Write workspace checkpoints during runs

internal/cli/run.go

@@ -2,6 +2,8 @@ package cli
 
 import (
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
 	"flag"
 	"fmt"
@@ -17,6 +19,7 @@ import (
 	"gitea.maximumdirect.net/eric/notarius/internal/core/config"
 	"gitea.maximumdirect.net/eric/notarius/internal/core/diagnostics"
 	"gitea.maximumdirect.net/eric/notarius/internal/core/workspace"
+	"gitea.maximumdirect.net/eric/notarius/internal/framework/checkpoint"
 	"gitea.maximumdirect.net/eric/notarius/internal/framework/contracts"
 	"gitea.maximumdirect.net/eric/notarius/internal/framework/pipeline"
 )
@@ -253,6 +256,10 @@ func runPipelineCommand(args []string, stdout, stderr io.Writer, opts Options) i
 	if err != nil {
 		return failPipelineCommand(stderr, runDir, cfg.Diagnostics.Retention, fmt.Errorf("create LLM client for profile %q: %w", factoryProfileID, err))
 	}
+	checkpointRecorder, err := checkpointRecorderForRun(workspaceSettings, effective.ResolvedPipeline, rawInput, only, llmProfiles, strings.TrimSpace(*llmProfile), strings.TrimSpace(sessionID.value))
+	if err != nil {
+		return failPipelineCommand(stderr, runDir, cfg.Diagnostics.Retention, err)
+	}
 
 	output, err := pipeline.New(registries).Run(ctx, pipeline.RunInput{
 		Pipeline:    effective.ResolvedPipeline,
@@ -265,6 +272,7 @@ func runPipelineCommand(args []string, stdout, stderr io.Writer, opts Options) i
 		LLMProfiles: llmProfiles,
 		Metadata:    runMetadata(*outputDir, *diagnosticsDir),
 		Warnings:    referenceWarnings,
+		Checkpoints: checkpointRecorder,
 	})
 	if err != nil {
 		if output.Manifest.PipelineID != "" && runDir != nil {
@@ -348,6 +356,68 @@ func writeDiagnostics(runDir *diagnostics.RunDirectory, write func() error) erro
 	return write()
 }
 
+func checkpointRecorderForRun(
+	settings workspace.Settings,
+	resolved pipeline.ResolvedPipeline,
+	rawInput []byte,
+	only []string,
+	llmProfiles []artifacts.LLMProfileManifest,
+	llmProfileOverride string,
+	sessionID string,
+) (pipeline.CheckpointRecorder, error) {
+	identity, err := workspace.NewCheckpointIdentity(workspace.CheckpointIdentityInput{
+		Pipeline:               resolved,
+		InputKey:               resolved.Input.Module,
+		RawInputDigest:         rawInputDigest(rawInput),
+		SelectedLanes:          only,
+		RuntimeOverrides:       runtimeOverrideFingerprints(llmProfileOverride, sessionID),
+		References:             pipeline.ReferenceProvenance(resolved),
+		ProvenanceFingerprints: llmProfileFingerprints(llmProfiles),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("create checkpoint identity: %w", err)
+	}
+	recorder, err := checkpoint.NewWorkspaceRecorder(settings, identity)
+	if err != nil {
+		return nil, fmt.Errorf("create checkpoint recorder: %w", err)
+	}
+	return recorder, nil
+}
+
+func rawInputDigest(data []byte) string {
+	sum := sha256.Sum256(data)
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+func runtimeOverrideFingerprints(llmProfileOverride string, sessionID string) []workspace.Fingerprint {
+	var values []workspace.Fingerprint
+	if strings.TrimSpace(llmProfileOverride) != "" {
+		values = append(values, workspace.Fingerprint{Name: "llm_profile_override", Value: strings.TrimSpace(llmProfileOverride)})
+	}
+	if strings.TrimSpace(sessionID) != "" {
+		values = append(values, workspace.Fingerprint{Name: "session_id", Value: strings.TrimSpace(sessionID)})
+	}
+	return values
+}
+
+func llmProfileFingerprints(profiles []artifacts.LLMProfileManifest) []workspace.Fingerprint {
+	if len(profiles) == 0 {
+		return nil
+	}
+	values := make([]workspace.Fingerprint, 0, len(profiles))
+	for _, profile := range profiles {
+		id := strings.TrimSpace(profile.ID)
+		if id == "" {
+			continue
+		}
+		values = append(values, workspace.Fingerprint{
+			Name:  "llm_profile:" + id,
+			Value: strings.TrimSpace(profile.Provider) + ":" + strings.TrimSpace(profile.Model),
+		})
+	}
+	return values
+}
+
 func configSource(configPath string) string {
 	if strings.TrimSpace(configPath) != "" {
 		return "flag"