@cairnkeep/cli 2.15.4 → 2.17.0

package/docs/learning/lessons/L02-installation.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.15.4 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.17.0 and Node.js 22 or newer
 
 ## Outcome
 
@@ -47,7 +47,7 @@ sync. Codex project trust remains an explicit operator decision.
 2. Install Cairnkeep:
 
    ```bash
-   npm install --global @cairnkeep/cli@2.14.0
+   npm install --global @cairnkeep/cli@2.17.0
    cairn --version
    ```
 

package/docs/learning/lessons/L03-first-project.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.15.4
+**Tested with:** Cairnkeep 2.17.0
 
 ## Outcome
 
@@ -26,20 +26,19 @@ recall it from a new session.
    cd "$HOME/cairnkeep-course/first-project"
    ```
 
-2. Choose one harness and run the deterministic form of guided setup. The
-   explicit flags make the
-   exercise reproducible while exercising the same preflight as interactive
-   `cairn setup`:
+2. Run the interactive setup and choose a harness. Use Up/Down and Enter for
+   Git and memory choices; use Space to tick Claude Code or Codex CLI in the
+   harness checklist. Review the plan before selecting **Yes, apply the plan**:
 
    ```bash
-   # Full operating-layer route from L02:
-   cairn setup "$PWD" --git init --harness claude --memory local --yes
-
-   # Or the self-contained Codex memory route:
-   # cairn setup "$PWD" --git init --harness codex --memory local --yes
+   cairn setup "$PWD"
    cp .ai/env.example .ai/.env
    ```
 
+   For a reproducible non-interactive exercise, the equivalent Claude Code
+   command is `cairn setup "$PWD" --git init --harness claude --memory local
+   --yes`; replace `claude` with `codex` for the self-contained Codex route.
+
    Setup must create the Git repository, generate only the selected harness
    assets, and write the private `.ai/cairnkeep.json` setup record. Codex also
    receives `.codex/config.toml`; review it and accept Codex's project-trust

package/docs/learning/lessons/L19-validated-skill-improvement.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Evidence and Evaluation
 **Time:** 50 minutes
-**Tested with:** Cairnkeep 2.15.4
+**Tested with:** Cairnkeep 2.17.0
 
 ## Outcome
 

package/docs/learning/lessons/L20-mcp-tool-profiles.md

@@ -1,7 +1,7 @@
 # L20 - Least-authority MCP tool profiles
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.15.4 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.17.0 and Node.js 22 or newer
 **Time:** 25 minutes
 
 ## Outcome

package/docs/learning/lessons/L21-context-packs.md

@@ -1,7 +1,7 @@
 # L21 - Immutable context packs and skill approval
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.15.4 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.17.0 and Node.js 22 or newer
 **Time:** 40 minutes
 
 ## Outcome

package/docs/learning/lessons/L22-native-windows.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Operator
 **Time:** 30 minutes
-**Tested with:** Cairnkeep 2.15.4, Windows x64, and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.17.0, Windows x64, and Node.js 22 or newer
 
