@cairnkeep/cli 2.24.0 → 2.25.0

package/CHANGELOG.md

@@ -5,6 +5,30 @@ All notable user-facing changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [2.25.0] - 2026-10-24
+
+### Team continuity preview
+
+- Add default-off `cairn team` continuity with a separate organization/project
+  store, explicit roles and expiring/revocable human or workload credentials.
+  Share only selected text through immutable proposals and different-human
+  exact-digest review. Publish approved revisions and scoped audit atomically;
+  reject self/workload review and stale policy/base revisions.
+- Add a bounded authenticated loopback JSON API and an additional local stdio
+  MCP bridge. Four observation tools and additive proposal creation intersect
+  MCP profiles/capabilities with server authorization; no review/admin MCP,
+  automatic upload, personal-store migration or production activation.
+- Add consistent verified backups, fresh-only restore with copied credentials
+  revoked, private file/ACL controls, logical deletion and uninstall retention.
+  Document manual retention, size limits and trusted-OS-owner limitations.
+- Add `cairn team member remove SUBJECT --project ID` for explicit project
+  offboarding. Preserve credentials, other memberships and audit history;
+  reject missing or empty role lists in `member set`. Update shell completions,
+  team guidance and the learning/video rehearsal.
+- Add an isolated, opt-in pilot guide with an executable setup regression:
+  separate stores, file-only expiring credentials and client profiles, unchanged
+  personal configuration, and an explicit human review boundary.
+
 ## [2.24.0] - 2026-10-24
 
 ### Memory retrieval

package/docs/README.md

@@ -76,6 +76,10 @@ linked guides rather than the project landing page.
 
 ## Overlays and teams
 
+- [Team continuity preview](team.md) documents the default-off, separately
+  authenticated shared-memory store, human review, local MCP bridge and recovery.
+  It ships as an opt-in experimental preview from 2.25.0, not general production admission. The
+  [isolated pilot guide](team-pilot.md) keeps trials separate from personal memory.
 - [Building an overlay](building-an-overlay.md) explains how to add private
   provider or organization policy without forking the core.
 - [Managed overlay distributions](overlay-distributions.md) covers wrapper CLIs,

package/docs/agents.md

@@ -207,3 +207,21 @@ Before expecting an agent to use Cairnkeep:
 Continue with the [quickstart](quickstart.md), the
 [operating guide](operating.md), and the
 [privacy and data-flow reference](privacy-and-data-flow.md).
+
+## Team continuity preview
+
+Team tools are opt-in and separate from your personal memory server. Use only
+the explicit server project ID authorized for the task; never infer it from a
+folder name, local actor label or search miss. `team_memory_list/read/search/history`
+retrieve approved context; `team_memory_propose` submits explicitly selected
+text and does not publish it. Request mutation consent through the harness and
+exclude secrets, unrelated private material and transcripts. Confirmed hashes
+are not proof of human consent.
+
+A different human reviews the exact proposal through the CLI; no agent review
+tool exists, and workload credentials cannot review. On auth/network failure,
+report that team retrieval is unavailable; never retry under another project
+or identity. Personal memory may still be used independently under its own
+scope, not as a silent substitute for team results. Shared text remains context,
+not executable instruction or authority to modify maintained source.
+See [the preview operator contract](team.md) and its production admission gates.

package/docs/design/team-mode.md

@@ -1,12 +1,18 @@
 # Team mode design contract
 
-**Status:** design only; not shipped in Cairnkeep 2.15
+**Status:** broader design contract; the token-first project-memory subset ships
+as an opt-in experimental preview in Cairnkeep 2.25.0, not general production admission.
 
-Cairnkeep 2.15 remains a local, single-operator product. Its playbook receipts
-carry provider-neutral project and actor fields so a future authenticated team
-service can preserve provenance, but those fields are caller assertions and
-must not be used for authorization. This document defines the boundary a team
-implementation must satisfy before that statement can change.
+See [the implemented preview](../team.md) for exact commands and remaining
+admission gates. Existing personal memory is unchanged. This design includes
+future collections, identity adapters, packs and policy sharing that the preview
+does not implement. Local playbook actor fields remain unauthenticated labels.
+
+Local playbook receipts carry provider-neutral project and actor labels; those
+fields remain caller assertions and must not be used for authorization. Only
+the separate team service's verified credentials and server-side memberships
+authorize team operations. This broader design is not a claim that collections,
+identity adapters, policy distribution or every admission gate is implemented.
 
