diff --git a/.claude/skills/tanstack-router/SKILL.md b/.claude/skills/tanstack-router/SKILL.md
index 14cf808..6cfd6d0 100644
--- a/.claude/skills/tanstack-router/SKILL.md
+++ b/.claude/skills/tanstack-router/SKILL.md
@@ -49,7 +49,7 @@ conditionally mounted for dev use `env.isDev` from `@/shared/config/env`.
 ## Router config
 
 `apps/web/src/routes/router.tsx` creates the router. It mounts under the proxy sub-path via
-`BASE_PREFIX` (from `@/shared/lib/basePath`) so client routing resolves behind the oasis pod-proxy:
+`BASE_PREFIX` (from `@/shared/lib/basePath`) so client routing resolves behind the tangle pod-proxy:
 
 ```typescript
 export const router = createRouter({
diff --git a/.env.example b/.env.example
index e638718..c35dc51 100644
--- a/.env.example
+++ b/.env.example
@@ -1,17 +1,17 @@
-# Minerva (Shopify SSO) auth config for scripts/minervaAuth.ts.
-# Copy to .env (gitignored) and fill in the internal values.
+# Oktasso SSO auth config for scripts/oktassoAuth.ts.
+# Copy to .env (gitignored) and fill in the provider values.
 
-# Shopify-internal endpoints + SSO client (ask your team / see tangle_deploy).
-MINERVA_OAUTH_ENDPOINT_BASE=
-MINERVA_TOKEN_EXCHANGE_URL=
-MINERVA_CLIENT_ID=
+# Provider endpoints + SSO client for your deployment.
+OKTASSO_OAUTH_ENDPOINT_BASE=
+OKTASSO_TOKEN_EXCHANGE_URL=
+OKTASSO_CLIENT_ID=
 
 # Generic OAuth/PKCE settings — the defaults below are fine for local dev.
-MINERVA_SCOPES="profile email openid"
-MINERVA_REDIRECT_URI=http://localhost:3001/auth
-MINERVA_CALLBACK_PORT=3001
+OKTASSO_SCOPES="profile email openid"
+OKTASSO_REDIRECT_URI=http://localhost:3001/auth
+OKTASSO_CALLBACK_PORT=3001
 # Token cache lifetime in ms (55 minutes).
-MINERVA_REFRESH_AFTER_MS=3300000
+OKTASSO_REFRESH_AFTER_MS=3300000
 
 # Default bundle used by the Sessions page New session button.
 VITE_DEFAULT_SESSION_BUNDLE_ID=tangle
diff --git a/README.md b/README.md
index e00d90a..ee64c0c 100644
--- a/README.md
+++ b/README.md
@@ -125,7 +125,7 @@ the full list and defaults):
 | `PI_BIN`                                   | Path to the `pi` agent executable                      |
 | `PI_PROVIDER` / `PI_MODEL` / `PI_THINKING` | Default LLM provider, model, and thinking level        |
 | `PI_PROXY_URL` / `PI_PROXY_API_KEY`        | LLM proxy endpoint and credential                      |
-| `TANGLE_API_URL` / `OASIS_TOKEN`           | Tangle pipeline API for bundles that integrate with it |
+| `TANGLE_API_URL` / `TANGLE_TOKEN`          | Tangle pipeline API for bundles that integrate with it |
 
 ### Common commands
 
diff --git a/apps/server/package.json b/apps/server/package.json
index d2c6557..f14fd73 100644
--- a/apps/server/package.json
+++ b/apps/server/package.json
@@ -5,7 +5,7 @@
   "type": "module",
   "prettier": "@tangent/build/prettier",
   "scripts": {
-    "dev": "AUTH_JWT_TOKEN_COOKIE_NAME=MINERVA_TOKEN tsx watch --tsconfig ./tsconfig.json src/index.ts",
+    "dev": "AUTH_JWT_TOKEN_COOKIE_NAME=OKTASSO_TOKEN tsx watch --tsconfig ./tsconfig.json src/index.ts",
     "seed": "tsx --tsconfig ./tsconfig.json src/seed.ts",
     "build": "node build.mjs",
     "lint": "eslint .",
diff --git a/apps/server/src/auth/identity.ts b/apps/server/src/auth/identity.ts
index c29c78f..fde6051 100644
--- a/apps/server/src/auth/identity.ts
+++ b/apps/server/src/auth/identity.ts
@@ -54,7 +54,7 @@ function pickString(
 
 /**
  * Resolves the current {@link UserIdentity} from a raw `Cookie` header. Reads
- * the Minerva JWT from {@link AUTH_JWT_TOKEN_COOKIE_NAME}, decodes its payload
+ * the Oktasso JWT from {@link AUTH_JWT_TOKEN_COOKIE_NAME}, decodes its payload
  * (no signature check), and maps the email + name claims onto the identity.
  *
  * Returns `null` when the cookie name is unconfigured, the cookie is missing,
diff --git a/apps/server/src/bundleUi/egressAllowlist.ts b/apps/server/src/bundleUi/egressAllowlist.ts
index 2499cf7..dbf274a 100644
--- a/apps/server/src/bundleUi/egressAllowlist.ts
+++ b/apps/server/src/bundleUi/egressAllowlist.ts
@@ -3,7 +3,7 @@
  *
  * A sandboxed component can only reach destinations registered here; anything
  * else is denied before a network call is made. Unlike the earlier alias-based
- * stub, components now name a **real, full URL** (e.g. the Oasis executions API)
+ * stub, components now name a **real, full URL** (e.g. the Tangle executions API)
  * and the proxy validates it against the allowlist of host/path patterns, then
  * performs the actual `fetch` server-side, injecting any credentials and
  * stripping host internals out of the response.
@@ -42,14 +42,14 @@ interface EgressRule {
 }
 
 /**
- * Optional credential for the Oasis API, injected server-side as a `Cookie`
+ * Optional credential for the Tangle API, injected server-side as a `Cookie`
  * header. Unset by default (the public executions-state endpoint is
- * unauthenticated); set `OASIS_TOKEN` to a cookie string such as
- * `MINERVA_TOKEN=<session>` to authenticate. Generate one with
- * `pnpm oasis:token` (or `pnpm dev:auth`).
+ * unauthenticated); set `TANGLE_TOKEN` to a cookie string such as
+ * `OKTASSO_TOKEN=<session>` to authenticate. Generate one with
+ * `pnpm tangle:token` (or `pnpm dev:auth`).
  */
-function oasisAuthHeaders(): Record<string, string> {
-  const token = process.env.OASIS_TOKEN;
+function tangleAuthHeaders(): Record<string, string> {
+  const token = process.env.TANGLE_TOKEN;
   return token ? { cookie: token } : {};
 }
 
@@ -91,7 +91,7 @@ const TANGLE_RULES: EgressRule[] = TANGLE_PATH_RULES.map((rule) => ({
   method: rule.method,
   matches: (url) =>
     url.origin === TANGLE_API_ORIGIN && rule.test.test(url.pathname),
-  headers: oasisAuthHeaders,
+  headers: tangleAuthHeaders,
 }));
 
 /** Registered destinations the bridge may reach. */
@@ -103,7 +103,7 @@ const EGRESS_RULES: EgressRule[] = [
     matches: (url) =>
       url.origin === "https://oasis.shopify.io" &&
       /^\/api\/executions\/[^/]+\/state$/.test(url.pathname),
-    headers: oasisAuthHeaders,
+    headers: tangleAuthHeaders,
   },
   ...TANGLE_RULES,
 ];
diff --git a/apps/server/src/config.ts b/apps/server/src/config.ts
index 7b102c1..9ab0032 100644
--- a/apps/server/src/config.ts
+++ b/apps/server/src/config.ts
@@ -128,7 +128,7 @@ export const INTERNAL_TOKEN =
   process.env.TANGENT_INTERNAL_TOKEN ?? randomUUID();
 
 /**
- * Name of the cookie holding the Minerva JWT that `GET /api/me` reads to resolve
+ * Name of the cookie holding the Oktasso JWT that `GET /api/me` reads to resolve
  * the current user. Empty by default so the route is effectively disabled until
  * an environment supplies the cookie name (the local `dev` script sets it).
  */
diff --git a/apps/server/src/index.ts b/apps/server/src/index.ts
index 826c213..193c3da 100644
--- a/apps/server/src/index.ts
+++ b/apps/server/src/index.ts
@@ -99,7 +99,7 @@ app.use(
 );
 app.use("/api/agent-bundles", createAgentBundlesRouter(agentBundleStore));
 app.use("/api/global-memory", createGlobalMemoryRouter(memory));
-// Returns the current user, derived from the Minerva JWT cookie.
+// Returns the current user, derived from the Oktasso JWT cookie.
 app.use("/api/me", createMeRouter());
 // Internal API for the orchestrator extension running inside each Pi process.
 app.use("/internal/agents", createInternalAgentsRouter(store, pi));
diff --git a/apps/server/src/pi/types.ts b/apps/server/src/pi/types.ts
index eb16bc3..0d29b32 100644
--- a/apps/server/src/pi/types.ts
+++ b/apps/server/src/pi/types.ts
@@ -155,7 +155,7 @@ export interface SessionAgents {
    */
   config?: ResolvedSessionConfig;
   /**
-   * The human who owns the session, resolved from their Minerva JWT. Captured
+   * The human who owns the session, resolved from their Oktasso JWT. Captured
    * so every agent's system prompt can be told who it's helping. Absent for
    * unauthenticated sessions.
    */
diff --git a/apps/server/src/routes/me.ts b/apps/server/src/routes/me.ts
index 9cebb7b..eb5623a 100644
--- a/apps/server/src/routes/me.ts
+++ b/apps/server/src/routes/me.ts
@@ -4,14 +4,14 @@ import { resolveUserIdentity } from "../auth/identity.ts";
 import { AUTH_JWT_TOKEN_COOKIE_NAME } from "../config.ts";
 
 /**
- * Handles `GET /api/me`. Resolves the current user from the Minerva JWT in the
+ * Handles `GET /api/me`. Resolves the current user from the Oktasso JWT in the
  * configured cookie ({@link AUTH_JWT_TOKEN_COOKIE_NAME}) and returns the full
  * identity. `user_id` is kept (set to the email) for backward compatibility
  * alongside the structured `email` / `first_name` / `last_name` fields.
  */
 function handleGetMe(req: Request, res: Response): void {
   if (!AUTH_JWT_TOKEN_COOKIE_NAME) {
-    res.status(501).json({ error: "Minerva cookie name not configured" });
+    res.status(501).json({ error: "Oktasso cookie name not configured" });
     return;
   }
 
@@ -25,8 +25,8 @@ function handleGetMe(req: Request, res: Response): void {
 }
 
 /**
- * Public REST router exposing the current user, derived from the Minerva JWT in
- * the `MINERVA_TOKEN` cookie. The signature is not verified at this time.
+ * Public REST router exposing the current user, derived from the Oktasso JWT in
+ * the `OKTASSO_TOKEN` cookie. The signature is not verified at this time.
  */
 export function createMeRouter(): Router {
   const router = Router();
diff --git a/apps/server/src/routes/sessions/handlers.ts b/apps/server/src/routes/sessions/handlers.ts
index f2bcb46..6f957bd 100644
--- a/apps/server/src/routes/sessions/handlers.ts
+++ b/apps/server/src/routes/sessions/handlers.ts
@@ -210,7 +210,7 @@ export async function handleCreateSession(
     return;
   }
 
-  // Resolve the creator's identity from their Minerva JWT cookie so every agent
+  // Resolve the creator's identity from their Oktasso JWT cookie so every agent
   // spawned for the session knows who it's helping.
   const user = resolveUserIdentity(req.headers.cookie) ?? undefined;
   const session = await store.createSession({ name: body.name, user });
diff --git a/apps/server/src/store/sessionStore.ts b/apps/server/src/store/sessionStore.ts
index 2e8e2ae..79a4ee4 100644
--- a/apps/server/src/store/sessionStore.ts
+++ b/apps/server/src/store/sessionStore.ts
@@ -15,6 +15,11 @@ import type {
  */
 export type SessionAgentStatus = "active" | "killed" | "error";
 
+/**
+ * Input accepted by {@link SessionStore.createSession}: the public wire request
+ * plus the server-resolved {@link UserIdentity} (from the creator's Oktasso JWT),
+ * which is never part of the client-supplied body.
+ */
 export interface CreateSessionParams {
   name?: string;
   user?: UserIdentity;
diff --git a/apps/web/index.html b/apps/web/index.html
index ecb8325..81284fc 100644
--- a/apps/web/index.html
+++ b/apps/web/index.html
@@ -3,7 +3,7 @@
   <head>
     <script>
       // Set <base href> to the proxy mount root (e.g. ".../ports/8000/") so the
-      // app works behind the oasis pod-proxy sub-path. The origin server cannot
+      // app works behind the tangle pod-proxy sub-path. The origin server cannot
       // know the external prefix, so it is derived here from the browser URL.
       // Must run before any asset tag so their relative URLs resolve correctly.
       (function () {
diff --git a/apps/web/src/features/chat/hooks/useSessionChat.ts b/apps/web/src/features/chat/hooks/useSessionChat.ts
index 8fba921..83835de 100644
--- a/apps/web/src/features/chat/hooks/useSessionChat.ts
+++ b/apps/web/src/features/chat/hooks/useSessionChat.ts
@@ -135,7 +135,7 @@ export function useSessionChat(sessionId: string) {
     if (!sessionId) return;
 
     // Connects to the same origin; Vite proxies /socket.io to the dev server.
-    // The path is mount-prefix aware so it works behind the oasis pod-proxy
+    // The path is mount-prefix aware so it works behind the tangle pod-proxy
     // sub-path (`${BASE_PREFIX}socket.io`, i.e. `/socket.io` at the origin root).
     const socket = io({ autoConnect: true, path: `${BASE_PREFIX}socket.io` });
     socketRef.current = socket;
diff --git a/apps/web/src/features/user/api/userApi.ts b/apps/web/src/features/user/api/userApi.ts
index d781ade..0b51765 100644
--- a/apps/web/src/features/user/api/userApi.ts
+++ b/apps/web/src/features/user/api/userApi.ts
@@ -6,7 +6,7 @@ import { DEFAULT_USER } from "../model/userDisplay";
 
 /**
  * Fetches the current user from `GET /api/me`. The endpoint returns `401`/`501`
- * when no Minerva JWT is present (e.g. local development), so any non-ok
+ * when no Oktasso JWT is present (e.g. local development), so any non-ok
  * response resolves to {@link DEFAULT_USER} rather than throwing — the UI always
  * has an identity to render.
  */
diff --git a/apps/web/src/features/user/model/userDisplay.ts b/apps/web/src/features/user/model/userDisplay.ts
index 78e9b67..7b14304 100644
--- a/apps/web/src/features/user/model/userDisplay.ts
+++ b/apps/web/src/features/user/model/userDisplay.ts
@@ -1,7 +1,7 @@
 import type { UserIdentity } from "@tangent/shared/contracts";
 
 /**
- * Safety-net identity used when the Minerva JWT is unavailable (e.g. local
+ * Safety-net identity used when the Oktasso JWT is unavailable (e.g. local
  * development without the cookie configured), so the UI always has a name to
  * show.
  */
diff --git a/apps/web/src/routes/bundle-ui-harness/BundleUiHarnessPage.tsx b/apps/web/src/routes/bundle-ui-harness/BundleUiHarnessPage.tsx
index bb37ecb..2bf935a 100644
--- a/apps/web/src/routes/bundle-ui-harness/BundleUiHarnessPage.tsx
+++ b/apps/web/src/routes/bundle-ui-harness/BundleUiHarnessPage.tsx
@@ -25,7 +25,7 @@ export function BundleUiHarnessPage() {
   const [crashToken, setCrashToken] = useState(0);
   const [showCrash, setShowCrash] = useState(false);
   const [collapsed, setCollapsed] = useState(false);
-  // A sample Oasis execution id; the component polls the real allowlisted
+  // A sample Tangle execution id; the component polls the real allowlisted
   // endpoint and degrades to a loading state when the host is unreachable.
   const [executionId] = useState("019ea56d72cd5f4d75f6");
 
@@ -36,7 +36,7 @@ export function BundleUiHarnessPage() {
           <Heading level={2}>Bundle UI harness</Heading>
           <Paragraph tone="subdued">
             Renders a sandboxed component in a Web Worker via remote-dom. The
-            progress bar polls the real allowlisted egress endpoint (Oasis
+            progress bar polls the real allowlisted egress endpoint (Tangle
             execution state); the button sends a prompt through the host bridge.
           </Paragraph>
         </BlockStack>
diff --git a/apps/web/src/routes/router.tsx b/apps/web/src/routes/router.tsx
index 3b0a72b..eed8d65 100644
--- a/apps/web/src/routes/router.tsx
+++ b/apps/web/src/routes/router.tsx
@@ -9,7 +9,7 @@ export const router = createRouter({
   routeTree,
   history: createBrowserHistory(),
   // Mount the router under the proxy sub-path so client-side routing resolves
-  // relative to the oasis pod-proxy prefix (`/` at the origin root).
+  // relative to the tangle pod-proxy prefix (`/` at the origin root).
   basepath: BASE_PREFIX,
   defaultPreload: "intent",
 });
diff --git a/apps/web/src/shared/lib/basePath.ts b/apps/web/src/shared/lib/basePath.ts
index 15ebc4b..321b9a7 100644
--- a/apps/web/src/shared/lib/basePath.ts
+++ b/apps/web/src/shared/lib/basePath.ts
@@ -1,7 +1,7 @@
 /**
  * Proxy mount-prefix awareness.
  *
- * Behind the oasis pod-proxy the app is served from a sub-path
+ * Behind the tangle pod-proxy the app is served from a sub-path
  * (e.g. `.../ports/8000/`), not the origin root. `index.html` injects a
  * `<base href>` pointing at that mount root, so `document.baseURI` reflects it.
  * `BASE_PREFIX` captures that prefix once at boot and `apiUrl` rewrites
diff --git a/apps/web/vite.config.ts b/apps/web/vite.config.ts
index f2e24e3..98d830b 100644
--- a/apps/web/vite.config.ts
+++ b/apps/web/vite.config.ts
@@ -13,7 +13,7 @@ const apiTarget = process.env.API_TARGET ?? "http://localhost:8787";
 // https://vite.dev/config/
 export default defineConfig({
   // Relative asset base so the built index.html references assets as
-  // "./assets/..." rather than "/assets/...". Behind the oasis pod-proxy the
+  // "./assets/..." rather than "/assets/...". Behind the tangle pod-proxy the
   // Kubernetes apiserver rewrites same-host absolute-path URLs in HTML to its
   // own proxy path; relative URLs are left untouched and resolve against the
   // runtime-injected <base href> (see index.html).
diff --git a/docs/bundle-ui/authoring-guide.md b/docs/bundle-ui/authoring-guide.md
index 4de625a..8594251 100644
--- a/docs/bundle-ui/authoring-guide.md
+++ b/docs/bundle-ui/authoring-guide.md
@@ -56,7 +56,7 @@ renders a progress chip:
 import { BlockStack, Card, host, Progress, Text } from "@tangent/bundle-ui";
 import { useEffect, useState } from "react";
 
-const OASIS_BASE = "https://oasis.shopify.io/api/executions";
+const TANGLE_BASE = "https://tangle.example.com/api/executions";
 
 export default function PipelineProgress() {
   const [executionId, setExecutionId] = useState<string | null>(null);
@@ -79,7 +79,7 @@ export default function PipelineProgress() {
     const tick = async () => {
       try {
         // A real, allowlisted endpoint — the host proxy validates the URL.
-        const res = await host.fetch(`${OASIS_BASE}/${executionId}/state`);
+        const res = await host.fetch(`${TANGLE_BASE}/${executionId}/state`);
         if (active && res.ok) {
           const s = (res.json as { child_execution_status_summary?: unknown })
             ?.child_execution_status_summary as
diff --git a/docs/bundle-ui/host-bridge.md b/docs/bundle-ui/host-bridge.md
index ba4b4df..bce6b2d 100644
--- a/docs/bundle-ui/host-bridge.md
+++ b/docs/bundle-ui/host-bridge.md
@@ -96,7 +96,7 @@ without growing the bridge surface.
 await host.execUICommand({ type: "collapse" });
 await host.execUICommand({
   type: "openUrl",
-  url: "https://oasis.shopify.io/runs/abc",
+  url: "https://tangle.example.com/runs/abc",
 });
 ```
 
@@ -130,7 +130,7 @@ interface HostResponse {
 
 - `input` is a **real, absolute `https://` URL** for the destination. The proxy
   matches it against allowlisted host/path patterns; authors name the actual
-  endpoint (e.g. `https://oasis.shopify.io/api/executions/<id>/state`) rather
+  endpoint (e.g. `https://tangle.example.com/api/executions/<id>/state`) rather
   than a logical alias.
 - The proxy **rejects any destination not on the allowlist** before making a
   network call, and strips/normalizes headers in both directions. Credentials
@@ -151,10 +151,10 @@ const EGRESS_RULES = [
   {
     method: "GET",
     matches: (url) =>
-      url.origin === "https://oasis.shopify.io" &&
+      url.origin === "https://tangle.example.com" &&
       /^\/api\/executions\/[^/]+\/state$/.test(url.pathname),
     // optional bearer token attached server-side; never exposed to the worker
-    headers: oasisAuthHeaders,
+    headers: tangleAuthHeaders,
   },
 ];
 ```
@@ -171,7 +171,7 @@ Request from the component:
 ```ts
 const id = "019ea56d72cd5f4d75f6";
 const res = await host.fetch(
-  `https://oasis.shopify.io/api/executions/${id}/state`,
+  `https://tangle.example.com/api/executions/${id}/state`,
 );
 if (!res.ok) throw new Error(`status ${res.status}`);
 const summary = (res.json as { child_execution_status_summary: unknown })
diff --git a/docs/server/egress-and-security.md b/docs/server/egress-and-security.md
index 9020d08..aa60b47 100644
--- a/docs/server/egress-and-security.md
+++ b/docs/server/egress-and-security.md
@@ -76,7 +76,7 @@ sequenceDiagram
   participant Caller as Agent tool / UI component
   participant Route as Egress route
   participant Resolver as resolveEgress
-  participant Upstream as Tangle / Oasis
+  participant Upstream as Tangle
 
   Caller->>Route: POST egress { input: URL, init }
   activate Route
@@ -106,7 +106,7 @@ Allowlist properties:
 - Only `http(s)` URLs whose method + parsed URL match a registered `EgressRule`
   are permitted; everything else throws `EgressDeniedError` (403).
 - Rules cover the configured Tangle API origin (`TANGLE_API_URL`) for specific
-  `pipeline_runs` / `executions` / `artifacts` paths, plus the Oasis execution
+  `pipeline_runs` / `executions` / `artifacts` paths, plus the Tangle execution
   state endpoint. Credentials are injected by the rule's `headers()` so the
   caller never sees them.
 - Responses surface only `content-type`; a 10s `AbortController` timeout bounds
@@ -139,35 +139,35 @@ Allowlist properties:
 
 ## Security findings
 
-### Finding 1 (critical): hardcoded personal `MINERVA_TOKEN` in source
+### Finding 1 (critical): hardcoded personal `OKTASSO_TOKEN` in source
 
 [server/src/bundleUi/egressAllowlist.ts](../../server/src/bundleUi/egressAllowlist.ts)
-currently hardcodes a personal Minerva JWT directly in `oasisAuthHeaders()`:
+currently hardcodes a personal Oktasso JWT directly in `tangleAuthHeaders()`:
 
 ```ts
-function oasisAuthHeaders(): Record<string, string> {
+function tangleAuthHeaders(): Record<string, string> {
   return {
-    cookie: `MINERVA_TOKEN=eyJ...<full JWT>...`,
+    cookie: `OKTASSO_TOKEN=eyJ...<full JWT>...`,
   };
   // unreachable below:
-  const token = process.env.OASIS_TOKEN;
+  const token = process.env.TANGLE_TOKEN;
   return token ? { authorization: `Bearer ${token}` } : {};
 }
 ```
 
 Problems:
 
-- A live, personal credential (decoded subject `maxim.ezhov@shopify.com`) is
+- A live, personal credential (decoded subject `user@example.com`) is
   committed to the repository. It will be exposed to anyone with repo access and
   in git history.
-- The early `return` makes the intended `OASIS_TOKEN` env path dead code, so the
-  hardcoded cookie is attached to **every** allowlisted Oasis/Tangle egress
+- The early `return` makes the intended `TANGLE_TOKEN` env path dead code, so the
+  hardcoded cookie is attached to **every** allowlisted Tangle egress
   request from any session's agents and UI components.
 
 Recommended remediation:
 
-1. Revoke/rotate the leaked Minerva token immediately.
-2. Remove the hardcoded `cookie` block and restore the `OASIS_TOKEN` (and
+1. Revoke/rotate the leaked Oktasso token immediately.
+2. Remove the hardcoded `cookie` block and restore the `TANGLE_TOKEN` (and
    `TANGLE_AUTH`) env-sourced path so credentials are injected from the
    environment, never from source.
 3. Scrub the secret from git history (e.g. `git filter-repo`) since rotating
diff --git a/docs/server/index.md b/docs/server/index.md
index 2ff0fc5..714a048 100644
--- a/docs/server/index.md
+++ b/docs/server/index.md
@@ -59,7 +59,7 @@ flowchart TB
   end
 
   LLM["LLM proxy (PI_PROXY_URL)"]
-  Tangle["Tangle / Oasis API"]
+  Tangle["Tangle API"]
 
   UI -->|"REST /api/*"| Express
   UI <-->|"Socket.IO session room"| SocketIO
@@ -178,9 +178,9 @@ From [server/src/config.ts](../../server/src/config.ts):
 - `ARTIFACTS_DIRNAME` (`artifacts`) and `UPLOADS_DIRNAME` (`uploads`) — the only
   per-session subtrees served over HTTP.
 - `PI_BIN` (`pi`), `PI_PROVIDER` (`openai`), `PI_MODEL` (`gpt-5.5`),
-  `PI_PROXY_URL` (`https://proxy.shopify.ai`), `PI_DEBUG` (on by default).
+  `PI_PROXY_URL` (`https://proxy.example.com`), `PI_DEBUG` (on by default).
 - `INTERNAL_URL` (loopback on `PORT`) + `INTERNAL_TOKEN` (per-start UUID).
-- `TANGLE_API_URL` (`https://oasis.shopify.io`) — origin for the egress
+- `TANGLE_API_URL` (`https://tangle.example.com`) — origin for the egress
   allowlist.
 
 ## Glossary
diff --git a/examples/tangle/skills/reproduce-research/references/builder-brief-template.md b/examples/tangle/skills/reproduce-research/references/builder-brief-template.md
index c093b75..05f9792 100644
--- a/examples/tangle/skills/reproduce-research/references/builder-brief-template.md
+++ b/examples/tangle/skills/reproduce-research/references/builder-brief-template.md
@@ -89,5 +89,5 @@ write their artifacts at runtime. Before submitting:
 3. `CORRECTED_DAG_READY` — pipeline path, config path, exact tasks present, wiring summary, "not monolithic".
 4. `VALIDATION_STATUS` — commands run, success/failure output, hydrated pipeline path; confirm pre-submit checks passed.
 5. Submit with `--no-wait` only after validation success.
-6. `PIPELINE_SUBMITTED` — pipeline path, config path, RUN_ID, ROOT_EXECUTION_ID, Oasis URL, source annotation.
+6. `PIPELINE_SUBMITTED` — pipeline path, config path, RUN_ID, ROOT_EXECUTION_ID, Tangle URL, source annotation.
 7. `SUBMISSION_FAILED` (on failure) — exact command, exact error, files involved, next fix.
diff --git a/package.json b/package.json
index dcde9d7..90c48a4 100644
--- a/package.json
+++ b/package.json
@@ -7,7 +7,7 @@
   "prettier": "@tangent/build/prettier",
   "scripts": {
     "dev": "SESSIONS_ROOT=\"$PWD/.sessions\" SESSIONS_DB=\"$PWD/.sessions/tangent.db\" AGENT_BUNDLES_ROOT=\"$PWD/.agent-bundles\" GLOBAL_MEMORY_DIR=\"$PWD/.memory\" turbo run dev",
-    "oasis:token": "tsx scripts/print-oasis-token.ts",
+    "tangle:token": "tsx scripts/print-tangle-token.ts",
     "seed": "AGENT_BUNDLES_ROOT=\"$PWD/.agent-bundles\" SEED_BUNDLES_DIR=\"$PWD/examples\" pnpm --filter @tangent/server seed",
     "build": "turbo run build",
     "lint": "turbo run lint",
diff --git a/packages/shared/src/contracts.ts b/packages/shared/src/contracts.ts
index 1457fe8..650b71d 100644
--- a/packages/shared/src/contracts.ts
+++ b/packages/shared/src/contracts.ts
@@ -10,7 +10,7 @@
 export type SessionStatus = "created";
 
 /**
- * The current human's identity, resolved from the Minerva JWT by `GET /api/me`.
+ * The current human's identity, resolved from the Oktasso JWT by `GET /api/me`.
  * The `email` doubles as the user id used when constructing Tangle API requests;
  * `first_name` lets agents address the user by name. Name fields default to an
  * empty string when the JWT omits the corresponding claim.
@@ -71,7 +71,7 @@ export interface Session {
   status: SessionStatus;
   /** Configuration Bundle this session was created from, when applicable. */
   config?: SessionConfigMeta;
-  /** The human who created the session, resolved from their Minerva JWT. */
+  /** The human who created the session, resolved from their Oktasso JWT. */
   user?: UserIdentity;
   /** Whether the session is archived (hidden from the default list). */
   archived: boolean;
diff --git a/scripts/env.ts b/scripts/env.ts
index 58720dd..ad06311 100644
--- a/scripts/env.ts
+++ b/scripts/env.ts
@@ -1,7 +1,7 @@
 /**
- * Loads the repo-root `.env` (if present) and validates the internal Minerva
+ * Loads the repo-root `.env` (if present) and validates the Oktasso
  * config. Import this for its side effects *before* any module that reads the
- * `MINERVA_*` variables at top level, so the values are populated in time.
+ * `OKTASSO_*` variables at top level, so the values are populated in time.
  *
  * `.env` is gitignored; see `.env.example` for the expected keys. Variables
  * already present in the real environment take precedence and are never
@@ -20,19 +20,19 @@ try {
 }
 
 const REQUIRED = [
-  "MINERVA_OAUTH_ENDPOINT_BASE",
-  "MINERVA_TOKEN_EXCHANGE_URL",
-  "MINERVA_SCOPES",
-  "MINERVA_CLIENT_ID",
-  "MINERVA_REDIRECT_URI",
-  "MINERVA_CALLBACK_PORT",
-  "MINERVA_REFRESH_AFTER_MS",
+  "OKTASSO_OAUTH_ENDPOINT_BASE",
+  "OKTASSO_TOKEN_EXCHANGE_URL",
+  "OKTASSO_SCOPES",
+  "OKTASSO_CLIENT_ID",
+  "OKTASSO_REDIRECT_URI",
+  "OKTASSO_CALLBACK_PORT",
+  "OKTASSO_REFRESH_AFTER_MS",
 ] as const;
 
 const missing = REQUIRED.filter((key) => !process.env[key]);
 if (missing.length > 0) {
   console.error(
-    `[minervaAuth] missing required config: ${missing.join(", ")}.\n` +
+    `[oktassoAuth] missing required config: ${missing.join(", ")}.\n` +
       `Copy .env.example to .env at the repo root and fill in the values.`,
   );
   process.exit(1);
diff --git a/scripts/minervaAuth.ts b/scripts/oktassoAuth.ts
similarity index 76%
rename from scripts/minervaAuth.ts
rename to scripts/oktassoAuth.ts
index e3645bb..4112ee7 100644
--- a/scripts/minervaAuth.ts
+++ b/scripts/oktassoAuth.ts
@@ -1,9 +1,9 @@
 /**
- * Minerva (Shopify SSO) authentication via Okta PKCE flow.
+ * Oktasso SSO authentication via Okta PKCE flow.
  *
- * Mirrors `rowlet.auth.MinervaAuth` (Python) — the helper that `tangle_deploy`
- * uses to obtain a `MINERVA_TOKEN` cookie for authenticated requests against
- * Oasis / Tangle.
+ * Mirrors `rowlet.auth.OktassoAuth` (Python) — the helper that `tangle_deploy`
+ * uses to obtain an `OKTASSO_TOKEN` cookie for authenticated requests against
+ * Tangle.
  *
  * Flow:
  *   1. Generate PKCE verifier + challenge.
@@ -11,11 +11,11 @@
  *   3. Run a one-shot HTTP server on http://localhost:3001/auth to catch the
  *      redirect with the authorization code.
  *   4. Exchange the code for an Okta access token at `/token`.
- *   5. Exchange the access token for a Minerva session token via
- *      `https://minerva.shopifycloud.com/client_auth/okta_token_exchange/`,
+ *   5. Exchange the access token for an Oktasso session token via the
+ *      configured token-exchange endpoint,
  *      passing the target API base URL as the `audience` parameter.
- *   6. Return headers `{ cookie: "MINERVA_TOKEN=<session>" }` and persist them
- *      to `~/.cache/tangle-deploy/minerva_token.json` so subsequent CLI
+ *   6. Return headers `{ cookie: "OKTASSO_TOKEN=<session>" }` and persist them
+ *      to `~/.cache/tangle-deploy/oktasso_token.json` so subsequent CLI
  *      invocations don't re-prompt for login.
  *
  * The on-disk cache shape intentionally matches what the Python client writes,
@@ -36,24 +36,24 @@ function env(name: string): string {
   return process.env[name] ?? "";
 }
 
-const OAUTH_ENDPOINT_BASE = env("MINERVA_OAUTH_ENDPOINT_BASE");
-const MINERVA_ENDPOINT_BASE = env("MINERVA_TOKEN_EXCHANGE_URL");
-const SCOPES = env("MINERVA_SCOPES");
+const OAUTH_ENDPOINT_BASE = env("OKTASSO_OAUTH_ENDPOINT_BASE");
+const OKTASSO_ENDPOINT_BASE = env("OKTASSO_TOKEN_EXCHANGE_URL");
+const SCOPES = env("OKTASSO_SCOPES");
 
-const DEFAULT_CLIENT_ID = env("MINERVA_CLIENT_ID");
-const DEFAULT_REDIRECT_URI = env("MINERVA_REDIRECT_URI");
-const DEFAULT_CALLBACK_PORT = Number(env("MINERVA_CALLBACK_PORT"));
-const DEFAULT_REFRESH_AFTER_MS = Number(env("MINERVA_REFRESH_AFTER_MS"));
+const DEFAULT_CLIENT_ID = env("OKTASSO_CLIENT_ID");
+const DEFAULT_REDIRECT_URI = env("OKTASSO_REDIRECT_URI");
+const DEFAULT_CALLBACK_PORT = Number(env("OKTASSO_CALLBACK_PORT"));
+const DEFAULT_REFRESH_AFTER_MS = Number(env("OKTASSO_REFRESH_AFTER_MS"));
 
 const CACHE_DIR = path.join(os.homedir(), ".cache", "tangle-deploy");
-const CACHE_FILE = path.join(CACHE_DIR, "minerva_token.json");
+const CACHE_FILE = path.join(CACHE_DIR, "oktasso_token.json");
 
-export interface MinervaHeaders {
+export interface OktassoHeaders {
   cookie: string;
   expiry?: string;
 }
 
-export interface GetMinervaHeadersOptions {
+export interface GetOktassoHeadersOptions {
   baseUrl: string;
   clientId?: string;
   refreshAfterMs?: number;
@@ -62,7 +62,7 @@ export interface GetMinervaHeadersOptions {
 }
 
 interface CachedTokenPayload {
-  headers: MinervaHeaders;
+  headers: OktassoHeaders;
   base_url: string;
   created_at: number; // seconds since epoch, matching Python's time.time()
 }
@@ -72,9 +72,9 @@ interface CachedTokenPayload {
  * fetch requests targeting `baseUrl`. Uses the on-disk cache when fresh and
  * for the same base URL; otherwise runs the full PKCE browser flow.
  */
-export async function getMinervaHeaders(
-  opts: GetMinervaHeadersOptions,
-): Promise<MinervaHeaders> {
+export async function getOktassoHeaders(
+  opts: GetOktassoHeadersOptions,
+): Promise<OktassoHeaders> {
   const clientId = opts.clientId ?? DEFAULT_CLIENT_ID;
   const refreshAfterMs = opts.refreshAfterMs ?? DEFAULT_REFRESH_AFTER_MS;
 
@@ -91,7 +91,7 @@ export async function getMinervaHeaders(
 async function loadCachedToken(
   baseUrl: string,
   refreshAfterMs: number,
-): Promise<MinervaHeaders | null> {
+): Promise<OktassoHeaders | null> {
   try {
     const raw = await readFile(CACHE_FILE, "utf8");
     const payload = JSON.parse(raw) as CachedTokenPayload;
@@ -106,7 +106,7 @@ async function loadCachedToken(
 }
 
 async function saveCachedToken(
-  headers: MinervaHeaders,
+  headers: OktassoHeaders,
   baseUrl: string,
 ): Promise<void> {
   try {
@@ -121,7 +121,7 @@ async function saveCachedToken(
     await chmod(CACHE_FILE, 0o600);
   } catch (err) {
     console.warn(
-      `[minervaAuth] warning: could not cache Minerva token: ${stringifyError(err)}`,
+      `[oktassoAuth] warning: could not cache Oktasso token: ${stringifyError(err)}`,
     );
   }
 }
@@ -129,7 +129,7 @@ async function saveCachedToken(
 async function runAuthFlow(
   clientId: string,
   audienceUrl: string,
-): Promise<MinervaHeaders> {
+): Promise<OktassoHeaders> {
   const { verifier, challenge } = generatePkcePair();
   const code = await getAuthorizationCode(clientId, challenge);
   const accessToken = await exchangeCodeForAccessToken(
@@ -137,13 +137,13 @@ async function runAuthFlow(
     code,
     verifier,
   );
-  const minervaToken = await exchangeAccessTokenForMinervaToken(
+  const oktassoToken = await exchangeAccessTokenForOktassoToken(
     accessToken,
     audienceUrl,
   );
   const expiry = new Date(Date.now() + 24 * 60 * 60 * 1000);
   return {
-    cookie: `MINERVA_TOKEN=${minervaToken}`,
+    cookie: `OKTASSO_TOKEN=${oktassoToken}`,
     expiry: formatExpiry(expiry),
   };
 }
@@ -180,16 +180,14 @@ async function getAuthorizationCode(
   url.searchParams.set("state", "1234");
   url.searchParams.set("redirect_uri", DEFAULT_REDIRECT_URI);
 
-  console.error(
-    "[minervaAuth] opening browser for Shopify SSO login (Minerva)...",
-  );
-  console.error(`[minervaAuth] if no browser opens, visit:\n${url.toString()}`);
+  console.error("[oktassoAuth] opening browser for Oktasso SSO login...");
+  console.error(`[oktassoAuth] if no browser opens, visit:\n${url.toString()}`);
 
   try {
     await open(url.toString());
   } catch (err) {
     console.warn(
-      `[minervaAuth] could not auto-open browser (${stringifyError(err)}); please open the URL above manually.`,
+      `[oktassoAuth] could not auto-open browser (${stringifyError(err)}); please open the URL above manually.`,
     );
   }
 
@@ -209,7 +207,7 @@ function waitForAuthorizationCode(port: number): Promise<string> {
       if (!code) {
         res.statusCode = 400;
         res.end("Missing ?code");
-        reject(new Error("Minerva auth: callback missing ?code parameter"));
+        reject(new Error("Oktasso auth: callback missing ?code parameter"));
         server.close();
         return;
       }
@@ -224,7 +222,7 @@ function waitForAuthorizationCode(port: number): Promise<string> {
     server.on("error", (err) => {
       reject(
         new Error(
-          `Minerva auth: local callback server failed to start on port ${port}: ${stringifyError(err)}`,
+          `Oktasso auth: local callback server failed to start on port ${port}: ${stringifyError(err)}`,
         ),
       );
     });
@@ -234,7 +232,7 @@ function waitForAuthorizationCode(port: number): Promise<string> {
       server.close();
       reject(
         new Error(
-          `Minerva auth: timed out after ${TIMEOUT_MS / 1000}s waiting for browser callback. Try again.`,
+          `Oktasso auth: timed out after ${TIMEOUT_MS / 1000}s waiting for browser callback. Try again.`,
         ),
       );
     }, TIMEOUT_MS);
@@ -267,27 +265,27 @@ async function exchangeCodeForAccessToken(
 
   if (!res.ok) {
     throw new Error(
-      `Minerva auth: Okta token exchange failed: ${res.status} ${res.statusText}\n${await safeText(res)}`,
+      `Oktasso auth: Okta token exchange failed: ${res.status} ${res.statusText}\n${await safeText(res)}`,
     );
   }
   const json = (await res.json()) as { access_token?: string };
   if (!json.access_token) {
     throw new Error(
-      "Minerva auth: Okta token response did not include access_token",
+      "Oktasso auth: Okta token response did not include access_token",
     );
   }
   return json.access_token;
 }
 
-async function exchangeAccessTokenForMinervaToken(
+async function exchangeAccessTokenForOktassoToken(
   accessToken: string,
   audienceUrl: string,
 ): Promise<string> {
   // The Python rowlet client uses GET with a form-encoded body
   // (`requests.get(..., data=payload)`). Node's fetch (undici) forbids
   // bodies on GET regardless of `duplex`, so we send `audience` as a
-  // query parameter instead — Minerva accepts either form.
-  const url = new URL(MINERVA_ENDPOINT_BASE);
+  // query parameter instead — Oktasso accepts either form.
+  const url = new URL(OKTASSO_ENDPOINT_BASE);
   url.searchParams.set("audience", audienceUrl);
 
   const res = await fetch(url, {
@@ -300,13 +298,13 @@ async function exchangeAccessTokenForMinervaToken(
 
   if (!res.ok) {
     throw new Error(
-      `Minerva auth: token exchange failed: ${res.status} ${res.statusText}\n${await safeText(res)}`,
+      `Oktasso auth: token exchange failed: ${res.status} ${res.statusText}\n${await safeText(res)}`,
     );
   }
   const json = (await res.json()) as { access_token?: string };
   if (!json.access_token) {
     throw new Error(
-      "Minerva auth: token exchange response did not include access_token",
+      "Oktasso auth: token exchange response did not include access_token",
     );
   }
   return json.access_token;
@@ -345,12 +343,6 @@ const SUCCESS_PAGE = `<!doctype html>
   <h2 style="text-align:center;font-family:Arial,Helvetica,sans-serif;color:#909090;margin-top:50px;">
     Auth successful! This window will close shortly.
   </h2>
-  <div style="text-align:center;">
-    <img alt="Shopify" src="https://cdn.shopify.com/assets/images/logos/shopify-bag.png">
-  </div>
-  <h4 style="text-align:center;font-family:Arial,Helvetica,sans-serif;color:#B0B0B0;margin-top:30px;">
-    Shopify
-  </h4>
   <script>setTimeout(function(){window.close();}, 2000);</script>
 </body>
 </html>`;
diff --git a/scripts/print-oasis-token.ts b/scripts/print-oasis-token.ts
deleted file mode 100644
index ba4844b..0000000
--- a/scripts/print-oasis-token.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/**
- * Prints an Oasis cookie token to stdout for use as `OASIS_TOKEN`.
- *
- * Runs the Minerva PKCE flow (or reuses the shared on-disk cache) and writes
- * the `MINERVA_TOKEN=<session>` cookie string — and nothing else — to stdout,
- * so it can be captured directly:
- *
- *   OASIS_TOKEN="$(pnpm -s oasis:token)" pnpm dev
- *
- * All diagnostics (browser prompt, errors) go to stderr.
- */
-
-import { getMinervaHeaders } from "./minervaAuth.ts";
-
-const baseUrl =
-  process.argv[2] ?? process.env.OASIS_BASE_URL ?? "https://oasis.shopify.io";
-const forceRefresh = process.env.OASIS_TOKEN_FORCE_REFRESH === "1";
-
-try {
-  const headers = await getMinervaHeaders({ baseUrl, forceRefresh });
-  process.stdout.write(headers.cookie);
-} catch (err) {
-  console.error(err instanceof Error ? err.message : String(err));
-  process.exit(1);
-}
diff --git a/scripts/print-tangle-token.ts b/scripts/print-tangle-token.ts
new file mode 100644
index 0000000..d15bcba
--- /dev/null
+++ b/scripts/print-tangle-token.ts
@@ -0,0 +1,27 @@
+/**
+ * Prints a Tangle cookie token to stdout for use as `TANGLE_TOKEN`.
+ *
+ * Runs the Oktasso PKCE flow (or reuses the shared on-disk cache) and writes
+ * the `OKTASSO_TOKEN=<session>` cookie string — and nothing else — to stdout,
+ * so it can be captured directly:
+ *
+ *   TANGLE_TOKEN="$(pnpm -s tangle:token)" pnpm dev
+ *
+ * All diagnostics (browser prompt, errors) go to stderr.
+ */
+
+import { getOktassoHeaders } from "./oktassoAuth.ts";
+
+const baseUrl =
+  process.argv[2] ??
+  process.env.TANGLE_BASE_URL ??
+  "https://tangle.example.com";
+const forceRefresh = process.env.TANGLE_TOKEN_FORCE_REFRESH === "1";
+
+try {
+  const headers = await getOktassoHeaders({ baseUrl, forceRefresh });
+  process.stdout.write(headers.cookie);
+} catch (err) {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+}
diff --git a/turbo.json b/turbo.json
index 9d880fc..a83a142 100644
--- a/turbo.json
+++ b/turbo.json
@@ -17,7 +17,7 @@
     "TANGENT_INTERNAL_URL",
     "TANGENT_INTERNAL_TOKEN",
     "TANGLE_API_URL",
-    "OASIS_TOKEN"
+    "TANGLE_TOKEN"
   ],
   "tasks": {
     "build": {