@cairnkeep/cli 2.11.0 → 2.13.0

package/scripts/test-phase19-eval-lifecycle.sh

@@ -336,8 +336,18 @@ const cancelTask={...tasks[0],id:"task-cancel",input:"cancel"};
 const cancelPlan=makePlan([cancelTask]);
 const cancelStore=await reports.createEvalReportStore({root:join(fixtureRoot,"reports"),experiment_id:"cancel-fixture"});
 const controller=new AbortController();
-setTimeout(()=>controller.abort(),100);
-const cancelled=await runner.runTwoPassExperiment({plan:cancelPlan,report_store:cancelStore,temporary_root:fixtureRoot,signal:controller.signal,distill_command:{program:process.execPath,args:[distillerScript]}});
+const cancellation=runner.runTwoPassExperiment({plan:cancelPlan,report_store:cancelStore,temporary_root:fixtureRoot,signal:controller.signal,distill_command:{program:process.execPath,args:[distillerScript]}});
+let adapterStarted=false;
+for (let attempt=0; attempt<200; attempt+=1) {
+  await new Promise((resolve)=>setTimeout(resolve,25));
+  if (existsSync(invocationLog) && readFileSync(invocationLog,"utf8").includes("task-cancel:run1")) {
+    adapterStarted=true;
+    break;
+  }
+}
+assert.equal(adapterStarted,true,"cancellation fixture adapter did not start");
+controller.abort();
+const cancelled=await cancellation;
 assert.equal(cancelled.report.status,"partial");
 assert.deepEqual(cancelled.report.observations.map(({terminal_state})=>terminal_state),["cancelled"]);
 assert.equal(cancelled.report.observations[0].process.cleanup!=="pending",true);

package/scripts/test-setup-compatibility.mjs

@@ -18,6 +18,7 @@ import { tmpdir } from "node:os";
 import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { bootstrapWindows } from "./windows-platform.mjs";
+import { HARNESS_IDS } from "./harness-registry.mjs";
 
 const EXPECTED_RED_EXIT = 86;
 const RED_MARKER = "PHASE26_RED:SETUP_RECONCILE_MISSING";
@@ -25,8 +26,8 @@ const here = dirname(fileURLToPath(import.meta.url));
 const root = resolve(here, "..");
 const setupCorePath = join(here, "setup-core.mjs");
 const setupReconcilePath = join(here, "setup-reconcile.mjs");
-const HARNESSES = ["claude", "opencode", "pi", "kimi", "qwen"];
-const MANAGED_ROOTS = [".ai", ".planning", ".agentfs"];
+const HARNESSES = HARNESS_IDS;
+const MANAGED_ROOTS = [".ai", ".codex", ".planning", ".agentfs"];
 
 function run(executable, args, options = {}) {
   const result = spawnSync(executable, args, {
@@ -141,9 +142,9 @@ async function testSetupCompatibility(production, sandbox, legacy) {
     choices: Object.freeze({ git: "existing", harnesses: HARNESSES, memory: "local", confirmed: true }),
   });
   const result = await production.reconcile.reconcileSetupPlan(plan);
-  assert.deepEqual(result.counts, { created: legacy.posixBefore.size, updated: 0, unchanged: 0, skipped: 0 });
+  assert.deepEqual(result.counts, { created: legacy.posixBefore.size + 1, updated: 0, unchanged: 0, skipped: 0 });
   const current = snapshot(target);
-  assertSnapshotEqual(current, legacy.posixBefore, "deterministic setup", [".ai/cairnkeep.json"]);
+  assertSnapshotEqual(current, legacy.posixBefore, "deterministic setup", [".ai/cairnkeep.json", ".codex/config.toml"]);
   assert.ok(current.has(".ai/cairnkeep.json"), "setup state missing");
   const state = JSON.parse(current.get(".ai/cairnkeep.json").bytes.toString("utf8"));
   assert.deepEqual(state.harnesses, HARNESSES);

