@cairnkeep/cli 2.26.0 → 2.27.0

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable user-facing changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [2.27.0] - 2026-10-26
+
+### Team operations
+
+- Add opt-in bounded paging to team listings with authenticated,
+  credential/project/filter/policy/view-bound cursors and unchanged legacy arrays.
+- Add payload-free capacity diagnostics, metadata-only audit export/verification
+  and backup-bound, exact-digest archival. Default to a no-write plan; explicit
+  apply atomically retains a chain checkpoint and frees the active audit prefix.
+  Retain external archives/backups; do not enable automatic retention or sharing.
+- Keep existing team stores/snapshots at v1 until explicit archival; compacted
+  stores use v2 and require the new server/admin binary. Restore revokes copied
+  credentials. Document offline operation and old-format rollback requirements.
+- Add disposable cross-process continuity endurance and adversarial/installed
+  package controls. Update operating/privacy/storage and learning/video briefs;
+  no new recording, independent-human trial or production admission is claimed.
+
+### Release maintenance
+
+- Use fresh process-scoped npm verification metadata/cache without weakening
+  signature, provenance or exact-byte checks. Record per-contract smoke timings
+  and rebalance complete Windows shards using measured hosted durations.
+
 ## [2.26.0] - 2026-10-26
 
 ### Guided team onboarding

package/docs/README.md

@@ -76,6 +76,10 @@ linked guides rather than the project landing page.
 
 ## Overlays and teams
 
+- [Team operations](team-operations.md): scoped paging, capacity, explicit
+  backup-bound audit archival and synthetic endurance from 2.27.0. Availability
+  is not permission to enable sharing.
+
 - [Team continuity preview](team.md) documents the default-off, separately
   authenticated shared-memory store, human review, local MCP bridge and recovery.
   It ships as an opt-in experimental preview from 2.25.0, not general production admission. The

package/docs/learning/CURRICULUM-MAP.md

@@ -1,6 +1,6 @@
 # Curriculum Coverage Map
 
-**Baseline:** Cairnkeep 2.26.0
+**Baseline:** Cairnkeep 2.27.0
 **Last reviewed:** 2026-10-26
 
 This map prevents the course from drifting behind the product. It assigns each

package/docs/learning/FEATURE-GUIDE.md

@@ -1,6 +1,6 @@
 # Cairnkeep feature guide
 
-**Baseline:** Cairnkeep 2.26.0
+**Baseline:** Cairnkeep 2.27.0
 
 This is the step-back map for choosing and operating Cairnkeep features. The
 [course labs](https://github.com/cairnkeep/cairnkeep-course-labs) provide one
@@ -197,6 +197,12 @@ supports drift-aware recovery. Both client and team API must be 2.26 or newer.
 These commands do not enroll users or enable sharing automatically. See the
 [guided recipe](../team-onboarding.md#guided-connection-226-or-newer).
 
+From 2.27.0, [team operations](../team-operations.md) adds optional authenticated
+paging, capacity diagnostics and offline, backup-bound audit archival. Upgrade
+client/API/admin binaries together. Archival defaults to a no-write plan and
+requires exact-digest apply; it alone upgrades the separate team store to v2.
+Keep every archive and backup. Installation never compacts or activates a team.
+
 Authority is rechecked per request. Backup/restore validates integrity and
 revokes restored credentials; retention is manual, and logical deletion is not
 physical erasure. Feature/profile changes require restarting the bridge;

package/docs/learning/lessons/L00-why-cairnkeep.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 10 minutes
-**Tested with:** Cairnkeep 2.26.0
+**Tested with:** Cairnkeep 2.27.0
 
 ## Outcome
 

package/docs/learning/lessons/L01-safe-trial.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 15 minutes
-**Tested with:** Cairnkeep 2.26.0
+**Tested with:** Cairnkeep 2.27.0
 
 ## Outcome
 
@@ -26,7 +26,7 @@ ephemeral; the named course volume is persistent.
 1. Pull the public image:
 
    ```bash
-   podman pull ghcr.io/cairnkeep/cairnkeep:2.26.0
+   podman pull ghcr.io/cairnkeep/cairnkeep:2.27.0
    ```
 
