run402 4.95.0 → 4.97.0

package/lib/deploy-v2.mjs

@@ -28,7 +28,7 @@
 import { existsSync, fstatSync, readFileSync } from "node:fs";
 import { resolve, dirname, extname, isAbsolute } from "node:path";
 import {
-  applyWithGitvault,
+  applyWithVault,
   assertLocalFileReferencesExist,
   buildDeployResolveSummary,
   githubActionsCredentials,
@@ -44,7 +44,7 @@ import {
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import { API, walletAuthHeaders, getActiveProjectId, resolveProjectId, isCoreApiTarget, updateProject } from "./config.mjs";
-import { delegateTokenFromEnv } from "#sdk/node";
+import { grantKeyFromEnv } from "#sdk/node";
 import { flagValue, normalizeArgv } from "./argparse.mjs";
 import { loadLiveControlPlaneSession } from "../core-dist/control-plane-session.js";
 import { withAutoApprove } from "./sign-in.mjs";
@@ -139,7 +139,7 @@ Options:
   --final-only            Alias for --quiet; final success/error envelope is still preserved
   --allow-warning <code>  Continue past this reviewed warning code (repeatable)
   --allow-warnings        Continue past plan warnings that require confirmation
-  --allow-dirty           gitvault-required projects only: capture a dirty
+  --allow-dirty           vault-required projects only: capture a dirty
                           work tree as-is instead of refusing
                           SNAPSHOT_DIRTY_TREE. The result discloses exactly
                           what was swept in, printed to stderr too — even
@@ -486,10 +486,10 @@ async function rehearseCmd(rawArgs) {
     fail({ code: "BAD_USAGE", message: "--teardown must be one of: on_pass, keep, always", details: { flag: "--teardown", value: teardown } });
   }
   const project = flagValue(args, "--project") ?? undefined;
-  // A delegate is a complete deploy credential and the gateway explicitly
+  // A grant key is a complete deploy credential and the gateway explicitly
   // supports rehearsing with one (the route rejects only CI sessions).
   // Rehearsal is the SAFE path; never make it the harder one.
-  if (!isCoreApiTarget() && !loadLiveControlPlaneSession() && !delegateTokenFromEnv()) {
+  if (!isCoreApiTarget() && !loadLiveControlPlaneSession() && !grantKeyFromEnv()) {
     walletAuthHeaders(`/apply/v1/plans/${givenPlanId ?? "_"}/rehearse`);
   }
   const sdk = getSdk();
@@ -723,9 +723,9 @@ async function promoteCmd(args) {
 
   // Preserve the aggressive early-exit when no local wallet is configured
   // — same as apply.
-  // A delegate holds `deploy` and the gateway accepts it on this route; refusing
+  // A grant key holds `deploy` and the gateway accepts it on this route; refusing
   // locally would tell a wallet-less holder to run `run402 init` (see 4.11.2).
-  if (!delegateTokenFromEnv()) walletAuthHeaders("/apply/v1/releases");
+  if (!grantKeyFromEnv()) walletAuthHeaders("/apply/v1/releases");
 
   try {
     // Call the engine directly (matches the pattern used by apply / resume
@@ -1295,20 +1295,20 @@ async function deployCmd(args) {
 
