@fourier-labs/harbour-contracts 0.51.0 → 0.53.0

package/contract-release.json

@@ -1,12 +1,12 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.51.0.0",
-  "publishVersion": "0.51.0",
-  "publishTag": "v0.51.0",
-  "schemasDigest": "sha256:018bf3078087a18b07990772c94669f658159bc84b0c8accedc7dd5daa38bee5",
+  "repositoryVersion": "0.53.0.0",
+  "publishVersion": "0.53.0",
+  "publishTag": "v0.53.0",
+  "schemasDigest": "sha256:c4d7c9642842bf3709003f447fb22429ce3573acabaa2da8279e0fc399e8d237",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:98bb6999738be926c36fd8d0735a17defdad590ced57e94bc431bb9bba53c9ad",
-  "generatedTypeScriptDigest": "sha256:1d83b04e4899777f2963177e39e7ac99852cae80ffb8c03b6a294f5fb19d3600",
+  "generatedGoDigest": "sha256:8f3c3281a76792a9480ca1f7bcbad820db1908efffb29072fcdb0a8f99dbd208",
+  "generatedTypeScriptDigest": "sha256:82a083862e500a06df3550e694221cff9dcb98461d5174889c374713f961040c",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
@@ -31,12 +31,12 @@
     "schema/ai-transform-result.schema.json": "sha256:244e380a36957ab2dcb526ea22aaecb56b53664ce1fda6934d0021c084c99133",
     "schema/ai-verification-evidence.schema.json": "sha256:bdbc762df256d2a8dd0bdda60d4d13915ce40034cd756af9515871d145f10ad9",
     "schema/api-error-response.schema.json": "sha256:3d43d5bdf0b59c944e20509d832e6776c3ecdba4d6c245a9118bbe52062a8304",
-    "schema/app-integrations-declaration.schema.json": "sha256:1a6ac2e7d77a4d4dcbce8b937747f125081413f819ffee9e27e8b950a436cb22",
+    "schema/app-integrations-declaration.schema.json": "sha256:5d43c31719c93c9c8235b6c03dbe55a42ebdb2efb78225ad14222bd1086dcf6a",
     "schema/artifact-contract.schema.json": "sha256:8047b461a1c6d07bbe867a259c57bdf5cc0fdf282cf842ec7b683a9e93713b10",
     "schema/binding-classification-subject.schema.json": "sha256:a8825ce652e7e00a18759c4249bd5bcd0cae552dd58440513f867e87f685133c",
     "schema/builder-input-proposal.schema.json": "sha256:fe85cffa6d76b1e1effe1f5d75525f8fe0e1eaa3be4a304e491aa23ad72c0e72",
     "schema/data-dependency.schema.json": "sha256:89ba8481ccabc935e7dab5d13871c985839a751ad1586710d8382a15e1f3340c",
-    "schema/data-grant-v2.schema.json": "sha256:6d639745e7a00f5f6383fa9034e3b04b6772cb29a60a6db1a3c517dc7a6c26ba",
+    "schema/data-grant-v2.schema.json": "sha256:7fa6022aa2fcfd3c94bb969315155ea24e5a1aa25a25cb718df4465397076e07",
     "schema/data-grant.schema.json": "sha256:e640553831ecc1c01cc9a37fe388b84d0ffeaa0d0050e63712b48f65fa437c8a",
     "schema/data-source.schema.json": "sha256:aec8d2497dae9a91886a3df9f6fbbdb3d3fcab44b14fbcacc3f5e99b827f1bba",
     "schema/deploy-request.schema.json": "sha256:32531e21983cdfeec511f8b4cddd4dad6530cd90e4e9fe147225d78d138b6198",
@@ -52,20 +52,20 @@
     "schema/error-envelope.schema.json": "sha256:75dccda7dd16fdf8435deda53fc7dbcdc109b65114617a17f11763010c656f90",
     "schema/integration-connect-result.schema.json": "sha256:3f254b67ef739dc1fa395bdc8c4dc93359b16d481dba2a2d777aa5b6f34b7af8",
     "schema/integration-error-details.schema.json": "sha256:09cebaddb7f88e63cbebaa1cada5f91057ae4dc4370e973ef38f7f11c6323284",
-    "schema/integration-execute-request.schema.json": "sha256:18613bab7c233d1e2d52b960f5fe6ae4409171fa03a3aebf415cf86ae66e2866",
+    "schema/integration-execute-request.schema.json": "sha256:efbf25e2c01ccafec6e5c8023d891daa51e8b8c29a1735afe0f0eb33c4615834",
     "schema/integration-execute-result.schema.json": "sha256:766146779c01ee1dbdd2161c5dc594f43ccaf322762352bb0dc5b80bcb3275b5",
     "schema/kit-bundle-manifest.schema.json": "sha256:c15e28ae028dbd1c262427b9c797142e19b1f38fa36b4ecfe187e32c20a174ec",
     "schema/kit-lock.schema.json": "sha256:5e24b76660f83990af7a6c037af350c3850ee439ef956f65a0360facbdcdd997",
     "schema/kvs-routing-entry.schema.json": "sha256:b75f3a5dfa93a428b2764e03222b66b6ef2bed980f8bac8ffac54afdf3526bc5",
     "schema/promotion-request.schema.json": "sha256:00e96dfd8ddbdba88ea222941d43f3609ff6c815a79e34f6705cab458101c969",
     "schema/promotion-response.schema.json": "sha256:4129712d2e29d6ef21d93d4bd0bacfd60ada3f2ee0ade852824e64346b817634",
-    "schema/saas-connection.schema.json": "sha256:fa62fc6e28124120c71ebc36e257263ba8820d48b7d505d54ac53bd812fdd9ee",
+    "schema/saas-connection.schema.json": "sha256:1fcb1a3ee922e49d8f846db6bd6284f6de483b26cb1ae03da0381b396bb8132d",
     "schema/sanitized-binding-evidence.schema.json": "sha256:1191ab88e2764df927e5f17837674cebebe068d480da2b2fdb390e589f96b51f",
     "schema/secret-reference.schema.json": "sha256:db4e3c2c6a2dbd72d7ea0f9c91cb3b2343a7e67b601996c6818b2ef08e440895",
     "schema/security-scan-input.schema.json": "sha256:83502dffb3c07ac2e0698928e6dc123f454fc667d4aacd336bcad6944ef2ac3d",
     "schema/security-verdict.schema.json": "sha256:ec3c2d5c9df3601aeed0909b36c7f427469c7f0eeb3295c5809b96d09bf3fc26",
     "schema/transform-parked-result.schema.json": "sha256:11729980d4c89d4a9e18f5f213232cd3359739c85626b36c20c2a37ba794c9af",
-    "schema/transform-report.schema.json": "sha256:858da48fa7fe97d8d06267bb3435d71ba307133b246cb020f5b473bb488c445a",
+    "schema/transform-report.schema.json": "sha256:62c8f3aa3ac748cb54d78cb729bdfbaaccf1c03574ea92841eb23b2557eff3cf",
     "schema/version-state.schema.json": "sha256:3b190007e2f8e3821c41ef11c6f5b226da7d5a18d34d4077f4618004846fd444",
     "schema/well-defined-app-manifest.schema.json": "sha256:40f1bfea912dd85a05a0a3be2f6becadaf8ae3c5de9d5782ff1c8dd1bd83485f"
   },
@@ -107,8 +107,8 @@
     "gen-go/error_category.go": "sha256:b2ddea22dcfa030f1a45e721e635485b0bd816cf1f38e7654628a653f5ed4583",
     "gen-go/integration_execute_input_rules.go": "sha256:224fb490a5f936b30927e6637e698093e1e42a695cbc1bcf9a39bc70db9f2172",
     "gen-go/integration_execute_input_rules_test.go": "sha256:c437a8406a2f062a0173b9419e4cb176fc6eb54e569506225d5162323f55b40b",
-    "gen-go/schema_documents.go": "sha256:66055e0d4354f73d922ee17984de8df065db665f93182b87fcd8a6a94ae94300",
-    "gen-go/types.go": "sha256:c94b302d560efb7d8a8f6a4387a22a2f0321489e04d9d126d561cd921ff07eec",
+    "gen-go/schema_documents.go": "sha256:a01b157658d23e2585e64ff101ed720942856626676b50c83efbd8b044a050d6",
+    "gen-go/types.go": "sha256:819a27018a274c83233993a0c54359219ebbd0b11523f68c3c34ba0223d9e5ba",
     "gen-go/version_state.go": "sha256:4ef8abb126414c0025cf2c59bc9c79a74ef4a2ff89e8f316cbf05acc872371c1"
   },
   "generatedTypeScript": {
@@ -133,13 +133,13 @@
     "gen-ts/ai-transform-result.ts": "sha256:208c66b2aeb425c0cbcc18b7191f6e8989443f2b2c1690648e0e06cc1448ce25",
     "gen-ts/ai-verification-evidence.ts": "sha256:979439d77f8b47631d1eb3b6c3c54ea6fec41089d2a51dc815fd370b1c4917fc",
     "gen-ts/api-error-response.ts": "sha256:0fd73be282e7a5d72d6c343a4e64d09c232556b16161167f0cffd6278ed7e3d3",
-    "gen-ts/app-integrations-declaration.ts": "sha256:aabebdbffc70dd87017f1c72e0b8713f9cef506ba5258279b3a1405185875141",
+    "gen-ts/app-integrations-declaration.ts": "sha256:c2edea82c2c80d15dc233499ef289ea310e59b61b1e4428ea9e4fed85168d2a4",
     "gen-ts/artifact-contract.ts": "sha256:4a6dc6d2caaeed4bb2066cc8a333e6e09e5a0d4745e0b1038293d54ab9403aeb",
     "gen-ts/binding-classification-digest-helper.ts": "sha256:40fc7d85b4c3f3ffc5caf7d7950c62d013c83ee42058c7453b2100d95817f167",
     "gen-ts/binding-classification-subject.ts": "sha256:c409a3fd7b942b50419632c51d9a79474fb30d6374bdc79c0e25c73618e800c3",
     "gen-ts/builder-input-proposal.ts": "sha256:b0108c3787873d3cf1a39f00967379418a6766275d3474cfa55f5a9d93ead174",
     "gen-ts/data-dependency.ts": "sha256:0572c31d7ae9088eccc104eee1a205bf176d1d6dacfaf0f290d666024e284966",
-    "gen-ts/data-grant-v2.ts": "sha256:d55491e8d1a73d8999a43904344760de9c6eb2ce500b1e942d49261a9c67808f",
+    "gen-ts/data-grant-v2.ts": "sha256:d7c78866dfbad6c852bdbf470057a7b926edcadf5563e6ea4da3da9ae96cf699",
     "gen-ts/data-grant.ts": "sha256:2358579d8aa1e57b01a6f2b0eacce5531e7f21ef226404c9809925365e0d6155",
     "gen-ts/data-source.ts": "sha256:77d6bb3b0eaa355789c5d97dd1f548734add6950329dc69549350b8d17c8d582",
     "gen-ts/deploy-request.ts": "sha256:0214faa8be6680f0bfc117d5ce67c1a59fcc18bd0ea4bc840e03e7d051fa9ab6",
@@ -158,21 +158,21 @@
     "gen-ts/integration-connect-result.ts": "sha256:4b10f169b6e1af364e9b418de21caa9fadbfb77b43cbff77d741cfae0b52180c",
     "gen-ts/integration-error-details.ts": "sha256:8243f5871f376d1cab4d90e07f3151d148fb03c704168dbccdfe6c9fe76bce83",
     "gen-ts/integration-execute-input-rules.ts": "sha256:a779c872c44bb892dec7b28173d961696d95e5b6e1fa14e2ba67dd78344cdc5b",
-    "gen-ts/integration-execute-request.ts": "sha256:06056ac8ca4a649560189ee78b40a9d5ad5ca5089d967e5708cbc082aa21ba95",
+    "gen-ts/integration-execute-request.ts": "sha256:b80260f8cca8da13692a6e0fa5de62b82c6eb48b0f3f3664f44f086441a519db",
     "gen-ts/integration-execute-result.ts": "sha256:4aaf6a9688f9dfdbc87a408556b62f822518acf5b76548076adb55393c0863b4",
     "gen-ts/kit-bundle-manifest.ts": "sha256:9041b32af3df781ca6800bc14c3719e5e54c81dff370633454ac3ad27432eb58",
     "gen-ts/kit-lock.ts": "sha256:de4ae82bac7bd234a3230ae671962e80eed6542d695a032a442673659dc6be5e",
     "gen-ts/kvs-routing-entry.ts": "sha256:d92e85ee9f257d77850d1d3aac9438e2055f38084ff84a48fcedae239d47d4ca",
     "gen-ts/promotion-request.ts": "sha256:9db88cef67f777a16bac628039ec3f582acb9e8cfff6fb592b30d0a0e55abc68",
     "gen-ts/promotion-response.ts": "sha256:f1c9cafac96faeb02a443a31786f67714e818f38d90108e7af41958396524d6f",
-    "gen-ts/saas-connection.ts": "sha256:62b5c5ffd125099bae46142013461c9ac3f75c2d27ab72cd4842a937f3e2f308",
+    "gen-ts/saas-connection.ts": "sha256:b60ab802c73edfe805d59d55a70ecd54fe569646d238f5ff213d26ab34b717f1",
     "gen-ts/sanitized-binding-digest-helper.ts": "sha256:c47d7fdc20500e2e72c23fe39ecdd610fc397c47fcba51335ebec3c380fe6872",
     "gen-ts/sanitized-binding-evidence.ts": "sha256:f3fb7b1d7d2e0929eb0ea981eaf32db3104010647185f6ae59f67167d42538a9",
     "gen-ts/secret-reference.ts": "sha256:731fbcde7315cb4128d5b01bdbe6e6f248f13c7ad8dea04a3a4e927ac4890198",
     "gen-ts/security-scan-input.ts": "sha256:b31f048be04c34b40f49d3b3ba53277e473cd435ae9216ba3a3b4dac69fb5685",
     "gen-ts/security-verdict.ts": "sha256:fea950cddbd12fe0218e2573c9a29c6748d56612a464559f1e6d688fa97f68c7",
     "gen-ts/transform-parked-result.ts": "sha256:6279e27cee8d75c29f3ede45580fef1daa0ca300867a78e43ead8a7689ec613f",
-    "gen-ts/transform-report.ts": "sha256:005a10b34b89f055c3aae4bf54c095bbca7a9e15bd9b406b61a9eaafffc37a61",
+    "gen-ts/transform-report.ts": "sha256:2f42c94644b0f4e2d03e339d0b9d333254555746f74d362d820522156e964ef9",
     "gen-ts/version-state-machine.ts": "sha256:c67af3e86ac306743345b850dfd3ae5201c19d10c40e2c149cf8c38258320d5f",
     "gen-ts/version-state.ts": "sha256:a835112930299e7b593a1b8810b7414f6c9e809da2092306c743128170a3b702",
     "gen-ts/well-defined-app-manifest.ts": "sha256:2b72a39c2fa8e76239634d0478dc0da05446e74e944950eacf999b78876455c6"

