@cairnkeep/cli 2.23.1 → 2.24.0

package/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable user-facing changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [2.24.0] - 2026-10-24
+
+### Memory retrieval
+
+- Add optional provider-neutral learned reranking for ordinary memory search,
+  with explicit endpoint/model consent and a separate optional credential.
+  Preserve existing scope, current-value, typed and relevance admission;
+  bound candidate text, streamed responses and deadlines. Provider failures
+  preserve the original ranking. Exact keys, including explicit aliases,
+  retain priority. Default search behavior stays unchanged.
+- Add functional POSIX/native-Windows diagnostics, real MCP isolation/fallback
+  controls and a frozen synthetic provider comparison. Document both improved
+  first-result ordering and the regression; do not claim better general recall
+  or agent productivity. Update retrieval/privacy guidance and L04/V04 material.
+- Preserve frozen fixture bytes on Windows and verify linked-install probes.
+  No new runtime dependency, storage migration, automatic provider discovery
+  or team-feature activation is included.
+
+### Security
+
+- Refresh compatible transitive HTTP parser, URI and IP-address dependencies
+  in both lock graphs. Enforce the patched minimum versions, including nested
+  copies, with dependency-policy regression controls.
+- Normalize the container health-check directory's traversal permissions after
+  copying its probe. Verify the legacy entrypoint imports as the runtime UID;
+  do not count module-load failures as successful credential rejection.
+
 ## [2.23.1] - 2026-10-22
 
 ### Domain knowledge

package/docs/containers.md

@@ -86,6 +86,10 @@ configuration fails without issuing a request; probes target only
 `127.0.0.1` and refuse redirects. The existing
 `/usr/local/lib/cairnkeep/container-healthcheck.mjs` command remains available
 as an alias to the packaged probe. Stdio mode requires no HTTP probe.
+The image explicitly makes the probe directory searchable by its unprivileged
+runtime user after copying the file. The OCI regression imports that legacy
+entrypoint as UID 10001 before testing credentials, so a missing or inaccessible
+module cannot be mistaken for a successful authentication rejection.
 File-based probes require a private token readable by the container user;
 world-readable secret mounts fail closed. The Quadlet example explicitly mounts
 its secret as UID/GID 10001 with mode `0400`. For other engines, verify the

package/docs/learning/CURRICULUM-MAP.md

@@ -1,6 +1,6 @@
 # Curriculum Coverage Map
 
-**Baseline:** Cairnkeep 2.23.1
+**Baseline:** Cairnkeep 2.24.0
 **Last reviewed:** 2026-10-22
 
 This map prevents the course from drifting behind the product. It assigns each

package/docs/learning/FEATURE-GUIDE.md

@@ -1,6 +1,6 @@
 # Cairnkeep feature guide
 
-**Baseline:** Cairnkeep 2.23.1
+**Baseline:** Cairnkeep 2.24.0
 
 This is the step-back map for choosing and operating Cairnkeep features. The
 [course labs](https://github.com/cairnkeep/cairnkeep-course-labs) provide one
@@ -42,6 +42,13 @@ match/source/conflict explanations without changing legacy defaults. See
 and its recording supplement. The synthetic Markdown comparison measures
 retrieval policy, not general task quality or a storage-format advantage.
 
+Version 2.24 adds an optional, separately configured ranking
+service, not a chat agent or memory authority. It remains default-off. See
+[its bounded provider comparison and regression](../memory-retrieval.md#optional-learned-reranking)
+before enabling it; L04 and its recording supplement cover the privacy,
+doctor and fallback controls. The default-off team preview is separate and is
+not included in this release.
+
 ## The three-layer model
 
 1. **Memory server:** an MCP process that owns scoped durable storage. The

package/docs/learning/lessons/L00-why-cairnkeep.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 10 minutes
-**Tested with:** Cairnkeep 2.23.1
+**Tested with:** Cairnkeep 2.24.0
 
 ## Outcome
 

package/docs/learning/lessons/L01-safe-trial.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 15 minutes
-**Tested with:** Cairnkeep 2.23.1
+**Tested with:** Cairnkeep 2.24.0
 
 ## Outcome
 
@@ -26,7 +26,7 @@ ephemeral; the named course volume is persistent.
 1. Pull the public image:
 
    ```bash
-   podman pull ghcr.io/cairnkeep/cairnkeep:2.23.1
+   podman pull ghcr.io/cairnkeep/cairnkeep:2.24.0
    ```
 
 2. Start the stdio server with a read-only root filesystem and no Linux
@@ -38,7 +38,7 @@ ephemeral; the named course volume is persistent.
      --read-only --cap-drop=all --security-opt=no-new-privileges \
      --tmpfs=/tmp:rw,noexec,nosuid,size=64m,mode=1777 \
      --volume cairnkeep-course-data:/data:Z,U \
-     ghcr.io/cairnkeep/cairnkeep:2.23.1 stdio
+     ghcr.io/cairnkeep/cairnkeep:2.24.0 stdio
    ```
 
 3. The process waits quietly for MCP input. Press `Ctrl-C` after confirming it

package/docs/learning/lessons/L02-installation.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
 
 ## Outcome
 
@@ -47,7 +47,7 @@ sync. Codex project trust remains an explicit operator decision.
 2. Install Cairnkeep:
 
    ```bash
-   npm install --global @cairnkeep/cli@2.23.1
+   npm install --global @cairnkeep/cli@2.24.0
    cairn --version
    ```
 

package/docs/learning/lessons/L03-first-project.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.23.1
+**Tested with:** Cairnkeep 2.24.0
 
 ## Outcome
 

package/docs/learning/lessons/L04-memory-fundamentals.md

@@ -53,6 +53,18 @@ fact and starting a fresh client, verifying the new value and explicit history.
 - No extracted candidate becomes durable without an explicit review action.
 - Enabling typed nodes changes discovery structure, not the authority of a fact.
 
