@cairnkeep/cli 2.24.0 → 2.26.0

package/CHANGELOG.md

@@ -5,6 +5,71 @@ All notable user-facing changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [2.26.0] - 2026-10-26
+
+### Guided team onboarding
+
+- Add opt-in `cairn team connect` with terminal harness selectors, a no-write
+  plan, explicit apply/confirmation and a read-only default. Add a dedicated
+  project-local MCP entry for Claude Code, OpenCode, Qwen Code or Codex without
+  replacing personal/unrelated MCPs. Store only private token-file references;
+  pin the bridge to one explicit server project.
+- Add `cairn team doctor --client` with authenticated, metadata-only project
+  diagnostics; no local admin store or memory payload. Add drift-aware
+  `disconnect`, private recoverable backups, serialized writers and a committed
+  activation record so interrupted multi-file connections stay inactive.
+- Add synthetic two-identity, adapter/cwd continuity, denied self-publication,
+  revocation and interrupted-recovery controls, plus actual installed-package
+  onboarding checks. Update completions, storage/privacy and learning/video
+  briefs. No new dependency, automatic enrollment or production admission.
+
+### Verification
+
+- Keep all CodeQL actions on one reviewed commit and group their dependency
+  updates; reject split or unpinned cohorts with mutation controls. Refresh
+  pinned CodeQL, Scorecard and release artifact-download actions.
+- Retry bounded capability-lock acquisition when the previous writer removes
+  the lock between contention and inspection. Keep other inspection failures
+  denied and add a deterministic disappearance regression; preserve concurrent
+  child diagnostics on lifecycle-test failure.
+
+- Serialize asynchronous security fixtures that patch shared filesystem
+  built-ins, with an aggregate hook-ownership/restoration regression. Preserve
+  runtime read guards and all actual replacement/growth injection assertions.
+- Add real MCP coverage and a review of file-derived provider workspace flows;
+  verify destination, credential and selected-content boundaries without
+  suppressing static-analysis findings.
+
+### Documentation
+
+- Add role-based team-preview onboarding, a tested reader connection card and
+  deployment-readiness checklist; align the reference, pilot, lesson and video
+  brief without enabling sharing or changing the released CLI.
+
+## [2.25.0] - 2026-10-24
+
+### Team continuity preview
+
+- Add default-off `cairn team` continuity with a separate organization/project
+  store, explicit roles and expiring/revocable human or workload credentials.
+  Share only selected text through immutable proposals and different-human
+  exact-digest review. Publish approved revisions and scoped audit atomically;
+  reject self/workload review and stale policy/base revisions.
+- Add a bounded authenticated loopback JSON API and an additional local stdio
+  MCP bridge. Four observation tools and additive proposal creation intersect
+  MCP profiles/capabilities with server authorization; no review/admin MCP,
+  automatic upload, personal-store migration or production activation.
+- Add consistent verified backups, fresh-only restore with copied credentials
+  revoked, private file/ACL controls, logical deletion and uninstall retention.
+  Document manual retention, size limits and trusted-OS-owner limitations.
+- Add `cairn team member remove SUBJECT --project ID` for explicit project
+  offboarding. Preserve credentials, other memberships and audit history;
+  reject missing or empty role lists in `member set`. Update shell completions,
+  team guidance and the learning/video rehearsal.
+- Add an isolated, opt-in pilot guide with an executable setup regression:
+  separate stores, file-only expiring credentials and client profiles, unchanged
+  personal configuration, and an explicit human review boundary.
+
 ## [2.24.0] - 2026-10-24
 
 ### Memory retrieval

package/docs/README.md

@@ -76,6 +76,12 @@ linked guides rather than the project landing page.
 
