docs(identifier): record repo-manager cutover pilot

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

docs/evidence/RMGR-WP-0005-repo-manager-pilot-2026-08-22.md

@@ -0,0 +1,97 @@
+# RMGR-WP-0005 Repo Manager pilot evidence
+
+**Observed at:** `2026-08-22T07:59:49Z`  
+**Fleet namespace:** `helixforge`  
+**Scope:** `repo-manager` / `RMGR-WP-0005` only
+
+## Outcome
+
+The first repository cutover completed without rollback. The workstation
+projection was migrated in place from minted UUIDs to deterministic UUIDv5
+identifiers. The production registrar had no Repo Manager projection, so it was
+upgraded and rebuilt from the same authoritative file identifiers. Both now
+resolve `RMGR-WP-0005` as
+`6dcf854e-9229-569d-90f0-2d9df235a61d`.
+
+The sealed fleet plan remains unchanged and no other repository was migrated.
+
+## Recovery points
+
+| Projection | Backup | SHA-256 | Size |
+| --- | --- | --- | --- |
+| Workstation | `/tmp/state-hub-rmgr-wp-0005-pilot-preapply.dump` | `8c5a4ef4cddef2d3a1af0303eeccbb6206613fa1a5fe932364262b3623f77950` | 4.4 MiB |
+| Production registrar | `/tmp/state-hub-registrar-rmgr-wp-0005-preapply.dump` | `01753744bc844b154900ead916f122946c5414e77f888c3e18016cae6d3d8929` | 4.6 MiB |
+
+Both are PostgreSQL custom-format archives with readable restore catalogs.
+The production deployment can also return to Helm revision 9 / image
+`main-d8808bf`. Recovery must stop writes first and restore into an isolated or
+replacement database before endpoint cutover; no destructive in-place restore
+was attempted.
+
+## Workstation projection migration
+
+- Alembic advanced to `b8d4f0a2c6e1`; 20/20 foreign keys into workplan/task
+  identities use `ON UPDATE CASCADE`.
+- The repository-atomic database executor applied six replacements and no
+  assignments. Six durable aliases have status `applied`.
+- All old rows are absent and all new rows are present.
+- Cascades preserved 12 task-to-workplan links, 12 workplan progress links, one
+  decision link, and three task progress links.
+- The guarded file executor applied the same six replacements from sealed plan
+  `5a2e0d1d4e6e121780a0e66a83e07a718f3050e8f1c6b94328b86b92de290a0c`.
+- File migration commit: `5de754a`; final consistency commit: `40ad9e9`.
+- The rebuilt local Repo Manager cache is fresh with 73 records.
+
+## Production registrar deployment and rebuild
+
+- Helm dry-run selected `main-697dd49` and rendered no host path, operator-home,
+  SSH, or sweep environment entries.
+- Helm revision 10 deployed atomically; the live release reports
+  `sweep.enabled: false`, no volumes or mounts, and `/state/health` returns 200
+  with a connected database.
+- Alembic advanced from `f0a1b2c3d4e5` to `b8d4f0a2c6e1`; 20/20 relevant
+  foreign keys cascade updates and the alias table exists.
+- The logical `repo-manager` repository was absent and was registered as
+  `a9d105c6-10fa-4cf9-8bc1-e248476698d3` under topic
+  `cee7bedf-2b48-46ef-8601-006474f2ad7a`.
+- Governed projection repair created deterministic `RMGR-WP-0005` and 12 tasks.
+  The 12 file task UUIDs and 12 production task UUIDs are byte-for-byte equal.
+- The new workplan lookup returns 200; old minted UUID
+  `7ddb5421-d960-4a3c-94b1-40b6c96abfab` returns 404.
+- A second read-only consistency pass reports no issue for `RMGR-WP-0005`.
+  Eight legacy/random-ID Repo Manager workplans remain explicit non-fixable
+  stale references and were not ingested.
+- Production aliases remain empty, as expected for rebuilding an absent
+  projection rather than rewriting an existing primary key.
+
+The first classified repository-create request returned 500 because the
+contained image does not package `repo-classification.allowed.yaml` and has no
+Custodian host mount. No row was created. The minimal logical record then
+created successfully. Packaging classification canon is follow-up work; host
+mount containment was not weakened.
+
+The scoped registrar child returned the broader consistency exit code 1 because
+of the eight intentionally untouched legacy references. It nevertheless created
+and returned the exact target UUID and tasks. Repo Manager commit `e656f7f`
+adds `--repair-workplan` and verifies that exact projection before accepting this
+bounded residual status. In the managed Codex sandbox the child could not create
+`.git/index.lock` for its generated brief; the complete local projection restored
+the brief and pushed consistency commit `4b5e48f`. No authoritative identifier
+file changed during registrar rebuild.
+
+## Published implementation
+
+- State Hub schema/executor: `cb1b028`
+- State Hub deterministic rebuild API/consistency: `697dd49`
+- State Hub declared production state and pilot record: `52a7d6b`
+- Repo Manager sealed plan: `e52ce3e`
+- Repo Manager file migration: `5de754a`
+- Repo Manager projection-repair wrapper: `e656f7f`
+
+## Gate after the pilot
+
+This evidence authorizes no fleet-wide mutation. Before a wider cutover, select
+the next repository batch, refresh preflight/source fingerprints, retain a
+per-database restore point, and preserve the same database-first/file-second
+rollback boundary. The scoped credential/sweep replacement in
+`RMGR-WP-0005-T12` remains separate and blocked; production sweeping stays off.

workplans/RMGR-WP-0005-registrar-consolidation-deterministic-ids.md

@@ -403,6 +403,19 @@ plan after this implementation commit. The remaining gate is a single-repository
 pilot that couples database apply, authoritative file rewrite, consistency
 verification, and database rollback if the file phase fails.
 
+**Pilot completed (2026-08-22):** the refreshed sealed plan covered 43/43
+eligible repositories, 245 mappings (212 replacements, 33 assignments), and no
+collisions. The authorized `repo-manager` slice migrated six existing
+workplan/task rows and file identifiers atomically. All referenced rows followed,
+six aliases are durable, the local cache is fresh, and both old/new API lookups
+have the expected 404/200 result. The production registrar was upgraded with
+sweeping still disabled and rebuilt the formerly absent projection from the
+same deterministic workplan UUID and all 12 authoritative task UUIDs. Exact
+evidence, restore points, hashes, and residuals are in
+`docs/evidence/RMGR-WP-0005-repo-manager-pilot-2026-08-22.md`. T04 remains in
+progress: widening beyond this single repository requires a new explicit fleet
+cutover decision and refreshed source fingerprints.
+
 ## Retire the interim rule
 
 ```task
@@ -459,6 +472,14 @@ State Hub database and verify hub-native centralization. The documented remote
 tunnel at `127.0.0.1:18000` was not running during this pass, so no central
 comparison was inferred.
 
+**Production comparison (2026-08-22):** the registrar began with no Repo
+Manager workplan projection. After the contained rebuild, `RMGR-WP-0005` and
+all 12 task UUIDs exactly match the authoritative file, and a second read-only
+pass reports no issue for that workplan. This proves discard-and-reconstruct for
+the pilot record without identifier writeback. T07 remains in progress because
+the full isolated projection rebuild and hub-native centralization proof still
+cover more than this one workplan.
+
 ## Separate file-derived from hub-native data
 
 ```task