Verify real lifecycle project-sync events with pagination and idempotence #18

Goal

Verify the existing project-sync workflow against real events (full pagination, stable IDs, live membership, replay idempotence) and preserve project items and existing label uses.

Observations

• The current workflow already queries all open repository issues and dedupes by project membership; tests exercise actual events, not a new dedup algorithm.
• Local gh scope and secret metadata are not proof of Actions-stored credentials; secret placement is tested manually on an approved sandbox target at runtime.
• No blanket PAT or App support claim is made without validation.

Decision gate

Approve sandbox secret placement and the test event set before running.

Acceptance criteria

• All open issues in the approved sandbox repository are paginated fully and deduped by stable issue/project IDs and live membership.
• Replay is idempotent; project items and existing label uses are preserved with no implicit issue-label migration.
• Any status-approval fixture is human-applied after an exact fixture grant, never automatic.
• Known permission failures warn or skip; unexpected failures are non-zero.

Verification

• Event replay against sandbox -> a single status per issue, no duplicates.
• Secret placement test -> the runtime credential works; local metadata alone is not accepted as proof.

Release checkpoint

Remaining risk: runtime secret wiring is manual and unverified until the sandbox test runs.

Tracking

Roadmap item: B02-03. All acceptance criteria remain pending; publication does not grant approval or release authority.

Dependencies

• Depends on Model auth and apply reality for labels, protection, and preservation #17 (B02-02).