sparda-mcp 0.70.1 → 0.71.1

package/demo-app/.sparda/immunity.json

@@ -1 +1 @@
-{"v":"imm1","proven":false,"surfaceOnly":true,"coverage":null,"blindHigh":0,"routes":[{"behaviorHash":"bh1_13969839d8a18d54aa0342618e56db6a","pol":121,"exposed":[]},{"behaviorHash":"bh1_2daf8a2b1b0ed393d443991a2b0700f6","pol":121,"exposed":[]},{"behaviorHash":"bh1_58fbf5ac38b6d71abc7204921de6b957","pol":121,"exposed":[]},{"behaviorHash":"bh1_58fbf5ac38b6d71abc7204921de6b957","pol":121,"exposed":[]},{"behaviorHash":"bh1_cc6788289c612af85b8d215b5bdf9b28","pol":121,"exposed":[]}],"posture":{"auth":{"protected":0,"exposed":0,"na":5},"atomicity":{"protected":0,"exposed":0,"na":5},"reversibility":{"protected":0,"exposed":0,"na":5},"validation":{"protected":0,"exposed":0,"na":5},"aggregate":{"protected":0,"exposed":0,"na":5}},"bytes":5}
+{"v":"imm1","proven":null,"premiseBasis":"unmeasured","surfaceOnly":true,"coverage":null,"blindHigh":0,"routes":[{"behaviorHash":"bh1_13969839d8a18d54aa0342618e56db6a","pol":121,"exposed":[]},{"behaviorHash":"bh1_2daf8a2b1b0ed393d443991a2b0700f6","pol":121,"exposed":[]},{"behaviorHash":"bh1_58fbf5ac38b6d71abc7204921de6b957","pol":121,"exposed":[]},{"behaviorHash":"bh1_58fbf5ac38b6d71abc7204921de6b957","pol":121,"exposed":[]},{"behaviorHash":"bh1_cc6788289c612af85b8d215b5bdf9b28","pol":121,"exposed":[]}],"posture":{"auth":{"protected":0,"exposed":0,"na":5},"atomicity":{"protected":0,"exposed":0,"na":5},"reversibility":{"protected":0,"exposed":0,"na":5},"validation":{"protected":0,"exposed":0,"na":5},"aggregate":{"protected":0,"exposed":0,"na":5}},"bytes":5}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sparda-mcp",
-  "version": "0.70.1",
+  "version": "0.71.1",
   "mcpName": "io.github.zyx77550/sparda-mcp",
   "description": "AI writes. SPARDA proves. A deterministic, offline gate that catches when an AI edit removes a guard, exposes a route, or breaks an invariant \u2014 no API key, right in the agent edit loop.",
   "type": "module",
@@ -31,7 +31,7 @@
     "mutation": "node tests/mutation/run.mjs",
     "wedge": "node bench/wedge.mjs",
     "release:check": "node scripts/release-gate.mjs",
-    "publish:vscode": "cd extensions/vscode && vsce publish"
+    "publish:vscode": "cd extensions/vscode && npx --yes @vscode/vsce@3.9.2 publish"
   },
   "files": [
     "src",

package/src/commands/apocalypse.js

@@ -19,7 +19,7 @@ import {
   buildProofObjects,
 } from '../ubg/apocalypse.js';
 import { surveyBlindspots, coveragePct } from '../ubg/blindspots.js';
-import { premiseFor, withPremiseGaps } from '../ubg/premise.js';
+import { premiseFor, withPremiseGaps, basisFrom } from '../ubg/premise.js';
 import { atomicWriteFileSync as atomicWrite } from '../server/persistence.js';
 
 // version travels with the proof so an audit knows which prover produced it
@@ -86,6 +86,7 @@ export async function runApocalypse(opts) {
     coverage: blind.coverage.ratio,
     blindHigh: blind.byRisk.critical + blind.byRisk.high,
     premiseGaps: premise.available ? premise.gaps.length : 0,
+    premiseBasis: basisFrom(premise),
   });
 
   if (opts.sarif) {

package/src/commands/badge.js

@@ -10,7 +10,7 @@ import { compileUBG } from '../ubg/compile.js';
 import { canonicalizeGraph } from '../ubg/schema.js';
 import { checkGraph, verdictOf, badgeFor } from '../ubg/apocalypse.js';
 import { surveyBlindspots, coveragePct } from '../ubg/blindspots.js';
-import { premiseFor, withPremiseGaps } from '../ubg/premise.js';
+import { premiseFor, withPremiseGaps, basisFrom } from '../ubg/premise.js';
 
 export async function runBadge(opts) {
   const { graph, report } = compileUBG(opts.cwd, { write: false });
@@ -28,6 +28,7 @@ export async function runBadge(opts) {
     coverage: blind.coverage.ratio,
     blindHigh: blind.byRisk.critical + blind.byRisk.high,
     premiseGaps: premise.available ? premise.gaps.length : 0,
+    premiseBasis: basisFrom(premise),
   });
   // null = measured-but-unknown (0/0): the JSON keeps the null, the console says the word
   const cov =

