proof-harness 0.1.0-next.8 → 0.1.0-next.9

package/COMPATIBILITY.md

@@ -11,7 +11,7 @@ Consumers must pin an exact prerelease version, for example:
 ```json
 {
   "devDependencies": {
-    "proof-harness": "0.1.0-next.7"
+    "proof-harness": "0.1.0-next.8"
   }
 }
 ```
@@ -27,11 +27,118 @@ versions rather than guessing how to interpret them.
 
 ## Prerelease migration notes
 
+### 0.1.0-next.9 — anonymous actions and control sensitivity (release candidate)
+
+Prepared for release; not yet published. After publication, pin exactly
+`proof-harness@0.1.0-next.9` and regenerate capabilities and baseline traces.
+Trace/mission/health versions remain unchanged. Authentication refusal and
+control-sensitivity output contracts use protocol/schema version 1.
+
+#### Anonymous self-service actions (#23)
+
+`assert.authorization` accepts `actor: "anonymous"` for **action probes only**.
+It sends the protected POST invoker request in a fresh API context, without
+login cookies or Authorization, and disables redirect following. It does not
+clear or reuse the authenticated page session. Use the Playwright project's
+`use.baseURL`, an explicit `action.baseURL`, or an already navigated page URL.
+
+```ts
+await assert.authorization({
+  actor: "anonymous", page,
+  action: {
+    module: "user-management", name: "selfDeleteAccount", inputParams: {},
+    expectedAuthRedirect: "/sign-in",
+  },
+});
+```
+
+The consumer must update its **guarded invoker**, after request validation and
+registered-handler lookup. In the catch around actual handler execution:
+
+```ts
+import { authenticationRedirectResponse } from "proof-harness/server";
+// Existing proofGuard, body validation, registry lookup, and handler call stay.
+const refusal = authenticationRedirectResponse(error, request, {
+  module: body.module, action: body.action, allowedRedirects: ["/sign-in"],
+});
+if (refusal) return refusal;
+// Keep the existing failure response for all other exceptions.
+```
+
+Choose the exact authentication destination from the consumer's own auth
+middleware. The adapter recognizes Next.js redirect errors only, requires no
+Cookie/Authorization request headers, and matches an exact allowlisted relative
+URL. It returns HTTP 401 with `{ protocolVersion: 1,
+ type: "proof_action_auth_refusal", module, action,
+ reason: "authentication_required", redirect }`. The client binds that envelope
+to the invoked action and the assertion checks `expectedAuthRedirect`.
+A generic 401/500, `action_threw`, invalid-form rejection, unexpected redirect,
+malformed result, or missing registry entry is incomplete evidence. Anonymous
+success is a failed authorization assertion. No seeded denied role is needed.
+
+Use `assert.actionSucceeds` with a disposable authenticated actor for the
+allowed-path control; account-deletion fixtures remain consumer-owned. The
+adapter's destination list and placement are protected trust inputs: it must
+only normalize authentication redirects from an executed registered action,
+not invoker setup errors or unrelated redirects. This is not automatic proof
+of an arbitrary application's authentication semantics.
+
+Workspace scope discovery now follows local caller-input bindings and accesses,
+including destructuring aliases and direct parse/safeParse results. It no
+longer counts comments, SQL/output keys, or generated/result workspace IDs.
+Unknown user-input dataflow used as workspace scope and dynamic input keys
+remain unassessed. Internal `_BOT.ts` actions retain their existing exemption
+from caller-boundary coverage. This is bounded local analysis, not intermodule
+schema inference. In particular `createTeamWorkspace` no longer inherits a
+cross-tenant requirement merely because it returns a new workspace ID. Declare
+any additional product invariants and add their proofs in the consumer.
+
+#### Separate positive-control sensitivity (#24)
+
+Move the old `TENANT-deny-all` entry out of the primary mutation catalog into
+a separate protected module named by `controlSensitivityCatalog` in
+`proof.config.mjs`. Keep its existing subject, apply SQL and spec; add:
+
+```js
+claims: [],
+controls: [{
+  kind: "tenant_isolation", target: "workspace_members", operation: "select",
+  emittedBy: "assert.tenantIsolation",
+}],
+expectedFailureCode: "tenant_isolation_control",
+```
+
+Run `proof-harness controls --inventory`, then `proof-harness controls` (or
+`--only TENANT-deny-all`). Both require fresh passing baseline evidence for
+every mapped package-origin **control** in the selected spec. The initial
+contract supports tenant-isolation SELECT controls emitted by
+`assert.tenantIsolation` or `assert.authorization`, with the exact failure code
+`tenant_isolation_control`. Other sensitivity categories remain unsupported.
+
+The runner reuses mutation planting/readback, isolated execution, restoration,
+and recovery checks. A successful test needs a non-timeout failed proof, a
+failed mapped control assertion of the same helper origin, and a step error
+beginning with that exact failure code. Setup errors, incomplete/skipped
+assertions, another spec, primary-only failures, or a missing failed control do
+not count. Unexpected owner-control database errors are setup failures rather
+than control rejection; explicit permission denial or zero visible owner rows
+can establish the intended anti-vacuity failure.
+
+Results live separately in `artifacts.controlSensitivity` (default
+`.proof/control-sensitivity`), with `mode: "control-sensitivity"`,
+`controlRejected`/`controlsTurnedRed`, and `detected: false`. They remain planted
+traces and cannot satisfy baseline claims or primary mutation coverage. Use
+`proof-harness controls --recover` for an interrupted run against the same
+local stack; the shared recovery journal blocks either runner until restored.
+Primary `mutate` still rejects `claims: []` with no resolved primary baseline.
+A failed control can no longer count as a failed primary claim of the same
+kind/target/operation. Wire both commands into consumer CI if both properties
+are required.
+
 ### 0.1.0-next.8
 
