fix(agents): strip stale compaction thinking signatures before Anthropic replay

openperf · sallyom · commit a351e8b848d2 · 2026-06-04T12:53:53.000-07:00
Pre-compaction assistant messages carry thinkingSignature values bound to the original conversation prefix. After compaction the prefix changes (summarized content is replaced by the compaction summary), so Anthropic rejects those signatures with "Invalid signature in thinking block", permanently stalling the session through gateway restarts. stripInvalidThinkingSignatures only catches absent/blank signatures; this adds stripStaleThinkingSignaturesForCompactionReplay (thinking.ts) which identifies pre-compaction assistant messages by timestamp comparison against the latest compaction summary and strips their signature fields. Called in sanitizeSessionHistory (replay-history.ts) before stripInvalidThinkingSignatures for all signed-thinking providers (Anthropic, Bedrock, Vertex). Also fixes buildSuccessorEntries (compaction-successor-transcript.ts) to strip only pre-compaction kept entries when writing the rotation successor JSONL; uses strict < timestamp boundary so same-instant post-compaction messages are not affected. Docs: update transcript-hygiene.md Anthropic and Bedrock sections. Tests: 8 new cases for stripStaleThinkingSignaturesForCompactionReplay; 1 new case for buildSuccessorEntries verifying pre/post-compaction signature boundary. Fixes #90108
diff --git a/docs/reference/transcript-hygiene.md b/docs/reference/transcript-hygiene.md
@@ -150,6 +150,13 @@ inter-session user turns that only have provenance metadata.
 - Turn validation (merge consecutive user turns to satisfy strict alternation).
 - Trailing assistant prefill turns are stripped from outgoing Anthropic Messages
   payloads when thinking is enabled, including Cloudflare AI Gateway routes.
+- Pre-compaction assistant thinking signatures are stripped before provider
+  replay when a session has been compacted. Thinking signatures are
+  cryptographically bound to the conversation prefix at generation time; after
+  compaction the prefix changes (summarized content is replaced by a compaction
+  summary), so replaying the original signatures causes Anthropic to reject the
+  request with "Invalid signature in thinking block". The thinking text is
+  preserved as an unsigned block and is then handled by the rule below.
 - Thinking blocks with missing, empty, or blank replay signatures are stripped
   before provider conversion. If that empties an assistant turn, OpenClaw keeps
   turn shape with non-empty omitted-reasoning text.
@@ -165,6 +172,9 @@ inter-session user turns that only have provenance metadata.
   repaired on disk before load.
 - Assistant stream-error turns that contain only blank text blocks are dropped
   from the in-memory replay copy instead of replaying an invalid blank block.
+- Pre-compaction assistant thinking signatures are stripped before Converse
+  replay when a session has been compacted, for the same reason as Anthropic
+  above.
 - Claude thinking blocks with missing, empty, or blank replay signatures are
   stripped before Converse replay. If that empties an assistant turn, OpenClaw
   keeps turn shape with non-empty omitted-reasoning text.
diff --git a/src/agents/embedded-agent-runner/compaction-successor-transcript.test.ts b/src/agents/embedded-agent-runner/compaction-successor-transcript.test.ts
@@ -33,6 +33,16 @@ function makeAssistant(text: string, timestamp: number) {
   });
 }
 