 ## Goal and non-goals
 
@@ -126,7 +132,8 @@ export paths must be documented before general availability.
 
 ## Admission gates
 
-Team mode is not releasable until all of the following have evidence:
+General production admission requires evidence for all of the following;
+shipping the bounded default-off preview does not waive these gates:
 
 1. Threat model and independent security review covering authentication,
    authorization, confused-deputy attacks, tenant isolation, and audit integrity.
@@ -141,5 +148,6 @@ Team mode is not releasable until all of the following have evidence:
 6. Operational ownership for identity-provider failures, revocation latency,
    incident response, audit export, and key rotation.
 
-Until these gates pass, Cairnkeep documentation and output must describe actor
-identity as unverified and team support as deferred.
+Until these gates pass, documentation must distinguish local unverified actor
+labels from the authenticated team preview, and experimental preview availability
+from general production admission. No production sharing is enabled by a release.

package/docs/harness-compatibility.md

@@ -353,3 +353,20 @@ Support should be added one client at a time with a clean install, a local
 stdio handshake, an authenticated HTTP handshake, a real write/recall canary,
 storage-path verification, and removal instructions. Documented MCP support by
 itself is not enough to claim Cairnkeep support.
+
+## Optional team bridge (opt-in 2.25 preview)
+
+[Team continuity](team.md) adds an additional generic local stdio MCP:
+`cairn team mcp`. It does not replace `cairn-memory`, rewrite harness config
+or change existing setup. Every call supplies a server project ID explicitly;
+the same credentials/project IDs work regardless of the starting cwd.
+Configure private file-based credentials and the separate JSON API URL in the
+client environment. Human reviewer credentials must not enter the agent's
+environment; review is CLI-only.
+
+Maintained tests use actual SDK stdio clients, profiles and live revocation.
+They do not constitute a live test of every named harness. The bridge exposes
+four observations plus explicit proposal creation, never review/admin.
+The completed internal review and isolated native pilot are not independent
+production review or a deployment-specific approved real-data pilot; both
+remain required for production support.

package/docs/learning/CURRICULUM-MAP.md

@@ -1,6 +1,6 @@
 # Curriculum Coverage Map
 
-**Baseline:** Cairnkeep 2.24.0
+**Baseline:** Cairnkeep 2.25.0
 **Last reviewed:** 2026-10-22
 
 This map prevents the course from drifting behind the product. It assigns each
@@ -45,6 +45,7 @@ been rehearsed.
 | Progressive pack retrieval, frozen benchmark, context-usage receipts, review-gated memory proposals, optional provider adapter | L26 | V26 | Ready; default flat search and AnythingLLM remain compatible; OpenViking and receipt mutation are explicitly gated |
 | Branchable agent state, model-managed context, and learned decision-model comparisons | L27 | V27 | Ready; evidence runners are operator-invoked and no companion is a runtime dependency or authority |
 | Threat model, local posture check, portable-path adversarial tests, and release security controls | L28 | V28 | Ready; diagnostic is read-only and evidence is not certification |
+| Token-first team identity, reviewed project memory, local stdio bridge, revocation and fresh-only restore | L29 | V29 | Brief; opt-in 2.25 preview; deployment-specific production admission required |
 
 ## Release Review
 
@@ -98,6 +99,7 @@ against `cairn help` so a new command cannot bypass a curriculum decision.
 | `cairn sync-omp` | L02 |
 | `cairn doctor` | L03; advanced repair in L13-L14 |
 | `cairn security` | L28 |
+| `cairn team` | L29 opt-in preview, included from 2.25.0 |
 | `cairn playbook` | L25 |
 | `cairn trajectory` | L13 |
 | `cairn artifact` | L13 |

package/docs/learning/FEATURE-GUIDE.md

@@ -1,6 +1,6 @@
 # Cairnkeep feature guide
 
-**Baseline:** Cairnkeep 2.24.0
+**Baseline:** Cairnkeep 2.25.0
 
 This is the step-back map for choosing and operating Cairnkeep features. The
 [course labs](https://github.com/cairnkeep/cairnkeep-course-labs) provide one
@@ -46,8 +46,13 @@ Version 2.24 adds an optional, separately configured ranking
 service, not a chat agent or memory authority. It remains default-off. See
 [its bounded provider comparison and regression](../memory-retrieval.md#optional-learned-reranking)
 before enabling it; L04 and its recording supplement cover the privacy,
-doctor and fallback controls. The default-off team preview is separate and is
-not included in this release.
+doctor and fallback controls.
+
+Version 2.25 adds the separate default-off team-continuity preview: selected
+project context, exact human review, revocable project roles and an additional
+local stdio MCP bridge. Installing it enables no sharing. L29/V29 cover its
+bounded trial and the distinction between preview availability and production
+admission; team search does not use personal-memory embeddings or reranking.
 
