@isomorph.ai/cli 0.5.1 → 0.6.0

package/dist/packages/harbour-cli/src/agent-setup.js

@@ -118,7 +118,7 @@ Rules live beside this file: \`core.md\` before the first edit; \`integrations.m
 | "run it", "show me" | \`isomorph dev --app-root . --detach --json\`; give them \`result.origin\` (the first start takes a minute or two). Locally they are a fixture user. |
 | "check it", "is it ready?" | \`isomorph check --app-root . --json\` (the output is the report). Failures in the app's code are yours: fix and re-check until clean, after every change and before every ship, unasked and never offered as a choice. |
 | "does it work?" (and before reporting anything as working) | open the dev link in your own browser, press the control you built or changed, read what the app shows; a green \`isomorph check\` is not that proof (fixtures answer AI and company systems). A Send in development is real: reuse explicit authorization or ask once. No browser: say the button is untested. |
-| "I need Slack / Gmail / the warehouse" | read \`integrations.md\` beside this skill first; then, in the same turn: catalog, declare only what the app calls, submit the request yourself, say READY or PENDING in one line. |
+| "I need Slack / Gmail / the warehouse" | read \`integrations.md\` beside this skill first; then, in the same turn: catalog, call only what it lists (literals), submit the request yourself, say READY or PENDING in one line. |
 | "summarise", "draft", "AI" | read \`ai.md\` beside this skill first; then one call behind a control they press. |
 | "ship it", "let my team try it" | show the person the three values in \`.isomorph/app.json\` (name, description, audience — "only you" when empty) and correct the file as they say; then \`isomorph deploy --app-root . --json\` (it runs the checks when needed and refuses once naming every blocker and its fix: relay that line; the app works meanwhile). Give them \`result.deployment.protectedUrl\`. \`--session-notes\`: what cost you time in Isomorph, or \`""\`. |
 | "make it live" | only after they have tried the preview: \`isomorph promote --operation <ref> --app-root . --confirm-tested --json\`. Report the production link, or that operator approval is pending. |

package/dist/packages/harbour-cli/src/check.js

@@ -69,14 +69,11 @@ export async function runChecks(root, options) {
         // failure ended the run as `fetch failed` (CLI_FAILED) with no report written.
         const skipped = (why) => record({ name: "integrations", status: "not_run", detail: why });
         const lock = await readKitLock(root).catch(() => undefined);
-        const { declaration, errors } = await readDeclaration(root);
         if (!lock?.appId)
             skipped("the app is not linked yet; `isomorph dev` (signed in) or `isomorph integrations request` links it");
-        else if (errors.length)
-            skipped(`.isomorph/integrations.json is invalid: ${errors[0]}`);
         else {
             try {
-                integrations = await testIntegrationReads(lock.appId, options.governance, declaration, output);
+                integrations = await testIntegrationReads(lock.appId, options.governance, await readDeclaration(root), output);
                 if (!integrations.length)
                     output("No READY development grants with read operations; real integrations were not exercised.");
             }
@@ -252,8 +249,8 @@ function indentLines(detail) { return detail.split("\n").map((line, index) => in
  */
 export async function writeGateFiles(root, files, output) {
     for (const [path, content] of Object.entries(files)) {
-        if (!/^\.isomorph\/checks\/[A-Za-z0-9._-]+$/.test(path))
-            throw new CliError("LOCAL_RUNTIME_FAILED", `The kit gate named a file outside .isomorph/checks/: ${path}.`);
+        if (!/^\.isomorph\/(checks\/[A-Za-z0-9._-]+|integrations\.json)$/.test(path))
+            throw new CliError("LOCAL_RUNTIME_FAILED", `The kit gate named a file it does not own: ${path}.`);
         const target = join(root, path);
         if (content === null) {
             await rm(target, { force: true });

