@cairnkeep/cli 2.22.4 → 2.23.0

package/CHANGELOG.md

@@ -5,6 +5,50 @@ All notable user-facing changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [2.23.0] - 2026-10-21
+
+### Memory retrieval
+
+- Add opt-in `memory_search` hybrid lexical/identifier admission, bounded query
+  aliases, explicit semantic-only thresholds, deterministic ranking, duplicate
+  source locators and optional conflict/match explanations. Preserve existing
+  default responses, history, scope filters and storage layouts. Fall back to
+  lexical admission when optional embedding results are invalid or unavailable.
+- Add a frozen continuity study against real curated Markdown files, including
+  the same-policy Markdown parity control and 0/100/1,000 distractors. Document
+  synthetic limitations and unsuccessful live-provider evaluation; update the
+  agent guidance, learning lesson and recording supplement.
+
+### CI
+
+- Allow a retried, fully gated CI job to replace its run-local tree-addressed
+  release candidate instead of failing on the existing artifact name. Keep all
+  platform/runtime dependencies and immutable published versions unchanged; add
+  parsed-workflow positive and mutation controls.
+
+## [2.22.5] - 2026-10-08
+
+### Operations
+
+- Add an explicit post-publication verifier for exact-tree CI candidates,
+  release and registry bytes, npm signatures/attestations, anonymous
+  dual-architecture OCI images, bound SBOMs and exact-source signed provenance.
+  Refuse partial verification and report replacement; keep artifact evidence
+  separate from deployment readiness. Add offline positive/mutation controls.
+
+### Security
+
+- Bind note-transaction pre-image hashes to bounded inspected descriptors;
+  reject linked, replaced, growing or over-64-MiB files before accepting their
+  hashes. Create developer note fixtures exclusively without overwriting a
+  competing file. Add actual runtime replacement and fixture race controls.
+- Use bounded descriptor reads for developer benchmark/import/note snapshots,
+  capability leases, corrupt-database controls and runtime-evidence files.
+  Preserve existing corruption, permissions and exact-byte assertions; keep
+  remote-context test labels static so provider values cannot forge log lines.
+  These controls do not make note publication a directory-wide transaction or
+  certify that every historical security-analysis finding is resolved.
+
 ## [2.22.4] - 2026-10-07
 
 ### Security

package/claude/commands/recall.md

@@ -19,7 +19,14 @@ Read order (canonical sources still win over derived layers):
 
 <process>
 ## 1. AgentFS
-`memory_search` scope `project` with $ARGUMENTS. If nothing relevant, retry scope `all`.
+`memory_search` scope `project` with $ARGUMENTS. When the discovered schema
+supports it, use `strategy: "hybrid"` for identifier-sensitive or mixed-wording
+queries and `explain: true` to inspect matches. Supply only aliases already known
+from the task. Semantic-only hybrid matches require an explicitly chosen
+positive `min_score`; retain the existing semantic strategy for paraphrases
+when no model-specific threshold is available. Empty results are valid.
+Use broader configured scopes only when the question genuinely spans them;
+do not automatically widen a search merely to force a hit.
 
 ## 2. Wiki
 Read `.planning/wiki/index.md` if present and follow links relevant to $ARGUMENTS.

package/docs/README.md

@@ -31,6 +31,9 @@ linked guides rather than the project landing page.
 
 ## Context intelligence
 
+- [Memory retrieval and the Markdown baseline](memory-retrieval.md) explains
+  optional hybrid admission, aliases, relevance diagnostics and reproducible
+  continuity evidence against searchable Markdown.
 - [Context intelligence](context-intelligence.md) connects progressive context-pack
   retrieval, the frozen benchmark, usage receipts, review-gated proposals, and
   the optional read-only OpenViking provider.

package/docs/agents.md

@@ -27,6 +27,15 @@ constraints, recurring failures, or prior work:
 This protocol improves continuity without allowing stale memory to outrank
 code, tests, current documentation, or the user's request.
 