package/dist/gen-ts/app-integrations-declaration.d.ts

@@ -8,12 +8,16 @@ export type IntegrationAlias = string;
  * @maxItems 64
  */
 export type ResourceNames = IntegrationAlias[];
+/**
+ * Whose authority an operation runs under. Fixed per operation (slack.message.post: declared per app); never chosen at call time.
+ */
+export type IntegrationIdentityMode = 'app' | 'user';
 /**
  * A plain column identifier of a warehouse view.
  */
 export type ColumnName = string;
 /**
- * Committed `.harbour/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (five operations) and each operation carries a fixed identity mode: slack.channel.history=user, slack.message.post=app, gmail.thread.list=user, gmail.message.read=user, warehouse.view.read=app. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read. Gmail is read-only and user-mode only; its single resource is the fixed `inbox` alias. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind enums referenced by the other integration schemas.
+ * Committed `.harbour/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (six operations). Each operation carries a fixed identity mode — slack.channel.history=user, gmail.thread.list=user, gmail.message.read=user, gmail.message.send=user, warehouse.view.read=app — except slack.message.post, whose mode the app DECLARES: `app` posts as the company's Slack app (the one audited bot identity, under the IT-approved per-app display name when the connection declares `presentation`), `user` posts as the signed-in person after their own consent. The mode is never chosen at call time: governance runs the call under the approved grant of the declared mode. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads plus one send); its single resource is the fixed `inbox` alias. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.
  */
 export interface AppIntegrationsDeclaration {
     schema: 'harbour.app-integrations/2.0';
@@ -23,21 +27,38 @@ export interface AppIntegrationsDeclaration {
 }
 export interface DeclaredConnection {
     kind: IntegrationConnectionKind;
+    presentation?: IntegrationPresentation;
     operations: {
         'slack.channel.history'?: UserModeChannelOperation;
-        'slack.message.post'?: AppModeChannelOperation;
+        'slack.message.post'?: DeclaredModeChannelOperation;
         'gmail.thread.list'?: UserModeChannelOperation;
         'gmail.message.read'?: UserModeChannelOperation;
         'gmail.message.send'?: UserModeChannelOperation;
         'warehouse.view.read'?: AppModeViewOperation;
     };
 }
+/**
+ * saas connections only (Slack): how this app's app-mode posts are presented; meaningless for every other operation.
+ */
+export interface IntegrationPresentation {
+    /**
+     * 1..80 characters of plain text: not blank, no control characters, no @-mentions (`@name`, `<@id>`). Must not impersonate a person: IT sees it before approving.
+     */
+    displayName: string;
+    /**
+     * A Slack emoji shortcode such as `:sandwich:`; absent keeps the bot's own icon.
+     */
+    iconEmoji?: string;
+}
 export interface UserModeChannelOperation {
     identity: 'user';
     resources: ResourceNames;
 }
-export interface AppModeChannelOperation {
-    identity: 'app';
+/**
+ * slack.message.post: the app declares the mode — app (posts as the company's Slack app) or user (posts as the signed-in person).
+ */
+export interface DeclaredModeChannelOperation {
+    identity: IntegrationIdentityMode;
     resources: ResourceNames;
 }
 export interface AppModeViewOperation {

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.51.0.0";
-export declare const ContractPublishVersion: "0.51.0";
-export declare const ContractPublishTag: "v0.51.0";
-export declare const ContractSchemasDigest: "sha256:018bf3078087a18b07990772c94669f658159bc84b0c8accedc7dd5daa38bee5";
+export declare const ContractRepositoryVersion: "0.53.0.0";
+export declare const ContractPublishVersion: "0.53.0";
+export declare const ContractPublishTag: "v0.53.0";
+export declare const ContractSchemasDigest: "sha256:c4d7c9642842bf3709003f447fb22429ce3573acabaa2da8279e0fc399e8d237";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:98bb6999738be926c36fd8d0735a17defdad590ced57e94bc431bb9bba53c9ad";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:1d83b04e4899777f2963177e39e7ac99852cae80ffb8c03b6a294f5fb19d3600";
+export declare const ContractGeneratedGoDigest: "sha256:8f3c3281a76792a9480ca1f7bcbad820db1908efffb29072fcdb0a8f99dbd208";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:82a083862e500a06df3550e694221cff9dcb98461d5174889c374713f961040c";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.51.0.0";
-export const ContractPublishVersion = "0.51.0";
-export const ContractPublishTag = "v0.51.0";
-export const ContractSchemasDigest = "sha256:018bf3078087a18b07990772c94669f658159bc84b0c8accedc7dd5daa38bee5";
+export const ContractRepositoryVersion = "0.53.0.0";
+export const ContractPublishVersion = "0.53.0";
+export const ContractPublishTag = "v0.53.0";
+export const ContractSchemasDigest = "sha256:c4d7c9642842bf3709003f447fb22429ce3573acabaa2da8279e0fc399e8d237";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:98bb6999738be926c36fd8d0735a17defdad590ced57e94bc431bb9bba53c9ad";
-export const ContractGeneratedTypeScriptDigest = "sha256:1d83b04e4899777f2963177e39e7ac99852cae80ffb8c03b6a294f5fb19d3600";
+export const ContractGeneratedGoDigest = "sha256:8f3c3281a76792a9480ca1f7bcbad820db1908efffb29072fcdb0a8f99dbd208";
+export const ContractGeneratedTypeScriptDigest = "sha256:82a083862e500a06df3550e694221cff9dcb98461d5174889c374713f961040c";

