@cairnkeep/cli 2.12.0 → 2.13.1

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable user-facing changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [2.13.1] - 2026-08-17
+
+### Fixed
+
+- Generate release SBOMs directly as reproducible, schema-validated CycloneDX
+  1.6 documents with the pinned official npm generator. This replaces npm's
+  invalid CycloneDX 1.5 output and fails publication before attaching a broken
+  SBOM.
+
+## [2.13.0] - 2026-08-17
+
+### Added
+
+- Add opt-in, local Git-linked work evidence for all six generated harness
+  launchers and native Windows, with bounded start/end state, touched paths,
+  append-only trajectory/artifact/reviewed-memory links, lifecycle CLI and two
+  local read-only MCP observations.
+- Add separately consented, redacted patch artifacts and document their
+  start-commit scope, pre-existing-dirty limitation and omitted untracked bodies.
+
 ## [2.12.0] - 2026-08-13
 
 ### Added
@@ -336,7 +356,9 @@ stored memories.
 - Preserve executable permissions and Bash 3.2 portability on macOS.
 - Add backup-first uninstall and SQLite-safe memory export/import guidance.
 
-[Unreleased]: https://github.com/cairnkeep/cairnkeep/compare/v2.12.0...HEAD
+[Unreleased]: https://github.com/cairnkeep/cairnkeep/compare/v2.13.1...HEAD
+[2.13.1]: https://github.com/cairnkeep/cairnkeep/compare/v2.13.0...v2.13.1
+[2.13.0]: https://github.com/cairnkeep/cairnkeep/compare/v2.12.0...v2.13.0
 [2.12.0]: https://github.com/cairnkeep/cairnkeep/compare/v2.11.0...v2.12.0
 [2.11.0]: https://github.com/cairnkeep/cairnkeep/compare/v2.9.0...v2.11.0
 [2.9.0]: https://github.com/cairnkeep/cairnkeep/compare/v2.8.0...v2.9.0

package/README.md

@@ -32,7 +32,7 @@ verification, and the first remember/recall cycle.
 ## Status
 
 Shipped: the memory server, the `cairn` CLI (`setup`, `bootstrap`, `memory-server`, `sync`, `sync-pi`, `sync-kimi`,
-`doctor`, `trajectory`, `artifact`, `mcp-tools`, `pack`, `notes`, `memory`, `eval`, `audit-timer`, `completion`, `uninstall`) installable via
+`doctor`, `trajectory`, `artifact`, `evidence`, `mcp-tools`, `pack`, `notes`, `memory`, `eval`, `audit-timer`, `completion`, `uninstall`) installable via
 `npm i -g @cairnkeep/cli`, and the
 operating layer (commands,
 agents, hooks) installed on Claude Code and OpenCode, plus the native Pi
@@ -46,6 +46,8 @@ cairnkeep-org sibling project.
 
 Version 2.12 adds a declarative harness registry, first-class Codex project
 setup, and a shorter path from installation to verified recall.
+Version 2.13 adds opt-in local Git-linked work evidence around generated harness
+launchers, including native Windows, without capturing prompts or replacing Git.
 
 ## Compatibility
 
@@ -329,6 +331,12 @@ search):
 | `CAIRN_TRAJECTORY_RETENTION_DAYS` | Retain captured sessions for this many days (default `30`) |
 | `CAIRN_TRAJECTORY_REDACTION_FILE` | Optional project-contained redaction config (default `.ai/trajectory-redaction.json` when present) |
 | `CAIRN_REDACTION_FILE` | Optional project-contained redaction config shared by trajectories and artifacts (falls back to `CAIRN_TRAJECTORY_REDACTION_FILE`) |
+| `CAIRN_WORK_EVIDENCE` | Capture bounded Git state around generated harness launches (off by default) |
+| `CAIRN_WORK_EVIDENCE_PATCH` | Request an optional redacted patch artifact (off by default; also requires `CAIRN_ARTIFACT_STORE`) |
+| `CAIRN_WORK_EVIDENCE_RETENTION_DAYS` | Work-evidence retention (default `30`; `0` disables age pruning) |
+| `CAIRN_WORK_EVIDENCE_STORE_MAX_BYTES` | Project-local work-evidence metadata budget (default `67108864`, 64 MiB) |
+| `CAIRN_WORK_EVIDENCE_MAX_TOUCHED_PATHS` | Maximum touched-path labels per record (default and hard maximum `4096`) |
+| `CAIRN_WORK_EVIDENCE_PATCH_MAX_BYTES` | Maximum optional patch bytes (default `1048576`, 1 MiB; the artifact cap can lower it) |
 | `CAIRN_COMPACTION_CAPTURE` | Opt in to local harness-produced compaction capture and fresh-session recovery (off by default) |
 | `CAIRN_ARTIFACT_STORE` | Expose four local stdio artifact tools (off by default; independent of compaction capture) |
 | `CAIRN_ARTIFACT_HTTP` | Separately consent to artifact tools over authenticated HTTP (off by default; also requires `CAIRN_ARTIFACT_STORE`) |
@@ -517,6 +525,17 @@ reject policy cannot overwrite; explicit supersede preserves typed history.
 Note addresses require `scope: project` and logical keys, never filesystem
 paths. See the [operating guide](docs/operating.md#typed-memory-nodes-and-note-address-spaces-opt-in).
 
