@cairnkeep/cli 2.20.1 → 2.21.0

package/CHANGELOG.md

@@ -5,6 +5,41 @@ All notable user-facing changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [2.21.0] - 2026-10-07
+
+### Added
+
+- Add `cairn security doctor [--project PATH] [--json]`, a read-only posture
+  check for private managed files, MCP authority, authenticated HTTP exposure,
+  Host allowlisting, token strength, and remote transport encryption.
+- Add a maintained threat model and security-assurance learning lesson with
+  explicit assets, trust boundaries, residual risks, and verification evidence.
+- Add CodeQL, pull-request dependency review, advisory OpenSSF Scorecard, and a
+  repository baseline gate that rejects unpinned external Actions and
+  `pull_request_target` workflows.
+
+### Security
+
+- Apply one portable-path contract across context packs, OKF, artifacts, and
+  evaluation paths, rejecting Windows drive/UNC paths, alternate separators,
+  ADS/device aliases and forbidden characters, traversal, invalid Unicode, and
+  case collisions while normalizing enumerated macOS filenames.
+- Bound authenticated MCP HTTP request bodies to 8 MiB and set header, request,
+  and keep-alive timeouts; direct and container servers now share private
+  token-file resolution, strict decimal port parsing, canonical IPv4/DNS/IPv6
+  Host authorities, and empty hosts normalize to loopback.
+- Bind relative HTTP token files to the selected project, verify project and
+  parent replacement boundaries, and parse private `.ai/.env` files through a
+  descriptor-bound 64 KiB limit.
+- Require trusted POSIX ownership in addition to safe mode bits, preserve
+  explicit HTTP ports including 80/443, and apply the same raw/canonical
+  portable inventory to context-pack initialization, locking, and validation.
+- Reject header-unsafe Bearer values, preserve ambient-over-project launcher
+  precedence, retain validated OKF bytes through import, and enforce portable
+  collisions at evaluation-bundle admission.
+- Add deterministic adversarial path cases, token non-disclosure checks, and
+  HTTP authorization, Host, and request-limit regression coverage.
+
 ## [2.20.1] - 2026-10-06
 
 ### Maintenance

package/README.md

@@ -87,9 +87,11 @@ memory candidates; durable promotion and every networked or sensitive capture
 path remain separately controlled. Ordinary uninstall retains durable data
 unless an explicit purge is requested.
 
-Start with [Privacy and data flow](docs/privacy-and-data-flow.md) and
-[Memory storage and deployment](docs/storage.md) before enabling remote HTTP,
-embeddings, trajectories, artifacts, work evidence, or context packs.
+Start with [Privacy and data flow](docs/privacy-and-data-flow.md),
+[Memory storage and deployment](docs/storage.md), and
+[Security assurance and threat model](docs/security-assurance.md) before
+enabling remote HTTP, embeddings, trajectories, artifacts, work evidence, or
+context packs.
 
 ## Documentation
 
@@ -103,6 +105,7 @@ guides. In particular:
 - [Operating guide](docs/operating.md)
 - [Harness compatibility](docs/harness-compatibility.md)
 - [Privacy and data flow](docs/privacy-and-data-flow.md)
+- [Security assurance and threat model](docs/security-assurance.md)
 - [Guided learning paths and video scripts](docs/learning/README.md)
 
 The repository supports Linux, macOS, native Windows x64, WSL, Node.js 22/24/26,

package/SECURITY.md

@@ -35,3 +35,16 @@ Reports are especially useful for:
 
 Configuration mistakes that deliberately disable documented safeguards are
 normally outside scope unless the safe default is ineffective.
+
+## Assurance model
+
+The maintained [security assurance and threat model](docs/security-assurance.md)
+documents assets, trust boundaries, implemented controls, verification gates,
+and residual risks. Operators can run the read-only local posture check with:
+
+```sh
+cairn security doctor --project .
+```
+
+This diagnostic complements dependency and repository scans; it is not a
+certification, sandbox, secret manager, or multi-user access-control system.

package/containers/entrypoint.sh

@@ -17,6 +17,7 @@ load_secret() {
     fi
     value=$(cat "$file")
     export "$name=$value"
+    unset "${name}_FILE"
   fi
 }
 
