proof-harness 0.1.0-next.4 → 0.1.0-next.6

package/COMPATIBILITY.md

@@ -11,7 +11,7 @@ Consumers must pin an exact prerelease version, for example:
 ```json
 {
   "devDependencies": {
-    "proof-harness": "0.1.0-next.4"
+    "proof-harness": "0.1.0-next.6"
   }
 }
 ```
@@ -27,6 +27,55 @@ versions rather than guessing how to interpret them.
 
 ## Prerelease migration notes
 
+### 0.1.0-next.6
+
+**Removed: the module-descriptor system.** It served the consumer's planner
+(what a module is for, what a buyer must decide, where answers land) and never
+fed verification, so it is now consumer-owned. Gone from the package:
+
+- CLI commands `modules` and `modules-check` (and the `modules` step inside
+  `build`); the `.proof/module-policy.json` accept-list introduced in
+  `next.5` went with the checker.
+- `proof-harness/shared` exports `ModuleMeta`, `ModuleDecision`,
+  `ModuleInput`, `ModuleDefault`, `ModuleSeam`, `ScannedModule`,
+  `ModulesArtifact`, `MODULE_DESCRIPTOR_SCHEMA_VERSION`, `MODULE_KINDS`,
+  `APPLIED_BY`, `ModuleKind`, `AppliedBy`, `isModuleKind`, `isAppliedBy`.
+- The `proof.config.mjs` keys `artifacts.modules`, `policies.module`,
+  `roots.modules`, `roots.sharedModules`, and `moduleKinds` (now ignored if
+  supplied).
+
+Migration: consumers using the system vendor it from
+`proof-harness@0.1.0-next.5` (Apache-2.0) — `cli/engines/scan_module_meta.mjs`,
+`cli/engines/proof_module_check.mjs`, and `src/shared/module-types.ts` plus the
+two vocabularies above — and point their `module.meta.ts` type imports at the
+vendored copy. Consumers that never ran `proof:modules` are unaffected. Trace,
+mission, and health protocol versions are unchanged.
+
+### 0.1.0-next.5
+
+No artifact schema or protocol changes. Three behavioral changes:
+
+- **`seed.workspace` no longer writes `type`.** The insert carries only
+  `name` plus caller-supplied values — the harness never invents a column
+  value it wasn't given. A schema whose `workspaces` table has required
+  columns without defaults (the conventional template's `type` included)
+  must supply them via `seed.workspace(name, { columns: { … } })` or the new
+  `workspaceColumns` option on `assert.tenantIsolation`, or add a database
+  default.
+- **`createProofServiceClient` refuses non-local targets.** Any
+  `NEXT_PUBLIC_SUPABASE_URL` whose parsed hostname is not
+  `localhost`/`127.0.0.1`/`[::1]` aborts as `unsafe_database` before a
+  client is constructed, because the suite deletes the users and workspaces
+  it seeds. CI setups reaching Supabase through a docker-network hostname
+  call `allowProofServiceHosts(["<host>"])` in code; there is no environment
+  override.
+- **`modules-check` gains an accept-list.** `.proof/module-policy.json`
+  (`schemaVersion: 1`, `acceptedUndescribed: [{ module, reason }]`) lets an
+  adopting consumer record undescribed required-root modules as visible debt
+  instead of turning the check off. Entries that stop applying fail as
+  `module_policy_stale`. Absent file = no acceptances; existing consumers
+  are unaffected.
+
 ### 0.1.0-next.4
 
 No entry-point, artifact schema, or protocol changes. The `mutate` command

package/PROOF_SDK_CONTRACT.md

@@ -9,9 +9,6 @@ instead; this document is for anyone _consuming_ the template.
 
 > **"Manifest" in this document always means the _mission_ manifest**
 > (`.proof/current-mission.json`) — the file that pins what one PR must prove.
-> It is unrelated to a **module descriptor** (`module.meta.ts` →
-> `.proof/modules.json`), which describes what a module is for and what a buyer
-> must decide before using it. See §3.1 below.
 
 - **Version:** 1 (`schemaVersion` in every manifest and artifact)
 - **Stability:** The shapes in this document are the contract. Additive
@@ -534,7 +531,6 @@ Everything the template produces that the consumer consumes.
 | Output                      | Location                                                                       | Emitted by                                           | Cadence                                |
 | --------------------------- | ------------------------------------------------------------------------------ | ---------------------------------------------------- | -------------------------------------- |
 | Capability map              | `.proof/capabilities.json` (gitignored)                                        | `pnpm proof:scan` (via `proof:build` in setup/CI)    | Every setup + CI run                   |
-| Module descriptors          | `.proof/modules.json` (gitignored)                                             | `pnpm proof:modules` (via `proof:build` in setup/CI) | Every setup + CI run                   |
 | Schema + RLS classification | `.proof/schema.json` (gitignored)                                              | `pnpm proof:parse` (via `proof:build` in setup/CI)   | Every setup + CI run                   |
 | Proof action allowlist      | `app/__shared/proof-runtime/action-registry.generated.ts`                      | `pnpm proof:registry`                                | When action requirements/probes change |
 | PR verification status      | GitHub check `Proof`                                                           | `pnpm proof:check` in `.github/workflows/ci.yml`     | Every PR push                          |
@@ -714,82 +710,16 @@ from another commit or whose `specFile` no longer exists with `stale_trace`.
 
