run402 4.94.0 → 4.96.0

package/lib/delegates.mjs

@@ -15,18 +15,18 @@ Usage:
   run402 delegates <subcommand> [args...]
 
 Subcommands:
-  create --grant <grant_id> [--project <id>] [--capability <cap>] [--kind <kind>]
+  create --grant <grant_id> [--project <project_id>] [--capability <cap>] [--kind <kind>]
          [--scope <json>] [--expires <iso8601>]
                                  Mint a delegate. The bearer is printed ONCE.
-  list [--project <id>]          List delegates (never shows tokens)
-  revoke <delegate_id> [--project <id>]
+  list [--project <project_id>]          List delegates (never shows tokens)
+  revoke <delegate_id> [--project <project_id>]
                                  Revoke immediately
-  rotate <delegate_id> [--project <id>]
+  rotate <delegate_id> [--project <project_id>]
                                  Revoke + reissue; new bearer printed ONCE
 
 Notes:
   - A delegate NARROWS an existing grant, so mint the grant first:
-      run402 grants create <agent-wallet> --capability deploy --project <id>
+      run402 grants create <agent-wallet> --capability deploy --project <project_id>
     then pass the returned grant_id to 'delegates create'.
   - Mutations require you to be an owner of the project's org (wallet SIWX).
   - A delegate can never be an owner, and is revocable and expiring.
@@ -51,7 +51,7 @@ const SUB_HELP = {
   create: `run402 delegates create — mint a scoped deploy credential
 
 Usage:
-  run402 delegates create --grant <grant_id> [--project <id>] [--capability <cap>]
+  run402 delegates create --grant <grant_id> [--project <project_id>] [--capability <cap>]
                           [--kind <kind>] [--scope <json>] [--expires <iso8601>]
 
 --capability defaults to "deploy". --kind defaults to "run402_agent_key" (the
@@ -64,21 +64,21 @@ Requires owner of the project's org.
   list: `run402 delegates list — list a project's delegates
 
 Usage:
-  run402 delegates list [--project <id>]
+  run402 delegates list [--project <project_id>]
 
 Never returns tokens or secret material — id, kind, scope, expiry, revocation.
 `,
   revoke: `run402 delegates revoke — revoke a delegate immediately
 
 Usage:
-  run402 delegates revoke <delegate_id> [--project <id>]
+  run402 delegates revoke <delegate_id> [--project <project_id>]
 
 Takes effect for every subsequent request. Requires owner of the project's org.
 `,
   rotate: `run402 delegates rotate — revoke and reissue in one step
 
 Usage:
-  run402 delegates rotate <delegate_id> [--project <id>]
+  run402 delegates rotate <delegate_id> [--project <project_id>]
 
 Keeps the same principal, grant, kind, scope, cap and expiry. The NEW bearer is
 printed once. Use this when a token is lost or possibly exposed.
@@ -99,12 +99,12 @@ async function create(args) {
   requirePositionalCount(rest, CREATE_VALUE_FLAGS, {
     min: 0,
     max: 0,
-    command: "run402 delegates create --grant <grant_id> [--project <id>]",
+    command: "run402 delegates create --grant <grant_id> [--project <project_id>]",
     missing: "",
   });
   if (!grantId) {
     console.error("Missing --grant <grant_id>. Mint one first:");
-    console.error("  run402 grants create <agent-wallet> --capability deploy --project <id>");
+    console.error("  run402 grants create <agent-wallet> --capability deploy --project <project_id>");
     process.exit(1);
   }
   const scope = scopeRaw != null
@@ -135,7 +135,7 @@ async function list(args) {
   requirePositionalCount(rest, ["--project"], {
     min: 0,
     max: 0,
-    command: "run402 delegates list [--project <id>]",
+    command: "run402 delegates list [--project <project_id>]",
     missing: "",
   });
   try {
@@ -153,7 +153,7 @@ function oneIdCommand(name) {
     const [delegateId] = requirePositionalCount(rest, ["--project"], {
       min: 1,
       max: 1,
-      command: `run402 delegates ${name} <delegate_id> [--project <id>]`,
+      command: `run402 delegates ${name} <delegate_id> [--project <project_id>]`,
       missing: "Missing <delegate_id>.",
     });
     try {

package/lib/deliveries.mjs

@@ -30,7 +30,7 @@ const HELP = `run402 deliveries — did a notification actually land
 
 Usage:
   run402 deliveries list [--type <event_type>] [--since <iso>] [--limit N] [--after <cursor>]
-  run402 deliveries get <id>
+  run402 deliveries get <notification_id>
 
