@cairnkeep/cli 1.0.2

package/scripts/sync-opencode-plugin-assets.sh

@@ -0,0 +1,163 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: sync-opencode-plugin-assets.sh [--check|--apply] [--live-root PATH]
+
+Compare or sync the repo-managed OpenCode plugin assets against the live
+OpenCode config tree.
+
+Options:
+  --check            Verify that the managed live assets match the repo copies (default)
+  --apply            Copy the repo-managed assets into the live OpenCode tree, then verify
+  --live-root PATH   Override the live OpenCode root (default: $OPENCODE_CONFIG_DIR or $HOME/.config/opencode)
+  -h, --help         Show this help text
+
+Notes:
+  - The repo-managed source of truth lives under ./opencode/plugins/
+  - OpenCode auto-discovers plugins/*.ts, so applying here activates them on the next session
+EOF
+}
+
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+SOURCE_ROOT="$ROOT_DIR/opencode"
+LIVE_ROOT="${OPENCODE_CONFIG_DIR:-$HOME/.config/opencode}"
+MODE="check"
+
+ASSETS=(
+  "plugins/memory-wakeup.ts"
+  "plugins/memory-capture.ts"
+  "plugins/memory-recall.ts"
+)
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --check)
+      MODE="check"
+      shift
+      ;;
+    --apply)
+      MODE="apply"
+      shift
+      ;;
+    --live-root)
+      LIVE_ROOT="$2"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+render_asset() {
+  local src="$1"
+  sed "s|@@INFRA_ROOT@@|$ROOT_DIR|g" "$src"
+}
+
+ensure_source_assets_exist() {
+  local rel
+  local missing=0
+
+  for rel in "${ASSETS[@]}"; do
+    if [[ ! -f "$SOURCE_ROOT/$rel" ]]; then
+      echo "Missing repo-managed source asset: $SOURCE_ROOT/$rel" >&2
+      missing=1
+    fi
+  done
+
+  if [[ $missing -ne 0 ]]; then
+    exit 2
+  fi
+}
+
+check_asset_sync() {
+  local rel
+  local src
+  local dst
+  local -a missing_live=()
+  local -a mismatched=()
+
+  for rel in "${ASSETS[@]}"; do
+    src="$SOURCE_ROOT/$rel"
+    dst="$LIVE_ROOT/$rel"
+
+    if [[ ! -f "$dst" ]]; then
+      missing_live+=("$rel")
+      continue
+    fi
+
+    if ! cmp -s <(render_asset "$src") "$dst"; then
+      mismatched+=("$rel")
+    fi
+  done
+
+  if ((${#missing_live[@]} == 0 && ${#mismatched[@]} == 0)); then
+    return 0
+  fi
+
+  if ((${#missing_live[@]} > 0)); then
+    printf 'Missing live OpenCode plugin assets under %s:\n' "$LIVE_ROOT" >&2
+    printf '  - %s\n' "${missing_live[@]}" >&2
+  fi
+
+  if ((${#mismatched[@]} > 0)); then
+    printf 'Out-of-sync live OpenCode plugin assets under %s:\n' "$LIVE_ROOT" >&2
+    printf '  - %s\n' "${mismatched[@]}" >&2
+  fi
+
+  return 1
+}
+
+run_check() {
+  ensure_source_assets_exist
+  check_asset_sync
+  printf 'OpenCode plugin assets are in sync under %s\n' "$LIVE_ROOT"
+}
+
+run_apply() {
+  local rel
+  local src
+  local dst
+  local rendered_tmp
+  local updated=0
+  local unchanged=0
+
+  ensure_source_assets_exist
+
+  for rel in "${ASSETS[@]}"; do
+    src="$SOURCE_ROOT/$rel"
+    dst="$LIVE_ROOT/$rel"
+
+    mkdir -p "$(dirname "$dst")"
+    if [[ -f "$dst" ]] && cmp -s <(render_asset "$src") "$dst"; then
+      unchanged=$((unchanged + 1))
+      continue
+    fi
+
+    rendered_tmp=$(mktemp)
+    render_asset "$src" > "$rendered_tmp"
+    install -m 0644 "$rendered_tmp" "$dst"
+    rm -f "$rendered_tmp"
+    updated=$((updated + 1))
+  done
+
+  printf 'Applied %s OpenCode plugin asset(s); %s already matched.\n' "$updated" "$unchanged"
+  run_check
+}
+
+case "$MODE" in
+  check)
+    run_check
+    ;;
+  apply)
+    run_apply
+    ;;
+esac

package/scripts/sync-opencode-security-assets.sh

@@ -0,0 +1,195 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: sync-opencode-security-assets.sh [--check|--apply] [--live-root PATH]
+
+Compare or sync the repo-managed OpenCode security-audit assets against the live
+OpenCode config tree.
