@nifrajs/core 4.0.2 → 5.1.0

package/src/assurance.ts

@@ -48,6 +48,80 @@ export { withRouteAssurance }
 /** Isolated request executor used by adversarial contract verification. */
 export type InvariantExecutor = (request: Request) => Response | Promise<Response>
 
+export type ContractTarget = "headers" | "cookies" | "params" | "body" | "query" | "response"
+export type ContractCaseKind = "input-rejection" | "response-conformance"
+export type ContractAuthContext = "authenticated" | "unauthenticated"
+
+export interface ContractExpectedResponse {
+  readonly status: number
+  readonly contentType?: "json" | "text"
+  readonly headers?: Readonly<Record<string, string>>
+  /** When present, the decoded body is compared byte-structure-wise to this value. */
+  readonly body?: unknown
+}
+
+/** A known-good request. Missing body/query values are synthesized from inspectable JSON Schema. */
+export interface ContractWitness {
+  readonly params?: Readonly<Record<string, string>>
+  readonly query?: unknown
+  readonly body?: unknown
+  readonly headers?: ConstructorParameters<typeof Headers>[0]
+  /** Explicit auth state for the prepareRequest hook; the harness never invents credentials. */
+  readonly auth?: ContractAuthContext
+  /** Expected response for a guard/error witness. Omit for the normal success witness. */
+  readonly expected?: ContractExpectedResponse
+}
+
+/** Stable context passed to request/rejection hooks. It contains no request payloads or secrets. */
+export interface ContractCaseContext {
+  readonly seed: number
+  readonly caseId: string
+  readonly route: ReflectedRoute
+  readonly runtime: string
+  readonly kind: ContractCaseKind
+  readonly target: ContractTarget
+  readonly auth?: ContractAuthContext
+  readonly mutation?: string
+}
+
+/** What `invariants.setup` provisions for one L4 run. */
+export interface InvariantSetupResult {
+  /** The isolated target for this run. Replaces `invariants.executor`. */
+  readonly executor?: InvariantExecutor
+  /** Called once the run ends, after a failure too. */
+  readonly teardown?: () => void | Promise<void>
+}
+
+/** Provisions a throwaway L4 target. Called once, before the first L4 request - never on import. */
+export type InvariantSetup = () => Promise<InvariantSetupResult | undefined | void>
+
+/** Fixture options handed to the L4 contract runner (`runAdversarialContract` in `@nifrajs/testing`). */
+export interface InvariantRunOptions {
+  /** Known-good request values keyed by `"METHOD /path"`. Required for opaque Standard Schemas. */
+  readonly witnesses?: Readonly<Record<string, ContractWitness>>
+  /** Attach a session, real row ids or signed tokens. Return a new Request. */
+  readonly prepareRequest?: (
+    request: Request,
+    context: ContractCaseContext,
+  ) => Request | Promise<Request>
+  /** Override rejection semantics, for an app with a custom validation response. */
+  readonly isRejected?: (
+    response: Response,
+    context: ContractCaseContext,
+  ) => boolean | Promise<boolean>
+  /** Run L4 on a subset of the reflected routes. */
+  readonly include?: (route: ReflectedRoute) => boolean
+  /** Maximum validator-proven mutations per body/query schema. Default 32. */
+  readonly maxMutationsPerInput?: number
+}
+
+/** L4 configuration: an isolated `executor`, a `setup` that provisions one, or both. */
+export type InvariantsConfig = InvariantRunOptions &
+  (
+    | { readonly executor: InvariantExecutor; readonly setup?: InvariantSetup }
+    | { readonly executor?: InvariantExecutor; readonly setup: InvariantSetup }
+  )
+
 /** Canonical evidence ids emitted by Nifra's official middleware modules. */
 export const NIFRA_ASSURANCE = NIFRA_ASSURANCE_IDS
 
@@ -103,8 +177,14 @@ export function assure(
 }
 
 export interface AssuranceRouteSelector {
-  /** Omit for every method. */
-  readonly methods?: readonly Method[]
+  /** Omit for every method. `"WS"` selects WebSocket routes. */
+  readonly methods?: readonly (Method | "WS")[]
+  /**
+   * Skip routes under these methods; `"WS"` skips WebSocket routes. Every other method matches, a
+   * custom one such as `PURGE` included, so `["GET", "HEAD", "OPTIONS", "WS"]` selects every route
+   * that can change state.
