@cairnkeep/cli 2.25.0 → 2.27.0

package/docs/security-assurance.md

@@ -138,6 +138,10 @@ prove a future privileged publish run succeeds.
 
 ## Verification evidence
 
+The [domain retrieval data-flow review](provider-data-flow-review.md) records
+the intentional file-derived workspace disclosure and its tested destination,
+credential and content boundaries. Static-analysis alerts are not suppressed.
+
 The maintained gates are `npm run security:baseline`, both production
 `npm audit` checks, `scripts/test-security-baseline.sh`, the memory-server
 security-assurance and HTTP-guard smoke tests, native-Windows tests, and the
@@ -161,6 +165,7 @@ node mcp-memory-server/scripts/smoke-runtime-file-reads.mjs
 node mcp-memory-server/scripts/smoke-bounded-input-reads.mjs
 node mcp-memory-server/scripts/smoke-workspace-file-security.mjs
 node mcp-memory-server/scripts/smoke-outbound-security.mjs
+node mcp-memory-server/scripts/smoke-security-fixture-order.mjs
 node scripts/test-runtime-file-security.mjs
 node scripts/test-omp-staged-security.mjs
 node scripts/test-container-health.mjs
@@ -173,6 +178,12 @@ assert that every historical CodeQL/Scorecard alert is fixed. Triage findings
 individually and use a fresh default-branch analysis to confirm alert status;
 never dismiss an uninvestigated finding merely to improve the score.
 
+The aggregate imports filesystem-hook fixtures sequentially. Top-level-await
+siblings are not a serial test runner: overlapping imports can restore another
+fixture's hooks and create a false failure before growth injection. The
+aggregate ownership/restoration observer covers this test-isolation contract;
+runtime reader checks and injection assertions remain unchanged.
+
 The developer-evidence follow-up also hardens the shared runtime note pre-image
 hasher: it reads from an inspected descriptor under a 64 MiB cap and rejects
 replacement or growth before accepting a hash. Missing targets remain valid

package/docs/storage.md

@@ -605,6 +605,15 @@ no separate prompt or retrieved-content log.
 
 ## Separate team store (opt-in 2.25 preview)
 
+From 2.27.0, [team operations](team-operations.md) keep unarchived stores/snapshots
+at v1. Only explicit offline archive/apply changes this team database to v2,
+retaining the terminal sequence/hash and archive/backup digests. All exported
+segments/backups remain external private files. New snapshots include the
+checkpoint; restore revokes credentials and invalidates paging cursors. The
+cursor signing key is local metadata, not exported as a credential. Ordinary
+memory, trajectories, context packs and their layouts are unchanged. Old server
+binaries cannot reopen the v2 store; retain a pre-archive v1 backup for rollback.
+
 [Team continuity](team.md) keeps organization/project records in a separate
 `team.db` under `CAIRN_TEAM_BASE_DIR` (default `~/.cairnkeep/team`). Built-in
 SQLite transactions serialize state and audit across processes; personal
@@ -620,3 +629,17 @@ pages, WAL or backup copies. Uninstall retains team data and refuses purge
 targets overlapping its configured directory. Independently selected
 `--data` stores must be outside purge targets or also configured through
 `CAIRN_TEAM_BASE_DIR`. Keep encrypted backups separately protected.
+
+Guided client connection state is separate from the organization database:
+`~/.cairnkeep/team-clients/<sha256-of-canonical-project-path>/` holds a strict
+versioned connection, private recovery receipt/original config snapshots and
+an exclusive sibling `<project-path-hash>.operation.lock`. Keeping the open lock
+outside the archived directory preserves native Windows rename semantics and
+continuous writer exclusion. Records contain token-file paths, not raw tokens.
+Original MCP configs can contain other secrets, so protect these backups.
+Activation is committed only after all selected entries are written. An
+interrupted connect stays inactive; interrupted disconnect can resume without
+overwriting unrelated edits. There is no automatic stale-lock cleanup.
+Disconnect archives state in a unique `.disconnected-*` sibling and retains
+credentials; uninstall/purge refuses to delete team client state/backups.
+See [client diagnostics/recovery](team-onboarding.md#client-diagnosis-and-recovery).

