@cairnkeep/cli 2.22.2 → 2.22.4

package/CHANGELOG.md

@@ -5,6 +5,71 @@ All notable user-facing changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [2.22.4] - 2026-10-07
+
+### Security
+
+- Remove ambiguous nested path expressions from failure signatures. Crafted
+  slash-heavy messages no longer cause exponential backtracking; existing v1
+  fixture signatures remain byte-equivalent. Add timeout-isolated regression
+  inputs and a reproducible generated corpus.
+- Bind capability compatibility configuration, skill artifacts/targets/backups
+  and work-evidence reads to inspected descriptors with fixed byte bounds,
+  identity rechecks and strict UTF-8. Reject replacement, growth and special-file
+  substitution; preserve private-ledger permissions and ordinary project-file
+  modes. Keep schemas, feature defaults and explicit approval gates unchanged.
+  Update security guidance and the learning/video supplement; historical
+  analysis findings remain subject to individual triage.
+- Bind evaluation inputs/note snapshots, OKF import/export, graph artifacts,
+  playbook receipts and progressive-context cache reads to bounded inspected
+  descriptors. Reject replacement and growth before accepting content; publish
+  snapshots from the validated bytes instead of reopening source paths.
+  Rebuild unsafe derived caches deterministically without changing pack
+  enablement or skill approval. Add public-reader regression controls and
+  update security, learning and video guidance.
+- Bound setup policy/state/ownership and instruction-file reads to 1 MiB;
+  bound OMP staged candidates to 8 KiB and exclude linked or oversized files.
+  Recheck observed setup/instruction targets before publication; preserve
+  caller edits detected after inspection, original instruction modes and
+  failed-operation state. Keep private approvals and machine sync explicit.
+  On Windows, use content ownership rather than POSIX executable-mode bits
+  when reconciling generated files; keep private-state ACL enforcement.
+- Publish evaluation overlays and Windows managed files through exclusive
+  descriptor-written temporary files. Reject substituted targets, clean only
+  owned temporary files, and never unlink live Windows data to retry a denied
+  replacement. Bound compressed and expanded memory imports to 512 MiB.
+- Keep container health checks on a validated numeric loopback port, using the
+  server's bounded credential resolver. Refuse provider URL credentials and
+  redirects, bound AnythingLLM query responses to 8 MiB, and sanitize provider
+  HTTP, network and stream failures without including response bodies.
+  Reject workspace dot segments, including shorthand OpenViking traversal.
+  Preserve default retrieval providers and successful response shapes.
+
+### CI
+
+- Preserve the bundled evaluation task set's canonical LF bytes in native
+  Windows source checkouts. Add a real Git CRLF-conversion regression control;
+  keep the installed-package exact-byte integrity check unchanged.
+- Canonicalize bounded-read fixture paths before injecting file changes, covering
+  Windows short temporary-directory names and a real POSIX alias control.
+- Run focused bounded-input controls before the longer Windows smoke shards on
+  all supported Node versions; retain every complete-catalog and install gate.
+- Wait for completed OpenCode V2 fixture capture before reading its database,
+  under a bounded event-stream completion deadline. A deterministic delayed
+  completion control rejects the old file-existence readiness assumption;
+  production capture behavior is unchanged.
+
+## [2.22.3] - 2026-10-07
+
+### Fixed
+
+- Diagnose preserved custom setup files separately from generated-file
+  ownership. A complete scaffold no longer fails merely because setup skipped
+  caller-owned files or its ownership map is empty. Keep missing/unsafe asset,
+  launcher-executable and recorded digest/mode checks; never adopt, rewrite or
+  remove custom files during diagnosis. Add cross-platform regression controls
+  and clarify operating and guided-setup learning documentation.
+
 ## [2.22.2] - 2026-10-07
 
 ### Security
@@ -716,7 +781,8 @@ stored memories.
 - Preserve executable permissions and Bash 3.2 portability on macOS.
 - Add backup-first uninstall and SQLite-safe memory export/import guidance.
 
