cleveragents/cleveragents-core

Fork 3

bug(session): session export checksum stored as raw hex — spec requires `sha256:` prefix #1450

New issue

Closed

opened 2026-04-02 18:17:27 +00:00 by freemo · 2 comments

freemo commented

2026-04-02 18:17:27 +00:00

Owner

Summary

Session.as_export_dict() in src/cleveragents/domain/models/core/session.py stores the checksum as a raw SHA-256 hex digest (e.g. "7a9b...42c1"). The specification (§2022, §2078) requires the checksum to be stored with a sha256: prefix (e.g. "sha256:7a9b...42c1").

Spec Reference

§2078 — Session export JSON output:

"integrity": {
  "checksum": "sha256:7a9b...42c1",
  "encrypted": false
}

§2022 — Session export Rich output:

╭─ Integrity ──────────────────╮
│ Checksum: sha256:7a9b...42c1 │
│ Encrypted: no                │
╰──────────────────────────────╯

Current Implementation

# src/cleveragents/domain/models/core/session.py
canonical = json.dumps(export, sort_keys=True, default=str)
export["checksum"] = hashlib.sha256(canonical.encode()).hexdigest()
# Stores: "7a9b3c2d..." (raw hex, no prefix)

Expected Fix

export["checksum"] = "sha256:" + hashlib.sha256(canonical.encode()).hexdigest()
# Stores: "sha256:7a9b3c2d..."

The import_session validation logic must also be updated to strip the sha256: prefix before verifying.

Impact

Import validation will fail if it expects the sha256: prefix
The CLI output panel shows the raw hex without the sha256: prefix, diverging from the spec's display format
Cross-tool interoperability may be affected if other tools expect the prefixed format

Definition of Done

as_export_dict() stores checksum as "sha256:<hex>"
import_session() validates checksum correctly with the prefix
BDD scenarios updated to verify the prefix format
nox -e lint && nox -e typecheck && nox -e unit_tests pass

Metadata

Suggested commit: fix(session): prefix export checksum with sha256: per spec
Suggested branch: bugfix/session-export-checksum-prefix

Automated by CleverAgents Bot
Supervisor: Spec Evolution | Agent: ca-spec-updater

## Summary `Session.as_export_dict()` in `src/cleveragents/domain/models/core/session.py` stores the checksum as a raw SHA-256 hex digest (e.g. `"7a9b...42c1"`). The specification (§2022, §2078) requires the checksum to be stored with a `sha256:` prefix (e.g. `"sha256:7a9b...42c1"`). ## Spec Reference **§2078 — Session export JSON output:** ```json "integrity": { "checksum": "sha256:7a9b...42c1", "encrypted": false } ``` **§2022 — Session export Rich output:** ``` ╭─ Integrity ──────────────────╮ │ Checksum: sha256:7a9b...42c1 │ │ Encrypted: no │ ╰──────────────────────────────╯ ``` ## Current Implementation ```python # src/cleveragents/domain/models/core/session.py canonical = json.dumps(export, sort_keys=True, default=str) export["checksum"] = hashlib.sha256(canonical.encode()).hexdigest() # Stores: "7a9b3c2d..." (raw hex, no prefix) ``` ## Expected Fix ```python export["checksum"] = "sha256:" + hashlib.sha256(canonical.encode()).hexdigest() # Stores: "sha256:7a9b3c2d..." ``` The `import_session` validation logic must also be updated to strip the `sha256:` prefix before verifying. ## Impact - Import validation will fail if it expects the `sha256:` prefix - The CLI output panel shows the raw hex without the `sha256:` prefix, diverging from the spec's display format - Cross-tool interoperability may be affected if other tools expect the prefixed format ## Definition of Done - [ ] `as_export_dict()` stores checksum as `"sha256:<hex>"` - [ ] `import_session()` validates checksum correctly with the prefix - [ ] BDD scenarios updated to verify the prefix format - [ ] `nox -e lint && nox -e typecheck && nox -e unit_tests` pass ## Metadata **Suggested commit:** `fix(session): prefix export checksum with sha256: per spec` **Suggested branch:** `bugfix/session-export-checksum-prefix` --- **Automated by CleverAgents Bot** Supervisor: Spec Evolution | Agent: ca-spec-updater

freemo self-assigned this

2026-04-02 18:45:09 +00:00

freemo added the

labels

2026-04-02 19:12:50 +00:00

freemo referenced this issue

2026-04-02 19:13:09 +00:00

[Automated] Backlog Groomer Session State — v3.7.0 #1463

freemo referenced this issue from a commit

2026-04-02 19:29:06 +00:00

fix(session): session export checksum stored with sha256 prefix per spec #1450

freemo referenced this issue from a pull request that will close it,

2026-04-02 19:29:16 +00:00

fix(session): session export checksum stored with sha256 prefix per spec #1450 #1481

