Add trusted auto-approval migration inventory

workplans/RREG-WP-0014-agentic-characteristic-acceptance.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Agentic Characteristic Acceptance"
 domain: capabilities
 repo: repo-scoping
-status: active
+status: done
 owner: codex
 topic_slug: foerster-capabilities
 created: "2026-05-15"
@@ -258,7 +258,7 @@ metadata, and manual approval still produces human review decisions.
 
 ```task
 id: RREG-WP-0014-T08
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "3d5475f6-71a7-4ca7-aa69-573e91d1fe1e"
 ```
@@ -272,6 +272,16 @@ Acceptance criteria:
 - The old behavior is either removed or guarded behind an explicit deprecated
   migration mode that cannot run by default.
 
+Implementation note 2026-05-15: added a guarded migration compatibility layer
+for historical `trusted_auto_approve_candidate_graph` records. The service now
+requires `allow_deprecated_migration_mode=True` before replaying the legacy
+auto-approval method, exposes an inventory of legacy auto-approval review debt,
+and documents the dry-run/rebuild/re-review path in
+`docs/migrations/trusted-auto-approval.md`. Added
+`repo-scoping list-legacy-auto-approvals` and
+`GET /review/migrations/trusted-auto-approvals` so existing maps produced by the
+legacy path can be identified before rebuilds.
+
 ## Completion Criteria
 
 - Deterministic rules no longer approve candidate characteristics.