@cairnkeep/cli 2.21.0 → 2.22.0

package/CHANGELOG.md

@@ -5,6 +5,40 @@ All notable user-facing changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [2.22.0] - 2026-10-07
+
+### Added
+
+- Add explicit `eval protocol --codex-jsonl PATH` for single-turn native Codex
+  exec exports, without automatic capture or changes to persisted trajectories.
+  Correlate MCP lifecycles conservatively; unknown or incomplete events cannot
+  pass. Include offline controls, installed-package tests, completions and
+  learning guidance; task correctness remains independently verified.
+- Add default-off `cairn eval protocol` to audit direct memory tool use in
+  existing normalized Claude Code, OpenCode and Pi trajectories. Reports
+  retrieval ordering, interpretable results and direct mutation attempts with
+  conservative pass/fail/inconclusive states, bounded local reads and
+  payload-free output. Capture authorization is a caller assertion, not an
+  authenticated grant; task quality and indirect shell effects are not certified.
+- Add offline positive/narration controls, packaged CLI verification, shell
+  completions, operating/privacy guidance and the L16/video learning supplement.
+
+## [2.21.1] - 2026-10-07
+
+### Fixed
+
+- Classify embedding health failures by sanitized HTTP status so operators can
+  distinguish authorization, missing endpoint/model, throttling, transport,
+  and upstream failures without exposing provider response bodies, request
+  identifiers, or credentials.
+
+### CI
+
+- Split all 48 memory-server smoke contracts exactly once across three
+  deterministically balanced native-Windows jobs while retaining Windows CLI,
+  package, global-install, Node 22/24/26, and full Linux matrix coverage. This
+  removes the serial 15-minute suite duplication from every Windows lane.
+
 ## [2.21.0] - 2026-10-07
 
 ### Added

package/docs/README.md

@@ -18,6 +18,8 @@ linked guides rather than the project landing page.
 
 - [Cairnkeep for coding agents](agents.md) explains retrieval-first behavior,
   memory authority, playbooks, approvals, and graceful fallback.
+- [Audit actual memory use](agent-memory-protocol.md) distinguishes direct tool
+  evidence from narration without claiming task quality or authenticated consent.
 - [Harness compatibility](harness-compatibility.md) records the exact commands,
   hooks, plugins, launchers, skills, and MCP surfaces available in each client.
 - [MCP tool annotations and least-authority profiles](mcp-tool-profiles.md)

