run402 4.95.0 → 4.96.0

package/README.md

@@ -61,7 +61,7 @@ Every mode (and `run402 deploy`) verifies the files the manifest references befo
 
 ### repos — host-blind encrypted git repos (zero deploy ceremony)
 
-One noun, fourteen verbs (`repo` singular resolves identically). `run402 gitvault <verb>` answers `COMMAND_MOVED`/`COMMAND_REMOVED`.
+One noun, seventeen verbs: KyGit is the brand, a vault is the resource, a repo is what you have.
 
 ```bash
 run402 init                                   # once per machine
@@ -76,7 +76,7 @@ run402 repos list --org org_1a2b3c
 run402 repos delete --project prj_xyz --force # refuses without --force while the vault holds generations
 ```
 
-A hosted git remote, encrypted before it leaves the machine — no deploy, no manifest, no app. `origin` is claimed additively — an existing `origin` is never touched, the run402 remote falls back to `run402` instead. A directory inside another repository is never scaffolded into that repository: the skip carries a `create_nested_repo` next action, `--nested` makes it its own nested repository (one line appended to the enclosing repository's local `.git/info/exclude`, nothing else touched), and `create` prints a `git push` next action only for a remote it actually added. Every mutating `repos` verb (`create`, `rename`, `delete`, `snapshot`, `policy`, `mirror`, `gc`, `handoff`, `resume`, `invite`, `join`) is CLI/OpenClaw-only by design — no MCP tool exists or will exist for them (one-shot recovery receipts, immutable generations, irreversible delete, single-use bearer keys). Three READ-ONLY tools do exist — `repos_view`, `repos_list_heads`, `repos_fsck` — teaching only `repos` spellings. See `run402 repos --help` for the full tiered surface (common: `create`/`view`/`list`; occasional: `snapshot`/`mirror`/`recover`/`handoff`/`resume`/`invite`/`join`; lifecycle: `rename`/`delete`; maintenance: `fsck`/`gc`/`access`/`policy`), and the CLI reference's `repos` section for the terminal-loss statement and the progressive backup warning.
+A hosted git remote, encrypted before it leaves the machine — no deploy, no manifest, no app. `origin` is claimed additively — an existing `origin` is never touched, the run402 remote falls back to `run402` instead. A directory inside another repository is never scaffolded into that repository: the skip carries a `create_nested_repo` next action, `--nested` makes it its own nested repository (one line appended to the enclosing repository's local `.git/info/exclude`, nothing else touched), and `create` prints a `git push` next action only for a remote it actually added. Every mutating `repos` verb (`create`, `rename`, `delete`, `capture`, `policy`, `mirror`, `gc`, `handoff`, `resume`, `invite`, `join`) is CLI/OpenClaw-only by design — no MCP tool exists or will exist for them (one-shot recovery receipts, immutable generations, irreversible delete, single-use bearer keys). Three READ-ONLY tools do exist — `repos_view`, `repos_list_heads`, `repos_fsck` — teaching only `repos` spellings. See `run402 repos --help` for the full tiered surface (common: `create`/`view`/`list`; occasional: `capture`/`mirror`/`recover`/`handoff`/`resume`/`invite`/`join`; lifecycle: `rename`/`delete`; maintenance: `fsck`/`gc`/`access`/`policy`), and the CLI reference's `repos` section for the terminal-loss statement and the progressive backup warning.
 
 **Handoff / resume.** `run402 repos handoff [--note-file <path>]` captures the actual working tree (staged/unstaged/untracked, like `git stash push -u`) into the vault and mints a single-use bearer key (`kgh1_…`, printed to stdout exactly once); `run402 repos resume <kgh1_…>` claims it on another machine, clones fresh, and reapplies the exact dirty state with `git stash apply --index`. No shared keystore, no shared wallet — the key is the whole handoff. On a wallet with no active tier, `resume` first folds the same cold-start chain `create` does (wallet → faucet → one x402 prototype payment); `--no-init` opts out, and the claim itself never waits on it. Sensitive untracked files (`.env`, `*.pem`, SSH/AWS/GPG dirs, …) are excluded from capture by default (`--include-sensitive <glob>` re-admits one). See the reference `run402.com/llms-cli.txt` for the full note-schema and flag reference.
