@cairnkeep/cli 2.21.1 → 2.22.1

package/mcp-memory-server/dist/eval-protocol.js

@@ -0,0 +1,200 @@
+import { createHash } from "node:crypto";
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync } from "node:fs";
+import { resolve } from "node:path";
+import { canonicalJson } from "./eval-schema.js";
+import { MCP_TOOL_CATALOG } from "./mcp-tool-catalog.js";
+import { trajectorySessionSchema } from "./trajectory-schema.js";
+import { normalizeCodexExec } from "./eval-codex.js";
+const MAX_BYTES = 16 * 1024 * 1024;
+const MAX_EVENTS = 50_000;
+const memoryEntries = Object.entries(MCP_TOOL_CATALOG).filter(([name]) => name.startsWith("memory_"));
+const MUTATIONS = new Set(memoryEntries.filter(([, metadata]) => !metadata.annotations.readOnlyHint).map(([name]) => name));
+const OBSERVATIONS = new Set(memoryEntries.filter(([, metadata]) => metadata.annotations.readOnlyHint).map(([name]) => name));
+function digest(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+function object(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value : undefined;
+}
+/** Only the maintained direct-tool names are recognized; suffix matching is unsafe. */
+function memoryTool(name, harness) {
+    if (typeof name !== "string")
+        return undefined;
+    const prefixes = harness === "claude-code" || harness === "codex" ? ["mcp__cairn-memory__", "mcp__cairn_memory__"]
+        : harness === "opencode" ? ["cairn-memory_", "cairn_memory_"] : [""];
+    for (const prefix of prefixes) {
+        if (!name.startsWith(prefix))
+            continue;
+        const tool = name.slice(prefix.length);
+        if (MUTATIONS.has(tool) || OBSERVATIONS.has(tool))
+            return tool;
+    }
+    return undefined;
+}
+/** Inspect an explicitly supplied export without following links or executing content. */
+function readProtocolBytes(path) {
+    let descriptor;
+    try {
+        const absolute = resolve(path);
+        // Validate the opened descriptor, not a pathname checked before open.
+        // Nonblocking/no-ctty flags prevent special-file admission from waiting
+        // or acquiring a controlling terminal before the regular-file check.
+        descriptor = openSync(absolute, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0)
+            | (constants.O_NOCTTY ?? 0) | (process.platform === "win32" ? 0 : constants.O_NONBLOCK ?? 0));
+        const before = fstatSync(descriptor);
+        if (!before.isFile() || before.size > MAX_BYTES || realpathSync(absolute) !== absolute)
+            throw new Error();
+        const buffer = Buffer.alloc(before.size + 1);
+        let length = 0;
+        while (length < buffer.length) {
+            const count = readSync(descriptor, buffer, length, buffer.length - length, null);
+            if (!count)
+                break;
+            length += count;
+        }
+        const after = fstatSync(descriptor);
+        const finalPath = realpathSync(absolute);
+        const finalNamed = lstatSync(absolute);
+        if (length !== before.size || before.size !== after.size || before.mtimeMs !== after.mtimeMs
+            || before.ctimeMs !== after.ctimeMs || finalNamed.isSymbolicLink()
+            || finalNamed.dev !== before.dev || finalNamed.ino !== before.ino
+            || finalNamed.size !== before.size || finalNamed.mtimeMs !== before.mtimeMs
+            || finalNamed.ctimeMs !== before.ctimeMs
+            || finalPath !== absolute)
+            throw new Error();
+        const bytes = buffer.subarray(0, length);
+        return bytes;
+    }
+    catch {
+        // Do not expose filesystem errors, parser excerpts, schema paths or input data.
+        throw new Error("protocol_input_invalid_or_unsafe");
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+    }
+}
+export function readProtocolTrajectory(path) {
+    try {
+        const bytes = readProtocolBytes(path);
+        const raw = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+        if (!Array.isArray(raw?.events) || raw.events.length > MAX_EVENTS)
+            throw new Error();
+        const parsed = trajectorySessionSchema.safeParse(raw);
+        if (!parsed.success)
+            throw new Error();
+        return { session: parsed.data, digest: digest(bytes) };
+    }
+    catch {
+        throw new Error("protocol_input_invalid_or_unsafe");
+    }
+}
+export function readCodexProtocol(path) {
+    try {
+        const bytes = readProtocolBytes(path);
+        const session = normalizeCodexExec(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+        return { session, digest: digest(bytes) };
+    }
+    catch {
+        throw new Error("protocol_input_invalid_or_unsafe");
+    }
+}
+function searchPayload(value, depth = 0) {
+    if (depth > 8)
+        return undefined;
+    if (typeof value === "string") {
+        try {
+            return searchPayload(JSON.parse(value), depth + 1);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    // Claude tool-result content and MCP result envelopes are both supported.
+    if (Array.isArray(value)) {
+        if (value.length !== 1)
+            return undefined;
+        const part = object(value[0]);
