proof-harness 0.1.0-next.6 → 0.1.0-next.8

package/COMPATIBILITY.md

@@ -11,7 +11,7 @@ Consumers must pin an exact prerelease version, for example:
 ```json
 {
   "devDependencies": {
-    "proof-harness": "0.1.0-next.6"
+    "proof-harness": "0.1.0-next.7"
   }
 }
 ```
@@ -27,6 +27,213 @@ versions rather than guessing how to interpret them.
 
 ## Prerelease migration notes
 
+### 0.1.0-next.8
+
+Release candidate prepared for publication. Publish from `main` with workflow
+input `0.1.0-next.8` after this version change is merged. Consumers can pin
+`proof-harness@0.1.0-next.8` after the publish workflow succeeds.
+
+#### Direct RLS clients and Auth administration (#18)
+
+The scanner recognizes immutable local bindings returned by
+`createSupabaseRLSClient`, including named-import aliases and awaited calls.
+Their table writes are assessed as RLS writes, never recorded as service-role
+writes. Binding identity is local to its scope: shadowed identifiers,
+reassignment, escaped clients/builders, and unresolved privilege still fail.
+This remains convention-based discovery of the named consumer factories, not
+verification of their implementation or arbitrary wrapper/dataflow analysis.
+
+Direct `serviceClient.auth.admin.deleteUser(...)` is recorded in the additive
+capability field `serviceRoleAuthOperations: ["deleteUser"]`, separate from
+`serviceRoleMutations`. This does not pretend the Auth API is a SQL DELETE
+(and does not infer whether its optional soft-delete argument is true).
+Other administrative methods, dynamic method names, detached calls, and
+unresolved administrative privilege remain unassessed.
+
+Regenerate capabilities. Changes to Auth operations participate in drift under
+`service_role_mutations_changed`. Coverage requires a package-origin denial
+assertion and an allowed-path control for a user-facing Auth-admin action,
+even when it has no workspace input or voluntary invariant declaration.
+Existing explicit action-gap policy handling remains unchanged; a recognized
+operation alone is not passing authorization evidence. Trace, mission and
+health protocol versions are unchanged; capability schema remains additive v1.
+
+#### Catalog providers and rollback INSERT controls (#19, #20)
+
+These changes are not in the published `0.1.0-next.7`. They are opt-in; the
+default SQL parser and REST INSERT/DELETE control remain available. No trace,
+mission, or health protocol version changes. Pin exactly `0.1.0-next.8` only
+after it is released.
+
+#### Catalog assessment
+
+Set `schemaProvider: "scripts/proof/catalog-provider.mjs"` in the protected
+`proof.config.mjs`. `parse`, the parse step of `build`, and both sides of
+`drift` use it instead of the conservative SQL parser. ALTER and DROP are then
+evaluated by PostgreSQL, not inferred from historical CREATE statements.
+
+The module must export a default async function receiving:
+
+- `protocolVersion: 1`, `rootDir` for the tree being assessed;
+- `migrations`: ordered `{ path, sql, sha256 }` entries from the configured
+  migration directory (top-level `.sql` files), and their combined `inputHash`;
+- `withLocalPostgres(connectionUrl, callback)` and
+  `readPostgresCatalog(client, schemas = ["public"])` from `proof-harness/node`.
+  These are injected so the archived base needs no installed dependencies to
+  import these helpers. Keep the provider's own imports dependency-free.
+
+The consumer provider must create an empty disposable database, apply its
+versioned platform bootstrap and every supplied migration in order, read the
+catalog, and drop the database in `finally`. Fail on migration or cleanup
+errors. Return `{ protocolVersion: 1, assessed: true, issues: [], tables }` only
+after successful evaluation and cleanup; `tables` is the helper's result.
+The connection helper restricts connections to loopback hosts. The consumer
+owns the local database URL, creation privileges, platform bootstrap, migration
+ordering, schema selection, and any required role setup. Never use the live
+head database as the base catalog, clone an application-populated database,
+or catch a failed migration and return partial facts.
