feat(identifier): declare helixforge fleet namespace

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

tests/test_identifiers.py

@@ -1,16 +1,23 @@
 from __future__ import annotations
 
+import subprocess
 from pathlib import Path
 
 import pytest
 
 from repo_manager.identifiers import (
     derive_work_record_uuid,
+    load_fleet_namespace,
     plan_identifier_migration,
     scan_live_identifier_collisions,
+    verify_identifier_migration_plan,
 )
 
 
+def test_declared_fleet_namespace_is_helixforge() -> None:
+    assert load_fleet_namespace() == "helixforge"
+
+
 def _workplan(path: Path, identifier: str, status: str, task_status: str = "todo") -> None:
     path.parent.mkdir(parents=True, exist_ok=True)
     path.write_text(
@@ -80,6 +87,8 @@ def test_migration_plan_preserves_mapping_and_is_atomic_per_repo(tmp_path: Path)
         "ONE-WP-0001-T01",
     }
     assert all(item["current_uuid"] is None for item in one_plan["mappings"])
+    assert len(report["plan_sha256"]) == 64
+    assert report["generated_at"].endswith("Z")
 
 
 def test_migration_plan_skips_entire_repo_affected_by_collision(tmp_path: Path) -> None:
@@ -97,3 +106,33 @@ def test_migration_plan_skips_entire_repo_affected_by_collision(tmp_path: Path)
     assert one_plan["eligible"] is False
     assert any(item["record_id"] == "ONE-WP-0002" for item in one_plan["mappings"])
     assert any(item["reason"] == "live identifier collision" for item in one_plan["blockers"])
+
+
+def test_migration_verification_detects_tampering_and_source_drift(tmp_path: Path) -> None:
+    repo = tmp_path / "one"
+    path = repo / "workplans" / "one.md"
+    _workplan(path, "ONE-WP-0001", "active")
+    subprocess.run(["git", "init"], cwd=repo, check=True, capture_output=True)
+    subprocess.run(["git", "add", "."], cwd=repo, check=True, capture_output=True)
+    subprocess.run(
+        ["git", "-c", "user.name=Test", "-c", "user.email=test@example.com", "commit", "-m", "seed"],
+        cwd=repo,
+        check=True,
+        capture_output=True,
+    )
+    plan = plan_identifier_migration(tmp_path, "helixforge")
+    assert verify_identifier_migration_plan(plan)["ok"] is True
+
+    path.write_text(path.read_text(encoding="utf-8") + "\nchanged\n", encoding="utf-8")
+    verification = verify_identifier_migration_plan(plan)
+    assert verification["ok"] is False
+    assert any(
+        error["reason"] == "authoritative source changed after planning"
+        for error in verification["errors"]
+    )
+
+    plan["namespace"] = "tampered"
+    assert any(
+        error["reason"] == "plan SHA-256 mismatch"
+        for error in verify_identifier_migration_plan(plan)["errors"]
+    )