package/docs/team-onboarding.md

@@ -0,0 +1,230 @@
+# Team preview: a small, explicit handoff
+
+For Cairnkeep 2.25.0 or newer. This is **not production admission**;
+no real-data deployment is authorized by following this guide.
+
+## Choose the right workflow
+
+For your own context across sessions, folders and harnesses, keep ordinary
+`cairn-memory`. You already have that continuity; you do not need a team store.
+Use the team preview when another person should retrieve **selected, reviewed
+project decisions**. Personal memory stays separate. An overlay upgrade does
+not enroll anyone, start a team service or enable sharing.
+
+| Person | Responsibility | Keep separate |
+|---|---|---|
+| Operator | Private service, memberships, credentials and recovery | Deployment consent |
+| Reader / coding client | Own workload token and explicit project | Human-review token |
+| Contributor | Select/redact and propose exact text with consent | Publication authority |
+| Human reviewer | Inspect actual proposal, approve/reject its digest | Agent workspace |
+
+## Operator handoff
+
+For an explicitly approved **synthetic** rehearsal, follow the
+[isolated pilot setup](team-pilot.md#1-prepare-a-private-lab), then start its
+foreground loopback service. The tested recipe refuses an existing lab and
+preserves personal MCP settings. Do not use production paths.
+
+Give each participant a connection card: verified CLI version/path; loopback
+or authenticated-tunnel URL; organization/project IDs; their individual private
+workload-token file and expiry; disposable workspace; revocation contact.
+For this lab the IDs are `trial-org` and `trial-project`.
+
+Transfer tokens privately, never through chat, Git, arguments or recordings.
+Keep the reviewer token outside agent workspaces. Same-OS-owner processes are
+not mutually isolated; use separate accounts/machines when that is required.
+
+## Reader quick-check
+
+In a separate Bash terminal on Linux/macOS, set the operator's paths and URL:
+
+```sh
+TEAM_CAIRN=/absolute/path/to/verified-checkout/bin/cairn
+TEAM_PILOT_DIR=/absolute/private/new-team-pilot
+TEAM_PILOT_URL=http://127.0.0.1:17955
+```
+
+This block makes one read request. It does not create storage, issue credentials,
+start a service or edit a harness. Expect `[]` before any human publication.
+Stop on connection/authorization failure; never fall back to personal memory.
+
+<!-- team-reader-check:start -->
+```sh
+set -e
+: "${TEAM_CAIRN:?Set the verified CLI path}"
+: "${TEAM_PILOT_DIR:?Set the private lab directory}"
+: "${TEAM_PILOT_URL:?Set the loopback or authenticated-tunnel URL}"
+team_pilot_reader() {
+  env -i PATH="$PATH" CAIRN_TEAM=1 \
+    CAIRN_TEAM_URL="$TEAM_PILOT_URL" CAIRN_TEAM_ORGANIZATION=trial-org \
+    CAIRN_TEAM_TOKEN_FILE="$TEAM_PILOT_DIR/reader.token" \
+    "$TEAM_CAIRN" team "$@" --project trial-project
+}
+team_pilot_reader list
+```
+<!-- team-reader-check:end -->
+
+On native Windows, use equivalent explicit environment settings and
+`cairn team list --project trial-project` from [the reference](team.md).
+
+Add **only an additional**, disposable `cairn-team-memory` stdio entry:
+the verified command, arguments `team mcp --project-root WORKSPACE`, and the
+same four `CAIRN_TEAM*` settings above. For a reader, also set
+`CAIRN_TEAM_MCP_TOOL_PROFILE=read-only`. Merge into the isolated harness profile;
+never replace `cairn-memory` or its entire configuration. See
+[connection semantics](team.md#harness-connection).
+Each tool call names `trial-project`; cwd and display names grant no access.
+The MCP profile restricts tools; server membership independently restricts data.
+
+<a id="guided-connection-next-release--matching-source-checkout"></a>
+
+## Guided connection (2.26 or newer)
+
+The original preview and reader card above work on 2.25.0. The guided commands
+below require both the client **and team API** at 2.26.0 or newer. They do not
+change ordinary `cairn setup`, personal memory or the preview's
+production-admission boundary.
+
+After the operator supplies a **workload reader** credential, opt in explicitly:
+
+```sh
+CAIRN_TEAM=1 cairn team connect --project-root /absolute/project
+```
+
