@everystack/cli 0.4.39 → 0.4.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.39",
+  "version": "0.4.41",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -109,7 +109,7 @@
     "structured-headers": "1.0.1",
     "tsx": "4.21.0",
     "typescript": "5.9.3",
-    "@everystack/model": "0.4.6"
+    "@everystack/model": "0.4.7"
   },
   "peerDependencies": {
     "@everystack/server": ">=0.4.0",

package/src/cli/apply-execute.ts

@@ -70,12 +70,20 @@ export interface ApplyPlanOptions {
    * attest their own --snapshot-ref keep the ceremony the command shell enforces).
    */
   verifySnapshot?: (ctx: { planFrom: string }) => Promise<{ ok: true } | { ok: false; reason: string }>;
+  /**
+   * The ungoverned-grantee gate, re-verified AT APPLY (B4). db:plan already refuses to mint
+   * against a stage holding a foreign grantee the baseline does not record — but a plan is
+   * an artifact with a lifetime, and a role minted between minting and applying would
+   * otherwise ride through unnoticed. Same contract as the other gates: refusal recorded in
+   * schema_log. Omitted = no gate (callers with no baseline to check against).
+   */
+  verifyAuthzBaseline?: (ctx: { contract: AuthzContract }) => Promise<{ ok: true } | { ok: false; reason: string }>;
   /** Injectable clock for tests. */
   now?: () => number;
 }
 
 export interface ApplyPlanResult {
-  status: 'applied' | 'already-applied' | 'refused' | 'descent-refused' | 'authority-refused' | 'snapshot-refused' | 'verify-failed';
+  status: 'applied' | 'already-applied' | 'refused' | 'descent-refused' | 'authority-refused' | 'snapshot-refused' | 'authz-refused' | 'verify-failed';
   liveFingerprint: string;
   reason?: string;
   logId?: number;
@@ -157,6 +165,17 @@ export async function executeApplyPlan(
     }
   }
 
+  // Before ANY write: a foreign grantee that arrived after the plan was minted must stop
+  // the apply, not ride through it. The plan's own gates check the SCHEMA has not moved;
+  // this checks who can reach it.
+  if (options.verifyAuthzBaseline) {
+    const authz = await options.verifyAuthzBaseline({ contract: beforeAuthz });
+    if (!authz.ok) {
+      await recordRefusal(runner, plan, live, 'ungoverned grantee', authz.reason, options);
+      return { status: 'authz-refused', liveFingerprint: live, reason: authz.reason };
+    }
+  }
+
   if (plan.destructive > 0 && options.verifyAuthority) {
     const authority = await options.verifyAuthority();
     if (!authority.ok) {

