youmd 0.8.7 → 0.8.13

package/scripts/skillstack-sync/README.md

@@ -28,8 +28,8 @@ Cross-machine sync toolkit for Houston Golden's agent skill/stack setup.
 
 ### Complementary sync planes
 
-- **Realtime identity/project plane:** `youmd sync --live --daemon` subscribes to Convex websocket updates, mints only a short-lived sync session token, materializes identity files and installed You.md skills locally, and triggers bounded shared stack/project-context syncs. It never prints or returns raw `.env.local` values.
-- **Identity repair plane:** `youmd sync --daemon` (Convex ↔ local profile, memories, preferences). Automated via `com.youmd.identity-sync` daemon as a timer-based fallback. Daemon mode refreshes local files/skills and skips unsafe lossy pushes instead of forcing over richer server data.
+- **Realtime identity/project/Skill Mesh plane:** `youmd sync --live --daemon` subscribes to Convex websocket updates, mints only a short-lived sync session token, materializes identity files and installed You.md skills locally, and triggers bounded shared stack/project-context plus safe agent-stack inventory syncs. It never prints or returns raw `.env.local` values.
+- **Identity repair plane:** `youmd sync --daemon` (Convex ↔ local profile, memories, preferences). Automated via `com.you.identity-sync` daemon as a timer-based fallback. Daemon mode refreshes local files/skills and skips unsafe lossy pushes instead of forcing over richer server data.
 - **Project-context plane:** `youmd stack context-sync` safely commits and syncs only `AGENTS.md`, `CLAUDE.md`, `project-context/`, and `.claude/` in curated Houston-owned repos. It refuses to merge remote app-code changes.
 - **Env-vault plane:** `cli/scripts/env-vault/restore.sh` for secrets (manual, invoked on new machine); also available as `youmd env restore <vault>`.
 
@@ -42,10 +42,10 @@ cli/scripts/skillstack-sync/
 ├── sync.sh                         Core syncer (bash 3.2 compatible)
 ├── install-daemons.sh              Installs all resident LaunchAgents
 ├── bootstrap-new-mac.sh            New machine setup script
-├── com.youmd.realtime-sync.plist   LaunchAgent: runs `youmd sync --live --daemon` as a resident websocket syncer
-├── com.youmd.skillstack-sync.plist LaunchAgent: runs `youmd stack sync` every 5 min
-├── com.youmd.identity-sync.plist   LaunchAgent: runs `youmd sync --daemon` every 5 min
-├── com.youmd.context-sync.plist    LaunchAgent: runs `youmd stack context-sync` every 15 min
+├── com.you.realtime-sync.plist     LaunchAgent: runs `youmd sync --live --daemon` as a resident websocket + Skill Mesh syncer
+├── com.you.skillstack-sync.plist   LaunchAgent: runs `youmd stack sync` every 5 min
+├── com.you.identity-sync.plist     LaunchAgent: runs `youmd sync --daemon` every 5 min
+├── com.you.context-sync.plist      LaunchAgent: runs `youmd stack context-sync` every 15 min
 └── README.md                       This file
 ```
 
@@ -66,7 +66,7 @@ cli/scripts/skillstack-sync/
      → skips if no changes detected
 ```
 
-All actions logged to `~/.youmd/logs/skillstack-sync.log`.
+All actions logged to `~/.you/logs/skillstack-sync.log`, with legacy `~/.youmd` logs still readable during migration.
 