-Release candidate prepared for publication. Publish from `main` with workflow
-input `0.1.0-next.8` after this version change is merged. Consumers can pin
-`proof-harness@0.1.0-next.8` after the publish workflow succeeds.
+Published release `0.1.0-next.8`. Consumers pin exactly
+`proof-harness@0.1.0-next.8` when adopting these features.
 
 #### Direct RLS clients and Auth administration (#18)
 

package/PROOF_SDK_CONTRACT.md

@@ -1246,3 +1246,23 @@ Such user-facing actions require denial and allowed-control evidence in
 coverage even without a workspace input. Changes use the existing
 `service_role_mutations_changed` drift facet. See `COMPATIBILITY.md` for
 supported factory/binding shapes and required consumer regeneration.
+
+
+## Anonymous invocations and control sensitivity (0.1.0-next.9 candidate)
+
+The versioned anonymous refusal envelope is `ActionAuthenticationRefusal`
+(protocol 1), validated by `isActionAuthenticationRefusal` from the shared
+entry point. The server exports `authenticationRedirectResponse`; Playwright
+exports `actAsUser.invokeAnonymousAction` and accepts `actor: "anonymous"` in
+`assert.authorization` action probes. Only an action-bound, expected
+authentication redirect can establish a passing anonymous denial; generic
+exceptions are not evidence. See `COMPATIBILITY.md` for the required protected
+invoker integration and allowed authenticated control.
+
+`proof-harness controls` consumes `controlSensitivityCatalog` independently
+from primary mutation inventory and writes `mode: "control-sensitivity"`
+results under `artifacts.controlSensitivity`. Its mapped failed controls never
+count as primary mutation detection. The initial contract is limited to
+tenant-isolation SELECT anti-vacuity checks with `tenant_isolation_control`;
+see `COMPATIBILITY.md` for exact selectors, fresh baseline requirements and
+recovery. Consumer claims and product fixtures remain consumer-owned.

package/README.md

@@ -17,7 +17,7 @@ Public prereleases are published under the npm `next` tag. Pin an exact
 prerelease version while the API is stabilizing:
 
 ```sh
-pnpm add proof-harness@0.1.0-next.7
+pnpm add proof-harness@0.1.0-next.8
 ```
 
 The package exposes environment-specific entry points:
@@ -61,7 +61,7 @@ code via `allowProofServiceHosts`; there is deliberately no environment
 override.
 