 ## Outcome
 
@@ -16,7 +16,7 @@ perform a reversible uninstall without relying on WSL or Git Bash.
 From PowerShell:
 
 ```powershell
-npm install --global @cairnkeep/cli@2.14.0
+npm install --global @cairnkeep/cli@2.17.0
 cairn version
 
 $Lab = Join-Path $env:TEMP 'Cairnkeep Windows Lab'

package/docs/learning/lessons/L23-guided-setup.md

@@ -3,13 +3,14 @@
 **Status:** Ready
 **Track:** Quickstart and Operator
 **Time:** 35 minutes
-**Tested with:** Cairnkeep 2.15.4; Pi 0.84.1; Node.js 22, 24, and 26
+**Tested with:** Cairnkeep 2.17.0; Pi 0.84.1; Node.js 22, 24, and 26
 
 ## Outcome
 
-You can classify a missing or empty target, replay setup without a TTY, explain
-the limitations of Git-less mode, verify Pi's local stdio memory bridge, and
-recover or uninstall every managed asset without hidden machine changes.
+You can use the guided terminal selectors, classify a missing or empty target,
+replay setup without a TTY, explain the limitations of Git-less mode, verify
+Pi's local stdio memory bridge, and recover or uninstall every managed asset
+without hidden machine changes.
 
 The selected harnesses come from Cairnkeep's declarative registry. Codex is a
 supported selection: it receives `.codex/config.toml` and a launcher, while Pi
@@ -24,6 +25,18 @@ continues to require its separate explicit machine sync.
 
 ## Exercise
 
+First experience the interactive path:
+
+```bash
+cairn setup /tmp/cairnkeep-guided-selector-lab
+```
+
+Choose Git with Up/Down and Enter, tick Pi with Space in the harness checklist,
+keep local memory, then inspect the plan before confirming. Pressing Escape or
+Ctrl-C cancels; redirected and limited terminals use the documented text-input
+fallback. Remove that disposable selector lab before continuing if you applied
+the plan.
+
 Start with a missing target. The explicit flags make this deterministic and
 safe to replay from a non-interactive or non-TTY process:
 
@@ -112,7 +125,7 @@ and context packs remain unless their separate purge flags are supplied.
 
 | Symptom | Cause | Recovery |
 |---|---|---|
-| Setup refuses a missing target | The non-interactive command omitted an explicit choice or `--yes` | Supply the target, `--git`, `--harness`, `--memory`, and `--yes` together |
+| Setup refuses a missing target | The non-interactive command omitted an explicit choice or `--yes` | Run `cairn setup PATH` in a terminal, or supply the target, `--git`, `--harness`, `--memory`, and `--yes` together |
 | Setup refuses `--git existing` | The target is not inside a Git work tree | Choose an existing repository, or explicitly authorize `--git init`; use `--git none` only when limited mode is intended |
 | Doctor reports missing or drifted Pi assets | Project setup selected Pi but machine sync is incomplete | Run `cairn sync-pi --apply`, then `cairn sync-pi --check` and `cairn doctor` |
 | A cancelled call ends the session | The Pi/bridge version does not satisfy the per-call cancellation contract | Preserve sanitized diagnostics, close the session, and do not claim release readiness |

package/docs/learning/lessons/L24-okf-exchange.md

@@ -1,7 +1,7 @@
 # L24 - Reviewed knowledge exchange
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.15.4 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.17.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L25-playbooks.md

@@ -1,7 +1,7 @@
 # L25 - Bounded workflow playbooks
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.15.4 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.17.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L26-context-intelligence.md

@@ -0,0 +1,180 @@
+# L26 - Context intelligence with explicit authority
+
+## Outcome
+
+You will measure retrieval before changing it, retrieve an enabled context pack
+progressively, link a privacy-preserving usage receipt to work evidence, and
+review a trajectory-derived memory proposal before any durable write. You will
+also understand when the optional OpenViking adapter is useful and what it does
+not replace.
+
+## Prerequisites
+
+- Complete [L21 - Immutable context packs](L21-context-packs.md) and
+  [L25 - Bounded workflow playbooks](L25-playbooks.md).
+- Work in a project already bootstrapped with Cairnkeep.
+- Enable at least one document-bearing context pack. Skill entries stay hidden
+  unless separately approved for this project.
+- For the proposal exercise, capture a trajectory and configure the existing
