@mycadet/gateway 0.12.7 → 0.12.8

package/src/email/register-callback.test.ts

@@ -8,9 +8,9 @@ import {
   resetMockFetch,
 } from "../__tests__/mock-fetch.js";
 import {
-  applyPlatformIdentityIds,
-  _resetPlatformIdentityForTests,
-} from "../platform-identity.js";
+  applyCloudIdentityIds,
+  _resetCloudIdentityForTests,
+} from "../cloud-identity.js";
 import {
   registerEmailCallbackRoute,
   EMAIL_CALLBACK_PATH,
@@ -18,9 +18,9 @@ import {
 
 afterEach(() => {
   resetMockFetch();
-  delete process.env.CADET_PLATFORM_URL;
+  delete process.env.CADET_CLOUD_URL;
   delete process.env.ASSISTANT_API_KEY;
-  _resetPlatformIdentityForTests();
+  _resetCloudIdentityForTests();
 });
 
 function makeConfigFile(
@@ -34,29 +34,22 @@ function makeConfigFile(
 }
 
 function makeCaches(opts: {
-  platformBaseUrl?: string;
+  cloudBaseUrl?: string;
   assistantApiKey?: string;
-  platformAssistantId?: string;
+  cloudAssistantId?: string;
   ingressUrl?: string;
 }): { credentials: CredentialCache; configFile?: ConfigFileCache } {
   const store = new Map<string, string>();
-  if (opts.platformBaseUrl)
-    store.set(
-      credentialKey("cadet", "platform_base_url"),
-      opts.platformBaseUrl,
-    );
+  if (opts.cloudBaseUrl)
+    process.env.CADET_CLOUD_URL = opts.cloudBaseUrl;
   if (opts.assistantApiKey)
     store.set(
       credentialKey("cadet", "assistant_api_key"),
       opts.assistantApiKey,
     );
-  if (opts.platformAssistantId) {
-    store.set(
-      credentialKey("cadet", "platform_assistant_id"),
-      opts.platformAssistantId,
-    );
-    applyPlatformIdentityIds({
-      assistantId: opts.platformAssistantId,
+  if (opts.cloudAssistantId) {
+    applyCloudIdentityIds({
+      assistantId: opts.cloudAssistantId,
       organizationId: "org-abc",
       userId: "user-123",
     });
@@ -95,13 +88,13 @@ describe("registerEmailCallbackRoute", () => {
 
   test("registers callback route with platform via credential cache", async () => {
     const caches = makeCaches({
-      platformBaseUrl: "https://platform.example.com",
+      cloudBaseUrl: "https://test-cloud.mycadet.ai",
       assistantApiKey: "test-api-key",
-      platformAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
+      cloudAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
     });
 
     const callbackUrl =
-      "https://platform.example.com/v1/gateway/callbacks/aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee/webhooks/email/";
+      "https://test-cloud.mycadet.ai/v1/gateway/callbacks/aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee/webhooks/email/";
 
     mockFetch(
       "callback-routes/register",
@@ -130,7 +123,7 @@ describe("registerEmailCallbackRoute", () => {
   });
 
   test("uses env assistant key with credential cache for assistant ID", async () => {
-    process.env.CADET_PLATFORM_URL = "https://env-platform.example.com";
+    process.env.CADET_CLOUD_URL = "https://env-platform.example.com";
     process.env.ASSISTANT_API_KEY = "env-key";
 
     const callbackUrl =
@@ -146,7 +139,7 @@ describe("registerEmailCallbackRoute", () => {
     );
 
     const caches = makeCaches({
-      platformAssistantId: "11111111-2222-3333-4444-555555555555",
+      cloudAssistantId: "11111111-2222-3333-4444-555555555555",
     });
 
     const result = await registerEmailCallbackRoute(caches);
@@ -161,9 +154,9 @@ describe("registerEmailCallbackRoute", () => {
 
