The name is lowercase ctrlrun, in prose and in what the terminal prints

.github/ISSUE_TEMPLATE/ambiguous-effect.yml

@@ -5,7 +5,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        `AMBIGUOUS` means nobody knows whether the remote acted, and CTRLRun refuses to guess. Most of the time that is the library doing its job: a timeout, a lost reply, a worker that died mid-call, or a lost connection during a store `COMMIT` all land here on purpose. This template is for the case where the events do not explain why, or where you believe the outcome was knowable.
+        `AMBIGUOUS` means nobody knows whether the remote acted, and ctrlrun refuses to guess. Most of the time that is the library doing its job: a timeout, a lost reply, a worker that died mid-call, or a lost connection during a store `COMMIT` all land here on purpose. This template is for the case where the events do not explain why, or where you believe the outcome was knowable.
 
         To move the record on: ask the remote what happened, then `ctrlrun resolve <effect_key> --committed` or `--failed`. A `reconcile` hook does the same automatically. Nothing else does.
   - type: input
@@ -41,4 +41,4 @@ body:
     id: expected
     attributes:
       label: What you expected, and why
-      description: If you believe the outcome was knowable at the time, say what CTRLRun could have observed that it did not.
+      description: If you believe the outcome was knowable at the time, say what ctrlrun could have observed that it did not.

.github/ISSUE_TEMPLATE/feature.yml

@@ -1,5 +1,5 @@
 name: Feature request
-description: Something CTRLRun should do that it does not.
+description: Something ctrlrun should do that it does not.
 labels: [enhancement]
 body:
   - type: markdown
@@ -25,7 +25,7 @@ body:
     id: situation
     attributes:
       label: The situation
-      description: What the agent does, what can go wrong, and what CTRLRun would need to refuse or record. Real domains help — money, infrastructure, permissions, records, communications.
+      description: What the agent does, what can go wrong, and what ctrlrun would need to refuse or record. Real domains help — money, infrastructure, permissions, records, communications.
     validations:
       required: true
   - type: textarea

.github/codeql/codeql-config.yml

@@ -14,7 +14,7 @@
 # five findings they produced were triaged individually and dismissed with a reason recorded in
 # the code-scanning tab.
 
-name: "CTRLRun Python"
+name: "ctrlrun Python"
 
 query-filters:
   # 79 findings, every one of them `...`. The Ellipsis literal is a statement with no effect, and

.github/workflows/traffic.yml

@@ -79,7 +79,7 @@ jobs:
             -H "X-GitHub-Api-Version: 2022-11-28" \
             "https://api.github.com/repos/$REPOSITORY/traffic/clones")
           if [ "$status" = "403" ] || [ "$status" = "404" ]; then
-            echo "::warning::TRAFFIC_TOKEN cannot read $REPOSITORY traffic (HTTP $status). It needs Administration: Read-only on this repository (fine-grained, resource owner CTRLRun) or the classic repo scope; a fine-grained token may also be waiting on org approval. The clones badge keeps its last value until then."
+            echo "::warning::TRAFFIC_TOKEN cannot read $REPOSITORY traffic (HTTP $status). It needs Administration: Read-only on this repository (fine-grained, resource owner ctrlrun) or the classic repo scope; a fine-grained token may also be waiting on org approval. The clones badge keeps its last value until then."
             echo "read=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi

.gitignore

@@ -21,7 +21,7 @@ venv/
 .ruff_cache/
 .coverage
 
-# CTRLRun local state (SPEC-v0.1 §5, §6)
+# ctrlrun local state (SPEC-v0.1 §5, §6)
 .ctrlrun/
 # Anchored: this ignores the operator's own policy at the repo root, which `ctrlrun init`
 # writes. Unanchored it matched every `ctrlrun.yaml` at any depth, which silently kept the

CITATION.cff

@@ -1,9 +1,9 @@
 cff-version: 1.2.0
-message: If you use CTRLRun in research, cite it as below.
+message: If you use ctrlrun in research, cite it as below.
 type: software
 title: "The last check before an AI agent does something it can't undo."
 abstract: >-
-  CTRLRun is the execution safety layer for AI agents: a Python library that binds a human's
+  ctrlrun is the execution safety layer for AI agents: a Python library that binds a human's
   approval to the exact action they saw, executes one logical effect at most once across
   processes and hosts, treats an unknown outcome as unknown rather than failed, fails closed,
   and leaves a portable receipt for every action.