+  Cairnkeep extraction endpoint. The retrieval and benchmark exercises are
+  local and offline.
+
+## 1. Freeze the retrieval baseline
+
+From a Cairnkeep source checkout, run the checked-in synthetic suite:
+
+```sh
+npm --prefix mcp-memory-server run build
+npm --prefix mcp-memory-server run check:retrieval-benchmark
+```
+
+The suite contains hierarchical documents, multiple versions, and a hidden
+skill. It checks frozen substring and deterministic mock-embedding results, then
+reports Hit@1, Recall@5, MRR, relevant and irrelevant bytes, estimated tokens,
+latency, mutation counts, and forbidden leakage. A quality improvement is not
+accepted if it leaks the skill, mutates storage, or quietly uses the network.
+
+For a non-golden current report:
+
+```sh
+npm --prefix mcp-memory-server run benchmark:retrieval
+```
+
+Record the mode with the score. Comparing one mode's score with another mode's
+label omitted is not meaningful evidence.
+
+## 2. Retrieve progressively
+
+Start the memory server with `CAIRN_CONTEXT_PACKS=1`. In an MCP-capable harness,
+inspect the visible hierarchy first:
+
+```json
+context_pack_tree { "detail": "abstract" }
+```
+
+Now ask a broad question without loading every file:
+
+```json
+context_pack_search {
+  "query": "release validation",
+  "strategy": "hierarchical",
+  "detail": "overview",
+  "explain": true,
+  "include_refs": true
+}
+```
+
+Check four things in the result:
+
+1. The selected pack, directory, and file fit the question.
+2. The bounded trace explains selection without exposing hidden content.
+3. Each result includes a `chunk_digest` and the response includes a
+   `result_digest`.
+4. No unapproved skill appears in the tree, summaries, results, or trace.
+
+Ask for `detail: "content"` only after summaries narrow the candidate set. For a
+known path, use `context_pack_read`; exact path/title searches can bypass the
+hierarchy. Omitting all new fields exercises the compatible flat search.
+
+## 3. Record use without recording content
+
+Create or activate a work-evidence record for the task, then enable the local
+receipt mutation with both `CAIRN_WORK_EVIDENCE=1` and
+`CAIRN_CONTEXT_USAGE=1`. After deciding whether you used a
+search result, call:
+
+```json
+context_usage_record {
+  "task_digest": "<64-lowercase-hex-task-digest>",
+  "result_digest": "<result_digest-from-search>",
+  "outcome": "used"
+}
+```
+
+Use `unused` or `unknown` when that is the honest outcome. Supply `evidence_id`
+only when linking a non-active record deliberately. Inspect the evidence and
+verify that the receipt contains identifiers and outcome—not query text,
+retrieved content, prompts, or responses.
+
+This is a mutation. A read-only MCP profile correctly hides it even though the
+pack retrieval tools remain visible.
+
+## 4. Promote a trajectory through review
+
+List or capture a trajectory you want to distill, then create a proposal:
+
+```sh
+cairn proposals create --session SESSION_ID --scope project --json
+cairn proposals list --json
+cairn proposals show PROPOSAL_DIGEST --json
+```
+
+Review every candidate for accuracy, scope, sensitivity, and durability. The
+proposal is not reviewed memory. If it is acceptable, apply the exact digest:
+
+```sh
+cairn proposals apply PROPOSAL_DIGEST --json
+cairn proposals doctor --json
+```
+
+Creation redacts the stored trajectory again before configured model extraction.
+Application rechecks the source digest and base reviewed-memory hashes. If it
+reports stale state, create and review a new proposal; do not edit the digest-
+addressed file or bypass the check.
+
+## 5. Decide whether an external provider helps
+
+AnythingLLM remains Cairnkeep's default domain provider. Use OpenViking only when
+you deliberately operate an OpenViking index and want its search results through
+the existing `domain_knowledge_query` surface:
+
+```sh
+CAIRN_DOMAIN_RETRIEVAL_PROVIDER=openviking
+CAIRN_OPENVIKING=1
+CAIRN_OPENVIKING_BASE_URL=http://127.0.0.1:1933
+```
+
+The adapter is read-only and calls search only. It does not synchronize data,
+manage OpenViking, or replace Cairnkeep's reviewed memory, context-pack pins,
+approvals, evidence, or tool profiles. Leave the variables unset when you do not
+need the external index.
+
+## Common failures
+
+- **A hidden skill appears:** revoke exposure, run `cairn doctor`, and treat it as
+  a visibility regression. Approval is bound to pack/path/file digests.