 Notes:
   - One row per delivery ATTEMPT, per channel, with its outcome — the audit
@@ -70,7 +70,7 @@ async function get(args) {
   assertKnownFlags(parsedArgs, ["--help", "-h"]);
   const positionals = positionalArgs(parsedArgs);
   if (positionals.length !== 1) {
-    fail({ code: "BAD_USAGE", message: "Usage: run402 notifications get <id>" });
+    fail({ code: "BAD_USAGE", message: "Usage: run402 deliveries get <notification_id>" });
   }
   walletAuthHeaders("/agent/v1/notifications");
   try {

package/lib/deploy-v2.mjs

@@ -28,7 +28,7 @@
 import { existsSync, fstatSync, readFileSync } from "node:fs";
 import { resolve, dirname, extname, isAbsolute } from "node:path";
 import {
-  applyWithGitvault,
+  applyWithVault,
   assertLocalFileReferencesExist,
   buildDeployResolveSummary,
   githubActionsCredentials,
@@ -139,7 +139,7 @@ Options:
   --final-only            Alias for --quiet; final success/error envelope is still preserved
   --allow-warning <code>  Continue past this reviewed warning code (repeatable)
   --allow-warnings        Continue past plan warnings that require confirmation
-  --allow-dirty           gitvault-required projects only: capture a dirty
+  --allow-dirty           vault-required projects only: capture a dirty
                           work tree as-is instead of refusing
                           SNAPSHOT_DIRTY_TREE. The result discloses exactly
                           what was swept in, printed to stderr too — even
@@ -506,14 +506,14 @@ async function rehearseCmd(rawArgs) {
     });
     const planId = planned.plan.plan_id;
     if (!planId) {
-      fail({ code: "DRY_RUN_PLAN_NOT_COMMITTABLE", message: "Rehearsal requires a persisted plan_id, but the plan response did not include one.", details: { project_id: normalized.spec.project } });
+      fail({ code: "DRY_RUN_PLAN_NOT_COMMITTABLE", message: "Rehearsal requires a persisted plan_id, but the plan response did not include one.", details: { project_id: normalized.spec.project_id } });
     }
     await sdk._applyEngine.upload(planned.plan, {
-      project: normalized.spec.project,
+      project: normalized.spec.project_id,
       byteReaders: planned.byteReaders,
       onEvent: emit,
     });
-    return { planId, plan: planned.plan, projectId: normalized.spec.project };
+    return { planId, plan: planned.plan, projectId: normalized.spec.project_id };
   }
 
   try {
@@ -1250,11 +1250,11 @@ async function deployCmd(args) {
     target = await resolveDeploymentTarget({
       appRoot: applicationScope.app_root,
       manifestPath: manifestPath ?? undefined, projectId: opts.project || undefined, environmentProjectId: process.env.RUN402_PROJECT_ID || undefined,
-      manifestProjectId: manifestProject || (releaseSpec.project === "prj_up_preflight_placeholder" ? undefined : releaseSpec.project),
+      manifestProjectId: manifestProject || (releaseSpec.project_id === "prj_up_preflight_placeholder" ? undefined : releaseSpec.project_id),
       targetKind: isCoreApiTarget() ? "core" : "cloud", apiBase: API,
       allowUnresolved: opts.mode === "check" || opts.mode === "printSpec" || opts.mode === "printManifest",
     });
-    if (target.project_id) releaseSpec.project = target.project_id;
+    if (target.project_id) releaseSpec.project_id = target.project_id;
   } catch (err) { reportSdkError(err); }
   const idempotencyKey = normalizedManifest.idempotencyKey;
 
@@ -1289,7 +1289,7 @@ async function deployCmd(args) {
     return;
   }
   if (opts.mode === "printSpec") {
-    console.log(JSON.stringify({ ...releaseSpec, project: target.project_id ?? undefined }, null, 2));
+    console.log(JSON.stringify({ ...releaseSpec, project_id: target.project_id ?? undefined }, null, 2));
     return;
   }
 
