diff --git a/server/__tests__/proof-api.test.js b/server/__tests__/proof-api.test.js
new file mode 100644
index 0000000..7a975da
--- /dev/null
+++ b/server/__tests__/proof-api.test.js
@@ -0,0 +1,154 @@
+/**
+ * @file Tests for GET/DELETE /api/lanes/:id/proof… and POST
+ * /api/lanes/:id/proof-link — the HTTP surface over server/lib/proof.js.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const os = require("node:os");
+const path = require("node:path");
+const fs = require("node:fs");
+const http = require("node:http");
+
+const SUITE_ROOT = fs.mkdtempSync(path.join(os.tmpdir(), "ccam-proof-api-"));
+process.env.DASHBOARD_DB_PATH = path.join(SUITE_ROOT, "dashboard.db");
+process.env.LANES_ROOT = path.join(SUITE_ROOT, "lanes");
+
+const { describe, it, before, after } = require("node:test");
+const assert = require("node:assert/strict");
+
+const { createApp } = require("../index");
+const lanesLib = require("../lib/lanes");
+
+let server;
+let PORT;
+
+before(async () => {
+  const app = createApp();
+  server = http.createServer(app);
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  PORT = server.address().port;
+});
+after(async () => {
+  await new Promise((resolve) => server.close(resolve));
+  fs.rmSync(SUITE_ROOT, { recursive: true, force: true });
+});
+
+function request(method, urlPath, body) {
+  return new Promise((resolve, reject) => {
+    const data = body ? JSON.stringify(body) : null;
+    const req = http.request(
+      {
+        method,
+        hostname: "127.0.0.1",
+        port: PORT,
+        path: urlPath,
+        headers: {
+          "Content-Type": "application/json",
+          ...(data ? { "Content-Length": Buffer.byteLength(data) } : {}),
+        },
+      },
+      (res) => {
+        let raw = "";
+        res.on("data", (chunk) => (raw += chunk));
+        res.on("end", () => {
+          let json = null;
+          try {
+            json = JSON.parse(raw);
+          } catch {
+            /* binary body (image) is fine */
+          }
+          resolve({ status: res.statusCode, headers: res.headers, body: json, raw });
+        });
+      }
+    );
+    req.on("error", reject);
+    if (data) req.write(data);
+    req.end();
+  });
+}
+
+let laneSeq = 0;
+function makeLane() {
+  laneSeq += 1;
+  const cwd = path.join(SUITE_ROOT, `lane-cwd-${laneSeq}`);
+  fs.mkdirSync(cwd, { recursive: true });
+  return lanesLib.createLane({ title: `lane ${laneSeq}`, cwd, kind: "managed" });
+}
+
+function writeShot(lane, slug, group, name) {
+  const dir = path.join(lane.cwd, ".playwright-mcp", "proof", slug, group);
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(path.join(dir, name), "fake-png-bytes");
+}
+
+describe("GET /api/lanes/:id/proof", () => {
+  it("lists grouped screenshots", async () => {
+    const lane = makeLane();
+    writeShot(lane, "one", "qc-local", "a.png");
+    const res = await request("GET", `/api/lanes/${lane.id}/proof`);
+    assert.equal(res.status, 200);
+    const one = res.body.features.find((f) => f.slug === "one");
+    assert.deepEqual(one.groups["qc-local"], ["a.png"]);
+  });
+});
+
+describe("GET /api/lanes/:id/proof/:slug/:group/:file", () => {
+  it("serves an existing screenshot", async () => {
+    const lane = makeLane();
+    writeShot(lane, "one", "qc-local", "a.png");
+    const res = await request("GET", `/api/lanes/${lane.id}/proof/one/qc-local/a.png`);
+    assert.equal(res.status, 200);
+    assert.equal(res.raw, "fake-png-bytes");
+  });
+
+  it("404s a traversal attempt", async () => {
+    const lane = makeLane();
+    writeShot(lane, "one", "qc-local", "a.png");
+    const res = await request(
+      "GET",
+      `/api/lanes/${lane.id}/proof/one/qc-local/${encodeURIComponent("../../../etc/passwd")}`
+    );
+    assert.equal(res.status, 404);
+  });
+});
+
+describe("DELETE /api/lanes/:id/proof/:slug", () => {
+  it("deletes listed images", async () => {
+    const lane = makeLane();