+function makeThinkingAssistant(text: string, thinkingSignature: string, timestamp: number) {
+  return makeAgentAssistantMessage({
+    content: [
+      { type: "thinking", thinking: "reasoning", thinkingSignature } as never,
+      { type: "text", text },
+    ],
+    timestamp,
+  });
+}
+
 function requireString(value: string | undefined, label: string): string {
   if (!value) {
     throw new Error(`expected ${label}`);
@@ -508,3 +518,71 @@ describe("shouldRotateCompactionTranscript", () => {
     ).toBe(true);
   });
 });
+
+describe("rotateTranscriptAfterCompaction — thinking signature stripping", () => {
+  it("strips thinkingSignature from kept assistant messages in the successor file", async () => {
+    const dir = await createTmpDir();
+    const manager = SessionManager.create(dir, dir);
+
+    const oldUserId = manager.appendMessage({
+      role: "user",
+      content: "old question",
+      timestamp: 1,
+    });
+    manager.appendMessage(makeThinkingAssistant("old answer", "stale_sig_old", 2));
+    const firstKeptId = manager.appendMessage({
+      role: "user",
+      content: "kept question",
+      timestamp: 3,
+    });
+    manager.appendMessage(makeThinkingAssistant("kept answer", "stale_sig_kept", 4));
+    manager.appendCompaction("Summary of old work.", firstKeptId, 3000);
+    manager.appendMessage({ role: "user", content: "post question", timestamp: 5 });
+    manager.appendMessage(makeThinkingAssistant("post answer", "fresh_sig", 6));
+
+    const sessionFile = requireString(manager.getSessionFile(), "source session file");
+    const result = await rotateTranscriptAfterCompaction({
+      sessionManager: manager,
+      sessionFile,
+      now: () => new Date("2026-06-04T00:00:00.000Z"),
+    });
+
+    expect(result.rotated).toBe(true);
+    const successor = SessionManager.open(
+      requireString(result.sessionFile, "successor session file"),
+    );
+
+    const entries = successor.getEntries();
+    function getThinkingSignatureForTimestamp(ts: number): unknown {
+      for (const entry of entries) {
+        if (entry.type !== "message" || entry.message.role !== "assistant") {
+          continue;
+        }
+        if ((entry.message as { timestamp?: number }).timestamp !== ts) {
+          continue;
+        }
+        const content = (entry.message as { content?: unknown[] }).content ?? [];
+        for (const block of content) {
+          if ((block as { type?: unknown }).type === "thinking") {
+            return (block as { thinkingSignature?: unknown }).thinkingSignature;
+          }
+        }
+      }
+      return undefined;
+    }
+
+    // Pre-compaction kept message (timestamp 4): signature stripped
+    expect(getThinkingSignatureForTimestamp(4)).toBeUndefined();
+    // Post-compaction message (timestamp 6): signature preserved intact
+    expect(getThinkingSignatureForTimestamp(6)).toBe("fresh_sig");
+
+    // Old summarized messages should not appear
+    expect(entries.find((e) => e.id === oldUserId)).toBeUndefined();
+
+    // Context should remain coherent: compaction summary + kept + post-compaction
+    const contextText = JSON.stringify(successor.buildSessionContext().messages);
+    expect(contextText).toContain("kept question");
+    expect(contextText).toContain("kept answer");
+    expect(contextText).toContain("post answer");
+  });
+});
diff --git a/src/agents/embedded-agent-runner/compaction-successor-transcript.ts b/src/agents/embedded-agent-runner/compaction-successor-transcript.ts
@@ -8,6 +8,7 @@ import { CURRENT_SESSION_VERSION } from "../../config/sessions/version.js";
 import type { OpenClawConfig } from "../../config/types.openclaw.js";
 import type { CompactionEntry, SessionEntry, SessionHeader } from "../sessions/index.js";
 import { collectDuplicateUserMessageEntryIdsForCompaction } from "./compaction-duplicate-user-messages.js";
+import { stripThinkingSignaturesFromMessage } from "./thinking.js";
 import {
   readTranscriptFileState,
   TranscriptFileState,
@@ -116,15 +117,21 @@ function buildSuccessorEntries(params: {
   const compaction = branch[latestCompactionIndex] as CompactionEntry;
 
