run402 4.95.0 → 4.96.0

package/lib/doctor.mjs

@@ -13,9 +13,9 @@ import { resolveApplicationScope, loadApplicationScanInput, scanDeploymentSource
  */
 
 import { existsSync, statSync } from "node:fs";
-import { GITVAULT_BYO_NO_PAYLOAD_COPY_STATEMENT } from "#sdk";
+import { VAULT_BYO_NO_PAYLOAD_COPY_STATEMENT } from "#sdk";
 import { configDir, readWallet, loadKeyStore } from "./config.mjs";
-import { resolveGitvaultTarget } from "./gitvault-target.mjs";
+import { resolveVaultTarget } from "./vault-target.mjs";
 import { getSdk } from "./sdk.mjs";
 import {
   resolveScanRoot,
@@ -54,7 +54,7 @@ const DOCTOR_CHECK_NAMES = [
   "account_health",
   "runtime_staleness",
   "recovery_posture",
-  "gitvault",
+  "vault",
   "source_scan",
 ];
 
@@ -91,7 +91,7 @@ Output:
               api_reachable error, tier inactive / frozen / past_due /
               dormant / missing / error, error-severity source_scan findings
     advisory  a warning that never stops a deploy: account_health,
-              recovery_posture, gitvault, runtime_staleness, cli_update gaps
+              recovery_posture, vault, runtime_staleness, cli_update gaps
     info      ok / skipped / unknown
   Agents: branch on \`ok\`; read \`warnings[]\` (one entry per gap) for the
   non-blocking gaps and \`blocking[]\` for what to fix when \`ok\` is false.
@@ -117,16 +117,16 @@ Options:
   --dir D        Select the application directory for deployment diagnostics.
   --manifest P   Explicitly select a manifest (executable configs are trusted code).
   --scan-dir D   Advanced arbitrary scan; does not claim deployment readiness
-  --project <project_id> Target THIS project's gitvault check instead of the repo-standing
+  --project <project_id> Target THIS project's vault check instead of the repo-standing
                  default (the 4.38.0 pin / run402 remote / RUN402_PROJECT_ID / active
-                 project, in that order — see \`gitvault-target.mjs\`). Scoped to the
-                 gitvault check only; every other check is wallet/machine-wide, not
+                 project, in that order — see \`vault-target.mjs\`). Scoped to the
+                 vault check only; every other check is wallet/machine-wide, not
                  per-project, and is unaffected by this flag. Composes with --only.
   --only <check> Run ONLY the named check (repeatable — pass it more than once
                  to run several). Every other check, INCLUDING the monorepo
                  source-tree scan, is suppressed rather than merely hidden: a
                  skipped check's network/filesystem work never runs at all, so
-                 \`doctor --only gitvault\` costs one gitvault read, not a
+                 \`doctor --only vault\` costs one vault read, not a
                  config/tier/account/scan sweep. An unknown check name is
                  BAD_USAGE listing the valid names below. Not used with --buzz
                  (buzz mode is its own separate, always-complete check set).
@@ -164,7 +164,7 @@ Checks performed:
     the org's disaster backstops if the agent machine dies. Evidence
     levels: "configured" is what the platform verified, never proof an
     off-platform passkey or saved code still exists.
-  - gitvault: the active project's vault — activation policy, whether THIS
+  - vault: the active project's vault — activation policy, whether THIS
     machine can produce the capture a 'required' policy demands, open
     unvaulted-override journals, and where the keystore lives (back it up:
     whole-keystore loss is terminal for vault history)
@@ -310,7 +310,7 @@ export async function run(sub, args = []) {
   const skipScan = all.includes("--no-scan");
   const scanDirArgIdx = all.indexOf("--scan-dir");
   const scanDirOverride = scanDirArgIdx >= 0 ? all[scanDirArgIdx + 1] : null;
-  // Scoped to the gitvault check (see HELP): every other check is
+  // Scoped to the vault check (see HELP): every other check is
   // wallet/machine-wide, not per-project.
   const projectOverride = flagValue(all, "--project");
 
@@ -650,7 +650,7 @@ export async function run(sub, args = []) {
       }
     }
 
-    // 6c. Org recovery posture (gitvault-recovery-custody). One entry per
+    // 6c. Org recovery posture (vault-recovery-custody). One entry per
     // vault-owning org the caller can see; rides the same account-status
     // read. Evidence levels, not guarantees: "configured" names what the
     // platform VERIFIED — it can never observe whether an off-platform
@@ -661,11 +661,11 @@ export async function run(sub, args = []) {
     if (wanted("recovery_posture")) {
       const posture = status.recovery_posture;
       if (!Array.isArray(posture)) {
-        // Gateway older than gitvault-recovery-custody doesn't surface it.
+        // Gateway older than vault-recovery-custody doesn't surface it.
         checks.push({
           name: "recovery_posture",
           status: "skipped",
-          ...(verbose && { hint: "account status has no 'recovery_posture' block; requires a gitvault-recovery-custody gateway." }),
+          ...(verbose && { hint: "account status has no 'recovery_posture' block; requires a vault-recovery-custody gateway." }),
         });
       } else if (posture.length === 0) {
         // No vault-owning org in the caller's view — nothing to lose, nothing to advise.
@@ -718,15 +718,15 @@ export async function run(sub, args = []) {
     });
   }
 
