Echo Anthropic thinking-block signatures on replay (GH #821) (#823)

Anthropic signs every extended-thinking block and schema-rejects a
replayed block without the signature (400: thinking.signature: Field
required), so the first in-process replay — the tool-use continuation —
failed on every reasoning-on turn that called a tool.

- ContentBlock::Thinking gains optional signature + signatureModel
  fields; both default/skip so legacy session JSON round-trips
  byte-identically (pinned by test).
- rig_stream captures the signature from the complete Reasoning event,
  including through the dirge-zf35 delta fold (replace and append arms),
  never clobbering a captured signature with None.
- The stream factory stamps the minting model onto signed blocks (the
  capture layer does not know the model identity).
- Replay attaches the signature only for the anthropic provider when
  the request's model matches the minting model and reasoning is on
  this turn; otherwise the block is dropped (unsigned or foreign-signed
  blocks are both rejected). Every other provider keeps the unsigned
  echo byte-identical to before.

Author: chrismurrph

src/agent/agent_loop/bridge.rs

@@ -447,7 +447,7 @@ impl EventBridge {
                             .content
                             .iter()
                             .filter_map(|b| match b {
-                                ContentBlock::Thinking { text } => Some(text.as_str()),
+                                ContentBlock::Thinking { text, .. } => Some(text.as_str()),
                                 _ => None,
                             })
                             .collect::<Vec<_>>()

src/agent/agent_loop/bridge_tests.rs

@@ -20,6 +20,8 @@ fn assistant_with_thinking(s: &str) -> AssistantMessage {
     AssistantMessage::new(
         vec![ContentBlock::Thinking {
             text: s.to_string(),
+            signature: None,
+            signature_model: None,
         }],
         StopReason::Stop,
     )
@@ -287,6 +289,8 @@ fn text_and_reasoning_tracked_independently() {
         message: AssistantMessage::new(
             vec![ContentBlock::Thinking {
                 text: "thinking".to_string(),
+                signature: None,
+                signature_model: None,
             }],
             StopReason::Stop,
         ),
@@ -298,6 +302,8 @@ fn text_and_reasoning_tracked_independently() {
             vec![
                 ContentBlock::Thinking {
                     text: "thinking".to_string(),
+                    signature: None,
+                    signature_model: None,
                 },
                 ContentBlock::Text {
                     text: "answer".to_string(),

src/agent/agent_loop/call_syntax.rs

@@ -990,13 +990,15 @@ mod tests {
         let msg = super::super::message::AssistantMessage::new(
             vec![ContentBlock::Thinking {
                 text: thought.to_string(),
+                signature: None,
+                signature_model: None,
             }],
             super::super::message::StopReason::ToolUse,
         );
         let out = absorb_text_calls(&msg, &[call("scav-1", "bash")], &tools(&["bash"]));
         match out.content.as_slice() {
             [
-                ContentBlock::Thinking { text },
+                ContentBlock::Thinking { text, .. },
                 ContentBlock::ToolCall { .. },
             ] => {
                 assert_eq!(text, thought)

src/agent/agent_loop/integration.rs

@@ -278,7 +278,11 @@ pub fn rig_message_to_loop_messages(m: rig::completion::Message) -> Vec<LoopMess
                             })
                             .collect::<Vec<_>>()
                             .join("\n");
-                        blocks.push(ContentBlock::Thinking { text });
+                        blocks.push(ContentBlock::Thinking {
+                            text,
+                            signature: None,
+                            signature_model: None,
+                        });
                     }
                     AssistantContent::Image(_) => {}
                 }