+        return part?.type === "text" && typeof part.text === "string" ? searchPayload(part.text, depth + 1) : undefined;
+    }
+    const record = object(value);
+    if (!record || record.isError === true || record.ok === false)
+        return undefined;
+    if (record.structuredContent !== undefined)
+        return searchPayload(record.structuredContent, depth + 1);
+    if (record.content !== undefined)
+        return searchPayload(record.content, depth + 1);
+    return record;
+}
+function successfulSearch(result) {
+    if (!result || result.payload.is_error !== false || result.truncation)
+        return false;
+    const payload = searchPayload(result.payload.output);
+    return !!payload && typeof payload.mode === "string" && ["semantic", "substring"].includes(payload.mode)
+        && Number.isSafeInteger(payload.count) && payload.count >= 0
+        && Array.isArray(payload.results) && payload.results.length === payload.count;
+}
+/** This is an observation of local evidence, not authentication or task verification. */
+export function auditMemoryProtocol(session, trajectoryDigest, captureAuthorized = false) {
+    const calls = [];
+    const byId = new Map();
+    let gap = session.capture.truncated || session.capture.omitted_unknown_records > 0
+        || (session.capture.omitted_size_events ?? 0) > 0;
+    for (const [index, event] of session.events.entries()) {
+        if (event.sequence !== index)
+            throw new Error("protocol_invalid_events");
+        if (event.truncation)
+            gap = true;
+        if (event.kind !== "tool_invocation" && event.kind !== "tool_result")
+            continue;
+        const id = event.payload.call_id;
+        if (typeof id !== "string" || !id || id.length > 1024)
+            throw new Error("protocol_invalid_events");
+        if (event.kind === "tool_invocation") {
+            if (byId.has(id) || typeof event.payload.tool_name !== "string")
+                throw new Error("protocol_invalid_events");
+            const call = { event, tool: memoryTool(event.payload.tool_name, session.harness) };
+            calls.push(call);
+            byId.set(id, call);
+        }
+        else {
+            const call = byId.get(id);
+            if (!call || call.result)
+                throw new Error("protocol_invalid_events");
+            call.result = event;
+        }
+    }
+    if (calls.some(call => !call.result))
+        gap = true;
+    const projectSearches = calls.filter(call => call.tool === "memory_search"
+        && object(call.event.payload.input)?.scope === "project" && !call.event.truncation);
+    const first = calls[0];
+    const writes = calls.filter(call => call.tool && MUTATIONS.has(call.tool));
+    const opaque = calls.filter(call => !call.tool);
+    const checks = [
+        { id: "evidence_complete", status: gap ? "inconclusive" : "pass", code: gap ? "capture_incomplete" : "capture_complete" },
+        { id: "memory_first", status: gap ? "inconclusive" : first && projectSearches[0] === first ? "pass" : "fail",
+            code: gap ? "ordering_unverifiable" : first && projectSearches[0] === first ? "project_search_first" : "project_search_not_first" },
+        { id: "retrieval_result", status: projectSearches.some(call => successfulSearch(call.result)) ? "pass" : projectSearches.length || gap ? "inconclusive" : "fail",
+            code: projectSearches.some(call => successfulSearch(call.result)) ? "project_search_completed"
+                : projectSearches.length || gap ? "search_result_unverifiable" : "project_search_absent" },
+        { id: "direct_write_boundary", status: writes.length && !captureAuthorized ? "fail" : gap || opaque.length ? "inconclusive" : "pass",
+            code: writes.length && !captureAuthorized ? "unapproved_write_attempt"
+                : gap || opaque.length ? "indirect_writes_unverifiable" : writes.length ? "caller_asserted_capture_authorization" : "no_direct_write_attempt" },
+    ];
+    const policy = { schema_version: 1, protocol: "project-memory-first-v1", capture_authorized: captureAuthorized,
+        scope: "direct-memory-tools", direct_mutation_tools: [...MUTATIONS].sort(), direct_observation_tools: [...OBSERVATIONS].sort() };
+    const status = checks.some(check => check.status === "fail") ? "fail"
+        : checks.some(check => check.status === "inconclusive") ? "inconclusive" : "pass";
+    return {
+        schema_version: 1, enabled: true, operation: "protocol", evidence_scope: "local-trajectory-observation",
+        harness: session.harness, trajectory_digest: trajectoryDigest, policy_digest: digest(canonicalJson(policy)),
+        policy, status, checks,
+        counts: { tool_invocations: calls.length, project_searches: projectSearches.length,
+            successful_project_searches: projectSearches.filter(call => successfulSearch(call.result)).length,
+            direct_write_attempts: writes.length, opaque_tool_invocations: opaque.length },
+        limitations: ["input_not_authenticated", "task_quality_not_measured", "authorization_is_caller_assertion",
+            "indirect_tool_effects_not_certified", "task_boundaries_not_inferred", "tool_availability_not_inferred"],
+    };
+}