 
@@ -323,7 +323,7 @@ run402 doctor                    # { ok, blocking[], warnings[], checks[] }
 run402 doctor --refresh          # live npm check for a newer run402
 ```
 
-`ok` is structural: `true` exactly when `blocking[]` is empty. Every check carries `severity: "blocking" | "advisory" | "info"`; advisory findings (an unbound contact passkey, a degraded recovery posture on another org, a stale CLI, gitvault gaps) land in `warnings[]` without changing `ok` or the exit code. The `tier` check's `status` is a fixed vocabulary (`ok | inactive | frozen | past_due | dormant | purged | missing | unknown | error`, never a tier name; see `value.tier` / `value.lifecycle`), and a wallet whose own org holds no tier but can reach another org's projects reports `missing` as advisory (`TIER_MISSING_ON_OWN_ORG`).
+`ok` is structural: `true` exactly when `blocking[]` is empty. Every check carries `severity: "blocking" | "advisory" | "info"`; advisory findings (an unbound contact passkey, a degraded recovery posture on another org, a stale CLI, vault gaps) land in `warnings[]` without changing `ok` or the exit code. The `tier` check's `status` is a fixed vocabulary (`ok | inactive | frozen | past_due | dormant | purged | missing | unknown | error`, never a tier name; see `value.tier` / `value.lifecycle`), and a wallet whose own org holds no tier but can reach another org's projects reports `missing` as advisory (`TIER_MISSING_ON_OWN_ORG`).
 
 ## State
 

package/cli.mjs

@@ -7,7 +7,7 @@
 import { readFileSync } from "node:fs";
 import * as nodeModule from "node:module";
 
-// gitvault-startup-amortization (D2): on-disk V8 compile cache for the
+// vault-startup-amortization (D2): on-disk V8 compile cache for the
 // lazily-imported subcommand graphs. Feature-guarded (Node 22.8+) and
 // try/caught — absence or an unwritable cache dir degrade silently.
 try {
@@ -95,8 +95,6 @@ PLATFORM — everything else, and the things still finding a home
   jobs        Submit and inspect platform-managed jobs
   transfer    Project transfer to a wallet, an email, or an owned org (init, preview, list, accept, cancel)
   archives    Portable project archives (create, status, download --target cloud; inspect, verify; import --target core)
-  gitvault    RETIRED — moved to repos (repo-surface-consolidation); every spelling answers COMMAND_MOVED/COMMAND_REMOVED
-  source-access RETIRED — moved into repos (recovery-bundle + access); every spelling answers COMMAND_MOVED
   buzz        Buzz human/community/agent control-plane workflows
   apps        Browse and manage the app marketplace
   ai          AI translation and moderation tools
@@ -232,14 +230,6 @@ switch (cmd) {
     await run(sub, rest);
     break;
   }
-  // `repo` singular resolves identically to `repos` (design D1 — agents type
-  // what `gh repo` already taught them). Its own case block, not a
-  // fall-through, so cli-conventions-gate's per-line family scanner sees it.
