@cairnkeep/cli 2.21.1 → 2.22.1

package/CHANGELOG.md

@@ -5,6 +5,45 @@ All notable user-facing changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [2.22.1] - 2026-10-07
+
+### Fixed
+
+- Handle bounded Windows context-pack pointer-lock contention during concurrent
+  updates, including delete-pending access errors. Preserve exclusive ownership,
+  unsafe-lock rejection, denied access and the existing retry budget; never
+  steal another writer's lock. Add deterministic fault controls and native
+  cross-process exclusion coverage without changing persisted data or approval.
+- Align lesson npm/container installation commands with the current release;
+  add a regression rejecting stale pins and update Windows/context-pack recovery
+  guidance and learning baselines.
+
+### CI
+
+- Restrict publication token permissions to the preparation, npm and container
+  jobs that need them. Read-only workflow defaults and parsed-YAML positive/
+  mutation controls reject unnecessary authority and missing provenance grants.
+  Update maintainer guidance and the security learning/video supplement; no
+  runtime package or deployed configuration change is required.
+
+## [2.22.0] - 2026-10-07
+
+### Added
+
+- Add explicit `eval protocol --codex-jsonl PATH` for single-turn native Codex
+  exec exports, without automatic capture or changes to persisted trajectories.
+  Correlate MCP lifecycles conservatively; unknown or incomplete events cannot
+  pass. Include offline controls, installed-package tests, completions and
+  learning guidance; task correctness remains independently verified.
+- Add default-off `cairn eval protocol` to audit direct memory tool use in
+  existing normalized Claude Code, OpenCode and Pi trajectories. Reports
+  retrieval ordering, interpretable results and direct mutation attempts with
+  conservative pass/fail/inconclusive states, bounded local reads and
+  payload-free output. Capture authorization is a caller assertion, not an
+  authenticated grant; task quality and indirect shell effects are not certified.
+- Add offline positive/narration controls, packaged CLI verification, shell
+  completions, operating/privacy guidance and the L16/video learning supplement.
+
 ## [2.21.1] - 2026-10-07
 
 ### Fixed

package/docs/README.md

@@ -18,6 +18,8 @@ linked guides rather than the project landing page.
 
 - [Cairnkeep for coding agents](agents.md) explains retrieval-first behavior,
   memory authority, playbooks, approvals, and graceful fallback.
+- [Audit actual memory use](agent-memory-protocol.md) distinguishes direct tool
+  evidence from narration without claiming task quality or authenticated consent.
 - [Harness compatibility](harness-compatibility.md) records the exact commands,
   hooks, plugins, launchers, skills, and MCP surfaces available in each client.
 - [MCP tool annotations and least-authority profiles](mcp-tool-profiles.md)