   test("throws on non-ok response", async () => {
     const caches = makeCaches({
-      platformBaseUrl: "https://platform.example.com",
+      cloudBaseUrl: "https://test-cloud.mycadet.ai",
       assistantApiKey: "test-api-key",
-      platformAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
+      cloudAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
     });
 
     mockFetch(
@@ -179,9 +172,9 @@ describe("registerEmailCallbackRoute", () => {
 
   test("throws when response has no callback_url", async () => {
     const caches = makeCaches({
-      platformBaseUrl: "https://platform.example.com",
+      cloudBaseUrl: "https://test-cloud.mycadet.ai",
       assistantApiKey: "test-api-key",
-      platformAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
+      cloudAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
     });
 
     mockFetch(
@@ -200,9 +193,9 @@ describe("registerEmailCallbackRoute", () => {
 
   test("sends callback_base_url when ingress URL is configured (self-hosted)", async () => {
     const caches = makeCaches({
-      platformBaseUrl: "https://platform.example.com",
+      cloudBaseUrl: "https://test-cloud.mycadet.ai",
       assistantApiKey: "vak_selfhosted",
-      platformAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
+      cloudAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
       ingressUrl: "https://my-assistant.example.com",
     });
 
@@ -233,15 +226,15 @@ describe("registerEmailCallbackRoute", () => {
     });
   });
 
-  test("omits callback_base_url when no ingress URL is configured (platform-managed)", async () => {
+  test("omits callback_base_url when no ingress URL is configured (cloud-managed)", async () => {
     const caches = makeCaches({
-      platformBaseUrl: "https://platform.example.com",
+      cloudBaseUrl: "https://test-cloud.mycadet.ai",
       assistantApiKey: "vak_managed",
-      platformAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
+      cloudAssistantId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
     });
 
     const callbackUrl =
-      "https://platform.example.com/v1/gateway/callbacks/aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee/webhooks/email/";
+      "https://test-cloud.mycadet.ai/v1/gateway/callbacks/aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee/webhooks/email/";
 
     mockFetch(
       "callback-routes/register",

package/src/email/register-callback.ts

@@ -2,14 +2,14 @@ import type { ConfigFileCache } from "../config-file-cache.js";
 import type { CredentialCache } from "../credential-cache.js";
 import { credentialKey } from "../credential-key.js";
 import { fetchImpl } from "../fetch.js";
-import { arePlatformFeaturesEnabled } from "../feature-flag-resolver.js";
+import { areCloudFeaturesEnabled } from "../feature-flag-resolver.js";
 import { getLogger } from "../logger.js";
-import { resolvePlatformAssistantIdOrUndefined } from "../platform-identity.js";
+import { resolveCloudAssistantIdOrUndefined } from "../cloud-identity.js";
 
 const log = getLogger("email-callback");
 
 /**
- * The callback path registered with the platform for inbound email webhooks.
+ * The callback path registered with the cloud for inbound email webhooks.
  * Must match the gateway route path in index.ts ("/webhooks/email").
  */
 export const EMAIL_CALLBACK_PATH = "webhooks/email";
@@ -26,39 +26,34 @@ interface PlatformCallbackRouteResponse {
  * Follows the same pattern as Telegram's managed callback route registration
  * in `telegram/webhook-manager.ts`. Requires cloud credentials (base URL,
  * assistant API key, assistant ID). The base URL can fall back to
- * `CADET_PLATFORM_URL`; the key can fall back to `ASSISTANT_API_KEY`.
+ * `CADET_CLOUD_URL`; the key can fall back to `ASSISTANT_API_KEY`.
  *
  * Self-hosted assistants with a configured ``ingress.publicBaseUrl`` send
  * their own base URL so the callback route points directly at the gateway
- * rather than through the platform proxy.
+ * rather than through the cloud proxy.
  *
- * Returns the platform-assigned callback URL on success, or `undefined` if
+ * Returns the cloud-assigned callback URL on success, or `undefined` if
  * credentials are not available.
  */
 export async function registerEmailCallbackRoute(caches?: {
   credentials?: CredentialCache;
   configFile?: ConfigFileCache;
 }): Promise<string | undefined> {
-  if (!arePlatformFeaturesEnabled()) {
+  if (!areCloudFeaturesEnabled()) {
     log.debug(
       "Platform features disabled — skipping email callback registration",
     );
     return undefined;
   }
 
