@aarwitz/tapp 0.15.1 → 0.16.0

package/AGENTS.md

@@ -18,7 +18,7 @@ npx -y @aarwitz/tapp shot            # screenshot the booted sim → file path (
 npx -y @aarwitz/tapp apps            # what's installed on the simulator, with bundle ids
 npx -y @aarwitz/tapp build [dir]     # build the app in an Xcode repo + install it (≈ tapp_build)
 npx -y @aarwitz/tapp qa app.apk --platform android --app-id com.acme.app
-npx -y @aarwitz/tapp flow run .autotap/flows/smoke.yml  # committed, keyless E2E replay
+npx -y @aarwitz/tapp flow run .tapp/flows/smoke.yml  # committed, keyless E2E replay
 ```
 
 **Seeing the screen, per client:** if you can read image files into your context (Claude
@@ -92,13 +92,13 @@ Returns `{verdict, confidence, headline, screensExplored, actionsPerformed, find
 
 ## Flows (deterministic E2E tests)
 
-Flow YAML is repository-native test code. Commit it under `.autotap/flows/`; CI can replay it
+Flow YAML is repository-native test code. Commit it under `.tapp/flows/`; CI can replay it
 without a coding agent, model, subscription, or API key. AI generation and `assert_ai` are optional.
 
 - **Record:** every successful `session_act` is recorded. After driving a flow, call
-  `tapp_flow_save { name: "checkout" }` → writes `.autotap/flows/checkout.yml` with waits and
+  `tapp_flow_save { name: "checkout" }` → writes `.tapp/flows/checkout.yml` with waits and
   a final screen assertion auto-inserted; typed credentials are templated to `$TEST_EMAIL`/`$TEST_PASSWORD`.
-- **Replay:** `tapp_flow_run { flowPath: ".autotap/flows/checkout.yml" }` — exact steps,
+- **Replay:** `tapp_flow_run { flowPath: ".tapp/flows/checkout.yml" }` — exact steps,
   deterministic assertions, same result every time. A failed assertion is a finding.
 - **Generate:** `tapp_flow_generate { goal: "log in and add the first item to cart" }` —
   grounded in the app's actually-explored screens, so it can't invent steps.

package/README.md

@@ -90,9 +90,9 @@ npx -y @aarwitz/tapp ci install .
 ```
 
 The baseline command writes only after autonomous QA and every selected deterministic suite pass
-conclusively. It stores `.autotap/baselines/<platform>/<target-id>.json`; the generated workflow
+conclusively. It stores `.tapp/baselines/<platform>/<target-id>.json`; the generated workflow
 uses that exact target identity so two apps on the same platform never share a baseline. `ci
-install` writes `.github/workflows/tapp.yml` plus `.autotap/ci.json`, refuses unresolved build
+install` writes `.github/workflows/tapp.yml` plus `.tapp/ci.json`, refuses unresolved build
 configuration and existing-file collisions, and never commits, pushes, enables branch protection,
 or creates GitHub resources. Review and pin the generated Tapp release reference to its immutable
 commit SHA before production.
@@ -182,8 +182,8 @@ Then ask your agent:
 
 Full agent playbook: [AGENTS.md](./AGENTS.md) — ships inside the package so agents can read it too.
 Application-model and import contract: [`docs/application-model.md`](docs/application-model.md).
-The desktop Coverage view reads the same `.autotap/application-model.json`,
-`.autotap/release-plan.json`, and `.autotap/ui-map.json`, including explicit proposal review; it
+The desktop Coverage view reads the same `.tapp/application-model.json`,
+`.tapp/release-plan.json`, and `.tapp/ui-map.json`, including explicit proposal review; it
 does not maintain a separate product model. Map nodes identify both the real launch entry and the
 deterministic per-platform navigation root used for bounded changed-surface replay.
 