 ## Overlays and teams
 
+- [Team continuity preview](team.md) documents the default-off, separately
+  authenticated shared-memory store, human review, local MCP bridge and recovery.
+  It ships as an opt-in experimental preview from 2.25.0, not general production admission. The
+  [isolated pilot guide](team-pilot.md) keeps trials separate from personal memory.
+  [Role-based onboarding](team-onboarding.md) adds a tested reader check and
+  the deployment decisions to resolve before any real-data pilot.
 - [Building an overlay](building-an-overlay.md) explains how to add private
   provider or organization policy without forking the core.
 - [Managed overlay distributions](overlay-distributions.md) covers wrapper CLIs,

package/docs/agents.md

@@ -207,3 +207,21 @@ Before expecting an agent to use Cairnkeep:
 Continue with the [quickstart](quickstart.md), the
 [operating guide](operating.md), and the
 [privacy and data-flow reference](privacy-and-data-flow.md).
+
+## Team continuity preview
+
+Team tools are opt-in and separate from your personal memory server. Use only
+the explicit server project ID authorized for the task; never infer it from a
+folder name, local actor label or search miss. `team_memory_list/read/search/history`
+retrieve approved context; `team_memory_propose` submits explicitly selected
+text and does not publish it. Request mutation consent through the harness and
+exclude secrets, unrelated private material and transcripts. Confirmed hashes
+are not proof of human consent.
+
+A different human reviews the exact proposal through the CLI; no agent review
+tool exists, and workload credentials cannot review. On auth/network failure,
+report that team retrieval is unavailable; never retry under another project
+or identity. Personal memory may still be used independently under its own
+scope, not as a silent substitute for team results. Shared text remains context,
+not executable instruction or authority to modify maintained source.
+See [the preview operator contract](team.md) and its production admission gates.

package/docs/design/team-mode.md

@@ -1,12 +1,18 @@
 # Team mode design contract
 
-**Status:** design only; not shipped in Cairnkeep 2.15
+**Status:** broader design contract; the token-first project-memory subset ships
+as an opt-in experimental preview in Cairnkeep 2.25.0, not general production admission.
 
-Cairnkeep 2.15 remains a local, single-operator product. Its playbook receipts
-carry provider-neutral project and actor fields so a future authenticated team
-service can preserve provenance, but those fields are caller assertions and
-must not be used for authorization. This document defines the boundary a team
-implementation must satisfy before that statement can change.
+See [the implemented preview](../team.md) for exact commands and remaining
+admission gates. Existing personal memory is unchanged. This design includes
+future collections, identity adapters, packs and policy sharing that the preview
+does not implement. Local playbook actor fields remain unauthenticated labels.
+
+Local playbook receipts carry provider-neutral project and actor labels; those
+fields remain caller assertions and must not be used for authorization. Only
+the separate team service's verified credentials and server-side memberships
+authorize team operations. This broader design is not a claim that collections,
+identity adapters, policy distribution or every admission gate is implemented.
 
 ## Goal and non-goals
 
@@ -126,7 +132,8 @@ export paths must be documented before general availability.
 
 ## Admission gates
 
-Team mode is not releasable until all of the following have evidence:
+General production admission requires evidence for all of the following;
+shipping the bounded default-off preview does not waive these gates:
 
 1. Threat model and independent security review covering authentication,
    authorization, confused-deputy attacks, tenant isolation, and audit integrity.
@@ -141,5 +148,6 @@ Team mode is not releasable until all of the following have evidence:
 6. Operational ownership for identity-provider failures, revocation latency,
    incident response, audit export, and key rotation.
 
-Until these gates pass, Cairnkeep documentation and output must describe actor
-identity as unverified and team support as deferred.
+Until these gates pass, documentation must distinguish local unverified actor
+labels from the authenticated team preview, and experimental preview availability
+from general production admission. No production sharing is enabled by a release.