-  case "repo": {
-    const { run } = await import("./lib/repos.mjs");
-    await run(sub, rest);
-    break;
-  }
   case "snapshots": {
     const { run } = await import("./lib/snapshots.mjs");
     await run(sub, rest);
@@ -325,11 +315,6 @@ switch (cmd) {
     await run(sub, rest);
     break;
   }
-  case "gitvault": {
-    const { run } = await import("./lib/gitvault.mjs");
-    await run(sub, rest);
-    break;
-  }
   case "escalations": {
     const { run } = await import("./lib/escalations.mjs");
     await run(sub, rest);
@@ -448,11 +433,6 @@ switch (cmd) {
     await run([sub, ...rest].filter(Boolean));
     break;
   }
-  case "source-access": {
-    const { run } = await import("./lib/source-access.mjs");
-    await run(sub, rest);
-    break;
-  }
   case "auth": {
     const { run } = await import("./lib/auth.mjs");
     await run(sub, rest);

package/core-dist/keystore.js

@@ -190,7 +190,7 @@ export function removeProject(projectId, path) {
  * bucket, not "unknown") and PERMANENTLY shadows every later wallet-scoped
  * activation for every caller that reads through this module: `resolveProjectId`
  * / `resolveProject` (cli/lib/config.mjs), `projects current`, and every
- * gitvault-verb target resolution. The failure it causes: `repos create`
+ * vault-verb target resolution. The failure it causes: `repos create`
  * calls `projects.provision`, whose `creds.setActiveProject` correctly
  * persists the new project under the real wallet's scoped bucket AND the
  * flat fallback, yet every CLI read of "the active project" resolves the

package/git-remote-run402.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * `git-remote-run402` — the THIN CLIENT (gitvault-persistent-helper).
+ * `git-remote-run402` — the THIN CLIENT (vault-persistent-helper).
  *
  * git spawns a fresh helper process per remote operation, so everything warm
  * dies per command — Node boot, the SDK graph, the signer, the paid stack,
@@ -10,7 +10,7 @@
  * when that is impossible does it load the full session module and run
  * in-process — which is byte-identical to the pre-daemon behavior.
  *
- * INVARIANTS (spec: gitvault-client-surface, "A resident helper engine…"):
+ * INVARIANTS (spec: vault-client-surface, "A resident helper engine…"):
  *   - The daemon is never load-bearing: any failure to use it — absent,
  *     busy, stale, mismatched, dying mid-handshake — falls back silently to
  *     the in-process path. The handshake completes BEFORE this client
@@ -35,7 +35,7 @@ import net from "node:net";
 import { spawn } from "node:child_process";
 import { daemonSocketPath, daemonRunnerPath, DAEMON_PROTOCOL_VERSION, cliVersion, forwardableEnv } from "./lib/daemon-path.mjs";
 
-// gitvault-startup-amortization (D2): on-disk V8 compile cache for every
+// vault-startup-amortization (D2): on-disk V8 compile cache for every
 // module loaded from here on. Feature-guarded (Node 22.8+) and try/caught
 // (a read-only install dir degrades silently).
 try {
@@ -201,11 +201,11 @@ if (invokedDirectly) {
     process.exitCode = code;
   } else {
     // Fallback: today's in-process path, byte-identical. Fire the prewarm
-    // BEFORE the heavy graph evaluates (gitvault-startup-amortization D1),
+    // BEFORE the heavy graph evaluates (vault-startup-amortization D1),
     // and leave a daemon behind for next time.
     if (daemonEnabled) spawnDaemon();
-    const { prewarmGitvaultConnection } = await import("./sdk/dist/node/gitvault-prewarm.js");
-    prewarmGitvaultConnection();
+    const { prewarmVaultConnection } = await import("./sdk/dist/node/vault-prewarm.js");
+    prewarmVaultConnection();
     const { runHelperSession } = await import("./lib/remote-helper-session.mjs");
     process.exitCode = await runHelperSession(argv);
   }

package/lib/cold-start.mjs

@@ -1,8 +1,8 @@
 /**
  * `cold-start.mjs` — the minimal x402/Base-Sepolia cold-start chain
  * (kygit-handoff design D5): wallet → faucet → one x402 prototype
- * payment. `repos create` (and so `kygit create`) folds this in when it is
- * refused `NO_ACTIVE_TIER`, so `kygit create` on a genuinely fresh machine
+ * payment. `repos create` folds this in when it is
+ * refused `NO_ACTIVE_TIER`, so `run402 repos create` on a genuinely fresh machine
  * ends with a vault, no human signup, no cloud dashboard.