+When the discovered tool schema supports it, `strategy: "hybrid"` is useful for
+identifier-sensitive and mixed-wording queries. `explain: true` exposes selection
+reasons; explicit `query_aliases` can express names already known from the task.
+Do not invent aliases or broaden scopes to obtain a match. Semantic-only
+paraphrase retrieval needs an explicitly chosen positive `min_score` in hybrid
+mode; without a model-specific threshold, the existing semantic strategy remains
+available. Empty results are valid, and ranking scores are not factual confidence.
+See [memory retrieval and evidence](memory-retrieval.md).
+
 ## What setup installs
 
 `cairn setup` reconciles a delimited Cairnkeep block in the project's

package/docs/benchmarks/memory-retrieval-v1.json

@@ -0,0 +1,115 @@
+{
+  "schema_version": 1,
+  "study": "synthetic-memory-continuity-v1",
+  "fixture_digest": "051a1ee175fc20d9e38c43d838b234c759133805ab335f74ef5603ee0871fce8",
+  "embedding": {
+    "mode": "none"
+  },
+  "limitations": [
+    "Synthetic retrieval scenarios, not autonomous task-quality or human-usability evidence.",
+    "Markdown baseline shares BM25/tokenization and receives identical alias information.",
+    "Markdown with the same admission policy is included to distinguish retrieval-policy gains from storage format.",
+    "Offline cases do not evaluate learned semantic paraphrase retrieval.",
+    "Explicit live threshold is an example, not universal calibration or a confidence probability.",
+    "Current-state fixture excludes archived history; actual supersession is covered by the MCP regression.",
+    "No automatic contradiction reconciliation, human consent or concurrent local-store access is claimed."
+  ],
+  "measurements": [
+    {
+      "adapter": "markdown-bm25",
+      "distractor_count": 0,
+      "hit_at_1": 0.8888888888888888,
+      "recall_at_5": 0.8888888888888888,
+      "negative_false_positive_rate": 0.75,
+      "irrelevant_bytes": 794
+    },
+    {
+      "adapter": "markdown-hybrid",
+      "distractor_count": 0,
+      "hit_at_1": 0.8888888888888888,
+      "recall_at_5": 0.8888888888888888,
+      "negative_false_positive_rate": 0,
+      "irrelevant_bytes": 0
+    },
+    {
+      "adapter": "legacy-substring",
+      "distractor_count": 0,
+      "hit_at_1": 0.3333333333333333,
+      "recall_at_5": 0.3333333333333333,
+      "negative_false_positive_rate": 0,
+      "irrelevant_bytes": 0
+    },
+    {
+      "adapter": "hybrid-lexical",
+      "distractor_count": 0,
+      "hit_at_1": 0.8888888888888888,
+      "recall_at_5": 0.8888888888888888,
+      "negative_false_positive_rate": 0,
+      "irrelevant_bytes": 0
+    },
+    {
+      "adapter": "markdown-bm25",
+      "distractor_count": 100,
+      "hit_at_1": 0.8888888888888888,
+      "recall_at_5": 0.8888888888888888,
+      "negative_false_positive_rate": 0.75,
+      "irrelevant_bytes": 3359
+    },
+    {
+      "adapter": "markdown-hybrid",
+      "distractor_count": 100,
+      "hit_at_1": 0.8888888888888888,
+      "recall_at_5": 0.8888888888888888,
+      "negative_false_positive_rate": 0,
+      "irrelevant_bytes": 0
+    },
+    {
+      "adapter": "legacy-substring",
+      "distractor_count": 100,
+      "hit_at_1": 0.3333333333333333,
+      "recall_at_5": 0.3333333333333333,
+      "negative_false_positive_rate": 0,
+      "irrelevant_bytes": 0
+    },
+    {
+      "adapter": "hybrid-lexical",
+      "distractor_count": 100,
+      "hit_at_1": 0.8888888888888888,
+      "recall_at_5": 0.8888888888888888,
+      "negative_false_positive_rate": 0,
+      "irrelevant_bytes": 0
+    },
+    {
+      "adapter": "markdown-bm25",
+      "distractor_count": 1000,
+      "hit_at_1": 0.8888888888888888,
+      "recall_at_5": 0.8888888888888888,
+      "negative_false_positive_rate": 0.75,
+      "irrelevant_bytes": 3359
+    },
+    {
+      "adapter": "markdown-hybrid",
+      "distractor_count": 1000,
+      "hit_at_1": 0.8888888888888888,
+      "recall_at_5": 0.8888888888888888,
+      "negative_false_positive_rate": 0,
+      "irrelevant_bytes": 0
+    },
+    {
+      "adapter": "legacy-substring",
+      "distractor_count": 1000,
+      "hit_at_1": 0.3333333333333333,
+      "recall_at_5": 0.3333333333333333,
+      "negative_false_positive_rate": 0,
+      "irrelevant_bytes": 0
+    },
+    {
+      "adapter": "hybrid-lexical",
+      "distractor_count": 1000,
+      "hit_at_1": 0.8888888888888888,
+      "recall_at_5": 0.8888888888888888,
+      "negative_false_positive_rate": 0,
+      "irrelevant_bytes": 0
+    }
+  ]
+}