 
   let sdkOpts;
-  const delegateToken = delegateTokenFromEnv();
+  const grantKey = grantKeyFromEnv();
   if (useGithubActionsOidc) {
     sdkOpts = {
       credentials: githubActionsCredentials({ projectId: releaseSpec.project_id, apiBase: API }),
       disablePaidFetch: true,
     };
-  } else if (delegateToken) {
-    // A delegate is a complete, self-contained deploy credential: the owner
+  } else if (grantKey) {
+    // A grant key is a complete, self-contained deploy credential: the owner
     // minted it with their wallet and handed it over, so this process needs no
     // wallet of its own. Skipping the guard is the point — an agent that
     // lost its local state (or never had a wallet) can still deploy. Paid fetch
-    // is disabled for the same reason it is under CI: a delegate authorizes
+    // is disabled for the same reason it is under CI: a grant key authorizes
     // deploys, not spending.
-    sdkOpts = { delegateToken, disablePaidFetch: true };
+    sdkOpts = { grantKey, disablePaidFetch: true };
   } else if (!isCoreApiTarget() && !loadLiveControlPlaneSession()) {
     // Aggressive early exit when no local wallet is configured — unless a
     // wallet-less person is deploying via their sign-in session
@@ -1328,14 +1328,14 @@ async function deployCmd(args) {
     const requiredPlan = opts.mode && opts.mode.kind === "applyReviewed"
       ? { planId: opts.mode.planId, ...(opts.mode.planFingerprint ? { planFingerprint: opts.mode.planFingerprint } : {}) }
       : undefined;
-    // A thin shim over the SDK lane (add-gitvault 5.0). `applyWithGitvault`
-    // takes the project's `gitvault_policy` into account: a project that is
+    // A thin shim over the SDK lane (add-vault 5.0). `applyWithVault`
+    // takes the project's `vault_policy` into account: a project that is
     // not `required` runs the same `apply()` this line always ran, with the
     // same options object; a `required` one captures, publishes, mints an
     // activation token, and commits with it.
     const sdk = getSdk(sdkOpts);
     const outcome = await withAutoApprove(() =>
-      applyWithGitvault({
+      applyWithVault({
         sdk,
         spec: releaseSpec,
         apply: {
@@ -1348,7 +1348,7 @@ async function deployCmd(args) {
         },
         target: isCoreApiTarget() ? "core" : "cloud",
         ...(opts.allowDirty ? { allowDirty: true } : {}),
-        // The `gitvault_commit` line is printed ALWAYS, and to stderr, so
+        // The `vault_commit` line is printed ALWAYS, and to stderr, so
         // `run402 deploy | jq` stays clean (the pipe contract).
         onCommitLine: (line) => { if (!opts.quiet) process.stderr.write(`${line}\n`); },
       }),
@@ -1357,29 +1357,29 @@ async function deployCmd(args) {
     // pass it as an optimization (the gateway defaults to the live release
     // without it). Best-effort: a keystore hiccup never fails the deploy.
     rememberLastDeployment(releaseSpec.project_id, outcome.deploy?.urls?.deployment_id);
-    if (!outcome.gitvault) {
+    if (!outcome.vault) {
       console.log(JSON.stringify({ ...outcome.deploy, stats: sdkStats(sdk) }, null, 2));
       printVerboseStats(opts.verbose, sdk);
       return;
     }
-    const vaulted = outcome.gitvault;
+    const vaulted = outcome.vault;
     // Both `DEPLOYED_*` outcomes activated a release; the override one just
     // did it without a vaulted capture and carries a draining advisory.
     const activated = vaulted.outcome === "DEPLOYED_AND_VAULTED" || vaulted.outcome === "DEPLOYED_UNVAULTED_OVERRIDE";
     console.log(JSON.stringify({
       ok: activated,
       outcome: vaulted.outcome,
-      gitvault_commit: vaulted.gitvault_commit,
+      vault_commit: vaulted.vault_commit,
       capture_id: vaulted.capture_id,
       operation_id: vaulted.operation_id,
       ...("generation" in vaulted ? { generation: vaulted.generation } : {}),
       ...("push_error" in vaulted ? { push_error: vaulted.push_error } : {}),
       ...("deploy_error" in vaulted ? { deploy_error: vaulted.deploy_error } : {}),
-      // Design D5/D6 (gitvault-human-envelopes task 4.1 + gitvault-mirror):
+      // Design D5/D6 (vault-human-envelopes task 4.1 + vault-mirror):
       // present only when this deploy landed a new generation — the SDK
       // omits both fields entirely on the other three outcomes rather than
       // faking a `skipped_*` value for something that never had a chance to
-      // run. See `Gitvault.deploy`'s doc comment (sdk/src/namespaces/gitvault.ts).
+      // run. See `Repos.deploy`'s doc comment (sdk/src/namespaces/repos.ts).
       ...("mirror_push" in vaulted ? { mirror_push: vaulted.mirror_push } : {}),
       ...("reconcile_recipients" in vaulted ? { reconcile_recipients: vaulted.reconcile_recipients } : {}),
       next_actions: vaulted.next_actions,
@@ -1388,11 +1388,11 @@ async function deployCmd(args) {
     }, null, 2));
     // Design D6: the mirror result is reported BESIDE the vault outcome
     // above, on its own stderr line — a mirror failure never blocks the
-    // deploy (mirrors `run402 gitvault snapshot`'s reporting).
+    // deploy (mirrors `run402 repos capture`'s reporting).
     if (vaulted.mirror_push?.outcome === "pushed") {
       console.error(`mirror: pushed generation ${vaulted.generation} (${vaulted.mirror_push.summary?.objects_copied ?? 0} object(s) copied)`);
     } else if (vaulted.mirror_push?.outcome === "failed") {
-      console.error(`mirror: dual-push FAILED (deploy is unaffected) — ${vaulted.mirror_push.error ?? "see mirror_push.summary.errors"}`);
+      console.error(`mirror: mirroring this capture FAILED (deploy is unaffected) — ${vaulted.mirror_push.error ?? "see mirror_push.summary.errors"}`);
     }
     // Dirty-tree disclosure (Tal's decision, "help people not make
     // mistakes"): even an explicit --allow-dirty override never captures
@@ -1502,12 +1502,12 @@ const CI_DEPLOY_ERROR_GUIDANCE = {
 };
 