-  // 6c. gitvault (add-gitvault). Doctor was completely silent about the vault
-  // even when `gitvault_policy: required` was the single thing that would break
+  // 6c. vault (add-vault). Doctor was completely silent about the vault
+  // even when `vault_policy: required` was the single thing that would break
   // the project's next deploy (dogfood #1, finding D1) — and doctor is where a
   // user looks when something is wrong. It also prints WHERE the keystore is:
   // "whole-keystore loss is terminal" was stated three times across this
   // surface while the directory to back up was stated nowhere (finding D2).
   //
   // Read-only and best-effort in every branch: no project, no vault, or a
-  // gateway that does not know gitvault are all ordinary and report `skipped`
+  // gateway that does not know vault are all ordinary and report `skipped`
   // or `ok`, never a doctor failure. A vault-only project that has never
   // deployed is a first-class shape (protocol D183), so its mere absence of a
   // deploy raises nothing.
@@ -734,12 +734,12 @@ export async function run(sub, args = []) {
   // TARGETING: when cwd is a repository
   // with its own pinned repo id or run402/origin remote, doctor checks THAT
   // vault, not the profile's active project — the same pin > remote >
-  // RUN402_PROJECT_ID env > active-project order every other gitvault verb
-  // follows (`gitvault-target.mjs`). An explicit `--project <project_id>` outranks
-  // all of that (the resolver's own top tier), same as every other gitvault
+  // RUN402_PROJECT_ID env > active-project order every other vault verb
+  // follows (`vault-target.mjs`). An explicit `--project <project_id>` outranks
+  // all of that (the resolver's own top tier), same as every other vault
   // verb's `--project`.
-  if (wanted("gitvault")) {
-    // gitvault-persistent-helper: a bounded LOCAL probe of the resident
+  if (wanted("vault")) {
+    // vault-persistent-helper: a bounded LOCAL probe of the resident
     // helper engine — {running:false} is a fine answer, never a finding
     // (the daemon is an accelerator, not a dependency).
     const daemonInfo = await (async () => {
@@ -783,18 +783,18 @@ export async function run(sub, args = []) {
         return { running: false };
       }
     })();
-    const target = await resolveGitvaultTarget({ repoDir: process.cwd(), explicitProjectId: projectOverride ?? undefined });
+    const target = await resolveVaultTarget({ repoDir: process.cwd(), explicitProjectId: projectOverride ?? undefined });
     const projectId = target.project_id ?? null;
     const repoId = target.repo_id ?? null;
     if (!projectId && !repoId) {
       checks.push({
-        name: "gitvault",
+        name: "vault",
         status: "skipped",
         ...(verbose && { hint: "no active project — run 'run402 projects use <project_id>' to check its vault." }),
       });
     } else {
       try {
-        const gv = await getSdk().gitvault.status({
+        const gv = await getSdk().repos.status({
           ...(repoId ? { repo_id: repoId } : { project_id: projectId }),
           repo_dir: process.cwd(),
         });
@@ -802,11 +802,11 @@ export async function run(sub, args = []) {
           project_id: gv.project_id ?? projectId,
           repo_id: gv.repo_id,
           vault: gv.vault === null ? null : "allocated",
-          // gitvault-byo-primary-bucket task 3.5 — absent-or-"managed" is
+          // vault-byo-primary-bucket task 3.5 — absent-or-"managed" is
           // byte-identical to before this fold for every non-BYO vault.
           storage_profile: gv.vault?.storage_profile ?? null,
           byo_destination: gv.vault?.byo_destination ?? null,
-          gitvault_policy: gv.gitvault_policy,
+          vault_policy: gv.vault_policy,
           keystore_root: gv.keystore.root,
           can_sign: gv.keystore.can_sign,
           holds_repo_key: gv.keystore.holds_repo_key,
@@ -819,7 +819,7 @@ export async function run(sub, args = []) {
           // to the durability sentence instead of the terminal-loss claim.
           covering_recipients: gv.covering_recipients ?? null,
           daemon: daemonInfo,
-          // gitvault-multi-writer (rev 47) task 6.2 — this machine's own
+          // vault-multi-writer (rev 47) task 6.2 — this machine's own
           // standing on the vault's chain-verified writer set. `null` only
           // when there is no vault at all (nothing to be a writer OF).
           // `read_only_vault` takes priority over the caller's own standing
@@ -839,22 +839,22 @@ export async function run(sub, args = []) {
         if (value.writer === "read_only_vault") {
           gaps.push("this vault has lost its last writer (D228 read-only terminal) — it still serves reads, but no push can be admitted until a new writer is admitted through a recovery path");
         } else if (value.writer === "pending") {
-          gaps.push("this machine's key is an eligible writer candidate but not yet admitted — run 'run402 repos access sync' if you already hold writer standing on this vault, or ask a current writer to run any gitvault operation");
+          gaps.push("this machine's key is an eligible writer candidate but not yet admitted — run 'run402 repos access sync' if you already hold writer standing on this vault, or ask a current writer to run any vault operation");
         } else if (value.writer === "not_admitted") {
-          gaps.push("this machine's key is not an active writer on this vault — a push from here is refused GITVAULT_WRITER_NOT_ADMITTED; ask a current writer to admit you (org membership at role developer+ and a published signing key make you eligible)");
+          gaps.push("this machine's key is not an active writer on this vault — a push from here is refused VAULT_WRITER_NOT_ADMITTED; ask a current writer to admit you (org membership at role developer+ and a published signing key make you eligible)");
         }
         // The one that actually breaks the next deploy: the project demands a
         // vaulted capture and THIS machine cannot produce one.
-        if (gv.gitvault_policy === "required" && !gv.keystore.holds_repo_key) {
+        if (gv.vault_policy === "required" && !gv.keystore.holds_repo_key) {
           gaps.push(
-            "gitvault_policy is 'required' but this machine holds no key for the vault — a deploy from here is refused with GITVAULT_CLIENT_UPGRADE_REQUIRED. " +
+            "vault_policy is 'required' but this machine holds no key for the vault — a deploy from here is refused with VAULT_CLIENT_UPGRADE_REQUIRED. " +
             "Run 'run402 repos create --project <project_id>' (idempotent; resolves to the existing repo), or 'run402 repos policy grandfathered --reason <why>' to un-gate the project.",
           );
-        } else if (gv.gitvault_policy === "required" && !gv.keystore.can_sign) {
-          gaps.push("gitvault_policy is 'required' and this keystore is read-only (no signing key) — it can verify but cannot publish the capture a deploy needs");
+        } else if (gv.vault_policy === "required" && !gv.keystore.can_sign) {
+          gaps.push("vault_policy is 'required' and this keystore is read-only (no signing key) — it can verify but cannot publish the capture a deploy needs");
         }
         if (gv.pending_overrides > 0) {
-          gaps.push(`${gv.pending_overrides} unvaulted-override journal(s) are still open — run 'run402 repos snapshot' to drain them`);
+          gaps.push(`${gv.pending_overrides} unvaulted-override journal(s) are still open — run 'run402 repos capture' to drain them`);
         }
         // `matches` is a TRI-STATE: `false` alone is
         // a real mismatch. `null` (a slug-form remote not yet resolved on
@@ -863,20 +863,11 @@ export async function run(sub, args = []) {
         if (gv.remote && gv.remote.matches === false) {
           gaps.push(`the '${gv.remote.name}' git remote points at a different project than ${value.project_id} (${gv.remote.url})`);
         }
-        // A `kygit::` remote with no
-        // `git-remote-kygit` helper on PATH means every push/clone/fetch
-        // in this checkout fails inside git with an opaque error.
-        if (gv.remote?.url?.startsWith("kygit::")) {
-          const { isExecutableOnPath } = await import("./path-lookup.mjs");
-          if (!isExecutableOnPath("git-remote-kygit")) {
-            gaps.push("this checkout's remote is kygit:: but git-remote-kygit is not on PATH — run `npm i -g @kychee/kygit`");
-          }
-        }
         // Echoed exactly as the SDK reported them — including the
         // doctor-persistent `grandfathered` advisory it owns.
         for (const w of gv.warnings ?? []) gaps.push(`${w.kind}: ${w.message}`);
 