-[Unreleased]: https://github.com/cairnkeep/cairnkeep/compare/v2.20.0...HEAD
+[Unreleased]: https://github.com/cairnkeep/cairnkeep/compare/v2.22.4...HEAD
+[2.22.4]: https://github.com/cairnkeep/cairnkeep/compare/v2.22.3...v2.22.4
 [2.20.0]: https://github.com/cairnkeep/cairnkeep/compare/v2.19.1...v2.20.0
 [2.19.1]: https://github.com/cairnkeep/cairnkeep/compare/v2.19.0...v2.19.1
 [2.19.0]: https://github.com/cairnkeep/cairnkeep/compare/v2.18.0...v2.19.0

package/containers/healthcheck.mjs

@@ -1,22 +1,6 @@
-import { readFileSync } from "node:fs";
-
-const port = process.env.MCP_HTTP_PORT?.trim();
-if (!port) {
-    process.exit(0);
-}
-
-let token = process.env.CAIRN_MEMORY_HTTP_TOKEN?.trim();
-const tokenFile = process.env.CAIRN_MEMORY_HTTP_TOKEN_FILE?.trim();
-if (!token && tokenFile) {
-    try {
-        token = readFileSync(tokenFile, "utf8").trim();
-    } catch {
-        process.exit(1);
-    }
-}
-if (!token) {
-    process.exit(1);
-}
+import { realpathSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+import { parseHttpPort, resolveHttpToken } from "../mcp-memory-server/dist/http-security.js";
 
 const body = {
     jsonrpc: "2.0",
@@ -29,18 +13,28 @@ const body = {
     },
 };
 
-try {
-    const response = await fetch(`http://127.0.0.1:${port}/mcp`, {
-        method: "POST",
-        headers: {
-            Authorization: `Bearer ${token}`,
-            "Content-Type": "application/json",
-            Accept: "application/json, text/event-stream",
-        },
-        body: JSON.stringify(body),
-        signal: AbortSignal.timeout(4000),
-    });
-    process.exit(response.ok ? 0 : 1);
-} catch {
-    process.exit(1);
+export async function containerHealthcheck(env = process.env) {
+    const port = parseHttpPort(env.MCP_HTTP_PORT);
+    if (!port.enabled) return "error" in port ? 1 : 0;
+    const token = resolveHttpToken(env);
+    if (!token.ok) return 1;
+    try {
+        const response = await fetch(`http://127.0.0.1:${port.port}/mcp`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token.token}`,
+                "Content-Type": "application/json",
+                Accept: "application/json, text/event-stream",
+            },
+            body: JSON.stringify(body),
+            redirect: "manual",
+            signal: AbortSignal.timeout(4000),
+        });
+        await response.body?.cancel();
+        return response.ok ? 0 : 1;
+    } catch { return 1; }
+}
+
+if (process.argv[1] && pathToFileURL(realpathSync(process.argv[1])).href === import.meta.url) {
+    process.exitCode = await containerHealthcheck();
 }

package/containers/quadlet/cairnkeep.container

@@ -9,7 +9,7 @@ ContainerName=cairnkeep
 Exec=http
 UserNS=keep-id:uid=10001,gid=10001
 Volume=cairnkeep-data.volume:/data:Z
-Secret=cairnkeep-http-token,type=mount,target=http-token
+Secret=cairnkeep-http-token,type=mount,target=http-token,uid=10001,gid=10001,mode=0400
 Environment=MCP_HTTP_HOST=0.0.0.0
 Environment=MCP_HTTP_PORT=7801
 Environment=CAIRN_MEMORY_HTTP_ALLOWED_HOSTS=localhost:7801,127.0.0.1:7801

package/docs/containers.md

@@ -80,6 +80,18 @@ cairn-container http \
 
 The container always adds its own loopback address for health checks.
 