freemo closed this issue

2026-04-02 19:29:51 +00:00

freemo referenced this issue from a commit

2026-04-02 19:29:56 +00:00

fix(session): session export checksum stored with sha256 prefix per spec #1450 (#1481)

freemo referenced this issue

2026-04-02 19:30:02 +00:00

[Automated] Product Build Session State #1458

freemo commented

2026-04-02 19:30:23 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
Priority: Medium (already assigned) — The checksum format deviates from spec. This affects interoperability and import validation.
Milestone: Needs assignment — session export is part of the session management feature set, belongs in v3.5.0.
MoSCoW: Should Have — The spec explicitly requires the sha256: prefix format (§2022, §2078). This is a data format compliance issue that could cause import failures if tools expect the prefixed format. The fix is trivial (one-line change plus import validation update).

Valid bug with a clear, trivial fix. The sha256: prefix is explicitly specified in two separate spec sections.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Issue triaged by project owner: - **State**: Verified - **Priority**: Medium (already assigned) — The checksum format deviates from spec. This affects interoperability and import validation. - **Milestone**: Needs assignment — session export is part of the session management feature set, belongs in v3.5.0. - **MoSCoW**: Should Have — The spec explicitly requires the `sha256:` prefix format (§2022, §2078). This is a data format compliance issue that could cause import failures if tools expect the prefixed format. The fix is trivial (one-line change plus import validation update). Valid bug with a clear, trivial fix. The `sha256:` prefix is explicitly specified in two separate spec sections. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo reopened this issue

2026-04-02 19:31:12 +00:00

freemo referenced this issue from a commit

2026-04-02 20:21:44 +00:00

docs(changelog): add Fixed entries for PRs #1498, #1481, #1479

freemo referenced this issue

2026-04-02 20:48:18 +00:00

fix(v3.7.0): resolve issue #1468 - plan use structured panels #1514

freemo referenced this issue

2026-04-02 20:48:31 +00:00

fix(v3.7.0): resolve issue #1421 #1496

freemo referenced this issue

2026-04-02 20:48:36 +00:00

fix(v3.7.0): resolve issue #1424 #1493

freemo referenced this issue

2026-04-02 20:48:49 +00:00

fix(v3.7.0): resolve issue #1431 #1489

freemo referenced this issue

2026-04-02 20:48:51 +00:00

[Automated] Documentation Writer Session State — ca-docs-writer #1487

freemo referenced this issue

2026-04-02 20:49:00 +00:00

fix(v3.7.0): resolve issue #1426 #1491

freemo referenced this issue

2026-04-02 20:49:03 +00:00

fix(v3.7.0): resolve issue #1422 #1495

freemo referenced this issue

2026-04-02 20:49:19 +00:00

fix(cli): add structured panels to plan cancel output #1473 #1510

freemo referenced this issue

2026-04-02 20:49:20 +00:00

UAT: A2A error codes use string identifiers instead of JSON-RPC 2.0 numeric codes — wire format non-compliant #1426

freemo referenced this issue

2026-04-02 20:49:38 +00:00

UAT: agents plan cancel rich output is a one-liner — missing spec-required structured panels (Plan Cancelled, Sandbox, Child Plans, Recovery) #1473

freemo referenced this issue

2026-04-02 20:49:43 +00:00

fix(v3.7.0): resolve issue #1432 #1488

freemo commented

2026-04-02 20:52:26 +00:00

Author

Owner

Closing as duplicate of #1352.

Both issues describe the same bug: agents session export stores the checksum as raw hex instead of the spec-required sha256:<hash> format. Issue #1352 was filed first (2026-04-02T16:57:29Z) and is the canonical tracking issue.

Please follow #1352 for updates on this bug.

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

Closing as duplicate of #1352. Both issues describe the same bug: `agents session export` stores the checksum as raw hex instead of the spec-required `sha256:<hash>` format. Issue #1352 was filed first (2026-04-02T16:57:29Z) and is the canonical tracking issue. Please follow #1352 for updates on this bug. --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: ca-backlog-groomer

freemo closed this issue

2026-04-02 20:52:31 +00:00

freemo referenced this issue

2026-04-02 20:53:06 +00:00

[Automated] Backlog Groomer Session State — ca-backlog-groomer (freemo) #1533

freemo referenced this issue

2026-04-03 04:08:50 +00:00

fix(typecheck): 5 Pyright errors in session CLI and service — references to non-existent Session.automation_profile, SessionService.list_messages(), and invalid checksum concatenation #2109

freemo referenced this issue

2026-04-03 04:27:58 +00:00

fix(v3.7.0): resolve issue #1422 #1495

freemo referenced this issue