+### Git-linked work evidence (opt-in)
+
+`CAIRN_WORK_EVIDENCE=1` makes generated Claude Code, OpenCode, Pi, Kimi, Qwen
+and Codex launchers record bounded start/end Git state and links to exact local
+trajectories, artifacts and reviewed-memory writes. It records no prompts,
+keystrokes or reasoning, and harness launch remains fail-open when Git or
+capture is unavailable. Inspect it with `cairn evidence list|show|delete|prune|doctor`.
+Optional patch capture requires both `CAIRN_WORK_EVIDENCE_PATCH=1` and
+`CAIRN_ARTIFACT_STORE=1`; Cairnkeep never applies or restores a patch. See the
+[work-evidence guide](docs/work-evidence.md).
+
 ### Compaction continuity and artifacts (opt-in)
 
 `CAIRN_COMPACTION_CAPTURE=1` captures only harness-produced compaction summaries

package/docs/harness-compatibility.md

@@ -4,6 +4,12 @@ Cairnkeep separates memory transport from harness-specific operating assets.
 An MCP client can use the memory tools without also supporting Cairnkeep's
 commands, hooks, plugins, or trajectory adapters.
 
+All six generated launchers—Claude Code, OpenCode, Kimi, Qwen, Pi and Codex—
+support the same opt-in Git-linked work-evidence wrapper. The wrapper is local,
+requires `CAIRN_WORK_EVIDENCE=1`, and fails open so optional capture cannot
+prevent a harness from launching. It does not imply that the harness supports
+Cairnkeep commands, hooks or native trajectory capture.
+
 ## Support levels
 
 | Harness | Supported surface | Runtime status |

package/docs/learning/CURRICULUM-MAP.md

@@ -1,6 +1,6 @@
 # Curriculum Coverage Map
 
-**Baseline:** Cairnkeep 2.12.0
+**Baseline:** Cairnkeep 2.13.1
 **Last reviewed:** 2026-08-13
 
 This map prevents the course from drifting behind the product. It assigns each
@@ -27,6 +27,7 @@ been rehearsed.
 | Structured trajectories and Pi capture adapter | L13 | L13 | Brief; default off |
 | Hindsight-note distillation, lookup, enrichment, and promotion | L13 | L13-L14 | Brief; default off |
 | Compaction continuity and immutable artifacts | L13 | L13 | Brief; default off |
+| Git-linked work evidence | L13 | L13 | Lab + recording outline; default off |
 | Typed memory nodes, filters, address spaces, and structured import | L14 | L14 | Brief; default off |
 | Managed eight-capability contract and payload-free callbacks | L15 | L15-L16 | Brief; default off |
 | Deterministic two-pass evaluation and one-capability ablation | L16 | L16 | Brief; default off |
@@ -88,6 +89,7 @@ against `cairn help` so a new command cannot bypass a curriculum decision.
 | `cairn doctor` | L03; advanced repair in L13-L14 |
 | `cairn trajectory` | L13 |
 | `cairn artifact` | L13 |
+| `cairn evidence` | L13 |
 | `cairn capabilities` | L15 |
 | `cairn mcp-tools` | L20 |
 | `cairn pack` | L21 |

