@visa/cli 5.0.0-rc.371 → 5.0.0-rc.373

package/README.md

@@ -211,12 +211,16 @@ are kept as `*.replaced-<time>` backups). `--restart` never touches the
 installed `pair-visa-agent` skill; `--force-skill` replaces it, moving a locally
 edited copy to `.visa-cli-managed/backups/` first.
 
-On macOS and Linux the private identity key lives under `~/.visa-cli/` in an
-owner-only directory with file mode `0600`. It is an exportable local file:
-copying it transfers identity proof, and losing it blocks new proofs, because
-same-agent key recovery does not exist yet. Protocol-v2 identity pairing fails
-closed on Windows until the CLI can apply and verify an owner-only Windows ACL.
-The approval link carries no credential and no private key.
+The agent's keys (wallet, card and TAP) live in the operating system's
+store: the macOS Keychain, Windows data protection (DPAPI), or the Linux Secret
+Service; a server without one uses an owner-only `0600` file only when
+`VISA_RUNTIME_CUSTODY_PROFILE=headless` is set. There are no password prompts,
+and software running as you on this machine can use the keys, so treat the
+machine as the key: pause or revoke the agent in the Console if it is lost. To
+move an agent to another computer, run `visa connect` there and choose
+**Replacing** on the approval page: the same agent gets new keys, keeps its
+budget and history, and the old keys are retired. The approval link carries no
+credential and no private key.
 
 ## Limits: what may be spent
 
@@ -490,6 +494,7 @@ Deterministic preconditions always resolve to a specific code:
 | The login keychain is locked or unavailable to the signer | `keychain_locked_or_unavailable` | `platform` |
 | The Linux keyring is locked, missing, or did not answer in time | `secret_service_locked_or_unavailable`, `secret_service_unavailable`, `secret_service_timeout` | `platform` |
 | Windows DPAPI refused the device key (usually a different Windows user) | `dpapi_locked_or_unavailable` | `platform` |
+| `visa connect --restart` while this computer's setup still waits for the owner's device approval (run `visa connect` to reopen it) | `enrollment_device_approval_pending` | `platform` |
 | The signer refused: this key is bound to another purpose, or an identity key was asked for a financial proof (nothing was signed or sent; update the CLI) | `key_purpose_mismatch`, `legacy_custody_profile_required` | `platform` |
 | The signer refused: the request named another agent or runtime than the key is bound to | `identity_binding_mismatch` | `platform` |
 | The signer refused a proof timestamp outside its window (the machine clock is wrong) | `proof_time_invalid` | `platform` |