@@ -271,8 +271,8 @@ The first successful, conclusive run on `main` seeds a repository-scoped Actions
 90-day baseline artifact. Both are keyed by platform and stable application-model target id. Pull requests automatically restore it and fail only on **new**
 high/critical findings or broken Flows—not pre-existing debt. No baseline commit or PAT is required.
 If you prefer a reviewed, durable baseline, run `tapp baseline create` and commit the generated
-`.autotap/baselines/<platform>/<target-id>.json`; `tapp ci install` wires its explicit path into the
-corresponding job. The legacy `.autotap/baseline.json` is still recognized. Automatic baseline restore and the PR comment need `actions: read` and
+`.tapp/baselines/<platform>/<target-id>.json`; `tapp ci install` wires its explicit path into the
+corresponding job. The legacy `.tapp/baseline.json` is still recognized. Automatic baseline restore and the PR comment need `actions: read` and
 `pull-requests: write` as shown above. Secrets are unavailable to workflows from forks, so
 auth-gated apps should either use a non-secret UI-testing launch argument or skip the gate for
 untrusted forks.
@@ -305,14 +305,14 @@ or accept a prebuilt one:
     android-app-id: com.acme.app
     android-project: android
     android-task: :app:assembleDebug
-    flows: android/.autotap/flows/*.yml
+    flows: android/.tapp/flows/*.yml
 ```
 
 For web, pass `platform: web` plus `web-target:` and Tapp uses the application model to run its
 lockfile-backed install/build, start a detected package script or read-only static server, wait for
 readiness, gate it, and stop it even on failure. Pass `url:` instead for an already-running owned
 environment. Add
-`scenarios: .autotap/scenarios/*.yml` to gate isolated cross-account journeys; see
+`scenarios: .tapp/scenarios/*.yml` to gate isolated cross-account journeys; see
 [`docs/scenarios.md`](docs/scenarios.md). Automatic
 baselines are isolated by platform and target, so two same-platform apps are never compared.
 
@@ -351,8 +351,11 @@ verdict calculation run entirely locally — no telemetry, nothing phones home.
 features are explicit: finding enrichment requires `TAPP_ENABLE_REMOTE_AI=1` (an ambient
 API key alone never changes data handling), and AI flow generation / `assert_ai` only run
 when you invoke them; these send selected metadata (screen names, finding titles) to your
-configured model provider. Runtime configuration uses `TAPP_*` environment variables; deprecated
-aliases remain readable for compatibility.
+configured model provider. Runtime configuration uses `TAPP_*` environment variables. Repository
+artifacts live under `.tapp/`, and desktop run configuration uses `.tapp.yml`. Existing
+`.autotap/`, `.autotap.yml`, and `AUTOTAP_*` inputs remain readable as migration fallbacks; when
+both names exist, Tapp uses the canonical one. Rename the old directory/config in your next
+reviewed repository change—no secrets or evidence formats need to be rewritten.
 
 Committed Flow replay, recording a driven session, autonomous exploration, exact assertions,
 regression comparison, and CI gating require **no API key and no coding agent at runtime**. AI is

package/bin/tapp.js

@@ -22,16 +22,16 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { existingProjectArtifactPath, isProjectArtifactDirectory } from "../mcp-server/src/project-paths.js";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const packageRoot = path.resolve(__dirname, "..");
 const pkg = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"));
 
 // Redirect all writable output away from the (possibly read-only) package dir.
-// The old environment alias remains populated only for older helper integrations.
+// The old environment alias remains a read-only fallback for older integrations.
 const tappHome = (process.env.TAPP_HOME || process.env.AUTOTAP_HOME || path.join(os.homedir(), ".tapp")).trim();
 process.env.TAPP_HOME = tappHome;
-if (!process.env.AUTOTAP_HOME) process.env.AUTOTAP_HOME = tappHome;
 fs.mkdirSync(tappHome, { recursive: true });
 
 const [, , command = "help", ...rest] = process.argv;
@@ -221,7 +221,7 @@ switch (command) {
       console.error("❌ --explore writes grounded UI Map evidence and cannot be combined with --dry-run");
       process.exit(2);
     }
-    const outDir = typeof flags["out-dir"] === "string" ? flags["out-dir"] : ".autotap";
+    const outDir = typeof flags["out-dir"] === "string" ? flags["out-dir"] : ".tapp";
     const artifactDir = path.resolve(projectDir, outDir);
     if (!artifactDir.startsWith(projectDir + path.sep) && artifactDir !== projectDir) {
       console.error("❌ --out-dir must remain inside the repository");
@@ -292,7 +292,7 @@ switch (command) {
   case "plan": {
     const { flags, positionals } = parseVerbArgs(rest);
     const verb = positionals[0] || "show";
-    const planPath = path.resolve(positionals[1] || ".autotap/release-plan.json");
+    const planPath = positionals[1] ? path.resolve(positionals[1]) : existingProjectArtifactPath(process.cwd(), "release-plan.json");
     if (!fs.existsSync(planPath)) {
       console.error(`❌ Release plan not found: ${planPath}`);
       process.exit(2);
@@ -366,7 +366,7 @@ switch (command) {
       break;
     }
     if (verb !== "review") {
-      console.error("usage: tapp plan show [.autotap/release-plan.json]\n       tapp plan review [.autotap/release-plan.json] --approve name[,name] --reject name[,name] --defer name[,name]\n       tapp plan generate [.autotap/release-plan.json] [--project-dir DIR]\n       tapp plan validate [.autotap/release-plan.json] --project-dir DIR --platform web [--url URL] [--target NAME|PATH]\n       tapp plan promote [.autotap/release-plan.json] --project-dir DIR [--item name[,name]]");
+      console.error("usage: tapp plan show [.tapp/release-plan.json]\n       tapp plan review [.tapp/release-plan.json] --approve name[,name] --reject name[,name] --defer name[,name]\n       tapp plan generate [.tapp/release-plan.json] [--project-dir DIR]\n       tapp plan validate [.tapp/release-plan.json] --project-dir DIR --platform web [--url URL] [--target NAME|PATH]\n       tapp plan promote [.tapp/release-plan.json] --project-dir DIR [--item name[,name]]");
       process.exit(2);
     }
     const list = (value) => typeof value === "string" ? value.split(",").map((item) => item.trim()).filter(Boolean) : [];
@@ -377,7 +377,7 @@ switch (command) {
     }
     const { reviewProductPlan } = await import(path.join(packageRoot, "mcp-server", "src", "product-operations.js"));
     const reviewProjectDir = typeof flags["project-dir"] === "string" ? path.resolve(flags["project-dir"])
-      : path.basename(path.dirname(planPath)) === ".autotap" ? path.dirname(path.dirname(planPath)) : path.dirname(planPath);
+      : isProjectArtifactDirectory(path.basename(path.dirname(planPath))) ? path.dirname(path.dirname(planPath)) : path.dirname(planPath);
     try { plan = reviewProductPlan({ projectDir: reviewProjectDir, planPath, ...decisions }).plan; }
     catch (error) { console.error(`❌ Could not review release plan: ${error.message || String(error)}`); process.exit(2); }
     console.log(`✅ Release plan updated — ${plan.items.filter((item) => ["approved", "accepted"].includes(item.decision)).length} accepted/approved · ${plan.items.filter((item) => item.decision === "rejected").length} rejected · ${plan.items.filter((item) => item.decision === "pending").length} pending`);
@@ -608,7 +608,7 @@ switch (command) {
     const verb = positionals[0] || "validate";
     const taskPath = positionals[1] ? path.resolve(positionals[1]) : "";
     if (!["validate", "compile", "run"].includes(verb) || !taskPath) {
-      console.error("usage: tapp task validate <task.yml> [--platform ios|android|web] [--map .autotap/ui-map.json]\n       tapp task compile <task.yml> --platform PLATFORM [--inputs '{\"name\":\"value\"}'] [--out compiled.json]\n       tapp task run <task.yml> --platform PLATFORM [--url URL|--bundle-id ID|--app-id ID] [--inputs JSON]");
+      console.error("usage: tapp task validate <task.yml> [--platform ios|android|web] [--map .tapp/ui-map.json]\n       tapp task compile <task.yml> --platform PLATFORM [--inputs '{\"name\":\"value\"}'] [--out compiled.json]\n       tapp task run <task.yml> --platform PLATFORM [--url URL|--bundle-id ID|--app-id ID] [--inputs JSON]");
       process.exit(2);
     }
     if (!fs.existsSync(taskPath)) { console.error(`❌ Task not found: ${taskPath}`); process.exit(2); }
@@ -741,7 +741,7 @@ switch (command) {