@@ -1298,7 +1298,7 @@ async function deployCmd(args) {
   const delegateToken = delegateTokenFromEnv();
   if (useGithubActionsOidc) {
     sdkOpts = {
-      credentials: githubActionsCredentials({ projectId: releaseSpec.project, apiBase: API }),
+      credentials: githubActionsCredentials({ projectId: releaseSpec.project_id, apiBase: API }),
       disablePaidFetch: true,
     };
   } else if (delegateToken) {
@@ -1328,14 +1328,14 @@ async function deployCmd(args) {
     const requiredPlan = opts.mode && opts.mode.kind === "applyReviewed"
       ? { planId: opts.mode.planId, ...(opts.mode.planFingerprint ? { planFingerprint: opts.mode.planFingerprint } : {}) }
       : undefined;
-    // A thin shim over the SDK lane (add-gitvault 5.0). `applyWithGitvault`
-    // takes the project's `gitvault_policy` into account: a project that is
+    // A thin shim over the SDK lane (add-vault 5.0). `applyWithVault`
+    // takes the project's `vault_policy` into account: a project that is
     // not `required` runs the same `apply()` this line always ran, with the
     // same options object; a `required` one captures, publishes, mints an
     // activation token, and commits with it.
     const sdk = getSdk(sdkOpts);
     const outcome = await withAutoApprove(() =>
-      applyWithGitvault({
+      applyWithVault({
         sdk,
         spec: releaseSpec,
         apply: {
@@ -1348,7 +1348,7 @@ async function deployCmd(args) {
         },
         target: isCoreApiTarget() ? "core" : "cloud",
         ...(opts.allowDirty ? { allowDirty: true } : {}),
-        // The `gitvault_commit` line is printed ALWAYS, and to stderr, so
+        // The `vault_commit` line is printed ALWAYS, and to stderr, so
         // `run402 deploy | jq` stays clean (the pipe contract).
         onCommitLine: (line) => { if (!opts.quiet) process.stderr.write(`${line}\n`); },
       }),
@@ -1356,30 +1356,30 @@ async function deployCmd(args) {
     // Cache the activated deployment id so `run402 subdomains add` can
     // pass it as an optimization (the gateway defaults to the live release
     // without it). Best-effort: a keystore hiccup never fails the deploy.
-    rememberLastDeployment(releaseSpec.project, outcome.deploy?.urls?.deployment_id);
-    if (!outcome.gitvault) {
+    rememberLastDeployment(releaseSpec.project_id, outcome.deploy?.urls?.deployment_id);
+    if (!outcome.vault) {
       console.log(JSON.stringify({ ...outcome.deploy, stats: sdkStats(sdk) }, null, 2));
       printVerboseStats(opts.verbose, sdk);
       return;
     }
-    const vaulted = outcome.gitvault;
+    const vaulted = outcome.vault;
     // Both `DEPLOYED_*` outcomes activated a release; the override one just
     // did it without a vaulted capture and carries a draining advisory.
     const activated = vaulted.outcome === "DEPLOYED_AND_VAULTED" || vaulted.outcome === "DEPLOYED_UNVAULTED_OVERRIDE";
     console.log(JSON.stringify({
       ok: activated,
       outcome: vaulted.outcome,
-      gitvault_commit: vaulted.gitvault_commit,
+      vault_commit: vaulted.vault_commit,
       capture_id: vaulted.capture_id,
       operation_id: vaulted.operation_id,
       ...("generation" in vaulted ? { generation: vaulted.generation } : {}),
       ...("push_error" in vaulted ? { push_error: vaulted.push_error } : {}),
       ...("deploy_error" in vaulted ? { deploy_error: vaulted.deploy_error } : {}),
-      // Design D5/D6 (gitvault-human-envelopes task 4.1 + gitvault-mirror):
+      // Design D5/D6 (vault-human-envelopes task 4.1 + vault-mirror):
       // present only when this deploy landed a new generation — the SDK
       // omits both fields entirely on the other three outcomes rather than
       // faking a `skipped_*` value for something that never had a chance to
-      // run. See `Gitvault.deploy`'s doc comment (sdk/src/namespaces/gitvault.ts).
+      // run. See `Repos.deploy`'s doc comment (sdk/src/namespaces/repos.ts).
       ...("mirror_push" in vaulted ? { mirror_push: vaulted.mirror_push } : {}),
       ...("reconcile_recipients" in vaulted ? { reconcile_recipients: vaulted.reconcile_recipients } : {}),
       next_actions: vaulted.next_actions,
@@ -1388,11 +1388,11 @@ async function deployCmd(args) {
     }, null, 2));
     // Design D6: the mirror result is reported BESIDE the vault outcome
     // above, on its own stderr line — a mirror failure never blocks the
-    // deploy (mirrors `run402 gitvault snapshot`'s reporting).
+    // deploy (mirrors `run402 repos capture`'s reporting).
     if (vaulted.mirror_push?.outcome === "pushed") {
       console.error(`mirror: pushed generation ${vaulted.generation} (${vaulted.mirror_push.summary?.objects_copied ?? 0} object(s) copied)`);
     } else if (vaulted.mirror_push?.outcome === "failed") {
-      console.error(`mirror: dual-push FAILED (deploy is unaffected) — ${vaulted.mirror_push.error ?? "see mirror_push.summary.errors"}`);
+      console.error(`mirror: mirroring this capture FAILED (deploy is unaffected) — ${vaulted.mirror_push.error ?? "see mirror_push.summary.errors"}`);
     }
     // Dirty-tree disclosure (Tal's decision, "help people not make
     // mistakes"): even an explicit --allow-dirty override never captures
@@ -1467,7 +1467,7 @@ const CI_DEPLOY_ERROR_GUIDANCE = {
     hint: "The GitHub repository id in the OIDC token does not match the linked binding.",
     next_actions: [
       editRequestAction("run402 ci link github", "Re-link from the current repository."),
-      editRequestAction("run402 ci link github --repository-id <id>", "Pass the numeric GitHub repository id if automatic lookup fails."),
+      editRequestAction("run402 ci link github --repository-id <repository_id>", "Pass the numeric GitHub repository id if automatic lookup fails."),
     ],
   },
   forbidden_spec_field: {
@@ -1502,12 +1502,12 @@ const CI_DEPLOY_ERROR_GUIDANCE = {
 };
 