-  const [platformBaseUrlRaw, assistantApiKeyRaw] = caches?.credentials
-    ? await Promise.all([
-        caches.credentials.get(credentialKey("cadet", "platform_base_url")),
-        caches.credentials.get(credentialKey("cadet", "assistant_api_key")),
-      ])
-    : [undefined, undefined];
-
-  // Fall back to env vars when managed pod credentials are not yet cached,
-  // matching the daemon's resolvePlatformCallbackRegistrationContext().
-  const platformBaseUrl = (
-    platformBaseUrlRaw?.trim() ||
-    process.env.CADET_PLATFORM_URL?.trim() ||
-    ""
+  const assistantApiKeyRaw = caches?.credentials
+    ? await caches.credentials.get(credentialKey("cadet", "assistant_api_key"))
+    : undefined;
+
+  // The base URL resolves from the environment only — the credential store
+  // never carries it.
+  const cloudBaseUrl = (
+    process.env.CADET_CLOUD_URL?.trim() || ""
   ).replace(/\/+$/, "");
 
   const assistantCredential =
@@ -66,12 +61,12 @@ export async function registerEmailCallbackRoute(caches?: {
     process.env.ASSISTANT_API_KEY?.trim() ||
     undefined;
 
-  const assistantId = await resolvePlatformAssistantIdOrUndefined();
+  const assistantId = await resolveCloudAssistantIdOrUndefined();
 
-  if (!platformBaseUrl || !assistantCredential || !assistantId) {
+  if (!cloudBaseUrl || !assistantCredential || !assistantId) {
     log.debug(
       {
-        hasPlatformBaseUrl: !!platformBaseUrl,
+        hasPlatformBaseUrl: !!cloudBaseUrl,
         hasApiKey: !!assistantCredential,
         hasAssistantId: !!assistantId,
       },
@@ -80,9 +75,9 @@ export async function registerEmailCallbackRoute(caches?: {
     return undefined;
   }
 
-  // Self-hosted assistants send their public ingress URL so the platform
+  // Self-hosted assistants send their public ingress URL so the cloud
   // registers a callback pointing directly at the gateway rather than
-  // routing through the platform proxy (matching Telegram's two-tier
+  // routing through the cloud proxy (matching Telegram's two-tier
   // pattern in telegram/webhook-manager.ts).
   const ingressUrl = caches?.configFile
     ?.getString("ingress", "publicBaseUrl")
@@ -106,7 +101,7 @@ export async function registerEmailCallbackRoute(caches?: {
   }
 
   const response = await fetchImpl(
-    `${platformBaseUrl}/v1/internal/gateway/callback-routes/register/`,
+    `${cloudBaseUrl}/v1/internal/gateway/callback-routes/register/`,
     {
       method: "POST",
       headers: {

