proof-harness 0.1.0-next.6 → 0.1.0-next.7

package/COMPATIBILITY.md

@@ -27,6 +27,76 @@ versions rather than guessing how to interpret them.
 
 ## Prerelease migration notes
 
+### Unreleased audit hardening
+
+Release candidate `0.1.0-next.7` tightens acceptance behavior; it has not been published. Trace
+schema remains 2, with additive source/execution identity fields. Version 1
+and unversioned trace shapes remain explicitly readable, but CLI acceptance
+requires current provenance. Required consumer changes:
+
+- Regenerate traces. `verify`, `coverage`, and mutation inventory share a
+  decoder: corrupt JSON, duplicate proof IDs, unknown vocabulary, and
+  contradictory verdicts fail. Only passing baseline evidence can satisfy
+  claims; mutation evidence is separate. Current spec contents must match
+  `specHash`; in Git worktrees both `commit` and `sourceHash` must match.
+  `sourceHash` includes tracked and untracked nonignored inputs and excludes
+  configured generated artifacts. Run generators before proofs. Non-Git
+  exports cannot establish whole-source freshness and only check spec hashes.
+- Use a dedicated trace directory. The writer honors `artifacts.traces` and
+  the runner's `--traces-dir` override. IDs must use letters, digits, dots,
+  underscores, or hyphens, starting with a letter or digit. Duplicate IDs
+  cannot overwrite another proof; a later Playwright retry of the same test
+  may replace its earlier attempt. Standalone repeated runs need fresh output.
+  Mission aggregates now live at `<traces>/missions/<missionId>.json` to
+  prevent collisions with proof IDs. Cleanup refuses unknown JSON before
+  deleting any trace and rejects repository/ancestor directories, including
+  symlink aliases. Move legacy or corrupt files aside before rerunning.
+- UPDATE denial probes require stable `identityColumns` (default `["id"]`),
+  present and non-null in every target row, excluded from the update payload.
+  The attempted update must change a value. Rereads use original identities,
+  even when a write changes a filter column. SQL errors other than `42501`
+  are incomplete evidence. INSERT probes require a payload absent before the
+  probe and valid for a service-role control insertion; that control is
+  cleaned up. HTTP expectations must contain a status or a nonempty matcher
+  list. Write requests are never automatically retried after transport errors.
+- Capability discovery uses TypeScript syntax analysis for import aliases and
+  multiple actions. Unknown factory/client indirection, escaped service query
+  builders, dynamic table names, and ambiguous metadata block assessment.
+  Discovery still assumes the configured template action layout.
+- The SQL parser is deliberately conservative, not a final PostgreSQL catalog
+  evaluator. Unsupported ALTER/DROP or dynamic SQL makes schema assessment
+  fail. RLS must be explicitly enabled for classification; public ALL/write
+  policies are never exempted as public-read. Policy expressions and mode
+  participate in drift. Resolve unsupported migrations with a catalog-backed
+  integration before using this parser as a gate; do not edit shipped SQL or
+  mark an unassessed artifact assessed to obtain a pass.
+- Drift always regenerates both trees using the installed harness and each
+  tree's consumer configuration. It includes untracked actions, SQL, and
+  lockfiles. For ignored/generated migrations, configure `driftPrepare` as a
+  command argv array (for example `["node", "scripts/aggregate_migrations.mjs",
+  "--fresh"]`). That consumer-owned command runs in each tree before parsing;
+  failure prevents assessment. It must work in the archived tree without an
+  implicit dependency install. The old `driftSources` optimization is unused.
+- Mutations require fresh mapped baseline claims and write isolated traces.
+  SQL applies run as one transaction; recovery is attempted even after a
+  failed apply. Policy snapshots preserve expressions, roles, command, and
+  permissive/restrictive mode. Generic privilege mutations support direct,
+  owner-issued grants without grant options; unsupported inherited/PUBLIC or
+  ownership cases fail before planting. Move old mutation outputs aside on
+  first use: nonempty output directories require a harness ownership marker.
+  An interrupted run leaves `mutation-recovery.json` beside the mutation output
+  directory. Run `proof-harness mutate --recover` against the same local
+  database to restore and verify the journaled subject. A timeout, signal, or
+  incomplete failed claim never counts as detection. Recovery covers the
+  catalog's declared subject and cleanup, not arbitrary undeclared side effects.