package/docs/agent-memory-protocol.md

@@ -0,0 +1,146 @@
+# Audit actual memory use
+
+**Availability:** Cairnkeep 2.22.0 or newer; default off.
+
+`cairn eval protocol` observes structured calls in an existing normalized
+trajectory or an explicitly supplied Codex exec JSONL export. It checks project-scoped retrieval ordering, interpretable search
+results, and direct memory mutation attempts without asserted capture consent.
+It does not run an agent, execute recorded commands, contact services, write
+memory or alter trajectories. It is disabled unless `CAIRN_EVAL=1`.
+
+## Safe offline controls
+
+From a source checkout after building the server:
+
+```sh
+CAIRN_EVAL=1 bin/cairn eval protocol \
+  --trajectory examples/eval/protocol-project-search.json --json
+CAIRN_EVAL=1 bin/cairn eval protocol \
+  --trajectory examples/eval/protocol-narration.json --json
+```
+
+The positive control passes; the narrated pseudo-call fails. These are
+synthetic parser controls, not live model performance evidence. An empty search
+is a successful retrieval observation: a memory hit is not mandatory. Never
+repeat or widen searches merely to manufacture a hit.
+
+## Inspect your own evidence
+
+Claude Code, OpenCode, and Pi use **normalized Cairnkeep trajectories**.
+Codex uses the separate explicit export below, not its internal session files.
+Capture remains separately
+opt-in; this audit does not enable it. In the project where a session was
+captured, export one closed, task-aligned session privately:
+
+```sh
+umask 077
+cairn trajectory show SESSION_ID --json > trajectory.json
+CAIRN_EVAL=1 cairn eval protocol --trajectory trajectory.json --json
+```
+
+The export can contain private prompts, paths and outputs despite capture
+redaction. Keep it local; do not commit or upload it. The audit emits fixed
+codes, counts, harness identity and SHA-256 digests—not the input path, session
+ID, prompts, arguments, outputs or memory keys. Input must be a UTF-8 regular
+file, at most 16 MiB and 50,000 events. Symlinks (including parent paths) and
+files changing during inspection are rejected. Use a canonical physical path
+if your filesystem path uses aliases.
+
+## Native Codex exec exports
+
+[Codex non-interactive mode](https://learn.chatgpt.com/docs/non-interactive-mode)
+documents `codex exec --json` as a structured JSONL event stream. Export a
+single task-aligned turn to a private file, then audit it explicitly:
+
+```sh
+umask 077
+# This command runs a live agent; review permissions and the task first.
+codex exec --json --ephemeral --sandbox workspace-write "YOUR TASK" > native.jsonl
+# This separate command only reads the file offline.
+CAIRN_EVAL=1 cairn eval protocol --codex-jsonl native.jsonl --json
+```
+
+Use exactly one of `--trajectory` or `--codex-jsonl`. The adapter is tested
+against the CLI/TypeScript SDK 0.160.1 exec event contract; it does not claim
+compatibility with arbitrary future streams, app-server events or internal
+rollout files. Persisted trajectory schemas and capture hooks are unchanged.
+The audit adds no SDK dependency and does not launch Codex.
+
+MCP items must identify the `cairn-memory` (or `cairn_memory`) server and the
+exact memory tool. Dispatch order comes from `item.started`; completions and
+updates must retain the same ID, server, tool and arguments. Parallel calls
+are correlated independently. A terminal-only MCP item cannot prove dispatch
+order. Native `structured_content` results or textual MCP content are accepted.
+
+Unknown records/fields, missing lifecycle events, failed turns and incomplete
+items make evidence inconclusive. Duplicate/mismatched IDs, malformed JSONL,
+multiple turns or events following a terminal turn are invalid input. Split
+multi-turn work into separately captured task-aligned turns; do not remove
+tool events to manufacture a passing audit. One terminal newline is allowed;
+blank records are rejected. The same 16 MiB byte limit applies, with at most
+50,000 source records and 50,000 normalized events.
+
+Reasoning and narrated messages are not tool evidence; their text is not
+retained by the adapter. File changes, commands and web searches are opaque
+effects, not proof of approved indirect writes. Native exports contain no
+authenticated project identity, timestamps or consent. Never publish private
+exports; the report keeps the same payload-free observation boundary.
+
+The packaged `examples/eval/protocol-codex.jsonl` is a synthetic positive
+control, not a recorded model run. Rehearse without launching Codex:
+
+```sh
+CAIRN_EVAL=1 bin/cairn eval protocol \
+  --codex-jsonl examples/eval/protocol-codex.jsonl --json
+```
+
+## Read the checks separately
+
+- `evidence_complete`: ordered calls with results, without omitted unknown
+  records, truncation or incomplete calls. Duplicate IDs, out-of-order sequences
+  and orphan results are invalid input, not successful evidence.
+- `memory_first`: the first recorded tool invocation is a project-scoped
+  `memory_search`. Task boundaries are not inferred. Trivial tasks need not
+  follow this protocol; tool availability is also not inferred. Apply this
+  check only to nontrivial tasks where direct retrieval was available, not
+  indiscriminately to every session or legitimate unavailable-tool fallback.
+- `retrieval_result`: a project search has a correlated, non-error,
+  interpretable semantic or substring result. Narration never counts. Failed
+  or missing results are inconclusive, not model-quality failures.
+- `direct_write_boundary`: direct `memory_*` mutation attempts are classified
+  from the MCP annotation catalog. Denied attempts still count. Opaque tools,
+  including shell commands, make indirect effects unverifiable.
+
+If the user or an applicable reviewed workflow explicitly authorized capture,
+add `--capture-authorized`. This is an **operator assertion**, not authenticated
+consent and never permission to write. The asserted policy and its digest are
+included in the report. Do not add the flag merely to turn a failure green.
+
+Exit codes: `0` all checks pass, `1` an observed violation, `2` invalid/unsafe
+input or command, `3` inconclusive without an observed violation. The disabled
+path returns its existing disabled envelope with exit `0` before reading any
+input; that is not a passing audit. Inspect `enabled` and `status`, not just
+the process exit code.
+
+## What this cannot prove
+
+A local trajectory is editable. Digests identify bytes and asserted policy;
+they do not authenticate a harness, server, publisher, user or tool result.
+Known direct tool names are recognized exactly, not by a permissive suffix.
+CLI-mediated retrieval/mutations, generic MCP dispatchers, opaque tools and
+full playbook start/finish enforcement are not certified here.
+
+Protocol compliance does not establish relevance, source verification,
+correctness, productivity or baseline improvement. Use the independent task
+verifier in the [evaluation harness](operating.md#evaluation-harness-opt-in)
+and the maintained [agent contract](agents.md). A realistic coding session may
+show successful retrieval while its overall audit remains inconclusive because
+shell effects cannot be certified. Do not convert this into a quality score or
+advertise a perfect agent benchmark.
+
+The [bounded release-ledger lab](research/release-ledger-task.md) provides a
+concrete task and a separate 15-check artifact grader. Offline controls cross
+all four combinations of passing/failing protocol and correct/incorrect code.
+A live lab uses the actual managed `AGENTS.md`, isolated read-only memory MCP
+tools and a closed single-turn export. Retain its raw evidence privately;
+do not substitute the synthetic positive fixture for a live trace.