package/src/cli/authz-baseline.ts

@@ -0,0 +1,227 @@
+/**
+ * authz-baseline — the foreign grantees that were already there, and the gate that makes a
+ * NEW one fail.
+ *
+ * The reconciler exempts a grantee the models do not govern rather than revoking it
+ * (authz-reconcile's `governedRoleSet` — a migrator or BI role must not have its access
+ * destroyed by a plan nobody read). That exemption is only half a design. Without the other
+ * half, an attacker-minted role holding SELECT on every table is reported forever and fails
+ * nothing, which is the failure mode the exemption was rejected for in the first place.
+ *
+ * So: record the foreign grantees present AT ADOPTION, per stage. After that, an ungoverned
+ * grantee that is not in the stage's baseline — or a baselined one that has GROWN — refuses
+ * the plan. A greenfield app's baseline is empty, so any foreign grantee is a failure from
+ * day one; a brownfield app's migrator is in it, so adoption proceeds with a warning that
+ * never goes away.
+ *
+ * Two deliberate decisions, both adjudicated:
+ *
+ *   - The baseline lives in the REPO, not the database. Storing it in the database looks
+ *     tamper-evident and is not: the attacker who minted the role owns the database and can
+ *     write the baseline row in the same session. More importantly it would hide the
+ *     exemption from the one human checkpoint that exists — a pull request. Adding a
+ *     grantee is a diff line someone merges. The database keeps a `schema_log` memoir of
+ *     the adoption event so a reviewer can check the claim against the observation.
+ *   - It is FROZEN at adoption. There is no "it showed up in production, baseline it"
+ *     path — that is the whole gate. Admitting a new role costs a PR line, on purpose.
+ *
+ * Per-stage, because stages legitimately differ (a BI role in production and nowhere else) —
+ * and scoped, so a production entry excuses that grantee in production only. The same role
+ * appearing in dev still fails there.
+ *
+ * Pure, with one exception named at the bottom: `readBaselineFile`, which every gate needs
+ * to agree on (including "the file is absent", which must behave exactly like an empty
+ * baseline rather than like a skipped check).
+ */
+
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import type { GrantExemption } from './authz-reconcile.js';
+
+/** The repo-relative artifact. Generated — regenerating it must reproduce it byte for byte. */
+export const BASELINE_FILE = 'db/authz-baseline.json';
+
+/** Privileges that change data or structure — flagged loudly, because a reviewer skims. */
+const WRITE_PRIVILEGES = new Set(['INSERT', 'UPDATE', 'DELETE', 'TRUNCATE', 'REFERENCES', 'TRIGGER']);
+
+export interface BaselineGrantee {
+  /** The union of table-level privileges held at adoption, sorted. */
+  privileges: string[];
+  /** The tables it held them on, sorted. */
+  tables: string[];
+  /** True when any privilege writes. Surfaced so a reviewer sees it without reading the list. */
+  write: boolean;
+}
+
+export interface BaselineStage {
+  /** When the observation was taken — provenance for the claim, not used by the gate. */
+  observedAt: string;
+  /** The live base fingerprint at observation time — what the claim was true OF. */
+  fingerprint: string;
+  grantees: Record<string, BaselineGrantee>;
+}
+
+export interface AuthzBaseline {
+  version: 1;
+  stages: Record<string, BaselineStage>;
+}
+
+export const EMPTY_BASELINE: AuthzBaseline = { version: 1, stages: {} };
+
+/** Fold the observed exemptions into one entry per grantee. */
+export function buildStageBaseline(
+  exemptions: readonly GrantExemption[],
+  meta: { observedAt: string; fingerprint: string },
+): BaselineStage {
+  const grantees: Record<string, BaselineGrantee> = {};
+  for (const e of exemptions) {
+    const g = (grantees[e.grantee] ??= { privileges: [], tables: [], write: false });
+    g.privileges = [...new Set([...g.privileges, ...e.privileges])].sort();
+    g.tables = [...new Set([...g.tables, e.table])].sort();
+    // A column-scoped privilege is still that privilege — it must count toward `write`,
+    // or a column-scoped UPDATE would read as a harmless reader in review.
+    const all = [...e.privileges, ...Object.keys(e.columnPrivileges ?? {})];
+    g.write ||= all.some((p) => WRITE_PRIVILEGES.has(p.toUpperCase()));
+  }
+  return { observedAt: meta.observedAt, fingerprint: meta.fingerprint, grantees };
+}
+
+/** Write one stage's entry into the file, leaving every other stage untouched. */
+export function mergeBaseline(existing: AuthzBaseline | null, stage: string, entry: BaselineStage): AuthzBaseline {
+  return { version: 1, stages: { ...(existing?.stages ?? {}), [stage]: entry } };
+}
+
+/**
+ * The artifact's canonical text. Keys sorted at every level so regenerating an unchanged
+ * baseline is byte-identical — that equality IS the offline check, and a diff that reorders
+ * itself would make the review signal worthless.
+ */
+export function renderBaseline(baseline: AuthzBaseline): string {
+  const stages: Record<string, BaselineStage> = {};
+  for (const stage of Object.keys(baseline.stages).sort()) {
+    const s = baseline.stages[stage];
+    const grantees: Record<string, BaselineGrantee> = {};
+    for (const g of Object.keys(s.grantees).sort()) {
+      const { privileges, tables, write } = s.grantees[g];
+      grantees[g] = { privileges: [...privileges].sort(), tables: [...tables].sort(), write };
+    }
+    stages[stage] = { observedAt: s.observedAt, fingerprint: s.fingerprint, grantees };
+  }
+  return JSON.stringify({ version: 1, stages }, null, 2) + '\n';
+}
+
+/** Parse the artifact, refusing anything malformed by name — a baseline that silently reads
+ *  as empty would disable the gate, which is the one outcome worse than failing. */
+export function parseBaseline(text: string, where = BASELINE_FILE): AuthzBaseline {
+  let raw: unknown;
+  try {
+    raw = JSON.parse(text);
+  } catch (err: any) {
+    throw new Error(`${where} is not valid JSON: ${err.message}`);
+  }
+  const b = raw as Partial<AuthzBaseline>;
+  if (b?.version !== 1) throw new Error(`${where}: unsupported version ${String(b?.version)} — expected 1.`);
+  if (b.stages == null || typeof b.stages !== 'object') throw new Error(`${where}: missing a "stages" object.`);
+  for (const [stage, s] of Object.entries(b.stages)) {
+    if (s?.grantees == null || typeof s.grantees !== 'object') {
+      throw new Error(`${where}: stage "${stage}" has no "grantees" object.`);
+    }
+  }
+  return b as AuthzBaseline;
+}
+
+/** One reason a live grantee fails the gate. */
+export interface BaselineViolation {
+  grantee: string;
+  kind: 'unbaselined' | 'widened';
+  detail: string;
+}
+
+/**
+ * The gate. A stage passes when every ungoverned grantee is in its baseline AND holds
+ * nothing beyond what the baseline recorded.
+ *
+ * `widened` matters as much as `unbaselined`: a role baselined with SELECT that has since
+ * acquired UPDATE, or spread to new tables, is not the role that was reviewed. Freezing the
+ * NAME while letting the privileges grow would leave the gate defending nothing.
+ *
+ * An ABSENT stage entry is not an empty one — it means the stage was never adopted, and any
+ * foreign grantee there fails. That is deliberate: the safe reading of "no record" is "not
+ * reviewed", never "nothing to see".
+ */
+export function checkAgainstBaseline(
+  baseline: AuthzBaseline | null,
+  stage: string,
+  exemptions: readonly GrantExemption[],
+): BaselineViolation[] {
+  const observed = buildStageBaseline(exemptions, { observedAt: '', fingerprint: '' }).grantees;
+  const recorded = baseline?.stages[stage]?.grantees ?? {};
+  const violations: BaselineViolation[] = [];
+
+  for (const grantee of Object.keys(observed).sort()) {
+    const now = observed[grantee];
+    const then = recorded[grantee];
+    if (!then) {
+      violations.push({
+        grantee,
+        kind: 'unbaselined',
+        detail: `holds ${now.privileges.join(', ') || 'column-scoped privileges'} on ${now.tables.length} table(s) and is not in the ${stage} baseline`,
+      });
+      continue;
+    }
+    const newPrivileges = now.privileges.filter((p) => !then.privileges.includes(p));
+    const newTables = now.tables.filter((t) => !then.tables.includes(t));
+    if (newPrivileges.length > 0 || newTables.length > 0) {
+      violations.push({
+        grantee,
+        kind: 'widened',
+        detail: [
+          newPrivileges.length ? `gained ${newPrivileges.join(', ')}` : null,
+          newTables.length ? `spread to ${newTables.join(', ')}` : null,
+        ].filter(Boolean).join('; ') + ` since the ${stage} baseline`,
+      });
+    }
+  }
+  return violations;
+}
+
+/** The refusal an operator reads. Names every violation — a count would not be actionable. */
+export function baselineRefusal(stage: string, violations: readonly BaselineViolation[]): string {
+  const lines = violations.map((v) => `  - ${v.grantee} ${v.detail}`);
+  return [
+    `${violations.length} role(s) hold privileges on ${stage} that the models do not govern and the baseline does not record:`,
+    ...lines,
+    '',
+    `A role the models cannot name is left alone by the reconciler, so it must be reviewed instead of reconciled.`,
+    `If these are legitimate, add them deliberately: re-run \`db:pull --abilities live --stage ${stage}\` to regenerate ${BASELINE_FILE},`,
+    `review the diff (write privileges are flagged), and commit it. If they are NOT legitimate, revoke them in the database first.`,
+  ].join('\n');
+}
+
+/**
+ * Read the baseline artifact, or null when there is none.
+ *
+ * ABSENT is not an error and not a skip — it is an EMPTY baseline, so every foreign grantee
+ * fails the gate. That is the greenfield default and it is the safe direction: a project
+ * that never adopted a baseline has never reviewed a foreign role. A file that exists but
+ * cannot be parsed THROWS (see parseBaseline) — silently continuing past a corrupt baseline
+ * would disable the gate exactly when someone has been editing it.
+ */
+export async function readBaselineFile(cwd = process.cwd()): Promise<AuthzBaseline | null> {
+  const file = path.resolve(cwd, BASELINE_FILE);
+  let text: string;
+  try {
+    text = await fs.readFile(file, 'utf8');
+  } catch {
+    return null;
+  }
+  return parseBaseline(text, BASELINE_FILE);
+}
+
+/** Write the artifact, creating `db/` if this is the first adoption. */
+export async function writeBaselineFile(baseline: AuthzBaseline, cwd = process.cwd()): Promise<string> {
+  const file = path.resolve(cwd, BASELINE_FILE);
+  await fs.mkdir(path.dirname(file), { recursive: true });
+  await fs.writeFile(file, renderBaseline(baseline), 'utf8');
+  return file;
+}

package/src/cli/authz-reconcile.ts

@@ -18,6 +18,104 @@
 import type { AuthzContract, TableContract, PolicyContract } from './authz-contract.js';
 import { quoteQualified } from './pg-ident.js';
 