+- Partial fixture setup is cleaned up, and cleanup errors now fail the proof.
+
+These checks validate observed evidence. Protect the installed harness,
+configuration, mission, policies, mutation catalog, and CI acceptance job from
+executor edits. Trace metadata is not a signature or a sandbox: it cannot
+establish honesty against an executor allowed to replace the gate or fabricate
+its inputs. Independent product acceptance and a trusted runner remain needed.
+
 ### 0.1.0-next.6
 
 **Removed: the module-descriptor system.** It served the consumer's planner

package/PROOF_SDK_CONTRACT.md

@@ -10,7 +10,7 @@ instead; this document is for anyone _consuming_ the template.
 > **"Manifest" in this document always means the _mission_ manifest**
 > (`.proof/current-mission.json`) — the file that pins what one PR must prove.
 
-- **Version:** 1 (`schemaVersion` in every manifest and artifact)
+- **Versions:** mission manifests 1; proof traces 2; proof health protocol 1.
 - **Stability:** The shapes in this document are the contract. Additive
   changes (new optional fields, new vocabulary entries) do not bump the
   version; breaking changes bump `schemaVersion` and are documented here.
@@ -22,6 +22,17 @@ instead; this document is for anyone _consuming_ the template.
 
 ---
 
+## Current acceptance semantics
+
+The unreleased audit hardening in [COMPATIBILITY.md](COMPATIBILITY.md#unreleased-audit-hardening)
+supersedes older template-specific command examples below. Trace consumers
+must use `decodeTrace`/`decodeTraceBundle` for structural validation and
+`readTraceDirectory` for CLI-equivalent freshness checks. Evidence counts only
+when the proof and step passed, the assertion has a passing consistent verdict,
+and the trace is a baseline rather than a planted mutation. Helper-origin
+metadata is a convention enforced by the writer, not cryptographic attestation.
+The consumer controls and protects the runner and its trust inputs.
+
 ## 1. The loop
 
 ```
@@ -47,7 +58,7 @@ instead; this document is for anyone _consuming_ the template.
 │             │    fails cheaply BEFORE the database proofs run        │
 │             ├─ proof:verify                                          │
 │                 ├─ runs every *.proof.ts spec                        │
-│                 ├─ aggregates  .proof/traces/<missionId>.json        │
+│                 ├─ aggregates  .proof/traces/missions/<missionId>.json        │
 │                 └─ validates manifest requirements against artifacts │
 │             ├─ proof:coverage --strict                               │
 │             └─ proof:inventory → requires mutation or acceptance      │

package/README.md

@@ -91,3 +91,17 @@ Licensed under the [Apache License 2.0](./LICENSE).
 The package is released from this public repository with npm provenance.
 Prerelease consumers must pin an exact version rather than using `next`, `^`, or
 `~`; see [COMPATIBILITY.md](./COMPATIBILITY.md) for the compatibility policy.
+
+## Audit hardening (0.1.0-next.7, unreleased)
+
+The working branch adds shared fail-closed trace ingestion, source freshness,
+stronger authorization probes, isolated mutation evidence and interruption
+recovery, conservative discovery, and package-owned drift regeneration.
+See [required migration changes](COMPATIBILITY.md#unreleased-audit-hardening)
+before upgrading a consumer. In particular, existing traces must be rerun and
+unsupported SQL now blocks assessment.
+
+The harness establishes specific tested claims. Acceptance still requires
+consumer-owned requirements and a trusted CI job that controls the harness,
+policies, and evidence. A passing trace is not a general proof of code quality
+or a defense against an executor that can rewrite the acceptance gate.

package/cli/config.mjs

@@ -43,6 +43,9 @@ const DEFAULT_CONFIG = Object.freeze({
     envExample: ".env.local.example",
     supabaseConfig: "supabase/config.toml",
   },
+  // Optional consumer-owned argv used to prepare generated migration inputs
+  // in both the working tree and the archived base before parsing.