+
+Catalog table facts contain `schema`, `name`, `columns` (names), `rls_enabled`,
+`rls_forced`, and `policies`. Each policy contains `name`, `command`, `roles`,
+`mode`, `using`, and `check`. Classification is package-owned. Drift compares
+column names, RLS state including FORCE, and full policy facts; this does not
+add drift coverage for column types, defaults, functions, triggers, or grants.
+Malformed envelopes/facts and changed migration inputs fail assessment and
+replace stale successful output with an unassessed artifact.
+
+The schema artifact adds `assessment` with provider protocol/path/hash,
+migration paths/hashes, combined input hash, and repository source hash. This
+is source identity, not a signature. The provider, its platform bootstrap,
+configuration, and installed harness remain protected trust inputs.
+
+For generated migrations, retain `driftPrepare` to rebuild them in each tree.
+**Adoption requires a preparatory base commit:** register the provider, its
+platform bootstrap, and config in the consumer before the comparison that
+upgrades the package. Both base and head must declare a provider. Drift rejects
+switching assessment modes across the comparison and never substitutes head
+configuration for a base without the provider. Existing next.7 ignores the new
+keys; registering them does not repair its conservative parser. A consumer
+already blocked on next.7 needs to land this trusted setup separately before
+the candidate's first successful drift run.
+
+#### Append-only INSERT controls
+
+Configure the protected consumer config explicitly, using your local ports:
+
+```js
+insertControl: {
+  mode: "rollback",
+  databaseUrlEnv: "PROOF_DATABASE_URL",
+  role: "service_role",
+  supabaseUrl: "http://127.0.0.1:54321",
+}
+```
+
+Supply the corresponding local PostgreSQL URL through that environment
+variable; never commit its password. The configured REST origin must match
+`NEXT_PUBLIC_SUPABASE_URL`. The database URL must refer to the same stack,
+schema, and migrations as REST; the harness validates the configured origin
+but cannot discover which database a REST server actually serves.
+
+The denied INSERT still executes through the authenticated Supabase client.
+Only after an explicit `42501` denial and a service read confirming no write
+does the harness validate the same payload on one PostgreSQL connection:
+BEGIN, SET LOCAL ROLE, INSERT, force deferred constraints, ROLLBACK. The role
+must have the intended INSERT permission. Missing columns keep their database
+defaults; the harness supplies no tenancy values. An invalid payload, failed
+role change, database error, or unacknowledged rollback fails as incomplete
+evidence. The harness records the control assertion only after success and a
+REST reread confirming no matching row remains. There is no consumer callback
+that can stamp a passing control.
+
+No DELETE privilege is needed for this control. Transactional trigger writes
+also roll back, but sequence advancement and external side effects do not;
+use only a disposable local stack. This control checks database validity under
+the configured role, not REST middleware or an authenticated user's JWT
+context. Templates whose privileged insert depends on that context must supply
+a suitable database design/control strategy rather than treat this mode as
+equivalent. Product authorization errors must still use SQLSTATE `42501`;
+generic exceptions such as `P0001` are not accepted as authorization evidence.
+
+For maintainers, `PROOF_DATABASE_URL=... node tests/postgres-integration.mjs`
+after `pnpm build` exercises a separate temporary database against PostgreSQL,
+including immediate and deferred failures and catalog ALTER/DROP behavior.
+
+### 0.1.0-next.7 — audit hardening
+
+Published release `0.1.0-next.7` tightens acceptance behavior. Trace
+<a id="unreleased-audit-hardening"></a>
+
+### 0.1.0-next.7
+
+Published September 7, 2026. This release tightens acceptance behavior. Trace
+schema remains 2, with additive source/execution identity fields. Version 1
+and unversioned trace shapes remain explicitly readable, but CLI acceptance
+requires current provenance. Required consumer changes:
+
+- Regenerate traces. `verify`, `coverage`, and mutation inventory share a
+  decoder: corrupt JSON, duplicate proof IDs, unknown vocabulary, and
+  contradictory verdicts fail. Only passing baseline evidence can satisfy
+  claims; mutation evidence is separate. Current spec contents must match
+  `specHash`; in Git worktrees both `commit` and `sourceHash` must match.