src/agent/agent_loop/message.rs

@@ -58,6 +58,30 @@ pub enum ContentBlock {
     },
     Thinking {
         text: String,
+        /// Provider-issued cryptographic signature over the thinking text
+        /// (GH #821). Anthropic mints one per thinking block and requires
+        /// it echoed back verbatim when the block is replayed — a thinking
+        /// block without it is schema-rejected (`signature: Field
+        /// required`). `None` for providers that don't sign reasoning and
+        /// for blocks captured before this field existed; both serde
+        /// attributes keep the serialized shape byte-identical to the
+        /// legacy `{type, text}` form in that case, so existing saved
+        /// sessions round-trip unchanged.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        signature: Option<String>,
+        /// The model that minted `signature` (GH #821). A signature is
+        /// only valid for the model that produced it — replaying it to a
+        /// different model is rejected (`Invalid signature in thinking
+        /// block`) — and dirge can switch models mid-session (`/model`,
+        /// escalation, subagents), so the replay path attaches the
+        /// signature only when this matches the request's model, and
+        /// drops the block otherwise.
+        #[serde(
+            default,
+            skip_serializing_if = "Option::is_none",
+            rename = "signatureModel"
+        )]
+        signature_model: Option<String>,
     },
     ToolCall {
         id: String,
@@ -778,6 +802,54 @@ impl LoopEvent {
 mod tests {
     use super::*;
 
+    /// GH #821 back-compat pin: `ContentBlock` is serde-serialized into
+    /// session storage, so the `Thinking` variant's new optional
+    /// signature fields must (a) deserialize legacy JSON that has no
+    /// such keys, and (b) serialize back to EXACTLY that legacy shape
+    /// when they are `None` — otherwise every saved session written
+    /// before (or without) the fields breaks on upgrade.
+    #[test]
+    fn legacy_thinking_block_json_round_trips_unchanged() {
+        let legacy = r#"{"type":"thinking","text":"pondering"}"#;
+        let block: ContentBlock = serde_json::from_str(legacy).expect("legacy JSON must parse");
+        assert_eq!(
+            block,
+            ContentBlock::Thinking {
+                text: "pondering".to_string(),
+                signature: None,
+                signature_model: None,
+            }
+        );
+        let reserialized = serde_json::to_string(&block).expect("must serialize");
+        assert_eq!(
+            reserialized, legacy,
+            "None signature fields must be omitted so the wire shape is byte-identical to pre-#821"
+        );
+    }
+
+    /// GH #821: a signed block round-trips both new fields (camelCase
+    /// `signatureModel`, matching the transcript key convention).
+    #[test]
+    fn signed_thinking_block_round_trips_signature_fields() {
+        let block = ContentBlock::Thinking {
+            text: "pondering".to_string(),
+            signature: Some("sig-abc".to_string()),
+            signature_model: Some("claude-opus-4-6".to_string()),
+        };
+        let json = serde_json::to_value(&block).expect("must serialize");
+        assert_eq!(
+            json,
+            serde_json::json!({
+                "type": "thinking",
+                "text": "pondering",
+                "signature": "sig-abc",
+                "signatureModel": "claude-opus-4-6",
+            })
+        );
+        let back: ContentBlock = serde_json::from_value(json).expect("must deserialize");
+        assert_eq!(back, block);
+    }
+
     /// `DeltaPhase::is_content()` is the single source of truth for
     /// "has downstream output already been emitted?" — it gates both
     /// the retry wrapper (`retry.rs`) and the billing-fallback safety

