diff --git a/Cargo.lock b/Cargo.lock
index a06495362..e3cd56113 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -287,6 +287,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b52af3cb4058c895d37317bb27508dccc8e5f2d39454016b297bf4a400597b8"
 dependencies = [
  "axum-core 0.5.6",
+ "base64 0.22.1",
  "bytes",
  "form_urlencoded",
  "futures-util",
@@ -305,8 +306,10 @@ dependencies = [
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
+ "sha1 0.10.6",
  "sync_wrapper",
  "tokio",
+ "tokio-tungstenite 0.28.0",
  "tower 0.5.3",
  "tower-layer",
  "tower-service",
@@ -2676,243 +2679,6 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084"
 
-[[package]]
-name = "navigator-bootstrap"
-version = "0.1.0"
-dependencies = [
- "base64 0.22.1",
- "bollard",
- "bytes",
- "futures",
- "miette",
- "rcgen",
- "serde",
- "serde_json",
- "serde_yaml",
- "tar",
- "tempfile",
- "tokio",
- "tracing",
-]
-
-[[package]]
-name = "navigator-cli"
-version = "0.1.0"
-dependencies = [
- "anyhow",
- "bytes",
- "clap",
- "clap_complete",
- "crossterm 0.28.1",
- "dialoguer",
- "futures",
- "http-body-util",
- "hyper",
- "hyper-rustls",
- "hyper-util",
- "indicatif",
- "miette",
- "navigator-bootstrap",
- "navigator-core",
- "navigator-policy",
- "navigator-providers",
- "navigator-tui",
- "owo-colors",
- "prost-types",
- "rcgen",
- "reqwest",
- "rustls",
- "rustls-pemfile",
- "serde",
- "serde_json",
- "serde_yaml",
- "tar",
- "tempfile",
- "thiserror 2.0.18",
- "tokio",
- "tokio-rustls",
- "tokio-stream",
- "tonic",
- "tracing",
- "tracing-subscriber",
- "url",
-]
-
-[[package]]
-name = "navigator-core"
-version = "0.1.0"
-dependencies = [
- "miette",
- "prost",
- "prost-types",
- "protobuf-src",
- "serde",
- "serde_json",
- "thiserror 2.0.18",
- "tonic",
- "tonic-build",
- "url",
-]
-
-[[package]]
-name = "navigator-policy"
-version = "0.1.0"
-dependencies = [
- "miette",
- "navigator-core",
- "serde",
- "serde_yaml",
-]
-
-[[package]]
-name = "navigator-providers"
-version = "0.1.0"
-dependencies = [
- "navigator-core",
- "thiserror 2.0.18",
-]
-
-[[package]]
-name = "navigator-router"
-version = "0.1.0"
-dependencies = [
- "bytes",
- "navigator-core",
- "reqwest",
- "serde",
- "serde_json",
- "serde_yaml",
- "tempfile",
- "thiserror 2.0.18",
- "tokio",
- "tracing",
- "uuid",
- "wiremock",
-]
-
-[[package]]
-name = "navigator-sandbox"
-version = "0.1.0"
-dependencies = [
- "anyhow",
- "bytes",
- "clap",
- "hex",
- "hmac",
- "ipnet",
- "landlock",
- "libc",
- "miette",
- "navigator-core",
- "navigator-policy",
- "navigator-router",
- "nix",
- "rand_core 0.6.4",
- "rcgen",
- "regorus",
- "russh",
- "rustls",
- "rustls-pemfile",
- "seccompiler",
- "serde_json",
- "serde_yaml",
- "sha2 0.10.9",
- "tempfile",
- "thiserror 2.0.18",
- "tokio",
- "tokio-rustls",
- "tokio-stream",
- "tonic",
- "tracing",
- "tracing-appender",
- "tracing-subscriber",
- "uuid",
- "webpki-roots 1.0.6",
-]
-
-[[package]]
-name = "navigator-server"
-version = "0.1.0"
-dependencies = [
- "anyhow",
- "axum 0.8.8",
- "bytes",
- "clap",
- "futures",
- "hex",
- "hmac",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-rustls",
- "hyper-util",
- "k8s-openapi",
- "kube",
- "kube-runtime",
- "miette",
- "navigator-core",
- "navigator-policy",
- "petname",
- "pin-project-lite",
- "prost",
- "prost-types",
- "rand 0.9.2",
- "rcgen",
- "russh",
- "rustls",
- "rustls-pemfile",
- "serde",
- "serde_json",
- "sha2 0.10.9",
- "sqlx",
- "tempfile",
- "thiserror 2.0.18",
- "tokio",
- "tokio-rustls",
- "tokio-stream",
- "tonic",
- "tower 0.5.3",
- "tower-http 0.6.8",
- "tracing",
- "tracing-subscriber",
- "uuid",
-]
-
-[[package]]
-name = "navigator-tui"
-version = "0.1.0"
-dependencies = [
- "crossterm 0.28.1",
- "miette",
- "navigator-bootstrap",
- "navigator-core",
- "navigator-policy",
- "navigator-providers",
- "owo-colors",
- "ratatui",
- "serde",
- "tokio",
- "tonic",
- "tracing",
- "url",
-]
-
-[[package]]
-name = "navigator-vm"
-version = "0.1.0"
-dependencies = [
- "base64 0.22.1",
- "clap",
- "libc",
- "miette",