package/docs/learning/CURRICULUM-MAP.md

@@ -1,6 +1,6 @@
 # Curriculum Coverage Map
 
-**Baseline:** Cairnkeep 2.22.4
+**Baseline:** Cairnkeep 2.23.0
 **Last reviewed:** 2026-10-07
 
 This map prevents the course from drifting behind the product. It assigns each

package/docs/learning/FEATURE-GUIDE.md

@@ -1,6 +1,6 @@
 # Cairnkeep feature guide
 
-**Baseline:** Cairnkeep 2.22.4
+**Baseline:** Cairnkeep 2.23.0
 
 This is the step-back map for choosing and operating Cairnkeep features. The
 [course labs](https://github.com/cairnkeep/cairnkeep-course-labs) provide one
@@ -36,6 +36,12 @@ explicit native Codex exec exports. See the L16 memory-protocol supplement;
 protocol observations and independently verified task correctness remain
 separate evidence, not a claim of model improvement.
 
+Version 2.23 adds opt-in hybrid memory retrieval, explicit query aliases and
+match/source/conflict explanations without changing legacy defaults. See
+[memory retrieval](../memory-retrieval.md), [L04](lessons/L04-memory-fundamentals.md)
+and its recording supplement. The synthetic Markdown comparison measures
+retrieval policy, not general task quality or a storage-format advantage.
+
 ## The three-layer model
 
 1. **Memory server:** an MCP process that owns scoped durable storage. The

package/docs/learning/lessons/L00-why-cairnkeep.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 10 minutes
-**Tested with:** Cairnkeep 2.22.4
+**Tested with:** Cairnkeep 2.23.0
 
 ## Outcome
 

package/docs/learning/lessons/L01-safe-trial.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 15 minutes
-**Tested with:** Cairnkeep 2.22.4
+**Tested with:** Cairnkeep 2.23.0
 
 ## Outcome
 
@@ -26,7 +26,7 @@ ephemeral; the named course volume is persistent.
 1. Pull the public image:
 
    ```bash
-   podman pull ghcr.io/cairnkeep/cairnkeep:2.22.4
+   podman pull ghcr.io/cairnkeep/cairnkeep:2.23.0
    ```
 
 2. Start the stdio server with a read-only root filesystem and no Linux
@@ -38,7 +38,7 @@ ephemeral; the named course volume is persistent.
      --read-only --cap-drop=all --security-opt=no-new-privileges \
      --tmpfs=/tmp:rw,noexec,nosuid,size=64m,mode=1777 \
      --volume cairnkeep-course-data:/data:Z,U \
-     ghcr.io/cairnkeep/cairnkeep:2.22.4 stdio
+     ghcr.io/cairnkeep/cairnkeep:2.23.0 stdio
    ```
 
 3. The process waits quietly for MCP input. Press `Ctrl-C` after confirming it

package/docs/learning/lessons/L02-installation.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.22.4 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.0 and Node.js 22 or newer
 
 ## Outcome
 
@@ -47,7 +47,7 @@ sync. Codex project trust remains an explicit operator decision.
 2. Install Cairnkeep:
 
    ```bash
-   npm install --global @cairnkeep/cli@2.22.4
+   npm install --global @cairnkeep/cli@2.23.0
    cairn --version
    ```
 

package/docs/learning/lessons/L03-first-project.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.22.4
+**Tested with:** Cairnkeep 2.23.0
 
