@fourier-labs/harbour-contracts 0.57.0 → 0.59.0

package/schema/app-integrations-declaration.schema.json

@@ -2,12 +2,12 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/app-integrations-declaration.schema.json",
   "title": "AppIntegrationsDeclaration",
-  "description": "Committed `.harbour/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (six operations). Each operation carries a fixed identity mode — slack.channel.history=user, gmail.thread.list=user, gmail.message.read=user, gmail.message.send=user, warehouse.view.read=app — except slack.message.post, whose mode the app DECLARES: `app` posts as the company's Slack app (the one audited bot identity, under the IT-approved per-app display name when the connection declares `presentation`), `user` posts as the signed-in person after their own consent. The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each slack.message.post call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads plus one send); its single resource is the fixed `inbox` alias. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.",
+  "description": "Committed `.isomorph/integrations.json`: the app's declared use of tenant-wide integration connections. Keys are logical connection aliases (the governance sourceId); resources are logical names (Slack channel alias, warehouse view name), never IDs, tokens or URLs. The operation set is closed (six operations). Each operation carries a fixed identity mode — slack.channel.history=user, gmail.thread.list=user, gmail.message.read=user, gmail.message.send=user, warehouse.view.read=app — except slack.message.post, whose mode the app DECLARES: `app` posts as the company's Slack app (the one audited bot identity, under the IT-approved per-app display name when the connection declares `presentation`), `user` posts as the signed-in person after their own consent. The declared mode is the one the app requests access for; an app may hold approved grants for both modes after two requests, and each slack.message.post call names which approved mode it runs under (`mode` on the execute request, 0.55.0) — a mode IT did not approve is refused, never swapped for the other. A `saas` connection may declare only the Slack and Gmail operations and a `database` connection only warehouse.view.read; `presentation` is a `saas` connection's optional per-app display name and icon for app-mode Slack posts, shown to IT at approval time and applied only from the approved grant. Gmail is user-mode only (reads plus one send); its single resource is the fixed `inbox` alias. This file also owns the shared IntegrationOperation / IntegrationIdentityMode / IntegrationEnvironment / IntegrationConnectionKind / IntegrationPresentation definitions referenced by the other integration schemas.",
   "type": "object",
   "additionalProperties": false,
   "required": ["schema", "connections"],
   "properties": {
-    "schema": { "type": "string", "const": "harbour.app-integrations/2.0" },
+    "schema": { "type": "string", "const": "isomorph.app-integrations/2.0" },
     "connections": {
       "type": "object",
       "minProperties": 1,
@@ -56,8 +56,8 @@
     },
     "ColumnName": {
       "type": "string",
-      "pattern": "^[A-Za-z_][A-Za-z0-9_]{0,62}$",
-      "description": "A plain column identifier of a warehouse view."
+      "pattern": "^(?:\\*|[A-Za-z_][A-Za-z0-9_]{0,62})$",
+      "description": "A plain warehouse column identifier, or `*` as the sole selection when IT exposed all current and future columns."
     },
     "ResourceNames": {
       "type": "array",
@@ -74,7 +74,8 @@
           "type": "array",
           "minItems": 1,
           "maxItems": 32,
-          "items": { "$ref": "#/definitions/ColumnName" }
+          "items": { "$ref": "#/definitions/ColumnName" },
+          "not": { "allOf": [{ "contains": { "const": "*" } }, { "minItems": 2 }] }
         }
       }
     },
@@ -147,7 +148,7 @@
   },
   "examples": [
     {
-      "schema": "harbour.app-integrations/2.0",
+      "schema": "isomorph.app-integrations/2.0",
       "connections": {
         "company-slack": {
           "kind": "saas",
@@ -177,7 +178,7 @@
       }
     },
     {
-      "schema": "harbour.app-integrations/2.0",
+      "schema": "isomorph.app-integrations/2.0",
       "connections": {
         "company-slack": {
           "kind": "saas",

