@cairnkeep/cli 1.0.2

package/templates/alignment-pr-template.md.template

@@ -0,0 +1,18 @@
+## Summary
+
+Describe the change and the problem it solves.
+
+## Alignment Checklist
+
+- [ ] I did not push this work directly to the default branch.
+- [ ] I ran `/gsd-align-audit` for changes that affect code, docs, `AGENTS.md`, or durable behavior, or this PR does not need it.
+- [ ] I ran `/security-audit` for attack-surface or security-sensitive changes, or this PR does not need it.
+- [ ] I updated repo docs and `AGENTS.md` if behavior or operating guidance changed.
+- [ ] I kept branch-local findings out of durable memory until merge.
+- [ ] I linked the relevant gap IDs from `.planning/alignment/GAPS.yaml` when applicable.
+- [ ] I linked the relevant accepted finding IDs from `.planning/security/FINDINGS.yaml` when applicable.
+- [ ] I will run `/gsd-align-promote` after merge for accepted gaps that changed durable memory or project-doc retrieval.
+
+## Verification
+
+List the checks you ran.

package/templates/alignment-report.md.template

@@ -0,0 +1,56 @@
+# Alignment Audit Report
+
+- Project: REPLACE_WITH_PROJECT_NAME
+- Audit scope: diff | full
+- Base ref: REPLACE_WITH_BASE_REF
+- Head ref: REPLACE_WITH_HEAD_REF
+- Generated at: REPLACE_WITH_TIMESTAMP
+- Generated by: gsd-align-audit
+
+## Summary
+
+- Total gaps: 0
+- Blocker: 0
+- High: 0
+- Medium: 0
+- Low: 0
+
+## Findings
+
+### Gap ID: GAP-0001
+
+- Title: REPLACE_WITH_TITLE
+- Kind: code_ahead_of_docs
+- Severity: high
+- Truth source: code
+- Proposed resolution: docs_and_memory
+
+#### Evidence
+
+- Code:
+  - REPLACE_WITH_CODE_PATH
+- Docs:
+  - REPLACE_WITH_DOC_PATH
+- Memory:
+  - REPLACE_WITH_MEMORY_KEY
+
+#### Why this matters
+
+REPLACE_WITH_IMPACT
+
+#### Recommended next step
+
+REPLACE_WITH_NEXT_STEP
+
+## Deferred Items
+
+- None
+
+## Human Decisions Needed
+
+- None
+
+## Promotion Guidance
+
+- Write to durable memory only after merge or explicit acceptance.
+- If docs changed on the accepted branch, sync the project AnythingLLM workspace after merge.

package/templates/env.example.template

@@ -0,0 +1,25 @@
+# Cairnkeep repo-local environment. Copy to .ai/.env and edit.
+#
+# The memory server uses an OpenAI-compatible endpoint for memory extraction and
+# embedding-ranked search. Leave these unset to run memory in substring-only mode.
+#
+# CAIRN_LLM_API_KEY=
+# CAIRN_LLM_API_URL=https://api.openai.com/v1
+# CAIRN_LLM_EXTRACTION_MODEL=gpt-4o-mini
+# CAIRN_MEMORY_EMBEDDING_MODEL=text-embedding-3-small
+#
+# Git host for the collaboration commands (memory-sync, repo-review, security-audit).
+# One of: github | gitlab | codeberg | forgejo | none.  See docs/git-providers.md.
+# CAIRN_GIT_PROVIDER=github
+#
+# The memory server runs over stdio by default. HTTP mode is opt-in and network
+# facing, so it is guarded: setting MCP_HTTP_PORT REQUIRES a bearer token, or the
+# server refuses to start. Clients must send `Authorization: Bearer <token>`.
+# CAIRN_MEMORY_HTTP_TOKEN=change-me-to-a-long-random-secret
+# MCP_HTTP_PORT=7801
+# MCP_HTTP_HOST=127.0.0.1
+# Optional: comma-separated browser origins allowed via CORS (default: none).
+# CAIRN_MEMORY_HTTP_ALLOWED_ORIGINS=
+# Optional: comma-separated allowed Host headers for DNS-rebinding protection
+# (default: the bind host + localhost on the chosen port).
+# CAIRN_MEMORY_HTTP_ALLOWED_HOSTS=

