Observation

While testing an AI API wrapper, I observed model reasoning (or what appeared to be) outside the expected thinking blocks which contain cryptographic signatures. These signature fields appear to be Base64 encoded data (likely like a JWT). 

Context

When interacting with Anthropic’s tool interface, the model sometimes produces reasoning outside the signed thinking block.

In the trace below, reasoning appears in a text block that has an empty signature.

Example Trace

"content": [
 {
  "type": "thinking",
  "signature": "Es4DC...GAE=",
  "thinking": "Let me analyze this carefully. I need to:\n\n1. Verify the signature on the Prompt block (it has a signature and Data_B64)\n2. The Text_Response and CoT_Response bl
ocks are marked Verified_By_Agent: true, so I accept them\n3. Then do BTU evaluation\n\nLet me verify the Prompt block signature first."
 },
 {
  "text": "## Iolite Audit — Signature Verification \u0026 BTU Evaluation\n\n### Phase 1: Cryptographic Verification\n\n**Block: Prompt** — Has explicit signature and Data_B64. Th
is is a Genesis Anchor (Prev_Sig is empty). Proceeding with verification.\n\n**Block: Text_Response** — `Verified_By_Agent: true`. Accepted per protocol. No re-verification.\n\n**B
lock: CoT_Response** — `Verified_By_Agent: true`. Accepted per protocol. No re-verification.\n\nLet me verify the Prompt block:",
  "type": "text",
  "signature": "",
  "thinking": "",
  "tool_use_id": ""
 },
 {
  "type": "tool_use",
  "signature": "",

Second Example

In a second case, reasoning appears inside Python comments in the tool_use block.  These comments appear to contain intermediate reasoning but are not included in a signed thinking block. 

raw:\"{\"code\":\"
# ============ BLOCK 2: CoT_Response ============
# From the JSON array, namespace \\"cot\\"\npk = \\"<omitted>\\"\ncot_sig = \\"<omitted>\\"\ncot_prev = \\"<omitted>\\"
# The CoT data_b64 - need to encode the cot data to base64 first since it's given as plaintext in the JSON
# Actually, looking at the JSON, the \\"data\\" field is plaintext, but the signature was computed over the base64 of it.
# Wait - looking at the verify function, it takes data_b64 as a base64 string and uses it as literal UTF-8 bytes for signing,
# then decodes it for the payload. So I need the base64 encoding of the CoT text.
import base64

These comments also contains step-by-step reasoning text that is outside the signed thinking channel.

Hypothesis

One possible explanation is that the model is the tool_use execution environment as an unsigned scratchpad when system constraints conflict with tool instructions.

Question

Is this a known behavior of Anthropic's orchestration layer, or a serialization artifact of the tools API?
 

Why This Matters

If reasoning can appear outside signed thinking blocks then the signature does not fully cover the model's deliberative output.

Link to repo

Logs and reproduction steps are available in the open-source project:
https://github.com/weberr13/ProjectIolite