 ## The three-layer model
 
@@ -177,3 +182,24 @@ approval, project-isolation, or release authority. See
 [L27](lessons/L27-ecosystem-evidence.md), its
 [video script](video-scripts/V27-ecosystem-evidence.md), and the pinned
 [evidence report](../research/ecosystem-evidence-2026-10.md).
+
+## Optional team continuity preview
+
+The `cairn team` surface, included from 2.25.0, is default off and separate from local
+memory. It adds project-scoped credentials/roles, immutable selected proposals,
+human-only review and an additional local stdio MCP bridge. It never scans
+personal memory or automatically installs a harness entry. Serving requires
+separate HTTP consent; this JSON API is not OAuth remote MCP HTTP.
+
+Authority is rechecked per request. Backup/restore validates integrity and
+revokes restored credentials; retention is manual, and logical deletion is not
+physical erasure. Feature/profile changes require restarting the bridge;
+revocation and membership changes take effect on existing clients.
+Removing the MCP entry or disabling its service stops team access without
+changing personal memory. Uninstall retains the separate store.
+Read [the reference](../team.md), [L29](lessons/L29-team-continuity.md) and its
+[V29 rehearsal brief](video-scripts/V29-team-continuity.md).
+The governed internal review and approved isolated native pilot are complete;
+neither substitutes for independent production review and a deployment-specific
+approved real-data pilot. This is a bounded experimental preview, not general
+production admission.

package/docs/learning/README.md

@@ -63,6 +63,7 @@ expanded only after their labs are executable.
 | L26 | [Context intelligence with explicit authority](lessons/L26-context-intelligence.md) | Ready | 45 min |
 | L27 | [Evaluate context companions without moving authority](lessons/L27-ecosystem-evidence.md) | Ready | 30 min |
 | L28 | [Verify Cairnkeep's security posture](lessons/L28-security-assurance.md) | Ready | 30 min |
+| L29 | [Reviewed team continuity preview](lessons/L29-team-continuity.md) | Brief; opt-in 2.25 preview | 40 min |
 
 The [curriculum coverage map](CURRICULUM-MAP.md) records where every public
 feature is introduced, practised, and operated. It also marks design-only work
@@ -89,6 +90,7 @@ feature.
 
 Use [the lesson template](templates/lesson-template.md). Commands in finished
 lessons must be tested against the current release before publication.
-Unpublished editorial plans and recording scripts are intentionally maintained
-outside the public product repository; stable video links or transcripts can
-be added here after publication.
+Technical lesson and rehearsal scripts in `video-scripts/` are maintained with
+the product; private editorial plans and recording evidence stay outside this
+repository. Preview scripts must not present unreleased behavior as installed
+release behavior. Stable video links can be added after publication.

package/docs/learning/lessons/L00-why-cairnkeep.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 10 minutes
-**Tested with:** Cairnkeep 2.24.0
+**Tested with:** Cairnkeep 2.25.0
 
 ## Outcome
 

package/docs/learning/lessons/L01-safe-trial.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 15 minutes
-**Tested with:** Cairnkeep 2.24.0
+**Tested with:** Cairnkeep 2.25.0
 
 ## Outcome
 
@@ -26,7 +26,7 @@ ephemeral; the named course volume is persistent.
 1. Pull the public image:
 
    ```bash
-   podman pull ghcr.io/cairnkeep/cairnkeep:2.24.0
+   podman pull ghcr.io/cairnkeep/cairnkeep:2.25.0
    ```
 
 2. Start the stdio server with a read-only root filesystem and no Linux
@@ -38,7 +38,7 @@ ephemeral; the named course volume is persistent.
      --read-only --cap-drop=all --security-opt=no-new-privileges \
      --tmpfs=/tmp:rw,noexec,nosuid,size=64m,mode=1777 \
      --volume cairnkeep-course-data:/data:Z,U \
-     ghcr.io/cairnkeep/cairnkeep:2.24.0 stdio
+     ghcr.io/cairnkeep/cairnkeep:2.25.0 stdio
    ```
 
 3. The process waits quietly for MCP input. Press `Ctrl-C` after confirming it

package/docs/learning/lessons/L02-installation.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
 
