docs: define the P1.1 registry layout and curator flow

docs/contracts/workspace-evidence-v3.md

@@ -7,9 +7,9 @@ source variant and the policy reject unknown keys.
 
 ## Filesystem source
 
-A filesystem source uses the exact URI `workspace-content/<workspace.id>/evidence`. `patterns` is
-a nonempty list of unique, normalized relative POSIX globs. Its defaults are
-`patterns: ["**/*.md"]` and `max_bytes: 10485760`.
+A filesystem source uses the exact URI `<workspace.id>/evidence`. `patterns` is a nonempty list of
+unique, normalized relative POSIX globs. Its defaults are `patterns: ["**/*.md"]` and
+`max_bytes: 10485760`.
 
 ### Example: filesystem
 
@@ -17,7 +17,7 @@ a nonempty list of unique, normalized relative POSIX globs. Its defaults are
 evidence:
   source:
     type: filesystem
-    uri: workspace-content/example/evidence
+    uri: example/evidence
     patterns:
       - "**/*.md"
     max_bytes: 10485760
@@ -26,9 +26,9 @@ evidence:
     retain_published_generations: 3
 ```
 
-Safe: `workspace-content/example/evidence`. Unsafe filesystem identities include `/srv/evidence`,
-`workspace-content/another/evidence`, and `workspace-content/example/../another/evidence` because
-absolute, cross-namespace, and traversal paths are not canonical.
+Safe: `example/evidence`. Unsafe filesystem identities include `/srv/evidence`,
+`another/evidence` and `example/evidence/../another` because cross-namespace and traversal
+paths are not canonical. Legacy split-layout paths are rejected as noncanonical.
 
 ## HTTP source
 
@@ -133,33 +133,46 @@ All workspace namespaces live in one Git repository:
 
 ```text
 registry.git/
-├── workspaces/
-│   ├── example.yaml
-│   └── another.yaml
-├── workspace-content/
-│   ├── example/evidence/...
-│   └── another/evidence/...
+├── thoth-workspaces.yaml
+├── example/
+│   ├── workspace.yaml
+│   └── evidence/...
+├── another/
+│   └── workspace.yaml
 └── workspace-docs/
     ├── example/{contract.env.example,README.md}
     └── another/{contract.env.example,README.md}
 ```
 
-Curators change only `workspace-content/<id>/evidence/**` through a normal clone. The API publishes
-only `workspaces/<id>.yaml` and
-`workspace-docs/<id>/{contract.env.example,README.md}`. It never writes Evidence source bytes.
+The curator-owned root catalog `thoth-workspaces.yaml` uses the `schema_version` value `1` and the ordered
+`workspaces` list of `{id, name, description?}` entries. It is authoritative for workspace ID,
+name, description, and display order. The descriptor at `<id>/workspace.yaml` must match the
+catalog metadata exactly. `workspace-docs` is the reserved top-level API directory and cannot be a
+workspace ID.
+
+Catalog-only entries without `<id>/workspace.yaml` are valid bootstrap slots and surface as
+`configuration_required`. The API may create `<id>/workspace.yaml` only when the catalog slot
+already exists and no Git object exists at that path in the exact pulled base commit. After
+bootstrap, existing descriptors change only through curator Git commit/push and installation pull.
+The API never writes `thoth-workspaces.yaml` or `<id>/evidence/**`. Generated docs stay outside the
+workspace namespace at `workspace-docs/<id>/{contract.env.example,README.md}`. An explicit docs
+synchronization may create a docs-only commit that changes only `workspace-docs/**` and preserves
+the catalog, descriptor, and Evidence object IDs.
 
 ## Registry revision and phase ownership
 
 | Relationship | Contract |
 | --- | --- |
-| Revision identity | The descriptor blob and filesystem Evidence root tree are checked at the same 40-hex Git commit. |
-| Content-only revision | An Evidence-only commit changes authoritative `revision.commit` even when the descriptor blob is unchanged. |
-| Browser | Create and edit flows preserve and show a read-only Evidence summary. |
+| Revision identity | The catalog blob, descriptor blob, and filesystem Evidence root tree are checked at the same 40-hex Git commit. |
+| Content-only revision | An Evidence-only commit changes authoritative `revision.commit` even when the catalog and descriptor blobs are unchanged. |
+| Docs-only sync commit | A docs-only synchronization may advance `revision.commit`, change only `workspace-docs/**`, and preserve the catalog, descriptor, and Evidence object IDs. |
+| Browser | Read-only curated workspaces preserve and show a read-only Evidence summary; only a catalog-only bootstrap slot may draft the first descriptor. |
 | Export | Export remains exactly manifest, descriptor, contract, and README; it excludes Evidence bytes. |
-| P1 | Validates the lexical URI and proves the declared filesystem root object is a Git tree at that same commit; it does not recursively inspect nested symlinks. |
+| P1.1 | Validates the lexical URI `<id>/evidence` and proves the declared filesystem root object is a Git tree at that same commit; it does not recursively inspect nested symlinks. Evidence materialization stays out of scope for P1.1. |
 | P6 | Owns commit-addressed materialization, realpath and recursive containment, nested-symlink checks, and race checks. |
 
-P1 performs no acquisition, extraction, preprocessing/indexing, embeddings, Qdrant writes, `ACTIVE` publication, retention, or GC.
+P1.1 performs no acquisition, extraction, preprocessing/indexing, embeddings, Qdrant writes,
+`ACTIVE` publication, retention, or GC.
 
 ## Operator validation