+- **Hierarchical search looks worse:** compare it with the frozen benchmark and
+  inspect a bounded trace. Do not change default flat behavior to hide a miss.
+- **A receipt conflicts:** the same task/result identity was recorded with a
+  different outcome. Resolve the evidence rather than overwriting history.
+- **Proposal apply is stale:** source or reviewed memory changed after creation.
+  Generate a new proposal and review it.
+- **OpenViking is unreachable:** verify the explicit gates, HTTPS requirement for
+  non-loopback hosts, endpoint, timeout, and service separately. Cairnkeep's
+  default operation does not depend on it.
+
+## Privacy and trust boundary
+
+Context-pack and proposal digests prove content integrity and bind decisions to
+specific state; they do not authenticate a publisher or prove that extracted
+claims are true. Derived summaries can contain visible pack content, so protect
+the cache like the pack store. Proposal extraction can cross a model-provider
+boundary only through the operator's existing extraction configuration and only
+after redaction. Context-usage receipts deliberately avoid raw content.
+
+## Recovery and acceptance
+
+You are done when:
+
+- the frozen benchmark passes without network or filesystem mutation;
+- tree and hierarchical search expose enabled documents and only approved skills;
+- flat search still works when optional fields are omitted;
+- a receipt links to work evidence without copying content;
+- a proposal is inspected before exact-digest apply, or intentionally rejected;
+- you can explain why OpenViking is optional retrieval rather than a replacement
+  for Cairnkeep.
+
+Continue with the operational references in
+[Context intelligence](../../context-intelligence.md),
+[Immutable context packs](../../context-packs.md), and
+[Git-linked work evidence](../../work-evidence.md).

package/docs/learning/tracks/evidence-and-evaluation.md

@@ -11,6 +11,7 @@
 4. [L16 - Evaluation and ablation](../lessons/L16-evaluation.md)
 5. [L17 - The agent boundary](../lessons/L17-agent-boundary.md)
 6. [L19 - Validated skill improvement](../lessons/L19-validated-skill-improvement.md)
+7. [L26 - Context intelligence with explicit authority](../lessons/L26-context-intelligence.md)
 
 The track is complete when the learner can explain each consent boundary,
 inspect and manage every local evidence store, including Git-linked work

package/docs/learning/tracks/operator.md

@@ -16,6 +16,7 @@
 10. [L23 - Guided setup and Pi memory](../lessons/L23-guided-setup.md)
 11. [L24 - Reviewed knowledge exchange](../lessons/L24-okf-exchange.md)
 12. [L25 - Bounded workflow playbooks](../lessons/L25-playbooks.md)
+13. [L26 - Context intelligence with explicit authority](../lessons/L26-context-intelligence.md)
 
 All modules are optional. The track is complete when the operator can add and
 remove each integration without breaking the standalone local workflow and can

package/docs/learning/tracks/practitioner.md

@@ -12,6 +12,7 @@
 6. [L08 - Multiple machines](../lessons/L08-multiple-machines.md)
 7. [L13 - Session evidence and hindsight](../lessons/L13-session-evidence.md)
 8. [L25 - Bounded workflow playbooks](../lessons/L25-playbooks.md)
+9. [L26 - Context intelligence with explicit authority](../lessons/L26-context-intelligence.md)
 
 The track is complete when the learner can decide what should become memory,
 review derived knowledge, run governed repository checks, locate the store, and

package/docs/learning/video-scripts/V26-context-intelligence.md

@@ -0,0 +1,144 @@
+# V26 - Context intelligence with explicit authority
+
+Target length: 12–15 minutes. Audience: experienced developers who understand
+MCP and have completed the context-pack lesson.
+
+## Recording outline
+
+### 0:00–0:45 — The contract
+
+Show a simple four-step card: **measure → retrieve → attest → review**.
+
+Narration:
+
+> Cairnkeep now makes context retrieval more selective without making memory
+> promotion automatic. We measure retrieval first, inspect context progressively,
+> record only a digest-level usage receipt, and review every durable-memory
+> proposal before applying it.
+
+Pause. State that OpenViking is optional external retrieval and does not replace
+Cairnkeep.
+
+### 0:45–2:15 — Run the frozen benchmark
+
+Use a real terminal at readable zoom and human typing speed:
+
+```sh
+npm --prefix mcp-memory-server run build
+npm --prefix mcp-memory-server run check:retrieval-benchmark
+```
+
