@visa/cli 4.1.0-rc.326 → 4.1.0-rc.328

package/README.md

@@ -12,7 +12,7 @@ The protected product flow has three explicit parts:
 1. **Enrollment** — call `agent_enroll` or have the owner run `visa agent enroll`
    and approves the exact device and its limits in the browser. The private key
    stays on the runtime device. Retired setup, pairing, handoff, and per-rail
-   grant names return `legacy_door_removed`; they never resume or proxy work.
+   grant names are not registered at all; they never resume or proxy work.
 2. **Capabilities** — payment methods, spend grants, email and directory
    bindings are configured separately, each with its own human-visible terms.
 3. **Use** — when a separately provisioned capability exists, the wallet and
@@ -241,23 +241,24 @@ is required so the CLI never guesses which agent can spend.
 ## MCP tools (v4 surface)
 
 Rows marked **Removed** are kept so old transcripts still resolve: the tool is
-no longer in `tools/list`, and a direct call by name answers
-`legacy_door_removed` naming the one door for a new agent,
-`visa agent enroll-protected`.
+no longer in `tools/list`, and a direct call by name is an unknown-tool error.
+The one door for a new agent is `visa agent enroll` / `agent_enroll`.
 
 A leftover direct-mode `turnkey.json` is not usable wallet authority.
 `agent_capabilities` reports wallet status `legacy_direct_mode` and unavailable;
 `get_status` directs even an already paired agent to `agent_enroll`. Have the
 owner complete `visa agent enroll` before attempting payment.
 
-Auth HTTP 410 responses with `code: route_retired` or `error: route_retired`
-are classified as `legacy_door_removed`. Follow `agent_enroll` /
-`visa agent enroll`; retrying the retired route does not restore it.
+A deploy that predates the tombstone removal can still answer HTTP 410 with
+`code: route_retired`; the CLI classifies that as `legacy_door_removed`. Once
+the removal is deployed the same paths answer a typed JSON 404
+(`ROUTE_NOT_FOUND`). Either way, follow `agent_enroll` / `visa agent enroll`;
+retrying the retired route does not restore it.
 
 
 | Tool | Description |
 |------|-------------|
-| `agent_capabilities` | Derived live capability map (identity, wallet, card, mail, tap, subway) with upgrade paths |
+| `agent_capabilities` | Derived live capability map (identity, wallet, card, mail, tap) with upgrade paths |
 | `agent_login` | Start/claim the owner's device account session (required before a grant) |
 | `wallet_status` | Delegated wallet address, network, and policy state |
 | `wallet_policy_set` | Set per-transaction / daily caps (with human approval) |
@@ -410,7 +411,7 @@ and resolves its owner root from the independently claimed selection. The device
 ceremonies (`connect-device`, `renew`, `resume`, `revoke --purpose tap`) travel the
 public identity-device relay with native possession proofs, so a missing or expired
 `visa agent login` never blocks them; the owner approval and owner revocation pages
-remain required. Hosted purposes (`card:vic`, `wallet:x402`, hosted `tap`, `subway`)
+remain required. Hosted purposes (`card:vic`, `wallet:x402`, hosted `tap`)
 still need a locally paired agent and its Auth session.
 
 `visa agent keychain renew --agent <name-or-id> --purpose tap` creates an independently
@@ -435,15 +436,6 @@ handle until exact terminal readback, then deletes keys idempotently; `keychain
 retries locked cleanup. A public revoked selection tombstone prevents legacy TAP fallback.
 After cleanup completes, `connect-device` explicitly enrolls a new runtime.
 
-### Native Subway owner certificates
-
-Subway certificate issuance and renewal retired with the runtime certificate plane
-(UNIFY D2); `agent keychain renew` and `revoke` accept only `--purpose tap`. A Subway
-certificate an earlier build already selected keeps signing through the native
-financial-presence key while its owner signature stays valid: WebSocket messages and
-direct libp2p Noise authentication use structured native signing operations, and an
-invalid, expired, revoked, or unavailable selection fails closed. Existing unpaired
-mesh usage retains its current behavior.
 
 ### Protected managed-wallet rollout