@visa/cli 4.1.0-rc.307 → 4.1.0-rc.308

package/README.md

@@ -439,23 +439,13 @@ After cleanup completes, `connect-device` explicitly enrolls a new runtime.
 
 ### Native Subway owner certificates
 
-New `agent keychain renew --purpose subway --advanced` requests keep the Subway
-child key in native custody. Complete the existing offline browser owner certificate
-review and import its response with `--response <file>`. Repeating the response
-command resumes interrupted certification, prior-runtime revocation, or locked-key
-cleanup. An expired unsigned request keeps its native key and produces a fresh
-owner request. `keychain status` reports pending work and the selected native profile.
-
-Register the Subway name again after renewal so its peer key matches the selected
-child. WebSocket messages and direct libp2p Noise authentication use structured
-native signing operations. Invalid, expired, revoked, or unavailable native selection
-fails closed. Existing unpaired mesh usage retains its current behavior.
-
-The public renewal journal preserves both generations until the runtime service
-confirms revocation of the exact previous child. Only then does cleanup remove its
-native handle or isolated legacy Subway key file. `keychain revoke --purpose subway`
-revokes the selected child before deleting its key; repeat it to retry locked cleanup.
-Wallet and card custody are separate.
+Subway certificate issuance and renewal retired with the runtime certificate plane
+(UNIFY D2); `agent keychain renew` and `revoke` accept only `--purpose tap`. A Subway
+certificate an earlier build already selected keeps signing through the native
+financial-presence key while its owner signature stays valid: WebSocket messages and
+direct libp2p Noise authentication use structured native signing operations, and an
+invalid, expired, revoked, or unavailable selection fails closed. Existing unpaired
+mesh usage retains its current behavior.
 
 ### Protected managed-wallet rollout