 The package also provides one `proof-harness` executable with `scan`, `parse`,
-`registry`, `build`, `verify`, `coverage`, `inventory`, `drift`, and `mutate`
+`registry`, `build`, `verify`, `coverage`, `inventory`, `drift`, `mutate`, and `controls`
 subcommands. Commands read repository paths from
 `proof.config.mjs`; without one they use a conventional application layout.
 Product migration aggregation and explicit mutation definitions remain
@@ -101,9 +101,9 @@ See [required migration changes](COMPATIBILITY.md#010-next7--audit-hardening)
 before upgrading a consumer. In particular, existing traces must be rerun and
 unsupported SQL now blocks assessment.
 
-Release candidate `0.1.0-next.8` adds direct RLS client and Auth-admin discovery,
+Release `0.1.0-next.8` adds direct RLS client and Auth-admin discovery,
 a consumer-owned catalog provider for full SQL histories, and transactional
-INSERT controls for append-only tables. After publication, pin exactly
+INSERT controls for append-only tables. Pin exactly
 `proof-harness@0.1.0-next.8`. See [compatibility and setup](COMPATIBILITY.md#010-next8)
 for the required consumer changes.
 
@@ -111,3 +111,9 @@ The harness establishes specific tested claims. Acceptance still requires
 consumer-owned requirements and a trusted CI job that controls the harness,
 policies, and evidence. A passing trace is not a general proof of code quality
 or a defense against an executor that can rewrite the acceptance gate.
+
+
+Release candidate `0.1.0-next.9` adds isolated anonymous action probes and a
+separate positive-control sensitivity runner. It also distinguishes caller
+workspace inputs from generated result IDs. See [next.9 setup and migration](COMPATIBILITY.md)
+before upgrading; consumer invoker and catalog changes are required.

package/cli/config.mjs

@@ -9,6 +9,7 @@ const DEFAULT_CONFIG = Object.freeze({
     traces: ".proof/traces",
     drift: ".proof/drift.json",
     mutations: ".proof/mutations",
+    controlSensitivity: ".proof/control-sensitivity",
   },
   // The module-descriptor system (module.meta.ts → modules.json and its
   // checker) moved to the consumer template in 0.1.0-next.6: it serves the
@@ -50,6 +51,7 @@ const DEFAULT_CONFIG = Object.freeze({
   insertControl: null,
   driftSources: ["app", "package.json"],
   mutationCatalog: null,
+  controlSensitivityCatalog: null,
 });
 