CONTRIBUTING.md

@@ -1,6 +1,6 @@
 # Contributing
 
-CTRLRun sits in the execution path of actions that move money, delete infrastructure and
+ctrlrun sits in the execution path of actions that move money, delete infrastructure and
 grant permissions. The rules below exist so that a change to it is evidence rather than
 intention. They are short to state and long to live with.
 

GOVERNANCE.md

@@ -6,7 +6,7 @@ rules for a security report are in [SECURITY.md](SECURITY.md).
 
 ## Decisions
 
-CTRLRun is maintainer-led. The maintainer has the final say on scope, on what a
+ctrlrun is maintainer-led. The maintainer has the final say on scope, on what a
 specification says, and on whether a change merges or a release ships. A decision that
 changes a shipped guarantee is written into the specification and the changelog with its
 reason, never settled in a review comment. Disagreement is argued in public, in the issue or
@@ -17,7 +17,7 @@ fork under Apache-2.0; that is the check on the maintainer.
 
 | Role | Who | Responsibilities |
 |---|---|---|
-| Maintainer | Arpan Ghoshal ([@arpanghoshal](https://github.com/arpanghoshal)) | Owns the specifications and the roadmap. Final say on merges and releases. Answers security reports per SECURITY.md. Administers the `CTRLRun` GitHub organization, the `ctrlrun` project on PyPI, and ctrlrun.dev. |
+| Maintainer | Arpan Ghoshal ([@arpanghoshal](https://github.com/arpanghoshal)) | Owns the specifications and the roadmap. Final say on merges and releases. Answers security reports per SECURITY.md. Administers the `ctrlrun` GitHub organization, the `ctrlrun` project on PyPI, and ctrlrun.dev. |
 | Committer | Rohan Kamath ([@rohanrkamath](https://github.com/rohanrkamath)) | Reviews and merges pull requests, the maintainer's included. Can cut a release by pushing a tag. Triages issues. Holds write access to every repository in the organization. |
 | Contributor | anyone | Opens issues and pull requests under the rules in CONTRIBUTING.md, with every commit signed off under the DCO. |
 
@@ -34,7 +34,7 @@ makes that true:
   access. A release is a tag: `publish.yml` publishes to PyPI through trusted publishing and
   `release.yml` signs the provenance against the workflow's own identity, so no release
   depends on a key or a password that one person holds alone.
-- **Two people own the organization.** Both are owners of the `CTRLRun` GitHub organization,
+- **Two people own the organization.** Both are owners of the `ctrlrun` GitHub organization,
   so either can grant access, change a workflow, or answer a private vulnerability report.
 - **Two people own the package.** Both are owners of `ctrlrun` on PyPI, so the trusted
   publisher can be repaired by either.

README.md

@@ -1,18 +1,18 @@
 <p align="center">
   <picture>
     <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/CTRLRun/ctrlrun/main/docs/assets/wordmark-dark.svg">
-    <img src="https://raw.githubusercontent.com/CTRLRun/ctrlrun/main/docs/assets/wordmark-light.svg" alt="CTRLRun" width="300">
+    <img src="https://raw.githubusercontent.com/CTRLRun/ctrlrun/main/docs/assets/wordmark-light.svg" alt="ctrlrun" width="300">
   </picture>
 </p>
 
