feat(agent-loop): content-digest plumbing for output-aware progress (PR2)

[serrrfirat]

Stacked on #4993 (PR1). Review against the base branch firat/elastic-driscoll-86596f so the diff shows only this change; retarget to main once #4993 merges.

What

PR2 of the no-progress redesign. This is inert plumbing: it adds a ContentDigest of each completed capability output so a later change (PR3) can treat "the output moved" as real progress. This PR does not change any detection/stop behavior.

• ContentDigest newtype (keyed-BLAKE3, low-8-bytes-LE — mirrors ArgsHash) in ironclaw_turns::run_profile::content_digest. normalize_for_hash is moved there and re-exported from agent_loop::strategies::progress, so CapabilityCallSignature hashing is byte-for-byte unchanged (no checkpoint-signature break).
• output_digest: Option<ContentDigest> on CapabilityResultMessage, #[serde(default)] (None = back-compat). Computed host-side in the single write_capability_result chokepoint alongside byte_len. Best-effort: a digest-compute failure degrades to None and never fails an otherwise-successful capability write.
• seen_capability_output_digests: BoundedRing<_, 64> on LoopExecutionState, populated at append_completed_capability_result but not consumed. Additive #[serde(default)] checkpoint field — legacy checkpoints decode to an empty ring (round-trip + legacy-decode tests added).
• Inertness is the invariant: record_result still receives the host's progress unchanged. An executor-level test asserts repeated identical-output completed calls do not newly trip no-progress.

Review fixes folded in (multi-agent review)

• from_output is fail-open (digest failure → None, never fails the write).
• A caller-level test drives a real run and asserts the digest lands in the ring (so the one production wiring line can't silently regress while inert).
• Boundary note documents why the digest impl lives in ironclaw_turns.

Roadmap

• PR1 (fix(agent-loop): no-progress stop fails honestly instead of faking completion #4993): no-progress stop fails honestly instead of faking completion.
• PR2 (this): content-digest plumbing (inert).
• PR3: consume the digest (NoChange when output repeats) + take failures off the no-progress axis. Benchmark-gated at PR3.

Validation

Local gate was run partially under heavy machine load: cargo fmt clean; full-workspace --all-targets build was at 0 errors (compiling final binaries) when stopped to free the machine. Deferring the authoritative clippy --all-features + test gate to CI — please watch CI before merge.

🤖 Generated with Claude Code

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[railway-app]

🚅 Deployed to the ironclaw-pr-5000 environment in ironclaw-ci-preview

Service	Status	Web	Updated (UTC)
ironclaw	✅ Success (View Logs)	Web	Jun 17, 2026 at 10:17 pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 7d0c3ab6-4f3a-4a73-9717-4981bedce4ca

📥 Commits

Reviewing files that changed from the base of the PR and between 0606bf7 and 19a4d81.

📒 Files selected for processing (1)

• crates/ironclaw_reborn/tests/loop_driver_host.rs

---

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Added deterministic output_digest support for capability results (with output normalization for UUIDs, timestamps, and correlation keys).
  • Executor now records observed output digests into checkpointed run state.

• Refactor

  • Updated capability result writing to return richer metadata, including an optional output digest.
  • Rewired hashing/normalization to use the shared digest utilities.

• Tests

  • Updated fixtures/middleware/test harnesses for the new output_digest field.
  • Added coverage for checkpoint round-trips, backward-compatible decoding, digest recording, and repeated-identical digest behavior.

Walkthrough

Adds a ContentDigest newtype (Blake3/JCS, 8-byte truncated u64) computed from normalized JSON capability output. The digest is threaded through a new CapabilityWriteResult struct that replaces the (LoopResultRef, u64) tuple return of LoopCapabilityResultWriter::write_capability_result. Completed capability results carrying a digest are recorded as CapabilityOutputObservation entries in a new seen_capability_output_digests: BoundedRing<_, 64> field on LoopExecutionState. The local normalize_for_hash implementation is consolidated into ironclaw_turns::run_profile.

