feat: generate repository rename adoption plans

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a049a4-ee9f-78e1-9d66-2cb0f9bea3e3

tests/test_repository_rename_cli.py

@@ -388,3 +388,86 @@ def test_human_status_distinguishes_lifecycle_states(
         _run(monkeypatch, "repo", "rename", "status", OPERATION_ID)
     captured = capsys.readouterr()
     assert f"{label}: repository rename status" in captured.out + captured.err
+
+
+def test_generate_workplan_cli_writes_once_and_reports_contract(
+    monkeypatch, tmp_path, capsys
+):
+    repo_root = tmp_path / "flex-auth"
+    repo_root.mkdir()
+    (repo_root / "AGENTS.md").write_text(
+        "**Workplan prefix:** `FLEX-WP-`\n"
+    )
+    output = repo_root / "workplans" / "rename.md"
+    report = {
+        "schema_version": "state-hub.repository-rename-preflight.v1",
+        "repo_id": REPO_ID,
+        "old_slug": "flex-auth",
+        "new_slug": "access-engine",
+        "safe_to_apply": True,
+        "blockers": [],
+        "warnings": [],
+        "report_checksum": "a" * 64,
+        "preflight_token": "private-token",
+        "preflighted_at": "2026-08-29T08:00:00Z",
+        "current": {
+            "statehub": {"local_path": str(repo_root), "host_paths": {}},
+            "forge_identity": {
+                "verification_state": "verified",
+                "forge_repository_id": 42,
+            },
+            "forge_available": True,
+            "forge": {
+                "repository_id": 42,
+                "default_branch": "main",
+                "head_commit": "b" * 40,
+            },
+        },
+        "active_work": {"workplans": [], "tasks": []},
+        "affected": {"external_handoffs": []},
+    }
+    repo = {**_repo(), "local_path": str(repo_root), "host_paths": {}}
+    workplans = [
+        {
+            "slug": "flex-wp-0018",
+            "backing_filename": "FLEX-WP-0018-last.md",
+            "status": "finished",
+        }
+    ]
+
+    def request(_api_base, method, path, body=None, *, expected=dict):
+        del body
+        if path.startswith("/repos/flex-auth"):
+            return repo
+        if path.startswith("/workplans/"):
+            assert expected is list
+            return workplans
+        assert method == "POST"
+        return report
+
+    monkeypatch.setattr(rename_cli, "_api_request", request)
+    args = (
+        "repo",
+        "rename",
+        "generate-workplan",
+        "flex-auth",
+        "access-engine",
+        "--repo-path",
+        str(repo_root),
+        "--output",
+        str(output),
+        "--json",
+    )
+    _run(monkeypatch, *args)
+    result = json.loads(capsys.readouterr().out)
+    assert result["state"] == "achieved"
+    assert result["result"]["workplan_id"] == "FLEX-WP-0019"
+    assert result["result"]["workplan_prefix"] == "FLEX-WP"
+    assert result["result"]["state_hub_uuid_fields_written"] == []
+    assert "private-token" not in output.read_text()
+
+    with pytest.raises(SystemExit) as exc:
+        _run(monkeypatch, *args)
+    assert exc.value.code == 1
+    refused = json.loads(capsys.readouterr().out)
+    assert refused["error"]["code"] == "output_exists"