package/docs/learning/FEATURE-GUIDE.md

@@ -1,6 +1,6 @@
 # Cairnkeep feature guide
 
-**Baseline:** Cairnkeep 2.12.0
+**Baseline:** Cairnkeep 2.13.1
 
 This is the step-back map for choosing and operating Cairnkeep features. The
 [course labs](https://github.com/cairnkeep/cairnkeep-course-labs) provide one
@@ -12,6 +12,9 @@ Guided setup and the maintained Pi memory extension shipped in v2.11. The v2.12
 harness registry adds first-class Codex project setup without granting project
 trust. See [L03](lessons/L03-first-project.md) and
 [L23](lessons/L23-guided-setup.md) for the tested boundaries.
+Version 2.13 adds local Git-linked work evidence around all generated harness
+launchers; [L13](lessons/L13-session-evidence.md) covers its privacy and
+retention contract.
 
 ## The three-layer model
 
@@ -35,7 +38,7 @@ Run setup in that order, then confirm `cairn doctor`, `cairn sync --check`, and
 | 2 | Wiki, alignment, graph, repository/security review | Tracked derived knowledge and quality workflows are sufficient |
 | 3 | Backup, migration, multiple-machine routing | Storage placement and recovery are predictable |
 | 4 | Document RAG or context exploration | An optional external corpus or faster repository exploration is justified |
-| 5 | Trajectories, notes, compaction, artifacts | Local session evidence has an explicit retention purpose |
+| 5 | Trajectories, notes, compaction, artifacts, Git work evidence | Local session evidence has an explicit retention purpose |
 | 6 | Typed nodes and capability governance | Filtering and centrally inspectable feature state are needed |
 | 7 | Evaluation and ablation | A concrete change needs bounded measurement |
 | 8 | Validated skill improvement | Repeated resolved hindsight warrants a measured skill change |
@@ -81,6 +84,7 @@ prerequisites for ordinary memory.
 | Note enrichment | Distillation plus separate enrichment flag, endpoint, key, and model | No server restart for the offline job | Failure leaves deterministic note usable; unset enrichment flag | `course-05-evidence` |
 | Compaction continuity | `CAIRN_COMPACTION_CAPTURE=1` | Sync assets and relaunch harness | Inspect provenance/age; remove retained local artifacts explicitly | `course-05-evidence` |
 | Artifact tools | `CAIRN_ARTIFACT_STORE=1`; HTTP needs a second flag and existing HTTP auth | Restart MCP server when tool exposure changes | `cairn artifact list|show|delete|prune` with dry runs | `course-05-evidence` |
+| Git-linked work evidence | `CAIRN_WORK_EVIDENCE=1`; optional patch also needs `CAIRN_WORK_EVIDENCE_PATCH=1` and the artifact store | Relaunch through a generated harness launcher | `cairn evidence list|show|delete|prune|doctor`; local only, no restore/apply | `course-05-evidence` |
 | Typed nodes/import | `CAIRN_TYPED_MEMORY_NODES=1` | Restart MCP server; tool schema changes | Hard-filter search; dry-run, replay-safe import; `cairn doctor --repair` only for derived state | `course-05-evidence` |
 | Capability contract | `CAIRN_CAPABILITY_CONTRACT=1` | MCP changes require restart; operating changes apply next invocation | `cairn capabilities list|status|enable|disable|reset|logging`; digest identifies state only | `course-06-governance` |
 | Evaluation | `CAIRN_EVAL=1` for the coordinator process | No harness chosen by Cairnkeep | `validate` before `run`; inspect report, missingness and evidence scope; dry-run prune/delete | `course-07-evaluation` |

package/docs/learning/README.md

@@ -44,7 +44,7 @@ expanded only after their labs are executable.
 | L10 | [Faster context exploration](lessons/L10-context-exploration.md) | Brief | 30 min |
 | L11 | [Containers and isolation](lessons/L11-containers.md) | Brief | 40 min |
 | L12 | [Managed overlays](lessons/L12-managed-overlays.md) | Brief | 45 min |
-| L13 | [Session evidence and hindsight](lessons/L13-session-evidence.md) | Brief | 45 min |
+| L13 | [Session evidence and hindsight](lessons/L13-session-evidence.md) | Brief | 60 min |
 | L14 | [Typed memory and controlled import](lessons/L14-typed-memory.md) | Brief | 40 min |
 | L15 | [Capability governance](lessons/L15-capability-governance.md) | Brief | 35 min |
 | L16 | [Evaluation and ablation](lessons/L16-evaluation.md) | Brief | 50 min |

package/docs/learning/lessons/L00-why-cairnkeep.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 10 minutes
-**Tested with:** Cairnkeep 2.12.0
+**Tested with:** Cairnkeep 2.13.1
 