     const verb = positionals[0] || "validate";
     const contractPath = positionals[1] ? path.resolve(positionals[1]) : "";
     if (!["validate", "compile", "run"].includes(verb) || !contractPath) {
-      console.error("usage: tapp contract validate <name.contract.ts> [--platform ios|android|web] [--map .autotap/ui-map.json]\n       tapp contract compile <name.contract.ts> --platform PLATFORM [--out compiled.json]\n       tapp contract run <name.contract.ts> --platform PLATFORM [--url URL|--bundle-id ID|--app-id ID]");
+      console.error("usage: tapp contract validate <name.contract.ts> [--platform ios|android|web] [--map .tapp/ui-map.json]\n       tapp contract compile <name.contract.ts> --platform PLATFORM [--out compiled.json]\n       tapp contract run <name.contract.ts> --platform PLATFORM [--url URL|--bundle-id ID|--app-id ID]");
       process.exit(2);
     }
     const {
@@ -918,7 +918,7 @@ switch (command) {
         console.error("❌ --platform must be ios|android|web");
         process.exit(2);
       }
-      const out = path.resolve(typeof flags.out === "string" ? flags.out : path.join(".autotap", "ui-map.json"));
+      const out = path.resolve(typeof flags.out === "string" ? flags.out : path.join(".tapp", "ui-map.json"));
       const observed = buildUiMapFromMarkers({
         markersPath,
         platform,
@@ -936,7 +936,7 @@ switch (command) {
       break;
     }
     if (verb === "inspect") {
-      const mapPath = path.resolve(positionals[1] || path.join(".autotap", "ui-map.json"));
+      const mapPath = positionals[1] ? path.resolve(positionals[1]) : existingProjectArtifactPath(process.cwd(), "ui-map.json");
       if (!fs.existsSync(mapPath)) { console.error(`❌ UI Map not found: ${mapPath}`); process.exit(2); }
       const map = JSON.parse(fs.readFileSync(mapPath, "utf8"));
       const errors = validateUiMap(map);
@@ -959,7 +959,7 @@ switch (command) {
       if (!diff.comparableFullSweep && (diff.notObservedNodes.length || diff.notObservedEdges.length)) console.log("ℹ️  Absence is not labeled a regression because the runs were not declared comparable full sweeps.");
       process.exit(diff.lostReachability.length || diff.lostTransitions.length ? 1 : 0);
     }
-    console.error("usage: tapp map build <ocqa-markers.txt> [--platform ios|android|web] [--out .autotap/ui-map.json]\n       tapp map inspect [ui-map.json]\n       tapp map diff <before.json> <after.json> [--comparable]");
+    console.error("usage: tapp map build <ocqa-markers.txt> [--platform ios|android|web] [--out .tapp/ui-map.json]\n       tapp map inspect [ui-map.json]\n       tapp map diff <before.json> <after.json> [--comparable]");
     process.exit(2);
   }
 
@@ -1096,7 +1096,7 @@ switch (command) {
       process.exit(2);
     }
     const projectDir = fs.realpathSync(path.resolve(positionals[1] || (typeof flags["project-dir"] === "string" ? flags["project-dir"] : process.cwd())));
-    const modelPath = path.resolve(projectDir, typeof flags.model === "string" ? flags.model : path.join(".autotap", "application-model.json"));
+    const modelPath = typeof flags.model === "string" ? path.resolve(projectDir, flags.model) : existingProjectArtifactPath(projectDir, "application-model.json");
     if (!modelPath.startsWith(projectDir + path.sep) || !fs.existsSync(modelPath)) {
       console.error(`❌ Application model not found inside the repository: ${modelPath}\n   Run tapp init --explore, review/generate/validate/promote the plan, then create the baseline.`);
       process.exit(2);
@@ -1203,7 +1203,7 @@ switch (command) {
       let projectDir;
       try { projectDir = fs.realpathSync(path.resolve(positionals[0] || (typeof flags["project-dir"] === "string" ? flags["project-dir"] : process.cwd()))); }
       catch { console.error(`❌ Repository directory not found: ${positionals[0] || flags["project-dir"] || process.cwd()}`); process.exit(2); }
-      const modelPath = path.resolve(projectDir, typeof flags.model === "string" ? flags.model : path.join(".autotap", "application-model.json"));
+      const modelPath = typeof flags.model === "string" ? path.resolve(projectDir, flags.model) : existingProjectArtifactPath(projectDir, "application-model.json");
       if (!modelPath.startsWith(projectDir + path.sep) || !fs.existsSync(modelPath)) {
         console.error(`❌ Application model not found inside the repository: ${modelPath}\n   Run tapp init --explore first.`);
         process.exit(2);
@@ -1242,7 +1242,7 @@ switch (command) {
           actionRef,
           defaultBranch: typeof flags["default-branch"] === "string" ? flags["default-branch"] : "main",
           workflowPath: typeof flags.out === "string" ? flags.out : ".github/workflows/tapp.yml",
-          manifestPath: typeof flags.manifest === "string" ? flags.manifest : ".autotap/ci.json",
+          manifestPath: typeof flags.manifest === "string" ? flags.manifest : ".tapp/ci.json",
           replace: flags.replace === true,
           allowUnresolved: flags["allow-unresolved"] === true,
         });

package/browser/app.js

@@ -471,7 +471,7 @@ async function entriesFromDrop(event) {
 }
 
 // The webkitdirectory input (and some drop implementations) silently exclude hidden
-// entries, which destroys committed .autotap/ config. The File System Access picker
+// entries, which destroys committed .tapp/ config. The File System Access picker
 // enumerates hidden files, so it is preferred wherever it exists.
 async function entriesFromDirectoryHandle(handle, prefix = "") {
   const entries = [];
@@ -526,7 +526,7 @@ async function uploadRepository(name, entries, { hiddenComplete = false } = {})
     $("#operation-progress-bar").style.width = "100%";
     const hasHiddenEntries = entries.some((entry) => entry.path.split("/").some((part) => part.startsWith(".")));
     if (!hiddenComplete && !hasHiddenEntries) {
-      toast("Imported, but no hidden files (like .autotap/) came through — this browser's folder picker skips them. Committed Tapp config was not uploaded.", true);
+      toast("Imported, but no hidden files (like .tapp/) came through — this browser's folder picker skips them. Committed Tapp config was not uploaded.", true);
     } else {
       toast("Repository imported into an isolated Tapp workspace");
     }

package/browser/index.html

@@ -41,7 +41,7 @@
         <div class="source-icon">↥</div>
         <p class="eyebrow">CLOUD COPY</p>
         <h2>Upload a project folder</h2>
-        <p>Upload an isolated working copy from this computer. Committed hidden config (like <code>.autotap/</code>) is included; dependency and build output folders are skipped.</p>
+        <p>Upload an isolated working copy from this computer. Committed hidden config (like <code>.tapp/</code>) is included; dependency and build output folders are skipped.</p>
         <button class="primary" id="browse-folder">Browse folder</button>
         <input id="folder-input" type="file" webkitdirectory multiple hidden>
         <small>For direct edits to an existing checkout, start with <code>tapp app /path/to/repo</code>.</small>

package/docs/BROWSER-PRODUCT.md

@@ -39,7 +39,7 @@ in the local process/filesystem. This is a local trust boundary, not hosted mult
 11. **Install CI** by previewing and writing a reviewable repository patch. Tapp does not commit,
     push, create GitHub secrets, or enable branch protection.
 
-Successful semantic actions can be saved in `.autotap/flows/`; credential values are templated to
+Successful semantic actions can be saved in `.tapp/flows/`; credential values are templated to
 environment references. Long-lived repository artifacts store binding names, not resolved secret
 values.
 

package/docs/PRODUCT-ENGINE.md

@@ -51,7 +51,7 @@ Current convergence:
   installation call the same operations;
 - the GitHub Action and `runProductGate` call the same portable gate and evidence protocol;
 - VS Code remains a thin MCP client;
-- desktop reads the same `.autotap` artifacts but still has legacy import/build orchestration. It is
+- desktop reads the same `.tapp` artifacts but still has legacy import/build orchestration. It is
   retained, not the launch UX, until that orchestration is removed;
 - `cloud/runner` is retained prototype evidence for exact checkout, versioned operation envelopes,
   leases, and cleanup. It is not the production hosted adapter or an adequate arbitrary-customer
@@ -60,10 +60,10 @@ Current convergence:
 
 ## Canonical repository protocol
 
-New product behavior writes only `.autotap/`:
+New product behavior writes only `.tapp/`:
 
