@cairnkeep/cli 2.25.0 → 2.27.0

package/CHANGELOG.md

@@ -5,6 +5,70 @@ All notable user-facing changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [2.27.0] - 2026-10-26
+
+### Team operations
+
+- Add opt-in bounded paging to team listings with authenticated,
+  credential/project/filter/policy/view-bound cursors and unchanged legacy arrays.
+- Add payload-free capacity diagnostics, metadata-only audit export/verification
+  and backup-bound, exact-digest archival. Default to a no-write plan; explicit
+  apply atomically retains a chain checkpoint and frees the active audit prefix.
+  Retain external archives/backups; do not enable automatic retention or sharing.
+- Keep existing team stores/snapshots at v1 until explicit archival; compacted
+  stores use v2 and require the new server/admin binary. Restore revokes copied
+  credentials. Document offline operation and old-format rollback requirements.
+- Add disposable cross-process continuity endurance and adversarial/installed
+  package controls. Update operating/privacy/storage and learning/video briefs;
+  no new recording, independent-human trial or production admission is claimed.
+
+### Release maintenance
+
+- Use fresh process-scoped npm verification metadata/cache without weakening
+  signature, provenance or exact-byte checks. Record per-contract smoke timings
+  and rebalance complete Windows shards using measured hosted durations.
+
+## [2.26.0] - 2026-10-26
+
+### Guided team onboarding
+
+- Add opt-in `cairn team connect` with terminal harness selectors, a no-write
+  plan, explicit apply/confirmation and a read-only default. Add a dedicated
+  project-local MCP entry for Claude Code, OpenCode, Qwen Code or Codex without
+  replacing personal/unrelated MCPs. Store only private token-file references;
+  pin the bridge to one explicit server project.
+- Add `cairn team doctor --client` with authenticated, metadata-only project
+  diagnostics; no local admin store or memory payload. Add drift-aware
+  `disconnect`, private recoverable backups, serialized writers and a committed
+  activation record so interrupted multi-file connections stay inactive.
+- Add synthetic two-identity, adapter/cwd continuity, denied self-publication,
+  revocation and interrupted-recovery controls, plus actual installed-package
+  onboarding checks. Update completions, storage/privacy and learning/video
+  briefs. No new dependency, automatic enrollment or production admission.
+
+### Verification
+
+- Keep all CodeQL actions on one reviewed commit and group their dependency
+  updates; reject split or unpinned cohorts with mutation controls. Refresh
+  pinned CodeQL, Scorecard and release artifact-download actions.
+- Retry bounded capability-lock acquisition when the previous writer removes
+  the lock between contention and inspection. Keep other inspection failures
+  denied and add a deterministic disappearance regression; preserve concurrent
+  child diagnostics on lifecycle-test failure.
+
+- Serialize asynchronous security fixtures that patch shared filesystem
+  built-ins, with an aggregate hook-ownership/restoration regression. Preserve
+  runtime read guards and all actual replacement/growth injection assertions.
+- Add real MCP coverage and a review of file-derived provider workspace flows;
+  verify destination, credential and selected-content boundaries without
+  suppressing static-analysis findings.
+
+### Documentation
+
+- Add role-based team-preview onboarding, a tested reader connection card and
+  deployment-readiness checklist; align the reference, pilot, lesson and video
+  brief without enabling sharing or changing the released CLI.
+
 ## [2.25.0] - 2026-10-24
 
 ### Team continuity preview

package/docs/README.md

@@ -76,10 +76,16 @@ linked guides rather than the project landing page.
 
 ## Overlays and teams
 
+- [Team operations](team-operations.md): scoped paging, capacity, explicit
+  backup-bound audit archival and synthetic endurance from 2.27.0. Availability
+  is not permission to enable sharing.
+
 - [Team continuity preview](team.md) documents the default-off, separately
   authenticated shared-memory store, human review, local MCP bridge and recovery.
   It ships as an opt-in experimental preview from 2.25.0, not general production admission. The
   [isolated pilot guide](team-pilot.md) keeps trials separate from personal memory.
+  [Role-based onboarding](team-onboarding.md) adds a tested reader check and
+  the deployment decisions to resolve before any real-data pilot.
 - [Building an overlay](building-an-overlay.md) explains how to add private
   provider or organization policy without forking the core.
 - [Managed overlay distributions](overlay-distributions.md) covers wrapper CLIs,

package/docs/harness-compatibility.md

@@ -357,8 +357,11 @@ itself is not enough to claim Cairnkeep support.
 ## Optional team bridge (opt-in 2.25 preview)
 
