proof-harness 0.1.0-next.5 → 0.1.0-next.7

package/COMPATIBILITY.md

@@ -11,7 +11,7 @@ Consumers must pin an exact prerelease version, for example:
 ```json
 {
   "devDependencies": {
-    "proof-harness": "0.1.0-next.5"
+    "proof-harness": "0.1.0-next.6"
   }
 }
 ```
@@ -27,6 +27,100 @@ versions rather than guessing how to interpret them.
 
 ## Prerelease migration notes
 
+### Unreleased audit hardening
+
+Release candidate `0.1.0-next.7` tightens acceptance behavior; it has not been published. Trace
+schema remains 2, with additive source/execution identity fields. Version 1
+and unversioned trace shapes remain explicitly readable, but CLI acceptance
+requires current provenance. Required consumer changes:
+
+- Regenerate traces. `verify`, `coverage`, and mutation inventory share a
+  decoder: corrupt JSON, duplicate proof IDs, unknown vocabulary, and
+  contradictory verdicts fail. Only passing baseline evidence can satisfy
+  claims; mutation evidence is separate. Current spec contents must match
+  `specHash`; in Git worktrees both `commit` and `sourceHash` must match.
+  `sourceHash` includes tracked and untracked nonignored inputs and excludes
+  configured generated artifacts. Run generators before proofs. Non-Git
+  exports cannot establish whole-source freshness and only check spec hashes.
+- Use a dedicated trace directory. The writer honors `artifacts.traces` and
+  the runner's `--traces-dir` override. IDs must use letters, digits, dots,
+  underscores, or hyphens, starting with a letter or digit. Duplicate IDs
+  cannot overwrite another proof; a later Playwright retry of the same test
+  may replace its earlier attempt. Standalone repeated runs need fresh output.
+  Mission aggregates now live at `<traces>/missions/<missionId>.json` to
+  prevent collisions with proof IDs. Cleanup refuses unknown JSON before
+  deleting any trace and rejects repository/ancestor directories, including
+  symlink aliases. Move legacy or corrupt files aside before rerunning.
+- UPDATE denial probes require stable `identityColumns` (default `["id"]`),
+  present and non-null in every target row, excluded from the update payload.
+  The attempted update must change a value. Rereads use original identities,
+  even when a write changes a filter column. SQL errors other than `42501`
+  are incomplete evidence. INSERT probes require a payload absent before the
+  probe and valid for a service-role control insertion; that control is
+  cleaned up. HTTP expectations must contain a status or a nonempty matcher
+  list. Write requests are never automatically retried after transport errors.
+- Capability discovery uses TypeScript syntax analysis for import aliases and
+  multiple actions. Unknown factory/client indirection, escaped service query
+  builders, dynamic table names, and ambiguous metadata block assessment.
+  Discovery still assumes the configured template action layout.
+- The SQL parser is deliberately conservative, not a final PostgreSQL catalog
+  evaluator. Unsupported ALTER/DROP or dynamic SQL makes schema assessment
+  fail. RLS must be explicitly enabled for classification; public ALL/write
+  policies are never exempted as public-read. Policy expressions and mode
+  participate in drift. Resolve unsupported migrations with a catalog-backed
+  integration before using this parser as a gate; do not edit shipped SQL or
+  mark an unassessed artifact assessed to obtain a pass.
+- Drift always regenerates both trees using the installed harness and each
+  tree's consumer configuration. It includes untracked actions, SQL, and
+  lockfiles. For ignored/generated migrations, configure `driftPrepare` as a
+  command argv array (for example `["node", "scripts/aggregate_migrations.mjs",
+  "--fresh"]`). That consumer-owned command runs in each tree before parsing;
+  failure prevents assessment. It must work in the archived tree without an
+  implicit dependency install. The old `driftSources` optimization is unused.
+- Mutations require fresh mapped baseline claims and write isolated traces.