 ---
 
-### 3.1 Module descriptors — what exists, and what must be decided
+### 3.1 Module descriptors — moved to the consumer
 
-`.proof/modules.json` answers a different question from everything else here.
-The trace artifacts say _"this claim was proved"_; this one says _"this is what
-exists, and this is what a buyer has to settle before it can be used"_. It is
-what a planning agent reads instead of the template's source, which is the point:
-without it the planner needs the codebase in its context, and that grows with
-every module we write.
-
-Regenerate it with `pnpm proof:modules`. Unlike `schema.json` it needs **no
-Docker, database, or migration aggregate** — it reads the filesystem and
-`capabilities.json`, and takes about a second.
-
-Each entry has a declared half and a derived half:
-
-```jsonc
-{
-  "schemaVersion": 1,
-  "modules": [
-    {
-      // Declared in app/__core/<module>/module.meta.ts
-      "id": "user-auth",
-      "kind": "core", // core | extension | business | generated
-      "purpose": "Signs people in and proves who they are — …",
-      "env": [],
-      "decisions": [
-        {
-          "id": "mfa_enforcement", // snake_case, unique across all modules
-          "ask": "Must people use a second factor to sign in?",
-          "because": "Stricter is safer but adds a step for everyone.",
-          "options": [{ "value": "optional", "means": "…" }],
-          "applied_by": "config", // config | content | code
-          "applies": ["app/__core/user-auth/src/config.ts#MFA_POLICY"],
-        },
-      ],
-      "inputs": [
-        /* values the buyer supplies rather than picks */
-      ],
-      "defaults": [
-        /* what we chose for them, each with a seam */
-      ],
-
-      // Derived from source — never written by hand
-      "path": "app/__core/user-auth",
-      "entities": [], // tables its own migrations create
-      "requires": ["config", "user-management"],
-      "uses_shared": ["ui", "db-supabase"],
-      "actions": [{ "name": "signin", "verb": null, "object": null }],
-      "proven": { "specs": 1, "mutations": 0 },
-    },
-  ],
-  // Tables no descriptor claims — today, the ones owned by __shared modules.
-  "unowned_tables": [
-    {
-      "table": "audit_logs",
-      "module": "audit-logging",
-      "path": "app/__shared/audit-logging",
-    },
-  ],
-}
-```
-
-**Two audiences, one file.** A planner reads `purpose`, `decisions`, `inputs`
-and `applied_by` — business language, no paths, roughly 80 tokens per decision.
-The agent that _applies_ an answer additionally reads `applies`, which names
-every place the answer lands, including files in other modules.
-
-**Every claim is checked.** `pnpm proof:modules:check` fails when a module has
-no descriptor, when an id does not match its directory, when a decision has
-fewer than two options or a duplicate id, when a declared environment variable
-is undocumented or an undeclared one is read, and — the one that matters most in
-practice — **when a seam no longer exists**. A moved file fails CI instead of
-quietly sending the next agent to the wrong place.
-
-Circular dependencies in the derived graph are **reported, not failed**, while a
-known inversion is being resolved.
+Until `0.1.0-next.5` the package also shipped a module-descriptor system
+(`module.meta.ts` → `.proof/modules.json`, plus the `modules` and
+`modules-check` commands). It served the consumer's *planner* — what a module
+is for, what a buyer must decide, where answers land — and never fed
+verification, so as of `0.1.0-next.6` it is consumer-owned and no longer part
+of this package. The last release carrying it is `proof-harness@0.1.0-next.5`
+(Apache-2.0), whose implementation is the reference for consumers vendoring
+the system into their own repository.
 
