Update the debug workflow to provide raw LLM output

internal/core/workspace/identity.go

@@ -125,7 +125,15 @@ func (i CheckpointIdentity) RelativePath() (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("checkpoint identity pipeline digest: %w", err)
 	}
-	return filepath.ToSlash(filepath.Join(pipelineID, inputKey+"-"+sourceComponent, pipelineComponent)), nil
+	identityDigest := digestPrefix(i.Digest)
+	if identityDigest == "" {
+		return "", fmt.Errorf("checkpoint identity digest prefix must not be empty")
+	}
+	identityComponent, err := safePathComponent(identityDigest)
+	if err != nil {
+		return "", fmt.Errorf("checkpoint identity digest: %w", err)
+	}
+	return filepath.ToSlash(filepath.Join(pipelineID, inputKey+"-"+sourceComponent, pipelineComponent, identityComponent)), nil
 }
 
 func identityDigest(identity CheckpointIdentity) (string, error) {

internal/core/workspace/identity_test.go

@@ -118,7 +118,9 @@ func TestCheckpointIdentityPathIsFilesystemSafe(t *testing.T) {
 	if strings.Contains(relative, `\`) || strings.Contains(relative, "..") {
 		t.Fatalf("relative path is not filesystem safe: %q", relative)
 	}
-	if relative != "campaign~2fmain/seriatim~2finput-abcdef0123456789/1234567890abcdef" {
+	identityDigest := digestPrefix(identity.Digest)
+	wantRelative := "campaign~2fmain/seriatim~2finput-abcdef0123456789/1234567890abcdef/" + identityDigest
+	if relative != wantRelative {
 		t.Fatalf("relative path = %q", relative)
 	}
 
@@ -131,12 +133,34 @@ func TestCheckpointIdentityPathIsFilesystemSafe(t *testing.T) {
 	if err != nil {
 		t.Fatalf("CheckpointDirectory: %v", err)
 	}
-	want := filepath.Join(root, "checkpoints", "campaign~2fmain", "seriatim~2finput-abcdef0123456789", "1234567890abcdef")
+	want := filepath.Join(root, "checkpoints", "campaign~2fmain", "seriatim~2finput-abcdef0123456789", "1234567890abcdef", identityDigest)
 	if got != want {
 		t.Fatalf("checkpoint directory = %q, want %q", got, want)
 	}
 }
 
+func TestCheckpointIdentityPathIncludesInvocationIdentity(t *testing.T) {
+	base := mustIdentity(t, identityInput())
+	changedInput := identityInput()
+	changedInput.References[0].Digest = "sha256:reference-b"
+	changed := mustIdentity(t, changedInput)
+
+	if base.Digest == changed.Digest {
+		t.Fatalf("test setup produced same identity digest: %q", base.Digest)
+	}
+	basePath, err := base.RelativePath()
+	if err != nil {
+		t.Fatalf("base RelativePath: %v", err)
+	}
+	changedPath, err := changed.RelativePath()
+	if err != nil {
+		t.Fatalf("changed RelativePath: %v", err)
+	}
+	if basePath == changedPath {
+		t.Fatalf("relative path did not change with invocation identity: %q", basePath)
+	}
+}
+
 func TestCheckpointDirectoryDisabledReturnsEmptyPath(t *testing.T) {
 	settings := Settings{CheckpointsRoot: filepath.Join(t.TempDir(), "checkpoints")}
 	got, err := settings.CheckpointDirectory(mustIdentity(t, identityInput()))