 ## Outcome
 

package/docs/learning/lessons/L01-safe-trial.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 15 minutes
-**Tested with:** Cairnkeep 2.12.0
+**Tested with:** Cairnkeep 2.13.1
 
 ## Outcome
 
@@ -26,7 +26,7 @@ ephemeral; the named course volume is persistent.
 1. Pull the public image:
 
    ```bash
-   podman pull ghcr.io/cairnkeep/cairnkeep:2.12.0
+   podman pull ghcr.io/cairnkeep/cairnkeep:2.13.1
    ```
 
 2. Start the stdio server with a read-only root filesystem and no Linux
@@ -38,7 +38,7 @@ ephemeral; the named course volume is persistent.
      --read-only --cap-drop=all --security-opt=no-new-privileges \
      --tmpfs=/tmp:rw,noexec,nosuid,size=64m,mode=1777 \
      --volume cairnkeep-course-data:/data:Z,U \
-     ghcr.io/cairnkeep/cairnkeep:2.12.0 stdio
+     ghcr.io/cairnkeep/cairnkeep:2.13.1 stdio
    ```
 
 3. The process waits quietly for MCP input. Press `Ctrl-C` after confirming it

package/docs/learning/lessons/L02-installation.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.12.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.13.1 and Node.js 22 or newer
 
 ## Outcome
 
@@ -47,7 +47,7 @@ sync. Codex project trust remains an explicit operator decision.
 2. Install Cairnkeep:
 
    ```bash
-   npm install --global @cairnkeep/cli@2.12.0
+   npm install --global @cairnkeep/cli@2.13.1
    cairn --version
    ```
 

package/docs/learning/lessons/L03-first-project.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.12.0
+**Tested with:** Cairnkeep 2.13.1
 
 ## Outcome
 

package/docs/learning/lessons/L13-session-evidence.md

@@ -2,7 +2,7 @@
 
 **Status:** Brief
 **Track:** Practitioner; Evidence and Evaluation
-**Planned time:** 45 minutes
+**Planned time:** 60 minutes
 
 ## Outcome
 
@@ -16,12 +16,14 @@ confusing it with reviewed durable memory.
   hindsight note, explicit shared promotion, and reviewed memory.
 - Independent consent flags for trajectory capture, note distillation, note
   enrichment, compaction capture, artifact tools, and artifact HTTP access.
+- Launcher-owned Git work evidence, its local-only read surface, its separate
+  patch consent boundary, and why interval evidence is not authorship proof.
 - Claude Code and OpenCode hooks versus Pi's native `session_shutdown` adapter.
 - Pre-write redaction, reasoning omission, size limits, 30-day defaults, and
   fail-open capture behavior.
 - Compaction summaries as harness-produced continuity evidence, never trusted
   instructions and never automatic fresh-session context.
-- `cairn trajectory`, `cairn notes`, `cairn artifact`, and `cairn doctor
+- `cairn trajectory`, `cairn notes`, `cairn artifact`, `cairn evidence`, and `cairn doctor
   --repair` inspection and recovery paths.
 
