@ -0,0 +1,54 @@
+---
+id: RMGR-EVIDENCE-0005-HELIXFORGE-MIGRATION-20260821
+type: evidence
+workplan_task: RMGR-WP-0005-T04
+created: "2026-08-21"
+---
+
+# HelixForge deterministic-identifier migration readiness
+
+Fleet owner Bernd Worsch declared `helixforge` as the authoritative current
+namespace. Repo Manager records it in `config/fleet-namespace.yaml`; omitting
+`--namespace` now resolves to that checked-in declaration.
+
+## Source preflight
+
+- 114 repository workplan roots scanned under `/home/worsch`;
+- 242 live workplan/task identifiers;
+- zero live identifier collisions;
+- one initial ineligible repository (`net-kingdom`) due to 14 legacy task ids
+  written as `-T1`…`-T8`;
+- those ids and their four documentation references were normalized to
+  `-T01`…`-T08` in NetKingdom commit `25ed928`;
+- regenerated plan: 42/42 repositories eligible, 242 records, 209 replacements,
+  33 assignments, zero skipped;
+- plan SHA-256:
+  `98a7d876d49fbec9c062f970c18e25750da4cd4b5c89ab0d4ed24d50183abbda`.
+
+The full old-to-derived mapping is
+`docs/evidence/RMGR-WP-0005-helixforge-uuid-migration-plan-2026-08-21.json`.
+It carries canonical UTC generation time plus per-repository Git HEAD and
+authoritative-source fingerprints. `rmgr identifier migration-verify` validates
+the seal and all 42 source preconditions.
+
+## Central-projection gate
+
+No UUID was rewritten. State Hub uses these UUIDs as primary keys, with
+references from tasks, progress and token events, decisions, dependencies,
+launch requests, intakes, capability requests, contributions, technical debt,
+extension points, and legacy suggestions. The checked-in foreign keys specify
+delete behavior but no `ON UPDATE CASCADE` behavior.
+
+Consequently, changing the repository fields first would detach the central
+projection, while directly updating database primary keys would fail or leave
+references split. Apply remains unauthorized until State Hub has:
+
+1. a transactional old→derived projection migration covering every referencing
+   table;
+2. durable alias/provenance for old ids used by saved links and events;
+3. per-repository prepare/apply/rollback behavior coordinated with the Git
+   commit and push seal; and
+4. an isolated PostgreSQL rehearsal proving forward and reverse mappings.
+
+This is a discovered compatibility requirement, not a source-data blocker. The
+sealed plan remains evidence; any source or HEAD drift requires regeneration.

docs/work-record-uuid-derivation_v1.md

@@ -25,10 +25,12 @@ fixed value above rather than recomputing it. Fleet namespace names are
 lowercase DNS-label style. Canonical identifiers are
 `PREFIX-WP-NNNN` or `PREFIX-WP-NNNN-TNN`.
 
-The repository is not a namespace. Under the current N1 posture, the fleet must
-declare one shared namespace name before activation. A future fork uses its own
-namespace name and therefore derives different UUIDs for the same unqualified
-identifier, as required by ADR-011.
+The repository is not a namespace. The fleet owner declared the current shared
+namespace as **`helixforge`** on 2026-08-21; the versioned declaration is
+`config/fleet-namespace.yaml`. This raises the namespace posture from implied
+N1 to declared N2. A future fork uses its own namespace name and therefore
+derives different UUIDs for the same unqualified identifier, as required by
+ADR-011.
 
 Only proposed, ready, active, blocked, or backlog workplans and their unfinished
 tasks enter the live derivation set. Finished and archived history retains its
@@ -37,10 +39,10 @@ the live-collision preflight. Any duplicate is a hard refusal; it is never
 silently disambiguated with a repository slug.
 
 ```bash
-rmgr identifier derive --namespace <fleet-namespace> --record-id RMGR-WP-0005
+rmgr identifier derive --record-id RMGR-WP-0005
 rmgr identifier preflight --root /path/to/fleet
-rmgr identifier migration-plan --root /path/to/fleet \
-  --namespace <fleet-namespace> --output uuid-migration.json
+rmgr identifier migration-plan --root /path/to/fleet --output uuid-migration.json
+rmgr identifier migration-verify --plan uuid-migration.json
 ```
 
 `migration-plan` is non-mutating. Its versioned JSON output preserves every
@@ -49,7 +51,12 @@ unit. A collision or malformed live identifier makes that whole repository
 ineligible while leaving unaffected repositories visible in the plan. Existing
 output files are not replaced unless `--force` is explicit.
 
+Plans carry a canonical UTC creation time, SHA-256 integrity seal, and per-repo
+Git HEAD/source fingerprints. `migration-verify` rejects a modified plan, a
+namespace mismatch, an ineligible repository, or any source/HEAD change after
+planning. A new plan is required after any such drift.
+
 Activation and applying a bulk migration remain separate governed steps.
 Publishing or planning this function does not retroactively rewrite existing
-identifiers. The caller must supply the namespace explicitly until the current
-fleet namespace is declared by the namespace owner under ADR-011.
+identifiers. `--namespace` remains an explicit override for a foreign/forked
+fleet; omitting it uses the checked-in `helixforge` declaration.