@@ -34,7 +35,7 @@ case "$mode" in
     exec cairn memory-server "$@"
     ;;
   http)
-    if [ -z "${CAIRN_MEMORY_HTTP_TOKEN:-}" ]; then
+    if [ -z "${CAIRN_MEMORY_HTTP_TOKEN:-}" ] && [ -z "${CAIRN_MEMORY_HTTP_TOKEN_FILE:-}" ]; then
       echo "cairnkeep: HTTP mode requires CAIRN_MEMORY_HTTP_TOKEN or CAIRN_MEMORY_HTTP_TOKEN_FILE" >&2
       exit 64
     fi

package/docs/README.md

@@ -43,6 +43,8 @@ linked guides rather than the project landing page.
   retention, backup, migration, and uninstall behavior.
 - [Privacy and data flow](privacy-and-data-flow.md) maps what each opt-in feature
   reads, stores, and may send over the network.
+- [Security assurance and threat model](security-assurance.md) records assets,
+  trust boundaries, controls, residual risks, and the local posture check.
 - [Git-linked work evidence](work-evidence.md) covers bounded local session-to-Git
   provenance without prompt or reasoning capture.
 - [Optional document knowledge](domain-knowledge.md) covers the separately

package/docs/learning/CURRICULUM-MAP.md

@@ -1,6 +1,6 @@
 # Curriculum Coverage Map
 
-**Baseline:** Cairnkeep 2.20.1
+**Baseline:** Cairnkeep 2.21.0
 **Last reviewed:** 2026-10-06
 
 This map prevents the course from drifting behind the product. It assigns each
@@ -43,6 +43,7 @@ been rehearsed.
 | Bounded project playbooks, generic memory retrieval guidance, enforcement, and private receipts | L25 | L25 | Ready; balanced/local by default; invocation requires runtime evidence; actor identity unverified |
 | Progressive pack retrieval, frozen benchmark, context-usage receipts, review-gated memory proposals, optional provider adapter | L26 | V26 | Ready; default flat search and AnythingLLM remain compatible; OpenViking and receipt mutation are explicitly gated |
 | Branchable agent state, model-managed context, and learned decision-model comparisons | L27 | V27 | Ready; evidence runners are operator-invoked and no companion is a runtime dependency or authority |
+| Threat model, local posture check, portable-path adversarial tests, and release security controls | L28 | V28 | Ready; diagnostic is read-only and evidence is not certification |
 
 ## Release Review
 
@@ -77,7 +78,7 @@ repository remains the canonical source for explanations and scripts.
 | `course-11-windows` | L22 | Native PowerShell lifecycle, ACL inspection, and reversible uninstall |
 | `course-12-guided-setup` | L23 | Deterministic setup, Pi local stdio, recovery, and backup-first uninstall |
 | `course-13-playbooks` | L25 | Policy profiles, lifecycle decisions, enforcement, receipts, and ownership-safe instructions |
-| Disposable source checkout | L26-L27 | Context retrieval and ecosystem evidence without modifying course projects |
+| Disposable source checkout | L26-L28 | Context retrieval, ecosystem evidence, and security assurance without modifying course projects |
 
 ## Command Ownership
 
@@ -95,6 +96,7 @@ against `cairn help` so a new command cannot bypass a curriculum decision.
 | `cairn sync-kimi` | L02 |
 | `cairn sync-omp` | L02 |
 | `cairn doctor` | L03; advanced repair in L13-L14 |
+| `cairn security` | L28 |
 | `cairn playbook` | L25 |
 | `cairn trajectory` | L13 |
 | `cairn artifact` | L13 |

package/docs/learning/FEATURE-GUIDE.md

@@ -1,6 +1,6 @@
 # Cairnkeep feature guide
 
-**Baseline:** Cairnkeep 2.20.1
+**Baseline:** Cairnkeep 2.21.0
 
 This is the step-back map for choosing and operating Cairnkeep features. The
 [course labs](https://github.com/cairnkeep/cairnkeep-course-labs) provide one
@@ -27,6 +27,9 @@ locator and actual tool invocation must be verified from runtime evidence.
 Version 2.20 adds OpenCode 2.0.24 plugin and compaction compatibility plus
 operator-invoked ecosystem evidence runners; see
 [L27](lessons/L27-ecosystem-evidence.md).
+Version 2.21 adds the formal threat model, a read-only local security posture
+check, portable-path adversarial coverage, bounded HTTP requests, and repository
+supply-chain gates; see [L28](lessons/L28-security-assurance.md).
 
