Expose current supporting-text evidence receipts
Saved supporting text returned only its request, so callers could not obtain the retained version ID for a later evidence association. HTTP and standard MCP read now add a metadata-only material_evidence receipt with current document/result/version references. The shared operation validates owner/request/material lineage and submission identity, then rechecks access. It returns no submitted text, locations, storage paths or signed access. Other request kinds keep their response; delegated OAuth keeps its legacy material response through a server-derived policy that callers cannot set.
The feature uses existing material-target/document RPCs: no migration, new store, upload, provider call or automatic association. draft_origin explicitly remains not_recorded. DRAFT-TEXT-ORIGIN.md specifies the minimal origin-aware writer and owner/key receipt lookup dependency; metadata embedded in submitted text is never treated as verified origin. Existing #985 retained history and #983 associations remain separate.
Review follow-up separates the new read orchestration and schemas from the legacy dispatcher, asserts the exact receipt and redacted HTTP response, and clarifies standard versus delegated MCP behavior. HTTP read failures emit fixed diagnostic categories without exception text or private fields; the test spy is restored automatically on failure.
Validation at 33737a1d3789bc3ff45bbb8df35dcd0144c240c1:
- 343 Context/OAuth cases pass, 8 opt-in skips; the final focused selection passes 26 cases. External HTTP was denied in the full local selection.
- Nine initial receipt cases show 8 assertion failures on the unchanged baseline after correcting an import mock. Two header cases, two transport-policy regressions and fixed-label/category diagnostic assertions also fail before their changes and pass after. Exact-equality strengthening and spy cleanup are test-only, not a newly reproduced runtime leak.
- Metadata HTTP/standard-MCP parity, delegated-response preservation, strict caller input and private/no-store success/domain errors pass.
- A private synthetic shared-operation-to-existing-SQL journey passes on PostgreSQL 15.10 and 17.7, including module-reload readback, revocation and withdrawal; no hosted connection or new migration. Those runs used
592be5b7; the SQL-exercised domain files are byte-identical in this head. The final delta is the HTTP diagnostic, MCP description and unit assertions. - Full lint and changed-file TypeScript pass. Twelve imported OAuth diagnostics match the unchanged baseline.
- The additional full in-memory OAuth catalog suite cannot collect with the reused local dependencies (
@workflow/core/serialization-format); the same collection failure occurs on unchanged main. It is not claimed as passing.
Reviewer-requested diagnostics use only exact controlled messages to distinguish material verification, owner change and generic dependency/access failure. Raw exception text and causes remain excluded; deeper dependency tracing is outside this MVP slice.
No production deployment, hosted write or customer import was performed. Final exact-head checks pass: format, lint, compatibility, test and Vercel preview. Cubic reports zero issues in the final incremental review. These checks remain distinct from local qualification and production verification. CodeRabbit reports its OSS review was skipped, not completed.