+Highlight Hit@1, Recall@5, MRR, byte/token estimates, latency, mutations, and
+forbidden leakage. Explain that the corpus includes versions, hierarchy, and a
+hidden skill. Do not claim that synthetic scores predict every project.
+
+### 2:15–5:15 — Tree, overview, then content
+
+Start from an already installed and enabled demo pack. Show:
+
+```json
+context_pack_tree { "detail": "abstract" }
+```
+
+Expand one directory visually. Then run:
+
+```json
+context_pack_search {
+  "query": "release validation",
+  "strategy": "hierarchical",
+  "detail": "overview",
+  "explain": true,
+  "include_refs": true
+}
+```
+
+Zoom briefly into the bounded trace, `chunk_digest`, and `result_digest`. Follow
+with one content-level read of the selected file. Cut between overview and
+content so the terminal remains dynamic without rushing.
+
+Call out that omitting the new options keeps the existing flat content response,
+and that an unapproved skill is absent from every visible surface.
+
+### 5:15–7:00 — Privacy-preserving receipt
+
+With work evidence active and `CAIRN_CONTEXT_USAGE=1`, record the result:
+
+```json
+context_usage_record {
+  "task_digest": "<demo-task-digest>",
+  "result_digest": "<search-result-digest>",
+  "outcome": "used"
+}
+```
+
+Show the stored receipt fields. Add an on-screen comparison:
+
+- stored: evidence ID, task digest, result digest, outcome;
+- not stored: query, prompt, content, response.
+
+Pause after the comparison. Mention that this is a mutation and is unavailable
+in the read-only MCP profile.
+
+### 7:00–10:15 — Review-gated proposal
+
+Use a real captured demo trajectory and type:
+
+```sh
+cairn proposals create --session SESSION_ID --scope project --json
+cairn proposals show PROPOSAL_DIGEST --json
+```
+
+Scroll through a small proposal. Inspect one candidate aloud for correctness,
+scope, sensitivity, and durability. Then apply the exact digest:
+
+```sh
+cairn proposals apply PROPOSAL_DIGEST --json
+cairn proposals doctor --json
+```
+
+Use a diagram or terminal split to show that creation redacts again, extraction
+creates immutable candidates, and apply rechecks source and base-memory state.
+Do not imply that the model writes reviewed memory directly.
+
+### 10:15–12:00 — Optional provider boundary
+
+Show the minimal settings, without exposing a real key:
+
+```sh
+CAIRN_DOMAIN_RETRIEVAL_PROVIDER=openviking
+CAIRN_OPENVIKING=1
+CAIRN_OPENVIKING_BASE_URL=http://127.0.0.1:1933
+```
+
+Run one `domain_knowledge_query`, then return to a boundary diagram:
+
+- OpenViking: optional read-only search index;
+- Cairnkeep: identity, reviewed memory, pack pins, approvals, evidence, profiles.
+
+Mention loopback-only HTTP, HTTPS elsewhere, no redirects, and the separate
+remote-MCP consent gate. Do not show installation as required.
+
+### 12:00–13:00 — Recap and acceptance
+
+Return to **measure → retrieve → attest → review**. Recap:
+
+1. Frozen evidence before retrieval changes.
+2. Summaries before content, with compatible flat fallback.
+3. Digest-level receipts instead of prompt logging.
+4. Explicit proposal review and exact-digest apply.
+5. Optional providers do not replace Cairnkeep's authority model.
+
+Point viewers to L26 and `docs/context-intelligence.md`.
+
+## Recording cautions
+
+- Use a synthetic pack, trajectory, digests, endpoint, and API key placeholder.
+- Ensure the skill shown in the manifest is unapproved and absent from tree,
+  search, trace, and summaries.
+- Keep command pauses long enough to read output; cut dead time rather than
+  accelerating narration.
+- Use terminal autocomplete and real command execution, but prewarm builds so the
+  lesson focuses on behavior rather than compilation.
+- Never label OpenViking as a dependency, synchronization target, memory store,
+  or Cairnkeep replacement.
+- Do not call a proposal “memory” until exact-digest application succeeds.

package/docs/native-windows.md

@@ -13,6 +13,11 @@ and `--untracked` bootstrap. Explicit `--git none` provides the same documented
 limited mode as POSIX setup.
 The optional `sqlite3.exe` command enables WAL-safe `cairn memory export`.
 
+From an interactive PowerShell or Command Prompt, `cairn setup $Project`
+presents native arrow-key Git and memory selectors plus a Space-toggle harness
+checklist. The explicit form below remains preferable for scripts and fleet
+automation:
+
 ```powershell
 npm install --global @cairnkeep/cli
 cairn version