 ## Hands-on lab
@@ -62,4 +64,48 @@ cairn artifact list --json
 - [Operating guide: structured trajectories](../../operating.md#structured-session-trajectories-opt-in)
 - [Operating guide: hindsight notes](../../operating.md#hindsight-notes-opt-in)
 - [Privacy and data flow](../../privacy-and-data-flow.md#structured-trajectory-capture)
+- [Git-linked work evidence](../../work-evidence.md)
 - [Storage and deployment](../../storage.md)
+
+## Git-linked work evidence lab
+
+Use a disposable Git repository and a generated launcher. Add this to
+`.ai/.env` without enabling patch capture:
+
+```sh
+CAIRN_WORK_EVIDENCE=1
+```
+
+Launch the selected harness, edit one tracked file and create one untracked
+file, then exit normally. Inspect the result:
+
+```sh
+cairn evidence list --json
+cairn evidence show EVIDENCE-ID --json
+cairn evidence doctor --json
+cairn evidence prune --dry-run --json
+```
+
+The learner should be able to identify the start/end Git state, touched path
+labels, exit status and overall digest; explain why the record does not prove
+authorship; and confirm that no prompt, keystroke, command history or reasoning
+was retained. Repeat with the feature unset and verify that no work-evidence
+directory is created.
+
+For the optional patch exercise, use only synthetic content and set both
+`CAIRN_WORK_EVIDENCE_PATCH=1` and `CAIRN_ARTIFACT_STORE=1`. Begin with an
+already-dirty tracked file, make another edit, then verify that the artifact can
+include both because its scope is the start commit to the end worktree. Confirm
+that an untracked file body is absent and that Cairnkeep exposes no apply or
+restore command.
+
+## Recording outline
+
+1. Show the default-off launcher and empty evidence list.
+2. Enable metadata-only capture, run a short session and inspect its digests.
+3. Follow one exact trajectory or artifact link without copying its body.
+4. Demonstrate missing-Git fail-open behavior and the preserved harness exit.
+5. Enable the two patch prerequisites with synthetic data and explain the
+   pre-existing-dirty and untracked-body boundaries.
+6. Finish with dry-run deletion/pruning, local-only MCP exposure and uninstall
+   retention.

package/docs/learning/lessons/L19-validated-skill-improvement.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Evidence and Evaluation
 **Time:** 50 minutes
-**Tested with:** Cairnkeep 2.12.0
+**Tested with:** Cairnkeep 2.13.1
 
 ## Outcome
 

package/docs/learning/lessons/L20-mcp-tool-profiles.md

@@ -1,7 +1,7 @@
 # L20 - Least-authority MCP tool profiles
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.12.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.13.1 and Node.js 22 or newer
 **Time:** 25 minutes
 
 ## Outcome

package/docs/learning/lessons/L21-context-packs.md

@@ -1,7 +1,7 @@
 # L21 - Immutable context packs and skill approval
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.12.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.13.1 and Node.js 22 or newer
 **Time:** 40 minutes
 
 ## Outcome

package/docs/learning/lessons/L22-native-windows.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Operator
 **Time:** 30 minutes
-**Tested with:** Cairnkeep 2.12.0, Windows x64, and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.13.1, Windows x64, and Node.js 22 or newer
 