+/**
+ * Always governed, whatever the models say. `PUBLIC` because a grant to PUBLIC is the
+ * broadest privilege the database can express and must never be exemptible; the three
+ * vocabulary roles because they ARE the model's authz surface — letting a module drop one
+ * would be a way to hide a grant from the thing that audits it.
+ */
+export const ALWAYS_GOVERNED = ['PUBLIC', 'admin', 'anon', 'authenticated'] as const;
+
+/** One grantee the declared contract does not govern, with what it actually holds. */
+export interface GrantExemption {
+  grantee: string;
+  table: string;
+  /** Table-level privileges. */
+  privileges: string[];
+  /** Column-scoped privileges, `privilege → columns`. Present only when there are any. */
+  columnPrivileges?: Record<string, string[]>;
+}
+
+/**
+ * The roles the declared authz governs: everything the models name, plus the always-governed
+ * set, plus whatever the modules widen it with. WIDEN-ONLY by construction — `declared` and
+ * {@link ALWAYS_GOVERNED} go in unconditionally, so `extra` can add and can never subtract.
+ *
+ * Grantee comparison is case-insensitive on `PUBLIC` only (PostgreSQL's pseudo-role, which
+ * the catalog reports uppercase and the models spell either way); real role names are
+ * case-sensitive because PostgreSQL's are.
+ */
+export function governedRoleSet(declared: AuthzContract, extra: readonly string[] = []): Set<string> {
+  const governed = new Set<string>(ALWAYS_GOVERNED);
+  for (const t of declared.tables) {
+    for (const grantee of Object.keys(t.grants)) governed.add(grantee);
+    for (const grantee of Object.keys(t.columnGrants ?? {})) governed.add(grantee);
+  }
+  for (const role of extra) governed.add(role);
+  return governed;
+}
+
+const isGoverned = (governed: ReadonlySet<string>, grantee: string): boolean =>
+  governed.has(grantee) || (grantee.toUpperCase() === 'PUBLIC' && governed.has('PUBLIC'));
+
+/**
+ * Every live grantee the declared contract does not govern, with its exact privileges —
+ * the enumeration that makes exempting them acceptable at all.
+ *
+ * The reconciler leaves these alone (a live migrator/ETL/BI role the model vocabulary
+ * cannot name must not have its access destroyed by a plan nobody read). That is only
+ * defensible because every artifact claiming to describe authz state reprints this list:
+ * exempt from reconciliation, never exempt from the report. Returns `grantee → table →
+ * privileges`, sorted, because a COUNT is not auditable.
+ */
+export function ungovernedGrants(live: AuthzContract, governed: ReadonlySet<string>): GrantExemption[] {
+  const out: GrantExemption[] = [];
+  for (const t of live.tables) {
+    const grantees = new Set([...Object.keys(t.grants), ...Object.keys(t.columnGrants ?? {})]);
+    for (const grantee of [...grantees].sort()) {
+      if (isGoverned(governed, grantee)) continue;
+      const columnPrivileges = t.columnGrants?.[grantee];
+      out.push({
+        grantee,
+        table: t.table,
+        privileges: [...(t.grants[grantee] ?? [])].sort(),
+        ...(columnPrivileges && Object.keys(columnPrivileges).length > 0 ? { columnPrivileges } : {}),
+      });
+    }
+  }
+  return out.sort((a, b) => a.grantee.localeCompare(b.grantee) || a.table.localeCompare(b.table));
+}
+
+/**
+ * The exemption report, one line per grantee — the shared rendering every surface prints.
+ *
+ * Grouped by grantee (an operator asks "what does this role have?", not "what does this
+ * table give?") and always EXACT: role, privileges, and the tables. `3 ungoverned roles`
+ * would not be auditable, which is the whole reason the exemption is allowed to exist.
+ */
+export function renderGrantExemptions(exemptions: readonly GrantExemption[]): string[] {
+  const byGrantee = new Map<string, GrantExemption[]>();
+  for (const e of exemptions) byGrantee.set(e.grantee, [...(byGrantee.get(e.grantee) ?? []), e]);
+
+  const lines: string[] = [];
+  for (const [grantee, entries] of [...byGrantee.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+    // The privilege set is usually uniform across the tables; say it once and list the
+    // tables, and only fall back to per-table lines when it genuinely differs.
+    const shapes = new Set(entries.map((e) => e.privileges.join(',')));
+    if (shapes.size === 1 && entries.length > 1) {
+      lines.push(`${grantee}: ${entries[0].privileges.join(', ')} on ${entries.length} table(s) — ${entries.map((e) => e.table).sort().join(', ')}`);
+    } else {
+      for (const e of entries.sort((a, b) => a.table.localeCompare(b.table))) {
+        const cols = e.columnPrivileges
+          ? `; column-scoped ${Object.entries(e.columnPrivileges).map(([p, c]) => `${p} (${c.join(', ')})`).join(', ')}`
+          : '';
+        lines.push(`${grantee}: ${e.privileges.join(', ') || 'no table-level privileges'} on ${e.table}${cols}`);
+      }
+    }
+  }
+  return lines;
+}
+
 /** True when `s`'s outer parens already wrap the whole expression (redundant to add more). */
 function isWrapped(s: string): boolean {
   if (!s.startsWith('(') || !s.endsWith(')')) return false;
@@ -72,9 +170,17 @@ function tableMap(c: AuthzContract): Map<string, TableContract> {
  * revoke/grant — so a replaced policy never briefly co-exists with its old form
  * and policies exist before grants reference the table.
  */
-export function emitReconcileSql(declared: AuthzContract, live: AuthzContract): string[] {
+export function emitReconcileSql(
+  declared: AuthzContract,
+  live: AuthzContract,
+  opts: { governedRoles?: ReadonlySet<string> } = {},
+): string[] {
   const sql: string[] = [];
   const lTables = tableMap(live);
+  // Default: govern exactly what the models name (plus the always-governed set). A caller
+  // that passes nothing gets the safe-for-greenfield behaviour; a brownfield caller widens
+  // it with the modules' declared governedRoles.
+  const governed = opts.governedRoles ?? governedRoleSet(declared);
 
   for (const d of declared.tables) {
     const l = lTables.get(d.table);
@@ -83,8 +189,8 @@ export function emitReconcileSql(declared: AuthzContract, live: AuthzContract):
     const table = quoteQualified(d.table);
     reconcileRls(table, d, l, sql);
     reconcilePolicies(table, d, l, sql);
-    reconcileGrants(table, d, l, sql);
-    reconcileColumnGrants(table, d, l, sql);
+    reconcileGrants(table, d, l, sql, governed);
+    reconcileColumnGrants(table, d, l, sql, governed);
   }
 
   return sql;
@@ -108,6 +214,7 @@ export function emitReconcileSql(declared: AuthzContract, live: AuthzContract):
  */
 export function emitSwapAuthzSql(declared: AuthzContract): string[] {
   const sql: string[] = [];
+  const governed = governedRoleSet(declared);
   for (const d of declared.tables) {
     const table = quoteQualified(d.table);
     if (d.rls.enabled) sql.push(`ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY;`);
@@ -116,8 +223,10 @@ export function emitSwapAuthzSql(declared: AuthzContract): string[] {
       sql.push(policyDropSql(table, p.name)); // idempotent against the policy the dump restored
       sql.push(policyCreateSql(table, p));
     }
-    reconcileGrants(table, d, undefined, sql);
-    reconcileColumnGrants(table, d, undefined, sql);
+    // No live side here, so every grantee comes from the DECLARED contract and is
+    // governed by definition — the exemption can never fire on this path.
+    reconcileGrants(table, d, undefined, sql, governed);
+    reconcileColumnGrants(table, d, undefined, sql, governed);
   }
   return sql;
 }
@@ -145,9 +254,15 @@ function reconcilePolicies(table: string, d: TableContract, l: TableContract | u
   }
 }
 
