@cairnkeep/cli 2.25.0 → 2.26.0

package/CHANGELOG.md

@@ -5,6 +5,47 @@ All notable user-facing changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [2.26.0] - 2026-10-26
+
+### Guided team onboarding
+
+- Add opt-in `cairn team connect` with terminal harness selectors, a no-write
+  plan, explicit apply/confirmation and a read-only default. Add a dedicated
+  project-local MCP entry for Claude Code, OpenCode, Qwen Code or Codex without
+  replacing personal/unrelated MCPs. Store only private token-file references;
+  pin the bridge to one explicit server project.
+- Add `cairn team doctor --client` with authenticated, metadata-only project
+  diagnostics; no local admin store or memory payload. Add drift-aware
+  `disconnect`, private recoverable backups, serialized writers and a committed
+  activation record so interrupted multi-file connections stay inactive.
+- Add synthetic two-identity, adapter/cwd continuity, denied self-publication,
+  revocation and interrupted-recovery controls, plus actual installed-package
+  onboarding checks. Update completions, storage/privacy and learning/video
+  briefs. No new dependency, automatic enrollment or production admission.
+
+### Verification
+
+- Keep all CodeQL actions on one reviewed commit and group their dependency
+  updates; reject split or unpinned cohorts with mutation controls. Refresh
+  pinned CodeQL, Scorecard and release artifact-download actions.
+- Retry bounded capability-lock acquisition when the previous writer removes
+  the lock between contention and inspection. Keep other inspection failures
+  denied and add a deterministic disappearance regression; preserve concurrent
+  child diagnostics on lifecycle-test failure.
+
+- Serialize asynchronous security fixtures that patch shared filesystem
+  built-ins, with an aggregate hook-ownership/restoration regression. Preserve
+  runtime read guards and all actual replacement/growth injection assertions.
+- Add real MCP coverage and a review of file-derived provider workspace flows;
+  verify destination, credential and selected-content boundaries without
+  suppressing static-analysis findings.
+
+### Documentation
+
+- Add role-based team-preview onboarding, a tested reader connection card and
+  deployment-readiness checklist; align the reference, pilot, lesson and video
+  brief without enabling sharing or changing the released CLI.
+
 ## [2.25.0] - 2026-10-24
 
 ### Team continuity preview

package/docs/README.md

@@ -80,6 +80,8 @@ linked guides rather than the project landing page.
   authenticated shared-memory store, human review, local MCP bridge and recovery.
   It ships as an opt-in experimental preview from 2.25.0, not general production admission. The
   [isolated pilot guide](team-pilot.md) keeps trials separate from personal memory.
+  [Role-based onboarding](team-onboarding.md) adds a tested reader check and
+  the deployment decisions to resolve before any real-data pilot.
 - [Building an overlay](building-an-overlay.md) explains how to add private
   provider or organization policy without forking the core.
 - [Managed overlay distributions](overlay-distributions.md) covers wrapper CLIs,

package/docs/harness-compatibility.md

@@ -357,8 +357,11 @@ itself is not enough to claim Cairnkeep support.
 ## Optional team bridge (opt-in 2.25 preview)
 
 [Team continuity](team.md) adds an additional generic local stdio MCP:
-`cairn team mcp`. It does not replace `cairn-memory`, rewrite harness config
-or change existing setup. Every call supplies a server project ID explicitly;
+`cairn team mcp`. It does not replace `cairn-memory` or change existing setup.
+The 2.26.0 explicit `team connect` wizard adds only a project-local team
+entry for Claude Code, OpenCode, Qwen Code or Codex; global config is unchanged.
+See [supported files and safe recovery](team-onboarding.md#guided-connection-next-release--matching-source-checkout).
+Other adapters retain the manual connection recipe. Every call supplies a server project ID explicitly;
 the same credentials/project IDs work regardless of the starting cwd.
 Configure private file-based credentials and the separate JSON API URL in the
 client environment. Human reviewer credentials must not enter the agent's

package/docs/learning/CURRICULUM-MAP.md

@@ -1,7 +1,7 @@
 # Curriculum Coverage Map
 
-**Baseline:** Cairnkeep 2.25.0
-**Last reviewed:** 2026-10-22
+**Baseline:** Cairnkeep 2.26.0
+**Last reviewed:** 2026-10-26
 