+  driftPrepare: null,
   driftSources: ["app", "package.json"],
   mutationCatalog: null,
 });
@@ -105,3 +108,29 @@ export async function loadMutationCatalog(config) {
 }
 
 export { DEFAULT_CONFIG };
+
+/** Derived outputs are excluded from the source identity, never trust inputs. */
+export function evidenceExclusions(config) {
+  return [
+    ...Object.values(config.artifacts),
+    `${path.dirname(config.artifacts.mutations)}/mutation-recovery.json`,
+  ].map((p) => path.resolve(config.rootDir, p));
+}
+
+/** Reject a trace/output directory that resolves to the repository or its parent. */
+export function assertArtifactDirectory(directory, rootDir) {
+  function canonical(file) {
+    const absolute = path.resolve(file);
+    if (fs.existsSync(absolute)) return fs.realpathSync(absolute);
+    const parent = path.dirname(absolute);
+    return path.join(canonical(parent), path.basename(absolute));
+  }
+  const output = canonical(directory);
+  const root = canonical(rootDir);
+  const relative = path.relative(output, root);
+  if (!relative || (!relative.startsWith("..") && !path.isAbsolute(relative)))
+    throw new Error(
+      "[PROOF_FAIL] unsafe_artifact_directory: output must not be the repository or an ancestor",
+    );
+  return output;
+}

package/cli/engines/parse_proof_schema.mjs

@@ -269,6 +269,7 @@ function parsePolicies(sql, sourceFile) {
       name: policyName,
       table: tableName,
       command,
+      mode: /\bAS\s+RESTRICTIVE\b/i.test(rest) ? "RESTRICTIVE" : "PERMISSIVE",
       roles,
       using: usingBody.trim(),
       check: checkBody.trim(),
@@ -308,7 +309,7 @@ function policyIndicatesUser(policy) {
 }
 
 function policyIsPublicRead(policy) {
-  if (policy.command !== "SELECT" && policy.command !== "ALL") return false;
+  if (policy.command !== "SELECT") return false;
   const body = policy.using.trim().toLowerCase();
   return body === "true";
 }
@@ -348,9 +349,7 @@ function classifyTable(policies) {
   if (
     readPolicies.length > 0 &&
     readPolicies.every(policyIsPublicRead) &&
-    authPolicies.every(
-      (p) => p.command === "SELECT" || p.command === "ALL" || p.check === "",
-    )
+    authPolicies.every((p) => p.command === "SELECT")
   ) {
     return "public_read";
   }
@@ -366,6 +365,26 @@ function classifyTable(policies) {
 
 export function main() {
   const sources = readAllMigrations();
+  const unsupported = [];
+  const enabledTables = new Set();
+  for (const { file, sql } of sources) {
+    // This parser is intentionally conservative. Never preserve historical CREATE
+    // facts as current evidence after an operation we cannot interpret.
+    const enable =
+      /ALTER\s+TABLE\s+(?:ONLY\s+)?(?:"?public"?\.)?"?(\w+)"?\s+ENABLE\s+ROW\s+LEVEL\s+SECURITY\s*;/gi;
+    for (const match of sql.matchAll(enable)) enabledTables.add(match[1]);
+    const remainder = sql.replace(enable, "");
+    if (
+      /\b(?:ALTER\s+(?:TABLE|POLICY)|DROP\s+(?:TABLE|POLICY)|DO\s+\$|EXECUTE\s+)/i.test(
+        remainder,
+      )
+    )
+      unsupported.push({
+        file,
+        reason:
+          "migration changes schema or policy state using unsupported SQL; final schema is unassessable",
+      });
+  }
   const tablesByName = new Map();
   const policiesByTable = new Map();
 
@@ -373,7 +392,10 @@ export function main() {
     for (const t of extractTables(sql, file)) {
       const existing = tablesByName.get(t.name);
       if (existing) {
-        // Merge columns from ALTER TABLE or re-declarations (future-proof).
