fix: harden model catalog projections

harness/tht/evidence/corpus/models.py

@@ -19,6 +19,9 @@ from tht.evidence.contracts import (
 _NAMESPACED_ID = re.compile(r"^[a-z][a-z0-9_-]*:[A-Za-z0-9._:-]+$")
 _SHA256 = re.compile(r"^sha256:[0-9a-f]{64}$")
 _EVIDENCE_ID = re.compile(r"^evidence:[a-z0-9]+(?:-[a-z0-9]+)*$")
+_CANONICAL_MODEL_ID = re.compile(
+    r"^[a-z][a-z0-9._-]{0,63}/[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$"
+)
 _EVIDENCE_METADATA_KEYS = frozenset({
     "evidence_id", "evidence_kind", "purposes", "scope", "language", "provenance",
 })
@@ -37,6 +40,12 @@ def _validate_hash(value: str) -> str:
     return value
 
 
+def _validate_canonical_model_id(value: str) -> str:
+    if not _CANONICAL_MODEL_ID.fullmatch(value):
+        raise ValueError("model identifier must use canonical provider/model form")
+    return value
+
+
 def _require_content_hash(content: str, content_hash: str) -> None:
     expected = f"sha256:{hashlib.sha256(content.encode('utf-8')).hexdigest()}"
     if content_hash != expected:
@@ -146,6 +155,7 @@ class CorpusManifest(_WithMetadata):
     manifest_id: str | None = None
     created_at: datetime = Field(default_factory=lambda: datetime.now(UTC))
     pipeline_version: str = Field(default="evidence-v1", min_length=1)
+    embedding_id: str | None = None
     embedding_model: str | None = None
     embedding_dimensions: int | None = Field(default=None, gt=0)
     vector_generation: str | None = None
@@ -155,6 +165,9 @@ class CorpusManifest(_WithMetadata):
     _manifest_id = field_validator("manifest_id")(
         lambda value: _validate_namespaced_id(value) if value is not None else None
     )
+    _embedding_id = field_validator("embedding_id")(
+        lambda value: _validate_canonical_model_id(value) if value is not None else None
+    )
     _vector_generation = field_validator("vector_generation")(
         lambda value: _validate_namespaced_id(value) if value is not None else None
     )
@@ -164,6 +177,10 @@ class CorpusManifest(_WithMetadata):
     def validate_generation(self) -> "CorpusManifest":
         if (self.embedding_model is None) != (self.embedding_dimensions is None):
             raise ValueError("embedding_model and embedding_dimensions must be set together")
+        if self.embedding_id is not None and self.embedding_model is None:
+            raise ValueError("embedding_id requires embedding model and dimensions")
+        if self.schema_version >= 2 and self.embedding_model is not None and self.embedding_id is None:
+            raise ValueError("schema version 2 embedding generations require embedding_id")
         if self.vector_generation is not None and self.embedding_model is None:
             raise ValueError("vector_generation requires embedding model and dimension compatibility")