  *
  * This is the SAME shape `run402 init` already walks (create the wallet →

package/lib/command-manifest.mjs

@@ -281,12 +281,6 @@ export const COMMAND_MANIFEST = [
   { path: ["claims", "list"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub" },
   { path: ["claims", "release"], positionals: [p("claim_id")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["clm_1"], runStyle: "sub" },
 
-  // ── gitvault — no manifest entries ──────────────────────
-  // `cli/lib/gitvault.mjs`'s dispatcher handles every `gitvault <verb>` and
-  // answers a structural COMMAND_MOVED (or, for `push`/`reconcile`,
-  // COMMAND_REMOVED) redirect that dispatches nothing — see
-  // RESERVED_SUBCOMMANDS below, and "gitvault" in SKIPPED_FAMILIES.
-
   // ── repos (the consolidated 15-verb family) ─
   // Every verb needs a real principal keystore and, for most, an allocated
   // repo and a local git working tree, so the gate runs structural checks
@@ -299,7 +293,7 @@ export const COMMAND_MANIFEST = [
   // name, with `--repo`/`--project` addressing.
   { path: ["repos", "rename"], positionals: [p("new_name")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["my-notes"], runStyle: "sub", skipBehavioral: "claims a per-org-unique repo name against a live project" },
   { path: ["repos", "delete"], positionals: [], projectScoped: true, legacyPositionalProject: true, minimalArgs: [], runStyle: "sub", skipBehavioral: "irreversibly deletes a project after reading its live non-repo-resource state and vault generation count" },
-  { path: ["repos", "snapshot"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub", skipBehavioral: "captures the cwd git working tree and publishes a signed head" },
+  { path: ["repos", "capture"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub", skipBehavioral: "captures the cwd git working tree and publishes a signed head" },
   // kygit-handoff: `handoff` captures a stash-shaped checkpoint and mints a
   // single-use bearer key through a live gateway call; `resume` claims one
   // (a real membership mutation) and writes into a fresh working tree.
@@ -320,7 +314,7 @@ export const COMMAND_MANIFEST = [
   { path: ["repos", "access", "repair"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--recipient-state-version", "0", "--recipient-revocation-version", "0"], runStyle: "sub", skipBehavioral: "owner+step-up-gated epoch rotation (D193-D203, rev 42) — samples a fresh epoch key and re-seals a live vault's recipients" },
   { path: ["repos", "access", "revoke-key"], positionals: [p("principal_id")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["prin_00000000000000000000000000000000"], runStyle: "sub", skipBehavioral: "owner+step-up-gated: declares a recipient's key revoked (org-scoped watermark) and drives a real epoch rotation off it" },
   { path: ["repos", "access", "declare-exposure"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub", skipBehavioral: "owner+step-up-gated: declares this vault's epoch secret exposed, forcing every subsequent ordinary push to refuse until a rotation lands" },
-  { path: ["repos", "access", "sync"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub", skipBehavioral: "gitvault-multi-writer (rev 47): on-demand writer-admission reconcile — resolves pending candidates' signing keys via the live org encryption-key directory and publishes a real add_writer_key head per candidate" },
+  { path: ["repos", "access", "sync"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub", skipBehavioral: "vault-multi-writer (rev 47): on-demand writer-admission reconcile — resolves pending candidates' signing keys via the live org encryption-key directory and publishes a real add_writer_key head per candidate" },
   { path: ["repos", "recover"], positionals: [p("source")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["s3://example-mirror-bucket", "--out", "__SCRATCH_DIR__/recover-out"], runStyle: "sub", skipBehavioral: "materializes a git repository from a mirror source, offline, with no server call" },
   // Principal-scoped (one bundle covers every vault you can read), so no
   // --project — deliberately unlike its eleven vault-scoped siblings.
@@ -477,7 +471,7 @@ export const COMMAND_MANIFEST = [
   { path: ["service", "health"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
   { path: ["cache", "inspect"], positionals: [p("url")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["https://example.com/"] },
   { path: ["cache", "invalidate"], positionals: [p("url", { required: false })], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["--all", "--host", "example.com"] },
-  // projectScoped: --project targets the gitvault
+  // projectScoped: --project targets the vault
   // check only (see doctor.mjs's own HELP) — every other check stays
   // wallet/machine-wide, but the gate's contract is "accepts --project
   // without rejecting it," which this satisfies.