-        // gitvault-mirror-and-recover task 4.3 + gitvault-mirror-default:
+        // vault-mirror-and-recover task 4.3 + vault-mirror-default:
         // mirror currency, reported ALONGSIDE (never in place of) the
         // deploy-related gaps above, and never blocking `run402 deploy`'s
         // own gate — the vault lane's outcome is unaffected regardless of
@@ -885,14 +876,14 @@ export async function run(sub, args = []) {
         // unreachable or vault unread). Only STALE is actionable enough to
         // become a warning gap; a vault with no successful mirror copy yet
         // carries the SDK-computed `vault_unmirrored` finding — named and
-        // standing (gitvault-mirror-default supersedes the old anonymous
+        // standing (vault-mirror-default supersedes the old anonymous
         // `advisory` string), echoed verbatim, and deliberately NOT pushed
         // into `gaps`: informational, never blocking, computed client-side
         // only, cleared by the first successful mirror write or sync.
         if (gv.vault !== null && value.repo_id) {
           try {
-            const mirrorStatus = await getSdk().gitvault.mirrorStatus({ repo_id: value.repo_id, is_byo: value.storage_profile === "byo" });
-            value.gitvault_mirror = {
+            const mirrorStatus = await getSdk().repos.mirrorStatus({ repo_id: value.repo_id, is_byo: value.storage_profile === "byo" });
+            value.vault_mirror = {
               configured: mirrorStatus.configured,
               destination: mirrorStatus.destination,
               mirrored_generation: mirrorStatus.mirrored_generation,
@@ -912,12 +903,12 @@ export async function run(sub, args = []) {
           }
         }
 