+  SQL applies run as one transaction; recovery is attempted even after a
+  failed apply. Policy snapshots preserve expressions, roles, command, and
+  permissive/restrictive mode. Generic privilege mutations support direct,
+  owner-issued grants without grant options; unsupported inherited/PUBLIC or
+  ownership cases fail before planting. Move old mutation outputs aside on
+  first use: nonempty output directories require a harness ownership marker.
+  An interrupted run leaves `mutation-recovery.json` beside the mutation output
+  directory. Run `proof-harness mutate --recover` against the same local
+  database to restore and verify the journaled subject. A timeout, signal, or
+  incomplete failed claim never counts as detection. Recovery covers the
+  catalog's declared subject and cleanup, not arbitrary undeclared side effects.
+- Partial fixture setup is cleaned up, and cleanup errors now fail the proof.
+
+These checks validate observed evidence. Protect the installed harness,
+configuration, mission, policies, mutation catalog, and CI acceptance job from
+executor edits. Trace metadata is not a signature or a sandbox: it cannot
+establish honesty against an executor allowed to replace the gate or fabricate
+its inputs. Independent product acceptance and a trusted runner remain needed.
+
+### 0.1.0-next.6
+
+**Removed: the module-descriptor system.** It served the consumer's planner
+(what a module is for, what a buyer must decide, where answers land) and never
+fed verification, so it is now consumer-owned. Gone from the package:
+
+- CLI commands `modules` and `modules-check` (and the `modules` step inside
+  `build`); the `.proof/module-policy.json` accept-list introduced in
+  `next.5` went with the checker.
+- `proof-harness/shared` exports `ModuleMeta`, `ModuleDecision`,
+  `ModuleInput`, `ModuleDefault`, `ModuleSeam`, `ScannedModule`,
+  `ModulesArtifact`, `MODULE_DESCRIPTOR_SCHEMA_VERSION`, `MODULE_KINDS`,
+  `APPLIED_BY`, `ModuleKind`, `AppliedBy`, `isModuleKind`, `isAppliedBy`.
+- The `proof.config.mjs` keys `artifacts.modules`, `policies.module`,
+  `roots.modules`, `roots.sharedModules`, and `moduleKinds` (now ignored if
+  supplied).
+
+Migration: consumers using the system vendor it from
+`proof-harness@0.1.0-next.5` (Apache-2.0) — `cli/engines/scan_module_meta.mjs`,
+`cli/engines/proof_module_check.mjs`, and `src/shared/module-types.ts` plus the
+two vocabularies above — and point their `module.meta.ts` type imports at the
+vendored copy. Consumers that never ran `proof:modules` are unaffected. Trace,
+mission, and health protocol versions are unchanged.
+
 ### 0.1.0-next.5
 
 No artifact schema or protocol changes. Three behavioral changes:

package/PROOF_SDK_CONTRACT.md

@@ -9,11 +9,8 @@ instead; this document is for anyone _consuming_ the template.
 
 > **"Manifest" in this document always means the _mission_ manifest**
 > (`.proof/current-mission.json`) — the file that pins what one PR must prove.
-> It is unrelated to a **module descriptor** (`module.meta.ts` →
-> `.proof/modules.json`), which describes what a module is for and what a buyer
-> must decide before using it. See §3.1 below.
 
-- **Version:** 1 (`schemaVersion` in every manifest and artifact)
+- **Versions:** mission manifests 1; proof traces 2; proof health protocol 1.
 - **Stability:** The shapes in this document are the contract. Additive
   changes (new optional fields, new vocabulary entries) do not bump the
   version; breaking changes bump `schemaVersion` and are documented here.
@@ -25,6 +22,17 @@ instead; this document is for anyone _consuming_ the template.
 
 ---
 
+## Current acceptance semantics
+
+The unreleased audit hardening in [COMPATIBILITY.md](COMPATIBILITY.md#unreleased-audit-hardening)
+supersedes older template-specific command examples below. Trace consumers
+must use `decodeTrace`/`decodeTraceBundle` for structural validation and
+`readTraceDirectory` for CLI-equivalent freshness checks. Evidence counts only
+when the proof and step passed, the assertion has a passing consistent verdict,
+and the trace is a baseline rather than a planted mutation. Helper-origin
+metadata is a convention enforced by the writer, not cryptographic attestation.