+        unsupported.push({
+          file,
+          reason: `repeated CREATE TABLE ${t.name} cannot establish final columns`,
+        });
         existing.columns = [...new Set([...existing.columns, ...t.columns])];
         if (!existing.files.includes(file)) existing.files.push(file);
       } else {
@@ -395,17 +417,23 @@ export function main() {
 
   for (const [name, entry] of tablesByName) {
     const policies = policiesByTable.get(name) ?? [];
-    const classification = classifyTable(policies);
+    const classification = enabledTables.has(name)
+      ? classifyTable(policies)
+      : "unclassified";
 
     const normalized = {
       name,
       columns: [...entry.columns].sort(),
       rls_classification: classification,
+      rls_enabled: enabledTables.has(name),
       policies: policies
         .map((p) => ({
           name: p.name,
           command: p.command,
           roles: [...p.roles].sort(),
+          using: p.using,
+          check: p.check,
+          mode: p.mode,
         }))
         .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0)),
       sourceFiles: [...entry.files]
@@ -429,6 +457,8 @@ export function main() {
 
   const output = {
     schemaVersion: 1,
+    assessed: unsupported.length === 0,
+    issues: unsupported,
     tables,
     unclassified: unclassifiedTables,
   };
@@ -439,6 +469,10 @@ export function main() {
   console.log(
     `[proof:parse] parsed ${sources.length} migration file(s); wrote ${tables.length} table(s), ${unclassifiedTables.length} unclassified to ${OUTPUT_PATH}`,
   );
+  if (unsupported.length)
+    throw new Error(
+      `[PROOF_FAIL] schema_unassessed: ${unsupported.map((p) => `${p.file}: ${p.reason}`).join("; ")}`,
+    );
   if (unclassifiedTables.length > 0) {
     console.log(`[proof:parse] unclassified tables:`);
     for (const u of unclassifiedTables)

package/cli/engines/proof_coverage.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { readTraceDirectory, baselineAssertions } from "../../dist/node.js";
 // ---------------------------------------------------------------------------
 // proof_coverage.mjs
 //
@@ -57,7 +58,7 @@ import {
   TENANT_ISOLATION_ACTION_HELPERS,
   TENANT_ISOLATION_TABLE_HELPERS,
 } from "../../dist/portable-vocabulary.js";
-import { loadProofConfig } from "../config.mjs";
+import { loadProofConfig, evidenceExclusions } from "../config.mjs";
 
 const CONFIG = await loadProofConfig();
 process.chdir(CONFIG.rootDir);
@@ -121,22 +122,11 @@ function readJson(file, { required = true } = {}) {
 
 /** Every assertion from every trace, flattened. Steps may nest assertions. */
 function readAssertions() {
-  if (!fs.existsSync(TRACES_DIR)) return [];
-  const out = [];
-  for (const file of fs.readdirSync(TRACES_DIR)) {
-    if (!file.endsWith(".json")) continue;
-    const parsed = readJson(path.join(TRACES_DIR, file));
-    for (const artifact of Array.isArray(parsed) ? parsed : [parsed]) {
-      // The aggregate <missionId>.json embeds every per-spec trace; skip it so
-      // assertions are not counted twice.
-      if (Array.isArray(artifact?.traces)) continue;
-      const nested = (artifact?.steps ?? []).flatMap((s) => s.assertions ?? []);
-      for (const assertion of [...(artifact?.assertions ?? []), ...nested]) {
-        out.push({ ...assertion, proofId: artifact?.proofId ?? null });
-      }
-    }
-  }
-  return out;
+  return baselineAssertions(
+    readTraceDirectory(TRACES_DIR, {
+      excludedPaths: evidenceExclusions(CONFIG),
+    }),
+  );
 }
 
 // ---------------------------------------------------------------------------
@@ -202,6 +192,10 @@ function buildReport() {
   const policy = readJson(POLICY_PATH, { required: false }) ?? {
     acceptedGaps: [],
   };
+  if (schema.assessed === false || capabilities.unclassified?.length)
+    throw new Error(
+      "[PROOF_FAIL] discovery_unassessed: schema or capability discovery is incomplete",
+    );
   const assertions = readAssertions();
 
   const tableNames = new Set((schema.tables ?? []).map((t) => t.name));

package/cli/engines/proof_drift.mjs

@@ -19,12 +19,11 @@
 //
 // against the same artifacts regenerated from the PR's merge base. The
 // artifact generators are pure filesystem scripts, so the base side is rebuilt
-// by extracting the base tree (`git archive`) and running THAT checkout's own
-// generators — no database, no install, a few seconds.
