@visa/cli 4.1.0-rc.274 → 4.1.0-rc.276

package/README.md

@@ -403,6 +403,30 @@ handle is deleted only after possession-authenticated protected readback proves
 that exact prior generation retired; uncertain readback preserves it. Native
 custody uses the configured OS store or explicit headless KEK descriptor.
 
-Native owner revocation is a separate follow-up; the legacy `keychain revoke`
-command refuses a selected native TAP profile rather than mutating a different
-legacy slot. Renewal retirement and cleanup above are available now.
+`visa agent keychain revoke --agent <name-or-id> --purpose tap` opens an independent
+owner review for the selected native runtime. The protected owner action stops current
+and pending TAP authority, including an interrupted renewal. Local locks or unreadable
+recovery journals do not prevent opening the owner review. The CLI preserves every known
+handle until exact terminal readback, then deletes keys idempotently; `keychain resume`
+retries locked cleanup. A public revoked selection tombstone prevents legacy TAP fallback.
+After cleanup completes, `connect-device` explicitly enrolls a new runtime.
+
+### Native Subway owner certificates
+
+New `agent keychain renew --purpose subway --advanced` requests keep the Subway
+child key in native custody. Complete the existing offline browser owner certificate
+review and import its response with `--response <file>`. Repeating the response
+command resumes interrupted certification, prior-runtime revocation, or locked-key
+cleanup. An expired unsigned request keeps its native key and produces a fresh
+owner request. `keychain status` reports pending work and the selected native profile.
+
+Register the Subway name again after renewal so its peer key matches the selected
+child. WebSocket messages and direct libp2p Noise authentication use structured
+native signing operations. Invalid, expired, revoked, or unavailable native selection
+fails closed. Existing unpaired mesh usage retains its current behavior.
+
+The public renewal journal preserves both generations until the runtime service
+confirms revocation of the exact previous child. Only then does cleanup remove its
+native handle or isolated legacy Subway key file. `keychain revoke --purpose subway`
+revokes the selected child before deleting its key; repeat it to retry locked cleanup.
+Wallet and card custody are separate.