+The consumer controls and protects the runner and its trust inputs.
+
 ## 1. The loop
 
 ```
@@ -50,7 +58,7 @@ instead; this document is for anyone _consuming_ the template.
 │             │    fails cheaply BEFORE the database proofs run        │
 │             ├─ proof:verify                                          │
 │                 ├─ runs every *.proof.ts spec                        │
-│                 ├─ aggregates  .proof/traces/<missionId>.json        │
+│                 ├─ aggregates  .proof/traces/missions/<missionId>.json        │
 │                 └─ validates manifest requirements against artifacts │
 │             ├─ proof:coverage --strict                               │
 │             └─ proof:inventory → requires mutation or acceptance      │
@@ -534,7 +542,6 @@ Everything the template produces that the consumer consumes.
 | Output                      | Location                                                                       | Emitted by                                           | Cadence                                |
 | --------------------------- | ------------------------------------------------------------------------------ | ---------------------------------------------------- | -------------------------------------- |
 | Capability map              | `.proof/capabilities.json` (gitignored)                                        | `pnpm proof:scan` (via `proof:build` in setup/CI)    | Every setup + CI run                   |
-| Module descriptors          | `.proof/modules.json` (gitignored)                                             | `pnpm proof:modules` (via `proof:build` in setup/CI) | Every setup + CI run                   |
 | Schema + RLS classification | `.proof/schema.json` (gitignored)                                              | `pnpm proof:parse` (via `proof:build` in setup/CI)   | Every setup + CI run                   |
 | Proof action allowlist      | `app/__shared/proof-runtime/action-registry.generated.ts`                      | `pnpm proof:registry`                                | When action requirements/probes change |
 | PR verification status      | GitHub check `Proof`                                                           | `pnpm proof:check` in `.github/workflows/ci.yml`     | Every PR push                          |
@@ -714,82 +721,16 @@ from another commit or whose `specFile` no longer exists with `stale_trace`.
 
 ---
 
-### 3.1 Module descriptors — what exists, and what must be decided
-
-`.proof/modules.json` answers a different question from everything else here.
-The trace artifacts say _"this claim was proved"_; this one says _"this is what
-exists, and this is what a buyer has to settle before it can be used"_. It is
-what a planning agent reads instead of the template's source, which is the point:
-without it the planner needs the codebase in its context, and that grows with
-every module we write.
-
-Regenerate it with `pnpm proof:modules`. Unlike `schema.json` it needs **no
-Docker, database, or migration aggregate** — it reads the filesystem and
-`capabilities.json`, and takes about a second.
-
-Each entry has a declared half and a derived half:
-
-```jsonc
-{
-  "schemaVersion": 1,
-  "modules": [
-    {
-      // Declared in app/__core/<module>/module.meta.ts
-      "id": "user-auth",
-      "kind": "core", // core | extension | business | generated
-      "purpose": "Signs people in and proves who they are — …",
-      "env": [],
-      "decisions": [
-        {
-          "id": "mfa_enforcement", // snake_case, unique across all modules
-          "ask": "Must people use a second factor to sign in?",
-          "because": "Stricter is safer but adds a step for everyone.",
-          "options": [{ "value": "optional", "means": "…" }],
-          "applied_by": "config", // config | content | code
-          "applies": ["app/__core/user-auth/src/config.ts#MFA_POLICY"],
-        },
-      ],
-      "inputs": [
-        /* values the buyer supplies rather than picks */
-      ],
-      "defaults": [
-        /* what we chose for them, each with a seam */
-      ],
-
-      // Derived from source — never written by hand
-      "path": "app/__core/user-auth",
-      "entities": [], // tables its own migrations create
-      "requires": ["config", "user-management"],
-      "uses_shared": ["ui", "db-supabase"],
-      "actions": [{ "name": "signin", "verb": null, "object": null }],
-      "proven": { "specs": 1, "mutations": 0 },
-    },
-  ],
-  // Tables no descriptor claims — today, the ones owned by __shared modules.