 /**
- * The gateway's envelope for gitvault deploy errors — `upgrade_client` first,
+ * The gateway's envelope for vault deploy errors — `upgrade_client` first,
  * then `grandfather_policy` — is relayed untouched: `deployCmd` deploys
- * through `applyWithGitvault`, which declares `{capture_id,
+ * through `applyWithVault`, which declares `{capture_id,
  * snapshot_oid_hmac}` at plan time and presents an activation token at
- * commit, satisfying `gitvault_policy: required`, so no client-side rewrite
- * of the envelope is needed. `cli-deploy-gitvault-lane.test.mjs` is the gate
+ * commit, satisfying `vault_policy: required`, so no client-side rewrite
+ * of the envelope is needed. `cli-deploy-vault-lane.test.mjs` is the gate
  * for this behavior.
  */
 function reportDeployApplyError(err, useGithubActionsOidc) {

package/lib/dev.mjs

@@ -29,12 +29,12 @@ import { fail } from "./sdk-errors.mjs";
 const HELP = `run402 dev — Run Astro dev with Run402 context
 
 Usage:
-  run402 dev [--port <n>] [--host <h>] [--project <id>]
+  run402 dev [--port <n>] [--host <h>] [--project <project_id>]
 
 Options:
   --port <n>        Astro dev port (default 4321)
   --host <h>        Astro dev host (default localhost)
-  --project <id>    Project id (default: RUN402_PROJECT_ID env var)
+  --project <project_id>    Project id (default: RUN402_PROJECT_ID env var)
 
 The command:
   1. Loads .env.local from the current directory (if present)
@@ -85,7 +85,7 @@ export async function run(sub, args = []) {
     fail({
       code: "BAD_USAGE",
       message: "Missing RUN402_PROJECT_ID.",
-      hint: "Set it in .env.local (or pass --project <id>). Run 'run402 projects provision' first if you don't have one.",
+      hint: "Set it in .env.local (or pass --project <project_id>). Run 'run402 projects provision' first if you don't have one.",
     });
   }
   if (!process.env.RUN402_SERVICE_KEY) {

package/lib/doctor.mjs

@@ -13,9 +13,9 @@ import { resolveApplicationScope, loadApplicationScanInput, scanDeploymentSource
  */
 
 import { existsSync, statSync } from "node:fs";
-import { GITVAULT_BYO_NO_PAYLOAD_COPY_STATEMENT } from "#sdk";
+import { VAULT_BYO_NO_PAYLOAD_COPY_STATEMENT } from "#sdk";
 import { configDir, readWallet, loadKeyStore } from "./config.mjs";
-import { resolveGitvaultTarget } from "./gitvault-target.mjs";
+import { resolveVaultTarget } from "./vault-target.mjs";
 import { getSdk } from "./sdk.mjs";
 import {
   resolveScanRoot,
@@ -54,7 +54,7 @@ const DOCTOR_CHECK_NAMES = [
   "account_health",
   "runtime_staleness",
   "recovery_posture",
-  "gitvault",
+  "vault",
   "source_scan",
 ];
 
@@ -75,7 +75,7 @@ function collectRepeatableFlag(args, flag) {
 const HELP = `run402 doctor — Health and config diagnostics
 