+   */
+  readonly exceptMethods?: readonly (Method | "WS")[]
   /** Absolute route globs. `*` matches one segment; final `**` matches zero or more. */
   readonly paths?: readonly string[]
   /** Restrict the rule to MCP tool routes (`true`) or non-tool routes (`false`). */
@@ -147,6 +227,12 @@ export interface AssuranceRouteSelector {
    * already carries `schema.body`, so this reads what the route declared, not where it lives.
    */
   readonly hasBody?: boolean
+  /**
+   * Match routes by whether they declare a success `response` schema - the routes a response contract
+   * can hold to anything. Pair it with `require: ["nifra.response-contract"]` to say "every route
+   * that declares a response enforces it" without listing the routes that declare none.
+   */
+  readonly hasResponse?: boolean
   /**
    * Match routes by their effective transport body policy. `"unlimited"` is the explicit
    * streaming/upload exemption; `"bounded"` is any finite cap (an explicit number or the inherited
@@ -179,7 +265,9 @@ const usesClassSelector = (selector: AssuranceRouteSelector): boolean =>
 
 /** The rules whose selector needs capability definitions to mean anything. */
 function rulesNeedingDefinitions(policy: AssurancePolicy): readonly string[] {
-  return policy.rules.filter((rule) => usesClassSelector(rule.match)).map((rule) => rule.name)
+  return [...policy.rules, ...(policy.baseline ?? [])]
+    .filter((rule) => usesClassSelector(rule.match))
+    .map((rule) => rule.name)
 }
 
 function definitionMap(
@@ -214,6 +302,13 @@ export interface AssuranceRule {
 export interface AssurancePolicy {
   /** First matching rule owns a route. Put exceptions before broad defaults. */
   readonly rules: readonly AssuranceRule[]
+  /**
+   * Rules checked on EVERY route they match, in addition to the first-match rule that owns it - for a
+   * requirement that holds across classes ("every route declaring a response enforces it"), which
+   * first-match-wins would otherwise make you repeat in each rule. A baseline rule does not classify a
+   * route: one no `rules` entry matches is still unclassified. Names share one namespace with `rules`.
+   */
+  readonly baseline?: readonly AssuranceRule[]
   /** Default `error`: an unclassified route fails closed. */
   readonly unmatched?: "error" | "ignore"
   /** Default false: reject an empty reflected source so a wrong import cannot pass CI silently. */
@@ -292,9 +387,7 @@ export interface AssuranceConfig {
     readonly signer?: (keyRef: string) => NifraManifestSigner | Promise<NifraManifestSigner>
   }
   /** Dynamic invariant execution is opt-in and must use a disposable/sandboxed target. */
-  readonly invariants?: {
-    readonly executor: InvariantExecutor
-  }
+  readonly invariants?: InvariantsConfig
   /** Optional application-supplied rule packs appended after built-in verification rules. */
   readonly rulePacks?: readonly AssuranceRulePack[]
   /** Optional sink for an assurance bundle. The CLI validates the callable shape at runtime. */
@@ -307,6 +400,23 @@ export interface AssuranceConfig {
 
 const nonEmpty = (value: string): boolean => value.trim() !== ""
 
+/** A selector's method list, upper-cased. Standard methods and `"WS"` only, so a typo throws rather
+ * than leaving a rule that never matches. */
+function selectorMethods(
+  values: readonly string[] | undefined,
+): readonly (Method | "WS")[] | undefined {
+  if (values === undefined) return undefined
+  return Object.freeze(
+    values.map((value): Method | "WS" => {
+      const method = value.toUpperCase()
+      if (method !== "WS" && !validMethod(method)) {
