Issue #3526: [Workflow] 内联确定性计算 step（版本化签名算法，免外部 connector 微服务）

[eanz17]

Issue

Closes #3526 — [Workflow] 内联确定性计算 step（版本化签名算法，免外部 connector 微服务）

Implementation summary

See .implement-loop/runs/implement-issue-3526.md.

Stacked-PR position

• Base: feat/2026-08-25_issue-3525 (previous issue's branch)
• Head: feat/2026-08-25_issue-3526
• Auto-loop iteration: implement-loop / milestone Typed Context & Deterministic Computation (v1)

🤖 Generated by codex-implement-loop. Reviewer is a Claude subagent (see PR comments for round-N review reports).

[eanz17]

Review of PR #3537 — round 1

Verdict: pass
Issue: #3526 — [Workflow] 内联确定性计算 step（版本化签名算法，免外部 connector 微服务）
Head: feat/2026-08-25_issue-3526 @ f4c784a96f6c9bb17e581fadbb78432ebce51775
Base: feat/2026-08-25_issue-3525
Reviewed by: Claude subagent (codex-implement-loop)

Verdict rationale (one paragraph)

Three-dot range origin/feat/2026-08-25_issue-3525...origin/feat/2026-08-25_issue-3526 is a single commit on top of merge-base 37569d7ba, 12 production files (well under 30), and does not contain #3525 feature commits. The diff matches the issue’s redirected design: no type: compute primitive, no new engine endpoint, and no second readiness chain. host_callback now has a typed catalog shape (HostCallbackConnectorConfigEntry proto field 9 + StoredHostCallbackConnectorConfig), listing/admission only publish when a live IDeterministicComputeHandler descriptor set-equals the catalog allowlist, contract digest binds host-callback-operation.v1 + algorithm id/version + schema digests, version bump is fail-closed as CONNECTOR_CONTRACT_DRIFT, deterministic builder rejects empty/mismatched AllowedOperations, SHA-256 UTF-8 is a real host algorithm with the NIST "abc" golden vector, annotations carry host_callback.algorithm_version, canon §2.5 / §3.3 / §3.5 is updated, and a reducer-shaped CI guard is wired from architecture_guards.sh. Sample-grep of the diff found none of the listed CLAUDE.md anti-patterns (Task.Delay(, GetAwaiter().GetResult(), TypeUrl.Contains(, JSON actor-state, ID-to-state middle-layer maps, HandleEventAsync(, SubscribeAsync<EventEnvelope>, *WriteActor/*ReadActor splits, new HttpClient(, [Skip] / Manual traits). Residual nits (hardcoded schema-digest literals, duplicated IsSHA256Digest helpers, constructor-level empty allowlist still allow-all) do not break the written acceptance criteria.

Findings

None.