 ### Flags
 
@@ -106,27 +106,35 @@ bash cli/scripts/skillstack-sync/install-daemons.sh
 ```
 
 Installs four LaunchAgents:
-- `com.youmd.realtime-sync` → runs `youmd sync --live --daemon`
-- `com.youmd.skillstack-sync` → runs `youmd stack sync`
-- `com.youmd.identity-sync` → runs `youmd sync --daemon`
-- `com.youmd.context-sync` → runs `youmd stack context-sync`
+- `com.you.realtime-sync` → runs `youmd sync --live --daemon`, including a bounded `youmd skill inventory --sync` pass every 30 minutes by default
+- `com.you.skillstack-sync` → runs `youmd stack sync`
+- `com.you.identity-sync` → runs `youmd sync --daemon`
+- `com.you.context-sync` → runs `youmd stack context-sync`
+
+Skill Mesh inventory knobs:
+
+```bash
+YOUMD_LIVE_SYNC_INVENTORY=0                    # disable resident inventory sync
+YOUMD_LIVE_SYNC_INVENTORY_INTERVAL_SECONDS=900 # tune cadence; default 1800
+YOU_AGENT_STACK_INVENTORY_DIR=~/.you/agent-stack-inventory
+```
 
 Check status:
 ```bash
 youmd stack daemon status
 # or directly:
-launchctl list com.youmd.skillstack-sync
-launchctl list com.youmd.realtime-sync
-launchctl list com.youmd.identity-sync
-launchctl list com.youmd.context-sync
+launchctl list com.you.skillstack-sync
+launchctl list com.you.realtime-sync
+launchctl list com.you.identity-sync
+launchctl list com.you.context-sync
 ```
 
 Check logs:
 ```bash
-tail -f ~/.youmd/logs/skillstack-sync.log
-tail -f ~/.youmd/logs/skillstack-sync.out.log
-tail -f ~/.youmd/logs/identity-sync.out.log
-tail -f ~/.youmd/logs/context-sync.log
+tail -f ~/.you/logs/skillstack-sync.log
+tail -f ~/.you/logs/skillstack-sync.out.log
+tail -f ~/.you/logs/identity-sync.out.log
+tail -f ~/.you/logs/context-sync.log
 ```
 
 ### Uninstall daemons
@@ -137,12 +145,12 @@ youmd stack daemon uninstall
 
 Or manually:
 ```bash
-launchctl unload ~/Library/LaunchAgents/com.youmd.skillstack-sync.plist
-launchctl unload ~/Library/LaunchAgents/com.youmd.identity-sync.plist
-launchctl unload ~/Library/LaunchAgents/com.youmd.context-sync.plist
-rm ~/Library/LaunchAgents/com.youmd.skillstack-sync.plist
-rm ~/Library/LaunchAgents/com.youmd.identity-sync.plist
-rm ~/Library/LaunchAgents/com.youmd.context-sync.plist
+launchctl unload ~/Library/LaunchAgents/com.you.skillstack-sync.plist
+launchctl unload ~/Library/LaunchAgents/com.you.identity-sync.plist
+launchctl unload ~/Library/LaunchAgents/com.you.context-sync.plist
+rm ~/Library/LaunchAgents/com.you.skillstack-sync.plist
+rm ~/Library/LaunchAgents/com.you.identity-sync.plist
+rm ~/Library/LaunchAgents/com.you.context-sync.plist
 ```
 
 ---

package/scripts/skillstack-sync/bootstrap-new-mac.sh

@@ -10,7 +10,7 @@
 # Usage: bash bootstrap-new-mac.sh
 
 set -euo pipefail
-export PATH="${HOME}/.youmd/bin:${HOME}/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:${PATH}"
+export PATH="${HOME}/.you/bin:${HOME}/.you/npm-global/bin:${HOME}/.youmd/bin:${HOME}/.youmd/npm-global/bin:/opt/homebrew/opt/node@22/bin:/usr/local/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:${PATH}"
 
 AGENT_SHARED="${HOME}/.agent-shared"
 SCISTACK="${HOME}/.claude/scistack"

package/scripts/skillstack-sync/capture-agent-config.sh

@@ -19,7 +19,7 @@ set -euo pipefail
 
 AGENT_SHARED="${HOME}/.agent-shared"
 DEST="${AGENT_SHARED}/agent-config"
-LOG_DIR="${HOME}/.youmd/logs"
+LOG_DIR="${YOU_HOME:-${YOUMD_HOME:-${HOME}/.you}}/logs"
 LOG_FILE="${LOG_DIR}/capture-agent-config.log"
 
 DRY_RUN=0
@@ -83,9 +83,16 @@ capture_plist() {
   sed "s|${HOME}|__HOME__|g" "${src}" > "${target}"
   log "captured plist ${label} → agent-config/automations/launchd/${label}.plist"
 }
+capture_plist "com.you.skillstack-sync"
+capture_plist "com.you.identity-sync"
+capture_plist "com.you.context-sync"
+capture_plist "com.you.realtime-sync"
+# Legacy labels are captured only if present so restore audits can identify
+# old hosts, but `youmd stack daemon install` replaces them with com.you.*.
 capture_plist "com.youmd.skillstack-sync"
 capture_plist "com.youmd.identity-sync"
 capture_plist "com.youmd.context-sync"
+capture_plist "com.youmd.realtime-sync"
 capture_plist "com.houstongolden.agent-runtime-guard"
 
 if ! is_dry; then

package/scripts/skillstack-sync/{com.youmd.context-sync.plist → com.you.context-sync.plist}

@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