+        throw new Error(`route assurance: unsupported HTTP method ${JSON.stringify(method)}`)
+      }
+      return method
+    }),
+  )
+}
+
 function normalizeEvidenceIds(
   values: readonly string[] | undefined,
   label: string,
@@ -343,8 +453,11 @@ export function defineAssurancePolicy(policy: AssurancePolicy): AssurancePolicy
   ) {
     throw new Error(`route assurance: flagClassifiedWithoutEvidence must be boolean`)
   }
+  if (policy.baseline !== undefined && !Array.isArray(policy.baseline)) {
+    throw new Error("route assurance: baseline must be an array of rules")
+  }
   const names = new Set<string>()
-  const rules = policy.rules.map((rule): AssuranceRule => {
+  const normalize = (rule: AssuranceRule): AssuranceRule => {
     if (typeof rule.name !== "string" || !nonEmpty(rule.name)) {
       throw new Error("route assurance: rule name must be non-empty")
     }
@@ -359,12 +472,14 @@ export function defineAssurancePolicy(policy: AssurancePolicy): AssurancePolicy
       (key) =>
         ![
           "methods",
+          "exceptMethods",
           "paths",
           "tools",
           "capabilities",
           ...CLASS_SELECTOR_KEYS,
           "classificationAtLeast",
           "hasBody",
+          "hasResponse",
           "bodyLimit",
         ].includes(key),
     )
@@ -380,10 +495,12 @@ export function defineAssurancePolicy(policy: AssurancePolicy): AssurancePolicy
         `route assurance: rule ${JSON.stringify(name)} tools selector must be boolean`,
       )
     }
-    if (rule.match.hasBody !== undefined && typeof rule.match.hasBody !== "boolean") {
-      throw new Error(
-        `route assurance: rule ${JSON.stringify(name)} hasBody selector must be boolean`,
-      )
+    for (const key of ["hasBody", "hasResponse"] as const) {
+      if (rule.match[key] !== undefined && typeof rule.match[key] !== "boolean") {
+        throw new Error(
+          `route assurance: rule ${JSON.stringify(name)} ${key} selector must be boolean`,
+        )
+      }
     }
     if (
       rule.match.bodyLimit !== undefined &&
@@ -397,7 +514,7 @@ export function defineAssurancePolicy(policy: AssurancePolicy): AssurancePolicy
     }
     // An empty list matches nothing, so the rule is inert and its routes fall through to whatever
     // laxer rule comes next - the same hole as a dropped key, the other way round.
-    for (const key of ["methods", "paths"] as const) {
+    for (const key of ["methods", "exceptMethods", "paths"] as const) {
       const list = rule.match[key]
       if (list !== undefined && (!Array.isArray(list) || list.length === 0)) {
         throw new Error(
@@ -405,12 +522,8 @@ export function defineAssurancePolicy(policy: AssurancePolicy): AssurancePolicy
         )
       }
     }
-    const methods = rule.match.methods?.map((method) => method.toUpperCase())
-    for (const method of methods ?? []) {
-      if (!validMethod(method)) {
-        throw new Error(`route assurance: unsupported HTTP method ${JSON.stringify(method)}`)
-      }
-    }
+    const methods = selectorMethods(rule.match.methods)
+    const exceptMethods = selectorMethods(rule.match.exceptMethods)
     const paths = rule.match.paths?.map((path) => {
       routeGlob(path)
       return path
@@ -480,21 +593,23 @@ export function defineAssurancePolicy(policy: AssurancePolicy): AssurancePolicy
         `route assurance: rule ${JSON.stringify(name)} both requires and forbids ${overlap}`,
       )
     }
+    const match: { -readonly [K in keyof AssuranceRouteSelector]: AssuranceRouteSelector[K] } = {}
+    if (methods !== undefined) match.methods = methods
+    if (exceptMethods !== undefined) match.exceptMethods = exceptMethods