package/dist/gen-ts/data-grant-v2.d.ts

@@ -8,7 +8,7 @@ export type DataGrantV2Status = 'REQUESTED' | 'GRANTED' | 'DENIED' | 'REVOKED';
 export type DataGrantV2ProvisioningStatus = 'NONE' | 'PENDING' | 'FAILED' | 'DONE';
 export type DataGrantV2CleanupStatus = 'PENDING' | 'FAILED' | 'DONE';
 /**
- * An app's integration grant for one connection, environment and identity mode (control table sk APP#<appId>#IGRANT#<environment>#<sourceId>#<mode>; grantId = base64url(JSON ["v2",appId,environment,sourceId,mode])). Additive to the legacy DataGrant (data-grant.schema.json), which is never consulted by v2 paths. A fresh REQUESTED record carries empty `operations`/`resources` until the attached request is approved; approved resources are structured `{name, columns?}` entries (a Slack channel alias, the fixed Gmail `inbox` alias, or a warehouse view alias with its approved columns). Expiry is enforced from UTC time on every call and SDK calls never extend it; `expiredAt` is stamped by the recovery sweep afterwards. Status edges live in x-transitions; DENIED and REVOKED are terminal (a regrant after revocation is a new REQUESTED record once cleanup is DONE). Database grants add credentialRef/mintedPrincipal; both hold references only. `identityMode` and `installation` are the deprecated 0.45.0 spellings: the record carries `mode`, and a SaaS grant runs on the connection's single installation.
+ * An app's integration grant for one connection, environment and identity mode (control table sk APP#<appId>#IGRANT#<environment>#<sourceId>#<mode>; grantId = base64url(JSON ["v2",appId,environment,sourceId,mode])). Additive to the legacy DataGrant (data-grant.schema.json), which is never consulted by v2 paths. A fresh REQUESTED record carries empty `operations`/`resources` until the attached request is approved; approved resources are structured `{name, columns?}` entries (a Slack channel alias, the fixed Gmail `inbox` alias, or a warehouse view alias with its approved columns). Expiry is enforced from UTC time on every call and SDK calls never extend it; `expiredAt` is stamped by the recovery sweep afterwards. Status edges live in x-transitions; DENIED and REVOKED are terminal (a regrant after revocation is a new REQUESTED record once cleanup is DONE). Database grants add credentialRef/mintedPrincipal; both hold references only. An app-mode Slack grant may carry `presentation` (0.53.0): the IT-approved display name and icon the app's posts go out under, copied from the approved request and read by every post — never from the call. `identityMode` and `installation` are the deprecated 0.45.0 spellings: the record carries `mode`, and a SaaS grant runs on the connection's single installation.
  */
 export interface DataGrantV2 {
     schema: 'harbour.data-grant/2.0';
@@ -23,7 +23,7 @@ export interface DataGrantV2 {
      */
     sourceId: string;
     /**
-     * Whose authority an operation runs under. Fixed per operation; callers never choose it.
+     * Whose authority an operation runs under. Fixed per operation (slack.message.post: declared per app); never chosen at call time.
      */
     mode: 'app' | 'user';
     kind: 'saas' | 'database';
@@ -58,6 +58,7 @@ export interface DataGrantV2 {
      * The one open access request attached to this grant, if any.
      */
     pendingRequestId?: string;
+    presentation?: IntegrationPresentation;
     provisioning: DataGrantV2Provisioning;
     /**
      * Database grants: secretref://tenant/{t}/app/{a}/env/{env}/source/{s}. Set only by a successful publish and removed by cleanup.
@@ -71,7 +72,7 @@ export interface DataGrantV2 {
     updatedAt: string;
     /**
      * @deprecated
-     * Whose authority an operation runs under. Fixed per operation; callers never choose it.
+     * Whose authority an operation runs under. Fixed per operation (slack.message.post: declared per app); never chosen at call time.
      */
     identityMode?: 'app' | 'user';
     /**
@@ -96,6 +97,19 @@ export interface IntegrationResource {
      */
     columns?: string[];
 }
+/**
+ * App-mode Slack grants only: how the app's posts are presented, as IT approved it. Absent means the posts carry the bot's own name.
+ */
+interface IntegrationPresentation {
+    /**
+     * 1..80 characters of plain text: not blank, no control characters, no @-mentions (`@name`, `<@id>`). Must not impersonate a person: IT sees it before approving.
+     */
+    displayName: string;
+    /**
+     * A Slack emoji shortcode such as `:sandwich:`; absent keeps the bot's own icon.
+     */
+    iconEmoji?: string;
+}
 export interface DataGrantV2Provisioning {
     status: DataGrantV2ProvisioningStatus;
     /**
@@ -126,3 +140,4 @@ export interface DataGrantV2Provisioning {
 export declare function canTransitionDataGrantV2Status(from: string, to: string): boolean;
 /** True iff the DataGrantV2Status is terminal (DENIED, REVOKED). */
 export declare function isTerminalDataGrantV2Status(state: string): boolean;
+export {};

package/dist/gen-ts/integration-execute-request.d.ts

@@ -1,5 +1,5 @@
 /**
- * Body of POST /_harbour/integrations/execute (app SDK), forwarded unchanged to the governance development and runtime execute routes. Exactly one declared operation against one declared resource. The identity mode is NOT a caller field: it is fixed by the operation and enforced from the approved grant; any identity/userId/scope field is rejected by additionalProperties. Per-operation input bounds: slack.channel.history {limit? 1..15, default 15}; slack.message.post {text 1..4000 chars} and a required idempotencyKey retained across retries of one explicit Send; gmail.thread.list {limit? 1..15, default 15}; gmail.message.read {messageId}; gmail.message.send {to 1..50 addresses (to+cc+bcc <= 50 in total), cc?, bcc?, subject 1..256 chars, text 1..4000 chars, replyToMessageId?} and a required idempotencyKey like slack.message.post (plain text only, no attachments); warehouse.view.read {columns 1..32, limit? 1..1000, default 100}. Each operation's then-block is the one statement of its input rules: propertyNames.enum names the fields it accepts, required the ones it needs, and per-field overrides (maximum, default) narrow the shared property. Codegen derives IntegrationExecuteInputRules and validateIntegrationExecuteInput (gen-ts/integration-execute-input-rules.ts, gen-go/integration_execute_input_rules.go) from exactly these blocks, so the governance execute route, the app SDK and the kit's local check refuse the same request with the same message. Transport limits (not expressible here): request <= 16 KiB, total deadline 10 s.
+ * Body of POST /_harbour/integrations/execute (app SDK), forwarded unchanged to the governance development and runtime execute routes. Exactly one declared operation against one declared resource. The identity mode is NOT a caller field: it is fixed by the operation (declared per app for slack.message.post) and enforced from the approved grant; any identity/userId/scope field is rejected by additionalProperties. A slack.message.post runs as the app (the IT-approved per-app name from the grant, plus a "Posted by <app> on Harbour" footer) or as the signed-in person (no name, no footer), whichever mode the app declared and IT approved — the same input either way. Per-operation input bounds: slack.channel.history {limit? 1..15, default 15}; slack.message.post {text 1..4000 chars} and a required idempotencyKey retained across retries of one explicit Send; gmail.thread.list {limit? 1..15, default 15}; gmail.message.read {messageId}; gmail.message.send {to 1..50 addresses (to+cc+bcc <= 50 in total), cc?, bcc?, subject 1..256 chars, text 1..4000 chars, replyToMessageId?} and a required idempotencyKey like slack.message.post (plain text only, no attachments); warehouse.view.read {columns 1..32, limit? 1..1000, default 100}. Each operation's then-block is the one statement of its input rules: propertyNames.enum names the fields it accepts, required the ones it needs, and per-field overrides (maximum, default) narrow the shared property. Codegen derives IntegrationExecuteInputRules and validateIntegrationExecuteInput (gen-ts/integration-execute-input-rules.ts, gen-go/integration_execute_input_rules.go) from exactly these blocks, so the governance execute route, the app SDK and the kit's local check refuse the same request with the same message. Transport limits (not expressible here): request <= 16 KiB, total deadline 10 s.
  */
 export type IntegrationExecuteRequest = {
     /**
@@ -7,7 +7,7 @@ export type IntegrationExecuteRequest = {
      */
     connection: string;
     /**
-     * Closed operation set. Extending it is a contracts change. gmail.message.send (0.50.0) sends one plain-text email as the signed-in person: a send like slack.message.post (explicit Send, idempotencyKey, write receipt) under user identity.
+     * Closed operation set. Extending it is a contracts change. gmail.message.send (0.50.0) sends one plain-text email as the signed-in person: a send like slack.message.post (explicit Send, idempotencyKey, write receipt) under user identity. slack.message.post (0.53.0) runs in the mode the app declares: app (the company's Slack app, under the IT-approved per-app name) or user (the signed-in person, after their consent).
      */
     operation: 'slack.channel.history' | 'slack.message.post' | 'gmail.thread.list' | 'gmail.message.read' | 'gmail.message.send' | 'warehouse.view.read';
     /**

package/dist/gen-ts/saas-connection.d.ts

@@ -93,6 +93,12 @@ export interface SaasInstallation {
     botUserId: string;
     status: SaasInstallationStatus;
     installedAt: string;
+    /**
+     * The bot scopes Slack granted at installation (0.53.0). Absent on installations recorded before it, which therefore lack chat:write.customize: per-app display names need a reinstall.
+     *
+     * @maxItems 64
+     */
+    scopes?: string[];
 }
 export interface DevelopmentPreapproval {
     /**