package/dist/packages/harbour-cli/src/deploy.js

@@ -63,9 +63,7 @@ async function runDeploy(rootArg, governance, output, tenantId, options) {
     // that is blank too; this only says so before the checks spend a minute.
     if (!profile.name.trim() || !profile.description.trim())
         throw new CliError("PROFILE_INCOMPLETE", "The app needs a name and a description in .isomorph/app.json before it can deploy.", undefined, "Edit `name` and `description` in .isomorph/app.json (show them to the person first), then run this again.");
-    const { declaration, errors } = await readDeclaration(root);
-    if (errors.length && !errors[0].startsWith(".isomorph/integrations.json is missing"))
-        throw new CliError("DECLARATION_INVALID", `.isomorph/integrations.json is invalid: ${errors[0]}`);
+    const declaration = await readDeclaration(root);
     // Link first: the app's identity lands in `.isomorph/kit.lock.json`, which is
     // one of the deployable files, so a report pinned after the link stays fresh
     // through the checks and the package is built from the linked tree.

package/dist/packages/harbour-cli/src/guide.js

@@ -53,13 +53,12 @@ Shared-read, owner-write: the same, plus \`CREATE POLICY posts_read ON posts FOR
 - \`APP_NOT_FOUND\`: clear \`appId\` and \`tenantId\` in \`.isomorph/kit.lock.json\` to relink.`,
     integrations: `# Company systems (Slack, Gmail, warehouse)
 
-## Declare
+## Call shape
 
-Company systems are reached through \`isomorph.integrations.execute(connection, { operation, resource, input })\`, declared in \`.isomorph/integrations.json\` by catalog identifier, with only the operations called. Closed set: \`slack.channel.history\` (user), \`slack.message.post\` (app or user), \`gmail.thread.list\`, \`gmail.message.read\`, \`gmail.message.send\` (user, \`inbox\`), \`warehouse.view.read\` (app). Resources are logical names, never IDs. Strict JSON.
+One call, this exact shape, never a wrapper function; \`connection\`, \`operation\`, \`resource\`, \`mode\` and \`input.columns\` are catalog literals (logical names, never IDs or variables). \`isomorph check\` derives \`.isomorph/integrations.json\` from them (committed, never edited); \`dev\`/\`deploy\` file the request.
 
-\`\`\`json
-"company-slack": { "kind": "saas", "operations": { "slack.message.post": { "identity": "app", "resources": ["team-updates"] } } },
-"sales-warehouse": { "kind": "database", "operations": { "warehouse.view.read": { "identity": "app", "resources": { "weekly_sales": { "columns": ["week", "total"] } } } } }
+\`\`\`ts
+await isomorph.integrations.execute("sales-warehouse", { operation: "warehouse.view.read", resource: "weekly_sales", input: { columns: ["week", "total"], limit: 100 } });
 \`\`\`
 
 ## Catalog
@@ -70,16 +69,6 @@ Never guess a connection, channel, table, view, mailbox or column: a guess is re
 
 \`isomorph integrations request <connection> --reason "<why>" --app-root . --json\` files the one request IT approves once for every environment (\`isomorph dev\` and \`isomorph deploy\` file it too); submit it yourself, in the same turn. \`isomorph integrations status --app-root . --json\`: READY, use it; PENDING, say "IT has to approve this; the app works meanwhile". \`RESOURCE_NOT_APPROVED\`: IT adds the channel, view or mailbox in the console (Controls & integrations); then run the same request again.
 
-## Call shape
-
-Always this exact shape, never a wrapper function: the kit gate reads the direct call.
-
-\`\`\`ts
-const report = await isomorph.integrations.execute("sales-warehouse", {
-  operation: "warehouse.view.read", resource: "weekly_sales", input: { columns: ["week", "total"], limit: 100 }
-});
-\`\`\`
-
 ## Consent
 
 Only user-identity operations need it, built in unasked: the control calls \`isomorph.integrations.connect(connection)\`, follows \`authorizationUrl\` on \`consent_required\`, and returns to a connected state. Never on page load; app-identity operations never call connect.
@@ -90,7 +79,7 @@ A send (\`slack.message.post\`, \`gmail.message.send\`) runs only from an explic
 
