ZeroClaw protects Anthropic signed reasoning from seam sanitizers

ZeroClaw contributors submitted PR #10953 on September 18, 2026, fixing a critical failure in Anthropic model turns caused by multimodal seam sanitizers. In previous revisions, sanitize_image_markers and sanitize_audio_markers performed regex replacements across entire assistant history message strings. Because native tool calls wrap content, tool calls, and signed reasoning_content inside a JSON envelope, modifying media markers inside thinking text invalidated Anthropic's cryptographic signature over that thinking block. When a turn hit max iterations and requested a graceful summary, Anthropic rejected the replayed thinking with HTTP 400 errors. PR #10953 introduces rewrite_model_visible_text, restricting sanitization strictly to user-visible content. In parallel, RFC #10526 proposes moving ZeroClaw to an append-only event log.

The facts

- PR #10953 resolves issue #10952 where turns reaching max iterations failed with HTTP 400 turn crashes during Anthropic summary requests. - The fix introduces rewrite_model_visible_text, ensuring that signed reasoning_content and tool_calls remain byte-identical. - Multimodal media placeholders in user-visible content continue to be stripped cleanly without tampering with model signatures. - RFC #10526 outlines an architectural transition from mutable ConversationMessage persistence to immutable append-only event streams. - Merged PR #10618 (September 17, 2026) enhances maintainer tooling by surfacing approval carry-forward candidates for independent Core reviews.

Why it matters

As frontier AI providers implement cryptographic signing over model reasoning blocks to prevent prompt manipulation and reasoning tampering, agent frameworks can no longer treat message history as malleable plain text. Modifying a single character inside a signed thinking block invalidates the payload signature and results in hard API rejection. Frameworks must recognize signature-protected envelopes and isolate preprocessing to genuinely mutable fields, ensuring downstream replayed turns pass strict upstream verification.

Current

Inspected on 2026-09-18. The ZeroClaw stable-channel baseline is v0.8.5 published 2026-09-05T07:31:19Z. The primary source was open (not merged) when captured. Mainline merges, open proposals and packaged releases are distinct availability states; the release baseline does not establish that a proposal has shipped.

Evidence

Primary evidence: zeroclaw-labs/zeroclaw PR #10953 (https://github.com/zeroclaw-labs/zeroclaw/pull/10953). Supporting context: zeroclaw-labs/zeroclaw issue #10952 (https://github.com/zeroclaw-labs/zeroclaw/issues/10952); zeroclaw-labs/zeroclaw issue #10526 (https://github.com/zeroclaw-labs/zeroclaw/issues/10526). The source bodies and linked context were inspected. Test results quoted from contributors remain attributed reports, not independently reproduced experiments.

Operator take

Cryptographically signed thinking blocks introduce immutable invariants into agent architectures. This bug in ZeroClaw is an early warning for the entire agent ecosystem: sanitizers, formatters, and token compressors must be updated to treat reasoning envelopes as read-only cryptographic artifacts. Framework maintainers must architect data pipelines that distinguish mutable presentation layers from immutable execution proofs.

Caveat

The fix preserves signed reasoning for compliant assistant envelopes, but non-standard tool outputs that embed signed tokens in raw content fields could still require specialized handling. RFC #10526 is in proposal phase and does not alter current storage formats. Older sessions stored with corrupted thinking signatures will still fail replay until refreshed.