-function reconcileGrants(table: string, d: TableContract, l: TableContract | undefined, out: string[]): void {
+function reconcileGrants(table: string, d: TableContract, l: TableContract | undefined, out: string[], governed: ReadonlySet<string>): void {
   const grantees = new Set([...Object.keys(d.grants), ...Object.keys(l?.grants ?? {})]);
   for (const grantee of [...grantees].sort()) {
+    // A live grantee the declared authz does not govern is LEFT ALONE. The union below
+    // would otherwise revoke every privilege it holds, because "no declaration" and "no
+    // privileges" are the same thing to a set difference — which is how a plan came to
+    // carry 32 revokes against a brownfield adopter's migration role. It is reported
+    // instead, by ungovernedGrants(), on every surface that describes authz state.
+    if (!isGoverned(governed, grantee)) continue;
     const declared = new Set(d.grants[grantee] ?? []);
     const live = new Set(l?.grants?.[grantee] ?? []);
     const target = grantee.toUpperCase() === 'PUBLIC' ? 'PUBLIC' : grantee;
@@ -165,10 +280,13 @@ function reconcileGrants(table: string, d: TableContract, l: TableContract | und
  * those live-but-not-declared. This is how `auth.users` exposes id/email/role (and only those)
  * to `authenticated` without a whole-table grant. Columns are sorted, so a re-pull is a no-op.
  */
-function reconcileColumnGrants(table: string, d: TableContract, l: TableContract | undefined, out: string[]): void {
+function reconcileColumnGrants(table: string, d: TableContract, l: TableContract | undefined, out: string[], governed: ReadonlySet<string>): void {
   const dcg = d.columnGrants ?? {};
   const lcg = l?.columnGrants ?? {};
   for (const grantee of [...new Set([...Object.keys(dcg), ...Object.keys(lcg)])].sort()) {
+    // Same exemption as the table-level grants — a column grant to an ungoverned role is
+    // still that role's access, and revoking it breaks the same pipeline.
+    if (!isGoverned(governed, grantee)) continue;
     const target = grantee.toUpperCase() === 'PUBLIC' ? 'PUBLIC' : grantee;
     const dPriv = dcg[grantee] ?? {};
     const lPriv = lcg[grantee] ?? {};

package/src/cli/commands/db-apply.ts

@@ -31,6 +31,11 @@ import { planHash, PLAN_VERSION, type EdgePlan } from '../edge-plan.js';
 import { verifyDescent, type DescentVerdict, type LiveState } from '../git-descent.js';
 import { checkDestructiveAuthority, readApproverParam, resolveCallerIdentity, type AuthorityVerdict } from '../apply-authority.js';
 import { resolveModelsPath } from '../models-path.js';
+import { loadModels } from './db-generate.js';
+import { loadDeclaredDerived } from '../declared-derived.js';
+import { compileTableContract } from '../authz-compile.js';
+import { governedRoleSet, ungovernedGrants } from '../authz-reconcile.js';
+import { readBaselineFile, checkAgainstBaseline, baselineRefusal } from '../authz-baseline.js';
 import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
 import { resolveConfig, opsFunction } from '../config.js';
 import { invokeAction, lambdaQueryRunner } from '../aws.js';
@@ -341,6 +346,19 @@ export async function dbApplyCommand(flags: Record<string, string>): Promise<voi
       actor: process.env.USER ?? null,
       gitRef: currentGitRef() ?? plan.gitRef,
       ...(verifyAuthority ? { verifyAuthority } : {}),
+      // Re-verified here, not just at mint: a plan is an artifact with a lifetime, and a
+      // foreign role granted between minting and applying would otherwise ride through.
+      verifyAuthzBaseline: async ({ contract }) => {
+        const stageName = flags.stage || 'local';
+        const models = await loadModels(resolveModelsPath(flags.models));
+        const governedRoles = (await loadDeclaredDerived(flags.models))?.governedRoles ?? [];
+        const declaredAuthz = { tables: models.map((m) => compileTableContract(m, {})), functions: [] };
+        const exemptions = ungovernedGrants(contract, governedRoleSet(declaredAuthz, governedRoles));
+        const violations = checkAgainstBaseline(await readBaselineFile(), stageName, exemptions);
+        return violations.length === 0
+          ? { ok: true as const }
+          : { ok: false as const, reason: baselineRefusal(stageName, violations) };
+      },
       ...(forceDescent === undefined ? {
         verifyDescent: async (live: LiveState & { fingerprint: string }) => {
           step('Descent: searching git for the commit that declares the target\'s state...');

package/src/cli/commands/db-check.ts

@@ -29,6 +29,7 @@
  */
 
 import fs from 'node:fs/promises';
+import path from 'node:path';
 import type { ModelDescriptor, DerivedDescriptor } from '@everystack/model';
 import { compileDeclaredState } from '../declared-diff.js';
 import { compileMigration } from '../migration-compile.js';
@@ -41,6 +42,7 @@ import { loadDeclaredDerived, retiredSqlDirAnywhere, retiredSqlDirFlagRefusal, t
 import type { SequenceDescriptor } from '@everystack/model';
 import type { SourceObject } from '../derived-source.js';
 import { findReadAuthzGaps } from '../authz-lint.js';
+import { parseBaseline, renderBaseline, BASELINE_FILE } from '../authz-baseline.js';
 import { findDerivedReadGaps, findSecdefExecuteGaps, findMatviewSnapshotWarnings } from '../derived-lint.js';
 import { step, success, fail, info, warn } from '../output.js';
 
@@ -82,6 +84,9 @@ export interface StaticCheckInput {
    *  stream reads `export const models`; when the two disagree, the state layer builds a
    *  different database than the modules declare — the split-brain gate below names it. */
   moduleModels?: ModelDescriptor[] | null;
+  /** Raw `db/authz-baseline.json`, or null when there is none. The ARTIFACT half of the
+   *  ungoverned-grantee gate — see the check below for what it deliberately does not do. */
+  baselineSource?: string | null;
 }
 
 export function runStaticChecks(input: StaticCheckInput): CheckFinding[] {
@@ -155,6 +160,37 @@ export function runStaticChecks(input: StaticCheckInput): CheckFinding[] {
     }
   }
 