+The health-check security follow-up validates `MCP_HTTP_PORT` with the server's
+numeric port parser and uses its bounded private token resolver. Invalid
+configuration fails without issuing a request; probes target only
+`127.0.0.1` and refuse redirects. The existing
+`/usr/local/lib/cairnkeep/container-healthcheck.mjs` command remains available
+as an alias to the packaged probe. Stdio mode requires no HTTP probe.
+File-based probes require a private token readable by the container user;
+world-readable secret mounts fail closed. The Quadlet example explicitly mounts
+its secret as UID/GID 10001 with mode `0400`. For other engines, verify the
+effective in-container ownership and mode rather than relying on a secret
+declaration that the engine may not honor.
+
 One HTTP server and bearer token form one trust domain. They are not a
 multi-tenant authorization boundary; see [Memory storage and
 deployment](storage.md).

package/docs/domain-knowledge.md

@@ -32,6 +32,17 @@ work exactly the same without them.
 | `CAIRN_ANYTHINGLLM_PROJECTS_FILE` | Optional config path for the bundled sync script. Default `${XDG_CONFIG_HOME:-~/.config}/cairnkeep/anythingllm-projects.json`. |
 | `CAIRN_ANYTHINGLLM_STATE_FILE` | Optional state path for the bundled sync script. Default `${XDG_STATE_HOME:-~/.local/state}/cairnkeep/anythingllm-sync.json`. |
 
+The query security follow-up validates HTTP(S) URLs and rejects embedded
+credentials, query strings and fragments before fetching. Redirects are not
+followed, and workspace names cannot be empty or URL dot segments. Responses
+are streamed under an 8 MiB cap and must be UTF-8 JSON
+objects; successful answer-field selection is unchanged. Failed requests
+report only a controlled failure class or HTTP status, never a provider error
+body or raw network/stream diagnostic. The existing two-minute query deadline
+remains. Configure HTTPS outside loopback: remote plaintext HTTP remains
+accepted for compatibility, not as a recommendation. Document synchronization
+uses a separate script and does not inherit these query-specific guarantees.
+
 The workspaces the tools target come from the project's **memory config** — the
 first of `.agent/memory.json`, `.opencode/memory.json`, `.claude/memory.json`, or
 `memory.json` that exists:
@@ -117,6 +128,10 @@ CAIRN_OPENVIKING_BASE_URL=http://127.0.0.1:1933
 
 Plain HTTP is limited to loopback. Use HTTPS for any other host. Credentials in
 the URL, redirects, invalid response shapes, and oversized bodies are rejected.
+The response cap is 1 MiB. Network and stream failures are payload-free in the
+security follow-up, including failures during response cleanup.
+Shorthand workspace names and explicit `viking://resources` URIs share the
+same decoded traversal checks before any request is sent.
 Authenticated remote MCP use requires the additional explicit consent setting
 `CAIRN_OPENVIKING_MCP_HTTP=1`.
 

package/docs/learning/CURRICULUM-MAP.md

@@ -1,6 +1,6 @@
 # Curriculum Coverage Map
 
-**Baseline:** Cairnkeep 2.22.2
+**Baseline:** Cairnkeep 2.22.4
 **Last reviewed:** 2026-10-07
 
 This map prevents the course from drifting behind the product. It assigns each

package/docs/learning/FEATURE-GUIDE.md

@@ -1,6 +1,6 @@
 # Cairnkeep feature guide
 
-**Baseline:** Cairnkeep 2.22.2
+**Baseline:** Cairnkeep 2.22.4
 
 This is the step-back map for choosing and operating Cairnkeep features. The
 [course labs](https://github.com/cairnkeep/cairnkeep-course-labs) provide one

package/docs/learning/lessons/L00-why-cairnkeep.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 10 minutes
-**Tested with:** Cairnkeep 2.22.2
+**Tested with:** Cairnkeep 2.22.4
 
 ## Outcome
 

package/docs/learning/lessons/L01-safe-trial.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 15 minutes
-**Tested with:** Cairnkeep 2.22.2
+**Tested with:** Cairnkeep 2.22.4
 
 ## Outcome
 
@@ -26,7 +26,7 @@ ephemeral; the named course volume is persistent.
 1. Pull the public image:
 
    ```bash
-   podman pull ghcr.io/cairnkeep/cairnkeep:2.22.2
+   podman pull ghcr.io/cairnkeep/cairnkeep:2.22.4
    ```
 