     <key>Label</key>
-    <string>com.youmd.context-sync</string>
+    <string>com.you.context-sync</string>
 
     <key>ProgramArguments</key>
     <array>
@@ -22,10 +22,10 @@
     <false/>
 
     <key>StandardOutPath</key>
-    <string>__HOME__/.youmd/logs/context-sync.out.log</string>
+    <string>__HOME__/.you/logs/context-sync.out.log</string>
 
     <key>StandardErrorPath</key>
-    <string>__HOME__/.youmd/logs/context-sync.err.log</string>
+    <string>__HOME__/.you/logs/context-sync.err.log</string>
 
     <key>EnvironmentVariables</key>
     <dict>

package/scripts/skillstack-sync/{com.youmd.identity-sync.plist → com.you.identity-sync.plist}

@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
     <key>Label</key>
-    <string>com.youmd.identity-sync</string>
+    <string>com.you.identity-sync</string>
 
     <key>ProgramArguments</key>
     <array>
@@ -22,10 +22,10 @@
     <false/>
 
     <key>StandardOutPath</key>
-    <string>__HOME__/.youmd/logs/identity-sync.out.log</string>
+    <string>__HOME__/.you/logs/identity-sync.out.log</string>
 
     <key>StandardErrorPath</key>
-    <string>__HOME__/.youmd/logs/identity-sync.err.log</string>
+    <string>__HOME__/.you/logs/identity-sync.err.log</string>
 
     <key>EnvironmentVariables</key>
     <dict>

package/scripts/skillstack-sync/{com.youmd.realtime-sync.plist → com.you.realtime-sync.plist}

@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
     <key>Label</key>
-    <string>com.youmd.realtime-sync</string>
+    <string>com.you.realtime-sync</string>
 
     <key>ProgramArguments</key>
     <array>
@@ -19,10 +19,10 @@
     <true/>
 
     <key>StandardOutPath</key>
-    <string>__HOME__/.youmd/logs/realtime-sync.out.log</string>
+    <string>__HOME__/.you/logs/realtime-sync.out.log</string>
 
     <key>StandardErrorPath</key>
-    <string>__HOME__/.youmd/logs/realtime-sync.err.log</string>
+    <string>__HOME__/.you/logs/realtime-sync.err.log</string>
 
     <key>EnvironmentVariables</key>
     <dict>

package/scripts/skillstack-sync/{com.youmd.skillstack-sync.plist → com.you.skillstack-sync.plist}

@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
     <key>Label</key>
-    <string>com.youmd.skillstack-sync</string>
+    <string>com.you.skillstack-sync</string>
 
     <key>ProgramArguments</key>
     <array>
@@ -22,10 +22,10 @@
     <false/>
 
     <key>StandardOutPath</key>
-    <string>__HOME__/.youmd/logs/skillstack-sync.out.log</string>
+    <string>__HOME__/.you/logs/skillstack-sync.out.log</string>
 
     <key>StandardErrorPath</key>
-    <string>__HOME__/.youmd/logs/skillstack-sync.err.log</string>
+    <string>__HOME__/.you/logs/skillstack-sync.err.log</string>
 
     <key>EnvironmentVariables</key>
     <dict>

package/scripts/skillstack-sync/context-sync.sh

@@ -44,7 +44,7 @@ set -euo pipefail
 # Config
 # ---------------------------------------------------------------------------
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-LOG_DIR="${HOME}/.youmd/logs"
+LOG_DIR="${YOU_HOME:-${YOUMD_HOME:-${HOME}/.you}}/logs"
 LOG_FILE="${LOG_DIR}/context-sync.log"
 
 GIT_USER_NAME="${GIT_USER_NAME:-Houston Golden}"

package/scripts/skillstack-sync/install-daemons.sh

@@ -10,9 +10,10 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 LAUNCH_AGENTS_DIR="${HOME}/Library/LaunchAgents"
-LOG_DIR="${HOME}/.youmd/logs"
+LOG_DIR="${YOU_HOME:-${YOUMD_HOME:-${HOME}/.you}}/logs"
 
-PLISTS="com.youmd.realtime-sync com.youmd.skillstack-sync com.youmd.identity-sync com.youmd.context-sync"
+PLISTS="com.you.realtime-sync com.you.skillstack-sync com.you.identity-sync com.you.context-sync"
+LEGACY_PLISTS="com.youmd.realtime-sync com.youmd.skillstack-sync com.youmd.identity-sync com.youmd.context-sync"
 
 echo "==> Creating log directory: ${LOG_DIR}"
 mkdir -p "${LOG_DIR}"
@@ -20,6 +21,19 @@ mkdir -p "${LOG_DIR}"
 echo "==> Creating LaunchAgents directory: ${LAUNCH_AGENTS_DIR}"
 mkdir -p "${LAUNCH_AGENTS_DIR}"
 
+echo "==> Removing legacy com.youmd LaunchAgents if present"
+for label in ${LEGACY_PLISTS}; do
+  dst="${LAUNCH_AGENTS_DIR}/${label}.plist"
+  if launchctl list "${label}" >/dev/null 2>&1; then
+    echo "  Unloading legacy ${label}..."
+    launchctl unload "${dst}" 2>/dev/null || true
+  fi