 ```text
-.autotap/
+.tapp/
   project.json              # actors, env binding names, controlled lifecycle; never secret values
   application-model.json    # detected/observed/declared product facts
   ui-map.json               # grounded screen/action/transition graph
@@ -74,9 +74,10 @@ New product behavior writes only `.autotap/`:
   ci.json                   # generated CI installation manifest
 ```
 
-`.autotap.yml` and `.tapp.yml` are legacy compatibility inputs, not parallel sources of product
-truth. Do not add a fourth configuration format. Migration readers may normalize old input into the
-canonical model; only an explicit reviewed operation may write new repository artifacts.
+`.tapp.yml` is the canonical run configuration. Existing `.autotap.yml`, `.autotap/`, and
+`AUTOTAP_*` inputs remain readable during migration, but new examples and output use the Tapp names.
+Do not add another configuration format. Migration readers may normalize old input into the canonical
+model; only an explicit reviewed operation may write new repository artifacts.
 
 ## Anti-duplication rules
 

package/docs/application-model.md

@@ -3,9 +3,9 @@
 `tapp init` is the deterministic import, exploration, and planning entrypoint of Tapp's customer
 journey. It turns a repository into three platform-neutral, repository-native artifacts:
 
-- `.autotap/ui-map.json` — observed UI states, controls, and transitions from real exploration;
-- `.autotap/application-model.json` — what Tapp can support with evidence;
-- `.autotap/release-plan.json` — the compact set of committed and proposed business guarantees a
+- `.tapp/ui-map.json` — observed UI states, controls, and transitions from real exploration;
+- `.tapp/application-model.json` — what Tapp can support with evidence;
+- `.tapp/release-plan.json` — the compact set of committed and proposed business guarantees a
   customer must review before generation.
 
 Plain `tapp init` performs source/artifact inspection only. `tapp init --explore` additionally uses
@@ -73,7 +73,7 @@ tapp actor list .
 tapp init . --refresh
 ```
 