package/scripts/test-uninstall.sh

@@ -124,6 +124,7 @@ ADJACENT_PROJECT="$SB/adjacent-project"
 mkdir -p "$PROJECT_DATA/.ai" \
   "$PROJECT_DATA/.agentfs/eval/experiments/complete/snapshots/task-one" \
   "$PROJECT_DATA/.agentfs/eval/experiments/partial" \
+  "$PROJECT_DATA/.agentfs/work-evidence/v1/records" \
   "$ADJACENT_PROJECT/.agentfs/eval/experiments/adjacent"
 printf '%s\n' '{"schema_version":1,"capabilities":{"wiki":false},"logging":{"callbacks":true}}' >"$PROJECT_DATA/.ai/capabilities.json"
 chmod 600 "$PROJECT_DATA/.ai/capabilities.json"
@@ -132,17 +133,22 @@ printf 'artifact-v1\000durable\377bytes\n' >"$PROJECT_DATA/.agentfs/artifacts.db
 printf 'session-and-callback-v1\000durable\377bytes\n' >"$PROJECT_DATA/.agentfs/trajectory.db"
 printf 'callback-wal-v1\000durable\377bytes\n' >"$PROJECT_DATA/.agentfs/trajectory.db-wal"
 printf 'unrelated-memory-v1\000durable\377bytes\n' >"$PROJECT_DATA/.agentfs/project.db"
+printf 'work-evidence-v1\000durable\377bytes\n' >"$PROJECT_DATA/.agentfs/work-evidence/v1/records/wev-fixture.json"
 printf 'complete-report-v1\000private\377bytes\n' >"$PROJECT_DATA/.agentfs/eval/experiments/complete/report.json"
 printf 'partial-report-v1\000private\377bytes\n' >"$PROJECT_DATA/.agentfs/eval/experiments/partial/report.json"
 printf 'note-snapshot-v1\000private\377bytes\n' >"$PROJECT_DATA/.agentfs/eval/experiments/complete/snapshots/task-one/note.md"
 printf 'adjacent-eval-v1\000must-survive\377bytes\n' >"$ADJACENT_PROJECT/.agentfs/eval/experiments/adjacent/report.json"
 chmod 700 "$PROJECT_DATA/.agentfs" "$PROJECT_DATA/.agentfs/eval" \
+  "$PROJECT_DATA/.agentfs/work-evidence" \
+  "$PROJECT_DATA/.agentfs/work-evidence/v1" \
+  "$PROJECT_DATA/.agentfs/work-evidence/v1/records" \
   "$PROJECT_DATA/.agentfs/eval/experiments" \
   "$PROJECT_DATA/.agentfs/eval/experiments/complete" \
   "$PROJECT_DATA/.agentfs/eval/experiments/complete/snapshots" \
   "$PROJECT_DATA/.agentfs/eval/experiments/complete/snapshots/task-one" \
   "$PROJECT_DATA/.agentfs/eval/experiments/partial"
 chmod 600 "$PROJECT_DATA/.agentfs/project.db" \
+  "$PROJECT_DATA/.agentfs/work-evidence/v1/records/wev-fixture.json" \
   "$PROJECT_DATA/.agentfs/eval/experiments/complete/report.json" \
   "$PROJECT_DATA/.agentfs/eval/experiments/partial/report.json"
 chmod 400 "$PROJECT_DATA/.agentfs/eval/experiments/complete/snapshots/task-one/note.md"
@@ -155,6 +161,7 @@ cp "$PROJECT_DATA/.ai/operator-state.bin" "$SB/operator-state.before.bin"
 cp "$PROJECT_DATA/.agentfs/artifacts.db" "$SB/artifacts.before.db"
 cp "$PROJECT_DATA/.agentfs/trajectory.db" "$SB/trajectory.before.db"
 cp "$PROJECT_DATA/.agentfs/trajectory.db-wal" "$SB/trajectory.before.db-wal"
+cp "$PROJECT_DATA/.agentfs/work-evidence/v1/records/wev-fixture.json" "$SB/work-evidence.before.json"
 agentfs_before=$(tree_identity "$PROJECT_DATA/.agentfs")
 eval_before=$(tree_identity "$PROJECT_DATA/.agentfs/eval")
 adjacent_before=$(tree_identity "$ADJACENT_PROJECT/.agentfs")
@@ -239,6 +246,7 @@ check "default uninstall leaves normal OpenCode installation exact" "$(diff -qr
 check "default uninstall keeps unrelated .ai bytes exact" "$(cmp -s "$SB/operator-state.before.bin" "$PROJECT_DATA/.ai/operator-state.bin" && echo yes || echo no)" "yes"
 check "default uninstall keeps callback DB exact" "$(cmp -s "$SB/trajectory.before.db" "$PROJECT_DATA/.agentfs/trajectory.db" && echo yes || echo no)" "yes"
 check "default uninstall keeps callback WAL exact" "$(cmp -s "$SB/trajectory.before.db-wal" "$PROJECT_DATA/.agentfs/trajectory.db-wal" && echo yes || echo no)" "yes"
+check "default uninstall keeps work evidence exact" "$(cmp -s "$SB/work-evidence.before.json" "$PROJECT_DATA/.agentfs/work-evidence/v1/records/wev-fixture.json" && echo yes || echo no)" "yes"
 check "default uninstall keeps complete and partial eval reports, snapshots, modes, and layout exact" "$(tree_identity "$PROJECT_DATA/.agentfs/eval")" "$eval_before"
 check "default uninstall keeps unrelated project memory exact" "$(tree_identity "$PROJECT_DATA/.agentfs")" "$agentfs_before"
 check "default uninstall leaves adjacent project exact" "$(tree_identity "$ADJACENT_PROJECT/.agentfs")" "$adjacent_before"
@@ -271,6 +279,7 @@ ARTIFACT_BK=$(ls -dt "$ARTIFACT_HOME/.cairnkeep-uninstall-"* 2>/dev/null | head
 check "artifact purge backup is exact" "$(cmp -s "$SB/artifacts.before.db" "$ARTIFACT_BK/files/${PROJECT_DATA#/}/.agentfs/artifacts.db" && echo yes || echo no)" "yes"
 check "callback purge backup is exact" "$(cmp -s "$SB/trajectory.before.db" "$ARTIFACT_BK/files/${PROJECT_DATA#/}/.agentfs/trajectory.db" && echo yes || echo no)" "yes"
 check "callback WAL purge backup is exact" "$(cmp -s "$SB/trajectory.before.db-wal" "$ARTIFACT_BK/files/${PROJECT_DATA#/}/.agentfs/trajectory.db-wal" && echo yes || echo no)" "yes"
+check "work-evidence purge backup is exact" "$(cmp -s "$SB/work-evidence.before.json" "$ARTIFACT_BK/files/${PROJECT_DATA#/}/.agentfs/work-evidence/v1/records/wev-fixture.json" && echo yes || echo no)" "yes"
 check "purge backup contains exact eval tree, bytes, and modes" "$(tree_identity "$ARTIFACT_BK/files/${PROJECT_DATA#/}/.agentfs/eval")" "$eval_before"
 check "purge backup contains exact unrelated project memory" "$(tree_identity "$ARTIFACT_BK/files/${PROJECT_DATA#/}/.agentfs")" "$agentfs_before"
 check "selected-project purge leaves adjacent project exact" "$(tree_identity "$ADJACENT_PROJECT/.agentfs")" "$adjacent_before"
@@ -278,6 +287,7 @@ HOME="$ARTIFACT_HOME" XDG_CONFIG_HOME="$ARTIFACT_HOME/.config" bash "$ARTIFACT_B
 check "artifact revert restores exact bytes" "$(cmp -s "$SB/artifacts.before.db" "$PROJECT_DATA/.agentfs/artifacts.db" && echo yes || echo no)" "yes"
 check "callback revert restores exact bytes" "$(cmp -s "$SB/trajectory.before.db" "$PROJECT_DATA/.agentfs/trajectory.db" && echo yes || echo no)" "yes"
 check "callback WAL revert restores exact bytes" "$(cmp -s "$SB/trajectory.before.db-wal" "$PROJECT_DATA/.agentfs/trajectory.db-wal" && echo yes || echo no)" "yes"
+check "work-evidence revert restores exact bytes" "$(cmp -s "$SB/work-evidence.before.json" "$PROJECT_DATA/.agentfs/work-evidence/v1/records/wev-fixture.json" && echo yes || echo no)" "yes"
 check "purge revert restores exact eval tree, bytes, and modes" "$(tree_identity "$PROJECT_DATA/.agentfs/eval")" "$eval_before"
 check "purge revert restores exact unrelated project memory" "$(tree_identity "$PROJECT_DATA/.agentfs")" "$agentfs_before"
 check "purge revert leaves adjacent project exact" "$(tree_identity "$ADJACENT_PROJECT/.agentfs")" "$adjacent_before"