-        // gitvault-byo-primary-bucket task 3.5 — unconditional, independent
+        // vault-byo-primary-bucket task 3.5 — unconditional, independent
         // of mirror status (D7); imported from the canonical constants, never
         // paraphrased.
-        const byoDisclosure = value.storage_profile === "byo" ? ` Storage: byo (${value.byo_destination ?? "(unknown)"}) — ${GITVAULT_BYO_NO_PAYLOAD_COPY_STATEMENT}` : "";
+        const byoDisclosure = value.storage_profile === "byo" ? ` Storage: byo (${value.byo_destination ?? "(unknown)"}) — ${VAULT_BYO_NO_PAYLOAD_COPY_STATEMENT}` : "";
         checks.push({
-          name: "gitvault",
+          name: "vault",
           status: gaps.length > 0 ? "warning" : "ok",
           value: gaps.length > 0 ? { ...value, gaps } : value,
           hint: (gv.vault === null
@@ -927,12 +918,12 @@ export async function run(sub, args = []) {
               : `Back up ${gv.keystore.root} — whole-machine or whole-keystore loss is terminal for vault history.`) + byoDisclosure,
         });
       } catch (err) {
-        // A gateway without gitvault, an unreachable API, or a project this
+        // A gateway without vault, an unreachable API, or a project this
         // wallet cannot see. None of those is a local health problem.
         checks.push({
-          name: "gitvault",
+          name: "vault",
           status: "skipped",
-          message: describeCheckFailure("gitvault status check", err),
+          message: describeCheckFailure("vault status check", err),
         });
       }
     }
@@ -944,7 +935,7 @@ export async function run(sub, args = []) {
   // `error` block deploy (`run402 deploy` wraps doctor and respects exit
   // code). Skipped via --no-scan when the user wants config-only checks, and
   // by any --only that omits it — on a monorepo this check's findings can
-  // otherwise bury the gitvault diagnosis under thousands of hits.
+  // otherwise bury the vault diagnosis under thousands of hits.
   if (!skipScan && wanted("source_scan")) {
     try {
       const scope = await resolveApplicationScope({ dir: flagValue(all, "--dir") ?? undefined, manifest: flagValue(all, "--manifest") ?? undefined });

package/lib/init.mjs

@@ -51,7 +51,7 @@ Options:
                   nothing; RUN402_AGENT_NAME=<name> sets or overrides it. Change
                   it any time with \`run402 whoami --set-name <name>\`.
   --git-remote    Also 'git init' the current directory when it is not a
-                  repository yet, so the gitvault remote can be added there.
+                  repository yet, so the vault remote can be added there.
                   Opt-in on purpose: init is often run outside a project
                   directory and must never create a repository somewhere you
                   did not ask it to. Inside an EXISTING repository the remote
@@ -62,11 +62,11 @@ Output:
   tier, projects_saved, active_project_id, next_step }. Progress lines
   (Config / Wallet / Balance / Tier / Next) go to stderr so a human
   re-running interactively sees what's happening while a script piping stdout
-  to jq stays clean. The summary also carries { gitvault } (the scaffolded
-  remote), or { gitvault: null, gitvault_skipped } naming why no remote was
-  added, or { gitvault: null, gitvault_error } when it could not be added.
+  to jq stays clean. The summary also carries { vault } (the scaffolded
+  remote), or { vault: null, vault_skipped } naming why no remote was
+  added, or { vault: null, vault_error } when it could not be added.
   \`projects_saved\` counts projects with LOCAL keys; \`active_project_id\` is the
-  project the gitvault scaffold acted on.
+  project the vault scaffold acted on.
 
   init scaffolds the git remote only. It does NOT allocate the vault — that is
   \`run402 repos create --project <project_id>\`, which mints key material and a
@@ -215,13 +215,13 @@ function errorMessage(err) {
 }
 
 /**
- * Which project the gitvault scaffold acts on — and why it may act on none.
+ * Which project the vault scaffold acts on — and why it may act on none.
  *
  * The CLI-wide resolution order (`RUN402_PROJECT_ID`, then the active
  * project), not `getActiveProjectId()` alone. Reading only the active project
  * meant an agent that had exported `RUN402_PROJECT_ID` — the normal way to
  * address a project without mutating machine state — got a silent no-op: no
- * remote, no allocation, and no `gitvault` key in the summary at all, with
+ * remote, no allocation, and no `vault` key in the summary at all, with
  * nothing anywhere saying `run402 projects use` was a prerequisite
  * (dogfood #1, finding A). A command that exits 0 having done nothing is worse
  * than an error, so the no-project case names itself.
@@ -375,7 +375,7 @@ export async function run(args = []) {
     ...(voucherCode ? { voucher: null } : {}),
     tier: null,
     projects_saved: 0,
-    /** The project init acted on — the input to the gitvault scaffold decision. */
+    /** The project init acted on — the input to the vault scaffold decision. */
     active_project_id: null,
     next_actions: [],
     next_step: null,
@@ -637,17 +637,17 @@ export async function run(args = []) {
   // local keys, so it is legitimately not counted here; `active_project_id`
   // below is the field that says which project init actually acted on, and
   // reading `projects_saved: 0` as "init did nothing" is what made the
-  // gitvault skip look silent (dogfood #1, finding A).
+  // vault skip look silent (dogfood #1, finding A).
   summary.projects_saved = Object.keys(store.projects).length;
   line("Projects", `${summary.projects_saved} saved`);
 