package/docs/agent-memory-protocol.md

@@ -0,0 +1,146 @@
+# Audit actual memory use
+
+**Availability:** Cairnkeep 2.22.0 or newer; default off.
+
+`cairn eval protocol` observes structured calls in an existing normalized
+trajectory or an explicitly supplied Codex exec JSONL export. It checks project-scoped retrieval ordering, interpretable search
+results, and direct memory mutation attempts without asserted capture consent.
+It does not run an agent, execute recorded commands, contact services, write
+memory or alter trajectories. It is disabled unless `CAIRN_EVAL=1`.
+
+## Safe offline controls
+
+From a source checkout after building the server:
+
+```sh
+CAIRN_EVAL=1 bin/cairn eval protocol \
+  --trajectory examples/eval/protocol-project-search.json --json
+CAIRN_EVAL=1 bin/cairn eval protocol \
+  --trajectory examples/eval/protocol-narration.json --json
+```
+
+The positive control passes; the narrated pseudo-call fails. These are
+synthetic parser controls, not live model performance evidence. An empty search
+is a successful retrieval observation: a memory hit is not mandatory. Never
+repeat or widen searches merely to manufacture a hit.
+
+## Inspect your own evidence
+
+Claude Code, OpenCode, and Pi use **normalized Cairnkeep trajectories**.
+Codex uses the separate explicit export below, not its internal session files.
+Capture remains separately
+opt-in; this audit does not enable it. In the project where a session was
+captured, export one closed, task-aligned session privately:
+
+```sh
+umask 077
+cairn trajectory show SESSION_ID --json > trajectory.json
+CAIRN_EVAL=1 cairn eval protocol --trajectory trajectory.json --json
+```
+
+The export can contain private prompts, paths and outputs despite capture
+redaction. Keep it local; do not commit or upload it. The audit emits fixed
+codes, counts, harness identity and SHA-256 digests—not the input path, session
+ID, prompts, arguments, outputs or memory keys. Input must be a UTF-8 regular
+file, at most 16 MiB and 50,000 events. Symlinks (including parent paths) and
+files changing during inspection are rejected. Use a canonical physical path
+if your filesystem path uses aliases.
+
+## Native Codex exec exports
+
+[Codex non-interactive mode](https://learn.chatgpt.com/docs/non-interactive-mode)
+documents `codex exec --json` as a structured JSONL event stream. Export a
+single task-aligned turn to a private file, then audit it explicitly:
+
+```sh
+umask 077
+# This command runs a live agent; review permissions and the task first.
+codex exec --json --ephemeral --sandbox workspace-write "YOUR TASK" > native.jsonl
+# This separate command only reads the file offline.
+CAIRN_EVAL=1 cairn eval protocol --codex-jsonl native.jsonl --json
+```
+
+Use exactly one of `--trajectory` or `--codex-jsonl`. The adapter is tested
+against the CLI/TypeScript SDK 0.160.1 exec event contract; it does not claim
+compatibility with arbitrary future streams, app-server events or internal
+rollout files. Persisted trajectory schemas and capture hooks are unchanged.
+The audit adds no SDK dependency and does not launch Codex.
+
+MCP items must identify the `cairn-memory` (or `cairn_memory`) server and the
+exact memory tool. Dispatch order comes from `item.started`; completions and
+updates must retain the same ID, server, tool and arguments. Parallel calls
+are correlated independently. A terminal-only MCP item cannot prove dispatch
+order. Native `structured_content` results or textual MCP content are accepted.
+
+Unknown records/fields, missing lifecycle events, failed turns and incomplete
+items make evidence inconclusive. Duplicate/mismatched IDs, malformed JSONL,
+multiple turns or events following a terminal turn are invalid input. Split
+multi-turn work into separately captured task-aligned turns; do not remove
+tool events to manufacture a passing audit. One terminal newline is allowed;
+blank records are rejected. The same 16 MiB byte limit applies, with at most
+50,000 source records and 50,000 normalized events.
+
+Reasoning and narrated messages are not tool evidence; their text is not
+retained by the adapter. File changes, commands and web searches are opaque
+effects, not proof of approved indirect writes. Native exports contain no
+authenticated project identity, timestamps or consent. Never publish private
+exports; the report keeps the same payload-free observation boundary.
+
+The packaged `examples/eval/protocol-codex.jsonl` is a synthetic positive
+control, not a recorded model run. Rehearse without launching Codex:
+
+```sh
+CAIRN_EVAL=1 bin/cairn eval protocol \
+  --codex-jsonl examples/eval/protocol-codex.jsonl --json
+```
+
+## Read the checks separately
+
+- `evidence_complete`: ordered calls with results, without omitted unknown
+  records, truncation or incomplete calls. Duplicate IDs, out-of-order sequences
+  and orphan results are invalid input, not successful evidence.
+- `memory_first`: the first recorded tool invocation is a project-scoped
+  `memory_search`. Task boundaries are not inferred. Trivial tasks need not
+  follow this protocol; tool availability is also not inferred. Apply this
+  check only to nontrivial tasks where direct retrieval was available, not
+  indiscriminately to every session or legitimate unavailable-tool fallback.
+- `retrieval_result`: a project search has a correlated, non-error,
+  interpretable semantic or substring result. Narration never counts. Failed
+  or missing results are inconclusive, not model-quality failures.
+- `direct_write_boundary`: direct `memory_*` mutation attempts are classified
+  from the MCP annotation catalog. Denied attempts still count. Opaque tools,
+  including shell commands, make indirect effects unverifiable.
+
+If the user or an applicable reviewed workflow explicitly authorized capture,
+add `--capture-authorized`. This is an **operator assertion**, not authenticated
+consent and never permission to write. The asserted policy and its digest are
+included in the report. Do not add the flag merely to turn a failure green.
+
+Exit codes: `0` all checks pass, `1` an observed violation, `2` invalid/unsafe
+input or command, `3` inconclusive without an observed violation. The disabled
+path returns its existing disabled envelope with exit `0` before reading any
+input; that is not a passing audit. Inspect `enabled` and `status`, not just
+the process exit code.
+
+## What this cannot prove
+
+A local trajectory is editable. Digests identify bytes and asserted policy;
+they do not authenticate a harness, server, publisher, user or tool result.
+Known direct tool names are recognized exactly, not by a permissive suffix.
+CLI-mediated retrieval/mutations, generic MCP dispatchers, opaque tools and
+full playbook start/finish enforcement are not certified here.
+
+Protocol compliance does not establish relevance, source verification,
+correctness, productivity or baseline improvement. Use the independent task
+verifier in the [evaluation harness](operating.md#evaluation-harness-opt-in)
+and the maintained [agent contract](agents.md). A realistic coding session may
+show successful retrieval while its overall audit remains inconclusive because
+shell effects cannot be certified. Do not convert this into a quality score or
+advertise a perfect agent benchmark.
+
+The [bounded release-ledger lab](research/release-ledger-task.md) provides a
+concrete task and a separate 15-check artifact grader. Offline controls cross
+all four combinations of passing/failing protocol and correct/incorrect code.
+A live lab uses the actual managed `AGENTS.md`, isolated read-only memory MCP
+tools and a closed single-turn export. Retain its raw evidence privately;
+do not substitute the synthetic positive fixture for a live trace.