package/dist/gen-ts/transform-report.d.ts

@@ -1,5 +1,5 @@
 /**
- * Structured output an agent must return from one Harbour transformation attempt. Handed to the agent as its output schema, then decoded and semantically re-validated by the control plane, which remains the authority. The enum on applied_playbooks.items is the one dynamic part: the adapter injects the names of the playbooks supplied for that invocation before writing the document, so the model is structurally prevented from naming a playbook it was not given. Application-secret handling was removed platform-wide, so this document carries no redactions and no secrets fields. A deployable report must also carry preservation_plan: the agent's own grounded smoke tests (one to three happy_path user journeys plus a boundary_check per behaviour its playbooks or edits could regress) that the validation cell executes after transformation, and an uncovered list naming every boundary it could not test and why. It also carries validation_fixtures: null when no external fixture is needed, or a bounded generic HTTP/WebSocket fixture declaration for that one run. An unsupported report carries only application.unsupported and no plan or fixtures.
+ * Structured output an agent must return from one Harbour transformation attempt. Handed to the agent as its output schema, then decoded and semantically re-validated by the control plane, which remains the authority. The enum on applied_playbooks.items is the one dynamic part: the adapter injects the names of the playbooks supplied for that invocation before writing the document, so the model is structurally prevented from naming a playbook it was not given. Application-secret handling was removed platform-wide, so this document carries no redactions and no secrets fields. A deployable report must also carry preservation_plan: the agent's own grounded smoke tests (one to three happy_path user journeys plus a boundary_check per behaviour its playbooks or edits could regress) that the validation cell executes after transformation, and an uncovered list naming every boundary it could not test and why. It may also carry validation_fixtures: null when no external fixture is needed, or a bounded generic HTTP/WebSocket fixture declaration for that one run; the deployment plane reads the workspace fixture sidecar, so the report's copy is optional. An unsupported report carries only application.unsupported and no plan or fixtures.
  */
 export type TransformReport = {
     /**
@@ -8,23 +8,33 @@ export type TransformReport = {
      * @minItems 1
      */
     applied_playbooks?: string[];
+    /**
+     * Optional. The deployed value is a platform constant supplied to the build, not a report field, so a deployable report may omit it and one that still carries it stays valid.
+     */
     static_rebuild_required?: boolean;
     analysis?: {
         deployable: boolean;
-        needsTransformation: boolean;
+        /**
+         * Whether the attempt changed the tree. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+         */
+        needsTransformation?: boolean;
         /**
          * @maxItems 64
          */
         blockers: string[];
         /**
+         * Paths the attempt touched. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+         *
          * @minItems 1
          * @maxItems 1024
          */
-        surfaces: string[];
+        surfaces?: string[];
         /**
+         * Optional file-and-line citations for why the transformation was needed. Nothing downstream reads them, so a deployable report may omit them and one that still carries them stays valid.
+         *
          * @maxItems 1024
          */
-        evidence: {
+        evidence?: {
             path: string;
             line: number;
             reason: string;
@@ -32,29 +42,46 @@ export type TransformReport = {
     };
     database?: {
         mode: 'none' | 'sql';
-        changeType: 'none' | 'code_only' | 'schema_only' | 'code_and_schema';
-        requiresCodeChanges: boolean;
-        requiresSchemaMigration: boolean;
         /**
+         * Classification of the changed paths. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+         */
+        changeType?: 'none' | 'code_only' | 'schema_only' | 'code_and_schema';
+        /**
+         * Whether any changed path sits outside the database boundary. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+         */
+        requiresCodeChanges?: boolean;
+        /**
+         * Whether the Aurora bundle grew past its seeded prefix. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+         */
+        requiresSchemaMigration?: boolean;
+        /**
+         * Migration files in the Aurora bundle. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+         *
          * @maxItems 128
          */
-        migrationPaths: string[];
+        migrationPaths?: string[];
         /**
+         * Changed paths on the database boundary. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+         *
          * @maxItems 512
          */
-        changedFiles: string[];
+        changedFiles?: string[];
         /**
+         * Optional file-and-line citations for the database findings. Nothing downstream reads them, so a deployable report may omit them and one that still carries them stays valid.
+         *
          * @maxItems 128
          */
-        evidence: {
+        evidence?: {
             path: string;
             line: number;
             reason: string;
         }[];
         /**
+         * Optional. The platform's only structural decline is application.unsupported; nothing reads this list, so a deployable report may omit it and one that still carries it stays valid.
+         *
          * @maxItems 64
          */
-        unsupportedFeatures: string[];
+        unsupportedFeatures?: string[];
     };
     /**
      * Agent-authored preservation (smoke) plan for this attempt. Required whenever the report is deployable; forbidden on an unsupported report. Every test must be grounded in files the agent actually read or changed (evidence) and expressed as tenant-relative browser or HTTP steps the validation cell can execute without secrets. Structural bounds live here; per-action required fields, at least one assert* step per test, one to three happy_path tests, unique ids, the {{runId}} substitution and path safety are enforced semantically by the deployment plane.
@@ -72,12 +99,12 @@ export type TransformReport = {
             kind: 'happy_path' | 'boundary_check';
             name: string;
             /**
-             * Transformation boundaries this test claims to cover.
+             * Transformation boundaries this test claims to cover. Optional: Harbour derives them from the test's own evidence paths, so a deployable report may omit them and one that still carries them stays valid.
              *
              * @minItems 1
              * @maxItems 8
              */
-            boundaries: ('application' | 'routing' | 'database' | 'authentication' | 'runtime_dependency' | 'files' | 'provider' | 'background_work')[];
+            boundaries?: ('application' | 'routing' | 'database' | 'authentication' | 'runtime_dependency' | 'files' | 'provider' | 'background_work')[];
             /**
              * Files (and optionally lines) in the transformed workspace that ground this test. Paths must exist after transformation.
              *
@@ -147,7 +174,10 @@ export type TransformReport = {
          * @maxItems 8
          */
         uncovered: {
-            boundary: 'application' | 'routing' | 'database' | 'authentication' | 'runtime_dependency' | 'files' | 'provider' | 'background_work';
+            /**
+             * Optional: Harbour derives the uncovered boundaries from the changed paths and the covered set, so a deployable report may omit this and one that still carries it stays valid.
+             */
+            boundary?: 'application' | 'routing' | 'database' | 'authentication' | 'runtime_dependency' | 'files' | 'provider' | 'background_work';
             reason: 'not-observable-in-validation-cell' | 'no-safe-fixture' | 'no-grounded-surface';
             detail?: string;
         }[];
@@ -224,7 +254,13 @@ export type TransformReport = {
             kind: 'sql';
             path: string;
         } | null;
+        /**
+         * Optional: determined by topology (static topology iff static build), so a deployable report may omit it and one that still carries it stays valid.
+         */
         buildKind?: 'container' | 'static';
+        /**
+         * Optional: determined by the build output kinds, so a deployable report may omit it and one that still carries it stays valid.
+         */
         topology?: 'static' | 'backend' | 'frontend_and_backend';
         entrypoint?: string;
         build?: {
@@ -248,6 +284,9 @@ export type TransformReport = {
                 route: string;
             }[];
         };
+        /**
+         * Optional: both members are platform constants, so a deployable report may omit this object and one that still carries it stays valid.
+         */
         basePath?: {
             required: boolean;
             environmentVariable: 'HARBOUR_BASE_PATH';
@@ -262,6 +301,8 @@ export type TransformReport = {
             reason: string;
         }[];
         /**
+         * Optional: a deployable plan requires this empty, so a deployable report may omit it and one that still carries it (empty) stays valid.
+         *
          * @maxItems 64
          */
         unsupportedFeatures?: string[];

package/gen-ts/app-integrations-declaration.ts

@@ -11,13 +11,17 @@ export type IntegrationAlias = string;
  * @maxItems 64
  */
 export type ResourceNames = IntegrationAlias[];
+/**
+ * Whose authority an operation runs under. Fixed per operation (slack.message.post: declared per app); never chosen at call time.
+ */
+export type IntegrationIdentityMode = 'app' | 'user';
 /**
  * A plain column identifier of a warehouse view.
  */
 export type ColumnName = string;
 
 /**
- * Committed `.harbour/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (five operations) and each operation carries a fixed identity mode: slack.channel.history=user, slack.message.post=app, gmail.thread.list=user, gmail.message.read=user, warehouse.view.read=app. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read. Gmail is read-only and user-mode only; its single resource is the fixed `inbox` alias. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind enums referenced by the other integration schemas.
+ * Committed `.harbour/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (six operations). Each operation carries a fixed identity mode — slack.channel.history=user, gmail.thread.list=user, gmail.message.read=user, gmail.message.send=user, warehouse.view.read=app — except slack.message.post, whose mode the app DECLARES: `app` posts as the company's Slack app (the one audited bot identity, under the IT-approved per-app display name when the connection declares `presentation`), `user` posts as the signed-in person after their own consent. The mode is never chosen at call time: governance runs the call under the approved grant of the declared mode. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads plus one send); its single resource is the fixed `inbox` alias. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.
  */
 export interface AppIntegrationsDeclaration {
   schema: 'harbour.app-integrations/2.0';
@@ -27,21 +31,38 @@ export interface AppIntegrationsDeclaration {
 }
 export interface DeclaredConnection {
   kind: IntegrationConnectionKind;
+  presentation?: IntegrationPresentation;
   operations: {
     'slack.channel.history'?: UserModeChannelOperation;
-    'slack.message.post'?: AppModeChannelOperation;
+    'slack.message.post'?: DeclaredModeChannelOperation;
     'gmail.thread.list'?: UserModeChannelOperation;
     'gmail.message.read'?: UserModeChannelOperation;
     'gmail.message.send'?: UserModeChannelOperation;
     'warehouse.view.read'?: AppModeViewOperation;
   };
 }
+/**
+ * saas connections only (Slack): how this app's app-mode posts are presented; meaningless for every other operation.
+ */
+export interface IntegrationPresentation {
+  /**
+   * 1..80 characters of plain text: not blank, no control characters, no @-mentions (`@name`, `<@id>`). Must not impersonate a person: IT sees it before approving.
+   */
+  displayName: string;
+  /**
+   * A Slack emoji shortcode such as `:sandwich:`; absent keeps the bot's own icon.
+   */
+  iconEmoji?: string;
+}
 export interface UserModeChannelOperation {
   identity: 'user';
   resources: ResourceNames;
 }
-export interface AppModeChannelOperation {
-  identity: 'app';
+/**
+ * slack.message.post: the app declares the mode — app (posts as the company's Slack app) or user (posts as the signed-in person).
+ */
+export interface DeclaredModeChannelOperation {
+  identity: IntegrationIdentityMode;
   resources: ResourceNames;
 }
 export interface AppModeViewOperation {