 2. Start the stdio server with a read-only root filesystem and no Linux
@@ -38,7 +38,7 @@ ephemeral; the named course volume is persistent.
      --read-only --cap-drop=all --security-opt=no-new-privileges \
      --tmpfs=/tmp:rw,noexec,nosuid,size=64m,mode=1777 \
      --volume cairnkeep-course-data:/data:Z,U \
-     ghcr.io/cairnkeep/cairnkeep:2.26.0 stdio
+     ghcr.io/cairnkeep/cairnkeep:2.27.0 stdio
    ```
 
 3. The process waits quietly for MCP input. Press `Ctrl-C` after confirming it

package/docs/learning/lessons/L02-installation.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0 and Node.js 22 or newer
 
 ## Outcome
 
@@ -47,7 +47,7 @@ sync. Codex project trust remains an explicit operator decision.
 2. Install Cairnkeep:
 
    ```bash
-   npm install --global @cairnkeep/cli@2.26.0
+   npm install --global @cairnkeep/cli@2.27.0
    cairn --version
    ```
 

package/docs/learning/lessons/L03-first-project.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart
 **Time:** 25 minutes
-**Tested with:** Cairnkeep 2.26.0
+**Tested with:** Cairnkeep 2.27.0
 
 ## Outcome
 

package/docs/learning/lessons/L19-validated-skill-improvement.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Evidence and Evaluation
 **Time:** 50 minutes
-**Tested with:** Cairnkeep 2.26.0
+**Tested with:** Cairnkeep 2.27.0
 
 ## Outcome
 

package/docs/learning/lessons/L20-mcp-tool-profiles.md

@@ -1,7 +1,7 @@
 # L20 - Least-authority MCP tool profiles
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0 and Node.js 22 or newer
 **Time:** 25 minutes
 
 ## Outcome

package/docs/learning/lessons/L21-context-packs.md

@@ -1,7 +1,7 @@
 # L21 - Immutable context packs and skill approval
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0 and Node.js 22 or newer
 **Time:** 40 minutes
 
 ## Outcome

package/docs/learning/lessons/L22-native-windows.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Operator
 **Time:** 30 minutes
-**Tested with:** Cairnkeep 2.26.0, Windows x64, and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0, Windows x64, and Node.js 22 or newer
 
