test(artifacts): bind workflow provenance and retained evidence sources

tests/acceptance/applications/applicationWorkflowCli.test.ts

@@ -1236,7 +1236,7 @@ describe("application workflow CLI input", () => {
       }),
       "--json",
     ]);
-    expect(result).toMatchObject({ code: "invalid_request" });
+    expect(result).toMatchObject({ code: "evidence_integrity_mismatch" });
   });
 });
 

tests/acceptance/godotPck.test.ts

@@ -329,9 +329,17 @@ cliTest(
     });
     const saved = await readEvidenceBundle(bundle);
     if (!saved.ok) throw saved.error;
-    const evidence = saved.value.records[0];
+    const evidence = saved.value.records.find(
+      (record) => record.operation === "inspect_artifact",
+    );
     if (evidence === undefined) throw new Error("Missing complete inspection");
     expect(graphFrom(evidence).occurrences).toHaveLength(3);
+    const inspection = artifactInspectionResultSchema.parse(
+      evidence.normalized_result,
+    );
+    expect(saved.value.records).toContainEqual(
+      inspection.substeps[0]?.evidence,
+    );
     const before = await readFile(bundle);
     expect((await cli.run({ arguments: args })).exitCode).toBe(1);
     expect(await readFile(bundle)).toEqual(before);

tests/acceptance/harmonyArtifactJourney.test.ts

@@ -8,10 +8,43 @@ import { TextReader, Uint8ArrayWriter, ZipWriter } from "@zip.js/zip.js";
 import { expect } from "vitest";
 
 import { artifactInspectionResultSchema } from "../../src/domain/artifactInspection.js";
+import { digestCanonicalValue } from "../../src/domain/canonicalDigest.js";
 import { parseEvidence } from "../../src/domain/evidence.js";
-import { harmonyApplicationProjectionResultSchema } from "../../src/domain/harmony/harmonyApplication.js";
+import {
+  harmonyApplicationProjectionResultSchema,
+  type HarmonyApplicationProjectionResult,
+} from "../../src/domain/harmony/harmonyApplication.js";
 import { workspaceCliTest as test } from "../support/cli/workspaceCliFixture.js";
 
+const expectProjectionParity = (
+  graph: HarmonyApplicationProjectionResult,
+  cliReply: unknown,
+  sources: { readonly mcp: string; readonly cli: string },
+) => {
+  const cliGraph = harmonyApplicationProjectionResultSchema.parse(
+    parseEvidence(cliReply).normalized_result,
+  );
+  expect(graph.source_evidence_ids).toEqual([sources.mcp]);
+  expect(cliGraph.source_evidence_ids).toEqual([sources.cli]);
+  // Projection identity includes the selected source Evidence. Bind each
+  // adapter's identity before comparing its otherwise identical semantics.
+  for (const projection of [graph, cliGraph]) {
+    const { projection_id, ...content } = projection;
+    expect(projection_id).toBe(
+      `hmp_${digestCanonicalValue(content, "HarmonyOS application projection")}`,
+    );
+  }
+  const mappedGraph = {
+    ...graph,
+    source_evidence_ids: [sources.cli],
+  };
+  const { projection_id: _mcpProjectionId, ...mappedContent } = mappedGraph;
+  expect(cliGraph).toEqual({
+    ...mappedContent,
+    projection_id: `hmp_${digestCanonicalValue(mappedContent, "HarmonyOS application projection")}`,
+  });
+};
+
 test("preserves Harmony archive formats through the public CLI/MCP lifecycle", async ({
   cli,
   workspace,
@@ -138,11 +171,10 @@ test("preserves Harmony archive formats through the public CLI/MCP lifecycle", a
         environment,
       });
       expect(cliProjection.exitCode, cliProjection.stderr).toBe(0);
-      expect(
-        harmonyApplicationProjectionResultSchema.parse(
-          parseEvidence(cliProjection.json).normalized_result,
-        ),
-      ).toEqual(graph);
+      expectProjectionParity(graph, cliProjection.json, {
+        mcp: inventoryEvidence.evidence_id,
+        cli: cliEvidence.evidence_id,
+      });
       const closed = await client.callTool({
         name: "close_binary",
         arguments: {},

tests/acceptance/managedCliOutput.test.ts

@@ -384,7 +384,8 @@ cliTest(
       arguments: [...argv, "--filter-output", "toString", "--token-count"],
     });
     expect(omittedCount.exitCode).toBe(0);
-    expect(omittedCount.stdout).toBe("0\n");
+    // A missing JSON selection delivers an empty object, which costs one token.
+    expect(omittedCount.stdout).toBe("1\n");
     const jsonl = await cli.run({
       arguments: [
         "inspect-managed-members",