package/scripts/test-windows-native.mjs

@@ -16,6 +16,7 @@ import {
   runWindowsCommand,
 } from "./windows-platform.mjs";
 import { runNativeContainer } from "./cairn-container-cli.mjs";
+import { HARNESS_IDS } from "./harness-registry.mjs";
 
 const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
 const sandbox = mkdtempSync(join(tmpdir(), "cairn-windows-native-"));
@@ -28,13 +29,15 @@ try {
   const project = join(sandbox, "Project with spaces – Unicode");
   mkdirSync(project, { recursive: true });
   bootstrapWindows(root, [project]);
-  for (const harness of ["claude", "opencode", "pi", "kimi", "qwen"]) {
+  for (const harness of HARNESS_IDS) {
     assert.ok(existsSync(join(project, ".ai", `start-${harness}.cmd`)), `${harness} cmd launcher`);
   }
   assert.match(readFileSync(join(project, ".ai", "start-claude.cmd"), "utf8"), /start-harness\.ps1/);
   assert.match(launcherModule(), /spawnSync\(command/);
   assert.match(launcherPowerShell(), /pre-launch\.ps1/);
   assert.match(launcherPowerShell(), /post-exit\.ps1/);
+  assert.match(launcherPowerShell(), /evidence run --harness/);
+  assert.match(launcherPowerShell(), /CAIRN_WORK_EVIDENCE/);
 
   const claudeRoot = join(sandbox, "Claude Config");
   await runWindowsCommand({ command: "sync", args: ["--apply", "--live-root", claudeRoot], root });
@@ -55,6 +58,7 @@ try {
   await runWindowsCommand({ command: "memory", args: ["import", archive], root });
   assert.equal(readFileSync(join(memory, "project.db"), "utf8"), "sqlite-a");
   assert.match(powershellCompletion(), /Register-ArgumentCompleter/);
+  assert.match(powershellCompletion(), /evidence/);
 
   let containerArgs = [];
   runNativeContainer(["stdio", "--image", "example/windows:1", "--volume", "windows-data"], root, (_engine, args) => { containerArgs = args; });
@@ -125,6 +129,28 @@ try {
     assert.match(powershellCompletion(), /--policy/);
     assert.match(powershellCompletion(), /--yes/);
     assert.match(powershellCompletion(), /--json/);
+    assert.match(powershellCompletion(), /codex/);
+
+    const codexProject = join(sandbox, "Guided Codex Project");
+    let codexOutput = "";
+    process.stdout.write = ((chunk) => {
+      codexOutput += String(chunk);
+      return true;
+    });
+    try {
+      await runWindowsCommand({
+        command: "setup",
+        args: [codexProject, "--git", "none", "--harness", "codex", "--memory", "local", "--yes", "--json"],
+        root,
+      });
+    } finally {
+      process.stdout.write = originalWrite;
+    }
+    const codexResult = JSON.parse(codexOutput);
+    assert.deepEqual(codexResult.harnesses, ["codex"]);
+    assert.equal(codexResult.machine_sync.command, null);
+    assert.ok(existsSync(join(codexProject, ".ai", "start-codex.cmd")));
+    assert.match(readFileSync(join(codexProject, ".codex", "config.toml"), "utf8"), /mcp_servers\.cairn-memory/);
     console.log("PASS: simulated Windows setup parity, private state, recovery, and completion contract");
   }
 } finally {