 2. Start the stdio server with a read-only root filesystem and no Linux
@@ -38,7 +38,7 @@ ephemeral; the named course volume is persistent.
      --read-only --cap-drop=all --security-opt=no-new-privileges \
      --tmpfs=/tmp:rw,noexec,nosuid,size=64m,mode=1777 \
      --volume cairnkeep-course-data:/data:Z,U \
-     ghcr.io/cairnkeep/cairnkeep:2.22.2 stdio
+     ghcr.io/cairnkeep/cairnkeep:2.22.4 stdio
    ```
 
 3. The process waits quietly for MCP input. Press `Ctrl-C` after confirming it

package/docs/learning/lessons/L02-installation.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.22.2 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.4 and Node.js 22 or newer
 
 ## Outcome
 
@@ -47,7 +47,7 @@ sync. Codex project trust remains an explicit operator decision.
 2. Install Cairnkeep:
 
    ```bash
-   npm install --global @cairnkeep/cli@2.22.2
+   npm install --global @cairnkeep/cli@2.22.4
    cairn --version
    ```
 

package/docs/learning/lessons/L03-first-project.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.22.2
+**Tested with:** Cairnkeep 2.22.4
 
 ## Outcome
 

package/docs/learning/lessons/L19-validated-skill-improvement.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Evidence and Evaluation
 **Time:** 50 minutes
-**Tested with:** Cairnkeep 2.22.2
+**Tested with:** Cairnkeep 2.22.4
 
 ## Outcome
 

package/docs/learning/lessons/L20-mcp-tool-profiles.md

@@ -1,7 +1,7 @@
 # L20 - Least-authority MCP tool profiles
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.22.2 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.4 and Node.js 22 or newer
 **Time:** 25 minutes
 
 ## Outcome

package/docs/learning/lessons/L21-context-packs.md

@@ -1,7 +1,7 @@
 # L21 - Immutable context packs and skill approval
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.22.2 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.4 and Node.js 22 or newer
 **Time:** 40 minutes
 
 ## Outcome

package/docs/learning/lessons/L22-native-windows.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Operator
 **Time:** 30 minutes
-**Tested with:** Cairnkeep 2.22.2, Windows x64, and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.4, Windows x64, and Node.js 22 or newer
 
 ## Outcome
 
@@ -16,7 +16,7 @@ perform a reversible uninstall without relying on WSL or Git Bash.
 From PowerShell:
 
 ```powershell
-npm install --global @cairnkeep/cli@2.22.2
+npm install --global @cairnkeep/cli@2.22.4
 cairn version
 
 $Lab = Join-Path $env:TEMP 'Cairnkeep Windows Lab'

package/docs/learning/lessons/L23-guided-setup.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart and Operator
 **Time:** 35 minutes
-**Tested with:** Cairnkeep 2.22.2; Pi 0.84.1; Node.js 22, 24, and 26
+**Tested with:** Cairnkeep 2.22.4; Pi 0.84.1; Node.js 22, 24, and 26
 
 ## Outcome
 
@@ -54,6 +54,13 @@ records the selected Pi harness in private `.ai/cairnkeep.json`, and reports
 created, updated, unchanged, and skipped assets. Repeating the same `cairn
 setup` command should report the managed files as unchanged.
 
+When an existing project has customized launchers or scaffold files, setup
+preserves and skips them. Its private asset map tracks ownership, not a full
+inventory. Doctor accepts safely present custom files without adopting them,
+but still rejects missing files, links, non-executable POSIX launchers and
+changes to recorded owned assets. Do not replace a custom file just to satisfy
+a generated digest. Diagnosis does not change file contents or ownership.
+
 Project setup never changes the Pi installation. Apply and check machine assets
 explicitly, then diagnose the project again:
 

package/docs/learning/lessons/L24-okf-exchange.md

@@ -1,7 +1,7 @@
 # L24 - Reviewed knowledge exchange
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.22.2 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.4 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L25-playbooks.md

@@ -1,7 +1,7 @@
 # L25 - Bounded workflow playbooks
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.22.2 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.4 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L26-context-intelligence.md

@@ -1,7 +1,7 @@
 # L26 - Context intelligence with explicit authority
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.22.2 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.4 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L27-ecosystem-evidence.md

@@ -1,6 +1,6 @@
 # L27 - Evaluate context companions without moving authority
 
-**Tested with:** Cairnkeep 2.22.2 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.4 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L28-security-assurance.md

@@ -1,7 +1,7 @@
 # L28 - Verify Cairnkeep's security posture
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.22.2 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.22.4 and Node.js 22 or newer
 
 ## Outcome
 
@@ -11,7 +11,7 @@ and choose least authority for a network-facing MCP client.
 
 ## Prerequisites
 
-- Install Cairnkeep 2.22.2 or use a disposable source checkout.
+- Install Cairnkeep 2.22.4 or use a disposable source checkout.
 - Complete [L20 - Least-authority MCP tool profiles](L20-mcp-tool-profiles.md).
 - Use synthetic values only; never paste a real bearer token into a recording,
   terminal transcript, or issue.
@@ -68,6 +68,14 @@ scripts/test-security-baseline.sh
 npm --prefix mcp-memory-server run check:security-assurance
 npm --prefix mcp-memory-server run check:http-guard
 node mcp-memory-server/scripts/smoke-context-pack-state.mjs
+node mcp-memory-server/scripts/smoke-note-signatures.mjs
+node mcp-memory-server/scripts/smoke-runtime-file-reads.mjs
+node mcp-memory-server/scripts/smoke-bounded-input-reads.mjs
+node mcp-memory-server/scripts/smoke-workspace-file-security.mjs
+node mcp-memory-server/scripts/smoke-outbound-security.mjs
+node scripts/test-runtime-file-security.mjs
+node scripts/test-omp-staged-security.mjs
+node scripts/test-container-health.mjs
 ```
 