What's good

• No second primitive. Issue boundary “不新增 workflow primitive、不新增 engine endpoint、不建第二套 readiness 语义” is kept. Runtime remains connector_call → existing HostCallbackConnector / ConnectorCallModule (metadata already copied onto WorkflowConnectorAttemptCompletedEvent.Annotations at ConnectorCallModule.cs foreach response.Metadata).
• Typed catalog, not a bag. connector_catalog_messages.proto adds HostCallbackConnectorConfigEntry { handler, allowed_operations, allowed_input_keys } as field 9 on ConnectorDefinitionEntry. Studio records/DTOs/import parser/actor store round-trip the same shape. This follows CLAUDE.md “核心语义强类型…必须建模为 proto field / typed option / typed sub-message，禁止塞入通用 bag” and the issue’s StoredHostCallbackConnectorConfig(Handler, AllowedOperations, AllowedInputKeys).
• Admission fail-closed for host_callback. ConnectorExternalWorkflowCapabilitySource.EnumerateHostCallbackOperations publishes nothing on missing handler, empty allowlist, extra/missing operations, duplicate/invalid signatures. BuildContractDigest host_callback case includes host-callback-operation.v1, handler, algorithm id/version, both schema digests, and Join(AllowedInputKeys); unknown types throw instead of the old weak default digest. Tests cover listing, CONNECTOR_NOT_FOUND / CONNECTOR_DISABLED / CONNECTOR_CONTRACT_DRIFT, catalog/algorithm mismatch, handler-name missing, version-bump inspect drift, and happy-path WorkflowExternalCapabilityAdmissionService.AdmitAsync of YAML copied from the listed tuple.
• Builder closes the empty-allowlist default for deterministic handlers. HostCallbackConnectorBuilder.HasExactDeterministicOperationContract requires non-empty allowlist set-equal to valid descriptors; tests assert empty and mismatched ops fail TryBuild.
• First algorithm + guard. SHA256DeterministicComputeHandler (sha256_utf8 v1) is registered in AddAevatarBootstrap; golden vector "abc" → ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad plus host_callback.algorithm_version=1 on success and schema-invalid failure; tools/ci/deterministic_compute_handler_guard.sh requires ≥1 production IDeterministicComputeHandler with a *Tests.cs class-name reference (same morphology as the non-abstract Reducer guard). Mainnet composition (AddAevatarDefaultHost then AddStudioCapability) puts the handler in the same container as ConnectorExternalWorkflowCapabilitySource.
• Canon. docs/canon/connector.md adds host_callback catalog/admission text, deterministic subset rules, and the transform vs host_callback vs http/cli/mcp vs user-upload decision tree from the issue.
• Stacked-PR pin. docs/contracts/nyxid-assistant-conformance/v1/sources.json only refreshes Aevatar revision to the 3525 HEAD (37569d7ba) for already-pinned files this PR does not otherwise touch. Not a 3525 commit leak.
• CLAUDE.md scan (no hits in this diff): no Task.Delay( in production; no GetAwaiter().GetResult(); no TypeUrl.Contains( routing; no JSON for actor/catalog state (catalog stays protobuf; JSON remains the existing connector payload / catalog-import host boundary); _deterministicHandlersByName is a DI strategy map of registered algorithms, not an “entity/actor/workflow-run/session 等 ID → 上下文/事实状态” registry; no new Metadata field where a proto field was required (version is stamped on the pre-existing connector metadata/annotations path the issue named); no [Skip] / Manual.

Residual (not blocking): InputSchemaDigest / OutputSchemaDigest are committed literals rather than hashes of in-tree canonical JSON Schema documents; IsValidAlgorithmDescriptor / IsSHA256Digest are copy-pasted between HostCallbackConnectorBuilder and ConnectorExternalWorkflowCapabilitySource (CLAUDE.md 编码规范: “出现复制粘贴代码即抽取为方法…不留重复”); HostCallbackConnector.ExecuteAsync still allow-alls when _allowedOperations.Count == 0 if constructed outside the builder. Worth a follow-up, not a miss of #3526’s written ACs.

REVIEW_VERDICT:pass:host_callback catalog+digest+sha256 algorithm meet #3526 ACs

[eanzhao]

Merged into feature/integrate as part of the milestone 45 stack (integration commit adc6cbf10). This PR's head commit is now an ancestor of feature/integrate; GitHub could not auto-close it because its base is still the stacked branch rather than feature/integrate.

The stack was merged as a single update rather than bottom-up, because the intermediate states were broken: #3538 registered MapDelete on the content-artifact pin resource with an inferred request body, which minimal APIs reject for DELETE. Endpoint construction threw and the Mainnet host failed to start, and #3539 did not fix it — so merging bottom-up would have left feature/integrate red in between.

Fixed on the way in (adc6cbf10):

• bound the pin clear body with [FromBody] and added ContentArtifactEndpointsRouteBindingTests — the handler tests called the method directly and never bound the route, so only MainnetHostCompositionTests caught it;
• moved the ContentArtifact read contracts and query port into Aevatar.Studio.Application.Abstractions and dropped the Aevatar.Studio.Application reference [NyxID Chat] Conversation 级类型化结构化档案附件（typed structured context attachment） #3525 added to the NyxidChat agent, restoring LayerDependencyTests.NyxidChat_ShouldOnlyDependOnStudioApplicationAbstractions.

Verification on the merged result: build 0 errors; Architecture/Capabilities/Studio/Bootstrap/AI 7166 passed, 0 failed; architecture_guards.sh and test_stability_guards.sh passed.