@isomorph.ai/cli 0.3.0 → 0.3.1-rc.2

package/README.md

@@ -36,12 +36,14 @@ isomorph integrations catalog --app-root <path> [--json]   the company's connect
 isomorph integrations request <connection> --app-root <path> [--reason <text>]   one request per connection; IT approves it once for every environment (`isomorph dev` and `isomorph productionise` file it for you)
 isomorph integrations status --app-root <path> [--json]
 isomorph connect <work-email | company-start-url>                 once per company; then isomorph login | logout
-isomorph productionise --app-root <path> [--wait] [--json]  save + preview deployment, prints the protected link
-isomorph status | retry | promote | setup | profile | audience | secrets … --operation <reference>
+isomorph productionise --app-root <path> [--confirm-save] [--json]  save + preview deployment, prints the protected link
+isomorph status | retry | promote | setup | profile | audience | secrets … --operation <reference>   (promote: [--confirm-tested])
 ```
 
 `productionise`, `status --wait`, `retry` and `promote` follow the deployment for up to `--max-wait <seconds>` (default 30 minutes). Past that they exit 0 with `status: "RUNNING"` and the `isomorph status --operation <reference> --wait --max-wait 120 --json` that continues the same deployment — a bounded wait is not a failure, and never a reason to start another deploy.
 
+`productionise` and `promote` each stop for a typed reply — `Approved.` before the app files are copied to the company code system, `Tested.` before the preview is released. `--confirm-save` and `--confirm-tested` give that same reply on the command line when nobody can type it.
+
 `isomorph --help` prints the full usage. Local commands need no company sign-in; integrations and shipping do.
 
 ## Apps set up by the old `harbour` CLI

package/dist/packages/harbour-cli/src/agent-setup.js

@@ -220,8 +220,8 @@ The kit's rules are the files beside this one: \`core.md\` before the first edit
 - "does it work?", and before you report anything as working → open the dev link in your own browser, press the control you built or changed, and read what the app shows. A green \`isomorph check\` is not that proof: fixtures answer AI and company systems, so their refusals appear only when the control is really pressed. Test rendering, navigation, fixtures and approved reads automatically; a Send in development is real: reuse explicit authorization for that bounded test, or ask once if none exists (IT approval alone is not permission to send). If you have no browser, say that the button itself is untested.
 - "I need Slack / Gmail / the warehouse / company data" → read \`integrations.md\` beside this skill first; then, in the same turn, read the catalog, declare only what the app calls, submit the access request yourself, and say READY or PENDING in one line.
 - "summarise", "draft", "explain", "AI" → read \`ai.md\` beside this skill first; then one call behind a control they press.
-- "ship it", "put it online", "let my team try it" → \`isomorph check --app-root . --json\` first, unasked, and fix everything it finds: the same gates run again in the cloud, minutes per attempt. Before sharing or deploying the private preview, show the exact proposed app name, description and audience that will be passed to Isomorph (say "only you" when the audience is empty) and ask for one confirmation or correction covering all three; do not run \`productionise\` until they confirm. Then \`isomorph productionise --app-root . --name "<app name>" --description "<description>" --emails "<comma-separated audience>" --wait --json\` (omit \`--emails\` for "only you"). It records the confirmed setup before uploading or deploying the app, files the access request for each declared connection itself and refuses with \`INTEGRATIONS_NOT_READY\` naming what IT still has to approve, or with \`AI_NOT_READY\` and the one IT step — say that line and nothing more; the app works without them until then. \`result.deployment.protectedUrl\` is the private preview, for them and the confirmed audience after company sign-in. If your tool cuts it off, \`${continueCommand("<ref>")}\` continues the same deployment — never start another one to find out what happened; \`TRANSFORMING\` means building and checking.
-- "make it live for everyone", "go to production" → only after they have tried the preview. Before \`isomorph promote --operation <ref> --json\`, show the exact app name, description and production audience again and ask for one confirmation or correction covering all three; never promote a profile or audience the person has not just seen and confirmed. Report the production link, or that an operator approval is pending.
+- "ship it", "put it online", "let my team try it" → \`isomorph check --app-root . --json\` first, unasked; fix everything it finds: the same gates rerun in the cloud, minutes per attempt. Before sharing or deploying the private preview, show the exact proposed app name, description and audience that will be passed to Isomorph (say "only you" when the audience is empty); ask for one confirmation or correction covering all three; do not run \`productionise\` until they confirm. \`isomorph productionise --app-root . --name "<app name>" --description "<description>" --emails "<comma-separated audience>" --confirm-save --json\` (omit \`--emails\` for "only you"; \`--confirm-save\` is the approval they just gave). It records the confirmed setup before uploading or deploying the app, files the access request for each declared connection itself and refuses with \`INTEGRATIONS_NOT_READY\` naming what IT still has to approve, or \`AI_NOT_READY\` and the one IT step: relay that line only; the app works without them until then. \`result.deployment.protectedUrl\` is the private preview, for them and the confirmed audience after company sign-in. If your tool cuts it off, \`${continueCommand("<ref>")}\` continues the same deployment; never start another one to find out what happened; \`TRANSFORMING\` means building and checking.
+- "make it live for everyone", "go to production" → only after they have tried the preview, which \`--confirm-tested\` states. Before \`isomorph promote --operation <ref> --confirm-tested --json\`, show the exact app name, description and production audience again; ask for one confirmation or correction covering all three; never promote a profile or audience the person has not just seen and confirmed. Report the production link, or that operator approval is pending.
 - "stop it" → \`isomorph stop --app-root .\` (data kept); \`isomorph dev --reset --app-root .\` deletes local data, only when they ask to start over.
 - "every day at 2pm", "run this on a schedule", "send this automatically" → read \`jobs.md\` beside this skill first; then write the job, run it once with \`isomorph jobs run\`, and say the sentence it gives you.
 

package/dist/packages/harbour-cli/src/app-schema.js

@@ -144,3 +144,7 @@ export function numericMinimum(checks, column) {
     }
     return minimum;
 }
+/** Whether `col <= n` / `col < n` caps the column: the mirror of `numericMinimum`, asked so no invented value is written into a range the app's own CHECK does not admit. */
+export function hasNumericMaximum(checks, column) {
+    return checks.some(check => new RegExp(String.raw `\b${column}\b[^<>=]*(?:<=|<)\s*-?\d+(?:\.\d+)?`, "i").test(check));
+}

package/dist/packages/harbour-cli/src/check.js

@@ -1,5 +1,6 @@
 import { readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
+import { pathToFileURL } from "node:url";
 import { readAppSchema } from "./app-schema.js";
 import { describeRetainedChecks, syncRetainedChecks } from "./retained-checks.js";
 import { CliError } from "./output.js";
@@ -158,7 +159,7 @@ export async function runKitGate(root, options) {
                     output("Running the retained journeys against the gate's App Gateway.");
                 }
                 const name = state.current;
-                const result = await run("node", [join(kitPaths(root).checks, name)], { cwd: root, quiet: true, env: { ...state.environment, ISOMORPH_SDK_MODULE: join(root, "node_modules", ...bundle.sdk.package.split("/"), "dist", "index.js"), NODE_NO_WARNINGS: "1" } });
+                const result = await run("node", [join(kitPaths(root).checks, name)], { cwd: root, quiet: true, env: { ...state.environment, ISOMORPH_SDK_MODULE: sdkModuleSpecifier(root, bundle), NODE_NO_WARNINGS: "1" } });
                 const posted = await post(`/_gate/journeys/${encodeURIComponent(name)}`, { code: result.code, output: `${result.stdout}${result.stderr}`.slice(-4000) });
                 if (posted?.status !== 200)
                     throw new CliError("LOCAL_RUNTIME_FAILED", `The kit gate did not accept the result of ${name}.`);
@@ -175,6 +176,21 @@ export async function runKitGate(root, options) {
             await runtime.down();
     }
 }
+/**
+ * The SDK a generated journey imports, as a `file://` URL rather than a path.
