fix: close evidence credential disclosure gaps

harness/tests/test_registry_evidence_config.py

@@ -1,4 +1,5 @@
 import json
+import traceback
 
 import pytest
 import yaml
@@ -112,6 +113,33 @@ def test_signed_http_file_resolves_in_memory_and_preserves_provenance_order(tmp_
     assert_no_canaries(repr(adapter))
 
 
+def test_signed_http_file_requires_explicit_provenance_urls(tmp_path):
+    secret_file = tmp_path / "signed-urls.json"
+    secret_file.write_text(json.dumps([
+        f"https://evidence.example.test/guide.md?token={SIGNED_CANARY}",
+    ]))
+    path = write_config(tmp_path, {
+        "type": "http", "signed_urls_file": str(secret_file),
+    })
+
+    with pytest.raises(ConfigError) as caught:
+        load_config(path)
+    assert "provenance" in str(caught.value).lower()
+    assert_no_canaries(caught.value)
+
+
+def test_public_http_rejects_inline_query_bearing_transport_urls(tmp_path):
+    path = write_config(tmp_path, {
+        "type": "http",
+        "urls": [f"https://evidence.example.test/guide.md?token={SIGNED_CANARY}"],
+    })
+
+    with pytest.raises(ConfigError) as caught:
+        load_config(path)
+    assert "evidence.sources.0" in str(caught.value)
+    assert_no_canaries(caught.value)
+
+
 @pytest.mark.parametrize("contents", [
     "{malformed", json.dumps({"url": "https://evidence.example.test/guide.md"}),
     json.dumps([]), json.dumps(["https://evidence.example.test/guide.md", 3]),
@@ -264,6 +292,7 @@ def test_validation_repr_cli_and_exception_output_never_disclose_transport_secre
     with pytest.raises(ConfigError) as caught:
         load_config(path)
     assert_no_canaries(caught.value)
+    assert_no_canaries("".join(traceback.format_exception(caught.value)))
 
     valid_file = tmp_path / "valid-signed-urls.json"
     valid_file.write_text(json.dumps([