-  "unowned_tables": [
-    {
-      "table": "audit_logs",
-      "module": "audit-logging",
-      "path": "app/__shared/audit-logging",
-    },
-  ],
-}
-```
-
-**Two audiences, one file.** A planner reads `purpose`, `decisions`, `inputs`
-and `applied_by` — business language, no paths, roughly 80 tokens per decision.
-The agent that _applies_ an answer additionally reads `applies`, which names
-every place the answer lands, including files in other modules.
-
-**Every claim is checked.** `pnpm proof:modules:check` fails when a module has
-no descriptor, when an id does not match its directory, when a decision has
-fewer than two options or a duplicate id, when a declared environment variable
-is undocumented or an undeclared one is read, and — the one that matters most in
-practice — **when a seam no longer exists**. A moved file fails CI instead of
-quietly sending the next agent to the wrong place.
+### 3.1 Module descriptors — moved to the consumer
 
-Circular dependencies in the derived graph are **reported, not failed**, while a
-known inversion is being resolved.
+Until `0.1.0-next.5` the package also shipped a module-descriptor system
+(`module.meta.ts` → `.proof/modules.json`, plus the `modules` and
+`modules-check` commands). It served the consumer's *planner* — what a module
+is for, what a buyer must decide, where answers land — and never fed
+verification, so as of `0.1.0-next.6` it is consumer-owned and no longer part
+of this package. The last release carrying it is `proof-harness@0.1.0-next.5`
+(Apache-2.0), whose implementation is the reference for consumers vendoring
+the system into their own repository.
 
 ## 4. Failure contract
 
@@ -956,13 +897,6 @@ operation }` assertion has neither a matching mutation nor a valid entry in
   `seed.workspace` writes only `name`; a schema that requires more states it
   via `seed.workspace(name, { columns })` or `workspaceColumns` on
   `assert.tenantIsolation`.
-- **Accepted descriptor gaps expire.** `proof:modules:check` accepts an
-  undescribed required-root module only through `.proof/module-policy.json`
-  (`schemaVersion: 1`, `acceptedUndescribed: [{ module, reason }]`), each
-  entry carrying a written reason, and prints the accepted backlog on every
-  run. An acceptance whose module gains a descriptor or no longer exists
-  fails as `module_policy_stale`, so paid-down debt leaves the file rather
-  than lingering as invisible permission.
 - **A mutation that is not demonstrably live cannot judge a proof.** The
   mutation runner never (re)applies migrations; it starts (or adopts) the
   shared dev server before the first defect is planted, then reads each

package/README.md

@@ -17,7 +17,7 @@ Public prereleases are published under the npm `next` tag. Pin an exact
 prerelease version while the API is stabilizing:
 
 ```sh
-pnpm add proof-harness@0.1.0-next.5
+pnpm add proof-harness@0.1.0-next.6
 ```
 
 The package exposes environment-specific entry points:
@@ -39,8 +39,8 @@ on:
 
 - **Assumes nothing about your schema** — trace recording and the assertion
   vocabulary, mission validation, coverage and its ratchet, drift, mutation
-  testing, module checks, and the CLI. These read your generated schema and
-  config, or take what you give them.
+  testing, and the CLI. These read your generated schema and config, or take
+  what you give them.
 - **Assumes the conventional Supabase/workspace layout** — `seed.*` (a
   `workspaces` table with a `name` column, a `workspace_members` join table,
   and a `public.users` mirror maintained by a `handle_new_user` trigger) and
@@ -61,8 +61,8 @@ code via `allowProofServiceHosts`; there is deliberately no environment
 override.