Changes

Capability Output Digest Feature

Layer / File(s)	Summary
ContentDigest type, normalization, and hashing crates/ironclaw_turns/Cargo.toml, crates/ironclaw_turns/src/run_profile/content_digest.rs, crates/ironclaw_turns/src/run_profile/mod.rs	New ContentDigest newtype and ContentDigestError implemented; pipeline is non-finite rejection → normalize_for_hash (UUID/timestamp/correlation-key scrubbing) → JCS canonicalization → Blake3 keyed hash → 8-byte truncation. blake3 and serde_jcs added as dependencies.
CapabilityResultMessage output_digest field crates/ironclaw_turns/src/run_profile/host.rs	Optional output_digest: Option<ContentDigest> added to CapabilityResultMessage with #[serde(default, skip_serializing_if = "Option::is_none")] for backward-compatible checkpoint decode.
normalize_for_hash consolidated into ironclaw_turns crates/ironclaw_agent_loop/src/strategies/progress.rs, crates/ironclaw_agent_loop/src/state/signature.rs	Local normalize_for_hash implementation (169 lines) removed from progress.rs and replaced with pub(crate) use ironclaw_turns::run_profile::normalize_for_hash. signature.rs import updated accordingly.
CapabilityWriteResult struct and trait signature crates/ironclaw_loop_support/src/capability_port.rs, crates/ironclaw_loop_support/src/lib.rs	LoopCapabilityResultWriter::write_capability_result return type changed from (LoopResultRef, u64) to CapabilityWriteResult { result_ref, byte_len, output_digest }. Adds without_output_digest and from_output constructors; from_output degrades to None on digest failure.
CapabilityOutputObservation and LoopExecutionState field crates/ironclaw_agent_loop/src/state/signature.rs, crates/ironclaw_agent_loop/src/state.rs	New CapabilityOutputObservation { signature, output_digest } struct added and re-exported. LoopExecutionState gains seen_capability_output_digests: BoundedRing<CapabilityOutputObservation, 64> with #[serde(default)]. Checkpoint round-trip and legacy-decode tests added.
Executor digest recording crates/ironclaw_agent_loop/src/executor/capabilities.rs	append_completed_capability_result appends CapabilityOutputObservation to seen_capability_output_digests when output_digest is present. Synthesized messages for AwaitDependentRun/SpawnedChildRun paths set output_digest: None.
Test support: ScriptedCapabilityOutcome digest crates/ironclaw_agent_loop/src/test_support/mod.rs	ScriptedCapabilityOutcome::Completed gains output_digest: Option<ContentDigest>. New completed_with_output_digest constructor added. All other completed* helpers set output_digest: None. Translation to CapabilityResultMessage forwards the field.
Production write_capability_result implementations crates/ironclaw_reborn_composition/src/product_live_adapters.rs, crates/ironclaw_reborn_composition/src/runtime/local_dev.rs, .../local_dev/outbound_delivery.rs, .../local_dev/skill_activation.rs, .../production.rs, crates/ironclaw_loop_support/src/subagent_spawn_port.rs	All production LoopCapabilityResultWriter impls updated to return CapabilityWriteResult::from_output(...). SubagentSpawnCapabilityPort::finish_spawn switches from tuple destructuring to struct field access.
Test double and helper implementations crates/ironclaw_loop_support/src/subagent_spawn_port/tests.rs, crates/ironclaw_loop_support/tests/host_capability_port_composition.rs, crates/ironclaw_reborn/tests/loop_driver_host.rs, crates/ironclaw_reborn_composition/tests/product_live_adapters.rs, tests/support/reborn/harness.rs	Test-only LoopCapabilityResultWriter impls (NoopResultWriter, FixedByteResultWriter, InMemoryCapabilityIo, UnusedResultWriter, RecordingCapabilityResultWriter) updated to return CapabilityWriteResult. Uses from_output for JSON capture, without_output_digest for fixed stubs.
Executor and safety net tests for digest recording crates/ironclaw_agent_loop/src/executor/tests.rs, crates/ironclaw_agent_loop/tests/safety_nets.rs, crates/ironclaw_reborn/tests/loop_driver_host.rs	New test completed_output_digest_is_recorded_into_seen_capability_output_digests verifies end-to-end recording in checkpointed state. Safety net test asserts repeated identical digests do not alter progress-stop behavior (model calls = 5, warning prompt = 1). Loop driver test refactored to use tokio::join!.
Test fixture output_digest: None additions (broad) crates/ironclaw_agent_loop/src/executor/..., crates/ironclaw_hooks/..., crates/ironclaw_loop_support/..., crates/ironclaw_product_workflow/..., crates/ironclaw_reborn/..., crates/ironclaw_reborn_composition/..., tests/support/reborn/harness.rs	All test stubs and fixture CapabilityResultMessage literals updated to set output_digest: None (23 executor test fixtures, cancellation, capability_helpers, middleware, loop_support, product_workflow, subagent, reborn, reborn_composition, harness). Import lists reformatted where needed.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Suggested reviewers

• henrypark133

Poem

🔐 Blake3 chews the JSON whole,
UUIDs scrubbed, timestamps scroll,
Eight bytes tucked in a u64,
The ring records what came before.
No phantom progress shall prevail —
The digest guards the replay trail. 🦀

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title follows Conventional Commits style (feat scope: summary) with descriptive, specific content related to output digest plumbing.
Description check	✅ Passed	Author description is comprehensive (objectives, validation status, roadmap, stacked PR note). Template sections unfilled, but substantive inline detail covers required aspects.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}