package/docs/harness-compatibility.md

@@ -353,3 +353,23 @@ Support should be added one client at a time with a clean install, a local
 stdio handshake, an authenticated HTTP handshake, a real write/recall canary,
 storage-path verification, and removal instructions. Documented MCP support by
 itself is not enough to claim Cairnkeep support.
+
+## Optional team bridge (opt-in 2.25 preview)
+
+[Team continuity](team.md) adds an additional generic local stdio MCP:
+`cairn team mcp`. It does not replace `cairn-memory` or change existing setup.
+The 2.26.0 explicit `team connect` wizard adds only a project-local team
+entry for Claude Code, OpenCode, Qwen Code or Codex; global config is unchanged.
+See [supported files and safe recovery](team-onboarding.md#guided-connection-next-release--matching-source-checkout).
+Other adapters retain the manual connection recipe. Every call supplies a server project ID explicitly;
+the same credentials/project IDs work regardless of the starting cwd.
+Configure private file-based credentials and the separate JSON API URL in the
+client environment. Human reviewer credentials must not enter the agent's
+environment; review is CLI-only.
+
+Maintained tests use actual SDK stdio clients, profiles and live revocation.
+They do not constitute a live test of every named harness. The bridge exposes
+four observations plus explicit proposal creation, never review/admin.
+The completed internal review and isolated native pilot are not independent
+production review or a deployment-specific approved real-data pilot; both
+remain required for production support.

package/docs/learning/CURRICULUM-MAP.md

@@ -1,7 +1,7 @@
 # Curriculum Coverage Map
 
-**Baseline:** Cairnkeep 2.24.0
-**Last reviewed:** 2026-10-22
+**Baseline:** Cairnkeep 2.26.0
+**Last reviewed:** 2026-10-26
 
 This map prevents the course from drifting behind the product. It assigns each
 user-facing surface to a lesson and records whether the lesson is complete or
@@ -45,6 +45,7 @@ been rehearsed.
 | Progressive pack retrieval, frozen benchmark, context-usage receipts, review-gated memory proposals, optional provider adapter | L26 | V26 | Ready; default flat search and AnythingLLM remain compatible; OpenViking and receipt mutation are explicitly gated |
 | Branchable agent state, model-managed context, and learned decision-model comparisons | L27 | V27 | Ready; evidence runners are operator-invoked and no companion is a runtime dependency or authority |
 | Threat model, local posture check, portable-path adversarial tests, and release security controls | L28 | V28 | Ready; diagnostic is read-only and evidence is not certification |
+| Token-first team identity, reviewed project memory, local stdio bridge, revocation and fresh-only restore | L29 | V29 | Brief; opt-in 2.25 preview; deployment-specific production admission required |
 
 ## Release Review
 
@@ -98,6 +99,7 @@ against `cairn help` so a new command cannot bypass a curriculum decision.
 | `cairn sync-omp` | L02 |
 | `cairn doctor` | L03; advanced repair in L13-L14 |
 | `cairn security` | L28 |
+| `cairn team` | L29 opt-in preview, included from 2.25.0; next-release guided connect/client doctor/disconnect requires matching client/API |
 | `cairn playbook` | L25 |
 | `cairn trajectory` | L13 |
 | `cairn artifact` | L13 |

package/docs/learning/FEATURE-GUIDE.md

@@ -1,6 +1,6 @@
 # Cairnkeep feature guide
 
-**Baseline:** Cairnkeep 2.24.0
+**Baseline:** Cairnkeep 2.26.0
 
 This is the step-back map for choosing and operating Cairnkeep features. The
 [course labs](https://github.com/cairnkeep/cairnkeep-course-labs) provide one
@@ -46,8 +46,13 @@ Version 2.24 adds an optional, separately configured ranking
 service, not a chat agent or memory authority. It remains default-off. See
 [its bounded provider comparison and regression](../memory-retrieval.md#optional-learned-reranking)
 before enabling it; L04 and its recording supplement cover the privacy,
-doctor and fallback controls. The default-off team preview is separate and is
-not included in this release.
+doctor and fallback controls.
+
+Version 2.25 adds the separate default-off team-continuity preview: selected
+project context, exact human review, revocable project roles and an additional
+local stdio MCP bridge. Installing it enables no sharing. L29/V29 cover its
+bounded trial and the distinction between preview availability and production
+admission; team search does not use personal-memory embeddings or reranking.
 