+ *
+ * The journey does `await import(process.env.ISOMORPH_SDK_MODULE)`, and on
+ * Windows a bare absolute path is not a specifier `import()` accepts: Node
+ * reads the drive letter in `D:\\app\\node_modules\\…` as a URL scheme and
+ * refuses it with ERR_UNSUPPORTED_ESM_URL_SCHEME. Every journey on Windows
+ * therefore failed before it reached its first assertion. It went unseen
+ * because `isomorph check` reported those failures and still exited 0 (a
+ * dependency's `beforeExit` hook overwrote `process.exitCode`, fixed in
+ * 0.3.1-rc.1), so the Windows lane read the run as a pass.
+ */
+export function sdkModuleSpecifier(root, bundle) {
+    return pathToFileURL(join(root, "node_modules", ...bundle.sdk.package.split("/"), "dist", "index.js")).href;
+}
 /**
  * `.isomorph/checks/` is generated from what the app declares — the tables the
  * gate's replayed database holds, the capabilities the gate derived from the

package/dist/packages/harbour-cli/src/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { RemoteMcpClient } from "./remote-mcp-client.js";
-import { appCallsAi, productionise } from "./productionise.js";
-import { confirmAudience, confirmProfile, continueCommand, dismissSecret, fetchStatus, follow, getAppSetup, listSecrets, promoteToProduction, readSecretFromStdin, readSecretFromTerminal, retryDeployment, setSecret, summarize } from "./operations.js";
+import { appCallsAi, productionise, SAVE_APPROVAL } from "./productionise.js";
+import { confirmAudience, confirmProfile, continueCommand, dismissSecret, fetchStatus, follow, getAppSetup, listSecrets, promoteToProduction, PROMOTION_CONFIRMATION, readSecretFromStdin, readSecretFromTerminal, retryDeployment, setSecret, summarize } from "./operations.js";
 import { CliError, failureEnvelope, operationEnvelope, renderFailure, renderSummary } from "./output.js";
 import { CLI_VERSION } from "./version.js";
 import { connectedAccount, login, logout, refreshStoredToken } from "./auth.js";
@@ -28,6 +28,9 @@ const profileDescription = optionValue("--description");
 const audienceEmails = optionValue("--emails");
 const personal = args.includes("--personal");
 const valueStdin = args.includes("--value-stdin");
+/** The reply the save and promote prompts would otherwise wait to have typed, for a caller with no terminal. */
+const confirmSave = args.includes("--confirm-save");
+const confirmTested = args.includes("--confirm-tested");
 const subcommand = args[1] && !args[1].startsWith("--") ? args[1] : undefined;
 const wait = args.includes("--wait");
 const reset = args.includes("--reset");
@@ -62,10 +65,10 @@ const usage = [
     "Usage:",
     "  isomorph connect <work-email | company-start-url>",
     "  isomorph login | logout",
-    "  isomorph productionise --app-root <path> [--include <relative-path>]... [--name <text> --description <text> [--emails a@co,b@co]] [--no-wait] [--max-wait <seconds>] [--json]",
+    "  isomorph productionise --app-root <path> [--include <relative-path>]... [--name <text> --description <text> [--emails a@co,b@co]] [--confirm-save] [--no-wait] [--max-wait <seconds>] [--json]",
     "  isomorph status --operation <reference> [--wait] [--max-wait <seconds>] [--json]",
     "  isomorph retry --operation <reference> [--no-wait] [--max-wait <seconds>] [--json]",
-    "  isomorph promote --operation <reference> [--app-root <path>] [--no-wait] [--max-wait <seconds>] [--json]   (--app-root: also confirm the company's AI setup for production when the app calls governed AI)",
+    "  isomorph promote --operation <reference> [--app-root <path>] [--confirm-tested] [--no-wait] [--max-wait <seconds>] [--json]   (--app-root: also confirm the company's AI setup for production when the app calls governed AI)",
     "  isomorph setup --operation <reference> [--json]            what the app still needs (name, audience, secrets)",
     "  isomorph profile --operation <reference> [--name <text>] [--description <text>] [--json]",
     "  isomorph audience --operation <reference> [--emails a@co,b@co] [--json]   (no --emails = only you)",
@@ -83,6 +86,7 @@ const usage = [
     "  isomorph integrations catalog --app-root <path> [--json]   the company's connections as .isomorph/integrations.json names them: identifiers, allowed operations, approved channels/tables/views/mailboxes per environment (no app needed)",
     "Run `isomorph connect <work-email>` once; sign in with `isomorph login` when Isomorph asks.",
     "productionise saves the app, follows its deployment, and prints the protected preview link; promote sends a tested preview to production.",
+    "productionise stops for a typed `Approved.` before it copies the app files to the company code system, and promote for a typed `Tested.` before it releases the preview. --confirm-save and --confirm-tested give that same reply on the command line when nobody can type it; the approval recorded is the one made by whoever ran the command.",
     `--max-wait bounds how long productionise, status --wait, retry and promote follow the deployment (default 30 minutes). When it passes the command exits 0 with status RUNNING, the last known deployment state, and the \`${continueCommand("<reference>")}\` that continues the same deployment: a bounded wait is not a failure and never means start another one.`,
     "For kit apps, productionise first files the access request for every connection in .isomorph/integrations.json (one per connection; IT approves it once for every environment) and exits 2 (INTEGRATIONS_NOT_READY) naming what IT still has to approve, asks governance whether the company's AI setup is ready when the app calls governed AI (exit 2, AI_NOT_READY, with the IT step), then runs the pipeline's kit gate in the local session and refuses (KIT_GATE_FAILED) what CodeBuild would refuse. promote asks the same AI question for production when --app-root names the app.",
     "secrets set reads the value from your terminal with echo off (or from stdin with --value-stdin); it is never printed or passed to any other program.",
@@ -95,6 +99,14 @@ const progress = (message) => { process.stderr.write(`${message}\n`); };
 const summaryEnvelope = (result) => ({ schema: "isomorph.cli-result/1.0", cliVersion: CLI_VERSION, status: "SUCCEEDED", operationStarted: false, result });
 /** `line` is the human form for a command whose result is a sentence, not a summary. */
 const emit = (value, line) => { process.stdout.write(json ? `${JSON.stringify(value)}\n` : line ?? renderSummary(value)); process.exitCode = 0; };
+/**
+ * The command's last bytes, then its exit code. Every non-zero exit goes through
+ * here: `process.exitCode` is not ours alone — a dependency's `beforeExit` hook
+ * overwrites it (see local-runtime.ts) — and `process.exit` on its own truncates
+ * a write still in flight when the stream is a pipe rather than a terminal,
+ * which is how an agent or a CI job reads this CLI. Both writes flush first.