+The wizard asks for URL, organization/project IDs, a private credential-file
+path and harness checkboxes. Its default tool profile is read-only. It displays
+the planned files and asks before applying. Cancellation returns to the shell.
+For automation, supply every choice; without `--apply` this only plans:
+
+```sh
+CAIRN_TEAM=1 cairn team connect --project-root /absolute/project \
+  --url http://127.0.0.1:17955 --organization trial-org --project trial-project \
+  --token-file /absolute/private/reader.token --harness claude,opencode
+# Repeat the same command with --apply --yes to connect.
+CAIRN_TEAM=1 cairn team doctor --client --project-root /absolute/project
+```
+
+Never pass a token value. Keep the credential file outside this project's
+source tree and owner-only (POSIX 0600; native Windows private ACL). URLs must
+be loopback HTTP or HTTPS, without credentials, query, fragment or path prefix.
+Use the operator's encrypted authenticated tunnel, not a public unauthenticated
+listener. The command authenticates reader access before changing a harness.
+It refuses human-class credentials: the operator must issue a workload token
+for the agent, keeping human review credentials in the separate human terminal.
+
+| Harness choice | Project-local file | Additional entry |
+|----------------|--------------------|------------------|
+| `claude` | `.mcp.json` | `mcpServers.cairn-team-memory` |
+| `opencode` | `opencode.json` | `mcp.cairn-team-memory` |
+| `qwen` | `.qwen/settings.json` | `mcpServers.cairn-team-memory` |
+| `codex` | `.codex/config.toml` | marked `mcp_servers.cairn-team-memory` block |
+
+No global harness file is written. Existing unrelated entries are preserved;
+an existing team entry, duplicate JSON keys, JSONC or unsupported inline TOML
+causes refusal rather than replacement. OpenCode `opencode.jsonc` is not edited.
+Pi/OMP/Kimi use the manual bridge recipe; this wizard does not claim automated
+configuration for them. Harness-native trust/enablement prompts still apply.
+Adapter regression uses real SDK stdio calls, not live model/harness UI sessions.
+
+The generated entry invokes the verified Node/CLI paths with a private
+`--connection` file. It pins the server project even if the harness starts in
+another folder; each tool call still names that ID. It does not grant server
+membership. Contributors can explicitly select `--access full` to expose
+proposal creation, still subject to existing profile/capability restrictions
+and server authorization. Human review/admin tools never become available.
+Changing connection settings requires disconnect/reconnect; credentials may be
+rotated in place without a harness restart because the bridge rereads the file.
+
+### Client diagnosis and recovery
+
+Client doctor verifies the active managed entries and private credential file,
+then makes one authenticated `connection-check` request. It reports the current
+subject, credential ID/class/expiry, project and roles, **not** memory text,
+proposals, token values or environment snapshots. The service appends its normal
+value-free audit event. It opens no local administrator store and cannot issue
+credentials, grant membership or repair permissions. Wrong org/project, missing
+reader membership and expired/revoked credentials require the operator; failed
+team access never falls back to personal memory. Check the tunnel/TLS and API
+version on connection failure. Store doctor remains `team doctor --data DIR`.
+
+```sh
+CAIRN_TEAM=1 cairn team disconnect --project-root /absolute/project
+# Inspect the no-write plan, then:
+CAIRN_TEAM=1 cairn team disconnect --project-root /absolute/project --apply --yes
+```
+
+Disconnect removes only unchanged owned entries. It restores exact original
+bytes when nothing else changed; otherwise it preserves unrelated edits and
+refuses an altered team entry. It keeps the token and private backups. Restart
+existing harness sessions; disconnect is **not revocation**. The operator must
+revoke a credential/remove membership for immediate denial in running sessions.
+
+Connection records and original configuration snapshots are private under
+`~/.cairnkeep/team-clients/<canonical-project-path-sha256>/`. Backups may include