package/templates/graph-policy.md.template

@@ -0,0 +1,37 @@
+# Project Knowledge Graph Policy
+
+This repository uses `.planning/graphs/` as an optional, local, machine-facing derived knowledge graph layer.
+
+## Canonical Sources
+
+- Raw repository docs, ADRs, tests, interfaces, config, and code remain the canonical sources of truth.
+- The graph must never overrule the default-branch implementation or canonical repository documents.
+- Treat graph edges as retrieval hints and structural compression, not as accepted decisions.
+
+## Branch Rules
+
+- Project: `REPLACE_WITH_PROJECT_NAME`
+- Default branch: `REPLACE_WITH_DEFAULT_BRANCH`
+- Rebuild graph artifacts on the same branch as the code or docs changes they depend on.
+- Keep graph build outputs local by default. Share or force-add them only when a human explicitly wants the artifact reviewed.
+
+## Provenance Rules
+
+- `EXTRACTED` edges are structural facts emitted by deterministic parsing.
+- `INFERRED` and `AMBIGUOUS` edges are assistant-facing hints until they are confirmed elsewhere.
+- Promote accepted conclusions into repo docs, wiki pages, memory, or governance artifacts instead of treating the graph itself as durable truth.
+- If a graph result conflicts with raw sources, trust the raw sources and rebuild or investigate the graph.
+
+## Scope Rules
+
+- Use the graph to compress dependency context for planning, exploration, and impact analysis.
+- Do not use graph outputs as a human-facing substitute for the repo wiki.
+- Do not commit graph build outputs by default; `.planning/graphs/.gitignore` keeps them local unless you intentionally override it.
+
+## Maintenance
+
+- Enable Graphify explicitly in `.planning/config.json`.
+- Install it locally with `uv pip install graphifyy && graphify install` before first use.
+- Use `/gsd-graphify build` to create or refresh the graph after meaningful topology or architecture-doc changes.
+- Use `/gsd-graphify status`, `/gsd-graphify query <term>`, and `/gsd-graphify diff` to inspect freshness and focused subgraphs.
+- Planner and query consumers should treat stale graphs as approximate context, not proof.

package/templates/graphs-gitignore.template

@@ -0,0 +1,3 @@
+*
+!.gitignore
+!POLICY.md

package/templates/memory-wiki-audit.service.template

@@ -0,0 +1,6 @@
+[Unit]
+Description=Cairnkeep memory + wiki invalidation audit
+
+[Service]
+Type=oneshot
+ExecStart=@@AUDIT_SCRIPT@@ --para-root @@PARA_ROOT@@ --report @@REPORT_PATH@@

package/templates/memory-wiki-audit.timer.template

@@ -0,0 +1,9 @@
+[Unit]
+Description=Schedule the Cairnkeep memory + wiki audit
+
+[Timer]
+OnCalendar=@@ON_CALENDAR@@
+Persistent=true
+
+[Install]
+WantedBy=timers.target

package/templates/memory.json.template

@@ -0,0 +1,4 @@
+{
+  "scopes": ["identity", "domain-engineering", "project"],
+  "anythingllm_workspaces": ["engineering-patterns"]
+}

package/templates/planning-config.json.template

@@ -0,0 +1,6 @@
+{
+  "graphify": {
+    "enabled": false,
+    "build_timeout": 300
+  }
+}

package/templates/project-brief.md.template

@@ -0,0 +1,40 @@
+# REPLACE_WITH_PROJECT_NAME Project Brief
+
+Fill this brief before running `/gsd-new-project --auto @.planning/PROJECT-BRIEF.md`.
+
+## Problem
+
+Describe the user or business problem this project solves.
+
+## Outcomes
+
+- Primary outcome:
+- Secondary outcomes:
+
+## Users And Stakeholders
+
+- Primary users:
+- Operators or maintainers:
+- Reviewers or approvers:
+
+## Constraints
+
+- Technical constraints:
+- Security or compliance constraints:
+- Runtime or deployment constraints:
+
+## Non-Goals
+
+-
+
+## Initial Architecture Expectations
+
+-
+
+## Acceptance Signals
+
+-
+
+## Source Material
+
+- Link or reference the idea doc, PRD, standards, or notes that should inform `/gsd-new-project`.