- "navigator-bootstrap",
- "serde_json",
- "thiserror 2.0.18",
- "tracing",
- "tracing-subscriber",
-]
-
 [[package]]
 name = "nix"
 version = "0.29.0"
@@ -3041,6 +2807,254 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
+[[package]]
+name = "openshell-bootstrap"
+version = "0.1.0"
+dependencies = [
+ "base64 0.22.1",
+ "bollard",
+ "bytes",
+ "futures",
+ "miette",
+ "openshell-core",
+ "rcgen",
+ "serde",
+ "serde_json",
+ "tar",
+ "tempfile",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "openshell-cli"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "bytes",
+ "clap",
+ "clap_complete",
+ "crossterm 0.28.1",
+ "dialoguer",
+ "futures",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "indicatif",
+ "miette",
+ "nix",
+ "openshell-bootstrap",
+ "openshell-core",
+ "openshell-policy",
+ "openshell-providers",
+ "openshell-tui",
+ "owo-colors",
+ "prost-types",
+ "rcgen",
+ "reqwest",
+ "rustls",
+ "rustls-pemfile",
+ "serde",
+ "serde_json",
+ "tar",
+ "temp-env",
+ "tempfile",
+ "thiserror 2.0.18",
+ "tokio",
+ "tokio-rustls",
+ "tokio-stream",
+ "tokio-tungstenite 0.26.2",
+ "tonic",
+ "tracing",
+ "tracing-subscriber",
+ "url",
+]
+
+[[package]]
+name = "openshell-core"
+version = "0.1.0"
+dependencies = [
+ "miette",
+ "prost",
+ "prost-types",
+ "protobuf-src",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "thiserror 2.0.18",
+ "tonic",
+ "tonic-build",
+ "url",
+]
+
+[[package]]
+name = "openshell-policy"
+version = "0.1.0"
+dependencies = [
+ "miette",
+ "openshell-core",
+ "serde",
+ "serde_yaml",
+]
+
+[[package]]
+name = "openshell-providers"
+version = "0.1.0"
+dependencies = [
+ "openshell-core",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "openshell-router"
+version = "0.1.0"
+dependencies = [
+ "bytes",
+ "openshell-core",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "serde_yaml",
+ "tempfile",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "uuid",
+ "wiremock",
+]
+
+[[package]]
+name = "openshell-sandbox"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "bytes",
+ "clap",
+ "hex",
+ "hmac",
+ "ipnet",
+ "landlock",
+ "libc",
+ "miette",
+ "nix",
+ "openshell-core",
+ "openshell-policy",
+ "openshell-router",
+ "rand_core 0.6.4",
+ "rcgen",
+ "regorus",
+ "russh",
+ "rustls",
+ "rustls-pemfile",
+ "seccompiler",
+ "serde_json",
+ "serde_yaml",
+ "sha2 0.10.9",
+ "temp-env",
+ "tempfile",
+ "thiserror 2.0.18",
+ "tokio",
+ "tokio-rustls",
+ "tokio-stream",
+ "tonic",
+ "tracing",
+ "tracing-appender",
+ "tracing-subscriber",
+ "uuid",
+ "webpki-roots 1.0.6",
+]
+
+[[package]]
+name = "openshell-server"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "axum 0.8.8",
+ "bytes",
+ "clap",
+ "futures",
+ "futures-util",
+ "hex",
+ "hmac",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "k8s-openapi",
+ "kube",
+ "kube-runtime",
+ "miette",
+ "openshell-core",
+ "openshell-policy",
+ "openshell-router",
+ "petname",
+ "pin-project-lite",
+ "prost",
+ "prost-types",
+ "rand 0.9.2",
+ "rcgen",
+ "reqwest",
+ "russh",
+ "rustls",
+ "rustls-pemfile",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "sqlx",
+ "tempfile",
+ "thiserror 2.0.18",
+ "tokio",
+ "tokio-rustls",
+ "tokio-stream",
+ "tokio-tungstenite 0.26.2",
+ "tonic",
+ "tower 0.5.3",
+ "tower-http 0.6.8",
+ "tracing",
+ "tracing-subscriber",
+ "uuid",
+ "wiremock",
+]
+
+[[package]]
+name = "openshell-tui"
+version = "0.1.0"
+dependencies = [
+ "base64 0.22.1",
+ "crossterm 0.28.1",
+ "miette",
+ "openshell-bootstrap",
+ "openshell-core",
+ "openshell-policy",
+ "openshell-providers",
+ "owo-colors",
+ "ratatui",
+ "serde",
+ "terminal-colorsaurus",
+ "tokio",
+ "tonic",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "openshell-vm"
+version = "0.1.0"
+dependencies = [
+ "base64 0.22.1",
+ "clap",
+ "libc",
+ "miette",
+ "openshell-bootstrap",
+ "serde_json",
+ "thiserror 2.0.18",
+ "tracing",
+ "tracing-subscriber",
+]
+
 [[package]]
 name = "openssh"
 version = "0.11.6"
@@ -4896,6 +4910,15 @@ dependencies = [
  "xattr",
 ]
 
