@cairnkeep/cli 2.23.1 → 2.25.0

package/CHANGELOG.md

@@ -5,6 +5,57 @@ All notable user-facing changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [2.25.0] - 2026-10-24
+
+### Team continuity preview
+
+- Add default-off `cairn team` continuity with a separate organization/project
+  store, explicit roles and expiring/revocable human or workload credentials.
+  Share only selected text through immutable proposals and different-human
+  exact-digest review. Publish approved revisions and scoped audit atomically;
+  reject self/workload review and stale policy/base revisions.
+- Add a bounded authenticated loopback JSON API and an additional local stdio
+  MCP bridge. Four observation tools and additive proposal creation intersect
+  MCP profiles/capabilities with server authorization; no review/admin MCP,
+  automatic upload, personal-store migration or production activation.
+- Add consistent verified backups, fresh-only restore with copied credentials
+  revoked, private file/ACL controls, logical deletion and uninstall retention.
+  Document manual retention, size limits and trusted-OS-owner limitations.
+- Add `cairn team member remove SUBJECT --project ID` for explicit project
+  offboarding. Preserve credentials, other memberships and audit history;
+  reject missing or empty role lists in `member set`. Update shell completions,
+  team guidance and the learning/video rehearsal.
+- Add an isolated, opt-in pilot guide with an executable setup regression:
+  separate stores, file-only expiring credentials and client profiles, unchanged
+  personal configuration, and an explicit human review boundary.
+
+## [2.24.0] - 2026-10-24
+
+### Memory retrieval
+
+- Add optional provider-neutral learned reranking for ordinary memory search,
+  with explicit endpoint/model consent and a separate optional credential.
+  Preserve existing scope, current-value, typed and relevance admission;
+  bound candidate text, streamed responses and deadlines. Provider failures
+  preserve the original ranking. Exact keys, including explicit aliases,
+  retain priority. Default search behavior stays unchanged.
+- Add functional POSIX/native-Windows diagnostics, real MCP isolation/fallback
+  controls and a frozen synthetic provider comparison. Document both improved
+  first-result ordering and the regression; do not claim better general recall
+  or agent productivity. Update retrieval/privacy guidance and L04/V04 material.
+- Preserve frozen fixture bytes on Windows and verify linked-install probes.
+  No new runtime dependency, storage migration, automatic provider discovery
+  or team-feature activation is included.
+
+### Security
+
+- Refresh compatible transitive HTTP parser, URI and IP-address dependencies
+  in both lock graphs. Enforce the patched minimum versions, including nested
+  copies, with dependency-policy regression controls.
+- Normalize the container health-check directory's traversal permissions after
+  copying its probe. Verify the legacy entrypoint imports as the runtime UID;
+  do not count module-load failures as successful credential rejection.
+
 ## [2.23.1] - 2026-10-22
 
 ### Domain knowledge

package/docs/README.md

@@ -76,6 +76,10 @@ linked guides rather than the project landing page.
 
 ## Overlays and teams
 
+- [Team continuity preview](team.md) documents the default-off, separately
+  authenticated shared-memory store, human review, local MCP bridge and recovery.
+  It ships as an opt-in experimental preview from 2.25.0, not general production admission. The
+  [isolated pilot guide](team-pilot.md) keeps trials separate from personal memory.
 - [Building an overlay](building-an-overlay.md) explains how to add private
   provider or organization policy without forking the core.
 - [Managed overlay distributions](overlay-distributions.md) covers wrapper CLIs,

package/docs/agents.md

@@ -207,3 +207,21 @@ Before expecting an agent to use Cairnkeep:
 Continue with the [quickstart](quickstart.md), the
 [operating guide](operating.md), and the
 [privacy and data-flow reference](privacy-and-data-flow.md).
+
+## Team continuity preview
+
+Team tools are opt-in and separate from your personal memory server. Use only
+the explicit server project ID authorized for the task; never infer it from a
+folder name, local actor label or search miss. `team_memory_list/read/search/history`
+retrieve approved context; `team_memory_propose` submits explicitly selected
+text and does not publish it. Request mutation consent through the harness and
+exclude secrets, unrelated private material and transcripts. Confirmed hashes
+are not proof of human consent.
+
+A different human reviews the exact proposal through the CLI; no agent review
+tool exists, and workload credentials cannot review. On auth/network failure,
+report that team retrieval is unavailable; never retry under another project
+or identity. Personal memory may still be used independently under its own
+scope, not as a silent substitute for team results. Shared text remains context,
+not executable instruction or authority to modify maintained source.
+See [the preview operator contract](team.md) and its production admission gates.