 ## Outcome
 
@@ -16,7 +16,7 @@ perform a reversible uninstall without relying on WSL or Git Bash.
 From PowerShell:
 
 ```powershell
-npm install --global @cairnkeep/cli@2.12.0
+npm install --global @cairnkeep/cli@2.13.1
 cairn version
 
 $Lab = Join-Path $env:TEMP 'Cairnkeep Windows Lab'

package/docs/learning/lessons/L23-guided-setup.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart and Operator
 **Time:** 35 minutes
-**Tested with:** Cairnkeep 2.12.0; Pi 0.84.1; Node.js 22, 24, and 26
+**Tested with:** Cairnkeep 2.13.1; Pi 0.84.1; Node.js 22, 24, and 26
 
 ## Outcome
 
@@ -134,7 +134,7 @@ prompts, approve skills, create an autonomous loop, or add remote access.
 
 ## Release boundary
 
-Ready means this lesson and its deterministic contracts pass against v2.12.0.
+Ready means this lesson and its deterministic contracts pass against v2.13.1.
 Release readiness requires a non-skipping acceptance run
 against separate Pi 0.84.1 minimum and explicitly versioned registry-current
 installations, plus the documented Node.js, Bash 3.2, and native Windows matrix.

package/docs/learning/tracks/evidence-and-evaluation.md

@@ -13,7 +13,8 @@
 6. [L19 - Validated skill improvement](../lessons/L19-validated-skill-improvement.md)
 
 The track is complete when the learner can explain each consent boundary,
-inspect and manage every local evidence store, compare baseline and ablation
+inspect and manage every local evidence store, including Git-linked work
+evidence, compare baseline and ablation
 reports without making unsupported claims, apply or roll back an exact eligible
 skill proposal, and distinguish that narrow runtime from the design-only
 general meta-agent contract.

package/docs/native-windows.md

@@ -53,6 +53,15 @@ Optional `.ai/pre-launch.ps1` and `.ai/post-exit.ps1` seams run in the same
 PowerShell process, so exported environment changes reach the harness. The post
 hook receives `$env:CAIRN_EXIT_STATUS`.
 
+With `CAIRN_WORK_EVIDENCE=1`, the native PowerShell launcher routes all selected
+harnesses through `cairn evidence run`. It uses the system `git.exe`, writes the
+same private project-local format as POSIX systems, and preserves the harness
+exit status. Missing Git, a non-repository directory or capture failure warns
+and launches the harness directly. Optional patch capture additionally requires
+`CAIRN_WORK_EVIDENCE_PATCH=1` and `CAIRN_ARTIFACT_STORE=1`; Windows atomic
+replacement uses the platform file-replace primitive rather than POSIX rename
+semantics.
+
 ## MCP and operating assets
 
 Register the stdio server exactly as on other platforms:

package/docs/operating.md

@@ -466,6 +466,12 @@ vendor or host.
 | `CAIRN_TRAJECTORY_RETENTION_DAYS` | Age retention applied on capture/prune (default `30`; `0` removes sessions once they are older than the current instant) |
 | `CAIRN_TRAJECTORY_REDACTION_FILE` | Optional redaction JSON path contained by the project (default `.ai/trajectory-redaction.json` when that file exists) |
 | `CAIRN_REDACTION_FILE` | Optional project-contained redaction JSON shared by trajectories and artifacts; takes precedence over `CAIRN_TRAJECTORY_REDACTION_FILE` |
+| `CAIRN_WORK_EVIDENCE` | Capture bounded Git state around generated harness launches (off by default) |
+| `CAIRN_WORK_EVIDENCE_PATCH` | Request an optional redacted patch artifact (off by default; requires `CAIRN_ARTIFACT_STORE`) |
+| `CAIRN_WORK_EVIDENCE_RETENTION_DAYS` | Work-evidence retention (default `30`; `0` disables age pruning) |
+| `CAIRN_WORK_EVIDENCE_STORE_MAX_BYTES` | Project-local metadata budget (default `67108864`, 64 MiB) |
+| `CAIRN_WORK_EVIDENCE_MAX_TOUCHED_PATHS` | Maximum touched-path labels per record (default and hard maximum `4096`) |
+| `CAIRN_WORK_EVIDENCE_PATCH_MAX_BYTES` | Optional patch cap (default `1048576`, 1 MiB; the artifact cap can lower it) |
 | `CAIRN_COMPACTION_CAPTURE` | Opt in to supported local compaction capture and automatic structured recovery (off by default; unset means zero new work) |
 | `CAIRN_ARTIFACT_STORE` | Expose the four local stdio artifact tools (off by default; independent of compaction capture) |
 | `CAIRN_ARTIFACT_HTTP` | Separately expose artifact tools over authenticated HTTP (off by default; also requires `CAIRN_ARTIFACT_STORE`) |
@@ -1042,6 +1048,43 @@ eligible for exact-digest application. See
 [Validated skill improvement](skill-improvement.md) for the command sequence,
 adapter contract, task constraints, and rollback procedure.
 
+### Git-linked work evidence (opt-in)
+
+Set `CAIRN_WORK_EVIDENCE=1` in `.ai/.env` and use a generated harness launcher.
+The launcher opens a local evidence interval before Claude Code, OpenCode, Pi,
+Kimi, Qwen or Codex and settles it after exit. A missing Git executable, a
+non-repository directory or a capture error produces a warning and never blocks
