feat: prove repository rename continuity

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a049a4-ee9f-78e1-9d66-2cb0f9bea3e3

tests/test_repository_rename_cli.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import json
 import stat
 import sys
+import urllib.error
 import uuid
 
 import pytest
@@ -240,6 +241,27 @@ def test_rollback_requires_separate_execute_flag(monkeypatch, capsys):
     assert [method for method, _path, _body in calls] == ["GET", "POST"]
 
 
+def test_state_hub_outage_fails_without_losing_operation_identity_or_leaking_secrets(
+    monkeypatch,
+):
+    def unavailable(*_args, **_kwargs):
+        raise urllib.error.URLError(
+            "connection refused token=super-secret authorization=Bearer-secret"
+        )
+
+    monkeypatch.setattr(rename_cli.urllib.request, "urlopen", unavailable)
+    with pytest.raises(rename_cli.RenameCLIError) as raised:
+        rename_cli._api_request(
+            "http://127.0.0.1:8000",
+            "GET",
+            f"/repository-renames/operations/{OPERATION_ID}",
+        )
+    assert raised.value.code == "state_hub_unavailable"
+    assert str(raised.value) == "State Hub is unavailable"
+    assert "super-secret" not in json.dumps(raised.value.details)
+    assert OPERATION_ID not in raised.value.details.get("reason", "")
+
+
 def test_rollback_execute_reaches_terminal_state(monkeypatch, capsys):
     calls = []