 ## Outcome
 
@@ -47,7 +47,7 @@ sync. Codex project trust remains an explicit operator decision.
 2. Install Cairnkeep:
 
    ```bash
-   npm install --global @cairnkeep/cli@2.24.0
+   npm install --global @cairnkeep/cli@2.25.0
    cairn --version
    ```
 

package/docs/learning/lessons/L03-first-project.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.24.0
+**Tested with:** Cairnkeep 2.25.0
 
 ## Outcome
 

package/docs/learning/lessons/L19-validated-skill-improvement.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Evidence and Evaluation
 **Time:** 50 minutes
-**Tested with:** Cairnkeep 2.24.0
+**Tested with:** Cairnkeep 2.25.0
 
 ## Outcome
 

package/docs/learning/lessons/L20-mcp-tool-profiles.md

@@ -1,7 +1,7 @@
 # L20 - Least-authority MCP tool profiles
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
 **Time:** 25 minutes
 
 ## Outcome

package/docs/learning/lessons/L21-context-packs.md

@@ -1,7 +1,7 @@
 # L21 - Immutable context packs and skill approval
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
 **Time:** 40 minutes
 
 ## Outcome

package/docs/learning/lessons/L22-native-windows.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Operator
 **Time:** 30 minutes
-**Tested with:** Cairnkeep 2.24.0, Windows x64, and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0, Windows x64, and Node.js 22 or newer
 