 ## Outcome
 

package/docs/learning/lessons/L04-memory-fundamentals.md

@@ -15,6 +15,10 @@ review extracted candidates before they become durable memory.
 - Key families: `decisions/`, `pitfalls/`, `patterns/`, `bugs/`,
   `constraints/`, and `conventions/`.
 - Exact read versus semantic search and substring fallback.
+- Optional hybrid lexical/identifier admission, explicit aliases, match reasons
+  and valid empty results; similarity scores are not factual confidence.
+- Curated Markdown as a credible baseline; indexing policy and storage format
+  are separate decisions.
 - Superseding a fact without losing history.
 - Session-end candidate extraction and `/memory-review` as the acceptance gate.
 - Typed node metadata, tags, and hard filters as an independent opt-in.
@@ -27,10 +31,24 @@ Store three synthetic facts in different categories, retrieve them by an
 imprecise query, supersede one, inspect its history, and reject one staged
 candidate.
 
+From a source checkout, run:
+
+```sh
+npm --prefix mcp-memory-server run study:memory-retrieval
+```
+
+Compare the 0/100/1,000-distractor results and explain
+why Markdown with the same admission policy matches Cairnkeep. Inspect the
+semantic-only case that lexical modes miss; do not describe the synthetic
+report as general accuracy. Repeat retrieval after superseding a synthetic
+fact and starting a fresh client, verifying the new value and explicit history.
+
 ## Acceptance criteria
 
 - The learner can justify the scope and category for each fact.
 - Search finds a fact without requiring its exact key.
+- A nearby but incorrect identifier and an unrelated query return no hybrid
+  match; aliases never widen scope or grant authority.
 - Superseding preserves the prior value in history.
 - No extracted candidate becomes durable without an explicit review action.
 - Enabling typed nodes changes discovery structure, not the authority of a fact.
@@ -38,5 +56,7 @@ candidate.
 ## Source material
 
 - [Operating guide](../../operating.md#the-workflow)
+- [Memory retrieval and the Markdown baseline](../../memory-retrieval.md)
+- [Recording supplement](../video-scripts/V04-memory-retrieval-supplement.md)
 - [Storage and deployment](../../storage.md)
 - [L14 - Typed memory and controlled import](L14-typed-memory.md)

package/docs/learning/lessons/L19-validated-skill-improvement.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Evidence and Evaluation
 **Time:** 50 minutes
-**Tested with:** Cairnkeep 2.22.4
+**Tested with:** Cairnkeep 2.23.0
 
 ## Outcome
 

package/docs/learning/lessons/L20-mcp-tool-profiles.md

@@ -1,7 +1,7 @@
 # L20 - Least-authority MCP tool profiles
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.22.4 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.0 and Node.js 22 or newer
 **Time:** 25 minutes
 
 ## Outcome

package/docs/learning/lessons/L21-context-packs.md

@@ -1,7 +1,7 @@
 # L21 - Immutable context packs and skill approval
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.22.4 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.0 and Node.js 22 or newer
 **Time:** 40 minutes
 
 ## Outcome

package/docs/learning/lessons/L22-native-windows.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Operator
 **Time:** 30 minutes
-**Tested with:** Cairnkeep 2.22.4, Windows x64, and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.0, Windows x64, and Node.js 22 or newer
 
