state-hub/docs/evidence/STATE-WP-0085-T07-repository-rename-recovery-matrix.md

Repository rename recovery and continuity matrix

Work item: STATE-WP-0085-T07 Scope: State Hub lifecycle only; no live flex-auth/access-engine mutation.

Automated recovery matrix

Hazard	Automated proof	Required result
Interruption/failure after every forward phase	test_every_forward_phase_failure_is_retry_safe; test_interrupt_resume_every_phase_and_preserve_uuid	Journal remains at the last achieved phase; retry resumes the same operation UUID.
Stale preflight/head	test_stale_head_wrong_id_target_conflict_and_queued_writes_fail_closed	Operation creation fails before mutation.
Double submission	test_client_operation_id_is_idempotent_and_globally_discoverable	Same intent and operation UUID returns no_op; changed intent fails closed.
Conflicting target rename	test_stale_head_wrong_id_target_conflict_and_queued_writes_fail_closed	Claimed Forge/State Hub target blocks preflight.
Forge redirect	test_redirected_forge_and_wrong_fresh_clone_identity_fail_closed_then_resume	A redirected lookup cannot masquerade as the requested coordinate.
Old slug unavailable during rollback	test_rollback_recovers_when_old_statehub_slug_temporarily_unavailable	Failure is journaled; restoring the protected route permits a safe retry after the external Forge rollback already committed.
State Hub outage	test_state_hub_outage_fails_without_losing_operation_identity_or_leaking_secrets	CLI reports state_hub_unavailable; the client-owned operation ID remains the recovery key.
Edge outbox replay	test_message_history_is_immutable_and_old_slug_write_replays_once; edge outbox/relay suites	Old-slug write canonicalizes and persists exactly once under its idempotency key.
Unreadable private repository	test_expired_token_bad_confirmation_and_unreadable_forge_fail_closed	Preflight is unsafe and no token is issued.
Fresh clone has wrong immutable Forge ID	test_redirected_forge_and_wrong_fresh_clone_identity_fail_closed_then_resume	source-synced fails, journals the failure, and succeeds only with matching repository ID and head.

Continuity proof

collect_continuity_baseline records both identity lists and immutable relationship tuples. Each record family has a relationship_checksum; token events additionally record input, output, cached-input, reasoning-output, and raw totals. Verification recomputes the relationships for every baseline ID, permits append-only records, and fails when an original ID is missing or any repository/workplan/task/snapshot binding changes.

The matrix covers repository identity, workplans, tasks, progress, decisions, token events and totals, SBOM snapshots and entries, active dispatch, protected slug routes, historical messages, and workplan file bindings. Alias verification is phase-aware because the intended mutation changes the old route from canonical to alias; all work-record and telemetry relationships remain unchanged.

test_equal_counts_do_not_hide_detached_work_and_telemetry deliberately moves an original workplan and token event to another repository, inserts replacements with identical counts and token totals, and proves verification still fails.

Operational evidence

The durable operation journal exposes:

• phase attempt counts and durations in milliseconds;
• total retries and failures plus failures by phase;
• rollback attempts and outcome;
• verification outcome;
• the last failure code, without operator evidence or credentials.

Credential-free NATS events publish phase, failure, verification, rollback, and completion outcomes. Event payloads contain immutable IDs, coordinate names, the expected source commit, metrics, and an operation evidence reference. They never include preflight tokens, supplied operator evidence, authorization data, remote URLs, or error details.

Reproduction

.venv/bin/pytest -q \
  tests/test_repository_rename_api.py \
  tests/test_repository_rename_cli.py \
  tests/test_repository_alias_routing.py \
  tests/test_edge_outbox.py \
  tests/test_edge_relay.py

Run the full repository suite before accepting this work item. Record the final test count and revision in the workplan result rather than editing this matrix with transient local values.