-This writes `.autotap/project.json`. The file contains roles, `default`/`isolated` session policy,
+This writes `.tapp/project.json`. The file contains roles, `default`/`isolated` session policy,
 provisioning mode, same-origin lifecycle declarations, and environment-variable *names*. The CLI
 and MCP `tapp_actor_config` reject credential values and refuse to replace an actor without an
 explicit `--replace`/`replace: true`. Contracts refer to `$ALICE_EMAIL`-style placeholders. Tapp
@@ -144,24 +144,24 @@ and the real-surface validation required before it can be trusted.
 ## Explicit review
 
 ```bash
-tapp plan show .autotap/release-plan.json
-tapp plan review .autotap/release-plan.json \
+tapp plan show .tapp/release-plan.json
+tapp plan review .tapp/release-plan.json \
   --approve signInWorks,checkoutWorks \
   --reject marketingPageReachable \
   --defer adminAuditWorks
 
-# Only after review: generate grounded Task + contract drafts under .autotap/proposals/.
-tapp plan generate .autotap/release-plan.json --project-dir .
+# Only after review: generate grounded Task + contract drafts under .tapp/proposals/.
+tapp plan generate .tapp/release-plan.json --project-dir .
 
 # Replay the draft on the real target and attach evidence to the plan.
 # Omit --url to build/start/stop the detected managed browser target.
-tapp plan validate .autotap/release-plan.json --project-dir . --platform web
+tapp plan validate .tapp/release-plan.json --project-dir . --platform web
 # Or connect to an already-running owned environment.
-tapp plan validate .autotap/release-plan.json --project-dir . \
+tapp plan validate .tapp/release-plan.json --project-dir . \
   --platform web --url http://127.0.0.1:3000
 
 # Explicitly accept only fully validated drafts into canonical reviewed locations.
-tapp plan promote .autotap/release-plan.json --project-dir . \
+tapp plan promote .tapp/release-plan.json --project-dir . \
   --item checkoutWorks
 ```
 