+secrets already present in your original MCP config: never commit or publish
+them; use separately encrypted backups as appropriate. No token content is
+copied from its file. Disconnected records are retained in uniquely named
+`.disconnected-*` siblings. Uninstall/purge refuses to delete this retained state.
+
+A per-project exclusive `<project-path-hash>.operation.lock` beside the state
+directory serializes Cairnkeep writers and stays held while state is archived,
+including on native Windows. A failed
+multi-file connect keeps its recovery record in `preparing`; the bridge refuses
+startup until **all** entries are written and activation is committed. Run
+disconnect to undo an interrupted operation after checking for configuration
+drift. An interrupted disconnect is likewise resumable. Do not restore a whole
+backup over newer unrelated edits. If the process crashed holding its lock,
+first verify no connection/disconnection process is running, preserve the state
+directory, then manually remove **only that project's** sibling `.operation.lock` and
+retry disconnect. The tool never guesses that a live lock is stale.
+
+Configuration directories must be owned/trusted and not writable by other users.
+Each configuration is bounded to 1 MiB and the four-file recovery record to
+16 MiB, including both original/new bytes and base64 overhead.
+Links and unsafe files are rejected. Writers use bounded descriptor-first reads,
+exclusive creation and atomic replacement with a final drift check. This is not
+an OS compare-and-swap against a hostile process running as your own identity;
+stop concurrent editor writes before applying. No root-directory or global
+configuration target, automatic permission changes to existing directories,
+automatic enrollment or background synchronization is introduced.
+
+## Contributor and reviewer
+
+Contributors get their **own** workload credential and explicit contributor
+membership. Start with one synthetic decision; select/redact exact text and
+confirm its value digest using the [proposal reference](team.md#harness-connection).
+There is no automatic personal-memory import.
+
+In the separate human terminal, inspect `proposal-show`, then approve/reject
+the actual stored bytes with their proposal digest. Never hand a human token
+to a model. Automated tests of human-class tokens are not human consent.
+Restart a reader in another folder: the approved decision/provenance must match;
+unrelated-project access and revoked credentials must fail. Follow the
+[pilot checks and cleanup](team-pilot.md#4-exercise-the-actual-review-boundary).
+Native trials require separately authorized providers; no model purchase or
+subscription use is authorized by this guide.
+
+## Deployment readiness
+
+The [operations guide](team-operations.md) adds paging, capacity diagnostics
+and backup-bound explicit audit archival from 2.27.0. Use matching upgraded
+client/API/admin binaries. Do not infer enrollment or admission from it.
+
+Before requesting a real-data pilot, record an owner and evidence for:
+
+- **Purpose:** project IDs, participants, data classes, one continuity use case,
+  explicit exclusions and a stop date.
+- **Consent:** selected-data approval, independent production security review
+  and deployment authorization. Mark absent decisions pending; tests supply none.
+- **Access:** least-privilege roles, individual expiring tokens, separate human
+  review, authenticated tunnel/TLS, private storage and trusted host ownership.
+- **Operation:** named operator, revocation/offboarding contact, storage/audit
+  capacity, encrypted backup retention and a rehearsed fresh-only restore.
+  Restored credentials are revoked; reissue and activation remain explicit.
+- **Acceptance/rollback:** continuity across clients/folders, denied/unapproved
+  content hidden, immediate revocation and unchanged personal config hashes.
+  Stop the separate service and remove only its additional client entry to
+  withdraw access; preserve agreed private evidence.
+
+Until these decisions are explicitly approved, stay in the disposable synthetic
+lab. No automatic production transition follows the rehearsal.