 ## Outcome
 
@@ -16,7 +16,7 @@ perform a reversible uninstall without relying on WSL or Git Bash.
 From PowerShell:
 
 ```powershell
-npm install --global @cairnkeep/cli@2.24.0
+npm install --global @cairnkeep/cli@2.25.0
 cairn version
 
 $Lab = Join-Path $env:TEMP 'Cairnkeep Windows Lab'

package/docs/learning/lessons/L23-guided-setup.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart and Operator
 **Time:** 35 minutes
-**Tested with:** Cairnkeep 2.24.0; Pi 0.84.1; Node.js 22, 24, and 26
+**Tested with:** Cairnkeep 2.25.0; Pi 0.84.1; Node.js 22, 24, and 26
 
 ## Outcome
 

package/docs/learning/lessons/L24-okf-exchange.md

@@ -1,7 +1,7 @@
 # L24 - Reviewed knowledge exchange
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L25-playbooks.md

@@ -1,7 +1,7 @@
 # L25 - Bounded workflow playbooks
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L26-context-intelligence.md

@@ -1,7 +1,7 @@
 # L26 - Context intelligence with explicit authority
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L27-ecosystem-evidence.md

@@ -1,6 +1,6 @@
 # L27 - Evaluate context companions without moving authority
 
-**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L28-security-assurance.md

@@ -1,7 +1,7 @@
 # L28 - Verify Cairnkeep's security posture
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
 
 ## Outcome
 
@@ -11,7 +11,7 @@ and choose least authority for a network-facing MCP client.
 
 ## Prerequisites
 
-- Install Cairnkeep 2.24.0 or use a disposable source checkout.
+- Install Cairnkeep 2.25.0 or use a disposable source checkout.
 - Complete [L20 - Least-authority MCP tool profiles](L20-mcp-tool-profiles.md).
 - Use synthetic values only; never paste a real bearer token into a recording,
   terminal transcript, or issue.

package/docs/learning/lessons/L29-team-continuity.md

@@ -0,0 +1,95 @@
+# L29 - Reviewed team continuity preview
+
+**Status:** Brief; opt-in experimental preview in Cairnkeep 2.25.0
+**Compatibility:** Cairnkeep 2.25.0 or newer; Node 22.13 or newer for team storage.
+Use a matching source checkout for the executable regression exercises below.
+Installing the released CLI does not enable team sharing.
+
+## Outcome
+
+Carry an approved project decision from one client process and working folder
+to another, without exposing personal memory or granting an agent review power.
+Explain the difference between a restrictive MCP profile and server membership.
+
+## Prerequisites
+
+Complete L20 and L28. Use only synthetic subjects and disposable local stores.
+Build the matching checkout with `npm --prefix mcp-memory-server ci` followed by
+`npm --prefix mcp-memory-server run build`. Read [Team continuity](../../team.md).
+Do not connect a real organization or reuse a production credential.
+For an explicitly approved native-harness trial, follow the
+[isolated pilot guide](../../team-pilot.md); do not use automated rehearsal as
+a substitute for the human review or release-admission steps.
+
+## Source-checkout rehearsal
+
+From the checkout, run the offline controls:
+
+```sh
+node mcp-memory-server/scripts/smoke-team.mjs
+node mcp-memory-server/scripts/smoke-team-review.mjs
+node mcp-memory-server/scripts/smoke-team-http.mjs
+node mcp-memory-server/scripts/smoke-team-mcp.mjs
+node mcp-memory-server/scripts/smoke-team-restore.mjs
+node mcp-memory-server/scripts/smoke-team-cli.mjs
+```
+
+These create disposable local fixtures and an authenticated loopback service,
+invoke actual stdio MCP clients, then clean their generated directories.
+No model, personal store, external API or corporate system is used. The MCP
+control changes client identity/cwd and retrieves the same approved decision;
+it does not infer authority from the working folder or a display name.
+
+Trace the lifecycle beside the operator commands in the reference:
+
+```text
+selected text → immutable proposal → different human reviews exact digest
+             → approved revision → authorized readers across client sessions
+```
+
+Stop at each negative control: unapproved proposal invisible to readers;
+self/workload review denied; stale policy/base conflicts; unrelated project
+denied; revoked credential blocked; restore refuses a live target and revokes
+all copied credentials. A confirmed value hash is not evidence of human consent.
+
+For project offboarding, use:
+
+```sh
+cairn team member remove SUBJECT --project ID --data DIR
+```
+
+Verify that a connected client immediately loses access while the subject's
+other project memberships still work. Re-enroll with `member set` and
+an explicit nonempty `--roles` list; revoke credentials separately when needed.
+
+## Acceptance criteria
+
+- Two independent stdio clients retrieve identical approved text and provenance.
+- Personal memory is untouched, and failed team retrieval never changes scope.
+- Reader profiles contain observations only; proposal creation requires consent.
+- Human review is absent from the MCP catalog and cannot be performed by workload tokens.
+- Role changes and offboarding apply to already-connected clients.
+- Backup verifies digests and audit links; restored data needs fresh credentials.
+- CLI administration returns to the shell; credentials are never printed.
+- Temporary restore remnants are reported, never silently deleted or activated.
+- Independent production review and a deployment's approved real-data pilot are
+  separate from the completed internal review and isolated native pilot.
+
+## Privacy and trust boundary
+
+Proposals and snapshots contain selected shared text and identities. Keep them
+private and encrypted by the surrounding storage/backup system. Roles do not
+make retrieved text executable authority. The OS owner administers membership
+and can rewrite the local database; hash links are not independent signatures.
+Team search is deterministic substring matching with no provider request.
+Personal-memory embedding and reranking settings do not apply to team search.
+This token-first JSON API plus local stdio bridge is not OAuth remote MCP HTTP.
+
+## Recovery
+
+The controls clean only their own temporary fixtures. For manual rehearsal,
+stop the disposable service, verify the exact generated paths and remove only
+that lab. Never run a purge against a real store for a recording. Logical key
+deletion does not erase old backup copies or guarantee physical erasure.
+Restoring a real service, enrolling users and publishing a release need separate
+admission evidence; passing this rehearsal does not supply it.

package/docs/learning/tracks/operator.md

@@ -19,6 +19,8 @@
 13. [L26 - Context intelligence with explicit authority](../lessons/L26-context-intelligence.md)
 14. [L27 - Evaluate ecosystem ideas with bounded evidence](../lessons/L27-ecosystem-evidence.md)
 15. [L28 - Verify Cairnkeep's security posture](../lessons/L28-security-assurance.md)
+16. Optional 2.25 preview: [L29 - Reviewed team continuity](../lessons/L29-team-continuity.md).
+    Do not enable it in production before the independent review and approved pilot.
 
 All modules are optional. The track is complete when the operator can add and
 remove each integration without breaking the standalone local workflow and can

package/docs/learning/video-scripts/V29-team-continuity.md

@@ -0,0 +1,66 @@
+# V29 - Remember together without sharing everything
+
+Status: technical rehearsal brief for the opt-in Cairnkeep 2.25.0 preview.
+Target: 10–12 minutes, experienced-developer audience. Describe a released
+experimental preview, not a generally production-admitted team service.
+Use the [isolated pilot guide](../../team-pilot.md) for a separately authorized
+native-harness trial, not as authorization to record private review or credentials.
+
+## 0:00–1:30 — Continuity is the goal
+
+“The useful part is not winning a one-shot puzzle. It is continuing tomorrow,
+in another harness, without explaining the same project decision again.”
+Pause, then introduce the new boundary: your private memory is not a team bucket.
+Show the proposal/review/revision lifecycle, one stage at a time.
+
+## 1:30–3:30 — Deliberately separate identities
+
+Use a disposable source checkout and only synthetic fixtures. Show
+`bin/cairn team --help` and the default-off failure. Read the roles in
+`docs/team.md`; highlight that a reviewer token is human-only and is never
+handed to the agent. Briefly show initialization/membership command forms,
+with no token contents on screen. The server is loopback-only.
+
+## 3:30–6:00 — Make the boundary visible
+
+Type the six L29 control commands at human speed; use completion where useful.
+Split the terminal: immutable selected proposal on one side, human review and
+approved retrieval on the other. Use the actual fixture results rather than
+fabricating a transcript. Pause on denied workload/self-review and the stale
+digest/base controls. Explain that confirming a hash does not prove human consent.
+
+## 6:00–8:00 — Change clients, not authority
+
+Run `smoke-team-mcp.mjs` separately and inspect its maintained fixture: two
+actual stdio clients, different cwd, same approved project decision. Zoom into
+project provenance, then contrast an unrelated project denial and live token
+revocation. Do not claim the test launched every named commercial harness.
+Show `cairn team member remove SUBJECT --project ID --data DIR` as the explicit
+project-offboarding command. Pause on the connected client's denial; explain
+that removing one project membership does not revoke all of that person's tokens.
+An additional MCP entry is opt-in; existing memory servers are not replaced.
+
+## 8:00–10:00 — Recovery with a catch
+
+Run `smoke-team-restore.mjs` and `smoke-team-cli.mjs`. Leave a two-second pause
+on “restored credentials revoked”: copying a backup must not silently restore
+access. Show fresh-only restore, no-overwrite and uninstall-retention controls.
+Explain that logical deletion is not secure disk erasure or backup deletion.
+
+## 10:00–11:30 — Honest closing
+
+End on the admission checklist in `docs/team.md`, not a production deployment.
+Distinguish completed regression controls, the internal governed review and
+the approved isolated native pilot from independent production review and a
+deployment-specific real-data pilot. Do not imply two independent human testers.
+Explain that personal-memory embeddings/reranking never process team search.
+Distinguish the JSON API/local stdio bridge from OAuth
+remote MCP. Call out OIDC, team packs and multi-organization tenancy as deferred.
+
+## Recording contract
+
+Use legible real terminals, short scene changes, natural pauses and emphasis
+around each changed authority boundary. Keep credentials, personal memory,
+source excerpts from private projects and raw snapshot text off screen.
+Do not enroll a real user, deploy, purchase services or mutate live MCP config
+to produce the video. This brief does not imply a video has been recorded.

package/docs/operating.md

@@ -962,9 +962,10 @@ cairn playbook record --help
 ```
 