+ */
+const exitAfterWriting = (code, out, err = "") => { process.stderr.write(err, () => process.stdout.write(out, () => process.exit(code))); };
 /** Exit 2, like a usage error: nothing started and the fix is a command the maker runs. */
 const USAGE_REFUSALS = ["INTEGRATIONS_NOT_READY", "AI_NOT_READY", "NOT_A_MEMBER", "TENANT_AMBIGUOUS", "NOT_A_START_LINK", "PLATFORM_UNREACHABLE"];
 if (command === "--version" || command === "version") {
@@ -127,10 +139,7 @@ else if (!["connect", "login", "logout", "productionise", "integrations", ...LOC
     || (command === "integrations" && (!root || !subcommand || !["request", "status", "catalog"].includes(subcommand) || (subcommand === "request" && (!args[2] || args[2].startsWith("--")))))
     || (OPERATION_COMMANDS.includes(command) && !operationRef)
     || (command === "secrets" && (!subcommand || !["list", "set", "dismiss"].includes(subcommand) || (subcommand !== "list" && !secretName)))) {
-    if (optionError)
-        process.stderr.write(`${optionError}\n`);
-    process.stderr.write(usage);
-    process.exit(2);
+    exitAfterWriting(2, "", `${optionError ? `${optionError}\n` : ""}${usage}`);
 }
 else {
     try {
@@ -192,10 +201,8 @@ else {
                     governance = new GovernanceClient(config.apiUrl, token, config.tenantId);
                 }
                 const report = await runChecks(target, { run: runCommand, bundle, output: progress, governance });
-                if (!report.passed) {
-                    process.stdout.write(json ? `${JSON.stringify({ ...summaryEnvelope(report), status: "FAILED", error: { code: "CHECKS_FAILED", message: "One or more checks failed; see .isomorph/local/check-report.json." } })}\n` : "Checks failed; see .isomorph/local/check-report.json.\n");
-                    process.exitCode = 1;
-                }
+                if (!report.passed)
+                    exitAfterWriting(1, json ? `${JSON.stringify({ ...summaryEnvelope(report), status: "FAILED", error: { code: "CHECKS_FAILED", message: "One or more checks failed; see .isomorph/local/check-report.json." } })}\n` : "Checks failed; see .isomorph/local/check-report.json.\n");
                 else
                     emit(summaryEnvelope(report));
             }
@@ -257,7 +264,7 @@ else {
                         ? { displayName: profileName, description: profileDescription, audienceEmails: audienceEmails ? audienceEmails.split(",").map(value => value.trim()).filter(Boolean) : [] }
                         : undefined;
                     await assertKitCurrent(appRoot(root));
-                    const result = await productionise(root, client, progress, tenant, includePaths, { waitForDeployment: !noWait, waitOptions, integrations: { governance: new GovernanceClient(config.apiUrl, token, tenant), bundle: EMBEDDED_KIT_BUNDLE }, ...(confirmedAppSetup ? { confirmedAppSetup } : {}) });
+                    const result = await productionise(root, client, progress, tenant, includePaths, { waitForDeployment: !noWait, waitOptions, integrations: { governance: new GovernanceClient(config.apiUrl, token, tenant), bundle: EMBEDDED_KIT_BUNDLE }, ...(confirmSave ? { readApproval: async () => SAVE_APPROVAL } : {}), ...(confirmedAppSetup ? { confirmedAppSetup } : {}) });
                     envelope = operationEnvelope(result.result, result.operationRef, CLI_VERSION);
                 }
                 else {
@@ -273,7 +280,7 @@ else {
                             if (lock?.appId)
                                 await assertAiReady(lock.appId, "production", new GovernanceClient(config.apiUrl, token, tenant), progress);
                         }
-                        summary = await promoteToProduction(client, operationRef, progress, { wait: !noWait, waitOptions });
+                        summary = await promoteToProduction(client, operationRef, progress, { wait: !noWait, waitOptions, ...(confirmTested ? { readConfirmation: async () => PROMOTION_CONFIRMATION } : {}) });
                     }
                     else if (command === "setup")
                         summary = { setup: await getAppSetup(client, operationRef) };
@@ -295,10 +302,7 @@ else {
     }
     catch (error) {
         const envelope = failureEnvelope(error, CLI_VERSION);
-        process.stderr.write(renderFailure(envelope));
-        if (json || command === "productionise")
-            process.stdout.write(`${JSON.stringify(envelope)}\n`);
-        process.exit(USAGE_REFUSALS.includes(envelope.error?.code ?? "") ? 2 : 1);
+        exitAfterWriting(USAGE_REFUSALS.includes(envelope.error?.code ?? "") ? 2 : 1, json || command === "productionise" ? `${JSON.stringify(envelope)}\n` : "", renderFailure(envelope));
     }
 }
 /** One line per (connection, identity): the three lanes are one approval, so they are read together. */

package/dist/packages/harbour-cli/src/guide.js

@@ -13,21 +13,23 @@ export const GUIDE_MODULES = {
 
 ## The SDK is the only door
 
-\`@isomorph.ai/app-sdk\`, on the client exported by \`src/isomorph.client.ts\`, is the whole path: \`isomorph.identity.current()\`, \`isomorph.data.from(table)\`, \`isomorph.files.*\`, \`isomorph.realtime.*\`, \`isomorph.integrations.execute\` (integrations.md) and \`isomorph.ai.chat\` (ai.md). Never open a database, bucket or company URL from browser code; never add another backend, auth library, deployment config, provider key or SDK. No secrets, tokens, \`.env\` values or fetched company content in source. Commit \`.isomorph/integrations.json\` and \`.isomorph/kit.lock.json\`, never \`.isomorph/local/\`.
+\`@isomorph.ai/app-sdk\`, on the client \`src/isomorph.client.ts\` exports, is the whole path: \`isomorph.identity.current()\`, \`isomorph.data.from(table)\`, \`isomorph.files.*\`, \`isomorph.realtime.*\`, \`isomorph.integrations.execute\` (integrations.md), \`isomorph.ai.chat\` (ai.md). Never open a database, bucket or company URL from browser code; never add a backend, auth library, deployment config, provider key or SDK. No secrets, tokens, \`.env\` values or fetched company content in source. Commit \`.isomorph/integrations.json\` and \`.isomorph/kit.lock.json\`, never \`.isomorph/local/\`.
 
 ## Identity
 
-Isomorph SSO signs everyone in: no login forms, no roles or ids trusted from the browser, no public routes or wildcard exceptions. \`isomorph.identity.current()\` answers \`{ id, email }\` only — no display name; derive one from the email.
+Isomorph SSO signs everyone in: no login forms, no browser-trusted roles or ids, no public routes. \`isomorph.identity.current()\` answers \`{ id, email }\` only; derive a display name from the address.