package/mcp-memory-server/package.json

@@ -45,11 +45,13 @@
         "check:eval-schema": "node scripts/smoke-eval-schema.mjs",
         "check:eval-process": "node scripts/smoke-eval-process.mjs",
         "check:eval-statistics": "node scripts/smoke-eval-statistics.mjs",
+        "check:eval-protocol": "node scripts/smoke-eval-protocol.mjs",
+        "check:codex-protocol": "node scripts/smoke-codex-protocol.mjs",
         "check:skill-lifecycle": "node scripts/smoke-skill-lifecycle.mjs",
         "check:graph-cli": "node scripts/smoke-graph-cli.mjs",
         "check:mcp-trust": "node scripts/smoke-mcp-trust.mjs",
         "check:pi-mcp-bridge": "node scripts/smoke-pi-mcp-bridge.mjs",
-        "check:context-pack": "node scripts/smoke-context-pack.mjs",
+        "check:context-pack": "node scripts/smoke-context-pack-lock.mjs && node scripts/smoke-context-pack.mjs",
         "check:context-pack-retrieval": "node scripts/smoke-context-pack-retrieval.mjs",
         "check:context-pack-v216-compat": "node scripts/smoke-context-pack-v216-compat.mjs",
         "check:context-usage": "node scripts/smoke-context-usage.mjs",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cairnkeep/cli",
-    "version": "2.21.1",
+    "version": "2.22.1",
     "description": "A durable, harness-agnostic memory + context layer for coding agents and MCP clients.",
     "license": "Apache-2.0",
     "type": "module",

package/scripts/cairn-cli.mjs

@@ -55,7 +55,7 @@ Usage:
   cairn mcp-tools <list|status|set|reset>
   cairn pack <init|lock|validate|install|list|show|remove|enable|disable|update|skills|approve-skill|revoke-skill>
   cairn notes <distill|search-error|promote|doctor>
-  cairn eval <validate|run|ablate|report|prune|delete>
+  cairn eval <validate|run|ablate|report|prune|delete|protocol>
   cairn skill <harvest|list|show|review|propose|evaluate|apply|rollback>
   cairn graph <build|query|status|diff|explain|path>
   cairn evidence <list|show|delete|prune|doctor>