package/schema/data-dependency.schema.json

@@ -30,7 +30,7 @@
     "DataDependencyKind": {
       "type": "string",
       "enum": ["database", "api", "app_owned_external"],
-      "description": "database = a SQL/warehouse connection; api = an HTTP(S) service; app_owned_external = infrastructure the app owns outside Harbour."
+      "description": "database = a SQL/warehouse connection; api = an HTTP(S) service; app_owned_external = infrastructure the app owns outside Isomorph."
     },
     "DataDependencyIdentifiers": {
       "type": "object",
@@ -65,7 +65,7 @@
     "DataDependencyClassification": {
       "type": "string",
       "enum": ["matched", "out_of_scope", "unknown", "inventory", "app_owned_external"],
-      "description": "matched = resolved to a registered source; out_of_scope = resolved but not requestable; unknown = unresolvable; inventory = registered but unused; app_owned_external = app-owned, outside Harbour's remit."
+      "description": "matched = resolved to a registered source; out_of_scope = resolved but not requestable; unknown = unresolvable; inventory = registered but unused; app_owned_external = app-owned, outside Isomorph's remit."
     },
     "DataDependencyOrigin": {
       "type": "string",

package/schema/data-source.schema.json

@@ -126,7 +126,7 @@
     "DataSourceProvisioningMode": {
       "type": "string",
       "enum": ["byo", "harbour_managed"],
-      "description": "byo = admin brought existing infrastructure; harbour_managed = Harbour provisioned it."
+      "description": "byo = admin brought existing infrastructure; harbour_managed = Isomorph provisioned it."
     },
     "DataSourceStatus": {
       "type": "string",

package/schema/deployment-environment.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/deployment-environment.schema.json",
   "title": "DeploymentEnvironment",
-  "description": "Public environment accepted by the preview deployment-control-plane APIs. The MVP accepts only preview; production remains reachable only through Harbour's human-merge promotion flow.",
+  "description": "Public environment accepted by the preview deployment-control-plane APIs. The MVP accepts only preview; production remains reachable only through Isomorph's human-merge promotion flow.",
   "type": "string",
   "enum": ["preview"],
   "examples": ["preview"]

package/schema/deployment-status-response.schema.json

@@ -122,7 +122,7 @@
       "type": "object",
       "additionalProperties": false,
       "required": ["account", "region"],
-      "description": "The customer account and region this version deploys into, stamped on the version record at admission for customer-account (BYOC) tenants. Absent means harbour-managed — the same convention the record itself uses — so every pre-destination version simply omits it. Deliberately only account and region: the record's roleArn/externalId are how the pipeline gets into the account, not where the deploy landed, and no status consumer needs them.",
+      "description": "The customer account and region this version deploys into, stamped on the version record at admission for customer-account (BYOC) tenants. Absent means Isomorph-managed — the same convention the record itself uses — so every pre-destination version simply omits it. Deliberately only account and region: the record's roleArn/externalId are how the pipeline gets into the account, not where the deploy landed, and no status consumer needs them.",
       "properties": {
         "account": {
           "type": "string",