 Usage:
-  run402 doctor [--verbose] [--refresh] [--no-scan] [--scan-dir <D>] [--project <id>]
+  run402 doctor [--verbose] [--refresh] [--no-scan] [--scan-dir <D>] [--project <project_id>]
                 [--only <check> ...]
   run402 --wallet <profile> doctor --buzz --buzz-agent <npub-or-hex>
 
@@ -91,7 +91,7 @@ Output:
               api_reachable error, tier inactive / frozen / past_due /
               dormant / missing / error, error-severity source_scan findings
     advisory  a warning that never stops a deploy: account_health,
-              recovery_posture, gitvault, runtime_staleness, cli_update gaps
+              recovery_posture, vault, runtime_staleness, cli_update gaps
     info      ok / skipped / unknown
   Agents: branch on \`ok\`; read \`warnings[]\` (one entry per gap) for the
   non-blocking gaps and \`blocking[]\` for what to fix when \`ok\` is false.
@@ -117,16 +117,16 @@ Options:
   --dir D        Select the application directory for deployment diagnostics.
   --manifest P   Explicitly select a manifest (executable configs are trusted code).
   --scan-dir D   Advanced arbitrary scan; does not claim deployment readiness
-  --project <id> Target THIS project's gitvault check instead of the repo-standing
+  --project <project_id> Target THIS project's vault check instead of the repo-standing
                  default (the 4.38.0 pin / run402 remote / RUN402_PROJECT_ID / active
-                 project, in that order — see \`gitvault-target.mjs\`). Scoped to the
-                 gitvault check only; every other check is wallet/machine-wide, not
+                 project, in that order — see \`vault-target.mjs\`). Scoped to the
+                 vault check only; every other check is wallet/machine-wide, not
                  per-project, and is unaffected by this flag. Composes with --only.
   --only <check> Run ONLY the named check (repeatable — pass it more than once
                  to run several). Every other check, INCLUDING the monorepo
                  source-tree scan, is suppressed rather than merely hidden: a
                  skipped check's network/filesystem work never runs at all, so
-                 \`doctor --only gitvault\` costs one gitvault read, not a
+                 \`doctor --only vault\` costs one vault read, not a
                  config/tier/account/scan sweep. An unknown check name is
                  BAD_USAGE listing the valid names below. Not used with --buzz
                  (buzz mode is its own separate, always-complete check set).
@@ -164,7 +164,7 @@ Checks performed:
     the org's disaster backstops if the agent machine dies. Evidence
     levels: "configured" is what the platform verified, never proof an
     off-platform passkey or saved code still exists.
-  - gitvault: the active project's vault — activation policy, whether THIS
+  - vault: the active project's vault — activation policy, whether THIS
     machine can produce the capture a 'required' policy demands, open
     unvaulted-override journals, and where the keystore lives (back it up:
     whole-keystore loss is terminal for vault history)
@@ -310,7 +310,7 @@ export async function run(sub, args = []) {
   const skipScan = all.includes("--no-scan");
   const scanDirArgIdx = all.indexOf("--scan-dir");
   const scanDirOverride = scanDirArgIdx >= 0 ? all[scanDirArgIdx + 1] : null;
-  // Scoped to the gitvault check (see HELP): every other check is
+  // Scoped to the vault check (see HELP): every other check is
   // wallet/machine-wide, not per-project.
   const projectOverride = flagValue(all, "--project");
 
@@ -650,7 +650,7 @@ export async function run(sub, args = []) {
       }
     }
 
-    // 6c. Org recovery posture (gitvault-recovery-custody). One entry per
+    // 6c. Org recovery posture (vault-recovery-custody). One entry per
     // vault-owning org the caller can see; rides the same account-status
     // read. Evidence levels, not guarantees: "configured" names what the
     // platform VERIFIED — it can never observe whether an off-platform
@@ -661,11 +661,11 @@ export async function run(sub, args = []) {
     if (wanted("recovery_posture")) {
       const posture = status.recovery_posture;
       if (!Array.isArray(posture)) {
-        // Gateway older than gitvault-recovery-custody doesn't surface it.
+        // Gateway older than vault-recovery-custody doesn't surface it.
         checks.push({
           name: "recovery_posture",
           status: "skipped",
-          ...(verbose && { hint: "account status has no 'recovery_posture' block; requires a gitvault-recovery-custody gateway." }),
+          ...(verbose && { hint: "account status has no 'recovery_posture' block; requires a vault-recovery-custody gateway." }),
         });
       } else if (posture.length === 0) {
         // No vault-owning org in the caller's view — nothing to lose, nothing to advise.
@@ -675,7 +675,7 @@ export async function run(sub, args = []) {
         for (const org of posture) {
           const label = `org ${org.org_id} (${org.vault_count} vault${org.vault_count === 1 ? "" : "s"})`;
           if (org.control_plane_configured === false) {
-            gaps.push(`${label}: no human owner with a working control-plane login — if this org's agent machine dies, nobody can sign in to recover it. Invite a backup human (run402 org invite create ${org.org_id} --email <their-email> --role owner) and have them complete login at console.run402.com.`);
+            gaps.push(`${label}: no human owner with a working control-plane login — if this org's agent machine dies, nobody can sign in to recover it. Invite a backup human (run402 orgs invite create ${org.org_id} --email <their-email> --role owner) and have them complete login at console.run402.com.`);
           }
           if (org.source_backup_configured === false) {
             gaps.push(`${label}: no human member holds a working source-access key — vault history has no member-side decryption backup. Have a member complete source enrollment at console.run402.com/account → Source access.`);
@@ -718,15 +718,15 @@ export async function run(sub, args = []) {
     });
   }
 