 [Team continuity](team.md) adds an additional generic local stdio MCP:
-`cairn team mcp`. It does not replace `cairn-memory`, rewrite harness config
-or change existing setup. Every call supplies a server project ID explicitly;
+`cairn team mcp`. It does not replace `cairn-memory` or change existing setup.
+The 2.26.0 explicit `team connect` wizard adds only a project-local team
+entry for Claude Code, OpenCode, Qwen Code or Codex; global config is unchanged.
+See [supported files and safe recovery](team-onboarding.md#guided-connection-next-release--matching-source-checkout).
+Other adapters retain the manual connection recipe. Every call supplies a server project ID explicitly;
 the same credentials/project IDs work regardless of the starting cwd.
 Configure private file-based credentials and the separate JSON API URL in the
 client environment. Human reviewer credentials must not enter the agent's

package/docs/learning/CURRICULUM-MAP.md

@@ -1,7 +1,7 @@
 # Curriculum Coverage Map
 
-**Baseline:** Cairnkeep 2.25.0
-**Last reviewed:** 2026-10-22
+**Baseline:** Cairnkeep 2.27.0
+**Last reviewed:** 2026-10-26
 
 This map prevents the course from drifting behind the product. It assigns each
 user-facing surface to a lesson and records whether the lesson is complete or
@@ -99,7 +99,7 @@ against `cairn help` so a new command cannot bypass a curriculum decision.
 | `cairn sync-omp` | L02 |
 | `cairn doctor` | L03; advanced repair in L13-L14 |
 | `cairn security` | L28 |
-| `cairn team` | L29 opt-in preview, included from 2.25.0 |
+| `cairn team` | L29 opt-in preview, included from 2.25.0; next-release guided connect/client doctor/disconnect requires matching client/API |
 | `cairn playbook` | L25 |
 | `cairn trajectory` | L13 |
 | `cairn artifact` | L13 |

package/docs/learning/FEATURE-GUIDE.md

@@ -1,6 +1,6 @@
 # Cairnkeep feature guide
 
-**Baseline:** Cairnkeep 2.25.0
+**Baseline:** Cairnkeep 2.27.0
 
 This is the step-back map for choosing and operating Cairnkeep features. The
 [course labs](https://github.com/cairnkeep/cairnkeep-course-labs) provide one
@@ -191,6 +191,18 @@ human-only review and an additional local stdio MCP bridge. It never scans
 personal memory or automatically installs a harness entry. Serving requires
 separate HTTP consent; this JSON API is not OAuth remote MCP HTTP.
 
+From 2.26.0, `cairn team connect` plans an additive project-local connection,
+`cairn team doctor --client` checks authenticated metadata, and `disconnect`
+supports drift-aware recovery. Both client and team API must be 2.26 or newer.
+These commands do not enroll users or enable sharing automatically. See the
+[guided recipe](../team-onboarding.md#guided-connection-226-or-newer).
+
+From 2.27.0, [team operations](../team-operations.md) adds optional authenticated
+paging, capacity diagnostics and offline, backup-bound audit archival. Upgrade
+client/API/admin binaries together. Archival defaults to a no-write plan and
+requires exact-digest apply; it alone upgrades the separate team store to v2.
+Keep every archive and backup. Installation never compacts or activates a team.
+
 Authority is rechecked per request. Backup/restore validates integrity and
 revokes restored credentials; retention is manual, and logical deletion is not
 physical erasure. Feature/profile changes require restarting the bridge;

package/docs/learning/lessons/L00-why-cairnkeep.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 10 minutes
-**Tested with:** Cairnkeep 2.25.0
+**Tested with:** Cairnkeep 2.27.0
 
 ## Outcome
 

package/docs/learning/lessons/L01-safe-trial.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 15 minutes
-**Tested with:** Cairnkeep 2.25.0
+**Tested with:** Cairnkeep 2.27.0
 
 ## Outcome
 
@@ -26,7 +26,7 @@ ephemeral; the named course volume is persistent.
 1. Pull the public image:
 
