fix(evidence): link composed workflows to consumed observations (#7028)

src/application/binary/BinarySession.ts

@@ -136,6 +136,16 @@ const trackCleanupFailures = (
   };
 };
 
+/** Provider metadata cannot confer authority to an uncommitted Evidence ID. */
+const unrecordedExecution = (
+  result: Result<AnalysisExecution, AnalysisError>,
+): Result<AnalysisExecution, AnalysisError> => {
+  if (!result.ok || !("evidenceId" in result.value)) return result;
+  const observation = { ...result.value };
+  delete observation.evidenceId;
+  return ok(observation);
+};
+
 /**
  * Owns the single active target shared by CLI and MCP adapters.
  *
@@ -1180,7 +1190,9 @@ export class BinarySession
             "This operation requires an executable analysis target; the active session contains only app resource access.",
           ),
         );
-      const result = await resources.client.execute(name, arguments_, options);
+      const result = unrecordedExecution(
+        await resources.client.execute(name, arguments_, options),
+      );
       if (!result.ok) return result;
       const execution = { ...result.value, subject: null };
       return ok(execution);
@@ -1207,7 +1219,7 @@ export class BinarySession
     // Stop replay before dispatch, including reads overlapping the write.
     if (capability.effects.mutatesArtifact) this.invalidateSnapshot();
     const call = active.client.execute(name, arguments_, options);
-    const result = await call;
+    const result = unrecordedExecution(await call);
     const profiled = bindExecutionTarget(
       commitExecutionProfile(name, result, profile),
       name,
@@ -1266,14 +1278,16 @@ export class BinarySession
       );
       const recorded = this.recordEvidence(evidence);
       if (!recorded.ok) return recorded;
+      const retained = { ...execution.value, evidenceId: evidence.evidence_id };
       if (execution.value.cachePolicy !== "live")
         this.recordSnapshot({
           target: active.target,
           profile,
           operation: name,
           parameters: arguments_,
-          execution: execution.value,
+          execution: retained,
         });
+      return ok(retained);
     }
     return execution;
   }