@@ -501,20 +495,6 @@ export const SKIPPED_FAMILIES = {
   // Split into `deliveries` / `contacts` / `subscriptions`; every subcommand
   // answers COMMAND_REMOVED naming its successor.
   "notifications": "reserved group; split by legible-cli-surface",
-  // The gitvault dispatcher answers COMMAND_MOVED/COMMAND_REMOVED for every
-  // `gitvault <verb>` (see RESERVED_SUBCOMMANDS below for the per-verb list)
-  // — the family stays dispatched in cli.mjs (so the redirect fires instead
-  // of UNKNOWN_COMMAND) but has zero manifest entries, since a redirect
-  // dispatches nothing.
-  "gitvault": "retired; every subcommand answers COMMAND_MOVED/COMMAND_REMOVED naming its `repos`/git successor",
-  // Shipped in exactly one release (v4.54.0, live for hours) before the
-  // one-noun review caught it: a gateway route namespace is not a CLI noun.
-  // Both verbs answer COMMAND_MOVED into the repos family for one release,
-  // then the spelling is reserved and answers nothing.
-  "source-access": "retired same-day; `export` -> `repos recovery-bundle`, `status` -> `repos access` (member_custody block)",
-  // `repo` singular resolves identically to `repos` — same
-  // module, same case block in cli.mjs, so it needs no manifest of its own.
-  "repo": "alias for `repos`, resolves identically (design D1)",
 };
 
 /**
@@ -530,23 +510,5 @@ export const SKIPPED_FAMILIES = {
  * which the family list cannot express.
  */
 export const RESERVED_SUBCOMMANDS = {
-  "source-access:export": "moved to `repos recovery-bundle` — the artifact `repos recover --bundle` consumes belongs to the repos family",
-  "source-access:status": "moved to `repos access` — your own wrapper custody rides its member_custody block; the org advisory is `doctor --only recovery_posture`",
   "escalations:contacts": "merged into `contacts` — the ladder and Telegram channels are one question",
-  // Every `gitvault <verb>` spelling. Nine
-  // answer COMMAND_MOVED naming their `repos` successor; `push` and
-  // `reconcile` answer COMMAND_REMOVED (no equivalent successor for either —
-  // `push`'s one-release alias window is over, `reconcile` was a workaround
-  // with no permanent replacement, only a read at `repos access`).
-  "gitvault:init": "moved to `repos create --project <project_id>`",
-  "gitvault:status": "moved to `repos view`",
-  "gitvault:snapshot": "moved to `repos snapshot`",
-  "gitvault:policy": "moved to `repos policy`",
-  "gitvault:compact": "moved to `repos gc`",
-  "gitvault:prune": "moved to `repos gc`",
-  "gitvault:verify": "moved to `repos fsck`",
-  "gitvault:mirror": "moved to `repos mirror`",
-  "gitvault:recover": "moved to `repos recover`",
-  "gitvault:push": "removed — its one-release deprecation-alias window is over; `git push` / `repos snapshot`",
-  "gitvault:reconcile": "removed — a workaround with no permanent successor; read `repos access` instead",
 };

package/lib/credentials.mjs

@@ -454,7 +454,7 @@ async function issue(args) {
   try {
     const res = await getSdk().credentials.issue(projectId, { kind, name, expiresAt: expiresAt || undefined });
     if (importToCache && res?.secret) {
-      // The cold-restart re-key path (gitvault-deploy-lane 6.5a): the minted
+      // The cold-restart re-key path (vault-deploy-lane 6.5a): the minted
       // secret goes straight into the local cache the deploy and data-plane
       // commands read, so a fresh machine re-keys in one command per kind
       // instead of the four-command issue-then-project-keys-import dance.