package/scripts/test-work-evidence-cli.sh

@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+fail() { echo "FAIL: $1" >&2; exit 1; }
+
+npm --prefix "$ROOT/mcp-memory-server" run build >/dev/null
+
+fake_bin="$tmp/bin"
+mkdir -p "$fake_bin"
+cat >"$fake_bin/cairn" <<EOF
+#!/usr/bin/env bash
+exec node "$ROOT/bin/cairn" "\$@"
+EOF
+chmod +x "$fake_bin/cairn"
+
+for harness in claude opencode pi kimi qwen codex; do
+  project="$tmp/$harness"
+  mkdir -p "$project/.ai" "$project/.agentfs"
+  cp "$ROOT/templates/start-$harness.sh.template" "$project/.ai/start-$harness.sh"
+  chmod +x "$project/.ai/start-$harness.sh"
+  printf '*\n!.gitignore\n' >"$project/.agentfs/.gitignore"
+  printf 'CAIRN_WORK_EVIDENCE=1\n' >"$project/.ai/.env"
+  cat >"$fake_bin/$harness" <<EOF
+#!/usr/bin/env bash
+printf '%s\n' "\$*" > "$project/args.txt"
+printf '%s\n' changed > "$project/session.txt"
+exit 17
+EOF
+  chmod +x "$fake_bin/$harness"
+  cat >"$project/.ai/post-exit.sh" <<EOF
+printf '%s\n' "\$CAIRN_EXIT_STATUS" > "$project/post-status.txt"
+EOF
+  (
+    cd "$project"
+    git init --quiet
+    git config user.email fixture@example.invalid
+    git config user.name Fixture
+    printf '%s\n' start > session.txt
+    git add session.txt .agentfs/.gitignore
+    git commit --quiet -m start
+  )
+  status=0
+  PATH="$fake_bin:$PATH" "$project/.ai/start-$harness.sh" --fixture "value with spaces" || status=$?
+  [[ $status -eq 17 ]] || fail "$harness launcher lost exit status"
+  grep -q -- '--fixture value with spaces' "$project/args.txt" || fail "$harness launcher lost arguments"
+  [[ $(cat "$project/post-status.txt") == 17 ]] || fail "$harness post-exit seam lost status"
+  (cd "$project" && PATH="$fake_bin:$PATH" "$ROOT/bin/cairn" evidence list --json) >"$tmp/$harness.json"
+  node -e '
+const value=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));
+if(value.evidence.length!==1||value.evidence[0].status!=="complete"||value.evidence[0].harness!==process.argv[2]||value.evidence[0].exit_status!==17)process.exit(1);
+if(!value.evidence[0].touched_paths.includes("session.txt"))process.exit(1);
+' "$tmp/$harness.json" "$harness" || fail "$harness evidence record is incomplete"
+done
+
+disabled="$tmp/disabled"
+mkdir -p "$disabled/.ai"
+cp "$ROOT/templates/start-codex.sh.template" "$disabled/.ai/start-codex.sh"
+chmod +x "$disabled/.ai/start-codex.sh"
+cat >"$fake_bin/cairn" <<'EOF'
+#!/usr/bin/env bash
+exit 88
+EOF
+cat >"$fake_bin/codex" <<'EOF'
+#!/usr/bin/env bash
+exit 0
+EOF
+chmod +x "$fake_bin/cairn" "$fake_bin/codex"
+PATH="$fake_bin:$PATH" "$disabled/.ai/start-codex.sh" || fail "disabled launcher called the evidence wrapper"
+[[ ! -e "$disabled/.agentfs/work-evidence" ]] || fail "disabled launcher created evidence storage"
+
+cat >"$fake_bin/codex" <<EOF
+#!/usr/bin/env bash
+printf launched >"$tmp/old-cairn-fallback"
+exit 19
+EOF
+chmod +x "$fake_bin/codex"
+status=0
+CAIRN_WORK_EVIDENCE=1 PATH="$fake_bin:$PATH" "$disabled/.ai/start-codex.sh" 2>"$tmp/old-cairn.err" || status=$?
+[[ $status -eq 19 ]] || fail "old cairn fallback lost the harness exit status"
+[[ -f "$tmp/old-cairn-fallback" ]] || fail "old cairn fallback did not launch the harness"
+grep -q 'compatible evidence command unavailable' "$tmp/old-cairn.err" || fail "old cairn fallback did not explain capture loss"
+
+"$ROOT/bin/cairn" help | grep -q 'cairn evidence' || fail "root help omits evidence"
+node "$ROOT/mcp-memory-server/dist/work-evidence-cli.js" --help | grep -q 'cairn evidence list' || fail "evidence help omits list"
+
+echo "PASS: work-evidence CLI and all harness launchers preserve lifecycle semantics"