package/schema/error-category.enum.json

@@ -13,16 +13,16 @@
   },
   "x-registry": [
     { "id": "intake.no-entrypoint", "retryable": false, "description": "No detectable app entrypoint in the repo." },
-    { "id": "intake.unsupported-runtime", "retryable": false, "description": "Detected runtime has no Harbour build recipe." },
+    { "id": "intake.unsupported-runtime", "retryable": false, "description": "Detected runtime has no Isomorph build recipe." },
     { "id": "intake.attestation-missing", "retryable": false, "description": "Required auth attestation absent." },
     { "id": "intake.multi-app-repo", "retryable": false, "description": "Repo contains more than one deployable app." },
-    { "id": "intake.source-invalid", "retryable": false, "description": "The submitted source tree fails its own clean install, build, import, boot, schema-presence, or pristine-lineage checks before Harbour transformation begins." },
+    { "id": "intake.source-invalid", "retryable": false, "description": "The submitted source tree fails its own clean install, build, import, boot, schema-presence, or pristine-lineage checks before Isomorph transformation begins." },
     { "id": "secrets.unresolvable", "retryable": false, "retired": true, "description": "RETIRED 2026-08-08 and no longer emittable: the secret-materializer stack, its reconciler and the secret-reference playbook were all removed, so nothing can reach this state. Kept rather than deleted because historical failure records still carry it and a dropped id would decode to nothing. Do not emit in new code." },
     { "id": "secrets.reference-unresolvable", "retryable": false, "description": "A governance secret reference supplied on the deploy request could not be resolved to a stored value — the secret does not exist, the read was denied, or the secretref:// URI is malformed. Not retryable: no amount of waiting produces the value, a human must set it (or fix the reference) before the deploy can proceed." },
     { "id": "secrets.placeholder-unresolved", "retryable": false, "description": "The built workspace still contains a ${HARBOUR_REDACTED_<KEY>} substitution placeholder after transformation, meaning the transform never converted it into a runtime secret lookup and the artifact would ship a literal placeholder where a secret belongs. Not retryable: the workspace is already built, so the same input yields the same placeholder until the transform is corrected." },
     { "id": "secrets.leaked-in-artifact", "retryable": false, "description": "Artifact secret scan found a plaintext secret in the built image (belt-and-suspenders)." },
     { "id": "storage.sqlite-misclassified", "retryable": false, "description": "SQLite usage not resolvable to a managed binding." },
-    { "id": "storage.unsupported-engine", "retryable": false, "family": true, "description": "Storage engine with no Harbour mapping; concrete token names the engine, e.g. storage.unsupported-engine.mongodb." },
+    { "id": "storage.unsupported-engine", "retryable": false, "family": true, "description": "Storage engine with no Isomorph mapping; concrete token names the engine, e.g. storage.unsupported-engine.mongodb." },
     { "id": "storage.mapping-drift", "retryable": false, "description": "Declared storage binding diverged from detected usage." },
     { "id": "storage.unavailable", "retryable": true, "description": "The platform's shared application database could not be reached while preparing or provisioning the deploy — e.g. the Aurora cluster dial timing out during a scale-from-zero cold start. Says nothing about the app, so it IS retryable: the same deploy submitted again is expected to succeed once the database is awake. Previously surfaced as uncategorized.deploy (errorType wrapError)." },
     { "id": "ai.plan-blocked", "retryable": false, "description": "The governance control plane's AI PLAN verdict was BLOCKED: the app makes AI calls that cannot be governed as the tenant is configured today — no provider connected or enabled, no credential, no budget, an SDK or provider the gateway cannot intercept, or a scan that could not cover the whole app. The analyzer's maker message carries the plain-English reason and the governance reason codes. NOT retryable: the same deploy re-earns the same verdict until a person changes the tenant's AI configuration or the app. Previously surfaced as uncategorized.deploy (errorType wrapError)." },
@@ -30,16 +30,16 @@
     { "id": "transform.attempts-exhausted", "retryable": false, "description": "The bounded transformation attempt count was exhausted before a passing candidate was found." },
     { "id": "transform.non-retryable", "retryable": false, "retired": true, "description": "RETIRED 2026-09-06. Historical agent declines used a prose-derived suffix in this family. New reports must select one of the fixed structured categories below." },
     { "id": "transform.validation-failed", "retryable": true, "description": "Transform candidate failed validation with iterable feedback; re-enters TRANSFORMING while deadline remains." },
-    { "id": "auth.validation-seed-unsupported", "retryable": false, "description": "The application requires authenticated validation setup that Harbour cannot express with its supported validation seed contract." },
-    { "id": "auth.identity-entity-unresolvable", "retryable": false, "description": "The application identity model cannot deterministically resolve the trusted Harbour subject to one application entity." },
-    { "id": "dependency.python-runtime-unsupported", "retryable": false, "description": "The application requires a Python minor version for which Harbour has no approved resolver and runtime image." },
+    { "id": "auth.validation-seed-unsupported", "retryable": false, "description": "The application requires authenticated validation setup that Isomorph cannot express with its supported validation seed contract." },
+    { "id": "auth.identity-entity-unresolvable", "retryable": false, "description": "The application identity model cannot deterministically resolve the trusted Isomorph subject to one application entity." },
+    { "id": "dependency.python-runtime-unsupported", "retryable": false, "description": "The application requires a Python minor version for which Isomorph has no approved resolver and runtime image." },
     { "id": "dependency.resolver-unavailable", "retryable": true, "description": "The approved dependency resolver image or restricted registry lane was unavailable." },
     { "id": "dependency.resolution-failed", "retryable": false, "description": "The application dependency manifest could not be resolved by its approved package manager." },
     { "id": "dependency.lockfile-stale", "retryable": false, "description": "The final dependency manifest and lockfile disagree after dependency resolution." },
-    { "id": "aurora.bundle-invalid", "retryable": false, "description": "The candidate's Harbour-managed Aurora migration bundle is missing, malformed, or inconsistent." },
-    { "id": "capability.unsupported", "retryable": false, "description": "A required application capability has no supported equivalent under the Harbour platform contract." },
+    { "id": "aurora.bundle-invalid", "retryable": false, "description": "The candidate's Isomorph-managed Aurora migration bundle is missing, malformed, or inconsistent." },
+    { "id": "capability.unsupported", "retryable": false, "description": "A required application capability has no supported equivalent under the Isomorph platform contract." },
     { "id": "frontend.env-inlined-unfixable", "retryable": false, "description": "Client code inlined build-time env/self-URLs in a way transformation cannot rewrite." },
-    { "id": "build.recipe-failed", "retryable": false, "description": "The Harbour build recipe failed for the detected runtime." },
+    { "id": "build.recipe-failed", "retryable": false, "description": "The Isomorph build recipe failed for the detected runtime." },
     { "id": "build.image-too-large", "retryable": false, "description": "Built image exceeded the size limit." },
     { "id": "browser.probe-failed", "retryable": true, "description": "The app built and produced its declared outputs, but the browser probe found it does not serve them — typically assets emitted at the root instead of under the app base path. Retryable because it is fed back to the transform agent, which is the component that can fix it; the merged job retries in-loop and the state machine retries the job. Distinct from build.recipe-failed, which means the build itself did not succeed: here it did." },
     { "id": "browser.probe-unavailable", "retryable": false, "description": "The browser probe could not reach a verdict — Chromium crashed or disconnected, or it wrote no result document. Says nothing about the app, so it is not fed back to the agent. Replaces the uncategorized.browser-probe token the merged job emitted while this entry did not exist." },