package/docs/operating.md

@@ -24,6 +24,9 @@ sync command but never runs it automatically. This guide covers all three.
   memory MCP, launcher, and opt-in graph Skill; Qwen Code receives the memory
   MCP and launcher. Pi receives a maintained local stdio MCP extension, native
   trajectory adapter, graph prompt, and launcher after explicit machine sync.
+- Cairnkeep 1.x remains the legacy line for older Node.js runtimes. New
+  installations should use the supported Cairnkeep 2.x and Node.js 22-or-newer
+  matrix.
 - Optional: the `sqlite3` CLI for `cairn memory export`. Runtime memory and
   `cairn memory import` do not require it.
 - Optional: an OpenAI-compatible LLM endpoint for memory extraction and
@@ -61,9 +64,11 @@ Invoke-Expression (& cairn completion powershell | Out-String)
 
 ## Guided project setup
 
-Interactive terminals may run `cairn setup` and answer the target, Git,
-harness, memory, and confirmation questions. Automation must make every choice
-explicit:
+Interactive terminals may run `cairn setup [PATH]`. Use Up/Down and Enter for
+Git and memory, Space to tick one or more harness checkboxes, `a` to toggle all
+harnesses, and the final selectable confirmation before anything is written.
+If the terminal cannot provide raw keyboard input, Cairnkeep falls back to the
+original text questions. Automation must make every choice explicit:
 
 ```bash
 cairn setup /path/to/project --git init --harness claude,pi --memory local --yes
@@ -890,6 +895,19 @@ Inspect receipts with `cairn playbook receipts list|show`; validate state with
 v2.15 does not authenticate them and does not provide team ACLs. See
 [team mode](design/team-mode.md) for the future admission contract.
 
+The corresponding process overrides are optional:
+
+| Variable | Default | Purpose |
+|---|---|---|
+| `CAIRN_PLAYBOOK_PROFILE` | project policy, then `balanced` | Select `minimal`, `balanced`, or `strict` without changing the project file |
+| `CAIRN_PLAYBOOK_ACTOR` | `local-agent` | Supply the unauthenticated local actor label used by checks and receipts |
+| `CAIRN_PLAYBOOK_ACTOR_KIND` | `agent` | Classify the local actor as `user`, `agent`, or `service` |
+| `CAIRN_PLAYBOOK_SESSION` | `local-<process-id>` | Supply the bounded local session label used by decisions and receipts |
+
+Command-line `--actor`, `--actor-kind`, and `--session` values take precedence
+over these process defaults. None of these labels establish identity or grant
+authority.
+
 The managed instruction lifecycle is explicit and ownership-safe:
 