+## Optional reranker extension
+
+From a source checkout of 2.24.0 or newer, run `npm --prefix mcp-memory-server run check:memory-reranker`
+without a provider. Then, only with explicit synthetic-data/provider consent,
+compare the frozen live study in the retrieval guide. Explain both the 6/16
+to 15/16 first-result improvement and the single regression; this is not a
+general accuracy or agent-productivity claim. Show that reranking is off by
+default, has a separate credential, preserves admission and exact-key priority,
+and falls back without mutating stored facts. A failed provider must make
+`cairn doctor` fail even though search still works. Read-only is not a promise
+of zero network traffic: configured search advertises open-world behavior.
+
 ## Source material
 
 - [Operating guide](../../operating.md#the-workflow)

package/docs/learning/lessons/L19-validated-skill-improvement.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Evidence and Evaluation
 **Time:** 50 minutes
-**Tested with:** Cairnkeep 2.23.1
+**Tested with:** Cairnkeep 2.24.0
 
 ## Outcome
 

package/docs/learning/lessons/L20-mcp-tool-profiles.md

@@ -1,7 +1,7 @@
 # L20 - Least-authority MCP tool profiles
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
 **Time:** 25 minutes
 
 ## Outcome

package/docs/learning/lessons/L21-context-packs.md

@@ -1,7 +1,7 @@
 # L21 - Immutable context packs and skill approval
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
 **Time:** 40 minutes
 
 ## Outcome

package/docs/learning/lessons/L22-native-windows.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Operator
 **Time:** 30 minutes
-**Tested with:** Cairnkeep 2.23.1, Windows x64, and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.24.0, Windows x64, and Node.js 22 or newer
 