package/schema/integration-error-details.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/integration-error-details.schema.json",
   "title": "IntegrationErrorDetails",
-  "description": "The `error` member of an integration failure response `{error, requestId}` on the execute/connect routes; the SDK maps it onto HarbourError(category, message, details). `category` is the app-SDK HarbourErrorCategory (not the deployment pipeline's dot-path error-category registry), with the HTTP status fixed per category: 401 AUTH_REQUIRED, 403 FORBIDDEN (denied/revoked/expired), 404 NOT_FOUND (unknown app/connection/resource), 409 CONFLICT (pending provisioning/consent/concurrent request), 400 or 413 VALIDATION_FAILED (invalid input / size overflow), 429 RATE_LIMITED (+ Retry-After header), 503 UNAVAILABLE. `details.code` is the closed stable reason set; `message` is human-facing and never carries provider error bodies, tokens or SQL.",
+  "description": "The `error` member of an integration failure response `{error, requestId}` on the execute/connect routes; the SDK maps it onto IsomorphError(category, message, details). `category` is the app-SDK IsomorphErrorCategory (not the deployment pipeline's dot-path error-category registry), with the HTTP status fixed per category: 401 AUTH_REQUIRED, 403 FORBIDDEN (denied/revoked/expired), 404 NOT_FOUND (unknown app/connection/resource), 409 CONFLICT (pending provisioning/consent/concurrent request), 400 or 413 VALIDATION_FAILED (invalid input / size overflow), 429 RATE_LIMITED (+ Retry-After header), 503 UNAVAILABLE. `details.code` is the closed stable reason set; `message` is human-facing and never carries provider error bodies, tokens or SQL.",
   "type": "object",
   "additionalProperties": false,
   "required": ["category", "message", "details"],
@@ -28,7 +28,7 @@
     "IntegrationErrorCategory": {
       "type": "string",
       "enum": ["AUTH_REQUIRED", "FORBIDDEN", "NOT_FOUND", "CONFLICT", "VALIDATION_FAILED", "RATE_LIMITED", "UNAVAILABLE"],
-      "description": "App-SDK HarbourErrorCategory values an integration route may emit; INTERNAL is reserved for the transport."
+      "description": "App-SDK IsomorphErrorCategory values an integration route may emit; INTERNAL is reserved for the transport."
     },
     "IntegrationErrorCode": {
       "type": "string",