+the harness. Direct harness launches do not create launcher-owned evidence.
+The launcher reserves `CAIRN_WORK_EVIDENCE_ID` and `CAIRN_WORK_EVIDENCE_ROOT`
+for child-process correlation; operators must not set either variable directly.
+
+```bash
+cairn evidence list --json
+cairn evidence show EVIDENCE-ID --json
+cairn evidence delete EVIDENCE-ID --dry-run --json
+cairn evidence prune --dry-run --json
+cairn evidence doctor --json
+```
+
+The start/end record includes commits, branch/detached/unborn state, dirty
+state, canonical status/workspace digests, touched path labels, timestamps and
+exit status. It can append exact trajectory, artifact and reviewed-memory
+identifiers produced by descendant processes. It captures no prompts,
+keystrokes, command history or reasoning. Concurrent writers are not
+attributed, and a path changed then restored to its starting state is invisible.
+
+Patch capture is a separate consent boundary: both
+`CAIRN_WORK_EVIDENCE_PATCH=1` and `CAIRN_ARTIFACT_STORE=1` are required. The
+redacted, bounded diff is computed from the starting commit to the ending
+worktree, so it can include tracked changes that predated the session; untracked
+bodies are omitted. Cairnkeep has no apply, restore or replay operation.
+
+When enabled, local stdio exposes only `work_evidence_list` and
+`work_evidence_read`; they are read-only, non-destructive, idempotent and
+closed-world. HTTP never exposes them. See [Git-linked work evidence](work-evidence.md),
+[storage](storage.md#git-linked-work-evidence) and
+[privacy](privacy-and-data-flow.md#git-linked-work-evidence).
+
 ### Structured session trajectories (opt-in)
 
 Trajectory capture is disabled by default. To enable it for a launched Claude

package/docs/privacy-and-data-flow.md

@@ -23,6 +23,8 @@ request unless the corresponding endpoint and credential are configured.
 | Remote HTTP memory | MCP requests and responses, including memory content | The explicitly registered Cairnkeep HTTP server |
 | Opt-in trajectory capture | None | Local `<project>/.agentfs/trajectory.db` only; no model or HTTP path exists |
 | Opt-in capability callback records | None | Payload-free final metadata in local `<project>/.agentfs/trajectory.db`; HTTP transport is always skipped |
+| Opt-in Git-linked work evidence | Repository-relative Git state and exact local object identifiers | Local `<Git root>/.agentfs/work-evidence/v1/`; HTTP transport is always skipped |
+| Separately enabled work-evidence patch | Redacted tracked diff from the starting commit to the ending worktree | Local artifact store only; requires both work-evidence patch and artifact-store consent |
 | Opt-in deterministic note distillation | None | Reads redacted closed trajectories; writes local Markdown + manifest under `${CAIRN_AGENTFS_BASE_DIR:-~/.cairnkeep}/notes/` |
 | Separately opted-in note enrichment | `CAIRN_LLM_API_KEY` | Sends bounded redacted note evidence to the explicit `CAIRN_LLM_API_URL` chat endpoint |
 | Typed lifecycle and inline `memory_import` over local stdio | None | Values, metadata, digests, replay bindings, and history remain in the selected local store |
@@ -331,6 +333,40 @@ compaction hooks, or a generic filesystem. With HTTP consent absent, remote
 clients cannot observe artifact schemas or content. Artifacts have no default egress.
 Artifacts have no telemetry; local capture/recovery never uses the HTTP route.
 
+## Git-linked work evidence
+
+Work evidence is disabled unless `CAIRN_WORK_EVIDENCE=1` is present in the
+launcher environment. Generated launchers observe Git immediately before and
+after the harness process and store commit, branch/detached/unborn and dirty
+state, canonical status/workspace digests, bounded touched-path labels,
+timestamps and exit status. Descendant processes may append exact identifiers
+for trajectories, artifacts and reviewed-memory writes. They do not copy those
+bodies into the evidence record.
+
+Workspace digests are derived from Git object state and can include the hashes
+of observed untracked content. Bodies are not retained, but hashing is not
+redaction: an observer can test guesses for low-entropy content. Keep secrets
+out of project worktrees and do not enable this feature when path labels or
+content-derived digests exceed the project's retention policy.
+
+No prompt, keystroke, shell history, environment value or model reasoning is
+captured. Repository-relative path labels are retained because they are needed
+to explain the observed worktree transition. Concurrent processes are not
+distinguishable, and a path restored to its starting state is not reported as
+touched. The record is evidence of an interval and integrity relationships, not
+proof of authorship.
+
+Optional patch capture requires both `CAIRN_WORK_EVIDENCE_PATCH=1` and