    ```bash
-   podman pull ghcr.io/cairnkeep/cairnkeep:2.25.0
+   podman pull ghcr.io/cairnkeep/cairnkeep:2.27.0
    ```
 
 2. Start the stdio server with a read-only root filesystem and no Linux
@@ -38,7 +38,7 @@ ephemeral; the named course volume is persistent.
      --read-only --cap-drop=all --security-opt=no-new-privileges \
      --tmpfs=/tmp:rw,noexec,nosuid,size=64m,mode=1777 \
      --volume cairnkeep-course-data:/data:Z,U \
-     ghcr.io/cairnkeep/cairnkeep:2.25.0 stdio
+     ghcr.io/cairnkeep/cairnkeep:2.27.0 stdio
    ```
 
 3. The process waits quietly for MCP input. Press `Ctrl-C` after confirming it

package/docs/learning/lessons/L02-installation.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0 and Node.js 22 or newer
 
 ## Outcome
 
@@ -47,7 +47,7 @@ sync. Codex project trust remains an explicit operator decision.
 2. Install Cairnkeep:
 
    ```bash
-   npm install --global @cairnkeep/cli@2.25.0
+   npm install --global @cairnkeep/cli@2.27.0
    cairn --version
    ```
 

package/docs/learning/lessons/L03-first-project.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.25.0
+**Tested with:** Cairnkeep 2.27.0
 
 ## Outcome
 

package/docs/learning/lessons/L19-validated-skill-improvement.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Evidence and Evaluation
 **Time:** 50 minutes
-**Tested with:** Cairnkeep 2.25.0
+**Tested with:** Cairnkeep 2.27.0
 
 ## Outcome
 

package/docs/learning/lessons/L20-mcp-tool-profiles.md

@@ -1,7 +1,7 @@
 # L20 - Least-authority MCP tool profiles
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0 and Node.js 22 or newer
 **Time:** 25 minutes
 
 ## Outcome

package/docs/learning/lessons/L21-context-packs.md

@@ -1,7 +1,7 @@
 # L21 - Immutable context packs and skill approval
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0 and Node.js 22 or newer
 **Time:** 40 minutes
 
 ## Outcome

package/docs/learning/lessons/L22-native-windows.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Operator
 **Time:** 30 minutes
-**Tested with:** Cairnkeep 2.25.0, Windows x64, and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0, Windows x64, and Node.js 22 or newer
 
 ## Outcome
 
@@ -16,7 +16,7 @@ perform a reversible uninstall without relying on WSL or Git Bash.
 From PowerShell:
 
 ```powershell
-npm install --global @cairnkeep/cli@2.25.0
+npm install --global @cairnkeep/cli@2.27.0
 cairn version
 
 $Lab = Join-Path $env:TEMP 'Cairnkeep Windows Lab'

package/docs/learning/lessons/L23-guided-setup.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart and Operator
 **Time:** 35 minutes
-**Tested with:** Cairnkeep 2.25.0; Pi 0.84.1; Node.js 22, 24, and 26
+**Tested with:** Cairnkeep 2.27.0; Pi 0.84.1; Node.js 22, 24, and 26
 
 ## Outcome
 

package/docs/learning/lessons/L24-okf-exchange.md

@@ -1,7 +1,7 @@
 # L24 - Reviewed knowledge exchange
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L25-playbooks.md

@@ -1,7 +1,7 @@
 # L25 - Bounded workflow playbooks
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L26-context-intelligence.md

@@ -1,7 +1,7 @@
 # L26 - Context intelligence with explicit authority
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L27-ecosystem-evidence.md

@@ -1,6 +1,6 @@
 # L27 - Evaluate context companions without moving authority
 
-**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L28-security-assurance.md

@@ -1,7 +1,7 @@
 # L28 - Verify Cairnkeep's security posture
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.25.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0 and Node.js 22 or newer
 
 ## Outcome
 
@@ -80,6 +80,10 @@ node mcp-memory-server/scripts/smoke-note-mcp.mjs --fixture-security-only
 node scripts/verify-phase19-runtime-evidence.mjs --self-test
 ```
 