+  if [ -f "${dst}" ]; then
+    echo "  Removing legacy ${dst}"
+    rm -f "${dst}"
+  fi
+done
+
 for label in ${PLISTS}; do
   src="${SCRIPT_DIR}/${label}.plist"
   dst="${LAUNCH_AGENTS_DIR}/${label}.plist"
@@ -70,10 +84,10 @@ echo "  ${LOG_DIR}/context-sync.out.log     (daemon stdout)"
 echo "  ${LOG_DIR}/context-sync.err.log     (daemon stderr)"
 echo ""
 echo "Check daemon status:"
-echo "  launchctl list com.youmd.realtime-sync"
-echo "  launchctl list com.youmd.skillstack-sync"
-echo "  launchctl list com.youmd.identity-sync"
-echo "  launchctl list com.youmd.context-sync"
+echo "  launchctl list com.you.realtime-sync"
+echo "  launchctl list com.you.skillstack-sync"
+echo "  launchctl list com.you.identity-sync"
+echo "  launchctl list com.you.context-sync"
 echo ""
 echo "To uninstall:"
 for label in ${PLISTS}; do

package/scripts/skillstack-sync/restore-agent-config.sh

@@ -25,7 +25,7 @@ set -euo pipefail
 
 AGENT_SHARED="${HOME}/.agent-shared"
 SRC="${AGENT_SHARED}/agent-config"
-LOG_DIR="${HOME}/.youmd/logs"
+LOG_DIR="${YOU_HOME:-${YOUMD_HOME:-${HOME}/.you}}/logs"
 LOG_FILE="${LOG_DIR}/restore-agent-config.log"
 
 DRY_RUN=0

package/scripts/skillstack-sync/sync.sh

@@ -17,7 +17,7 @@ set -euo pipefail
 # Config
 # ---------------------------------------------------------------------------
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-LOG_DIR="${HOME}/.youmd/logs"
+LOG_DIR="${YOU_HOME:-${YOUMD_HOME:-${HOME}/.you}}/logs"
 LOG_FILE="${LOG_DIR}/skillstack-sync.log"
 
 GIT_USER_NAME="${GIT_USER_NAME:-Houston Golden}"

package/skills/machine-bootstrap.md

@@ -26,7 +26,7 @@ You.md is the brain. The new machine should become a runnable local agent workst
 ## Default Flow
 
 1. Confirm whether this looks like a fresh machine:
-   - `youmd status`
+   - `you status`
    - `test -d ~/Desktop/CODE_YOU && find ~/Desktop/CODE_YOU -maxdepth 1 -type d | wc -l`
    - `git config user.name && git config user.email`
    - `gh auth status`
@@ -34,16 +34,17 @@ You.md is the brain. The new machine should become a runnable local agent workst
    for Claude Code or Codex on the new machine, generate it first:
 
    ```bash
-   youmd machine prompt --root ~/Desktop/CODE_YOU --days 30 --limit 80 --require-env-vault
+   you machine prompt --root ~/Desktop/CODE_YOU --days 30 --limit 80 --require-env-vault
    ```
 
    If the web dashboard minted a scoped bootstrap key, the generated prompt may
-   include `YOUMD_API_KEY`. Treat that prompt as secret-bearing local setup
+   include `YOU_API_KEY` (legacy `YOUMD_API_KEY` still works). Treat that prompt as secret-bearing local setup
    material and do not paste it into public chats, tickets, or docs.
    Fresh-machine bootstrap keys must include the `vault` scope so the trusted
    device can pull encrypted Secret Vault snapshots after login.
    For bounded proof runs on a clean local root, add
-   `--max-clone-projects 2` or set `YOUMD_MAX_CLONE_PROJECTS=2`; omit that cap
+   `--max-clone-projects 2` or set `YOU_MAX_CLONE_PROJECTS=2`; legacy
+   `YOUMD_MAX_CLONE_PROJECTS=2` still works. Omit that cap
    on the real new machine.
 
 3. If You.md is not installed on the new machine, install it:
@@ -55,19 +56,19 @@ You.md is the brain. The new machine should become a runnable local agent workst
 4. Authenticate and hydrate the local brain:
 
    ```bash
-   youmd login --key "$YOUMD_API_KEY"  # or: youmd login
-   youmd pull
-   youmd sync
+   you login --key "$YOU_API_KEY"  # or: you login
+   you pull
+   you sync
    ```
 
 5. Restore shared agent skills, stack config, and host adapters:
 
    ```bash
-   youmd machine setup
-   youmd skill install all
-   youmd skill sync
-   youmd skill link codex
-   youmd skill link claude
+   you machine setup
+   you skill install all
+   you skill sync
+   you skill link codex
+   you skill link claude
    ```
 
 6. Hydrate the portfolio graph from You.md/GitHub records before cloning, then
@@ -75,18 +76,18 @@ You.md is the brain. The new machine should become a runnable local agent workst
    and syncing truly active 30-day projects first:
 
    ```bash
-   youmd project portfolio-hydrate --root ~/Desktop/CODE_YOU --days 30 --limit 80
-   youmd machine projects --root ~/Desktop/CODE_YOU --days 30 --recent-only --dry-run