 ## The three-layer model
 
@@ -70,6 +73,7 @@ prerequisites for ordinary memory.
 | Wiki and alignment | `/wiki-ingest`, `/wiki-query`, `/wiki-lint`, alignment files | Written only when invoked; reviewable `.planning/` artifacts | Re-run lint, inspect source citations, revert tracked changes normally | `course-02-memory` |
 | Local code graph | `cairn graph build|query|status|diff|explain|path`; `/graphify` delegates | Default off; optional isolated `graphify` executable; incremental work under `graphify-out/`, published view under `.planning/graphs/` | Ignore both derived locations; check status and source before trusting a result; use `--force` only after intentional deletion; uninstall adapters separately | `course-08-graph` |
 | Repository quality | `/repo-review`, `/security-audit` | On-demand workflow; findings are hypotheses until reproduced | Require file/line evidence and regression tests | `course-03-quality` |
+| Security posture | `cairn security doctor [--project PATH] [--json]` | Read-only local configuration and permission inspection; no network; token values never emitted | Resolve failures, decide warnings explicitly, and re-run after exposure or authority changes | Disposable source checkout, L28 |
 | Guided project setup | `cairn setup [PATH]` selectors; deterministic `--git`, `--harness`, `--memory`, and `--yes` flags | Arrow-key Git/memory choices and harness checkboxes in capable terminals; text fallback otherwise; reconciles only selected assets; private `.ai/cairnkeep.json`; machine sync is never automatic | Repeat deterministically, run doctor, or replay its recovery command; Git-less mode remains limited | `course-12-guided-setup` |
 | Codex project memory | Select `--harness codex --memory local` | Writes `.codex/config.toml` plus POSIX/native Windows launchers; local stdio; user-wide configuration and trust remain untouched | Review the MCP table, accept Codex project trust, run doctor, and relaunch; uninstall is backup-first | `course-01-bootstrap` |
 | Workflow playbooks and durable-context guidance | `cairn playbook check start|check|finish`; project `minimal`, `balanced`, or `strict` policy; managed `AGENTS.md` retrieval protocol | Balanced by default; private `.ai/playbooks.json`; one task-derived project search when applicable; optional receipts in `.agentfs/playbooks/`; checks are offline and execute nothing | Verify the actual memory tool event and maintained source, inspect status/digests, enforce truthful `must` evidence, inspect receipts, reset overrides, remove only the managed `AGENTS.md` block | `course-13-playbooks` |
@@ -108,6 +112,7 @@ prerequisites for ordinary memory.
 | General meta-agent loop | Not shipped | Not applicable | Playbooks select bounded existing actions; no generic configuration loop, command language, or scheduler | `course-07-evaluation` |
 | Pack retrieval and skills | `CAIRN_CONTEXT_PACKS=1`; HTTP needs separate consent; skills need exact-digest approval | Restart MCP server | `cairn pack skills`; revoke approval or disable pack; no automatic execution | `course-10-trust-context` |
 | Ecosystem evidence runners | Explicit script invocation plus caller-supplied binaries/model configuration | None; disposable processes only | Temporary state is removed by default; inspect the JSON report and pinned evidence | Disposable source checkout, L27 |
+| Security assurance | `cairn security doctor`; repository security workflows and offline gates | No restart for diagnostics; runtime HTTP bounds apply after server restart | Inspect failures/warnings, run security baseline and smoke gates, read residual risks | Disposable source checkout, L28 |
 
 ## Harness and maintenance checks
 

package/docs/learning/README.md

@@ -62,6 +62,7 @@ expanded only after their labs are executable.
 | L25 | [Bounded workflow playbooks](lessons/L25-playbooks.md) | Ready | 35 min |
 | L26 | [Context intelligence with explicit authority](lessons/L26-context-intelligence.md) | Ready | 45 min |
 | L27 | [Evaluate context companions without moving authority](lessons/L27-ecosystem-evidence.md) | Ready | 30 min |
+| L28 | [Verify Cairnkeep's security posture](lessons/L28-security-assurance.md) | Ready | 30 min |
 