package/src/commands/dossier.js

@@ -10,7 +10,7 @@ import path from 'node:path';
 import { compileUBG } from '../ubg/compile.js';
 import { canonicalizeGraph } from '../ubg/schema.js';
 import { checkGraph, verdictOf, verdictState } from '../ubg/apocalypse.js';
-import { premiseFor, withPremiseGaps } from '../ubg/premise.js';
+import { premiseFor, withPremiseGaps, basisFrom } from '../ubg/premise.js';
 import { surveyBlindspots, coveragePct } from '../ubg/blindspots.js';
 import { buildCapsule } from '../ubg/immunity.js';
 import { AXES, POLARITY_SYMBOL, exposedAxes } from '../ubg/polarity.js';
@@ -20,7 +20,6 @@ export async function runDossier(opts) {
   const compiled = compileUBG(opts.cwd, { write: false, openapi: opts.openapi });
   const canonical = canonicalizeGraph(compiled.graph);
   const { findings, polarity } = checkGraph(canonical);
-  const capsule = buildCapsule(canonical);
   // the public report — same rule as the badge: it must not describe an app SPARDA
   // never fully had
   const premise = await premiseFor(canonical, compiled.report, {
@@ -35,7 +34,11 @@ export async function runDossier(opts) {
     coverage: blindspots.coverage.ratio,
     blindHigh: blindspots.byRisk.critical + blindspots.byRisk.high,
     premiseGaps: premise.available ? premise.gaps.length : 0,
+    premiseBasis: basisFrom(premise),
   });
+  // built AFTER the premise, deliberately: the old ordering put `buildCapsule` three lines
+  // above the only value that licenses it, which is how the capsule stayed ungraded (E-106).
+  const capsule = buildCapsule(canonical, { premiseBasis: basisFrom(premise) });
 
   const data = {
     app: path.basename(path.resolve(opts.cwd)) || 'app',

package/src/commands/enforce.js

@@ -29,6 +29,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { parse } from '@babel/parser';
 import { compileUBG } from '../ubg/compile.js';
+import { premiseFor } from '../ubg/premise.js';
 import { canonicalizeGraph } from '../ubg/schema.js';
 import {
   checkGraph,
@@ -141,11 +142,35 @@ function applyEdits(src, plan, principal, shimBody) {
   return out;
 }
 
+// The DELTA verdict: same app, before and after the synthesized check. Deliberately
+// premise-blind — the premise is identical on both sides, so it cannot discriminate, and
+// enforce V1 is Express-only where no boot-free oracle exists. Gating the rollback decision
+// on it would not make enforce safer, it would make enforce impossible.
+//
+// What the premise DOES license is the WORD. Those are two different questions and E-104 is
+// what happens when one answer is used for both: the edit is justified by the delta, the
+// announcement by the oracle. See `announcedState` below.
 function compileVerdict(cwd) {
-  const canonical = canonicalizeGraph(compileUBG(cwd, { write: false }).graph);
+  const { graph, report } = compileUBG(cwd, { write: false });
+  const canonical = canonicalizeGraph(graph);
   const { findings } = checkGraph(canonical);
   const verdict = verdictOf(findings, canonical, {});
-  return { canonical, findings, verdict, state: verdictState(verdict) };
+  return { canonical, report, findings, verdict, state: verdictState(verdict) };
+}
+
+// The word this command is allowed to print, once the edit has proven itself.
+//
+// Before E-104 this was the literal string 'PROVEN (ENFORCED)', announced unconditionally on
+// every successful run — on Express, the only framework enforce V1 supports, and one with no
+// boot-free oracle. So the strongest word SPARDA has was printed on an app whose route table
+// nobody had checked, every single time.
+//
+// The synthesized check really was verified on the recompiled graph; that part was never a
+// lie. What was missing is that a verified guard over an UNVERIFIED ROUTE SET does not add up
+// to PROVEN — Direction 3 is a claim about the subject, not the proof.
+async function announcedState(cwd, canonical, report) {
+  const premise = await premiseFor(canonical, report, { cwd });
+  return premise.available ? 'PROVEN (ENFORCED)' : 'PARTIAL (ENFORCED)';
 }
 
 export function readEnforceManifest(cwd) {
@@ -272,13 +297,14 @@ export async function runEnforce(opts) {
     JSON.stringify(manifest, null, 2) + '\n',
   );
 
+  const announced = await announcedState(cwd, after.canonical, after.report);
   if (opts.json)
     console.log(
       JSON.stringify(
         {
           enforced: manifest.routes,
           files: Object.keys(manifest.files),
-          verdict: 'PROVEN (ENFORCED)',
+          verdict: announced,
         },
         null,
         2,
@@ -287,7 +313,11 @@ export async function runEnforce(opts) {
   else {
     for (const t of targets) log(`  ✓ enforced ${t.label}`);
     log(
-      `\n✓ PROVEN (ENFORCED) — ${targets.length} route(s) now carry a boundary check SPARDA verified on the recompiled graph.\n  Revert any time: sparda enforce --revert (byte-for-byte).`,
+      `\n✓ ${announced} — ${targets.length} route(s) now carry a boundary check SPARDA verified on the recompiled graph.` +
+        (announced.startsWith('PARTIAL')
+          ? `\n  Not PROVEN: no oracle checked this app's route table, so Direction 3 is unverified. Run with --probe to measure it.`
+          : '') +
+        `\n  Revert any time: sparda enforce --revert (byte-for-byte).`,
     );
   }
 }