+// by extracting the base tree (`git archive`) and running the installed harness
+// with the archived consumer configuration. Optional driftPrepare builds inputs.
 //
 // WHAT THIS IS NOT. Drift sees exactly what the scanners see, and no more. It
-// does NOT see: RLS policy predicates (USING / WITH CHECK bodies), column
-// types, constraints, or defaults; SQL grants, triggers, or function bodies;
+// does NOT see: column types, constraints, or defaults; SQL grants, triggers, or function bodies;
 // transitive dependency contents; or ordinary product behavior. "No drift"
 // means "no change on the proof-relevant derived surfaces", never "nothing
 // else changed" — behavior inside declared scope still merits review or a
@@ -72,7 +71,7 @@ import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 // Single source of truth for the facet vocabularies, shared with both mission
 // validators (which reject exactly what the standalone budget check below
@@ -91,10 +90,6 @@ const SCHEMA_PATH = CONFIG.artifacts.schema;
 const MISSION_PATH = CONFIG.mission.current;
 const OUTPUT_PATH = CONFIG.artifacts.drift;
 
-// Paths whose contents feed the derived artifacts. If none of them differ from
-// the base, there is nothing to regenerate or diff.
-const SOURCE_PATHS = CONFIG.driftSources;
-
 // ---------------------------------------------------------------------------
 // Diffing (pure — unit-tested directly)
 // ---------------------------------------------------------------------------
@@ -282,7 +277,10 @@ export function diffSchema(baseArtifact, headArtifact) {
     // Enforcement covers a table change only when EVERY facet is declared,
     // so `columns_added` on a declared table never authorizes a policy edit.
     const facets = [];
-    if (baseTable.rls_classification !== headTable.rls_classification) {
+    if (
+      baseTable.rls_classification !== headTable.rls_classification ||
+      baseTable.rls_enabled !== headTable.rls_enabled
+    ) {
       facets.push("rls_classification_changed");
       notes.push(
         `rls_classification: ${baseTable.rls_classification} -> ${headTable.rls_classification}`,
@@ -301,7 +299,7 @@ export function diffSchema(baseArtifact, headArtifact) {
     // `TO authenticated` widens who a policy reaches without renaming it, and
     // may leave the coarse rls_classification untouched.
     const policyKey = (p) =>
-      `${p.name} FOR ${p.command} TO ${[...(p.roles ?? [])].sort().join(",") || "PUBLIC"}`;
+      `${p.name} FOR ${p.command} TO ${[...(p.roles ?? [])].sort().join(",") || "PUBLIC"} ${p.mode ?? "PERMISSIVE"} USING ${p.using ?? ""} CHECK ${p.check ?? ""}`;
     const policies = setDiff(
       (baseTable.policies ?? []).map(policyKey),
       (headTable.policies ?? []).map(policyKey),
@@ -564,13 +562,8 @@ export function resolveBase(explicit) {
   return null;
 }
 
-/**
- * Materialize the base tree and regenerate its proof artifacts using the base
- * checkout's OWN generator scripts (they are pure filesystem scripts with no
- * node_modules imports, so no install is needed). Returns the artifact set or
- * throws with a reason.
- */
-function generateBaseArtifacts(baseSha, tmpDir) {
+/** Materialize the base consumer and evaluate it with this installed harness. */
+async function generateBaseArtifacts(baseSha, tmpDir) {
   const tarPath = path.join(tmpDir, "base.tar");
   execFileSync("git", ["archive", "--format=tar", "-o", tarPath, baseSha], {
     stdio: ["ignore", "ignore", "pipe"],
@@ -581,31 +574,43 @@ function generateBaseArtifacts(baseSha, tmpDir) {
     stdio: ["ignore", "ignore", "pipe"],
   });
 
-  const generators = [
-    ["scripts/scan_proof_capabilities.mjs"],
-    ["scripts/aggregate_migrations.mjs", "--fresh"],
-    ["scripts/parse_proof_schema.mjs"],
-  ];
-  for (const [script, ...args] of generators) {
-    if (!fs.existsSync(path.join(treeDir, script))) {
-      throw new Error(`base commit has no ${script} — too old to diff against`);
+  // Use the installed harness on both trees so generator-version differences
+  // cannot masquerade as product drift. Rebase every configured path into
+  // the archived consumer; never run removed template-owned scripts.