 
 The package also provides one `proof-harness` executable with `scan`, `parse`,
-`registry`, `build`, `verify`, `coverage`, `inventory`, `drift`, `modules`,
-`modules-check`, and `mutate` subcommands. Commands read repository paths from
+`registry`, `build`, `verify`, `coverage`, `inventory`, `drift`, and `mutate`
+subcommands. Commands read repository paths from
 `proof.config.mjs`; without one they use a conventional application layout.
 Product migration aggregation and explicit mutation definitions remain
 repository-owned trust inputs rather than package defaults.
@@ -91,3 +91,17 @@ Licensed under the [Apache License 2.0](./LICENSE).
 The package is released from this public repository with npm provenance.
 Prerelease consumers must pin an exact version rather than using `next`, `^`, or
 `~`; see [COMPATIBILITY.md](./COMPATIBILITY.md) for the compatibility policy.
+
+## Audit hardening (0.1.0-next.7, unreleased)
+
+The working branch adds shared fail-closed trace ingestion, source freshness,
+stronger authorization probes, isolated mutation evidence and interruption
+recovery, conservative discovery, and package-owned drift regeneration.
+See [required migration changes](COMPATIBILITY.md#unreleased-audit-hardening)
+before upgrading a consumer. In particular, existing traces must be rerun and
+unsupported SQL now blocks assessment.
+
+The harness establishes specific tested claims. Acceptance still requires
+consumer-owned requirements and a trusted CI job that controls the harness,
+policies, and evidence. A passing trace is not a general proof of code quality
+or a defense against an executor that can rewrite the acceptance gate.

package/cli/config.mjs

@@ -6,11 +6,15 @@ const DEFAULT_CONFIG = Object.freeze({
   artifacts: {
     capabilities: ".proof/capabilities.json",
     schema: ".proof/schema.json",
-    modules: ".proof/modules.json",
     traces: ".proof/traces",
     drift: ".proof/drift.json",
     mutations: ".proof/mutations",
   },
+  // The module-descriptor system (module.meta.ts → modules.json and its
+  // checker) moved to the consumer template in 0.1.0-next.6: it serves the
+  // planner, which is product, not verification. Its former config keys
+  // (artifacts.modules, policies.module, roots.modules, roots.sharedModules,
+  // moduleKinds) are ignored if a proof.config.mjs still supplies them.
   mission: {
     current: ".proof/current-mission.json",
     directory: ".proof/missions",
@@ -19,13 +23,10 @@ const DEFAULT_CONFIG = Object.freeze({
     coverage: ".proof/coverage-policy.json",
     mutation: ".proof/mutation-policy.json",
     migration: ".proof/migration-policy.json",
-    module: ".proof/module-policy.json",
   },
   roots: {
     source: "app",
     actions: ["app/__core", "app/__business-logic", "app/__extensions"],
-    modules: ["app/__core", "app/__extensions", "app/__business-logic"],
-    sharedModules: "app/__shared",
     proofs: "e2e/proofs",
     fixtures: "e2e/fixtures",
     migrations: "supabase/migrations",
@@ -42,13 +43,9 @@ const DEFAULT_CONFIG = Object.freeze({
     envExample: ".env.local.example",
     supabaseConfig: "supabase/config.toml",
   },
-  moduleKinds: {
-    required: [
-      { root: "app/__core", kind: "core" },
-      { root: "app/__extensions", kind: "extension" },
-    ],
-    optional: [{ root: "app/__business-logic", kind: "business" }],
-  },
+  // Optional consumer-owned argv used to prepare generated migration inputs
+  // in both the working tree and the archived base before parsing.
