Record reference provenance in manifests

internal/modules/output/json/encoder_test.go

@@ -142,6 +142,42 @@ func TestEncodePrettyPrintsJSON(t *testing.T) {
 	}
 }
 
+func TestEncodeIncludesManifestReferences(t *testing.T) {
+	result, err := New().Encode(context.Background(), contracts.OutputRequest{
+		Manifest: artifacts.RunManifest{
+			RunID: "run-1",
+			References: []artifacts.ReferenceProvenance{
+				{
+					LaneID:        "events",
+					SlotName:      "roster",
+					OriginType:    "file",
+					OriginURI:     "file:///tmp/roster.txt",
+					Digest:        "sha256:reference",
+					MediaType:     "text/plain; charset=utf-8",
+					SizeBytes:     12,
+					BindingSource: "config",
+				},
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("Encode() error = %v, want nil", err)
+	}
+
+	manifest := decodeObject(t, fileBytes(t, result.Files, "manifest.json"))
+	references := manifest["references"].([]any)
+	if len(references) != 1 {
+		t.Fatalf("references = %#v, want one entry", references)
+	}
+	reference := references[0].(map[string]any)
+	if reference["lane_id"] != "events" || reference["slot_name"] != "roster" || reference["digest"] != "sha256:reference" {
+		t.Fatalf("reference manifest = %#v, want lane slot digest", reference)
+	}
+	if _, ok := reference["content"]; ok {
+		t.Fatalf("reference manifest = %#v, want no content field", reference)
+	}
+}
+
 func TestEncodeRejectsArtifactTypeWithoutSafeFileName(t *testing.T) {
 	_, err := New().Encode(context.Background(), contracts.OutputRequest{
 		Approved: []artifacts.Artifact{artifact("///", "unsafe")},