 /**
- * The gateway's envelope for gitvault deploy errors — `upgrade_client` first,
+ * The gateway's envelope for vault deploy errors — `upgrade_client` first,
  * then `grandfather_policy` — is relayed untouched: `deployCmd` deploys
- * through `applyWithGitvault`, which declares `{capture_id,
+ * through `applyWithVault`, which declares `{capture_id,
  * snapshot_oid_hmac}` at plan time and presents an activation token at
- * commit, satisfying `gitvault_policy: required`, so no client-side rewrite
- * of the envelope is needed. `cli-deploy-gitvault-lane.test.mjs` is the gate
+ * commit, satisfying `vault_policy: required`, so no client-side rewrite
+ * of the envelope is needed. `cli-deploy-vault-lane.test.mjs` is the gate
  * for this behavior.
  */
 function reportDeployApplyError(err, useGithubActionsOidc) {
@@ -1766,9 +1766,9 @@ async function resumeCmd(args) {
   emitDeployUpdateNotice("resume", args, { quiet: opts.quiet });
   const project = resolveProjectId(opts.project);
 
-  // A delegate holds `deploy` and the gateway accepts it on this route; refusing
+  // A grant key holds `deploy` and the gateway accepts it on this route; refusing
   // locally would tell a wallet-less holder to run `run402 init` (see 4.11.2).
-  if (!delegateTokenFromEnv()) walletAuthHeaders("/apply/v1/operations");
+  if (!grantKeyFromEnv()) walletAuthHeaders("/apply/v1/operations");
 
   try {
     const result = await getSdk({ disablePaidFetch: true })._applyEngine.resume(opts.operationId, {
@@ -1794,9 +1794,9 @@ async function statusCmd(args) {
     missing: "Missing <operation_id>.",
   });
   const project = resolveProjectId(parsed.flags["--project"] ?? null);
-  // A delegate holds `deploy` and the gateway accepts it on this route; refusing
+  // A grant key holds `deploy` and the gateway accepts it on this route; refusing
   // locally would tell a wallet-less holder to run `run402 init` (see 4.11.2).
-  if (!delegateTokenFromEnv()) walletAuthHeaders("/apply/v1/operations");
+  if (!grantKeyFromEnv()) walletAuthHeaders("/apply/v1/operations");
 
   try {
     const result = await getSdk()._applyEngine.status(operationId, { project });
@@ -1822,24 +1822,24 @@ async function listCmd(args) {
   };
 
