Confine publish archive reads

internal/manifest/manifest.go

@@ -33,6 +33,7 @@ type ArtifactRecord struct {
 	Kind               string                            `json:"kind"`
 	SourceID           string                            `json:"source_id,omitempty"`
 	LocalPath          string                            `json:"local_path"`
+	ArchivePath        string                            `json:"archive_path,omitempty"`
 	Contract           *artifactmodel.ContractMetadata   `json:"contract,omitempty"`
 	ExternalProvenance *artifactmodel.ExternalProvenance `json:"external_provenance,omitempty"`
 	// ProducerRunID identifies the run that produced this durable artifact.

internal/manifest/store.go

@@ -149,18 +149,35 @@ func (s *LocalStore) LoadRun(ctx context.Context, path string) (*RunManifest, er
 		return nil, fmt.Errorf("load run manifest: path is required")
 	}
 
-	data, err := os.ReadFile(path)
+	file, err := os.Open(path)
 	if err != nil {
 		return nil, fmt.Errorf("load run manifest %q: %w", path, err)
 	}
+	defer file.Close()
+	return s.LoadRunReader(ctx, file)
+}
+
+// LoadRunReader reads and validates a run manifest from a caller-owned reader.
+func (s *LocalStore) LoadRunReader(ctx context.Context, source io.Reader) (*RunManifest, error) {
+	if err := checkContext(ctx); err != nil {
+		return nil, err
+	}
+	if source == nil {
+		return nil, fmt.Errorf("load run manifest: source is required")
+	}
+
+	data, err := io.ReadAll(source)
+	if err != nil {
+		return nil, fmt.Errorf("read run manifest: %w", err)
+	}
 
 	var m RunManifest
 	if err := json.Unmarshal(data, &m); err != nil {
-		return nil, fmt.Errorf("decode run manifest %q: %w", path, err)
+		return nil, fmt.Errorf("decode run manifest: %w", err)
 	}
 
 	if err := validateLoadedRunManifest(&m); err != nil {
-		return nil, fmt.Errorf("run manifest %q invalid: %w", path, err)
+		return nil, fmt.Errorf("run manifest invalid: %w", err)
 	}
 	normalizeRunManifest(&m)