+  // The adoption baseline, ARTIFACT ONLY.
+  //
+  // This check cannot see the threat and must not pretend to. The foreign grantees it
+  // exists to catch live in a real database; db:check's ephemeral compose builds a scratch
+  // database that by construction has none of them. So what runs offline is: does the
+  // artifact parse, and does it regenerate byte-identically (a hand-edit that does not
+  // match the recorded observation shape is a fail). The gate that actually defends the
+  // database is on the LIVE path — db:plan refuses to mint and db:apply re-verifies.
+  if (input.baselineSource != null) {
+    try {
+      const parsed = parseBaseline(input.baselineSource);
+      if (renderBaseline(parsed) !== input.baselineSource) {
+        findings.push({
+          level: 'fail',
+          area: 'authz',
+          message: `${BASELINE_FILE} is not in generated form — re-run \`db:pull --abilities live --stage <name>\` and commit the result. (A hand-edited baseline is how a foreign role gets admitted without the observation that justifies it.)`,
+        });
+      } else {
+        const stages = Object.keys(parsed.stages).sort();
+        const total = stages.reduce((n, st) => n + Object.keys(parsed.stages[st].grantees).length, 0);
+        findings.push({
+          level: 'ok',
+          area: 'authz',
+          message: `${BASELINE_FILE} is in generated form — ${total} adopted foreign grantee(s) across ${stages.length} stage(s): ${stages.join(', ')} (the live gate runs at db:plan/db:apply, not here)`,
+        });
+      }
+    } catch (err: any) {
+      findings.push({ level: 'fail', area: 'authz', message: err.message });
+    }
+  }
+
   // The derived layer failing to COMPILE (reachability, cycles, undeclared trigger
   // functions) is a hard fail — CI cannot shrug at a compile error.
   if (input.derivedError) {
@@ -295,10 +331,19 @@ export async function dbCheckCommand(flags: Record<string, string>): Promise<voi
     derivedError = err.message;
   }
 
+  // The baseline artifact, read raw so the check can compare it against its own
+  // regeneration. Absent is not a failure here — an app with no foreign grantees has
+  // nothing to adopt; the LIVE gate is what refuses an unadopted one.
+  let baselineSource: string | null = null;
+  try {
+    baselineSource = await fs.readFile(path.resolve(process.cwd(), BASELINE_FILE), 'utf8');
+  } catch { /* no baseline — see above */ }
+
   const findings = runStaticChecks({
     modelsPath, models, modelsError, artifactPath, artifactSource, sqlDirRetired,
     sequences: declaredDb?.sequences, derived: declaredDb?.derived, derivedError,
     moduleModels: declaredDb?.models ?? null,
+    baselineSource,
   });
   for (const f of findings) {
     (f.level === 'fail' || f.level === 'warn' ? warn : info)(`${MARK[f.level]} ${f.area}: ${f.message}`);

package/src/cli/commands/db-generate.ts

@@ -27,7 +27,9 @@ import { introspectSchema } from '../schema-introspect.js';
 import { compileDrizzleSource } from '../schema-source.js';
 import { compileModuleMigration } from '../migration-compile.js';
 import { generateMigrationSql, unmodeledTables, formatMigrationFile, planMigrationFile, resolveSchemaOut, HELD_DROP_PREFIX, type Journal } from '../migration-generate.js';
-import { introspectContract, type QueryRunner } from '../authz-contract.js';
+import { introspectContract, type QueryRunner, type AuthzContract } from '../authz-contract.js';
+import { compileTableContract } from '../authz-compile.js';
+import { governedRoleSet, ungovernedGrants, renderGrantExemptions } from '../authz-reconcile.js';
 import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
 import { resolveDbSource, createUrlRunner, connectingVia, type DbSource } from '../db-source.js';
 import { resolveModelsPath } from '../models-path.js';
@@ -86,7 +88,7 @@ async function loadModules(modelsPath: string): Promise<Module[]> {
   }
   if (Array.isArray(mod.modules)) return mod.modules;
   const models = mod.models ?? mod.default;
-  if (Array.isArray(models)) return [{ models, extensions: [], sequences: [], derived: [], functions: [] }];
+  if (Array.isArray(models)) return [{ models, extensions: [], sequences: [], derived: [], governedRoles: [], functions: [] }];
   throw new Error(`${modelsPath} must export a \`modules\` (or \`models\`) array.`);
 }
 
@@ -129,6 +131,26 @@ async function dbGenerateInit(modelsPath: string, migrationsDir: string, schemaO
 }
 
 /** Read the journal if present (null = no history yet). */
+/**
+ * Name every live grantee the declared authz does not govern, with its exact privileges.
+ *
+ * The reconciler EXEMPTS these from revocation — a migrator, ETL account or BI reader the
+ * model vocabulary cannot express would otherwise have its access destroyed by a plan
+ * nobody read (32 such revokes on the first brownfield schema this was measured against).
+ * The exemption is only defensible if it is never silent, so this prints on every generate,
+ * dry run or not, and names roles and privileges exactly rather than counting them.
+ */
+function reportGrantExemptions(liveAuthz: AuthzContract | undefined, models: ModelDescriptor[], governedRoles: string[]): void {
+  if (!liveAuthz) return; // no live side — nothing can be ungoverned
+  const declared: AuthzContract = { tables: models.map((m) => compileTableContract(m, {})), functions: [] };
+  const exemptions = ungovernedGrants(liveAuthz, governedRoleSet(declared, governedRoles));
+  if (exemptions.length === 0) return;
+  const roles = new Set(exemptions.map((e) => e.grantee));
+  warn(`${roles.size} role(s) hold privileges this schema does not govern — left UNTOUCHED, never revoked:`);
+  for (const line of renderGrantExemptions(exemptions)) info(`  ${line}`);
+  info(`Bring them under the reconciler with defineModule({ governedRoles: [...] }), or leave them exempt — either way they are listed here every run.`);
+}
+
 async function readJournal(migrationsDir: string): Promise<Journal | null> {
   try {
     return JSON.parse(await fs.readFile(path.join(migrationsDir, 'meta', '_journal.json'), 'utf8'));
@@ -226,11 +248,15 @@ export async function dbGenerateCommand(flags: Record<string, string>): Promise<
 
   // One ordered migration carries both layers: data DDL first, then the authz reconcile
   // (RLS/policies/grants) the Models' abilities declare, diffed against the live contract.
-  const statements = generateMigrationSql(models, current, { allowDrops, liveAuthz, sequences: declaredDb?.sequences });
+  const statements = generateMigrationSql(models, current, { allowDrops, liveAuthz, sequences: declaredDb?.sequences, governedRoles: declaredDb?.governedRoles });
   const unmodeled = unmodeledTables(models, current);
   if (unmodeled.length) {
     info(`${unmodeled.length} table(s) in the database are not declared by any model — left untouched (db:generate manages only declared tables).`);
   }
+  // Exemptions are enumerated on EVERY generate, dry run or not. The reconciler leaves an
+  // ungoverned grantee's privileges alone rather than revoking them; that is only
+  // defensible because the artifact says exactly whose access it chose not to govern.
+  reportGrantExemptions(liveAuthz, models, declaredDb?.governedRoles ?? []);
   console.log('');
   if (statements.length === 0) {
     success(`db:generate — the live database already matches the models. ${dryRun ? 'Nothing to preview.' : 'No migration written.'}`);

package/src/cli/commands/db-plan.ts

@@ -33,6 +33,10 @@ import { resolveModelsPath } from '../models-path.js';
 import { resolveConfig, opsFunction } from '../config.js';
 import { lambdaQueryRunner } from '../aws.js';
 import { loadModels } from './db-generate.js';
+import { loadDeclaredDerived } from '../declared-derived.js';
+import { governedRoleSet, ungovernedGrants } from '../authz-reconcile.js';
+import { readBaselineFile, checkAgainstBaseline, baselineRefusal } from '../authz-baseline.js';
+import { compileTableContract } from '../authz-compile.js';
 import { reportPipelineLastRun } from './pipeline-run.js';
 import { step, success, fail, info, warn } from '../output.js';
 
