hasna · andrei-hasna · Jul 23, 2026 · Jul 23, 2026 · Jul 23, 2026 · Jul 23, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -92,14 +92,14 @@ jobs:
           target: runner
           platforms: linux/arm64
           load: true
-          tags: openloops-ci:${{ github.sha }}
+          tags: loops-ci:${{ github.sha }}
           provenance: false
           sbom: false
 
       - name: Scan runner image
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
         with:
-          image-ref: openloops-ci:${{ github.sha }}
+          image-ref: loops-ci:${{ github.sha }}
           vuln-type: os,library
           severity: CRITICAL,HIGH
           ignore-unfixed: true

diff --git a/.github/workflows/ecr-candidate.yml b/.github/workflows/ecr-candidate.yml
@@ -102,9 +102,9 @@ jobs:
             --load \
             --label "org.opencontainers.image.revision=${SOURCE_SHA}" \
             --label "org.opencontainers.image.source=https://github.com/${GITHUB_REPOSITORY}" \
-            --tag "openloops-candidate:${SOURCE_SHA}" \
+            --tag "loops-candidate:${SOURCE_SHA}" \
             .
-          local_image_id="$(docker image inspect --format '{{.Id}}' "openloops-candidate:${SOURCE_SHA}")"
+          local_image_id="$(docker image inspect --format '{{.Id}}' "loops-candidate:${SOURCE_SHA}")"
           if [[ ! "${local_image_id}" =~ ^sha256:[0-9a-f]{64}$ ]]; then
             echo "built image did not produce a valid local image id" >&2
             exit 1
@@ -114,7 +114,7 @@ jobs:
       - name: Generate local vulnerability report
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
-          image-ref: openloops-candidate:${{ inputs.source_sha }}
+          image-ref: loops-candidate:${{ inputs.source_sha }}
           format: json
           output: trivy-local.json
           scanners: vuln
@@ -142,9 +142,9 @@ jobs:
       - name: Generate CycloneDX SBOM
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
-          image-ref: openloops-candidate:${{ inputs.source_sha }}
+          image-ref: loops-candidate:${{ inputs.source_sha }}
           format: cyclonedx
-          output: openloops-candidate.sbom.cdx.json
+          output: loops-candidate.sbom.cdx.json
           scanners: vuln
           vuln-type: os,library
           exit-code: "0"
@@ -154,7 +154,7 @@ jobs:
         with:
           aws-region: ${{ vars.AWS_REGION }}
           role-to-assume: ${{ vars.AWS_ROLE_ARN }}
-          role-session-name: openloops-ecr-${{ github.run_id }}
+          role-session-name: loops-ecr-${{ github.run_id }}
           role-duration-seconds: 1800
           mask-aws-account-id: true
           unset-current-credentials: true
@@ -199,7 +199,7 @@ jobs:
         run: |
           set -Eeuo pipefail
           image_uri="${ECR_REGISTRY}/${ECR_REPOSITORY}:${CANDIDATE_TAG}"
-          docker tag "openloops-candidate:${SOURCE_SHA}" "${image_uri}"
+          docker tag "loops-candidate:${SOURCE_SHA}" "${image_uri}"
           docker push "${image_uri}"
 
           remote_digest=""
@@ -341,7 +341,7 @@ jobs:
                   metadata: {invocationId: ($run_id + ":" + $run_attempt)}
                 }
               }
-            }' > openloops-candidate.provenance.json
+            }' > loops-candidate.provenance.json
 
       - name: Upload candidate evidence
         if: ${{ always() }}
@@ -350,8 +350,8 @@ jobs:
           name: ecr-candidate-${{ github.run_id }}
           path: |
             trivy-local.json
-            openloops-candidate.sbom.cdx.json
-            openloops-candidate.provenance.json
+            loops-candidate.sbom.cdx.json
+            loops-candidate.provenance.json
             ecr-scan-counts.json
           if-no-files-found: warn
           retention-days: 30

diff --git a/.github/workflows/shared-database-transfer.yml b/.github/workflows/shared-database-transfer.yml
@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       confirmation:
-        description: Type "transfer openloops shared source" to run the protected ECS task
+        description: Type "transfer loops shared source" to run the protected ECS task
         required: true
         type: string
 
@@ -36,8 +36,8 @@ jobs:
         shell: bash
         run: |
           set -Eeuo pipefail
-          if [[ "${CONFIRMATION}" != "transfer openloops shared source" ]]; then
-            echo "confirmation must exactly match: transfer openloops shared source" >&2
+          if [[ "${CONFIRMATION}" != "transfer loops shared source" ]]; then
+            echo "confirmation must exactly match: transfer loops shared source" >&2
             exit 1
           fi
           for name in AWS_REGION AWS_ROLE_ARN ECS_CLUSTER_ARN ECS_TASK_DEFINITION_ARN ECS_SUBNET_IDS ECS_SECURITY_GROUP_IDS; do
@@ -52,7 +52,7 @@ jobs:
         with:
           aws-region: ${{ vars.AWS_REGION }}
           role-to-assume: ${{ vars.AWS_ROLE_ARN }}
-          role-session-name: openloops-db-transfer-${{ github.run_id }}
+          role-session-name: loops-db-transfer-${{ github.run_id }}
           role-duration-seconds: 3600
           mask-aws-account-id: true
           unset-current-credentials: true

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,19 @@ documented in this file. Version entries are generated from the
 conventional-commit git history; one commit maps to one released patch version
 unless noted.
 