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.51.0.0" as const;
-export const ContractPublishVersion = "0.51.0" as const;
-export const ContractPublishTag = "v0.51.0" as const;
-export const ContractSchemasDigest = "sha256:018bf3078087a18b07990772c94669f658159bc84b0c8accedc7dd5daa38bee5" as const;
+export const ContractRepositoryVersion = "0.53.0.0" as const;
+export const ContractPublishVersion = "0.53.0" as const;
+export const ContractPublishTag = "v0.53.0" as const;
+export const ContractSchemasDigest = "sha256:c4d7c9642842bf3709003f447fb22429ce3573acabaa2da8279e0fc399e8d237" as const;
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
-export const ContractGeneratedGoDigest = "sha256:98bb6999738be926c36fd8d0735a17defdad590ced57e94bc431bb9bba53c9ad" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:1d83b04e4899777f2963177e39e7ac99852cae80ffb8c03b6a294f5fb19d3600" as const;
+export const ContractGeneratedGoDigest = "sha256:8f3c3281a76792a9480ca1f7bcbad820db1908efffb29072fcdb0a8f99dbd208" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:82a083862e500a06df3550e694221cff9dcb98461d5174889c374713f961040c" as const;

package/gen-ts/data-grant-v2.ts

@@ -12,7 +12,7 @@ export type DataGrantV2ProvisioningStatus = 'NONE' | 'PENDING' | 'FAILED' | 'DON
 export type DataGrantV2CleanupStatus = 'PENDING' | 'FAILED' | 'DONE';
 
 /**
- * An app's integration grant for one connection, environment and identity mode (control table sk APP#<appId>#IGRANT#<environment>#<sourceId>#<mode>; grantId = base64url(JSON ["v2",appId,environment,sourceId,mode])). Additive to the legacy DataGrant (data-grant.schema.json), which is never consulted by v2 paths. A fresh REQUESTED record carries empty `operations`/`resources` until the attached request is approved; approved resources are structured `{name, columns?}` entries (a Slack channel alias, the fixed Gmail `inbox` alias, or a warehouse view alias with its approved columns). Expiry is enforced from UTC time on every call and SDK calls never extend it; `expiredAt` is stamped by the recovery sweep afterwards. Status edges live in x-transitions; DENIED and REVOKED are terminal (a regrant after revocation is a new REQUESTED record once cleanup is DONE). Database grants add credentialRef/mintedPrincipal; both hold references only. `identityMode` and `installation` are the deprecated 0.45.0 spellings: the record carries `mode`, and a SaaS grant runs on the connection's single installation.
+ * An app's integration grant for one connection, environment and identity mode (control table sk APP#<appId>#IGRANT#<environment>#<sourceId>#<mode>; grantId = base64url(JSON ["v2",appId,environment,sourceId,mode])). Additive to the legacy DataGrant (data-grant.schema.json), which is never consulted by v2 paths. A fresh REQUESTED record carries empty `operations`/`resources` until the attached request is approved; approved resources are structured `{name, columns?}` entries (a Slack channel alias, the fixed Gmail `inbox` alias, or a warehouse view alias with its approved columns). Expiry is enforced from UTC time on every call and SDK calls never extend it; `expiredAt` is stamped by the recovery sweep afterwards. Status edges live in x-transitions; DENIED and REVOKED are terminal (a regrant after revocation is a new REQUESTED record once cleanup is DONE). Database grants add credentialRef/mintedPrincipal; both hold references only. An app-mode Slack grant may carry `presentation` (0.53.0): the IT-approved display name and icon the app's posts go out under, copied from the approved request and read by every post — never from the call. `identityMode` and `installation` are the deprecated 0.45.0 spellings: the record carries `mode`, and a SaaS grant runs on the connection's single installation.
  */
 export interface DataGrantV2 {
   schema: 'harbour.data-grant/2.0';
@@ -27,7 +27,7 @@ export interface DataGrantV2 {
    */
   sourceId: string;
   /**
-   * Whose authority an operation runs under. Fixed per operation; callers never choose it.
+   * Whose authority an operation runs under. Fixed per operation (slack.message.post: declared per app); never chosen at call time.
    */
   mode: 'app' | 'user';
   kind: 'saas' | 'database';
@@ -69,6 +69,7 @@ export interface DataGrantV2 {
    * The one open access request attached to this grant, if any.
    */
   pendingRequestId?: string;
+  presentation?: IntegrationPresentation;
   provisioning: DataGrantV2Provisioning;
   /**
    * Database grants: secretref://tenant/{t}/app/{a}/env/{env}/source/{s}. Set only by a successful publish and removed by cleanup.
@@ -82,7 +83,7 @@ export interface DataGrantV2 {
   updatedAt: string;
   /**
    * @deprecated
-   * Whose authority an operation runs under. Fixed per operation; callers never choose it.
+   * Whose authority an operation runs under. Fixed per operation (slack.message.post: declared per app); never chosen at call time.
    */
   identityMode?: 'app' | 'user';
   /**
@@ -107,6 +108,19 @@ export interface IntegrationResource {
    */
   columns?: string[];
 }
+/**
+ * App-mode Slack grants only: how the app's posts are presented, as IT approved it. Absent means the posts carry the bot's own name.
+ */
+interface IntegrationPresentation {
+  /**
+   * 1..80 characters of plain text: not blank, no control characters, no @-mentions (`@name`, `<@id>`). Must not impersonate a person: IT sees it before approving.
+   */
+  displayName: string;
+  /**
+   * A Slack emoji shortcode such as `:sandwich:`; absent keeps the bot's own icon.
+   */
+  iconEmoji?: string;
+}
 export interface DataGrantV2Provisioning {
   status: DataGrantV2ProvisioningStatus;
   /**

package/gen-ts/integration-execute-request.ts

@@ -2,7 +2,7 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Body of POST /_harbour/integrations/execute (app SDK), forwarded unchanged to the governance development and runtime execute routes. Exactly one declared operation against one declared resource. The identity mode is NOT a caller field: it is fixed by the operation and enforced from the approved grant; any identity/userId/scope field is rejected by additionalProperties. Per-operation input bounds: slack.channel.history {limit? 1..15, default 15}; slack.message.post {text 1..4000 chars} and a required idempotencyKey retained across retries of one explicit Send; gmail.thread.list {limit? 1..15, default 15}; gmail.message.read {messageId}; gmail.message.send {to 1..50 addresses (to+cc+bcc <= 50 in total), cc?, bcc?, subject 1..256 chars, text 1..4000 chars, replyToMessageId?} and a required idempotencyKey like slack.message.post (plain text only, no attachments); warehouse.view.read {columns 1..32, limit? 1..1000, default 100}. Each operation's then-block is the one statement of its input rules: propertyNames.enum names the fields it accepts, required the ones it needs, and per-field overrides (maximum, default) narrow the shared property. Codegen derives IntegrationExecuteInputRules and validateIntegrationExecuteInput (gen-ts/integration-execute-input-rules.ts, gen-go/integration_execute_input_rules.go) from exactly these blocks, so the governance execute route, the app SDK and the kit's local check refuse the same request with the same message. Transport limits (not expressible here): request <= 16 KiB, total deadline 10 s.
+ * Body of POST /_harbour/integrations/execute (app SDK), forwarded unchanged to the governance development and runtime execute routes. Exactly one declared operation against one declared resource. The identity mode is NOT a caller field: it is fixed by the operation (declared per app for slack.message.post) and enforced from the approved grant; any identity/userId/scope field is rejected by additionalProperties. A slack.message.post runs as the app (the IT-approved per-app name from the grant, plus a "Posted by <app> on Harbour" footer) or as the signed-in person (no name, no footer), whichever mode the app declared and IT approved — the same input either way. Per-operation input bounds: slack.channel.history {limit? 1..15, default 15}; slack.message.post {text 1..4000 chars} and a required idempotencyKey retained across retries of one explicit Send; gmail.thread.list {limit? 1..15, default 15}; gmail.message.read {messageId}; gmail.message.send {to 1..50 addresses (to+cc+bcc <= 50 in total), cc?, bcc?, subject 1..256 chars, text 1..4000 chars, replyToMessageId?} and a required idempotencyKey like slack.message.post (plain text only, no attachments); warehouse.view.read {columns 1..32, limit? 1..1000, default 100}. Each operation's then-block is the one statement of its input rules: propertyNames.enum names the fields it accepts, required the ones it needs, and per-field overrides (maximum, default) narrow the shared property. Codegen derives IntegrationExecuteInputRules and validateIntegrationExecuteInput (gen-ts/integration-execute-input-rules.ts, gen-go/integration_execute_input_rules.go) from exactly these blocks, so the governance execute route, the app SDK and the kit's local check refuse the same request with the same message. Transport limits (not expressible here): request <= 16 KiB, total deadline 10 s.
  */
 export type IntegrationExecuteRequest = {
   /**
@@ -10,7 +10,7 @@ export type IntegrationExecuteRequest = {
    */
   connection: string;
   /**
-   * Closed operation set. Extending it is a contracts change. gmail.message.send (0.50.0) sends one plain-text email as the signed-in person: a send like slack.message.post (explicit Send, idempotencyKey, write receipt) under user identity.
+   * Closed operation set. Extending it is a contracts change. gmail.message.send (0.50.0) sends one plain-text email as the signed-in person: a send like slack.message.post (explicit Send, idempotencyKey, write receipt) under user identity. slack.message.post (0.53.0) runs in the mode the app declares: app (the company's Slack app, under the IT-approved per-app name) or user (the signed-in person, after their consent).
    */
   operation:
     | 'slack.channel.history'

package/gen-ts/saas-connection.ts

@@ -104,6 +104,12 @@ export interface SaasInstallation {
   botUserId: string;
   status: SaasInstallationStatus;
   installedAt: string;
+  /**
+   * The bot scopes Slack granted at installation (0.53.0). Absent on installations recorded before it, which therefore lack chat:write.customize: per-app display names need a reinstall.
+   *
+   * @maxItems 64
+   */
+  scopes?: string[];
 }
 export interface DevelopmentPreapproval {
   /**