package/scripts/uninstall.sh

@@ -45,6 +45,7 @@ PROJECT_AI_FILES=(
   start-pi.sh
   start-kimi.sh
   start-qwen.sh
+  start-codex.sh
   env.example
   trajectory-redaction.json
   capabilities.json
@@ -129,9 +130,11 @@ remove_path() {
 # record. The record identifies candidates, but never grants authority to an
 # arbitrary path. Modified candidates are still backed up before removal.
 setup_owned_paths() {
-  node --input-type=module - "$1" <<'NODE'
+  node --input-type=module - "$1" "$CAIRN_ROOT/scripts/harness-registry.mjs" <<'NODE'
 import { lstatSync, readFileSync } from "node:fs";
+import { pathToFileURL } from "node:url";
 const path = process.argv[2];
+const registry = await import(pathToFileURL(process.argv[3]).href);
 const info = lstatSync(path);
 if (!info.isFile() || info.isSymbolicLink() || info.size > 1024 * 1024) process.exit(1);
 if (process.platform !== "win32" && (info.mode & 0o777) !== 0o600) process.exit(1);
@@ -153,7 +156,8 @@ const allowed = new Set([
   ".planning/wiki/LOG.md", ".planning/alignment/policy.md", ".planning/alignment/gap-register.yaml",
   ".planning/graphs/policy.md", ".planning/graphs/.gitignore", ".planning/security/policy.md",
   ".ai/start-harness.mjs", ".ai/start-harness.ps1",
-  ...["claude", "opencode", "pi", "kimi", "qwen"].flatMap((name) => [`.ai/start-${name}.sh`, `.ai/start-${name}.cmd`]),
+  ...registry.HARNESS_IDS.flatMap((name) => [`.ai/start-${name}.sh`, `.ai/start-${name}.cmd`]),
+  ...registry.HARNESS_IDS.flatMap((name) => registry.harnessProjectAssets(name, "local").map(({ path }) => path)),
 ]);
 for (const [asset, record] of Object.entries(state.assets)) {
   if (!allowed.has(asset)
@@ -321,7 +325,7 @@ for proj in "${PROJECTS[@]:-}"; do
       if [[ $DRY_RUN -eq 0 ]]; then
         for managed_dir in \
           "$proj/.planning/wiki" "$proj/.planning/alignment" "$proj/.planning/graphs" \
-          "$proj/.planning/security" "$proj/.planning" "$proj/.ai" "$proj/.agentfs"; do
+          "$proj/.planning/security" "$proj/.planning" "$proj/.codex" "$proj/.ai" "$proj/.agentfs"; do
           rmdir "$managed_dir" 2>/dev/null || true
         done
       fi

package/scripts/verify-docs-parity.sh

@@ -432,6 +432,41 @@ check_artifact_remote_path_contract() {
   return "$failed"
 }
 
+check_work_evidence_contract() {
+  local failed=0 key value source_term
+
+  while IFS='|' read -r key value source_term; do
+    [[ -n "$key" ]] || continue
+    grep -qF "$key" mcp-memory-server/src/work-evidence-schema.ts || failed=1
+    grep -qF "$source_term" mcp-memory-server/src/work-evidence-schema.ts || failed=1
+    grep -qxF "# $key=$value" templates/env.example.template || failed=1
+    grep -qF "$key" README.md docs/operating.md docs/work-evidence.md || failed=1
+    grep -qF "$value" README.md docs/operating.md docs/work-evidence.md || failed=1
+  done <<'EOF'
+CAIRN_WORK_EVIDENCE_RETENTION_DAYS|30|WORK_EVIDENCE_DEFAULT_RETENTION_DAYS = 30
+CAIRN_WORK_EVIDENCE_STORE_MAX_BYTES|67108864|WORK_EVIDENCE_DEFAULT_STORE_MAX_BYTES = 64 * 1024 * 1024
+CAIRN_WORK_EVIDENCE_MAX_TOUCHED_PATHS|4096|WORK_EVIDENCE_DEFAULT_MAX_TOUCHED_PATHS = 4096
+CAIRN_WORK_EVIDENCE_PATCH_MAX_BYTES|1048576|WORK_EVIDENCE_DEFAULT_PATCH_MAX_BYTES = 1024 * 1024
+EOF
+
+  for key in CAIRN_WORK_EVIDENCE CAIRN_WORK_EVIDENCE_PATCH; do
+    grep -qF "$key" mcp-memory-server/src/work-evidence-schema.ts templates/env.example.template README.md docs/operating.md docs/privacy-and-data-flow.md || failed=1
+  done
+  for source_term in work_evidence_list work_evidence_read; do
+    grep -qF "\"$source_term\"" mcp-memory-server/src/index.ts || failed=1
+    grep -qF "$source_term" README.md docs/operating.md docs/privacy-and-data-flow.md docs/work-evidence.md || failed=1
+  done
+  for source_term in 'list [--status pending|complete] [--json]' 'show <evidence-id-or-prefix> [--json]' 'delete <evidence-id-or-prefix> [--dry-run] [--json]' 'prune [--dry-run] [--json]' 'doctor [--repair] [--json]'; do
+    grep -qF "$source_term" mcp-memory-server/src/work-evidence-cli.ts || failed=1
+  done
+  grep -qF '.agentfs/work-evidence/v1/' docs/storage.md docs/privacy-and-data-flow.md docs/work-evidence.md || failed=1
+  grep -qF 'cairn evidence' docs/learning/CURRICULUM-MAP.md docs/learning/FEATURE-GUIDE.md docs/learning/lessons/L13-session-evidence.md || failed=1
+  grep -qF 'never exposed by the HTTP transport' docs/work-evidence.md || failed=1
+
+  [[ "$failed" -eq 0 ]] && echo "[work-evidence-contract] OK: flags/defaults/tools/storage/privacy/learning match source"
+  return "$failed"
+}
+
 check_capability_contract() {
   local failed=0 file id env tool term source_file docs_files
 
