Here-doc separators were previously derived from an HMAC of the workflow frontmatter hash, causing all separators to change whenever any unrelated frontmatter changed. Separators now hash the content they wrap (SHA-256), so they change only when their own content changes — reducing diff noise and merge conflicts.

Core change

New function in strings.go:

// GenerateHeredocDelimiterFromContent derives a stable delimiter from SHA-256(UPPER(name) || content).
// The name prefix ensures two heredocs wrapping identical content still produce distinct delimiters.
func GenerateHeredocDelimiterFromContent(name string, content string) string {
    h := sha256.New()
    h.Write([]byte(strings.ToUpper(name)))
    h.Write([]byte(content))
    tag := hex.EncodeToString(h.Sum(nil)[:8])
    ...
}

Output format (GH_AW_<NAME>_<16hex>_EOF) is unchanged, so all existing validation and normalization code works as-is.

Call site changes

• mcp_renderer.go, mcp_setup_generator.go, codex_mcp.go (custom config) — content variable was already in scope; one-line swap.
• compiler_safe_outputs_job.go — reordered to generate scriptContent before the delimiter; removed now-unused frontmatterHash parameter from buildCustomScriptFilesStep.
• codex_mcp.go (MCP_CONFIG, shell policy) — content was built incrementally; refactored to accumulate into a strings.Builder, hash, then write to YAML output.
• unified_prompt_step.go — hashes the concatenation of all built-in section content and user prompt chunks, which is the stable compile-time representation of the prompt.

Tests

Six new unit tests covering stability, content-sensitivity, name disambiguation, empty inputs, and case normalisation. Golden fixtures updated to reflect the new stable delimiter values (e.g. GH_AW_PROMPT_2db13b3f20a79b91_EOF).

GenerateHeredocDelimiterFromSeed is retained for backward compatibility.