package/docs/agents.md

@@ -46,6 +46,13 @@ integrations. See [Harness compatibility](harness-compatibility.md) for the
 exact tested surface. Instruction presence is not evidence that an agent
 actually invoked a tool.
 
+For existing Claude Code, OpenCode, and Pi normalized trajectories or explicit
+single-turn Codex exec JSONL exports, the
+default-off [memory protocol audit](agent-memory-protocol.md) distinguishes
+genuine direct calls from narration. It reports ordering, result evidence and
+direct mutation attempts separately; it does not certify task quality or
+indirect shell effects.
+
 ## Memory scopes and authority
 
 Use `scope: project` for task-specific decisions and conventions. Broader

package/docs/context-packs.md

@@ -59,6 +59,16 @@ cairn pack update my-pack --apply --confirm CANDIDATE-DIGEST --project ./project
 requires the candidate digest, installs an immutable object, and atomically
 switches only the named project.
 
+Project enablement, disablement and skill approvals serialize through an
+exclusive directory lock before reading/replacing the pointer. Windows can
+temporarily report access errors while a previous directory deletion completes;
+2.22.1 retries this contention under the existing 200-attempt, 10 ms wait budget.
+Unsafe symlink/non-directory locks and unrelated access failures are rejected.
+No contender removes another writer's lock or grants approval on a failed write.
+If the bounded wait expires, let the active update finish, inspect `cairn doctor`
+for temporary remnants, and retry. A persistent lock is not proof of abandonment;
+never delete it blindly or change ACLs to silence the error.
+
 ## Retrieval and skill approval
 
 Set `CAIRN_CONTEXT_PACKS=1` and restart the memory server to register the

package/docs/learning/CURRICULUM-MAP.md

@@ -1,7 +1,7 @@
 # Curriculum Coverage Map
 
-**Baseline:** Cairnkeep 2.21.1
-**Last reviewed:** 2026-10-06
+**Baseline:** Cairnkeep 2.22.1
+**Last reviewed:** 2026-10-07
 
 This map prevents the course from drifting behind the product. It assigns each
 user-facing surface to a lesson and records whether the lesson is complete or
@@ -31,6 +31,7 @@ been rehearsed.
 | Typed memory nodes, filters, address spaces, and structured import | L14 | L14 | Brief; default off |
 | Managed eight-capability contract and payload-free callbacks | L15 | L15-L16 | Brief; default off |
 | Deterministic two-pass evaluation and one-capability ablation | L16 | L16 | Brief; default off |
+| Offline direct-memory protocol audit and narration negative controls | L16 | V16 supplement | Introduced in 2.22.0; default off; normalized Claude Code/OpenCode/Pi trajectories or explicit single-turn Codex exec JSONL; not task-quality evidence |
 | Shell completion | L02 | L02 | Ready; optional convenience |
 | Bounded meta-agent configuration loop | L17 | None | Design-only; not shipped |
 | Reviewed, evaluated, reversible skill-file improvement | L19 | L19 | Ready; explicit and default off |

package/docs/learning/FEATURE-GUIDE.md

@@ -1,6 +1,6 @@
 # Cairnkeep feature guide
 
-**Baseline:** Cairnkeep 2.21.1
+**Baseline:** Cairnkeep 2.22.1
 
 This is the step-back map for choosing and operating Cairnkeep features. The
 [course labs](https://github.com/cairnkeep/cairnkeep-course-labs) provide one
@@ -31,6 +31,11 @@ Version 2.21 adds the formal threat model, a read-only local security posture
 check, portable-path adversarial coverage, bounded HTTP requests, and repository
 supply-chain gates; see [L28](lessons/L28-security-assurance.md).
 