+[[package]]
+name = "temp-env"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96374855068f47402c3121c6eed88d29cb1de8f3ab27090e273e420bdabcf050"
+dependencies = [
+ "parking_lot",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.24.0"
@@ -4909,6 +4932,32 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "terminal-colorsaurus"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a46bb5364467da040298c573c8a95dbf9a512efc039630409a03126e3703e90"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "memchr",
+ "mio 1.1.1",
+ "terminal-trx",
+ "windows-sys 0.61.2",
+ "xterm-color",
+]
+
+[[package]]
+name = "terminal-trx"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b3f27d9a8a177e57545481faec87acb45c6e854ed1e5a3658ad186c106f38ed"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "terminal_size"
 version = "0.4.3"
@@ -5104,6 +5153,34 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "tokio-tungstenite"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a9daff607c6d2bf6c16fd681ccb7eecc83e4e2cdc1ca067ffaadfca5de7f084"
+dependencies = [
+ "futures-util",
+ "log",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tungstenite 0.26.2",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d25a406cddcc431a75d3d9afc6a7c0f7428d4891dd973e4d54c56b46127bf857"
+dependencies = [
+ "futures-util",
+ "log",
+ "tokio",
+ "tungstenite 0.28.0",
+]
+
 [[package]]
 name = "tokio-util"
 version = "0.7.18"
@@ -5139,6 +5216,7 @@ dependencies = [
  "percent-encoding",
  "pin-project",
  "prost",
+ "rustls-native-certs",
  "rustls-pemfile",
  "socket2 0.5.10",
  "tokio",
@@ -5343,6 +5421,42 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
+[[package]]
+name = "tungstenite"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4793cb5e56680ecbb1d843515b23b6de9a75eb04b66643e256a396d43be33c13"
+dependencies = [
+ "bytes",
+ "data-encoding",
+ "http",
+ "httparse",
+ "log",
+ "rand 0.9.2",
+ "rustls",
+ "rustls-pki-types",
+ "sha1 0.10.6",
+ "thiserror 2.0.18",
+ "utf-8",
+]
+
+[[package]]
+name = "tungstenite"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8628dcc84e5a09eb3d8423d6cb682965dea9133204e8fb3efee74c2a0c259442"
+dependencies = [
+ "bytes",
+ "data-encoding",
+ "http",
+ "httparse",
+ "log",
+ "rand 0.9.2",
+ "sha1 0.10.6",
+ "thiserror 2.0.18",
+ "utf-8",
+]
+
 [[package]]
 name = "typenum"
 version = "1.19.0"
@@ -5463,6 +5577,12 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -6174,6 +6294,12 @@ dependencies = [
  "rustix 1.1.3",
 ]
 
