fix(evidence)!: validate native view parent predicates (#8451)

Reject native view sources whose predicate disagrees with the selected operation. Use the original predicate for existing Evidence; do not alter a record without recomputing its identity.

src/application/native/NativeFunctionMatchingService.ts

@@ -20,6 +20,7 @@ import { resolveNativeMatchingSources } from "./NativeMatchingSources.js";
 import type { ExecutionOptions } from "../AnalysisProvider.js";
 import type { NativeMatchingAllowance } from "../../config/nativeMatchingAllowance.js";
 import { FUNCTION_COMPARISON_PROVIDER } from "../../domain/comparisonEvidenceIdentity.js";
+import { NATIVE_FUNCTION_MATCHING_PREDICATE } from "../../domain/native/functionMatching.js";
 
 const OPERATION = "match_native_functions";
 
@@ -144,7 +145,7 @@ const matchWithAdmission = async (
   await checkpoint();
   const evidence = createEvidence(undefined, FUNCTION_COMPARISON_PROVIDER, {
     operation: OPERATION,
-    predicateType: "rea.native-function-matching",
+    predicateType: NATIVE_FUNCTION_MATCHING_PREDICATE,
     confidence: "derived",
     authority: "analyst-inference",
     parameters: {

src/application/native/NativeFunctionMatchingViews.test.ts

@@ -119,6 +119,7 @@ it("rebuilds native row selection when a caller's sealed flag covers only a shal
   );
   Object.freeze(report);
   const parent = {
+    predicateType: matched.value.evidence.predicate_type,
     evidenceId: matched.value.evidence.evidence_id,
     operation: matched.value.evidence.operation,
     normalizedResult: report,

src/application/native/NativeMatchingSources.ts

@@ -1,7 +1,11 @@
 import type { MatchNativeFunctionsInput } from "../../contracts/native/functionMatchingContracts.js";
 import { digestCanonicalValue } from "../../domain/canonicalDigest.js";
 import { AnalysisInputError } from "../../domain/analysisErrorCore.js";
-import { isImmutableEvidence, type Evidence } from "../../domain/evidence.js";
+import {
+  ANALYSIS_EVIDENCE_PREDICATE,
+  isImmutableEvidence,
+  type Evidence,
+} from "../../domain/evidence.js";
 import { readEvidence } from "../../domain/evidenceValidation.js";
 import { retainedEvidenceReferenceSchema } from "../../domain/evidenceReference.js";
 import {
@@ -82,7 +86,7 @@ export const resolveNativeMatchingSources = async (
   ): Promise<Evidence> => {
     const evidence = await resolve(raw, path, borrowable);
     if (
-      evidence.predicate_type !== "rea.analysis" ||
+      evidence.predicate_type !== ANALYSIS_EVIDENCE_PREDICATE ||
       !operations.includes(evidence.operation) ||
       evidence.subject === null
     ) {