+
+Options:
+  --check            Verify that the managed live assets match the repo copy (default)
+  --apply            Copy the repo-managed assets into the live OpenCode tree, then verify
+  --live-root PATH   Override the live OpenCode root (default: $OPENCODE_CONFIG_DIR or $HOME/.config/opencode)
+  -h, --help         Show this help text
+
+Notes:
+  - The repo-managed source of truth lives under ./opencode/
+  - This script manages only the security-audit OpenCode assets
+  - --apply also removes the legacy gsd-overrides security-audit workflow/template files
+EOF
+}
+
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+SOURCE_ROOT="$ROOT_DIR/opencode"
+LIVE_ROOT="${OPENCODE_CONFIG_DIR:-$HOME/.config/opencode}"
+MODE="check"
+
+ASSETS=(
+  "command/security-audit.md"
+  "agents/security-target-selector.md"
+  "agents/security-investigator.md"
+  "agents/security-validator.md"
+  "workflows/security-audit-workflow.md"
+  "templates/security-policy.md.template"
+  "templates/security-report.md.template"
+  "templates/security-finding-register.yaml.template"
+  "templates/security-issue.md.template"
+)
+
+LEGACY_ASSETS=(
+  "gsd-overrides/workflows/security-audit.md"
+  "gsd-overrides/templates/security-policy.md.template"
+  "gsd-overrides/templates/security-report.md.template"
+  "gsd-overrides/templates/security-finding-register.yaml.template"
+  "gsd-overrides/templates/security-issue.md.template"
+)
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --check)
+      MODE="check"
+      shift
+      ;;
+    --apply)
+      MODE="apply"
+      shift
+      ;;
+    --live-root)
+      LIVE_ROOT="$2"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+ensure_source_assets_exist() {
+  local rel
+  local missing=0
+
+  for rel in "${ASSETS[@]}"; do
+    if [[ ! -f "$SOURCE_ROOT/$rel" ]]; then
+      echo "Missing repo-managed source asset: $SOURCE_ROOT/$rel" >&2
+      missing=1
+    fi
+  done
+
+  if [[ $missing -ne 0 ]]; then
+    exit 2
+  fi
+}
+
+report_legacy_live_assets() {
+  local rel
+  local -a legacy_found=()
+
+  for rel in "${LEGACY_ASSETS[@]}"; do
+    if [[ -f "$LIVE_ROOT/$rel" ]]; then
+      legacy_found+=("$rel")
+    fi
+  done
+
+  if ((${#legacy_found[@]} == 0)); then
+    return
+  fi
+
+  printf 'Warning: found legacy live security-audit assets under %s:\n' "$LIVE_ROOT" >&2
+  printf '  - %s\n' "${legacy_found[@]}" >&2
+}
+
+run_check() {
+  local rel
+  local src
+  local dst
+  local -a missing_live=()
+  local -a mismatched=()
+
+  ensure_source_assets_exist
+
+  for rel in "${ASSETS[@]}"; do
+    src="$SOURCE_ROOT/$rel"
+    dst="$LIVE_ROOT/$rel"
+
+    if [[ ! -f "$dst" ]]; then
+      missing_live+=("$rel")
+      continue
+    fi
+
+    if ! cmp -s "$src" "$dst"; then
+      mismatched+=("$rel")
+    fi
+  done
+
+  report_legacy_live_assets
+
+  if ((${#missing_live[@]} == 0 && ${#mismatched[@]} == 0)); then
