feat: prove repository rename continuity

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a049a4-ee9f-78e1-9d66-2cb0f9bea3e3

docs/evidence/STATE-WP-0085-T07-repository-rename-recovery-matrix.md

@@ -0,0 +1,70 @@
+# Repository rename recovery and continuity matrix
+
+Work item: `STATE-WP-0085-T07`
+Scope: State Hub lifecycle only; no live `flex-auth`/`access-engine` mutation.
+
+## Automated recovery matrix
+
+| Hazard | Automated proof | Required result |
+| --- | --- | --- |
+| Interruption/failure after every forward phase | `test_every_forward_phase_failure_is_retry_safe`; `test_interrupt_resume_every_phase_and_preserve_uuid` | Journal remains at the last achieved phase; retry resumes the same operation UUID. |
+| Stale preflight/head | `test_stale_head_wrong_id_target_conflict_and_queued_writes_fail_closed` | Operation creation fails before mutation. |
+| Double submission | `test_client_operation_id_is_idempotent_and_globally_discoverable` | Same intent and operation UUID returns `no_op`; changed intent fails closed. |
+| Conflicting target rename | `test_stale_head_wrong_id_target_conflict_and_queued_writes_fail_closed` | Claimed Forge/State Hub target blocks preflight. |
+| Forge redirect | `test_redirected_forge_and_wrong_fresh_clone_identity_fail_closed_then_resume` | A redirected lookup cannot masquerade as the requested coordinate. |
+| Old slug unavailable during rollback | `test_rollback_recovers_when_old_statehub_slug_temporarily_unavailable` | Failure is journaled; restoring the protected route permits a safe retry after the external Forge rollback already committed. |
+| State Hub outage | `test_state_hub_outage_fails_without_losing_operation_identity_or_leaking_secrets` | CLI reports `state_hub_unavailable`; the client-owned operation ID remains the recovery key. |
+| Edge outbox replay | `test_message_history_is_immutable_and_old_slug_write_replays_once`; edge outbox/relay suites | Old-slug write canonicalizes and persists exactly once under its idempotency key. |
+| Unreadable private repository | `test_expired_token_bad_confirmation_and_unreadable_forge_fail_closed` | Preflight is unsafe and no token is issued. |
+| Fresh clone has wrong immutable Forge ID | `test_redirected_forge_and_wrong_fresh_clone_identity_fail_closed_then_resume` | `source-synced` fails, journals the failure, and succeeds only with matching repository ID and head. |
+
+## Continuity proof
+
+`collect_continuity_baseline` records both identity lists and immutable
+relationship tuples. Each record family has a `relationship_checksum`; token
+events additionally record input, output, cached-input, reasoning-output, and
+raw totals. Verification recomputes the relationships for every baseline ID,
+permits append-only records, and fails when an original ID is missing or any
+repository/workplan/task/snapshot binding changes.
+
+The matrix covers repository identity, workplans, tasks, progress, decisions,
+token events and totals, SBOM snapshots and entries, active dispatch, protected
+slug routes, historical messages, and workplan file bindings. Alias verification
+is phase-aware because the intended mutation changes the old route from
+`canonical` to `alias`; all work-record and telemetry relationships remain
+unchanged.
+
+`test_equal_counts_do_not_hide_detached_work_and_telemetry` deliberately moves
+an original workplan and token event to another repository, inserts replacements
+with identical counts and token totals, and proves verification still fails.
+
+## Operational evidence
+
+The durable operation journal exposes:
+
+- phase attempt counts and durations in milliseconds;
+- total retries and failures plus failures by phase;
+- rollback attempts and outcome;
+- verification outcome;
+- the last failure code, without operator evidence or credentials.
+
+Credential-free NATS events publish phase, failure, verification, rollback, and
+completion outcomes. Event payloads contain immutable IDs, coordinate names,
+the expected source commit, metrics, and an operation evidence reference. They
+never include preflight tokens, supplied operator evidence, authorization data,
+remote URLs, or error details.
+
+## Reproduction
+
+```bash
+.venv/bin/pytest -q \
+  tests/test_repository_rename_api.py \
+  tests/test_repository_rename_cli.py \
+  tests/test_repository_alias_routing.py \
+  tests/test_edge_outbox.py \
+  tests/test_edge_relay.py
+```
+
+Run the full repository suite before accepting this work item. Record the final
+test count and revision in the workplan result rather than editing this matrix
+with transient local values.

docs/nats-event-subjects.md

@@ -42,6 +42,11 @@ those publishers from colliding on the same `{noun}.{verb}` shape.
 | Subject                              | When                                                         | Required attributes                                                                                                          |
 | ------------------------------------ | ------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------- |
 | `org.statehub.repo.registered`       | A new repo is registered via `POST /repos/`                  | `repo_id`, `repo_slug`, `domain_slug`, `remote_url?`, `local_path?`                                                          |
+| `org.statehub.repo.rename.phase`     | A rename operation starts, advances, or is safely retried    | `operation_id`, `repo_id`, `forge_repository_id`, `old_slug`, `new_slug`, `phase`, `actor`, `expected_source_commit`, `outcome`, `no_op`, phase metrics, `evidence_ref` |
+| `org.statehub.repo.rename.failed`    | A rename or rollback phase fails closed                      | Rename phase attributes plus `error_code`; never error details or supplied evidence                                         |
+| `org.statehub.repo.rename.verified`  | An operator/API verification evaluates continuity            | Rename phase attributes plus `verification_outcome`                                                                          |
+| `org.statehub.repo.rename.rolled_back` | A rename operation reaches `rolled-back`                   | Rename phase attributes plus rollback attempts and outcome                                                                   |
+| `org.statehub.repo.renamed`          | A rename operation reaches `completed`                       | Rename phase attributes; repository and Forge immutable IDs remain unchanged                                                 |
 | `org.statehub.workplan.completed`    | A workplan transitions to canonical status `finished`        | `workplan_id`, `slug`, `title`, `topic_id`, `repo_id?`, `repo_goal_id?`                                                    |
 | ~~`org.statehub.workstream.completed`~~ | **Retired 2026-07-08** (`STATE-WP-0069` T05). Use `org.statehub.workplan.completed`. | — |
 | `org.statehub.decision.resolved`     | A decision is resolved via `POST /decisions/{id}/resolve`    | `decision_id`, `title`, `topic_id?`, `workstream_id?`, `decided_by`, `rationale_snippet`                                     |