 ## Slack modes
 
-\`"identity": "app"\` posts as the company's bot under IT's approved \`presentation.displayName\`; \`"identity": "user"\` posts as the person after consent (\`USER_RECONNECT_REQUIRED\`: offer Connect again). Name the \`mode\` when both are approved (\`MODE_REQUIRED\`); an unapproved mode is \`MODE_NOT_GRANTED\`, never swapped. \`RESOURCE_NOT_APPROVED\` on a post: the bot is not in the channel; anyone there runs \`/invite @Isomorph AI\`.`,
+\`execute("company-slack", { …, mode: "app" })\` posts as the bot under \`slack.displayName\`/\`iconEmoji\` in \`.isomorph/app.json\`; \`mode: "user"\` posts as the person after consent (\`USER_RECONNECT_REQUIRED\`: offer Connect again). One mode per connection (\`MODE_REQUIRED\`); an unapproved mode is \`MODE_NOT_GRANTED\`, never swapped. \`RESOURCE_NOT_APPROVED\` on a post: the bot is not in the channel; \`/invite @Isomorph AI\`.`,
     ai: `# Governed AI
 
 AI goes through \`isomorph.ai\` only: one \`isomorph.ai.chat({ messages, maxTokens })\` call on the app's one client (\`src/isomorph.client.ts\`), never through a wrapper function (the gate reads only the direct call), behind a control the person presses — never on load, in an effect or a timer. Never add an OpenAI/Anthropic/Gemini key, SDK or URL: the governed AI gateway holds the key and IT sees every call. Send \`messages\` and \`maxTokens\` and nothing else; a refusal with \`unsupported_request_capability\` names a field the company's AI route does not accept — remove that field. A refusal with \`AI_NOT_ENABLED\` means IT has not enabled an AI provider yet: say so in one line and keep the app working without AI.