package/docs/containers.md

@@ -86,6 +86,10 @@ configuration fails without issuing a request; probes target only
 `127.0.0.1` and refuse redirects. The existing
 `/usr/local/lib/cairnkeep/container-healthcheck.mjs` command remains available
 as an alias to the packaged probe. Stdio mode requires no HTTP probe.
+The image explicitly makes the probe directory searchable by its unprivileged
+runtime user after copying the file. The OCI regression imports that legacy
+entrypoint as UID 10001 before testing credentials, so a missing or inaccessible
+module cannot be mistaken for a successful authentication rejection.
 File-based probes require a private token readable by the container user;
 world-readable secret mounts fail closed. The Quadlet example explicitly mounts
 its secret as UID/GID 10001 with mode `0400`. For other engines, verify the

package/docs/design/team-mode.md

@@ -1,12 +1,18 @@
 # Team mode design contract
 
-**Status:** design only; not shipped in Cairnkeep 2.15
+**Status:** broader design contract; the token-first project-memory subset ships
+as an opt-in experimental preview in Cairnkeep 2.25.0, not general production admission.
 
-Cairnkeep 2.15 remains a local, single-operator product. Its playbook receipts
-carry provider-neutral project and actor fields so a future authenticated team
-service can preserve provenance, but those fields are caller assertions and
-must not be used for authorization. This document defines the boundary a team
-implementation must satisfy before that statement can change.
+See [the implemented preview](../team.md) for exact commands and remaining
+admission gates. Existing personal memory is unchanged. This design includes
+future collections, identity adapters, packs and policy sharing that the preview
+does not implement. Local playbook actor fields remain unauthenticated labels.
+
+Local playbook receipts carry provider-neutral project and actor labels; those
+fields remain caller assertions and must not be used for authorization. Only
+the separate team service's verified credentials and server-side memberships
+authorize team operations. This broader design is not a claim that collections,
+identity adapters, policy distribution or every admission gate is implemented.
 
 ## Goal and non-goals
 
@@ -126,7 +132,8 @@ export paths must be documented before general availability.
 
 ## Admission gates
 
-Team mode is not releasable until all of the following have evidence:
+General production admission requires evidence for all of the following;
+shipping the bounded default-off preview does not waive these gates:
 
 1. Threat model and independent security review covering authentication,
    authorization, confused-deputy attacks, tenant isolation, and audit integrity.
@@ -141,5 +148,6 @@ Team mode is not releasable until all of the following have evidence:
 6. Operational ownership for identity-provider failures, revocation latency,
    incident response, audit export, and key rotation.
 
-Until these gates pass, Cairnkeep documentation and output must describe actor
-identity as unverified and team support as deferred.
+Until these gates pass, documentation must distinguish local unverified actor
+labels from the authenticated team preview, and experimental preview availability
+from general production admission. No production sharing is enabled by a release.

package/docs/harness-compatibility.md

@@ -353,3 +353,20 @@ Support should be added one client at a time with a clean install, a local
 stdio handshake, an authenticated HTTP handshake, a real write/recall canary,
 storage-path verification, and removal instructions. Documented MCP support by
 itself is not enough to claim Cairnkeep support.
+
+## Optional team bridge (opt-in 2.25 preview)
+
+[Team continuity](team.md) adds an additional generic local stdio MCP:
+`cairn team mcp`. It does not replace `cairn-memory`, rewrite harness config
+or change existing setup. Every call supplies a server project ID explicitly;
+the same credentials/project IDs work regardless of the starting cwd.
+Configure private file-based credentials and the separate JSON API URL in the
+client environment. Human reviewer credentials must not enter the agent's
+environment; review is CLI-only.
+
+Maintained tests use actual SDK stdio clients, profiles and live revocation.
+They do not constitute a live test of every named harness. The bridge exposes
+four observations plus explicit proposal creation, never review/admin.
+The completed internal review and isolated native pilot are not independent
+production review or a deployment-specific approved real-data pilot; both
+remain required for production support.