-   youmd machine projects --root ~/Desktop/CODE_YOU --days 30 --recent-only
+   you project portfolio-hydrate --root ~/Desktop/CODE_YOU --days 30 --limit 80
+   you machine projects --root ~/Desktop/CODE_YOU --days 30 --recent-only --dry-run
+   you machine projects --root ~/Desktop/CODE_YOU --days 30 --recent-only
    ```
 
 7. Ask whether Houston wants to expand the workspace to all active projects
    from the last 90 days before calling the full project clone set complete:
 
    ```bash
-   youmd project portfolio-hydrate --root ~/Desktop/CODE_YOU --days 90 --limit 80
-   youmd machine projects --root ~/Desktop/CODE_YOU --days 90 --recent-only --dry-run
-   youmd machine projects --root ~/Desktop/CODE_YOU --days 90 --recent-only
+   you project portfolio-hydrate --root ~/Desktop/CODE_YOU --days 90 --limit 80
+   you machine projects --root ~/Desktop/CODE_YOU --days 90 --recent-only --dry-run
+   you machine projects --root ~/Desktop/CODE_YOU --days 90 --recent-only
    ```
 
 8. If GitHub auth is missing, help the user log in and rerun only the project
@@ -94,7 +95,7 @@ You.md is the brain. The new machine should become a runnable local agent workst
 
    ```bash
    gh auth login
-   youmd machine projects --root ~/Desktop/CODE_YOU --days 30 --recent-only
+   you machine projects --root ~/Desktop/CODE_YOU --days 30 --recent-only
    ```
 
 9. After projects are cloned and any encrypted env vault is restored, hydrate the
@@ -102,19 +103,20 @@ You.md is the brain. The new machine should become a runnable local agent workst
    evidence becomes visible to future agents:
 
    ```bash
-   youmd project portfolio-hydrate --root ~/Desktop/CODE_YOU --days 30 --limit 80
+   you project portfolio-hydrate --root ~/Desktop/CODE_YOU --days 30 --limit 80
    ```
 
 10. Run the secret-safe readiness audit and sync the proof summary:
 
    ```bash
-   youmd machine verify --root ~/Desktop/CODE_YOU --max-projects 80 --write-report --sync-report
+   you machine verify --root ~/Desktop/CODE_YOU --max-projects 80 --write-report --sync-report
    ```
 
    This checks cloned directories, git remotes, package managers, standard
    scripts, `.env.local` presence, `.env.example` presence, root agent docs, and
    `project-context/` presence. It writes a secret-safe JSON proof artifact to
-   `~/.youmd/machine-reports/latest.json` and syncs only the compact proof
+   `~/.you/machine-reports/latest.json` with legacy `~/.youmd` fallback during
+   migration, and syncs only the compact proof
    summary to the You.md machine dashboard. It does not read secret values,
    upload raw logs, or launch every dev server.
 
@@ -122,7 +124,7 @@ You.md is the brain. The new machine should become a runnable local agent workst
     enough time/CPU, run bounded package checks and dev-server probes:
 
    ```bash
-   youmd machine verify --root ~/Desktop/CODE_YOU --max-projects 80 --install-deps --run-checks --probe-servers --write-report --sync-report
+   you machine verify --root ~/Desktop/CODE_YOU --max-projects 80 --install-deps --run-checks --probe-servers --write-report --sync-report
    ```
 
    The default check scripts are `typecheck`, `lint`, `test`, and `build`.
@@ -134,11 +136,11 @@ You.md is the brain. The new machine should become a runnable local agent workst
 
 - Use the You.md CLI and You Agent yourself before asking Houston to do manual
   work. Prefer deterministic commands for setup and proof:
-  `youmd status`, `youmd whoami`, `youmd pull`, `youmd sync`,
-  `youmd machine prompt`, `youmd machine setup`,
-  `youmd skill install all`, `youmd skill sync`,
-  `youmd env vault list`, `youmd env vault pull`,
-  `youmd project portfolio-hydrate`, `youmd machine verify`,
+  `you status`, `you whoami`, `you pull`, `you sync`,
+  `you machine prompt`, `you machine setup`,
+  `you skill install all`, `you skill sync`,
+  `you env vault list`, `you env vault pull`,
+  `you project portfolio-hydrate`, `you machine verify`,
   `youmd agent status`, and `youmd agent inbox`.
 - Report setup milestones to Houston's other trusted Macs with the realtime
   agent bus instead of relying on clipboard/manual status relays:
@@ -148,7 +150,7 @@ You.md is the brain. The new machine should become a runnable local agent workst
   ```
 