package/scripts/completion.sh

@@ -70,7 +70,8 @@ _cairn_complete() {
         report) COMPREPLY=( $(compgen -W "--experiment --json" -- "$current") ) ;;
         prune) COMPREPLY=( $(compgen -W "--older-than-days --dry-run --json" -- "$current") ) ;;
         delete) COMPREPLY=( $(compgen -W "--experiment --dry-run --json" -- "$current") ) ;;
-        *) COMPREPLY=( $(compgen -W "validate run ablate report prune delete" -- "$current") ) ;;
+        protocol) COMPREPLY=( $(compgen -W "--trajectory --codex-jsonl --capture-authorized --json" -- "$current") ) ;;
+        *) COMPREPLY=( $(compgen -W "validate run ablate report prune delete protocol" -- "$current") ) ;;
       esac
       ;;
     skill) COMPREPLY=( $(compgen -W "harvest list show review propose evaluate apply rollback --project --minimum-occurrences --kind --id --candidate --approve --target --adapter --edit-budget --proposal --exploration-task-set --confirmation-task-set --output --repetitions --seed --minimum-improvement --evaluation --application --confirm --yes --json" -- "$current") ) ;;
@@ -164,7 +165,8 @@ _cairn() {
         report) _arguments '--experiment[experiment ID]:experiment ID:' '--json[emit JSON]' ;;
         prune) _arguments '--older-than-days[retention age]:days:' '--dry-run[report without pruning]' '--json[emit JSON]' ;;
         delete) _arguments '--experiment[experiment ID]:experiment ID:' '--dry-run[report without deleting]' '--json[emit JSON]' ;;
-        *) _values 'eval command' validate run ablate report prune delete ;;
+        protocol) _arguments '--trajectory[normalized trajectory export]:file:_files' '--codex-jsonl[single-turn Codex exec JSONL export]:file:_files' '--capture-authorized[assert operator authorization for capture]' '--json[emit JSON]' ;;
+        *) _values 'eval command' validate run ablate report prune delete protocol ;;
       esac
       ;;
     skill)
@@ -272,7 +274,10 @@ complete -c cairn -n "__fish_seen_subcommand_from proposals" -l category -r
 complete -c cairn -n "__fish_seen_subcommand_from proposals" -l project -r
 complete -c cairn -n "__fish_seen_subcommand_from proposals" -l json
 complete -c cairn -n "__fish_seen_subcommand_from notes" -a "distill search-error promote doctor"
-complete -c cairn -n "__fish_seen_subcommand_from eval; and not __fish_seen_subcommand_from validate run ablate report prune delete" -a "validate run ablate report prune delete"
+complete -c cairn -n "__fish_seen_subcommand_from eval; and not __fish_seen_subcommand_from validate run ablate report prune delete protocol" -a "validate run ablate report prune delete protocol"
+complete -c cairn -n "__fish_seen_subcommand_from eval; and __fish_seen_subcommand_from protocol" -l trajectory -r
+complete -c cairn -n "__fish_seen_subcommand_from eval; and __fish_seen_subcommand_from protocol" -l codex-jsonl -r
+complete -c cairn -n "__fish_seen_subcommand_from eval; and __fish_seen_subcommand_from protocol" -l capture-authorized
 complete -c cairn -n "__fish_seen_subcommand_from eval; and __fish_seen_subcommand_from validate run ablate" -l task-set -r
 complete -c cairn -n "__fish_seen_subcommand_from eval; and __fish_seen_subcommand_from validate run ablate" -l adapter -r
 complete -c cairn -n "__fish_seen_subcommand_from eval; and __fish_seen_subcommand_from validate run ablate" -l output -r
@@ -283,7 +288,7 @@ complete -c cairn -n "__fish_seen_subcommand_from eval; and __fish_seen_subcomma
 complete -c cairn -n "__fish_seen_subcommand_from eval; and __fish_seen_subcommand_from report delete" -l experiment -r
 complete -c cairn -n "__fish_seen_subcommand_from eval; and __fish_seen_subcommand_from prune" -l older-than-days -r
 complete -c cairn -n "__fish_seen_subcommand_from eval; and __fish_seen_subcommand_from prune delete" -l dry-run
-complete -c cairn -n "__fish_seen_subcommand_from eval; and __fish_seen_subcommand_from validate run ablate report prune delete" -l json
+complete -c cairn -n "__fish_seen_subcommand_from eval; and __fish_seen_subcommand_from validate run ablate report prune delete protocol" -l json
 complete -c cairn -n "__fish_seen_subcommand_from skill; and not __fish_seen_subcommand_from harvest list show review propose evaluate apply rollback" -a "harvest list show review propose evaluate apply rollback"
 complete -c cairn -n "__fish_seen_subcommand_from skill; and __fish_seen_subcommand_from harvest list show review propose evaluate apply rollback" -l project -r
 complete -c cairn -n "__fish_seen_subcommand_from skill; and __fish_seen_subcommand_from harvest list show review propose evaluate apply rollback" -l json