+`CAIRN_ARTIFACT_STORE=1`. The diff is computed from the start commit to the end
+worktree, so it can contain tracked edits that existed before launch. Untracked
+bodies are omitted. Existing recursive redaction and the lower configured byte
+cap apply before the artifact is persisted. Cairnkeep never applies, restores
+or sends the patch.
+
+`work_evidence_list` and `work_evidence_read` are local-stdio-only observation
+tools. They are absent when the feature is off and absent from authenticated
+HTTP even when it is on. No work-evidence path performs a network request.
+
 ## Structured trajectory capture
 
 `CAIRN_TRAJECTORY_CAPTURE` is unset and off by default. When explicitly set to

package/docs/quickstart.md

@@ -84,3 +84,8 @@ cairn uninstall --dry-run .                                       # preview remo
 For all harnesses, remote HTTP, storage, profiles, context packs, overlays, and
 recovery details, continue with [Operating Cairnkeep](operating.md) or the
 [learning path](learning/README.md).
+
+To add bounded Git state around future generated-launcher sessions, set
+`CAIRN_WORK_EVIDENCE=1` in `.ai/.env`; inspect it with `cairn evidence list`.
+It is local and off by default. Patch capture remains a separate double-consent
+feature. See [Git-linked work evidence](work-evidence.md).

package/docs/releasing.md

@@ -12,8 +12,12 @@ from a workstation.
 4. Publish a GitHub Release whose tag is exactly `v<package.json version>`.
 5. The `Publish release` workflow checks out that immutable tag, repeats the
    tests, and publishes `@cairnkeep/cli` with npm provenance.
-6. The workflow attaches the npm tarball, a CycloneDX SBOM, and SHA-256 checksums
-   to the GitHub Release.
+6. The workflow uses the exact locked `@cyclonedx/cyclonedx-npm` development
+   dependency to generate a reproducible CycloneDX 1.6 SBOM from
+   `package-lock.json`. Generation includes schema validation and runs before
+   npm publication, so an invalid document blocks both publication and
+   attachment. The workflow attaches that SBOM, the npm tarball, and SHA-256
+   checksums to the GitHub Release.
 7. The workflow publishes versioned `linux/amd64` and `linux/arm64`
    memory-server and workspace images to GHCR. It also updates `latest` for a
    stable release or `next` for a prerelease.

package/docs/storage.md

@@ -20,6 +20,7 @@ registration, memory remains on that computer.
 | `project` | `<server working directory>/.agentfs/project.db` |
 | Opt-in session trajectories and capability callback state | `<harness project root>/.agentfs/trajectory.db` |
 | Opt-in local artifacts and compaction revisions | `<project root>/.agentfs/artifacts.db` |
+| Opt-in Git-linked work evidence | `<Git root>/.agentfs/work-evidence/v1/` |
 | Opt-in evaluation reports and note snapshots | `<project root>/.agentfs/eval/experiments/<experiment-id>/` |
 | Immutable context-pack objects and source records | `${CAIRN_PACK_BASE_DIR:-~/.cairnkeep/packs}/objects/` and `sources/` |
 | Digest-pinned context-pack project pointers and approvals | `${CAIRN_PACK_BASE_DIR:-~/.cairnkeep/packs}/projects/` |
@@ -128,6 +129,31 @@ the processed-session ledger at 4096 digests per project. Note bodies do not
 expire automatically: inspect/delete them according to your own retention
 policy. Trajectory pruning does not delete already-derived notes.
 
+## Git-linked work evidence
+
+`CAIRN_WORK_EVIDENCE=1` stores private, atomic JSON records below
+`<Git root>/.agentfs/work-evidence/v1/records/` and append-only link sets below
+`links/`. The root is resolved with the system Git executable; ancestor
+symlinks, non-regular records and malformed data fail closed. Files and
+directories are hardened with the same platform-specific private-permission
+boundary used by other local stores.
+
+Each record is immutable after it moves from pending to complete. Completion
+captures the final Git observation and an overall digest; it never rewrites the
+start observation. A crash can leave a pending record, which `cairn evidence
+doctor` reports. Doctor may report permissions, corruption and temporary
+remnants, but does not infer or manufacture a missing end state.
+
+Defaults are 30 days, 64 MiB of local metadata, 4,096 touched path labels and a
+1 MiB optional patch cap. Capture and `cairn evidence prune` apply the age and
+budget policy. `delete` and `prune` support dry runs. Patch bodies, when doubly
+enabled, are ordinary redacted artifacts in `.agentfs/artifacts.db`; the
+evidence record keeps only the artifact identifier and digest relationship.
+
+Default uninstall retains the project `.agentfs` tree. Explicit
+`--purge-memory` follows the existing backup-first project-store boundary and
+therefore includes work evidence. Memory export does not include it.
+
 ## Artifact storage
 
 Artifacts are deliberately separate from memory and trajectories. Local