src/agent/agent_loop/rig_stream.rs

@@ -360,7 +360,7 @@ where
                     let over_budget = reasoning_meter.record(&reasoning);
                     match current_thinking_idx {
                         Some(idx) => {
-                            if let Some(ContentBlock::Thinking { text }) =
+                            if let Some(ContentBlock::Thinking { text, .. }) =
                                 partial.content.get_mut(idx)
                             {
                                 text.push_str(&reasoning);
@@ -372,7 +372,11 @@ where
                         }
                         None => {
                             current_thinking_idx = Some(partial.content.len());
-                            partial.content.push(ContentBlock::Thinking { text: reasoning });
+                            partial.content.push(ContentBlock::Thinking {
+                                text: reasoning,
+                                signature: None,
+                                signature_model: None,
+                            });
                             current_text_idx = None;
                             yield StreamEvent::Delta {
                                 partial: partial.clone(),
@@ -420,6 +424,19 @@ where
                         })
                         .collect::<Vec<_>>()
                         .join("\n");
+                    // GH #821: capture the provider-issued signature the
+                    // complete block carries (Anthropic sends it via a
+                    // `signature_delta` that rig folds into the final
+                    // `ReasoningContent::Text`). It must be echoed back
+                    // verbatim when the block is replayed, so dropping it
+                    // here — the old `Text { text, .. }` did — 400s the
+                    // first tool-use continuation with reasoning on.
+                    let signature: Option<String> = r.content.iter().find_map(|c| match c {
+                        rig::completion::message::ReasoningContent::Text {
+                            signature, ..
+                        } => signature.clone(),
+                        _ => None,
+                    });
                     // dirge-zf35: mirror the H-7 ToolCall dedupe. Some
                     // providers stream `ReasoningDelta`s and THEN send a
                     // complete `Reasoning` for the same content. If a
@@ -444,17 +461,32 @@ where
                                 Some(ContentBlock::Thinking { .. })
                             ) =>
                         {
-                            if let Some(ContentBlock::Thinking { text: acc }) =
-                                partial.content.get_mut(idx)
+                            if let Some(ContentBlock::Thinking {
+                                text: acc,
+                                signature: acc_signature,
+                                ..
+                            }) = partial.content.get_mut(idx)
                             {
                                 if acc.is_empty() || text.starts_with(acc.as_str()) {
                                     *acc = text;
                                 } else {
                                     acc.push_str(&text);
                                 }
+                                // GH #821: the fold must carry the signature
+                                // too — in the Anthropic flow the text arrives
+                                // as deltas and the signature ONLY on this
+                                // complete block. Never clobber a previously
+                                // captured signature with `None`.
+                                if signature.is_some() {
+                                    *acc_signature = signature;
+                                }
                             }
                         }
-                        _ => partial.content.push(ContentBlock::Thinking { text }),
+                        _ => partial.content.push(ContentBlock::Thinking {
+                            text,
+                            signature,
+                            signature_model: None,
+                        }),
                     }
                     current_thinking_idx = None;
                     current_text_idx = None;
@@ -1153,7 +1185,7 @@ mod tests {
             .content
             .iter()
             .filter_map(|b| match b {
-                ContentBlock::Thinking { text } => Some(text.clone()),
+                ContentBlock::Thinking { text, .. } => Some(text.clone()),
                 _ => None,
             })
             .collect();
@@ -1207,7 +1239,7 @@ mod tests {
         );
         match events.last().unwrap() {
             StreamEvent::Done { message, .. } => {
-                if let ContentBlock::Thinking { text } = &message.content[0] {
+                if let ContentBlock::Thinking { text, .. } = &message.content[0] {
                     assert_eq!(text, "Let me think about this");
                 } else {
                     panic!("expected thinking");
@@ -1263,7 +1295,7 @@ mod tests {
                     .content
                     .iter()
                     .filter_map(|b| match b {
-                        ContentBlock::Thinking { text } => Some(text),
+                        ContentBlock::Thinking { text, .. } => Some(text),
                         _ => None,
                     })
                     .collect();
@@ -1278,6 +1310,103 @@ mod tests {
         }
     }
 
