scbrown · Oct 23, 2026 · Oct 21, 2026 · Oct 21, 2026 · Oct 23, 2026 · Oct 23, 2026
diff --git a/README.md b/README.md
@@ -55,6 +55,7 @@ tambo quickstart
 This saves a reviewed retrieval plan, installs Quipu, Camayoc and Bobbin, and
 checks each tool. Success is exit 0 and `quipu: verified`, `camayoc: verified`,
 `bobbin: verified`. Keep `caboodle-plan.toml` and `.caboodle/` to resume.
+See the [compatibility contracts](docs/book/src/compatibility.md) for retained aliases and state paths.
 Recheck the same install:
 
 ```bash

diff --git a/assets/footer.svg b/assets/footer.svg
diff --git a/assets/header.svg b/assets/header.svg
diff --git a/assets/logo.svg b/assets/logo.svg
diff --git a/docs/book/book.toml b/docs/book/book.toml
@@ -8,7 +8,7 @@ src = "src"
 [output.html]
 default-theme = "coal"
 preferred-dark-theme = "coal"
-# Keep working GitHub alias links until the repository rename is verified.
+# Canonical source links for the published Tambo book.
 git-repository-url = "https://github.com/intigraph/tambo"
 edit-url-template = "https://github.com/intigraph/tambo/edit/main/docs/book/{path}"
 additional-css = ["custom/css/custom.css"]

diff --git a/docs/book/custom/css/custom.css b/docs/book/custom/css/custom.css
@@ -1,7 +1,7 @@
 /* Intel One Mono font for code */
 @import url('https://fonts.googleapis.com/css2?family=Intel+One+Mono:wght@400;700&display=swap');
 
-/* Caboodle Documentation — Dracula Theme Override
+/* Tambo Documentation — Dracula Theme Override
    Applied to the Coal theme (default) */
 
 /* Dracula palette:

diff --git a/docs/book/src/SUMMARY.md b/docs/book/src/SUMMARY.md
@@ -5,8 +5,9 @@
 - [Getting started](getting-started.md)
 - [Installing and removing](installing.md)
   - [Installation and agent reference](installation-reference.md)
+  - [Compatibility](compatibility.md)
 - [Using it with agents](agents.md)
-- [Using Caboodle](using.md)
+- [Using Tambo](using.md)
 - [Reference](reference.md)
   - [Configuration](configuration.md)
 - [How it works](architecture.md)

diff --git a/docs/book/src/agents.md b/docs/book/src/agents.md
@@ -1,6 +1,6 @@
 # Using it with agents
 
-Caboodle is a CLI that an agent can run with the
+Tambo is a CLI that an agent can run with the
 [Tambo skill](https://github.com/intigraph/tambo/blob/main/skills/tambo/SKILL.md).
 It does not expose its own MCP server. MCP (Model Context Protocol) lets an
 agent call servers supplied by the installed tools.
@@ -28,7 +28,7 @@ in their client-specific server configuration.
 
 ## Managed crew
 
-For a configured Shantytown rig, `caboodle project-settings` delegates
+For a configured Shantytown rig, `tambo project-settings` delegates
 registration to Shantytown and its Quipu tooling manifest. It does not launch
 or restart agents. See [registering MCP servers](installing.md#registering-mcp-servers)
 for prerequisites, selection flags, remote proxies and the policy-only mode.
@@ -160,7 +160,7 @@ existing key file.
   or a symlink to one, is still present on the agent's machine, older clients may
   keep authenticating through it. They then never report the missing or rejected
   identity. Remove such fallbacks once every client uses its own key, and confirm
-  with `caboodle doctor`, which names the credential source in use.
+  with `tambo doctor`, which names the credential source in use.
 
 ### Worked example: enrolling an agent on a second host
 

diff --git a/docs/book/src/architecture.md b/docs/book/src/architecture.md
@@ -1,10 +1,10 @@
 # Architecture
 
-Caboodle's engine is a **plan → apply → verify** loop with a state file
+Tambo's engine is a **plan → apply → verify** loop with a state file
 recording what is installed *and last proven working*. Idempotent and
 resumable: re-running converges, and a failed step names itself.
 
-The wizard is an interview, not a form over install switches. `caboodle init
+The wizard is an interview, not a form over install switches. `tambo init
 --guided` first elicits intended use, themed crew-member identities/domains/roles,
 and the questions the installed graph must answer. Those answers become typed
 plan data and executable reader-path contracts. The engine therefore builds

diff --git a/docs/book/src/compatibility.md b/docs/book/src/compatibility.md
@@ -0,0 +1,12 @@
+# Compatibility
+
+The `caboodle` command remains an alias for `tambo`. Existing
+`caboodle-plan.toml`, `caboodle-intent.toml`, `.caboodle` state, `CABOODLE_*`
+environment variables, Rust crate imports and published vocabulary IRIs remain
+valid. These are compatibility contracts; renaming the product does not move
+installed state or rewrite stored graph identities.