 This map prevents the course from drifting behind the product. It assigns each
 user-facing surface to a lesson and records whether the lesson is complete or
@@ -99,7 +99,7 @@ against `cairn help` so a new command cannot bypass a curriculum decision.
 | `cairn sync-omp` | L02 |
 | `cairn doctor` | L03; advanced repair in L13-L14 |
 | `cairn security` | L28 |
-| `cairn team` | L29 opt-in preview, included from 2.25.0 |
+| `cairn team` | L29 opt-in preview, included from 2.25.0; next-release guided connect/client doctor/disconnect requires matching client/API |
 | `cairn playbook` | L25 |
 | `cairn trajectory` | L13 |
 | `cairn artifact` | L13 |

package/docs/learning/FEATURE-GUIDE.md

@@ -1,6 +1,6 @@
 # Cairnkeep feature guide
 
-**Baseline:** Cairnkeep 2.25.0
+**Baseline:** Cairnkeep 2.26.0
 
 This is the step-back map for choosing and operating Cairnkeep features. The
 [course labs](https://github.com/cairnkeep/cairnkeep-course-labs) provide one
@@ -191,6 +191,12 @@ human-only review and an additional local stdio MCP bridge. It never scans
 personal memory or automatically installs a harness entry. Serving requires
 separate HTTP consent; this JSON API is not OAuth remote MCP HTTP.
 
+From 2.26.0, `cairn team connect` plans an additive project-local connection,
+`cairn team doctor --client` checks authenticated metadata, and `disconnect`
+supports drift-aware recovery. Both client and team API must be 2.26 or newer.
+These commands do not enroll users or enable sharing automatically. See the
+[guided recipe](../team-onboarding.md#guided-connection-226-or-newer).
+
 Authority is rechecked per request. Backup/restore validates integrity and
 revokes restored credentials; retention is manual, and logical deletion is not
 physical erasure. Feature/profile changes require restarting the bridge;

package/docs/learning/lessons/L00-why-cairnkeep.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 10 minutes
-**Tested with:** Cairnkeep 2.25.0
+**Tested with:** Cairnkeep 2.26.0
 
 ## Outcome
 

package/docs/learning/lessons/L01-safe-trial.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 15 minutes
-**Tested with:** Cairnkeep 2.25.0
+**Tested with:** Cairnkeep 2.26.0
 
 ## Outcome
 
@@ -26,7 +26,7 @@ ephemeral; the named course volume is persistent.
 1. Pull the public image:
 
    ```bash
-   podman pull ghcr.io/cairnkeep/cairnkeep:2.25.0
+   podman pull ghcr.io/cairnkeep/cairnkeep:2.26.0
    ```
 
 2. Start the stdio server with a read-only root filesystem and no Linux
@@ -38,7 +38,7 @@ ephemeral; the named course volume is persistent.
      --read-only --cap-drop=all --security-opt=no-new-privileges \
      --tmpfs=/tmp:rw,noexec,nosuid,size=64m,mode=1777 \
      --volume cairnkeep-course-data:/data:Z,U \
-     ghcr.io/cairnkeep/cairnkeep:2.25.0 stdio
+     ghcr.io/cairnkeep/cairnkeep:2.26.0 stdio
    ```
 
 3. The process waits quietly for MCP input. Press `Ctrl-C` after confirming it

package/docs/learning/lessons/L02-installation.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
 
 ## Outcome
 
@@ -47,7 +47,7 @@ sync. Codex project trust remains an explicit operator decision.
 2. Install Cairnkeep:
 