   This writes through Convex realtime and the receiving daemon materializes it
-  into `~/.youmd/agent-bus/inbox.json` without reading or exposing `.env.local`
+  into `~/.you/agent-bus/inbox.json` without reading or exposing `.env.local`
   values.
 - Use `you` / `youmd chat` when you need the You Agent to synthesize context,
   route a natural-language request, or produce the setup artifact, then turn the
@@ -157,8 +159,8 @@ You.md is the brain. The new machine should become a runnable local agent workst
   command, verify the result, and report concise proof.
 - Interrupt Houston only for true human-gated steps: GitHub browser auth,
   source-Mac Secret Vault share if no trusted-device envelope exists yet, local
-  vault passphrase/Keychain only when `YOUMD_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1`
-  or `YOUMD_ENV_VAULT` is explicitly provided, npm OTP, OS permissions, or the
+  vault passphrase/Keychain only when `YOU_ALLOW_LOCAL_ENV_VAULT_FALLBACK=1`
+  or `YOU_ENV_VAULT` is explicitly provided, npm OTP, OS permissions, or the
   explicit 90-day project expansion choice.
 - If the installed CLI is stale, run the curl installer/update path first, then
   retry the You.md command. Tell Houston when npm publish is needed for
@@ -175,7 +177,7 @@ You.md is the brain. The new machine should become a runnable local agent workst
 - Use the You.md Portfolio Graph as the strategic source of truth, then merge
   authenticated GitHub recent-repo data and local bundle project records so repo
   names and URLs stay cloneable.
-- `youmd machine projects` should fetch the persisted owner graph through the
+- `you machine projects` should fetch the persisted owner graph through the
   You.md API when authenticated. If that graph is unavailable, fall back to the
   local bundle plus authenticated GitHub scan and say so.
 - Clone with `gh repo clone owner/repo <target>` when `gh` is authenticated; otherwise fall back to `git clone`.
@@ -183,7 +185,7 @@ You.md is the brain. The new machine should become a runnable local agent workst
 - Never print secrets. If `.env.local` files are needed, use You.md Secret Vault
   or the shared encrypted env backup/restore path. Never paste raw env values
   into chat.
-- After cloning, initialize missing per-repo agent context with `youmd skill init-project` from inside that repo.
+- After cloning, initialize missing per-repo agent context with `you skill init-project` from inside that repo.
 
