Add Notarius configuration and extraction source policy

internal/config/load.go

@@ -19,6 +19,9 @@ func LoadPipeline(path string) (*PipelineConfig, error) {
 		return nil, fmt.Errorf("load pipeline config: %w", err)
 	}
 	applyPipelineDefaults(&cfg)
+	if err := resolveNotariusPaths(&cfg, path); err != nil {
+		return nil, fmt.Errorf("load pipeline config: %w", err)
+	}
 	return &cfg, nil
 }
 
@@ -86,12 +89,17 @@ func LoadSessionBytesWithOptions(label string, data []byte, opts SessionLoadOpti
 
 // LoadPublishLockStoreBytes loads a mutable session lock store with strict
 // field checking and source validation.
-func LoadPublishLockStoreBytes(label string, data []byte, scriptorium *ScriptoriumConfig) (*PublishLockStore, error) {
+func LoadPublishLockStoreBytes(
+	label string,
+	data []byte,
+	scriptorium *ScriptoriumConfig,
+	notarius *NotariusConfig,
+) (*PublishLockStore, error) {
 	var store PublishLockStore
 	if err := decodeStrictYAMLFromReader("publish lock store", label, strings.NewReader(string(data)), &store); err != nil {
 		return nil, fmt.Errorf("load publish lock store: %w", err)
 	}
-	locks, err := ValidatePublishLockRules(store.Locks, scriptorium, "locks")
+	locks, err := ValidatePublishLockRules(store.Locks, scriptorium, notarius, "locks")
 	if err != nil {
 		return nil, fmt.Errorf("load publish lock store: %w", err)
 	}
@@ -359,6 +367,7 @@ func applyPipelineDefaults(cfg *PipelineConfig) {
 	}
 	applyRenderDefaults(&cfg.Render)
 	applyScriptoriumDefaults(cfg.Scriptorium)
+	applyNotariusDefaults(cfg.Notarius)
 }
 
 func applyCampaignsDefaults(cfg *CampaignsConfig) {
@@ -516,6 +525,57 @@ func applyScriptoriumDefaults(cfg *ScriptoriumConfig) {
 	}
 }
 
+func applyNotariusDefaults(cfg *NotariusConfig) {
+	if cfg == nil {
+		return
+	}
+	if cfg.Binary == "" {
+		cfg.Binary = DefaultNotariusBinary
+	}
+	if cfg.Timeout == "" {
+		cfg.Timeout = DefaultNotariusTimeout
+	}
+}
+
+func resolveNotariusPaths(cfg *PipelineConfig, pipelinePath string) error {
+	if cfg == nil || cfg.Notarius == nil || !cfg.Notarius.Enabled {
+		return nil
+	}
+	pipelineAbs, err := filepath.Abs(pipelinePath)
+	if err != nil {
+		return fmt.Errorf("resolve pipeline config path %q: %w", pipelinePath, err)
+	}
+	baseDir := filepath.Dir(pipelineAbs)
+	resolve := func(value string) (string, error) {
+		trimmed := strings.TrimSpace(value)
+		if trimmed == "" {
+			return "", nil
+		}
+		if !filepath.IsAbs(trimmed) {
+			trimmed = filepath.Join(baseDir, trimmed)
+		}
+		return filepath.Abs(trimmed)
+	}
+
+	resolvedConfigPath, err := resolve(cfg.Notarius.ConfigPath)
+	if err != nil {
+		return fmt.Errorf("resolve pipeline.notarius.config_path: %w", err)
+	}
+	cfg.Notarius.ConfigPath = resolvedConfigPath
+	if strings.TrimSpace(cfg.Notarius.WorkingDirectory) == "" {
+		if resolvedConfigPath != "" {
+			cfg.Notarius.WorkingDirectory = filepath.Dir(resolvedConfigPath)
+		}
+		return nil
+	}
+	workingDirectory, err := resolve(cfg.Notarius.WorkingDirectory)
+	if err != nil {
+		return fmt.Errorf("resolve pipeline.notarius.working_directory: %w", err)
+	}
+	cfg.Notarius.WorkingDirectory = workingDirectory
+	return nil
+}
+
 func applyTrimDefaults(cfg *TrimConfig) {
 	if cfg == nil {
 		return