Snapshot verified references for extraction

docs/config.md

@@ -274,8 +274,9 @@ It validates only selector structure and the prepared source vocabulary;
 Notarius owns target-slot declarations and media compatibility.
 
 Before extraction, Narratio resolves every binding from the current prepared
-session manifest and passes its canonical absolute `inputs/` path to Notarius.
-Missing, unsafe, empty, or checksum-inconsistent prepared evidence fails with
+session manifest and streams it into a verified invocation-local snapshot whose
+absolute path is passed to Notarius. Missing, unsafe, empty,
+changed-during-copy, or checksum-inconsistent prepared evidence fails with
 guidance to force `prepare`. Bindings are sorted by normalized selector and are
 part of extraction fingerprint and resume identity. See the
 [Notarius integration contract](./integrations/notarius.md) for the subprocess

docs/integrations/notarius.md

@@ -30,14 +30,16 @@ references are configured and invokes each binding as a separate argument
 before `--json`:
 
 ```text
-notarius run <pipeline_id> --config <config_path> --input <trimmed_json> --output-dir <staging_dir> [--reference <selector>=<prepared_path>]... --json
+notarius run <pipeline_id> --config <config_path> --input <trimmed_json> --output-dir <staging_dir> [--reference <selector>=<verified_snapshot_path>]... --json
 ```
 
-Reference paths are absolute canonical files prepared inside the current
-Narratio session workspace. Narratio passes only configured bindings, ordered
-lexically by normalized selector, as direct argument-vector entries without
-shell interpretation. A CLI binding takes precedence over a matching external
-path in Notarius configuration. Narratio never emits `--without-reference`.
+Reference paths are absolute invocation-local snapshots streamed from the
+manifest-verified canonical files prepared inside the current Narratio session
+workspace. Narratio verifies snapshot checksum and size before and after the
+subprocess, and passes only configured bindings, ordered lexically by normalized
+selector, as direct argument-vector entries without shell interpretation. A CLI
+binding takes precedence over a matching external path in Notarius
+configuration. Narratio never emits `--without-reference`.
 
 The maintained D&D boundary binds only the four campaign-owned external slots:
 
@@ -46,10 +48,10 @@ notarius run dnd-session \
   --config <absolute config path> \
   --input <absolute trimmed transcript path> \
   --output-dir <absolute staging directory> \
-  --reference glossary=<absolute prepared glossary path> \
-  --reference party=<absolute prepared party path> \
-  --reference players=<absolute prepared players path> \
-  --reference spell_catalog=<absolute prepared spell catalog path> \
+  --reference glossary=<absolute verified glossary snapshot> \
+  --reference party=<absolute verified party snapshot> \
+  --reference players=<absolute verified players snapshot> \
+  --reference spell_catalog=<absolute verified spell catalog snapshot> \
   --json
 ```
 

docs/internal/stage-extract.md

@@ -19,17 +19,19 @@ procedures belong in [Operations](../operations.md).
 1. resolves the final trimmed transcript from the shared artifact catalog;
 2. resolves every configured prepared reference through the shared
    manifest-authoritative identity resolver before creating run-local output;
-3. fingerprints the Notarius invocation contract, including sorted reference
+3. streams each verified reference into an invocation-local snapshot and
+   rejects any source change observed while copying;
+4. fingerprints the Notarius invocation contract, including sorted reference
    identities;
-4. creates a run-local staging directory and invokes the injected
+5. creates a run-local staging directory and invokes the injected
    `notarius.Runner`;
-5. validates the v2 successful receipt, confined index, management documents,
-   configured required lane descriptors, validation summaries, and regular
-   payload files;
-6. atomically promotes the complete bundle to its immutable durable location;
-7. records one non-selectable `notarius_index` output and one selectable
+6. revalidates the reference snapshots, then validates the v2 successful
+   receipt, confined index, management documents, configured required lane
+   descriptors, validation summaries, and regular payload files;
+7. atomically promotes the complete bundle to its immutable durable location;
+8. records one non-selectable `notarius_index` output and one selectable
    `notarius_lane` output per configured lane; and
-8. registers each lane as `narratio.extraction.<output_key>` for downstream
+9. registers each lane as `narratio.extraction.<output_key>` for downstream
    Scriptorium and publish resolution.
 
 Lane records retain checksum, contract, producer run ID, and Notarius system,
@@ -40,7 +42,10 @@ fingerprint. The input identity binds the exact transcript bytes, canonical
 source ID, producer stage/output/run identity, and resolution provenance.
 Reference metadata contains only selector, source ID, canonical session-relative
 path, checksum, and size; adapter requests receive selector and absolute
-prepared path, never payload contents.
+invocation-local snapshot path, never payload contents. Snapshot bytes must
+match the prepared identity both before and after Notarius runs, so a concurrent
+prepared-file replacement cannot make recorded provenance describe different
+bytes from those supplied to Notarius.
 Validation completes before
 promotion, so a rejected result cannot expose a partial durable bundle.
 

docs/operations.md

@@ -143,7 +143,10 @@ are not selectable or published implicitly.
 Configured Notarius references resolve only from the current manifest-backed
 prepared inputs. Their canonical locations are `inputs/party.yml`,
 `inputs/players.yml`, `inputs/glossary.yml`, and, when configured,
-`inputs/spell_catalog.json`. Inspect the effective stable-input inventory and
+`inputs/spell_catalog.json`. Extraction supplies Notarius with verified copies
+under `runs/<run_id>/extract/references/` so a concurrent refresh of canonical
+prepared files cannot change the bytes consumed by an in-flight invocation.
+Inspect the effective stable-input inventory and
 prepared-file readiness with:
 
 ```bash