-  // 5b. gitvault git remote (gitvault-client-surface, task 5.7).
+  // 5b. vault git remote (vault-client-surface, task 5.7).
   //
   // Purely LOCAL git. No vault is allocated and no key material is written
   // here — the spec is explicit that neither exists until first capture, so the
   // cold-start path gains no prompt and no new failure mode. Allocation happens
-  // on the first `git push origin <branch>` or `run402 gitvault snapshot` (D2,
-  // repo-first-onramp) — NOT on deploy: `applyWithGitvault` only ever reads an
+  // on the first `git push origin <branch>` or `run402 repos capture` (D2,
+  // repo-first-onramp) — NOT on deploy: `applyWithVault` only ever reads an
   // EXISTING vault's policy (D3) and never allocates one that does not exist,
   // so a project with no vault deploys exactly as it always did.
   //
@@ -664,11 +664,11 @@ export async function run(args = []) {
   const { projectId: activeProjectId, skipped: noProjectSkip } = resolveScaffoldProject();
   summary.active_project_id = activeProjectId;
   if (noProjectSkip) {
-    summary.gitvault = null;
-    summary.gitvault_skipped = noProjectSkip;
-    line("Gitvault", "skipped — no project selected (run402 projects use <project_id>)");
+    summary.vault = null;
+    summary.vault_skipped = noProjectSkip;
+    line("Vault", "skipped — no project selected (run402 projects use <project_id>)");
   } else {
-    summary.gitvault = null;
+    summary.vault = null;
     try {
       // Dynamic import: the scaffold is the only thing here that needs the
       // Node SDK's hardened git runner, and a top-level import would drag it
@@ -681,43 +681,43 @@ export async function run(args = []) {
         insideRepo = false;
       }
       if (!insideRepo && !scaffoldGitRemote) {
-        summary.gitvault_skipped = "not a git repository — re-run with --git-remote to create one and add the remote";
-        line("Gitvault", "skipped — not a git repository (--git-remote creates one)");
+        summary.vault_skipped = "not a git repository — re-run with --git-remote to create one and add the remote";
+        line("Vault", "skipped — not a git repository (--git-remote creates one)");
       } else {
         const orgId = await resolveOwningOrgId(activeProjectId);
         if (!orgId) {
-          summary.gitvault_skipped = `could not resolve the owning org for ${activeProjectId} — the run402 remote was not added`;
-          line("Gitvault", "skipped — owning org unresolved");
+          summary.vault_skipped = `could not resolve the owning org for ${activeProjectId} — the run402 remote was not added`;
+          line("Vault", "skipped — owning org unresolved");
         } else {
-          const remote = await getSdk().gitvault.scaffoldRemote({
+          const remote = await getSdk().repos.scaffoldRemote({
             repo_dir: process.cwd(),
             org_id: orgId,
             project_id: activeProjectId,
           });
           // `allocated: false` is stated, not left to be inferred: this was
           // local git only, and no vault exists for the project yet.
-          summary.gitvault = { ...remote, allocated: false };
+          summary.vault = { ...remote, allocated: false };
           if (remote.already_present && remote.existing_url !== remote.url) {
             // Left exactly as it was. Name the URL that is actually in place
             // rather than implying the remote now points at this project.
-            line("Gitvault", `remote '${remote.name}' already points at ${remote.existing_url} — left unchanged (${remote.reason})`);
+            line("Vault", `remote '${remote.name}' already points at ${remote.existing_url} — left unchanged (${remote.reason})`);
           } else if (remote.already_present) {
-            line("Gitvault", `remote '${remote.name}' already set (${remote.url})`);
+            line("Vault", `remote '${remote.name}' already set (${remote.url})`);
           } else {
             // D1: `origin` when it was free, `run402` when it was already
             // taken by something else — `remote.reason` says which happened.
-            line("Gitvault", `${remote.created_repository ? "initialized a repository and added" : "added"} remote '${remote.name}' -> ${remote.url} (${remote.reason})`);
+            line("Vault", `${remote.created_repository ? "initialized a repository and added" : "added"} remote '${remote.name}' -> ${remote.url} (${remote.reason})`);
           }
         }
       }
     } catch (err) {
       const reason = errorMessage(err);
-      summary.gitvault = null;
-      summary.gitvault_error = {
-        code: err?.body?.code ?? err?.code ?? "GITVAULT_SCAFFOLD_FAILED",
+      summary.vault = null;
+      summary.vault_error = {
+        code: err?.body?.code ?? err?.code ?? "VAULT_SCAFFOLD_FAILED",
         message: reason,
       };
-      line("Gitvault", `remote not added: ${reason}`);
+      line("Vault", `remote not added: ${reason}`);
     }
   }
 