 ## 4. Failure contract
 
@@ -941,6 +871,21 @@ operation }` assertion has neither a matching mutation nor a valid entry in
   `.proof/mutation-policy.json`, pinned to the current spec hash and a passing
   positive control. A changed/deleted claim, changed spec, missing control, or
   newly added mutation makes the acceptance stale and fails inventory.
+- **A proof run cannot target a hosted database.** `createProofServiceClient`
+  parses `NEXT_PUBLIC_SUPABASE_URL` and hard-aborts as `unsafe_database` on
+  any hostname that is not local — matched on the parsed hostname, never by
+  substring, so `localhost.example.com` does not pass. The suite deletes the
+  auth users and workspaces it seeds; against a hosted project that failure
+  is silent and unrecoverable. There is deliberately no environment-variable
+  override: a genuinely disposable non-local host (a docker-network CI
+  hostname) is allowed in code via `allowProofServiceHosts`, where a reviewer
+  sees it. The mutation runner applies the same refusal to its psql target.
+- **The harness never invents a column value it wasn't given.** Anywhere the
+  package writes to a consumer-owned table, the values are caller-supplied or
+  the column is omitted — tenancy shape is a consumer decision.
+  `seed.workspace` writes only `name`; a schema that requires more states it
+  via `seed.workspace(name, { columns })` or `workspaceColumns` on
+  `assert.tenantIsolation`.
 - **A mutation that is not demonstrably live cannot judge a proof.** The
   mutation runner never (re)applies migrations; it starts (or adopts) the
   shared dev server before the first defect is planted, then reads each

package/README.md

@@ -17,7 +17,7 @@ Public prereleases are published under the npm `next` tag. Pin an exact
 prerelease version while the API is stabilizing:
 
 ```sh
-pnpm add proof-harness@0.1.0-next.4
+pnpm add proof-harness@0.1.0-next.6
 ```
 
 The package exposes environment-specific entry points:
@@ -32,9 +32,37 @@ See [PROOF_SDK_CONTRACT.md](./PROOF_SDK_CONTRACT.md) for the consumer contract
 and [COMPATIBILITY.md](./COMPATIBILITY.md) for protocol/schema compatibility
 and consumer pinning requirements.
 
+## Portability map
+
+The package has two layers; consumers should know which one they are leaning
+on:
+
+- **Assumes nothing about your schema** — trace recording and the assertion
+  vocabulary, mission validation, coverage and its ratchet, drift, mutation
+  testing, and the CLI. These read your generated schema and config, or take
+  what you give them.
+- **Assumes the conventional Supabase/workspace layout** — `seed.*` (a
+  `workspaces` table with a `name` column, a `workspace_members` join table,
+  and a `public.users` mirror maintained by a `handle_new_user` trigger) and
+  `assert.tenantIsolation`, which seeds through those helpers. The seed
+  helpers never invent column values: a schema that requires more than the
+  helpers are given states it via `seed.workspace(name, { columns })` or
+  `workspaceColumns` on `assert.tenantIsolation`.
+
+The `/api/proof/*` routes and the `NEXT_PUBLIC_SUPABASE_URL` /
+`SUPABASE_SECRET_KEY` environment names are documented protocol rather than
+template leakage.
+
+`createProofServiceClient` refuses every non-local Supabase target
+(`unsafe_database`): the proof suite deletes the auth users and workspaces it
+seeds, so a hosted project must never be reachable. A genuinely disposable
+non-local host — a docker-network hostname in CI — is allowed explicitly in
+code via `allowProofServiceHosts`; there is deliberately no environment
+override.
+
 The package also provides one `proof-harness` executable with `scan`, `parse`,
-`registry`, `build`, `verify`, `coverage`, `inventory`, `drift`, `modules`,
-`modules-check`, and `mutate` subcommands. Commands read repository paths from
+`registry`, `build`, `verify`, `coverage`, `inventory`, `drift`, and `mutate`
+subcommands. Commands read repository paths from
 `proof.config.mjs`; without one they use a conventional application layout.
 Product migration aggregation and explicit mutation definitions remain
 repository-owned trust inputs rather than package defaults.

package/cli/config.mjs

@@ -6,11 +6,15 @@ const DEFAULT_CONFIG = Object.freeze({
   artifacts: {
     capabilities: ".proof/capabilities.json",
     schema: ".proof/schema.json",
-    modules: ".proof/modules.json",
     traces: ".proof/traces",
     drift: ".proof/drift.json",
     mutations: ".proof/mutations",
   },
+  // The module-descriptor system (module.meta.ts → modules.json and its
+  // checker) moved to the consumer template in 0.1.0-next.6: it serves the
+  // planner, which is product, not verification. Its former config keys
+  // (artifacts.modules, policies.module, roots.modules, roots.sharedModules,
+  // moduleKinds) are ignored if a proof.config.mjs still supplies them.
   mission: {
     current: ".proof/current-mission.json",
     directory: ".proof/missions",
@@ -23,8 +27,6 @@ const DEFAULT_CONFIG = Object.freeze({
   roots: {
     source: "app",
     actions: ["app/__core", "app/__business-logic", "app/__extensions"],
-    modules: ["app/__core", "app/__extensions", "app/__business-logic"],
-    sharedModules: "app/__shared",
     proofs: "e2e/proofs",
     fixtures: "e2e/fixtures",
     migrations: "supabase/migrations",
@@ -41,13 +43,6 @@ const DEFAULT_CONFIG = Object.freeze({
     envExample: ".env.local.example",
     supabaseConfig: "supabase/config.toml",
   },
-  moduleKinds: {
-    required: [
-      { root: "app/__core", kind: "core" },
-      { root: "app/__extensions", kind: "extension" },
-    ],
-    optional: [{ root: "app/__business-logic", kind: "business" }],
-  },
   driftSources: ["app", "package.json"],
   mutationCatalog: null,
 });
@@ -65,10 +60,6 @@ function mergeConfig(config = {}) {
       ...DEFAULT_CONFIG.registryAliases,
       ...config.registryAliases,
     },
-    moduleKinds: {
-      ...DEFAULT_CONFIG.moduleKinds,
-      ...config.moduleKinds,
-    },
   };
 }
 

