chore: repoint repository references and fix npm publish permissions

.github/CODEOWNERS

@@ -1,4 +1,4 @@
 # Lines starting with '#' are comments.
 # Each line is a file pattern followed by one or more owners.
 
-*                                    @MetaMask/ocap-kernel
+*                                    @Consensys-Incorporated/ocap-kernel

.github/workflows/main.yml

@@ -130,23 +130,6 @@ jobs:
         run: ${{ steps.download-actionlint.outputs.executable }} -color
         shell: bash
 
-  analyse-code:
-    name: Code scanner
-    needs: [check-skip-merge-queue, check-workflows, detect-changes]
-    if: |
-      always()
-      && needs.check-skip-merge-queue.outputs.skip-merge-queue != 'true'
-      && needs.detect-changes.outputs.has-code == 'true'
-      && needs.check-workflows.result != 'failure'
-    uses: ./.github/workflows/security-code-scanner.yml
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-    secrets:
-      SECURITY_SCAN_METRICS_TOKEN: ${{ secrets.SECURITY_SCAN_METRICS_TOKEN }}
-      APPSEC_BOT_SLACK_WEBHOOK: ${{ secrets.APPSEC_BOT_SLACK_WEBHOOK }}
-
   lint-build-test:
     name: Lint, build, and test
     needs: [check-skip-merge-queue, check-workflows, detect-changes]
@@ -219,12 +202,14 @@ jobs:
     name: Publish release
     needs: is-release
     if: needs.is-release.outputs.IS_RELEASE == 'true'
+    # A called workflow's jobs cannot request more than the caller grants, and
+    # an enumerated block sets every unlisted scope to `none`.
     permissions:
       contents: write
+      id-token: write
     uses: ./.github/workflows/publish-release.yml
     secrets:
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
 
   all-jobs-complete:
     name: All jobs complete
@@ -234,7 +219,6 @@ jobs:
       - detect-changes
       - check-skip-merge-queue
       - check-workflows
-      - analyse-code
       - lint-build-test
       - lint-only
     outputs:
@@ -247,7 +231,6 @@ jobs:
             detect-changes=${{ needs.detect-changes.result }}
             check-skip-merge-queue=${{ needs.check-skip-merge-queue.result }}
             check-workflows=${{ needs.check-workflows.result }}
-            analyse-code=${{ needs.analyse-code.result }}
             lint-build-test=${{ needs.lint-build-test.result }}
             lint-only=${{ needs.lint-only.result }}
         run: |

.github/workflows/publish-release.yml

@@ -5,8 +5,6 @@ on:
     secrets:
       NPM_TOKEN:
         required: true
-      SLACK_WEBHOOK_URL:
-        required: false
 
 jobs:
   publish-release:
@@ -34,6 +32,11 @@ jobs:
 
   publish-npm-dry-run:
     name: Dry run publish to NPM
+    # Deliberately no `id-token`: this job runs before the `npm-publish`
+    # approval gate, and an OIDC token is exchangeable at npm for a publish
+    # credential. Without one the action packs instead of publishing.
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     needs: publish-release
     steps:
@@ -48,13 +51,15 @@ jobs:
           name: publish-release-artifacts-${{ github.sha }}
       - name: Dry run publish to NPM
         uses: MetaMask/action-npm-publish@v6
-        with:
-          slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
-          subteam: S042S7RE4AE # @metamask-npm-publishers
 
   publish-npm:
     name: Publish to NPM
     environment: npm-publish
+    # For packages that already exist on npm, `action-npm-publish` unsets the
+    # auth token and publishes via OIDC, degrading to `yarn pack` without one.
+    permissions:
+      contents: read
+      id-token: write
     runs-on: ubuntu-latest
     needs: publish-npm-dry-run
     steps:

docs/usage.md

@@ -474,7 +474,7 @@ export function buildRootObject(vatPowers, parameters, _baggage) {
 
 For more detailed information about the technology underlying the OCAP Kernel:
 