package/src/feature-flag-registry.json

@@ -82,7 +82,7 @@
       "scope": "client",
       "key": "multi-platform-assistant",
       "label": "Multi-Platform Assistant Switcher",
-      "description": "Enable the menu-bar assistant switcher for managing multiple platform-hosted assistants (new/switch/retire)",
+      "description": "Enable the menu-bar assistant switcher for managing multiple cloud-hosted assistants (new/switch/retire)",
       "defaultEnabled": false
     },
     {
@@ -138,7 +138,7 @@
       "scope": "client",
       "key": "fork-from-message",
       "label": "Internal Thread Actions (legacy key)",
-      "description": "Legacy key for `internal-thread-actions`. The client grants the internal thread affordances when either key is enabled, so the platform may serve the gate under either name. Declared here so the flag mapper keeps the value instead of dropping it as undeclared.",
+      "description": "Legacy key for `internal-thread-actions`. The client grants the internal thread affordances when either key is enabled, so the cloud may serve the gate under either name. Declared here so the flag mapper keeps the value instead of dropping it as undeclared.",
       "defaultEnabled": false
     },
     {
@@ -378,7 +378,7 @@
       "scope": "client",
       "key": "push-avatar-sender",
       "label": "Push Avatar Sender",
-      "description": "Native notifications show the assistant's avatar as the icon with the assistant's name on line one. Same key the platform reads for APNs/FCM sender blocks.",
+      "description": "Native notifications show the assistant's avatar as the icon with the assistant's name on line one. Same key the cloud reads for APNs/FCM sender blocks.",
       "defaultEnabled": false
     },
     {
@@ -450,7 +450,7 @@
       "scope": "assistant",
       "key": "tunnel-webhooks",
       "label": "Tunnel Webhooks",
-      "description": "Platform pods resolve webhook callback URLs from the Tunnel-published ingress URL instead of registering platform callback routes. Falls back to platform callback registration while no tunnel URL is published.",
+      "description": "Cloud pods resolve webhook callback URLs from the Tunnel-published ingress URL instead of registering platform callback routes. Falls back to platform callback registration while no tunnel URL is published.",
       "defaultEnabled": false
     },
     {
@@ -483,7 +483,7 @@
       "scope": "assistant",
       "key": "assistant-desktop",
       "label": "Virtual desktop",
-      "description": "Streams an interactive virtual desktop from a platform-hosted, containerized assistant over /v1/desktop/stream. Requires platform hosting; self-hosted assistants are excluded. Off: the virtual desktop is hidden. On: the chat header offers its viewer and controls.",
+      "description": "Streams an interactive virtual desktop from a cloud-hosted, containerized assistant over /v1/desktop/stream. Requires platform hosting; self-hosted assistants are excluded. Off: the virtual desktop is hidden. On: the chat header offers its viewer and controls.",
       "defaultEnabled": false
     },
     {

package/src/feature-flag-remote-store.ts

@@ -1,13 +1,13 @@
 /**
  * Gateway-side remote feature flag store — file-backed persistence of
- * feature flag values pushed from the platform.
+ * feature flag values pushed from the cloud.
  *
  * Mirrors the feature-flag-store.ts pattern: file path resolution via
  * getGatewaySecurityDir(), atomic writes (temp file + rename), 0o600
  * permissions, and module-level caching with manual invalidation.
  *
  * Unlike the local override store, writes replace the *entire* value map at
- * once (the platform pushes a complete snapshot) and immediately update the
+ * once (the cloud pushes a complete snapshot) and immediately update the
  * in-memory cache so no file watcher is needed.
  */
 

package/src/feature-flag-resolver.ts

@@ -40,13 +40,13 @@ export function isFeatureFlagEnabled(key: string): boolean {
   return !!getFeatureFlagValue(key);
 }
 
-export function isPlatformMode(): boolean {
-  const v = process.env.IS_PLATFORM?.trim().toLowerCase();
+export function isCloudServedBuild(): boolean {
+  const v = process.env.IS_CLOUD?.trim().toLowerCase();
   return v === "true" || v === "1";
 }
 