+  driftPrepare: null,
   driftSources: ["app", "package.json"],
   mutationCatalog: null,
 });
@@ -66,10 +63,6 @@ function mergeConfig(config = {}) {
       ...DEFAULT_CONFIG.registryAliases,
       ...config.registryAliases,
     },
-    moduleKinds: {
-      ...DEFAULT_CONFIG.moduleKinds,
-      ...config.moduleKinds,
-    },
   };
 }
 
@@ -115,3 +108,29 @@ export async function loadMutationCatalog(config) {
 }
 
 export { DEFAULT_CONFIG };
+
+/** Derived outputs are excluded from the source identity, never trust inputs. */
+export function evidenceExclusions(config) {
+  return [
+    ...Object.values(config.artifacts),
+    `${path.dirname(config.artifacts.mutations)}/mutation-recovery.json`,
+  ].map((p) => path.resolve(config.rootDir, p));
+}
+
+/** Reject a trace/output directory that resolves to the repository or its parent. */
+export function assertArtifactDirectory(directory, rootDir) {
+  function canonical(file) {
+    const absolute = path.resolve(file);
+    if (fs.existsSync(absolute)) return fs.realpathSync(absolute);
+    const parent = path.dirname(absolute);
+    return path.join(canonical(parent), path.basename(absolute));
+  }
+  const output = canonical(directory);
+  const root = canonical(rootDir);
+  const relative = path.relative(output, root);
+  if (!relative || (!relative.startsWith("..") && !path.isAbsolute(relative)))
+    throw new Error(
+      "[PROOF_FAIL] unsafe_artifact_directory: output must not be the repository or an ancestor",
+    );
+  return output;
+}

package/cli/engines/parse_proof_schema.mjs

@@ -269,6 +269,7 @@ function parsePolicies(sql, sourceFile) {
       name: policyName,
       table: tableName,
       command,
+      mode: /\bAS\s+RESTRICTIVE\b/i.test(rest) ? "RESTRICTIVE" : "PERMISSIVE",
       roles,
       using: usingBody.trim(),
       check: checkBody.trim(),
@@ -308,7 +309,7 @@ function policyIndicatesUser(policy) {
 }
 
 function policyIsPublicRead(policy) {
-  if (policy.command !== "SELECT" && policy.command !== "ALL") return false;
+  if (policy.command !== "SELECT") return false;
   const body = policy.using.trim().toLowerCase();
   return body === "true";
 }
@@ -348,9 +349,7 @@ function classifyTable(policies) {
   if (
     readPolicies.length > 0 &&
     readPolicies.every(policyIsPublicRead) &&
-    authPolicies.every(
-      (p) => p.command === "SELECT" || p.command === "ALL" || p.check === "",
-    )
+    authPolicies.every((p) => p.command === "SELECT")
   ) {
     return "public_read";
   }
@@ -366,6 +365,26 @@ function classifyTable(policies) {
 
 export function main() {
   const sources = readAllMigrations();
+  const unsupported = [];
+  const enabledTables = new Set();
+  for (const { file, sql } of sources) {
+    // This parser is intentionally conservative. Never preserve historical CREATE
+    // facts as current evidence after an operation we cannot interpret.
+    const enable =
+      /ALTER\s+TABLE\s+(?:ONLY\s+)?(?:"?public"?\.)?"?(\w+)"?\s+ENABLE\s+ROW\s+LEVEL\s+SECURITY\s*;/gi;
+    for (const match of sql.matchAll(enable)) enabledTables.add(match[1]);
+    const remainder = sql.replace(enable, "");
+    if (
+      /\b(?:ALTER\s+(?:TABLE|POLICY)|DROP\s+(?:TABLE|POLICY)|DO\s+\$|EXECUTE\s+)/i.test(
+        remainder,
+      )
+    )
+      unsupported.push({
+        file,
+        reason:
+          "migration changes schema or policy state using unsupported SQL; final schema is unassessable",
+      });
+  }
   const tablesByName = new Map();
   const policiesByTable = new Map();
 
@@ -373,7 +392,10 @@ export function main() {
     for (const t of extractTables(sql, file)) {
       const existing = tablesByName.get(t.name);
       if (existing) {
-        // Merge columns from ALTER TABLE or re-declarations (future-proof).
