feat: bind evidence trees to registry revisions

backend/test/workspaces-git-repository.test.ts

@@ -1,5 +1,5 @@
 import { execFile } from "node:child_process";
-import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
@@ -45,7 +45,7 @@ async function git(cwd: string, args: string[]): Promise<void> {
   await runFile("git", args, { cwd });
 }
 
-async function temporaryRemote(): Promise<{ root: string; remote: string; initialCommit: string }> {
+async function temporaryRemote(): Promise<{ root: string; remote: string; source: string; initialCommit: string }> {
   const root = mkdtempSync(join(tmpdir(), "thoth-workspace-git-"));
   temporaryRoots.push(root);
   const remote = join(root, "remote.git");
@@ -57,12 +57,23 @@ async function temporaryRemote(): Promise<{ root: string; remote: string; initia
   await git(source, ["config", "user.email", "workspace-registry@example.invalid"]);
   mkdirSync(join(source, "workspaces"));
   writeFileSync(join(source, "workspaces", "psd-clinical.yaml"), validYaml);
-  await git(source, ["add", "workspaces/psd-clinical.yaml"]);
+  writeFileSync(join(source, "workspaces", "research.yaml"), validYaml
+    .replace("id: psd-clinical", "id: research"));
+  mkdirSync(join(source, "workspace-content", "research", "evidence"), { recursive: true });
+  mkdirSync(join(source, "workspace-content", "other", "evidence"), { recursive: true });
+  mkdirSync(join(source, "workspace-content", "blob"), { recursive: true });
+  mkdirSync(join(source, "workspace-content", "link"), { recursive: true });
+  writeFileSync(join(source, "workspace-content", "research", "evidence", "guide.md"), "guide v1\n");
+  writeFileSync(join(source, "workspace-content", "other", "evidence", "other.md"), "other\n");
+  writeFileSync(join(source, "workspace-content", "blob", "evidence"), "not a tree\n");
+  symlinkSync("../research/evidence", join(source, "workspace-content", "link", "evidence"));
+  symlinkSync("guide.md", join(source, "workspace-content", "research", "evidence", "nested-link"));
+  await git(source, ["add", "workspaces", "workspace-content"]);
   await git(source, ["commit", "-m", "Initial workspace"]);
   await git(source, ["remote", "add", "origin", remote]);
   await git(source, ["push", "origin", "main"]);
   const { stdout } = await runFile("git", ["rev-parse", "HEAD"], { cwd: source });
-  return { root, remote, initialCommit: stdout.trim() };
+  return { root, remote, source, initialCommit: stdout.trim() };
 }
 
 function config(root: string, remoteUrl: string): WorkspaceRegistryConfig {
@@ -94,6 +105,101 @@ test("bootstraps a persistent checkout from a local bare repository", async () =
   });
 });
 
+test("accepts only a tree at the declared Evidence root for the requested revision", async () => {
+  const fixture = await temporaryRemote();
+  const repository = new GitWorkspaceRepository(config(join(fixture.root, "registry"), fixture.remote));
+  await repository.bootstrap();
+
+  await expect(repository.assertTreeAtRevision(
+    fixture.initialCommit,
+    "workspace-content/research/evidence",
+  )).resolves.toBeUndefined();
+  await expect(repository.assertTreeAtRevision(
+    fixture.initialCommit,
+    "workspace-content/missing/evidence",
+  )).rejects.toMatchObject({ code: "workspace_invalid" });
+  await expect(repository.assertTreeAtRevision(
+    fixture.initialCommit,
+    "workspace-content/blob/evidence",
+  )).rejects.toMatchObject({ code: "workspace_invalid" });
+  await expect(repository.assertTreeAtRevision(
+    fixture.initialCommit,
+    "workspace-content/link/evidence",
+  )).rejects.toMatchObject({ code: "workspace_invalid" });
+});
+
+test("redacts Git failures while checking an Evidence tree", async () => {
+  const fixture = await temporaryRemote();
+  const repository = new GitWorkspaceRepository(config(join(fixture.root, "registry"), fixture.remote));
+  await repository.bootstrap();
+  rmSync(repository.repoPath, { recursive: true, force: true });
+
+  const error = await repository.assertTreeAtRevision(
+    fixture.initialCommit,
+    "workspace-content/research/evidence",
+  ).catch((failure: unknown) => failure);
+  expect(error).toMatchObject({ code: "git_unavailable", message: "Workspace Git operation failed" });
+  expect((error as Error).message).not.toContain(fixture.root);
+});
+
+test("binds Evidence tree validation to old and new content-only commits", async () => {
+  const fixture = await temporaryRemote();
+  const repository = new GitWorkspaceRepository(config(join(fixture.root, "registry"), fixture.remote));
+  await repository.bootstrap();
+  writeFileSync(join(fixture.source, "workspace-content", "research", "evidence", "guide.md"), "guide v2\n");
+  await git(fixture.source, ["add", "workspace-content/research/evidence/guide.md"]);
+  await git(fixture.source, ["commit", "-m", "Update Evidence content"]);
+  await git(fixture.source, ["push", "origin", "main"]);
+  const { stdout } = await runFile("git", ["rev-parse", "HEAD"], { cwd: fixture.source });
+  const newCommit = stdout.trim();
+  await repository.pull();
+  const oldTree = (await runFile("git", ["rev-parse", `${fixture.initialCommit}:workspace-content/research/evidence`], {
+    cwd: fixture.source,
+  })).stdout.trim();
+  const newTree = (await runFile("git", ["rev-parse", `${newCommit}:workspace-content/research/evidence`], {
+    cwd: fixture.source,
+  })).stdout.trim();
+
+  expect(newTree).not.toBe(oldTree);
+  await expect(repository.assertTreeAtRevision(
+    fixture.initialCommit,
+    "workspace-content/research/evidence",
+  )).resolves.toBeUndefined();
+  await expect(repository.assertTreeAtRevision(
+    newCommit,
+    "workspace-content/research/evidence",
+  )).resolves.toBeUndefined();
+});
+
+test("defers nested Evidence symlink containment to P6", async () => {
+  const fixture = await temporaryRemote();
+  const repository = new GitWorkspaceRepository(config(join(fixture.root, "registry"), fixture.remote));
+  await repository.bootstrap();
+
+  // Task 2 validates only the declared root object. Recursive containment remains a P6 boundary.
+  await expect(repository.assertTreeAtRevision(
+    fixture.initialCommit,
+    "workspace-content/research/evidence",
+  )).resolves.toBeUndefined();
+});
+
+test("rejects malformed revisions and shell-like paths without executing them", async () => {
+  const fixture = await temporaryRemote();
+  const repository = new GitWorkspaceRepository(config(join(fixture.root, "registry"), fixture.remote));
+  await repository.bootstrap();
+  const marker = join(fixture.root, "shell-marker");
+
+  await expect(repository.assertTreeAtRevision(
+    "HEAD",
+    "workspace-content/research/evidence",
+  )).rejects.toMatchObject({ code: "workspace_invalid" });
+  await expect(repository.assertTreeAtRevision(
+    fixture.initialCommit,
+    `workspace-content/research/evidence;touch ${marker}`,
+  )).rejects.toMatchObject({ code: "workspace_invalid" });
+  expect(existsSync(marker)).toBe(false);
+});
+
 test("redacts failed Git checkout details behind a stable error code", async () => {
   const root = mkdtempSync(join(tmpdir(), "thoth-workspace-git-missing-"));
   temporaryRoots.push(root);