@@ -73,6 +77,29 @@ export async function dbPlanCommand(flags: Record<string, string>): Promise<void
     step('Asking the target its fingerprint (introspecting state + authz)...');
     const snapshot = await introspectSchema(runner);
     const contract = await introspectContract(runner, contractFunctionRow, FUNCTIONS_SQL);
+    // The modules' widened governed-role set. A barrel that exports only `models` has none,
+    // which is the greenfield default: govern exactly what the models name.
+    let declaredGovernedRoles: string[] = [];
+    try {
+      declaredGovernedRoles = (await loadDeclaredDerived(flags.models))?.governedRoles ?? [];
+    } catch {
+      // The barrel's own compose errors surface on the paths that need the derived layer;
+      // a plan must not fail to mint because a module could not be read for this one field.
+    }
+
+    // THE GATE. The reconciler leaves an ungoverned grantee alone rather than revoking it,
+    // so the only thing standing between a brownfield exemption and a permanent silent hole
+    // is this: a foreign grantee must be in the stage's adoption baseline, and must not have
+    // grown since. An absent baseline is an EMPTY one, so greenfield gets the strong
+    // property with no flag to remember — a new foreign role refuses on day one.
+    const stageName = flags.stage || 'local';
+    const declaredAuthz = { tables: models.map((m) => compileTableContract(m, {})), functions: [] };
+    const exemptions = ungovernedGrants(contract, governedRoleSet(declaredAuthz, declaredGovernedRoles));
+    const violations = checkAgainstBaseline(await readBaselineFile(), stageName, exemptions);
+    if (violations.length > 0) {
+      fail(baselineRefusal(stageName, violations));
+      process.exit(1);
+    }
 
     let plan;
     try {
@@ -80,6 +107,9 @@ export async function dbPlanCommand(flags: Record<string, string>): Promise<void
         allowDrops: flags['allow-drops'] === 'true',
         gitRef: currentGitRef(),
         actor: process.env.USER ?? null,
+        // Without this the MINTED PLAN carries a REVOKE for every live grantee the models
+        // do not name — which is the artifact an operator actually applies.
+        governedRoles: declaredGovernedRoles,
       });
     } catch (err: any) {
       fail(`Mint refused: ${err.message}`);

package/src/cli/commands/db-pull.ts

@@ -30,6 +30,9 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { introspectSchema, MATVIEW_COLUMNS_SQL, matviewColumnsByIdentity, type ColumnRow, type ColumnSchema } from '../schema-introspect.js';
+import { fingerprintLive } from '../schema-fingerprint.js';
+import { ungovernedGrants, ALWAYS_GOVERNED, type GrantExemption } from '../authz-reconcile.js';
+import { buildStageBaseline, mergeBaseline, readBaselineFile, writeBaselineFile, BASELINE_FILE } from '../authz-baseline.js';
 import { introspectDerived, type DerivedCatalog } from '../derived-introspect.js';
 import { introspectContract, type TableContract } from '../authz-contract.js';
 import { FUNCTIONS_SQL, contractFunctionRow } from '../security-catalog.js';
@@ -126,6 +129,9 @@ export async function dbPullCommand(flags: Record<string, string>): Promise<void
 
   let current;
   let liveAuthz: Map<string, TableContract> | undefined;
+  /** Adoption observation — the foreign grantees present, and what the claim is true OF. */
+  let pulledExemptions: GrantExemption[] = [];
+  let pulledFingerprint = '';
   let derivedCatalog: DerivedCatalog | undefined;
   let matviewColumns: Map<string, ColumnSchema[]> | undefined;
   let candidatesByIdentity: Map<string, string[]> | undefined;
@@ -167,6 +173,17 @@ export async function dbPullCommand(flags: Record<string, string>): Promise<void
         note(`Grants exist for ${[...unmapped].sort().join(', ')} — not rendered: abilities name the roles the model knows (anon/authenticated/admin).`);
         detail(`These are left exactly as they are in the database. Add can(..., { role }) only if you want the models to own them.`);
       }
+      // ADOPTION: record the foreign grantees that were already here, per stage. The
+      // reconciler exempts them from revocation, so this artifact is what stops that
+      // exemption becoming permanent and silent — anything NEW, or anything that has since
+      // grown, refuses at db:plan. It lands as a reviewable diff, with writes flagged,
+      // because nothing mechanical can tell a legitimate BI role from an attacker's on day
+      // one; the defence is forcing the look and making it recur.
+      // The governed set at ADOPTION is the fixed vocabulary alone: the models being
+      // rendered here can only name anon/authenticated/admin, so every other grantee is
+      // foreign by construction — the same set `unmapped` just reported, with privileges.
+      pulledExemptions = ungovernedGrants(contract, new Set(ALWAYS_GOVERNED));
+      pulledFingerprint = fingerprintLive(current, contract).hash;
     }
     // --matviews-as-tables: the flip needs real fields — one extra catalog read for the
     // matview columns the derived layer (definition-only) doesn't carry.
@@ -299,5 +316,28 @@ export async function dbPullCommand(flags: Record<string, string>): Promise<void
   } else {
     note(`Stamped '${abilities}' abilities into every model — review the generated stanzas; they are code, not defaults.`);
   }
+
+  // The adoption baseline. Only under --abilities live (it is an OBSERVATION of the live
+  // grants, so there is nothing to record without having read them) and only for a named
+  // stage, because the gate is per-stage: a production entry must not excuse the same role
+  // in dev. Written even when EMPTY — an empty baseline for a stage is a real, reviewed
+  // claim ("this stage had no foreign grantees"), and it is what makes a later arrival fail.
+  if (abilities === 'live') {
+    const stageName = flags.stage;
+    if (!stageName) {
+      note(`No --stage, so ${BASELINE_FILE} was not written. The foreign grantees above are recorded per stage; re-run with --stage <name> to adopt them, or db:plan will refuse until you do.`);
+    } else {
+      const entry = buildStageBaseline(pulledExemptions, { observedAt: new Date().toISOString(), fingerprint: pulledFingerprint });
+      const merged = mergeBaseline(await readBaselineFile(), stageName, entry);
+      const written = await writeBaselineFile(merged);
+      const names = Object.keys(entry.grantees);
+      const writers = names.filter((n) => entry.grantees[n].write);
+      ok(`Wrote ${path.relative(process.cwd(), written)} — ${names.length} foreign grantee(s) recorded for stage '${stageName}'.`);
+      if (writers.length) {
+        caution(`${writers.length} of them hold WRITE privileges: ${writers.join(', ')}. Review the diff before committing — this is the moment those roles get looked at.`);
+      }
+      note(`Committing this file ADOPTS those roles. Anything not in it — or anything that grows beyond it — refuses at db:plan.`);
+    }
+  }
   process.exit(0);
 }