@@ -181,7 +181,7 @@ The macOS desktop Coverage experience reads these same files. Its **Application*
 detected targets, actors, capabilities, journeys, Tasks, contracts, and exact remediation. Its
 **Release Plan** tab writes explicit approve/reject/defer decisions atomically into the canonical
 plan while preserving fields from newer engine versions; committed contract intent is not editable
-through these proposal controls. Flow Map merges the repository `.autotap/ui-map.json` with current
+through these proposal controls. Flow Map merges the repository `.tapp/ui-map.json` with current
 run evidence instead of building a separate desktop-only graph.
 
 Schema compatibility is exercised by the repository's protocol tests and retained desktop reader.
@@ -191,8 +191,8 @@ actor-attributed Task calls, captured output variables, bounded eventual asserti
 reviewed project lifecycle, then compile through the isolated Scenario executor. Existing
 Task-backed proposals compose those reviewed Tasks. For UI-Map-only proposals, it finds an observed path from each platform's
 recorded entry state, deduplicates shared semantic transitions into compositional Task drafts under
-`.autotap/proposals/tasks/`, grounds every Task in exact node/edge ids, and writes the contract draft
-under `.autotap/proposals/contracts/`. Proposal Tasks are visible only to proposal contracts; an
+`.tapp/proposals/tasks/`, grounds every Task in exact node/edge ids, and writes the contract draft
+under `.tapp/proposals/contracts/`. Proposal Tasks are visible only to proposal contracts; an
 ordinary committed contract or CI glob cannot silently consume one.
 