 
 ## Data (\`core.rls-owner-scoped\`)
 
-Schema changes are SQL files in \`migrations/\`, applied by \`isomorph dev\` and \`isomorph check\`. Every table: \`ENABLE ROW LEVEL SECURITY\`, a policy, and \`GRANT\` of every verb a policy allows to \`harbour_app_gateway\` and no other role; the database gate names whatever breaks this. Row ownership is decided in SQL through \`current_setting('harbour.user_id', true)\` (set by the gateway per request, with \`harbour.user_email\`), never in the browser. Two patterns:
+Schema changes are SQL files in \`migrations/\`. Every table: \`ENABLE ROW LEVEL SECURITY\`, a policy, and \`GRANT\` of every verb it allows to \`harbour_app_gateway\` and no other role. Row ownership is decided in SQL through \`current_setting('harbour.user_id', true)\` (set by the gateway per request, with \`harbour.user_email\`), never in the browser. Two patterns:
 
-- **Private table** — every policy scoped to \`current_setting('harbour.user_id', true)\`; the gate then asserts a second signed-in person cannot read, update or delete another person's row.
-- **Shared-read, owner-write** — \`USING (true)\` for SELECT; INSERT, UPDATE and DELETE scoped to the identity setting.
+- **Private table** — every policy scoped to that setting; the gate asserts another signed-in person cannot read, update or delete the row.
+- **Shared-read, owner-write** — \`USING (true)\` for SELECT; INSERT, UPDATE and DELETE scoped to that setting.
 
 The gate treats a table as private when any of its policies mentions \`harbour.user_id\` (or \`harbour.user_email\`), so a shared-read table must keep that setting out of its SELECT policy, or its cross-user read check fails.
 
+Iterating on the schema needs no restart: every \`isomorph check\` replays \`migrations/*.sql\` into a fresh, empty scratch database. \`isomorph dev --reset\` only refreshes the running app's own data, so its UI shows the new schema; stopping, resetting and waiting before each check costs minutes and changes nothing.
+
 ## Files
 
 \`isomorph.files.upload(path, file)\`, \`list(prefix)\` and \`remove([path])\`.
@@ -38,45 +40,47 @@ The gate treats a table as private when any of its policies mentions \`harbour.u
 
 ## Retained checks (\`core.journey-fk\`)
 
-\`.isomorph/checks/\` holds one journey per capability the app's code uses plus a cross-user denial per private table. \`isomorph check\` generates them from \`migrations/\` and \`src/\` and deletes the ones the app no longer needs, so run it in the same edit that changes the app; never write or remove these files by hand. A generated check starts with \`// isomorph:generated\` and a digest of its body; edit one and it is yours — kept, no longer updated, never deleted — so delete it yourself in the same edit that removes the feature it covers. The pairing is two-way: the \`flow\` gate refuses a capability no check exercises and a check exercising something the code no longer does (\`flow.check-failed\`) — the most common reason a first deploy is refused. What cannot be generated (\`actions\`, \`realtime\`, a table with no migration) is named for you to write. No journey is generated for a table whose row needs a parent (a foreign key): write that table's journey yourself.
+\`.isomorph/checks/\` holds one journey per capability the app uses, plus a cross-user denial per private table. \`isomorph check\` generates them from \`migrations/\` and \`src/\` and deletes what the app dropped, so run it in the edit that changes the app; never write or remove them by hand. A generated check starts with \`// isomorph:generated\` and a digest of its body; edit one and it is yours: kept, never updated or deleted, so delete it in the same edit that drops the feature. Two-way (\`flow.check-failed\`): the \`flow\` gate refuses a capability no check exercises, and a check exercising what the code dropped — the most common first-deploy refusal. What cannot be generated (\`actions\`, \`realtime\`, a table with no migration) is named for you to write. No journey is generated for a table whose row needs a parent (a foreign key): write that table's journey yourself.
+
+A journey failing on a CHECK constraint: generation marks the row by the first free text or number column with no foreign key, no allowed-values CHECK and no ceiling on a number, so that column's other CHECKs must admit an arbitrary unique value. Only the generated file names the column.
 
 ## Commands
 
-- \`isomorph dev --app-root .\` — local Postgres, storage, gateway and Vite behind one loopback origin; company calls use the \`isomorph login\` account.
-- \`isomorph check --app-root . --json\` — types, build, then the pipeline's own kit gate locally (declaration, database gate, write probe with cross-user denial, journeys, operation coverage); report in \`.isomorph/local/check-report.json\`.
-- \`isomorph productionise --app-root . …\` — saves and deploys the private preview; \`isomorph promote\` after the person has tried it.
+- \`isomorph dev --app-root .\` — local Postgres, storage, gateway and Vite on one origin; company calls use the \`isomorph login\` account.
+- \`isomorph check --app-root . --json\` — types, build, then the pipeline's kit gate locally (declaration, database, write probe, journeys, coverage).
+- \`isomorph productionise --app-root . …\` — private preview; \`isomorph promote\` makes it live.
 
 ## Error codes
 
-- \`CONFIG_REQUIRED\`: no company connected — \`isomorph connect <work-email>\`.
-- \`AUTH_REQUIRED\`: sign in — \`isomorph login\`.
-- \`NOT_A_MEMBER\` / \`TENANT_AMBIGUOUS\`: no company, or more than one, admits that email domain — use the command it printed or IT's link.
-- \`CHECKS_FAILED\` / \`CHECKS_STALE\`: fix what \`isomorph check\` reports and run it again on this exact code.
+- \`CONFIG_REQUIRED\`: \`isomorph connect <work-email>\`; \`AUTH_REQUIRED\`: \`isomorph login\`.
+- \`NOT_A_MEMBER\` / \`TENANT_AMBIGUOUS\`: use the command it printed or IT's link.
+- \`CHECKS_FAILED\` / \`CHECKS_STALE\`: fix what \`isomorph check\` reports, then rerun on this code.
 - \`APP_NOT_FOUND\`: the app is linked to another company — connect back to it with its start link, or clear \`appId\` and \`tenantId\` in \`.isomorph/kit.lock.json\` to relink.
-- \`INTEGRATIONS_NOT_READY\`: IT has not approved a declared connection yet (integrations.md).
-- \`AI_NOT_READY\`: IT has not enabled the company's AI setup yet (ai.md).`,
+- \`INTEGRATIONS_NOT_READY\` / \`AI_NOT_READY\`: IT has not approved the connection (integrations.md) or enabled AI (ai.md).`,
     integrations: `# Company systems (Slack, Gmail, warehouse)
 
 ## Declare
 
-Reach company systems only through \`isomorph.integrations.execute(connection, { operation, resource, input })\`, declared in \`.isomorph/integrations.json\`. Operations, a closed set: \`slack.channel.history\` (user identity), \`slack.message.post\` (app or user identity, declared per app), \`gmail.thread.list\`, \`gmail.message.read\` and \`gmail.message.send\` (user identity, resource \`inbox\`, plain-text send), \`warehouse.view.read\` (app identity). Resources are logical names, never IDs, URLs or tokens. The file starts as \`"connections": {}\`: declare a connection only when the app really calls it, by the identifier the catalog lists, with only the operations it calls — each declared connection blocks the deploy until IT grants it, and an undeclared one cannot be requested (\`CONNECTION_NOT_DECLARED\`). Strict JSON, no comments.
