Make configured artifacts manifest authoritative

docs/internal/artifacts.md

@@ -47,22 +47,26 @@ kind and prepared filename vocabulary.
 
 - `planned`: source registered for run context;
 - `executable`: included in the effective analyze artifact set;
-- `available`: local file exists and validates;
+- `available`: the source's canonical evidence owner validates its current
+  manifest record and durable bytes;
 - `provenance`: availability source.
 
 Configured definitions are always registered. Without an explicit selection,
 the effective analyze set contains enabled definitions. With `--artifacts`, the
 exact named configured definitions become the effective set for that invocation,
 regardless of their `enabled` value; dependencies are not added implicitly.
-Availability is separate from executability: a non-executable configured output
-may be reused from a canonical non-empty file, while an executable definition
-is generated by analyze. Extraction entries are registered from configuration
-and become available only after compatible extraction evidence is hydrated.
+Availability is separate from executability. Configured outputs, including
+non-executable prerequisites, become available only when the versioned analyze
+state identifies a current result whose source, contract, canonical configured
+path, size, and checksum match a confined no-follow regular file. An incidental
+canonical file and a legacy aggregate analyze output are unavailable.
+Extraction entries are registered from configuration and become available only
+after compatible extraction evidence is hydrated.
 
 Current provenance values:
 
 - `generated.current_analyze_run`
-- `filesystem.disabled_artifact_output`
+- `manifest.current_analyze_artifact`
 - `manifest.inputs.previous_cache`
 - `current_session.previous_cache`
 
@@ -75,7 +79,17 @@ Built-ins:
 
 Configured sources (`narratio.artifact.*`):
 
-- resolve only through runtime catalog availability.
+- resolve only through runtime catalog availability;
+- use the shared typed analyze-evidence inspection in
+  `analyze_evidence.go` for prior current-session results;
+- require the supported analyze-state and fingerprint versions, a `current`
+  record for the exact configured key and source ID, a complete contract, the
+  configured canonical relative path, positive stored size, and stored
+  checksum matching bytes read from a confined no-follow regular file; and
+- treat non-current statuses, legacy or malformed records, removed keys,
+  unsafe or missing files, and size/checksum mismatches as unavailable without
+  rewriting manifest state. Catalog construction iterates current
+  configuration, so removed or renamed records are not advertised.
 
 Prepared stable sources (`narratio.input.*`):
 

docs/internal/stage-publish.md

@@ -38,7 +38,13 @@ Exact remote placement and the operator workflow belong in
   checks a declared checksum when present, then streams the opened descriptor.
 - derives the durable previous-cache archive from its validated manifest using
   the same confinement and regular-file checks.
-- resolves publish output sources through runtime artifact catalog and manifest-aware resolution.
+- resolves publish output sources through runtime artifact catalog and
+  manifest-aware resolution. Configured Scriptorium outputs are publishable
+  only from validated `current` per-artifact analyze evidence; an incidental
+  canonical file, legacy aggregate output, stale/failed/unselected record, or
+  mismatched path, size, or checksum remains unavailable. This does not change
+  the explicit compatibility policies owned by built-in, extraction, or
+  previous-session sources.
 - publishes extraction lanes only through explicit configured output rules;
   neither run-local nor durable Notarius bundles are scanned or uploaded wholesale.
 - selected artifact filter applies to configured artifact sources only.

docs/roadmap/implementation.md

@@ -409,6 +409,8 @@ history through the existing application-owned runner transaction.
 
 ## Stage 8 — Manifest-Authoritative Configured Artifact Evidence
 
+**Status: Completed**
+
 ### Goal
 
 Make configured analysis outputs available to analyze and publish only through