+        unsupported.push({
+          file,
+          reason: `repeated CREATE TABLE ${t.name} cannot establish final columns`,
+        });
         existing.columns = [...new Set([...existing.columns, ...t.columns])];
         if (!existing.files.includes(file)) existing.files.push(file);
       } else {
@@ -395,17 +417,23 @@ export function main() {
 
   for (const [name, entry] of tablesByName) {
     const policies = policiesByTable.get(name) ?? [];
-    const classification = classifyTable(policies);
+    const classification = enabledTables.has(name)
+      ? classifyTable(policies)
+      : "unclassified";
 
     const normalized = {
       name,
       columns: [...entry.columns].sort(),
       rls_classification: classification,
+      rls_enabled: enabledTables.has(name),
       policies: policies
         .map((p) => ({
           name: p.name,
           command: p.command,
           roles: [...p.roles].sort(),
+          using: p.using,
+          check: p.check,
+          mode: p.mode,
         }))
         .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0)),
       sourceFiles: [...entry.files]
@@ -429,6 +457,8 @@ export function main() {
 
   const output = {
     schemaVersion: 1,
+    assessed: unsupported.length === 0,
+    issues: unsupported,
     tables,
     unclassified: unclassifiedTables,
   };
@@ -439,6 +469,10 @@ export function main() {
   console.log(
     `[proof:parse] parsed ${sources.length} migration file(s); wrote ${tables.length} table(s), ${unclassifiedTables.length} unclassified to ${OUTPUT_PATH}`,
   );
+  if (unsupported.length)
+    throw new Error(
+      `[PROOF_FAIL] schema_unassessed: ${unsupported.map((p) => `${p.file}: ${p.reason}`).join("; ")}`,
+    );
   if (unclassifiedTables.length > 0) {
     console.log(`[proof:parse] unclassified tables:`);
     for (const u of unclassifiedTables)

package/cli/engines/proof_coverage.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { readTraceDirectory, baselineAssertions } from "../../dist/node.js";
 // ---------------------------------------------------------------------------
 // proof_coverage.mjs
 //
@@ -57,7 +58,7 @@ import {
   TENANT_ISOLATION_ACTION_HELPERS,
   TENANT_ISOLATION_TABLE_HELPERS,
 } from "../../dist/portable-vocabulary.js";
-import { loadProofConfig } from "../config.mjs";
+import { loadProofConfig, evidenceExclusions } from "../config.mjs";
 
 const CONFIG = await loadProofConfig();
 process.chdir(CONFIG.rootDir);
@@ -121,22 +122,11 @@ function readJson(file, { required = true } = {}) {
 
 /** Every assertion from every trace, flattened. Steps may nest assertions. */
 function readAssertions() {
-  if (!fs.existsSync(TRACES_DIR)) return [];
-  const out = [];
-  for (const file of fs.readdirSync(TRACES_DIR)) {
-    if (!file.endsWith(".json")) continue;
-    const parsed = readJson(path.join(TRACES_DIR, file));
-    for (const artifact of Array.isArray(parsed) ? parsed : [parsed]) {
-      // The aggregate <missionId>.json embeds every per-spec trace; skip it so
-      // assertions are not counted twice.
-      if (Array.isArray(artifact?.traces)) continue;
-      const nested = (artifact?.steps ?? []).flatMap((s) => s.assertions ?? []);
-      for (const assertion of [...(artifact?.assertions ?? []), ...nested]) {
-        out.push({ ...assertion, proofId: artifact?.proofId ?? null });
-      }
-    }
-  }
-  return out;
+  return baselineAssertions(
+    readTraceDirectory(TRACES_DIR, {
+      excludedPaths: evidenceExclusions(CONFIG),
+    }),
+  );
 }
 
 // ---------------------------------------------------------------------------
@@ -202,6 +192,10 @@ function buildReport() {
   const policy = readJson(POLICY_PATH, { required: false }) ?? {
     acceptedGaps: [],
   };
+  if (schema.assessed === false || capabilities.unclassified?.length)
+    throw new Error(
+      "[PROOF_FAIL] discovery_unassessed: schema or capability discovery is incomplete",
+    );
   const assertions = readAssertions();
 
   const tableNames = new Set((schema.tables ?? []).map((t) => t.name));