   const project = resolveProjectId(opts.project);
-  // NOT ungated for delegates, deliberately: /apply/v1/operations (list) is
+  // NOT ungated for grant keys, deliberately: /apply/v1/operations (list) is
   // `apikeyAuth` only — unlike get/events/resume/promote, which accept a
-  // delegate bearer. Listing every operation on a project is broader than
+  // grant-key bearer. Listing every operation on a project is broader than
   // the per-operation reads a deploy credential is scoped to. If this is
   // ever widened, widen the ROUTE first, then this guard.
   //
   // The refusal is correct; the REMEDY must still be honest. Falling through
-  // to NO_WALLET would tell a delegate holder to run `run402 init`, which
+  // to NO_WALLET would tell a grant-key holder to run `run402 init`, which
   // is wrong for a credential that is wallet-less by design — the same
   // misleading-remedy shape removed from the payment path in 4.11.2.
-  if (delegateTokenFromEnv()) {
+  if (grantKeyFromEnv()) {
     fail({
-      code: "DELEGATE_SCOPE_INSUFFICIENT",
-      message: "Listing deploy operations is not available to a delegate.",
-      hint: "Use `run402 deploy status <operation_id>`, `deploy events <operation_id>` or `deploy verify <operation_id>` for a specific operation, which a delegate CAN read. A full listing needs the project apikey or the owner wallet.",
-      details: { command: "deploy list", credential: "delegate", route: "GET /apply/v1/operations" },
+      code: "GRANT_KEY_SCOPE_INSUFFICIENT",
+      message: "Listing deploy operations is not available to a grant key.",
+      hint: "Use `run402 deploy status <operation_id>`, `deploy events <operation_id>` or `deploy verify <operation_id>` for a specific operation, which a grant key CAN read. A full listing needs the project apikey or the owner wallet.",
+      details: { command: "deploy list", credential: "grant_key", route: "GET /apply/v1/operations" },
       next_actions: [
-        { type: "run_command", command: "run402 deploy status <operation_id>", why: "Per-operation reads are within a delegate's deploy scope." },
+        { type: "run_command", command: "run402 deploy status <operation_id>", why: "Per-operation reads are within a grant key's deploy scope." },
       ],
     });
   }
@@ -1870,9 +1870,9 @@ async function eventsCmd(args) {
   const opts = { operationId, project: parsed.flags["--project"] ?? null };
 
   const project = resolveProjectId(opts.project);
-  // A delegate holds `deploy` and the gateway accepts it on this route; refusing
+  // A grant key holds `deploy` and the gateway accepts it on this route; refusing
   // locally would tell a wallet-less holder to run `run402 init` (see 4.11.2).
-  if (!delegateTokenFromEnv()) walletAuthHeaders("/apply/v1/operations");
+  if (!grantKeyFromEnv()) walletAuthHeaders("/apply/v1/operations");
 
   try {
     const result = await getSdk()._applyEngine.events(opts.operationId, { project });
@@ -1916,9 +1916,9 @@ async function verifyCmd(args) {
     ? 60
     : parsePositiveInt(parsed.flags["--timeout"], "--timeout");
 
-  // A delegate holds `deploy` and the gateway accepts it on this route; refusing
+  // A grant key holds `deploy` and the gateway accepts it on this route; refusing
   // locally would tell a wallet-less holder to run `run402 init` (see 4.11.2).
-  if (!delegateTokenFromEnv()) walletAuthHeaders("/apply/v1/operations");
+  if (!grantKeyFromEnv()) walletAuthHeaders("/apply/v1/operations");
 
   try {
     let result;

package/lib/doctor.mjs

@@ -13,9 +13,9 @@ import { resolveApplicationScope, loadApplicationScanInput, scanDeploymentSource
  */
 
 import { existsSync, statSync } from "node:fs";
-import { GITVAULT_BYO_NO_PAYLOAD_COPY_STATEMENT } from "#sdk";
+import { VAULT_BYO_NO_PAYLOAD_COPY_STATEMENT } from "#sdk";
 import { configDir, readWallet, loadKeyStore } from "./config.mjs";
-import { resolveGitvaultTarget } from "./gitvault-target.mjs";
+import { resolveVaultTarget } from "./vault-target.mjs";
 import { getSdk } from "./sdk.mjs";
 import {
   resolveScanRoot,
@@ -54,7 +54,7 @@ const DOCTOR_CHECK_NAMES = [
   "account_health",
   "runtime_staleness",
   "recovery_posture",
-  "gitvault",
+  "vault",
   "source_scan",
 ];
 