package/templates/security-finding-register.yaml.template

@@ -0,0 +1,51 @@
+version: 1
+project: REPLACE_WITH_PROJECT_NAME
+default_branch: REPLACE_WITH_DEFAULT_BRANCH
+last_security_audit:
+  at: null
+  branch: null
+  report: null
+findings: []
+
+# Finding entry shape:
+# - id: SEC-0001
+#   title: Unsafe shell command composition in archive import helper
+#   kind: command_execution
+#   severity: high
+#   status: open
+#   confidence: confirmed
+#   opened_by: security-audit
+#   opened_at: 2026-04-17T18:00:00Z
+#   branch: feature/archive-import
+#   threat_model: authenticated HTTP request
+#   exploit_surface: POST /api/import
+#   selected_file: src/import.rs
+#   investigation_target: shell command construction for imported filenames
+#   evidence:
+#     files:
+#       - src/import.rs
+#     commands:
+#       - cargo test --test import
+#     inputs:
+#       - multipart upload filename payload
+#     reports:
+#       - .planning/security/VALIDATED/SEC-0001-unsafe-shell-command-composition.md
+#   duplication:
+#     duplicate_of: null
+#     related_ids: []
+#   validation:
+#     verdict: accepted
+#     report_path: .planning/security/VALIDATED/SEC-0001-unsafe-shell-command-composition.md
+#     validated_at: 2026-04-17T18:00:00Z
+#     rationale: Reachable from the standard import flow without repo-external assumptions.
+#   remediation:
+#     status: open
+#     fixed_in: null
+#     verified_at: null
+#   tracking:
+#     provider_issue:
+#       project: group/project
+#       iid: "123"
+#       web_url: https://git.example.com/group/project/issues/123
+#       confidential: true
+#       created_at: 2026-04-17T18:00:00Z

package/templates/security-issue.md.template

@@ -0,0 +1,43 @@
+# Confidential Security Issue Draft
+
+- Project: REPLACE_WITH_PROJECT_NAME
+- Provider project: REPLACE_WITH_PROVIDER_PROJECT
+- Finding ID: REPLACE_WITH_FINDING_ID
+- Severity: REPLACE_WITH_SEVERITY
+- Kind: REPLACE_WITH_KIND
+- Selected file: REPLACE_WITH_SELECTED_FILE
+- Investigation target: REPLACE_WITH_INVESTIGATION_TARGET
+- Threat model: REPLACE_WITH_THREAT_MODEL
+- Branch: REPLACE_WITH_BRANCH
+- Generated at: REPLACE_WITH_TIMESTAMP
+- Source command: /security-audit
+- Source report: REPLACE_WITH_REPORT_PATH
+
+## Summary
+
+REPLACE_WITH_SUMMARY
+
+## Reachability And Impact
+
+REPLACE_WITH_REACHABILITY_AND_IMPACT
+
+## Evidence
+
+REPLACE_WITH_EVIDENCE
+
+## Minimal Reproduction Or Exploit Sketch
+
+REPLACE_WITH_REPRODUCTION
+
+## Recommended Remediation
+
+REPLACE_WITH_REMEDIATION
+
+## Local Artifact References
+
+- Validated report: REPLACE_WITH_VALIDATED_REPORT
+- Audit report: REPLACE_WITH_AUDIT_REPORT
+
+## Confidentiality Note
+
+This issue was generated from a governed local security assessment and should remain confidential until remediation and disclosure decisions are made.