package/scripts/spikes/verify-release-ledger.mjs

@@ -0,0 +1,46 @@
+import { createHash } from "node:crypto";
+import assert from "node:assert/strict";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+// Independent artifact grader for the bounded release-ledger task. Importing
+// an explicitly selected module executes it: run only in an isolated lab.
+export async function verifyReleaseLedger(path) {
+  const checks = [];
+  const check = async (id, fn) => {
+    try { await fn(); checks.push({ id, pass: true }); }
+    catch { checks.push({ id, pass: false }); }
+  };
+  let mod, ledger, first, final;
+  const input = { package: "sample", version: "1.0.0", notes: ["First", "Second"] };
+  const errorCode = (fn, code) => assert.throws(fn, error => error?.code === code);
+  await check("export", async () => {
+    mod = await import(pathToFileURL(resolve(path)).href);
+    assert.equal(typeof mod.createLedger, "function");
+    ledger = mod.createLedger();
+  });
+  await check("methods", () => { for (const method of ["append", "get", "list", "finalize"]) assert.equal(typeof ledger[method], "function"); });
+  await check("append", () => { first = ledger.append(input); assert.equal(first.state, "draft"); assert.equal(first.sequence, 1); assert.deepEqual(first.notes, input.notes); });
+  await check("shape", () => assert.deepEqual(Object.keys(first).sort(), ["package", "version", "notes", "sequence", "state"].sort()));
+  await check("invalid-package", () => errorCode(() => ledger.append({ ...input, package: "Bad_Name" }), "INVALID_PACKAGE"));
+  await check("invalid-version", () => errorCode(() => ledger.append({ ...input, version: "v1.0" }), "INVALID_VERSION"));
+  await check("invalid-notes", () => errorCode(() => ledger.append({ ...input, notes: [] }), "INVALID_NOTES"));
+  await check("duplicate", () => errorCode(() => ledger.append(input), "DUPLICATE_RELEASE"));
+  await check("sequence", () => assert.equal(ledger.append({ ...input, package: "other" }).sequence, 2));
+  await check("not-found", () => errorCode(() => ledger.get("missing", "1.0.0"), "NOT_FOUND"));
+  await check("finalize", () => { final = ledger.finalize("sample", "1.0.0"); assert.equal(final.state, "final"); });
+  await check("checksum", () => assert.equal(final.checksum, createHash("sha256").update(JSON.stringify({ ...input, sequence: 1 })).digest("hex")));
+  await check("idempotent", () => assert.deepEqual(ledger.finalize("sample", "1.0.0"), final));
+  await check("detached-get", () => { const copy = ledger.get("sample", "1.0.0"); copy.notes.push("tamper"); copy.state = "draft"; const fresh = ledger.get("sample", "1.0.0"); assert.deepEqual(fresh.notes, ["First", "Second"]); assert.equal(fresh.state, "final"); });
+  await check("ordered-detached-list", () => { const copies = ledger.list(); assert.deepEqual(copies.map(entry => entry.sequence), [1, 2]); copies[0].notes[0] = "tamper"; assert.equal(ledger.list()[0].notes[0], "First"); });
+  return { checks, passed: checks.filter(check => check.pass).length, total: checks.length };
+}
+
+if (process.argv[1] && pathToFileURL(resolve(process.argv[1])).href === import.meta.url) {
+  if (process.argv.length !== 3) { process.stderr.write("Usage: verify-release-ledger.mjs MODULE_PATH\n"); process.exitCode = 2; }
+  else {
+    const value = await verifyReleaseLedger(process.argv[2]);
+    process.stdout.write(`${JSON.stringify(value)}\n`);
+    process.exitCode = value.passed === value.total ? 0 : 1;
+  }
+}

package/scripts/test-completion.sh

@@ -12,8 +12,8 @@ for shell in bash zsh fish; do
 done
 
 capability_ids='memory.write memory.search notes.distill wiki graph security.audit route.check context.explore'
-eval_commands='validate run ablate report prune delete'
-eval_flags='--task-set --adapter --output --repetitions --seed --json --yes --disable --experiment --older-than-days --dry-run'
+eval_commands='validate run ablate report prune delete protocol'
+eval_flags='--task-set --adapter --output --repetitions --seed --json --yes --disable --experiment --older-than-days --dry-run --trajectory --codex-jsonl --capture-authorized'
 skill_commands='harvest list show review propose evaluate apply rollback'
 for shell in bash zsh fish; do
   grep -q 'capabilities' "$tmp/$shell"
@@ -70,7 +70,7 @@ for shell in bash zsh fish; do
 done
 
 "$ROOT/bin/cairn" help >"$tmp/root-help"
-grep -qF 'cairn eval <validate|run|ablate|report|prune|delete>' "$tmp/root-help"
+grep -qF 'cairn eval <validate|run|ablate|report|prune|delete|protocol>' "$tmp/root-help"
 node "$ROOT/mcp-memory-server/dist/eval-cli.js" --help >"$tmp/eval-help"
 for command in $eval_commands; do
   grep -q "cairn eval $command" "$tmp/eval-help"
@@ -152,6 +152,10 @@ for shell in bash zsh fish; do
   fi
 done
 "$ROOT/bin/cairn" completion powershell >"$tmp/powershell"
+grep -qF "'protocol'" "$tmp/powershell"
+grep -qF "'--trajectory'" "$tmp/powershell"
+grep -qF "'--codex-jsonl'" "$tmp/powershell"
+grep -qF "'--capture-authorized'" "$tmp/powershell"
 if ! grep -qE "['\"]setup['\"]" "$tmp/powershell"; then
   completion_surface_complete=false
 fi

package/scripts/test-ecosystem-spikes.sh

@@ -6,6 +6,7 @@ ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 for script in \
   run-memfork-evaluation.mjs \
   run-clm-pi-evaluation.mjs \
+  verify-release-ledger.mjs \
   run-ollaya-decision-evaluation.mjs
 do
   node --check "$ROOT/scripts/spikes/$script"

package/scripts/test-learning-docs.sh

@@ -74,6 +74,7 @@ done < <(bin/cairn help | sed -n 's/^  cairn \([a-z-]*\).*/\1/p' | sort -u)
 node <<'NODE'
 const { existsSync, readdirSync, readFileSync } = require("node:fs");
 const { dirname, resolve } = require("node:path");
+const packageVersion = JSON.parse(readFileSync("package.json", "utf8")).version;
 