package/docs/agents.md

@@ -46,6 +46,13 @@ integrations. See [Harness compatibility](harness-compatibility.md) for the
 exact tested surface. Instruction presence is not evidence that an agent
 actually invoked a tool.
 
+For existing Claude Code, OpenCode, and Pi normalized trajectories or explicit
+single-turn Codex exec JSONL exports, the
+default-off [memory protocol audit](agent-memory-protocol.md) distinguishes
+genuine direct calls from narration. It reports ordering, result evidence and
+direct mutation attempts separately; it does not certify task quality or
+indirect shell effects.
+
 ## Memory scopes and authority
 
 Use `scope: project` for task-specific decisions and conventions. Broader

package/docs/learning/CURRICULUM-MAP.md

@@ -1,7 +1,7 @@
 # Curriculum Coverage Map
 
-**Baseline:** Cairnkeep 2.21.0
-**Last reviewed:** 2026-10-06
+**Baseline:** Cairnkeep 2.22.0
+**Last reviewed:** 2026-10-07
 
 This map prevents the course from drifting behind the product. It assigns each
 user-facing surface to a lesson and records whether the lesson is complete or
@@ -31,6 +31,7 @@ been rehearsed.
 | Typed memory nodes, filters, address spaces, and structured import | L14 | L14 | Brief; default off |
 | Managed eight-capability contract and payload-free callbacks | L15 | L15-L16 | Brief; default off |
 | Deterministic two-pass evaluation and one-capability ablation | L16 | L16 | Brief; default off |
+| Offline direct-memory protocol audit and narration negative controls | L16 | V16 supplement | Introduced in 2.22.0; default off; normalized Claude Code/OpenCode/Pi trajectories or explicit single-turn Codex exec JSONL; not task-quality evidence |
 | Shell completion | L02 | L02 | Ready; optional convenience |
 | Bounded meta-agent configuration loop | L17 | None | Design-only; not shipped |
 | Reviewed, evaluated, reversible skill-file improvement | L19 | L19 | Ready; explicit and default off |

package/docs/learning/FEATURE-GUIDE.md

@@ -1,6 +1,6 @@
 # Cairnkeep feature guide
 
-**Baseline:** Cairnkeep 2.21.0
+**Baseline:** Cairnkeep 2.22.0
 
 This is the step-back map for choosing and operating Cairnkeep features. The
 [course labs](https://github.com/cairnkeep/cairnkeep-course-labs) provide one
@@ -31,6 +31,11 @@ Version 2.21 adds the formal threat model, a read-only local security posture
 check, portable-path adversarial coverage, bounded HTTP requests, and repository
 supply-chain gates; see [L28](lessons/L28-security-assurance.md).
 
+Version 2.22 adds the default-off direct-memory protocol audit, including
+explicit native Codex exec exports. See the L16 memory-protocol supplement;
+protocol observations and independently verified task correctness remain
+separate evidence, not a claim of model improvement.
+
 ## The three-layer model
 