    ```bash
-   npm install --global @cairnkeep/cli@2.25.0
+   npm install --global @cairnkeep/cli@2.26.0
    cairn --version
    ```
 

package/docs/learning/lessons/L03-first-project.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.25.0
+**Tested with:** Cairnkeep 2.26.0
 
 ## Outcome
 

package/docs/learning/lessons/L19-validated-skill-improvement.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Evidence and Evaluation
 **Time:** 50 minutes
-**Tested with:** Cairnkeep 2.25.0
+**Tested with:** Cairnkeep 2.26.0
 
 ## Outcome
 

package/docs/learning/lessons/L20-mcp-tool-profiles.md

@@ -1,7 +1,7 @@
 # L20 - Least-authority MCP tool profiles
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
 **Time:** 25 minutes
 
 ## Outcome

package/docs/learning/lessons/L21-context-packs.md

@@ -1,7 +1,7 @@
 # L21 - Immutable context packs and skill approval
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
 **Time:** 40 minutes
 
 ## Outcome

package/docs/learning/lessons/L22-native-windows.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Operator
 **Time:** 30 minutes
-**Tested with:** Cairnkeep 2.25.0, Windows x64, and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0, Windows x64, and Node.js 22 or newer
 
 ## Outcome
 
@@ -16,7 +16,7 @@ perform a reversible uninstall without relying on WSL or Git Bash.
 From PowerShell:
 
 ```powershell
-npm install --global @cairnkeep/cli@2.25.0
+npm install --global @cairnkeep/cli@2.26.0
 cairn version
 
 $Lab = Join-Path $env:TEMP 'Cairnkeep Windows Lab'

package/docs/learning/lessons/L23-guided-setup.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart and Operator
 **Time:** 35 minutes
-**Tested with:** Cairnkeep 2.25.0; Pi 0.84.1; Node.js 22, 24, and 26
+**Tested with:** Cairnkeep 2.26.0; Pi 0.84.1; Node.js 22, 24, and 26
 
 ## Outcome
 

package/docs/learning/lessons/L24-okf-exchange.md

@@ -1,7 +1,7 @@
 # L24 - Reviewed knowledge exchange
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L25-playbooks.md

@@ -1,7 +1,7 @@
 # L25 - Bounded workflow playbooks
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L26-context-intelligence.md

@@ -1,7 +1,7 @@
 # L26 - Context intelligence with explicit authority
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L27-ecosystem-evidence.md

@@ -1,6 +1,6 @@
 # L27 - Evaluate context companions without moving authority
 
-**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L28-security-assurance.md

@@ -1,7 +1,7 @@
 # L28 - Verify Cairnkeep's security posture
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
 
 ## Outcome
 
@@ -80,6 +80,10 @@ node mcp-memory-server/scripts/smoke-note-mcp.mjs --fixture-security-only
 node scripts/verify-phase19-runtime-evidence.mjs --self-test
 ```
 
+The aggregate serializes fixtures that patch Node's shared filesystem hooks.
+Read the [provider data-flow review](../../provider-data-flow-review.md): a
+read-only network tool can still disclose a configured workspace and query.
+
 The baseline rejects unpinned external Actions, `pull_request_target` and
 workflow-wide write permissions. It also checks the exact preparation/npm/OCI
 job permission maps, including missing provenance grants and unnecessary write

package/docs/learning/lessons/L29-team-continuity.md

@@ -1,7 +1,8 @@
 # L29 - Reviewed team continuity preview
 
 **Status:** Brief; opt-in experimental preview in Cairnkeep 2.25.0
-**Compatibility:** Cairnkeep 2.25.0 or newer; Node 22.13 or newer for team storage.
+**Compatibility:** Cairnkeep 2.25.0 or newer for manual connection; 2.26.0 or newer
+on both client and team API for guided connection. Node 22.13 or newer for team storage.
 Use a matching source checkout for the executable regression exercises below.
 Installing the released CLI does not enable team sharing.
 
