feat(evidence): add filesystem and HTTP sources

harness/tht/config.py

@@ -5,7 +5,7 @@ from pathlib import Path
 from typing import Annotated, Any, Literal
 
 import yaml
-from pydantic import BaseModel, Field, model_validator, ValidationError
+from pydantic import BaseModel, Field, SecretStr, model_validator, ValidationError
 
 from tht.config_compat import translate_legacy_config
 
@@ -172,13 +172,45 @@ class EligibilityConfig(BaseModel):
     ignore_columns: list[str] = ["etl_last_update"]
 
 
+class FilesystemEvidenceSourceConfig(BaseModel):
+    type: Literal["filesystem"]
+    root: Path
+    patterns: list[str] = ["**/*.md"]
+    max_bytes: int = Field(default=10 * 1024 * 1024, gt=0)
+
+
+class HttpEvidenceSourceConfig(BaseModel):
+    type: Literal["http"]
+    # Manifest URLs may contain signed query parameters. Treat the complete transport URL as
+    # secret-bearing configuration; adapters derive a query-free provenance URI from it.
+    urls: list[SecretStr] = Field(min_length=1)
+    connect_timeout: float = Field(default=5, gt=0)
+    read_timeout: float = Field(default=30, gt=0)
+    max_bytes: int = Field(default=10 * 1024 * 1024, gt=0)
+    max_redirects: int = Field(default=5, ge=0)
+
+
+EvidenceSourceConfig = Annotated[
+    FilesystemEvidenceSourceConfig | HttpEvidenceSourceConfig,
+    Field(discriminator="type"),
+]
+
+
 class EvidenceSourcesConfig(BaseModel):
-    source_root: Path
+    # Legacy curated-tree configuration remains accepted during migration.
+    source_root: Path | None = None
     # cartella curata a mano nell'ETL (relativa a source_root): unica fonte delle
     # evidence. Niente piu' estrazione automatica dalle schede tabella: i documenti
     # qui dentro sono gia' evidence pronte (frontmatter + corpo), scelte e arricchite
     # dall'autore ETL e organizzate in sottocartelle per dominio.
     evidence_dir: str = "evidence"
+    sources: list[EvidenceSourceConfig] = []
+
+    @model_validator(mode="after")
+    def require_a_source(self):
+        if self.source_root is None and not self.sources:
+            raise ValueError("evidence requires source_root or sources")
+        return self
 
 
 class EmbeddingsConfig(BaseModel):