@@ -91,7 +91,7 @@ Output:
               api_reachable error, tier inactive / frozen / past_due /
               dormant / missing / error, error-severity source_scan findings
     advisory  a warning that never stops a deploy: account_health,
-              recovery_posture, gitvault, runtime_staleness, cli_update gaps
+              recovery_posture, vault, runtime_staleness, cli_update gaps
     info      ok / skipped / unknown
   Agents: branch on \`ok\`; read \`warnings[]\` (one entry per gap) for the
   non-blocking gaps and \`blocking[]\` for what to fix when \`ok\` is false.
@@ -117,16 +117,16 @@ Options:
   --dir D        Select the application directory for deployment diagnostics.
   --manifest P   Explicitly select a manifest (executable configs are trusted code).
   --scan-dir D   Advanced arbitrary scan; does not claim deployment readiness
-  --project <project_id> Target THIS project's gitvault check instead of the repo-standing
+  --project <project_id> Target THIS project's vault check instead of the repo-standing
                  default (the 4.38.0 pin / run402 remote / RUN402_PROJECT_ID / active
-                 project, in that order — see \`gitvault-target.mjs\`). Scoped to the
-                 gitvault check only; every other check is wallet/machine-wide, not
+                 project, in that order — see \`vault-target.mjs\`). Scoped to the
+                 vault check only; every other check is wallet/machine-wide, not
                  per-project, and is unaffected by this flag. Composes with --only.
   --only <check> Run ONLY the named check (repeatable — pass it more than once
                  to run several). Every other check, INCLUDING the monorepo
                  source-tree scan, is suppressed rather than merely hidden: a
                  skipped check's network/filesystem work never runs at all, so
-                 \`doctor --only gitvault\` costs one gitvault read, not a
+                 \`doctor --only vault\` costs one vault read, not a
                  config/tier/account/scan sweep. An unknown check name is
                  BAD_USAGE listing the valid names below. Not used with --buzz
                  (buzz mode is its own separate, always-complete check set).
@@ -164,7 +164,7 @@ Checks performed:
     the org's disaster backstops if the agent machine dies. Evidence
     levels: "configured" is what the platform verified, never proof an
     off-platform passkey or saved code still exists.
-  - gitvault: the active project's vault — activation policy, whether THIS
+  - vault: the active project's vault — activation policy, whether THIS
     machine can produce the capture a 'required' policy demands, open
     unvaulted-override journals, and where the keystore lives (back it up:
     whole-keystore loss is terminal for vault history)
@@ -310,7 +310,7 @@ export async function run(sub, args = []) {
   const skipScan = all.includes("--no-scan");
   const scanDirArgIdx = all.indexOf("--scan-dir");
   const scanDirOverride = scanDirArgIdx >= 0 ? all[scanDirArgIdx + 1] : null;
-  // Scoped to the gitvault check (see HELP): every other check is
+  // Scoped to the vault check (see HELP): every other check is
   // wallet/machine-wide, not per-project.
   const projectOverride = flagValue(all, "--project");
 
@@ -650,7 +650,7 @@ export async function run(sub, args = []) {
       }
     }
 
-    // 6c. Org recovery posture (gitvault-recovery-custody). One entry per
+    // 6c. Org recovery posture (vault-recovery-custody). One entry per
     // vault-owning org the caller can see; rides the same account-status
     // read. Evidence levels, not guarantees: "configured" names what the
     // platform VERIFIED — it can never observe whether an off-platform
@@ -661,11 +661,11 @@ export async function run(sub, args = []) {
     if (wanted("recovery_posture")) {
       const posture = status.recovery_posture;
       if (!Array.isArray(posture)) {
-        // Gateway older than gitvault-recovery-custody doesn't surface it.
+        // Gateway older than vault-recovery-custody doesn't surface it.
         checks.push({
           name: "recovery_posture",
           status: "skipped",
-          ...(verbose && { hint: "account status has no 'recovery_posture' block; requires a gitvault-recovery-custody gateway." }),
+          ...(verbose && { hint: "account status has no 'recovery_posture' block; requires a vault-recovery-custody gateway." }),
         });
       } else if (posture.length === 0) {
         // No vault-owning org in the caller's view — nothing to lose, nothing to advise.
@@ -718,15 +718,15 @@ export async function run(sub, args = []) {
     });
   }
 