-- [Notes On The Design Of An Ocap Kernel](https://github.com/MetaMask/ocap-kernel/wiki/Notes-On-The-Design-Of-An-Ocap-Kernel)
+- [Notes On The Design Of An Ocap Kernel](https://github.com/Consensys-Incorporated/ocap-kernel/wiki/Notes-On-The-Design-Of-An-Ocap-Kernel)
 - [Endo Documentation](https://github.com/endojs/endo/blob/master/README.md)
 - [SES (Secure ECMAScript)](https://github.com/endojs/endo/tree/master/packages/ses)
 - [Endo Marshal](https://github.com/endojs/endo/tree/master/packages/marshal)

package.json

@@ -4,7 +4,7 @@
   "private": true,
   "repository": {
     "type": "git",
-    "url": "https://github.com/MetaMask/ocap-kernel.git"
+    "url": "https://github.com/Consensys-Incorporated/ocap-kernel.git"
   },
   "type": "module",
   "files": [],

packages/agentmask/CHANGELOG.md

@@ -7,4 +7,4 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-[Unreleased]: https://github.com/MetaMask/ocap-kernel/
+[Unreleased]: https://github.com/Consensys-Incorporated/ocap-kernel/

packages/agentmask/README.md

@@ -6,4 +6,4 @@ The primary artifact is the OpenClaw plugin in [`openclaw-plugin-metamask/`](./o
 
 ## Contributing
 
-This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/MetaMask/ocap-kernel#readme).
+This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/Consensys-Incorporated/ocap-kernel#readme).

packages/agentmask/package.json

@@ -3,13 +3,13 @@
   "version": "0.0.0",
   "private": true,
   "description": "OpenClaw plugin for requesting and using MetaMask wallet capabilities via the OCAP kernel daemon",
-  "homepage": "https://github.com/MetaMask/ocap-kernel/tree/main/packages/agentmask#readme",
+  "homepage": "https://github.com/Consensys-Incorporated/ocap-kernel/tree/main/packages/agentmask#readme",
   "bugs": {
-    "url": "https://github.com/MetaMask/ocap-kernel/issues"
+    "url": "https://github.com/Consensys-Incorporated/ocap-kernel/issues"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/MetaMask/ocap-kernel.git"
+    "url": "https://github.com/Consensys-Incorporated/ocap-kernel.git"
   },
   "type": "module",
   "exports": {

packages/create-package/CHANGELOG.md

@@ -7,4 +7,4 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-[Unreleased]: https://github.com/MetaMask/ocap-kernel/
+[Unreleased]: https://github.com/Consensys-Incorporated/ocap-kernel/

packages/create-package/package.json

@@ -3,13 +3,13 @@
   "version": "0.0.0",
   "private": true,
   "description": "Monorepo-internal utility for creating new packages",
-  "homepage": "https://github.com/MetaMask/ocap-kernel/tree/main/packages/create-package#readme",
+  "homepage": "https://github.com/Consensys-Incorporated/ocap-kernel/tree/main/packages/create-package#readme",
   "bugs": {
-    "url": "https://github.com/MetaMask/ocap-kernel/issues"
+    "url": "https://github.com/Consensys-Incorporated/ocap-kernel/issues"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/MetaMask/ocap-kernel.git"
+    "url": "https://github.com/Consensys-Incorporated/ocap-kernel.git"
   },
   "type": "module",
   "exports": {

packages/evm-wallet-experiment/docs/setup-guide.md

@@ -28,7 +28,7 @@ This guide walks through setting up the OCAP evm-wallet on two devices:
 - The `ocap-kernel` monorepo cloned and built
 
 ```bash
-git clone https://github.com/MetaMask/ocap-kernel.git
+git clone https://github.com/Consensys-Incorporated/ocap-kernel.git
 ```
 
 - OpenClaw installed on the VPS (for the agent integration)

packages/evm-wallet-experiment/package.json

@@ -3,13 +3,13 @@
   "version": "0.0.0",
   "private": true,
   "description": "Capability-driven EVM wallet subcluster for the OCAP kernel",
-  "homepage": "https://github.com/MetaMask/ocap-kernel/tree/main/packages/evm-wallet-experiment#readme",
+  "homepage": "https://github.com/Consensys-Incorporated/ocap-kernel/tree/main/packages/evm-wallet-experiment#readme",
   "bugs": {
-    "url": "https://github.com/MetaMask/ocap-kernel/issues"
+    "url": "https://github.com/Consensys-Incorporated/ocap-kernel/issues"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/MetaMask/ocap-kernel.git"
+    "url": "https://github.com/Consensys-Incorporated/ocap-kernel.git"
   },
   "type": "module",
   "exports": {

packages/extension/README.md

@@ -47,4 +47,4 @@ To ensure proper type checking and autocompletion configure your IDE to use the
 
 ## Contributing
 
-This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/MetaMask/ocap-kernel#readme).
+This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/Consensys-Incorporated/ocap-kernel#readme).