 1. **Memory server:** an MCP process that owns scoped durable storage. The
@@ -108,6 +113,7 @@ prerequisites for ordinary memory.
 | Typed nodes/import | `CAIRN_TYPED_MEMORY_NODES=1` | Restart MCP server; tool schema changes | Hard-filter search; dry-run, replay-safe import; `cairn doctor --repair` only for derived state | `course-05-evidence` |
 | Capability contract | `CAIRN_CAPABILITY_CONTRACT=1` | MCP changes require restart; operating changes apply next invocation | `cairn capabilities list|status|enable|disable|reset|logging`; digest identifies state only | `course-06-governance` |
 | Evaluation | `CAIRN_EVAL=1` for the coordinator process | No harness chosen by Cairnkeep | `validate` before `run`; inspect report, missingness and evidence scope; dry-run prune/delete | `course-07-evaluation` |
+| Memory protocol audit | `CAIRN_EVAL=1` for the audit process | No restart; existing normalized trajectory or single-turn Codex exec JSONL export | `eval protocol --trajectory PATH` or `--codex-jsonl PATH`; fixed-code observations, no writes/network; caller-asserted capture authorization; task quality and indirect effects not certified | L16 supplement |
 | Validated skill improvement | Reviewed recurring hindsight; proposal adapter; `CAIRN_EVAL=1` for evaluation | No server restart; explicit subprocesses only | `cairn skill list|show`; exact-digest apply; concurrent-edit-safe rollback | `course-09-skill` |
 | General meta-agent loop | Not shipped | Not applicable | Playbooks select bounded existing actions; no generic configuration loop, command language, or scheduler | `course-07-evaluation` |
 | Pack retrieval and skills | `CAIRN_CONTEXT_PACKS=1`; HTTP needs separate consent; skills need exact-digest approval | Restart MCP server | `cairn pack skills`; revoke approval or disable pack; no automatic execution | `course-10-trust-context` |

package/docs/learning/lessons/L00-why-cairnkeep.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 10 minutes
-**Tested with:** Cairnkeep 2.21.0
+**Tested with:** Cairnkeep 2.22.0
 
 ## Outcome
 

package/docs/learning/lessons/L01-safe-trial.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 15 minutes
-**Tested with:** Cairnkeep 2.21.0
+**Tested with:** Cairnkeep 2.22.0
 
 ## Outcome
 

package/docs/learning/lessons/L02-installation.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.21.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L03-first-project.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.21.0
+**Tested with:** Cairnkeep 2.22.0
 
 ## Outcome
 

package/docs/learning/lessons/L16-evaluation.md

@@ -19,6 +19,8 @@ report, and explain what a one-capability ablation can and cannot establish.
 - Eligible pairs, missingness, compatible turn semantics, reported token/cost
   fields, bootstrap intervals, and bounded reports.
 - `offline-framework` evidence versus separately validated live evidence.
+- Genuine memory calls versus narrated pseudo-calls; protocol ordering,
+  interpretable results, consent assertions and inconclusive indirect effects.
 - Dry validation, invocation estimates, explicit `--yes`, cancellation, report
   retention, dry-run pruning, and deletion.
 
@@ -51,6 +53,27 @@ after the lab is rehearsed from the packaged CLI rather than a source clone.
 - The learner reports estimates, intervals, missingness, and evidence scope
   without claiming causality, significance, or product improvement.
 - Course cleanup is limited to its temporary contained experiment root.
+- The protocol positive control passes and narration fails; neither is
+  described as live model improvement or task correctness.
+
+## Supplement: memory protocol evidence
+
+This supplement requires Cairnkeep 2.22.0 or newer for `eval protocol` and
+`--codex-jsonl`. Evaluation remains default off.
+
+Run the two synthetic commands in the
+[memory protocol guide](../../agent-memory-protocol.md). Pause on the negative
+control's exit `1`: saying a tool was used is not evidence of using it. Explain
+why an empty real search can pass retrieval, why incomplete capture or failed
+retrieval is inconclusive, and why shell calls prevent certification of
+indirect memory writes. Never publish a real trajectory export for this lab.
+
+Repeat with the packaged `protocol-codex.jsonl` synthetic control using
+`--codex-jsonl`, not `--trajectory`. Explain start/completion correlation,
+unknown-event gaps, single-turn boundaries and the distinction between a
+private live export and a public parser fixture. Internal rollout files and
+automatic Codex capture are not supported. Pair protocol observations with an
+independent artifact verifier; either dimension can fail separately.
 