+The aggregate serializes fixtures that patch Node's shared filesystem hooks.
+Read the [provider data-flow review](../../provider-data-flow-review.md): a
+read-only network tool can still disclose a configured workspace and query.
+
 The baseline rejects unpinned external Actions, `pull_request_target` and
 workflow-wide write permissions. It also checks the exact preparation/npm/OCI
 job permission maps, including missing provenance grants and unnecessary write

package/docs/learning/lessons/L29-team-continuity.md

@@ -1,7 +1,9 @@
 # L29 - Reviewed team continuity preview
 
 **Status:** Brief; opt-in experimental preview in Cairnkeep 2.25.0
-**Compatibility:** Cairnkeep 2.25.0 or newer; Node 22.13 or newer for team storage.
+**Compatibility:** Cairnkeep 2.25.0 or newer for manual connection; 2.26.0 or newer
+on both client and team API for guided connection; 2.27.0 or newer client/API/admin
+for operations. Node 22.13 or newer for team storage.
 Use a matching source checkout for the executable regression exercises below.
 Installing the released CLI does not enable team sharing.
 
@@ -32,6 +34,7 @@ node mcp-memory-server/scripts/smoke-team-http.mjs
 node mcp-memory-server/scripts/smoke-team-mcp.mjs
 node mcp-memory-server/scripts/smoke-team-restore.mjs
 node mcp-memory-server/scripts/smoke-team-cli.mjs
+node mcp-memory-server/scripts/smoke-team-onboarding.mjs
 ```
 
 These create disposable local fixtures and an authenticated loopback service,
@@ -40,6 +43,44 @@ No model, personal store, external API or corporate system is used. The MCP
 control changes client identity/cwd and retrieves the same approved decision;
 it does not infer authority from the working folder or a display name.
 
+Use the [role-based handoff](../../team-onboarding.md) to separate operator,
+reader/contributor and human-reviewer tasks. Its executable reader check uses
+the original 2.25.0 CLI or newer. The 2.26.0 guided connection exercise below is
+still opt-in, not automatic enrollment or deployment. Complete
+the readiness checklist with missing decisions marked pending; do not enroll
+real users or introduce real data during this exercise.
+
+## Guided client exercise (2.26 or newer)
+
+The separate [operations exercise](../../team-operations.md) requires
+2.27.0 or newer client/API/admin binaries. Practice paging, capacity,
+read-only backup, metadata export, no-write archive plan, exact apply and fresh
+v2 restore only in a disposable lab. Keep archive files/private backups, explain
+old-server rollback requirements, and distinguish active suffix integrity from
+complete retained history. The longer two-process endurance run is synthetic
+transport/policy evidence, not independent human review or native UI validation.
+
+Use the [guided connection recipe](../../team-onboarding.md#guided-connection-next-release--matching-source-checkout)
+with a disposable project and the operator's synthetic workload-reader file.
+Run `cairn team connect` once without `--apply`: inspect its selected project,
+read-only profile and additional harness files. Confirm that personal/unrelated
+MCP entries remain present. Explicitly apply, then run
+`cairn team doctor --client --project-root PATH`. Explain the reported credential
+expiry/roles and why no memory text is needed to check project access.
+
+Move to another folder: the saved connection still names the explicit team
+project. Try an unrelated project and a revoked credential; both must fail.
+Compare a disconnect plan with `disconnect --apply --yes`: tokens/backups stay,
+only owned unchanged entries disappear. Existing sessions require restart or
+server-side revocation; removing local config is not offboarding.
+
+The onboarding regression uses two workload identities and four generated
+adapter configurations, actual MCP reads from different folders, a synthetic
+review-policy fixture, interrupted activation/recovery and competing writers.
+It does not claim two independent humans, a real user approval, every native
+harness UI or an LLM quality advantage. No paid model is used. Keep the lesson
+Brief until the release-verified learner lab is independently rehearsed.
+
 Trace the lifecycle beside the operator commands in the reference:
 
 ```text

package/docs/learning/tracks/operator.md

@@ -21,6 +21,11 @@
 15. [L28 - Verify Cairnkeep's security posture](../lessons/L28-security-assurance.md)
 16. Optional 2.25 preview: [L29 - Reviewed team continuity](../lessons/L29-team-continuity.md).
     Do not enable it in production before the independent review and approved pilot.
+    Version 2.26.0 adds guided additive connection, client
+    diagnostics and disconnect/recovery exercises; no production enrollment.
+    Version 2.27.0 adds optional paging, capacity and explicit offline audit
+    archival. Rehearse only in a disposable lab; retain backups and stop older
+    writers before the explicit v2 store-format change.
 