 ## Secret-Safe Env Transfer
 
@@ -192,22 +194,22 @@ Audit local project env coverage before backup:
 ```bash
 ~/.agent-shared/bin/env-key-audit.py --root ~/Desktop/CODE_2025
 ~/.agent-shared/bin/env-secure-backup.sh --preflight
-youmd env backup --root ~/Desktop/CODE_2025 --preflight
+you env backup --root ~/Desktop/CODE_2025 --preflight
 ```
 
 Primary path: from the old/source machine, create an encrypted archive and push
 only the ciphertext plus safe manifest metadata to You.md Secret Vault:
 
 ```bash
-youmd env vault push --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault
-youmd env vault list
+you env vault push --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault
+you env vault list
 ```
 
 On the new machine, register its local Secret Vault device key. The private key
-stays under `~/.youmd/secret-vault/devices/`; only the public key is synced:
+stays under `~/.you/secret-vault/devices/`; only the public key is synced:
 
 ```bash
-youmd env vault device-register
+you env vault device-register
 ```
 
 Back on the old/source machine, share local decrypt access to trusted devices.
@@ -215,19 +217,19 @@ This stores per-device encrypted passphrase envelopes; it does not upload raw en
 values:
 
 ```bash
-youmd env vault share
+you env vault share
 ```
 
 On the new machine, pull the latest encrypted account snapshot and restore into
 already-cloned project directories without clobbering local agent auth:
 
 ```bash
-youmd env vault pull --restore --root ~/Desktop/CODE_YOU --map-existing --existing-only --skip-agent-auth
+you env vault pull --restore --root ~/Desktop/CODE_YOU --map-existing --existing-only --skip-agent-auth
 ```
 
 If `pull --restore` says no trusted-device envelope exists for this Mac, do not
 ask Houston for raw secrets. Confirm `device-register` ran on the new Mac, run
-`youmd env vault share` on the source Mac, then rerun `pull --restore`.
+`you env vault share` on the source Mac, then rerun `pull --restore`.
 
 Fallback path: create an encrypted archive from the old machine in an
 interactive macOS terminal and transfer the encrypted file by iCloud, AirDrop,
@@ -235,15 +237,15 @@ USB, or private password-manager attachment:
 
 ```bash
 open ~/.agent-shared/bin/env-backup-interactive.command
-youmd env backup --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault
+you env backup --root ~/Desktop/CODE_2025 --out ~/Desktop/youmd-env-vault
 ```
 