 The [curriculum coverage map](CURRICULUM-MAP.md) records where every public
 feature is introduced, practised, and operated. It also marks design-only work

package/docs/learning/lessons/L00-why-cairnkeep.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 10 minutes
-**Tested with:** Cairnkeep 2.20.1
+**Tested with:** Cairnkeep 2.21.0
 
 ## Outcome
 

package/docs/learning/lessons/L01-safe-trial.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 15 minutes
-**Tested with:** Cairnkeep 2.20.1
+**Tested with:** Cairnkeep 2.21.0
 
 ## Outcome
 

package/docs/learning/lessons/L02-installation.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.20.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.21.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L03-first-project.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.20.1
+**Tested with:** Cairnkeep 2.21.0
 
 ## Outcome
 

package/docs/learning/lessons/L19-validated-skill-improvement.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Evidence and Evaluation
 **Time:** 50 minutes
-**Tested with:** Cairnkeep 2.20.1
+**Tested with:** Cairnkeep 2.21.0
 
 ## Outcome
 

package/docs/learning/lessons/L20-mcp-tool-profiles.md

@@ -1,7 +1,7 @@
 # L20 - Least-authority MCP tool profiles
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.20.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.21.0 and Node.js 22 or newer
 **Time:** 25 minutes
 
 ## Outcome

package/docs/learning/lessons/L21-context-packs.md

@@ -1,7 +1,7 @@
 # L21 - Immutable context packs and skill approval
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.20.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.21.0 and Node.js 22 or newer
 **Time:** 40 minutes
 
 ## Outcome

package/docs/learning/lessons/L22-native-windows.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Operator
 **Time:** 30 minutes
-**Tested with:** Cairnkeep 2.20.1, Windows x64, and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.21.0, Windows x64, and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L23-guided-setup.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart and Operator
 **Time:** 35 minutes
-**Tested with:** Cairnkeep 2.20.1; Pi 0.84.1; Node.js 22, 24, and 26
+**Tested with:** Cairnkeep 2.21.0; Pi 0.84.1; Node.js 22, 24, and 26
 
 ## Outcome
 

package/docs/learning/lessons/L24-okf-exchange.md

@@ -1,7 +1,7 @@
 # L24 - Reviewed knowledge exchange
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.20.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.21.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L25-playbooks.md

@@ -1,7 +1,7 @@
 # L25 - Bounded workflow playbooks
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.20.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.21.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L26-context-intelligence.md

@@ -1,5 +1,8 @@
 # L26 - Context intelligence with explicit authority
 
+**Status:** Ready
+**Tested with:** Cairnkeep 2.21.0 and Node.js 22 or newer
+
 ## Outcome
 
 You will measure retrieval before changing it, retrieve an enabled context pack

package/docs/learning/lessons/L27-ecosystem-evidence.md

@@ -1,6 +1,6 @@
 # L27 - Evaluate context companions without moving authority
 
-**Tested with:** Cairnkeep 2.20.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.21.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L28-security-assurance.md