+    if (paths !== undefined) match.paths = Object.freeze(paths)
+    if (rule.match.tools !== undefined) match.tools = rule.match.tools
+    if (capabilities !== undefined) match.capabilities = Object.freeze([...capabilities])
+    if (access !== undefined) match.access = access
+    if (zone !== undefined) match.zone = zone
+    if (rule.match.classificationAtLeast !== undefined) {
+      match.classificationAtLeast = rule.match.classificationAtLeast
+    }
+    if (rule.match.hasBody !== undefined) match.hasBody = rule.match.hasBody
+    if (rule.match.hasResponse !== undefined) match.hasResponse = rule.match.hasResponse
+    if (rule.match.bodyLimit !== undefined) match.bodyLimit = rule.match.bodyLimit
     return Object.freeze({
       name,
-      match: Object.freeze({
-        ...(methods !== undefined ? { methods: Object.freeze(methods as Method[]) } : {}),
-        ...(paths !== undefined ? { paths: Object.freeze(paths) } : {}),
-        ...(rule.match.tools !== undefined ? { tools: rule.match.tools } : {}),
-        ...(capabilities !== undefined ? { capabilities: Object.freeze([...capabilities]) } : {}),
-        ...(access !== undefined ? { access } : {}),
-        ...(zone !== undefined ? { zone } : {}),
-        ...(rule.match.classificationAtLeast !== undefined
-          ? { classificationAtLeast: rule.match.classificationAtLeast }
-          : {}),
-        ...(rule.match.hasBody !== undefined ? { hasBody: rule.match.hasBody } : {}),
-        ...(rule.match.bodyLimit !== undefined ? { bodyLimit: rule.match.bodyLimit } : {}),
-      }),
+      match: Object.freeze(match),
       require: required,
       forbid: forbidden,
       ...(rule.requireProvenance !== undefined
@@ -502,15 +617,75 @@ export function defineAssurancePolicy(policy: AssurancePolicy): AssurancePolicy
         : {}),
       ...(rule.requireCsrfWithAuthenticated === true ? { requireCsrfWithAuthenticated: true } : {}),
     })
-  })
+  }
+  const rules = policy.rules.map(normalize)
+  const baseline = (policy.baseline ?? []).map(normalize)
   return Object.freeze({
     rules: Object.freeze(rules),
+    ...(baseline.length > 0 ? { baseline: Object.freeze(baseline) } : {}),
     unmatched: policy.unmatched ?? "error",
     allowEmpty: policy.allowEmpty ?? false,
     flagClassifiedWithoutEvidence: policy.flagClassifiedWithoutEvidence ?? false,
   })
 }
 
+const INVARIANT_FUNCTIONS = [
+  "executor",
+  "setup",
+  "prepareRequest",
+  "isRejected",
+  "include",
+] as const
+
+function assertInvariantsConfig(invariants: InvariantsConfig): void {
+  if (invariants === null || typeof invariants !== "object") {
+    throw new TypeError("route assurance: invariants must be an object")
+  }
+  for (const name of INVARIANT_FUNCTIONS) {
+    const value: unknown = invariants[name]
+    if (value !== undefined && typeof value !== "function") {
+      throw new TypeError(
+        name === "executor"
+          ? "route assurance: invariant executor must be a function"
+          : `route assurance: invariants.${name} must be a function`,
+      )
+    }
+  }
+  if (invariants.executor === undefined && invariants.setup === undefined) {
+    throw new TypeError("route assurance: invariants needs an executor or a setup")
+  }
+  const witnesses: unknown = invariants.witnesses
+  if (witnesses !== undefined) {
+    if (witnesses === null || typeof witnesses !== "object" || Array.isArray(witnesses)) {
+      throw new TypeError(
+        'route assurance: invariants.witnesses must map "METHOD /path" to a witness',
+      )
+    }
+    for (const [key, witness] of Object.entries(witnesses)) {
+      if (witness === null || typeof witness !== "object" || Array.isArray(witness)) {
