Document and validate Notarius extraction workflows

docs/internal/artifacts.md

@@ -24,12 +24,15 @@ Registry entries bind each ID to its producer, output kind, canonical fallback,
 and content validator. The focused stage documents own their input/output flow;
 [Configuration](../config.md) owns where operators may select these IDs.
 
-## Configured and Previous-Session Sources
+## Configured, Extraction, And Previous-Session Sources
 
 - configured source ID format: `narratio.artifact.<artifact_key>`
+- extraction source ID format: `narratio.extraction.<output_key>`
 - previous-session source ID format: `narratio.previous_session.artifact.<artifact_key>`
 
-Both formats are validated by strict source-policy rules.
+All formats are validated by strict source-policy rules. Extraction sources are
+registered only from `pipeline.notarius.outputs`; the Notarius index has no
+selectable source ID.
 
 ## Runtime Catalog
 
@@ -58,6 +61,15 @@ Configured sources (`narratio.artifact.*`):
 
 - resolve only through runtime catalog availability.
 
+Extraction sources (`narratio.extraction.*`):
+
+- use the shared registration and manifest hydration path in
+  `extraction_catalog.go`;
+- require a current successful extract record with the exact configured source,
+  compatible contract and Notarius provenance, a confined regular durable
+  payload, and matching checksum; and
+- are never inferred by scanning the Notarius bundle directory.
+
 Previous-session sources (`narratio.previous_session.artifact.*`):
 
 - resolve only from local `previous/` cache state;
@@ -127,19 +139,23 @@ physical layout.
 
 - source ID formats are stable contracts;
 - artifact resolution is deterministic and manifest-aware;
+- extraction sources are available only from a compatible successful manifest
+  record;
 - previous-session source resolution in `analyze` is local-only;
 - remote current-state key construction remains centralized in artifacts helpers.
 
 ## Implementation And Tests
 
 - Registry and resolution: `internal/artifacts/artifact_resolver.go`,
-  `internal/artifacts/catalog.go`, `internal/artifacts/transcripts.go`
+  `internal/artifacts/catalog.go`, `internal/artifacts/transcripts.go`,
+  `internal/artifacts/extraction_catalog.go`
 - Current state: `internal/artifacts/current_state.go`
 - Paths and keys: `internal/artifacts/paths.go`,
   `internal/artifacts/s3_keys.go`
 - Previous requirements: `internal/artifacts/previous_requirements.go`
 - Tests: `internal/artifacts/artifact_resolver_test.go`,
   `internal/artifacts/catalog_test.go`,
+  `internal/artifacts/extraction_catalog_test.go`,
   `internal/artifacts/current_state_test.go`,
   `internal/artifacts/paths_model_test.go`,
   `internal/artifacts/previous_requirements_test.go`