 ## The three-layer model
 
@@ -177,3 +182,30 @@ approval, project-isolation, or release authority. See
 [L27](lessons/L27-ecosystem-evidence.md), its
 [video script](video-scripts/V27-ecosystem-evidence.md), and the pinned
 [evidence report](../research/ecosystem-evidence-2026-10.md).
+
+## Optional team continuity preview
+
+The `cairn team` surface, included from 2.25.0, is default off and separate from local
+memory. It adds project-scoped credentials/roles, immutable selected proposals,
+human-only review and an additional local stdio MCP bridge. It never scans
+personal memory or automatically installs a harness entry. Serving requires
+separate HTTP consent; this JSON API is not OAuth remote MCP HTTP.
+
+From 2.26.0, `cairn team connect` plans an additive project-local connection,
+`cairn team doctor --client` checks authenticated metadata, and `disconnect`
+supports drift-aware recovery. Both client and team API must be 2.26 or newer.
+These commands do not enroll users or enable sharing automatically. See the
+[guided recipe](../team-onboarding.md#guided-connection-226-or-newer).
+
+Authority is rechecked per request. Backup/restore validates integrity and
+revokes restored credentials; retention is manual, and logical deletion is not
+physical erasure. Feature/profile changes require restarting the bridge;
+revocation and membership changes take effect on existing clients.
+Removing the MCP entry or disabling its service stops team access without
+changing personal memory. Uninstall retains the separate store.
+Read [the reference](../team.md), [L29](lessons/L29-team-continuity.md) and its
+[V29 rehearsal brief](video-scripts/V29-team-continuity.md).
+The governed internal review and approved isolated native pilot are complete;
+neither substitutes for independent production review and a deployment-specific
+approved real-data pilot. This is a bounded experimental preview, not general
+production admission.

package/docs/learning/README.md

@@ -63,6 +63,7 @@ expanded only after their labs are executable.
 | L26 | [Context intelligence with explicit authority](lessons/L26-context-intelligence.md) | Ready | 45 min |
 | L27 | [Evaluate context companions without moving authority](lessons/L27-ecosystem-evidence.md) | Ready | 30 min |
 | L28 | [Verify Cairnkeep's security posture](lessons/L28-security-assurance.md) | Ready | 30 min |
+| L29 | [Reviewed team continuity preview](lessons/L29-team-continuity.md) | Brief; opt-in 2.25 preview | 40 min |
 
 The [curriculum coverage map](CURRICULUM-MAP.md) records where every public
 feature is introduced, practised, and operated. It also marks design-only work
@@ -89,6 +90,7 @@ feature.
 
 Use [the lesson template](templates/lesson-template.md). Commands in finished
 lessons must be tested against the current release before publication.
-Unpublished editorial plans and recording scripts are intentionally maintained
-outside the public product repository; stable video links or transcripts can
-be added here after publication.
+Technical lesson and rehearsal scripts in `video-scripts/` are maintained with
+the product; private editorial plans and recording evidence stay outside this
+repository. Preview scripts must not present unreleased behavior as installed
+release behavior. Stable video links can be added after publication.

package/docs/learning/lessons/L00-why-cairnkeep.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 10 minutes
-**Tested with:** Cairnkeep 2.24.0
+**Tested with:** Cairnkeep 2.26.0
 
 ## Outcome
 

package/docs/learning/lessons/L01-safe-trial.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 15 minutes
-**Tested with:** Cairnkeep 2.24.0
+**Tested with:** Cairnkeep 2.26.0
 
 ## Outcome
 
@@ -26,7 +26,7 @@ ephemeral; the named course volume is persistent.
 1. Pull the public image:
 
    ```bash
-   podman pull ghcr.io/cairnkeep/cairnkeep:2.24.0
+   podman pull ghcr.io/cairnkeep/cairnkeep:2.26.0
    ```
 
 2. Start the stdio server with a read-only root filesystem and no Linux
@@ -38,7 +38,7 @@ ephemeral; the named course volume is persistent.
      --read-only --cap-drop=all --security-opt=no-new-privileges \
      --tmpfs=/tmp:rw,noexec,nosuid,size=64m,mode=1777 \
      --volume cairnkeep-course-data:/data:Z,U \
-     ghcr.io/cairnkeep/cairnkeep:2.24.0 stdio
+     ghcr.io/cairnkeep/cairnkeep:2.26.0 stdio
    ```
 