@@ -32,6 +33,7 @@ node mcp-memory-server/scripts/smoke-team-http.mjs
 node mcp-memory-server/scripts/smoke-team-mcp.mjs
 node mcp-memory-server/scripts/smoke-team-restore.mjs
 node mcp-memory-server/scripts/smoke-team-cli.mjs
+node mcp-memory-server/scripts/smoke-team-onboarding.mjs
 ```
 
 These create disposable local fixtures and an authenticated loopback service,
@@ -40,6 +42,36 @@ No model, personal store, external API or corporate system is used. The MCP
 control changes client identity/cwd and retrieves the same approved decision;
 it does not infer authority from the working folder or a display name.
 
+Use the [role-based handoff](../../team-onboarding.md) to separate operator,
+reader/contributor and human-reviewer tasks. Its executable reader check uses
+the original 2.25.0 CLI or newer. The 2.26.0 guided connection exercise below is
+still opt-in, not automatic enrollment or deployment. Complete
+the readiness checklist with missing decisions marked pending; do not enroll
+real users or introduce real data during this exercise.
+
+## Guided client exercise (2.26 or newer)
+
+Use the [guided connection recipe](../../team-onboarding.md#guided-connection-next-release--matching-source-checkout)
+with a disposable project and the operator's synthetic workload-reader file.
+Run `cairn team connect` once without `--apply`: inspect its selected project,
+read-only profile and additional harness files. Confirm that personal/unrelated
+MCP entries remain present. Explicitly apply, then run
+`cairn team doctor --client --project-root PATH`. Explain the reported credential
+expiry/roles and why no memory text is needed to check project access.
+
+Move to another folder: the saved connection still names the explicit team
+project. Try an unrelated project and a revoked credential; both must fail.
+Compare a disconnect plan with `disconnect --apply --yes`: tokens/backups stay,
+only owned unchanged entries disappear. Existing sessions require restart or
+server-side revocation; removing local config is not offboarding.
+
+The onboarding regression uses two workload identities and four generated
+adapter configurations, actual MCP reads from different folders, a synthetic
+review-policy fixture, interrupted activation/recovery and competing writers.
+It does not claim two independent humans, a real user approval, every native
+harness UI or an LLM quality advantage. No paid model is used. Keep the lesson
+Brief until the release-verified learner lab is independently rehearsed.
+
 Trace the lifecycle beside the operator commands in the reference:
 
 ```text

package/docs/learning/tracks/operator.md

@@ -21,6 +21,8 @@
 15. [L28 - Verify Cairnkeep's security posture](../lessons/L28-security-assurance.md)
 16. Optional 2.25 preview: [L29 - Reviewed team continuity](../lessons/L29-team-continuity.md).
     Do not enable it in production before the independent review and approved pilot.
+    Version 2.26.0 adds guided additive connection, client
+    diagnostics and disconnect/recovery exercises; no production enrollment.
 
 All modules are optional. The track is complete when the operator can add and
 remove each integration without breaking the standalone local workflow and can

package/docs/learning/video-scripts/V28-security-assurance.md

@@ -60,6 +60,10 @@ npm --prefix mcp-memory-server run check:http-guard
 Highlight full-SHA action pins, CodeQL, dependency review, token non-leakage,
 portable Windows/POSIX path cases, and the HTTP 413 test. Do not show repository
 secrets or live security-alert details.
+Explain that a passing retry is not a root-cause fix: the aggregate now
+serializes filesystem-hook fixtures without weakening read/growth assertions.
+Use the [provider flow review](../../provider-data-flow-review.md) to distinguish
+an intentional workspace/query disclosure from arbitrary-file upload.
 