 On the new machine, list the encrypted archive by path only before restore:
 
 ```bash
 ~/.agent-shared/bin/env-secure-restore.sh --archive ~/Desktop/env-local-backup.tar.gz.gpg --list
-youmd env restore ~/Desktop/env-local-backup.tar.gz.gpg --root ~/Desktop/CODE_YOU --list --map-existing --existing-only --skip-agent-auth
-youmd env restore ~/Desktop/env-local-backup.tar.gz.gpg --root ~/Desktop/CODE_YOU --map-existing --existing-only --skip-agent-auth
+you env restore ~/Desktop/env-local-backup.tar.gz.gpg --root ~/Desktop/CODE_YOU --list --map-existing --existing-only --skip-agent-auth
+you env restore ~/Desktop/env-local-backup.tar.gz.gpg --root ~/Desktop/CODE_YOU --map-existing --existing-only --skip-agent-auth
 ```
 
 If a headless agent still cannot decrypt after device sharing, then and only then
@@ -261,55 +263,55 @@ unset PW && echo "stored in Keychain"
 Dry-run the project layout:
 
 ```bash
-youmd machine projects --root ~/Desktop/CODE_YOU --days 30 --recent-only --dry-run
+you machine projects --root ~/Desktop/CODE_YOU --days 30 --recent-only --dry-run
 ```
 
 Create directories only, without cloning:
 
 ```bash
-youmd machine projects --root ~/Desktop/CODE_YOU --no-clone
+you machine projects --root ~/Desktop/CODE_YOU --no-clone
 ```
 
 Audit cloned readiness:
 
 ```bash
-youmd machine verify --root ~/Desktop/CODE_YOU --max-projects 80 --write-report --sync-report
+you machine verify --root ~/Desktop/CODE_YOU --max-projects 80 --write-report --sync-report
 ```
 
 Run bounded package checks:
 
 ```bash
-youmd machine verify --root ~/Desktop/CODE_YOU --run-checks --max-check-projects 8 --check-timeout-ms 120000
+you machine verify --root ~/Desktop/CODE_YOU --run-checks --max-check-projects 8 --check-timeout-ms 120000
 ```
 
 Run clean-host dependency installs and localhost dev-server probes:
 
 ```bash
-youmd machine verify --root ~/Desktop/CODE_YOU --install-deps --probe-servers --write-report --sync-report
+you machine verify --root ~/Desktop/CODE_YOU --install-deps --probe-servers --write-report --sync-report
 ```
 
 Include older projects without prompts:
 
 ```bash
-youmd machine projects --root ~/Desktop/CODE_YOU --yes
+you machine projects --root ~/Desktop/CODE_YOU --yes
 ```
 
 Generate the copy/paste prompt for a new Claude Code or Codex terminal:
 
 ```bash
-youmd machine prompt --root ~/Desktop/CODE_YOU --days 30 --limit 80 --require-env-vault
+you machine prompt --root ~/Desktop/CODE_YOU --days 30 --limit 80 --require-env-vault
 ```
 
 Generate the same prompt but cap clones for a clean-host proof run:
 
 ```bash
-youmd machine prompt --root /tmp/youmd-clean-host-CODE_YOU --days 30 --limit 80 --max-clone-projects 2 --require-env-vault
+you machine prompt --root /tmp/you-clean-host-CODE_YOU --days 30 --limit 80 --max-clone-projects 2 --require-env-vault
 ```
 
 Fetch the secret-safe project graph directly:
 
 ```bash
-curl -H "Authorization: Bearer $YOUMD_API_KEY" https://you.md/api/v1/me/portfolio/graph
+curl -H "Authorization: Bearer $YOU_API_KEY" https://you.md/api/v1/me/portfolio/graph
 ```
 
 ## Done Means
@@ -321,9 +323,9 @@ curl -H "Authorization: Bearer $YOUMD_API_KEY" https://you.md/api/v1/me/portfoli
 - Active GitHub-backed project repos are cloned into matching repo-name directories.
 - The clone plan visibly used the persisted portfolio graph, authenticated
   GitHub recent repos, and local bundle records with source counts.
-- `youmd machine verify` reports git/package/env/agent-doc/project-context
+- `you machine verify` reports git/package/env/agent-doc/project-context
   readiness for the cloned workspace without reading `.env.local` values and
-  writes `~/.youmd/machine-reports/latest.json`.
+  writes `~/.you/machine-reports/latest.json`.
 - `--sync-report` creates or updates an owner-gated You.md machine proof row
   that the dashboard can show across computers.
 - If `--run-checks` was requested, bounded package checks ran with project and