package/gen-ts/transform-report.ts

@@ -2,7 +2,7 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Structured output an agent must return from one Harbour transformation attempt. Handed to the agent as its output schema, then decoded and semantically re-validated by the control plane, which remains the authority. The enum on applied_playbooks.items is the one dynamic part: the adapter injects the names of the playbooks supplied for that invocation before writing the document, so the model is structurally prevented from naming a playbook it was not given. Application-secret handling was removed platform-wide, so this document carries no redactions and no secrets fields. A deployable report must also carry preservation_plan: the agent's own grounded smoke tests (one to three happy_path user journeys plus a boundary_check per behaviour its playbooks or edits could regress) that the validation cell executes after transformation, and an uncovered list naming every boundary it could not test and why. It also carries validation_fixtures: null when no external fixture is needed, or a bounded generic HTTP/WebSocket fixture declaration for that one run. An unsupported report carries only application.unsupported and no plan or fixtures.
+ * Structured output an agent must return from one Harbour transformation attempt. Handed to the agent as its output schema, then decoded and semantically re-validated by the control plane, which remains the authority. The enum on applied_playbooks.items is the one dynamic part: the adapter injects the names of the playbooks supplied for that invocation before writing the document, so the model is structurally prevented from naming a playbook it was not given. Application-secret handling was removed platform-wide, so this document carries no redactions and no secrets fields. A deployable report must also carry preservation_plan: the agent's own grounded smoke tests (one to three happy_path user journeys plus a boundary_check per behaviour its playbooks or edits could regress) that the validation cell executes after transformation, and an uncovered list naming every boundary it could not test and why. It may also carry validation_fixtures: null when no external fixture is needed, or a bounded generic HTTP/WebSocket fixture declaration for that one run; the deployment plane reads the workspace fixture sidecar, so the report's copy is optional. An unsupported report carries only application.unsupported and no plan or fixtures.
  */
 export type TransformReport = {
   /**
@@ -11,23 +11,33 @@ export type TransformReport = {
    * @minItems 1
    */
   applied_playbooks?: string[];
+  /**
+   * Optional. The deployed value is a platform constant supplied to the build, not a report field, so a deployable report may omit it and one that still carries it stays valid.
+   */
   static_rebuild_required?: boolean;
   analysis?: {
     deployable: boolean;
-    needsTransformation: boolean;
+    /**
+     * Whether the attempt changed the tree. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+     */
+    needsTransformation?: boolean;
     /**
      * @maxItems 64
      */
     blockers: string[];
     /**
+     * Paths the attempt touched. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+     *
      * @minItems 1
      * @maxItems 1024
      */
-    surfaces: string[];
+    surfaces?: string[];
     /**
+     * Optional file-and-line citations for why the transformation was needed. Nothing downstream reads them, so a deployable report may omit them and one that still carries them stays valid.
+     *
      * @maxItems 1024
      */
-    evidence: {
+    evidence?: {
       path: string;
       line: number;
       reason: string;
@@ -35,29 +45,46 @@ export type TransformReport = {
   };
   database?: {
     mode: 'none' | 'sql';
-    changeType: 'none' | 'code_only' | 'schema_only' | 'code_and_schema';
-    requiresCodeChanges: boolean;
-    requiresSchemaMigration: boolean;
     /**
+     * Classification of the changed paths. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+     */
+    changeType?: 'none' | 'code_only' | 'schema_only' | 'code_and_schema';
+    /**
+     * Whether any changed path sits outside the database boundary. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+     */
+    requiresCodeChanges?: boolean;
+    /**
+     * Whether the Aurora bundle grew past its seeded prefix. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+     */
+    requiresSchemaMigration?: boolean;
+    /**
+     * Migration files in the Aurora bundle. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+     *
      * @maxItems 128
      */
-    migrationPaths: string[];
+    migrationPaths?: string[];
     /**
+     * Changed paths on the database boundary. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.
+     *
      * @maxItems 512
      */
-    changedFiles: string[];
+    changedFiles?: string[];
     /**
+     * Optional file-and-line citations for the database findings. Nothing downstream reads them, so a deployable report may omit them and one that still carries them stays valid.
+     *
      * @maxItems 128
      */
-    evidence: {
+    evidence?: {
       path: string;
       line: number;
       reason: string;
     }[];
     /**
+     * Optional. The platform's only structural decline is application.unsupported; nothing reads this list, so a deployable report may omit it and one that still carries it stays valid.
+     *
      * @maxItems 64
      */
-    unsupportedFeatures: string[];
+    unsupportedFeatures?: string[];
   };
   /**
    * Agent-authored preservation (smoke) plan for this attempt. Required whenever the report is deployable; forbidden on an unsupported report. Every test must be grounded in files the agent actually read or changed (evidence) and expressed as tenant-relative browser or HTTP steps the validation cell can execute without secrets. Structural bounds live here; per-action required fields, at least one assert* step per test, one to three happy_path tests, unique ids, the {{runId}} substitution and path safety are enforced semantically by the deployment plane.
@@ -75,12 +102,12 @@ export type TransformReport = {
       kind: 'happy_path' | 'boundary_check';
       name: string;
       /**
-       * Transformation boundaries this test claims to cover.
+       * Transformation boundaries this test claims to cover. Optional: Harbour derives them from the test's own evidence paths, so a deployable report may omit them and one that still carries them stays valid.
        *
        * @minItems 1
        * @maxItems 8
        */
-      boundaries: (
+      boundaries?: (
         | 'application'
         | 'routing'
         | 'database'
@@ -159,7 +186,10 @@ export type TransformReport = {
      * @maxItems 8
      */
     uncovered: {
-      boundary:
+      /**
+       * Optional: Harbour derives the uncovered boundaries from the changed paths and the covered set, so a deployable report may omit this and one that still carries it stays valid.
+       */
+      boundary?:
         | 'application'
         | 'routing'
         | 'database'
@@ -247,7 +277,13 @@ export type TransformReport = {
       kind: 'sql';
       path: string;
     } | null;
+    /**
+     * Optional: determined by topology (static topology iff static build), so a deployable report may omit it and one that still carries it stays valid.
+     */
     buildKind?: 'container' | 'static';
+    /**
+     * Optional: determined by the build output kinds, so a deployable report may omit it and one that still carries it stays valid.
+     */
     topology?: 'static' | 'backend' | 'frontend_and_backend';
     entrypoint?: string;
     build?: {
@@ -271,6 +307,9 @@ export type TransformReport = {
         route: string;
       }[];
     };
+    /**
+     * Optional: both members are platform constants, so a deployable report may omit this object and one that still carries it stays valid.
+     */
     basePath?: {
       required: boolean;
       environmentVariable: 'HARBOUR_BASE_PATH';
@@ -285,6 +324,8 @@ export type TransformReport = {
       reason: string;
     }[];
     /**
+     * Optional: a deployable plan requires this empty, so a deployable report may omit it and one that still carries it (empty) stays valid.
+     *
      * @maxItems 64
      */
     unsupportedFeatures?: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.51.0",
+  "version": "0.53.0",
   "description": "Single source of truth for every data shape that crosses a boundary between Harbour components.",
   "license": "UNLICENSED",
   "private": false,