 ## Outcome
 
@@ -16,7 +16,7 @@ perform a reversible uninstall without relying on WSL or Git Bash.
 From PowerShell:
 
 ```powershell
-npm install --global @cairnkeep/cli@2.22.4
+npm install --global @cairnkeep/cli@2.23.0
 cairn version
 
 $Lab = Join-Path $env:TEMP 'Cairnkeep Windows Lab'

package/docs/learning/lessons/L23-guided-setup.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart and Operator
 **Time:** 35 minutes
-**Tested with:** Cairnkeep 2.22.4; Pi 0.84.1; Node.js 22, 24, and 26
+**Tested with:** Cairnkeep 2.23.0; Pi 0.84.1; Node.js 22, 24, and 26
 
 ## Outcome
 

package/docs/learning/lessons/L24-okf-exchange.md

@@ -1,7 +1,7 @@
 # L24 - Reviewed knowledge exchange
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.22.4 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L25-playbooks.md

@@ -1,7 +1,7 @@
 # L25 - Bounded workflow playbooks
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.22.4 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L26-context-intelligence.md

@@ -1,7 +1,7 @@
 # L26 - Context intelligence with explicit authority
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.22.4 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L27-ecosystem-evidence.md

@@ -1,6 +1,6 @@
 # L27 - Evaluate context companions without moving authority
 
-**Tested with:** Cairnkeep 2.22.4 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L28-security-assurance.md

@@ -1,7 +1,7 @@
 # L28 - Verify Cairnkeep's security posture
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.22.4 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.23.0 and Node.js 22 or newer
 
 ## Outcome
 
@@ -11,7 +11,7 @@ and choose least authority for a network-facing MCP client.
 
 ## Prerequisites
 
-- Install Cairnkeep 2.22.4 or use a disposable source checkout.
+- Install Cairnkeep 2.23.0 or use a disposable source checkout.
 - Complete [L20 - Least-authority MCP tool profiles](L20-mcp-tool-profiles.md).
 - Use synthetic values only; never paste a real bearer token into a recording,
   terminal transcript, or issue.
@@ -76,6 +76,8 @@ node mcp-memory-server/scripts/smoke-outbound-security.mjs
 node scripts/test-runtime-file-security.mjs
 node scripts/test-omp-staged-security.mjs
 node scripts/test-container-health.mjs
+node mcp-memory-server/scripts/smoke-note-mcp.mjs --fixture-security-only
+node scripts/verify-phase19-runtime-evidence.mjs --self-test
 ```
 
 The baseline rejects unpinned external Actions, `pull_request_target` and
@@ -89,6 +91,15 @@ These are static contract checks, not a live publication test. The npm secret
 is a separate credential, and steps within one job share its token authority.
 Do not republish an immutable version to demonstrate the test.
 
+For post-publication evidence, run `node scripts/test-release-verification.mjs`
+and read [Repeatable post-publication verification](../../releasing.md#repeatable-post-publication-verification).
+The offline mutations reject mismatched trees/assets and failed signature or
+provenance decisions; they do not validate real signatures. The explicit live
+verifier checks the published artifacts with npm and the GitHub CLI and writes
+a new report only after success. Its report says `deployment_verified: false`:
+server backups, canaries and project doctors remain separate rollout evidence.
+Never publish or upgrade a service just to record this exercise.
+
 The smoke tests cover token non-disclosure, request bounds, and deterministic
 portable-path adversarial cases.
 
@@ -141,6 +152,15 @@ retrieval still sends a query to the explicitly configured external provider.
 AnythingLLM responses have an 8 MiB cap; OpenViking retains its 1 MiB cap and
 separate consent gates. Prefer HTTPS outside loopback.
 
+In a checkout with the developer-evidence follow-up, the focused note control
+shows that exclusive fixture creation preserves a competing file and that the
+actual note transaction rejects a substituted pre-image. Hashing is bounded
+at 64 MiB, including same-inode growth checks. The runtime-evidence self-test
+rejects changed or replaced log files under its existing 16 MiB cap. Developer
+snapshots and corrupt-database controls still compare exact bytes; static log
+labels cannot turn provider text into forged passing results. This does not
+make multi-file note publication atomic or prove an empty analysis backlog.
+
 ## Common failures
 
 - A private `.ai` file is group/world accessible on POSIX: restore mode `0600`.

package/docs/learning/tracks/operator.md

@@ -2,7 +2,7 @@
 
 **Audience:** advanced users and platform maintainers
 **Prerequisite:** Practitioner track; L13 before operating captured evidence
-**Total time:** about 6 hours 45 minutes
+**Total time:** about 6 hours 45 minutes, plus optional evidence/security supplements
 
 1. [L09 - Domain knowledge with RAG](../lessons/L09-domain-knowledge.md)
 2. [L10 - Faster context exploration](../lessons/L10-context-exploration.md)
@@ -17,6 +17,8 @@
 11. [L24 - Reviewed knowledge exchange](../lessons/L24-okf-exchange.md)
 12. [L25 - Bounded workflow playbooks](../lessons/L25-playbooks.md)
 13. [L26 - Context intelligence with explicit authority](../lessons/L26-context-intelligence.md)
+14. [L27 - Evaluate ecosystem ideas with bounded evidence](../lessons/L27-ecosystem-evidence.md)
+15. [L28 - Verify Cairnkeep's security posture](../lessons/L28-security-assurance.md)
 
