feat: add durable addressed registry publication

harness/tht/cli/preprocess_cmd.py

@@ -20,6 +20,13 @@ from tht.vectorstore.embeddings import EmbeddingsError
 preprocess_app = typer.Typer(help="Materialize versioned preprocessing artifacts")
 logger = logging.getLogger(__name__)
 
+def _require_writer_capability() -> None:
+    """Mutating children opt into the backend-owned fd capability contract."""
+    import os
+    if os.environ.get("THOTH_WORKSPACE_CAPABILITY_REQUIRED") == "1":
+        from tht.workspace_writer_lock import require_workspace_writer_capability
+        require_workspace_writer_capability()
+
 _PREPROCESS_EXPECTED_ERRORS = (
     OSError, RuntimeError, ValueError, TypeError, KeyError,
     EvidenceSourceError, VectorStoreError, EmbeddingsError,
@@ -29,6 +36,7 @@ _PREPROCESS_EXPECTED_ERRORS = (
 def run_dwh_from_config(
     config: Path, *, steps: tuple[str, ...], resume: str | None = None,
 ):
+    _require_writer_capability()
     from tht.cli.lsh_cmd import build_lsh_artifacts
     from tht.cli.schema_cmd import _load_config_or_exit, refresh_catalog
     from tht.jobs.dwh_pipeline import (
@@ -74,6 +82,7 @@ def _parse_dwh_steps(value: str) -> tuple[str, ...]:
 
 
 def run_from_config(config: Path, *, dry_run: bool = False, resume: str | None = None):
+    _require_writer_capability()
     from tht.adapters.factory import build_evidence_sources, build_vector_store
     from tht.cli.vector_cmd import make_embedder
     from tht.corpus.chunk import ChunkPolicy

harness/tht/cli/schema_cmd.py

@@ -16,6 +16,12 @@ from tht.mschema.eligibility import classify_all
 schema_app = typer.Typer(help="Gestione mschema (rappresentazione canonica dello schema)")
 logger = logging.getLogger(__name__)
 
+def _require_writer_capability() -> None:
+    import os
+    if os.environ.get("THOTH_WORKSPACE_CAPABILITY_REQUIRED") == "1":
+        from tht.workspace_writer_lock import require_workspace_writer_capability
+        require_workspace_writer_capability()
+
 
 def _add_examples(dwh, phys, examples) -> None:
     for table_name, table in phys.tables.items():
@@ -54,6 +60,7 @@ def annotations_path(cfg: Config) -> Path:
 
 
 def refresh_catalog(cfg, *, dwh=None, output_path: Path | None = None):
+    _require_writer_capability()
     """Run the existing catalog algorithm and persist its canonical output."""
     target = dwh if dwh is not None else build_dwh(cfg)
     physical = target.introspect()

harness/tht/cli/vector_cmd.py

@@ -24,6 +24,12 @@ from tht.vectorstore.store import SyncStats, content_hash
 vector_app = typer.Typer(help="Indice semantico Qdrant (derivato, rigenerabile)")
 logger = logging.getLogger(__name__)
 
+def _require_writer_capability() -> None:
+    import os
+    if os.environ.get("THOTH_WORKSPACE_CAPABILITY_REQUIRED") == "1":
+        from tht.workspace_writer_lock import require_workspace_writer_capability
+        require_workspace_writer_capability()
+
 
 def make_embedder(embeddings_cfg):
     """Factory del client embeddings (monkeypatchabile nei test)."""
@@ -64,6 +70,7 @@ def open_searcher(cfg):
 
 
 def sync_canonical_records(collection, records, *, store, embedder):
+    _require_writer_capability()
     kinds = sorted({record.kind for record in records})
     existing = store.existing_hashes(collection, kinds)
     pending = []