 All modules are optional. The track is complete when the operator can add and
 remove each integration without breaking the standalone local workflow and can

package/docs/learning/video-scripts/V28-security-assurance.md

@@ -60,6 +60,10 @@ npm --prefix mcp-memory-server run check:http-guard
 Highlight full-SHA action pins, CodeQL, dependency review, token non-leakage,
 portable Windows/POSIX path cases, and the HTTP 413 test. Do not show repository
 secrets or live security-alert details.
+Explain that a passing retry is not a root-cause fix: the aggregate now
+serializes filesystem-hook fixtures without weakening read/growth assertions.
+Use the [provider flow review](../../provider-data-flow-review.md) to distinguish
+an intentional workspace/query disclosure from arbitrary-file upload.
 
 Include the offline pointer-lock control in a source checkout:
 `node mcp-memory-server/scripts/smoke-context-pack-lock.mjs`. It reproduces

package/docs/learning/video-scripts/V29-team-continuity.md

@@ -1,6 +1,8 @@
 # V29 - Remember together without sharing everything
 
-Status: technical rehearsal brief for the opt-in Cairnkeep 2.25.0 preview.
+Status: technical rehearsal brief for Cairnkeep 2.27.0 operations and guided
+onboarding to the opt-in preview introduced in 2.25.0. Not a recorded or
+independently rehearsed lesson.
 Target: 10–12 minutes, experienced-developer audience. Describe a released
 experimental preview, not a generally production-admitted team service.
 Use the [isolated pilot guide](../../team-pilot.md) for a separately authorized
@@ -20,6 +22,10 @@ Use a disposable source checkout and only synthetic fixtures. Show
 `docs/team.md`; highlight that a reviewer token is human-only and is never
 handed to the agent. Briefly show initialization/membership command forms,
 with no token contents on screen. The server is loopback-only.
+Use the [role-based handoff](../../team-onboarding.md) connection card to show
+which steps belong to the operator, reader and human reviewer. Run its actual
+reader check in the disposable lab; never film a credential or replace the
+personal memory entry. Keep a pause on the pending deployment decisions.
 
 ## 3:30–6:00 — Make the boundary visible
 
@@ -47,6 +53,19 @@ on “restored credentials revoked”: copying a backup must not silently restor
 access. Show fresh-only restore, no-overwrite and uninstall-retention controls.
 Explain that logical deletion is not secure disk erasure or backup deletion.
 
+With a matching 2.26.0-or-newer client and team API, insert a short dynamic client segment:
+open the harness checkboxes in `team connect`, pause on the no-write plan and
+read-only default, then explicitly apply in a disposable project. Keep the
+personal MCP entry visible beside the new team entry. Run `team doctor --client`
+and zoom into expiry/project/roles, never the token file or original-config
+backup. Switch folders, show the pinned project, then plan/apply disconnect.
+Explain that disconnect is not revocation and running sessions need a restart.
+Use the maintained `smoke-team-onboarding.mjs` results for interruption/drift
+controls, not a fabricated typing transcript. The automated human-class policy
+fixture is not actual human consent; no independent-human trial is claimed.
+Do not record this addition against a 2.25-only client/API; follow the version
+note in the onboarding guide and verify the published package before recording.
+
 ## 10:00–11:30 — Honest closing
 
 End on the admission checklist in `docs/team.md`, not a production deployment.
@@ -59,6 +78,15 @@ remote MCP. Call out OIDC, team packs and multi-organization tenancy as deferred
 
 ## Recording contract
 
+For an operations supplement on 2.27.0 or newer client/API/admin binaries, use the
+[operations recipe](../../team-operations.md). Show the capacity counters,
+optional page envelope and stale-cursor refusal, then a stopped disposable
+service, read-only backup, audit export, no-write archive plan and exact apply.
+Pause on “older server binaries cannot reopen v2”; keep all backups and tokens
+off screen. Show the synthetic endurance counts without claiming real human
+consent, native-harness UI coverage or a quality benchmark. Do not record these
+commands against an older CLI/API; this remains a rehearsal brief.
+
 Use legible real terminals, short scene changes, natural pauses and emphasis
 around each changed authority boundary. Keep credentials, personal memory,
 source excerpts from private projects and raw snapshot text off screen.

