Harden pipeline state and plan release upgrades

internal/config/effective_digest.go

@@ -4,6 +4,8 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"fmt"
+	"path/filepath"
+	"strings"
 
 	"gopkg.in/yaml.v3"
 )
@@ -77,7 +79,14 @@ func recomputePipelineEffectiveDigest(cfg *PipelineConfig) error {
 	if cfg == nil || cfg.resolution == nil {
 		return fmt.Errorf("pipeline resolution metadata is required")
 	}
-	data, err := yaml.Marshal(cfg)
+	digestConfig := *cfg
+	if cfg.Notarius != nil && cfg.resolution.logicalNotariusCaptured {
+		notarius := *cfg.Notarius
+		notarius.ConfigPath = cfg.resolution.logicalNotariusConfig
+		notarius.WorkingDirectory = cfg.resolution.logicalNotariusWorking
+		digestConfig.Notarius = &notarius
+	}
+	data, err := yaml.Marshal(&digestConfig)
 	if err != nil {
 		return fmt.Errorf("serialize normalized effective pipeline: %w", err)
 	}
@@ -93,3 +102,28 @@ func recomputePipelineEffectiveDigest(cfg *PipelineConfig) error {
 	cfg.resolution.effectiveDigest = hex.EncodeToString(digest[:])
 	return nil
 }
+
+// captureLogicalNotariusPaths retains normalized user-facing path semantics
+// before runtime resolution makes relative paths depend on the checkout or
+// installation directory. Runtime paths remain absolute; provenance does not.
+func captureLogicalNotariusPaths(cfg *PipelineConfig) {
+	if cfg == nil || cfg.resolution == nil || cfg.Notarius == nil {
+		return
+	}
+	configPath := normalizeLogicalFilesystemPath(cfg.Notarius.ConfigPath)
+	workingDirectory := normalizeLogicalFilesystemPath(cfg.Notarius.WorkingDirectory)
+	if cfg.Notarius.Enabled && workingDirectory == "" && configPath != "" {
+		workingDirectory = normalizeLogicalFilesystemPath(filepath.Dir(configPath))
+	}
+	cfg.resolution.logicalNotariusConfig = configPath
+	cfg.resolution.logicalNotariusWorking = workingDirectory
+	cfg.resolution.logicalNotariusCaptured = true
+}
+
+func normalizeLogicalFilesystemPath(value string) string {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return ""
+	}
+	return filepath.ToSlash(filepath.Clean(value))
+}