feat: activate commit-addressed Evidence materialization with an integrity chain (P6)

backend/src/workspaces/registry.ts

@@ -1,10 +1,11 @@
 import { createHash, randomUUID } from "node:crypto";
-import { lstatSync } from "node:fs";
+import { lstatSync, readFileSync } from "node:fs";
 import { mkdir, readdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { isAbsolute, join } from "node:path";
 import { buildInstallationContract, renderWorkspaceDocs } from "./contracts.js";
 import { parseAnnotationsYaml } from "./annotations.js";
 import { syncAnnotations } from "./annotations-sync.js";
+import { materializeEvidenceTree } from "./evidence-materialization.js";
 import { assertCatalogMatchesDescriptor, parseWorkspaceCatalogYaml, type WorkspaceCatalog, type WorkspaceCatalogEntry } from "./catalog.js";
 import {
   GitWorkspaceRepository,
@@ -640,6 +641,16 @@ export class WorkspaceRegistry {
           await writeFile(join(staging, docsName), docs.markdown, { encoding: "utf8", mode: 0o400 });
           files[envName] = digest(docs.envExample);
           files[docsName] = digest(docs.markdown);
+          if (snapshot.workspace.evidence?.source.type === "filesystem") {
+            const materialized = await materializeEvidenceTree({
+              repository: this.repository,
+              revision: safeHead,
+              id: snapshot.id,
+              targetDirectory: join(staging, snapshot.id),
+              limits: this.evidenceMaterializationLimits(),
+            });
+            files[`${snapshot.id}/evidence.manifest.json`] = materialized.manifestDigest;
+          }
         }
         await writeFile(join(staging, "snapshot.json"), JSON.stringify({ head: safeHead, revisions, catalog, files }), {
           encoding: "utf8", mode: 0o400,
@@ -822,7 +833,7 @@ export class WorkspaceRegistry {
         || JSON.stringify(manifest.catalog ?? null) !== JSON.stringify(state.catalog ?? null)) {
         throw new Error("manifest state does not match active state");
       }
-      await this.assertManifestFiles(directory, manifest.files, this.expectedSnapshotFiles(state));
+      await this.assertManifestFiles(directory, manifest.files, this.expectedSnapshotFiles(state, directory));
       await this.assertSnapshotEvidenceContexts(state);
     } catch (error) {
       if (error instanceof WorkspaceRegistryError) throw error;
@@ -830,12 +841,31 @@ export class WorkspaceRegistry {
     }
   }
 
-  private expectedSnapshotFiles(state: ActiveState): string[] {
-    // P1 snapshots only descriptors and derived public docs. P6 owns revision-pinned
-    // workspace-content materialization and its recursive containment checks.
-    return state.revisions.flatMap((revision) => [
-      `${revision.id}.yaml`, `${revision.id}.env.example`, `${revision.id}.md`,
-    ]);
+  private expectedSnapshotFiles(state: ActiveState, directory: string): string[] {
+    return state.revisions.flatMap((revision) => {
+      const names = [`${revision.id}.yaml`, `${revision.id}.env.example`, `${revision.id}.md`];
+      const workspace = parseWorkspaceYaml(readFileSync(join(directory, `${revision.id}.yaml`), "utf8"));
+      if (workspace.evidence?.source.type === "filesystem") {
+        names.push(`${revision.id}/evidence.manifest.json`);
+      }
+      return names;
+    });
+  }
+
+  private evidenceMaterializationLimits(): Partial<{
+    maxEntries: number;
+    maxTotalBytes: number;
+    maxFileBytes: number;
+    maxPathBytes: number;
+    maxManifestBytes: number;
+  }> {
+    return {
+      ...(this.config.maxEvidenceEntries === undefined ? {} : { maxEntries: this.config.maxEvidenceEntries }),
+      ...(this.config.maxEvidenceBytes === undefined ? {} : { maxTotalBytes: this.config.maxEvidenceBytes }),
+      ...(this.config.maxEvidenceFileBytes === undefined ? {} : { maxFileBytes: this.config.maxEvidenceFileBytes }),
+      ...(this.config.maxEvidencePathBytes === undefined ? {} : { maxPathBytes: this.config.maxEvidencePathBytes }),
+      ...(this.config.maxEvidenceManifestBytes === undefined ? {} : { maxManifestBytes: this.config.maxEvidenceManifestBytes }),
+    };
   }
 
   private async assertManifestFiles(

backend/src/workspaces/types.ts

@@ -10,6 +10,12 @@ export interface WorkspaceRegistryConfig {
   maxImportEntries: number;
   /** Absolute runtime data root; when set, activation also syncs curated annotations per revision. */
   dataRoot?: string;
+  /** P6 Evidence materialization bounds; defaults are applied by the materializer. */
+  maxEvidenceEntries?: number;
+  maxEvidenceBytes?: number;
+  maxEvidenceFileBytes?: number;
+  maxEvidencePathBytes?: number;
+  maxEvidenceManifestBytes?: number;
 }
 
 export type WorkspaceErrorCode =