+Reach company systems only through \`isomorph.integrations.execute(connection, { operation, resource, input })\`, declared in \`.isomorph/integrations.json\`. Operations, a closed set: \`slack.channel.history\` (user identity), \`slack.message.post\` (app or user identity, declared per app), \`gmail.thread.list\`, \`gmail.message.read\` and \`gmail.message.send\` (user identity, resource \`inbox\`, plain-text send), \`warehouse.view.read\` (app identity). Resources are logical names, never IDs, URLs or tokens. The file starts as \`"connections": {}\`: declare one only when the app calls it, by the catalog's identifier, with only the operations it calls — each declared connection blocks the deploy until IT grants it; an undeclared one cannot be requested (\`CONNECTION_NOT_DECLARED\`). Strict JSON, no comments.
 
 \`\`\`json
 "company-slack": { "kind": "saas", "operations": { "slack.message.post": { "identity": "app", "resources": ["team-updates"] } } },
 "sales-warehouse": { "kind": "database", "operations": { "warehouse.view.read": { "identity": "app", "resources": { "weekly_sales": { "columns": ["week", "total"] } } } } }
 \`\`\`
 
+A connection that was READY reporting PENDING again: widening an approved declaration (another column on a declared resource, or another operation) re-files the request, and a database connection's development lane re-enters provisioning while access is re-minted, so the widened read fails until it republishes. Nothing is revoked: the record stays GRANTED with the resources it had, and the window closes on its own — re-check the status rather than treat it as a blocker.
+
 ## Catalog
 
-Never guess a connection, channel, table, view, mailbox or warehouse column — a guessed name is refused before IT's queue ever sees it. Before writing a warehouse query or mapping response fields, run \`isomorph integrations catalog --app-root . --json\`, select a listed table or view, and copy its listed column names exactly; if the object or column is absent, report that catalog gap instead of substituting a plausible name. A resource whose catalog columns are \`["*"]\` is declared and read with \`["*"]\`: inspect the returned row keys; do not invent a schema or ask IT for one.
+Never guess a connection, channel, table, view, mailbox or warehouse column — a guessed name is refused before IT's queue ever sees it. Before writing a warehouse query or mapping response fields, run \`isomorph integrations catalog --app-root . --json\`, select a listed table or view, and copy its listed column names exactly; if either is absent, report that catalog gap instead of substituting a plausible name. A resource whose catalog columns are \`["*"]\` is declared and read with \`["*"]\`: inspect the returned row keys; never invent a schema.
 
 ## Request
 
-One request per connection; IT approves it once for every environment. \`isomorph dev\` and \`isomorph productionise\` file it for you; \`isomorph integrations request <connection> --reason "<what the app does with it>" --app-root . --json\` files it now — submit the request yourself in the same turn, and never tell the person to ask IT before you have submitted the request.
+One request per connection; IT approves it once for every environment. \`isomorph dev\` and \`isomorph productionise\` file it for you; \`isomorph integrations request <connection> --reason "<why the app needs it>" --app-root . --json\` files it now — submit the request yourself in the same turn, and never tell the person to ask IT before you have submitted the request.
 
 ## Status
 
-READY: use it now. PENDING: say "IT has to approve this; the app works without it until then" and check later with \`isomorph integrations status --app-root . --json\`. Before a real integration test, read that status; show pending IT approval and missing consent separately, and test ready destinations independently. Retained checks that call \`isomorph.integrations.execute\` get the gate's fixture, locally and in the pipeline alike (nothing sent or read; the report says so); only \`isomorph check --integrations\` (reads) exercises real access.
+READY: use it now. PENDING: say "IT has to approve this; the app works without it until then" and check later with \`isomorph integrations status --app-root . --json\`. Before a real integration test read that status: show pending approval and missing consent separately. Retained checks calling \`isomorph.integrations.execute\` get the gate's fixture, locally and in the pipeline (nothing sent or read); only \`isomorph check --integrations\` (reads) exercises real access.
 
 ## Call shape
 
@@ -92,11 +96,11 @@ Input bounds: \`slack.channel.history\` \`input.limit\` 1..15, \`gmail.thread.li
 
 ## Slack modes
 
-\`"identity": "app"\` posts as the company's Slack bot, Isomorph AI, under the connection's \`presentation.displayName\` (optional \`iconEmoji\`), which IT approves — leave it out to post as Isomorph AI itself; every app-mode post ends "Posted by <app> on Isomorph". \`"identity": "user"\` posts as the person after their consent; an older consent answers \`USER_RECONNECT_REQUIRED\` — offer Connect again. Never pretend one is the other. The declaration is the mode requested; the call names the approved mode it runs under (\`mode: "app"\` or \`"user"\`): optional with one approved mode, required with both (\`MODE_REQUIRED\`), and an unapproved mode is \`MODE_NOT_GRANTED\`, never swapped. \`RESOURCE_NOT_APPROVED\` on a post: the bot is not in the channel — say "IT (or anyone in the channel) has to run \`/invite @Isomorph AI\` in #<channel> first". On a request: the resource is not on the connection yet — IT adds it in the console under Controls & integrations, then you run the same request again.
+\`"identity": "app"\` posts as the company's Slack bot, Isomorph AI, under the connection's IT-approved \`presentation.displayName\` (optional \`iconEmoji\`); omit it to post as Isomorph AI itself. \`"identity": "user"\` posts as the person after their consent; an older consent answers \`USER_RECONNECT_REQUIRED\`: offer Connect again. Never pretend one is the other. The call names the approved mode it runs under (\`mode: "app"\` or \`"user"\`): optional with one approved mode, required with both (\`MODE_REQUIRED\`); an unapproved mode is \`MODE_NOT_GRANTED\`, never swapped. \`RESOURCE_NOT_APPROVED\` on a post: the bot is not in the channel — say "IT (or anyone in the channel) runs \`/invite @Isomorph AI\` in #<channel>". On a request: the resource is not on the connection yet — IT adds it in the console under Controls & integrations, then run the same request again.
 
 ## Consent
 
-Only user-identity operations (\`slack.channel.history\`, \`gmail.thread.list\`, \`gmail.message.read\`, \`gmail.message.send\`, and \`slack.message.post\` declared \`"identity": "user"\`) need it; build the flow in unasked, during the original implementation: the operation's control calls \`isomorph.integrations.connect(connection)\`, follows \`authorizationUrl\` when the result is \`consent_required\`, returns to a clear connected state and lets the person continue. Consent starts only from that person's control, never on page load; missing consent never falls back to another account. App-identity operations (\`slack.message.post\` declared \`"identity": "app"\`, \`warehouse.view.read\`) never call connect — it is refused as unapproved user access and puts nothing in IT's queue.
+Only user-identity operations (\`slack.channel.history\`, \`gmail.thread.list\`, \`gmail.message.read\`, \`gmail.message.send\`, and \`slack.message.post\` declared \`"identity": "user"\`) need it; build the flow in unasked, during the original implementation: the operation's control calls \`isomorph.integrations.connect(connection)\`, follows \`authorizationUrl\` when the result is \`consent_required\`, returns to a clear connected state and lets the person continue. Consent starts from that control, never on page load; missing consent never falls back to another account. App-identity operations (\`slack.message.post\` declared \`"identity": "app"\`, \`warehouse.view.read\`) never call connect — it is refused and puts nothing in IT's queue.