package/cli/proof-harness.mjs

@@ -15,8 +15,6 @@ const ENGINES = {
   verify: "proof_verify.mjs",
   coverage: "proof_coverage.mjs",
   drift: "proof_drift.mjs",
-  modules: "scan_module_meta.mjs",
-  "modules-check": "proof_module_check.mjs",
   mutate: "proof_mutation_check.mjs",
 };
 
@@ -24,8 +22,7 @@ function printHelp() {
   console.log(`Usage: proof-harness [--config <path>] <command> [flags]
 
 Commands:
-  scan, parse, registry, build, verify, coverage, inventory, drift,
-  modules, modules-check, mutate
+  scan, parse, registry, build, verify, coverage, inventory, drift, mutate
 
 Repository paths and the protected mutation catalog are read from
 proof.config.mjs. Missing config falls back to a conventional application layout.`);
@@ -74,7 +71,6 @@ export async function runCli(argv = process.argv.slice(2)) {
       ["scan", []],
       ["parse", []],
       ["registry", ["--check"]],
-      ["modules", []],
     ]) {
       const status = runEngine(step, stepArgs, config);
       if (status !== 0) return status;

package/dist/{fixture-B-dmnG5G.d.ts → fixture-DwDOegDK.d.ts}

@@ -25,8 +25,16 @@ declare const seed: {
      *
      * Bypasses RLS via the service-role client, so it works even when no user
      * is authenticated.
+     *
+     * The insert writes only `name` plus whatever `opts.columns` supplies: the
+     * harness never invents a column value it wasn't given, because tenancy
+     * shape is a consumer decision. A schema whose `workspaces` table requires
+     * more than `name` (a NOT NULL column without a default) states those
+     * values here — or via `workspaceColumns` on `assert.tenantIsolation`.
      */
-    workspace(name: string): Promise<SeedWorkspace>;
+    workspace(name: string, opts?: {
+        columns?: Record<string, unknown>;
+    }): Promise<SeedWorkspace>;
     /**
      * Create an auth user with the given credentials and attach them to the
      * provided workspace with the given role. Relies on the `handle_new_user`

package/dist/{mission-types-Dr5rBHYO.d.ts → mission-types-bdwBGf7O.d.ts}

@@ -1,4 +1,4 @@
-import { h as ProofKind, d as AssertionRole, k as ProofVerb, l as RlsClassification, y as PolicyCommand } from './trace-types-DkIzq-l9.js';
+import { d as ProofKind, a as AssertionRole, g as ProofVerb, h as RlsClassification, t as PolicyCommand } from './trace-types-CbMb65OB.js';
 import { ACTION_CHANGE_KINDS, TABLE_CHANGE_KINDS } from './portable-vocabulary.js';
 
 /**
@@ -296,4 +296,4 @@ interface ValidationResult {
     evidence?: RequirementEvidence[];
 }
 
-export { type CapabilityRequirement as C, MISSION_MANIFEST_SCHEMA_VERSION as M, type SchemaRequirement as S, type TraceRequirement as T, type ValidationResult as V, type MissionManifest as a, type MissionRequirements as b, type ValidationCategory as c, type ValidationIssue as d };
+export { type CapabilityRequirement as C, MISSION_MANIFEST_SCHEMA_VERSION as M, type SchemaRequirement as S, type TraceRequirement as T, type ValidationCategory as V, type MissionManifest as a, type MissionRequirements as b, type ValidationIssue as c, type ValidationResult as d };

package/dist/node.d.ts

@@ -1,5 +1,5 @@
-import { V as ValidationResult } from './mission-types-Dr5rBHYO.js';
-import { T as TraceArtifact, a as TraceAssertion } from './trace-types-DkIzq-l9.js';
+import { d as ValidationResult } from './mission-types-bdwBGf7O.js';
+import { j as TraceArtifact, k as TraceAssertion } from './trace-types-CbMb65OB.js';
 import './portable-vocabulary.js';
 
 interface CapabilitiesArtifact {