@@ -624,6 +659,7 @@ main() {
   check_typed_contract || failed=1
   check_artifact_contract || failed=1
   check_artifact_remote_path_contract || failed=1
+  check_work_evidence_contract || failed=1
   check_capability_contract || failed=1
   check_native_capability_docs || failed=1
 

package/scripts/windows-platform.mjs

@@ -20,6 +20,7 @@ import { gzipSync, gunzipSync } from "node:zlib";
 import { spawnSync } from "node:child_process";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { homedir, tmpdir } from "node:os";
+import { HARNESS_IDS, harnessProjectAssets } from "./harness-registry.mjs";
 
 const BOOTSTRAP_FILES = [
   ["env.example.template", ".ai/env.example"],
@@ -39,7 +40,7 @@ const BOOTSTRAP_FILES = [
   ["security-policy.md.template", ".planning/security/policy.md"],
 ];
 
-const HARNESSES = ["claude", "opencode", "pi", "kimi", "qwen"];
+const HARNESSES = HARNESS_IDS;
 const HOOK_EVENTS = new Map([
   ["memory-wakeup", ["SessionStart", ""]],
   ["memory-capture", ["SessionEnd", ""]],
@@ -189,7 +190,19 @@ if ($env:CAIRN_EXTRA_SETTINGS -and $Harness -eq 'claude') {
 if ($env:CAIRN_EXTRA_SETTINGS -and $Harness -eq 'opencode') { $env:OPENCODE_CONFIG = $env:CAIRN_EXTRA_SETTINGS }
 Push-Location $ProjectRoot
 try {
-  & $Harness @HarnessArgs
+  $EvidenceEnabled = $env:CAIRN_WORK_EVIDENCE -match '^(1|true|yes|on)$'
+  $CairnCommand = if ($EvidenceEnabled) { Get-Command cairn -ErrorAction SilentlyContinue } else { $null }
+  $EvidenceSupported = $false
+  if ($EvidenceEnabled -and $CairnCommand) {
+    & $CairnCommand.Source evidence --help *> $null
+    $EvidenceSupported = ($LASTEXITCODE -eq 0)
+  }
+  if ($EvidenceSupported) {
+    & $CairnCommand.Source evidence run --harness $Harness -- $Harness @HarnessArgs
+  } else {
+    if ($EvidenceEnabled) { Write-Warning 'a compatible cairn evidence command is unavailable; launching without capture' }
+    & $Harness @HarnessArgs
+  }
   $Status = if ($null -eq $LASTEXITCODE) { 0 } else { $LASTEXITCODE }
 } finally {
   Pop-Location
@@ -249,7 +262,8 @@ export function bootstrapWindows(root, args) {
     installFile(join(templates, source), join(target, ...destination.split("/")), destination.endsWith("capabilities.json") ? 0o600 : 0o644);
   }
   for (const harness of HARNESSES) {
-    installFile(join(templates, `start-${harness}.sh.template`), join(target, ".ai", `start-${harness}.sh`), 0o755);
+    const asset = harnessProjectAssets(harness, "local")[0];
+    installFile(join(templates, asset.template), join(target, ...asset.path.split("/")), asset.mode);
     const cmdPath = join(target, ".ai", `start-${harness}.cmd`);
     if (!existsSync(cmdPath)) atomicWrite(cmdPath, windowsLauncher(harness), 0o755);
   }
@@ -267,7 +281,9 @@ export function bootstrapWindows(root, args) {
   }
 
   console.log(`\nCairnkeep bootstrapped into ${target}`);
-  console.log(`Launch from PowerShell or Command Prompt with ${join(target, ".ai", "start-claude.cmd")}`);
+  console.log(`Codex: run 'cairn setup' in the project and select Codex, review trust, then use ${join(target, ".ai", "start-codex.cmd")}`);
+  console.log(`Claude: register 'cairn memory-server', run 'cairn sync --apply', then use ${join(target, ".ai", "start-claude.cmd")}`);
+  console.log("For new projects, prefer 'cairn setup'; guide: docs/quickstart.md");
 }
 