+    writeShot(lane, "one", "qc-local", "a.png");
+    const res = await request("DELETE", `/api/lanes/${lane.id}/proof/one`, {
+      group: "qc-local",
+      images: ["a.png"],
+    });
+    assert.equal(res.status, 200);
+    assert.equal(res.body.deleted, 1);
+  });
+
+  it("400s EBADPATH for a slug containing ..", async () => {
+    const lane = makeLane();
+    const res = await request(
+      "DELETE",
+      `/api/lanes/${lane.id}/proof/${encodeURIComponent("../escape")}`,
+      {}
+    );
+    assert.equal(res.status, 400);
+    assert.equal(res.body.error.code, "EBADPATH");
+  });
+
+  it("404s ENOFEATURE for a slug with no proof dir", async () => {
+    const lane = makeLane();
+    const res = await request("DELETE", `/api/lanes/${lane.id}/proof/never-had-proof`, {});
+    assert.equal(res.status, 404);
+    assert.equal(res.body.error.code, "ENOFEATURE");
+  });
+});
+
+describe("POST /api/lanes/:id/proof-link", () => {
+  it("creates the symlink and reports linked: true", async () => {
+    const lane = makeLane();
+    const res = await request("POST", `/api/lanes/${lane.id}/proof-link`);
+    assert.equal(res.status, 200);
+    assert.equal(res.body.linked, true);
+    assert.equal(fs.lstatSync(path.join(lane.cwd, "proof")).isSymbolicLink(), true);
+  });
+});
diff --git a/server/routes/lanes.js b/server/routes/lanes.js
index 925f90a..afec3d7 100644
--- a/server/routes/lanes.js
+++ b/server/routes/lanes.js
@@ -15,6 +15,7 @@ const { db } = require("../db");
 const lanesLib = require("../lib/lanes");
 const { listPipelines, getPipeline, nodeStates, progressPct } = require("../lib/pipelines");
 const laneFeatures = require("../lib/lane-features");
+const proofLib = require("../lib/proof");
 const { broadcast } = require("../websocket");
 const runs = require("../lib/run-spawner");
 const { sameOriginGuard } = require("./run");
@@ -282,6 +283,50 @@ router.post("/:id/features/activate", sameOriginGuard, (req, res) => {
   }
 });
 
+router.get("/:id/proof", (req, res) => {
+  const lane = lanesLib.getLane(req.params.id);
+  if (!lane) return res.status(404).json({ error: { code: "ENOLANE", message: "lane not found" } });
+  res.json({ features: proofLib.listProof(lane.id) });
+});
+
+router.get("/:id/proof/:slug/:group/:file", (req, res) => {
+  const lane = lanesLib.getLane(req.params.id);
+  if (!lane) return res.status(404).send("not found");
+  const p = proofLib.proofFile(lane.id, req.params.slug, req.params.group, req.params.file);
+  if (!p) return res.status(404).send("not found");
+  const ext = path.extname(p).toLowerCase();
+  const contentType =
+    ext === ".html" ? "text/html; charset=utf-8" : ext === ".png" ? "image/png" : "image/jpeg";
+  res.type(contentType).sendFile(p);
+});
+
+router.delete("/:id/proof/:slug", sameOriginGuard, (req, res) => {
+  const lane = lanesLib.getLane(req.params.id);
+  if (!lane) return res.status(404).json({ error: { code: "ENOLANE", message: "lane not found" } });
+  try {
+    const result = proofLib.deleteProof(lane.id, {
+      slug: req.params.slug,
+      group: req.body?.group,
+      images: req.body?.images,
+    });
+    res.json(result);
+  } catch (err) {
+    if (err.code === "ENOFEATURE") {
+      return res.status(404).json({ error: { code: err.code, message: err.message } });
+    }
+    if (err.code === "EBADPATH") {
+      return res.status(400).json({ error: { code: err.code, message: err.message } });
+    }
+    res.status(500).json({ error: { code: err.code, message: err.message } });
+  }
+});
+
+router.post("/:id/proof-link", sameOriginGuard, (req, res) => {
+  const lane = lanesLib.getLane(req.params.id);
+  if (!lane) return res.status(404).json({ error: { code: "ENOLANE", message: "lane not found" } });
+  res.json(proofLib.ensureProofLink(lane));
+});
+
 /**
  * A lane's working-copy facts: branch, short HEAD, that commit's subject, and
  * the uncommitted counts. Read-only, so no same-origin guard — that guard