docs: describe read-only workspace runtime configuration

docs/contracts/workspace-evidence-v3.md

@@ -123,41 +123,37 @@ hold file paths, never credential or signed-URL values.
 | Static S3 pair | `THT_WS_<NAMESPACE>_EVIDENCE_ACCESS_KEY_FILE` and `THT_WS_<NAMESPACE>_EVIDENCE_SECRET_KEY_FILE` | Required together for `static_files`; each file is at most 65536 bytes. |
 | Static S3 session | `THT_WS_<NAMESPACE>_EVIDENCE_SESSION_TOKEN_FILE` | Optional, valid only with the required access/secret pair, and at most 65536 bytes. |
 
-Every variable is an absolute path to a readable regular file whose resolved target is strictly below one of the roots configured by `THT_WORKSPACE_SECRET_ROOTS`. Scalar S3 files are nonempty
-UTF-8 tokens without whitespace or NUL. Public docs, exports, and rendered YAML never expose file contents. `changeme`, `replace-me`, `YOUR_SECRET`, `<secret>`, access-key-looking strings, and any
+At the connector boundary every variable is an absolute path to a readable regular file whose
+resolved target is strictly below one of the roots configured by `THT_WORKSPACE_SECRET_ROOTS`.
+Users enter the corresponding values through Workspace management; the backend stores them as
+authenticated ciphertext and materializes these files only for a runtime lease. Scalar S3 files
+are nonempty UTF-8 tokens without whitespace or NUL. Public docs, APIs, and rendered YAML never
+expose file contents. `changeme`, `replace-me`, `YOUR_SECRET`, `<secret>`, access-key-looking strings, and any
 credential-bearing or query-bearing URI are forbidden as public placeholder values.
 
-## One shared registry repository
+## One shared workspace repository
 
 All workspace namespaces live in one Git repository:
 
 ```text
-registry.git/
+workspace-repository.git/
 ├── thoth-workspaces.yaml
 ├── example/
 │   ├── workspace.yaml
 │   └── evidence/...
-├── another/
-│   └── workspace.yaml
-└── workspace-docs/
-    ├── example/{contract.env.example,README.md}
-    └── another/{contract.env.example,README.md}
+└── another/
+    └── workspace.yaml
 ```
 
 The curator-owned root catalog `thoth-workspaces.yaml` uses the `schema_version` value `1` and the ordered
 `workspaces` list of `{id, name, description?}` entries. It is authoritative for workspace ID,
 name, description, and display order. The descriptor at `<id>/workspace.yaml` must match the
-catalog metadata exactly. `workspace-docs` is the reserved top-level API directory and cannot be a
-workspace ID.
+catalog metadata exactly. Every catalog entry must have its descriptor at that same commit;
+catalog-only entries are invalid and reject the complete candidate revision.
 
-Catalog-only entries without `<id>/workspace.yaml` are valid bootstrap slots and surface as
-`configuration_required`. The API may create `<id>/workspace.yaml` only when the catalog slot
-already exists and no Git object exists at that path in the exact pulled base commit. After
-bootstrap, existing descriptors change only through curator Git commit/push and installation pull.
-The API never writes `thoth-workspaces.yaml` or `<id>/evidence/**`. Generated docs stay outside the
-workspace namespace at `workspace-docs/<id>/{contract.env.example,README.md}`. An explicit docs
-synchronization may create a docs-only commit that changes only `workspace-docs/**` and preserves
-the catalog, descriptor, and Evidence object IDs.
+Workspace source changes only through curator Git commit/push in a separate authoring clone,
+followed by an installation pull. The API never writes `thoth-workspaces.yaml`,
+`<id>/workspace.yaml`, `<id>/schema/**`, or `<id>/evidence/**`.
 
 ## Registry revision and phase ownership
 
@@ -165,14 +161,13 @@ the catalog, descriptor, and Evidence object IDs.
 | --- | --- |
 | Revision identity | The catalog blob, descriptor blob, and filesystem Evidence root tree are checked at the same 40-hex Git commit. |
 | Content-only revision | An Evidence-only commit changes authoritative `revision.commit` even when the catalog and descriptor blobs are unchanged. |
-| Docs-only sync commit | A docs-only synchronization may advance `revision.commit`, change only `workspace-docs/**`, and preserve the catalog, descriptor, and Evidence object IDs. |
-| Browser | Read-only curated workspaces preserve and show a read-only Evidence summary; only a catalog-only bootstrap slot may draft the first descriptor. |
-| Export | Export remains exactly manifest, descriptor, contract, and README; it excludes Evidence bytes. |
+| Repository consumer | ThothII fetches and validates a complete candidate, atomically activates it only on success, and never edits, commits, or pushes repository content. |
+| Runtime secrets | Workspace management returns configured/missing status only; decrypted values exist only for the lifetime of a diagnostic or runtime lease. |
 | P1.1 | Validates the lexical URI `<id>/evidence` and proves the declared filesystem root object is a Git tree at that same commit; it does not recursively inspect nested symlinks. Evidence materialization stays out of scope for P1.1. |
 | P6 | Owns commit-addressed materialization, realpath and recursive containment, nested-symlink checks, and race checks. |
 
 P1.1 performs no acquisition, extraction, preprocessing/indexing, embeddings, Qdrant writes,
-`ACTIVE` publication, retention, or GC.
+active-snapshot retention, or GC.
 
 ## Operator validation