 
 ## Sends
 

package/dist/packages/harbour-cli/src/integrations.js

@@ -205,8 +205,24 @@ export function openRequestId(lanes) {
 }
 /** A granted lane past IT's expiry (the server reads it as failed; the sentence says why). */
 const expired = (grant, nowMs) => grant.status === "GRANTED" && Boolean(grant.expiresAt && Date.parse(grant.expiresAt) <= nowMs);
-/** A lane a deploy can run on: granted, unexpired, not still provisioning or failed (a person's consent is asked in the app, at runtime). */
-const laneReady = (grant, nowMs) => grant.status === "GRANTED" && !expired(grant, nowMs) && grant.readiness !== "pending" && grant.readiness !== "failed";
+/**
+ * The worker is minting this lane's credentials right now. `readiness` cannot say so on its own —
+ * the server folds both waits into `pending` — but the grant summary has always carried the
+ * provisioning status beside it, and the two together separate seconds from days: `REQUESTED` waits
+ * on a person at IT, while `PENDING` provisioning follows a decision already taken (IT's, the anchor
+ * rule's, or the connection's development preapproval) and clears itself. Observed 2026-09-14: one
+ * added column re-files an approved warehouse request, the still-GRANTED lanes are re-minted, and
+ * reading that as IT's sent a builder off to report a permanently broken development lane.
+ */
+const minting = (grant) => grant.readiness === "pending" && grant.provisioning === "PENDING";
+/**
+ * Which readiness values can carry a deploy, as a total map so `npm run check` refuses a new
+ * readiness value until this question has been answered for it. A person's consent is asked
+ * inside the running app, so a consent lane deploys.
+ */
+const DEPLOYABLE = { ready: true, consent_required: true, reconnect_required: true, pending: false, failed: false };
+/** A lane a deploy can run on: granted, unexpired, on a readiness that can carry one, and not still being minted — implied by `pending` today, and asked anyway so the gate fails closed if that map ever changes. */
+const laneReady = (grant, nowMs) => grant.status === "GRANTED" && !expired(grant, nowMs) && DEPLOYABLE[grant.readiness] && !minting(grant);
 /** Builder-safe failure guidance as one sentence: what failed, then what to do. */
 export const failureSentence = (failure) => `${failure.message} ${failure.remediation}`;
 const failureError = (failure) => new CliError(failure.code, failureSentence(failure));
@@ -218,12 +234,17 @@ const failureError = (failure) => new CliError(failure.code, failureSentence(fai
  * read right after filing may not carry the anchor yet, so the filing's own
  * request id is the fallback). Development ready while another lane waits is
  * the connection's development preapproval: the server writes that lane at
- * filing time and keeps the request open for IT.
+ * filing time and keeps the request open for IT. A lane the worker is still
+ * minting reads `being set up`: it carries the request it was re-filed under,
+ * but nobody has to decide anything and it clears itself in seconds.
  */
 export function laneSummary(group, requestHint, nowMs = Date.now()) {
     const { lanes } = group;
     const open = openRequestId(lanes) ?? requestHint;
-    const waitingOn = (lane) => { const grant = lanes[lane]; return grant ? (grant.readiness === "pending" ? grant.pendingRequestId ?? requestHint : undefined) : open; };
+    // Only a lane a person still has to decide is named as IT's. A lane being minted is `pending` too and always
+    // carries the request id it was re-filed under, so naming it here was the whole bug — and it also turned a
+    // sibling `ready` development lane into a "(preapproved)" one, as if something were being held back from it.
+    const waitingOn = (lane) => { const grant = lanes[lane]; return grant ? (grant.readiness === "pending" && !minting(grant) ? grant.pendingRequestId ?? requestHint : undefined) : open; };
     const word = (lane) => {
         const grant = lanes[lane];
         const request = waitingOn(lane);
@@ -236,6 +257,8 @@ export function laneSummary(group, requestHint, nowMs = Date.now()) {
             case "ready": return { base: "ready", suffix: lane === "development" && ENVIRONMENTS.some(other => other !== lane && waitingOn(other)) ? ` (preapproved${until})` : until };
             case "consent_required": return { base: "approved", suffix: " (connect your account in the app)" };
             case "reconnect_required": return { base: "approved", suffix: " (reconnect your account in the app)" };
+            // `being set up` is reachable at last: a minting lane is `pending` here too, and `waitingOn` no longer hands
+            // it a request id, so it falls through to the words that were always the right ones for it.
             case "pending": return { base: request ? `waiting for IT (request ${request})` : "being set up", suffix: "" };
             case "failed": return { base: grant.status === "DENIED" ? "denied" : grant.status === "REVOKED" ? "revoked" : "failed", suffix: "" };
         }
@@ -277,6 +300,9 @@ export async function assertPreviewIntegrationsReady(root, client, tenantId, bun
     if (!filed)
         return (await readKitLock(root))?.appId || undefined;
     const nowMs = Date.now();
+    // `awaitsDecision` separates the refusals a person has to act on from a preview lane the worker is
+    // simply still minting: that one refuses too (there are no credentials to deploy against yet), but
+    // saying "Waiting for IT" over it is the same false blocker the minting predicate exists to end.
     const waiting = [];
     for (const item of settled(filed.requests)) {
         const group = findGroup(filed.groups, item.connection, item.identityMode);
@@ -286,17 +312,24 @@ export async function assertPreviewIntegrationsReady(root, client, tenantId, bun
             throw failureError(preview.failure);
         if (preview && laneReady(preview, nowMs))
             continue;
+        if (preview && minting(preview)) {
+            waiting.push({ awaitsDecision: false, line: `${item.connection} ${IDENTITY_WORDS[item.identityMode]} is being set up for the preview; nobody has to approve anything and it finishes on its own.` });
+            continue;
+        }
         const requestId = item.outcome.requestId ?? openRequestId(group.lanes);
-        waiting.push(requestId
-            ? `Waiting for IT: ${item.connection} ${IDENTITY_WORDS[item.identityMode]} (request ${requestId}).`
-            : `${item.connection} ${IDENTITY_WORDS[item.identityMode]} is not ready for the preview (${laneSummary(group, undefined, nowMs)}); ask IT to review this app's access in the Isomorph console.`);
+        waiting.push({ awaitsDecision: true, line: requestId
+                ? `Waiting for IT: ${item.connection} ${IDENTITY_WORDS[item.identityMode]} (request ${requestId}).`
+                : `${item.connection} ${IDENTITY_WORDS[item.identityMode]} is not ready for the preview (${laneSummary(group, undefined, nowMs)}); ask IT to review this app's access in the Isomorph console.` });
     }
     if (!waiting.length)
         return filed.appId;
     output("Isomorph cannot deploy the preview yet:");
-    for (const line of waiting)
+    for (const { line } of waiting)
         output(`  ${line}`);
-    throw new CliError("INTEGRATIONS_NOT_READY", `${waiting.join(" ")} IT approves a request once, for every environment; rerun productionise when it is approved.`);
+    const next = waiting.some(item => item.awaitsDecision)
+        ? "IT approves a request once, for every environment; rerun productionise when it is approved."