package/src/commands/gate.js

@@ -125,8 +125,12 @@ export async function runGate(opts) {
   try {
     ({ graph, report } = compileUBG(opts.cwd, { write: false }));
   } catch (err) {
+    // `ok` is DELIBERATELY absent, not `true`. Abstaining is right — the agent is mid-edit and
+    // a false alarm here is worse than silence — but a consumer reading `ok` must not be able
+    // to read a pass out of a check that never ran. The gate still exits 0; it just refuses to
+    // say the word (ADR-092).
     if (opts.json)
-      console.log(JSON.stringify({ ok: true, abstained: err.message }, null, 2));
+      console.log(JSON.stringify({ ok: null, abstained: err.message }, null, 2));
     else if (!hook)
       say(
         `⏳ GATE ABSTAINED — the tree does not compile yet (${err.message}). Fix it, then re-check.`,

package/src/commands/genome.js

@@ -21,16 +21,23 @@ import {
   emptyGenome,
   recall,
 } from '../ubg/genome.js';
+import { premiseFor, basisFrom } from '../ubg/premise.js';
 import { atomicWriteFileSync as atomicWrite } from '../server/persistence.js';
 
 const GENOME_FILE = 'sparda-genome.jsonl';
 const KEY_FILE = 'genome.key';
 
 export async function runGenome(opts) {
-  const canonical = canonicalizeGraph(
-    compileUBG(opts.cwd, { write: false, openapi: opts.openapi }).graph,
-  );
-  const capsule = buildCapsule(canonical);
+  const compiled = compileUBG(opts.cwd, { write: false, openapi: opts.openapi });
+  const canonical = canonicalizeGraph(compiled.graph);
+  // The premise matters MORE here than anywhere, and it was the one place that never asked
+  // (E-106). An antibody is a per-behavior claim, so a route the compiler never saw does not
+  // falsify the antibodies that were minted — it means no antibody exists for it. But this
+  // contribution is signed, content-addressed and merged into a file other people pull, and
+  // a genome that silently under-represents an app teaches the world that the surface it
+  // covers IS the app. The gaps are named below rather than counted.
+  const premise = await premiseFor(canonical, compiled.report, { cwd: opts.cwd });
+  const capsule = buildCapsule(canonical, { premiseBasis: basisFrom(premise) });
   const identity = loadOrCreateIdentity(opts.cwd);
   const minted = mintGenome(capsule, identity);
 
@@ -62,6 +69,19 @@ export async function runGenome(opts) {
   console.log(
     `  merged: +${added} new, ${corroborated} corroborated → ${genome.antibodies.length} antibody(ies) in ${GENOME_FILE}`,
   );
+  // What this contribution is NOT. A count of antibodies reads as a measure of the app; it is
+  // a measure of the surface SPARDA had. Gaps are NAMED, because "3 routes missing" is a
+  // number a reader discounts and "GET /api/legacy/purge" is one they go and look at.
+  if (premise.available && premise.gaps.length)
+    for (const g of premise.gaps)
+      console.log(
+        `  ⚠ no antibody for ${g.method} ${g.path} — the ${premise.oracle} oracle serves it, the compiler never saw it`,
+      );
+  else if (capsule.premiseBasis === 'unmeasured')
+    console.log(
+      `  ◐ UNMEASURED PREMISE — no oracle checked this app's route table, so this contribution` +
+        ` covers the surface SPARDA saw, which may not be the app (${premise.reason}).`,
+    );
   // surface any behavior the world now disagrees about — load-bearing signal
   const conflicts = distinctHashes(genome).filter((h) => recall(genome, h).conflict);
   if (conflicts.length)

package/src/commands/heal.js

@@ -102,7 +102,13 @@ async function gate(opts, id, flight, healDir) {
   const staticFindings = checkGraph(fixedGraph).findings;
   let regressions;
   const baselinePath = path.join(healDir, 'baseline.json');
-  if (fs.existsSync(baselinePath)) {
+  // "nothing protected got removed" is a DELTA, and a delta needs two sides. `--check` can be
+  // run without the diagnose phase ever having frozen `baseline.json` — and then `diffGraphs`
+  // never runs, so no removed guard can possibly be detected. The old verdict line said
+  // "zero protection lost" either way: a property nothing had measured, asserted as an
+  // outcome. Tracked, so the headline can be qualified rather than the check silently skipped.
+  const deltaMeasured = fs.existsSync(baselinePath);
+  if (deltaMeasured) {
     const baseline = JSON.parse(fs.readFileSync(baselinePath, 'utf8'));
     regressions = diffGraphs(baseline, fixedGraph).findings;
     // pre-existing static findings are not the fix's fault — only NEW ones gate
@@ -131,14 +137,31 @@ async function gate(opts, id, flight, healDir) {
   console.log(
     `  ${apocalypse.safe ? '✓' : '✗'} apocalypse: ${regressions.length === 0 ? 'no new findings' : regressions.map((f) => f.rule).join(', ')}`,
   );
+  if (!deltaMeasured)
+    console.log(
+      `  ◐ guard delta UNMEASURED — no baseline.json in .sparda/heal/${id}/;` +
+        ` run \`sparda heal ${id}\` first so the pre-fix graph is frozen`,
+    );
 
