fix(proxy): align signed-thinking wire accounting

[JerrettDavis]

Description

Signed-thinking histories force byte-faithful passthrough because re-serializing signed Anthropic blocks can invalidate their signatures. Headroom correctly forwarded the original client bytes, but continued reporting mutations, transforms, savings, response headers, and prefix state from a different body that never reached the provider. Separately, the final Anthropic guard hoisted every role: system message into the top-level prompt, including valid mid-conversation system sections, changing their semantics and destroying the cached prefix if that mutation ever shipped.

This coupled fix makes downstream accounting use the actual wire body whenever the signed-thinking lock discards edits, and narrows system relocation to the current Anthropic model and placement contract.

Closes #2990
Closes #2991

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Performance improvement
• Code refactoring (no functional changes)

Changes Made

• Detects signed thinking in the original request as well as the mutated body, so a transform cannot remove the block and accidentally bypass the byte lock.
• Keeps the original-body signature probe best-effort under malformed, recursive, and MemoryError conditions.
• Carries discarded mutation reasons through the streaming forwarder and emits the existing structured warning on HTTP streaming paths too.
• When signed passthrough wins, resets message savings, tool-schema savings, attribution ledgers, transform labels, response headers, and prefix tracking to the original client wire body.
• Adds bounded public diagnostic tags naming/counting discarded mutation reasons without exposing body content.
• Preserves valid mid-conversation system sections on currently supported Claude models and official Anthropic, Bedrock, and parsed *.googleapis.com routes; hostname-boundary validation rejects lookalike and userinfo URLs.
• Preserves consecutive system sections and enforces documented predecessor/successor placement rules.
• Continues relocating initial, invalidly placed, unsupported-model, and conservative third-party-gateway system messages to avoid upstream 400s.
• Includes current main, including fix(ci): prevent native detector from hanging test shards #2996, fix(proxy): complete stateless Responses and buffered CCR lifecycle #2997, fix: tool_search_tool_regex deferred and falsely resolved on direct-Anthropic path #2971, ci: allow Dependabot deps commits #3009, ci: allow generated dependency commit bodies #3012, and the MCP dependency cap.

Testing

• Unit tests pass (pytest)
• Linting passes (ruff check .)
• Type checking passes (mypy headroom)
• New tests added for new functionality
• Manual testing performed

Test Output

uv run pytest -q <wire/cache/savings/system focused suite>
379 passed

uv run pytest -q tests/test_proxy/test_anthropic_recount_and_reparse_safety.py tests/test_proxy_byte_faithful_forwarding.py tests/test_proxy_handler_helpers.py
99 passed

pytest tests scripts/tests --splits 4 --group N --tb=short -q
All four CI-shaped fresh-process groups passed locally after correcting the MemoryError regression; each completed in roughly 75-83 seconds.

Post-CodeQL correction: 91 focused tests passed; all four exact-head CI-shaped shards passed in roughly 82-95 seconds.

uv run ruff format --check .
1411 files already formatted
uv run ruff check .
All checks passed
uv run mypy headroom
Success: no issues found in 520 source files

Real Behavior Proof

• Environment: macOS arm64, Python 3.13, branch rebased onto current main.
• Exact command / steps: sent a signed-thinking request whose tool schema is measurably compacted inside the handler, captured the exact upstream bytes, wrapped the real outcome funnel, and inspected response headers, aggregate metrics, attribution tags, transforms, and prefix-tracker state. Exercised valid, consecutive, invalid, initial, supported-model, and unsupported-model system placements.
• Observed result: upstream bytes remain byte-identical to the client; discarded edits contribute zero tokens, zero tool savings, no transform header, and no attribution while the prefix tracker stores the actual wire messages. Valid mid-conversation system sections remain in place; only out-of-contract sections relocate.
• Not tested: live paid Anthropic traffic with production credentials. The placement/model contract was verified against the current official documentation and wire behavior is covered with a byte-capturing transport.

Runtime Rollout Safety

• Rollout-managed feature(s): signed-thinking wire-truth accounting and Anthropic mid-conversation system preservation.
• Minimum rollout channel: normal patch release after exact-head CI is entirely green.
• Stable/default behavior changed: discarded mutations no longer inflate savings; supported valid system sections are no longer hoisted into the top-level prompt.
• Kill switch / disable path: no unsafe runtime override; human revert restores the previous conservative relocation/accounting behavior.
• Unsafe override required: none.
• Qualification impact: all Python shards, byte-forwarding, cache-prefix, outcome/savings, signed-thinking, Anthropic handler, static, Docker, and security checks must remain green.
• Rollback path: fix forward through a human-reviewed corrective PR; no persisted data or configuration migration is involved.

Review Readiness

• I have performed a self-review
• This PR is ready for human review

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation — inline wire-contract documentation; no separate guide is required
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I did not edit CHANGELOG.md — it is generated by release-please from my Conventional Commit PR title (a CI guard enforces this)

Screenshots (if applicable)

Not applicable; proxy wire behavior and accounting only.

Additional Notes

Human review only. No merge or auto-merge is configured. Current provider contract reference: https://platform.claude.com/docs/en/build-with-claude/mid-conversation-system-messages

[github-actions]

PR governance

This PR follows the template and is marked ready for human review.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 44.87179% with 43 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
headroom/proxy/handlers/anthropic.py	5.88%	31 Missing and 1 partial ⚠️
headroom/proxy/helpers.py	80.64%	5 Missing and 1 partial ⚠️
headroom/proxy/body_forwarding.py	50.00%	3 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!