packages/extension/package.json

@@ -5,7 +5,7 @@
   "description": "For running Ocap Kernel experiments in an extension environment",
   "repository": {
     "type": "git",
-    "url": "https://github.com/MetaMask/ocap-kernel.git"
+    "url": "https://github.com/Consensys-Incorporated/ocap-kernel.git"
   },
   "type": "module",
   "files": [

packages/kernel-agents-repl/CHANGELOG.md

@@ -7,4 +7,4 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-[Unreleased]: https://github.com/MetaMask/ocap-kernel/
+[Unreleased]: https://github.com/Consensys-Incorporated/ocap-kernel/

packages/kernel-agents-repl/README.md

@@ -14,4 +14,4 @@ or
 
 ## Contributing
 
-This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/MetaMask/ocap-kernel#readme).
+This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/Consensys-Incorporated/ocap-kernel#readme).

packages/kernel-agents-repl/package.json

@@ -3,13 +3,13 @@
   "version": "0.0.0",
   "private": true,
   "description": "REPL strategy for capability-enabled, language-model-flow-controlled programming",
-  "homepage": "https://github.com/MetaMask/ocap-kernel/tree/main/packages/kernel-agents-repl#readme",
+  "homepage": "https://github.com/Consensys-Incorporated/ocap-kernel/tree/main/packages/kernel-agents-repl#readme",
   "bugs": {
-    "url": "https://github.com/MetaMask/ocap-kernel/issues"
+    "url": "https://github.com/Consensys-Incorporated/ocap-kernel/issues"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/MetaMask/ocap-kernel.git"
+    "url": "https://github.com/Consensys-Incorporated/ocap-kernel.git"
   },
   "type": "module",
   "exports": {

packages/kernel-agents/CHANGELOG.md

@@ -15,4 +15,4 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **BREAKING:** Remove the `capability()` authoring helper from `@ocap/kernel-agents/capabilities/capability`. Author capabilities as pattern-guarded discoverable exos (via the `described*()` combinators in `@metamask/kernel-utils`) and convert them with `discover`, so the exo's interface guard is the sole argument enforcer ([#960](https://github.com/MetaMask/ocap-kernel/pull/960))
 
-[Unreleased]: https://github.com/MetaMask/ocap-kernel/
+[Unreleased]: https://github.com/Consensys-Incorporated/ocap-kernel/

packages/kernel-agents/README.md

@@ -12,7 +12,7 @@ or
 
 ## Contributing
 
-This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/MetaMask/ocap-kernel#readme).
+This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/Consensys-Incorporated/ocap-kernel#readme).
 
 ## Running E2E Tests
 

packages/kernel-agents/package.json

@@ -3,13 +3,13 @@
   "version": "0.0.0",
   "private": true,
   "description": "Capability-enabled, language-model-flow-controlled programming",
-  "homepage": "https://github.com/MetaMask/ocap-kernel/tree/main/packages/kernel-agents#readme",
+  "homepage": "https://github.com/Consensys-Incorporated/ocap-kernel/tree/main/packages/kernel-agents#readme",
   "bugs": {
-    "url": "https://github.com/MetaMask/ocap-kernel/issues"
+    "url": "https://github.com/Consensys-Incorporated/ocap-kernel/issues"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/MetaMask/ocap-kernel.git"
+    "url": "https://github.com/Consensys-Incorporated/ocap-kernel.git"
   },
   "type": "module",
   "exports": {

packages/kernel-browser-runtime/CHANGELOG.md

@@ -95,10 +95,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Initial release.
 