package/docs/learning/CURRICULUM-MAP.md

@@ -1,6 +1,6 @@
 # Curriculum Coverage Map
 
-**Baseline:** Cairnkeep 2.23.1
+**Baseline:** Cairnkeep 2.25.0
 **Last reviewed:** 2026-10-22
 
 This map prevents the course from drifting behind the product. It assigns each
@@ -45,6 +45,7 @@ been rehearsed.
 | Progressive pack retrieval, frozen benchmark, context-usage receipts, review-gated memory proposals, optional provider adapter | L26 | V26 | Ready; default flat search and AnythingLLM remain compatible; OpenViking and receipt mutation are explicitly gated |
 | Branchable agent state, model-managed context, and learned decision-model comparisons | L27 | V27 | Ready; evidence runners are operator-invoked and no companion is a runtime dependency or authority |
 | Threat model, local posture check, portable-path adversarial tests, and release security controls | L28 | V28 | Ready; diagnostic is read-only and evidence is not certification |
+| Token-first team identity, reviewed project memory, local stdio bridge, revocation and fresh-only restore | L29 | V29 | Brief; opt-in 2.25 preview; deployment-specific production admission required |
 
 ## Release Review
 
@@ -98,6 +99,7 @@ against `cairn help` so a new command cannot bypass a curriculum decision.
 | `cairn sync-omp` | L02 |
 | `cairn doctor` | L03; advanced repair in L13-L14 |
 | `cairn security` | L28 |
+| `cairn team` | L29 opt-in preview, included from 2.25.0 |
 | `cairn playbook` | L25 |
 | `cairn trajectory` | L13 |
 | `cairn artifact` | L13 |

package/docs/learning/FEATURE-GUIDE.md

@@ -1,6 +1,6 @@
 # Cairnkeep feature guide
 
-**Baseline:** Cairnkeep 2.23.1
+**Baseline:** Cairnkeep 2.25.0
 
 This is the step-back map for choosing and operating Cairnkeep features. The
 [course labs](https://github.com/cairnkeep/cairnkeep-course-labs) provide one
@@ -42,6 +42,18 @@ match/source/conflict explanations without changing legacy defaults. See
 and its recording supplement. The synthetic Markdown comparison measures
 retrieval policy, not general task quality or a storage-format advantage.
 
+Version 2.24 adds an optional, separately configured ranking
+service, not a chat agent or memory authority. It remains default-off. See
+[its bounded provider comparison and regression](../memory-retrieval.md#optional-learned-reranking)
+before enabling it; L04 and its recording supplement cover the privacy,
+doctor and fallback controls.
+
+Version 2.25 adds the separate default-off team-continuity preview: selected
+project context, exact human review, revocable project roles and an additional
+local stdio MCP bridge. Installing it enables no sharing. L29/V29 cover its
+bounded trial and the distinction between preview availability and production
+admission; team search does not use personal-memory embeddings or reranking.
+
 ## The three-layer model
 
 1. **Memory server:** an MCP process that owns scoped durable storage. The
@@ -170,3 +182,24 @@ approval, project-isolation, or release authority. See
 [L27](lessons/L27-ecosystem-evidence.md), its
 [video script](video-scripts/V27-ecosystem-evidence.md), and the pinned
 [evidence report](../research/ecosystem-evidence-2026-10.md).
+
+## Optional team continuity preview
+
+The `cairn team` surface, included from 2.25.0, is default off and separate from local
+memory. It adds project-scoped credentials/roles, immutable selected proposals,
+human-only review and an additional local stdio MCP bridge. It never scans
+personal memory or automatically installs a harness entry. Serving requires
+separate HTTP consent; this JSON API is not OAuth remote MCP HTTP.
+
+Authority is rechecked per request. Backup/restore validates integrity and
+revokes restored credentials; retention is manual, and logical deletion is not
+physical erasure. Feature/profile changes require restarting the bridge;
+revocation and membership changes take effect on existing clients.
+Removing the MCP entry or disabling its service stops team access without
+changing personal memory. Uninstall retains the separate store.
+Read [the reference](../team.md), [L29](lessons/L29-team-continuity.md) and its
+[V29 rehearsal brief](video-scripts/V29-team-continuity.md).
+The governed internal review and approved isolated native pilot are complete;
+neither substitutes for independent production review and a deployment-specific
+approved real-data pilot. This is a bounded experimental preview, not general
+production admission.