+        throw new TypeError(
+          `route assurance: invariants.witnesses[${JSON.stringify(key)}] must be an object`,
+        )
+      }
+    }
+  }
+  const max = invariants.maxMutationsPerInput
+  if (max !== undefined && (!Number.isSafeInteger(max) || max < 1)) {
+    throw new RangeError(
+      "route assurance: invariants.maxMutationsPerInput must be a positive integer",
+    )
+  }
+}
+
+function frozenInvariantsConfig(invariants: InvariantsConfig): InvariantsConfig {
+  const witnesses = invariants.witnesses
+  return Object.freeze(
+    witnesses === undefined
+      ? { ...invariants }
+      : { ...invariants, witnesses: Object.freeze({ ...witnesses }) },
+  )
+}
+
 /** Identity helper for a `nifra.assurance.ts` default export. */
 export function defineAssuranceConfig(config: AssuranceConfig): AssuranceConfig {
   if (config.manifest?.path !== undefined && config.manifest.path.trim() === "") {
@@ -519,9 +694,7 @@ export function defineAssuranceConfig(config: AssuranceConfig): AssuranceConfig
   if (config.manifest?.signer !== undefined && typeof config.manifest.signer !== "function") {
     throw new Error("route assurance: manifest signer must be a function")
   }
-  if (config.invariants !== undefined && typeof config.invariants.executor !== "function") {
-    throw new Error("route assurance: invariant executor must be a function")
-  }
+  if (config.invariants !== undefined) assertInvariantsConfig(config.invariants)
   if (config.rulePacks !== undefined) {
     if (!Array.isArray(config.rulePacks))
       throw new TypeError("route assurance: rulePacks must be an array")
@@ -584,7 +757,7 @@ export function defineAssuranceConfig(config: AssuranceConfig): AssuranceConfig
   // that passes capability assurance, so the rule would match nothing.
   if (capabilities !== undefined) {
     const defined = new Set(capabilities.definitions.map((definition) => definition.id))
-    for (const rule of policy.rules) {
+    for (const rule of [...policy.rules, ...(policy.baseline ?? [])]) {
       const undefinedToken = rule.match.capabilities?.find((token) => !defined.has(token))
       if (undefinedToken !== undefined) {
         throw new Error(
@@ -616,7 +789,7 @@ export function defineAssuranceConfig(config: AssuranceConfig): AssuranceConfig
         }
       : {}),
     ...(config.invariants !== undefined
-      ? { invariants: Object.freeze({ executor: config.invariants.executor }) }
+      ? { invariants: frozenInvariantsConfig(config.invariants) }
       : {}),
     ...(config.rulePacks !== undefined ? { rulePacks: Object.freeze([...config.rulePacks]) } : {}),
     ...(config.assureSink !== undefined ? { assureSink: config.assureSink } : {}),
@@ -656,12 +829,15 @@ export function matchesAssuranceSelector(
   definitions?: ReadonlyMap<string, CapabilityDefinition>,
 ): boolean {
   const { methods, paths, tools, capabilities, access, zone, classificationAtLeast } = selector
-  const { hasBody, bodyLimit } = selector
-  if (methods !== undefined && !methods.includes(route.method as Method)) return false
+  const { exceptMethods, hasBody, hasResponse, bodyLimit } = selector
+  if (methods !== undefined && !methods.includes(route.method as Method | "WS")) return false
+  if (exceptMethods?.some((method) => method === route.method) === true) return false
   if (paths !== undefined && !paths.some((pattern) => routeGlob(pattern).test(route.path)))
     return false
   if (tools !== undefined && (route.tool !== undefined) !== tools) return false
   if (hasBody !== undefined && (route.schema?.body !== undefined) !== hasBody) return false