package/dist/packages/harbour-cli/src/integrations.js

@@ -1,5 +1,5 @@
 import { basename } from "node:path";
-import { linkIdempotencyKey, OPERATIONS, readDeclaration, readKitLock, requestResourceName, requestResources, writeKitLock, newKitLock } from "./kit.js";
+import { linkIdempotencyKey, readDeclaration, readKitLock, requestResourceName, requestResources, writeKitLock, newKitLock } from "./kit.js";
 import { CliError } from "./output.js";
 import { CLI_VERSION } from "./version.js";
 export class GovernanceClient {
@@ -164,12 +164,7 @@ function settled(requests) {
  * so governance is not called.
  */
 export async function fileDeclaredRequests(root, client, tenantId, bundle) {
-    const { declaration, errors } = await readDeclaration(root);
-    if (errors.length) {
-        if (errors[0].startsWith(".isomorph/integrations.json is missing"))
-            return undefined;
-        throw new CliError("DECLARATION_INVALID", `.isomorph/integrations.json is invalid: ${errors[0]}`);
-    }
+    const declaration = await readDeclaration(root);
     const connections = Object.keys(declaration.connections);
     if (!connections.length)
         return undefined;
@@ -183,9 +178,7 @@ export async function fileDeclaredRequests(root, client, tenantId, bundle) {
  * for up to 30 s; PENDING is reported as pending, never as ready.
  */
 export async function requestIntegrations(root, client, tenantId, bundle, options) {
-    const { declaration, errors } = await readDeclaration(root);
-    if (errors.length)
-        throw new CliError("DECLARATION_INVALID", `.isomorph/integrations.json is invalid: ${errors[0]}`);
+    const declaration = await readDeclaration(root);
     const appId = await ensureLinkedApp(root, client, tenantId, bundle);
     const submitted = settled(await submitRequests(client, appId, declaration, root, options.connection, options.reason, options.operations)).map(item => ({ ...item, state: item.outcome.state }));
     const sleep = options.sleep ?? ((ms) => new Promise(resolve => setTimeout(resolve, ms)));
@@ -352,9 +345,7 @@ export function renderGrantGroup(group, nowMs = Date.now()) {
  * each a separate cycle.
  */
 export async function assertDeployReady(root, client, tenantId, bundle, environment, output, callsAi) {
-    const { declaration, errors } = await readDeclaration(root);
-    if (errors.length && !errors[0].startsWith(".isomorph/integrations.json is missing"))
-        throw new CliError("DECLARATION_INVALID", `.isomorph/integrations.json is invalid: ${errors[0]}`);
+    const declaration = await readDeclaration(root);
     const appId = await ensureLinkedApp(root, client, tenantId, bundle);
     const preflight = await client.deployPreflight(appId, { environment, callsAi, declaration, cliVersion: CLI_VERSION });
     if (preflight.ready && !blockersOf(preflight.blockers).length) {
@@ -386,25 +377,25 @@ export function deployBlocked(value, environment, output) {
 /** The code readers already know for a refusal that is all of one kind. */
 const BLOCKER_CODES = { integration: "INTEGRATIONS_NOT_READY", ai: "AI_NOT_READY", cli: "CLI_UPGRADE_REQUIRED" };
 /**
- * Splits the declared operations of one connection by identity mode — the
- * declaration's own `identity` (the gate has checked it against the closed
- * set; an operation with one mode is read as that mode). The app-mode part
- * that carries `slack.message.post` also carries the connection's declared
- * presentation, so IT sees "posts as" on the request.
+ * Splits the operations the app calls on one connection by identity mode — the
+ * derived declaration's own `identity` (the gate derived it from the call's
+ * `mode` or the operation's only identity and checked it against the closed
+ * set). The app-mode part that carries `slack.message.post` also carries the
+ * connection's presentation (from `.isomorph/app.json`), so IT sees "posts as"
+ * on the request. A connection or operation the app does not call cannot be
+ * asked for: the declaration is the source, so the fix is the call.
  */
 export function requestScope(declaration, connection, only) {
     const declared = declaration.connections[connection];
     if (!declared)
-        throw new CliError("CONNECTION_NOT_DECLARED", `${connection} is not declared in .isomorph/integrations.json.`);
+        throw new CliError("CONNECTION_NOT_CALLED", `The app does not call ${connection}; add the isomorph.integrations.execute call first, then run \`isomorph check\`.`);
     const names = (only?.length ? only : Object.keys(declared.operations));
     const unknown = names.filter(name => !declared.operations[name]);
     if (unknown.length)
-        throw new CliError("OPERATION_NOT_DECLARED", `${unknown.join(", ")} not declared for ${connection}.`);
+        throw new CliError("OPERATION_NOT_CALLED", `The app does not call ${unknown.join(", ")} on ${connection}; add the call first, then run \`isomorph check\`.`);
     const byMode = new Map();
     for (const name of names) {
-        const allowed = OPERATIONS[name]?.identities ?? [];
-        const declaredMode = declared.operations[name].identity;
-        const mode = allowed.includes(declaredMode) ? declaredMode : allowed[0];
+        const mode = declared.operations[name].identity;
         const entry = byMode.get(mode) ?? { operations: [], resources: new Map() };
         entry.operations.push(name);
         for (const resource of requestResources(declared.operations[name]))