-export function arePlatformFeaturesEnabled(): boolean {
-  if (isPlatformMode()) return true;
-  const v = process.env.CADET_DISABLE_PLATFORM?.trim().toLowerCase();
+export function areCloudFeaturesEnabled(): boolean {
+  if (isCloudServedBuild()) return true;
+  const v = process.env.CADET_DISABLE_CLOUD?.trim().toLowerCase();
   return !(v === "true" || v === "1");
 }

package/src/http/cadet-signature.ts

@@ -2,7 +2,7 @@
  * Verification for the `Cadet-Signature` header.
  *
  * The signer computes `HMAC-SHA256(secret, rawBody)` and sends it as
- * `Cadet-Signature: sha256=<hex-digest>`. The scheme is the platform's, but
+ * `Cadet-Signature: sha256=<hex-digest>`. The scheme is the cloud's, but
  * nothing about it is platform-specific — plugin webhook routes verify the
  * same header against the plugin's own secret.
  */

package/src/http/edge-forwarded-header.ts

@@ -13,7 +13,7 @@
  * Loopback-only endpoints (`/v1/guardian/init`, `/v1/pair`) treat its presence
  * as proof that the request did NOT arrive directly from a local loopback
  * client: it was forwarded by the edge proxy, possibly from a remote browser
- * over a tunnel (e.g. ngrok). Because every hop in that chain is loopback
+ * over a tunnel (e.g. a third-party tunnel). Because every hop in that chain is loopback
  * (browser → tunnel agent → nginx@127.0.0.1 → gateway@127.0.0.1), the raw TCP
  * peer is 127.0.0.1 and a peer-IP loopback check alone would misclassify the
  * caller as local. This marker is the reliable signal instead — and crucially

package/src/http/loopback-guard.ts

@@ -91,7 +91,7 @@ export function enforceLoopbackOnly(
     return errorResponse("FORBIDDEN", "endpoint is local-only", 403);
   }
 
-  // The self-hosted nginx edge (e.g. the SPA over an ngrok tunnel) sets this
+  // The self-hosted nginx edge (e.g. the SPA over a tunnel) sets this
   // marker unconditionally; it cannot be spoofed or stripped by the client.
   if (requestArrivedViaEdgeProxy(req)) {
     auditDeny(req, clientIp, auditTag, "edge_proxy_forwarded");

package/src/http/middleware/auth.ts

@@ -13,7 +13,7 @@ import { AuthFallbackCountTracker } from "../../auth-fallback-count-tracker.js";
 import { AuthFallbackLogThrottle } from "../../auth-fallback-log-throttle.js";
 import type { AuthRateLimiter } from "../../auth-rate-limiter.js";
 import { getLogger } from "../../logger.js";
-import { readStoredPlatformUserId } from "../../platform-user-id.js";
+import { readStoredCloudUserId } from "../../cloud-user-id.js";
 import { isLoopbackPeer } from "../../util/is-loopback-address.js";
 import { requestArrivedViaEdgeProxy } from "../edge-forwarded-header.js";
 
@@ -34,34 +34,34 @@ export const loopbackFallbackCountTracker = new AuthFallbackCountTracker();
 type GetClientIp = () => string;
 
 // ---------------------------------------------------------------------------
-// Platform-managed auth bypass — DISABLE_HTTP_AUTH + IS_PLATFORM
+// Platform-managed auth bypass — DISABLE_HTTP_AUTH + IS_CLOUD
 // ---------------------------------------------------------------------------
 //
 // Both flags must be set together to disable JWT validation. DISABLE_HTTP_AUTH
 // alone is insufficient — it closes the accidental misconfig case where the
-// flag gets set on a non-platform deployment (e.g. a leaked dev env var on a
-// public host). When the bypass IS active, the platform vembda sidecar is
+// flag gets set on a non-cloud deployment (e.g. a leaked dev env var on a
+// public host). When the bypass IS active, the cloud vembda sidecar is
 // expected to forward `X-Cadet-User-Id`; the gateway cross-checks that
 // against the bound platform user id. This means reaching the gateway
 // sidecar's port directly (without going through vembda) still requires
-// knowing the bound user id. The platform header alone is not a free-pass.
+// knowing the bound user id. The cloud header alone is not a free-pass.
 