 The baseline rejects unpinned external Actions, `pull_request_target` and
@@ -91,6 +99,48 @@ under bounded reads. A resolved review thread or green CodeQL job does not mean
 all historical alerts are fixed: inspect current findings and test the actual
 boundary without dismissing results merely to improve an advisory score.
 
+In a checkout containing the runtime-security follow-up, the signature control
+keeps existing v1 fingerprints byte-equivalent and isolates crafted path inputs
+behind a five-second child-process timeout. The runtime file-read control
+substitutes valid capability configuration, skill targets/ledgers/backups and
+work-evidence records after inspection. Readers reject those replacements,
+bound growth, reject special files without waiting for a writer and close their
+descriptors. Ordinary project configuration may remain `0644`; private evidence
+and approval ledgers still require private ownership/ACLs. Build the server
+before running source-checkout controls. The generated parser corpus is
+reproducible regression coverage, not integrated coverage-guided fuzzing.
+
+The bounded-input follow-up extends descriptor-bound reads to evaluation,
+OKF import/export, graph artifacts, private playbook receipts and derived
+progressive-context caches. Compare a replaced valid file with same-inode
+growth: rejecting oversized content after `readFile` has allocated it is not
+a bounded read. Note snapshots publish the bytes that were inspected and
+hashed, not a later reopened file. Unsafe derived caches can be rebuilt from
+immutable content; read-only doctor reports them without deletion. Cache
+rebuilding never changes project enablement or skill approval. This exercise
+does not certify directory-wide transactions against other same-account
+processes.
+
+The publication follow-up extends the exercise to setup, instruction files,
+evaluation overlays and native Windows managed writes. Inspect a concurrent
+caller edit: rechecking the observed target before publication must preserve
+it. A denied Windows replacement must retain the live database, not unlink it
+to retry. A substituted overlay symlink must leave its outside sentinel intact.
+Exclusive descriptor-written temporaries retain modes and clean only their own
+files. These are point-in-time safeguards, not all-project transactions or
+protection against another hostile process using your account. Native Windows
+and container/package verification remain required before shipping.
+
+The OMP control reads only synthetic staged candidates, never invokes a model,
+and shows that linked, growing or over-8-KiB content cannot become wakeup
+evidence or `/cairn-staged` output. It does not approve or persist a candidate.
+The outbound and health controls stub network calls: provider redirects and
+oversized bodies fail, private error sentinels never appear in diagnostics,
+and a malformed health port never becomes a network destination. Successful
+retrieval still sends a query to the explicitly configured external provider.
+AnythingLLM responses have an 8 MiB cap; OpenViking retains its 1 MiB cap and
+separate consent gates. Prefer HTTPS outside loopback.
+
 ## Common failures
 
 - A private `.ai` file is group/world accessible on POSIX: restore mode `0600`.

package/docs/learning/video-scripts/V28-security-assurance.md

@@ -3,6 +3,11 @@
 Target length: 10–12 minutes. Audience: experienced developers operating an
 agent-memory service locally or behind authenticated HTTP.
 
