feat: implement memory and evidence administration with guided repairs

Add PostgreSQL-backed memory, editable evidence with source review and activation, and human-approved archive repairs across the harness, API, and UI. Include migrations, deployment support, regression coverage, and validation documentation.

Refresh permissions from validated session roles so existing administrator logins can access newly deployed archive management features.

tools/tht/cmd/tht/main.go

@@ -83,6 +83,9 @@ Commands:
                       Verify a terminal installation, remove stale lifecycle files, and clear maintenance.
   pi logs             Show the latest 200 sanitized core log lines (bounded; no follow mode).
   workspace inspect --workspace ID [--json]
+  workspace evidence consolidate --workspace ID [--json]
+  workspace evidence refresh --workspace ID [--json]
+  workspace evidence decide --workspace ID --source-id SHA --revision SHA --decision keep|replace [--json]
                        Inspect the active registry snapshot for one workspace.
   workspace preprocess run --workspace ID [--json]
                        Rebuild Catalog metadata, LSH, schema/Evidence vectors, then enable the core.

tools/tht/internal/workspaceops/operations.go

@@ -44,6 +44,27 @@ type InspectRequest struct{ baseRequest }
 
 type RunRequest struct{ baseRequest }
 type ClearRequest struct{ baseRequest }
+type EvidenceRequest struct {
+	baseRequest
+	Action   string
+	SourceID string
+	Revision string
+	Decision string
+}
+
+func (EvidenceRequest) workspaceRequest() {}
+func (r EvidenceRequest) operatorCommand() string {
+	if r.Action == "refresh" {
+		return "evidence-refresh"
+	}
+	if r.Action == "decide" {
+		return "evidence-decide"
+	}
+	return "evidence-consolidate"
+}
+func (r EvidenceRequest) stdinEnvelope() (requestEnvelope, error) {
+	return requestEnvelope{SchemaVersion: 1, WorkspaceID: r.Workspace, SourceID: r.SourceID, Revision: r.Revision, Decision: r.Decision}, nil
+}
 
 func (InspectRequest) workspaceRequest() {}
 func (RunRequest) workspaceRequest()     {}
@@ -68,6 +89,9 @@ func (r ClearRequest) stdinEnvelope() (requestEnvelope, error) {
 type requestEnvelope struct {
 	SchemaVersion int    `json:"schemaVersion"`
 	WorkspaceID   string `json:"workspaceId"`
+	SourceID      string `json:"sourceId,omitempty"`
+	Revision      string `json:"revision,omitempty"`
+	Decision      string `json:"decision,omitempty"`
 }
 
 type Result struct {
@@ -141,6 +165,42 @@ func Parse(args []string) (Request, error) {
 		return nil, errors.New("workspace requires a subcommand")
 	}
 	switch args[0] {
+	case "evidence":
+		if len(args) < 2 || (args[1] != "consolidate" && args[1] != "refresh" && args[1] != "decide") {
+			return nil, errors.New("workspace evidence requires consolidate, refresh or decide")
+		}
+		request := EvidenceRequest{Action: args[1]}
+		baseArgs := []string{}
+		seen := map[string]bool{}
+		for i := 2; i < len(args); i++ {
+			flag := args[i]
+			if flag == "--source-id" || flag == "--revision" || flag == "--decision" {
+				if request.Action != "decide" || seen[flag] || i+1 >= len(args) {
+					return nil, errors.New("invalid Evidence decision flags")
+				}
+				seen[flag] = true
+				i++
+				switch flag {
+				case "--source-id":
+					request.SourceID = args[i]
+				case "--revision":
+					request.Revision = args[i]
+				case "--decision":
+					request.Decision = args[i]
+				}
+			} else {
+				baseArgs = append(baseArgs, flag)
+			}
+		}
+		if request.Action == "decide" && (!regexp.MustCompile(`^[a-f0-9]{64}$`).MatchString(request.SourceID) || !regexp.MustCompile(`^[a-f0-9]{64}$`).MatchString(request.Revision) || (request.Decision != "keep" && request.Decision != "replace")) {
+			return nil, errors.New("decide requires source-id, revision and decision keep or replace")
+		}
+		base, err := parseBaseFlags(baseArgs)
+		if err != nil {
+			return nil, err
+		}
+		request.baseRequest = base
+		return request, nil
 	case "inspect":
 		parsed, err := parseInspect(args[1:])
 		if err != nil {

tools/tht/internal/workspaceops/operations_test.go

@@ -20,6 +20,23 @@ type fakeRunner struct {
 	stdins []string
 }
 
+func TestEvidenceConsolidationUsesClosedMaintenanceContract(t *testing.T) {
+	request, err := Parse([]string{"evidence", "consolidate", "--workspace", "sales", "--json"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if request.operatorCommand() != "evidence-consolidate" || !request.JSONMode() {
+		t.Fatal("incorrect command")
+	}
+	envelope, err := request.stdinEnvelope()
+	if err != nil || envelope.WorkspaceID != "sales" {
+		t.Fatal("incorrect workspace envelope")
+	}
+	if _, err := Parse([]string{"evidence", "consolidate", "--workspace", "../foreign"}); err == nil {
+		t.Fatal("accepted an unsafe workspace")
+	}
+}
+
 func (r *fakeRunner) Run(_ context.Context, args []string, stdin io.Reader) (compose.Result, error) {
 	payload := ""
 	if stdin != nil {
@@ -147,3 +164,29 @@ func contains(values []string, sequence ...string) bool {
 func successResult(operation string) string {
 	return `{"schemaVersion":1,"status":"succeeded","code":"ok","workspaceId":"abc","workspaceRevision":"1234567890abcdef1234567890abcdef12345678","descriptorBlob":"sha256:` + strings.Repeat("f", 64) + `","operation":"` + operation + `","completedStages":[]}`
 }
+
+func TestEvidenceSourceCommandsAreClosedAndCarryReviewIdentity(t *testing.T) {
+	request, err := Parse([]string{"evidence", "refresh", "--workspace", "sales", "--json"})
+	if err != nil || request.operatorCommand() != "evidence-refresh" {
+		t.Fatalf("refresh: %v", err)
+	}
+	args := []string{"evidence", "decide", "--workspace", "sales", "--source-id", strings.Repeat("a", 64), "--revision", strings.Repeat("b", 64), "--decision", "keep"}
+	request, err = Parse(args)
+	if err != nil {
+		t.Fatal(err)
+	}
+	envelope, _ := request.stdinEnvelope()
+	if envelope.SourceID != strings.Repeat("a", 64) || envelope.Decision != "keep" || request.operatorCommand() != "evidence-decide" {
+		t.Fatal("review identity lost")
+	}
+	for _, invalid := range [][]string{
+		{"evidence", "refresh", "--workspace", "sales", "--url", "http://localhost"},
+		{"evidence", "decide", "--workspace", "sales"},
+		append(append([]string{}, args...), "--decision", "replace"),
+		{"evidence", "consolidate", "--workspace", "sales", "--source-id", strings.Repeat("a", 64)},
+	} {
+		if _, err := Parse(invalid); err == nil {
+			t.Fatalf("accepted invalid flags: %v", invalid)
+		}
+	}
+}