Add purpose-bound form evidence storage

docs/FILES_HANDBOOK.md

@@ -60,6 +60,7 @@ The main domain objects are:
 | Connector policy | Allow and deny rules inherited from system through tenant to one leaf scope | Evaluated before configuration and connector use |
 | Connector space | A read-only, manually synchronized remote folder/library linked to a user or group space | Created, updated, disabled, and soft-deleted |
 | Campaign attachment use | Evidence connecting a campaign job or entry to an exact asset, version, blob, checksum, and stage | Retained for campaign execution evidence |
+| Form evidence upload grant | A one-use, hash-only bearer grant tied to an exact Form instance/revision, purpose, custodian, size, and media-type policy | Issued for at most 15 minutes, consumed by one managed upload, then retained as evidence provenance |
 
 ## User tasks
 
@@ -649,6 +650,7 @@ public HTTP API. They must not import Files ORM models or storage helpers.
 | `files.access` (`0.1.6`) | Explain resource access provenance for managed files, explicit folders, and virtual folders |
 | `files.campaign_attachments` (`0.1.6`) | Resolve managed attachment matches, prepare frozen campaign snapshots, annotate built messages, share assets with a campaign, and record/mark exact attachment use |
 | `records.source.files` (`1.0.0`) | Recheck current Files access and resolve one exact, integrity-approved managed file version for Records filing |
+| `forms_runtime.evidence.files` (`1.0.0`) | Issue a one-time managed attachment grant and re-verify the exact file/version/checksum at Form submission |
 
 Files requires Core principal resolution and permission evaluation. Campaign is
 an optional dependency; when installed, Files consumes the optional
@@ -659,6 +661,14 @@ requested `FileVersion` identity, path snapshot, content metadata, SHA-256,
 integrity/protection state, and launch link. It rejects mutable aliases,
 cross-tenant requests, missing access, and quarantined or failed blobs. Records
 stores the filing decision; Files continues to own the version and bytes.
+Forms Runtime is optional as well. Its public or authenticated participant never
+receives general Files access through this integration. Forms Runtime asks for a
+purpose-bound grant, Files verifies an active same-tenant user custodian, stores
+only the token digest, accepts one bounded upload, and returns an immutable
+`EvidenceReference`. Draft save and final submit independently recheck the exact
+Form instance/revision, grant, asset, version, checksum, deletion state, and
+integrity state. An idempotent replay returns the existing grant without
+reproducing its bearer secret.
 
 ### API families
 
@@ -678,6 +688,7 @@ All routes below are under `/api/v1/files`.
 | Credentials | `GET/POST /connectors/credentials`, `GET/PATCH/DELETE /connectors/credentials/{credential_id}` |
 | Policy | `GET/PUT /connectors/policies/{scope_type}`, `POST /connector-policy/evaluate` |
 | Incremental connector settings | `GET /connectors/settings/delta` |
+| Form evidence | `POST /form-evidence/upload` with a short-lived `X-Form-Evidence-Token` issued by Forms Runtime |
 
 Consumers should use cursor/watermark contracts instead of assuming an
 unbounded complete list. The default full-list page size is 500 and public page
@@ -715,6 +726,9 @@ Files baseline indiscriminately.
 - Upload, archive extraction, connector response, and S3 stream code use bounded
   reads. Archive previews are sealed and short-lived; ZIP passwords are
   request-only.
+- Public Form evidence uploads require a custom-header bearer grant that is
+  stored only as SHA-256, expires after at most 15 minutes, is bound to one
+  exact submission and user custodian, and can create only one managed file.
 - Connector HTTP sockets use connection-time DNS/IP validation and pinning,
   redirects are refused, and unsafe SDK transports fail before client creation.
 - Database-managed connector passwords/tokens are encrypted; responses redact
@@ -894,6 +908,7 @@ returning different content or credentials.
 | Audit | Connector discovery/import/sync/access and connector deletion; campaign exact-use evidence | Dedicated canonical audit events for every ordinary Files mutation |
 | Preview | File metadata and attachment download | Dedicated safe content-preview service |
 | Campaign | Stable capability-based frozen attachments and sent-use evidence | Campaign-specific process state remains in Campaign |
+| Forms Runtime | One-time managed attachment grants plus exact-version, checksum, deletion, tenant, submission, and integrity verification | Malware scanning and advanced/qualified signature providers remain separate assurance depth |
 | Collaboration | Governed input/output snapshots | Co-editing, comments, review, presence, locks, and semantic document versions belong to Documents/workflow/provider modules |
 
 ## Release and change checklist
@@ -917,7 +932,9 @@ Before releasing Files:
    checksum after the current file changes.
 10. Exercise a committed upload, a rolled-back upload, object tamper detection,
     and applied orphan cleanup; inspect their `files` operations in Ops.
-11. Update the implemented/planned table whenever a boundary changes.
+11. Exercise a Form evidence grant, token replay, wrong-submission reference,
+    expired token, unsupported media type, and quarantined-file rejection.
+12. Update the implemented/planned table whenever a boundary changes.
 
 ## Related documents