Module determinism_guard 

Formal, verifiable prompt-cache safety for proxy request rewrites.

A provider can reuse a prompt-cache entry only while its cached prefix stays byte-identical. This module makes that invariant observable: it canonicalizes cache-relevant messages, hashes their frozen prefix, and writes compact audit records for offline verification.

Structs

DeterminismAuditReport

A machine-readable audit summary for lean-ctx audit determinism.

DeterminismGuard

Verifies transformations under one proxy trace id.

DeterminismProof

A cryptographic proof that a provider-cached message prefix was preserved.

Functions

apply_response_headers

Applies the public verification headers to a proxied response.

audit_report

Reads the recent determinism audit records and summarizes cache safety.

cache_relevant_messages

Extracts the fields whose order and content determine prompt-cache reuse.

ensure_response_headers

Adds deterministic defaults for responses that never enter the shared forwarder (health, auth refusals, local APIs, and WebSocket handshakes).

message_hashes

Content hash of each message as the provider caches it (cache_control markers left out), in order. The determinism guard compares these against what a previous turn forwarded (prefix_replay::SentPrefix).

record_audit

Persists a compact, newline-delimited proof record for offline audit.

verify_determinism

Verifies that after leaves the provider-cached prefix of before intact.