Ship-Safe gate · 6 of 7

The schema-bump check.

The quietest failure in the list: a schema change that works everywhere except production. This gate exists to make it loud.

WARNSreport label: Schema-bump check

What the check reads

The check reads two git diffs of one file, the database layer at app/lib/server/db.ts: the committed delta since the branch diverged from main, plus any uncommitted edits. It never modifies anything. Among the added and removed lines it looks for DDL-shaped statements (CREATE TABLE, ADD COLUMN, ALTER TABLE, CREATE INDEX, DROP) and for a change to the SCHEMA_VERSION constant. DDL changed while the version did not: that is the warning, and the record quotes the exact lines it saw.

Why AI-built code ships this

The failure is silent by design. Additive schema statements are skipped on a live database whose stored version already matches, so a change that adds a column without bumping the version passes every proof on a fresh local database, then quietly does nothing in production. The app reads a column that was never created, and the first symptom is a runtime error days later, far from the change that caused it.

Why it warns

Warns, never blocks. A diff cannot prove intent: the DDL-shaped line may sit in a comment, or the migration may be handled deliberately elsewhere. So the gate names the exact lines it matched and hands the decision to a person. The overall run can still be a GO, with this warning attached for someone to eyeball first.

In the proof record

A pass line when nothing schema-shaped changed or the version moved with it, or a warning that quotes the matched DDL lines from the diff.

✓ Schema-bump check — No changes to app/lib/server/db.ts vs main.
⚠ Schema-bump check — app/lib/server/db.ts has DDL-ish changes but SCHEMA_VERSION was NOT bumped.

Honest limits

It watches one file, app/lib/server/db.ts, the convention this gate grew up with; schema logic living anywhere else is outside its view. Detection goes by the shape of the line, so an unusual migration style can pass unseen. And when the main base ref is missing, only the uncommitted edits can be judged.

Want every change gated like this before it ships?

The same gate runs in every engagement, and each piece of work ends on a plain go or no-go, in writing. The gate itself is open source, so you can read exactly what we run.

Book a call →Run the gate yourself

The other 6 gates

Dirty-tree guardSecret scanTracked .env fileTypecheckProduction buildEnvelope maps

The whole method, from the controlled zone to the proof record: the methodology.