@@ -0,0 +1,104 @@
+# L28 - Verify Cairnkeep's security posture
+
+**Status:** Ready
+**Tested with:** Cairnkeep 2.21.0 and Node.js 22 or newer
+
+## Outcome
+
+You will distinguish repository assurance from local deployment posture, run a
+read-only security diagnostic, deliberately reproduce a weak-token failure,
+and choose least authority for a network-facing MCP client.
+
+## Prerequisites
+
+- Install Cairnkeep 2.21.0 or use a disposable source checkout.
+- Complete [L20 - Least-authority MCP tool profiles](L20-mcp-tool-profiles.md).
+- Use synthetic values only; never paste a real bearer token into a recording,
+  terminal transcript, or issue.
+
+## Exercise
+
+Create a disposable project and inspect the local-only posture:
+
+```sh
+lab=$(mktemp -d)
+mkdir -p "$lab/.ai"
+chmod 700 "$lab/.ai"
+cairn security doctor --project "$lab"
+cairn security doctor --project "$lab" --json
+```
+
+With HTTP disabled, the transport checks are `SKIP`. That is not missing
+coverage: local stdio is the closed-by-default path.
+
+Now model an unsafe deployment with a deliberately weak synthetic token:
+
+```sh
+MCP_HTTP_PORT=7801 \
+CAIRN_MEMORY_HTTP_TOKEN=short \
+cairn security doctor --project "$lab" --json
+```
+
+The command exits non-zero and reports `http-token` as `FAIL`. Confirm that the
+JSON does not contain `short`. Then model a bounded observation-only endpoint:
+
+```sh
+MCP_HTTP_PORT=7801 \
+MCP_HTTP_HOST=127.0.0.1 \
+CAIRN_MEMORY_HTTP_TOKEN=synthetic-0123456789abcdef-0123456789abcdef \
+CAIRN_MCP_TOOL_PROFILE=read-only \
+cairn security doctor --project "$lab"
+```
+
+The diagnostic passes. This does not start the server, modify the project, or
+prove that a reverse proxy supplies TLS; it checks only the effective local
+configuration visible to this process.
+
+Read [Security assurance and threat model](../../security-assurance.md), then
+map each control to one boundary: project storage, MCP authority, remote
+transport, context content, or release supply chain.
+
+## Verification
+
+From a source checkout, run the maintained offline gates:
+
+```sh
+npm run security:baseline
+scripts/test-security-baseline.sh
+npm --prefix mcp-memory-server run check:security-assurance
+npm --prefix mcp-memory-server run check:http-guard
+```
+
+The baseline rejects unpinned external Actions and `pull_request_target`. The
+smoke tests cover token non-disclosure, request bounds, and deterministic
+portable-path adversarial cases.
+
+## Common failures
+
+- A private `.ai` file is group/world accessible on POSIX: restore mode `0600`.
+- HTTP is non-loopback without an explicit Host allowlist: set the public host
+  names and ports intentionally.
+- A network client receives the `full` profile although it only observes:
+  choose `read-only` or a reviewed `custom` allowlist and restart the server.
+- A remote URL uses plaintext HTTP: use HTTPS, unless it is an intentional
+  loopback-only hop.
+
+## Privacy and trust boundary
+
+The diagnostic reads configuration, file metadata, and only the length and
+simple repetition of a configured token. It writes nothing and performs no
+network request, but JSON includes the canonical project path. A passing report
+is point-in-time evidence, not a certification or a substitute for TLS, host
+hardening, secret management, or multi-user authorization.
+
+## Recovery
+
+Remove the disposable directory after inspecting the output:
+
+```sh
+rm -rf -- "$lab"
+```
+
+For a real project, correct only the named file or environment setting. Do not
+delete durable memory or regenerate credentials merely to silence a warning;
+first decide whether the reported exposure is intentional.

package/docs/learning/video-scripts/V28-security-assurance.md

@@ -0,0 +1,72 @@
+# V28 - Security evidence you can inspect
+
+Target length: 10–12 minutes. Audience: experienced developers operating an
+agent-memory service locally or behind authenticated HTTP.
+
+## Recording outline
+
+### 0:00–1:20 — Threat model before tooling
+
+Animate five boundaries: project storage, MCP authority, remote transport,
+retrieved content, and release supply chain. State that Cairnkeep is not a
+sandbox, secret manager, TLS terminator, or multi-user ACL.
+
+### 1:20–3:20 — Safe local baseline
+
+Type at human speed in a disposable directory:
+
+```sh
+lab=$(mktemp -d)
+mkdir -p "$lab/.ai"
+chmod 700 "$lab/.ai"
+cairn security doctor --project "$lab"
+```
+
+Pause on the skipped HTTP checks. Explain that disabled network exposure is the
+expected secure default, not a missing test.
+
+### 3:20–5:30 — Make one failure visible
+
+Run the weak synthetic-token example from L28. Zoom into the non-zero exit and
+the `http-token` failure, then search the JSON for the planted value to show it
+was not emitted. Leave a two-second pause before remediation.
+
+### 5:30–7:20 — Reduce authority
+
+Re-run with a long synthetic token, loopback host, and
+`CAIRN_MCP_TOOL_PROFILE=read-only`. Put the tool-catalog intersection on screen:
+
+```text
+feature gates ∩ capabilities ∩ MCP profile = exposed tools
+```
+
+Stress that a profile removes authority; it never enables a feature.
+
+### 7:20–9:20 — Show repository evidence
+
+Use a split terminal for:
+
+```sh
+npm run security:baseline
+npm --prefix mcp-memory-server run check:security-assurance
+npm --prefix mcp-memory-server run check:http-guard
+```
+
+Highlight full-SHA action pins, CodeQL, dependency review, token non-leakage,
+portable Windows/POSIX path cases, and the HTTP 413 test. Do not show repository
+secrets or live security-alert details.
+
+### 9:20–10:30 — Read the residual risks
+
+End on `docs/security-assurance.md`, not on a green checkmark. Call out the
+same-account trust boundary, lack of per-user HTTP ACLs, unencrypted local
+databases, and prompt-injection residual risk. The closing message is: evidence
+narrows uncertainty; it does not abolish trust.
+
+## Recording cautions
+
+- Use only a temporary project and synthetic token.
+- Keep commands, exit codes, and report states legible; cut dead time rather
+  than speeding narration.
+- Do not imply that Scorecard, CodeQL, an SBOM, or provenance is a certification.
+- Delete the exact temporary directory on screen at the end.