+    /// GH #821: a complete reasoning block's signature must be captured,
+    /// not discarded — Anthropic requires it echoed back verbatim when
+    /// the block is replayed (the tool-use continuation 400s without it).
+    #[tokio::test]
+    async fn complete_reasoning_signature_is_captured() {
+        let raw = raw_stream(vec![Ok(StreamedAssistantContent::Reasoning(
+            Reasoning::new_with_signature("All thinking", Some("sig-821".to_string())),
+        ))]);
+        let events = drain(wrap_streamed_assistant(raw, None, None)).await;
+        match events.last().unwrap() {
+            StreamEvent::Done { message, .. } => match &message.content[0] {
+                ContentBlock::Thinking {
+                    text, signature, ..
+                } => {
+                    assert_eq!(text, "All thinking");
+                    assert_eq!(signature.as_deref(), Some("sig-821"));
+                }
+                other => panic!("expected thinking, got {other:?}"),
+            },
+            _ => panic!("expected Done last"),
+        }
+    }
+
+    /// GH #821 + dirge-zf35: in the Anthropic flow the text arrives as
+    /// `ReasoningDelta`s and the signature ONLY on the trailing complete
+    /// `Reasoning`. The fold that merges the complete block into the open
+    /// delta-built block must carry the signature onto that block.
+    #[tokio::test]
+    async fn signature_survives_the_delta_fold() {
+        let raw = raw_stream(vec![
+            Ok(StreamedAssistantContent::ReasoningDelta {
+                id: None,
+                reasoning: "Let me think".to_string(),
+            }),
+            Ok(StreamedAssistantContent::ReasoningDelta {
+                id: None,
+                reasoning: " about this".to_string(),
+            }),
+            Ok(StreamedAssistantContent::Reasoning(
+                Reasoning::new_with_signature(
+                    "Let me think about this",
+                    Some("sig-821".to_string()),
+                ),
+            )),
+        ]);
+        let events = drain(wrap_streamed_assistant(raw, None, None)).await;
+        match events.last().unwrap() {
+            StreamEvent::Done { message, .. } => {
+                let blocks: Vec<_> = message
+                    .content
+                    .iter()
+                    .filter_map(|b| match b {
+                        ContentBlock::Thinking {
+                            text, signature, ..
+                        } => Some((text.as_str(), signature.as_deref())),
+                        _ => None,
+                    })
+                    .collect();
+                assert_eq!(
+                    blocks,
+                    vec![("Let me think about this", Some("sig-821"))],
+                    "fold must keep one block AND adopt the complete block's signature"
+                );
+            }
+            _ => panic!("expected Done last"),
+        }
+    }
+
+    /// GH #821, Gemini shape: when the complete `Reasoning` is only the
+    /// trailing chunk (append path of the dirge-zf35 fold), its signature
+    /// must still land on the accumulated block.
+    #[tokio::test]
+    async fn signature_survives_the_append_fold() {
+        let raw = raw_stream(vec![
+            Ok(StreamedAssistantContent::ReasoningDelta {
+                id: None,
+                reasoning: "chunk A".to_string(),
+            }),
+            Ok(StreamedAssistantContent::Reasoning(
+                Reasoning::new_with_signature("chunk Z", Some("sig-tail".to_string())),
+            )),
+        ]);
+        let events = drain(wrap_streamed_assistant(raw, None, None)).await;
+        match events.last().unwrap() {
+            StreamEvent::Done { message, .. } => match &message.content[0] {
+                ContentBlock::Thinking {
+                    text, signature, ..
+                } => {
+                    assert_eq!(text, "chunk Achunk Z");
+                    assert_eq!(signature.as_deref(), Some("sig-tail"));
+                }
+                other => panic!("expected thinking, got {other:?}"),
+            },
+            _ => panic!("expected Done last"),
+        }
+    }
+
     /// Gemini shape: non-signature thought parts stream as
     /// `ReasoningDelta`s, and the complete `Reasoning` event carries
     /// only the FINAL chunk (the thought_signature-bearing part), not
@@ -1305,7 +1434,7 @@ mod tests {
                     .content
                     .iter()
                     .filter_map(|b| match b {
-                        ContentBlock::Thinking { text } => Some(text),
+                        ContentBlock::Thinking { text, .. } => Some(text),
                         _ => None,
                     })
                     .collect();
@@ -1344,7 +1473,7 @@ mod tests {
                     .content
                     .iter()
                     .filter_map(|b| match b {
-                        ContentBlock::Thinking { text } => Some(text),
+                        ContentBlock::Thinking { text, .. } => Some(text),
                         _ => None,
                     })
                     .collect();
@@ -1413,7 +1542,7 @@ mod tests {
             .content
             .iter()
             .filter_map(|b| match b {
-                ContentBlock::Thinking { text } => Some(text.as_str()),
+                ContentBlock::Thinking { text, .. } => Some(text.as_str()),
                 _ => None,
             })
             .collect::<Vec<_>>()
@@ -1835,7 +1964,7 @@ mod tests {
         ));
         assert!(matches!(
             &final_msg.content[1],
-            ContentBlock::Thinking { text } if text == "thinking"
+            ContentBlock::Thinking { text, .. } if text == "thinking"
         ));
         assert!(matches!(
             &final_msg.content[2],