   const ok = healing.healed && laws.ok && apocalypse.safe;
-  const report = { id, healed: healing, laws: laws.checks, regressions, ok };
+  const report = {
+    id,
+    healed: healing,
+    laws: laws.checks,
+    regressions,
+    deltaMeasured,
+    ok,
+  };
   atomicWrite(path.join(healDir, 'report.json'), JSON.stringify(report, null, 2) + '\n');
 
   if (ok) {
+    // The claim is trimmed to what was actually measured. Without a baseline the fixed tree
+    // was still graded — every static finding gated, which is STRICTER — but "zero protection
+    // lost" specifically requires the before/after diff, so it is not said.
     console.log(
-      `✓ HEALED & PROVEN — same recorded inputs, correct output, zero law broken, zero protection lost. Ship it.`,
+      deltaMeasured
+        ? `✓ HEALED & PROVEN — same recorded inputs, correct output, zero law broken, zero protection lost. Ship it.`
+        : `◐ HEALED, PARTIALLY PROVEN — same recorded inputs, correct output, zero law broken, no static finding. Whether a guard was REMOVED is unmeasured: no pre-fix graph was frozen.`,
     );
   } else {
     console.log(

package/src/commands/immunize.js

@@ -11,13 +11,18 @@ import { compileUBG } from '../ubg/compile.js';
 import { canonicalizeGraph } from '../ubg/schema.js';
 import { buildCapsule } from '../ubg/immunity.js';
 import { AXES } from '../ubg/polarity.js';
+import { premiseFor, basisFrom } from '../ubg/premise.js';
 import { atomicWriteFileSync as atomicWrite } from '../server/persistence.js';
 
 export async function runImmunize(opts) {
-  const canonical = canonicalizeGraph(
-    compileUBG(opts.cwd, { write: false, openapi: opts.openapi }).graph,
-  );
-  const capsule = buildCapsule(canonical);
+  const compiled = compileUBG(opts.cwd, { write: false, openapi: opts.openapi });
+  const canonical = canonicalizeGraph(compiled.graph);
+  // THE PREMISE, asked here too (E-106). `immunize` grades a compiled graph and freezes the
+  // result into a portable artifact — the strongest claim in the product, because it is the
+  // one that leaves the repo. It printed an `UNMEASURED PREMISE` branch that no call path
+  // could reach, because nothing ever told the capsule on what basis it was built.
+  const premise = await premiseFor(canonical, compiled.report, { cwd: opts.cwd });
+  const capsule = buildCapsule(canonical, { premiseBasis: basisFrom(premise) });
 
   if (opts.json) {
     console.log(JSON.stringify(capsule, null, 2));
@@ -44,11 +49,18 @@ export async function runImmunize(opts) {
   const exposed = AXES.filter((a) => capsule.posture[a].exposed > 0)
     .map((a) => `${a}×${capsule.posture[a].exposed}`)
     .join(', ');
-  const verdictText = capsule.surfaceOnly
-    ? '● SURFACE ONLY — routes seen, no behavior resolved (nothing to prove)'
-    : capsule.proven
-      ? '✓ PROVEN'
-      : '✗ NOT PROVEN';
+  // `proven` is three-state since ADR-092: null means the premise behind this capsule was
+  // never measured, so the capsule carries no licence for the strongest word. Checked FIRST —
+  // a falsy `null` read as "not proven" would be a different lie in the safe direction, and
+  // still a lie.
+  const verdictText =
+    capsule.proven === null
+      ? "◑ UNMEASURED PREMISE — no oracle checked this app's route table, so this capsule cannot claim PROVEN"
+      : capsule.surfaceOnly
+        ? '● SURFACE ONLY — routes seen, no behavior resolved (nothing to prove)'
+        : capsule.proven
+          ? '✓ PROVEN'
+          : '✗ NOT PROVEN';
   console.log(`  verdict: ${verdictText}` + (exposed ? ` — exposed: ${exposed}` : ''));
   console.log(
     `  coverage: ${(capsule.coverage * 100).toFixed(0)}% of observed behavior resolved` +
@@ -60,6 +72,11 @@ export async function runImmunize(opts) {
   );
   // surface-only is not a risk (nothing to fault) → don't fail CI; only a real
   // unproven capsule (an exposed axis) gates.
-  if (!capsule.proven && !capsule.surfaceOnly) process.exitCode = 1;
+  //
+  // `=== false`, not `!capsule.proven`: `null` is falsy, and gating on it would make SPARDA
+  // fail a build because no oracle was AVAILABLE — demanding what it could not measure, which
+  // premise.js forbids in exactly these words. Withholding the word and finding a fault are
+  // different outcomes, and only the second one closes a gate.
+  if (capsule.proven === false && !capsule.surfaceOnly) process.exitCode = 1;
   return { capsule, outPath };
 }