-  // 6c. gitvault (add-gitvault). Doctor was completely silent about the vault
-  // even when `gitvault_policy: required` was the single thing that would break
+  // 6c. vault (add-vault). Doctor was completely silent about the vault
+  // even when `vault_policy: required` was the single thing that would break
   // the project's next deploy (dogfood #1, finding D1) — and doctor is where a
   // user looks when something is wrong. It also prints WHERE the keystore is:
   // "whole-keystore loss is terminal" was stated three times across this
   // surface while the directory to back up was stated nowhere (finding D2).
   //
   // Read-only and best-effort in every branch: no project, no vault, or a
-  // gateway that does not know gitvault are all ordinary and report `skipped`
+  // gateway that does not know vault are all ordinary and report `skipped`
   // or `ok`, never a doctor failure. A vault-only project that has never
   // deployed is a first-class shape (protocol D183), so its mere absence of a
   // deploy raises nothing.
@@ -734,12 +734,12 @@ export async function run(sub, args = []) {
   // TARGETING: when cwd is a repository
   // with its own pinned repo id or run402/origin remote, doctor checks THAT
   // vault, not the profile's active project — the same pin > remote >
-  // RUN402_PROJECT_ID env > active-project order every other gitvault verb
-  // follows (`gitvault-target.mjs`). An explicit `--project <project_id>` outranks
-  // all of that (the resolver's own top tier), same as every other gitvault
+  // RUN402_PROJECT_ID env > active-project order every other vault verb
+  // follows (`vault-target.mjs`). An explicit `--project <project_id>` outranks
+  // all of that (the resolver's own top tier), same as every other vault
   // verb's `--project`.
-  if (wanted("gitvault")) {
-    // gitvault-persistent-helper: a bounded LOCAL probe of the resident
+  if (wanted("vault")) {
+    // vault-persistent-helper: a bounded LOCAL probe of the resident
     // helper engine — {running:false} is a fine answer, never a finding
     // (the daemon is an accelerator, not a dependency).
     const daemonInfo = await (async () => {
@@ -783,18 +783,18 @@ export async function run(sub, args = []) {
         return { running: false };
       }
     })();
-    const target = await resolveGitvaultTarget({ repoDir: process.cwd(), explicitProjectId: projectOverride ?? undefined });
+    const target = await resolveVaultTarget({ repoDir: process.cwd(), explicitProjectId: projectOverride ?? undefined });
     const projectId = target.project_id ?? null;
     const repoId = target.repo_id ?? null;
     if (!projectId && !repoId) {
       checks.push({
-        name: "gitvault",
+        name: "vault",
         status: "skipped",
         ...(verbose && { hint: "no active project — run 'run402 projects use <project_id>' to check its vault." }),
       });
     } else {
       try {
-        const gv = await getSdk().gitvault.status({
+        const gv = await getSdk().repos.status({
           ...(repoId ? { repo_id: repoId } : { project_id: projectId }),
           repo_dir: process.cwd(),
         });
@@ -802,11 +802,11 @@ export async function run(sub, args = []) {
           project_id: gv.project_id ?? projectId,
           repo_id: gv.repo_id,
           vault: gv.vault === null ? null : "allocated",
-          // gitvault-byo-primary-bucket task 3.5 — absent-or-"managed" is
+          // vault-byo-primary-bucket task 3.5 — absent-or-"managed" is
           // byte-identical to before this fold for every non-BYO vault.
           storage_profile: gv.vault?.storage_profile ?? null,
           byo_destination: gv.vault?.byo_destination ?? null,
-          gitvault_policy: gv.gitvault_policy,
+          vault_policy: gv.vault_policy,
           keystore_root: gv.keystore.root,
           can_sign: gv.keystore.can_sign,
           holds_repo_key: gv.keystore.holds_repo_key,
@@ -819,7 +819,7 @@ export async function run(sub, args = []) {
           // to the durability sentence instead of the terminal-loss claim.
           covering_recipients: gv.covering_recipients ?? null,
           daemon: daemonInfo,
-          // gitvault-multi-writer (rev 47) task 6.2 — this machine's own
+          // vault-multi-writer (rev 47) task 6.2 — this machine's own
           // standing on the vault's chain-verified writer set. `null` only
           // when there is no vault at all (nothing to be a writer OF).
           // `read_only_vault` takes priority over the caller's own standing
@@ -839,22 +839,22 @@ export async function run(sub, args = []) {
         if (value.writer === "read_only_vault") {
           gaps.push("this vault has lost its last writer (D228 read-only terminal) — it still serves reads, but no push can be admitted until a new writer is admitted through a recovery path");
         } else if (value.writer === "pending") {
-          gaps.push("this machine's key is an eligible writer candidate but not yet admitted — run 'run402 repos access sync' if you already hold writer standing on this vault, or ask a current writer to run any gitvault operation");
+          gaps.push("this machine's key is an eligible writer candidate but not yet admitted — run 'run402 repos access sync' if you already hold writer standing on this vault, or ask a current writer to run any vault operation");
         } else if (value.writer === "not_admitted") {
-          gaps.push("this machine's key is not an active writer on this vault — a push from here is refused GITVAULT_WRITER_NOT_ADMITTED; ask a current writer to admit you (org membership at role developer+ and a published signing key make you eligible)");
+          gaps.push("this machine's key is not an active writer on this vault — a push from here is refused VAULT_WRITER_NOT_ADMITTED; ask a current writer to admit you (org membership at role developer+ and a published signing key make you eligible)");
         }
         // The one that actually breaks the next deploy: the project demands a
         // vaulted capture and THIS machine cannot produce one.
-        if (gv.gitvault_policy === "required" && !gv.keystore.holds_repo_key) {
+        if (gv.vault_policy === "required" && !gv.keystore.holds_repo_key) {
           gaps.push(
-            "gitvault_policy is 'required' but this machine holds no key for the vault — a deploy from here is refused with GITVAULT_CLIENT_UPGRADE_REQUIRED. " +
+            "vault_policy is 'required' but this machine holds no key for the vault — a deploy from here is refused with VAULT_CLIENT_UPGRADE_REQUIRED. " +
             "Run 'run402 repos create --project <project_id>' (idempotent; resolves to the existing repo), or 'run402 repos policy grandfathered --reason <why>' to un-gate the project.",
           );
-        } else if (gv.gitvault_policy === "required" && !gv.keystore.can_sign) {
-          gaps.push("gitvault_policy is 'required' and this keystore is read-only (no signing key) — it can verify but cannot publish the capture a deploy needs");
+        } else if (gv.vault_policy === "required" && !gv.keystore.can_sign) {
+          gaps.push("vault_policy is 'required' and this keystore is read-only (no signing key) — it can verify but cannot publish the capture a deploy needs");
         }
         if (gv.pending_overrides > 0) {
-          gaps.push(`${gv.pending_overrides} unvaulted-override journal(s) are still open — run 'run402 repos snapshot' to drain them`);
+          gaps.push(`${gv.pending_overrides} unvaulted-override journal(s) are still open — run 'run402 repos capture' to drain them`);
         }
         // `matches` is a TRI-STATE: `false` alone is
         // a real mismatch. `null` (a slug-form remote not yet resolved on
@@ -863,20 +863,11 @@ export async function run(sub, args = []) {
         if (gv.remote && gv.remote.matches === false) {
           gaps.push(`the '${gv.remote.name}' git remote points at a different project than ${value.project_id} (${gv.remote.url})`);
         }
-        // A `kygit::` remote with no
-        // `git-remote-kygit` helper on PATH means every push/clone/fetch
-        // in this checkout fails inside git with an opaque error.
-        if (gv.remote?.url?.startsWith("kygit::")) {
-          const { isExecutableOnPath } = await import("./path-lookup.mjs");
-          if (!isExecutableOnPath("git-remote-kygit")) {
-            gaps.push("this checkout's remote is kygit:: but git-remote-kygit is not on PATH — run `npm i -g @kychee/kygit`");
-          }
-        }
         // Echoed exactly as the SDK reported them — including the
         // doctor-persistent `grandfathered` advisory it owns.
         for (const w of gv.warnings ?? []) gaps.push(`${w.kind}: ${w.message}`);
 
