[NanaseInori]

Summary

When official Google AI Studio Gemini 3 returns thought signatures with tool calls, the Chat adapter previously discarded the private metadata needed for the next request. Preserve the recognized complete signatures at their original assistant-message and tool-call positions through parallel and sequential tools, retries, private persistence and SQLite reopen. Bind replay to the provider, route model, actual mapped wire model, endpoint/runtime, native response identity and accepted ordered tool batch. Public text, events, ordinary JSON and diagnostics exclude private signatures.

Scope is the official HTTPS generativelanguage.googleapis.com endpoint, using /v1beta/openai or its full Chat endpoint, with no port or 443 and the constructor's existing whitespace/trailing-slash normalization. Actual mapped wire models must be in the Gemini 3 family. A provider display name, proxy/Vertex endpoint or google/ wire-model prefix does not establish this scope. Generic Chat assembly, termination, usage and valid upstream model acceptance remain unchanged.

The scoped Registry freezes a three-call/two-synthetic-tool qualification plan within the existing 30-second deadline, 256 tokens per call and stream bounds. Both round instructions are present from the original request; continuations contain assistant replay and paired tool results. Old one-round qualification bindings cannot certify sequential signatures. Other providers retain their existing probe and binding.

This is stacked on Draft PR #228 and targets codex/lane-b-213-anthropic-thinking-01a0f0c2 at reviewed fa33f3be532b6878cf4a803d41c9abf4b0d8476f. The own increment is 12 files, 1790 additions and 51 deletions. A normal merge imported only #228's six reviewed test files; neither shared history nor the Anthropic implementation was rewritten.

Fixes #219.

Supported boundary and limitations

• Only extra_content.google.thought_signature is retained, separately for the assistant message and each original tool position. Identical repeated complete values are idempotent; conflicting complete values fail closed. Signature-string fragments are not concatenated.
• The first parallel call of each current-turn step must be signed; other calls may be unsigned. Preserve every sequential step's state and complete each tool batch before another message.
• Enforce 256 KiB per signature, 1 MiB aggregate signatures per response and outbound replay history, and the existing 1 MiB private-envelope bound. Unknown extension siblings are inert and are never forwarded.
• Store uses strict numeric private replay v3. Responses v1 and Anthropic v2 remain readable; unknown versions and transport mismatches fail closed. No old rows are rewritten and no reader is retired. Rollback to a binary without v3 support requires a matching pre-v3 database backup while retaining the current private evidence.
• Optional final text-only signatures are validated when recognized but are not persisted across later ordinary user turns by the tool-round Store. This PR does not claim complete cross-turn text-signature history.
• Deterministic local fixtures establish the supported paths. No paid-provider request, online qualification or live acceptance test was performed. Gemini 2.5, Vertex, proxies and other compatible suppliers gain no claimed support.

Validation

Parent personally reviewed the complete own increment and merge/evidence proof at exact HEAD 4c8f8abf69759513ebf630dcadffa0b419d5fd68, tree d577daa3c74bf18127eb5af18e36cea56c620a91. Supplemental Astra/xhigh review confirmed the metadata-first schema correction and reported no remaining blockers; that review does not replace parent review.

• Complete repository Go suite — CI 36940980860 passed the full non-Store suite and all eight Store shards against the reviewed tree.
• go vet ./... — passed in CI 36940980860 against the reviewed tree.
• Exact-HEAD complete llm/modelregistry ordinary tests: 679 pass records including subtests, zero failures.
• Exact-HEAD complete llm/modelregistry race tests: 679 pass records including subtests, zero failures.
• Exact-HEAD focused Store/application replay, timeout, caller Stop and tool-authority race checks: 24 pass records, zero failures.
• Exact-HEAD protocol registry unit tests: 15 pass records; CLI compiled and both baseline checks passed against reviewed fix(llm): preserve Anthropic thinking state across tool continuations #228 and main e82d91b0.
• Focused vet passed for llm/modelregistry/store/application; whitespace check passed.
• Real local HTTP/SSE fixtures check two signed tool rounds, native IDs, retry, malformed metadata, provenance drift, privacy and bounded history; Store fixtures check private-insert rollback/retry, lease fencing and close/reopen.
• All other 35 governance families, top-level registry entries and generated document sections are byte-identical to reviewed fix(llm): preserve Anthropic thinking state across tool continuations #228. Only the control-plane-ledgers v3 writer/reader and retention/rollback guidance changed.

Exact-source CI 36940980860 completed successfully: all 19 jobs passed, including full Go tests, authority-fencing race checks, vet, protocol/Surface checks, Windows/macOS Desktop, TypeScript, Rust, real Edge and LSP gates. GitHub tested merge commit 8b0ebcf4dbb8bd134889321f9b18d8397bc54a05 (parents fa33f3be and 4c8f8abf); its tree is exactly the reviewed HEAD's d577daa3c74bf18127eb5af18e36cea56c620a91.

Desktop release 36940980859 completed with a failure: 3 jobs passed, Windows dual-product candidate failed, and attestation/publication were skipped. The failed step was Exercise packaged Standard Code bootstrap, diagnostic sentinel_evidence_unreadable, phase sentinel_non_persistence. Its sanitized artifact confirms package provenance, reproducibility, start/close/reopen and repository immutability passed first; the 40-case attack matrix remains unexecuted. The underlying path/exception is redacted, so the root cause and any relationship to provider replay remain unestablished. Packaged-bootstrap script and internal/producte2e are unchanged from the PR base. No rerun, waiver or merge was requested.

Own-increment SHA-256: 8b1c1599999bd8238ad59bdd019e2ddbb582ad429f9db66d20772d871b3344bf.

Surface governance

• No Surface is added, promoted, downgraded, deprecated, or removed.

• If the checkbox above is not applicable, every declaration below is complete and the surface registry plus its generated inventory are included.

• Registry item(s): N/A — no Surface change.

• Target tier / transition: N/A — no Surface change.

• Entry criteria / decision: N/A — no Surface change.

• Owner: N/A — no Surface change.

• Shared Go Application contract: N/A — no Surface change.

• Authority impact: N/A — no Surface change.

• Supported platforms: N/A — no Surface change.

• Release / test evidence: N/A — no Surface change.

• Compatibility strategy: N/A — no Surface change.

• Deprecation window: N/A — no Surface change.

• Removal / rollback plan: N/A — no Surface change.

Audit

• No credentials or local runtime data are included.
• Replay grants no tool/network/credential authority and does not redispatch completed tools.
• Provider/operator documentation and generated protocol governance describe the supported scope, private data retention, qualification bounds and rollback.
• Existing v1/v2 readers and tests remain retained.

Draft only. Central CI passed; Desktop release and its full packaged security matrix remain blocked as described above. #228's separate Windows packaged sentinel_evidence_unreadable failure also remains unresolved. No gate is waived. OpenCodeReview remains held by the parent's latest instruction.