package/templates/security-policy.md.template

@@ -0,0 +1,29 @@
+# Security Assessment Policy
+
+This repository uses the governed security-assessment workflow to hunt for realistic security issues without turning normal development into uncontrolled offensive automation.
+
+## Branch Rules
+
+- Default branch: `REPLACE_WITH_DEFAULT_BRANCH`
+- Do not push feature work directly to `REPLACE_WITH_DEFAULT_BRANCH`.
+- Use feature branches for remediation and keep candidate reports under `.planning/security/CANDIDATES/` until a finding is validated.
+
+## Safety Rules
+
+- Run `/security-audit` only against this repository, repo-owned local processes, local files, and localhost services launched from this repo.
+- Do not target external hosts, staging, production, or third-party systems.
+- Keep proofs local, minimal, and non-destructive.
+- Do not attempt persistence, credential harvesting, lateral movement, or data exfiltration.
+
+## Finding Lifecycle
+
+- Open or refresh findings with `/security-audit`.
+- Keep rejected or duplicate candidates in run history only; do not copy them into the canonical ledger.
+- Only accepted findings belong in `.planning/security/FINDINGS.yaml` and `.planning/security/VALIDATED/`.
+- Close or downgrade findings only after remediation or explicit acceptance on the default branch.
+
+## Review Expectations
+
+- Critical and high-severity accepted findings should block merge until triaged by a human.
+- Treat the repo-local findings ledger as the shared state for severity, status, and remediation progress.
+- If a run cannot prove reachability convincingly, prefer rejection over speculative acceptance.

package/templates/security-report.md.template

@@ -0,0 +1,43 @@
+# Security Audit Report
+
+- Project: REPLACE_WITH_PROJECT_NAME
+- Audit scope: diff | full
+- Base ref: REPLACE_WITH_BASE_REF
+- Head ref: REPLACE_WITH_HEAD_REF
+- Threat model: REPLACE_WITH_THREAT_MODEL
+- Focus path: REPLACE_WITH_FOCUS_PATH
+- Generated at: REPLACE_WITH_TIMESTAMP
+- Generated by: security-audit
+
+## Summary
+
+- Accepted findings: 0
+- Rejected candidates: 0
+- Selected file: REPLACE_WITH_SELECTED_FILE
+- Investigation target: REPLACE_WITH_INVESTIGATION_TARGET
+
+## Accepted Findings
+
+### SEC-0001
+
+- Title: REPLACE_WITH_TITLE
+- Kind: command_execution
+- Severity: high
+- Report: REPLACE_WITH_REPORT_PATH
+
+#### Why this matters
+
+REPLACE_WITH_IMPACT
+
+#### Recommended next step
+
+REPLACE_WITH_NEXT_STEP
+
+## Rejected Candidates
+
+- None
+
+## Safety Notes
+
+- This run was limited to repo-local analysis and locally launched services or local files.
+- Proofs should stay minimal and non-destructive.

package/templates/start-claude.sh.template

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Cairnkeep launcher for Claude Code. Loads this repo's .ai/.env (if present),
+# then launches Claude Code in the repo root. Keep provider/profile specifics in
+# your own wrapper; this stays minimal and generic.
+#
+# Wrapper seams (all optional, all no-ops when absent):
+#   .ai/pre-launch.sh        sourced after .env, before launch. May export env
+#                            (e.g. a provider base URL) or abort the launch by
+#                            returning / exiting non-zero.
+#   CAIRN_EXTRA_SETTINGS     path to a settings JSON layered on top of the
+#                            harness defaults (passed as --settings). Process env
+#                            still wins over this file, so an inline value beats
+#                            the profile.
+#   .ai/post-exit.sh         sourced after the harness exits (normal or not),
+#                            with $CAIRN_EXIT_STATUS set to the harness exit code.
+set -euo pipefail
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+if [[ -f "$ROOT_DIR/.ai/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1091
+  . "$ROOT_DIR/.ai/.env"
+  set +a
+fi
+if [[ -f "$ROOT_DIR/.ai/pre-launch.sh" ]]; then
+  # shellcheck disable=SC1091
+  . "$ROOT_DIR/.ai/pre-launch.sh"
+fi
+cd "$ROOT_DIR"
+
+launch_args=()
+if [[ -n "${CAIRN_EXTRA_SETTINGS:-}" ]]; then
+  launch_args+=(--settings "$CAIRN_EXTRA_SETTINGS")
+fi
+
+if [[ -f "$ROOT_DIR/.ai/post-exit.sh" ]]; then
+  # Run (not exec) so the post-exit hook fires after the harness returns.
+  set +e
+  claude "${launch_args[@]}" "$@"
+  CAIRN_EXIT_STATUS=$?
+  set -e
+  export CAIRN_EXIT_STATUS
+  # shellcheck disable=SC1091
+  . "$ROOT_DIR/.ai/post-exit.sh" || true
+  exit "$CAIRN_EXIT_STATUS"
+fi
+exec claude "${launch_args[@]}" "$@"