 ## Outcome
 
@@ -16,7 +16,7 @@ perform a reversible uninstall without relying on WSL or Git Bash.
 From PowerShell:
 
 ```powershell
-npm install --global @cairnkeep/cli@2.26.0
+npm install --global @cairnkeep/cli@2.27.0
 cairn version
 
 $Lab = Join-Path $env:TEMP 'Cairnkeep Windows Lab'

package/docs/learning/lessons/L23-guided-setup.md

@@ -3,7 +3,7 @@
 **Status:** Ready
 **Track:** Quickstart and Operator
 **Time:** 35 minutes
-**Tested with:** Cairnkeep 2.26.0; Pi 0.84.1; Node.js 22, 24, and 26
+**Tested with:** Cairnkeep 2.27.0; Pi 0.84.1; Node.js 22, 24, and 26
 
 ## Outcome
 

package/docs/learning/lessons/L24-okf-exchange.md

@@ -1,7 +1,7 @@
 # L24 - Reviewed knowledge exchange
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L25-playbooks.md

@@ -1,7 +1,7 @@
 # L25 - Bounded workflow playbooks
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0 and Node.js 22 or newer
 **Time:** 35 minutes
 
 ## Outcome

package/docs/learning/lessons/L26-context-intelligence.md

@@ -1,7 +1,7 @@
 # L26 - Context intelligence with explicit authority
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L27-ecosystem-evidence.md

@@ -1,6 +1,6 @@
 # L27 - Evaluate context companions without moving authority
 
-**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L28-security-assurance.md

@@ -1,7 +1,7 @@
 # L28 - Verify Cairnkeep's security posture
 
 **Status:** Ready
-**Tested with:** Cairnkeep 2.26.0 and Node.js 22 or newer
+**Tested with:** Cairnkeep 2.27.0 and Node.js 22 or newer
 
 ## Outcome
 

package/docs/learning/lessons/L29-team-continuity.md

@@ -2,7 +2,8 @@
 
 **Status:** Brief; opt-in experimental preview in Cairnkeep 2.25.0
 **Compatibility:** Cairnkeep 2.25.0 or newer for manual connection; 2.26.0 or newer
-on both client and team API for guided connection. Node 22.13 or newer for team storage.
+on both client and team API for guided connection; 2.27.0 or newer client/API/admin
+for operations. Node 22.13 or newer for team storage.
 Use a matching source checkout for the executable regression exercises below.
 Installing the released CLI does not enable team sharing.
 
@@ -51,6 +52,14 @@ real users or introduce real data during this exercise.
 
 ## Guided client exercise (2.26 or newer)
 
+The separate [operations exercise](../../team-operations.md) requires
+2.27.0 or newer client/API/admin binaries. Practice paging, capacity,
+read-only backup, metadata export, no-write archive plan, exact apply and fresh
+v2 restore only in a disposable lab. Keep archive files/private backups, explain
+old-server rollback requirements, and distinguish active suffix integrity from
+complete retained history. The longer two-process endurance run is synthetic
+transport/policy evidence, not independent human review or native UI validation.
+
 Use the [guided connection recipe](../../team-onboarding.md#guided-connection-next-release--matching-source-checkout)
 with a disposable project and the operator's synthetic workload-reader file.
 Run `cairn team connect` once without `--apply`: inspect its selected project,

package/docs/learning/tracks/operator.md

@@ -23,6 +23,9 @@
     Do not enable it in production before the independent review and approved pilot.
     Version 2.26.0 adds guided additive connection, client
     diagnostics and disconnect/recovery exercises; no production enrollment.
+    Version 2.27.0 adds optional paging, capacity and explicit offline audit
+    archival. Rehearse only in a disposable lab; retain backups and stop older
+    writers before the explicit v2 store-format change.
 
 All modules are optional. The track is complete when the operator can add and
 remove each integration without breaking the standalone local workflow and can

package/docs/learning/video-scripts/V29-team-continuity.md

@@ -1,7 +1,8 @@
 # V29 - Remember together without sharing everything
 
-Status: technical rehearsal brief for Cairnkeep 2.26.0 guided onboarding to the
-opt-in preview introduced in 2.25.0. Not a recorded or independently rehearsed lesson.
+Status: technical rehearsal brief for Cairnkeep 2.27.0 operations and guided
+onboarding to the opt-in preview introduced in 2.25.0. Not a recorded or
+independently rehearsed lesson.
 Target: 10–12 minutes, experienced-developer audience. Describe a released
 experimental preview, not a generally production-admitted team service.
 Use the [isolated pilot guide](../../team-pilot.md) for a separately authorized
@@ -77,6 +78,15 @@ remote MCP. Call out OIDC, team packs and multi-organization tenancy as deferred
 
 ## Recording contract
 
+For an operations supplement on 2.27.0 or newer client/API/admin binaries, use the
+[operations recipe](../../team-operations.md). Show the capacity counters,
+optional page envelope and stale-cursor refusal, then a stopped disposable
+service, read-only backup, audit export, no-write archive plan and exact apply.
+Pause on “older server binaries cannot reopen v2”; keep all backups and tokens
+off screen. Show the synthetic endurance counts without claiming real human
+consent, native-harness UI coverage or a quality benchmark. Do not record these
+commands against an older CLI/API; this remains a rehearsal brief.
+
 Use legible real terminals, short scene changes, natural pauses and emphasis
 around each changed authority boundary. Keep credentials, personal memory,
 source excerpts from private projects and raw snapshot text off screen.

package/docs/operating.md

@@ -1556,6 +1556,10 @@ The 2.26.0 guided client workflow is documented in
 authenticated project/credential metadata, and `team disconnect` preserves
 personal memory and credentials. Both client and team API must support 2.26's
 connection check. No ordinary setup or production sharing is enabled implicitly.