 ## Outcome
 
@@ -16,7 +16,7 @@ perform a reversible uninstall without relying on WSL or Git Bash.
 From PowerShell:
 
 ```powershell
-npm install --global @cairnkeep/cli@2.23.1
+npm install --global @cairnkeep/cli@2.24.0
 cairn version
 
 $Lab = Join-Path $env:TEMP 'Cairnkeep Windows Lab'

package/docs/learning/lessons/L23-guided-setup.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart and Operator
 **Time:** 35 minutes
-**Tested with:** Cairnkeep 2.23.1; Pi 0.84.1; Node.js 22, 24, and 26
+**Tested with:** Cairnkeep 2.24.0; Pi 0.84.1; Node.js 22, 24, and 26
 
 ## Outcome
 

package/docs/learning/lessons/L24-okf-exchange.md

@@ -1,7 +1,7 @@
 # L24 - Reviewed knowledge exchange
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L25-playbooks.md

@@ -1,7 +1,7 @@
 # L25 - Bounded workflow playbooks
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L26-context-intelligence.md

@@ -1,7 +1,7 @@
 # L26 - Context intelligence with explicit authority
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L27-ecosystem-evidence.md

@@ -1,6 +1,6 @@
 # L27 - Evaluate context companions without moving authority
 
-**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L28-security-assurance.md

@@ -1,7 +1,7 @@
 # L28 - Verify Cairnkeep's security posture
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
 
 ## Outcome
 
@@ -11,7 +11,7 @@ and choose least authority for a network-facing MCP client.
 
 ## Prerequisites
 
-- Install Cairnkeep 2.23.1 or use a disposable source checkout.
+- Install Cairnkeep 2.24.0 or use a disposable source checkout.
 - Complete [L20 - Least-authority MCP tool profiles](L20-mcp-tool-profiles.md).
 - Use synthetic values only; never paste a real bearer token into a recording,
   terminal transcript, or issue.

package/docs/learning/video-scripts/V04-memory-retrieval-supplement.md

@@ -32,3 +32,16 @@ not confidence, and that the attempted live study failed with HTTP 502. Do not
 invent a successful live result or claim general task-quality improvements.
 Use short terminal zooms and side-by-side result comparisons instead of static
 slides; keep credentials and real memory off screen.
+
+## Optional reranker segment (2.24.0 or newer source checkout)
+
+Record real `check:memory-reranker` output, pausing on the no-network default,
+scope/history canaries and provider-failure fallback. With explicit synthetic
+provider configuration, run `run-memory-reranker-study.mjs --live --summary`.
+Do not show credentials or endpoint addresses. Compare the two arms using the
+same embeddings: the first frozen run improved first hits from 6/16 to 15/16,
+but `current-not-history` regressed. Zoom into that failure rather than hiding
+it. Explain that the earlier HTTP-502 study is separate and remains a failed
+run. Demonstrate the doctor's synthetic request, then disable reranking and
+show unchanged memory text and provenance. This is a recording brief, not a
+claim that this segment has been filmed or published.

package/docs/mcp-tool-profiles.md

@@ -41,3 +41,10 @@ The default `full` profile preserves the same tool names, schemas, responses,
 feature gates, and ordering as an unconfigured server. The annotations help
 conservative clients distinguish observations from actions; they do not grant
 permission or replace the client's approval policy.
+
+With a valid, explicitly enabled memory reranker, `memory_search` advertises
+`openWorldHint: true` because query and bounded candidate excerpts can reach
+the configured service. It remains `readOnlyHint: true`, so a read-only
+profile still exposes it. Tool restriction is not network consent: omit it
+from a custom profile or disable reranking if that data flow is unwanted.
+With reranking off, existing discovery metadata is unchanged.

package/docs/memory-retrieval.md

@@ -161,8 +161,90 @@ Its sample threshold of 0.75 is an evaluation arm, not a recommended default.
 An attempted live run during development accepted short probes but failed with
 HTTP 502 on some fixture inputs. No successful live-model result is claimed.
 The offline suite never requires a model, API key, paid service or network beyond
-its own loopback fixture. An optional learned reranker remains deferred until
-provider-specific evidence demonstrates a benefit beyond this simpler policy.
+its own loopback fixture. A separate optional reranker comparison below does
+not replace this older study or retroactively make that failed run successful.
+
+## Optional learned reranking
+
+Available since Cairnkeep 2.24.0. This feature improves ordering, not guaranteed
+recall: the small live comparison below retained the same Recall@3 in both arms.
+
+The optional reranker is default-off and independent of extraction and
+embeddings. Set `CAIRN_MEMORY_RERANK=1`, `CAIRN_MEMORY_RERANK_URL` (a base URL,
+normally ending in `/v1`) and `CAIRN_MEMORY_RERANK_MODEL` on the memory-server
+process. The client appends `/rerank`. If authentication is needed, set the
+separate `CAIRN_MEMORY_RERANK_API_KEY`; extraction/embedding credentials are
+never reused. `CAIRN_MEMORY_RERANK_TIMEOUT_MS` defaults to 2,000 ms and accepts
+100–10,000 ms. Restart the server after configuration changes.
+
+Only `memory_search` in the `memory` address space is reranked, for either
+legacy or hybrid strategy. Notes, context packs, documents and the separate
+team store are unchanged. Existing scope, current-value, typed and relevance
+filters admit candidates first. The provider receives the original query
+(at most 4 KiB) and at most 50 admitted key/value excerpts (at most 4 KiB each),
+not the whole store. Candidate depth is `min(50, max(32, 4 * top_k))`.
+Exact-key priority in hybrid search (including explicit aliases) and typed legacy exact-hit priority remain
+ahead of model scores. The provider only reorders admitted records; it cannot
+add facts, change authority, write memory or recover a candidate already
+rejected by admission. A small final `top_k` can include a candidate outside
+the original top-k prefix after reranking.
+
+The endpoint must return every candidate index exactly once in a `results`
+array with finite `relevance_score` numbers. Negative raw scores are accepted;
+these are ranking values, not calibrated confidence. Returned memory text,
+provenance and existing retrieval scores are unchanged; those scores need not
+be descending after learned reranking. Ties preserve the
+existing order. Timeout, HTTP errors, redirects, oversized responses, invalid
+configuration or malformed/partial indices preserve the original order.