package/docs/team-operations.md

@@ -0,0 +1,127 @@
+# Team operations: bounded history without automatic deletion
+
+Available from **Cairnkeep 2.27.0**. Use 2.27.0 or newer client/API/admin
+binaries for paging and archival; older releases do not include these commands.
+The team preview remains default off and is not general production admission.
+
+## Optional pagination
+
+`list`, `history`, `proposals`, `audit` and `search` accept an optional `page`:
+
+```json
+{"organization":"demo-org","project":"alpha","operation":"list","page":{"size":20}}
+```
+
+The result is `{ "items": [...], "next_cursor": "..." }`; the final cursor
+is `null`. Without `page`, existing bounded arrays and ordering remain unchanged.
+Sizes are 1–100, or 1–10 for search. The existing team MCP list/search/history
+tools accept the same optional object. No admin/review tool is added to MCP.
+CLI equivalents are `--page-size N --cursor CURSOR`. Repeat the same project,
+operation, filters and page size when continuing.
+
+Cursors are authenticated and bound to the credential, project, roles/policy,
+filters and visible result set. Tampering or cross-identity reuse fails;
+changed results cause a conflict requiring a new first page. Every call checks
+current membership, expiry and revocation. Cursor validity is not authorization.
+Audit paging freezes an upper sequence so its own read events do not invalidate
+the traversal. New events are visible in a fresh traversal. Restore invalidates
+old cursors; its new credentials require a fresh traversal too.
+
+## Capacity before refusal
+
+`cairn team doctor --data DIR` remains local, metadata-only and non-mutating.
+It reports record/audit entries, UTF-8 bytes, ceilings, remaining space and
+`available`, `near-limit` (80%) or `exhausted` status. These are diagnostics,
+not a guarantee that the next write fits. Records remain bounded at 32,768 and
+16 MiB. Ordinary audit admission is 99,000 events/16 MiB, with a separate local
+operator reserve of 1,000 events/256 KiB. Nothing is evicted automatically.
+Archiving audit does not free record capacity.
+
+## Offline, exact-digest archival
+
+Only the trusted local OS operator can archive. **Stop the team API and bridge
+writers first**, and use the matching new admin binary. Existing older server
+processes cannot be retroactively made schema-aware. Do not archive a store
+while an older service still has it open.
+
+Choose private paths outside source trees; ancestors must not be writable by
+other users/groups. Keep the backup and archive on durable protected storage.
+The following paths are placeholders, not production defaults:
+
+```sh
+CAIRN_TEAM=1 cairn team doctor --data /absolute/private/team
+CAIRN_TEAM=1 cairn team backup --data /absolute/private/team --read-only \
+  --output /absolute/private/backups/pre-archive.json
+CAIRN_TEAM=1 cairn team audit-export --data /absolute/private/team \
+  --backup /absolute/private/backups/pre-archive.json \
+  --output /absolute/private/backups/audit-segment.json
+CAIRN_TEAM=1 cairn team audit-verify \
+  --input /absolute/private/backups/audit-segment.json
+```
+
+`--read-only` makes a consistent backup without adding an audit event, including
+when the local reserve is full. Normal backup retains its existing audit event.
+The export verifies its backup against current state, writes exclusively with
+private permissions and file fsync (plus a directory flush on POSIX), and changes
+no database state. Node cannot flush directory handles on Windows; protect and
+retain the exported files on reliable storage before applying compaction.
+It contains audit
+metadata, not memory values or raw bearer tokens. Names and activity are still
+sensitive; an export is not a public report.
+
+Use the returned **archive_digest**, not a memory or backup digest:
+
+```sh
+# No-write plan:
+CAIRN_TEAM=1 cairn team audit-archive --data /absolute/private/team \
+  --input /absolute/private/backups/audit-segment.json \
+  --backup /absolute/private/backups/pre-archive.json --confirm ARCHIVE_DIGEST
+# Repeat the exact command with --apply to compact the verified active prefix.
+```
+
+Wrong/tampered/stale backups, archives or confirmation fail. Any intervening
+audited operation makes the plan stale: stop writers and produce a fresh pair.
+Apply atomically records the archive/backup digests and terminal sequence/hash,
+removes the active audit prefix, and appends an archival event. A failed database
+transaction rolls back checkpoint, schema change and removal together. No file
+is removed or overwritten. Keep **all segments and backups** under an explicit
+operator-owned retention policy; no background job or default expiry is added.
+
+## Compatibility, recovery and limits of evidence
+
+Unarchived stores and snapshots stay version 1. Explicit archival changes only
+this separate team store to version 2; subsequent snapshots carry its checkpoint.
+Older server/admin binaries reject reopening that store. Legacy remote clients
+can still use unchanged non-paged API calls with the new service. To roll back
+the server format, use the retained pre-archive v1 backup in a fresh location;
+never point an older binary at the compacted database. Restore continues to
+revoke every copied credential. Reissue credentials and approve reactivation
+explicitly; never overwrite a live store with a restore.
+
+Doctor and snapshot validation check the active audit suffix anchored at its
+checkpoint. They do **not** open external archives or prove full historical
+retention. Verify retained segments with `audit-verify`; pass `--previous FILE`
+to check the adjacent archive link. One successful segment check is not a claim
+that every earlier segment is present. Digests provide integrity, not publisher
+authenticity, independent timestamping or protection against a malicious OS owner.
+Compaction is not secure erasure: backups, archives and SQLite pages may retain
+data. Audit capacity still fails closed if operators take no action.
+
+## Synthetic continuity endurance
+
+From a matching built source checkout, in a private disposable lab:
+
+```sh
+lab=$(mktemp -d)
+CAIRN_TEAM_SOAK=1 node mcp-memory-server/scripts/run-team-continuity-soak.mjs \
+  --cycles 120 --duration-ms 1200000 --out "$lab/report.json"
+```
+
+This exercises two actual stdio MCP client processes across working folders,
+separate API process restarts (including an unclean termination), private
+token-file rotation, revoked credentials, audit
+archival and fresh restore. Its human-class reviewer is a **synthetic policy
+fixture**, not actual human consent. No paid model, provider, real memory or
+production configuration is used. Reports contain counts, digests and latency,
+not selected text or bearer credentials. This is transport/authorization
+continuity evidence, not a native-harness UI trial or a model-quality benchmark.