 ## Source material
 

package/docs/learning/lessons/L19-validated-skill-improvement.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Evidence and Evaluation
 **Time:** 50 minutes
-**Tested with:** Cairnkeep 2.21.0
+**Tested with:** Cairnkeep 2.22.0
 
 ## Outcome
 

package/docs/learning/lessons/L20-mcp-tool-profiles.md

@@ -1,7 +1,7 @@
 # L20 - Least-authority MCP tool profiles
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.21.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.0 and Node.js 22 or newer
 **Time:** 25 minutes
 
 ## Outcome

package/docs/learning/lessons/L21-context-packs.md

@@ -1,7 +1,7 @@
 # L21 - Immutable context packs and skill approval
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.21.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.0 and Node.js 22 or newer
 **Time:** 40 minutes
 
 ## Outcome

package/docs/learning/lessons/L22-native-windows.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Operator
 **Time:** 30 minutes
-**Tested with:** Cairnkeep 2.21.0, Windows x64, and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.0, Windows x64, and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L23-guided-setup.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart and Operator
 **Time:** 35 minutes
-**Tested with:** Cairnkeep 2.21.0; Pi 0.84.1; Node.js 22, 24, and 26
+**Tested with:** Cairnkeep 2.22.0; Pi 0.84.1; Node.js 22, 24, and 26
 
 ## Outcome
 

package/docs/learning/lessons/L24-okf-exchange.md

@@ -1,7 +1,7 @@
 # L24 - Reviewed knowledge exchange
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.21.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L25-playbooks.md

@@ -1,7 +1,7 @@
 # L25 - Bounded workflow playbooks
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.21.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L26-context-intelligence.md

@@ -1,7 +1,7 @@
 # L26 - Context intelligence with explicit authority
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.21.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L27-ecosystem-evidence.md

@@ -1,6 +1,6 @@
 # L27 - Evaluate context companions without moving authority
 
-**Tested with:** Cairnkeep 2.21.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L28-security-assurance.md

@@ -1,7 +1,7 @@
 # L28 - Verify Cairnkeep's security posture
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.21.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.0 and Node.js 22 or newer
 
 ## Outcome
 
@@ -11,7 +11,7 @@ and choose least authority for a network-facing MCP client.
 
 ## Prerequisites
 
-- Install Cairnkeep 2.21.0 or use a disposable source checkout.
+- Install Cairnkeep 2.22.0 or use a disposable source checkout.
 - Complete [L20 - Least-authority MCP tool profiles](L20-mcp-tool-profiles.md).
 - Use synthetic values only; never paste a real bearer token into a recording,
   terminal transcript, or issue.

package/docs/learning/tracks/evidence-and-evaluation.md

@@ -20,5 +20,9 @@ reports without making unsupported claims, apply or roll back an exact eligible
 skill proposal, and distinguish that narrow runtime from the design-only
 general meta-agent contract.
 
+L16 also covers the offline memory protocol controls: distinguish direct tool
+events from narration and explain why protocol observations, caller-asserted
+consent and task-quality evidence are separate claims.
+
 Hands-on spine: `course-05-evidence` through `course-07-evaluation` in the
 public [course labs](https://github.com/cairnkeep/cairnkeep-course-labs).

package/docs/learning/video-scripts/V16-memory-protocol-audit.md

@@ -0,0 +1,32 @@
+# V16 supplement — Show the tool call, not the claim
+
+Target length: 4–6 minutes. Experienced-developer audience. Record with
+Cairnkeep 2.22.0 or newer and opt in to `cairn eval protocol` explicitly.
+Use only committed synthetic controls, never private transcripts.
+
+1. Split the terminal: show `protocol-narration.json` beside its audit. Type the
+   command from the memory protocol guide at human speed. Pause two seconds
+   on `project_search_absent` and exit `1`: narration is not execution.
+2. Switch to `protocol-project-search.json`. Highlight the correlated IDs and
+   project scope. Run the audit and pause on the separate checks. Zero hits is
+   acceptable; it is not a reason to keep widening the query.
+3. Show the four exit states. Default-off exit `0` is not a successful audit.
+   Incomplete capture, failed retrieval and opaque shell commands yield
+   inconclusive observations, not a fabricated perfect score.
+4. Zoom into digests and counts, then back to the input: the report omits
+   private content. A digest authenticates neither a publisher nor human
+   approval. `--capture-authorized` is an assertion, not a bypass button.
+5. Switch to `protocol-codex.jsonl`, then run `--codex-jsonl`. Visually pair
+   `item.started` and `item.completed`; updates are not extra calls. Explain
+   single-turn boundaries and unknown events. Keep private exports off screen.
+6. End on the independent verifier, not a green audit. This parser lab does not
+   prove a better model, correct code, full playbook compliance or superiority
+   over a baseline.
+
+Vary framing between input, IDs and report codes. Leave breathing room after
+failures and caveats; do not accelerate terminal footage to match speech.
+
+For a coding demonstration, show task correctness beside the individual
+protocol checks. Successful retrieval followed by coding commands may produce
+an inconclusive overall audit because shell effects are opaque. Do not edit
+that into a pass or claim an A/B improvement from one run.