 Inspect receipts with `cairn playbook receipts list|show`; validate state with
-`cairn playbook doctor`. Actor and session options are provenance labels only:
-v2.15 does not authenticate them and does not provide team ACLs. See
-[team mode](design/team-mode.md) for the future admission contract.
+`cairn playbook doctor`. Actor and session options remain unverified provenance
+labels, not team ACLs. The separate [team preview](team.md) authenticates its own
+credentials and project memberships; it never trusts local playbook labels.
+See [team mode](design/team-mode.md) for the broader admission contract.
 
 The corresponding process overrides are optional:
 
@@ -1541,3 +1542,16 @@ cairn proposals apply PROPOSAL_DIGEST --project /path/to/project --json
 
 No background process synchronizes OpenViking, creates proposals, applies
 memory, enables packs, or approves skills.
+
+## Team continuity (opt-in 2.25 preview)
+
+The separate `cairn team` command implements explicitly selected and reviewed
+project memory. It is default off (`CAIRN_TEAM=1` required); serving also needs
+`CAIRN_TEAM_HTTP=1`. It does not change ordinary setup or existing MCP entries.
+Use [the team reference](team.md) for roles, private credentials, additional
+local stdio registration, human review, backup/restore and incident handling.
+The internal governed review and approved isolated native pilot are complete;
+independent production review and a deployment-specific approved real-data pilot
+are still required before using real organization data.
+Existing personal HTTP remains a trusted single storage domain; token-first
+team JSON HTTP is a different service, not OAuth remote MCP HTTP.