package/lib/next-actions.mjs

@@ -81,7 +81,7 @@ export function upDeployAction() {
 }
 
 /**
- * `repos create` (and `gitvault init`) on an org with no slug set: the
+ * `repos create` (and `vault init`) on an org with no slug set: the
  * response's `address: null` had no pointer to WHY, or to the named-addressing
  * feature at all. Owner-only. Wording deliberately
  * omits a price: the first slug per org is free, and renames/re-claims cost

package/lib/org-context.mjs

@@ -97,15 +97,15 @@ function orgFromRoomEnv(env) {
  * `r402.orgId` from `cwd`'s LOCAL git config (kygit-handoff design D10) —
  * best-effort, gracefully degrading like `findBindingKey`: no repository,
  * no pin, or a shape-invalid value all answer `null` rather than throwing,
- * so a bare directory or a checkout with no gitvault remote costs nothing.
+ * so a bare directory or a checkout with no vault remote costs nothing.
  * Checks a real vault checkout's pin first (gated on `r402.repoId`), then
  * falls back to the bare org/room pin a room-only `rooms join <key>` writes
  * in a directory with no vault at all (add-room-invite design D10).
  */
-async function readGitvaultPinnedOrgId(cwd) {
+async function readVaultPinnedOrgId(cwd) {
   try {
-    const { readPinnedGitvaultRepo, readPinnedRoomBinding } = await import("#sdk/node");
-    const pinned = await readPinnedGitvaultRepo(cwd);
+    const { readPinnedVaultRepo, readPinnedRoomBinding } = await import("#sdk/node");
+    const pinned = await readPinnedVaultRepo(cwd);
     const orgId = trimmed(pinned?.org_id);
     if (orgId && ORG_ID_RE.test(orgId)) return orgId;
     const bare = await readPinnedRoomBinding(cwd);
@@ -254,14 +254,14 @@ export async function resolveOrg(input = {}, opts = {}) {
   }
   if (bindingOrg) return { orgId: bindingOrg, source: "binding", sourceDetail: bindingHit.file };
 
-  // --- Class 3.5: gitvault local pin (kygit-handoff design D10) ------------
+  // --- Class 3.5: vault local pin (kygit-handoff design D10) ------------
   // `r402.orgId` in this checkout's LOCAL git config — written by every
-  // gitvault pin site (`repos create`, `resume`, address resolution), a
+  // vault pin site (`repos create`, `resume`, address resolution), a
   // rung below env/binding and above profile state: a checkout that IS a
   // resumed/pinned vault should resolve its own org with zero configuration,
   // but an explicit env var or a committed `.run402.json` binding still wins.
-  const pinnedOrg = await readGitvaultPinnedOrgId(cwd);
-  if (pinnedOrg) return { orgId: pinnedOrg, source: "gitvault_pin", sourceDetail: "r402.orgId (local git config)" };
+  const pinnedOrg = await readVaultPinnedOrgId(cwd);
+  if (pinnedOrg) return { orgId: pinnedOrg, source: "vault_pin", sourceDetail: "r402.orgId (local git config)" };
 
   // --- Class 4: profile state ----------------------------------------------
   const selected = trimmed(coreGetActiveOrgId());
@@ -434,7 +434,7 @@ export function orgProvenance(resolved) {
  * owns THIS project id", which is what a project-scoped scaffold needs and
  * where an `--org` override would be a mis-binding, not a convenience.
  *
- * WHY IT CACHES (task 5.12c): the gitvault scaffold is the one part of
+ * WHY IT CACHES (task 5.12c): the vault scaffold is the one part of
  * `run402 init` the client-surface spec says adds no network dependency to the
  * cold-start path, and resolving the org through `projects.list()` quietly made
  * that untrue. `org_id` is a non-secret routing identifier the control plane

package/lib/orgs.mjs

@@ -44,7 +44,7 @@ Usage:
   run402 orgs members add  [<org_id>] <wallet_address> [--role <role>]
   run402 orgs members role [<org_id>] --principal <principal_id> --role <role>
   run402 orgs members rm   [<org_id>] --principal <principal_id>
-  run402 orgs members revoke-key [<org_id>] --principal <principal_id> [--reason <why>]   (owner + step-up; revokes the member's gitvault encryption key — its next gitvault operation enrolls afresh)
+  run402 orgs members revoke-key [<org_id>] --principal <principal_id> [--reason <why>]   (owner + step-up; revokes the member's vault encryption key — its next vault operation enrolls afresh)
   run402 orgs invite list   [<org_id>]
   run402 orgs invite create [<org_id>] --email <email> [--role <role>] [--ttl-hours N]
   run402 orgs invite rm     [<org_id>] --principal <principal_id>
@@ -53,7 +53,7 @@ Usage:
 omit it and the org comes from --org, then RUN402_ORG, then the .run402.json
 binding, then 'run402 orgs use'. Inside a bound checkout two agents add each
 other with nothing to look up: run402 orgs members add <wallet_address> --role developer.
-A developer-or-above add REFUSES (GITVAULT_WRITER_NOT_ADMITTED) unless this session's key is an admitted writer on every vault of the org, so the new member can push at once; a current writer admits your key with run402 repos access sync.
+A developer-or-above add REFUSES (VAULT_WRITER_NOT_ADMITTED) unless this session's key is an admitted writer on every vault of the org, so the new member can push at once; a current writer admits your key with run402 repos access sync.
 The second attribute may also be passed positionally (run402 orgs members add <wallet_address>).
 