package/schema/app-integrations-declaration.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/app-integrations-declaration.schema.json",
   "title": "AppIntegrationsDeclaration",
-  "description": "Committed `.harbour/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (five operations) and each operation carries a fixed identity mode: slack.channel.history=user, slack.message.post=app, gmail.thread.list=user, gmail.message.read=user, warehouse.view.read=app. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read. Gmail is read-only and user-mode only; its single resource is the fixed `inbox` alias. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind enums referenced by the other integration schemas.",
+  "description": "Committed `.harbour/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (six operations). Each operation carries a fixed identity mode — slack.channel.history=user, gmail.thread.list=user, gmail.message.read=user, gmail.message.send=user, warehouse.view.read=app — except slack.message.post, whose mode the app DECLARES: `app` posts as the company's Slack app (the one audited bot identity, under the IT-approved per-app display name when the connection declares `presentation`), `user` posts as the signed-in person after their own consent. The mode is never chosen at call time: governance runs the call under the approved grant of the declared mode. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads plus one send); its single resource is the fixed `inbox` alias. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.",
   "type": "object",
   "additionalProperties": false,
   "required": ["schema", "connections"],
@@ -26,18 +26,34 @@
     "IntegrationOperation": {
       "type": "string",
       "enum": ["slack.channel.history", "slack.message.post", "gmail.thread.list", "gmail.message.read", "gmail.message.send", "warehouse.view.read"],
-      "description": "Closed operation set. Extending it is a contracts change. gmail.message.send (0.50.0) sends one plain-text email as the signed-in person: a send like slack.message.post (explicit Send, idempotencyKey, write receipt) under user identity."
+      "description": "Closed operation set. Extending it is a contracts change. gmail.message.send (0.50.0) sends one plain-text email as the signed-in person: a send like slack.message.post (explicit Send, idempotencyKey, write receipt) under user identity. slack.message.post (0.53.0) runs in the mode the app declares: app (the company's Slack app, under the IT-approved per-app name) or user (the signed-in person, after their consent)."
     },
     "IntegrationIdentityMode": {
       "type": "string",
       "enum": ["app", "user"],
-      "description": "Whose authority an operation runs under. Fixed per operation; callers never choose it."
+      "description": "Whose authority an operation runs under. Fixed per operation (slack.message.post: declared per app); never chosen at call time."
     },
     "IntegrationEnvironment": {
       "type": "string",
       "enum": ["development", "preview", "production"],
       "description": "development is the CLI/local kit; preview and production are hosted."
     },
+    "IntegrationPresentation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["displayName"],
+      "description": "How an app's app-mode Slack posts are presented (0.53.0): the display name and optional icon the platform bot posts under, so each app's posts are distinguishable while the bot stays the one audited identity. Declared by the app, shown to IT on the access request (\"posts as\"), copied onto the approved grant and applied only from there — a call can never name itself. Needs the Slack app scope chat:write.customize on the tenant's installation; without it the post goes out under the bot's own name and the receipt says so.",
+      "properties": {
+        "displayName": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 80,
+          "pattern": "^(?!\\s*$)(?!.*(^|[\\s(\\[<\"'])@[A-Za-z0-9_])(?!.*<@)[^\\u0000-\\u001F\\u007F]*$",
+          "description": "1..80 characters of plain text: not blank, no control characters, no @-mentions (`@name`, `<@id>`). Must not impersonate a person: IT sees it before approving."
+        },
+        "iconEmoji": { "type": "string", "pattern": "^:[a-z0-9_+-]{1,60}:$", "description": "A Slack emoji shortcode such as `:sandwich:`; absent keeps the bot's own icon." }
+      }
+    },
     "ColumnName": {
       "type": "string",
       "pattern": "^[A-Za-z_][A-Za-z0-9_]{0,62}$",
@@ -71,12 +87,13 @@
         "resources": { "$ref": "#/definitions/ResourceNames" }
       }
     },
-    "AppModeChannelOperation": {
+    "DeclaredModeChannelOperation": {
       "type": "object",
       "additionalProperties": false,
       "required": ["identity", "resources"],
+      "description": "slack.message.post: the app declares the mode — app (posts as the company's Slack app) or user (posts as the signed-in person).",
       "properties": {
-        "identity": { "type": "string", "const": "app" },
+        "identity": { "$ref": "#/definitions/IntegrationIdentityMode" },
         "resources": { "$ref": "#/definitions/ResourceNames" }
       }
     },
@@ -101,13 +118,14 @@
       "required": ["kind", "operations"],
       "properties": {
         "kind": { "$ref": "#/definitions/IntegrationConnectionKind" },
+        "presentation": { "$ref": "#/definitions/IntegrationPresentation", "description": "saas connections only (Slack): how this app's app-mode posts are presented; meaningless for every other operation." },
         "operations": {
           "type": "object",
           "additionalProperties": false,
           "minProperties": 1,
           "properties": {
             "slack.channel.history": { "$ref": "#/definitions/UserModeChannelOperation" },
-            "slack.message.post": { "$ref": "#/definitions/AppModeChannelOperation" },
+            "slack.message.post": { "$ref": "#/definitions/DeclaredModeChannelOperation" },
             "gmail.thread.list": { "$ref": "#/definitions/UserModeChannelOperation" },
             "gmail.message.read": { "$ref": "#/definitions/UserModeChannelOperation" },
             "gmail.message.send": { "$ref": "#/definitions/UserModeChannelOperation" },
@@ -118,6 +136,7 @@
       "if": { "properties": { "kind": { "const": "saas" } } },
       "then": { "properties": { "operations": { "not": { "required": ["warehouse.view.read"] } } } },
       "else": {
+        "not": { "required": ["presentation"] },
         "properties": {
           "operations": {
             "not": { "anyOf": [{ "required": ["slack.channel.history"] }, { "required": ["slack.message.post"] }, { "required": ["gmail.thread.list"] }, { "required": ["gmail.message.read"] }, { "required": ["gmail.message.send"] }] }
@@ -132,6 +151,7 @@
       "connections": {
         "company-slack": {
           "kind": "saas",
+          "presentation": { "displayName": "Lunch Vote", "iconEmoji": ":sandwich:" },
           "operations": {
             "slack.channel.history": { "identity": "user", "resources": ["team-updates"] },
             "slack.message.post": { "identity": "app", "resources": ["team-updates"] }
@@ -155,6 +175,17 @@
           }
         }
       }
+    },
+    {
+      "schema": "harbour.app-integrations/2.0",
+      "connections": {
+        "company-slack": {
+          "kind": "saas",
+          "operations": {
+            "slack.message.post": { "identity": "user", "resources": ["team-updates"] }
+          }
+        }
+      }
     }
   ]
 }

package/schema/data-grant-v2.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/data-grant-v2.schema.json",
   "title": "DataGrantV2",
-  "description": "An app's integration grant for one connection, environment and identity mode (control table sk APP#<appId>#IGRANT#<environment>#<sourceId>#<mode>; grantId = base64url(JSON [\"v2\",appId,environment,sourceId,mode])). Additive to the legacy DataGrant (data-grant.schema.json), which is never consulted by v2 paths. A fresh REQUESTED record carries empty `operations`/`resources` until the attached request is approved; approved resources are structured `{name, columns?}` entries (a Slack channel alias, the fixed Gmail `inbox` alias, or a warehouse view alias with its approved columns). Expiry is enforced from UTC time on every call and SDK calls never extend it; `expiredAt` is stamped by the recovery sweep afterwards. Status edges live in x-transitions; DENIED and REVOKED are terminal (a regrant after revocation is a new REQUESTED record once cleanup is DONE). Database grants add credentialRef/mintedPrincipal; both hold references only. `identityMode` and `installation` are the deprecated 0.45.0 spellings: the record carries `mode`, and a SaaS grant runs on the connection's single installation.",
+  "description": "An app's integration grant for one connection, environment and identity mode (control table sk APP#<appId>#IGRANT#<environment>#<sourceId>#<mode>; grantId = base64url(JSON [\"v2\",appId,environment,sourceId,mode])). Additive to the legacy DataGrant (data-grant.schema.json), which is never consulted by v2 paths. A fresh REQUESTED record carries empty `operations`/`resources` until the attached request is approved; approved resources are structured `{name, columns?}` entries (a Slack channel alias, the fixed Gmail `inbox` alias, or a warehouse view alias with its approved columns). Expiry is enforced from UTC time on every call and SDK calls never extend it; `expiredAt` is stamped by the recovery sweep afterwards. Status edges live in x-transitions; DENIED and REVOKED are terminal (a regrant after revocation is a new REQUESTED record once cleanup is DONE). Database grants add credentialRef/mintedPrincipal; both hold references only. An app-mode Slack grant may carry `presentation` (0.53.0): the IT-approved display name and icon the app's posts go out under, copied from the approved request and read by every post — never from the call. `identityMode` and `installation` are the deprecated 0.45.0 spellings: the record carries `mode`, and a SaaS grant runs on the connection's single installation.",
   "type": "object",
   "additionalProperties": false,
   "required": ["schema", "tenantId", "appId", "environment", "sourceId", "mode", "kind", "status", "operations", "resources", "version", "provisioning", "createdAt", "updatedAt"],
@@ -35,6 +35,7 @@
     "approvedAt": { "type": "string", "format": "date-time" },
     "version": { "type": "integer", "minimum": 1, "description": "Optimistic-concurrency version; approvals compare it with the reviewed value." },
     "pendingRequestId": { "type": "string", "minLength": 1, "maxLength": 128, "description": "The one open access request attached to this grant, if any." },
+    "presentation": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationPresentation", "description": "App-mode Slack grants only: how the app's posts are presented, as IT approved it. Absent means the posts carry the bot's own name." },
     "provisioning": { "$ref": "#/definitions/DataGrantV2Provisioning" },
     "credentialRef": {
       "type": "string",

package/schema/integration-execute-request.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/integration-execute-request.schema.json",
   "title": "IntegrationExecuteRequest",
-  "description": "Body of POST /_harbour/integrations/execute (app SDK), forwarded unchanged to the governance development and runtime execute routes. Exactly one declared operation against one declared resource. The identity mode is NOT a caller field: it is fixed by the operation and enforced from the approved grant; any identity/userId/scope field is rejected by additionalProperties. Per-operation input bounds: slack.channel.history {limit? 1..15, default 15}; slack.message.post {text 1..4000 chars} and a required idempotencyKey retained across retries of one explicit Send; gmail.thread.list {limit? 1..15, default 15}; gmail.message.read {messageId}; gmail.message.send {to 1..50 addresses (to+cc+bcc <= 50 in total), cc?, bcc?, subject 1..256 chars, text 1..4000 chars, replyToMessageId?} and a required idempotencyKey like slack.message.post (plain text only, no attachments); warehouse.view.read {columns 1..32, limit? 1..1000, default 100}. Each operation's then-block is the one statement of its input rules: propertyNames.enum names the fields it accepts, required the ones it needs, and per-field overrides (maximum, default) narrow the shared property. Codegen derives IntegrationExecuteInputRules and validateIntegrationExecuteInput (gen-ts/integration-execute-input-rules.ts, gen-go/integration_execute_input_rules.go) from exactly these blocks, so the governance execute route, the app SDK and the kit's local check refuse the same request with the same message. Transport limits (not expressible here): request <= 16 KiB, total deadline 10 s.",
+  "description": "Body of POST /_harbour/integrations/execute (app SDK), forwarded unchanged to the governance development and runtime execute routes. Exactly one declared operation against one declared resource. The identity mode is NOT a caller field: it is fixed by the operation (declared per app for slack.message.post) and enforced from the approved grant; any identity/userId/scope field is rejected by additionalProperties. A slack.message.post runs as the app (the IT-approved per-app name from the grant, plus a \"Posted by <app> on Harbour\" footer) or as the signed-in person (no name, no footer), whichever mode the app declared and IT approved — the same input either way. Per-operation input bounds: slack.channel.history {limit? 1..15, default 15}; slack.message.post {text 1..4000 chars} and a required idempotencyKey retained across retries of one explicit Send; gmail.thread.list {limit? 1..15, default 15}; gmail.message.read {messageId}; gmail.message.send {to 1..50 addresses (to+cc+bcc <= 50 in total), cc?, bcc?, subject 1..256 chars, text 1..4000 chars, replyToMessageId?} and a required idempotencyKey like slack.message.post (plain text only, no attachments); warehouse.view.read {columns 1..32, limit? 1..1000, default 100}. Each operation's then-block is the one statement of its input rules: propertyNames.enum names the fields it accepts, required the ones it needs, and per-field overrides (maximum, default) narrow the shared property. Codegen derives IntegrationExecuteInputRules and validateIntegrationExecuteInput (gen-ts/integration-execute-input-rules.ts, gen-go/integration_execute_input_rules.go) from exactly these blocks, so the governance execute route, the app SDK and the kit's local check refuse the same request with the same message. Transport limits (not expressible here): request <= 16 KiB, total deadline 10 s.",
   "type": "object",
   "additionalProperties": false,
   "required": ["connection", "operation", "resource", "input"],