+Version 2.22 adds the default-off direct-memory protocol audit, including
+explicit native Codex exec exports. See the L16 memory-protocol supplement;
+protocol observations and independently verified task correctness remain
+separate evidence, not a claim of model improvement.
+
 ## The three-layer model
 
 1. **Memory server:** an MCP process that owns scoped durable storage. The
@@ -108,6 +113,7 @@ prerequisites for ordinary memory.
 | Typed nodes/import | `CAIRN_TYPED_MEMORY_NODES=1` | Restart MCP server; tool schema changes | Hard-filter search; dry-run, replay-safe import; `cairn doctor --repair` only for derived state | `course-05-evidence` |
 | Capability contract | `CAIRN_CAPABILITY_CONTRACT=1` | MCP changes require restart; operating changes apply next invocation | `cairn capabilities list|status|enable|disable|reset|logging`; digest identifies state only | `course-06-governance` |
 | Evaluation | `CAIRN_EVAL=1` for the coordinator process | No harness chosen by Cairnkeep | `validate` before `run`; inspect report, missingness and evidence scope; dry-run prune/delete | `course-07-evaluation` |
+| Memory protocol audit | `CAIRN_EVAL=1` for the audit process | No restart; existing normalized trajectory or single-turn Codex exec JSONL export | `eval protocol --trajectory PATH` or `--codex-jsonl PATH`; fixed-code observations, no writes/network; caller-asserted capture authorization; task quality and indirect effects not certified | L16 supplement |
 | Validated skill improvement | Reviewed recurring hindsight; proposal adapter; `CAIRN_EVAL=1` for evaluation | No server restart; explicit subprocesses only | `cairn skill list|show`; exact-digest apply; concurrent-edit-safe rollback | `course-09-skill` |
 | General meta-agent loop | Not shipped | Not applicable | Playbooks select bounded existing actions; no generic configuration loop, command language, or scheduler | `course-07-evaluation` |
 | Pack retrieval and skills | `CAIRN_CONTEXT_PACKS=1`; HTTP needs separate consent; skills need exact-digest approval | Restart MCP server | `cairn pack skills`; revoke approval or disable pack; no automatic execution | `course-10-trust-context` |

package/docs/learning/lessons/L00-why-cairnkeep.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 10 minutes
-**Tested with:** Cairnkeep 2.21.1
+**Tested with:** Cairnkeep 2.22.1
 
 ## Outcome
 

package/docs/learning/lessons/L01-safe-trial.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 15 minutes
-**Tested with:** Cairnkeep 2.21.1
+**Tested with:** Cairnkeep 2.22.1
 
 ## Outcome
 
@@ -26,7 +26,7 @@ ephemeral; the named course volume is persistent.
 1. Pull the public image:
 
    ```bash
-   podman pull ghcr.io/cairnkeep/cairnkeep:2.17.1
+   podman pull ghcr.io/cairnkeep/cairnkeep:2.22.1
    ```
 
 2. Start the stdio server with a read-only root filesystem and no Linux
@@ -38,7 +38,7 @@ ephemeral; the named course volume is persistent.
      --read-only --cap-drop=all --security-opt=no-new-privileges \
      --tmpfs=/tmp:rw,noexec,nosuid,size=64m,mode=1777 \
      --volume cairnkeep-course-data:/data:Z,U \
-     ghcr.io/cairnkeep/cairnkeep:2.17.1 stdio
+     ghcr.io/cairnkeep/cairnkeep:2.22.1 stdio
    ```
 
 3. The process waits quietly for MCP input. Press `Ctrl-C` after confirming it

package/docs/learning/lessons/L02-installation.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.21.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.1 and Node.js 22 or newer
 
 ## Outcome
 
@@ -47,7 +47,7 @@ sync. Codex project trust remains an explicit operator decision.
 2. Install Cairnkeep:
 