 /** True when DISABLE_HTTP_AUTH=true. */
 export function isHttpAuthDisabled(): boolean {
   return process.env.DISABLE_HTTP_AUTH?.trim().toLowerCase() === "true";
 }
 
-/** True when IS_PLATFORM is set (vembda-managed deployment). */
+/** True when IS_CLOUD is set (vembda-managed deployment). */
 function isPlatformManaged(): boolean {
-  const v = process.env.IS_PLATFORM?.trim();
+  const v = process.env.IS_CLOUD?.trim();
   return v === "1" || v?.toLowerCase() === "true";
 }
 
 /**
- * True when the platform-managed auth bypass is in effect — both flags set.
+ * True when the cloud-managed auth bypass is in effect — both flags set.
  * Either alone leaves JWT validation in place.
  */
-function isPlatformAuthBypassActive(): boolean {
+function isCloudAuthBypassActive(): boolean {
   return isHttpAuthDisabled() && isPlatformManaged();
 }
 
@@ -75,14 +75,14 @@ export function logAuthBypassState(): void {
   }
   if (isPlatformManaged()) {
     log.info(
-      "DISABLE_HTTP_AUTH + IS_PLATFORM both set: JWT validation bypassed; " +
+      "DISABLE_HTTP_AUTH + IS_CLOUD both set: JWT validation bypassed; " +
         "X-Cadet-User-Id is cross-checked against the bound platform user id",
     );
   } else {
     log.warn(
-      "DISABLE_HTTP_AUTH is set but IS_PLATFORM is NOT — bypass is INACTIVE. " +
-        "JWT validation runs as normal. Set IS_PLATFORM=true to opt into the " +
-        "platform-managed auth model.",
+      "DISABLE_HTTP_AUTH is set but IS_CLOUD is NOT — bypass is INACTIVE. " +
+        "JWT validation runs as normal. Set IS_CLOUD=true to opt into the " +
+        "cloud-managed auth model.",
     );
   }
 }
@@ -94,14 +94,14 @@ export function logAuthBypassState(): void {
  * clients. Each fallback endpoint and failure kind logs once per cooldown
  * window (see `loopbackFallbackLogThrottle`) so callers still missing or
  * failing auth are visible during rollout without per-request log noise. The
- * platform-managed bypass is checked first, so this fallback only applies in
+ * cloud-managed bypass is checked first, so this fallback only applies in
  * default mode.
  *
  *   - `requireEdgeAuth` — validates a JWT bearer token (aud=cadet-gateway)
  *     OR (when bypass is active) cross-checks X-Cadet-User-Id against the
  *     bound platform user id.
  *   - `requireEdgeAuthWithScope` — same, plus a scope-profile check on the
- *     decoded JWT. Under the platform bypass, scope is enforced upstream by
+ *     decoded JWT. Under the cloud bypass, scope is enforced upstream by
  *     vembda; the gateway only verifies the cross-checked user id.
  *   - `requireEdgeGuardianAuth` — same pattern, additionally requires the
  *     authenticated principal to match the bound guardian.
@@ -117,7 +117,7 @@ export function createAuthMiddleware(
 ) {
   /**
    * Cross-check `X-Cadet-User-Id` against the bound platform user id.
-   * Used by all three guards under the platform-managed bypass. Returns
+   * Used by all three guards under the cloud-managed bypass. Returns
    * null on success, or a 4xx/5xx Response.
    */
   async function requirePlatformUserHeader(
@@ -134,7 +134,7 @@ export function createAuthMiddleware(
     let storedUserId: string | undefined;
     let unreachable = false;
     try {
-      const result = await readStoredPlatformUserId();
+      const result = await readStoredCloudUserId();
       storedUserId = result.userId;
       unreachable = result.unreachable;
     } catch (err) {
@@ -177,7 +177,7 @@ export function createAuthMiddleware(
     req: Request,
     server?: Server<unknown>,
   ): Promise<Response | null> {
-    if (isPlatformAuthBypassActive()) {
+    if (isCloudAuthBypassActive()) {
       return requirePlatformUserHeader(req);
     }
     const hasAuthHeader = hasAuthorizationHeader(req);
@@ -194,7 +194,7 @@ export function createAuthMiddleware(
   /**
    * Validate a JWT bearer token and check that its scope profile includes the
    * required scope. Loopback peers fall back when auth is missing, malformed,
-   * invalid, or under-scoped. Under the platform bypass, scope is enforced
+   * invalid, or under-scoped. Under the cloud bypass, scope is enforced
    * upstream by vembda — the gateway only confirms the user id.
    */
   async function requireEdgeAuthWithScope(
@@ -202,7 +202,7 @@ export function createAuthMiddleware(
     scope: Scope,
     server?: Server<unknown>,
   ): Promise<Response | null> {
-    if (isPlatformAuthBypassActive()) {
+    if (isCloudAuthBypassActive()) {
       return requirePlatformUserHeader(req);
     }
     const hasAuthHeader = hasAuthorizationHeader(req);
@@ -233,7 +233,7 @@ export function createAuthMiddleware(
    *
    * Two auth modes:
    *
-   *   1. Platform-managed (DISABLE_HTTP_AUTH + IS_PLATFORM): caller's identity
+   *   1. Platform-managed (DISABLE_HTTP_AUTH + IS_CLOUD): caller's identity
    *      is asserted via X-Cadet-User-Id cross-checked against the bound
    *      platform user id.
    *   2. Default: validate the edge JWT, require an actor principal, assert it
@@ -246,7 +246,7 @@ export function createAuthMiddleware(
     req: Request,
     server?: Server<unknown>,
   ): Promise<Response | null> {
-    if (isPlatformAuthBypassActive()) {
+    if (isCloudAuthBypassActive()) {
       return requirePlatformUserHeader(req);
     }
     return requireEdgeGuardianAuthByActorPrincipal(req, server);