 Subcommands:
@@ -186,7 +186,7 @@ Usage:
   run402 orgs members add  [<org_id>] <wallet_address> [--role <role>]
   run402 orgs members role [<org_id>] --principal <principal_id> --role <role>
   run402 orgs members rm   [<org_id>] --principal <principal_id>
-  run402 orgs members revoke-key [<org_id>] --principal <principal_id> [--reason <why>]   (owner + step-up; revokes the member's gitvault encryption key — its next gitvault operation enrolls afresh)
+  run402 orgs members revoke-key [<org_id>] --principal <principal_id> [--reason <why>]   (owner + step-up; revokes the member's vault encryption key — its next vault operation enrolls afresh)
 
 Roles: ${ROLE_LIST} (add defaults to developer). Mutations require an active owner.
 Demoting/removing the org's only active owner fails with 409 LAST_OWNER.
@@ -202,7 +202,7 @@ Usage:
 omit it and the org comes from --org, then RUN402_ORG, then the .run402.json
 binding, then 'run402 orgs use'. Inside a bound checkout two agents add each
 other with nothing to look up: run402 orgs members add <wallet_address> --role developer.
-A developer-or-above add REFUSES (GITVAULT_WRITER_NOT_ADMITTED) unless this session's key is an admitted writer on every vault of the org, so the new member can push at once; a current writer admits your key with run402 repos access sync.
+A developer-or-above add REFUSES (VAULT_WRITER_NOT_ADMITTED) unless this session's key is an admitted writer on every vault of the org, so the new member can push at once; a current writer admits your key with run402 repos access sync.
 The second attribute may also be passed positionally (run402 orgs members add <wallet_address>).
 
 An invite is claimed at the recipient's first login. Mutations require an active owner
@@ -223,7 +223,7 @@ Requires an admin+ membership on the org. Newest-first. Page forward with --afte
 
 
 /**
- * gitvault-multi-writer (rev 47) task 6.3 / design D3 — decided 2026-09-03
+ * vault-multi-writer (rev 47) task 6.3 / design D3 — decided 2026-09-03
  * (Tal): `orgs members add` REFUSES a writer-eligible add (developer or
  * above) when this session's own key is not an admitted writer on EVERY
  * vault of the org, because a developer who cannot push is not the member
@@ -237,11 +237,11 @@ Requires an admin+ membership on the org. Newest-first. Page forward with --afte
  * Every read failure REFUSES too (an unverifiable gate is not a passed one).
  */
 async function assertCallerCanAdmitWritersEverywhere(sdk, orgId, effectiveRole) {
-  const listing = await sdk.gitvault.listByOrg(orgId);
+  const listing = await sdk.repos.listByOrg(orgId);
   const vaults = listing?.vaults ?? [];
   const blocked = [];
   for (const v of vaults) {
-    const st = await sdk.gitvault.status({ repo_id: v.repo_id, reconcile: "forbidden" });
+    const st = await sdk.repos.status({ repo_id: v.repo_id, reconcile: "forbidden" });
     const vault = st?.vault ?? null;
     if (!vault || vault.read_only_terminal) continue;
     const me = st?.keystore?.identity_fingerprint ?? null;
@@ -250,7 +250,7 @@ async function assertCallerCanAdmitWritersEverywhere(sdk, orgId, effectiveRole)
   }
   if (blocked.length > 0) {
     fail({
-      code: "GITVAULT_WRITER_NOT_ADMITTED",
+      code: "VAULT_WRITER_NOT_ADMITTED",
       message: `refusing to add a ${effectiveRole}: this session's key is not an admitted writer on ${blocked.length} of this org's ${vaults.length} vault(s), so the new member could not push there`,
       details: { role: effectiveRole, vaults: blocked, checked: vaults.length },
       next_actions: [
@@ -266,7 +266,7 @@ async function assertCallerCanAdmitWritersEverywhere(sdk, orgId, effectiveRole)
 }
 
