refactor(evidence): unify retained inputs across domains (#8299)

Declare logical Evidence sources once and resolve exact retained inputs through
shared application workflows across 20 composition tools. Preserve domain-owned
authentication, source closure, caller choices, coverage and resource admission.

Validation includes public CLI/MCP regressions, local Codex terra/high trials
and fresh-import real-artifact workflows. Measurements, failed attempts and
coverage limits are recorded in docs/verification/evidence-input-composition-2026-10-31.md.

Fixes #8293.
Fixes #8281.

Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)

src/cli/sourceToBundleCommand.ts

@@ -1,4 +1,3 @@
-import { projectCliAnalysisResult } from "./projectCliAnalysisResult.js";
 import { z } from "incur";
 import type { Logger } from "pino";
 import type { CliInstance } from "./types.js";
@@ -6,11 +5,11 @@ import { CLI_COMMANDS } from "../cliCommandNames.js";
 import { parseCliJsonInput } from "../cliJsonInput.js";
 import { logCliCommand } from "../cliLogging.js";
 import { compareSourceToBundleCliInputSchema } from "../contracts/javascript/applicationWorkflowInputContracts.js";
-import { analysisInputErrorFromIssues } from "../domain/inputIssueProjection.js";
-import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
-import { ArtifactResourceScope } from "../artifacts/ArtifactResourceScope.js";
 import { withCommandCancellation } from "./commandCancellation.js";
-import { finishAnalysisCommand } from "./finishAnalysisCommand.js";
+import {
+  evidenceBundleOption,
+  runEvidenceInputCommand,
+} from "./evidenceInputCommand.js";
 
 /** CLI file transport delegates graph authentication and comparison to the same owners as MCP. */
 export const registerSourceToBundleCommand = (
@@ -24,50 +23,30 @@ export const registerSourceToBundleCommand = (
     args: z.object({
       inputJson: z.string().describe("Inline workflow JSON or JSON file path"),
     }),
-    run: ({ args }) =>
+    options: z.object({ evidenceBundle: evidenceBundleOption }),
+    run: ({ args, options }) =>
       withCommandCancellation((signal) =>
         logCliCommand(logger, name, async () => {
           const input = await parseCliJsonInput(args.inputJson, name, signal);
           if (!input.ok) return input.error;
-          const parsed = compareSourceToBundleCliInputSchema.safeParse(
-            input.value,
-          );
-          if (!parsed.success)
-            return {
-              error: "Application workflow failed",
-              ...projectAnalysisError(
-                analysisInputErrorFromIssues(
-                  name,
-                  parsed.error.issues,
-                  input.value,
-                ),
-              ),
-            };
-          const resources = new ArtifactResourceScope();
-          const result = await finishAnalysisCommand(
-            async () => {
-              const { resolveSourceToBundleReference } =
-                await import("../application/javascript/SourceToBundleReference.js");
-              const reference = await resolveSourceToBundleReference(
-                parsed.data.reference,
-                signal,
-                resources,
-              );
-              if (!reference.ok) return reference;
-              const { compareSourceToBundleEvidence } =
+          const result = await runEvidenceInputCommand(
+            "compare_source_to_bundle",
+            options.evidenceBundle,
+            signal,
+            async (lookup, resources) => {
+              const { executeSourceToBundleComparison } =
                 await import("../application/javascript/JavaScriptApplicationWorkflowService.js");
-              const compared = compareSourceToBundleEvidence({
-                ...reference.value,
-                application: parsed.data.application,
-              });
+              const compared = await executeSourceToBundleComparison(
+                input.value,
+                compareSourceToBundleCliInputSchema,
+                lookup,
+                resources,
+                { signal },
+              );
               return compared.ok
                 ? { ok: true, value: compared.value.evidence }
                 : compared;
             },
-            resources,
-            "javascript-application-workflow",
-            "compare_source_to_bundle",
-            signal,
           );
           return result.ok
             ? result.value