    ```bash
-   npm install --global @cairnkeep/cli@2.17.1
+   npm install --global @cairnkeep/cli@2.22.1
    cairn --version
    ```
 

package/docs/learning/lessons/L03-first-project.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.21.1
+**Tested with:** Cairnkeep 2.22.1
 
 ## Outcome
 

package/docs/learning/lessons/L16-evaluation.md

@@ -19,6 +19,8 @@ report, and explain what a one-capability ablation can and cannot establish.
 - Eligible pairs, missingness, compatible turn semantics, reported token/cost
   fields, bootstrap intervals, and bounded reports.
 - `offline-framework` evidence versus separately validated live evidence.
+- Genuine memory calls versus narrated pseudo-calls; protocol ordering,
+  interpretable results, consent assertions and inconclusive indirect effects.
 - Dry validation, invocation estimates, explicit `--yes`, cancellation, report
   retention, dry-run pruning, and deletion.
 
@@ -51,6 +53,27 @@ after the lab is rehearsed from the packaged CLI rather than a source clone.
 - The learner reports estimates, intervals, missingness, and evidence scope
   without claiming causality, significance, or product improvement.
 - Course cleanup is limited to its temporary contained experiment root.
+- The protocol positive control passes and narration fails; neither is
+  described as live model improvement or task correctness.
+
+## Supplement: memory protocol evidence
+
+This supplement requires Cairnkeep 2.22.0 or newer for `eval protocol` and
+`--codex-jsonl`. Evaluation remains default off.
+
+Run the two synthetic commands in the
+[memory protocol guide](../../agent-memory-protocol.md). Pause on the negative
+control's exit `1`: saying a tool was used is not evidence of using it. Explain
+why an empty real search can pass retrieval, why incomplete capture or failed
+retrieval is inconclusive, and why shell calls prevent certification of
+indirect memory writes. Never publish a real trajectory export for this lab.
+
+Repeat with the packaged `protocol-codex.jsonl` synthetic control using
+`--codex-jsonl`, not `--trajectory`. Explain start/completion correlation,
+unknown-event gaps, single-turn boundaries and the distinction between a
+private live export and a public parser fixture. Internal rollout files and
+automatic Codex capture are not supported. Pair protocol observations with an
+independent artifact verifier; either dimension can fail separately.
 
 ## Source material
 

package/docs/learning/lessons/L19-validated-skill-improvement.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Evidence and Evaluation
 **Time:** 50 minutes
-**Tested with:** Cairnkeep 2.21.1
+**Tested with:** Cairnkeep 2.22.1
 
 ## Outcome
 

package/docs/learning/lessons/L20-mcp-tool-profiles.md

@@ -1,7 +1,7 @@
 # L20 - Least-authority MCP tool profiles
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.21.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.1 and Node.js 22 or newer
 **Time:** 25 minutes
 
 ## Outcome

package/docs/learning/lessons/L21-context-packs.md

@@ -1,7 +1,7 @@
 # L21 - Immutable context packs and skill approval
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.21.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.1 and Node.js 22 or newer
 **Time:** 40 minutes
 
 ## Outcome
@@ -54,6 +54,10 @@ copies them into a harness.
   an enabled digest all fail closed.
 - Enabling the pack does not expose a skill until its current file digest is
   approved.
+- A concurrent project update can exhaust the bounded pointer-lock wait. Let
+  the writer finish, inspect `cairn doctor`, then retry; do not delete another
+  writer's lock or weaken permissions. Windows contention recovery is included
+  in 2.22.1, with symlink/non-directory locks still rejected.
 
 ## Privacy and trust boundary
 

package/docs/learning/lessons/L22-native-windows.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Operator
 **Time:** 30 minutes
-**Tested with:** Cairnkeep 2.21.1, Windows x64, and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.1, Windows x64, and Node.js 22 or newer
 