+No retries or alternate provider fallback are made. Unset/disabled configuration
+performs no reranker request and preserves existing discovery and responses.
+When configured, `memory_search` remains read-only but advertises
+`openWorldHint: true` because it can export candidate text.
+
+`cairn doctor` uses synthetic text to check configured reranking and fails if
+the configuration or response is invalid. Ordinary searches still fall back
+safely; doctor does not mistake fallback for a healthy provider.
+
+### Bounded provider comparison
+
+The frozen `memory-reranker-study-v1.json` fixture contains 20 synthetic
+continuity cases, including 16 positive and four negative cases. Both arms use
+the same embedding vectors, admission rules, aliases and final top three.
+Labels and the fixture digest were frozen before the first live ranking run.
+
+| Metric | Hybrid + embeddings | Same candidates + reranker |
+|---|---:|---:|
+| Relevant first result, 16 positive cases | 6/16 | 15/16 |
+| MRR@3 | 0.635417 | 0.968750 |
+| NDCG@3 | 0.728416 | 0.976933 |
+| Recall@3 | 1.0 | 1.0 |
+| Negative queries returning results, 4 cases | 0/4 | 0/4 |
+
+Ten cases improved and **one regressed**: `current-not-history` ranked a
+topical interface distractor above the correct current fact. Hidden history
+was still excluded. No scope/history violation or provider failure occurred.
+Observed additional ranking latency was 9 ms median and 46 ms p95 in this
+small local run; this is not a deployment latency guarantee.
+
+This is an engineering-labeled synthetic comparison with deliberately
+ambiguous topical distractors, not an independent holdout, a human study or
+proof of general agent-quality gains. It justifies an optional experiment,
+not default enablement. Evaluate your provider and corpus before opting in;
+disable `CAIRN_MEMORY_RERANK` to reverse the change.
+
+From a source checkout (these developer study scripts are not installed CLI
+commands):
+
+```sh
+npm --prefix mcp-memory-server run check:memory-reranker
+# Requires explicit existing embedding and reranker configuration:
+node mcp-memory-server/scripts/run-memory-reranker-study.mjs --live --summary
+```
+
+Without `--live`, the study makes no provider calls even when configured.
+Reports include fixture, implementation and model-ID digests, no URLs or keys.
+The frozen fixture SHA-256 is
+`f6a5d2de8d2846dd5a8de764096d92255716592805e8abfdc771181eac23beb1`.
 
 ## Research connection
 

package/docs/operating.md

@@ -495,6 +495,11 @@ vendor or host.
 | `CAIRN_MEMORY_EMBEDDING_URL` | Embeddings endpoint (falls back to `CAIRN_LLM_API_URL`) |
 | `CAIRN_MEMORY_EMBEDDING_MODEL` | Embedding model name (required for semantic search) |
 | `CAIRN_MEMORY_EMBEDDING_TIMEOUT_MS` | Embedding request timeout before substring fallback (default `15000`) |
+| `CAIRN_MEMORY_RERANK` | Explicit `1` enables optional learned memory-search reranking; off by default |
+| `CAIRN_MEMORY_RERANK_URL` | Explicit HTTP(S) base URL; client appends `/rerank`; no embedded credentials, query or fragment |
+| `CAIRN_MEMORY_RERANK_MODEL` | Required model identifier when reranking is enabled |
+| `CAIRN_MEMORY_RERANK_API_KEY` | Optional separate reranker credential; no extraction/embedding key fallback |
+| `CAIRN_MEMORY_RERANK_TIMEOUT_MS` | Reranking deadline, default `2000`, allowed `100`–`10000`; failure preserves existing search order |
 | `CAIRN_AGENTFS_BASE_DIR` | Server-side base dir for named/global memory scopes (default `~/.cairnkeep`); it does not affect `project` scope |
 | `CAIRN_TRAJECTORY_CAPTURE` | Opt in to local structured session capture (`1`, `true`, `yes`, or `on`; unset/default → no capture work) |
 | `CAIRN_TRAJECTORY_SESSION_MAX_BYTES` | Maximum serialized bytes per session (default `5242880`, 5 MiB; minimum 1024) |

package/docs/privacy-and-data-flow.md

@@ -3,7 +3,8 @@
 Cairnkeep has no telemetry, analytics collector, hosted control plane, or
 automatic remote-service discovery. A default local stdio installation stores
 memory in SQLite on the machine running the MCP server and makes no model or RAG
-request unless the corresponding endpoint and credential are configured.
+request unless the corresponding feature is explicitly configured as described
+below (some operator-owned endpoints do not require a credential).
 
 ## Data flows
 
@@ -11,6 +12,7 @@ request unless the corresponding endpoint and credential are configured.
 |---|---|---|
 | Local substring search | None | Local SQLite only |
 | Embedding-ranked search | Stored memory values that are not cached, plus the search query | `CAIRN_MEMORY_EMBEDDING_URL` or `CAIRN_LLM_API_URL` |
+| Separately opted-in memory reranking | Query and at most 50 scope/current/filter-admitted key/value excerpts, each at most 4 KiB | Only the explicit `CAIRN_MEMORY_RERANK_URL`; separate optional credential, no retries/redirects/alternate hosts |
 | `memory_extract` | The transcript supplied to the tool | `CAIRN_LLM_API_URL` |
 | `domain_knowledge_query` | Workspace slug and query | `ANYTHINGLLM_BASE_URL` |
 | `domain_knowledge_sync` | Files selected by the sync configuration | `ANYTHINGLLM_BASE_URL` |
@@ -50,6 +52,10 @@ Model endpoints may be local or remote. Cairnkeep cannot determine a provider's
 retention, training, or logging policy; verify it before sending confidential
 material. Disabling `CAIRN_LLM_API_KEY`, `ANYTHINGLLM_API_KEY`, remote HTTP
 registration, and delegated tools keeps the core memory workflow local.
+Also leave `CAIRN_MEMORY_RERANK` unset to disable its independent data flow;
+it does not require or inherit `CAIRN_LLM_API_KEY`. A local provider is still a
+separate process that receives these excerpts. Neither a chat agent nor a
+research assistant is part of reranking or authorization.
 
 ## Playbook decision and receipt flow
 
@@ -91,11 +97,14 @@ backups/journals are sensitive local data at rest. Dry-run and commit responses
 contain scopes/address spaces, digests, keys, actions, and counts—not supplied
 or displaced values. No model, API key, endpoint, or network is required.
 
-The existing explicitly configured embedding search is the sole related egress:
-eligible key/value/type/tag text and the query may be sent to
+Explicitly configured embedding search can send eligible key/value/type/tag
+text and the query to
 `CAIRN_MEMORY_EMBEDDING_URL` (or its documented fallback). Hard filters run
 before that request; endpoint failure returns to local substring search. Note
-search is always local and never uses embeddings.
