Module schema_identity 

The canonical schema identity (cratestack#1065): the whole-IR digest. Binding version 1 bound it into the COSE AAD as schema_sha; binding version 2 binds the per-op contract_sha of crate::client_contract instead (ADR 0006 §4, cratestack#1123), and this digest is now the identity the warn-only x-cratestack-schema-sha drift header carries.

It identifies the schema’s meaning, not its source text. The macros, the CLI generators and every runtime take it from schema_digest, so a comment, a /// doc, an indentation change or a re-ordered declaration cannot make two builds of one contract disagree — a disagreement that signing turns into a 401 at deploy.

The digest is SHA-256(DOMAIN || canonical JSON). The JSON is written by private structs in [nodes] (fields declared in lexicographic order, so the bytes do not depend on serde_json’s preserve_order feature) and every IR node is destructured exhaustively there: a new IR field is a compile error until it is encoded or dropped on purpose, and never leaks into every digest through a #[serde(default)]. What is dropped: source spans, /// docs and the whitespace of attribute text ([attribute_norm]). What is sorted: top-level declarations and model/type/mixin/view fields, by name. What keeps declared order: enum variants (the first is the Default, and Postgres orders an enum by declaration), attributes and arguments. A server-only edit (a policy, an index, a view’s SQL) still changes the digest: the IR is hashed whole. The per-op digests in crate::client_contract are the ones that ignore such edits, which is why the AAD binds them and not this.

Constants

SCHEMA_IDENTITY_DOMAIN

Domain-separation tag, versioned so a change to the canonical form is a deliberate new digest rather than a silent one.

Functions

normalize_attribute_text

Normalises attribute text as described in the module doc.

schema_digest

The canonical identity of schema, as raw SHA-256 bytes.

schema_digest_hex

schema_digest as 64 lowercase hex digits (the SCHEMA_SHA256 string).