package/dist/packages/harbour-cli/src/kit-bundle.manifest.js

@@ -1,6 +1,6 @@
 export const PUBLISHED_KIT_BUNDLE = {
     "schema": "isomorph.kit-bundle/1.0",
-    "kitVersion": "0.5.1",
+    "kitVersion": "0.6.0",
     "sdk": {
         "package": "@isomorph.ai/app-sdk",
         "version": "1.2.1",
@@ -8,21 +8,21 @@ export const PUBLISHED_KIT_BUNDLE = {
         "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:607e3896aa4116d82d0473677d38a68fecd4855a250cd44e038780290c335c67"
     },
     "images": {
-        "appGateway": "public.ecr.aws/y6t4p3i8/harbour-app-gateway@sha256:558e3aa74f315a8bf2ae18f1344be3b8fad0203286f43d14d411a4a1f3e15dc0",
-        "sessionFixture": "public.ecr.aws/y6t4p3i8/harbour-session-fixture@sha256:578cc8d98ca687dc79d8567f46abc636db2df0b3d8a01ccf38b30d5932c43353"
+        "appGateway": "public.ecr.aws/y6t4p3i8/harbour-app-gateway@sha256:7f7ae24c24d81cf2951ce8ae9033e252373c17f3a31299e05714103068273232",
+        "sessionFixture": "public.ecr.aws/y6t4p3i8/harbour-session-fixture@sha256:14803bd23b64c0ba5aa68022716c339a772ce0664c739dabda3457ec27978bb2"
     },
     "nativeRuntime": {
         "darwinArm64": {
-            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:e36aeea224867ebd7ae4a609284393460f707eaf6c50cb5f8ea1596926bae04b",
-            "sha256": "e36aeea224867ebd7ae4a609284393460f707eaf6c50cb5f8ea1596926bae04b"
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:42705c1b74d45f08b4f926e98b7ae15bcc8688d26d1424a74cf2d03472c9b332",
+            "sha256": "42705c1b74d45f08b4f926e98b7ae15bcc8688d26d1424a74cf2d03472c9b332"
         },
         "linuxX64": {
-            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:0673c75610f7fc8a5f1dbc1ec39570eee2278301430e7bbd4b4323319e7a1e6e",
-            "sha256": "0673c75610f7fc8a5f1dbc1ec39570eee2278301430e7bbd4b4323319e7a1e6e"
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:853563fb277f49eb8862ee06227d5faba8c82cb8de304357083c19d9f616fa81",
+            "sha256": "853563fb277f49eb8862ee06227d5faba8c82cb8de304357083c19d9f616fa81"
         },
         "windowsX64": {
-            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:8c1fc2e83d6b4cfd056b5252b9676a32e1e49e0596bb072f2c33faef63781aab",
-            "sha256": "8c1fc2e83d6b4cfd056b5252b9676a32e1e49e0596bb072f2c33faef63781aab"
+            "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:8709b4922c8c5e3ba19662999df4beb97d01fe8a8a85b32d6025088234714a50",
+            "sha256": "8709b4922c8c5e3ba19662999df4beb97d01fe8a8a85b32d6025088234714a50"
         }
     },
     "brief": {