+## Unreleased
+
+### Changed
+
+- **Canonical identity:** current SDK, MCP, workflow, CLI, artifact, schema,
+  test, CI, container, and documentation output now uses `Loops`, `loops`, or
+  `@hasna/loops` as appropriate.
+- **Bounded migration compatibility:** legacy persisted inputs remain readable
+  behind an exact counted allowlist with documented removal conditions.
+  PostgreSQL migration `0013_loops_identity_aliases` adds canonical functions,
+  settings, policies, trigger names, and a ledger view without rewriting the
+  released physical checksum authority.
+
 ## 0.4.29 (2026-07-21)
 
 This source release gives the post-`npm/loops/v0.4.28` code line a new,

diff --git a/README.md b/README.md
@@ -123,6 +123,10 @@ without memberships until migration `0010_tenant_enforce` has landed. After
 If PostgreSQL 16 implicit creator memberships cannot be normalized, the
 reconciler fails before publishing app credentials.
 
+Those role names are retained provider capability identifiers, not current
+product branding. Their bounded compatibility and provider-owned removal gate
+are documented in [`docs/IDENTITY-MIGRATION.md`](docs/IDENTITY-MIGRATION.md).
+
 ## Install
 
 **Loops requires the [Bun](https://bun.sh) runtime (`bun >= 1.0`).** The
@@ -755,8 +759,8 @@ resolved in the intended Todos store, the workflow fails before repo-mutating
 agent work starts.
 The lifecycle template adds deterministic gates after triage and planning. If
 either step marks the task blocked, omits its contextual
-`openloops:triage=go task=<id> event=<event-id>` /
-`openloops:planner=go task=<id> event=<event-id>` marker comment, or the task
+`loops:triage=go task=<id> event=<event-id>` /
+`loops:planner=go task=<id> event=<event-id>` marker comment, or the task
 is blocked/completed/done/cancelled/failed/archived/no-auto/manual/
 approval-required, the worker step is not started. Use
 `--triage-auth-profile`, `--planner-auth-profile`, `--worker-auth-profile`, and
@@ -863,7 +867,7 @@ loops routes schedule todos-task oss-task-route-drain \
   --max-per-profile 2 \
   --launch-gate "pa19-controlled-launch" \
   --launch-gate-blocker "$HOME/workspace/example/opensource/open-codewith::2d9d931b" \
-  --launch-gate-blocker "$HOME/workspace/example/opensource/open-loops::816e99db" \
+  --launch-gate-blocker "$HOME/workspace/example/opensource/loops::816e99db" \
   --worktree-mode required \
   --evidence-dir "$HOME/.hasna/loops/reports/oss-task-route-drain" \
   --compact
@@ -943,8 +947,8 @@ const binding = openAutomationsRuntimeBinding();
 ```
 
 ```bash
-automations queue claim --runner open-loops:<worker-id>
-automations queue complete <action-id> --runner open-loops:<worker-id>
+automations queue claim --runner loops:<worker-id>
+automations queue complete <action-id> --runner loops:<worker-id>
 ```
 
 For explicit event workflow routing, OpenAutomations can export the normalized
@@ -1001,8 +1005,8 @@ work.
 Loops can turn long-form media or meeting transcripts into recurring workflow work when paired with `iapp-transcriber`. The template at `docs/workflows/transcript-feedback-to-loops.json` transcribes an authorized media URL, asks an agent to extract recurring loop candidates, authors workflow specs, and validates generated workflows before scheduling. Copy it into the target repo, replace `/path/to/repo` with that repo's absolute path, and provide `TRANSCRIBER_SOURCE_URL` through the runner environment or a private, uncommitted workflow copy before storing or scheduling it. Do not commit private or signed media URLs.
 
 ```bash
-loops workflows validate /path/to/repo/.openloops/transcript-feedback-to-loops.json --preflight
-loops workflows create /path/to/repo/.openloops/transcript-feedback-to-loops.json
+loops workflows validate /path/to/repo/.loops/transcript-feedback-to-loops.json --preflight
+loops workflows create /path/to/repo/.loops/transcript-feedback-to-loops.json
 loops workflows run transcript-feedback-to-loops --show-output
 ```
 
@@ -1038,7 +1042,7 @@ loops health route-tasks --project ~/.hasna/loops --task-list loop-error-self-he
 loops hygiene names --json
 loops hygiene duplicates --json
 loops hygiene scripts --json
-loops hygiene route-tasks --checks duplicates,scripts --project ~/.hasna/loops --task-list openloops-hygiene
+loops hygiene route-tasks --checks duplicates,scripts --project ~/.hasna/loops --task-list loops-hygiene
 ```
 
 `health` and `expectations` classify latest-run failures with stable