-  // 6c. gitvault (add-gitvault). Doctor was completely silent about the vault
-  // even when `gitvault_policy: required` was the single thing that would break
+  // 6c. vault (add-vault). Doctor was completely silent about the vault
+  // even when `vault_policy: required` was the single thing that would break
   // the project's next deploy (dogfood #1, finding D1) — and doctor is where a
   // user looks when something is wrong. It also prints WHERE the keystore is:
   // "whole-keystore loss is terminal" was stated three times across this
   // surface while the directory to back up was stated nowhere (finding D2).
   //
   // Read-only and best-effort in every branch: no project, no vault, or a
-  // gateway that does not know gitvault are all ordinary and report `skipped`
+  // gateway that does not know vault are all ordinary and report `skipped`
   // or `ok`, never a doctor failure. A vault-only project that has never
   // deployed is a first-class shape (protocol D183), so its mere absence of a
   // deploy raises nothing.
@@ -734,12 +734,12 @@ export async function run(sub, args = []) {
   // TARGETING: when cwd is a repository
   // with its own pinned repo id or run402/origin remote, doctor checks THAT
   // vault, not the profile's active project — the same pin > remote >
-  // RUN402_PROJECT_ID env > active-project order every other gitvault verb
-  // follows (`gitvault-target.mjs`). An explicit `--project <id>` outranks
-  // all of that (the resolver's own top tier), same as every other gitvault
+  // RUN402_PROJECT_ID env > active-project order every other vault verb
+  // follows (`vault-target.mjs`). An explicit `--project <project_id>` outranks
+  // all of that (the resolver's own top tier), same as every other vault
   // verb's `--project`.
-  if (wanted("gitvault")) {
-    // gitvault-persistent-helper: a bounded LOCAL probe of the resident
+  if (wanted("vault")) {
+    // vault-persistent-helper: a bounded LOCAL probe of the resident
     // helper engine — {running:false} is a fine answer, never a finding
     // (the daemon is an accelerator, not a dependency).
     const daemonInfo = await (async () => {
@@ -783,18 +783,18 @@ export async function run(sub, args = []) {
         return { running: false };
       }
     })();
-    const target = await resolveGitvaultTarget({ repoDir: process.cwd(), explicitProjectId: projectOverride ?? undefined });
+    const target = await resolveVaultTarget({ repoDir: process.cwd(), explicitProjectId: projectOverride ?? undefined });
     const projectId = target.project_id ?? null;
     const repoId = target.repo_id ?? null;
     if (!projectId && !repoId) {
       checks.push({
-        name: "gitvault",
+        name: "vault",
         status: "skipped",
         ...(verbose && { hint: "no active project — run 'run402 projects use <project_id>' to check its vault." }),
       });
     } else {
       try {
-        const gv = await getSdk().gitvault.status({
+        const gv = await getSdk().repos.status({
           ...(repoId ? { repo_id: repoId } : { project_id: projectId }),
           repo_dir: process.cwd(),
         });
@@ -802,11 +802,11 @@ export async function run(sub, args = []) {
           project_id: gv.project_id ?? projectId,
           repo_id: gv.repo_id,
           vault: gv.vault === null ? null : "allocated",
-          // gitvault-byo-primary-bucket task 3.5 — absent-or-"managed" is
+          // vault-byo-primary-bucket task 3.5 — absent-or-"managed" is
           // byte-identical to before this fold for every non-BYO vault.
           storage_profile: gv.vault?.storage_profile ?? null,
           byo_destination: gv.vault?.byo_destination ?? null,
-          gitvault_policy: gv.gitvault_policy,
+          vault_policy: gv.vault_policy,
           keystore_root: gv.keystore.root,
           can_sign: gv.keystore.can_sign,
           holds_repo_key: gv.keystore.holds_repo_key,
@@ -819,7 +819,7 @@ export async function run(sub, args = []) {
           // to the durability sentence instead of the terminal-loss claim.
           covering_recipients: gv.covering_recipients ?? null,
           daemon: daemonInfo,
-          // gitvault-multi-writer (rev 47) task 6.2 — this machine's own
+          // vault-multi-writer (rev 47) task 6.2 — this machine's own
           // standing on the vault's chain-verified writer set. `null` only
           // when there is no vault at all (nothing to be a writer OF).
           // `read_only_vault` takes priority over the caller's own standing
@@ -839,22 +839,22 @@ export async function run(sub, args = []) {
         if (value.writer === "read_only_vault") {
           gaps.push("this vault has lost its last writer (D228 read-only terminal) — it still serves reads, but no push can be admitted until a new writer is admitted through a recovery path");
         } else if (value.writer === "pending") {
-          gaps.push("this machine's key is an eligible writer candidate but not yet admitted — run 'run402 repos access sync' if you already hold writer standing on this vault, or ask a current writer to run any gitvault operation");
+          gaps.push("this machine's key is an eligible writer candidate but not yet admitted — run 'run402 repos access sync' if you already hold writer standing on this vault, or ask a current writer to run any vault operation");
         } else if (value.writer === "not_admitted") {
-          gaps.push("this machine's key is not an active writer on this vault — a push from here is refused GITVAULT_WRITER_NOT_ADMITTED; ask a current writer to admit you (org membership at role developer+ and a published signing key make you eligible)");
+          gaps.push("this machine's key is not an active writer on this vault — a push from here is refused VAULT_WRITER_NOT_ADMITTED; ask a current writer to admit you (org membership at role developer+ and a published signing key make you eligible)");
         }
         // The one that actually breaks the next deploy: the project demands a
         // vaulted capture and THIS machine cannot produce one.
-        if (gv.gitvault_policy === "required" && !gv.keystore.holds_repo_key) {
+        if (gv.vault_policy === "required" && !gv.keystore.holds_repo_key) {
           gaps.push(
-            "gitvault_policy is 'required' but this machine holds no key for the vault — a deploy from here is refused with GITVAULT_CLIENT_UPGRADE_REQUIRED. " +
-            "Run 'run402 repos create --project <id>' (idempotent; resolves to the existing repo), or 'run402 repos policy grandfathered --reason <why>' to un-gate the project.",
+            "vault_policy is 'required' but this machine holds no key for the vault — a deploy from here is refused with VAULT_CLIENT_UPGRADE_REQUIRED. " +
+            "Run 'run402 repos create --project <project_id>' (idempotent; resolves to the existing repo), or 'run402 repos policy grandfathered --reason <why>' to un-gate the project.",
           );
-        } else if (gv.gitvault_policy === "required" && !gv.keystore.can_sign) {
-          gaps.push("gitvault_policy is 'required' and this keystore is read-only (no signing key) — it can verify but cannot publish the capture a deploy needs");
+        } else if (gv.vault_policy === "required" && !gv.keystore.can_sign) {
+          gaps.push("vault_policy is 'required' and this keystore is read-only (no signing key) — it can verify but cannot publish the capture a deploy needs");
         }
         if (gv.pending_overrides > 0) {
-          gaps.push(`${gv.pending_overrides} unvaulted-override journal(s) are still open — run 'run402 repos snapshot' to drain them`);
+          gaps.push(`${gv.pending_overrides} unvaulted-override journal(s) are still open — run 'run402 repos capture' to drain them`);
         }
         // `matches` is a TRI-STATE: `false` alone is
         // a real mismatch. `null` (a slug-form remote not yet resolved on
@@ -863,20 +863,11 @@ export async function run(sub, args = []) {
         if (gv.remote && gv.remote.matches === false) {
           gaps.push(`the '${gv.remote.name}' git remote points at a different project than ${value.project_id} (${gv.remote.url})`);
         }
-        // A `kygit::` remote with no
-        // `git-remote-kygit` helper on PATH means every push/clone/fetch
-        // in this checkout fails inside git with an opaque error.
-        if (gv.remote?.url?.startsWith("kygit::")) {
-          const { isExecutableOnPath } = await import("./path-lookup.mjs");
-          if (!isExecutableOnPath("git-remote-kygit")) {
-            gaps.push("this checkout's remote is kygit:: but git-remote-kygit is not on PATH — run `npm i -g @kychee/kygit`");
-          }
-        }
         // Echoed exactly as the SDK reported them — including the
         // doctor-persistent `grandfathered` advisory it owns.
         for (const w of gv.warnings ?? []) gaps.push(`${w.kind}: ${w.message}`);
 