+  `sourceHash` includes tracked and untracked nonignored inputs and excludes
+  configured generated artifacts. Run generators before proofs. Non-Git
+  exports cannot establish whole-source freshness and only check spec hashes.
+- Use a dedicated trace directory. The writer honors `artifacts.traces` and
+  the runner's `--traces-dir` override. IDs must use letters, digits, dots,
+  underscores, or hyphens, starting with a letter or digit. Duplicate IDs
+  cannot overwrite another proof; a later Playwright retry of the same test
+  may replace its earlier attempt. Standalone repeated runs need fresh output.
+  Mission aggregates now live at `<traces>/missions/<missionId>.json` to
+  prevent collisions with proof IDs. Cleanup refuses unknown JSON before
+  deleting any trace and rejects repository/ancestor directories, including
+  symlink aliases. Move legacy or corrupt files aside before rerunning.
+- UPDATE denial probes require stable `identityColumns` (default `["id"]`),
+  present and non-null in every target row, excluded from the update payload.
+  The attempted update must change a value. Rereads use original identities,
+  even when a write changes a filter column. SQL errors other than `42501`
+  are incomplete evidence. INSERT probes require a payload absent before the
+  probe and valid for a service-role control insertion; that control is
+  cleaned up. HTTP expectations must contain a status or a nonempty matcher
+  list. Write requests are never automatically retried after transport errors.
+- Capability discovery uses TypeScript syntax analysis for import aliases and
+  multiple actions. Unknown factory/client indirection, escaped service query
+  builders, dynamic table names, and ambiguous metadata block assessment.
+  Discovery still assumes the configured template action layout.
+- The SQL parser is deliberately conservative, not a final PostgreSQL catalog
+  evaluator. Unsupported ALTER/DROP or dynamic SQL makes schema assessment
+  fail. RLS must be explicitly enabled for classification; public ALL/write
+  policies are never exempted as public-read. Policy expressions and mode
+  participate in drift. Resolve unsupported migrations with a catalog-backed
+  integration before using this parser as a gate; do not edit shipped SQL or
+  mark an unassessed artifact assessed to obtain a pass.
+- Drift always regenerates both trees using the installed harness and each
+  tree's consumer configuration. It includes untracked actions, SQL, and
+  lockfiles. For ignored/generated migrations, configure `driftPrepare` as a
+  command argv array (for example `["node", "scripts/aggregate_migrations.mjs",
+  "--fresh"]`). That consumer-owned command runs in each tree before parsing;
+  failure prevents assessment. It must work in the archived tree without an
+  implicit dependency install. The old `driftSources` optimization is unused.
+- Mutations require fresh mapped baseline claims and write isolated traces.
+  SQL applies run as one transaction; recovery is attempted even after a
+  failed apply. Policy snapshots preserve expressions, roles, command, and
+  permissive/restrictive mode. Generic privilege mutations support direct,
+  owner-issued grants without grant options; unsupported inherited/PUBLIC or
+  ownership cases fail before planting. Move old mutation outputs aside on
+  first use: nonempty output directories require a harness ownership marker.
+  An interrupted run leaves `mutation-recovery.json` beside the mutation output
+  directory. Run `proof-harness mutate --recover` against the same local
+  database to restore and verify the journaled subject. A timeout, signal, or
+  incomplete failed claim never counts as detection. Recovery covers the
+  catalog's declared subject and cleanup, not arbitrary undeclared side effects.
+- Partial fixture setup is cleaned up, and cleanup errors now fail the proof.