+[[package]]
+name = "xterm-color"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7008a9d8ba97a7e47d9b2df63fcdb8dade303010c5a7cd5bf2469d4da6eba673"
+
 [[package]]
 name = "yasna"
 version = "0.5.2"
diff --git a/crates/openshell-vm/src/lib.rs b/crates/openshell-vm/src/lib.rs
index db362c2b4..f55df64c5 100644
--- a/crates/openshell-vm/src/lib.rs
+++ b/crates/openshell-vm/src/lib.rs
@@ -844,16 +844,18 @@ const GATEWAY_PORT: u16 = 30051;
 fn bootstrap_gateway(kubeconfig: &Path, rootfs: &Path) -> Result<(), VmError> {
     let bootstrap_start = Instant::now();
 
-    // Build cluster metadata early — it only depends on knowing the port and
-    // cluster name, not on the cluster being ready.
-    let metadata = navigator_bootstrap::ClusterMetadata {
+    // Build gateway metadata early — it only depends on knowing the port and
+    // gateway name, not on the cluster being ready.
+    let metadata = openshell_bootstrap::GatewayMetadata {
         name: GATEWAY_CLUSTER_NAME.to_string(),
         gateway_endpoint: format!("https://127.0.0.1:{GATEWAY_PORT}"),
         is_remote: false,
         gateway_port: GATEWAY_PORT,
-        kube_port: Some(6443),
         remote_host: None,
         resolved_host: None,
+        auth_mode: None,
+        edge_team_domain: None,
+        edge_auth_url: None,
     };
 
     // ── Path 1: Pre-baked PKI from build-rootfs.sh ─────────────────
@@ -871,7 +873,7 @@ fn bootstrap_gateway(kubeconfig: &Path, rootfs: &Path) -> Result<(), VmError> {
                 .map_err(|e| VmError::Bootstrap(format!("failed to read {name}: {e}")))
         };
 
-        let pki_bundle = navigator_bootstrap::pki::PkiBundle {
+        let pki_bundle = openshell_bootstrap::pki::PkiBundle {
             ca_cert_pem: read("ca.crt")?,
             ca_key_pem: read("ca.key")?,
             server_cert_pem: read("server.crt")?,
@@ -881,13 +883,13 @@ fn bootstrap_gateway(kubeconfig: &Path, rootfs: &Path) -> Result<(), VmError> {
         };
 
         // Store metadata and credentials on the host.
-        navigator_bootstrap::store_cluster_metadata(GATEWAY_CLUSTER_NAME, &metadata)
+        openshell_bootstrap::store_gateway_metadata(GATEWAY_CLUSTER_NAME, &metadata)
             .map_err(|e| VmError::Bootstrap(format!("failed to store metadata: {e}")))?;
 
-        navigator_bootstrap::mtls::store_pki_bundle(GATEWAY_CLUSTER_NAME, &pki_bundle)
+        openshell_bootstrap::mtls::store_pki_bundle(GATEWAY_CLUSTER_NAME, &pki_bundle)
             .map_err(|e| VmError::Bootstrap(format!("failed to store mTLS creds: {e}")))?;
 
-        navigator_bootstrap::save_active_cluster(GATEWAY_CLUSTER_NAME)
+        openshell_bootstrap::save_active_gateway(GATEWAY_CLUSTER_NAME)
             .map_err(|e| VmError::Bootstrap(format!("failed to set active cluster: {e}")))?;
 
         eprintln!(
@@ -924,10 +926,10 @@ fn bootstrap_gateway(kubeconfig: &Path, rootfs: &Path) -> Result<(), VmError> {
 