+  if (hasResponse !== undefined && (route.schema?.response !== undefined) !== hasResponse)
+    return false
   if (bodyLimit !== undefined && effectiveBodyLimit(route.schema) !== bodyLimit) return false
   if (
     classificationAtLeast !== undefined &&
@@ -687,7 +863,61 @@ export function matchesAssuranceSelector(
   return true
 }
 
-/** Evaluate reflected route evidence against the first matching policy rule. */
+/** One rule's missing and forbidden evidence on one route, each also reported as a finding. */
+function checkAssuranceRule(
+  rule: AssuranceRule,
+  route: Pick<ReflectedRoute, "method" | "path">,
+  evidence: readonly AssuranceEvidence[],
+  evidenceIds: ReadonlySet<string>,
+  findings: AssuranceFinding[],
+): { readonly missing: readonly string[]; readonly forbidden: readonly string[] } {
+  const requiredProvenance = rule.requireProvenance ?? "any"
+  const missing = (rule.require ?? []).filter((id) => {
+    if (!evidenceIds.has(id)) return true
+    if (requiredProvenance === "any") return false
+    return !evidence.some(
+      (item) => item.id === id && evidenceProvenance(item) === requiredProvenance,
+    )
+  })
+  const forbidden = (rule.forbid ?? []).filter((id) => evidenceIds.has(id))
+  if (
+    rule.requireCsrfWithAuthenticated === true &&
+    evidenceIds.has(NIFRA_ASSURANCE_IDS.AUTHENTICATED) &&
+    !evidence.some(
+      (item) => item.id === NIFRA_ASSURANCE_IDS.CSRF && evidenceProvenance(item) === "runtime",
+    ) &&
+    !missing.includes(NIFRA_ASSURANCE_IDS.CSRF)
+  ) {
+    missing.push(NIFRA_ASSURANCE_IDS.CSRF)
+  }
+  for (const id of missing) {
+    findings.push({
+      code: "missing-evidence",
+      method: route.method,
+      path: route.path,
+      rule: rule.name,
+      evidence: id,
+      message:
+        requiredProvenance === "any"
+          ? `${route.method} ${route.path} (${rule.name}) is missing ${id}`
+          : `${route.method} ${route.path} (${rule.name}) is missing ${requiredProvenance} evidence for ${id}`,
+    })
+  }
+  for (const id of forbidden) {
+    findings.push({
+      code: "forbidden-evidence",
+      method: route.method,
+      path: route.path,
+      rule: rule.name,
+      evidence: id,
+      message: `${route.method} ${route.path} (${rule.name}) carries forbidden ${id}`,
+    })
+  }
+  return { missing, forbidden }
+}
+
+/** Evaluate reflected route evidence against the first matching policy rule, plus every matching
+ * baseline rule. */
 export function evaluateRouteAssurance(
   source: unknown,
   policyInput: AssurancePolicy,
@@ -726,6 +956,13 @@ export function evaluateRouteAssurance(
     )
     const evidence = route.assurance ?? []
     const evidenceIds = new Set(evidence.map((item) => item.id))
+    const missing: string[] = []
+    const forbidden: string[] = []
+    const hold = (candidate: AssuranceRule): void => {
+      const outcome = checkAssuranceRule(candidate, route, evidence, evidenceIds, findings)
+      for (const id of outcome.missing) if (!missing.includes(id)) missing.push(id)
+      for (const id of outcome.forbidden) if (!forbidden.includes(id)) forbidden.push(id)
+    }
     if (rule === undefined) {
       if (policy.unmatched !== "ignore") {
         findings.push({
@@ -735,82 +972,33 @@ export function evaluateRouteAssurance(
           message: `${route.method} ${route.path} is not classified by an assurance rule`,
         })
       }
-      routes.push({
-        method: route.method,
-        path: route.path,
-        evidence,
-        missing: [],
-        forbidden: [],
-        ...(route.schema?.response !== undefined || route.schema?.errors !== undefined
-          ? { responseContract: route.responseContract ?? "unchecked" }