 Generation blocks when entry-state evidence is missing, the target is unreachable, an observed
@@ -200,7 +200,7 @@ action cannot be represented deterministically, or platform paths require incomp
 composition. It never overwrites a draft, statically compiles each declared platform, and marks all
 outputs untrusted. Missing non-secret Task inputs stay blocked until the plan has explicit bindings;
 standard email/password secrets remain placeholders. Successful grounding and compilation are not
-real-surface evidence and never promote drafts into `.autotap/tasks` or `.autotap/contracts`.
+real-surface evidence and never promote drafts into `.tapp/tasks` or `.tapp/contracts`.
 
 `plan validate` invokes the ordinary deterministic contract executor and records pass/fail evidence
 per declared platform. A multi-platform draft remains only partially validated until every declared
@@ -209,8 +209,8 @@ substitution or automatic assertion update.
 
 `plan promote` is the explicit acceptance boundary. It refuses any contract or generated Task that
 has not passed every declared platform, preflights every destination, never overwrites a reviewed
-artifact, moves accepted files from `.autotap/proposals/{tasks,contracts}` into
-`.autotap/{tasks,contracts}`, and applies their exact node/edge coverage to the canonical UI Map.
+artifact, moves accepted files from `.tapp/proposals/{tasks,contracts}` into
+`.tapp/{tasks,contracts}`, and applies their exact node/edge coverage to the canonical UI Map.
 Shared Task paths in still-unpromoted proposals are rewritten to the canonical file. Promotion does
 not commit, push, or install CI; the resulting repository patch remains reviewable by the customer.
 
@@ -232,7 +232,7 @@ tapp ci install . --action-ref aarwitz/tapp@v0.13.1
 
 Baseline creation rejects non-gate JSON, missing or mismatched target identity, platform mismatch,
 failed Flows/Scenarios/contracts, `blocked`, and `inconclusive`. It writes atomically to
-`.autotap/baselines/<platform>/<target-id>.json` and requires `--replace` to supersede reviewed
+`.tapp/baselines/<platform>/<target-id>.json` and requires `--replace` to supersede reviewed
 evidence. Capture-local paths are replaced with portable `tapp-capture:` references before the
 repository artifact is written. The gate also checks baseline platform and target identity before
 comparing findings. On iOS, the same validated launch arguments and string-valued launch
@@ -240,7 +240,7 @@ environment are passed to autonomous exploration and deterministic Flow/contract
 JSON or unsupported value types fail before execution rather than silently testing different app
 configurations.
 