package/src/commands/prove.js

@@ -9,7 +9,7 @@ import { compileUBG } from '../ubg/compile.js';
 import { canonicalizeGraph } from '../ubg/schema.js';
 import { checkGraph, verdictOf, verdictState, badgeFor } from '../ubg/apocalypse.js';
 import { surveyBlindspots, coveragePct } from '../ubg/blindspots.js';
-import { premiseFor, withPremiseGaps } from '../ubg/premise.js';
+import { premiseFor, withPremiseGaps, basisFrom } from '../ubg/premise.js';
 import { buildCapsule } from '../ubg/immunity.js';
 import { fingerprintGraph } from '../ubg/fingerprint.js';
 import { suggestAppDirs } from '../detect.js';
@@ -39,8 +39,12 @@ export async function runProve(opts) {
     coverage: blind.coverage.ratio,
     blindHigh: blind.byRisk.critical + blind.byRisk.high,
     premiseGaps: premise.available ? premise.gaps.length : 0,
+    premiseBasis: basisFrom(premise),
   });
-  const capsule = buildCapsule(canonical);
+  // The capsule is graded on the SAME basis as the verdict. It shipped without one (E-106):
+  // `prove` computed the premise two lines above, used it for the verdict word, and then
+  // built a portable capsule that re-asserted `proven: true` with no licence at all.
+  const capsule = buildCapsule(canonical, { premiseBasis: basisFrom(premise) });
   const prints = fingerprintGraph(canonical);
   // one app-level seal: a content address over every route's behavior hash — the same
   // behavior, in any repo, yields the same seal (the genome's join key, made visible).
@@ -77,7 +81,14 @@ export async function runProve(opts) {
           probed: premise.probed,
           gaps: premise.gaps.length,
         }
-      : { verified: false, reason: premise.reason },
+      : {
+          verified: false,
+          // 'unmeasured' (no oracle ran) vs 'declared' (OpenAPI — the document analysed IS
+          // the route table). A machine consumer that cannot tell those apart is in exactly
+          // the position E-104 put the verdict in.
+          basis: premise.basis ?? 'unmeasured',
+          reason: premise.reason,
+        },
     findings: findings.map((f) => ({
       rule: f.rule,
       severity: f.severity,
@@ -147,6 +158,15 @@ export async function runProve(opts) {
       );
     if (summary.blindHigh > 0)
       reasons.push(`${summary.blindHigh} high-risk blind spot(s)`);
+    // FIRST, because it is the only rung that is about the SUBJECT rather than the proof.
+    // A reader told "PARTIAL: 100% of the surface resolved" and nothing else concludes the
+    // analysis was thorough and the word merely cautious. The truth was that no oracle ever
+    // checked whether the surface analysed was the app's — and that is a different sentence,
+    // with a different remedy (E-104).
+    if (verdict.premiseUnmeasured)
+      reasons.unshift(
+        `the route table was never checked by an oracle — no boot-free oracle for this framework, and --probe was not used, so Direction 3 is UNVERIFIED (not a finding: an unmeasured premise, which PROVEN would assert)`,
+      );
     if (verdict.coverageUnknown)
       reasons.push(
         `coverage is UNKNOWN (0 behaviors resolved out of 0 seen — no measurement, not a pass)`,

package/src/commands/review.js

@@ -86,6 +86,7 @@ export function reviewGraphs(
       coverage: candCov,
       blindHigh: candBlind.byRisk.critical + candBlind.byRisk.high,
       premiseGaps: premise?.available ? premise.gaps.length : 0,
+      premiseBasis: premise?.available ? 'measured' : (premise?.basis ?? 'unmeasured'),
     }),
     obligations,
     findings,

package/src/commands/speculate.js

@@ -65,7 +65,9 @@ export async function runSpeculate(opts) {
           (result.novel.length ? ` · ${result.novel.length} novel need full proof` : '')
       : result.novel.length
         ? `· ${result.novel.length} novel shape(s) need the full prover — run \`sparda apocalypse\``
-        : `✓ PROVEN (by lookup) — every route settled from the frozen capsule, zero prover work`,
+        : capsule?.proven === null
+          ? `◑ UNMEASURED PREMISE (by lookup) — every route settled from the frozen capsule, but nothing ever checked that capsule's route table`
+          : `✓ PROVEN (by lookup) — every route settled from the frozen capsule, zero prover work`,
   );
   if (result.rejected.length) process.exitCode = 1;
   return { result };

package/src/commands/stitch.js

@@ -17,7 +17,14 @@ export async function runStitch(opts, dirs) {
     process.exitCode = 1;
     return;
   }
+  // A service that does not compile is UNMEASURED, and the join is only as complete as the
+  // set it ran over. The failure used to go to stderr and nowhere else: the headline still
+  // said "no cross-service calls resolved (targets may be dynamic or unrelated)" — a
+  // reassuring parenthetical for what was really "we compiled one of your two services".
+  // Cross-service BOLA is found by JOINING; half a join finds nothing and says nothing,
+  // which is the most confident silence in the product.
   const services = [];
+  const unread = [];
   for (const d of dirs) {
     const abs = path.resolve(opts.cwd, d);
     try {
@@ -26,7 +33,7 @@ export async function runStitch(opts, dirs) {
       const { findings } = checkGraph(g);
       services.push({ name: path.basename(abs), graph: g, findings });
     } catch (e) {
-      console.error(`  ✗ ${d}: ${e.message.slice(0, 70)}`);
+      unread.push({ dir: d, reason: e.message.slice(0, 140) });
     }
   }
 