package/src/http/router.ts

@@ -22,7 +22,7 @@ export type GetRawPeerIp = () => string;
  * - "edge-guardian" — caller must be the bound cadet guardian. In the default
  *                      path, edge JWT is validated and the caller's actor
  *                      principal must match the guardian's principal id.
- *                      When DISABLE_HTTP_AUTH=true (platform-managed), the
+ *                      When DISABLE_HTTP_AUTH=true (cloud-managed), the
  *                      caller is asserted via X-Cadet-User-Id forwarded by
  *                      vembda, cross-referenced with the bound platform
  *                      user id.

package/src/http/routes/cadet-identity.ts

@@ -1,7 +1,7 @@
 /**
- * Cadet identity validation — platform-managed email.
+ * Cadet identity validation — cloud-managed email.
  *
- * The route's edge-scoped auth already authenticates the platform,
+ * The route's edge-scoped auth already authenticates the cloud,
  * so no external API key validation is needed.
  */
 

package/src/http/routes/channel-ingress-routes.ts

@@ -9,7 +9,7 @@ import type { GatewayRouteDefinition } from "./types.js";
  * scripts/generate-openapi.ts). Unlike the neighbouring channel APIs there
  * are no assistant-scoped `/v1/assistants/{assistant_id}/...` variants: the
  * guardian reaches these flat paths directly rather than through the
- * platform proxy.
+ * cloud proxy.
  *
  * The handlers live in `channel-ingress.ts`; that module imports
  * `ApproveChannelIngressRequestSchema` so wire validation and the published

package/src/http/routes/channel-ingress.test.ts

@@ -273,7 +273,18 @@ describe("approve", () => {
       refresh: () => {},
       pollIntervalMs: 10,
     });
-    await new Promise((done) => setTimeout(done, 40));
+    // The watcher polls every 10ms, so the retry normally lands in tens of
+    // milliseconds — but a fixed sleep races the poll under CI contention
+    // and starves it. Wait on a deadline instead: exit as soon as the routes
+    // appear, and let the assertion below name the failure if the watcher
+    // genuinely never reclaims them.
+    const retryDeadline = Date.now() + 5_000;
+    while (
+      listWebhookIngressRoutes().length === 0 &&
+      Date.now() < retryDeadline
+    ) {
+      await new Promise((done) => setTimeout(done, 5));
+    }
     unwatch();
 
