Module sha 

A compact, dependency-free SHA-256 (FIPS 180-4) — content identity: workflow hashes, skill body hashes, artifact digests. A checkpoint envelope binds the graph it was taken from by sha256(canonical graph JSON); resume refuses a mismatch. Hand-rolled like the cron parser and FNV-1a (the minimalism moat): ~60 lines, byte-oriented, verified against the FIPS/NIST test vectors below. Also backs hmac_sha256 for inbound webhook signature verification (RFC 2104); agentd’s own outbound request signing (RFC 9421) uses ring under aauth.

Functions

ct_eq

Constant-time byte-slice equality (short-circuits on a length mismatch only).

hmac_sha256

HMAC-SHA256 (RFC 2104), hand-rolled over sha256 — for inbound webhook signature verification (GitHub/Stripe-style X-Signature: sha256=…). Kept dependency-free like the rest of the moat; agentd’s own outbound request signing (RFC 9421) uses ring under --features aauth.

sha256

SHA-256 of bytes — the raw 32-byte digest.

sha256_hex

SHA-256 of bytes, lowercase hex.

to_hex

Lowercase hex of a byte slice.