-[Unreleased]: https://github.com/MetaMask/ocap-kernel/compare/@metamask/kernel-browser-runtime@0.6.0...HEAD
-[0.6.0]: https://github.com/MetaMask/ocap-kernel/compare/@metamask/kernel-browser-runtime@0.5.0...@metamask/kernel-browser-runtime@0.6.0
-[0.5.0]: https://github.com/MetaMask/ocap-kernel/compare/@metamask/kernel-browser-runtime@0.4.0...@metamask/kernel-browser-runtime@0.5.0
-[0.4.0]: https://github.com/MetaMask/ocap-kernel/compare/@metamask/kernel-browser-runtime@0.3.0...@metamask/kernel-browser-runtime@0.4.0
-[0.3.0]: https://github.com/MetaMask/ocap-kernel/compare/@metamask/kernel-browser-runtime@0.2.0...@metamask/kernel-browser-runtime@0.3.0
-[0.2.0]: https://github.com/MetaMask/ocap-kernel/compare/@metamask/kernel-browser-runtime@0.1.0...@metamask/kernel-browser-runtime@0.2.0
-[0.1.0]: https://github.com/MetaMask/ocap-kernel/releases/tag/@metamask/kernel-browser-runtime@0.1.0
+[Unreleased]: https://github.com/Consensys-Incorporated/ocap-kernel/compare/@metamask/kernel-browser-runtime@0.6.0...HEAD
+[0.6.0]: https://github.com/Consensys-Incorporated/ocap-kernel/compare/@metamask/kernel-browser-runtime@0.5.0...@metamask/kernel-browser-runtime@0.6.0
+[0.5.0]: https://github.com/Consensys-Incorporated/ocap-kernel/compare/@metamask/kernel-browser-runtime@0.4.0...@metamask/kernel-browser-runtime@0.5.0
+[0.4.0]: https://github.com/Consensys-Incorporated/ocap-kernel/compare/@metamask/kernel-browser-runtime@0.3.0...@metamask/kernel-browser-runtime@0.4.0
+[0.3.0]: https://github.com/Consensys-Incorporated/ocap-kernel/compare/@metamask/kernel-browser-runtime@0.2.0...@metamask/kernel-browser-runtime@0.3.0
+[0.2.0]: https://github.com/Consensys-Incorporated/ocap-kernel/compare/@metamask/kernel-browser-runtime@0.1.0...@metamask/kernel-browser-runtime@0.2.0
+[0.1.0]: https://github.com/Consensys-Incorporated/ocap-kernel/releases/tag/@metamask/kernel-browser-runtime@0.1.0

packages/kernel-browser-runtime/README.md

@@ -12,4 +12,4 @@ or
 
 ## Contributing
 
-This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/MetaMask/ocap-kernel#readme).
+This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/Consensys-Incorporated/ocap-kernel#readme).

packages/kernel-browser-runtime/package.json

@@ -7,13 +7,13 @@
     "object capabilities",
     "ocap"
   ],
-  "homepage": "https://github.com/MetaMask/ocap-kernel/tree/main/packages/kernel-browser-runtime#readme",
+  "homepage": "https://github.com/Consensys-Incorporated/ocap-kernel/tree/main/packages/kernel-browser-runtime#readme",
   "bugs": {
-    "url": "https://github.com/MetaMask/ocap-kernel/issues"
+    "url": "https://github.com/Consensys-Incorporated/ocap-kernel/issues"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/MetaMask/ocap-kernel.git"
+    "url": "https://github.com/Consensys-Incorporated/ocap-kernel.git"
   },
   "license": "(MIT OR Apache-2.0)",
   "sideEffects": false,

packages/kernel-cli/CHANGELOG.md

@@ -39,5 +39,5 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Initial release.
 
-[Unreleased]: https://github.com/MetaMask/ocap-kernel/compare/@metamask/kernel-cli@0.1.0...HEAD
-[0.1.0]: https://github.com/MetaMask/ocap-kernel/releases/tag/@metamask/kernel-cli@0.1.0
+[Unreleased]: https://github.com/Consensys-Incorporated/ocap-kernel/compare/@metamask/kernel-cli@0.1.0...HEAD
+[0.1.0]: https://github.com/Consensys-Incorporated/ocap-kernel/releases/tag/@metamask/kernel-cli@0.1.0

packages/kernel-cli/README.md

@@ -108,4 +108,4 @@ The daemon is a prototype. The following limitations apply:
 
 ## Contributing
 
-This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/MetaMask/ocap-kernel#readme).
+This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/Consensys-Incorporated/ocap-kernel#readme).

packages/kernel-cli/package.json

@@ -7,13 +7,13 @@
     "object capabilities",
     "ocap"
   ],
-  "homepage": "https://github.com/MetaMask/ocap-kernel/tree/main/packages/kernel-cli#readme",
+  "homepage": "https://github.com/Consensys-Incorporated/ocap-kernel/tree/main/packages/kernel-cli#readme",
   "bugs": {
-    "url": "https://github.com/MetaMask/ocap-kernel/issues"
+    "url": "https://github.com/Consensys-Incorporated/ocap-kernel/issues"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/MetaMask/ocap-kernel.git"
+    "url": "https://github.com/Consensys-Incorporated/ocap-kernel.git"
   },
   "license": "(MIT OR Apache-2.0)",
   "type": "module",