 ## Outcome
 
@@ -16,7 +16,7 @@ perform a reversible uninstall without relying on WSL or Git Bash.
 From PowerShell:
 
 ```powershell
-npm install --global @cairnkeep/cli@2.17.1
+npm install --global @cairnkeep/cli@2.22.1
 cairn version
 
 $Lab = Join-Path $env:TEMP 'Cairnkeep Windows Lab'
@@ -62,6 +62,7 @@ the removed managed assets.
 | Hook registration reports drift | Managed `.cmd` hook or settings entry is absent | Run `cairn sync --apply`, then repeat `cairn sync --check` |
 | Memory export fails | `sqlite3.exe` is absent | Install SQLite and confirm `Get-Command sqlite3.exe`; runtime and import remain available |
 | A private-state check fails | The file inherited a broader ACL | Preserve the file, inspect it with `Get-Acl`, and recreate it through the owning Cairnkeep command |
+| A context-pack project update is locked | Another writer is active or a directory remains delete-pending | Allow the writer to finish, inspect `cairn doctor`, then retry; never blindly delete a lock or weaken ACLs |
 
 ## Privacy and trust boundary
 

package/docs/learning/lessons/L23-guided-setup.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart and Operator
 **Time:** 35 minutes
-**Tested with:** Cairnkeep 2.21.1; Pi 0.84.1; Node.js 22, 24, and 26
+**Tested with:** Cairnkeep 2.22.1; Pi 0.84.1; Node.js 22, 24, and 26
 
 ## Outcome
 

package/docs/learning/lessons/L24-okf-exchange.md

@@ -1,7 +1,7 @@
 # L24 - Reviewed knowledge exchange
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.21.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.1 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L25-playbooks.md

@@ -1,7 +1,7 @@
 # L25 - Bounded workflow playbooks
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.21.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.1 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L26-context-intelligence.md

@@ -1,7 +1,7 @@
 # L26 - Context intelligence with explicit authority
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.21.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.1 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L27-ecosystem-evidence.md

@@ -1,6 +1,6 @@
 # L27 - Evaluate context companions without moving authority
 
-**Tested with:** Cairnkeep 2.21.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.1 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L28-security-assurance.md

@@ -1,7 +1,7 @@
 # L28 - Verify Cairnkeep's security posture
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.21.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.1 and Node.js 22 or newer
 
 ## Outcome
 
@@ -11,7 +11,7 @@ and choose least authority for a network-facing MCP client.
 
 ## Prerequisites
 
-- Install Cairnkeep 2.21.1 or use a disposable source checkout.
+- Install Cairnkeep 2.22.1 or use a disposable source checkout.
 - Complete [L20 - Least-authority MCP tool profiles](L20-mcp-tool-profiles.md).
 - Use synthetic values only; never paste a real bearer token into a recording,
   terminal transcript, or issue.
@@ -69,8 +69,18 @@ npm --prefix mcp-memory-server run check:security-assurance
 npm --prefix mcp-memory-server run check:http-guard
 ```
 
-The baseline rejects unpinned external Actions and `pull_request_target`. The
-smoke tests cover token non-disclosure, request bounds, and deterministic
+The baseline rejects unpinned external Actions, `pull_request_target` and
+workflow-wide write permissions. It also checks the exact preparation/npm/OCI
+job permission maps, including missing provenance grants and unnecessary write
+authority. Inspect `.github/workflows/publish.yml` and compare its maps with
+[Releasing](../../releasing.md): preparation must not inherit publishing or
+signing authority. Unspecified entries in an explicit job map are denied.
+
+These are static contract checks, not a live publication test. The npm secret
+is a separate credential, and steps within one job share its token authority.
+Do not republish an immutable version to demonstrate the test.
+
+The smoke tests cover token non-disclosure, request bounds, and deterministic
 portable-path adversarial cases.
 
 ## Common failures

package/docs/learning/tracks/evidence-and-evaluation.md

@@ -20,5 +20,9 @@ reports without making unsupported claims, apply or roll back an exact eligible
 skill proposal, and distinguish that narrow runtime from the design-only
 general meta-agent contract.
 
+L16 also covers the offline memory protocol controls: distinguish direct tool
+events from narration and explain why protocol observations, caller-asserted
+consent and task-quality evidence are separate claims.
+
 Hands-on spine: `course-05-evidence` through `course-07-evaluation` in the
 public [course labs](https://github.com/cairnkeep/cairnkeep-course-labs).