+
+These checks validate observed evidence. Protect the installed harness,
+configuration, mission, policies, mutation catalog, and CI acceptance job from
+executor edits. Trace metadata is not a signature or a sandbox: it cannot
+establish honesty against an executor allowed to replace the gate or fabricate
+its inputs. Independent product acceptance and a trusted runner remain needed.
+
 ### 0.1.0-next.6
 
 **Removed: the module-descriptor system.** It served the consumer's planner

package/PROOF_SDK_CONTRACT.md

@@ -10,7 +10,7 @@ instead; this document is for anyone _consuming_ the template.
 > **"Manifest" in this document always means the _mission_ manifest**
 > (`.proof/current-mission.json`) — the file that pins what one PR must prove.
 
-- **Version:** 1 (`schemaVersion` in every manifest and artifact)
+- **Versions:** mission manifests 1; proof traces 2; proof health protocol 1.
 - **Stability:** The shapes in this document are the contract. Additive
   changes (new optional fields, new vocabulary entries) do not bump the
   version; breaking changes bump `schemaVersion` and are documented here.
@@ -22,6 +22,17 @@ instead; this document is for anyone _consuming_ the template.
 
 ---
 
+## Current acceptance semantics
+
+The `0.1.0-next.7` audit hardening in [COMPATIBILITY.md](COMPATIBILITY.md#010-next7)
+supersedes older template-specific command examples below. Trace consumers
+must use `decodeTrace`/`decodeTraceBundle` for structural validation and
+`readTraceDirectory` for CLI-equivalent freshness checks. Evidence counts only
+when the proof and step passed, the assertion has a passing consistent verdict,
+and the trace is a baseline rather than a planted mutation. Helper-origin
+metadata is a convention enforced by the writer, not cryptographic attestation.
+The consumer controls and protects the runner and its trust inputs.
+
 ## 1. The loop
 
 ```
@@ -47,7 +58,7 @@ instead; this document is for anyone _consuming_ the template.
 │             │    fails cheaply BEFORE the database proofs run        │
 │             ├─ proof:verify                                          │
 │                 ├─ runs every *.proof.ts spec                        │
-│                 ├─ aggregates  .proof/traces/<missionId>.json        │
+│                 ├─ aggregates  .proof/traces/missions/<missionId>.json        │
 │                 └─ validates manifest requirements against artifacts │
 │             ├─ proof:coverage --strict                               │
 │             └─ proof:inventory → requires mutation or acceptance      │
@@ -1210,3 +1221,28 @@ a trace version bump.
 `.proof/coverage-policy.json` carries its own `schemaVersion` (currently `1`).
 It is authored, not derived, and is read only by `pnpm proof:coverage`; consumers
 do not need to parse it.
+
+
+## Catalog provider and rollback controls (0.1.0-next.8)
+
+The protected consumer config may opt into `schemaProvider` protocol 1 and
+`insertControl.mode: "rollback"`. See [the setup and migration contract](COMPATIBILITY.md)
+for the exact provider envelope, base-commit requirements, and control configuration.
+`proof-harness/node` exports `withLocalPostgres`, `readPostgresCatalog`,
+`rollbackInsertControl`, and the `PostgresCatalogTable`/`PostgresCatalogPolicy` types.
+Providers own database materialization; the harness validates catalog facts,
+classifies policies, binds source identity, and compares both trees. A rollback
+INSERT control is package-executed and can only record passing control evidence
+after its insert, deferred checks, rollback, and absence reread succeed. The
+original authenticated request remains the primary authorization assertion.
+
+
+## Direct Auth administration (0.1.0-next.8)
+
+Capability schema v1 adds optional `serviceRoleAuthOperations`, currently a
+closed list containing only `"deleteUser"`. It describes direct service-client
+Auth API calls separately from `serviceRoleMutations` (SQL table writes).
+Such user-facing actions require denial and allowed-control evidence in
+coverage even without a workspace input. Changes use the existing
+`service_role_mutations_changed` drift facet. See `COMPATIBILITY.md` for
+supported factory/binding shapes and required consumer regeneration.