+The source-checkout security follow-up blocks below are optional supplemental
+clips, not part of the original 10–12-minute timing. Record them as a separate
+segment after their branch passes the complete release gates; do not present
+unreleased controls as installed-package behavior.
+
 ## Recording outline
 
 ### 0:00–1:20 — Threat model before tooling
@@ -69,6 +74,46 @@ rejection, bounded growth and cleanup; use no real private pointer/approval
 data. Distinguish resolved old review comments from current analysis findings,
 and do not imply a green CI run certifies an empty security backlog.
 
+For the runtime-security follow-up, show
+`node mcp-memory-server/scripts/smoke-note-signatures.mjs` and
+`node mcp-memory-server/scripts/smoke-runtime-file-reads.mjs` from a built source
+checkout. Explain that a tiny crafted path used to stall signature parsing,
+while the fixed parser preserves the existing v1 fixture fingerprints. The
+child-process timeout makes a regression fail instead of freezing the demo.
+Then show valid-file replacement rejection through capability, skill and
+work-evidence readers. Explain fixed byte bounds and descriptor cleanup, and
+distinguish private ledger permissions from ordinary project-file modes. Do not
+call the generated corpus coverage-guided fuzzing or claim that this patch
+resolves every historical analysis alert. Use only the synthetic fixtures.
+
+In a checkout with the bounded-input follow-up, run
+`node mcp-memory-server/scripts/smoke-bounded-input-reads.mjs`. Zoom into
+valid-file substitution and same-inode growth through evaluation, OKF, graph,
+receipt and cache entry points. Contrast a byte cap checked after allocation
+with a fixed descriptor-read allocation. Show that note snapshots publish the
+validated bytes and rejected derived cache data is rebuilt, while read-only
+doctor never deletes it. Explain that this does not enable a pack or approve a
+skill, make directory-wide publication transactional, or substitute for native
+Windows verification. Keep a pause between the failure and remediation.
+
+For the publication follow-up, show
+`node scripts/test-runtime-file-security.mjs` beside
+`node mcp-memory-server/scripts/smoke-workspace-file-security.mjs`. Pause on the
+concurrent caller edit and denied-replacement controls: the previous content
+must survive. Contrast a direct path write with an exclusive, flushed temporary
+file followed by publication. State that immediate parent/target checks are
+not directory-wide transactions or a same-account sandbox. Native Windows
+verification is still required; POSIX fixture execution is not proof of it.
+
+Run `node scripts/test-omp-staged-security.mjs` and explain the 8 KiB candidate
+bound, symlink exclusion and unchanged agent-review requirement. Then show
+`node mcp-memory-server/scripts/smoke-outbound-security.mjs` and
+`node scripts/test-container-health.mjs`: synthetic provider errors must stay
+out of diagnostics, redirects are refused, response bytes are bounded, and
+the health probe cannot turn an unvalidated port into an outside destination.
+These controls stub network calls; never show real credentials or imply that
+the exercise contacted a provider. Leave a reading pause after each result.
+
 Briefly open `.github/workflows/publish.yml` beside the permission table in
 `docs/releasing.md`. Contrast the read-only preparation job with the necessary
 npm and OCI publication grants. Explain that explicit maps deny unspecified

package/docs/native-windows.md

@@ -125,6 +125,16 @@ access, or background synchronization.
 uses `sqlite3.exe` `.backup` for a consistent snapshot of each live WAL database
 and then writes the same portable `.tgz` format used on Unix.
 