-          : {}),
-      })
-      continue
-    }
-
-    const requiredProvenance = rule.requireProvenance ?? "any"
-    let missing = (rule.require ?? []).filter((id) => {
-      if (!evidenceIds.has(id)) return true
-      if (requiredProvenance === "any") return false
-      return !evidence.some(
-        (item) => item.id === id && evidenceProvenance(item) === requiredProvenance,
-      )
-    })
-    const forbidden = (rule.forbid ?? []).filter((id) => evidenceIds.has(id))
-    if (
-      rule.requireCsrfWithAuthenticated === true &&
-      evidenceIds.has(NIFRA_ASSURANCE_IDS.AUTHENTICATED) &&
-      !evidence.some(
-        (item) => item.id === NIFRA_ASSURANCE_IDS.CSRF && evidenceProvenance(item) === "runtime",
-      )
-    ) {
-      const id = NIFRA_ASSURANCE_IDS.CSRF
-      if (!missing.includes(id)) missing = [...missing, id]
-    }
-    for (const id of missing) {
-      findings.push({
-        code: "missing-evidence",
-        method: route.method,
-        path: route.path,
-        rule: rule.name,
-        evidence: id,
-        message:
-          requiredProvenance === "any"
-            ? `${route.method} ${route.path} (${rule.name}) is missing ${id}`
-            : `${route.method} ${route.path} (${rule.name}) is missing ${requiredProvenance} evidence for ${id}`,
-      })
-    }
-    for (const id of forbidden) {
-      findings.push({
-        code: "forbidden-evidence",
-        method: route.method,
-        path: route.path,
-        rule: rule.name,
-        evidence: id,
-        message: `${route.method} ${route.path} (${rule.name}) carries forbidden ${id}`,
-      })
+    } else {
+      hold(rule)
+      // Opt-in visibility: a pure-classification rule (no require + no forbid) matching a route with
+      // zero evidence is a "label without proof". Surface it so the gap isn't silently green. A rule
+      // that expects or forbids evidence already speaks for itself, so it's excluded here.
+      if (
+        policy.flagClassifiedWithoutEvidence === true &&
+        evidence.length === 0 &&
+        (rule.require ?? []).length === 0 &&
+        (rule.forbid ?? []).length === 0
+      ) {
+        findings.push({
+          code: "classified-no-evidence",
+          method: route.method,
+          path: route.path,
+          rule: rule.name,
+          message: `${route.method} ${route.path} (${rule.name}) is classified but carries no enforcement evidence`,
+        })
+      }
     }
-    // Opt-in visibility: a pure-classification rule (no require + no forbid) matching a route with zero
-    // evidence is a "label without proof". Surface it so the gap isn't silently green. A rule that expects
-    // or forbids evidence already speaks for itself via the loops above, so it's excluded here.
-    if (
-      policy.flagClassifiedWithoutEvidence === true &&
-      evidence.length === 0 &&
-      (rule.require ?? []).length === 0 &&
-      (rule.forbid ?? []).length === 0
-    ) {
-      findings.push({
-        code: "classified-no-evidence",
-        method: route.method,
-        path: route.path,
-        rule: rule.name,
-        message: `${route.method} ${route.path} (${rule.name}) is classified but carries no enforcement evidence`,
-      })
+    for (const candidate of policy.baseline ?? []) {
+      if (matchesAssuranceSelector(route, candidate.match, definitions)) hold(candidate)
     }
     routes.push({
       method: route.method,
       path: route.path,
-      rule: rule.name,
+      ...(rule === undefined ? {} : { rule: rule.name }),
       evidence,
       missing: Object.freeze(missing),
       forbidden: Object.freeze(forbidden),