package/docs/team-pilot.md

@@ -11,6 +11,8 @@ The pilot runs beside existing personal memory: a new private store, expiring
 credentials, a separate loopback port and additional isolated client profiles.
 It never imports a personal store or replaces an existing MCP registration.
 Use synthetic project decisions, not employer, personal or customer data.
+For a shorter role-by-role route and reader connection card, see
+[Team onboarding](team-onboarding.md). It does not grant deployment consent.
 
 ## 1. Prepare a private lab
 

package/docs/team.md

@@ -20,6 +20,8 @@ Sharing changes visibility: inspect and redact the selected text first.
 For a trial alongside unchanged personal memory, use the
 [isolated pilot guide](team-pilot.md). It keeps stores, credentials, ports and
 client profiles separate and distinguishes actual human review from rehearsal.
+Start with the [role-based handoff](team-onboarding.md) for operator, coding
+client and human-reviewer tasks, a tested reader check and readiness checklist.
 
 ## Trust boundary
 
@@ -78,6 +80,15 @@ OIDC/SSO and standards-compliant remote MCP HTTP authorization are deferred.
 
 ## Harness connection
 
+Cairnkeep 2.26.0 (both client and team API) adds
+the opt-in [guided connection and recovery workflow](team-onboarding.md#guided-connection-next-release--matching-source-checkout):
+`cairn team connect`, `cairn team doctor --client` and `cairn team disconnect`.
+It adds only a dedicated project-local entry, defaults to read-only, references
+a private token file and pins the server project. No global MCP replacement or
+personal upload occurs. The manual environment recipe below remains supported
+on 2.25.0. The diagnostics API returns only authenticated project/credential
+metadata and records a value-free audit event, not memory text.
+
 Set `CAIRN_TEAM_URL`, `CAIRN_TEAM_ORGANIZATION` and `CAIRN_TEAM_TOKEN_FILE` in the
 local harness environment, alongside `CAIRN_TEAM=1`. Tokens are file-only.
 The URL may be loopback HTTP through a tunnel or HTTPS, without embedded
@@ -203,13 +214,19 @@ store are refused before any uninstall changes; a store selected only through
 
 ## Bounded preview and admission
 
+From 2.27.0, optional pagination, capacity diagnostics and explicitly confirmed
+audit archival are available in [team operations](team-operations.md). Upgrade
+the client, API and admin binary before using these operations.
+
 Selected values are at most 64 KiB UTF-8; requests 512 KiB; responses 2 MiB;
 snapshots 64 MiB. Records are capped at 32,768 and 16 MiB of stored JSON;
-audit at 100,000 events and 16 MiB, with a 1,000-event/256 KiB OS-operator reserve.
+ordinary audit at 99,000 events and 16 MiB, with a separate
+1,000-event/256 KiB OS-operator reserve.
 Limits fail closed rather than discarding records. Back up and review retention
-before approaching them; the preview has no audit archival/compaction command.
-Retrieval is bounded (100 list/history items, ten search results); the API
-currently has no pagination. HTTP separately limits malformed authentication
+before approaching them; archival is offline, manual and backup-bound, never
+automatic. Retrieval is bounded (100 list/history items, ten search results);
+optional authenticated paging is available from 2.27.0. HTTP separately limits
+malformed authentication
 per connection address and authenticated requests per subject to 120 per minute;
 invalid token-shaped credentials receive ten attempts per token digest. Each
 budget holds at most 512 identities, and invalid authentication cannot consume