package/README.md

@@ -17,13 +17,13 @@ Public prereleases are published under the npm `next` tag. Pin an exact
 prerelease version while the API is stabilizing:
 
 ```sh
-pnpm add proof-harness@0.1.0-next.6
+pnpm add proof-harness@0.1.0-next.7
 ```
 
 The package exposes environment-specific entry points:
 
 - `proof-harness/shared` — portable types and vocabularies
-- `proof-harness/node` — Node mission validation helpers
+- `proof-harness/node` — Node mission validation and local PostgreSQL helpers
 - `proof-harness/playwright` — Playwright proof assertions and traces
 - `proof-harness/server` — server-side fixtures, guards, and service clients
 - `proof-harness/portable-vocabulary` — dependency-free runtime constants
@@ -91,3 +91,23 @@ Licensed under the [Apache License 2.0](./LICENSE).
 The package is released from this public repository with npm provenance.
 Prerelease consumers must pin an exact version rather than using `next`, `^`, or
 `~`; see [COMPATIBILITY.md](./COMPATIBILITY.md) for the compatibility policy.
+
+## Audit hardening (0.1.0-next.7)
+
+This release adds shared fail-closed trace ingestion, source freshness,
+stronger authorization probes, isolated mutation evidence and interruption
+recovery, conservative discovery, and package-owned drift regeneration.
+See [required migration changes](COMPATIBILITY.md#010-next7--audit-hardening)
+before upgrading a consumer. In particular, existing traces must be rerun and
+unsupported SQL now blocks assessment.
+
+Release candidate `0.1.0-next.8` adds direct RLS client and Auth-admin discovery,
+a consumer-owned catalog provider for full SQL histories, and transactional
+INSERT controls for append-only tables. After publication, pin exactly
+`proof-harness@0.1.0-next.8`. See [compatibility and setup](COMPATIBILITY.md#010-next8)
+for the required consumer changes.
+
+The harness establishes specific tested claims. Acceptance still requires
+consumer-owned requirements and a trusted CI job that controls the harness,
+policies, and evidence. A passing trace is not a general proof of code quality
+or a defense against an executor that can rewrite the acceptance gate.

package/cli/config.mjs

@@ -43,6 +43,11 @@ const DEFAULT_CONFIG = Object.freeze({
     envExample: ".env.local.example",
     supabaseConfig: "supabase/config.toml",
   },
+  // Optional consumer-owned argv used to prepare generated migration inputs
+  // in both the working tree and the archived base before parsing.
+  driftPrepare: null,
+  schemaProvider: null,
+  insertControl: null,
   driftSources: ["app", "package.json"],
   mutationCatalog: null,
 });
@@ -105,3 +110,29 @@ export async function loadMutationCatalog(config) {
 }
 
 export { DEFAULT_CONFIG };
+
+/** Derived outputs are excluded from the source identity, never trust inputs. */
+export function evidenceExclusions(config) {
+  return [
+    ...Object.values(config.artifacts),
+    `${path.dirname(config.artifacts.mutations)}/mutation-recovery.json`,
+  ].map((p) => path.resolve(config.rootDir, p));
+}
+
+/** Reject a trace/output directory that resolves to the repository or its parent. */
+export function assertArtifactDirectory(directory, rootDir) {
+  function canonical(file) {
+    const absolute = path.resolve(file);
+    if (fs.existsSync(absolute)) return fs.realpathSync(absolute);
+    const parent = path.dirname(absolute);
+    return path.join(canonical(parent), path.basename(absolute));
+  }
+  const output = canonical(directory);
+  const root = canonical(rootDir);
