Expose SBOM controlled source evidence

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f

src/activity_core/rules/executor.py

@@ -762,6 +762,22 @@ def _sbom_catchup_report(instr: Any, catchup: dict) -> InstructionResult:
     updated = [r for r in catchup.get("updated", []) if isinstance(r, dict)]
     skipped = [r for r in catchup.get("skipped", []) if isinstance(r, dict)]
     limit = catchup.get("limit")
+    selected_repos = []
+    controlled_source_count = 0
+    for repo in selected:
+        item = {
+            "repo_slug": repo.get("repo_slug"),
+            "sbom_age_days": repo.get("sbom_age_days"),
+            "has_sbom": repo.get("has_sbom"),
+            "last_sbom_at": repo.get("last_sbom_at"),
+            "checkout_available": repo.get("checkout_available"),
+        }
+        source_ref = _safe_sbom_source_ref(repo.get("source_ref"))
+        if source_ref is not None:
+            item["source_ref"] = source_ref
+            controlled_source_count += 1
+        selected_repos.append(item)
+
     report: dict[str, Any] = {
         "summary": (
             f"SBOM catch-up: {len(selected)} selected (limit {limit}), "
@@ -773,19 +789,11 @@ def _sbom_catchup_report(instr: Any, catchup: dict) -> InstructionResult:
         "deterministic": True,
         "limit": limit,
         "selected_count": len(selected),
+        "controlled_source_count": controlled_source_count,
         "stale_count": catchup.get("stale_count"),
         "never_count": catchup.get("never_count"),
         "total_count": catchup.get("total_count"),
-        "selected_repos": [
-            {
-                "repo_slug": r.get("repo_slug"),
-                "sbom_age_days": r.get("sbom_age_days"),
-                "has_sbom": r.get("has_sbom"),
-                "last_sbom_at": r.get("last_sbom_at"),
-                "checkout_available": r.get("checkout_available"),
-            }
-            for r in selected
-        ],
+        "selected_repos": selected_repos,
         "updated_repos": [r.get("repo_slug") for r in updated],
         "skipped_repos": [
             {"repo_slug": r.get("repo_slug"), "reason": r.get("reason")}
@@ -803,6 +811,23 @@ def _sbom_catchup_report(instr: Any, catchup: dict) -> InstructionResult:
     )
 
 
+def _safe_sbom_source_ref(raw: Any) -> dict[str, str] | None:
+    """Keep only the reviewable controlled-source identity in progress evidence."""
+    if not isinstance(raw, dict) or raw.get("kind") != "forgejo-archive-v1":
+        return None
+    repository = raw.get("repository")
+    revision = raw.get("revision")
+    if not isinstance(repository, str) or not repository.strip():
+        return None
+    if not isinstance(revision, str) or re.fullmatch(r"[0-9a-f]{40}", revision) is None:
+        return None
+    return {
+        "kind": "forgejo-archive-v1",
+        "repository": repository,
+        "revision": revision,
+    }
+
+
 def _validate_output(
     raw_output: Any,
     instr: Any,