+    printf 'Security-audit assets are in sync: %s managed files match %s\n' "${#ASSETS[@]}" "$LIVE_ROOT"
+    return 0
+  fi
+
+  if ((${#missing_live[@]} > 0)); then
+    printf 'Missing live security-audit assets under %s:\n' "$LIVE_ROOT" >&2
+    printf '  - %s\n' "${missing_live[@]}" >&2
+  fi
+
+  if ((${#mismatched[@]} > 0)); then
+    printf 'Out-of-sync live security-audit assets under %s:\n' "$LIVE_ROOT" >&2
+    printf '  - %s\n' "${mismatched[@]}" >&2
+  fi
+
+  return 1
+}
+
+run_apply() {
+  local rel
+  local src
+  local dst
+  local updated=0
+  local unchanged=0
+  local removed_legacy=0
+
+  ensure_source_assets_exist
+
+  for rel in "${ASSETS[@]}"; do
+    src="$SOURCE_ROOT/$rel"
+    dst="$LIVE_ROOT/$rel"
+
+    mkdir -p "$(dirname "$dst")"
+    if [[ -f "$dst" ]] && cmp -s "$src" "$dst"; then
+      unchanged=$((unchanged + 1))
+      continue
+    fi
+
+    install -m 0644 "$src" "$dst"
+    updated=$((updated + 1))
+  done
+
+  for rel in "${LEGACY_ASSETS[@]}"; do
+    dst="$LIVE_ROOT/$rel"
+    if [[ -f "$dst" ]]; then
+      rm -f "$dst"
+      removed_legacy=$((removed_legacy + 1))
+    fi
+  done
+
+  printf 'Applied %s security-audit asset(s); %s already matched; removed %s legacy asset(s).\n' "$updated" "$unchanged" "$removed_legacy"
+  run_check
+}
+
+case "$MODE" in
+  check)
+    run_check
+    ;;
+  apply)
+    run_apply
+    ;;
+esac

package/scripts/sync-opencode-wiki-assets.sh

@@ -0,0 +1,250 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: sync-opencode-wiki-assets.sh [--check|--apply] [--live-root PATH]
+
+Compare or sync the repo-managed OpenCode wiki assets against the live
+OpenCode config tree.
+
+Options:
+  --check            Verify that the managed live assets match the repo copy (default)
+  --apply            Copy the repo-managed assets into the live OpenCode tree, then verify
+  --live-root PATH   Override the live OpenCode root (default: $OPENCODE_CONFIG_DIR or $HOME/.config/opencode)
+  -h, --help         Show this help text
+
+Notes:
+  - The repo-managed source of truth lives under ./opencode/
+  - This script manages only the wiki-specific OpenCode assets
+  - Extra live wiki assets are reported as warnings but are not deleted automatically
+  - --apply also removes the legacy gsd-overrides wiki workflow/template files
+EOF
+}
+
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+SOURCE_ROOT="$ROOT_DIR/opencode"
+LIVE_ROOT="${OPENCODE_CONFIG_DIR:-$HOME/.config/opencode}"
+MODE="check"
+
+ASSETS=(
+  "command/wiki-ingest.md"
+  "command/wiki-query.md"
+  "command/wiki-lint.md"
+  "agents/wiki-ingester.md"
+  "agents/wiki-query-analyst.md"
+  "agents/wiki-lint-auditor.md"
+  "workflows/wiki-ingest-workflow.md"
+  "workflows/wiki-query-workflow.md"
+  "workflows/wiki-lint-workflow.md"
+  "templates/wiki-policy.md.template"
+  "templates/wiki-index.md.template"
+  "templates/wiki-log.md.template"
