docs(evidence): publish curated-only workspace contract

backend/test/workspace-runtime-renderer.test.ts

@@ -139,8 +139,14 @@ function evidenceSecretFile(name: string, contents: string): string {
   return path;
 }
 
-function evidenceWorkspace(source: Record<string, unknown>, policy?: Record<string, unknown>) {
-  return parseWorkspaceYaml(`${canonicalEvidenceWorkspace}\nevidence:\n  source: ${JSON.stringify(source)}${
+function evidenceWorkspace(
+  source: Record<string, unknown>,
+  policy?: Record<string, unknown>,
+  evidenceSchemaVersion?: number,
+) {
+  return parseWorkspaceYaml(`${canonicalEvidenceWorkspace}\nevidence:${
+    evidenceSchemaVersion === undefined ? "" : `\n  schema_version: ${evidenceSchemaVersion}`
+  }\n  source: ${JSON.stringify(source)}${
     policy === undefined ? "" : `\n  policy: ${JSON.stringify(policy)}`
   }\n`);
 }
@@ -180,9 +186,10 @@ function evidenceRender(
   source: Record<string, unknown>,
   evidenceBinding: RuntimeBindings["evidence"] = { missing: [], values: {} },
   policy?: Record<string, unknown>,
+  evidenceSchemaVersion?: number,
 ) {
   return renderRuntimeConfig(
-    evidenceWorkspace(source, policy),
+    evidenceWorkspace(source, policy, evidenceSchemaVersion),
     { ...directBindings, evidence: evidenceBinding },
     paths,
     evidenceContext,
@@ -195,7 +202,7 @@ test("renders filesystem Evidence below the immutable revision content root with
   const yaml = evidenceRender({
     type: "filesystem",
     uri: "psd-clinical/evidence",
-  });
+  }, undefined, undefined, 2);
   const rendered = parse(yaml);
 
   expect(rendered.runtime_identity.workspace_revision).toBe(evidenceRevision);
@@ -203,7 +210,7 @@ test("renders filesystem Evidence below the immutable revision content root with
     sources: [{
       type: "filesystem",
       root: `/srv/registry/snapshots/${evidenceRevision}/psd-clinical/evidence`,
-      patterns: ["**/*.md"],
+      patterns: ["curated/**/*.md"],
       max_bytes: 10_485_760,
     }],
   });

backend/test/workspaces-schema.test.ts

@@ -390,6 +390,58 @@ test("applies filesystem and policy defaults to the canonical descriptor", () =>
   });
 });
 
+test("defaults schema-versioned filesystem Evidence to curated documents only", () => {
+  const parsed = validateWorkspaceDescriptor({
+    ...withEvidence({
+      type: "filesystem",
+      uri: "psd-clinical/evidence",
+    }),
+    evidence: {
+      schema_version: 2,
+      source: { type: "filesystem", uri: "psd-clinical/evidence" },
+    },
+  });
+
+  expect(parsed.evidence).toMatchObject({
+    schema_version: 2,
+    source: { patterns: ["curated/**/*.md"] },
+  });
+});
+
+test("rejects a schema-versioned Evidence layout that mixes source and curated runtime patterns", () => {
+  expectSafeEvidenceError({
+    ...withEvidence({
+      type: "filesystem",
+      uri: "psd-clinical/evidence",
+    }),
+    evidence: {
+      schema_version: 2,
+      source: {
+        type: "filesystem",
+        uri: "psd-clinical/evidence",
+        patterns: ["source/**/*.md", "curated/**/*.md"],
+      },
+    },
+  }, /source.*curated|curated.*source/i);
+});
+
+test("rejects a schema-versioned Evidence layout that acquires source documents at runtime", () => {
+  expectSafeEvidenceError({
+    ...withEvidence({
+      type: "filesystem",
+      uri: "psd-clinical/evidence",
+    }),
+    evidence: {
+      schema_version: 2,
+      source: {
+        type: "filesystem",
+        uri: "psd-clinical/evidence",
+        patterns: ["source/**/*.md"],
+      },
+    },
+  }, /curated/i);
+});
+
 test("keeps evidence optional on schema v3", () => {
   expect(validateWorkspaceDescriptor(validWorkspaceObject())).not.toHaveProperty("evidence");
 });