 <p align="center">
-  <strong>CTRLRun stops AI agents from taking wrong, restricted, or malicious actions in your workflows.</strong><br>
+  <strong>ctrlrun stops AI agents from taking wrong, restricted, or malicious actions in your workflows.</strong><br>
   Every action is checked against your rules before it runs. Allowed actions go through.<br>
   Sensitive ones wait for a person. Forbidden ones are blocked.<br>
   <br>
   Execution safety for AI agents. A Python library that sits between the decision to act and the call that acts.<br>
   A consequential action happens at most once, exactly as approved, and leaves a receipt.<br>
-  When the outcome is unknown, CTRLRun says so instead of guessing.<br>
+  When the outcome is unknown, ctrlrun says so instead of guessing.<br>
   <br>
   Runs in production on a single file, or on Postgres across hosts. Apache-2.0.
 </p>
@@ -27,7 +27,7 @@
   <a href="https://github.com/CTRLRun/ctrlrun/actions/workflows/codeql.yml"><img src="https://github.com/CTRLRun/ctrlrun/actions/workflows/codeql.yml/badge.svg?branch=main" alt="CodeQL"></a>
   <a href="https://github.com/CTRLRun/ctrlrun/actions/workflows/fuzz.yml"><img src="https://github.com/CTRLRun/ctrlrun/actions/workflows/fuzz.yml/badge.svg?branch=main" alt="Fuzz"></a>
   <a href="https://docs.ctrlrun.dev/how-this-is-built"><img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/CTRLRun/ctrlrun/badges/tests-badge.json" alt="Tests"></a>
-  <a href="https://docs.ctrlrun.dev/security/verify-guarantees"><img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/CTRLRun/ctrlrun/badges/verify-badge.json" alt="CTRLRun verified"></a>
+  <a href="https://docs.ctrlrun.dev/security/verify-guarantees"><img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/CTRLRun/ctrlrun/badges/verify-badge.json" alt="ctrlrun verified"></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/CTRLRun/ctrlrun"><img src="https://api.scorecard.dev/projects/github.com/CTRLRun/ctrlrun/badge" alt="OpenSSF Scorecard"></a>
   <a href="https://www.bestpractices.dev/projects/14615"><img src="https://www.bestpractices.dev/projects/14615/badge" alt="OpenSSF Best Practices"></a>
   <a href="https://github.com/CTRLRun/ctrlrun/blob/main/LICENSE"><img src="https://img.shields.io/pypi/l/ctrlrun?color=B8730A" alt="License"></a>
@@ -44,16 +44,16 @@ pip install ctrlrun && ctrlrun demo
 
 ## What it does
 
-**The model guesses. CTRLRun does not.** The ticket says refund €500. The agent asks for
+**The model guesses. ctrlrun does not.** The ticket says refund €500. The agent asks for
 €5,000, one extra zero. The tool is in its list, the arguments are well formed, and the model
 is completely confident. Nothing above the call disagrees, because nothing above the call is a
 check: a tool being callable is not permission to call it with those arguments.
 
-| Without CTRLRun | With CTRLRun |
+| Without ctrlrun | With ctrlrun |
 |---|---|
 | Nothing checks the amount. The call goes through. **€4,500 too much.** | Your rule checks the amount. The call never leaves. **€0 wrongly paid.** |
 
-CTRLRun is that check. It reads the arguments about to leave your process and answers what may
+ctrlrun is that check. It reads the arguments about to leave your process and answers what may
 happen to them: let it run, ask a human, or stop it cold. Four rules do the work, and each one
 is a test in this repository before it is a sentence here.
 
@@ -66,7 +66,7 @@ is a test in this repository before it is a sentence here.
 
 The third one is the half people forget. A correct €500 refund commits at the provider and the
 reply is lost coming back, so the agent retries. Retry libraries, agent frameworks and tool
-loops collapse *this failed* into *I do not know what happened*. CTRLRun keeps them apart: a
+loops collapse *this failed* into *I do not know what happened*. ctrlrun keeps them apart: a
 lost reply is `AMBIGUOUS`, never `FAILED`, and a retry against an `AMBIGUOUS` effect is refused
 until a human, or a `reconcile` hook, says what happened.
 
