feat: persist trustworthy-transition continuity v0.1

[safal207]

Summary

Implements LS #768 as a follow-up to the landed Continuity Store PR #766.

This PR adds a provider-neutral continuity adapter that persists exact trustworthy-transition record references and derives safe resume posture across pause, restart, retry, and context drift.

Landed base

PR #766 landed on main as 9c7fc7c3c73ec0107615af3051e78639405301e7.

This PR is retargeted to main and exact head 71164c7bdf53d940d410e1120b5f858ac36598ef merges that landed base without rewriting history. The PR diff is again limited to seven transition-adapter files.

Added

• src/trustworthy-transition.ts
• src/transition-demo.ts
• tests/fixtures/trustworthy-transition-continuity-v0.1.json
• tests/trustworthy-transition.test.ts
• docs/TRUSTWORTHY_TRANSITION_CONTINUITY_V0_1.md
• demo:transition package script
• README interoperability and boundary documentation

Snapshot model

Each transition snapshot is stored as an immutable verification_receipt and binds:

• transition and subject identity;
• action identity and arguments binding digest;
• authorization, observation, response-integrity, and causal-audit references;
• deterministic evidence-set digest;
• runtime context digest;
• independent authority, execution, response-integrity, and causal-validity dimensions;
• side-effect commitment state;
• expiry and idempotent retry metadata;
• optional explicit reauthorization reference.

Resume postures

• CONTINUE_SIDE_EFFECT
• RETRY_SIDE_EFFECT
• REPORT_ONLY
• REMEDIATE_RESPONSE
• REVALIDATE
• BLOCKED
• ALREADY_CONSUMED

Safety rules

• A committed or observed side effect cannot replay after restart.
• Expired, denied, pending, consumed, unknown, or revalidation-required authority cannot silently resume.
• Context or evidence drift requires a rebuilt snapshot.
• Error retry requires an exact stored idempotency key and explicit retryable profile.
• Failed response integrity routes to response remediation rather than execution replay.
• Invalid causal lineage blocks continuation.
• Historical snapshots remain reportable without regaining live permission.
• Cross-subject, transition, action, and binding substitution fail closed.
• Live permission is derived only inside a verified event/index/projection read snapshot.
• Every VALID causal state requires an immutable causal-audit reference; UNKNOWN or NOT_EVALUATED needs a fresh causal record before VALID.
• Every VERIFIED response-integrity state requires an immutable response-integrity reference.
• A newly observed execution error needs a fresh observation record even when retry policy was predeclared.

Snapshot-chain monotonicity

The chain assessment rejects:

• broken previous_ref;
• observation removal;
• committed-side-effect rollback;
• executed-to-unobserved rollback;
• terminal authority reopened under the same authorization;
• capture-time rollback;
• reuse of earlier authorization, causal, or response-integrity refs as fresh recovery evidence;
• any later VERIFIED use of a response ref already classified FAILED or PARTIAL, even after an intervening successful recovery;
• an unresolved response-recovery state that is neither newly FAILED/PARTIAL nor VERIFIED with fresh evidence.
• retry eligibility made permissive without fresh observation evidence or an explicit new authorization epoch.
• an OBSERVED_ERRORED transition without fresh observation evidence;
• causal recovery from UNKNOWN or NOT_EVALUATED using absent or reused evidence.

Reopening terminal authority requires a different authorization reference plus an explicit matching reauthorization_ref.

Validation

Local replay on exact tree 4179823cec7261b99877ee7ebb381e60cc8a8dcc:

• TypeScript build passed;
• 62/62 unit, restart, adversarial, and transition tests passed;
• base and transition compiled demos passed through node dist/...;
• git diff --check passed.

The tsx CLI wrapper itself cannot open its IPC socket in this sandbox (EPERM); the same sources were executed through Node's loader. Hosted exact-head workflows are the authoritative wrapper replay.