package/docs/learning/README.md

@@ -63,6 +63,7 @@ expanded only after their labs are executable.
 | L26 | [Context intelligence with explicit authority](lessons/L26-context-intelligence.md) | Ready | 45 min |
 | L27 | [Evaluate context companions without moving authority](lessons/L27-ecosystem-evidence.md) | Ready | 30 min |
 | L28 | [Verify Cairnkeep's security posture](lessons/L28-security-assurance.md) | Ready | 30 min |
+| L29 | [Reviewed team continuity preview](lessons/L29-team-continuity.md) | Brief; opt-in 2.25 preview | 40 min |
 
 The [curriculum coverage map](CURRICULUM-MAP.md) records where every public
 feature is introduced, practised, and operated. It also marks design-only work
@@ -89,6 +90,7 @@ feature.
 
 Use [the lesson template](templates/lesson-template.md). Commands in finished
 lessons must be tested against the current release before publication.
-Unpublished editorial plans and recording scripts are intentionally maintained
-outside the public product repository; stable video links or transcripts can
-be added here after publication.
+Technical lesson and rehearsal scripts in `video-scripts/` are maintained with
+the product; private editorial plans and recording evidence stay outside this
+repository. Preview scripts must not present unreleased behavior as installed
+release behavior. Stable video links can be added after publication.

package/docs/learning/lessons/L00-why-cairnkeep.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 10 minutes
-**Tested with:** Cairnkeep 2.23.1
+**Tested with:** Cairnkeep 2.25.0
 
 ## Outcome
 

package/docs/learning/lessons/L01-safe-trial.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 15 minutes
-**Tested with:** Cairnkeep 2.23.1
+**Tested with:** Cairnkeep 2.25.0
 
 ## Outcome
 
@@ -26,7 +26,7 @@ ephemeral; the named course volume is persistent.
 1. Pull the public image:
 
    ```bash
-   podman pull ghcr.io/cairnkeep/cairnkeep:2.23.1
+   podman pull ghcr.io/cairnkeep/cairnkeep:2.25.0
    ```
 
 2. Start the stdio server with a read-only root filesystem and no Linux
@@ -38,7 +38,7 @@ ephemeral; the named course volume is persistent.
      --read-only --cap-drop=all --security-opt=no-new-privileges \
      --tmpfs=/tmp:rw,noexec,nosuid,size=64m,mode=1777 \
      --volume cairnkeep-course-data:/data:Z,U \
-     ghcr.io/cairnkeep/cairnkeep:2.23.1 stdio
+     ghcr.io/cairnkeep/cairnkeep:2.25.0 stdio
    ```
 
 3. The process waits quietly for MCP input. Press `Ctrl-C` after confirming it

package/docs/learning/lessons/L02-installation.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
 
 ## Outcome
 
@@ -47,7 +47,7 @@ sync. Codex project trust remains an explicit operator decision.
 2. Install Cairnkeep:
 
    ```bash
-   npm install --global @cairnkeep/cli@2.23.1
+   npm install --global @cairnkeep/cli@2.25.0
    cairn --version
    ```
 

package/docs/learning/lessons/L03-first-project.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.23.1
+**Tested with:** Cairnkeep 2.25.0
 
 ## Outcome
 

package/docs/learning/lessons/L04-memory-fundamentals.md

@@ -53,6 +53,18 @@ fact and starting a fresh client, verifying the new value and explicit history.
 - No extracted candidate becomes durable without an explicit review action.
 - Enabling typed nodes changes discovery structure, not the authority of a fact.
 
+## Optional reranker extension
+
+From a source checkout of 2.24.0 or newer, run `npm --prefix mcp-memory-server run check:memory-reranker`
+without a provider. Then, only with explicit synthetic-data/provider consent,
+compare the frozen live study in the retrieval guide. Explain both the 6/16
+to 15/16 first-result improvement and the single regression; this is not a
+general accuracy or agent-productivity claim. Show that reranking is off by
+default, has a separate credential, preserves admission and exact-key priority,
+and falls back without mutating stored facts. A failed provider must make
+`cairn doctor` fail even though search still works. Read-only is not a promise
+of zero network traffic: configured search advertises open-world behavior.
+
 ## Source material
 
 - [Operating guide](../../operating.md#the-workflow)

package/docs/learning/lessons/L19-validated-skill-improvement.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Evidence and Evaluation
 **Time:** 50 minutes
-**Tested with:** Cairnkeep 2.23.1
+**Tested with:** Cairnkeep 2.25.0
 