+  "templates/wiki-source-summary.md.template"
+  "templates/wiki-query-answer.md.template"
+  "templates/wiki-lint-report.md.template"
+  "templates/wiki-contradictions.md.template"
+)
+
+LEGACY_ASSETS=(
+  "gsd-overrides/workflows/wiki-ingest.md"
+  "gsd-overrides/workflows/wiki-query.md"
+  "gsd-overrides/workflows/wiki-lint.md"
+  "gsd-overrides/templates/wiki-policy.md.template"
+  "gsd-overrides/templates/wiki-index.md.template"
+  "gsd-overrides/templates/wiki-log.md.template"
+  "gsd-overrides/templates/wiki-source-summary.md.template"
+  "gsd-overrides/templates/wiki-query-answer.md.template"
+  "gsd-overrides/templates/wiki-lint-report.md.template"
+)
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --check)
+      MODE="check"
+      shift
+      ;;
+    --apply)
+      MODE="apply"
+      shift
+      ;;
+    --live-root)
+      LIVE_ROOT="$2"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+collect_extra_live_assets() {
+  local root="$1"
+  local -A managed=()
+  local rel
+
+  for rel in "${ASSETS[@]}"; do
+    managed["$rel"]=1
+  done
+
+  while IFS= read -r rel; do
+    [[ -n "$rel" ]] || continue
+    if [[ -z "${managed[$rel]:-}" ]]; then
+      printf '%s\n' "$rel"
+    fi
+  done < <(
+    (
+      find "$root/command" -maxdepth 1 -type f \( -name 'gsd-wiki-*.md' -o -name 'wiki-*.md' \) -printf 'command/%f\n' 2>/dev/null || true
+      find "$root/agents" -maxdepth 1 -type f \( -name 'gsd-wiki-*.md' -o -name 'wiki-*.md' \) -printf 'agents/%f\n' 2>/dev/null || true
+      find "$root/workflows" -maxdepth 1 -type f -name 'wiki-*.md' -printf 'workflows/%f\n' 2>/dev/null || true
+      find "$root/templates" -maxdepth 1 -type f -name 'wiki-*.template' -printf 'templates/%f\n' 2>/dev/null || true
+      find "$root/gsd-overrides/workflows" -maxdepth 1 -type f -name 'wiki-*.md' -printf 'gsd-overrides/workflows/%f\n' 2>/dev/null || true
+      find "$root/gsd-overrides/templates" -maxdepth 1 -type f -name 'wiki-*.template' -printf 'gsd-overrides/templates/%f\n' 2>/dev/null || true
+    ) | sort -u
+  )
+}
+
+ensure_source_assets_exist() {
+  local rel
+  local missing=0
+
+  for rel in "${ASSETS[@]}"; do
+    if [[ ! -f "$SOURCE_ROOT/$rel" ]]; then
+      echo "Missing repo-managed source asset: $SOURCE_ROOT/$rel" >&2
+      missing=1
+    fi
+  done
+
+  if [[ $missing -ne 0 ]]; then
+    exit 2
+  fi
+}
+
+report_extra_live_assets() {
+  local -a extras=()
+
+  if [[ ! -d "$LIVE_ROOT" ]]; then
+    return
+  fi
+
+  mapfile -t extras < <(collect_extra_live_assets "$LIVE_ROOT")
+  if ((${#extras[@]} == 0)); then
+    return
+  fi
+
+  printf 'Warning: found unmanaged live wiki assets under %s:\n' "$LIVE_ROOT" >&2
+  printf '  - %s\n' "${extras[@]}" >&2
+}
+
+report_legacy_live_assets() {
+  local -a extras=()
+  local rel
+
+  for rel in "${LEGACY_ASSETS[@]}"; do
+    if [[ -f "$LIVE_ROOT/$rel" ]]; then
+      extras+=("$rel")
+    fi
+  done
+