 All modules are optional. The track is complete when the operator can add and
 remove each integration without breaking the standalone local workflow and can
@@ -27,6 +29,9 @@ L24 adds portable exchange only after the immutable-pack and privacy boundaries
 are understood.
 L25 adds policy enforcement and the unauthenticated local actor boundary before
 any future team deployment.
+L27 separates protocol observations from measured task benefits. L28 adds
+deployment posture, adversarial source-checkout controls and exact-source
+release verification; a verified artifact is not a verified fleet rollout.
 
 Hands-on spine: `course-04-operation`, `course-06-governance`, and
 `course-07-evaluation`, `course-10-trust-context`, and

package/docs/learning/video-scripts/V04-memory-retrieval-supplement.md

@@ -0,0 +1,34 @@
+# V04 supplement — Finding the current fact without flooding context
+
+Technical recording brief; no video is claimed as recorded. Use the source
+checkout containing hybrid memory search and only invented fixture content.
+
+## Real terminal demonstration
+
+Type at readable human speed, leaving pauses after each command:
+
+```sh
+npm --prefix mcp-memory-server run build
+npm --prefix mcp-memory-server run check:memory-retrieval
+npm --prefix mcp-memory-server run study:memory-retrieval
+```
+
+Zoom into the real MCP test's new-process handoff, superseded-history exclusion,
+wrong-identifier refusal and provider-failure result. Demonstrate an MCP call
+with `strategy: "hybrid"` and `explain: true`; show matched terms and source
+locators, then show an unrelated query returning zero results. Explain that
+agents still verify maintained sources and do not automatically correct memory.
+
+## Evidence and pacing
+
+Show the frozen 1,000-distractor table: 3/9 first hits for substring, 8/9 for
+BM25 and hybrid. Pause on the difference in irrelevant bytes and negative hits.
+Then highlight that Markdown with the same admission policy also achieves 8/9
+and zero negative hits. State that storage format did not cause the gain.
+
+Finish with the semantic-only paraphrase that lexical modes miss. Explain that
+provider-specific thresholds need their own evidence, that a ranking score is
+not confidence, and that the attempted live study failed with HTTP 502. Do not
+invent a successful live result or claim general task-quality improvements.
+Use short terminal zooms and side-by-side result comparisons instead of static
+slides; keep credentials and real memory off screen.

package/docs/learning/video-scripts/V28-security-assurance.md

@@ -121,6 +121,26 @@ permissions, but steps in a job still share authority and the npm secret is
 separate. The baseline checks declared grants; do not present it as a successful
 live publish or rerun a release merely for this recording.
 
+In the release-verification supplement, run
+`node scripts/test-release-verification.mjs` using only the synthetic corpus.
+Show a mismatched tree, altered asset and failed provenance decision, then
+contrast offline policy coverage with the explicitly invoked live verifier in
+`docs/releasing.md`. Show only public artifact metadata from an already
+completed release, never tokens or raw diagnostics. Pause on
+`deployment_verified: false`: signed artifact evidence does not prove that a
+server was upgraded or its project routes still work. Do not publish or
+upgrade production for a demonstration.
+
+For the developer-evidence supplement, run
+`node mcp-memory-server/scripts/smoke-note-mcp.mjs --fixture-security-only` and
+`node scripts/verify-phase19-runtime-evidence.mjs --self-test` in a built source
+checkout. Pause on the competing-file preservation and actual transaction
+pre-image replacement controls. Explain that hashing uses one bounded inspected
+descriptor, not a pathname check followed by reopening. Contrast integrity of
+a read with atomicity of a multi-file transaction: this patch improves the
+former, not the latter. Use synthetic files and keep historical alert status
+separate from a green test result; record only after the release gates pass.
+
 ### 9:20–10:30 — Read the residual risks
 
 End on `docs/security-assurance.md`, not on a green checkmark. Call out the