package/docs/operating.md

@@ -1049,6 +1049,10 @@ then checks `./.ai/.env` (or the current environment). It does not inspect a
 harness's remote HTTP registration. Unconfigured optional dependencies are
 skipped; it exits non-zero when the local server probe fails or a configured
 dependency (LLM/embedding endpoint, writable store) is unreachable.
+Embedding probes report only a bounded classification and HTTP status, such as
+`authorization rejected (HTTP 403)` or `endpoint or model not found (HTTP
+404)`. Provider response bodies and request identifiers are discarded so a
+health check cannot echo sensitive upstream diagnostics.
 
 It also checks an existing project-local trajectory database for SQLite
 integrity, schema compatibility and index consistency. Because capture is
@@ -1076,6 +1080,14 @@ machine-level drift; setup itself never performs the sync.
 
 ### Evaluation harness (opt-in)
 
+To inspect actual direct memory tool use in an existing normalized trajectory,
+use `CAIRN_EVAL=1 cairn eval protocol --trajectory PATH --json`. Native
+single-turn Codex exec JSONL exports use `--codex-jsonl PATH` instead. This read-only,
+offline audit returns separate pass/fail/inconclusive checks, emits no recorded
+content, and does not measure task quality. See the
+[memory protocol guide](agent-memory-protocol.md) for controls, export privacy,
+supported harnesses, consent assertions and exit codes.
+
 `cairn eval` is a local, serial experiment coordinator. It is disabled unless
 `CAIRN_EVAL` is explicitly truthy. The disabled path returns before reading a
 task set or adapter configuration, creating a workspace or report, opening a

package/docs/privacy-and-data-flow.md

@@ -172,6 +172,15 @@ file, so the diagnostic and runtime use the same precedence.
 
 ## Evaluation adapter and report flow
 
+`cairn eval protocol` is a separate read-only audit of an explicitly supplied
+normalized trajectory or single-turn Codex exec JSONL export. With evaluation disabled it does not read that
+file. When enabled it performs bounded local reads only: no adapter, command
+execution, network, database, or persistent report. Output is limited to fixed
+codes, counts, harness identity, input/policy digests and limitations. Exports
+can contain private content even after redaction; keep them local. See the
+[memory protocol guide](agent-memory-protocol.md). A capture-authorization flag
+is the caller's assertion, not authenticated consent.
+
 `CAIRN_EVAL` is unset/off by default. With it off, `cairn eval` returns a fixed
 disabled result before task-set or adapter reads, workspace/report creation,
 database access, subprocess execution, or network activity. A credential in

package/docs/releasing.md

@@ -29,6 +29,13 @@ from a workstation.
 9. Verify both image digests, SBOM attestations, provenance attestations, and an
    anonymous pull before announcing the release.
 
+The native-Windows lanes retain stable check names for branch protection. Each
+lane exercises the Windows CLI and packed global install on its Node version,
+while the complete memory-server smoke catalog is deterministically balanced
+across the three lanes. The Linux Node 22/24/26 matrix independently runs the
+complete catalog on every supported runtime. This preserves coverage while
+removing three serial copies of the slow Windows suite from the critical path.
+
 Stable versions must use a stable GitHub Release and publish to npm's `latest`
 tag. SemVer prerelease versions must use a GitHub prerelease and publish to
 `next`. A mismatch fails before publication.