-        // gitvault-mirror-and-recover task 4.3 + gitvault-mirror-default:
+        // vault-mirror-and-recover task 4.3 + vault-mirror-default:
         // mirror currency, reported ALONGSIDE (never in place of) the
         // deploy-related gaps above, and never blocking `run402 deploy`'s
         // own gate — the vault lane's outcome is unaffected regardless of
@@ -885,14 +876,14 @@ export async function run(sub, args = []) {
         // unreachable or vault unread). Only STALE is actionable enough to
         // become a warning gap; a vault with no successful mirror copy yet
         // carries the SDK-computed `vault_unmirrored` finding — named and
-        // standing (gitvault-mirror-default supersedes the old anonymous
+        // standing (vault-mirror-default supersedes the old anonymous
         // `advisory` string), echoed verbatim, and deliberately NOT pushed
         // into `gaps`: informational, never blocking, computed client-side
         // only, cleared by the first successful mirror write or sync.
         if (gv.vault !== null && value.repo_id) {
           try {
-            const mirrorStatus = await getSdk().gitvault.mirrorStatus({ repo_id: value.repo_id, is_byo: value.storage_profile === "byo" });
-            value.gitvault_mirror = {
+            const mirrorStatus = await getSdk().repos.mirrorStatus({ repo_id: value.repo_id, is_byo: value.storage_profile === "byo" });
+            value.vault_mirror = {
               configured: mirrorStatus.configured,
               destination: mirrorStatus.destination,
               mirrored_generation: mirrorStatus.mirrored_generation,
@@ -912,12 +903,12 @@ export async function run(sub, args = []) {
           }
         }
 
