Add trusted auto-approval migration inventory

tests/test_cli.py

@@ -182,6 +182,40 @@ def test_list_quality_criteria_cli_writes_json(tmp_path):
     )
 
 
+def test_list_legacy_auto_approvals_cli_writes_json_inventory(tmp_path):
+    service = make_service(tmp_path)
+    source = write_repo(tmp_path)
+    repository = service.register_repository(name="Legacy CLI", url=str(source))
+    summary = service.analyze_repository(repository.id, use_llm_assistance=False)
+    service.trusted_auto_approve_candidate_graph(
+        repository.id,
+        summary.analysis_run.id,
+        allow_deprecated_migration_mode=True,
+    )
+    output_path = tmp_path / "legacy-auto-approvals.json"
+
+    exit_code = main(
+        [
+            "list-legacy-auto-approvals",
+            "--format",
+            "json",
+            "--output",
+            str(output_path),
+            "--database-path",
+            str(tmp_path / "registry.sqlite3"),
+            "--checkout-root",
+            str(tmp_path / "checkouts"),
+        ]
+    )
+
+    records = json.loads(output_path.read_text(encoding="utf-8"))
+    assert exit_code == 0
+    assert records[0]["repository_id"] == repository.id
+    assert records[0]["repository_name"] == "Legacy CLI"
+    assert records[0]["analysis_run_id"] == summary.analysis_run.id
+    assert records[0]["current_approved_ability_count"] == 1
+
+
 def test_self_assess_cli_exports_challenger_and_comparison(tmp_path):
     source = write_repo(tmp_path)
     golden_path = tmp_path / "golden.json"

tests/test_trusted_auto_approval_migration.py

@@ -0,0 +1,65 @@
+from repo_registry.core.service import RegistryService
+from repo_registry.repo_ingestion.git import GitIngestionService
+from repo_registry.storage.sqlite import RegistryStore
+
+
+def make_service(tmp_path):
+    store = RegistryStore(tmp_path / "registry.sqlite3")
+    store.initialize()
+    return RegistryService(store, ingestion=GitIngestionService(tmp_path / "checkouts"))
+
+
+def write_api_repo(tmp_path):
+    source = tmp_path / "api-repo"
+    source.mkdir()
+    (source / "README.md").write_text("# API Repo\nReports health.\n", encoding="utf-8")
+    (source / "app.py").write_text('@app.get("/health")\ndef health():\n    return {}\n', encoding="utf-8")
+    return source
+
+
+def test_trusted_auto_approval_requires_explicit_migration_mode(tmp_path):
+    service = make_service(tmp_path)
+    repository = service.register_repository(
+        name="Legacy Guard Repo",
+        url=str(write_api_repo(tmp_path)),
+    )
+    summary = service.analyze_repository(repository.id, use_llm_assistance=False)
+
+    try:
+        service.trusted_auto_approve_candidate_graph(
+            repository.id,
+            summary.analysis_run.id,
+        )
+    except ValueError as exc:
+        assert "deprecated" in str(exc)
+    else:
+        raise AssertionError("trusted auto-approval should be guarded by default")
+
+    assert service.ability_map(repository.id).abilities == []
+
+
+def test_legacy_auto_approval_inventory_identifies_review_debt(tmp_path):
+    service = make_service(tmp_path)
+    repository = service.register_repository(
+        name="Legacy Inventory Repo",
+        url=str(write_api_repo(tmp_path)),
+    )
+    summary = service.analyze_repository(repository.id, use_llm_assistance=False)
+
+    service.trusted_auto_approve_candidate_graph(
+        repository.id,
+        summary.analysis_run.id,
+        notes="Historical migration replay.",
+        allow_deprecated_migration_mode=True,
+    )
+
+    records = service.list_trusted_auto_approval_migration_records()
+    assert len(records) == 1
+    record = records[0]
+    assert record.repository_id == repository.id
+    assert record.repository_name == "Legacy Inventory Repo"
+    assert record.analysis_run_id == summary.analysis_run.id
+    assert record.review_decision_id > 0
+    assert record.analysis_run_status == "completed"
+    assert record.current_approved_ability_count == 1
+    assert "rebuild" in record.recommended_next_step

tests/test_web_api.py

@@ -3,6 +3,9 @@ import sqlite3
 
 from fastapi.testclient import TestClient
 
+from repo_registry.core.service import RegistryService
+from repo_registry.repo_ingestion.git import GitIngestionService
+from repo_registry.storage.sqlite import RegistryStore
 from repo_registry.web_api import app as app_module
 from repo_registry.web_api.app import Settings, app, get_service, get_settings
 
@@ -191,6 +194,48 @@ def test_quality_gate_override_api_records_auditable_override(tmp_path):
         app.dependency_overrides.clear()
 
 
+def test_trusted_auto_approval_migration_inventory_api(tmp_path):
+    source = tmp_path / "legacy-api-repo"
+    source.mkdir()
+    (source / "README.md").write_text("# Legacy API Repo\nReports health.\n", encoding="utf-8")
+    (source / "app.py").write_text('@app.get("/health")\ndef health():\n    return {}\n', encoding="utf-8")
+    database_path = str(tmp_path / "legacy-auto-approval.sqlite3")
+    store = RegistryStore(database_path)
+    store.initialize()
+    service = RegistryService(
+        store,
+        ingestion=GitIngestionService(tmp_path / "checkouts"),
+    )
+    repository = service.register_repository(name="Legacy API Repo", url=str(source))
+    summary = service.analyze_repository(repository.id, use_llm_assistance=False)
+    service.trusted_auto_approve_candidate_graph(
+        repository.id,
+        summary.analysis_run.id,
+        allow_deprecated_migration_mode=True,
+    )
+
+    def override_settings():
+        return Settings(
+            database_path=database_path,
+            checkout_root=str(tmp_path / "checkouts"),
+        )
+
+    app.dependency_overrides[get_settings] = override_settings
+    client = TestClient(app)
+    try:
+        response = client.get("/review/migrations/trusted-auto-approvals")
+
+        assert response.status_code == 200
+        records = response.json()
+        assert records[0]["repository_id"] == repository.id
+        assert records[0]["repository_name"] == "Legacy API Repo"
+        assert records[0]["analysis_run_id"] == summary.analysis_run.id
+        assert records[0]["current_approved_ability_count"] == 1
+        assert "rebuild" in records[0]["recommended_next_step"]
+    finally:
+        app.dependency_overrides.clear()
+
+
 def test_openapi_contract_snapshot_for_stable_agent_paths():
     client = TestClient(app)
 
@@ -246,6 +291,12 @@ def test_openapi_contract_snapshot_for_stable_agent_paths():
                 "success_schema": "QualityCriteriaRegistryResponse",
             }
         },
+        "/review/migrations/trusted-auto-approvals": {
+            "get": {
+                "tags": ["review"],
+                "success_schema": "list[TrustedAutoApprovalMigrationRecordResponse]",
+            }
+        },
         "/repos": {
             "get": {"tags": ["repositories"], "success_schema": "list[RepositoryResponse]"},
             "post": {"tags": ["repositories"], "success_schema": "RepositoryResponse"},