+  if ((${#extras[@]} == 0)); then
+    return
+  fi
+
+  printf 'Warning: found legacy live wiki assets under %s:\n' "$LIVE_ROOT" >&2
+  printf '  - %s\n' "${extras[@]}" >&2
+}
+
+run_check() {
+  local rel
+  local src
+  local dst
+  local -a missing_live=()
+  local -a mismatched=()
+
+  ensure_source_assets_exist
+
+  for rel in "${ASSETS[@]}"; do
+    src="$SOURCE_ROOT/$rel"
+    dst="$LIVE_ROOT/$rel"
+
+    if [[ ! -f "$dst" ]]; then
+      missing_live+=("$rel")
+      continue
+    fi
+
+    if ! cmp -s "$src" "$dst"; then
+      mismatched+=("$rel")
+    fi
+  done
+
+  report_extra_live_assets
+  report_legacy_live_assets
+
+  if ((${#missing_live[@]} == 0 && ${#mismatched[@]} == 0)); then
+    printf 'Wiki assets are in sync: %s managed files match %s\n' "${#ASSETS[@]}" "$LIVE_ROOT"
+    return 0
+  fi
+
+  if ((${#missing_live[@]} > 0)); then
+    printf 'Missing live wiki assets under %s:\n' "$LIVE_ROOT" >&2
+    printf '  - %s\n' "${missing_live[@]}" >&2
+  fi
+
+  if ((${#mismatched[@]} > 0)); then
+    printf 'Out-of-sync live wiki assets under %s:\n' "$LIVE_ROOT" >&2
+    printf '  - %s\n' "${mismatched[@]}" >&2
+  fi
+
+  return 1
+}
+
+run_apply() {
+  local rel
+  local src
+  local dst
+  local updated=0
+  local unchanged=0
+  local removed_legacy=0
+
+  ensure_source_assets_exist
+
+  for rel in "${ASSETS[@]}"; do
+    src="$SOURCE_ROOT/$rel"
+    dst="$LIVE_ROOT/$rel"
+
+    mkdir -p "$(dirname "$dst")"
+    if [[ -f "$dst" ]] && cmp -s "$src" "$dst"; then
+      unchanged=$((unchanged + 1))
+      continue
+    fi
+
+    install -m 0644 "$src" "$dst"
+    updated=$((updated + 1))
+  done
+
+  for rel in "${LEGACY_ASSETS[@]}"; do
+    dst="$LIVE_ROOT/$rel"
+    if [[ -f "$dst" ]]; then
+      rm -f "$dst"
+      removed_legacy=$((removed_legacy + 1))
+    fi
+  done
+
+  printf 'Applied %s wiki asset(s); %s already matched; removed %s legacy asset(s).\n' "$updated" "$unchanged" "$removed_legacy"
+  run_check
+}
+
+case "$MODE" in
+  check)
+    run_check
+    ;;
+  apply)
+    run_apply
+    ;;
+esac

package/scripts/test-audit-timer.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Render test for install-audit-timer.sh: --render-only substitutes every
+# placeholder and produces valid-looking unit files (no systemd required).
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+fail() { echo "FAIL: $1" >&2; exit 1; }
+
+"$ROOT/scripts/install-audit-timer.sh" \
+  --para-root "$tmp/PARA" --on-calendar "Mon *-*-* 04:00:00" \
+  --report "$tmp/audit.md" --render-only "$tmp/units" >/dev/null
+
+svc="$tmp/units/memory-wiki-audit.service"
+tmr="$tmp/units/memory-wiki-audit.timer"
+[[ -f "$svc" && -f "$tmr" ]] || fail "unit files not rendered"
+
+# No placeholders left.
+! grep -q "@@" "$svc" || fail "unsubstituted @@ placeholder left in service"
+! grep -q "@@" "$tmr" || fail "unsubstituted @@ placeholder left in timer"
+
+# Substitutions landed.