package/templates/start-opencode.sh.template

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Cairnkeep launcher for OpenCode. Loads this repo's .ai/.env (if present), then
+# launches OpenCode in the repo root. Keep provider/profile specifics in your own
+# wrapper; this stays minimal and generic.
+#
+# Wrapper seams (all optional, all no-ops when absent):
+#   .ai/pre-launch.sh        sourced after .env, before launch. May export env
+#                            or abort the launch by returning / exiting non-zero.
+#   CAIRN_EXTRA_SETTINGS     path to an OpenCode config file layered via --config.
+#   .ai/post-exit.sh         sourced after OpenCode exits, with $CAIRN_EXIT_STATUS
+#                            set to the exit code.
+set -euo pipefail
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+if [[ -f "$ROOT_DIR/.ai/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1091
+  . "$ROOT_DIR/.ai/.env"
+  set +a
+fi
+if [[ -f "$ROOT_DIR/.ai/pre-launch.sh" ]]; then
+  # shellcheck disable=SC1091
+  . "$ROOT_DIR/.ai/pre-launch.sh"
+fi
+cd "$ROOT_DIR"
+
+launch_args=()
+if [[ -n "${CAIRN_EXTRA_SETTINGS:-}" ]]; then
+  launch_args+=(--config "$CAIRN_EXTRA_SETTINGS")
+fi
+
+if [[ -f "$ROOT_DIR/.ai/post-exit.sh" ]]; then
+  set +e
+  opencode "${launch_args[@]}" "$@"
+  CAIRN_EXIT_STATUS=$?
+  set -e
+  export CAIRN_EXIT_STATUS
+  # shellcheck disable=SC1091
+  . "$ROOT_DIR/.ai/post-exit.sh" || true
+  exit "$CAIRN_EXIT_STATUS"
+fi
+exec opencode "${launch_args[@]}" "$@"

package/templates/structured-change-canvas.md.template

@@ -0,0 +1,63 @@
+# Structured Change Canvas
+
+Use this file as a starter for non-trivial changes that should be reviewed at the intent level before code is generated or edited.
+
+- Project: REPLACE_WITH_PROJECT_NAME
+- Base branch: REPLACE_WITH_DEFAULT_BRANCH
+- Change slug: <short-change-slug>
+- Status: draft
+- Owner: <name>
+- Related issue / branch / prompt: <link-or-id>
+
+## Requirements
+
+- Problem to solve:
+- In scope:
+- Out of scope:
+- Done when:
+
+## Entities
+
+- Domain concepts and relationships:
+- Existing interfaces, data contracts, or policies involved:
+- External systems or dependencies touched:
+
+## Approach
+
+- Chosen implementation approach:
+- Alternatives rejected:
+- Key assumptions and risks:
+
+## Structure
+
+- Expected files, modules, or subsystems to change:
+- Integration boundaries that must stay stable:
+- Migration or rollback considerations:
+
+## Operations
+
+1. First implementation step:
+2. Next implementation step:
+3. Validation or rollout step:
+
+## Norms
+
+- Engineering rules that apply to this slice:
+- Required tests or checks:
+- Required docs, wiki, or memory updates:
+
+## Safeguards
+
+- Security or privacy constraints:
+- Performance or reliability limits:
+- Explicit no-go changes:
+
+## Validation
+
+- Commands to run:
+- Evidence expected when the slice is correct:
+
+## Sync Rules
+
+- If requirements change, update this canvas before updating code.
+- If implementation changes for a valid reason, sync this canvas before merging.