+  const baseConfigPath = CONFIG.configPath
+    ? path.join(treeDir, path.relative(CONFIG.rootDir, CONFIG.configPath))
+    : undefined;
+  const baseConfig = await loadProofConfig({
+    cwd: treeDir,
+    configPath: baseConfigPath,
+  });
+  const relocated = { ...baseConfig, rootDir: treeDir };
+  for (const group of ["artifacts", "roots", "repository"]) {
+    for (const value of Object.values(relocated[group])) {
+      for (const item of Array.isArray(value) ? value : [value]) {
+        if (typeof item !== "string") continue;
+        const relative = path.relative(treeDir, path.resolve(treeDir, item));
+        if (relative.startsWith("..") || path.isAbsolute(relative))
+          throw new Error(`base ${group} path escapes archive: ${item}`);
+      }
     }
-    execFileSync("node", [script, ...args], {
-      cwd: treeDir,
-      stdio: ["ignore", "ignore", "pipe"],
-    });
   }
-
+  const configFile = path.join(tmpDir, "base-proof.config.mjs");
+  fs.writeFileSync(configFile, `export default ${JSON.stringify(relocated)};`);
+  generateArtifacts(treeDir, configFile, relocated);
   return {
     capabilities: JSON.parse(
-      fs.readFileSync(path.join(treeDir, CAPABILITIES_PATH), "utf8"),
+      fs.readFileSync(
+        path.join(treeDir, relocated.artifacts.capabilities),
+        "utf8",
+      ),
     ),
     schema: JSON.parse(
-      fs.readFileSync(path.join(treeDir, SCHEMA_PATH), "utf8"),
+      fs.readFileSync(path.join(treeDir, relocated.artifacts.schema), "utf8"),
     ),
     pkg: JSON.parse(
       fs.readFileSync(
-        path.join(treeDir, CONFIG.repository.packageJson),
+        path.join(treeDir, relocated.repository.packageJson),
         "utf8",
       ),
     ),
@@ -616,6 +621,44 @@ function generateBaseArtifacts(baseSha, tmpDir) {
 // CLI
 // ---------------------------------------------------------------------------
 
+function generateArtifacts(rootDir, configPath, config) {
+  const env = { ...process.env };
+  delete env.PROOF_HARNESS_CONFIG;
+  if (configPath) env.PROOF_HARNESS_CONFIG = configPath;
+  if (config.driftPrepare !== null && config.driftPrepare !== undefined) {
+    if (
+      !Array.isArray(config.driftPrepare) ||
+      !config.driftPrepare.length ||
+      config.driftPrepare.some((v) => typeof v !== "string" || !v)
+    )
+      throw new Error("driftPrepare must be a nonempty command argv array");
+    const [command, ...args] = config.driftPrepare;
+    execFileSync(command, args, {
+      cwd: rootDir,
+      env,
+      stdio: ["ignore", "ignore", "pipe"],
+      timeout: 30_000,
+    });
+  } else if (
+    rootDir === CONFIG.rootDir &&
+    tryGit(["check-ignore", config.roots.migrations]) !== null
+  ) {
+    throw new Error(
+      "ignored migration inputs need a consumer-owned driftPrepare command to rebuild the archived base",
+    );
+  }
+  for (const name of [
+    "scan_proof_capabilities.mjs",
+    "parse_proof_schema.mjs",
+  ]) {
+    execFileSync(
+      process.execPath,
+      [fileURLToPath(new URL(name, import.meta.url))],
+      { cwd: rootDir, env, stdio: ["ignore", "ignore", "pipe"] },
+    );
+  }
+}
+
 function readJson(file, { hint } = {}) {
   if (!fs.existsSync(file)) {
     console.error(
@@ -738,7 +781,7 @@ function printEntries(entries) {
   for (const e of entries) row(e.area, e.key, e.change, e.severity, e.detail);
 }
 
-export function main() {
+export async function main() {
   const args = process.argv.slice(2);
   const asJson = args.includes("--json");
   const baseFlagIndex = args.indexOf("--base");
@@ -766,14 +809,6 @@ Without it, the report is informational. Writes ${OUTPUT_PATH}.`);
     process.exit(2);
   }
 
-  const headCapabilities = readJson(CAPABILITIES_PATH, {
-    hint: "run `pnpm proof:build` first — drift diffs the regenerated artifacts",
-  });
-  const headSchema = readJson(SCHEMA_PATH, {
-    hint: "run `pnpm proof:build` first — drift diffs the regenerated artifacts",
-  });
-  const headPkg = readJson(CONFIG.repository.packageJson, {});
-
   let base;
   try {
     base = resolveBase(explicitBase);
@@ -817,61 +852,35 @@ Without it, the report is informational. Writes ${OUTPUT_PATH}.`);
 
   const headSha = tryGit(["rev-parse", "HEAD"]);
 
-  // Lockfile drift is tracked separately from the package.json surface: a
-  // lockfile that changes while the dependency surface does not means the
-  // RESOLUTION changed (a swapped tarball, a widened range realized), which
-  // no package.json diff can see.