package/docs/operating.md

@@ -829,22 +829,57 @@ is guarded and **fails closed**:
 
 | Variable | Purpose |
 |---|---|
-| `MCP_HTTP_PORT` | Enable HTTP mode on this port (unset → stdio) |
+| `MCP_HTTP_PORT` | Enable HTTP mode with a canonical decimal port from 1 through 65535 (unset → stdio; signs, whitespace, prefixes, and suffixes are rejected) |
 | `MCP_HTTP_HOST` | Bind address (default `127.0.0.1`) |
-| `CAIRN_MEMORY_HTTP_TOKEN` | **Required** in HTTP mode — clients send `Authorization: Bearer <token>`; the server refuses to start without it |
+| `CAIRN_MEMORY_HTTP_TOKEN` | **Required** in HTTP mode — clients send `Authorization: Bearer <token>`; the server refuses to start without a header-safe ASCII Bearer value |
+| `CAIRN_MEMORY_HTTP_TOKEN_FILE` | Alternative private token file; set exactly one token source. Relative paths resolve from the server/project root. The direct server validates a private non-symlink file; the container entrypoint converts its mounted secret to the direct token and clears `_FILE` |
 | `CAIRN_MEMORY_HTTP_ALLOWED_ORIGINS` | Comma-separated browser origins allowed via CORS (default: none — no cross-origin access) |
-| `CAIRN_MEMORY_HTTP_ALLOWED_HOSTS` | Comma-separated allowed `Host` headers for DNS-rebinding protection (default: the bind host + `localhost` on the chosen port) |
+| `CAIRN_MEMORY_HTTP_ALLOWED_HOSTS` | Comma-separated `host:port` authorities allowed for DNS-rebinding protection (default: the bind host + `localhost` on the chosen port; bracket IPv6 literals) |
 | `CAIRN_ARTIFACT_HTTP` | Additional consent for artifact tools (default off; requires `CAIRN_ARTIFACT_STORE`, a valid `X-Cairn-Project`, bearer auth, and the normal Host/CORS checks) |
 
 Requests without a valid bearer token get `401`; requests with an unexpected
-`Host` header get `403`. Keep HTTP mode bound to `127.0.0.1` unless you have a
-specific reason to expose it, and use a long random token. HTTP mode has no
+`Host` header get `403`; request bodies over 8 MiB get `413`. The server also
+bounds header size, header/request duration, and keep-alive time. Keep HTTP mode
+bound to `127.0.0.1` unless you have a specific reason to expose it, and use a
+random token of at least 32 bytes. HTTP mode has no
 per-user ACL or tenant isolation. Clients may bind sessions to separate project
 databases with validated `X-Cairn-Project` routing metadata, but that metadata
 is not an authorization boundary. See [Memory storage and deployment](storage.md)
 for the placement rules, client registration, TLS requirements, project headers,
 and backup boundaries.
 