   const summarizedBranchIds = new Set<string>();
+  const preCompactionKeptBranchIds = new Set<string>();
+  let foundFirstKept = false;
   for (let index = 0; index < latestCompactionIndex; index += 1) {
     const entry = branch[index];
     if (!entry) {
       continue;
     }
     if (compaction.firstKeptEntryId && entry.id === compaction.firstKeptEntryId) {
-      break;
+      foundFirstKept = true;
+    }
+    if (foundFirstKept) {
+      preCompactionKeptBranchIds.add(entry.id);
+    } else {
+      summarizedBranchIds.add(entry.id);
     }
-    summarizedBranchIds.add(entry.id);
   }
 
   const latestStateEntryIds = collectLatestStateEntryIds(branch.slice(0, latestCompactionIndex));
@@ -174,9 +181,17 @@ function buildSuccessorEntries(params: {
       parentId = entryById.get(parentId)?.parentId ?? null;
     }
 
-    keptEntries.push(
-      parentId === entry.parentId ? entry : ({ ...entry, parentId } as SessionEntry),
-    );
+    const reparented =
+      parentId === entry.parentId ? entry : ({ ...entry, parentId } as SessionEntry);
+    // Strip thinking signatures only from pre-compaction kept entries. Pre-compaction
+    // signatures are bound to the original context prefix; the successor file has a different
+    // prefix so those signatures would cause Anthropic "Invalid signature in thinking block".
+    // Post-compaction entries were generated in the new context and have valid signatures.
+    const transformed =
+      reparented.type === "message" && preCompactionKeptBranchIds.has(reparented.id)
+        ? { ...reparented, message: stripThinkingSignaturesFromMessage(reparented.message) }
+        : reparented;
+    keptEntries.push(transformed);
   }
 
   return orderSuccessorEntries({
diff --git a/src/agents/embedded-agent-runner/replay-history.ts b/src/agents/embedded-agent-runner/replay-history.ts
@@ -55,6 +55,7 @@ import {
   dropThinkingBlocks,
   shouldPreserveLatestAssistantThinking,
   stripInvalidThinkingSignatures,
+  stripStaleThinkingSignaturesForCompactionReplay,
 } from "./thinking.js";
 
 const MODEL_SNAPSHOT_CUSTOM_TYPE = "model-snapshot";
@@ -734,16 +735,25 @@ export async function sanitizeSessionHistory(params: {
   const preserveLatestAssistantThinking =
     params.preserveLatestAssistantThinking ??
     shouldPreserveLatestAssistantThinking(sanitizedImages);
+  // Strip thinking signatures that are stale due to compaction context changes before
+  // stripInvalidThinkingSignatures runs. Pre-compaction kept messages carry signatures
+  // bound to the original prefix; after compaction the prefix changes and Anthropic
+  // rejects them. Timestamp comparison with the latest compaction summary identifies
+  // the affected messages regardless of path (standard or truncateAfterCompaction).
+  const compactionStaleStripped =
+    signedThinkingProvider || policy.preserveSignatures
+      ? stripStaleThinkingSignaturesForCompactionReplay(sanitizedImages)
+      : sanitizedImages;
   // Some recovery paths supply a narrow policy with preserveSignatures disabled.
   // Native signed-thinking providers still cannot replay missing/blank
   // signatures once the assistant turn is no longer latest in the outbound
   // request.
   const validatedThinkingSignatures =
     signedThinkingProvider || policy.preserveSignatures
-      ? stripInvalidThinkingSignatures(sanitizedImages, {
+      ? stripInvalidThinkingSignatures(compactionStaleStripped, {
           preserveLatestAssistant: preserveLatestAssistantThinking,
         })
-      : sanitizedImages;
+      : compactionStaleStripped;
   const droppedReasoning = policy.dropReasoningFromHistory
     ? dropReasoningFromHistory(validatedThinkingSignatures)
     : validatedThinkingSignatures;
diff --git a/src/agents/embedded-agent-runner/thinking.test.ts b/src/agents/embedded-agent-runner/thinking.test.ts
diff --git a/src/agents/embedded-agent-runner/thinking.ts b/src/agents/embedded-agent-runner/thinking.ts