package/docs/learning/video-scripts/V16-memory-protocol-audit.md

@@ -0,0 +1,32 @@
+# V16 supplement — Show the tool call, not the claim
+
+Target length: 4–6 minutes. Experienced-developer audience. Record with
+Cairnkeep 2.22.0 or newer and opt in to `cairn eval protocol` explicitly.
+Use only committed synthetic controls, never private transcripts.
+
+1. Split the terminal: show `protocol-narration.json` beside its audit. Type the
+   command from the memory protocol guide at human speed. Pause two seconds
+   on `project_search_absent` and exit `1`: narration is not execution.
+2. Switch to `protocol-project-search.json`. Highlight the correlated IDs and
+   project scope. Run the audit and pause on the separate checks. Zero hits is
+   acceptable; it is not a reason to keep widening the query.
+3. Show the four exit states. Default-off exit `0` is not a successful audit.
+   Incomplete capture, failed retrieval and opaque shell commands yield
+   inconclusive observations, not a fabricated perfect score.
+4. Zoom into digests and counts, then back to the input: the report omits
+   private content. A digest authenticates neither a publisher nor human
+   approval. `--capture-authorized` is an assertion, not a bypass button.
+5. Switch to `protocol-codex.jsonl`, then run `--codex-jsonl`. Visually pair
+   `item.started` and `item.completed`; updates are not extra calls. Explain
+   single-turn boundaries and unknown events. Keep private exports off screen.
+6. End on the independent verifier, not a green audit. This parser lab does not
+   prove a better model, correct code, full playbook compliance or superiority
+   over a baseline.
+
+Vary framing between input, IDs and report codes. Leave breathing room after
+failures and caveats; do not accelerate terminal footage to match speech.
+
+For a coding demonstration, show task correctness beside the individual
+protocol checks. Successful retrieval followed by coding commands may produce
+an inconclusive overall audit because shell effects are opaque. Do not edit
+that into a pass or claim an A/B improvement from one run.

package/docs/learning/video-scripts/V28-security-assurance.md

@@ -56,6 +56,19 @@ Highlight full-SHA action pins, CodeQL, dependency review, token non-leakage,
 portable Windows/POSIX path cases, and the HTTP 413 test. Do not show repository
 secrets or live security-alert details.
 
+Include the offline pointer-lock control in a source checkout:
+`node mcp-memory-server/scripts/smoke-context-pack-lock.mjs`. It reproduces
+Windows contention/denial and unsafe-lock cases deterministically, then checks
+real cross-process exclusion. Explain bounded retry versus lock stealing; a
+Linux run with injected Windows errors is not native-Windows evidence.
+
+Briefly open `.github/workflows/publish.yml` beside the permission table in
+`docs/releasing.md`. Contrast the read-only preparation job with the necessary
+npm and OCI publication grants. Explain that explicit maps deny unspecified
+permissions, but steps in a job still share authority and the npm secret is
+separate. The baseline checks declared grants; do not present it as a successful
+live publish or rerun a release merely for this recording.
+
 ### 9:20–10:30 — Read the residual risks
 
 End on `docs/security-assurance.md`, not on a green checkmark. Call out the

package/docs/operating.md

@@ -1080,6 +1080,14 @@ machine-level drift; setup itself never performs the sync.
 
 ### Evaluation harness (opt-in)
 
+To inspect actual direct memory tool use in an existing normalized trajectory,
+use `CAIRN_EVAL=1 cairn eval protocol --trajectory PATH --json`. Native
+single-turn Codex exec JSONL exports use `--codex-jsonl PATH` instead. This read-only,
+offline audit returns separate pass/fail/inconclusive checks, emits no recorded
+content, and does not measure task quality. See the
+[memory protocol guide](agent-memory-protocol.md) for controls, export privacy,
+supported harnesses, consent assertions and exit codes.
+
 `cairn eval` is a local, serial experiment coordinator. It is disabled unless
 `CAIRN_EVAL` is explicitly truthy. The disabled path returns before reading a
 task set or adapter configuration, creating a workspace or report, opening a

package/docs/privacy-and-data-flow.md

@@ -172,6 +172,15 @@ file, so the diagnostic and runtime use the same precedence.
 
 ## Evaluation adapter and report flow
 
+`cairn eval protocol` is a separate read-only audit of an explicitly supplied
+normalized trajectory or single-turn Codex exec JSONL export. With evaluation disabled it does not read that
+file. When enabled it performs bounded local reads only: no adapter, command
+execution, network, database, or persistent report. Output is limited to fixed
+codes, counts, harness identity, input/policy digests and limitations. Exports
+can contain private content even after redaction; keep them local. See the
+[memory protocol guide](agent-memory-protocol.md). A capture-authorization flag
+is the caller's assertion, not authenticated consent.
+
 `CAIRN_EVAL` is unset/off by default. With it off, `cairn eval` returns a fixed
 disabled result before task-set or adapter reads, workspace/report creation,
 database access, subprocess execution, or network activity. A credential in