+  const relative = path.relative(output, root);
+  if (!relative || (!relative.startsWith("..") && !path.isAbsolute(relative)))
+    throw new Error(
+      "[PROOF_FAIL] unsafe_artifact_directory: output must not be the repository or an ancestor",
+    );
+  return output;
+}

package/cli/engines/parse_proof_schema.mjs

@@ -40,6 +40,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 
+import { assessWithProvider } from "./proof_schema_provider.mjs";
+import { classifyTable } from "./proof_schema_classification.mjs";
 import { loadProofConfig } from "../config.mjs";
 
 const CONFIG = await loadProofConfig();
@@ -269,6 +271,7 @@ function parsePolicies(sql, sourceFile) {
       name: policyName,
       table: tableName,
       command,
+      mode: /\bAS\s+RESTRICTIVE\b/i.test(rest) ? "RESTRICTIVE" : "PERMISSIVE",
       roles,
       using: usingBody.trim(),
       check: checkBody.trim(),
@@ -282,90 +285,33 @@ function parsePolicies(sql, sourceFile) {
 // Classification
 // ---------------------------------------------------------------------------
 
-function policyIndicatesWorkspace(policy) {
-  const body = `${policy.using} ${policy.check}`.toLowerCase();
-  if (body.includes("get_user_workspace_ids(")) return true;
-  if (
-    /workspace_id\s+in\s*\(\s*select\s+workspace_id\s+from\s+workspace_members/i.test(
-      `${policy.using} ${policy.check}`,
-    )
-  ) {
-    return true;
-  }
-  return false;
-}
-
-function policyIndicatesUser(policy) {
-  const body = `${policy.using} ${policy.check}`;
-  // user_id = auth.uid() OR auth.uid() = user_id OR owner/created_by variants
-  const patterns = [
-    /\b(user_id|owner_id|created_by|invited_by)\s*=\s*\(?\s*(select\s+)?auth\.uid\(\)/i,
-    /\bauth\.uid\(\)\s*=\s*(user_id|owner_id|created_by|invited_by)\b/i,
-    /\(\s*select\s+auth\.uid\(\)\s*\)\s*=\s*(user_id|owner_id|created_by|invited_by)\b/i,
-    /\b(user_id|owner_id|created_by|invited_by)\s*=\s*\(\s*select\s+auth\.uid\(\)\s*\)/i,
-  ];
-  return patterns.some((re) => re.test(body));
-}
-
-function policyIsPublicRead(policy) {
-  if (policy.command !== "SELECT" && policy.command !== "ALL") return false;
-  const body = policy.using.trim().toLowerCase();
-  return body === "true";
-}
-
-function classifyTable(policies) {
-  // No policies at all → admin_only (assumes RLS-enabled Supabase table
-  // without authenticated access).
-  if (policies.length === 0) return "admin_only";
-
-  // A policy with no TO clause defaults to `TO public` in Postgres, so
-  // treat an empty `roles` list as implicit public (i.e. authenticated
-  // users are subject to it). This matches the common
-  // `CREATE POLICY foo ON t FOR SELECT USING (...)` pattern.
-  const isAuthFacing = (p) =>
-    p.roles.length === 0 ||
-    p.roles.some((r) => r === "authenticated" || r === "public");
-  const authPolicies = policies.filter(isAuthFacing);
-  const serviceOnly =
-    authPolicies.length === 0 &&
-    policies.length > 0 &&
-    policies.every(
-      (p) => p.roles.length === 1 && p.roles[0] === "service_role",
-    );
-
-  if (serviceOnly) return "service_only";
-
-  // Check workspace first (most specific).
-  if (authPolicies.some(policyIndicatesWorkspace)) return "workspace_scoped";
-  if (authPolicies.some(policyIndicatesUser)) return "user_scoped";
-
-  // public_read: every authenticated-accessible policy is SELECT with
-  // USING (true). (Don't classify as public_read if any write policy
-  // targets authenticated, that's a different pattern.)