 ## Outcome
 

package/docs/learning/lessons/L20-mcp-tool-profiles.md

@@ -1,7 +1,7 @@
 # L20 - Least-authority MCP tool profiles
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
 **Time:** 25 minutes
 
 ## Outcome

package/docs/learning/lessons/L21-context-packs.md

@@ -1,7 +1,7 @@
 # L21 - Immutable context packs and skill approval
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
 **Time:** 40 minutes
 
 ## Outcome

package/docs/learning/lessons/L22-native-windows.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Operator
 **Time:** 30 minutes
-**Tested with:** Cairnkeep 2.23.1, Windows x64, and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0, Windows x64, and Node.js 22 or newer
 
 ## Outcome
 
@@ -16,7 +16,7 @@ perform a reversible uninstall without relying on WSL or Git Bash.
 From PowerShell:
 
 ```powershell
-npm install --global @cairnkeep/cli@2.23.1
+npm install --global @cairnkeep/cli@2.25.0
 cairn version
 
 $Lab = Join-Path $env:TEMP 'Cairnkeep Windows Lab'

package/docs/learning/lessons/L23-guided-setup.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart and Operator
 **Time:** 35 minutes
-**Tested with:** Cairnkeep 2.23.1; Pi 0.84.1; Node.js 22, 24, and 26
+**Tested with:** Cairnkeep 2.25.0; Pi 0.84.1; Node.js 22, 24, and 26
 
 ## Outcome
 

package/docs/learning/lessons/L24-okf-exchange.md

@@ -1,7 +1,7 @@
 # L24 - Reviewed knowledge exchange
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L25-playbooks.md

@@ -1,7 +1,7 @@
 # L25 - Bounded workflow playbooks
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L26-context-intelligence.md

@@ -1,7 +1,7 @@
 # L26 - Context intelligence with explicit authority
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L27-ecosystem-evidence.md

@@ -1,6 +1,6 @@
 # L27 - Evaluate context companions without moving authority
 
-**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L28-security-assurance.md

@@ -1,7 +1,7 @@
 # L28 - Verify Cairnkeep's security posture
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.23.1 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
 
 ## Outcome
 
@@ -11,7 +11,7 @@ and choose least authority for a network-facing MCP client.
 
 ## Prerequisites
 
-- Install Cairnkeep 2.23.1 or use a disposable source checkout.
+- Install Cairnkeep 2.25.0 or use a disposable source checkout.
 - Complete [L20 - Least-authority MCP tool profiles](L20-mcp-tool-profiles.md).
 - Use synthetic values only; never paste a real bearer token into a recording,
   terminal transcript, or issue.

package/docs/learning/lessons/L29-team-continuity.md

@@ -0,0 +1,95 @@
+# L29 - Reviewed team continuity preview
+
+**Status:** Brief; opt-in experimental preview in Cairnkeep 2.25.0
+**Compatibility:** Cairnkeep 2.25.0 or newer; Node 22.13 or newer for team storage.
+Use a matching source checkout for the executable regression exercises below.
+Installing the released CLI does not enable team sharing.
+
+## Outcome
+
+Carry an approved project decision from one client process and working folder
+to another, without exposing personal memory or granting an agent review power.
+Explain the difference between a restrictive MCP profile and server membership.
+
+## Prerequisites
+
+Complete L20 and L28. Use only synthetic subjects and disposable local stores.
+Build the matching checkout with `npm --prefix mcp-memory-server ci` followed by
+`npm --prefix mcp-memory-server run build`. Read [Team continuity](../../team.md).
+Do not connect a real organization or reuse a production credential.
+For an explicitly approved native-harness trial, follow the
+[isolated pilot guide](../../team-pilot.md); do not use automated rehearsal as
+a substitute for the human review or release-admission steps.
+
+## Source-checkout rehearsal
+
+From the checkout, run the offline controls:
+
+```sh
+node mcp-memory-server/scripts/smoke-team.mjs
+node mcp-memory-server/scripts/smoke-team-review.mjs
+node mcp-memory-server/scripts/smoke-team-http.mjs
+node mcp-memory-server/scripts/smoke-team-mcp.mjs
+node mcp-memory-server/scripts/smoke-team-restore.mjs
+node mcp-memory-server/scripts/smoke-team-cli.mjs
+```
+
+These create disposable local fixtures and an authenticated loopback service,
+invoke actual stdio MCP clients, then clean their generated directories.
+No model, personal store, external API or corporate system is used. The MCP
+control changes client identity/cwd and retrieves the same approved decision;
+it does not infer authority from the working folder or a display name.
+
+Trace the lifecycle beside the operator commands in the reference:
+