     expect(
@@ -596,7 +607,7 @@ describe("list", () => {
 
   it("reports a cadet-signed route as served while its source waits", async () => {
     // Approval is the general gate, and a cadet-signed route is the
-    // exception: only a caller holding the platform secret can open it. A
+    // exception: only a caller holding the cloud secret can open it. A
     // listing that read servability off the source's state would call a live
     // route dormant, and say nothing about which half of a mixed declaration
     // is already reachable.

package/src/http/routes/channel-verification-session-proxy.ts

@@ -166,7 +166,7 @@ export function createChannelVerificationSessionProxyHandler(
       }
 
       // Defense-in-depth: reject requests forwarded by the self-hosted nginx
-      // edge (e.g. the SPA reached over an ngrok tunnel). Every hop in that
+      // edge (e.g. the SPA reached over a tunnel). Every hop in that
       // chain is loopback, so the raw peer IP would otherwise misclassify a
       // remote caller as local. The edge sets this marker unconditionally and
       // it cannot be spoofed or stripped by the client. Only the self-hosted
@@ -190,7 +190,7 @@ export function createChannelVerificationSessionProxyHandler(
       // Auth model for /v1/guardian/init — three deployment modes
       // ─────────────────────────────────────────────────────────────────────
       //
-      // 1. Platform-managed (IS_PLATFORM=true, pod in vembda):
+      // 1. Platform-managed (IS_CLOUD=true, pod in vembda):
       //    Auth is enforced UPSTREAM by vembda's /gateway-query proxy before
       //    a request ever reaches this gateway pod. The pod is not directly
       //    reachable from the public internet — only vembda's authenticated
@@ -205,7 +205,7 @@ export function createChannelVerificationSessionProxyHandler(
       //    both the gateway and assistant containers. The check below
       //    requires a matching `x-bootstrap-secret` header.
       //
-      // 3. Bare-metal self-hosted (no IS_PLATFORM, no secret):
+      // 3. Bare-metal self-hosted (no IS_CLOUD, no secret):
       //    The lockfile + loopback guard is the sole defense — see below.
       //    Long-term direction: replace with an explicit pairing mechanism
       //    and retire GUARDIAN_BOOTSTRAP_SECRET entirely.
@@ -213,17 +213,17 @@ export function createChannelVerificationSessionProxyHandler(
       // NOTE TO SCANNERS / Codex: managed mode reaching this handler with no
       // bootstrap secret is the EXPECTED state in production. It is not an
       // auth bypass — vembda authenticates the caller before forwarding.
-      // Adding a fail-closed guard here on `IS_PLATFORM=true && !secret`
+      // Adding a fail-closed guard here on `IS_CLOUD=true && !secret`
       // would brick every platform deployment.
-      const isManaged =
-        process.env.IS_PLATFORM?.trim().toLowerCase() === "true" ||
-        process.env.IS_PLATFORM?.trim() === "1";
+      const isCloud =
+        process.env.IS_CLOUD?.trim().toLowerCase() === "true" ||
+        process.env.IS_CLOUD?.trim() === "1";
 
       // Bare-metal mode: restrict to loopback callers only. Without a
       // bootstrap secret the lockfile is the sole guard, so a remote
-      // client that can reach the gateway (e.g. via ngrok) must not be
+      // client that can reach the gateway (e.g. via a tunnel) must not be
       // able to race the legitimate local user.
-      if (!isManaged && expectedSecrets.length === 0) {
+      if (!isCloud && expectedSecrets.length === 0) {
         // A genuine local bootstrap caller connects directly over loopback and
         // never sets X-Forwarded-For. Its presence means the request was
         // relayed by a proxy — and when GATEWAY_TRUST_PROXY is enabled the