Review status

• Exact PR head: 71164c7bdf53d940d410e1120b5f858ac36598ef.
• All inline review findings are resolved against the current implementation.
• CodeRabbit and all older-head hosted results are stale after this update.
• Hosted LS Continuity Store, Security, and Reflection checks are pending on the exact head.
• Mandatory Codex exact-head review is pending.
• Exact-head regressions now prove that a same-authorization OBSERVED_BLOCKED → OBSERVED_ERRORED chain is blocked before side-effect retry, while an explicit new authorization epoch permits retry.
• A FAILED → UNKNOWN → VERIFIED sequence with fresh unique verification evidence recovers cleanly; a fresh return to FAILED/PARTIAL preserves remediation while an outstanding unknown recovery remains blocked.
• Newly enabled retry eligibility and idempotency-key replacement now require a fresh observation reference or explicit new authorization epoch.
• A staged BLOCKED(auth A) → BLOCKED(auth B, reauth B) → ERRORED(auth B) sequence honors the prepared epoch; any later fresh blocked observation consumes that clearance and requires another epoch.
• Truncating the newest event while retaining its object/index/projection fails closed before live evaluation; historical report-only access remains bounded.
• NOT_OBSERVED → OBSERVED_ERRORED with a reused observation and NOT_EVALUATED/UNKNOWN → VALID with a reused causal ref are rejected.
• VALID authority now requires a non-null immutable authorization record, including at creation and stored verification.
• Every OBSERVED_ERRORED snapshot, including the first, requires observation evidence; later entry still requires a fresh observation.
• A causal record previously classified as non-valid remains permanently ineligible to establish later VALID permission.
• VALID causal and VERIFIED response states require non-null immutable evidence at creation and stored verification.
• Response refs classified FAILED or PARTIAL remain permanently ineligible for later VERIFIED, including FAILED(A) → VERIFIED(C) → VERIFIED(A).

Boundary

LS persists continuity and derives continuation posture only. It does not issue authorization, observe execution, verify response claims, or decide causal validity.

Merge gate

Keep this PR draft. Do not merge until:

1. hosted checks finish green on 71164c7bdf53d940d410e1120b5f858ac36598ef;
2. mandatory Codex review covers that exact head and passes;
3. no new actionable review thread remains.

Relates to #768 and safal207/Liminal#108.

Summary by CodeRabbit

• New Features

  • Added a new continuity workflow and demo path for the LS Continuity Store.
  • Introduced transition snapshot evaluation, chain assessment, and resume decision support.
  • Added a new demo command to show transition behavior end to end.

• Bug Fixes

  • Improved demo setup and shutdown so local data is created and cleaned up reliably.
  • Added checks that help detect invalid snapshot changes, rollback cases, and stale or mismatched continuity state.

• Documentation

  • Expanded the README and reference docs with clearer continuity rules, demo steps, and expected behavior.

[github-actions]

LS multi-model PR review

• Exact head: 71164c7bdf53d940d410e1120b5f858ac36598ef
• Base: 9c7fc7c3c73ec0107615af3051e78639405301e7
• Provider: openrouter
• Status: PARTIAL
• Aggregate verdict: COMMENT
• Mode: advisory
• High-risk route: true
• Diff truncated: true
• Files represented in bounded evidence: 7/10
• Policy would block: true

Model executions

Role	Model	Status	Verdict
architecture_and_governance_reviewer	nvidia/nemotron-3-ultra-550b-a55b:free	INVALID	-
fast_diff_reviewer	cohere/north-mini-code:free	INVALID	-
deep_implementation_reviewer	poolside/laguna-xs-2.1:free	INVALID	-

Confirmed findings

No finding reached independent two-model confirmation.

Candidate findings

No structured candidate finding was produced.

Incomplete lanes

• diff\_coverage: {'key': 'diff_coverage', 'reason': 'bounded diff was truncated; the review cannot claim complete PR coverage', 'reviewed_files': ['packages/ls-continuity-store/README.md', 'packages/ls-continuity-store/docs/TRUSTWORTHY_TRANSITION_CONTINUITY_V0_1.md', 'packages/ls-continuity-store/package.json', 'packages/ls-continuity-store/src/recover.ts', 'packages/ls-continuity-store/src/store.ts', 'packages/ls-continuity-store/src/transition-demo.ts', 'packages/ls-continuity-store/src/trustworthy-transition.ts'], 'omitted_files': ['packages/ls-continuity-store/src/verify.ts', 'packages/ls-continuity-store/tests/fixtures/trustworthy-transition-continuity-v0.1.json', 'packages/ls-continuity-store/tests/trustworthy-transition.test.ts']}
• independent\_challenger: {'key': 'independent_challenger', 'requested_model': 'hy3', 'candidates': ['tencent/hy3:free', 'poolside/laguna-xs-2.1:free', 'cohere/north-mini-code:free'], 'reserved_candidates': []}

Authority boundary

This output is evidence for human review. It cannot approve or merge the PR, and a single-model finding remains a candidate rather than a gate decision.