-  const readPolicies = authPolicies.filter(
-    (p) => p.command === "SELECT" || p.command === "ALL",
-  );
-  if (
-    readPolicies.length > 0 &&
-    readPolicies.every(policyIsPublicRead) &&
-    authPolicies.every(
-      (p) => p.command === "SELECT" || p.command === "ALL" || p.check === "",
-    )
-  ) {
-    return "public_read";
-  }
-
-  if (authPolicies.length === 0) return "admin_only";
-
-  return "unclassified";
-}
-
 // ---------------------------------------------------------------------------
 // Main
 // ---------------------------------------------------------------------------
 
-export function main() {
+export async function main() {
+  if (CONFIG.schemaProvider) return assessWithProvider(CONFIG);
   const sources = readAllMigrations();
+  const unsupported = [];
+  const enabledTables = new Set();
+  for (const { file, sql } of sources) {
+    // This parser is intentionally conservative. Never preserve historical CREATE
+    // facts as current evidence after an operation we cannot interpret.
+    const enable =
+      /ALTER\s+TABLE\s+(?:ONLY\s+)?(?:"?public"?\.)?"?(\w+)"?\s+ENABLE\s+ROW\s+LEVEL\s+SECURITY\s*;/gi;
+    for (const match of sql.matchAll(enable)) enabledTables.add(match[1]);
+    const remainder = sql.replace(enable, "");
+    if (
+      /\b(?:ALTER\s+(?:TABLE|POLICY)|DROP\s+(?:TABLE|POLICY)|DO\s+\$|EXECUTE\s+)/i.test(
+        remainder,
+      )
+    )
+      unsupported.push({
+        file,
+        reason:
+          "migration changes schema or policy state using unsupported SQL; final schema is unassessable",
+      });
+  }
   const tablesByName = new Map();
   const policiesByTable = new Map();
 
@@ -373,7 +319,10 @@ export function main() {
     for (const t of extractTables(sql, file)) {
       const existing = tablesByName.get(t.name);
       if (existing) {
-        // Merge columns from ALTER TABLE or re-declarations (future-proof).
+        unsupported.push({
+          file,
+          reason: `repeated CREATE TABLE ${t.name} cannot establish final columns`,
+        });
         existing.columns = [...new Set([...existing.columns, ...t.columns])];
         if (!existing.files.includes(file)) existing.files.push(file);
       } else {
@@ -395,17 +344,23 @@ export function main() {
 
   for (const [name, entry] of tablesByName) {
     const policies = policiesByTable.get(name) ?? [];
-    const classification = classifyTable(policies);
+    const classification = enabledTables.has(name)
+      ? classifyTable(policies)
+      : "unclassified";
 
     const normalized = {
       name,
       columns: [...entry.columns].sort(),
       rls_classification: classification,
+      rls_enabled: enabledTables.has(name),
       policies: policies
         .map((p) => ({
           name: p.name,
           command: p.command,
           roles: [...p.roles].sort(),
+          using: p.using,
+          check: p.check,
+          mode: p.mode,
         }))
         .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0)),
       sourceFiles: [...entry.files]
@@ -429,6 +384,8 @@ export function main() {
 
   const output = {
     schemaVersion: 1,
+    assessed: unsupported.length === 0,
+    issues: unsupported,
     tables,
     unclassified: unclassifiedTables,
   };
@@ -439,6 +396,10 @@ export function main() {
   console.log(
     `[proof:parse] parsed ${sources.length} migration file(s); wrote ${tables.length} table(s), ${unclassifiedTables.length} unclassified to ${OUTPUT_PATH}`,
   );
+  if (unsupported.length)
+    throw new Error(
+      `[PROOF_FAIL] schema_unassessed: ${unsupported.map((p) => `${p.file}: ${p.reason}`).join("; ")}`,
+    );
   if (unclassifiedTables.length > 0) {
     console.log(`[proof:parse] unclassified tables:`);
     for (const u of unclassifiedTables)
@@ -453,5 +414,5 @@ const invokedDirectly =
   import.meta.url === pathToFileURL(process.argv[1]).href;
 
 if (invokedDirectly) {
-  main();
+  await main();
 }