+search is always local and never uses embeddings or reranking. Separately
+opting into the [bounded reranker](memory-retrieval.md#optional-learned-reranking)
+can also send admitted memory excerpts and the query. It only changes ordering,
+never scope, history admission, approval, factual authority or durable memory.
 
 Canonical note storage includes manifest records, Markdown, indexes, history,
 import replay state, staged bytes, backups, and journals. Prepared/committing

package/examples/eval/bundled-fake.json

@@ -1 +1 @@
-{"identifier":"cairn-offline-fake-v1","package_version":"2.23.1","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}
+{"identifier":"cairn-offline-fake-v1","package_version":"2.24.0","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}

package/mcp-memory-server/dist/index.js

@@ -16,6 +16,7 @@ import { artifactIdSchema, artifactKindSchema, artifactMediaTypeSchema, artifact
 import { isCapabilityContractEnabled, resolveCapabilityStatus, } from "./capability-config.js";
 import { EmbeddingCache, cosineSimilarity, embedTexts, getEmbeddingConfig, hashText, } from "./embeddings.js";
 import { queryDomainKnowledge, resolveDomainRetrievalProvider } from "./domain-retrieval-provider.js";
+import { getMemoryRerankerConfig, memoryRerankCandidateCount, rerankMemoryResults } from "./memory-reranker.js";
 import { formatHostAuthority, normalizeHostAuthority, normalizeHttpHost, parseHttpPort, resolveHttpToken } from "./http-security.js";
 import { computeRepoState, exploreCacheKey, normalizeExploreQuery, readExploreCache, writeExploreCache, } from "./explore-cache.js";
 import { canonicalTagsSchema, isTypedMemoryNodesEnabled, memoryImportEnvelopeSchema, noteNodeSchema, nodeTypeSchema, } from "./node-schema.js";
@@ -377,7 +378,7 @@ function entryText(entry) {
 function embeddingCachePath(scope, projectId) {
     return join(getBaseDir(), ".embeddings", `${hashText(resolveScopePath(scope, { projectId }))}.json`);
 }
-async function semanticSearch(scope, query, topK, minScore, config = getMemoryConfig(), projectId, options = {}) {
+async function semanticSearchCandidates(scope, query, topK, minScore, config = getMemoryConfig(), projectId, options = {}) {
     const scopes = getSearchScopes(scope, config);
     const embeddingConfig = getEmbeddingConfig();
     const perScopeEntries = await Promise.all(scopes.map(async (candidate) => ({
@@ -480,6 +481,32 @@ async function semanticSearch(scope, query, topK, minScore, config = getMemoryCo
         return substringFallback();
     }
 }
+async function semanticSearch(...args) {
+    const reranker = getMemoryRerankerConfig();
+    if (!reranker)
+        return semanticSearchCandidates(...args);
+    const [, query, topK] = args;
+    const options = args[6] ?? {};
+    const candidateArgs = [...args];
+    candidateArgs[2] = memoryRerankCandidateCount(topK, reranker);
+    // The existing path still owns scope, current-value, typed and relevance
+    // admission. The external ranker never sees records rejected by that path.
+    const candidate = await semanticSearchCandidates(...candidateArgs);
+    const exactKeys = new Set([query, ...(options.aliases ?? [])].map(value => value.normalize('NFKC').toLowerCase().trim()));
+    const pinned = (entry) => options.strategy === 'hybrid'
+        ? exactKeys.has(entry.key.normalize('NFKC').toLowerCase())
+        : Boolean(options.typed && isExactTextHit(entry, query));
+    const { results } = await rerankMemoryResults(candidate.results, query, topK, reranker, pinned);
+    const retrieval = candidate.retrieval;
+    if (retrieval?.possible_conflicts) {
+        const keys = new Set(results.map(entry => entry.key));
+        // Explain only selected keys, including when the larger candidate pool
+        // falls back. Do not leak explanations for unreturned candidates.
+        return { ...candidate, results, retrieval: { ...retrieval,
+                possible_conflicts: retrieval.possible_conflicts.filter(row => keys.has(row.key)) } };
+    }
+    return { ...candidate, results };
+}
 // Confines a candidate wiki source file to inside `<repoRoot>/.planning/wiki/sources`
 // via relative()-based containment (Phase 2 SEC-0001 idiom, reused from
 // opencode/plugins/memory-recall.ts) — `resolve() === join()` misses `../`
@@ -708,8 +735,9 @@ function gitToplevel(cwd) {
 // serve many concurrent clients within one trusted server-side storage domain.
 function buildMemoryServer(context, capabilitySnapshot, withCapability, toolProfile = resolveMcpToolProfile({ projectRoot: process.cwd() })) {
     const server = new McpServer({ name: "cairn-memory", version: "0.1.0" });
+    const memoryReranking = getMemoryRerankerConfig() !== null;
     const registerTool = (name, config, callback) => {
-        const metadata = metadataForTool(name);
+        const metadata = metadataForTool(name, { memoryReranking });
         if (!profileAllowsTool(toolProfile, name))
             return;
         server.registerTool(name, {

package/mcp-memory-server/dist/mcp-tool-catalog.js

@@ -45,8 +45,11 @@ export const MCP_TOOL_NAMES = Object.freeze(Object.keys(MCP_TOOL_CATALOG));
 export function isCairnToolName(value) {
     return Object.hasOwn(MCP_TOOL_CATALOG, value);
 }
-export function metadataForTool(name) {
+export function metadataForTool(name, options = {}) {
     if (!isCairnToolName(name))
         throw new Error(`MCP tool ${name} has no annotation contract.`);
+    if (name === 'memory_search' && options.memoryReranking) {
+        return { ...MCP_TOOL_CATALOG[name], annotations: { ...MCP_TOOL_CATALOG[name].annotations, openWorldHint: true } };
+    }
     return MCP_TOOL_CATALOG[name];
 }

package/mcp-memory-server/dist/memory-reranker.js

@@ -0,0 +1,109 @@
+import { z } from 'zod';
+const MAX_CANDIDATES = 50;
+const MAX_TEXT_BYTES = 4096;
+const MAX_REQUEST_BYTES = 256 * 1024;
+const MAX_RESPONSE_BYTES = 64 * 1024;
+const responseSchema = z.object({ results: z.array(z.object({
+        index: z.number().int().min(0).max(MAX_CANDIDATES - 1),
+        relevance_score: z.number().finite(),
+    })).max(MAX_CANDIDATES) });
+/** Configuration alone never grants permission: explicit opt-in is required. */
+export function getMemoryRerankerConfig(env = process.env) {
+    if (env.CAIRN_MEMORY_RERANK !== '1')
+        return null;
+    try {
+        const url = new URL(env.CAIRN_MEMORY_RERANK_URL ?? '');
+        const model = env.CAIRN_MEMORY_RERANK_MODEL?.trim();
+        const rawTimeout = env.CAIRN_MEMORY_RERANK_TIMEOUT_MS ?? '2000';