+
+The release installer prefers a `tambo-` archive. Only an HTTP 404 selects a
+legacy `caboodle-` archive; checksum and transport failures never select a
+fallback. Existing package-manager identifiers remain valid until their own
+managed migration.
diff --git a/docs/book/src/configuration.md b/docs/book/src/configuration.md
@@ -1,6 +1,6 @@
 # Configuration reference
 
-Caboodle writes a reviewable TOML plan and a JSON progress file. Use the CLI to
+Tambo writes a reviewable TOML plan and a JSON progress file. Use the CLI to
 create the plan; keep credentials in the environment, never in intent text.
 The plan's schema rejects unknown keys.
 
@@ -94,8 +94,8 @@ installing a random token does not grant access.
 
 ```sh
 install -d -m 700 "$HOME/.config/quipu" && install -m 400 /secure/issued-token "$HOME/.config/quipu/token"
-caboodle provision-quipu-token --from /secure/issued-token --server https://your-quipu-server.example
-caboodle doctor
+tambo provision-quipu-token --from /secure/issued-token --server https://your-quipu-server.example
+tambo doctor
 ```
 
 `provision-quipu-token` proves the issued file against the authenticated server
@@ -118,7 +118,7 @@ accepted authorization, missing token, rejected token, read-only server, or an
 unknown write path (including no HTTP response). This is authorization evidence,
 not a successful storage commit. Doctor also requires a nonempty canonical file
 with mode `0400` and parent mode `0700`, and an authenticated `/shapes` read
-returning 2xx. `caboodle verify` runs that live credential proof before recording
+returning 2xx. `tambo verify` runs that live credential proof before recording
 Quipu as verified, then exercises installed tools in isolated scratch stores.
 Set `QUIPU_SERVER` to the intended server; without it, verify uses the plan's
 Quipu MCP URL or `http://localhost:3030`. Missing, rejected, or unproven
@@ -128,7 +128,7 @@ credentials leave verification incomplete. Public health is not an auth check.
 
 A Claude Code MCP entry for Quipu that holds only a URL sends no bearer. Reads
 work and every MCP write is refused with `missing_or_invalid_bearer_token`.
-`caboodle plan --quipu-mcp-url <server>` adds a reviewable `[quipu_mcp]` step.
+`tambo plan --quipu-mcp-url <server>` adds a reviewable `[quipu_mcp]` step.
 That step changes your Claude Code configuration, so it is opt-in.
 
 `apply` installs `~/.local/bin/quipu-mcp-headers` (mode 0755). Claude Code runs
@@ -188,13 +188,13 @@ agents pick up changed hooks on their next launch.
 ## Externally owned Quipu
 
 Set `external_quipu = true` in a reviewed plan when another mechanism owns
-Quipu installation. The default is false. Caboodle resolves `quipu` and
+Quipu installation. The default is false. Tambo resolves `quipu` and
 `quipu-server` from PATH, reads both versions, and records their canonical paths
 with the identity. It never installs, converges, or release-updates these files.
 Missing executables and incompatible versions fail; external ownership does not
 waive the isolated write/read round trip or hook registration checks. Other tools
 retain their managed-install and shadow checks. Build flavors are incompatible
-with external ownership because Caboodle does not build that installation.
+with external ownership because Tambo does not build that installation.
 
 Verify uses the resolved client for both the entity and vocabulary round trips.
 An external source build has to support those contracts; a version banner alone

diff --git a/docs/book/src/conventions.md b/docs/book/src/conventions.md
@@ -6,7 +6,7 @@ caboodle-ready by exposing the pattern the repos already follow:
 - conventional CLI verbs: `<tool> selftest`, `<tool> health`, `<tool> init`
 - and/or `just` recipes: `just install`, `just verify`
 
-Caboodle discovers and drives these directly. Metrics contracts live as
+Tambo discovers and drives these directly. Metrics contracts live as
 camayoc catalogue entries, not per-repo config. The readiness contract every
 corpus repo adopts:
 

diff --git a/docs/book/src/corpus.md b/docs/book/src/corpus.md
@@ -19,21 +19,21 @@ Every profile includes Quipu and can stage git-native knowledge shares into an
 explicit local database:
 
 ```console
-caboodle plan --profile retrieval \
+tambo plan --profile retrieval \
   --share ./team-knowledge \
   --share ./project-knowledge \
   --quipu-db ./knowledge.db
-caboodle apply --skip-install
+tambo apply --skip-install
 ```
 
 A share directory is the canonical output of `quipu share`: `manifest.json`,
-`export.nt`, and `shapes.ttl`. Caboodle does not parse, rewrite, unpack, or wrap
+`export.nt`, and `shapes.ttl`. Tambo does not parse, rewrite, unpack, or wrap
 those files. It invokes `quipu import <directory> --db <database>`, so Quipu
 owns payload-hash verification, identity candidates, local SHACL validation,
 and the staging/quarantine graph.
 
 The returned `share_id`, graph, outcome, promotion eligibility, and blockers
 are retained under `shares` in `.caboodle/state.json`. A quarantined import is
-a successful safe consumption outcome that still needs review; Caboodle never
+a successful safe consumption outcome that still needs review; Tambo never
 runs `quipu import promote`. Promotion into ROOT remains a separate explicit
 operator decision using the share ID.