 3. The process waits quietly for MCP input. Press `Ctrl-C` after confirming it

package/docs/learning/lessons/L02-installation.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
 
 ## Outcome
 
@@ -47,7 +47,7 @@ sync. Codex project trust remains an explicit operator decision.
 2. Install Cairnkeep:
 
    ```bash
-   npm install --global @cairnkeep/cli@2.24.0
+   npm install --global @cairnkeep/cli@2.26.0
    cairn --version
    ```
 

package/docs/learning/lessons/L03-first-project.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.24.0
+**Tested with:** Cairnkeep 2.26.0
 
 ## Outcome
 

package/docs/learning/lessons/L19-validated-skill-improvement.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Evidence and Evaluation
 **Time:** 50 minutes
-**Tested with:** Cairnkeep 2.24.0
+**Tested with:** Cairnkeep 2.26.0
 
 ## Outcome
 

package/docs/learning/lessons/L20-mcp-tool-profiles.md

@@ -1,7 +1,7 @@
 # L20 - Least-authority MCP tool profiles
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
 **Time:** 25 minutes
 
 ## Outcome

package/docs/learning/lessons/L21-context-packs.md

@@ -1,7 +1,7 @@
 # L21 - Immutable context packs and skill approval
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
 **Time:** 40 minutes
 
 ## Outcome

package/docs/learning/lessons/L22-native-windows.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Operator
 **Time:** 30 minutes
-**Tested with:** Cairnkeep 2.24.0, Windows x64, and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0, Windows x64, and Node.js 22 or newer
 
 ## Outcome
 
@@ -16,7 +16,7 @@ perform a reversible uninstall without relying on WSL or Git Bash.
 From PowerShell:
 
 ```powershell
-npm install --global @cairnkeep/cli@2.24.0
+npm install --global @cairnkeep/cli@2.26.0
 cairn version
 
 $Lab = Join-Path $env:TEMP 'Cairnkeep Windows Lab'

package/docs/learning/lessons/L23-guided-setup.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart and Operator
 **Time:** 35 minutes
-**Tested with:** Cairnkeep 2.24.0; Pi 0.84.1; Node.js 22, 24, and 26
+**Tested with:** Cairnkeep 2.26.0; Pi 0.84.1; Node.js 22, 24, and 26
 
 ## Outcome
 

package/docs/learning/lessons/L24-okf-exchange.md

@@ -1,7 +1,7 @@
 # L24 - Reviewed knowledge exchange
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L25-playbooks.md

@@ -1,7 +1,7 @@
 # L25 - Bounded workflow playbooks
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L26-context-intelligence.md

@@ -1,7 +1,7 @@
 # L26 - Context intelligence with explicit authority
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L27-ecosystem-evidence.md

@@ -1,6 +1,6 @@
 # L27 - Evaluate context companions without moving authority
 
-**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L28-security-assurance.md

@@ -1,7 +1,7 @@
 # L28 - Verify Cairnkeep's security posture
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.24.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
 
 ## Outcome
 
@@ -11,7 +11,7 @@ and choose least authority for a network-facing MCP client.
 
 ## Prerequisites
 
-- Install Cairnkeep 2.24.0 or use a disposable source checkout.
+- Install Cairnkeep 2.25.0 or use a disposable source checkout.
 - Complete [L20 - Least-authority MCP tool profiles](L20-mcp-tool-profiles.md).
 - Use synthetic values only; never paste a real bearer token into a recording,
   terminal transcript, or issue.
@@ -80,6 +80,10 @@ node mcp-memory-server/scripts/smoke-note-mcp.mjs --fixture-security-only
 node scripts/verify-phase19-runtime-evidence.mjs --self-test
 ```
 