 /**
- * `orgs members rm`'s inline epoch rotation (gitvault-multi-writer D6, the
+ * `orgs members rm`'s inline epoch rotation (vault-multi-writer D6, the
  * kygit-handoff member-removal decision): for every vault of the org where
  * this session's key is an admitted writer, drive
  * `rotateEpochForKeyRevocation(principalId)` — the one self-contained
@@ -275,7 +275,7 @@ async function assertCallerCanAdmitWritersEverywhere(sdk, orgId, effectiveRole)
  * no vault (nothing to rotate, nothing to report).
  */
 async function rotateOrgVaultsAfterRemoval(sdk, orgId, principalId) {
-  const listing = await sdk.gitvault.listByOrg(orgId);
+  const listing = await sdk.repos.listByOrg(orgId);
   const vaults = listing?.vaults ?? [];
   if (vaults.length === 0) return null;
   const rotated = [];
@@ -284,7 +284,7 @@ async function rotateOrgVaultsAfterRemoval(sdk, orgId, principalId) {
   for (const v of vaults) {
     let st;
     try {
-      st = await sdk.gitvault.status({ repo_id: v.repo_id, reconcile: "forbidden" });
+      st = await sdk.repos.status({ repo_id: v.repo_id, reconcile: "forbidden" });
     } catch (err) {
       errors.push({ repo_id: v.repo_id, code: err?.code ?? null, error: err?.message ?? String(err) });
       continue;
@@ -300,7 +300,7 @@ async function rotateOrgVaultsAfterRemoval(sdk, orgId, principalId) {
     try {
       // reason:"member_removed" — writer-capable (no owner step-up); the
       // removal itself advanced the counters this rotation is fenced on.
-      const r = await sdk.gitvault.rotateEpochForMemberRemoval({ repo_id: v.repo_id });
+      const r = await sdk.repos.rotateEpochForMemberRemoval({ repo_id: v.repo_id });
       rotated.push({ repo_id: v.repo_id, new_epoch: r.new_epoch, generation: r.generation, included: r.included.length, writers_removed: r.writers_removed?.length ?? 0, self_check: r.self_check });
     } catch (err) {
       errors.push({ repo_id: v.repo_id, code: err?.code ?? null, error: err?.message ?? String(err) });
@@ -717,7 +717,7 @@ async function runMember(args) {
         await assertCallerCanAdmitWritersEverywhere(sdk, org, effectiveRole);
       }
       const res = await sdk.org(org).members.add({ wallet, role: role || undefined });
-      // gitvault-multi-writer (rev 47) task 6.3 — the gateway names which of
+      // vault-multi-writer (rev 47) task 6.3 — the gateway names which of
       // this org's vaults now have a pending writer candidate (D3: there is
       // no server-side writer admission — the client holds the keys) via a
       // `sync_writers` next_action carrying `vault_ids[]`. Run the ACTUAL
@@ -737,7 +737,7 @@ async function runMember(args) {
         const errors = [];
         for (const vaultId of syncTarget.vault_ids) {
           try {
-            const r = await sdk.gitvault.reconcile({ repo_id: vaultId });
+            const r = await sdk.repos.reconcile({ repo_id: vaultId });
             if (!r.eligible) notEligible.push(vaultId);
             else if (r.admitted.length > 0) admitted.push({ repo_id: vaultId, admitted: r.admitted });
           } catch (err) {
@@ -748,7 +748,7 @@ async function runMember(args) {
       }
       console.log(JSON.stringify(writerSync ? { ...res, writer_sync: writerSync } : res, null, 2));
       if (writerSync?.not_eligible.length > 0) {
-        console.error(`writer sync: this session is not (yet) a writer on ${writerSync.not_eligible.length} vault(s) — the new member is a pending writer candidate there until a CURRENT writer's next gitvault operation admits them.`);
+        console.error(`writer sync: this session is not (yet) a writer on ${writerSync.not_eligible.length} vault(s) — the new member is a pending writer candidate there until a CURRENT writer's next vault operation admits them.`);
       }
       if (writerSync?.errors.length > 0) {
         for (const e of writerSync.errors) console.error(`writer sync: ${e.repo_id} — ${e.error}`);
@@ -760,10 +760,10 @@ async function runMember(args) {
   }
 
   if (memberAction === "revoke-key") {
-    // gitvault-agent-envelopes D3: owner + step-up revokes a member's current
-    // gitvault encryption key — the ONLY rotation path for a member that shares
+    // vault-agent-envelopes D3: owner + step-up revokes a member's current
+    // vault encryption key — the ONLY rotation path for a member that shares
     // an org with another custodian (a lost/rebuilt keystore fails
-    // GITVAULT_KEY_ROTATION_REQUIRED and points here). Adapter only.
+    // VAULT_KEY_ROTATION_REQUIRED and points here). Adapter only.
     const a = normalizeArgv(rest);
     assertKnownFlags(a, ["--org", "--principal", "--reason", "--help", "-h"], ["--org", "--principal", "--reason"]);
     const principalFlag = flagValue(a, "--principal");
@@ -818,7 +818,7 @@ async function runMember(args) {
     try {
       const sdk = getSdk();
       const res = await sdk.org(org).members.revoke(principalId);
-      // gitvault-multi-writer D6 — a removal rides `rotate_epoch`: the gateway
+      // vault-multi-writer D6 — a removal rides `rotate_epoch`: the gateway
       // has just blocked the principal's writer keys and flipped its desired
       // row to pending_removal, so every ordinary push on every vault of this
       // org now refuses EPOCH_ROTATION_REQUIRED until a surviving writer