-        // gitvault-mirror-and-recover task 4.3 + gitvault-mirror-default:
+        // vault-mirror-and-recover task 4.3 + vault-mirror-default:
         // mirror currency, reported ALONGSIDE (never in place of) the
         // deploy-related gaps above, and never blocking `run402 deploy`'s
         // own gate — the vault lane's outcome is unaffected regardless of
@@ -885,14 +876,14 @@ export async function run(sub, args = []) {
         // unreachable or vault unread). Only STALE is actionable enough to
         // become a warning gap; a vault with no successful mirror copy yet
         // carries the SDK-computed `vault_unmirrored` finding — named and
-        // standing (gitvault-mirror-default supersedes the old anonymous
+        // standing (vault-mirror-default supersedes the old anonymous
         // `advisory` string), echoed verbatim, and deliberately NOT pushed
         // into `gaps`: informational, never blocking, computed client-side
         // only, cleared by the first successful mirror write or sync.
         if (gv.vault !== null && value.repo_id) {
           try {
-            const mirrorStatus = await getSdk().gitvault.mirrorStatus({ repo_id: value.repo_id, is_byo: value.storage_profile === "byo" });
-            value.gitvault_mirror = {
+            const mirrorStatus = await getSdk().repos.mirrorStatus({ repo_id: value.repo_id, is_byo: value.storage_profile === "byo" });
+            value.vault_mirror = {
               configured: mirrorStatus.configured,
               destination: mirrorStatus.destination,
               mirrored_generation: mirrorStatus.mirrored_generation,
@@ -912,27 +903,27 @@ export async function run(sub, args = []) {
           }
         }
 