 ```bash
@@ -1391,3 +1409,47 @@ read-only related-document traversal. Privacy-reviewed export is an explicit
 `export-okf --check` followed by `--apply --confirm PREVIEW-DIGEST`; only named
 Markdown files and promoted shared notes are eligible. See
 [Open Knowledge Format exchange](open-knowledge-format.md).
+
+## Context-intelligence operations
+
+The v2.17 context-intelligence surfaces are opt-in and independently bounded:
+
+```sh
+# Existing context-pack gate; default search stays flat and compatible.
+CAIRN_CONTEXT_PACKS=1
+
+# Optional local usage-receipt mutation.
+CAIRN_CONTEXT_USAGE=1
+
+# Optional external retrieval provider (AnythingLLM remains the default).
+CAIRN_DOMAIN_RETRIEVAL_PROVIDER=openviking
+CAIRN_OPENVIKING=1
+CAIRN_OPENVIKING_BASE_URL=http://127.0.0.1:1933
+```
+
+For authenticated remote MCP, context packs still require
+`CAIRN_CONTEXT_PACK_HTTP=1`; OpenViking retrieval separately requires
+`CAIRN_OPENVIKING_MCP_HTTP=1`. Neither setting weakens authentication, Host, or
+CORS checks.
+
+Use these source-checkout checks during upgrades and incident diagnosis:
+
+```sh
+npm --prefix mcp-memory-server run check:context-pack-retrieval
+npm --prefix mcp-memory-server run check:context-usage
+npm --prefix mcp-memory-server run check:domain-retrieval
+npm --prefix mcp-memory-server run check:retrieval-benchmark
+cairn proposals doctor --project /path/to/project --json
+(cd /path/to/project && cairn doctor)
+```
+
+Proposal extraction is manual. Create, inspect, and apply the exact digest:
+
+```sh
+cairn proposals create --session SESSION_ID --scope project --project /path/to/project --json
+cairn proposals show PROPOSAL_DIGEST --project /path/to/project --json
+cairn proposals apply PROPOSAL_DIGEST --project /path/to/project --json
+```
+
+No background process synchronizes OpenViking, creates proposals, applies
+memory, enables packs, or approves skills.

package/docs/privacy-and-data-flow.md

@@ -630,3 +630,25 @@ All enabled documents carry pack and file provenance in MCP results. Skill files
 are excluded until the current project approves the exact pack digest, path, and
 file digest. Updating the pack invalidates that approval. Approval only makes a
 skill readable; Cairnkeep never copies it into a harness or executes it.
+
+## Context-intelligence privacy boundaries
+
+- Progressive pack summaries are deterministic local derivatives of currently
+  visible files. Unapproved skills are excluded from trees, summaries, search,
+  and explanation traces.
+- `include_refs: true` produces content-derived digests. A usage receipt stores
+  only evidence/task/result identifiers and `used`, `unused`, or `unknown`; it
+  does not store the query, prompt, retrieved content, or model response.
+- Proposal creation starts from a locally stored trajectory and runs redaction
+  again before configured model extraction. Extraction remains a proposal until
+  an operator or authorized agent reviews and applies its exact digest.
+- AnythingLLM is still the default external domain provider. Selecting
+  OpenViking requires `CAIRN_DOMAIN_RETRIEVAL_PROVIDER=openviking` and
+  `CAIRN_OPENVIKING=1`; remote MCP requires an additional
+  `CAIRN_OPENVIKING_MCP_HTTP=1` consent flag.
+- The OpenViking adapter is query-only. It sends the requested workspace target
+  and query to the configured endpoint, but performs no synchronization, watch,
+  commit, update, or deletion. Non-loopback endpoints must use HTTPS.
+
+Pack digests and proposal digests protect integrity and stale-state detection;
+they do not authenticate a publisher or make extracted statements true.