+        : "Run productionise again in a minute.";
+    throw new CliError("INTEGRATIONS_NOT_READY", `${waiting.map(item => item.line).join(" ")} ${next}`);
 }
 /**
  * `productionise` / `promote` pre-check for an app that calls governed AI
@@ -386,5 +419,5 @@ export async function integrationsStatus(root, client) {
     if (!lock?.appId)
         return { linked: false, grants: [], requests: [] };
     const listed = await client.list(lock.appId);
-    return { appId: lock.appId, linked: true, grants: listed.grants.map(grant => ({ connection: grant.connection, environment: grant.environment, identityMode: grant.identityMode, status: grant.status, operations: grant.operations, resources: grant.resources, expiresAt: grant.expiresAt, readiness: grant.readiness, pendingRequestId: grant.pendingRequestId, failure: grant.failure })), requests: listed.requests };
+    return { appId: lock.appId, linked: true, grants: listed.grants.map(grant => ({ connection: grant.connection, environment: grant.environment, identityMode: grant.identityMode, status: grant.status, operations: grant.operations, resources: grant.resources, expiresAt: grant.expiresAt, readiness: grant.readiness, provisioning: grant.provisioning, pendingRequestId: grant.pendingRequestId, failure: grant.failure })), requests: listed.requests };
 }

package/dist/packages/harbour-cli/src/kit-bundle.manifest.js

@@ -1,6 +1,6 @@
 export const PUBLISHED_KIT_BUNDLE = {
     "schema": "isomorph.kit-bundle/1.0",
-    "kitVersion": "0.3.0",
+    "kitVersion": "0.3.1",
     "sdk": {
         "package": "@isomorph.ai/app-sdk",
         "version": "1.2.0",
@@ -8,21 +8,21 @@ export const PUBLISHED_KIT_BUNDLE = {
         "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:6b41494883215527a73e05a1e07d022552dfe3402915e23950e357e5e9381c49"
     },
     "images": {
-        "appGateway": "public.ecr.aws/y6t4p3i8/harbour-app-gateway@sha256:cdb494a98ddcab21a42b9cb8089d077007da1d4f178458cef94b3aa9ad6e1a11",
-        "sessionFixture": "public.ecr.aws/y6t4p3i8/harbour-session-fixture@sha256:34d5e175a6346636a25fe8c6f9b730e93d67ef1e3361b0349c31f2a2da3322a8"
+        "appGateway": "public.ecr.aws/y6t4p3i8/harbour-app-gateway@sha256:af841461de984099c202b5d0c86321c5e5f51713f3bcd487f0fc904b17a30d3a",
+        "sessionFixture": "public.ecr.aws/y6t4p3i8/harbour-session-fixture@sha256:fe94fb879357520bc9b34db590a64b6c82cb63e59b97ca76d1cde470e84f7df3"
     },
     "nativeRuntime": {
         "darwinArm64": {
-            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:a07e18b61ca9b5db8077fd37ced21ca29bc4e37049f10724c61cea5a68d46077",
-            "sha256": "a07e18b61ca9b5db8077fd37ced21ca29bc4e37049f10724c61cea5a68d46077"
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:56db6d0080e0f38401d8a4a6cba0dfd44fd66878d574e88df8b6ffe63551fa4e",
+            "sha256": "56db6d0080e0f38401d8a4a6cba0dfd44fd66878d574e88df8b6ffe63551fa4e"
         },
         "linuxX64": {
-            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:43b80fbe2153c79ccca6b663d79e32e100f56b6ada896f0bb192cfd23bbfc1cc",
-            "sha256": "43b80fbe2153c79ccca6b663d79e32e100f56b6ada896f0bb192cfd23bbfc1cc"
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:082272dd1823d51e05d5f9497c5644dd62dd3996ffe83ae69f357471d7d492a0",
+            "sha256": "082272dd1823d51e05d5f9497c5644dd62dd3996ffe83ae69f357471d7d492a0"
         },
         "windowsX64": {
-            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:540020f44f874d20c28fbd19b8879aab9f3e41aa2d228f9b5b7bc301ac428afd",
-            "sha256": "540020f44f874d20c28fbd19b8879aab9f3e41aa2d228f9b5b7bc301ac428afd"
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:5341eab77337713255fa3175f14038d702b07332bb0073b5bba333ba5adf5bf1",
+            "sha256": "5341eab77337713255fa3175f14038d702b07332bb0073b5bba333ba5adf5bf1"
         }
     },
     "brief": {

package/dist/packages/harbour-cli/src/local-runtime.js

@@ -4,7 +4,6 @@ import { copyFile, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promi
 import { createServer } from "node:net";
 import { dirname, join, relative, win32 } from "node:path";
 import { fileURLToPath } from "node:url";
-import EmbeddedPostgres from "embedded-postgres";
 import { kitPaths, projectName } from "./kit.js";
 import { CliError } from "./output.js";
 export function nodePackageCommand(tool, args, platform = process.platform, execPath = process.execPath) {
@@ -209,6 +208,7 @@ export class LocalRuntime {
         const paths = kitPaths(this.root);
         const postgresBinaries = await hydrateEmbeddedPostgres(this.run);
         const postgresMessages = [];
+        const { default: EmbeddedPostgres } = await import("embedded-postgres");
         this.postgres = new EmbeddedPostgres({ databaseDir: join(paths.state, "postgres"), port: this.ports.postgres, user: LOCAL.dbUser, password: LOCAL.dbPassword, persistent: true, onLog: message => postgresMessages.push(String(message).trim()), onError: error => postgresMessages.push(String(error)) });
         try {
             if (!(await readdir(join(paths.state, "postgres")).catch(() => [])).length)

package/dist/packages/harbour-cli/src/operations.js

@@ -250,6 +250,10 @@ export async function retryDeployment(client, operationRef, output, options = {}
         return summarize(await fetchStatus(client, operationRef));
     return follow(client, operationRef, output, options.waitOptions);
 }
+/** What the maker types at the promote prompt. `--confirm-tested` supplies this same literal through
+ * `readConfirmation`, so governance receives the attestation it receives today, byte for byte — the
+ * claim is unchanged, only reachable where no terminal can answer the prompt. */
+export const PROMOTION_CONFIRMATION = "Tested.";
 /**
  * Promotion mirrors the console's "I tested this version" button: the maker
  * must have opened the live preview and say so, and the version they tested
@@ -268,8 +272,8 @@ export async function promoteToProduction(client, operationRef, output, options
     output(`Open the protected preview and test it: ${deployment.protectedUrl}`);
     output("When it works as expected, type Tested. then press Enter to promote it to production.");
     const reply = await (options.readConfirmation ?? readLine)();
-    if (reply !== "Tested.")