package/docs/operating.md

@@ -1550,6 +1550,16 @@ project memory. It is default off (`CAIRN_TEAM=1` required); serving also needs
 `CAIRN_TEAM_HTTP=1`. It does not change ordinary setup or existing MCP entries.
 Use [the team reference](team.md) for roles, private credentials, additional
 local stdio registration, human review, backup/restore and incident handling.
+The 2.26.0 guided client workflow is documented in
+[team onboarding](team-onboarding.md#guided-connection-next-release--matching-source-checkout):
+`team connect` plans before explicit apply, `team doctor --client` checks only
+authenticated project/credential metadata, and `team disconnect` preserves
+personal memory and credentials. Both client and team API must support 2.26's
+connection check. No ordinary setup or production sharing is enabled implicitly.
+From 2.27.0, [team operations](team-operations.md) covers optional paging,
+capacity and offline, backup-bound audit archival. Keep matching client/API/admin
+binaries, stop older writers and retain all archives/backups. The no-write plan
+does not change a store; only explicit exact-digest apply upgrades it to v2.
 The internal governed review and approved isolated native pilot are complete;
 independent production review and a deployment-specific approved real-data pilot
 are still required before using real organization data.

package/docs/privacy-and-data-flow.md

@@ -14,7 +14,7 @@ below (some operator-owned endpoints do not require a credential).
 | Embedding-ranked search | Stored memory values that are not cached, plus the search query | `CAIRN_MEMORY_EMBEDDING_URL` or `CAIRN_LLM_API_URL` |
 | Separately opted-in memory reranking | Query and at most 50 scope/current/filter-admitted key/value excerpts, each at most 4 KiB | Only the explicit `CAIRN_MEMORY_RERANK_URL`; separate optional credential, no retries/redirects/alternate hosts |
 | `memory_extract` | The transcript supplied to the tool | `CAIRN_LLM_API_URL` |
-| `domain_knowledge_query` | Workspace slug and query | `ANYTHINGLLM_BASE_URL` |
+| `domain_knowledge_query` | Workspace identifier and query | Configured domain provider: `ANYTHINGLLM_BASE_URL`, or separately enabled `CAIRN_OPENVIKING_BASE_URL` |
 | `domain_knowledge_sync` | Files selected by the sync configuration | `ANYTHINGLLM_BASE_URL` |
 | `route_check` | A health request, with no memory or prompt content | `CAIRN_ROUTE_ENDPOINT` |
 | `context_explore` | Repository path and query are passed to the configured local executable | `CAIRN_EXPLORE_BINARY`; any further data flow is controlled by that tool |
@@ -57,6 +57,14 @@ it does not require or inherit `CAIRN_LLM_API_KEY`. A local provider is still a
 separate process that receives these excerpts. Neither a chat agent nor a
 research assistant is part of reranking or authorization.
 
+## Domain retrieval configuration
+
+Domain queries may derive a workspace identifier from local configuration;
+that identifier is intentionally disclosed to the chosen provider. This does
+not upload the configuration file or other local documents. See the
+[provider data-flow review](provider-data-flow-review.md) for the exact tested
+boundary and its limitations.
+
 ## Playbook decision and receipt flow
 
 Playbooks are local workflow policy, not model inference. A check reads the
@@ -704,6 +712,15 @@ they do not authenticate a publisher or make extracted statements true.
 