package/schema/integration-execute-request.schema.json

@@ -26,7 +26,9 @@
           "type": "array",
           "minItems": 1,
           "maxItems": 32,
-          "items": { "$ref": "app-integrations-declaration.schema.json#/definitions/ColumnName" }
+          "items": { "$ref": "app-integrations-declaration.schema.json#/definitions/ColumnName" },
+          "not": { "allOf": [{ "contains": { "const": "*" } }, { "minItems": 2 }] },
+          "description": "Explicit columns, or `*` alone when the app's approved resource grant allows all current and future columns."
         }
       }
     },

package/schema/kit-bundle-manifest.schema.json

@@ -7,14 +7,14 @@
   "additionalProperties": false,
   "required": ["schema", "kitVersion", "sdk", "images", "brief", "declarationSchema"],
   "properties": {
-    "schema": { "type": "string", "const": "harbour.kit-bundle/1.0" },
+    "schema": { "type": "string", "const": "isomorph.kit-bundle/1.0" },
     "kitVersion": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?$", "description": "The CLI package version that published this bundle." },
     "sdk": {
       "type": "object",
       "additionalProperties": false,
       "required": ["package", "tarballSha256"],
       "properties": {
-        "package": { "type": "string", "const": "@harbour/app-sdk" },
+        "package": { "type": "string", "const": "@isomorph.ai/app-sdk" },
         "version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?$", "description": "The SDK package version the tarball was packed from (informational; compatibility is decided by tarballSha256)." },
         "tarballSha256": { "$ref": "#/definitions/HexSha256", "description": "SHA-256 of the SDK tarball baked into this bundle; the CodeBuild gate compares it with the pipeline's own tarball." },
         "url": { "type": "string", "pattern": "^https://[^\\s{}]+$", "maxLength": 2048, "description": "Where the CLI downloads the SDK tarball from when it is not shipped inline; the bytes are verified against tarballSha256 before install. The publisher may name the location by content address (for example an OCI blob whose path ends in sha256:<tarballSha256>)." }
@@ -51,7 +51,7 @@
         }
       }
     },
-    "declarationSchema": { "type": "string", "const": "harbour.app-integrations/2.0" }
+    "declarationSchema": { "type": "string", "const": "isomorph.app-integrations/2.0" }
   },
   "definitions": {
     "HexSha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
@@ -73,10 +73,10 @@
   },
   "examples": [
     {
-      "schema": "harbour.kit-bundle/1.0",
+      "schema": "isomorph.kit-bundle/1.0",
       "kitVersion": "0.2.0",
       "sdk": {
-        "package": "@harbour/app-sdk",
+        "package": "@isomorph.ai/app-sdk",
         "version": "1.0.0",
         "tarballSha256": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
         "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
@@ -86,7 +86,7 @@
         "sessionFixture": "123456789012.dkr.ecr.us-east-1.amazonaws.com/harbour/session-fixture@sha256:fcde2b2edba56bf408601fb721fe9b5c338d10ee429ea04fae5511b68fbf8fb9"
       },
       "brief": { "fingerprint": "unknown" },
-      "declarationSchema": "harbour.app-integrations/2.0"
+      "declarationSchema": "isomorph.app-integrations/2.0"
     }
   ]
 }