     // ── Path 3: Cold boot (no pre-baked state) ─────────────────────
     eprintln!("Generating TLS certificates...");
-    let pki_bundle = navigator_bootstrap::pki::generate_pki(&[])
+    let pki_bundle = openshell_bootstrap::pki::generate_pki(&[])
         .map_err(|e| VmError::Bootstrap(format!("PKI generation failed: {e}")))?;
 
-    navigator_bootstrap::store_cluster_metadata(GATEWAY_CLUSTER_NAME, &metadata)
+    openshell_bootstrap::store_gateway_metadata(GATEWAY_CLUSTER_NAME, &metadata)
         .map_err(|e| VmError::Bootstrap(format!("failed to store cluster metadata: {e}")))?;
 
     let ns_start = Instant::now();
@@ -938,10 +940,10 @@ fn bootstrap_gateway(kubeconfig: &Path, rootfs: &Path) -> Result<(), VmError> {
     eprintln!("Creating TLS secrets...");
     apply_tls_secrets(kc, &pki_bundle)?;
 
-    navigator_bootstrap::mtls::store_pki_bundle(GATEWAY_CLUSTER_NAME, &pki_bundle)
+    openshell_bootstrap::mtls::store_pki_bundle(GATEWAY_CLUSTER_NAME, &pki_bundle)
         .map_err(|e| VmError::Bootstrap(format!("failed to store mTLS credentials: {e}")))?;
 
-    navigator_bootstrap::save_active_cluster(GATEWAY_CLUSTER_NAME)
+    openshell_bootstrap::save_active_gateway(GATEWAY_CLUSTER_NAME)
         .map_err(|e| VmError::Bootstrap(format!("failed to set active cluster: {e}")))?;
 
     eprintln!(
@@ -1238,7 +1240,7 @@ fn wait_for_namespace(kubeconfig: &str) -> Result<(), VmError> {
 /// Uses `kubectl apply -f -` on the host, piping JSON manifests via stdin.
 fn apply_tls_secrets(
     kubeconfig: &str,
-    bundle: &navigator_bootstrap::pki::PkiBundle,
+    bundle: &openshell_bootstrap::pki::PkiBundle,
 ) -> Result<(), VmError> {
     use base64::Engine;
     use base64::engine::general_purpose::STANDARD;
@@ -1249,7 +1251,7 @@ fn apply_tls_secrets(
             "apiVersion": "v1",
             "kind": "Secret",
             "metadata": {
-                "name": navigator_bootstrap::constants::SERVER_TLS_SECRET_NAME,
+                "name": openshell_bootstrap::constants::SERVER_TLS_SECRET_NAME,
                 "namespace": "navigator"
             },
             "type": "kubernetes.io/tls",
@@ -1263,7 +1265,7 @@ fn apply_tls_secrets(
             "apiVersion": "v1",
             "kind": "Secret",
             "metadata": {
-                "name": navigator_bootstrap::constants::SERVER_CLIENT_CA_SECRET_NAME,
+                "name": openshell_bootstrap::constants::SERVER_CLIENT_CA_SECRET_NAME,
                 "namespace": "navigator"
             },
             "type": "Opaque",
@@ -1276,7 +1278,7 @@ fn apply_tls_secrets(
             "apiVersion": "v1",
             "kind": "Secret",
             "metadata": {
-                "name": navigator_bootstrap::constants::CLIENT_TLS_SECRET_NAME,
+                "name": openshell_bootstrap::constants::CLIENT_TLS_SECRET_NAME,
                 "namespace": "navigator"
             },
             "type": "Opaque",
diff --git a/crates/navigator-vm/tests/gateway_integration.rs b/crates/openshell-vm/tests/gateway_integration.rs
similarity index 98%
rename from crates/navigator-vm/tests/gateway_integration.rs
rename to crates/openshell-vm/tests/gateway_integration.rs
index 060ac5332..413d1b3c4 100644
--- a/crates/navigator-vm/tests/gateway_integration.rs
+++ b/crates/openshell-vm/tests/gateway_integration.rs
@@ -11,7 +11,7 @@
 //! All tests are `#[ignore]` — run them explicitly:
 //!
 //! ```sh
-//! cargo test -p navigator-vm --test gateway_integration -- --ignored
+//! cargo test -p openshell-vm --test gateway_integration -- --ignored
 //! ```
 
 #![allow(unsafe_code)]