@@ -34,16 +41,32 @@ export async function runStitch(opts, dirs) {
 
   if (opts.json) {
     console.log(
-      JSON.stringify({ services: services.map((s) => s.name), edges, findings }, null, 2),
+      JSON.stringify(
+        { services: services.map((s) => s.name), unread, edges, findings },
+        null,
+        2,
+      ),
     );
+    // the JSON consumer is a CI job, and it must not read an empty `findings` over a partial
+    // join as a clean bill of health
+    if (unread.length) process.exitCode = 1;
     return;
   }
 
   console.log(`\nSPARDA · stitch — ${services.map((s) => s.name).join(' · ')}`);
   console.log('─'.repeat(52));
+  // stated BEFORE the result, because it is the qualifier on everything that follows
+  for (const u of unread) console.log(`  ✗ ${u.dir} did not compile — ${u.reason}`);
+  if (unread.length)
+    console.log(
+      `  ◐ PARTIAL JOIN — ${services.length} of ${dirs.length} service(s) read.` +
+        ` Any call to or from the missing one(s) is UNMEASURED, not absent.`,
+    );
   if (!edges.length) {
     console.log(
-      '  no cross-service calls resolved (targets may be dynamic or unrelated)',
+      unread.length
+        ? '  no cross-service calls resolved among the services that DID compile'
+        : '  no cross-service calls resolved (targets may be dynamic or unrelated)',
     );
   } else {
     console.log(`  ${edges.length} cross-service call(s):`);
@@ -55,4 +78,6 @@ export async function runStitch(opts, dirs) {
     for (const f of findings) console.log(`    ${f.message}`);
   }
   console.log('');
+  if (unread.length) process.exitCode = 1;
+  return { services: services.map((s) => s.name), unread, edges, findings };
 }

package/src/commands/timeless.js

@@ -77,9 +77,23 @@ async function replay(opts, id) {
     `TIMELESS — replaying ${flight.request.method} ${flight.request.url} (${flight.taps.length} taps virtualized)`,
   );
   if (result.match) {
-    console.log(
-      `✓ byte-identical replay — status ${result.actual.status}, every tap consumed, zero divergence`,
-    );
+    // A flight with ZERO taps passes `match` on the response alone: `leftover` and
+    // `divergences` are empty because there was nothing to consume and nothing to diverge
+    // from. "every tap consumed, zero divergence" over an empty tap set is the falsify bug's
+    // shape — a perfect score for a control set of size 0. It matters practically: a flight
+    // recorded before `box.wrapClient(db)` was installed captures no taps, so the replay hit
+    // the LIVE dependency and the match says the environment answered the same way today,
+    // not that the code is unchanged.
+    if (!flight.taps.length)
+      console.log(
+        `◐ response identical (status ${result.actual.status}) — but 0 taps were recorded, so` +
+          ` NOTHING was virtualized: determinism is UNMEASURED. Wrap your clients` +
+          ` (\`box.wrapClient(db)\`) and re-record to make this a proof.`,
+      );
+    else
+      console.log(
+        `✓ byte-identical replay — status ${result.actual.status}, all ${flight.taps.length} tap(s) consumed, zero divergence`,
+      );
   } else {
     if (!result.statusMatch)
       console.log(

package/src/server/stdio.js

@@ -30,7 +30,7 @@ import { compileUBG } from '../ubg/compile.js';
 import { canonicalizeGraph } from '../ubg/schema.js';
 import { checkGraph, diffGraphs, verdictOf, verdictState } from '../ubg/apocalypse.js';
 import { surveyBlindspots } from '../ubg/blindspots.js';
-import { premiseFor, withPremiseGaps } from '../ubg/premise.js';
+import { premiseFor, withPremiseGaps, basisFrom } from '../ubg/premise.js';
 import { witnessTargets, admitWitnesses } from '../ubg/witness.js';
 
 const EVENT_POLL_MS = Number(process.env.SPARDA_EVENT_POLL_MS ?? 5000);
@@ -1266,6 +1266,7 @@ export async function proveApp(cwd, { route } = {}) {
     coverage: blind.coverage.ratio,
     blindHigh: blind.byRisk.critical + blind.byRisk.high,
     premiseGaps: premise.available ? premise.gaps.length : 0,
+    premiseBasis: basisFrom(premise),
   });
   return {
     verdict: verdictState(verdict),

