[Nic-dorman]

Part of the sha-fanout round (V2-1724): the SDK side of the sha256 fields antd 0.17.0 added in #398. Targets main; the daemon and antd-go are already released.

Surface the antd 0.17.0 sha256 fields (V2-1724) through the MCP tools, on
top of the antd-py change that adds them to the result types.

Outputs: store_data, upload_file, finalize_upload and finalize_merkle_upload
return "sha256", the plaintext's SHA-256 in hex. build_manifest and
decode_manifest return it on every entry. Like the sibling fields (sizes,
data_map, error) it is always present and null when unset: a daemon older
than antd 0.17.0, a missing key, or an empty string (gRPC zero value) all
read as null, never "".

Input: build_manifest accepts an optional per-entry "sha256" and passes it to
the SDK exactly as given (no hex, length or case check; the daemon validates
it and a malformed one comes back as BAD_REQUEST with the daemon's
entries[i] message). Like path, data_map and address it must be a string, and
the SDK omits an unset or empty value on the wire. If the installed antd SDK
predates the field, an entry that sets it is refused with BAD_REQUEST rather
than crashing; entries without it still work.

Read defensively: the value is read with getattr(obj, "sha256", None) (new
_fields.sha256_of), because the dependency floor is still antd[rest]>=0.3.0,
whose results have no such attribute. The floor and the package version are
unchanged; bumping the floor to the next antd-py release is the follow-up.
Tool descriptions and the README say "antd 0.17.0 or later". The tool count
stays 31 (CI step unchanged).

Tests: new test_sha256.py (37 tests, 3 of them live) covering all six upload-result tool
paths with sha256 present, None, "" and an SDK object without the attribute,
a real AsyncRestClient over httpx MockTransport for a 0.17.0 and a pre-0.17.0
REST body, manifest build/decode entries, the exact request JSON (sha256 only
when set), the daemon's 400 for "zz", the old-SDK input refusal, and tool
descriptions. Three live tests (decode the fixture link, build with a hash,
build with "zz") are gated on ANTD_TEST_URL and ANTD_TEST_SHA_LINK. Two
existing exact-dict assertions in test_server_renames.py gain "sha256": None.
Full suite on dev2: 160 passed, 2 skipped with the fixtures sourced; 157
passed, 5 skipped without. Smoke over stdio against the antd 0.17.0 devnet:
store_data of a unique text returned the same sha256 as computed locally.

🤖 Generated with Claude Code

[MaidSafe-Hermes]

APPROVE — reviewed exact head 59af872feab40351e14061c9e5629c7737df9dbd.

Coverage: 2/2 seats reviewed (sol-1 gpt-6.1-sol xhigh; glm-1 z-ai/glm-5.3); both seats agree (two model families).

The MCP layer adds sha256 to the upload/finalize results, maps absent/empty SDK values to null, and includes manifest hashes only when supplied. Tests cover present, absent, empty and legacy-SDK cases, REST request omission and daemon validation errors. The README and tool descriptions document the antd 0.17.0+ requirement.

Exact-head Python CI passed for both antd-mcp and antd-py. The MCP tests exercise its REST client path; no separate gRPC test is included. Non-blocking wording note: the older-SDK compatibility error says “antd 0.17.0 or later” although the immediate issue is the Python SDK shape. No merge performed.