Record reference provenance in manifests

internal/framework/pipeline/references.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 	"unicode/utf8"
 
+	"gitea.maximumdirect.net/eric/notarius/internal/core/artifacts"
 	"gitea.maximumdirect.net/eric/notarius/internal/framework/contracts"
 )
 
@@ -185,3 +186,33 @@ func CloneReferenceSet(in contracts.ReferenceSet) contracts.ReferenceSet {
 	}
 	return out
 }
+
+func ReferenceProvenance(resolved ResolvedPipeline) []artifacts.ReferenceProvenance {
+	provenance := []artifacts.ReferenceProvenance{}
+	for _, lane := range resolved.ArtifactLanes {
+		if len(lane.ReferenceSet.Slots) == 0 {
+			continue
+		}
+		slotNames := make([]string, 0, len(lane.ReferenceSet.Slots))
+		for slotName := range lane.ReferenceSet.Slots {
+			slotNames = append(slotNames, slotName)
+		}
+		sort.Strings(slotNames)
+		for _, slotName := range slotNames {
+			slot := lane.ReferenceSet.Slots[slotName]
+			for _, item := range slot.Items {
+				provenance = append(provenance, artifacts.ReferenceProvenance{
+					LaneID:        lane.ID,
+					SlotName:      item.SlotName,
+					OriginType:    item.Origin.Type,
+					OriginURI:     item.Origin.URI,
+					Digest:        item.Digest,
+					MediaType:     item.MediaType,
+					SizeBytes:     item.SizeBytes,
+					BindingSource: item.BindingSource,
+				})
+			}
+		}
+	}
+	return provenance
+}

internal/framework/pipeline/references_test.go

@@ -83,6 +83,17 @@ func TestMaterializeReferencesResolvesPathsAndDigestsContent(t *testing.T) {
 		t.Fatalf("glossary origin URI = %q, want cli reference path", glossary.Origin.URI)
 	}
 
+	provenance := ReferenceProvenance(first)
+	if len(provenance) != 2 {
+		t.Fatalf("ReferenceProvenance() = %#v, want two entries", provenance)
+	}
+	if provenance[0].LaneID != "events" || provenance[0].SlotName != "glossary" || provenance[0].Digest != glossary.Digest {
+		t.Fatalf("ReferenceProvenance()[0] = %#v, want sorted glossary provenance", provenance[0])
+	}
+	if provenance[1].LaneID != "events" || provenance[1].SlotName != "roster" || provenance[1].Digest != roster.Digest {
+		t.Fatalf("ReferenceProvenance()[1] = %#v, want roster provenance", provenance[1])
+	}
+
 	encoded, err := json.Marshal(first)
 	if err != nil {
 		t.Fatalf("json.Marshal(materialized) error = %v, want nil", err)

internal/framework/pipeline/runner.go

@@ -356,8 +356,12 @@ func manifestFromPipeline(input RunInput) artifacts.RunManifest {
 		ArtifactLanes:  make([]artifacts.ArtifactLaneManifest, 0, len(pipeline.ArtifactLanes)),
 		RunID:          runID,
 		StartedAt:      timePtr(startedAt),
+		References:     ReferenceProvenance(pipeline),
 		LLMProfiles:    cloneLLMProfiles(input.LLMProfiles),
 	}
+	// The runner does not currently maintain a cache or idempotency key. Reference
+	// digests are recorded in manifest provenance and intentionally kept separate
+	// from source_digests.
 
 	for _, lane := range pipeline.ArtifactLanes {
 		laneManifest := artifacts.ArtifactLaneManifest{

internal/framework/pipeline/runner_test.go

@@ -960,7 +960,27 @@ func TestRunReturnsFailedManifestWhenOutputEncoderFails(t *testing.T) {
 }
 
 func TestRunManifestIncludesPipelineAndLaneDetails(t *testing.T) {
-	output, err := New(newRunnerRegistries(t, nil)).Run(context.Background(), RunInput{Pipeline: resolvedPipelineWithValidators("configured")})
+	resolved := resolvedPipelineWithValidators("configured")
+	resolved.ArtifactLanes[0].ReferenceSet = contracts.ReferenceSet{
+		Slots: map[string]contracts.ResolvedReferenceSlot{
+			"roster": {
+				Slot: contracts.ReferenceSlot{Name: "roster"},
+				Items: []contracts.ReferenceItem{
+					{
+						SlotName:      "roster",
+						MediaType:     "text/plain; charset=utf-8",
+						Content:       []byte("reference content"),
+						Digest:        "sha256:reference",
+						Origin:        contracts.ReferenceOrigin{Type: "file", URI: "file:///tmp/roster.txt"},
+						SizeBytes:     int64(len("reference content")),
+						BindingSource: contracts.ReferenceBindingSourceConfig,
+					},
+				},
+			},
+		},
+	}
+
+	output, err := New(newRunnerRegistries(t, nil)).Run(context.Background(), RunInput{Pipeline: resolved})
 	if err != nil {
 		t.Fatalf("Run() error = %v, want nil", err)
 	}
@@ -975,6 +995,16 @@ func TestRunManifestIncludesPipelineAndLaneDetails(t *testing.T) {
 	if !reflect.DeepEqual(manifest.SourceDigests, []string{"sha256:source"}) {
 		t.Fatalf("SourceDigests = %#v, want source digest", manifest.SourceDigests)
 	}
+	if len(manifest.References) != 1 {
+		t.Fatalf("References = %#v, want one reference provenance entry", manifest.References)
+	}
+	reference := manifest.References[0]
+	if reference.LaneID != "alpha" || reference.SlotName != "roster" || reference.Digest != "sha256:reference" {
+		t.Fatalf("reference provenance = %#v, want lane slot digest", reference)
+	}
+	if reference.OriginType != "file" || reference.OriginURI != "file:///tmp/roster.txt" || reference.MediaType != "text/plain; charset=utf-8" || reference.SizeBytes != int64(len("reference content")) || reference.BindingSource != contracts.ReferenceBindingSourceConfig {
+		t.Fatalf("reference provenance = %#v, want origin/media/size/source", reference)
+	}
 	if manifest.ValidationStatus != "approved" {
 		t.Fatalf("ValidationStatus = %q, want approved", manifest.ValidationStatus)
 	}