+        const timeoutMs = Number(rawTimeout);
+        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash
+            || !model || Buffer.byteLength(model) > 256 || !/^\d+$/.test(rawTimeout)
+            || !Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 10000)
+            return null;
+        const apiKey = env.CAIRN_MEMORY_RERANK_API_KEY?.trim();
+        if (apiKey && (apiKey.length > 8192 || /[\r\n]/.test(apiKey)))
+            return null;
+        return { apiUrl: url.href.replace(/\/+$/, ''), model, ...(apiKey ? { apiKey } : {}), timeoutMs };
+    }
+    catch {
+        return null;
+    }
+}
+export function memoryRerankCandidateCount(topK, config) {
+    if (!Number.isInteger(topK) || topK < 1 || topK > MAX_CANDIDATES)
+        throw new Error('Reranking requires a bounded result count.');
+    return config ? Math.min(MAX_CANDIDATES, Math.max(32, topK * 4)) : topK;
+}
+function textPrefix(value, maxUnits) {
+    let end = Math.min(value.length, maxUnits);
+    const last = value.charCodeAt(end - 1);
+    if (end < value.length && last >= 0xD800 && last <= 0xDBFF)
+        end--;
+    return value.slice(0, end);
+}
+function rankingText(entry) {
+    // Bound allocation before UTF-8 encoding, then discard an incomplete final
+    // code point rather than introducing replacement characters at the cutoff.
+    const text = `${textPrefix(entry.key, 1024)}\n${textPrefix(entry.value, MAX_TEXT_BYTES)}`;
+    const bytes = Buffer.from(text);
+    return new TextDecoder().decode(bytes.subarray(0, MAX_TEXT_BYTES), { stream: true });
+}
+async function readRankingResponse(response) {
+    if (!response.ok || !response.body || Number(response.headers.get('content-length')) > MAX_RESPONSE_BYTES) {
+        await response.body?.cancel();
+        throw new Error('Reranker response unavailable.');
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > MAX_RESPONSE_BYTES)
+                throw new Error('Reranker response exceeds limit.');
+            chunks.push(value);
+        }
+        const bytes = Buffer.concat(chunks, size);
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+        reader.releaseLock();
+    }
+}
+/** Reorder admitted records only. No input object, score, scope or value is changed. */
+export async function rerankMemoryResults(entries, query, topK, config, pinned = () => false) {
+    const baseline = entries.slice(0, topK);
+    if (!config)
+        return { results: baseline, status: 'disabled' };
+    if (entries.length < 2 || entries.length > MAX_CANDIDATES || !query.trim() || Buffer.byteLength(query) > MAX_TEXT_BYTES) {
+        return { results: baseline, status: 'skipped' };
+    }
+    try {
+        const body = JSON.stringify({ model: config.model, query, documents: entries.map(rankingText), top_n: entries.length });
+        if (Buffer.byteLength(body) > MAX_REQUEST_BYTES)
+            return { results: baseline, status: 'skipped' };
+        const response = await fetch(`${config.apiUrl}/rerank`, {
+            method: 'POST', redirect: 'manual', signal: AbortSignal.timeout(config.timeoutMs),
+            headers: { 'Content-Type': 'application/json', ...(config.apiKey ? { Authorization: `Bearer ${config.apiKey}` } : {}) },
+            body,
+        });
+        const parsed = responseSchema.parse(await readRankingResponse(response));
+        if (parsed.results.length !== entries.length
+            || new Set(parsed.results.map(row => row.index)).size !== entries.length
+            || parsed.results.some(row => row.index >= entries.length))
+            throw new Error('Invalid ranking indices.');
+        const scores = new Map(parsed.results.map(row => [row.index, row.relevance_score]));
+        const ordered = entries.map((entry, index) => ({ entry, index, pinned: pinned(entry) }));
+        ordered.sort((a, b) => Number(b.pinned) - Number(a.pinned)
+            || scores.get(b.index) - scores.get(a.index) || a.index - b.index);
+        return { results: ordered.slice(0, topK).map(row => row.entry), status: 'reranked' };
+    }
+    catch {
+        // Never return endpoint errors, response bodies or credentials to clients.
+        return { results: baseline, status: 'failed' };
+    }
+}

package/mcp-memory-server/package.json

@@ -16,6 +16,7 @@
         "check:extract": "node scripts/smoke-extract-cli.mjs",
         "check:search": "node scripts/smoke-search-e2e.mjs",
         "check:memory-retrieval": "node scripts/smoke-memory-retrieval.mjs && node scripts/smoke-memory-retrieval-mcp.mjs && node scripts/run-memory-retrieval-study.mjs --check --summary",
+        "check:memory-reranker": "node scripts/smoke-memory-reranker.mjs && node scripts/smoke-memory-reranker-mcp.mjs && node scripts/run-memory-reranker-study.mjs --check --summary",
         "study:memory-retrieval": "npm run build && node scripts/run-memory-retrieval-study.mjs --summary",
         "check:scope-guard": "node scripts/smoke-scope-guard.mjs",
         "check:http-guard": "node scripts/smoke-http-guard.mjs",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cairnkeep/cli",
-    "version": "2.23.1",
+    "version": "2.24.0",
     "description": "A durable, harness-agnostic memory + context layer for coding agents and MCP clients.",
     "license": "Apache-2.0",
     "type": "module",

package/scripts/doctor.sh

@@ -112,6 +112,23 @@ else
   skip "embedding endpoint (CAIRN_MEMORY_EMBEDDING_URL unset)"
 fi
 
+# Optional learned reranking: use the runtime validator and a synthetic request.
+# Never print provider bodies, credentials, URLs or user memory in diagnostics.
+if [[ "${CAIRN_MEMORY_RERANK:-}" == 1 ]]; then
+  if node "$CAIRN_ROOT/scripts/probe-memory-reranker.mjs" >/dev/null 2>&1; then
+    pass "memory reranker accepted a synthetic ranking request"
+  else
+    rerank_status=$?
+    if [[ "$rerank_status" == 2 ]]; then
+      fail "memory reranker configuration invalid — set CAIRN_MEMORY_RERANK_URL and CAIRN_MEMORY_RERANK_MODEL; timeout must be 100–10000 ms"
+    else
+      fail "memory reranker unavailable or returned invalid ranking data — search falls back to its existing order"
+    fi
+  fi
+else
+  skip "memory reranker (CAIRN_MEMORY_RERANK unset/not 1)"
+fi
+
 # 4. Git provider (collaboration commands). Report configuration only — auth is
 #    provider- and host-specific and lives in the wrapper, not the core.
 case "${CAIRN_GIT_PROVIDER:-}" in

package/scripts/probe-memory-reranker.mjs

@@ -0,0 +1,22 @@
+// Exit codes are a value-free doctor protocol: 0 disabled/healthy,