package/schema/kit-lock.schema.json

@@ -2,12 +2,12 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/kit-lock.schema.json",
   "title": "KitLock",
-  "description": "Committed `.harbour/kit.lock.json`: which app and tenant a kit-built app belongs to and the exact bundle it was developed against. The data-plane vendorAppSDK gate reads bundle.sdk.tarballSha256 and fails with kit_bundle_incompatible (naming both digests) when it differs from the baked tarball; apps without a kit.lock keep the existing path.",
+  "description": "Committed `.isomorph/kit.lock.json`: which app and tenant a kit-built app belongs to and the exact bundle it was developed against. The data-plane vendorAppSDK gate reads bundle.sdk.tarballSha256 and fails with kit_bundle_incompatible (naming both digests) when it differs from the baked tarball; apps without a kit.lock keep the existing path.",
   "type": "object",
   "additionalProperties": false,
   "required": ["schema", "appId", "tenantId", "bundle", "createdAt", "updatedAt"],
   "properties": {
-    "schema": { "type": "string", "const": "harbour.kit-lock/1.0" },
+    "schema": { "type": "string", "const": "isomorph.kit-lock/1.0" },
     "appId": { "type": "string", "pattern": "^app-[0-9a-f]{8,}$" },
     "tenantId": { "type": "string", "minLength": 1, "maxLength": 128 },
     "bundle": { "$ref": "kit-bundle-manifest.schema.json" },
@@ -16,19 +16,19 @@
   },
   "examples": [
     {
-      "schema": "harbour.kit-lock/1.0",
+      "schema": "isomorph.kit-lock/1.0",
       "appId": "app-1f2e3d4c",
       "tenantId": "fourier",
       "bundle": {
-        "schema": "harbour.kit-bundle/1.0",
+        "schema": "isomorph.kit-bundle/1.0",
         "kitVersion": "0.2.0",
-        "sdk": { "package": "@harbour/app-sdk", "tarballSha256": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08" },
+        "sdk": { "package": "@isomorph.ai/app-sdk", "tarballSha256": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08" },
         "images": {
           "appGateway": "123456789012.dkr.ecr.us-east-1.amazonaws.com/harbour/app-gateway@sha256:2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae",
           "sessionFixture": "123456789012.dkr.ecr.us-east-1.amazonaws.com/harbour/session-fixture@sha256:fcde2b2edba56bf408601fb721fe9b5c338d10ee429ea04fae5511b68fbf8fb9"
         },
         "brief": { "fingerprint": "unknown" },
-        "declarationSchema": "harbour.app-integrations/2.0"
+        "declarationSchema": "isomorph.app-integrations/2.0"
       },
       "createdAt": "2026-09-09T08:00:00Z",
       "updatedAt": "2026-09-09T08:00:00Z"

package/schema/security-scan-input.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/security-scan-input.schema.json",
   "title": "SecurityScanInput",
-  "description": "Input to the Harbour Security Assurance machine (Security Assurance LLD §2). SOURCE (M1) scans an ingested commit; ARTIFACT (M2) scans built outputs — a container image digest, a deployable bundle, and/or synthesized infrastructure — named directly by the caller. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance. When phase is ARTIFACT at least one of `imageDigest`, `bundleRef`, or `infraRefs` must be present.",
+  "description": "Input to the Isomorph Security Assurance machine (Security Assurance LLD §2). SOURCE (M1) scans an ingested commit; ARTIFACT (M2) scans built outputs — a container image digest, a deployable bundle, and/or synthesized infrastructure — named directly by the caller. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance. When phase is ARTIFACT at least one of `imageDigest`, `bundleRef`, or `infraRefs` must be present.",
   "type": "object",
   "additionalProperties": false,
   "required": ["phase", "org", "app", "env", "repo", "commit", "branch"],
@@ -23,12 +23,12 @@
     "org": {
       "type": "string",
       "minLength": 1,
-      "description": "Harbour organization id, e.g. fourier."
+      "description": "Isomorph organization id, e.g. fourier."
     },
     "app": {
       "type": "string",
       "minLength": 1,
-      "description": "Harbour app id within the org, e.g. focuslist."
+      "description": "Isomorph app id within the org, e.g. focuslist."
     },
     "env": {
       "type": "string",

package/schema/security-verdict.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/security-verdict.schema.json",
   "title": "SecurityVerdict",
-  "description": "Decision produced by the Harbour Security Assurance machine (Security Assurance LLD §2). `outcome: BLOCKED` surfaces to callers as the registered non-retryable `gate.security-scan` error category; `reason` is present exactly when BLOCKED. The S3 evidence object named by `evidenceRef` is the full record — in-payload findings may be truncated.",
+  "description": "Decision produced by the Isomorph Security Assurance machine (Security Assurance LLD §2). `outcome: BLOCKED` surfaces to callers as the registered non-retryable `gate.security-scan` error category; `reason` is present exactly when BLOCKED. The S3 evidence object named by `evidenceRef` is the full record — in-payload findings may be truncated.",
   "type": "object",
   "additionalProperties": false,
   "required": ["outcome", "profile", "evidence", "evidenceRef", "provenance"],
@@ -20,7 +20,7 @@
     "reason": {
       "type": "string",
       "minLength": 1,
-      "description": "Human-readable cause, present when outcome is BLOCKED; becomes the Fail-state cause of HarbourSecurityBlocked."
+      "description": "Human-readable cause, present when outcome is BLOCKED; becomes the cause carried by the Security Assurance state machine's `HarbourSecurityBlocked` fail state."
     },
     "evidence": {
       "type": "object",