package/src/cli/commands/db-sync.ts

@@ -75,6 +75,9 @@ export interface SyncOptions {
   declared?: SourceObject[];
   /** Standalone sequences the modules declare (state — created before tables, fingerprinted). */
   sequences?: SequenceDescriptor[];
+  /** Roles the modules govern beyond the ones the models name — a grantee outside the set
+   *  is exempted from revocation and enumerated instead (authz-reconcile's governedRoleSet). */
+  governedRoles?: string[];
   /** Pending table renames — trigger provenance migrates instead of drop+create. */
   renamedTables?: Record<string, string>;
   /** Injectable clock for tests. */
@@ -118,6 +121,7 @@ export async function executeSync(
   const liveAuthz = await introspectContract(runner, contractFunctionRow, FUNCTIONS_SQL);
   const statements = generateMigrationSql(models, current, {
     allowDrops: options.allowDrops, liveAuthz, sequences: options.sequences,
+    governedRoles: options.governedRoles,
   });
   hooks.onStatePlan?.(statements, classifyGeneratedStatements(statements));
 

package/src/cli/declared-derived.ts

@@ -12,6 +12,7 @@ import path from 'node:path';
 import fs from 'node:fs/promises';
 import { pathToFileURL } from 'node:url';
 import type { Module, ModelDescriptor, SequenceDescriptor, DerivedDescriptor } from '@everystack/model';
+import { moduleGovernedRoles } from '@everystack/model';
 import { compileDerived } from './derived-compile.js';
 import { compileTableRenames, compileTableMoves } from './schema-compile.js';
 import type { SourceObject } from './derived-source.js';
@@ -30,6 +31,9 @@ export interface DeclaredDerived {
   /** The models the modules compose — db:check's split-brain gate compares these against
    *  the barrel's `export const models` (the array every verb's state stream reads). */
   models: ModelDescriptor[];
+  /** Roles the modules declare as governed beyond the ones the models name. A live grantee
+   *  outside the governed set is exempted from reconciliation and ENUMERATED instead. */
+  governedRoles: string[];
 }
 
 /**
@@ -64,7 +68,7 @@ export async function loadModulesFrom(modelsPath: string): Promise<Module[]> {
     const models = mod.models ?? mod.default;
     if (Array.isArray(models)) {
       assertNoHoles(modelsPath, 'models', models);
-      return [{ models, extensions: [], sequences: [], derived: [], functions: [] }];
+      return [{ models, extensions: [], sequences: [], derived: [], governedRoles: [], functions: [] }];
     }
     throw new Error(`${modelsPath} must export a \`modules\` (or \`models\`) array.`);
   } catch (err) {
@@ -173,6 +177,7 @@ export function composeDeclaredDerived(modules: Module[], modelsPath: string): D
       // ... SET SCHEMA alike, so the trigger-provenance migration is identical — feed both.
       renamedTables: { ...compileTableRenames(models, {}), ...compileTableMoves(models, {}) },
       models,
+      governedRoles: moduleGovernedRoles(modules),
     };
   } catch (err) {
     throw asModelComposeError(modelsPath, err);

package/src/cli/edge-plan.ts

@@ -29,6 +29,7 @@ import type { ModelDescriptor } from '@everystack/model';
 import type { SchemaSnapshot } from './schema-introspect.js';
 import type { AuthzContract } from './authz-contract.js';
 import { generateMigrationSql, unmodeledTables } from './migration-generate.js';
+import { compileTableContract } from './authz-compile.js';
 import { classifyGeneratedStatements, classifyDestructive, renderStatementHistogram } from './state-apply.js';
 import { fingerprintLive, fingerprintState, fingerprintModels, stableStringify } from './schema-fingerprint.js';
 import { compileDeclaredState } from './declared-diff.js';
@@ -36,7 +37,7 @@ import { compileTableRenames, compileTableMoves } from './schema-compile.js';
 
 export const PLAN_VERSION = 2;
 
-/** Classification counts (brick 9, decision 11): destructive = drops + narrowings. */
+/** Classification counts (brick 9, decision 11): destructive = drops + narrowings + strips. */
 export interface PlanClassification {
   /** Executable statements that lose no data. */
   additive: number;
@@ -44,6 +45,9 @@ export interface PlanClassification {
   drops: number;
   /** Lossy/risky `ALTER COLUMN … TYPE` — data loss wearing an ALTER. */
   narrowings: number;
+  /** REVOKEs against a grantee no model declares — nothing re-derives that access.
+   *  Optional: a plan minted before this classification existed has no field for it. */
+  strips?: number;
 }
 
 export interface EdgePlan {
@@ -72,6 +76,12 @@ export interface MintOptions {
   allowDrops?: boolean;
   gitRef?: string | null;
   actor?: string | null;
+  /**
+   * Roles the modules declare as governed beyond the ones the models name. A live grantee
+   * outside the governed set is left untouched rather than revoked — without this the
+   * MINTED PLAN carries those revokes, which is where they would actually be applied.
+   */
+  governedRoles?: string[];
 }
 
 /**
@@ -145,6 +155,7 @@ export function mintEdgePlan(
     schema: opts.schema,
     allowDrops: opts.allowDrops,
     liveAuthz: contract,
+    governedRoles: opts.governedRoles,
   });
   const classified = classifyGeneratedStatements(statements);
   if (classified.heldDrops.length > 0) {
@@ -158,8 +169,16 @@ export function mintEdgePlan(
   // (the authz phase is data-safe by construction); dropping a table,
   // column, or type is not — and neither is a narrowing type change, which
   // is data loss wearing an ALTER.
-  const breakdown = classifyDestructive(classified.executable);
-  const destructive = breakdown.drops.length + breakdown.narrowings.length;
+  // The grantees the models actually declare — the discriminator for a STRIP (a revoke
+  // against a role no model grants to has nothing to restore it from, so it carries the
+  // same ceremony as a dropped column).
+  const declaredGrantees = new Set<string>();
+  for (const t of models.map((m) => compileTableContract(m, { schema: opts.schema }))) {
+    for (const g of Object.keys(t.grants)) declaredGrantees.add(g);
+    for (const g of Object.keys(t.columnGrants ?? {})) declaredGrantees.add(g);
+  }
+  const breakdown = classifyDestructive(classified.executable, { declaredGrantees });
+  const destructive = breakdown.drops.length + breakdown.narrowings.length + breakdown.strips.length;
 