@@ -75,7 +75,7 @@ until a human, or a `reconcile` hook, says what happened.
 
 ```console
 $ ctrlrun demo
-CTRLRun demo — five ways an agent action goes wrong, and what stops it.
+ctrlrun demo — five ways an agent action goes wrong, and what stops it.
 Policy: refunds up to €1,000 are autonomous, up to €10,000 need a human, above that are denied.
 
 1. Duplicate effect after a lost response
@@ -139,7 +139,7 @@ compliant, certified or audited:
 · [`OWASP-AGENTIC-TOP10.md`](https://docs.ctrlrun.dev/OWASP-AGENTIC-TOP10)
 names the four entries this does not address.
 
-If an agent only reads and answers, you do not need CTRLRun. The moment it can **send, pay,
+If an agent only reads and answers, you do not need ctrlrun. The moment it can **send, pay,
 refund, delete, deploy, grant, revoke, approve, submit, purchase or cancel**, you do.
 
 ## Use it in three steps
@@ -293,7 +293,7 @@ that reaches its tools over MCP, in any language.
 | A framework with its own approval interrupt | an adapter | the framework to have a human-in-the-loop primitive |
 
 **It works with agents you can and can't modify.** WhatsApp, Slack and Teams bots, ChatGPT,
-Cursor, Codex, OpenAI Agents: any AI agent you have. CTRLRun checks the action, not the
+Cursor, Codex, OpenAI Agents: any AI agent you have. ctrlrun checks the action, not the
 agent, so if the agent acts through a tool server or an API you run, the action is checked, and
 the agent is not rebuilt, redeployed or told.
 [Agents you can't modify](https://docs.ctrlrun.dev/agents-you-cant-modify) says where the
@@ -376,7 +376,7 @@ grades the transport classifier.
 
 ## The same shape in nine domains
 
-Nothing in CTRLRun knows what a refund is. An action is a **name**, **canonical arguments**, an
+Nothing in ctrlrun knows what a refund is. An action is a **name**, **canonical arguments**, an
 **effect key** and a **resource**, and the three questions asked of it are the same whichever
 domain it came from: how much autonomy does *this action* get, did a human approve *this exact*
 action, and has this effect already happened. Two things carry your domain, and you write both.
@@ -405,7 +405,7 @@ action, and has this effect already happened. Two things carry your domain, and
 Read any row left to right and it is one rule wearing different nouns. The security row is the
 one to read twice: adding a **deny** rule to a firewall is autonomous and adding an **allow**
 rule is not, which no amount threshold would have told you. The policy is where your judgement
-about your domain gets written down; CTRLRun is what makes it hold.
+about your domain gets written down; ctrlrun is what makes it hold.
 
 ## Documentation
 

SECURITY.md

@@ -67,7 +67,7 @@ provenance and cannot be checked this way.
 
 ## Supported versions
 
-CTRLRun is pre-1.0. Only the latest release receives fixes.
+ctrlrun is pre-1.0. Only the latest release receives fixes.
 
 | Version | Supported |
 |---|---|
@@ -81,7 +81,7 @@ migration that cannot be reversed says so in its entry.
 
 ## What counts as a vulnerability
 
-CTRLRun sits in the execution path of consequential actions. Treat anything that breaks one of
+ctrlrun sits in the execution path of consequential actions. Treat anything that breaks one of
 these as a security issue, not a bug:
 
 - An action executes that policy should have denied.

VISION.md

@@ -12,15 +12,15 @@ That creates a new infrastructure question:
 
 **How much authority should a machine have over each consequential action — and how do we enforce it, prove it, and recover when execution goes wrong?**
 
-CTRLRun is the enforcement infrastructure between **intention** and **consequence**. Not between prompt and model.
+ctrlrun is the enforcement infrastructure between **intention** and **consequence**. Not between prompt and model.
 
 ## 2. Two concentric circles
 
-**Circle 1 — the wedge.** Agent executes payment → response lost → agent retries → CTRLRun refuses the blind retry. Narrow. Instantly understood. This is v0.1.