+### Security posture check
+
+`cairn security doctor [--project PATH] [--json]` performs a read-only local
+posture check. It validates canonical project placement and its immediate
+replacement boundary, permissions on private managed files, the effective MCP
+profile, HTTP token strength and token-file
+safety, explicit Host allowlisting for network bindings, least authority, and
+remote URL encryption. It never prints a token value. A failed check exits 1;
+warnings remain visible but nonfatal, and disabled optional surfaces are
+reported as skipped.
+
+The command safely parses literal `KEY=value`, single-quoted, or double-quoted
+assignments from the selected project's private `.ai/.env` through a
+descriptor-bound 64 KiB read; it never sources or executes that file. Ambient variables take precedence, matching launcher
+override behavior. Shell expansion, command substitution, or another ambiguous
+line fails the environment check instead of being evaluated. Relative token
+files are resolved from the selected project, even when the command is invoked
+from another directory. Unquoted values accept only letters, digits, and the
+literal characters `_./:@%+,=-`; use single or double quotes for other literal
+punctuation. POSIX file checks require ownership by the current account or the
+trusted root account in addition to restrictive mode bits.
+
+The generated POSIX launchers snapshot exported ambient variables before
+sourcing `.ai/.env`, then restore those existing values. Project-only variables
+are added, while an explicit process environment remains the highest-precedence
+override, matching the Windows launchers and the posture report.
+
+Run it after setup, after changing HTTP or MCP-profile configuration, and
+before a security-sensitive deployment. It does not replace `cairn doctor`,
+TLS, a secret manager, or a multi-user authorization layer. See
+[Security assurance and threat model](security-assurance.md).
+
 ## Project playbooks
 
 Guided setup and tracked bootstrap create private `.ai/playbooks.json` mode

package/docs/privacy-and-data-flow.md

@@ -156,6 +156,20 @@ Sanitized test replay uses synthetic tool arguments, results, stderr, and
 project paths only; release evidence must not include credentials, private
 endpoints, memory values, or identifying local paths.
 
+`cairn security doctor` reads filesystem metadata for private project files and,
+when HTTP is configured, the bearer token or configured token file only far
+enough to check presence, byte length, repetition, header-safe syntax, and file safety. It emits no
+token content, writes no state, and makes no network request. JSON output can
+contain the canonical project path and should be treated as local diagnostic
+data. The command parses literal assignments from `.ai/.env` without sourcing
+the file, expanding variables, or executing commands; reads are descriptor-bound
+and limited to 64 KiB, and the ambient environment retains precedence. Relative
+token-file paths are anchored to the selected project rather than the caller's
+working directory. The accepted literal grammar excludes unquoted shell
+control, grouping, redirection, escape, expansion, tilde syntax, and control
+bytes. Generated launchers restore existing ambient values after loading the
+file, so the diagnostic and runtime use the same precedence.
+
 ## Evaluation adapter and report flow
 
 `CAIRN_EVAL` is unset/off by default. With it off, `cairn eval` returns a fixed

package/docs/releasing.md

@@ -8,7 +8,8 @@ from a workstation.
 1. Update the root `package.json` version and `CHANGELOG.md` on a pull request.
 2. Run `npm ci`, `npm run check:public`, and
    `npm --prefix mcp-memory-server test`.
-3. Merge only after every required CI check passes.
+3. Merge only after every required CI and security check passes. CodeQL and
+   dependency review are blocking; OpenSSF Scorecard is advisory evidence.
 4. Publish a GitHub Release whose tag is exactly `v<package.json version>`.
 5. After every platform and runtime job passes, CI builds one release candidate
    keyed by the exact Git tree. It contains the npm tarball, reproducible
@@ -58,3 +59,10 @@ automatic. Confirm an unauthenticated pull after changing visibility.
 
 Treat a published version as immutable. If a release is wrong, fix it in a new
 version rather than moving its tag or replacing the npm package.
+
+Repository Actions are restricted to the maintained allowlist and every
+non-local action reference must use a full commit SHA. `npm run
+security:baseline` enforces that contract, rejects `pull_request_target`, and
+asserts that CodeQL, dependency review, and advisory Scorecard workflows remain
+present. See [Security assurance and threat model](security-assurance.md) for
+the wider threat model and residual risks.