-  let lockfileChanged = false;
-  if (
-    fs.existsSync(CONFIG.repository.lockfile) ||
-    tryGit(["cat-file", "-e", `${base.sha}:${CONFIG.repository.lockfile}`]) !==
-      null
-  ) {
-    try {
-      execFileSync(
-        "git",
-        ["diff", "--quiet", base.sha, "--", CONFIG.repository.lockfile],
-        { stdio: "ignore" },
-      );
-    } catch {
-      lockfileChanged = true;
-    }
-  }
-
-  // Fast path: when nothing feeding the artifacts differs from the base
-  // (committed or not), there is no drift and no need to rebuild anything.
-  let sourceUnchanged = false;
+  const lockfilePath = path.relative(
+    CONFIG.rootDir,
+    path.resolve(CONFIG.repository.lockfile),
+  );
+  const baseLockfile = tryGit(["show", `${base.sha}:${lockfilePath}`]);
+  const headLockfile = fs.existsSync(CONFIG.repository.lockfile)
+    ? fs.readFileSync(CONFIG.repository.lockfile, "utf8").trim()
+    : null;
+  const lockfileChanged = baseLockfile !== headLockfile;
+
+  // Always regenerate. Git diff alone omits untracked action and SQL files.
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "proof-drift-"));
+  let entries;
   try {
-    execFileSync("git", ["diff", "--quiet", base.sha, "--", ...SOURCE_PATHS], {
-      stdio: "ignore",
-    });
-    sourceUnchanged = true;
-  } catch {
-    sourceUnchanged = false;
-  }
-
-  let entries = [];
-  if (!sourceUnchanged) {
-    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "proof-drift-"));
-    let baseArtifacts;
-    try {
-      baseArtifacts = generateBaseArtifacts(base.sha, tmpDir);
-    } catch (err) {
-      notAssessed(
-        `could not rebuild base artifacts at ${base.sha.slice(0, 12)}: ${err.message}`,
-      );
-      return;
-    } finally {
-      fs.rmSync(tmpDir, { recursive: true, force: true });
-    }
+    generateArtifacts(CONFIG.rootDir, CONFIG.configPath, CONFIG);
+    const baseArtifacts = await generateBaseArtifacts(base.sha, tmpDir);
     entries = buildDrift({
       baseCapabilities: baseArtifacts.capabilities,
-      headCapabilities,
+      headCapabilities: readJson(CAPABILITIES_PATH),
       baseSchema: baseArtifacts.schema,
-      headSchema,
+      headSchema: readJson(SCHEMA_PATH),
       basePkg: baseArtifacts.pkg,
-      headPkg,
+      headPkg: readJson(CONFIG.repository.packageJson),
     });
+  } catch (err) {
+    notAssessed(`could not regenerate proof surfaces: ${err.message}`);
+    return;
+  } finally {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
   }
 
   if (lockfileChanged) {
@@ -976,5 +985,8 @@ const isDirectInvocation =
   import.meta.url === pathToFileURL(process.argv[1]).href;
 
 if (isDirectInvocation) {
-  main();
+  main().catch((error) => {
+    console.error(`[PROOF_FAIL] drift_unassessed: ${error.message}`);
+    process.exitCode = 1;
+  });
 }