package/schema/saas-connection.schema.json

@@ -94,7 +94,8 @@
         "workspaceId": { "type": "string", "minLength": 1, "maxLength": 128 },
         "botUserId": { "type": "string", "maxLength": 128, "description": "Empty only for a legacy record normalised without one." },
         "status": { "$ref": "#/definitions/SaasInstallationStatus" },
-        "installedAt": { "type": "string", "format": "date-time" }
+        "installedAt": { "type": "string", "format": "date-time" },
+        "scopes": { "type": "array", "maxItems": 64, "uniqueItems": true, "items": { "type": "string", "minLength": 1, "maxLength": 64 }, "description": "The bot scopes Slack granted at installation (0.53.0). Absent on installations recorded before it, which therefore lack chat:write.customize: per-app display names need a reinstall." }
       }
     },
     "DevelopmentPreapproval": {
@@ -144,7 +145,7 @@
       "displayName": "Company Slack",
       "status": "ACTIVE",
       "version": 3,
-      "installation": { "tokenRecordId": "tok_workspace", "workspaceId": "T0WORKSPACE", "botUserId": "U0BOT", "status": "installed", "installedAt": "2026-09-09T08:00:00Z" },
+      "installation": { "tokenRecordId": "tok_workspace", "workspaceId": "T0WORKSPACE", "botUserId": "U0BOT", "status": "installed", "installedAt": "2026-09-09T08:00:00Z", "scopes": ["channels:read", "chat:write", "chat:write.customize"] },
       "channels": { "team-updates": "C0123TEAM" },
       "operations": ["slack.channel.history", "slack.message.post"],
       "developmentPreapproval": { "enabled": true, "hours": 24 },

package/schema/transform-report.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/transform-report.schema.json",
   "title": "TransformReport",
-  "description": "Structured output an agent must return from one Harbour transformation attempt. Handed to the agent as its output schema, then decoded and semantically re-validated by the control plane, which remains the authority. The enum on applied_playbooks.items is the one dynamic part: the adapter injects the names of the playbooks supplied for that invocation before writing the document, so the model is structurally prevented from naming a playbook it was not given. Application-secret handling was removed platform-wide, so this document carries no redactions and no secrets fields. A deployable report must also carry preservation_plan: the agent's own grounded smoke tests (one to three happy_path user journeys plus a boundary_check per behaviour its playbooks or edits could regress) that the validation cell executes after transformation, and an uncovered list naming every boundary it could not test and why. It also carries validation_fixtures: null when no external fixture is needed, or a bounded generic HTTP/WebSocket fixture declaration for that one run. An unsupported report carries only application.unsupported and no plan or fixtures.",
+  "description": "Structured output an agent must return from one Harbour transformation attempt. Handed to the agent as its output schema, then decoded and semantically re-validated by the control plane, which remains the authority. The enum on applied_playbooks.items is the one dynamic part: the adapter injects the names of the playbooks supplied for that invocation before writing the document, so the model is structurally prevented from naming a playbook it was not given. Application-secret handling was removed platform-wide, so this document carries no redactions and no secrets fields. A deployable report must also carry preservation_plan: the agent's own grounded smoke tests (one to three happy_path user journeys plus a boundary_check per behaviour its playbooks or edits could regress) that the validation cell executes after transformation, and an uncovered list naming every boundary it could not test and why. It may also carry validation_fixtures: null when no external fixture is needed, or a bounded generic HTTP/WebSocket fixture declaration for that one run; the deployment plane reads the workspace fixture sidecar, so the report's copy is optional. An unsupported report carries only application.unsupported and no plan or fixtures.",
   "x-go-embed": true,
   "type": "object",
   "additionalProperties": false,
@@ -14,26 +14,34 @@
       "minItems": 1,
       "items": { "type": "string", "minLength": 1 }
     },
-    "static_rebuild_required": { "type": "boolean" },
+    "static_rebuild_required": {
+      "description": "Optional. The deployed value is a platform constant supplied to the build, not a report field, so a deployable report may omit it and one that still carries it stays valid.",
+      "type": "boolean"
+    },
     "analysis": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["deployable", "needsTransformation", "blockers", "surfaces", "evidence"],
+      "required": ["deployable", "blockers"],
       "properties": {
         "deployable": { "type": "boolean" },
-        "needsTransformation": { "type": "boolean" },
+        "needsTransformation": {
+          "description": "Whether the attempt changed the tree. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
+          "type": "boolean"
+        },
         "blockers": {
           "type": "array",
           "maxItems": 64,
           "items": { "type": "string", "minLength": 1, "maxLength": 1024 }
         },
         "surfaces": {
+          "description": "Paths the attempt touched. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
           "type": "array",
           "minItems": 1,
           "maxItems": 1024,
           "items": { "type": "string", "minLength": 1, "maxLength": 512 }
         },
         "evidence": {
+          "description": "Optional file-and-line citations for why the transformation was needed. Nothing downstream reads them, so a deployable report may omit them and one that still carries them stays valid.",
           "type": "array",
           "maxItems": 1024,
           "items": {
@@ -52,35 +60,36 @@
     "database": {
       "type": "object",
       "additionalProperties": false,
-      "required": [
-        "mode",
-        "changeType",
-        "requiresCodeChanges",
-        "requiresSchemaMigration",
-        "migrationPaths",
-        "changedFiles",
-        "evidence",
-        "unsupportedFeatures"
-      ],
+      "required": ["mode"],
       "properties": {
         "mode": { "type": "string", "enum": ["none", "sql"] },
         "changeType": {
+          "description": "Classification of the changed paths. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
           "type": "string",
           "enum": ["none", "code_only", "schema_only", "code_and_schema"]
         },
-        "requiresCodeChanges": { "type": "boolean" },
-        "requiresSchemaMigration": { "type": "boolean" },
+        "requiresCodeChanges": {
+          "description": "Whether any changed path sits outside the database boundary. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
+          "type": "boolean"
+        },
+        "requiresSchemaMigration": {
+          "description": "Whether the Aurora bundle grew past its seeded prefix. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
+          "type": "boolean"
+        },
         "migrationPaths": {
+          "description": "Migration files in the Aurora bundle. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
           "type": "array",
           "maxItems": 128,
           "items": { "type": "string", "minLength": 1, "maxLength": 512 }
         },
         "changedFiles": {
+          "description": "Changed paths on the database boundary. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
           "type": "array",
           "maxItems": 512,
           "items": { "type": "string", "minLength": 1, "maxLength": 512 }
         },
         "evidence": {
+          "description": "Optional file-and-line citations for the database findings. Nothing downstream reads them, so a deployable report may omit them and one that still carries them stays valid.",
           "type": "array",
           "maxItems": 128,
           "items": {
@@ -95,6 +104,7 @@
           }
         },
         "unsupportedFeatures": {
+          "description": "Optional. The platform's only structural decline is application.unsupported; nothing reads this list, so a deployable report may omit it and one that still carries it stays valid.",
           "type": "array",
           "maxItems": 64,
           "items": { "type": "string", "minLength": 1, "maxLength": 512 }
@@ -116,13 +126,13 @@
           "items": {
             "type": "object",
             "additionalProperties": false,
-            "required": ["id", "kind", "name", "boundaries", "evidence", "confidence", "steps"],
+            "required": ["id", "kind", "name", "evidence", "confidence", "steps"],
             "properties": {
               "id": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" },
               "kind": { "type": "string", "enum": ["happy_path", "boundary_check"] },
               "name": { "type": "string", "minLength": 1, "maxLength": 120 },
               "boundaries": {
-                "description": "Transformation boundaries this test claims to cover.",
+                "description": "Transformation boundaries this test claims to cover. Optional: Harbour derives them from the test's own evidence paths, so a deployable report may omit them and one that still carries them stays valid.",
                 "type": "array",
                 "minItems": 1,
                 "maxItems": 8,
@@ -202,9 +212,10 @@
           "items": {
             "type": "object",
             "additionalProperties": false,
-            "required": ["boundary", "reason"],
+            "required": ["reason"],
             "properties": {
               "boundary": {
+                "description": "Optional: Harbour derives the uncovered boundaries from the changed paths and the covered set, so a deployable report may omit this and one that still carries it stays valid.",
                 "type": "string",
                 "enum": ["application", "routing", "database", "authentication", "runtime_dependency", "files", "provider", "background_work"]
               },
@@ -390,8 +401,13 @@
             { "type": "null" }
           ]
         },
-        "buildKind": { "type": "string", "enum": ["container", "static"] },
+        "buildKind": {
+          "description": "Optional: determined by topology (static topology iff static build), so a deployable report may omit it and one that still carries it stays valid.",
+          "type": "string",
+          "enum": ["container", "static"]
+        },
         "topology": {
+          "description": "Optional: determined by the build output kinds, so a deployable report may omit it and one that still carries it stays valid.",
           "type": "string",
           "enum": ["static", "backend", "frontend_and_backend"]
         },
@@ -434,6 +450,7 @@
           }
         },
         "basePath": {
+          "description": "Optional: both members are platform constants, so a deployable report may omit this object and one that still carries it stays valid.",
           "type": "object",
           "additionalProperties": false,
           "required": ["required", "environmentVariable"],
@@ -458,6 +475,7 @@
           }
         },
         "unsupportedFeatures": {
+          "description": "Optional: a deployable plan requires this empty, so a deployable report may omit it and one that still carries it (empty) stays valid.",
           "type": "array",
           "maxItems": 64,
           "items": { "type": "string", "minLength": 1, "maxLength": 512 }
@@ -667,10 +685,10 @@
   ],
   "oneOf": [
     {
-      "required": ["static_rebuild_required", "analysis", "database", "preservation_plan", "validation_fixtures", "application"],
+      "required": ["analysis", "database", "preservation_plan", "application"],
       "properties": {
         "application": {
-          "required": ["runtime", "buildKind", "topology", "entrypoint", "build", "basePath", "evidence", "unsupportedFeatures"],
+          "required": ["runtime", "entrypoint", "build", "evidence"],
           "not": { "required": ["unsupported"] }
         }
       }