   return {
     v: PLAN_VERSION,
@@ -173,6 +192,7 @@ export function mintEdgePlan(
       additive: classified.executable.length - destructive,
       drops: breakdown.drops.length,
       narrowings: breakdown.narrowings.length,
+      ...(breakdown.strips.length > 0 ? { strips: breakdown.strips.length } : {}),
     },
     notices: classified.notices.length,
     unmodeled: unmodeledTables(models, snapshot),

package/src/cli/migration-generate.ts

@@ -20,7 +20,7 @@ import type { SchemaSnapshot } from './schema-introspect.js';
 import type { AuthzContract } from './authz-contract.js';
 import { compileTableSchema, compileRenames, compileTableRenames, compileTableMoves, compileCreateTable, compileEnums, compileSequences } from './schema-compile.js';
 import { compileTableContract } from './authz-compile.js';
-import { emitReconcileSql } from './authz-reconcile.js';
+import { emitReconcileSql, governedRoleSet } from './authz-reconcile.js';
 import { diffSchema, emitSchemaSql, type SchemaChange } from './schema-diff.js';
 
 export interface GenerateOptions {
@@ -44,6 +44,13 @@ export interface GenerateOptions {
    * removed table/enum becomes a drop (still held by the `allowDrops` gate).
    */
   scope?: 'declared' | 'full';
+  /**
+   * Roles the modules declare as governed BEYOND the ones the models name
+   * (`moduleGovernedRoles`). A live grantee outside the governed set is left untouched
+   * rather than revoked — see authz-reconcile's `governedRoleSet`. Widen-only: this can
+   * never stop a model-named role being governed.
+   */
+  governedRoles?: string[];
   /**
    * The live authorization contract (`introspectContract`). When provided, the migration
    * carries the authz layer too — the Models' `abilities` compiled to RLS/policies/grants,
@@ -208,8 +215,11 @@ export function generateMigrationSql(models: ModelDescriptor[], current: SchemaS
       }
     : opts.liveAuthz;
   const desiredContracts = models.map((m) => compileTableContract(m, { schema }));
+  const desiredAuthz: AuthzContract = { tables: desiredContracts, functions: [] };
   const authzPhase = liveAuthzRenamed
-    ? emitReconcileSql({ tables: desiredContracts, functions: [] }, liveAuthzRenamed)
+    ? emitReconcileSql(desiredAuthz, liveAuthzRenamed, {
+        governedRoles: governedRoleSet(desiredAuthz, opts.governedRoles ?? []),
+      })
     : [];
 
   // 0a-bis (the diff analog of compileMigration's). A role cannot reach a table in a

package/src/cli/model-render.ts

@@ -226,7 +226,13 @@ function renderDefault(expr: string): string | null {
   const str = n.match(/^'([\s\S]*)'$/);
   if (str) return `.default(${JSON.stringify(str[1].replace(/''/g, "'"))})`;
   if (n === 'true' || n === 'false') return `.default(${n})`;
-  if (/^-?\d+(\.\d+)?$/.test(n)) return `.default(${n})`;
+  // A numeric default only survives as a JS number when the number renders back to the
+  // SAME text. `0.0` is the number 0, so `.default(0.0)` stores 0 and compiles to
+  // `DEFAULT 0` against a live `DEFAULT 0.0` — drift on every apply, forever (21 statements
+  // on the first real schema this was measured against). Same for `1.50`, `0.10`, `1e3`.
+  // Where the text cannot round-trip, fall through to `.defaultSql()`, which carries the
+  // live spelling verbatim. The exact-integer and exact-decimal cases are unchanged.
+  if (/^-?\d+(\.\d+)?$/.test(n)) return String(Number(n)) === n ? `.default(${n})` : null;
   return null;
 }
 

package/src/cli/state-apply.ts

@@ -71,22 +71,59 @@ export function classifyGeneratedStatements(statements: string[]): ClassifiedSta
  *
  * Recoverable metadata is never destructive: policies, grants, constraints,
  * defaults, nullability all re-declare from the models without touching a row.
+ *
+ *   strips     — the ONE exception to that rule. A REVOKE against a grantee NO model
+ *                declares is not recoverable from the models: there is no declaration to
+ *                re-derive it from, and the role simply loses its access. This is the
+ *                deliberate case left over once ungoverned grantees stopped being revoked
+ *                by accident (authz-reconcile's governedRoleSet) — someone put a role in
+ *                `governedRoles` and then granted it nothing, which reads as "strip it".
+ *                Deliberate removal deserves the same ceremony as a dropped column.
+ *                Framework roles (anon/authenticated/admin/PUBLIC) are excluded: revoking
+ *                from those is ordinary authz churn and re-declaring an ability restores it.
  */
 export interface DestructiveBreakdown {
   drops: string[];
   narrowings: string[];
+  /** REVOKEs that leave an undeclared grantee with nothing to restore it from. */
+  strips: string[];
+}
+
+/** `REVOKE … ON <table> FROM <grantee>;` → the grantee, or null when it is not a revoke. */
+export function revokeTarget(statement: string): string | null {
+  // A quoted identifier can hold anything (`"Odd-Role"`, a reserved word, mixed case), and
+  // reading one as null would silently UNDER-classify a strip — the failure direction that
+  // matters, since it skips the ceremony rather than adding one.
+  const m = /^REVOKE\s+[\s\S]+?\sFROM\s+("[^"]*"|[A-Za-z_][A-Za-z0-9_$]*)\s*;?\s*$/i.exec(statement.trim());
+  return m ? m[1].replace(/^"|"$/g, '') : null;
 }
 
-export function classifyDestructive(executable: string[]): DestructiveBreakdown {
+export function classifyDestructive(
+  executable: string[],
+  opts: { declaredGrantees?: ReadonlySet<string> } = {},
+): DestructiveBreakdown {
   const drops: string[] = [];
   const narrowings: string[] = [];
+  const strips: string[] = [];
   for (const statement of executable) {
     if (/\bDROP\s+(TABLE|COLUMN|TYPE)\b/.test(statement)) drops.push(statement);
     else if (/\bSET DATA TYPE\b/.test(statement) && /\bUSING\b/.test(statement)) narrowings.push(statement);
+    else if (opts.declaredGrantees) {
+      // Only classified when the caller supplied the declared side — without it there is
+      // no way to tell a strip from ordinary churn, and guessing would newly force
+      // --confirm on plans that never needed it.
+      const grantee = revokeTarget(statement);
+      if (grantee && !opts.declaredGrantees.has(grantee) && !FRAMEWORK_ROLES.has(grantee.toUpperCase())) {
+        strips.push(statement);
+      }
+    }
   }
-  return { drops, narrowings };
+  return { drops, narrowings, strips };
 }
 
+/** Roles the framework itself owns — revoking from these re-declares from an ability. */
+const FRAMEWORK_ROLES = new Set(['PUBLIC', 'ANON', 'AUTHENTICATED', 'ADMIN']);
+
 /**
  * The kind histogram — what a plan IS, before anyone reads its SQL. A real edge can
  * run to four digits of statements (a consumer's adoption edge was 1,671), and the