package/examples/eval/bundled-fake.json

@@ -1 +1 @@
-{"identifier":"cairn-offline-fake-v1","package_version":"2.25.0","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}
+{"identifier":"cairn-offline-fake-v1","package_version":"2.27.0","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}

package/mcp-memory-server/dist/capability-config.js

@@ -222,7 +222,18 @@ async function acquireLock(lockPath) {
         catch (error) {
             if (error.code !== "EEXIST")
                 throw error;
-            const info = await lstat(lockPath);
+            let info;
+            try {
+                info = await lstat(lockPath);
+            }
+            catch (inspectionError) {
+                // The current writer may release its lock after our mkdir
+                // reports contention but before inspection. Only disappearance
+                // admits another bounded acquisition attempt, never ownership.
+                if (inspectionError.code === 'ENOENT')
+                    continue;
+                throw inspectionError;
+            }
             if (info.isSymbolicLink() || !info.isDirectory()) {
                 throw new Error("Capability configuration lock is unsafe.");
             }

package/mcp-memory-server/dist/team-audit.js

@@ -0,0 +1,41 @@
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { TeamError } from './team-errors.js';
+const id = z.string().regex(/^[a-z0-9][a-z0-9-]{0,63}$/);
+const digest = z.string().regex(/^[a-f0-9]{64}$/);
+export const teamAuditCheckpointSchema = z.object({ sequence: z.number().int().positive(), digest, archive_digest: digest, backup_digest: digest, previous_archive_digest: digest.nullable() }).strict();
+export const teamAuditRowSchema = z.object({ sequence: z.number().int().positive(), organization: id, project: id.or(z.literal('')), value: z.string().max(4096), digest }).strict();
+export const teamAuditEntrySchema = z.object({ schema_version: z.literal(1), sequence: z.number().int().positive(), organization: id, project: id.or(z.literal('')), subject: id, credential_class: z.enum(['human', 'workload', 'local-os']), operation: z.enum(['project-create', 'member-set', 'credential-revoke', 'credential-issue', 'memory-delete', 'list', 'audit', 'read', 'history', 'search', 'propose', 'proposals', 'proposal-show', 'review', 'snapshot', 'restore', 'connection-check', 'audit-archive']), result: z.enum(['accepted', 'denied', 'conflict', 'invalid']), object_digest: digest.nullable(), previous_digest: digest.nullable(), request_id: z.string().uuid(), at: z.iso.datetime() }).strict();
+const archiveSchema = z.object({ schema_version: z.literal(1), organization: id, backup_digest: digest, previous_checkpoint: teamAuditCheckpointSchema.nullable(), entries: z.array(teamAuditRowSchema).min(1).max(100000), digest }).strict();
+const hash = (text) => createHash('sha256').update(text).digest('hex');
+export function verifyTeamAuditRows(organization, rows, checkpoint) {
+    try {
+        let sequence = checkpoint?.sequence ?? 0, previous = checkpoint?.digest ?? null, bytes = 0;
+        for (const row of rows) {
+            const entry = teamAuditEntrySchema.parse(JSON.parse(row.value));
+            bytes += Buffer.byteLength(row.value);
+            if (row.organization !== organization || row.sequence !== ++sequence || entry.sequence !== sequence || entry.organization !== organization || entry.project !== row.project || entry.previous_digest !== previous || hash(row.value) !== row.digest)
+                throw new Error();
+            previous = row.digest;
+        }
+        if (bytes > 16 * 1024 * 1024 + 256 * 1024)
+            throw new Error();
+    }
+    catch {
+        throw new TeamError('integrity');
+    }
+}
+export function verifyTeamAuditArchive(input) {
+    try {
+        if (Buffer.byteLength(JSON.stringify(input)) > 64 * 1024 * 1024)
+            throw new Error();
+        const archive = archiveSchema.parse(input), { digest, ...body } = archive;
+        if (hash(JSON.stringify(body)) !== digest)
+            throw new Error();
+        verifyTeamAuditRows(archive.organization, archive.entries, archive.previous_checkpoint);
+        return archive;
+    }
+    catch {
+        throw new TeamError('integrity');
+    }
+}