+grep -q "scripts/memory-wiki-audit.sh --para-root $tmp/PARA --report $tmp/audit.md" "$svc" \
+  || fail "service ExecStart not substituted as expected"
+grep -q "OnCalendar=Mon \*-\*-\* 04:00:00" "$tmr" || fail "timer OnCalendar not substituted"
+grep -q "WantedBy=timers.target" "$tmr" || fail "timer missing [Install] WantedBy"
+
+echo "PASS: audit-timer render (placeholders substituted, units well-formed)"

package/scripts/test-bootstrap-untracked.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Smoke test for `cairn bootstrap --untracked` (contributor mode).
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+fail() {
+  echo "FAIL: $1" >&2
+  exit 1
+}
+
+# --untracked outside a git repo fails before creating anything
+mkdir "$tmp/plain"
+if "$ROOT/scripts/bootstrap.sh" --untracked "$tmp/plain" >/dev/null 2>&1; then
+  fail "--untracked should refuse a non-git target"
+fi
+[[ ! -e "$tmp/plain/.ai" ]] || fail "non-git target was partially scaffolded"
+
+# In a git repo: scaffold exists, git sees nothing, entries are anchored
+mkdir "$tmp/repo"
+git -C "$tmp/repo" init -q
+"$ROOT/scripts/bootstrap.sh" --untracked "$tmp/repo" >/dev/null
+[[ -f "$tmp/repo/.ai/start-claude.sh" ]] || fail "scaffold missing"
+[[ -f "$tmp/repo/.planning/config.json" ]] || fail "planning layer missing"
+[[ -z "$(git -C "$tmp/repo" status --porcelain)" ]] || fail "scaffold visible to git"
+grep -qxF "/.ai/" "$tmp/repo/.git/info/exclude" || fail "missing /.ai/ exclude entry"
+grep -qxF "/.planning/" "$tmp/repo/.git/info/exclude" || fail "missing /.planning/ exclude entry"
+
+# Re-run is idempotent: no duplicate exclude entries
+"$ROOT/scripts/bootstrap.sh" --untracked "$tmp/repo" >/dev/null
+[[ $(grep -cxF "/.ai/" "$tmp/repo/.git/info/exclude") -eq 1 ]] || fail "duplicate exclude entries"
+
+# Default mode is unchanged: scaffold stays visible to git
+mkdir "$tmp/repo2"
+git -C "$tmp/repo2" init -q
+"$ROOT/scripts/bootstrap.sh" "$tmp/repo2" >/dev/null
+git -C "$tmp/repo2" status --porcelain | grep -q "\.ai/" || fail "default mode should leave the scaffold tracked"
+
+echo "PASS: bootstrap --untracked contributor mode"

package/scripts/test-cli-dispatch.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Smoke test: bin/cairn dispatches the new subcommands.
+set -euo pipefail
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+fail() { echo "FAIL: $1" >&2; exit 1; }
+cairn="$ROOT/bin/cairn"
+
+"$cairn" help | grep -q "cairn doctor" || fail "help missing doctor"
+"$cairn" help | grep -q "cairn memory" || fail "help missing memory"
+"$cairn" help | grep -q "cairn audit-timer" || fail "help missing audit-timer"
+"$cairn" help | grep -q "cairn sync" || fail "help missing sync"
+"$cairn" help | grep -q "cairn memory-server" || fail "help missing memory-server"
+"$cairn" sync --help >/dev/null 2>&1 || fail "cairn sync dispatch"
+
+tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT
+CAIRN_AGENTFS_BASE_DIR="$tmp/store" "$cairn" memory path | grep -qx "$tmp/store" || fail "cairn memory path dispatch"
+( cd "$tmp" && "$cairn" doctor ) >/dev/null || fail "cairn doctor dispatch (clean env should exit 0)"
+"$cairn" audit-timer --render-only "$tmp/u" >/dev/null || fail "cairn audit-timer dispatch"
+[[ -f "$tmp/u/memory-wiki-audit.timer" ]] || fail "audit-timer render via cairn produced no units"
+
+echo "PASS: cairn dispatch (doctor, memory, audit-timer)"