# Repository rename recovery and continuity matrix

Work item: `STATE-WP-0085-T07`
Scope: State Hub lifecycle only; no live `flex-auth`/`access-engine` mutation.

## Automated recovery matrix

| Hazard | Automated proof | Required result |
| --- | --- | --- |
| Interruption/failure after every forward phase | `test_every_forward_phase_failure_is_retry_safe`; `test_interrupt_resume_every_phase_and_preserve_uuid` | Journal remains at the last achieved phase; retry resumes the same operation UUID. |
| Stale preflight/head | `test_stale_head_wrong_id_target_conflict_and_queued_writes_fail_closed` | Operation creation fails before mutation. |
| Double submission | `test_client_operation_id_is_idempotent_and_globally_discoverable` | Same intent and operation UUID returns `no_op`; changed intent fails closed. |
| Conflicting target rename | `test_stale_head_wrong_id_target_conflict_and_queued_writes_fail_closed` | Claimed Forge/State Hub target blocks preflight. |
| Forge redirect | `test_redirected_forge_and_wrong_fresh_clone_identity_fail_closed_then_resume` | A redirected lookup cannot masquerade as the requested coordinate. |
| Old slug unavailable during rollback | `test_rollback_recovers_when_old_statehub_slug_temporarily_unavailable` | Failure is journaled; restoring the protected route permits a safe retry after the external Forge rollback already committed. |
| State Hub outage | `test_state_hub_outage_fails_without_losing_operation_identity_or_leaking_secrets` | CLI reports `state_hub_unavailable`; the client-owned operation ID remains the recovery key. |
| Edge outbox replay | `test_message_history_is_immutable_and_old_slug_write_replays_once`; edge outbox/relay suites | Old-slug write canonicalizes and persists exactly once under its idempotency key. |
| Unreadable private repository | `test_expired_token_bad_confirmation_and_unreadable_forge_fail_closed` | Preflight is unsafe and no token is issued. |
| Fresh clone has wrong immutable Forge ID | `test_redirected_forge_and_wrong_fresh_clone_identity_fail_closed_then_resume` | `source-synced` fails, journals the failure, and succeeds only with matching repository ID and head. |

## Continuity proof

`collect_continuity_baseline` records both identity lists and immutable
relationship tuples. Each record family has a `relationship_checksum`; token
events additionally record input, output, cached-input, reasoning-output, and
raw totals. Verification recomputes the relationships for every baseline ID,
permits append-only records, and fails when an original ID is missing or any
repository/workplan/task/snapshot binding changes.

The matrix covers repository identity, workplans, tasks, progress, decisions,
token events and totals, SBOM snapshots and entries, active dispatch, protected
slug routes, historical messages, and workplan file bindings. Alias verification
is phase-aware because the intended mutation changes the old route from
`canonical` to `alias`; all work-record and telemetry relationships remain
unchanged.

`test_equal_counts_do_not_hide_detached_work_and_telemetry` deliberately moves
an original workplan and token event to another repository, inserts replacements
with identical counts and token totals, and proves verification still fails.

## Operational evidence

The durable operation journal exposes:

- phase attempt counts and durations in milliseconds;
- total retries and failures plus failures by phase;
- rollback attempts and outcome;
- verification outcome;
- the last failure code, without operator evidence or credentials.

Credential-free NATS events publish phase, failure, verification, rollback, and
completion outcomes. Event payloads contain immutable IDs, coordinate names,
the expected source commit, metrics, and an operation evidence reference. They
never include preflight tokens, supplied operator evidence, authorization data,
remote URLs, or error details.

## Reproduction

```bash
.venv/bin/pytest -q \
  tests/test_repository_rename_api.py \
  tests/test_repository_rename_cli.py \
  tests/test_repository_alias_routing.py \
  tests/test_edge_outbox.py \
  tests/test_edge_relay.py
```

Run the full repository suite before accepting this work item. Record the final
test count and revision in the workplan result rather than editing this matrix
with transient local values.