+// 2 invalid opt-in configuration, 3 unavailable or invalid ranking response.
+import { getMemoryRerankerConfig, rerankMemoryResults } from '../mcp-memory-server/dist/memory-reranker.js';
+import { realpathSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+export async function probeMemoryReranker() {
+  if (process.env.CAIRN_MEMORY_RERANK !== '1') return 0;
+  const config = getMemoryRerankerConfig();
+  if (!config) return 2;
+  const result = await rerankMemoryResults([
+    { key: 'health/policy', value: 'Corrections append a new release ledger entry.' },
+    { key: 'health/theme', value: 'The release ledger interface uses a dark theme.' },
+  ], 'How are release ledger corrections recorded?', 2, config);
+  return result.status === 'reranked' ? 0 : 3;
+}
+
+let invokedDirectly = false;
+try { invokedDirectly = Boolean(process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)); } catch {}
+if (invokedDirectly) {
+  process.exitCode = await probeMemoryReranker();
+}

package/scripts/test-container-health.mjs

@@ -11,6 +11,8 @@ assert.match(quadlet, /^Secret=cairnkeep-http-token,type=mount,target=http-token
   "the managed container secret must satisfy the probe's private-file contract");
 assert.match(containerfile, /COPY --chmod=644 containers\/healthcheck\.mjs \/opt\/cairnkeep\/containers\/healthcheck\.mjs/, "probe imports must resolve within the packaged server");
 assert.match(containerfile, /ln -s \/opt\/cairnkeep\/containers\/healthcheck\.mjs \/usr\/local\/lib\/cairnkeep\/container-healthcheck\.mjs/, "keep the established container probe path");
+assert.match(containerfile, /COPY --chmod=644 containers\/healthcheck\.mjs[^\n]*\nRUN chmod 755 \/opt\/cairnkeep\/containers\b/,
+  "normalize the probe directory's traversal mode after COPY for unprivileged runtime users");
 assert.match(source, /parseHttpPort/, "health destination must use the server's numeric port parser");
 assert.match(source, /resolveHttpToken/, "health tokens must use the server's bounded resolver");
 const { containerHealthcheck } = await import("../containers/healthcheck.mjs");

package/scripts/test-container.sh

@@ -43,6 +43,21 @@ image_user=$("$ENGINE" image inspect --format '{{.Config.User}}' "$server_image"
   exit 1
 }
 
+# Check the real legacy entrypoint before a failing credential probe can mask
+# a module-load or directory-traversal error as an expected authentication denial.
+"$ENGINE" run --rm --entrypoint node "$server_image" --input-type=module -e '
+  import assert from "node:assert/strict";
+  import { accessSync, constants, realpathSync } from "node:fs";
+  import { pathToFileURL } from "node:url";
+  assert.equal(process.getuid(), 10001);
+  accessSync("/opt/cairnkeep/containers", constants.R_OK | constants.X_OK);
+  const target = realpathSync("/usr/local/lib/cairnkeep/container-healthcheck.mjs");
+  assert.equal(target, "/opt/cairnkeep/containers/healthcheck.mjs");
+  accessSync(target, constants.R_OK);
+  await import(pathToFileURL(target).href);
+  console.log("container health entrypoint: readable, searchable and importable as runtime UID");
+'
+
 "$ENGINE" volume create "$volume" >/dev/null
 node scripts/probe-memory-server.mjs --command \
   "$ENGINE" run --rm -i --volume "$volume:/data" "$server_image" stdio
@@ -112,10 +127,15 @@ done
 cat "$tmp/write.out"
 # Exec probes see the original container environment, not the entrypoint's
 # loaded secret. The deliberately public bind fixture must be rejected.
-if "$ENGINE" exec "$name" node /usr/local/lib/cairnkeep/container-healthcheck.mjs; then
+if "$ENGINE" exec "$name" node /usr/local/lib/cairnkeep/container-healthcheck.mjs >"$tmp/health.out" 2>"$tmp/health.err"; then
   echo "FAIL: healthcheck accepted a non-private token file" >&2
   exit 1
 fi
+[[ ! -s "$tmp/health.out" && ! -s "$tmp/health.err" ]] || {
+  cat "$tmp/health.out" "$tmp/health.err" >&2
+  echo "FAIL: healthcheck must reject unsafe credentials without a runtime error" >&2
+  exit 1
+}
 # Exercise the same legacy entrypoint against a private, container-owned file.
 "$ENGINE" exec "$name" sh -c 'umask 077; cat /run/secrets/http-token > /tmp/health-token; CAIRN_MEMORY_HTTP_TOKEN_FILE=/tmp/health-token node /usr/local/lib/cairnkeep/container-healthcheck.mjs; status=$?; rm -f /tmp/health-token; exit "$status"'
 "$ENGINE" rm -f "$name" >/dev/null

package/scripts/test-dependency-security.mjs

@@ -25,6 +25,16 @@ function check(label, mutate, expected) {
 }
 try {
   check("valid dependency graph", () => {}, null);
+  for (const lockPath of ['package-lock.json', 'mcp-memory-server/package-lock.json']) {
+    for (const [name, vulnerable] of [['body-parser', '2.3.0'], ['fast-uri', '3.1.8'], ['ip-address', '10.7.3']]) {
+      check(`${lockPath} rejects vulnerable ${name}`, x => {
+        x[lockPath].packages[`node_modules/${name}`].version = vulnerable;
+      }, new RegExp(`resolved ${name}: requires`));
+      check(`${lockPath} rejects nested vulnerable ${name}`, x => {
+        x[lockPath].packages[`node_modules/fixture/node_modules/${name}`] = { version: vulnerable };
+      }, new RegExp(`resolved ${name}: requires`));
+    }
+  }
   check("root manifest/lock mismatch", x => { x["package.json"].dependencies.zod = "^4.0.0"; }, /manifest and lock root Zod ranges differ/);
   check("server manifest/lock mismatch", x => { x["mcp-memory-server/package-lock.json"].packages[""].dependencies.zod = "^4.0.0"; }, /manifest and lock root Zod ranges differ/);
   check("matched server range differs from packaged CLI", x => {
@@ -34,7 +44,7 @@ try {
   check("different resolved schema version", x => { x["mcp-memory-server/package-lock.json"].packages["node_modules/zod"].version = "4.0.0"; }, /root and server resolved Zod versions differ/);
   check("missing direct schema", x => { delete x["package-lock.json"].packages["node_modules/zod"]; }, /direct Zod: version must be a string/);
   check("existing SDK advisory check retained", x => { x["package-lock.json"].packages["node_modules/@modelcontextprotocol/sdk"].version = "1.0.0"; }, /resolved @modelcontextprotocol\/sdk: requires/);
-  console.log("PASS: dependency policy positive control, schema parity mutations and SDK advisory rejection");
+  console.log("PASS: dependency policy positive control, both-lock/nested advisory rejection and schema parity mutations");
 } finally {
   rmSync(scratch, { recursive: true, force: true });
 }

package/scripts/test-doctor.sh

@@ -18,12 +18,14 @@ export HOME="$tmp/home"
 mkdir -p "$HOME"