+The archive/publication security follow-up binds compressed input to one
+descriptor with a 512 MiB cap; decompressed tar output is independently capped
+at 512 MiB. Managed writes use exclusive descriptor-written temporary files,
+flush them and recheck the immediate parent/target before publication. Sharing
+violations get bounded retries with at most 250 ms total backoff. A denied
+replacement never unlinks the live destination; its prior contents survive.
+These checks do not make a multi-database import transactional, and a post-write
+ACL failure is not a rollback. Keep the pre-import backup and diagnose the
+failure before retrying.
+
 ## Scheduling and process cleanup
 
 `cairn audit-timer` registers the opt-in `Cairnkeep Memory Audit` task through

package/docs/operating.md

@@ -94,6 +94,22 @@ returns the same schema-v1 result. The private mode-`0600`
 selected harnesses, and digests/modes/template identifiers for setup-owned
 assets. It contains no credentials, endpoints, or absolute paths.
 
+The asset map records ownership, not every file in the project. Existing custom
+files that setup skips remain caller-owned. Doctor checks that every required
+selected asset is a regular file under non-symlinked scaffold directories and
+that POSIX launchers are executable, without adopting or rewriting custom files.
+An empty ownership map is valid when all required assets were already present.
+
+In the security follow-up, policy/state/owned-asset and `AGENTS.md` reads are
+descriptor-bound and capped at 1 MiB. A changed, linked, oversized or invalid
+UTF-8 input fails closed instead of being accepted through a later path read.
+Publication rechecks observed targets and preserves concurrent caller edits
+detected before replacement. Instruction reconciliation retains the original
+file mode; unsafe instruction files are not rewritten. These checks are not an
+all-project transaction or a sandbox against another process using your account.
+Correct the reported input and rerun the printed recovery command; do not
+delete caller-owned files or the ownership record to bypass a failure.
+
 Setup never installs or refreshes machine-level harness assets. Its
 `machine_sync.automatic` field is always false, and the human output labels each
 reported command as not run automatically. The JSON result's
@@ -1072,7 +1088,9 @@ Unsupported schema, SQLite failure, invalid full records, or digest corruption
 fails untouched with guidance to preserve the database before manual recovery.
 
 When `.ai/cairnkeep.json` exists, doctor also validates its private state,
-selected assets, digests, and modes. It reports `limited` for explicit
+selected assets, and the digests and modes of recorded setup-owned files.
+Preserved caller-owned files need safe presence, not a generated-file digest;
+doctor never claims ownership of them. It reports `limited` for explicit
 `--git none`, fails an incomplete or drifted setup with the recorded
 deterministic `cairn setup` recovery command, and checks the Pi machine
 extension when Pi was selected. `cairn sync-pi --apply` repairs that

package/docs/privacy-and-data-flow.md

@@ -683,6 +683,12 @@ skill readable; Cairnkeep never copies it into a harness or executes it.
 - The OpenViking adapter is query-only. It sends the requested workspace target
   and query to the configured endpoint, but performs no synchronization, watch,
   commit, update, or deletion. Non-loopback endpoints must use HTTPS.
+- In the query security follow-up, AnythingLLM and OpenViking do not follow
+  redirects, bound response bytes and suppress provider error bodies and raw
+  network/stream diagnostics. Successful requests still send the selected
+  query to the configured provider. AnythingLLM retains remote HTTP support
+  for compatibility; choose HTTPS outside loopback. Synchronization scripts
+  have their own authority and do not inherit query-only guarantees.
 
 Pack digests and proposal digests protect integrity and stale-state detection;
 they do not authenticate a publisher or make extracted statements true.

package/docs/releasing.md

@@ -47,8 +47,9 @@ does not require republishing the npm package.
    anonymous pull before announcing the release.
 
 The native-Windows lanes retain stable check names for branch protection. Each
-lane exercises the Windows CLI and packed global install on its Node version,
-while the complete memory-server smoke catalog is deterministically balanced
+lane exercises the Windows CLI and packed global install on its Node version.
+Focused bounded-input controls run first so platform-specific failures surface
+before the longer smoke shards. The complete memory-server smoke catalog is deterministically balanced
 across the three lanes. The Linux Node 22/24/26 matrix independently runs the
 complete catalog on every supported runtime. This preserves coverage while
 removing three serial copies of the slow Windows suite from the critical path.