Project evidence artifacts into the durable evidence_artifacts table (Epic 6)

[Lvvphole]

What & why

The evidence_artifacts table (with an attempt_id FK into run_attempts) has existed since Epic 2 but was never written. Epic 3 populated run_attempts and scoped artifacts per attempt on disk — leaving a populated parent table, real on-disk evidence, and an empty child table. This PR closes that loop: each run's hashed evidence artifacts are projected into evidence_artifacts, linked to the producing attempt.

The core obstacle

The rich Artifact records (sha256 + path) accumulate in ChainContext.artifacts, which never left the executor — ChainExecutionResult only carried artifact names. So the change surfaces those records out of execution and into the record/projection, mirroring how attempts already works.

Changes

• Artifact.attempt_id added; ArtifactStore.write stamps it from the store's per-attempt scope (Epic 3) — every artifact is self-describing about which attempt produced it.
• ChainExecutionResult.evidence_artifacts in-process carrier, Field(..., exclude=True) so it is never in an API response. Artifact.path is an absolute host path — same disclosure class as the workspace_id leak fixed earlier — so it stays server-side only.
• RunRecord.artifacts embedded and round-tripped via the snapshot (like attempts); the route captures result.evidence_artifacts after each attempt, so retries accumulate.
• Postgres projection: delete + reinsert evidence_artifacts per save (same idiom as handler_results), inserted after the run_attempts upsert so the FK target always exists. Path stored in object_uri (operator-queryable, never API-exposed); used_as_evidence = TRUE (quarantined agent narrative is never added to record.artifacts, so it never lands here).
• Docs updated: persistence.md, workspace_isolation.md, README "Deferred" entry.

Tests (276 passed, 10 skipped — Postgres tests skip without a DSN)

• ArtifactStore.write stamps / omits attempt_id per scope.
• Record round-trip carries artifacts (memory + serialization).
• Postgres-gated: evidence_artifacts projects with the attempt link, sha256, used_as_evidence, and is idempotent across re-saves.
• Route captures artifacts tagged with the attempt; the carrier is excluded from /execute and /results responses.

Scope / safety

No auth/RBAC, no object-storage backend (that's slice b), no change to verifier/gate authority, no merge/deploy/bypass. git diff --check clean; security review clean.

Note: while testing I found a pre-existing absolute-path leak in HandlerResult.artifacts_created/artifacts (untouched by this PR) — being addressed in a separate follow-up.

🤖 Generated with Claude Code

---

Generated by Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 93798d86d1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Include ledgered LLM invocation artifacts in the projection

For runs that invoke a configured agent (the default runtime uses the fake analyst), LLMInvocationRecorder writes llm_invocation_*.json and appends it to the evidence ledger, but it writes directly to the store/evidence writer rather than through ChainContext.record_artifact, so it never enters context.artifacts. Since the durable carrier is populated only from context.artifacts here, those ledgered LLM_INVOCATION artifacts are omitted from RunRecord.artifacts and therefore never projected into evidence_artifacts, leaving the Postgres audit table incomplete for agent-backed executions.

Useful? React with 👍 / 👎.