tegwick
9f0a104b56
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a049a4-ee9f-78e1-9d66-2cb0f9bea3e3
70 lines
4.2 KiB
Markdown
70 lines
4.2 KiB
Markdown
# Repository rename recovery and continuity matrix
|
|
|
|
Work item: `STATE-WP-0085-T07`
|
|
Scope: State Hub lifecycle only; no live `flex-auth`/`access-engine` mutation.
|
|
|
|
## Automated recovery matrix
|
|
|
|
| Hazard | Automated proof | Required result |
|
|
| --- | --- | --- |
|
|
| Interruption/failure after every forward phase | `test_every_forward_phase_failure_is_retry_safe`; `test_interrupt_resume_every_phase_and_preserve_uuid` | Journal remains at the last achieved phase; retry resumes the same operation UUID. |
|
|
| Stale preflight/head | `test_stale_head_wrong_id_target_conflict_and_queued_writes_fail_closed` | Operation creation fails before mutation. |
|
|
| Double submission | `test_client_operation_id_is_idempotent_and_globally_discoverable` | Same intent and operation UUID returns `no_op`; changed intent fails closed. |
|
|
| Conflicting target rename | `test_stale_head_wrong_id_target_conflict_and_queued_writes_fail_closed` | Claimed Forge/State Hub target blocks preflight. |
|
|
| Forge redirect | `test_redirected_forge_and_wrong_fresh_clone_identity_fail_closed_then_resume` | A redirected lookup cannot masquerade as the requested coordinate. |
|
|
| Old slug unavailable during rollback | `test_rollback_recovers_when_old_statehub_slug_temporarily_unavailable` | Failure is journaled; restoring the protected route permits a safe retry after the external Forge rollback already committed. |
|
|
| State Hub outage | `test_state_hub_outage_fails_without_losing_operation_identity_or_leaking_secrets` | CLI reports `state_hub_unavailable`; the client-owned operation ID remains the recovery key. |
|
|
| Edge outbox replay | `test_message_history_is_immutable_and_old_slug_write_replays_once`; edge outbox/relay suites | Old-slug write canonicalizes and persists exactly once under its idempotency key. |
|
|
| Unreadable private repository | `test_expired_token_bad_confirmation_and_unreadable_forge_fail_closed` | Preflight is unsafe and no token is issued. |
|
|
| Fresh clone has wrong immutable Forge ID | `test_redirected_forge_and_wrong_fresh_clone_identity_fail_closed_then_resume` | `source-synced` fails, journals the failure, and succeeds only with matching repository ID and head. |
|
|
|
|
## Continuity proof
|
|
|
|
`collect_continuity_baseline` records both identity lists and immutable
|
|
relationship tuples. Each record family has a `relationship_checksum`; token
|
|
events additionally record input, output, cached-input, reasoning-output, and
|
|
raw totals. Verification recomputes the relationships for every baseline ID,
|
|
permits append-only records, and fails when an original ID is missing or any
|
|
repository/workplan/task/snapshot binding changes.
|
|
|
|
The matrix covers repository identity, workplans, tasks, progress, decisions,
|
|
token events and totals, SBOM snapshots and entries, active dispatch, protected
|
|
slug routes, historical messages, and workplan file bindings. Alias verification
|
|
is phase-aware because the intended mutation changes the old route from
|
|
`canonical` to `alias`; all work-record and telemetry relationships remain
|
|
unchanged.
|
|
|
|
`test_equal_counts_do_not_hide_detached_work_and_telemetry` deliberately moves
|
|
an original workplan and token event to another repository, inserts replacements
|
|
with identical counts and token totals, and proves verification still fails.
|
|
|
|
## Operational evidence
|
|
|
|
The durable operation journal exposes:
|
|
|
|
- phase attempt counts and durations in milliseconds;
|
|
- total retries and failures plus failures by phase;
|
|
- rollback attempts and outcome;
|
|
- verification outcome;
|
|
- the last failure code, without operator evidence or credentials.
|
|
|
|
Credential-free NATS events publish phase, failure, verification, rollback, and
|
|
completion outcomes. Event payloads contain immutable IDs, coordinate names,
|
|
the expected source commit, metrics, and an operation evidence reference. They
|
|
never include preflight tokens, supplied operator evidence, authorization data,
|
|
remote URLs, or error details.
|
|
|
|
## Reproduction
|
|
|
|
```bash
|
|
.venv/bin/pytest -q \
|
|
tests/test_repository_rename_api.py \
|
|
tests/test_repository_rename_cli.py \
|
|
tests/test_repository_alias_routing.py \
|
|
tests/test_edge_outbox.py \
|
|
tests/test_edge_relay.py
|
|
```
|
|
|
|
Run the full repository suite before accepting this work item. Record the final
|
|
test count and revision in the workplan result rather than editing this matrix
|
|
with transient local values.
|