-        // gitvault-byo-primary-bucket task 3.5 — unconditional, independent
+        // vault-byo-primary-bucket task 3.5 — unconditional, independent
         // of mirror status (D7); imported from the canonical constants, never
         // paraphrased.
-        const byoDisclosure = value.storage_profile === "byo" ? ` Storage: byo (${value.byo_destination ?? "(unknown)"}) — ${GITVAULT_BYO_NO_PAYLOAD_COPY_STATEMENT}` : "";
+        const byoDisclosure = value.storage_profile === "byo" ? ` Storage: byo (${value.byo_destination ?? "(unknown)"}) — ${VAULT_BYO_NO_PAYLOAD_COPY_STATEMENT}` : "";
         checks.push({
-          name: "gitvault",
+          name: "vault",
           status: gaps.length > 0 ? "warning" : "ok",
           value: gaps.length > 0 ? { ...value, gaps } : value,
           hint: (gv.vault === null
@@ -927,12 +918,12 @@ export async function run(sub, args = []) {
               : `Back up ${gv.keystore.root} — whole-machine or whole-keystore loss is terminal for vault history.`) + byoDisclosure,
         });
       } catch (err) {
-        // A gateway without gitvault, an unreachable API, or a project this
+        // A gateway without vault, an unreachable API, or a project this
         // wallet cannot see. None of those is a local health problem.
         checks.push({
-          name: "gitvault",
+          name: "vault",
           status: "skipped",
-          message: describeCheckFailure("gitvault status check", err),
+          message: describeCheckFailure("vault status check", err),
         });
       }
     }
@@ -944,7 +935,7 @@ export async function run(sub, args = []) {
   // `error` block deploy (`run402 deploy` wraps doctor and respects exit
   // code). Skipped via --no-scan when the user wants config-only checks, and
   // by any --only that omits it — on a monorepo this check's findings can
-  // otherwise bury the gitvault diagnosis under thousands of hits.
+  // otherwise bury the vault diagnosis under thousands of hits.
   if (!skipScan && wanted("source_scan")) {
     try {
       const scope = await resolveApplicationScope({ dir: flagValue(all, "--dir") ?? undefined, manifest: flagValue(all, "--manifest") ?? undefined });

package/lib/errors.mjs

@@ -110,7 +110,7 @@ Exit codes (the promote gate — only when --fail-on-new is set):
 
 Auth:
   The addressed project's own service_key when it is cached locally; otherwise
-  your wallet / session / delegate, which the gateway authorizes with
+  your wallet / session / grant key, which the gateway authorizes with
   project.read — an org member or teammate agent needs no project key. A key
   for project A requesting project B's errors gets 403 (never a 404 that
   leaks existence). Read-only; never lifecycle-gated.

package/lib/events.mjs

@@ -95,7 +95,7 @@ Event shape:
 
 Auth:
   --project: the project's own service_key, your SIWX wallet, a control-plane
-             session, or a scoped delegate with project.read.
+             session, or a grant key with project.read.
   --org:     wallet / control-plane session with an active org membership
              (a project service_key cannot read sibling projects' events).
   The feed is read-only and never lifecycle-gated: a frozen project's feed