 Include the offline pointer-lock control in a source checkout:
 `node mcp-memory-server/scripts/smoke-context-pack-lock.mjs`. It reproduces

package/docs/learning/video-scripts/V29-team-continuity.md

@@ -1,6 +1,7 @@
 # V29 - Remember together without sharing everything
 
-Status: technical rehearsal brief for the opt-in Cairnkeep 2.25.0 preview.
+Status: technical rehearsal brief for Cairnkeep 2.26.0 guided onboarding to the
+opt-in preview introduced in 2.25.0. Not a recorded or independently rehearsed lesson.
 Target: 10–12 minutes, experienced-developer audience. Describe a released
 experimental preview, not a generally production-admitted team service.
 Use the [isolated pilot guide](../../team-pilot.md) for a separately authorized
@@ -20,6 +21,10 @@ Use a disposable source checkout and only synthetic fixtures. Show
 `docs/team.md`; highlight that a reviewer token is human-only and is never
 handed to the agent. Briefly show initialization/membership command forms,
 with no token contents on screen. The server is loopback-only.
+Use the [role-based handoff](../../team-onboarding.md) connection card to show
+which steps belong to the operator, reader and human reviewer. Run its actual
+reader check in the disposable lab; never film a credential or replace the
+personal memory entry. Keep a pause on the pending deployment decisions.
 
 ## 3:30–6:00 — Make the boundary visible
 
@@ -47,6 +52,19 @@ on “restored credentials revoked”: copying a backup must not silently restor
 access. Show fresh-only restore, no-overwrite and uninstall-retention controls.
 Explain that logical deletion is not secure disk erasure or backup deletion.
 
+With a matching 2.26.0-or-newer client and team API, insert a short dynamic client segment:
+open the harness checkboxes in `team connect`, pause on the no-write plan and
+read-only default, then explicitly apply in a disposable project. Keep the
+personal MCP entry visible beside the new team entry. Run `team doctor --client`
+and zoom into expiry/project/roles, never the token file or original-config
+backup. Switch folders, show the pinned project, then plan/apply disconnect.
+Explain that disconnect is not revocation and running sessions need a restart.
+Use the maintained `smoke-team-onboarding.mjs` results for interruption/drift
+controls, not a fabricated typing transcript. The automated human-class policy
+fixture is not actual human consent; no independent-human trial is claimed.
+Do not record this addition against a 2.25-only client/API; follow the version
+note in the onboarding guide and verify the published package before recording.
+
 ## 10:00–11:30 — Honest closing
 
 End on the admission checklist in `docs/team.md`, not a production deployment.

package/docs/operating.md

@@ -1550,6 +1550,12 @@ project memory. It is default off (`CAIRN_TEAM=1` required); serving also needs
 `CAIRN_TEAM_HTTP=1`. It does not change ordinary setup or existing MCP entries.
 Use [the team reference](team.md) for roles, private credentials, additional
 local stdio registration, human review, backup/restore and incident handling.
+The 2.26.0 guided client workflow is documented in
+[team onboarding](team-onboarding.md#guided-connection-next-release--matching-source-checkout):
+`team connect` plans before explicit apply, `team doctor --client` checks only
+authenticated project/credential metadata, and `team disconnect` preserves
+personal memory and credentials. Both client and team API must support 2.26's
+connection check. No ordinary setup or production sharing is enabled implicitly.
 The internal governed review and approved isolated native pilot are complete;
 independent production review and a deployment-specific approved real-data pilot
 are still required before using real organization data.