package/src/ubg/apocalypse.js

@@ -290,8 +290,21 @@ export function checkGraph(graph) {
       // "confirm intent" — never hidden, never marked safe, never touches PROVEN. The list is the
       // HEAD of the distribution (deliberately precise, not `**/auth/**` blanket: change-password /
       // 2fa / session management are NOT public, and re-labeling those would hide a real hole).
+      //
+      // The list is precise, but its TOKENS are not: `register` also names authenticated management
+      // (`/account/2fa/register`, `/devices/register`), `webhook`/`hook` a subscription CREATE, and
+      // any signature can sit under an authenticated namespace (`/account/…`, `/admin/…`). Because
+      // this re-label carries NO evidence of a gate, the asymmetric error model forbids it from
+      // firing on those: it must ABSTAIN when the path sits in an authenticated area, or it hides
+      // the same unguarded mutation it swears off for change-password, one alternative over (the
+      // 2FA-register / webhook-management class). Abstaining only ADDS criticals — the safe direction.
+      const authenticatedArea =
+        /(^|[:/\- ])(account|accounts|settings|admin|me|profile|2fa|mfa|totp|webhooks?|hooks?|devices?|tokens?|api[_-]?keys?|applications?|integrations?)([/:\- ]|$)/i.test(
+          ep.label,
+        );
       const expectedPublic =
         !credentialGated &&
+        !authenticatedArea &&
         (/(^|[:/\- ])(log-?in|sign-?in|sign-?up|register|log-?out|sign-?out|forgot-?password|reset-?password|forgot|verify-?email|email-?verification|confirm-?email|magic-?link|oauth\d?|openid|sso|saml|health(z|check|-?check)?|livez|readyz|metrics|well-known)([/:\- ]|$)/i.test(
           ep.label,
         ) ||
@@ -764,7 +777,7 @@ const COVERAGE_COMPLETE = 0.6;
 export function verdictOf(
   findings,
   graph,
-  { coverage, blindHigh = 0, premiseGaps = 0 } = {},
+  { coverage, blindHigh = 0, premiseGaps = 0, premiseBasis = null } = {},
 ) {
   const counts = { critical: 0, high: 0, medium: 0, info: 0 };
   for (const f of findings) counts[f.severity]++;
@@ -824,12 +837,32 @@ export function verdictOf(
   // from undefined (not measured at all, e.g. heal's partial-graph delta, old semantics
   // kept). An unknown coverage can never carry a complete PROVEN: unknown ≠ 100%.
   const coverageUnknown = coverage === null;
+  // E-104. The premise is the claim that the route set analysed IS the route set the app
+  // serves — Direction 3 — and the ONLY instrument that checks it is an oracle that is not
+  // the analyser. When no oracle ran, that claim is UNVERIFIED, and `PROVEN` asserts it.
+  //
+  // The bug this closes: `premiseFor` reported `{ available: false, gaps: [] }` honestly, and
+  // every consumer then read it through `premiseGaps === 0` — byte-identical to "an oracle ran
+  // and agreed". Measured on our own fixtures: 7 of the 8 that read PROVEN had never had an
+  // oracle run at all, every one of them Express or FastAPI. An honest LABEL is not an honest
+  // SYSTEM; the place a distinction gets flattened is where the lie is told.
+  //
+  // Deliberately a PARTIAL rung and not a PREMISE_GAP: a gap is measured evidence that the
+  // subject was incomplete (blocking), while silence is only the absence of a witness. PARTIAL
+  // already means exactly that — "proved what was seen" — so this neither blocks a deploy nor
+  // invents a fault. It withholds the strongest word, which is the one thing it must do.
+  //
+  // `null` keeps the old semantics for callers with no premise to speak of (heal's regression
+  // delta is a partial graph, not a whole-app proof). `'declared'` is OpenAPI, where the
+  // document analysed IS the route table and a second witness would be the same map twice.
+  const premiseUnmeasured = premiseBasis === 'unmeasured';
   const partial =
     clean &&
     entrypoints > 0 &&
     ((coverage != null && coverage < COVERAGE_COMPLETE) ||
       coverageUnknown ||
       blindHigh > 0 ||
+      premiseUnmeasured ||
       assertedMutations > 0);
   // THE PREMISE GATE. Every other rung above softens a claim about what SPARDA
   // ANALYSED. This one answers a prior question — was the analysis about the whole
@@ -860,6 +893,11 @@ export function verdictOf(
     coverageUnknown,
     premiseGaps,
     premiseUnverified,
+    // Carried so every surface can say WHY the word was withheld. A PARTIAL whose reason is
+    // "nobody checked the route table" reads very differently from one whose reason is "77 %
+    // coverage", and a user who cannot tell them apart cannot act on either.
+    premiseBasis,
+    premiseUnmeasured,
     // The CI gate. A premise gap belongs here and not only in the verdict word: an
     // app whose route surface we demonstrably did not have cannot be called safe, and
     // a green CI over it would reproduce the exact failure this whole audit removed —

package/src/ubg/falsify.js

@@ -82,8 +82,12 @@ export function falsifyGraph(graph, { check = checkGraph } = {}) {
       controls: [],
       flipped: 0,
       holes: [],
-      score: 1,
-      note: 'no protected mutation routes — nothing to falsify',
+      // NOT 1. A score of 1 means "every green depends on its guard, and we checked". Here
+      // nothing was checked, and 1 is the number a reader acts on while the `note` sits
+      // beside it, unread. `null` cannot be misread — it is the only value that carries its
+      // own caveat (ADR-092: the admission goes INSIDE the headline, never next to it).
+      score: null,
+      note: 'no protected mutation routes — nothing to falsify (score UNMEASURED, not 1)',
     };
 