[safal207]

PR #766 is landed and this stack is now retargeted to main. Exact head 13b44574b96e19b12118b5a2df8b1340f6427741 (tree c2d5cb520a74c7ff2965233f37bbd73970b85b03) has a seven-file transition-only diff. Local replay: build passed, 40/40 tests passed, both demos passed through node --import tsx, and git diff --check passed. All prior threads remain resolved; authority and local-replay boundaries are unchanged.

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 13b44574b9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[safal207]

Fresh Codex findings are addressed on exact head fff5118cb111c4bb069380f7274d957f024b84b3 (tree 59c963fa18647d82172fd2563d9cda6bcacff61f).

• local exact-tree validation: TypeScript build passed; 43/43 tests passed; transition demo passed via node --import tsx; git diff --check passed.
• unresolved review threads: 0.
• hosted exact-head checks are pending.

Local replay remains local evidence only; continuity stays non-authorizing and does not claim to observe execution, issue authority, or verify response truth.

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fff5118cb1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[safal207]

Exact-head follow-up: 7dc14b9df852b28328306935494b79c7eb05a7a7 (tree 9bd9684357629c696af77fef362773d80fd7cb1e). The authority-expiry and blocking-evidence epoch bypasses are fixed; local package tests are 45/45 green and TypeScript build passes. Draft/authority boundary is unchanged, and hosted exact-head evidence is pending. @codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7dc14b9df8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[safal207]

Exact-head follow-up published at 90de52f1d98766477381b4a893b48b9a20da3dbf (tree e5a9f4741f894bf886ad1f712053c20d5d2149a0). Local package replay: 48/48 passed; TypeScript build and git diff --check passed. All three fresh findings are regression-covered and resolved. This PR remains draft; hosted CI and mandatory review must be evaluated only for this exact head.

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 90de52f1d9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[safal207]

Exact-head update: b7c33e133203c8357b44a5fca58acef2d54b07b0 (tree c5a82d048041b158bff8dcbdf6ecd3cce07ac767). Both fresh transition-integrity findings are fixed with focused regressions; local replay passes 50/50 tests plus the TypeScript build. The PR intentionally remains Draft, and all earlier-head evidence is stale. @codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b7c33e1332

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[safal207]

Exact-head follow-up published at 3b22fce39d81ab722e6d0b393f2d71273f2a5d57 (tree 9b08a30fecdab61570cb834e43390d1b2873cda9). The three fresh findings are addressed with regressions for retry-evidence binding, staged authorization epochs, and restored response remediation. Local validation: 53/53 tests, TypeScript build, and git diff --check pass. PR remains draft while exact-head hosted checks and review run.

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3b22fce39d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[safal207]

Exact-head follow-up published at 0bf7ef8c4d982e83949852ed87fff9f3a861ca69 (tree 34027c7384ded6380394573b739899fcb67b1a08). Fresh blocked observations now consume staged clearance. Local validation: 54/54 tests, TypeScript build, and git diff --check pass. PR remains Draft pending exact-head hosted checks and fresh review.

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0bf7ef8c4d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[safal207]

@codex review

Exact head: f3aab934b0f64b899a03693844b666a14a8e4be0.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f3aab934b0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[safal207]

@codex review

Please review exact head 2586d4ddc9d563d346c31e393dc5a38ba538fb74 (tree e17027a5945c425bd8e511f8bce0b035ec5c5558). Local build, 59/59 tests, and both compiled demos pass. This follow-up binds VALID authority and initial errors to immutable evidence and makes non-valid causal references permanently non-permissive. PR remains Draft.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2586d4ddc9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[safal207]

@codex review

Please review exact head 71164c7bdf53d940d410e1120b5f858ac36598ef (tree 4179823cec7261b99877ee7ebb381e60cc8a8dcc). Focus on mandatory evidence for permissive VALID/VERIFIED states and permanent rejection of response refs previously classified FAILED/PARTIAL. Full package replay: 62/62; build and compiled demos pass. Keep Draft.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 71164c7bdf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".