 function walkFiles(root, predicate = () => true, prefix = "") {
@@ -436,6 +452,7 @@ async function doctorWindows(root, args) {
   for (const [label, file, doctorArgs] of [
     ["trajectory", "trajectory-cli.js", ["doctor", "--json", ...(repair ? ["--repair"] : [])]],
     ["artifact", "artifact-cli.js", ["doctor", "--json", ...(repair ? ["--repair"] : [])]],
+    ["work evidence", "work-evidence-cli.js", ["doctor", "--json", ...(repair ? ["--repair"] : [])]],
     ["typed memory", "node-cli.js", ["doctor", "--project-root", process.cwd(), ...(repair ? ["--repair"] : [])]],
     ["capability", "capability-cli.js", ["doctor", "--json"]],
     ["context pack", "context-pack-cli.js", ["doctor", "--json"]],
@@ -616,7 +633,10 @@ function uninstallWindows(root, args) {
   for (const project of projects) {
     const base = resolve(project);
     for (const [, rel] of BOOTSTRAP_FILES) targets.push(join(base, ...rel.split("/")));
-    for (const harness of HARNESSES) targets.push(join(base, ".ai", `start-${harness}.cmd`));
+    for (const harness of HARNESSES) {
+      for (const asset of harnessProjectAssets(harness, "local")) targets.push(join(base, ...asset.path.split("/")));
+      targets.push(join(base, ".ai", `start-${harness}.cmd`));
+    }
     targets.push(join(base, ".ai", "start-harness.mjs"));
     targets.push(join(base, ".ai", "start-harness.ps1"));
     if (options.has("--purge-memory")) targets.push(join(base, ".agentfs"));
@@ -685,10 +705,11 @@ foreach ($Item in $Manifest.items) {
 }
 
 export function powershellCompletion() {
+  const harnesses = HARNESS_IDS.map((id) => `'${id}'`).join(",");
   return `Register-ArgumentCompleter -Native -CommandName cairn -ScriptBlock {
   param($wordToComplete, $commandAst, $cursorPosition)
-  $commands = 'bootstrap','setup','memory-server','sync','sync-pi','sync-kimi','doctor','trajectory','artifact','capabilities','mcp-tools','pack','notes','eval','skill','graph','memory','audit-timer','uninstall','completion','version','help'
-  $setup = '--git','--harness','--memory','--policy','--yes','--json','init','existing','none','claude','opencode','pi','kimi','qwen','local'
+  $commands = 'bootstrap','setup','memory-server','sync','sync-pi','sync-kimi','doctor','trajectory','artifact','evidence','capabilities','mcp-tools','pack','notes','eval','skill','graph','memory','audit-timer','uninstall','completion','version','help'
+  $setup = '--git','--harness','--memory','--policy','--yes','--json','init','existing','none',${harnesses},'local'
   $candidates = if ($commandAst.ToString() -match '^\\s*cairn\\s+setup(?:\\s|$)') { $setup } else { $commands }
   $candidates | Where-Object { $_ -like "$wordToComplete*" } | ForEach-Object {
     [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_)

package/templates/codex-config.toml.template

@@ -0,0 +1,5 @@
+# Cairnkeep project-scoped memory server. Codex loads project configuration only
+# after the project has been trusted.
+[mcp_servers.cairn-memory]
+command = "cairn"
+args = ["memory-server"]

package/templates/env.example.template

@@ -65,6 +65,16 @@
 # Bootstrap creates .ai/trajectory-redaction.json for optional custom patterns.
 # CAIRN_TRAJECTORY_REDACTION_FILE=.ai/trajectory-redaction.json
 #
+# Git-linked work evidence is local and OFF by default. Generated harness
+# launchers capture bounded Git state before and after a session. Optional patch
+# capture also requires the artifact store; no patch is ever applied by Cairnkeep.
+# CAIRN_WORK_EVIDENCE=1
+# CAIRN_WORK_EVIDENCE_PATCH=1
+# CAIRN_WORK_EVIDENCE_RETENTION_DAYS=30
+# CAIRN_WORK_EVIDENCE_STORE_MAX_BYTES=67108864
+# CAIRN_WORK_EVIDENCE_MAX_TOUCHED_PATHS=4096
+# CAIRN_WORK_EVIDENCE_PATCH_MAX_BYTES=1048576
+#
 # Harness-produced compaction continuity and explicit artifact access are local
 # and OFF by default. Either capability may be enabled independently; neither
 # needs a model, API key, or network endpoint. HTTP artifact tools require the

package/templates/start-claude.sh.template

@@ -68,6 +68,24 @@ if [[ -n "${CAIRN_EXTRA_SETTINGS:-}" ]]; then
   launch_args+=(--settings "$CAIRN_EXTRA_SETTINGS")
 fi
 
+case "${CAIRN_WORK_EVIDENCE:-}" in
+  1|true|TRUE|yes|YES|on|ON)
+    if command -v cairn >/dev/null 2>&1 && cairn evidence --help >/dev/null 2>&1; then
+      set +e
+      cairn evidence run --harness claude -- claude "${launch_args[@]}" "$@"
+      CAIRN_EXIT_STATUS=$?
+      set -e
+      export CAIRN_EXIT_STATUS
+      if [[ -f "$ROOT_DIR/.ai/post-exit.sh" ]]; then
+        # shellcheck disable=SC1091
+        . "$ROOT_DIR/.ai/post-exit.sh" || true
+      fi
+      exit "$CAIRN_EXIT_STATUS"
+    fi
+    echo "cairn: compatible evidence command unavailable; launching without capture" >&2
+    ;;
+esac
+
 if [[ -f "$ROOT_DIR/.ai/post-exit.sh" ]]; then
   # Run (not exec) so the post-exit hook fires after the harness returns.
   set +e