-        throw new CliError("PROMOTION_NOT_CONFIRMED", "The production promotion was not confirmed.", operationRef);
+    if (reply !== PROMOTION_CONFIRMATION)
+        throw new CliError("PROMOTION_NOT_CONFIRMED", "The production promotion was not confirmed. Confirm the tested preview with --confirm-tested instead.", operationRef);
     const result = structured(await client.call("isomorph_promote_to_production", {
         operationId: operationRef,
         expectedPreviewVersionId: deployment.versionId,

package/dist/packages/harbour-cli/src/productionise.js

@@ -12,6 +12,9 @@ import { isProhibitedSecretPath } from "../../../src/secret-paths.js";
 import { assertAiReady, assertPreviewIntegrationsReady } from "./integrations.js";
 import { kitPaths, readKitLock, recordKitAppId, sourceDigest } from "./kit.js";
 import { FLOW_CHECK, preflightKitGate, readReport } from "./check.js";
+/** What the maker types at the save prompt; `--confirm-save` supplies this same literal, so the
+ * `isomorph.stage-approval/1.0` attestation governance receives is unchanged, byte for byte. */
+export const SAVE_APPROVAL = "Approved.";
 export async function productionise(rootArg, client, output, tenantId, includePaths = [], options = {}) {
     const root = resolve(rootArg);
     output(`Isomorph is checking ${basename(root)}.`);
@@ -159,9 +162,9 @@ export async function productionise(rootArg, client, output, tenantId, includePa
         let execution = prior?.sourceSave?.status && prior.sourceSave.status !== "AWAITING_APPROVAL" ? { status: prior.sourceSave.status } : await execute(client, operationRef, appId, graph);
         if (execution.status === "APPROVAL_REQUIRED" || execution.approvalRequiredBeforeExternalAction === true) {
             output(`Approval required: Isomorph can copy ${graph.deploymentScope.includedFiles.length} app files to the approved company code system. Nothing will be deployed or released. Type Approved. then press Enter.`);
-            const approval = await readApproval();
-            if (approval !== "Approved.")
-                throw new CliError("APPROVAL_NOT_GRANTED", "The Isomorph save was not approved.", operationRef);
+            const approval = await (options.readApproval ?? readLine)();
+            if (approval !== SAVE_APPROVAL)
+                throw new CliError("APPROVAL_NOT_GRANTED", "The Isomorph save was not approved. Approve copying the app files with --confirm-save instead.", operationRef);
             execution = await execute(client, operationRef, appId, graph, { schema: "isomorph.stage-approval/1.0", step: "save_source_baseline", approved: true, approvedByUser: true, userApprovalText: approval, userVisibleProgress: "Approved.", nextStepSummary: "Isomorph can safely save the app.", dataOrActions: ["Save the app in the company code system."] });
         }
         if (execution.status === "ADMIN_SETUP_REQUIRED")
@@ -437,7 +440,6 @@ function outcomeLine(summary) {
         default: return summary.nextStep ?? "Isomorph saved the app; deployment has not started.";
     }
 }
-const readApproval = readLine;
 /**
  * Whether the app really calls governed AI: the gate's inventory of
  * `isomorph.ai.*` call sites (`.isomorph/local/check-report.json`,

package/dist/packages/harbour-cli/src/retained-checks.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
-import { allowedLiterals, numericMinimum, textLengthBounds } from "./app-schema.js";
+import { allowedLiterals, hasNumericMaximum, numericMinimum, textLengthBounds } from "./app-schema.js";
 import { COVERED_CAPABILITIES, capabilitiesCalled, capabilityCallSurface, capabilityUsage, sourceTableUsage } from "./source-inventory.js";
 import { kitPaths } from "./kit.js";
 /**
@@ -334,7 +334,7 @@ function rowShape(schema, needsUpdate) {
         return { blocked: `its \`${unwritable.name} ${unwritable.declaredType}\` column ${unwritable.references ? "references another table, so a row cannot be written without inventing its parent — rule core.journey-fk (core.md in the isomorph skill)" : "has a type Isomorph cannot invent a value for"}` };
     const marker = writable.find(column => isMarker(column) && column.notNull && !column.hasDefault) ?? writable.find(isMarker);
     if (!marker)
-        return { blocked: "it has no free text or number column a check could write a unique value into and find the row by" };
+        return { blocked: markerless(writable) };
     const markerExpression = marker.type === "text" ? textMarker(marker) : "Date.now() % 2000000000";
     if (!markerExpression)
         return { blocked: `\`${marker.name}\` is the only column a check could find a row by, and its CHECK constraint leaves no room for a unique value` };
@@ -345,6 +345,12 @@ function rowShape(schema, needsUpdate) {
         return { blocked: "the app updates it, but every column Isomorph could change is the one the check finds the row by" };
     return { values: [`${marker.name}: markerValue`, ...fill], marker, markerExpression, locator, uuid: fill.some(value => value.includes("randomUUID(")), update };
 }
+/** Why nothing on the table can carry the unique value a journey finds its row by — naming the capped number when that is what ruled the last candidate out, so the answer is a column to add rather than a CHECK to weaken. */
+function markerless(writable) {
+    const none = "it has no free text or number column a check could write a unique value into and find the row by";
+    const capped = writable.find(cappedNumber);
+    return capped ? `${none}: \`${capped.name} ${capped.declaredType}\` is a number its own CHECK caps, and the unique value a journey writes is a timestamp` : none;
+}
 /** What a journey writes into a free-text column it updates, when the column's length bounds admit it. */
 const UPDATED_TEXT = "isomorph check updated";
 /** The column a journey changes, and what it changes it to: a boolean is flipped, a closed set moves to its other value, free text gets a fixed one. */
@@ -366,8 +372,10 @@ function updateStep(writable, marker, locator) {
     }
     return undefined;
 }
+/** A number the app's own CHECK caps from above: the unique value a journey marks a row with is a timestamp, which no ordinary ceiling admits, so such a column is never the marker. */
+const cappedNumber = (column) => (column.type === "integer" || column.type === "number") && hasNumericMaximum(column.checks, column.name);
 /** A column a check can write a unique value into and then filter on. */
-const isMarker = (column) => (column.type === "text" || column.type === "integer" || column.type === "number") && !column.references && !allowedLiterals(column.checks, column.name).length;
+const isMarker = (column) => (column.type === "text" || column.type === "integer" || column.type === "number") && !column.references && !cappedNumber(column) && !allowedLiterals(column.checks, column.name).length;
 /** A unique marker satisfying the column's own length constraints, or `undefined` when they leave no room for one. */
 function textMarker(column) {
     const { min, max } = textLengthBounds(column.checks, column.name);

package/dist/packages/harbour-cli/src/starter.js

@@ -421,8 +421,11 @@ export function App() {
       {error && <p role="alert" style={{ color: "crimson" }}>{error}</p>}
 
       {/* Notes — paired with .isomorph/checks/notes-journey.mjs and notes-cross-user.mjs, generated
-          from this section and migrations/0001_notes.sql; replace the table and \`isomorph check\`
-          rewrites both. Rules: core.md in the isomorph skill (data). */}
+          from this section and migrations/0001_notes.sql; \`isomorph check\` rewrites both whenever
+          either one changes. Edit 0001_notes.sql in place only until this app's first deploy: an
+          applied migration is frozen, so after that the schema changes by adding the next
+          migrations/000N_*.sql — never by editing or deleting an applied file, and never by
+          dropping a deployed table. Rules: core.md in the isomorph skill (data). */}
       <section>
         <h2>Notes</h2>
         <form onSubmit={event => { event.preventDefault(); void addNote(); }}>

package/dist/packages/harbour-cli/src/version.js

@@ -1 +1 @@
-export const CLI_VERSION = "0.3.0";
+export const CLI_VERSION = "0.3.1-rc.2";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/cli",
-  "version": "0.3.0",
+  "version": "0.3.1-rc.2",
   "description": "Isomorph development kit CLI",
   "type": "module",
   "bin": {
@@ -37,7 +37,7 @@
   "harbour": {
     "kitBundle": {
       "repository": "public.ecr.aws/y6t4p3i8/harbour-kit-bundle",
-      "version": "0.3.0"
+      "version": "0.3.1"
     }
   }
 }