package/lib/daemon-path.mjs

@@ -1,11 +1,11 @@
 /**
- * Daemon identity + transport addressing (gitvault-persistent-helper D4/D5)
+ * Daemon identity + transport addressing (vault-persistent-helper D4/D5)
  * — the ONE module the thin client's fast path may import beside node
  * builtins (pinned by the import-graph gate test), so it must stay tiny.
  *
  * The socket lives INSIDE the client configuration directory — the same
  * 0700 trust boundary that already holds the wallet private key and the
- * gitvault keystore — and its path is keyed by CLI version, so a CLI
+ * vault keystore — and its path is keyed by CLI version, so a CLI
  * upgrade resolves a NEW path: the new client never reaches the old daemon,
  * which idles out on its own. Windows uses a named pipe whose name carries
  * a hash of the config dir (pipes have no filesystem home) plus the same
@@ -79,7 +79,7 @@ export function daemonSocketPath() {
 }
 
 export function daemonRunnerPath() {
-  return join(dirname(fileURLToPath(import.meta.url)), "gitvault-daemon-run.mjs");
+  return join(dirname(fileURLToPath(import.meta.url)), "vault-daemon-run.mjs");
 }
 
 /**

package/lib/deploy-v2.mjs

@@ -28,7 +28,7 @@
 import { existsSync, fstatSync, readFileSync } from "node:fs";
 import { resolve, dirname, extname, isAbsolute } from "node:path";
 import {
-  applyWithGitvault,
+  applyWithVault,
   assertLocalFileReferencesExist,
   buildDeployResolveSummary,
   githubActionsCredentials,
@@ -139,7 +139,7 @@ Options:
   --final-only            Alias for --quiet; final success/error envelope is still preserved
   --allow-warning <code>  Continue past this reviewed warning code (repeatable)
   --allow-warnings        Continue past plan warnings that require confirmation
-  --allow-dirty           gitvault-required projects only: capture a dirty
+  --allow-dirty           vault-required projects only: capture a dirty
                           work tree as-is instead of refusing
                           SNAPSHOT_DIRTY_TREE. The result discloses exactly
                           what was swept in, printed to stderr too — even
@@ -1328,14 +1328,14 @@ async function deployCmd(args) {
     const requiredPlan = opts.mode && opts.mode.kind === "applyReviewed"
       ? { planId: opts.mode.planId, ...(opts.mode.planFingerprint ? { planFingerprint: opts.mode.planFingerprint } : {}) }
       : undefined;
-    // A thin shim over the SDK lane (add-gitvault 5.0). `applyWithGitvault`
-    // takes the project's `gitvault_policy` into account: a project that is
+    // A thin shim over the SDK lane (add-vault 5.0). `applyWithVault`
+    // takes the project's `vault_policy` into account: a project that is
     // not `required` runs the same `apply()` this line always ran, with the
     // same options object; a `required` one captures, publishes, mints an
     // activation token, and commits with it.
     const sdk = getSdk(sdkOpts);
     const outcome = await withAutoApprove(() =>
-      applyWithGitvault({
+      applyWithVault({
         sdk,
         spec: releaseSpec,
         apply: {
@@ -1348,7 +1348,7 @@ async function deployCmd(args) {
         },
         target: isCoreApiTarget() ? "core" : "cloud",
         ...(opts.allowDirty ? { allowDirty: true } : {}),
-        // The `gitvault_commit` line is printed ALWAYS, and to stderr, so
+        // The `vault_commit` line is printed ALWAYS, and to stderr, so
         // `run402 deploy | jq` stays clean (the pipe contract).
         onCommitLine: (line) => { if (!opts.quiet) process.stderr.write(`${line}\n`); },
       }),
@@ -1357,29 +1357,29 @@ async function deployCmd(args) {
     // pass it as an optimization (the gateway defaults to the live release
     // without it). Best-effort: a keystore hiccup never fails the deploy.
