pub fn config_digest(settings: &Settings) -> BTreeMap<String, String>Expand description
The digest of the settings that shaped the durable state (RFC 0033 §3.3): section name → SHA-256 hex of that section’s canonical JSON.
Deliberately not the whole document. Only the three sections whose meaning
the stored records depend on are digested — a different intelligence.model
or a new MCP server does not make yesterday’s inbox mean something else, and
including them would make the signal fire on every ordinary edit until an
operator learned to ignore it.
Nothing secret-bearing goes in. store.http.headers and the endpoint URLs
that can carry credentials in userinfo or a query are excluded by
construction (see [store_shape]) — they are auth, not layout, and a digest
of a low-entropy secret is a secret. The hash uses the crate’s dependency-free
SHA-256 (crate::sha::sha256_hex, already the workflow/artifact content
hash), so this adds no dependency and no feature gate.