package/docs/privacy-and-data-flow.md

@@ -14,7 +14,7 @@ below (some operator-owned endpoints do not require a credential).
 | Embedding-ranked search | Stored memory values that are not cached, plus the search query | `CAIRN_MEMORY_EMBEDDING_URL` or `CAIRN_LLM_API_URL` |
 | Separately opted-in memory reranking | Query and at most 50 scope/current/filter-admitted key/value excerpts, each at most 4 KiB | Only the explicit `CAIRN_MEMORY_RERANK_URL`; separate optional credential, no retries/redirects/alternate hosts |
 | `memory_extract` | The transcript supplied to the tool | `CAIRN_LLM_API_URL` |
-| `domain_knowledge_query` | Workspace slug and query | `ANYTHINGLLM_BASE_URL` |
+| `domain_knowledge_query` | Workspace identifier and query | Configured domain provider: `ANYTHINGLLM_BASE_URL`, or separately enabled `CAIRN_OPENVIKING_BASE_URL` |
 | `domain_knowledge_sync` | Files selected by the sync configuration | `ANYTHINGLLM_BASE_URL` |
 | `route_check` | A health request, with no memory or prompt content | `CAIRN_ROUTE_ENDPOINT` |
 | `context_explore` | Repository path and query are passed to the configured local executable | `CAIRN_EXPLORE_BINARY`; any further data flow is controlled by that tool |
@@ -57,6 +57,14 @@ it does not require or inherit `CAIRN_LLM_API_KEY`. A local provider is still a
 separate process that receives these excerpts. Neither a chat agent nor a
 research assistant is part of reranking or authorization.
 
+## Domain retrieval configuration
+
+Domain queries may derive a workspace identifier from local configuration;
+that identifier is intentionally disclosed to the chosen provider. This does
+not upload the configuration file or other local documents. See the
+[provider data-flow review](provider-data-flow-review.md) for the exact tested
+boundary and its limitations.
+
 ## Playbook decision and receipt flow
 
 Playbooks are local workflow policy, not model inference. A check reads the
@@ -720,3 +728,15 @@ tokens. Backups include shared proposals and memberships and need separate
 encryption and access control. No unapproved personal content is discoverable.
 A hash confirmation does not establish human consent or content truth.
 Review and production admission remain separate operator responsibilities.
+
+The opt-in guided connection workflow stores endpoint/org/project IDs and a
+credential **file path**, never the credential bytes, in private client state.
+Its project-local MCP entry references that connection file; personal/global
+MCP configuration is not replaced. Private recovery snapshots copy the original
+harness configuration and may therefore contain preexisting operator secrets;
+keep them out of source control and protect/encrypt backups separately.
+Client doctor's authenticated metadata probe discloses the chosen project ID
+to the configured service and returns only subject, roles and credential
+ID/class/expiry. It neither reads memory text nor sends data to model providers.
+It appends a normal value-free service audit event. Disconnect retains backups
+and tokens and is not server-side revocation. See [onboarding](team-onboarding.md).

package/docs/provider-data-flow-review.md

@@ -0,0 +1,48 @@
+# Domain retrieval data-flow review
+
+The `js/file-access-to-http` findings in `domain-retrieval-provider.ts` trace
+the default workspace from the local memory configuration through
+`domain_knowledge_query` to the configured provider. The source is the
+`anythingllm_workspaces` field, not arbitrary document contents or stored memory.
+
+This is an intentional disclosure boundary, not evidence of no disclosure:
+the configured workspace identifier and the selected query leave the process.
+Only configure a provider trusted to receive both. A read-only MCP annotation
+means the tool does not mutate Cairnkeep state; it does **not** mean no network
+traffic. The tool's open-world annotation reflects this boundary.
+
+## Boundaries checked
+
+- Provider origin and authentication come from operator environment settings,
+  not workspace values or unrelated keys in a memory configuration file.
+- The default provider percent-encodes the workspace as one path segment. A
+  workspace that resembles a URL cannot select another origin or add headers.
+- The optional resource provider uses its fixed read-only endpoint, scopes
+  target identifiers below resources and rejects decoded traversal segments.
+  It requires explicit feature consent and separate remote-HTTP consent.
+- Neither request path reads, enumerates or uploads local documents. The
+  query tool is separate from explicitly approved document synchronization.
+- Both providers refuse redirects, bound responses and sanitize failures.
+  Do not weaken these controls to make a static-analysis finding disappear.
+
+`smoke-provider-config-flow.mjs` exercises the actual stdio MCP configuration
+path for both providers, including a URL-shaped workspace, unrelated file
+sentinels and forged endpoint/credential fields. It asserts the exact selected
+request body, fixed mock origin and operator-supplied authentication. All
+fixtures are synthetic and run against loopback only. Existing outbound tests
+cover redirect denial, consent, response bounds and payload-free failures.
+
+## Review disposition and limits
+
+The reviewed flows are expected provider-routing disclosures, not a discovered
+arbitrary-file-upload or file-selected-origin vulnerability. The alerts are
+not dismissed or suppressed by this change: retain the finding and this
+rationale for review, and reassess when source fields, destination selection,
+workspace handling or provider behavior changes.
+
+This is not a sandbox or a provider-side workspace ACL. A trusted local caller
+can explicitly choose another workspace served by its provider credential;
+the existing shared-token HTTP service is one trusted storage domain. Team
+authorization remains separate, and team retrieval does not use these providers.
+Same-account processes can change operator configuration. Tests establish the
+documented application boundary, not the trustworthiness of a configured host.

