feat(t214): persist candidate observation identities

backend-api/internal/repository/sqlite/execution_result_repository.go

@@ -557,9 +557,7 @@ func validateCandidateEvidence(
 	write usecase.ExecutionResultWrite,
 	candidatesJSON string,
 ) error {
-	var candidates []struct {
-		EvidenceAssetIDs []string `json:"evidence_asset_ids"`
-	}
+	var candidates []usecase.ExecutionCandidate
 	if err := json.Unmarshal([]byte(candidatesJSON), &candidates); err != nil {
 		return usecase.ErrRepositoryInvariant
 	}
@@ -569,6 +567,30 @@ func validateCandidateEvidence(
 		); err != nil {
 			return err
 		}
+		if len(candidate.EvidenceAssetIDs) != 2 {
+			return usecase.ErrTaskStateConflict
+		}
+		expectedHashes := []string{
+			candidate.DetailEvidenceSHA256,
+			candidate.SpecificationEvidenceSHA256,
+		}
+		for index, evidenceID := range candidate.EvidenceAssetIDs {
+			var actualHash string
+			err := tx.QueryRowContext(
+				ctx,
+				`SELECT sha256 FROM execution_evidence_assets
+				WHERE id = ? AND task_id = ? AND execution_id = ?`,
+				evidenceID,
+				write.TaskID,
+				write.ExecutionID,
+			).Scan(&actualHash)
+			if err != nil {
+				return repositoryFailure(err)
+			}
+			if actualHash != expectedHashes[index] {
+				return usecase.ErrTaskStateConflict
+			}
+		}
 	}
 	return nil
 }