 function markdownFiles(root) {
   return readdirSync(root, { withFileTypes: true }).flatMap((entry) => {
@@ -84,6 +85,13 @@ function markdownFiles(root) {
 
 for (const file of markdownFiles("docs/learning")) {
   const text = readFileSync(file, "utf8");
+  if (file.startsWith("docs/learning/lessons/")) {
+    for (const match of text.matchAll(/(?:@cairnkeep\/cli@|ghcr\.io\/cairnkeep\/cairnkeep(?:-workspace)?:)(\d+\.\d+\.\d+(?:-[\w.-]+)?)/g)) {
+      if (match[1] !== packageVersion) {
+        throw new Error(`stale installation command in ${file}: ${match[1]} instead of ${packageVersion}`);
+      }
+    }
+  }
   for (const match of text.matchAll(/\]\(([^)]+)\)/g)) {
     const target = match[1].split("#", 1)[0];
     if (!target || /^[a-z]+:/i.test(target)) continue;

package/scripts/test-package-install.sh

@@ -76,6 +76,21 @@ cmp -s "$tmp/source-eval-disabled.json" "$tmp/installed-eval-disabled.json" || \
   fail "source and installed disabled eval identity differ"
 [[ ! -e "$tmp/installed-unwritten-output" ]] || fail "installed disabled eval created output"
 
+CAIRN_EVAL=1 cairn eval protocol \
+  --trajectory "$installed_root/examples/eval/protocol-project-search.json" --json >"$tmp/protocol-pass.json"
+node -e 'const v=require(process.argv[1]);if(v.status!=="pass"||v.evidence_scope!=="local-trajectory-observation")process.exit(1)' "$tmp/protocol-pass.json" \
+  || fail "installed memory protocol positive control failed"
+set +e
+CAIRN_EVAL=1 cairn eval protocol \
+  --trajectory "$installed_root/examples/eval/protocol-narration.json" --json >"$tmp/protocol-fail.json"
+protocol_status=$?
+set -e
+[[ "$protocol_status" -eq 1 ]] || fail "installed memory protocol counted narration as evidence"
+CAIRN_EVAL=1 cairn eval protocol \
+  --codex-jsonl "$installed_root/examples/eval/protocol-codex.jsonl" --json >"$tmp/protocol-codex.json"
+node -e 'const v=require(process.argv[1]);if(v.status!=="pass"||v.harness!=="codex")process.exit(1)' "$tmp/protocol-codex.json" \
+  || fail "installed native Codex protocol control failed"
+
 for required in \
   schemas/capability-contract.schema.json \
   schemas/capability-callback.schema.json \
@@ -159,11 +174,16 @@ for required in \
   mcp-memory-server/dist/eval-report.js \
   mcp-memory-server/dist/eval-runner.js \
   mcp-memory-server/dist/eval-cli.js \
+  mcp-memory-server/dist/eval-protocol.js \
+  mcp-memory-server/dist/eval-codex.js \
   scripts/fake-eval-adapter.mjs \
   examples/eval/task-set.json \
   examples/eval/bundled-fake.json \
   examples/eval/adapter.json \
   examples/eval/ecosystem-decisions.json \
+  examples/eval/protocol-project-search.json \
+  examples/eval/protocol-narration.json \
+  examples/eval/protocol-codex.jsonl \
   examples/eval/README.md
 do
   [[ -f "$installed_root/$required" ]] || fail "npm tarball omitted $required"
@@ -183,13 +203,16 @@ for asset in \
   examples/eval/bundled-fake.json \
   examples/eval/adapter.json \
   examples/eval/ecosystem-decisions.json \
+  examples/eval/protocol-project-search.json \
+  examples/eval/protocol-narration.json \
+  examples/eval/protocol-codex.jsonl \
   examples/eval/README.md
 do
   [[ ! -x "$installed_root/$asset" ]] || \
     fail "installed public eval data asset is unexpectedly executable: $asset"
 done
 eval_assets=$(cd "$installed_root/examples/eval" && find . -type f -print | LC_ALL=C sort)
-[[ "$eval_assets" == $'./README.md\n./adapter.json\n./bundled-fake.json\n./ecosystem-decisions.json\n./task-set.json' ]] || \
+[[ "$eval_assets" == $'./README.md\n./adapter.json\n./bundled-fake.json\n./ecosystem-decisions.json\n./protocol-codex.jsonl\n./protocol-narration.json\n./protocol-project-search.json\n./task-set.json' ]] || \
   fail "installed eval examples contain an unexpected path"
 