+The aggregate serializes fixtures that patch Node's shared filesystem hooks.
+Read the [provider data-flow review](../../provider-data-flow-review.md): a
+read-only network tool can still disclose a configured workspace and query.
+
 The baseline rejects unpinned external Actions, `pull_request_target` and
 workflow-wide write permissions. It also checks the exact preparation/npm/OCI
 job permission maps, including missing provenance grants and unnecessary write

package/docs/learning/lessons/L29-team-continuity.md

@@ -0,0 +1,127 @@
+# L29 - Reviewed team continuity preview
+
+**Status:** Brief; opt-in experimental preview in Cairnkeep 2.25.0
+**Compatibility:** Cairnkeep 2.25.0 or newer for manual connection; 2.26.0 or newer
+on both client and team API for guided connection. Node 22.13 or newer for team storage.
+Use a matching source checkout for the executable regression exercises below.
+Installing the released CLI does not enable team sharing.
+
+## Outcome
+
+Carry an approved project decision from one client process and working folder
+to another, without exposing personal memory or granting an agent review power.
+Explain the difference between a restrictive MCP profile and server membership.
+
+## Prerequisites
+
+Complete L20 and L28. Use only synthetic subjects and disposable local stores.
+Build the matching checkout with `npm --prefix mcp-memory-server ci` followed by
+`npm --prefix mcp-memory-server run build`. Read [Team continuity](../../team.md).
+Do not connect a real organization or reuse a production credential.
+For an explicitly approved native-harness trial, follow the
+[isolated pilot guide](../../team-pilot.md); do not use automated rehearsal as
+a substitute for the human review or release-admission steps.
+
+## Source-checkout rehearsal
+
+From the checkout, run the offline controls:
+
+```sh
+node mcp-memory-server/scripts/smoke-team.mjs
+node mcp-memory-server/scripts/smoke-team-review.mjs
+node mcp-memory-server/scripts/smoke-team-http.mjs
+node mcp-memory-server/scripts/smoke-team-mcp.mjs
+node mcp-memory-server/scripts/smoke-team-restore.mjs
+node mcp-memory-server/scripts/smoke-team-cli.mjs
+node mcp-memory-server/scripts/smoke-team-onboarding.mjs
+```
+
+These create disposable local fixtures and an authenticated loopback service,
+invoke actual stdio MCP clients, then clean their generated directories.
+No model, personal store, external API or corporate system is used. The MCP
+control changes client identity/cwd and retrieves the same approved decision;
+it does not infer authority from the working folder or a display name.
+
+Use the [role-based handoff](../../team-onboarding.md) to separate operator,
+reader/contributor and human-reviewer tasks. Its executable reader check uses
+the original 2.25.0 CLI or newer. The 2.26.0 guided connection exercise below is
+still opt-in, not automatic enrollment or deployment. Complete
+the readiness checklist with missing decisions marked pending; do not enroll
+real users or introduce real data during this exercise.
+
+## Guided client exercise (2.26 or newer)
+
+Use the [guided connection recipe](../../team-onboarding.md#guided-connection-next-release--matching-source-checkout)
+with a disposable project and the operator's synthetic workload-reader file.
+Run `cairn team connect` once without `--apply`: inspect its selected project,
+read-only profile and additional harness files. Confirm that personal/unrelated
+MCP entries remain present. Explicitly apply, then run
+`cairn team doctor --client --project-root PATH`. Explain the reported credential
+expiry/roles and why no memory text is needed to check project access.
+
+Move to another folder: the saved connection still names the explicit team
+project. Try an unrelated project and a revoked credential; both must fail.
+Compare a disconnect plan with `disconnect --apply --yes`: tokens/backups stay,
+only owned unchanged entries disappear. Existing sessions require restart or
+server-side revocation; removing local config is not offboarding.
+
+The onboarding regression uses two workload identities and four generated
+adapter configurations, actual MCP reads from different folders, a synthetic
+review-policy fixture, interrupted activation/recovery and competing writers.
+It does not claim two independent humans, a real user approval, every native
+harness UI or an LLM quality advantage. No paid model is used. Keep the lesson
+Brief until the release-verified learner lab is independently rehearsed.
+
+Trace the lifecycle beside the operator commands in the reference:
+
+```text
+selected text → immutable proposal → different human reviews exact digest
+             → approved revision → authorized readers across client sessions
+```
+
+Stop at each negative control: unapproved proposal invisible to readers;
+self/workload review denied; stale policy/base conflicts; unrelated project
+denied; revoked credential blocked; restore refuses a live target and revokes
+all copied credentials. A confirmed value hash is not evidence of human consent.
+
+For project offboarding, use:
+
+```sh
+cairn team member remove SUBJECT --project ID --data DIR
+```
+
+Verify that a connected client immediately loses access while the subject's
+other project memberships still work. Re-enroll with `member set` and
+an explicit nonempty `--roles` list; revoke credentials separately when needed.
+
+## Acceptance criteria
+
+- Two independent stdio clients retrieve identical approved text and provenance.
+- Personal memory is untouched, and failed team retrieval never changes scope.
+- Reader profiles contain observations only; proposal creation requires consent.
+- Human review is absent from the MCP catalog and cannot be performed by workload tokens.
+- Role changes and offboarding apply to already-connected clients.
+- Backup verifies digests and audit links; restored data needs fresh credentials.
+- CLI administration returns to the shell; credentials are never printed.
+- Temporary restore remnants are reported, never silently deleted or activated.
+- Independent production review and a deployment's approved real-data pilot are
+  separate from the completed internal review and isolated native pilot.
+
+## Privacy and trust boundary
+
+Proposals and snapshots contain selected shared text and identities. Keep them
+private and encrypted by the surrounding storage/backup system. Roles do not
+make retrieved text executable authority. The OS owner administers membership
+and can rewrite the local database; hash links are not independent signatures.
+Team search is deterministic substring matching with no provider request.
+Personal-memory embedding and reranking settings do not apply to team search.
+This token-first JSON API plus local stdio bridge is not OAuth remote MCP HTTP.
+
+## Recovery
+
+The controls clean only their own temporary fixtures. For manual rehearsal,
+stop the disposable service, verify the exact generated paths and remove only
+that lab. Never run a purge against a real store for a recording. Logical key
+deletion does not erase old backup copies or guarantee physical erasure.
+Restoring a real service, enrolling users and publishing a release need separate
+admission evidence; passing this rehearsal does not supply it.