 ## Team preview flow and isolation
 
+The 2.27.0 [operations workflow](team-operations.md) adds only explicit
+local audit export/archival, not automatic collection, sharing or deletion.
+Audit exports contain activity/subject metadata and digests, not selected memory
+values or bearer tokens; keep them private. Full backups still contain selected
+team values and credential hashes. Doctor verifies active history from a stored
+checkpoint, not unseen external archive retention. Digests are integrity checks,
+not publisher authentication or secure erasure. Optional cursors are bound to
+credentials and the visible query view; every page still checks current access.
+
 The default-off [team preview](team.md) reads no personal memory automatically.
 Only explicitly supplied, inspected text becomes an immutable project proposal;
 only review by a different human credential publishes a shared revision.
@@ -720,3 +737,15 @@ tokens. Backups include shared proposals and memberships and need separate
 encryption and access control. No unapproved personal content is discoverable.
 A hash confirmation does not establish human consent or content truth.
 Review and production admission remain separate operator responsibilities.
+
+The opt-in guided connection workflow stores endpoint/org/project IDs and a
+credential **file path**, never the credential bytes, in private client state.
+Its project-local MCP entry references that connection file; personal/global
+MCP configuration is not replaced. Private recovery snapshots copy the original
+harness configuration and may therefore contain preexisting operator secrets;
+keep them out of source control and protect/encrypt backups separately.
+Client doctor's authenticated metadata probe discloses the chosen project ID
+to the configured service and returns only subject, roles and credential
+ID/class/expiry. It neither reads memory text nor sends data to model providers.
+It appends a normal value-free service audit event. Disconnect retains backups
+and tokens and is not server-side revocation. See [onboarding](team-onboarding.md).

package/docs/provider-data-flow-review.md

@@ -0,0 +1,48 @@
+# Domain retrieval data-flow review
+
+The `js/file-access-to-http` findings in `domain-retrieval-provider.ts` trace
+the default workspace from the local memory configuration through
+`domain_knowledge_query` to the configured provider. The source is the
+`anythingllm_workspaces` field, not arbitrary document contents or stored memory.
+
+This is an intentional disclosure boundary, not evidence of no disclosure:
+the configured workspace identifier and the selected query leave the process.
+Only configure a provider trusted to receive both. A read-only MCP annotation
+means the tool does not mutate Cairnkeep state; it does **not** mean no network
+traffic. The tool's open-world annotation reflects this boundary.
+
+## Boundaries checked
+
+- Provider origin and authentication come from operator environment settings,
+  not workspace values or unrelated keys in a memory configuration file.
+- The default provider percent-encodes the workspace as one path segment. A
+  workspace that resembles a URL cannot select another origin or add headers.
+- The optional resource provider uses its fixed read-only endpoint, scopes
+  target identifiers below resources and rejects decoded traversal segments.
+  It requires explicit feature consent and separate remote-HTTP consent.
+- Neither request path reads, enumerates or uploads local documents. The
+  query tool is separate from explicitly approved document synchronization.
+- Both providers refuse redirects, bound responses and sanitize failures.
+  Do not weaken these controls to make a static-analysis finding disappear.
+
+`smoke-provider-config-flow.mjs` exercises the actual stdio MCP configuration
+path for both providers, including a URL-shaped workspace, unrelated file
+sentinels and forged endpoint/credential fields. It asserts the exact selected
+request body, fixed mock origin and operator-supplied authentication. All
+fixtures are synthetic and run against loopback only. Existing outbound tests
+cover redirect denial, consent, response bounds and payload-free failures.
+
+## Review disposition and limits
+
+The reviewed flows are expected provider-routing disclosures, not a discovered
+arbitrary-file-upload or file-selected-origin vulnerability. The alerts are
+not dismissed or suppressed by this change: retain the finding and this
+rationale for review, and reassess when source fields, destination selection,
+workspace handling or provider behavior changes.
+
+This is not a sandbox or a provider-side workspace ACL. A trusted local caller
+can explicitly choose another workspace served by its provider credential;
+the existing shared-token HTTP service is one trusted storage domain. Team
+authorization remains separate, and team retrieval does not use these providers.
+Same-account processes can change operator configuration. Tests establish the
+documented application boundary, not the trustworthiness of a configured host.

package/docs/releasing.md

@@ -100,6 +100,12 @@ npm supporting registry-signature and provenance verification. Use `--gh PATH`
 or `--npm PATH` for explicit tool selection; stale trust data or unsupported
 flags fail closed rather than skipping a check. No runtime dependency is added.
 
+The npm verification install and signature audit use a fresh cache inside the
+disposable verification prefix and explicitly request online metadata. Ambient
+offline/prefer-offline settings cannot hide a newly published version behind
+an older cached package listing. This writes no global npm configuration and
+does not relax exact bytes, registry authority, signatures or provenance checks.
+
 The tool checks successful maintained CI, security and publication workflows, immutable
 tag/commit/tree binding, retained CI candidate checksums and exact release-asset
 bytes, CycloneDX 1.6, registry bytes/integrity, npm signatures/attestations, both