 node - "$installed_root/examples/eval/adapter.json" <<'NODE'

package/scripts/verify-security-baseline.mjs

@@ -35,6 +35,10 @@ function walk(value, visit, path = "workflow") {
 
 function validateWorkflow(name, workflow) {
     assert.ok(workflow && typeof workflow === "object" && !Array.isArray(workflow), `${name} is not a workflow mapping`);
+    assert.ok(workflow.permissions && typeof workflow.permissions === "object" && !Array.isArray(workflow.permissions), `${name} must have an explicit workflow permission mapping`);
+    for (const [permission, level] of Object.entries(workflow.permissions)) {
+        assert.ok(["read", "none"].includes(level), `${name} has a non-read-only workflow permission: ${permission}`);
+    }
     const triggers = workflow.on;
     const triggerNames = typeof triggers === "string" ? [triggers] : Array.isArray(triggers) ? triggers : Object.keys(triggers ?? {});
     assert.ok(!triggerNames.includes("pull_request_target"), `${name} uses pull_request_target`);
@@ -51,24 +55,81 @@ function validateWorkflow(name, workflow) {
     });
 }
 
-for (const { name, workflow } of sources) validateWorkflow(name, workflow);
+const PUBLICATION_PERMISSIONS = {
+    prepare: { actions: "read", contents: "read" },
+    npm: { contents: "write", "id-token": "write" },
+    containers: {
+        contents: "read",
+        packages: "write",
+        attestations: "write",
+        "id-token": "write",
+        "artifact-metadata": "write",
+    },
+};
+
+function validatePublicationPermissions(workflow) {
+    validateWorkflow("publish.yml", workflow);
+    assert.deepEqual(workflow.permissions, { contents: "read" }, "publication workflow default must be contents-read only");
+    assert.deepEqual(Object.keys(workflow.jobs).sort(), Object.keys(PUBLICATION_PERMISSIONS).sort(), "publication jobs require explicit permission review");
+    for (const [job, permissions] of Object.entries(PUBLICATION_PERMISSIONS)) {
+        assert.deepEqual(workflow.jobs[job].permissions, permissions, `publication ${job} permissions must match its reviewed tasks`);
+    }
+}
+
+const publish = sources.find(({ name }) => name === "publish.yml")?.workflow;
+assert.ok(publish, "publication workflow is missing");
+const permissionControl = structuredClone(publish);
+permissionControl.permissions = { contents: "read" };
+for (const [job, permissions] of Object.entries(PUBLICATION_PERMISSIONS)) {
+    permissionControl.jobs[job].permissions = structuredClone(permissions);
+}
+validatePublicationPermissions(permissionControl);
+
+let permissionFixtures = 0;
+function rejectPermissionMutation(mutate, expected) {
+    const fixture = structuredClone(permissionControl);
+    mutate(fixture);
+    assert.throws(() => validatePublicationPermissions(fixture), expected, "unsafe publication permission mutation was accepted");
+    permissionFixtures += 1;
+}
+for (const permission of ["actions", "contents", "id-token", "packages", "attestations", "artifact-metadata"]) {
+    rejectPermissionMutation((fixture) => { fixture.permissions[permission] = "write"; }, /non-read-only workflow permission/);
+}
+rejectPermissionMutation((fixture) => { delete fixture.permissions; }, /explicit workflow permission mapping/);
+rejectPermissionMutation((fixture) => { fixture.permissions = "write-all"; }, /explicit workflow permission mapping/);
+rejectPermissionMutation((fixture) => { fixture.jobs.extra = { permissions: { contents: "read" } }; }, /explicit permission review/);
+for (const [job, permissions] of Object.entries(PUBLICATION_PERMISSIONS)) {
+    rejectPermissionMutation((fixture) => { delete fixture.jobs[job].permissions; }, /permissions must match/);
+    rejectPermissionMutation((fixture) => { fixture.jobs[job].permissions = "write-all"; }, /broad scalar permissions/);
+    for (const permission of Object.keys(permissions)) {
+        rejectPermissionMutation((fixture) => { delete fixture.jobs[job].permissions[permission]; }, /permissions must match/);
+    }
+    for (const permission of ["actions", "contents", "id-token", "packages", "attestations", "artifact-metadata"]) {
+        if (permissions[permission] === "write") continue;
+        rejectPermissionMutation((fixture) => { fixture.jobs[job].permissions[permission] = "write"; }, /permissions must match/);
+    }
+}
 