package/templates/start-codex.sh.template

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Cairnkeep launcher for Codex CLI. Loads this project's private .ai/.env and
+# starts Codex in the project root. The project-scoped MCP registration lives in
+# .codex/config.toml and is only loaded after Codex trusts the project.
+set -euo pipefail
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+
+if [[ -f "$ROOT_DIR/.ai/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1091
+  . "$ROOT_DIR/.ai/.env"
+  set +a
+fi
+if [[ -f "$ROOT_DIR/.ai/pre-launch.sh" ]]; then
+  # shellcheck disable=SC1091
+  . "$ROOT_DIR/.ai/pre-launch.sh"
+fi
+cd "$ROOT_DIR"
+
+case "${CAIRN_WORK_EVIDENCE:-}" in
+  1|true|TRUE|yes|YES|on|ON)
+    if command -v cairn >/dev/null 2>&1 && cairn evidence --help >/dev/null 2>&1; then
+      set +e
+      cairn evidence run --harness codex -- codex "$@"
+      CAIRN_EXIT_STATUS=$?
+      set -e
+      export CAIRN_EXIT_STATUS
+      if [[ -f "$ROOT_DIR/.ai/post-exit.sh" ]]; then
+        # shellcheck disable=SC1091
+        . "$ROOT_DIR/.ai/post-exit.sh" || true
+      fi
+      exit "$CAIRN_EXIT_STATUS"
+    fi
+    echo "cairn: compatible evidence command unavailable; launching without capture" >&2
+    ;;
+esac
+
+if [[ -f "$ROOT_DIR/.ai/post-exit.sh" ]]; then
+  set +e
+  codex "$@"
+  CAIRN_EXIT_STATUS=$?
+  set -e
+  export CAIRN_EXIT_STATUS
+  # shellcheck disable=SC1091
+  . "$ROOT_DIR/.ai/post-exit.sh" || true
+  exit "$CAIRN_EXIT_STATUS"
+fi
+exec codex "$@"

package/templates/start-kimi.sh.template

@@ -26,6 +26,23 @@ fi
 
 cd "$ROOT_DIR"
 
+case "${CAIRN_WORK_EVIDENCE:-}" in
+  1|true|TRUE|yes|YES|on|ON)
+    if command -v cairn >/dev/null 2>&1 && cairn evidence --help >/dev/null 2>&1; then
+      set +e
+      cairn evidence run --harness kimi -- kimi "$@"
+      CAIRN_EXIT_STATUS=$?
+      set -e
+      export CAIRN_EXIT_STATUS
+      if [[ -f "$ROOT_DIR/.ai/post-exit.sh" ]]; then
+        # shellcheck disable=SC1091
+        . "$ROOT_DIR/.ai/post-exit.sh" || true
+      fi
+      exit "$CAIRN_EXIT_STATUS"
+    fi
+    echo "cairn: compatible evidence command unavailable; launching without capture" >&2
+    ;;
+esac
 if [[ -f "$ROOT_DIR/.ai/post-exit.sh" ]]; then
   set +e
   kimi "$@"

package/templates/start-opencode.sh.template

@@ -70,6 +70,23 @@ if [[ -n "${CAIRN_EXTRA_SETTINGS:-}" ]]; then
   export OPENCODE_CONFIG="$CAIRN_EXTRA_SETTINGS"
 fi
 
+case "${CAIRN_WORK_EVIDENCE:-}" in
+  1|true|TRUE|yes|YES|on|ON)
+    if command -v cairn >/dev/null 2>&1 && cairn evidence --help >/dev/null 2>&1; then
+      set +e
+      cairn evidence run --harness opencode -- opencode "$@"
+      CAIRN_EXIT_STATUS=$?
+      set -e
+      export CAIRN_EXIT_STATUS
+      if [[ -f "$ROOT_DIR/.ai/post-exit.sh" ]]; then
+        # shellcheck disable=SC1091
+        . "$ROOT_DIR/.ai/post-exit.sh" || true
+      fi
+      exit "$CAIRN_EXIT_STATUS"
+    fi
+    echo "cairn: compatible evidence command unavailable; launching without capture" >&2
+    ;;
+esac
 if [[ -f "$ROOT_DIR/.ai/post-exit.sh" ]]; then
   set +e
   opencode "$@"

package/templates/start-pi.sh.template

@@ -17,6 +17,23 @@ if [[ -f "$ROOT_DIR/.ai/pre-launch.sh" ]]; then
 fi
 cd "$ROOT_DIR"
 
+case "${CAIRN_WORK_EVIDENCE:-}" in
+  1|true|TRUE|yes|YES|on|ON)
+    if command -v cairn >/dev/null 2>&1 && cairn evidence --help >/dev/null 2>&1; then
+      set +e
+      cairn evidence run --harness pi -- pi "$@"
+      CAIRN_EXIT_STATUS=$?
+      set -e
+      export CAIRN_EXIT_STATUS
+      if [[ -f "$ROOT_DIR/.ai/post-exit.sh" ]]; then
+        # shellcheck disable=SC1091
+        . "$ROOT_DIR/.ai/post-exit.sh" || true
+      fi
+      exit "$CAIRN_EXIT_STATUS"
+    fi
+    echo "cairn: compatible evidence command unavailable; launching without capture" >&2
+    ;;
+esac
 if [[ -f "$ROOT_DIR/.ai/post-exit.sh" ]]; then
   set +e
   pi "$@"