package/docs/security-assurance.md

@@ -138,6 +138,10 @@ prove a future privileged publish run succeeds.
 
 ## Verification evidence
 
+The [domain retrieval data-flow review](provider-data-flow-review.md) records
+the intentional file-derived workspace disclosure and its tested destination,
+credential and content boundaries. Static-analysis alerts are not suppressed.
+
 The maintained gates are `npm run security:baseline`, both production
 `npm audit` checks, `scripts/test-security-baseline.sh`, the memory-server
 security-assurance and HTTP-guard smoke tests, native-Windows tests, and the
@@ -161,6 +165,7 @@ node mcp-memory-server/scripts/smoke-runtime-file-reads.mjs
 node mcp-memory-server/scripts/smoke-bounded-input-reads.mjs
 node mcp-memory-server/scripts/smoke-workspace-file-security.mjs
 node mcp-memory-server/scripts/smoke-outbound-security.mjs
+node mcp-memory-server/scripts/smoke-security-fixture-order.mjs
 node scripts/test-runtime-file-security.mjs
 node scripts/test-omp-staged-security.mjs
 node scripts/test-container-health.mjs
@@ -173,6 +178,12 @@ assert that every historical CodeQL/Scorecard alert is fixed. Triage findings
 individually and use a fresh default-branch analysis to confirm alert status;
 never dismiss an uninvestigated finding merely to improve the score.
 
+The aggregate imports filesystem-hook fixtures sequentially. Top-level-await
+siblings are not a serial test runner: overlapping imports can restore another
+fixture's hooks and create a false failure before growth injection. The
+aggregate ownership/restoration observer covers this test-isolation contract;
+runtime reader checks and injection assertions remain unchanged.
+
 The developer-evidence follow-up also hardens the shared runtime note pre-image
 hasher: it reads from an inspected descriptor under a 64 MiB cap and rejects
 replacement or growth before accepting a hash. Missing targets remain valid

package/docs/storage.md

@@ -620,3 +620,17 @@ pages, WAL or backup copies. Uninstall retains team data and refuses purge
 targets overlapping its configured directory. Independently selected
 `--data` stores must be outside purge targets or also configured through
 `CAIRN_TEAM_BASE_DIR`. Keep encrypted backups separately protected.
+
+Guided client connection state is separate from the organization database:
+`~/.cairnkeep/team-clients/<sha256-of-canonical-project-path>/` holds a strict
+versioned connection, private recovery receipt/original config snapshots and
+an exclusive sibling `<project-path-hash>.operation.lock`. Keeping the open lock
+outside the archived directory preserves native Windows rename semantics and
+continuous writer exclusion. Records contain token-file paths, not raw tokens.
+Original MCP configs can contain other secrets, so protect these backups.
+Activation is committed only after all selected entries are written. An
+interrupted connect stays inactive; interrupted disconnect can resume without
+overwriting unrelated edits. There is no automatic stale-lock cleanup.
+Disconnect archives state in a unique `.disconnected-*` sibling and retains
+credentials; uninstall/purge refuses to delete team client state/backups.
+See [client diagnostics/recovery](team-onboarding.md#client-diagnosis-and-recovery).