+```text
+selected text → immutable proposal → different human reviews exact digest
+             → approved revision → authorized readers across client sessions
+```
+
+Stop at each negative control: unapproved proposal invisible to readers;
+self/workload review denied; stale policy/base conflicts; unrelated project
+denied; revoked credential blocked; restore refuses a live target and revokes
+all copied credentials. A confirmed value hash is not evidence of human consent.
+
+For project offboarding, use:
+
+```sh
+cairn team member remove SUBJECT --project ID --data DIR
+```
+
+Verify that a connected client immediately loses access while the subject's
+other project memberships still work. Re-enroll with `member set` and
+an explicit nonempty `--roles` list; revoke credentials separately when needed.
+
+## Acceptance criteria
+
+- Two independent stdio clients retrieve identical approved text and provenance.
+- Personal memory is untouched, and failed team retrieval never changes scope.
+- Reader profiles contain observations only; proposal creation requires consent.
+- Human review is absent from the MCP catalog and cannot be performed by workload tokens.
+- Role changes and offboarding apply to already-connected clients.
+- Backup verifies digests and audit links; restored data needs fresh credentials.
+- CLI administration returns to the shell; credentials are never printed.
+- Temporary restore remnants are reported, never silently deleted or activated.
+- Independent production review and a deployment's approved real-data pilot are
+  separate from the completed internal review and isolated native pilot.
+
+## Privacy and trust boundary
+
+Proposals and snapshots contain selected shared text and identities. Keep them
+private and encrypted by the surrounding storage/backup system. Roles do not
+make retrieved text executable authority. The OS owner administers membership
+and can rewrite the local database; hash links are not independent signatures.
+Team search is deterministic substring matching with no provider request.
+Personal-memory embedding and reranking settings do not apply to team search.
+This token-first JSON API plus local stdio bridge is not OAuth remote MCP HTTP.
+
+## Recovery
+
+The controls clean only their own temporary fixtures. For manual rehearsal,
+stop the disposable service, verify the exact generated paths and remove only
+that lab. Never run a purge against a real store for a recording. Logical key
+deletion does not erase old backup copies or guarantee physical erasure.
+Restoring a real service, enrolling users and publishing a release need separate
+admission evidence; passing this rehearsal does not supply it.

package/docs/learning/tracks/operator.md

@@ -19,6 +19,8 @@
 13. [L26 - Context intelligence with explicit authority](../lessons/L26-context-intelligence.md)
 14. [L27 - Evaluate ecosystem ideas with bounded evidence](../lessons/L27-ecosystem-evidence.md)
 15. [L28 - Verify Cairnkeep's security posture](../lessons/L28-security-assurance.md)
+16. Optional 2.25 preview: [L29 - Reviewed team continuity](../lessons/L29-team-continuity.md).
+    Do not enable it in production before the independent review and approved pilot.
 
 All modules are optional. The track is complete when the operator can add and
 remove each integration without breaking the standalone local workflow and can

package/docs/learning/video-scripts/V04-memory-retrieval-supplement.md

@@ -32,3 +32,16 @@ not confidence, and that the attempted live study failed with HTTP 502. Do not
 invent a successful live result or claim general task-quality improvements.
 Use short terminal zooms and side-by-side result comparisons instead of static
 slides; keep credentials and real memory off screen.
+
+## Optional reranker segment (2.24.0 or newer source checkout)
+
+Record real `check:memory-reranker` output, pausing on the no-network default,
+scope/history canaries and provider-failure fallback. With explicit synthetic
+provider configuration, run `run-memory-reranker-study.mjs --live --summary`.
+Do not show credentials or endpoint addresses. Compare the two arms using the
+same embeddings: the first frozen run improved first hits from 6/16 to 15/16,
+but `current-not-history` regressed. Zoom into that failure rather than hiding
+it. Explain that the earlier HTTP-502 study is separate and remains a failed
+run. Demonstrate the doctor's synthetic request, then disable reranking and
+show unchanged memory text and provenance. This is a recording brief, not a
+claim that this segment has been filmed or published.