feat: multi-signal checkpoint linkage for resilience across git rewrites

[peyton-alt]

Summary

Store multiple content-based linkage signals in checkpoint metadata so the web can automatically re-link checkpoints after git history rewrites (rebase, reword, amend, filter-branch) without user intervention.

• Add linkage block to CheckpointSummary on entire/checkpoints/v1 with four signals: tree_hash, patch_id, files_changed_hash, session_files_hash
• Allow checkpoint trailers on agent-initiated revert/cherry-pick (when session is ACTIVE)
• Remove per-session TreeHash from CommittedMetadata (superseded by checkpoint-level linkage)

Problem (#834)

When users rewrite git history (git rebase, git rebase -i reword, git filter-branch), the Entire-Checkpoint trailer can be stripped from the commit message. The checkpoint data still exists on entire/checkpoints/v1, but the rewritten commit no longer points to it.

Tree hash alone doesn't survive rebase — rebasing onto a new base changes the full tree snapshot even if the feature's own changes are identical.

How multi-signal linkage fixes this

Each signal captures a different aspect of the commit's identity. The web uses a fallback chain:

Signal	What it hashes	Survives
tree_hash	Full repo snapshot	Reword, amend (msg-only), filter-branch (msg-only)
patch_id	Just the diff content (via git patch-id --stable)	Clean rebase, cherry-pick
files_changed_hash	SHA256 of agent-touched file:blob pairs	Rebase with conflicts in other files
session_files_hash	SHA256 of all session file:blob pairs	Local squash merge

The only case with no match is when the agent's actual code was modified (e.g., conflict resolution in agent-touched files) — which is semantically correct.

What's in this PR (CLI-side)

• LinkageMetadata struct with four fixed-size hash fields (all omitempty for clean JSON)
• ComputePatchID: pipes git diff-tree -p through git patch-id --stable
• ComputeFilesChangedHash: single git ls-tree call, SHA256 of sorted file:blob pairs
• Commit-level linkage computed once per PostCommit via computeBaseLinkage() (cached), with SessionFilesHash added per-session via linkageForSession()
• Written to root-level CheckpointSummary on entire/checkpoints/v1
• Agent-initiated git revert/cherry-pick gets checkpoint trailer when session is ACTIVE (condensation deferred to next normal commit)

What's needed on the web side

• DB migration: add patch_id, files_changed_hash, session_files_hash columns to repo_checkpoints
• Webhook: extend fallback chain beyond tree hash to include patch_id → files_changed_hash → session_files_hash
• Lazy backfill for new signals on existing checkpoints

Testing

Automated

• TestComputePatchID / TestComputePatchID_StableAcrossRebase / TestComputePatchID_InitialCommit
• TestComputeFilesChangedHash / TestComputeFilesChangedHash_StableAcrossRebase
• TestWriteCommitted_IncludesLinkage / TestWriteCommitted_NilLinkageOmitted
• TestShadowStrategy_PostCommit_LinkagePopulated — full pipeline integration test
• TestShadowStrategy_PrepareCommitMsg_AgentRevertGetsTrailer / _UserRevertSkipped
• Full CI passes (unit + integration + E2E canary)

Manual verification (local binary)

Tested with a real Claude Code session against a local repo:

1. Linkage block populated — after a Claude Code commit, the entire/checkpoints/v1 metadata contains the full linkage block:

{
  "linkage": {
    "tree_hash": "d82e8f38e91d7e1efca4993ff7c4023313a55292",
    "patch_id": "e00217d29a078e2bd1e2d16e289a9cdc78c41df7",
    "files_changed_hash": "4c22e14d5ce80bdd2f..."
  }
}

2. Patch ID survives rebase — created a feature branch, committed, rebased onto main with new commits. Patch ID 7a94b75a... was identical before and after rebase, while tree hash changed (expected).

3. Tree hash survives reword — git commit --amend -m "new msg" preserved the tree hash exactly.

Test plan

• Verify linkage block appears in metadata.json on entire/checkpoints/v1 after a commit
• Verify patch ID is stable across a clean rebase (same value before/after)
• Verify tree hash survives reword (amend message only)
• Verify old checkpoints without linkage still work (nil omitted, backward compat)
• Web companion PR: verify fallback chain matches rewritten commits

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Stores a commit’s git tree hash in checkpoint metadata during condensation so the web side can re-link checkpoints after history rewrites that drop the Entire-Checkpoint trailer, and tweaks prepare-commit-msg behavior so agent-driven revert/cherry-pick operations still get checkpoint trailers when a session is active.

Changes:

• Add tree_hash to committed checkpoint metadata (CommittedMetadata, WriteCommittedOptions) and populate it during PostCommit condensation from the HEAD commit’s tree hash.
• Allow prepare-commit-msg to proceed during git sequence operations (revert/cherry-pick/rebase) when an ACTIVE session exists in the current worktree; keep skipping when no active session.
• Add unit tests for tree_hash persistence and the new revert trailer behavior split by agent-active vs user/manual.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
cmd/entire/cli/strategy/manual_commit_test.go	Adds tests ensuring agent revert gets a trailer when session is ACTIVE and user revert is skipped when not active.
cmd/entire/cli/strategy/manual_commit_session.go	Adds helper to detect whether any session in the current worktree is ACTIVE.
cmd/entire/cli/strategy/manual_commit_hooks.go	Adjusts PrepareCommitMsg sequence-operation skip logic; passes commit tree hash into condensation options.
cmd/entire/cli/strategy/manual_commit_condensation.go	Threads treeHash through condensation options into committed checkpoint write options.
cmd/entire/cli/checkpoint/committed.go	Writes TreeHash into per-session committed metadata.json.
cmd/entire/cli/checkpoint/checkpoint.go	Extends checkpoint option/metadata structs to include TreeHash serialized as tree_hash.
cmd/entire/cli/checkpoint/checkpoint_test.go	Adds coverage that tree_hash is written and read back from committed metadata.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR