Docs: say host, not machine, for the enrolled computer

docs/CLI.md

@@ -24,8 +24,8 @@ hyp setup
 ```
 
 Select **Sync to the cloud** to store your recordings on HypAware Cloud or
-choose **Local only** to keep recordings on your machine. To change this later,
-see [connect a machine](TEAM_SETUP.md#connect-a-machine).
+choose **Local only** to keep recordings on your host. To change this later,
+see [connect a host](TEAM_SETUP.md#connect-a-host).
 
 Setup then asks which AI clients to record, installs the background service,
 connects the clients you selected, and imports their supported session history.
@@ -85,7 +85,7 @@ attention, with guidance to help resolve problems. For capture checks, see
 The daemon keeps capture and scheduled sync running after you close the terminal.
 Setup installs it as a per-user service. On macOS, its LaunchAgent runs while
 you are logged in. On Linux, its systemd user service requires user-session
-support; see [headless deployment](TEAM_SETUP.md#long-lived-headless-machines)
+support; see [headless deployment](TEAM_SETUP.md#long-lived-headless-hosts)
 for hosts that must keep running after logout.
 
 ```sh
@@ -105,7 +105,7 @@ hyp setup
 ```
 
 Select **Reconfigure** in the menu. HypAware preserves a centrally managed
-configuration layer and changes only the choices this machine owns.
+configuration layer and changes only the choices this host owns.
 
 For unattended replacements and configuration files, see
 [repeatable configuration](CONFIGURATION.md#make-a-repeatable-setup).
@@ -163,7 +163,7 @@ detached, replacing `<client>` with its name, such as `claude` or `codex`.
 ## Uninstall
 
 ```sh
-hyp leave                  # if this machine is enrolled in Cloud
+hyp leave                  # if this host is enrolled in Cloud
 hyp daemon uninstall
 npm uninstall -g hypaware
 ```

docs/CLIENTS.md

@@ -158,7 +158,7 @@ hyp client status ollama
 
 To add Ollama on an existing installation while preserving its export choice,
 run `hyp setup --source ollama` without `--export`. An explicit `--export` changes
-that choice. Other clients are preserved; check `hyp status` to see your sinks. Recorded local inference can leave the machine through configured sinks.
+that choice. Other clients are preserved; check `hyp status` to see your sinks. Recorded local inference can leave the host through configured sinks.
 Setup checks the service and model inventory without starting Ollama, downloading
 or loading a model, or sending inference. Missing executable, unavailable service
 and empty model inventory are separate results. SDK use does not need the CLI

docs/CLI_REFERENCE.md

@@ -70,7 +70,7 @@ clients with scheduled recovery still import history. Neither flag applies to
 a preset.
 
 With no arguments and no output terminal, setup prints an agent guide on
-stdout and exits `0` without configuring the machine. It lists detected
+stdout and exits `0` without configuring the host. It lists detected
 sources, recording disclosures, choices and commands, browser sign-in
 handoffs, and verification. An agent asks the person before selecting sources
 or enabling cloud sync, then runs explicit unattended flags. `hyp setup
@@ -497,9 +497,9 @@ hyp report list [--local] [--kind <kind>] [--period <period>] [--limit <n>] [--b
 ```
 
 Lists the newest reports visible to the selected organization, then this
-machine's saved reports (`$HYP_HOME/reports`, as `hyp report save` leaves
+host's saved reports (`$HYP_HOME/reports`, as `hyp report save` leaves
 them) in their own section, newest first by `report.md` mtime, at most 100
-with the rest counted. A machine with nothing saved prints no section.
+with the rest counted. A host with nothing saved prints no section.
 `--local` prints the saved section alone, with no remote read, and takes none
 of the remote's selectors or filters. When nothing selects or filters the
 remote and it cannot be read, the saved reports are still listed under a
@@ -727,7 +727,7 @@ hyp sync [instance] [--history <client>] [--yes] [--dry-run]
 
 Prints a destination and exclusion plan, confirms it, then forces the selected
 sink or every configured sink to export. `--dry-run` sends nothing. On a newly
-enrolled machine, an interactive all-destination sync can release the
+enrolled host, an interactive all-destination sync can release the
 first-sync review hold early. A single-instance sync can't release that hold.
 
 `--history <client>` is a separate mode: it previews and, after its own
@@ -1352,7 +1352,7 @@ hyp privacy show . --json
 hyp privacy set <path> sync|local-only|ignore
 ```
 
-Upserts an exact machine-local path marking. It doesn't write a dotfile or
+Upserts an exact host-local path marking. It doesn't write a dotfile or
 delete rows. An `ignore` marking prints a line naming
 `hyp privacy purge --ignored`, which deletes what was already recorded in
 every ignored folder.
@@ -1367,7 +1367,7 @@ hyp privacy set ./private-research local-only
 hyp privacy unset <path> [sync|local-only|ignore]
 ```
 
-Removes machine-local entries governing the path. Add a class to remove only
+Removes host-local entries governing the path. Add a class to remove only
 entries of that class. The operation is idempotent and doesn't delete rows.
 
 ```sh
@@ -1380,7 +1380,7 @@ hyp privacy unset ./private-research local-only
 hyp privacy list [--json]
 ```
 
-Lists machine-local path and client policy plus the new-folder prompt
+Lists host-local path and client policy plus the new-folder prompt
 preference. It can't globally enumerate `.hypignore` files; use
 `hyp privacy show PATH` for a specific path.
 
@@ -1397,7 +1397,7 @@ hyp privacy ignore [path]
 Writes a shareable `.hypignore` file in an existing directory at the explicit
 path. With no path, uses
 the repository root, or the current directory when outside a repository.
-Use `hyp privacy set <path> sync|local-only|ignore` for machine-local markings
+Use `hyp privacy set <path> sync|local-only|ignore` for host-local markings
 and `hyp privacy show [path]` to report without writing. The receipt names
 `hyp privacy purge --ignored` to delete what was already recorded in ignored
 folders.
@@ -1413,7 +1413,7 @@ hyp privacy unignore [path]
 ```
 
 Removes the nearest governing `.hypignore`. Use `hyp privacy unset <path>`
-to remove machine-local markings. It does not remove cached rows.
+to remove host-local markings. It does not remove cached rows.
 
 ```sh
 hyp privacy unignore ./customer-data
@@ -1455,7 +1455,7 @@ hyp privacy purge <path> | --session <id> [--remote <target> | --local-only] | -
 ```
 
 **Warning:** This operation permanently deletes matching rows from this
-machine's local cache. Select exactly one target. Every form also sweeps the
+host's local cache. Select exactly one target. Every form also sweeps the
 Claude raw-body spool so pending bodies can't recreate deleted rows. A terminal
 prompts for confirmation; a non-interactive call requires `--yes`.
 
@@ -1543,7 +1543,7 @@ Installs the persistent launchd or systemd user service. When invoked from an
 ephemeral `npx` path, it installs a durable global package before it writes the
 service. `--force` allows the existing CLI path if that global installation
 fails; removing that directory later can break capture. `--dry-run` renders
-the exact service definition without changing the machine; add `--json` for
+the exact service definition without changing the host; add `--json` for
 structured plan output.
 
 ```sh
@@ -1931,13 +1931,13 @@ hyp remote login [name] [--token-file <path>] [--org <org>] [--host <label>] [--
 Signs in through a browser by default, or reads a static token from
 `--token-file` or standard input. It stores the credential with mode `0600`.
 Omit `name` to sign in to the default target. Unless you set `--no-forward`,
-login can enroll this machine, set up sync, and install the daemon.
+login can enroll this host, set up sync, and install the daemon.
 
 - `--org <org>` selects an organization.
 - `--browser` forces browser sign-in when stdin is piped, unless an explicit
   `--token-file` is supplied.
 - `--no-browser` prints the sign-in URL instead of opening a browser.
-- `--host <label>` overrides the host label this machine syncs under, which defaults to the
+- `--host <label>` overrides the host label this host syncs under, which defaults to the
   hostname.
 - `--no-forward` signs in for queries only, with no organization enrollment.
 - `--no-daemon` sets up sync without installing the service.
@@ -1957,9 +1957,11 @@ hyp remote mint [name] [--scope query] [--label <label>] [--expires-days <n>]
 Mints a long-lived CI enrollment token from your logged-in session and prints
 it once, for pasting into CI secrets. It requires a session stored by
 `hyp remote login`. Omit `name` to mint against the default target.
-`--label` names the gateway the token is bound to, and `--expires-days`
+`--label` names the host the token is bound to, and `--expires-days`
 overrides the 365-day default. Every CI run that joins with the token shares
-that one gateway, and the token itself never rotates.
+that one host record, and the token itself never rotates. Mint prints its
+id on standard error, shown as gateway in the current CLI output; this is the
+host record.
 
 ```sh
 hyp remote mint team --label repo-ci --expires-days 90

docs/CONFIGURATION.md

@@ -20,7 +20,7 @@ To disable automatic updates, set `"auto_update": false` and restart the daemon.
 Organization policy may control this setting. Each plugin owns its own `config` block. Use
 `hyp plugin info PLUGIN` to inspect an installed plugin's manifest.
 
-On an enrolled machine, a separate central layer under `config-control/` is
+On an enrolled host, a separate central layer under `config-control/` is
 authoritative. Local settings are additive and cannot override central locks.
 `hyp status --verbose` identifies each layer and any rejected local entries.
 Joining does not replace your local configuration; leaving removes central
@@ -85,7 +85,7 @@ from that cache, not a prerequisite for querying it.
 
 These `--export` flags select unattended setup; they are not extra choices
 inside the guided walkthrough. New guided setups default to local Parquet
-exports; interactive reconfiguration preserves the existing export choice. An enrolled machine may also have a
+exports; interactive reconfiguration preserves the existing export choice. An enrolled host may also have a
 centrally managed sync sink regardless of its local export choice.
 
 For previewing destinations and sending recordings now, see

docs/MCP.md

@@ -9,7 +9,7 @@ ways to connect:
   `hyp` installed and uses your own sign-in. No token is involved.
 - **Remote:** the client connects over HTTPS to your team's server at
   `/v1/mcp` and sends an agent token. Use it for cloud agents, CI jobs, and
-  any client that has no `hyp` on its machine.
+  any client that has no `hyp` on its host.
 
 > **Tip:** At your own computer, use the local setup, even to reach your
 > team's history: `hyp mcp serve --remote` uses the session you already

docs/MCP_REFERENCE.md

@@ -4,7 +4,7 @@
 
 HypAware serves MCP in two places:
 
-- `hyp mcp serve`, over stdio, for an agent on your machine. It lists the tools core and your active plugins register.
+- `hyp mcp serve`, over stdio, for an agent on your host. It lists the tools core and your active plugins register.
 - hypaware-server's `/v1/mcp`, over HTTP, for an agent with a member session or an agent token. What it lists depends on the credential.
 
 Every tool below has a CLI command that does the same thing. Each tool's `tools/list` entry carries its title, description, input schema and hints, as shown here.

docs/PRIVACY.md

@@ -1,6 +1,6 @@
 # What HypAware records, and how to control it
 
-HypAware records AI activity on your machine. This page explains what is
+HypAware records AI activity on your host. This page explains what is
 captured, where it goes, and how to control it. If your team is rolling
 HypAware out, read this page before you enroll.
 
@@ -43,7 +43,7 @@ transcripts under `~/.claude/projects`.
 
 Spool cleanup works as follows:
 
-- A session you ignored, by `.hypignore`, by a machine-local marking, or with
+- A session you ignored, by `.hypignore`, by a host-local marking, or with
   `hyp session ignore`, has its bodies **deleted unread**, not skipped.
 - The default cap is 512 MB, configured as `telemetry.spool_max_bytes` in
   the `@hypaware/claude` plugin's config. The listener and Claude hooks enforce
@@ -56,8 +56,8 @@ Spool cleanup works as follows:
 ### Proxy mode and certificate cleanup
 
 Claude Code uses OTEL capture by default. An explicitly configured proxy routes
-HTTPS through the local gateway. The gateway decrypts hosts named by the
-configured capture adapters; other hosts are tunneled without decryption.
+HTTPS through the local gateway. The gateway decrypts AI provider hosts named
+by the configured capture adapters; other hosts are tunneled without decryption.
 Only supported provider API requests are recorded.
 
 The proxy's local certificate authority (CA) is stored under
@@ -101,7 +101,7 @@ organization unless you saved a preference. It is separate from session recordin
 
 Every directory subtree resolves to one class. Starting at the session's
 working directory, HypAware uses the nearest ancestor `.hypignore` file and
-the most-specific matching machine-local marking. It then takes the most
+the most-specific matching host-local marking. It then takes the most
 restrictive result across those sources: `ignore`, then `local-only`, then
 `sync`. This is not a merge of every ancestor file.
 
@@ -111,7 +111,7 @@ restrictive result across those sources: `ignore`, then `local-only`, then
 | `local-only` | yes              | never                        |
 | `ignore`     | never            | never                        |
 
-`local-only` rows stay fully queryable on your own machine; they are
+`local-only` rows stay fully queryable on your own host; they are
 withheld at the export seam, so no sink or remote query can see them.
 
 ## Marking directories
@@ -129,8 +129,8 @@ There are two authoring surfaces for the same classes:
 
   An empty or comment-only `.hypignore` also means `ignore`.
 
-- **A machine-local store** (`hyp privacy`) records the class privately on
-  this machine, never as a file in the repo. Use it when the marking itself
+- **A host-local store** (`hyp privacy`) records the class privately on
+  this host, never as a file in the repo. Use it when the marking itself
   is sensitive (a dotfile in a hidden directory is a breadcrumb pointing at
   exactly the thing you are hiding), or when the path is not a repo:
 
@@ -139,11 +139,11 @@ There are two authoring surfaces for the same classes:
   hyp privacy set <path> local-only    # recorded, never synced
   hyp privacy set <path> sync          # explicitly synced (not asked again)
   hyp privacy show [path]              # which class governs, and why
-  hyp privacy list                     # every machine-local entry
+  hyp privacy list                     # every host-local entry
   hyp privacy unset <path> [class]     # back to the implicit default
   ```
 
-On a machine connected to HypAware Cloud, folders you have not marked sync
+On a host connected to HypAware Cloud, folders you have not marked sync
 without asking. You can instead be asked, once per new folder, how to
 handle it, at the moment you open a session there:
 
@@ -155,9 +155,9 @@ hyp privacy folders        # report which is in force
 
 This gates the question only. In either setting, folders you already
 marked keep their class, `.hypignore` files are unaffected, and nothing
-already local-only or ignored starts syncing. The setting is machine-local
+already local-only or ignored starts syncing. The setting is host-local
 and reversible, `hyp setup` asks for it in its own step, and `hyp status`
-names it on an enrolled machine.
+names it on an enrolled host.
 
 Three caveats apply to both surfaces:
 
@@ -186,7 +186,7 @@ for them.
 
 ## Control a whole client's sharing
 
-Keep a locally configured client's recordings on this machine:
+Keep a locally configured client's recordings on this host:
 
 ```sh
 hyp privacy client codex local-only
@@ -237,7 +237,7 @@ to delete previously captured rows.
 
 ## Deleting what was already recorded
 
-`hyp privacy purge` permanently deletes rows from this machine's local cache:
+`hyp privacy purge` permanently deletes rows from this host's local cache:
 
 ```sh
 hyp privacy purge <path>          # rows whose cwd is at or under the path
@@ -248,14 +248,14 @@ hyp privacy purge --all           # everything, wholesale
 
 It prompts on a TTY; pass `--yes` for non-interactive use.
 
-> **Caution:** A session purge is the only form that reaches beyond this machine. It also
+> **Caution:** A session purge is the only form that reaches beyond this host. It also
 > deletes that session's rows from every configured or signed-in remote and
 > every enrolled server, and keeps the session from being recorded again. The
 > confirmation prompt names the servers it will contact:
 
 ```sh
-hyp privacy purge --session <id> --remote <target>  # this machine and one server
-hyp privacy purge --session <id> --local-only       # this machine only
+hyp privacy purge --session <id> --remote <target>  # this host and one server
+hyp privacy purge --session <id> --local-only       # this host only
 ```
 
 Deleting on a server uses your login, and needs you to be the session's owner
@@ -275,13 +275,13 @@ next batch write back rows you just deleted.
 ## Review before the first Cloud sync
 
 Before sharing recordings, review captured directories with the
-`hypaware-privacy` skill in Claude Code or Codex. It checks this machine's local
+`hypaware-privacy` skill in Claude Code or Codex. It checks this host's local
 cache, samples recordings, and proposes directory markings and deletions for
 your confirmation. A review cannot guarantee it will find every secret, and it
 does not automatically redact all recorded content. You can run it at any time,
 even without Cloud enrollment.
 
-<!-- agent: Run the hypaware-privacy skill: review what this machine has recorded, sample it, and propose which folders to mark local-only or ignore before anything syncs. Do not delete anything without asking me. -->
+<!-- agent: Run the hypaware-privacy skill: review what this host has recorded, sample it, and propose which folders to mark local-only or ignore before anything syncs. Do not delete anything without asking me. -->
 ```sh
 hyp privacy show
 hyp privacy list
@@ -290,8 +290,8 @@ hyp privacy list
 For the enrollment hold, deadline, and unattended behavior, see
 [the first-sync review](TEAM_SETUP.md#review-before-the-first-upload).
 
-For disconnecting a machine while retaining its local recordings, see
-[Cloud and teams](TEAM_SETUP.md#disconnect-a-machine).
+For disconnecting a host while retaining its local recordings, see
+[Cloud and teams](TEAM_SETUP.md#disconnect-a-host).
 
 ## The daemon's own telemetry
 
@@ -311,7 +311,7 @@ separate; see [data paths](CONFIGURATION.md#know-where-data-lives).
 
 Product telemetry reports how HypAware itself is running. It is enabled for an
 enrolled organization unless you saved an `off` or `local` preference. An
-already-enrolled machine starts reporting on its next CLI run or daemon start
+already-enrolled host starts reporting on its next CLI run or daemon start
 after an upgrade, without a new prompt. Standalone installations default to off.
 Check the effective state and destination:
 
@@ -320,7 +320,7 @@ Check the effective state and destination:
 hyp telemetry status
 ```
 
-Organization telemetry goes to the HypAware server this machine is enrolled
+Organization telemetry goes to the HypAware server this host is enrolled
 with, using its existing enrollment. The CLI does not send telemetry anywhere
 else. The server also copies the HypAware version, OS family, and configured
 client names to PostHog for product analytics, where they are kept until