feat(evidence): add safe retention and materialized reads

2026-07-12 05:02:47 +02:00
parent b6a52995ae
commit f3b49f41c8
11 changed files with 310 additions and 14 deletions
@@ -64,6 +64,9 @@ def resolve_evidence_file(store: CorpusStore, evidence_id: str) -> str:
        frontmatter = document.metadata.get("frontmatter", {})
        identifiers = {document.document_id, document.source_id, str(frontmatter.get("id", ""))}
        if evidence_id in identifiers:
+            # Validate the immutable bytes through the dirfd/O_NOFOLLOW reader before
+            # handing the path to legacy session-artifact consumers.
+            store.read_document(document.document_id)
            path = store.resolve_document(document.document_id)
            return str(path) if path else ""
    return ""