package/schema/transform-report.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/transform-report.schema.json",
   "title": "TransformReport",
-  "description": "Structured output an agent must return from one Harbour transformation attempt. Handed to the agent as its output schema, then decoded and semantically re-validated by the control plane, which remains the authority. The enum on applied_playbooks.items is the one dynamic part: the adapter injects the names of the playbooks supplied for that invocation before writing the document, so the model is structurally prevented from naming a playbook it was not given. Application-secret handling was removed platform-wide, so this document carries no redactions and no secrets fields. A deployable report must also carry preservation_plan: the agent's own grounded smoke tests (one to three happy_path user journeys plus a boundary_check per behaviour its playbooks or edits could regress) that the validation cell executes after transformation, and an uncovered list naming every boundary it could not test and why. It may also carry validation_fixtures: null when no external fixture is needed, or a bounded generic HTTP/WebSocket fixture declaration for that one run; the deployment plane reads the workspace fixture sidecar, so the report's copy is optional. An unsupported report carries only application.unsupported and no plan or fixtures.",
+  "description": "Structured output an agent must return from one Isomorph transformation attempt. Handed to the agent as its output schema, then decoded and semantically re-validated by the control plane, which remains the authority. The enum on applied_playbooks.items is the one dynamic part: the adapter injects the names of the playbooks supplied for that invocation before writing the document, so the model is structurally prevented from naming a playbook it was not given. Application-secret handling was removed platform-wide, so this document carries no redactions and no secrets fields. A deployable report must also carry preservation_plan: the agent's own grounded smoke tests (one to three happy_path user journeys plus a boundary_check per behaviour its playbooks or edits could regress) that the validation cell executes after transformation, and an uncovered list naming every boundary it could not test and why. It may also carry validation_fixtures: null when no external fixture is needed, or a bounded generic HTTP/WebSocket fixture declaration for that one run; the deployment plane reads the workspace fixture sidecar, so the report's copy is optional. An unsupported report carries only application.unsupported and no plan or fixtures.",
   "x-go-embed": true,
   "type": "object",
   "additionalProperties": false,
@@ -25,7 +25,7 @@
       "properties": {
         "deployable": { "type": "boolean" },
         "needsTransformation": {
-          "description": "Whether the attempt changed the tree. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
+          "description": "Whether the attempt changed the tree. Optional: Isomorph derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
           "type": "boolean"
         },
         "blockers": {
@@ -34,7 +34,7 @@
           "items": { "type": "string", "minLength": 1, "maxLength": 1024 }
         },
         "surfaces": {
-          "description": "Paths the attempt touched. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
+          "description": "Paths the attempt touched. Optional: Isomorph derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
           "type": "array",
           "minItems": 1,
           "maxItems": 1024,
@@ -64,26 +64,26 @@
       "properties": {
         "mode": { "type": "string", "enum": ["none", "sql"] },
         "changeType": {
-          "description": "Classification of the changed paths. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
+          "description": "Classification of the changed paths. Optional: Isomorph derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
           "type": "string",
           "enum": ["none", "code_only", "schema_only", "code_and_schema"]
         },
         "requiresCodeChanges": {
-          "description": "Whether any changed path sits outside the database boundary. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
+          "description": "Whether any changed path sits outside the database boundary. Optional: Isomorph derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
           "type": "boolean"
         },
         "requiresSchemaMigration": {
-          "description": "Whether the Aurora bundle grew past its seeded prefix. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
+          "description": "Whether the Aurora bundle grew past its seeded prefix. Optional: Isomorph derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
           "type": "boolean"
         },
         "migrationPaths": {
-          "description": "Migration files in the Aurora bundle. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
+          "description": "Migration files in the Aurora bundle. Optional: Isomorph derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
           "type": "array",
           "maxItems": 128,
           "items": { "type": "string", "minLength": 1, "maxLength": 512 }
         },
         "changedFiles": {
-          "description": "Changed paths on the database boundary. Optional: Harbour derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
+          "description": "Changed paths on the database boundary. Optional: Isomorph derives this from the transformed workspace, so a deployable report may omit it and one that still carries it stays valid.",
           "type": "array",
           "maxItems": 512,
           "items": { "type": "string", "minLength": 1, "maxLength": 512 }
@@ -132,7 +132,7 @@
               "kind": { "type": "string", "enum": ["happy_path", "boundary_check"] },
               "name": { "type": "string", "minLength": 1, "maxLength": 120 },
               "boundaries": {
-                "description": "Transformation boundaries this test claims to cover. Optional: Harbour derives them from the test's own evidence paths, so a deployable report may omit them and one that still carries them stays valid.",
+                "description": "Transformation boundaries this test claims to cover. Optional: Isomorph derives them from the test's own evidence paths, so a deployable report may omit them and one that still carries them stays valid.",
                 "type": "array",
                 "minItems": 1,
                 "maxItems": 8,
@@ -215,7 +215,7 @@
             "required": ["reason"],
             "properties": {
               "boundary": {
-                "description": "Optional: Harbour derives the uncovered boundaries from the changed paths and the covered set, so a deployable report may omit this and one that still carries it stays valid.",
+                "description": "Optional: Isomorph derives the uncovered boundaries from the changed paths and the covered set, so a deployable report may omit this and one that still carries it stays valid.",
                 "type": "string",
                 "enum": ["application", "routing", "database", "authentication", "runtime_dependency", "files", "provider", "background_work"]
               },
@@ -383,7 +383,7 @@
           ]
         },
         "validationSeed": {
-          "description": "Build-only PostgreSQL bootstrap for authenticated browser validation. Use null when the application does not require a pre-existing database identity. The SQL file runs only in Harbour's throwaway validation database after migrations and before candidate boot. Harbour supplies the fixed probe subject and lowercased email as transaction-local settings.",
+          "description": "Build-only PostgreSQL bootstrap for authenticated browser validation. Use null when the application does not require a pre-existing database identity. The SQL file runs only in Isomorph's throwaway validation database after migrations and before candidate boot. Isomorph supplies the fixed probe subject and lowercased email as transaction-local settings.",
           "anyOf": [
             {
               "type": "object",

