A per-field schema, rather than one monolithic (evidence) => T function,
is what makes automatic provenance possible at all: each projector runs
against its own read-tracking membrane, so .project() can say which
evidence a specific output field was derived from, not merely which
evidence the whole report touched. That is the difference between "this
report read the Capability Model" and "this row's sensitivity came from
capability.capabilities.0.docs.sensitivity" -- the second is reviewable
evidence, the first is trivia.
Superseded ADR 0050's earlier (name, project) signature, whose name
existed only to label a thrown error. That named-wrapper design predates
this mechanism and bought strictly less: the membrane below both enforces
the purity the old wrapper only documented, and produces provenance the
old wrapper had no way to compute.
Declares a projection: a pure transform from the
EvidenceModelto any consumer-defined output shape, built entirely fromschema's independent per-field projector functions.data-cap's own reference projections (reference-projections.ts's Classification/Privacy/Retention/Compliance/Audit Evidence) are built through this exact function, with no privileged internal path -- a consumer's own projection is a first-class citizen, not a lesser one.