+**Circle 1 — the wedge.** Agent executes payment → response lost → agent retries → ctrlrun refuses the blind retry. Narrow. Instantly understood. This is v0.1.
 
 **Circle 2 — the product.** Action-level autonomy infrastructure: for each action, is it authorized, how much autonomy, is approval needed, was *this* action approved, is execution safe, did it already happen, what was the outcome. This is v0.2–v0.5.
 
-CTRLRun is consequence-specific, not industry-specific. If an agent only reads, searches, summarizes, or answers, CTRLRun is low value. It earns its place where an agent has write access to the real world.
+ctrlrun is consequence-specific, not industry-specific. If an agent only reads, searches, summarizes, or answers, ctrlrun is low value. It earns its place where an agent has write access to the real world.
 
 ## 3. End-state architecture
 
@@ -100,7 +100,7 @@ Delegation attenuates, never amplifies: `child ⊆ parent`. Human €100k → fi
 
 *Status: v0.6, as the kernel-side object a sector pack configures.*
 
-**Recovery** — declarative per-action `on_ambiguous: reconcile` / `on_failure: compensate`. CTRLRun coordinates safety semantics; it never becomes the workflow scheduler. Integrate with Temporal-class runtimes; don't recreate them.
+**Recovery** — declarative per-action `on_ambiguous: reconcile` / `on_failure: compensate`. ctrlrun coordinates safety semantics; it never becomes the workflow scheduler. Integrate with Temporal-class runtimes; don't recreate them.
 
 *Status: reconciliation shipped in v0.2 as a hook that resolves an `AMBIGUOUS` effect, and `ctrlrun resolve` is the human path. Compensation and sagas are not built and are on the do-not-build list.*
 
@@ -118,7 +118,7 @@ Align, don't invent: OWASP ACS, MCP, A2A, OAuth, OpenTelemetry, and NIST agent i
 
 **Full depth (a content track, after v0.6).** The same nine sectors, each with a control registry, approver roles, data scope, consequence defaults, and worked examples. It waits on v0.6 because that is where the control registry and data-scope primitives land, and a pack should be configuration rather than code; it waits on nothing else. Packs are released individually as `packs/<sector>/` under their own version tags — `packs-payments-1.0` and so on — never sharing a version with the kernel, never gating a kernel release and never gated by one. Kernel versions ship correctness; content ships on its own cadence.
 
-Each pack is authored in one AI session and reviewed in a separate AI session that did not author it, against cited public sources — PCI DSS, PSD2, the HIPAA Security Rule, SOX/COSO and maker-checker guidance, ABA Model Rules, NIST SP 800-53, CIS benchmarks, records-management and employment-law basics. The review ships with the pack as `REVIEW.md`, listing every control, the source clause it derives from, and every gap found; unresolved gaps stay listed rather than being quietly closed. A pack states that it was authored and reviewed by AI against those sources, and never describes itself as compliant with any regulation. That is a claim only an accountable human reviewer can make, and CTRLRun does not make it on anyone's behalf.
+Each pack is authored in one AI session and reviewed in a separate AI session that did not author it, against cited public sources — PCI DSS, PSD2, the HIPAA Security Rule, SOX/COSO and maker-checker guidance, ABA Model Rules, NIST SP 800-53, CIS benchmarks, records-management and employment-law basics. The review ships with the pack as `REVIEW.md`, listing every control, the source clause it derives from, and every gap found; unresolved gaps stay listed rather than being quietly closed. A pack states that it was authored and reviewed by AI against those sources, and never describes itself as compliant with any regulation. That is a claim only an accountable human reviewer can make, and ctrlrun does not make it on anyone's behalf.
 
 Same kernel, different `ctrlrun.yaml` and control registries.