 function mergeConfig(config = {}) {

package/cli/engines/proof_control_sensitivity.mjs

@@ -0,0 +1,95 @@
+const assertionHelpers = new Set([
+  "assert.tenantIsolation",
+  "assert.authorization",
+  "assert.actionSucceeds",
+  "assert.httpResponse",
+]);
+const helpers = new Set(["assert.tenantIsolation", "assert.authorization"]);
+const primary = (a) =>
+  a.role === undefined ||
+  a.role === null ||
+  ["primary", "negative"].includes(a.role);
+const control = (a) => ["control", "positive_control"].includes(a.role);
+const decisive = (a) => a.status !== "incomplete" && a.status !== "skipped";
+const matches = (a, s) =>
+  a.kind === s.kind &&
+  a.target === s.target &&
+  a.operation === s.operation &&
+  (!s.emittedBy || a.emittedBy === s.emittedBy);
+
+export function validateControlBaseline(mutation, traces) {
+  if (
+    !Array.isArray(mutation.claims) ||
+    mutation.claims.length ||
+    !Array.isArray(mutation.controls) ||
+    !mutation.controls.length ||
+    mutation.expectedFailureCode !== "tenant_isolation_control"
+  )
+    throw new Error(
+      `[PROOF_FAIL] control_contract: ${mutation.id} requires claims: [], nonempty controls, and expectedFailureCode: tenant_isolation_control`,
+    );
+  for (const selector of mutation.controls) {
+    if (
+      selector.kind !== "tenant_isolation" ||
+      selector.operation !== "select" ||
+      typeof selector.target !== "string" ||
+      !selector.target ||
+      !helpers.has(selector.emittedBy)
+    )
+      throw new Error(
+        `[PROOF_FAIL] control_contract: ${mutation.id} has an unsupported control selector`,
+      );
+    const exists = traces.some(
+      (t) =>
+        t.specFile === mutation.spec &&
+        t.passed === true &&
+        !t.mutation &&
+        t.steps.some(
+          (step) =>
+            step.passed === true &&
+            (step.assertions ?? []).some(
+              (a) =>
+                a.passed === true &&
+                decisive(a) &&
+                control(a) &&
+                matches(a, selector),
+            ),
+        ),
+    );
+    if (!exists)
+      throw new Error(
+        `[PROOF_FAIL] control_baseline_missing: ${mutation.id} has no fresh passing package-origin control for ${selector.target}`,
+      );
+  }
+  return mutation.controls;
+}
+
+/** Control failures cannot satisfy primary claim detection, even for the same key. */
+export function assertionSelectorsTurnedRed(
+  traces,
+  selectors,
+  role,
+  expectedFailureCode,
+) {
+  if (!selectors.length) return false;
+  return selectors.every((selector) =>
+    traces.some(
+      (t) =>
+        t.passed === false &&
+        t.steps.some(
+          (step) =>
+            step.passed === false &&
+            (!expectedFailureCode ||
+              step.error?.startsWith(`[PROOF_FAIL] ${expectedFailureCode}:`)) &&
+            (step.assertions ?? []).some(
+              (a) =>
+                a.passed === false &&
+                decisive(a) &&
+                (role === "control" ? control(a) : primary(a)) &&
+                assertionHelpers.has(a.emittedBy) &&
+                matches(a, selector),
+            ),
+        ),
+    ),
+  );
+}