-CI installation writes `.github/workflows/tapp.yml` and `.autotap/ci.json`, never overwrites by
+CI installation writes `.github/workflows/tapp.yml` and `.tapp/ci.json`, never overwrites by
 default, and refuses unresolved iOS schemes, Android ids, browser lockfiles, or runtimes. The
 workflow uses exact contract paths, maps each actor environment binding to a same-named GitHub
 Secret, uses the first/default actor for autonomous-login inputs, preserves the remaining bindings

package/docs/scenarios.md

@@ -1,6 +1,6 @@
 # Multi-actor Scenarios
 
-A Scenario is Tapp's low-level deterministic multi-actor execution format in `.autotap/scenarios/*.yml`. It uses the same semantic actions, polling assertions, timeouts, evidence markers, and merge policy as a Flow, but adds isolated named actors, shared variables, and explicit lifecycle steps. The customer-facing business authoring layer is a TypeScript [release contract](release-contracts.md), which composes reusable Tasks and compiles to this runtime instead of duplicating UI steps.
+A Scenario is Tapp's low-level deterministic multi-actor execution format in `.tapp/scenarios/*.yml`. It uses the same semantic actions, polling assertions, timeouts, evidence markers, and merge policy as a Flow, but adds isolated named actors, shared variables, and explicit lifecycle steps. The customer-facing business authoring layer is a TypeScript [release contract](release-contracts.md), which composes reusable Tasks and compiles to this runtime instead of duplicating UI steps.
 
 Ordinary replay is keyless. AI may propose a Scenario during authoring, but no model, API key, or coding agent participates when CI executes it.
 
@@ -61,13 +61,13 @@ teardown:
 ## Run it
 
 ```bash
-tapp scenario validate .autotap/scenarios/social-system.yml
+tapp scenario validate .tapp/scenarios/social-system.yml
 ALICE_EMAIL=alice@example.test ALICE_PASSWORD=demo \
 BOB_EMAIL=bob@example.test BOB_PASSWORD=demo \
-  tapp scenario run .autotap/scenarios/social-system.yml
+  tapp scenario run .tapp/scenarios/social-system.yml
 
 tapp ci --platform web --url http://127.0.0.1:4180 \
-  --scenarios '.autotap/scenarios/*.yml' \
+  --scenarios '.tapp/scenarios/*.yml' \
   --json-out tapp-report.json --md-out tapp-report.md
 ```
 
@@ -78,16 +78,16 @@ GitHub Action:
   with:
     platform: web
     url: http://127.0.0.1:4180
-    scenarios: .autotap/scenarios/*.yml
+    scenarios: .tapp/scenarios/*.yml
 ```
 
 MCP clients call `tapp_scenario_run` with `scenarioPath`, or an inline reviewed Scenario. The structured result identifies `kind: scenario`, actual executed/total steps, and actor-tagged steps.
 
 ## Verified fixture and boundaries
 
-`SocialDemo/.autotap/contracts/social-system.contract.ts` is the reference system guarantee; the Scenario remains its low-level execution proof and backwards-compatible escape hatch. On 2026-08-04 the contract passed 41/41 compiled steps using two isolated contexts against one delayed shared backend. With `SOCIAL_DEMO_FAULT=hide-cross-actor-posts`, the unchanged contract failed for Bob at 19/41 and the portable merge gate exited non-zero specifically because one release contract failed.
+`SocialDemo/.tapp/contracts/social-system.contract.ts` is the reference system guarantee; the Scenario remains its low-level execution proof and backwards-compatible escape hatch. On 2026-08-04 the contract passed 41/41 compiled steps using two isolated contexts against one delayed shared backend. With `SOCIAL_DEMO_FAULT=hide-cross-actor-posts`, the unchanged contract failed for Bob at 19/41 and the portable merge gate exited non-zero specifically because one release contract failed.
 
-The fixture's `.autotap/project.json` is the central actor contract. It records Alice and Bob's
+The fixture's `.tapp/project.json` is the central actor contract. It records Alice and Bob's
 roles, isolated sessions, seeded provisioning, reset lifecycle, and four environment-variable
 names. The release contract and Scenario consume those names; neither stores the public fixture
 values. Customer values belong in the local environment or CI secret store.