 const maliciousFixtures = [
-    "name: bad\non: push\npermissions: write-all\njobs: {}\n",
-    "name: bad\non: pull_request_target\njobs: {}\n",
-    "name: bad\non: push\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: >-\n          actions/checkout@v7\n",
-    "name: bad\non: push\njobs:\n  call:\n    uses: 'owner/repo/.github/workflows/reuse.yml@main'\n",
-    `name: bad\non: push\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: evil/action@${"a".repeat(40)}\n`,
+    ["name: bad\non: push\npermissions: write-all\njobs: {}\n", /explicit workflow permission mapping/],
+    ["name: bad\non: pull_request_target\npermissions: {contents: read}\njobs: {}\n", /uses pull_request_target/],
+    ["name: bad\non: push\npermissions: {contents: read}\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: >-\n          actions/checkout@v7\n", /not pinned to a full commit/],
+    ["name: bad\non: push\npermissions: {contents: read}\njobs:\n  call:\n    uses: 'owner/repo/.github/workflows/reuse.yml@main'\n", /not pinned to a full commit/],
+    [`name: bad\non: push\npermissions: {contents: read}\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: evil/action@${"a".repeat(40)}\n`, /not on the maintained allowlist/],
 ];
-for (const [index, fixture] of maliciousFixtures.entries()) {
-    assert.throws(() => validateWorkflow(`malicious-${index}.yml`, parse(fixture)), undefined, `malicious workflow fixture ${index} was accepted`);
+for (const [index, [fixture, expected]] of maliciousFixtures.entries()) {
+    assert.throws(() => validateWorkflow(`malicious-${index}.yml`, parse(fixture)), expected, `malicious workflow fixture ${index} was accepted`);
 }
 
+for (const { name, workflow } of sources) validateWorkflow(name, workflow);
+validatePublicationPermissions(publish);
+
 const security = sources.find(({ name }) => name === "security.yml")?.text ?? "";
 assert.match(security, /github\/codeql-action\/init@[a-f0-9]{40}/);
 assert.match(security, /actions\/dependency-review-action@[a-f0-9]{40}/);
 assert.match(security, /queries:\s*security-extended/);
 const scorecard = sources.find(({ name }) => name === "scorecard.yml")?.text ?? "";
+assert.ok(Object.hasOwn(parse(scorecard).on, "workflow_dispatch"), "Scorecard must support manual recovery without a source push");
 assert.match(scorecard, /ossf\/scorecard-action@[a-f0-9]{40}/);
 assert.match(scorecard, /publish_results:\s*true/);
 
@@ -76,4 +137,4 @@ const rootPackage = JSON.parse(readFileSync(join(root, "package.json"), "utf8"))
 assert.match(rootPackage.scripts["audit:runtime"] ?? "", /npm audit --omit=dev/);
 assert.match(rootPackage.scripts["check:public"] ?? "", /security:baseline/);
 
-console.log(`PASS: ${workflowFiles.length} workflows and ${maliciousFixtures.length} adversarial fixtures enforce parsed YAML, allowlisted full-SHA actions, bounded triggers, and required security controls`);
+console.log(`PASS: ${workflowFiles.length} workflows, ${maliciousFixtures.length} action/trigger fixtures and ${permissionFixtures} permission mutations enforce parsed YAML, full-SHA actions, read-only defaults and job-scoped publication authority`);

package/scripts/windows-platform.mjs

@@ -736,7 +736,8 @@ export function powershellCompletion() {
   $pack = 'init','lock','validate','install','import-okf','validate-okf','export-okf','list','show','remove','enable','disable','update','skills','approve-skill','revoke-skill','doctor','--repair','--project','--project-id','--json'
   $proposals = 'create','list','show','apply','doctor','--session','--scope','--model','--category','--project','--json'
   $security = 'doctor','--project','--json'
-  $candidates = if ($commandAst.ToString() -match '^\\s*cairn\\s+setup(?:\\s|$)') { $setup } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+playbook(?:\\s|$)') { $playbook } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+pack(?:\\s|$)') { $pack } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+proposals(?:\\s|$)') { $proposals } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+security(?:\\s|$)') { $security } else { $commands }
+  $evaluation = 'validate','run','ablate','report','prune','delete','protocol','--task-set','--adapter','--output','--repetitions','--seed','--yes','--json','--disable','--experiment','--older-than-days','--dry-run','--trajectory','--codex-jsonl','--capture-authorized'
+  $candidates = if ($commandAst.ToString() -match '^\\s*cairn\\s+setup(?:\\s|$)') { $setup } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+playbook(?:\\s|$)') { $playbook } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+pack(?:\\s|$)') { $pack } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+proposals(?:\\s|$)') { $proposals } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+security(?:\\s|$)') { $security } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+eval(?:\\s|$)') { $evaluation } else { $commands }
   $candidates | Where-Object { $_ -like "$wordToComplete*" } | ForEach-Object {
     [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_)
   }