package/docs/learning/tracks/operator.md

@@ -19,6 +19,10 @@
 13. [L26 - Context intelligence with explicit authority](../lessons/L26-context-intelligence.md)
 14. [L27 - Evaluate ecosystem ideas with bounded evidence](../lessons/L27-ecosystem-evidence.md)
 15. [L28 - Verify Cairnkeep's security posture](../lessons/L28-security-assurance.md)
+16. Optional 2.25 preview: [L29 - Reviewed team continuity](../lessons/L29-team-continuity.md).
+    Do not enable it in production before the independent review and approved pilot.
+    Version 2.26.0 adds guided additive connection, client
+    diagnostics and disconnect/recovery exercises; no production enrollment.
 
 All modules are optional. The track is complete when the operator can add and
 remove each integration without breaking the standalone local workflow and can

package/docs/learning/video-scripts/V28-security-assurance.md

@@ -60,6 +60,10 @@ npm --prefix mcp-memory-server run check:http-guard
 Highlight full-SHA action pins, CodeQL, dependency review, token non-leakage,
 portable Windows/POSIX path cases, and the HTTP 413 test. Do not show repository
 secrets or live security-alert details.
+Explain that a passing retry is not a root-cause fix: the aggregate now
+serializes filesystem-hook fixtures without weakening read/growth assertions.
+Use the [provider flow review](../../provider-data-flow-review.md) to distinguish
+an intentional workspace/query disclosure from arbitrary-file upload.
 
 Include the offline pointer-lock control in a source checkout:
 `node mcp-memory-server/scripts/smoke-context-pack-lock.mjs`. It reproduces