 # Clean the inherited env so the test controls what is "configured".
 unset CAIRN_LLM_API_URL CAIRN_MEMORY_EMBEDDING_URL CAIRN_GIT_PROVIDER CAIRN_AGENTFS_BASE_DIR
+unset CAIRN_MEMORY_RERANK CAIRN_MEMORY_RERANK_URL CAIRN_MEMORY_RERANK_MODEL CAIRN_MEMORY_RERANK_API_KEY CAIRN_MEMORY_RERANK_TIMEOUT_MS
 
 # 1. Nothing configured → only SKIP/PASS/WARN, exit 0.
 proj="$tmp/clean"; mkdir -p "$proj"
 ( cd "$proj" && "$doctor" ) >"$tmp/out1" 2>&1 || fail "doctor exited non-zero with nothing configured:\n$(cat "$tmp/out1")"
 grep -q "\[SKIP\]" "$tmp/out1" || fail "expected SKIP lines when nothing is configured"
 grep -q "typed metadata and note transaction state" "$tmp/out1" || fail "expected typed/note diagnostics in the public doctor output"
+grep -qF "[SKIP] memory reranker" "$tmp/out1" || fail "expected default-off reranker diagnostic"
 grep -q "artifact store (not present" "$tmp/out1" || fail "expected absent opt-in artifact diagnostics"
 grep -q "capability configuration (not present — managed overrides are unused)" "$tmp/out1" ||
   fail "expected absent capability configuration diagnostics"
@@ -92,6 +94,12 @@ const server = createServer((request, response) => {
   request.on("end", () => {
     let body = {};
     try { body = JSON.parse(Buffer.concat(chunks).toString("utf8")); } catch {}
+    if (request.url === "/v1/rerank") {
+      response.writeHead(200, { "Content-Type": "application/json" });
+      response.end(JSON.stringify({ results: body.model === "invalid-ranker" ? [] :
+        body.documents.map((_, index) => ({ index, relevance_score: -index })) }));
+      return;
+    }
     const routeValid = request.url === "/v1/embeddings";
     const keyValid = request.headers.authorization === "Bearer test-key";
     const modelValid = body.model === "test-embedding";
@@ -153,6 +161,26 @@ EOF
     fail "missing-model diagnostic leaked an upstream body or request id"
 fi
 
+# Reranker diagnostics validate configuration and actual data, not HTTP status alone.
+if [[ -n "${port:-}" ]]; then
+  ( cd "$proj" && CAIRN_MEMORY_RERANK=1 CAIRN_MEMORY_RERANK_URL="http://127.0.0.1:$port/v1" \
+      CAIRN_MEMORY_RERANK_MODEL=test-ranker "$doctor" ) >"$tmp/reranker-ok" 2>&1 ||
+    fail "doctor rejected a valid reranking response"
+  grep -qF "[PASS] memory reranker accepted a synthetic ranking request" "$tmp/reranker-ok" ||
+    fail "doctor did not probe reranking"
+  if ( cd "$proj" && CAIRN_MEMORY_RERANK=1 "$doctor" ) >"$tmp/reranker-config" 2>&1; then
+    fail "doctor accepted an incomplete opted-in reranker"
+  fi
+  grep -qF "[FAIL] memory reranker configuration invalid" "$tmp/reranker-config" ||
+    fail "doctor omitted the reranker configuration diagnostic"
+  if ( cd "$proj" && CAIRN_MEMORY_RERANK=1 CAIRN_MEMORY_RERANK_URL="http://127.0.0.1:$port/v1" \
+      CAIRN_MEMORY_RERANK_MODEL=invalid-ranker "$doctor" ) >"$tmp/reranker-invalid" 2>&1; then
+    fail "doctor mistook fallback for a healthy reranker"
+  fi
+  grep -qF "[FAIL] memory reranker unavailable or returned invalid ranking data" "$tmp/reranker-invalid" ||
+    fail "doctor omitted the invalid ranking response diagnostic"
+fi
+
 # 5. Artifact doctor passes a valid store, repairs only derived state, and
 # refuses authoritative full-record corruption without leaking stored values.
 artifact_cli="$ROOT/mcp-memory-server/dist/artifact-cli.js"

package/scripts/test-windows-native.mjs

@@ -88,10 +88,12 @@ try {
   writeFileSync(join(invalidDerivedPack, `${"e".repeat(64)}.json`), "{\"corrupt\":true}\n");
   process.env.CAIRN_PACK_BASE_DIR = packBase;
   const inheritedLlmUrl = process.env.CAIRN_LLM_API_URL;
+  const inheritedRerank = process.env.CAIRN_MEMORY_RERANK;
   const exitCodeBeforeDoctor = process.exitCode;
   const doctorWrite = process.stdout.write.bind(process.stdout);
   let doctorOutput = "";
   delete process.env.CAIRN_LLM_API_URL;
+  delete process.env.CAIRN_MEMORY_RERANK;
   process.stdout.write = ((chunk) => { doctorOutput += String(chunk); return true; });
   try {
     await runWindowsCommand({ command: "doctor", args: ["--repair"], root });
@@ -100,9 +102,12 @@ try {
     process.exitCode = exitCodeBeforeDoctor;
     if (inheritedLlmUrl === undefined) delete process.env.CAIRN_LLM_API_URL;
     else process.env.CAIRN_LLM_API_URL = inheritedLlmUrl;
+    if (inheritedRerank === undefined) delete process.env.CAIRN_MEMORY_RERANK;
+    else process.env.CAIRN_MEMORY_RERANK = inheritedRerank;
   }
   assert.equal(existsSync(invalidDerivedPack), false, "native Windows doctor forwards safe context-pack cache repair");
   assert.match(doctorOutput, /\[PASS\] context pack diagnostics passed/);
+  assert.match(doctorOutput, /\[SKIP\] memory reranker unset\/not 1/);
 
   let containerArgs = [];
   runNativeContainer(["stdio", "--image", "example/windows:1", "--volume", "windows-data"], root, (_engine, args) => { containerArgs = args; });

package/scripts/verify-dependency-security.mjs

@@ -7,9 +7,10 @@ const ROOT = resolve(process.cwd());
 const MINIMUM_SDK = [1, 32, 1];
 const MINIMUM_NODE_SERVER = [2, 0, 5];
 const TRANSITIVE_MINIMUMS = new Map([
-  ["fast-uri", [3, 1, 8]],
+  ["body-parser", [2, 4, 0]],
+  ["fast-uri", [3, 1, 9]],
   ["hono", [4, 13, 13]],
-  ["ip-address", [10, 7, 3]],
+  ["ip-address", [10, 7, 4]],
   ["proxy-addr", [2, 0, 8]],
 ]);
 const DIRECT_HONO_PACKAGES = new Set(["hono", "@hono/node-server"]);

package/scripts/windows-platform.mjs

@@ -526,6 +526,14 @@ async function doctorWindows(root, args) {
       } catch { line("FAIL", `embedding endpoint request failed (${process.env.CAIRN_MEMORY_EMBEDDING_URL})`); }
     }
   } else line("SKIP", "embedding endpoint unset");
+  if (process.env.CAIRN_MEMORY_RERANK === "1") {
+    let status = 3;
+    try { status = await (await import("./probe-memory-reranker.mjs")).probeMemoryReranker(); } catch {}
+    line(status === 0 ? "PASS" : "FAIL", status === 0
+      ? "memory reranker accepted a synthetic ranking request"
+      : status === 2 ? "memory reranker configuration invalid — set URL/model and a timeout within 100–10000 ms"
+        : "memory reranker unavailable or returned invalid ranking data — search falls back to its existing order");
+  } else line("SKIP", "memory reranker unset/not 1");
   const provider = process.env.CAIRN_GIT_PROVIDER?.trim();
   if (!provider || provider === "none") line("SKIP", "git provider unset/none; collaboration commands are off");
   else if (["github", "gitlab", "codeberg", "forgejo"].includes(provider)) line("PASS", `git provider configured: ${provider}`);