package/dist/packages/harbour-cli/src/kit.js

@@ -5,30 +5,18 @@ import { basename, dirname, join, parse, resolve } from "node:path";
 import { scanWorkspace } from "../../../src/analyzer.js";
 import { isKitBundle } from "./kit-bundle.js";
 import { CliError } from "./output.js";
-/**
- * Closed set: each operation has one connection kind and the identity modes it
- * may run under — exactly one, except slack.message.post, which the app
- * declares (`app` posts as the company's Slack app under its IT-approved name,
- * `user` posts as the signed-in person after their consent). Gmail is
- * user-mode only (two reads and one send as the signed-in person).
- */
-export const OPERATIONS = {
-    "slack.channel.history": { identities: ["user"], kind: "saas" },
-    "slack.message.post": { identities: ["app", "user"], kind: "saas" },
-    "gmail.thread.list": { identities: ["user"], kind: "saas" },
-    "gmail.message.read": { identities: ["user"], kind: "saas" },
-    "gmail.message.send": { identities: ["user"], kind: "saas" },
-    "warehouse.view.read": { identities: ["app"], kind: "database" }
-};
 /** Explicit reads `isomorph check --integrations` may run; every other operation is a send and never runs during checks. */
 export const READ_OPERATIONS = ["slack.channel.history", "gmail.thread.list", "warehouse.view.read"];
 /** Reads whose input needs an identifier from a prior read (a message id): listed as reads, exercised only through the list. */
 export const DEPENDENT_READ_OPERATIONS = ["gmail.message.read"];
 /**
- * Reads the committed declaration as JSON. The closed rules (schema, connection
- * kinds, the operation set, identity modes, logical resource names) are the
- * kit gate's `declaration` check — the pipeline's own — so a defect is named
- * once, in the same words, by `isomorph check` and by CodeBuild.
+ * Reads the declaration `isomorph check` derived from the app's
+ * `isomorph.integrations.execute` calls and wrote to `.isomorph/integrations.json`
+ * (data plane ADR 0016). Nobody edits the file: its closed rules are the kit
+ * gate's `declaration` check, so a defect is named once, at the call site, by
+ * `isomorph check` and by CodeBuild alike. A missing file is the empty
+ * declaration (`init` writes one); a file that is not JSON is not the gate's
+ * and the fix is to run the check.
  */
 export function emptyDeclaration() { return { schema: "isomorph.app-integrations/2.0", connections: {} }; }
 export function resourceNames(operation) { return Array.isArray(operation.resources) ? operation.resources : Object.keys(operation.resources); }
@@ -42,20 +30,20 @@ export async function readDeclaration(root) {
         raw = await readFile(kitPaths(root).declaration, "utf8");
     }
     catch {
-        return { declaration: emptyDeclaration(), errors: [".isomorph/integrations.json is missing (run `isomorph init`)"] };
+        return emptyDeclaration();
     }
     let parsed;
     try {
         parsed = JSON.parse(raw);
     }
     catch {
-        return { declaration: emptyDeclaration(), errors: [".isomorph/integrations.json is not valid JSON"] };
+        parsed = undefined;
     }
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-        return { declaration: emptyDeclaration(), errors: [".isomorph/integrations.json must be a JSON object"] };
+        throw new CliError("DECLARATION_UNREADABLE", ".isomorph/integrations.json is not the file `isomorph check` writes.", undefined, "Run `isomorph check --app-root .`: it derives the file from the app's isomorph.integrations.execute calls.");
     const record = parsed;
     const connections = record.connections && typeof record.connections === "object" && !Array.isArray(record.connections) ? record.connections : {};
-    return { declaration: { schema: record.schema, connections }, errors: [] };
+    return { schema: record.schema, connections };
 }
 export function isKitLock(value) {
     const record = value;
@@ -156,7 +144,8 @@ export async function readAppProfile(root) {
         problems.push("audience must be a list of email addresses (an empty list means only you)");
     if (problems.length)
         throw new CliError("APP_PROFILE_INVALID", `.isomorph/app.json is invalid: ${problems.join("; ")}.`, undefined, "Fix the file, then run this again.");
-    return { schema: "isomorph.app/1.0", name: record.name.trim(), description: (record.description ?? "").trim(), audience: record.audience.map(entry => entry.trim()) };
+    const slack = record.slack && typeof record.slack === "object" && typeof record.slack.displayName === "string" ? { slack: { displayName: record.slack.displayName, ...(typeof record.slack.iconEmoji === "string" ? { iconEmoji: record.slack.iconEmoji } : {}) } } : {};
+    return { schema: "isomorph.app/1.0", name: record.name.trim(), description: (record.description ?? "").trim(), audience: record.audience.map(entry => entry.trim()), ...slack };
 }
 /** Stable per-project identity for the kit-managed local state. */
 export function projectName(root, suffix = "") {