package/docs/research/release-ledger-task.md

@@ -0,0 +1,36 @@
+# Bounded release-ledger task
+
+Use a disposable project, Node standard APIs and ESM only. Implement
+`src/release-ledger.mjs` exporting `createLedger()`. The returned API exposes
+`append(input)`, `finalize(packageName, version)`, `get(packageName, version)`
+and `list()`.
+
+- Package names match `^[a-z][a-z0-9-]*$`; versions are numeric x.y.z. Notes
+  are non-empty arrays of non-empty strings, preserving order. Invalid input
+  throws Error with code `INVALID_PACKAGE`, `INVALID_VERSION` or `INVALID_NOTES`.
+- `append({package,version,notes})` creates a draft with monotonically
+  increasing sequence starting at 1. A pair is unique forever; duplicates
+  throw `DUPLICATE_RELEASE`.
+- Entries have exactly package, version, notes, sequence, state and optional
+  checksum. Draft state is `draft`; finalized state is `final`.
+- `finalize` is idempotent. Checksum is lowercase SHA-256 of
+  `JSON.stringify({package,version,notes,sequence})` in that property order.
+  Missing releases throw `NOT_FOUND`.
+- `get` and `list` return detached copies including nested notes. `list` is
+  sequence ordered. Add and run self-tests without changing this brief.
+
+After the task closes, run the maintained independent grader from outside the
+project, with an external process timeout:
+
+```sh
+node scripts/spikes/verify-release-ledger.mjs /PATH/TO/LAB/src/release-ledger.mjs
+```
+
+This imports and executes the selected artifact; it is not a safe reader for
+arbitrary untrusted code. Use a lab with no production secrets or services.
+The grader checks 15 bounded behaviors, not all possible inputs or security.
+Do not expose its implementation to the task before grading. A model could
+deliberately game any visible rubric; this is a correctness smoke test, not
+adversarial certification. Run protocol observation separately using the
+[memory audit](../agent-memory-protocol.md). Keep raw exports private; publish
+only appropriately reviewed aggregate evidence. One run is not an A/B study.

package/docs/security-assurance.md

@@ -86,6 +86,10 @@ punctuation.
 `cairn doctor` remains the operational dependency/store check. Run both before
 exposing HTTP, after changing tool authority, and before a security-sensitive
 release.
+Its embedding probe retains only a sanitized failure class and HTTP status;
+provider response bodies and request identifiers are never emitted. This makes
+expired credentials distinguishable from a missing model without turning the
+doctor output into a secondary secret or telemetry channel.
 
 ## Repository and release controls
 
@@ -120,3 +124,7 @@ The maintained gates are `npm run security:baseline`, both production
 security-assurance and HTTP-guard smoke tests, native-Windows tests, and the
 complete public test matrix. The baseline gate also rejects
 `pull_request_target` and every unpinned non-local GitHub Action.
+The native-Windows matrix runs the CLI, package, and global-install contracts on
+Node 22, 24, and 26. It deterministically partitions the complete memory-server
+smoke catalog across those lanes exactly once; the Linux matrix still runs the
+complete catalog independently on every supported Node version.

package/examples/eval/README.md

@@ -1,5 +1,18 @@
 # Offline evaluation fixture
 
+The separate `protocol-project-search.json`, `protocol-narration.json` and
+native-format `protocol-codex.jsonl`
+controls exercise `cairn eval protocol`, without running an adapter. See the
+[memory protocol guide](../../docs/agent-memory-protocol.md). These synthetic
+controls demonstrate parser behavior, not live model quality.
+
+`scripts/spikes/verify-release-ledger.mjs MODULE_PATH` separately grades the
+bounded release-ledger coding task with 15 deterministic artifact checks. It
+imports and executes the explicitly selected module: use an isolated lab and
+an external timeout, never untrusted production files. Its score is not a
+protocol score, a comprehensive security audit or an A/B comparison.
+The [task brief](../../docs/research/release-ledger-task.md) defines the lab.
+
 This directory contains Cairnkeep's deterministic, network-free evaluation
 population. It validates the evaluation framework; its designed differences are
 not performance, efficiency, quality, or live-product evidence.

package/examples/eval/bundled-fake.json

@@ -1 +1 @@
-{"identifier":"cairn-offline-fake-v1","package_version":"2.21.0","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}
+{"identifier":"cairn-offline-fake-v1","package_version":"2.22.0","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}

package/examples/eval/protocol-codex.jsonl

@@ -0,0 +1,5 @@
+{"type":"thread.started","thread_id":"synthetic-control"}
+{"type":"turn.started"}
+{"type":"item.started","item":{"id":"a","type":"mcp_tool_call","server":"cairn-memory","tool":"memory_search","arguments":{"scope":"project","query":"release ledger"},"status":"in_progress"}}
+{"type":"item.completed","item":{"id":"a","type":"mcp_tool_call","server":"cairn-memory","tool":"memory_search","arguments":{"scope":"project","query":"release ledger"},"status":"completed","result":{"content":[],"structured_content":{"mode":"substring","count":0,"results":[]}}}}
+{"type":"turn.completed","usage":{"input_tokens":10,"cached_input_tokens":0,"output_tokens":1}}