   // Per-route attribution, flood-aware: ablating EVERY guard at once makes UNGUARDED_MUTATION

package/src/ubg/immunity.js

@@ -19,7 +19,7 @@ import { AXES, posture, provenByPolarity, packVector, exposedAxes } from './pola
 export const CAPSULE_VERSION = 'imm1';
 
 // canonical graph → a compact, portable, deterministic safety capsule.
-export function buildCapsule(graph) {
+export function buildCapsule(graph, { premiseBasis = null } = {}) {
   const prints = new Map(fingerprintGraph(graph).map((p) => [p.entrypoint, p]));
   const { polarity } = checkGraph(graph);
 
@@ -38,9 +38,29 @@ export function buildCapsule(graph) {
   // only if it says so. The genome inherits this, so the world memory carries not just
   // "proven" but "proven over how much" — a verdict's confidence, made portable.
   const survey = surveyBlindspots(graph);
+  // THE CAPSULE CARRIES ITS OWN BASIS OF MEASUREMENT (ADR-092). A capsule is PORTABLE — it
+  // travels between repos and is replayed by `speculate`/`immunize` far from the analysis that
+  // produced it. A frozen `proven: true` whose premise nobody ever measured would be a claim
+  // re-asserted in a context where its licence cannot even be checked, which is worse than the
+  // original E-104: there, at least, the oracle was one call away.
+  //
+  // So `proven` is a THREE-state field, not a boolean. `null` = the premise was never measured,
+  // and no consumer can read a pass out of it. Absent basis (an older capsule, or a caller
+  // with no premise to speak of) keeps the previous semantics rather than retroactively
+  // invalidating capsules already in the wild.
+  //
+  // ONLY THE POSITIVE IS WITHHELD, and getting this wrong is a regression in the unsafe
+  // direction. The premise bounds the route SET; a route that is missing from the graph cannot
+  // rescue one that IS in it and is exposed. So `proven: false` needs no premise and survives
+  // untouched — the direction premise.js states plainly: gaps WITHHOLD a verdict, never grant
+  // one. Blanking `false` to `null` would have turned "this app has an unguarded mutation"
+  // into "we don't know", which is the same lie pointed the other way.
+  const premiseUnmeasured = premiseBasis === 'unmeasured';
+  const provenByPol = !surfaceOnly && provenByPolarity(polarity);
   return {
     v: CAPSULE_VERSION,
-    proven: !surfaceOnly && provenByPolarity(polarity),
+    proven: premiseUnmeasured && provenByPol ? null : provenByPol,
+    premiseBasis,
     surfaceOnly,
     coverage: survey.coverage.ratio,
     blindHigh: survey.byRisk.critical + survey.byRisk.high,

package/src/ubg/premise.js

@@ -181,18 +181,53 @@ export async function premiseFor(graph, report, { cwd, probe = false } = {}) {
   if (!wanted)
     return {
       available: false,
+      basis: basisOf(report.framework),
       gaps: [],
       probed: 0,
       reason: PROBEABLE.has(report.framework)
         ? 'runtime oracle not requested (--probe)'
         : `no oracle for ${report.framework}`,
     };
-  return verifyPremise(graph, {
+  const verified = await verifyPremise(graph, {
     framework: report.framework,
     entryFile: report.entry,
     cwd,
     unknownHandlers: report.unknownHandlers,
   });
+  return {
+    ...verified,
+    basis: verified.available ? 'measured' : basisOf(report.framework),
+  };
+}
+
+// On what BASIS do we hold the premise — that the route set analysed is the route set the
+// app serves? Three answers, and collapsing the last two is E-104:
+//
+//   'measured'   — an oracle that is not the analyser enumerated the surface and agreed.
+//   'declared'   — there is nothing to cross-check against because the artefact analysed IS
+//                  the route table. An OpenAPI document does not have a premise behind it;
+//                  it is the premise. Demanding a second witness for it would be demanding
+//                  that a map be verified against itself.
+//   'unmeasured' — no oracle ran. NOT the same as "an oracle ran and found nothing", and the
+//                  whole point of naming this state is that the verdict must be able to tell
+//                  the difference (E-104: `PROVEN` was reachable on 7 of our 8 proving
+//                  fixtures with no oracle ever having run).
+export function basisOf(framework) {
+  if (framework === 'openapi') return 'declared';
+  return 'unmeasured';
+}
+
+// The basis of a premise RESULT, as every consumer needs it. `premiseFor` already computes
+// it; NINE call sites re-derived it by hand anyway — the same ternary, copied, which is nine
+// chances to get it subtly wrong and one more shape to keep in sync.
+//
+// The default is the load-bearing part: a caller that has NO premise object at all — because
+// it never asked — gets 'unmeasured', not 'measured' and not `null`. Forgetting to measure
+// must fail toward the weaker word, never toward silence. That is the whole of E-106 in one
+// default value.
+export function basisFrom(premise) {
+  if (premise?.available) return 'measured';
+  return premise?.basis ?? 'unmeasured';
 }
 
 // Fold the gaps into the report the blind-spot ledger reads. Every caller did these two