package/dist/packages/harbour-cli/src/output.js

@@ -26,7 +26,13 @@ export function safeError(error) {
     const paths = error instanceof CliError && error.paths?.length ? error.paths : undefined;
     // Structured, so it is neither bounded nor redacted: a command's choices are its commands, and a refusal's blockers are what the reader acts on.
     const details = error instanceof CliError && error.details && Object.keys(error.details).length ? error.details : undefined;
-    return { code, layer, message: redact(raw) || NO_DETAIL, ...(hint ? { remediationHint: hint } : {}), ...(paths ? { paths } : {}), ...(details ? { details } : {}) };
+    // A refusal another layer authored — the gate, governance, the pipeline — is
+    // the whole answer and is already bounded where it was written; cutting it
+    // here deleted the table name from a pipeline refusal on 2026-09-16 (the cut
+    // fell exactly on "No journey was generated for `notes`"). Only this CLI's
+    // own prose keeps the cap.
+    const message = (layer === "cli" ? redact(raw) : scrub(raw)) || NO_DETAIL;
+    return { code, layer, message, ...(hint ? { remediationHint: hint } : {}), ...(paths ? { paths } : {}), ...(details ? { details } : {}) };
 }
 /** Anything that must never reach a terminal, a log or an envelope. */
 const SECRETS = /https?:\/\/\S+|Bearer\s+\S+|(?:x-harbour|authorization|content-type)[^\n]*/gi;
@@ -70,8 +76,12 @@ const ELISION = " \u2026 ";
  * phrasings, it deletes words the server actually said, and it is the kind of
  * meaning-guessing the classifier deleted above was deleted for.
  */
+/** Redacted and whitespace-folded, never bounded: what a server-authored refusal reaches the reader as. */
+function scrub(value) {
+    return value.replace(SECRETS, "").replace(/\s+/g, " ").trim();
+}
 function redact(value) {
-    const said = value.replace(SECRETS, "").replace(/\s+/g, " ").trim();
+    const said = scrub(value);
     if (said.length <= DETAIL_BOUND)
         return said;
     const keep = DETAIL_BOUND - ELISION.length;

package/dist/packages/harbour-cli/src/starter.js

@@ -136,14 +136,11 @@ function kitFiles(root) {
         // Name, description and audience: what `isomorph deploy` prints before it starts and records
         // with the deployment. The folder name and an empty audience are only a starting point.
         ".isomorph/app.json": renderAppProfile(defaultAppProfile(root)),
-        // No connection. The starter calls no company system, and a connection the
-        // app does not call is a deploy that never happens: `isomorph deploy`
-        // files the access request for every declared connection and refuses to
-        // start until IT has approved it. One is added when the app really calls it —
-        // the steps and the worked Slack and warehouse examples are in integrations.md
-        // beside the `isomorph` skill (guide.ts). They are not in this file: it is read
-        // with JSON.parse here and again by the pipeline's source intake, so it cannot
-        // carry comments.
+        // No connection: the starter calls no company system. The kit gate derives
+        // this file from the app's isomorph.integrations.execute calls on every
+        // `isomorph check` (data plane ADR 0016); it is committed and packaged for
+        // governance, never edited. `init` writes the empty one so a fresh app has
+        // a declaration before its first check.
         ".isomorph/integrations.json": `${JSON.stringify(emptyDeclaration(), null, 2)}\n`
     };
 }
@@ -196,7 +193,7 @@ Created by \`isomorph init\`: a Vite + React app that runs on Isomorph. Sign-in,
 
 The kit's rules are in the \`isomorph\` skill that \`isomorph agent-setup\` installs for Claude Code (\`~/.claude/skills/isomorph/\`) and Codex (\`~/.codex/skills/isomorph/\`): \`core.md\` (identity, data, files, realtime, commands, error codes), \`integrations.md\` (Slack, Gmail, warehouse), \`ai.md\` and \`jobs.md\`. The managed block in CLAUDE.md / AGENTS.md points there.
 
-\`.isomorph/checks/\` is regenerated on each check and gitignored — put your own checks in \`tests/<name>.mjs\`. \`.isomorph/integrations.json\` declares the company systems the app calls: none, to start. \`.isomorph/app.json\` holds the app's name, description and audience.
+\`.isomorph/checks/\` is regenerated on each check and gitignored — put your own checks in \`tests/<name>.mjs\`. \`.isomorph/integrations.json\` is derived by \`isomorph check\` from the app's \`isomorph.integrations.execute\` calls and committed, never edited. \`.isomorph/app.json\` holds the app's name, description and audience.
 `;
 const VITE_CONFIG = `import { defineConfig } from "vite";
 import react from "@vitejs/plugin-react";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/cli",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Isomorph development kit CLI",
   "type": "module",
   "bin": {
@@ -37,7 +37,7 @@
   "harbour": {
     "kitBundle": {
       "repository": "public.ecr.aws/y6t4p3i8/harbour-kit-bundle",
-      "version": "0.5.1"
+      "version": "0.6.0"
     }
   }
 }