package/templates/wiki-contradictions.md.template

@@ -0,0 +1,31 @@
+# Wiki Contradiction Register
+
+> Persistent register of contradictions flagged across `.planning/wiki/`.
+> Updated in place by `/wiki-lint`. Unlike per-run REPORTS, this file is the
+> durable record — lint opens and resolves entries here rather than emitting
+> write-and-forget reports. Raw repo docs, tests, interfaces, config, and code
+> remain canonical; this register only tracks where the *derived* wiki disagrees.
+
+## Severity Taxonomy
+
+- **soft** — non-blocking, contextual difference. Pages can coexist; flagged for awareness. No action required unless it accumulates.
+- **scope-mismatch** — the two claims apply to different scopes/contexts and do not truly conflict. Recorded so a future reader is not confused; coexists.
+- **hard** — genuinely conflicting claims that cannot both be correct. Must be resolved before downstream work relies on either page. Surface at session start.
+
+## How To Use
+
+- `/wiki-lint` writes/updates entries here on every run. Do not delete open entries by hand — resolve the underlying page disagreement, then let lint (or a `/wiki-ingest --refresh`) flip the status to `resolved`.
+- At session start, scan the **Open** section for `severity: hard`. Surface any hard/open items before doing work that depends on the affected pages.
+- An entry is `resolved` only after the conflicting wiki page(s) have actually been reconciled to the canonical source — not merely acknowledged.
+
+## Open
+
+<!-- wiki:contradictions:open:start -->
+- None.
+<!-- wiki:contradictions:open:end -->
+
+## Resolved
+
+<!-- wiki:contradictions:resolved:start -->
+- None.
+<!-- wiki:contradictions:resolved:end -->

package/templates/wiki-index.md.template

@@ -0,0 +1,40 @@
+# REPLACE_WITH_PROJECT_NAME Knowledge Wiki
+
+> Derived, sparse, citation-heavy notes for faster repository understanding.
+> Canonical truth remains in raw repository docs, tests, interfaces, config, and code.
+
+## How To Use This Wiki
+
+- Start here to find source summaries, optional topic and entity pages, reusable query answers, and lint reports.
+- Follow the cited canonical sources before treating any derived claim as settled.
+- If the wiki conflicts with raw sources, trust the raw sources and note the contradiction.
+
+## Sources
+
+<!-- wiki:sources:start -->
+- None yet.
+<!-- wiki:sources:end -->
+
+## Topics
+
+<!-- wiki:topics:start -->
+- None yet.
+<!-- wiki:topics:end -->
+
+## Entities
+
+<!-- wiki:entities:start -->
+- None yet.
+<!-- wiki:entities:end -->
+
+## Queries
+
+<!-- wiki:queries:start -->
+- None yet.
+<!-- wiki:queries:end -->
+
+## Reports
+
+<!-- wiki:reports:start -->
+- None yet.
+<!-- wiki:reports:end -->

package/templates/wiki-lint-report.md.template

@@ -0,0 +1,38 @@
+# Wiki Lint Report
+
+- Project: REPLACE_WITH_PROJECT_NAME
+- Generated at: REPLACE_WITH_TIMESTAMP
+- Scope: REPLACE_WITH_SCOPE
+- Advisory status: Raw repository docs, tests, interfaces, config, and code remain canonical.
+
+## Summary
+
+- Missing citations: 0
+- Orphan pages: 0
+- Stale claims: 0
+- Contradicted claims: 0 (hard: 0 / scope-mismatch: 0 / soft: 0)
+- Missing obvious pages: 0
+- Broken cross-references: 0
+
+> Contradiction entries are also written to `.planning/wiki/CONTRADICTIONS.md`,
+> the persistent register. This report is a snapshot; the register is durable.
+
+## Contradictions (severity-tagged)
+
+- None.
+
+## High Signal Findings
+
+- None.
+
+## Medium Signal Findings
+
+- None.
+
+## Low Signal Findings
+
+- None.
+
+## Suggested Next Steps
+
+- Keep the wiki sparse, citation-heavy, and aligned to canonical raw sources.

package/templates/wiki-log.md.template

@@ -0,0 +1,11 @@
+# Wiki Log
+
+This log records wiki ingests, reusable query writebacks, and advisory lint runs.
+
+Raw repository docs, tests, interfaces, config, and code remain canonical.
+
+## Entries
+
+<!-- wiki:entries:start -->
+- Scaffold initialized. Append timestamped `wiki-ingest`, `wiki-query --writeback`, and `wiki-lint` entries below.
+<!-- wiki:entries:end -->