package/schema/well-defined-app-manifest.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/well-defined-app-manifest.schema.json",
   "title": "WellDefinedAppManifest",
-  "description": "Versioned provisioning input emitted by Harbour Transform. It describes runtime wiring and workload lifecycle only; PostgreSQL grants and RLS remain the database authorization authority.",
+  "description": "Versioned provisioning input emitted by Isomorph Transform. It describes runtime wiring and workload lifecycle only; PostgreSQL grants and RLS remain the database authorization authority.",
   "type": "object",
   "additionalProperties": false,
   "required": ["version", "architecture", "workloads", "bindings"],
@@ -15,7 +15,7 @@
     "sdkMajor": {
       "type": "integer",
       "const": 1,
-      "description": "Required only when transformed browser code uses @harbour/app-sdk."
+      "description": "Required only when transformed browser code uses @isomorph.ai/app-sdk."
     },
     "workloads": {
       "type": "array",
@@ -37,11 +37,11 @@
       "maxItems": 5,
       "uniqueItems": true,
       "items": { "$ref": "#/definitions/Capability" },
-      "description": "Optional declaration of the Harbour browser capabilities the application uses. Same closed set as the app-capabilities document; this is the declaration, not a source scan."
+      "description": "Optional declaration of the Isomorph browser capabilities the application uses. Same closed set as the app-capabilities document; this is the declaration, not a source scan."
     },
     "routeAuth": {
       "$ref": "#/definitions/RouteAuth",
-      "description": "Optional method/path authentication policy. Omitted means every route requires Harbour SSO, the same default the policy states explicitly."
+      "description": "Optional method/path authentication policy. Omitted means every route requires Isomorph SSO, the same default the policy states explicitly."
     }
   },
   "definitions": {
@@ -53,7 +53,7 @@
       "type": "object",
       "additionalProperties": false,
       "required": ["default", "public"],
-      "description": "Harbour SSO is required by default; the public list is the only way a route escapes it, and each entry names the methods and the application-authorized mode so the artifact contract's route_auth can be built from this document alone.",
+      "description": "Isomorph SSO is required by default; the public list is the only way a route escapes it, and each entry names the methods and the application-authorized mode so the artifact contract's route_auth can be built from this document alone.",
       "properties": {
         "default": {
           "type": "string",