     rememberLastDeployment(releaseSpec.project_id, outcome.deploy?.urls?.deployment_id);
-    if (!outcome.gitvault) {
+    if (!outcome.vault) {
       console.log(JSON.stringify({ ...outcome.deploy, stats: sdkStats(sdk) }, null, 2));
       printVerboseStats(opts.verbose, sdk);
       return;
     }
-    const vaulted = outcome.gitvault;
+    const vaulted = outcome.vault;
     // Both `DEPLOYED_*` outcomes activated a release; the override one just
     // did it without a vaulted capture and carries a draining advisory.
     const activated = vaulted.outcome === "DEPLOYED_AND_VAULTED" || vaulted.outcome === "DEPLOYED_UNVAULTED_OVERRIDE";
     console.log(JSON.stringify({
       ok: activated,
       outcome: vaulted.outcome,
-      gitvault_commit: vaulted.gitvault_commit,
+      vault_commit: vaulted.vault_commit,
       capture_id: vaulted.capture_id,
       operation_id: vaulted.operation_id,
       ...("generation" in vaulted ? { generation: vaulted.generation } : {}),
       ...("push_error" in vaulted ? { push_error: vaulted.push_error } : {}),
       ...("deploy_error" in vaulted ? { deploy_error: vaulted.deploy_error } : {}),
-      // Design D5/D6 (gitvault-human-envelopes task 4.1 + gitvault-mirror):
+      // Design D5/D6 (vault-human-envelopes task 4.1 + vault-mirror):
       // present only when this deploy landed a new generation — the SDK
       // omits both fields entirely on the other three outcomes rather than
       // faking a `skipped_*` value for something that never had a chance to
-      // run. See `Gitvault.deploy`'s doc comment (sdk/src/namespaces/gitvault.ts).
+      // run. See `Repos.deploy`'s doc comment (sdk/src/namespaces/repos.ts).
       ...("mirror_push" in vaulted ? { mirror_push: vaulted.mirror_push } : {}),
       ...("reconcile_recipients" in vaulted ? { reconcile_recipients: vaulted.reconcile_recipients } : {}),
       next_actions: vaulted.next_actions,
@@ -1388,11 +1388,11 @@ async function deployCmd(args) {
     }, null, 2));
     // Design D6: the mirror result is reported BESIDE the vault outcome
     // above, on its own stderr line — a mirror failure never blocks the
-    // deploy (mirrors `run402 gitvault snapshot`'s reporting).
+    // deploy (mirrors `run402 repos capture`'s reporting).
     if (vaulted.mirror_push?.outcome === "pushed") {
       console.error(`mirror: pushed generation ${vaulted.generation} (${vaulted.mirror_push.summary?.objects_copied ?? 0} object(s) copied)`);
     } else if (vaulted.mirror_push?.outcome === "failed") {
-      console.error(`mirror: dual-push FAILED (deploy is unaffected) — ${vaulted.mirror_push.error ?? "see mirror_push.summary.errors"}`);
+      console.error(`mirror: mirroring this capture FAILED (deploy is unaffected) — ${vaulted.mirror_push.error ?? "see mirror_push.summary.errors"}`);
     }
     // Dirty-tree disclosure (Tal's decision, "help people not make
     // mistakes"): even an explicit --allow-dirty override never captures
@@ -1502,12 +1502,12 @@ const CI_DEPLOY_ERROR_GUIDANCE = {
 };
 
 /**
- * The gateway's envelope for gitvault deploy errors — `upgrade_client` first,
+ * The gateway's envelope for vault deploy errors — `upgrade_client` first,
  * then `grandfather_policy` — is relayed untouched: `deployCmd` deploys
- * through `applyWithGitvault`, which declares `{capture_id,
+ * through `applyWithVault`, which declares `{capture_id,
  * snapshot_oid_hmac}` at plan time and presents an activation token at
- * commit, satisfying `gitvault_policy: required`, so no client-side rewrite
- * of the envelope is needed. `cli-deploy-gitvault-lane.test.mjs` is the gate
+ * commit, satisfying `vault_policy: required`, so no client-side rewrite
+ * of the envelope is needed. `cli-deploy-vault-lane.test.mjs` is the gate
  * for this behavior.
  */
 function reportDeployApplyError(err, useGithubActionsOidc) {