package/cli/engines/proof_input_scope.mjs

@@ -0,0 +1,177 @@
+import ts from "typescript";
+const workspace = (name) => /^(workspaceId|workspace_id)$/.test(name);
+function visit(node, fn) {
+  fn(node);
+  ts.forEachChild(node, (child) => visit(child, fn));
+}
+function unwrap(node) {
+  while (
+    node &&
+    (ts.isParenthesizedExpression(node) ||
+      ts.isAwaitExpression(node) ||
+      ts.isAsExpression(node))
+  )
+    node = node.expression;
+  return node;
+}
+
+/** Trace caller input bindings, never result fields, comments or SQL keys. */
+export function actionAcceptsWorkspaceInput(
+  source,
+  checker,
+  exportName,
+  problems,
+) {
+  let owner;
+  visit(source, (node) => {
+    if (
+      (ts.isFunctionDeclaration(node) || ts.isVariableDeclaration(node)) &&
+      node.name?.getText(source) === exportName
+    )
+      owner = node;
+  });
+  if (owner && ts.isVariableDeclaration(owner))
+    owner = unwrap(owner.initializer);
+  if (
+    !owner ||
+    !(
+      ts.isFunctionDeclaration(owner) ||
+      ts.isArrowFunction(owner) ||
+      ts.isFunctionExpression(owner)
+    )
+  )
+    return false;
+  const inputs = new Map();
+  const containers = new Set();
+  let found = false;
+  const symbol = (node) => checker.getSymbolAtLocation(node);
+  const typeHasWorkspace = (type, seen = new Set()) => {
+    if (!type || seen.has(type)) return false;
+    seen.add(type);
+    return checker
+      .getPropertiesOfType(type)
+      .some(
+        (p) =>
+          workspace(p.name) ||
+          (p.name !== "contextParams" &&
+            p.valueDeclaration &&
+            typeHasWorkspace(
+              checker.getTypeOfSymbolAtLocation(p, p.valueDeclaration),
+              seen,
+            )),
+      );
+  };
+  function bind(name, state) {
+    if (ts.isIdentifier(name)) {
+      inputs.set(symbol(name), state);
+      return;
+    }
+    if (ts.isObjectBindingPattern(name))
+      for (const element of name.elements) {
+        const key = (element.propertyName ?? element.name)
+          .getText(source)
+          .replace(/["']/g, "");
+        if (workspace(key)) {
+          if (state === "known") found = true;
+          else
+            problems.push("workspace input passes through unresolved dataflow");
+        }
+        bind(element.name, state);
+      }
+  }
+  for (const parameter of owner.parameters) {
+    if (ts.isIdentifier(parameter.name)) {
+      if (parameter.name.text === "contextParams") continue;
+      if (workspace(parameter.name.text)) found = true;
+      const type = checker.getTypeAtLocation(parameter);
+      const nested = type.getProperty("inputParams");
+      if (nested) {
+        containers.add(symbol(parameter.name));
+        if (
+          typeHasWorkspace(checker.getTypeOfSymbolAtLocation(nested, parameter))
+        )
+          found = true;
+      } else {
+        bind(parameter.name, "known");
+        if (typeHasWorkspace(type)) found = true;
+      }
+    } else if (ts.isObjectBindingPattern(parameter.name)) {
+      for (const element of parameter.name.elements) {
+        const key = (element.propertyName ?? element.name).getText(source);
+        if (key === "contextParams") continue;
+        bind(element.name, "known");
+        if (
+          workspace(key) ||
+          typeHasWorkspace(checker.getTypeAtLocation(element))
+        )
+          found = true;
+      }
+    }
+  }
+  function state(node) {
+    node = unwrap(node);
+    if (!node) return undefined;
+    if (ts.isIdentifier(node)) return inputs.get(symbol(node));
+    if (
+      ts.isPropertyAccessExpression(node) ||
+      ts.isElementAccessExpression(node)
+    ) {
+      const key = ts.isPropertyAccessExpression(node)
+        ? node.name.text
+        : node.argumentExpression?.text;
+      if (
+        ts.isIdentifier(node.expression) &&
+        containers.has(symbol(node.expression))
+      )
+        return key === "inputParams" ? "known" : undefined;
+      return state(node.expression);
+    }
+    if (ts.isCallExpression(node)) {
+      const fromInput = node.arguments.map(state).find(Boolean);
+      if (fromInput)
+        return ts.isPropertyAccessExpression(node.expression) &&
+          ["parse", "safeParse"].includes(node.expression.name.text)
+          ? fromInput
+          : "unknown";
+    }
+    return undefined;
+  }
+  const declarations = [];
+  visit(owner, (node) => {
+    if (ts.isVariableDeclaration(node)) declarations.push(node);
+  });
+  for (let pass = 0; pass <= declarations.length; pass++)
+    for (const node of declarations) {
+      const input = state(node.initializer);
+      if (input) {
+        bind(
+          node.name,
+          node.parent.flags & ts.NodeFlags.Const ? input : "unknown",
+        );
+      }
+    }
+  visit(owner, (node) => {
+    if (
+      !(
+        ts.isPropertyAccessExpression(node) ||
+        ts.isElementAccessExpression(node)
+      )
+    )
+      return;
+    const key = ts.isPropertyAccessExpression(node)
+      ? node.name.text
+      : node.argumentExpression?.text;
+    const input = state(node.expression);
+    if (workspace(key) && input) {
+      if (input === "known") found = true;
+      else problems.push("workspace input passes through unresolved dataflow");
+    }
+    if (
+      ts.isElementAccessExpression(node) &&
+      input &&
+      !ts.isStringLiteral(node.argumentExpression)
+    )
+      problems.push("dynamic caller input key cannot be assessed");
+  });
+  return found;
+}