-        // gitvault-byo-primary-bucket task 3.5 — unconditional, independent
+        // vault-byo-primary-bucket task 3.5 — unconditional, independent
         // of mirror status (D7); imported from the canonical constants, never
         // paraphrased.
-        const byoDisclosure = value.storage_profile === "byo" ? ` Storage: byo (${value.byo_destination ?? "(unknown)"}) — ${GITVAULT_BYO_NO_PAYLOAD_COPY_STATEMENT}` : "";
+        const byoDisclosure = value.storage_profile === "byo" ? ` Storage: byo (${value.byo_destination ?? "(unknown)"}) — ${VAULT_BYO_NO_PAYLOAD_COPY_STATEMENT}` : "";
         checks.push({
-          name: "gitvault",
+          name: "vault",
           status: gaps.length > 0 ? "warning" : "ok",
           value: gaps.length > 0 ? { ...value, gaps } : value,
           hint: (gv.vault === null
-            ? `No vault for this project (that is a normal shape). Allocate one with 'run402 repos create --project <id>'. Keystore: ${gv.keystore.root}`
+            ? `No vault for this project (that is a normal shape). Allocate one with 'run402 repos create --project <project_id>'. Keystore: ${gv.keystore.root}`
             : gv.durability_statement
               ? `Back up ${gv.keystore.root} anyway — ${gv.durability_statement} (covering_recipients: ${gv.covering_recipients})`
               : `Back up ${gv.keystore.root} — whole-machine or whole-keystore loss is terminal for vault history.`) + byoDisclosure,
         });
       } catch (err) {
-        // A gateway without gitvault, an unreachable API, or a project this
+        // A gateway without vault, an unreachable API, or a project this
         // wallet cannot see. None of those is a local health problem.
         checks.push({
-          name: "gitvault",
+          name: "vault",
           status: "skipped",
-          message: describeCheckFailure("gitvault status check", err),
+          message: describeCheckFailure("vault status check", err),
         });
       }
     }
@@ -944,7 +935,7 @@ export async function run(sub, args = []) {
   // `error` block deploy (`run402 deploy` wraps doctor and respects exit
   // code). Skipped via --no-scan when the user wants config-only checks, and
   // by any --only that omits it — on a monorepo this check's findings can
-  // otherwise bury the gitvault diagnosis under thousands of hits.
+  // otherwise bury the vault diagnosis under thousands of hits.
   if (!skipScan && wanted("source_scan")) {
     try {
       const scope = await resolveApplicationScope({ dir: flagValue(all, "--dir") ?? undefined, manifest: flagValue(all, "--manifest") ?? undefined });