+From 2.27.0, [team operations](team-operations.md) covers optional paging,
+capacity and offline, backup-bound audit archival. Keep matching client/API/admin
+binaries, stop older writers and retain all archives/backups. The no-write plan
+does not change a store; only explicit exact-digest apply upgrades it to v2.
 The internal governed review and approved isolated native pilot are complete;
 independent production review and a deployment-specific approved real-data pilot
 are still required before using real organization data.

package/docs/privacy-and-data-flow.md

@@ -712,6 +712,15 @@ they do not authenticate a publisher or make extracted statements true.
 
 ## Team preview flow and isolation
 
+The 2.27.0 [operations workflow](team-operations.md) adds only explicit
+local audit export/archival, not automatic collection, sharing or deletion.
+Audit exports contain activity/subject metadata and digests, not selected memory
+values or bearer tokens; keep them private. Full backups still contain selected
+team values and credential hashes. Doctor verifies active history from a stored
+checkpoint, not unseen external archive retention. Digests are integrity checks,
+not publisher authentication or secure erasure. Optional cursors are bound to
+credentials and the visible query view; every page still checks current access.
+
 The default-off [team preview](team.md) reads no personal memory automatically.
 Only explicitly supplied, inspected text becomes an immutable project proposal;
 only review by a different human credential publishes a shared revision.

package/docs/releasing.md

@@ -100,6 +100,12 @@ npm supporting registry-signature and provenance verification. Use `--gh PATH`
 or `--npm PATH` for explicit tool selection; stale trust data or unsupported
 flags fail closed rather than skipping a check. No runtime dependency is added.
 
+The npm verification install and signature audit use a fresh cache inside the
+disposable verification prefix and explicitly request online metadata. Ambient
+offline/prefer-offline settings cannot hide a newly published version behind
+an older cached package listing. This writes no global npm configuration and
+does not relax exact bytes, registry authority, signatures or provenance checks.
+
 The tool checks successful maintained CI, security and publication workflows, immutable
 tag/commit/tree binding, retained CI candidate checksums and exact release-asset
 bytes, CycloneDX 1.6, registry bytes/integrity, npm signatures/attestations, both

package/docs/storage.md

@@ -605,6 +605,15 @@ no separate prompt or retrieved-content log.
 
 ## Separate team store (opt-in 2.25 preview)
 
+From 2.27.0, [team operations](team-operations.md) keep unarchived stores/snapshots
+at v1. Only explicit offline archive/apply changes this team database to v2,
+retaining the terminal sequence/hash and archive/backup digests. All exported
+segments/backups remain external private files. New snapshots include the
+checkpoint; restore revokes credentials and invalidates paging cursors. The
+cursor signing key is local metadata, not exported as a credential. Ordinary
+memory, trajectories, context packs and their layouts are unchanged. Old server
+binaries cannot reopen the v2 store; retain a pre-archive v1 backup for rollback.
+
 [Team continuity](team.md) keeps organization/project records in a separate
 `team.db` under `CAIRN_TEAM_BASE_DIR` (default `~/.cairnkeep/team`). Built-in
 SQLite transactions serialize state and audit across processes; personal

package/docs/team-onboarding.md

@@ -206,6 +206,10 @@ subscription use is authorized by this guide.
 
 ## Deployment readiness
 
+The [operations guide](team-operations.md) adds paging, capacity diagnostics
+and backup-bound explicit audit archival from 2.27.0. Use matching upgraded
+client/API/admin binaries. Do not infer enrollment or admission from it.
+
 Before requesting a real-data pilot, record an owner and evidence for:
 
 - **Purpose:** project IDs, participants, data classes, one continuity use case,

package/docs/team-operations.md

@@ -0,0 +1,127 @@
+# Team operations: bounded history without automatic deletion
+
+Available from **Cairnkeep 2.27.0**. Use 2.27.0 or newer client/API/admin
+binaries for paging and archival; older releases do not include these commands.
+The team preview remains default off and is not general production admission.
+
+## Optional pagination
+
+`list`, `history`, `proposals`, `audit` and `search` accept an optional `page`:
+
+```json
+{"organization":"demo-org","project":"alpha","operation":"list","page":{"size":20}}
+```
+
+The result is `{ "items": [...], "next_cursor": "..." }`; the final cursor
+is `null`. Without `page`, existing bounded arrays and ordering remain unchanged.
+Sizes are 1–100, or 1–10 for search. The existing team MCP list/search/history
+tools accept the same optional object. No admin/review tool is added to MCP.
+CLI equivalents are `--page-size N --cursor CURSOR`. Repeat the same project,
+operation, filters and page size when continuing.
+
+Cursors are authenticated and bound to the credential, project, roles/policy,
+filters and visible result set. Tampering or cross-identity reuse fails;
+changed results cause a conflict requiring a new first page. Every call checks
+current membership, expiry and revocation. Cursor validity is not authorization.
+Audit paging freezes an upper sequence so its own read events do not invalidate
+the traversal. New events are visible in a fresh traversal. Restore invalidates
+old cursors; its new credentials require a fresh traversal too.
+
+## Capacity before refusal
+
+`cairn team doctor --data DIR` remains local, metadata-only and non-mutating.
+It reports record/audit entries, UTF-8 bytes, ceilings, remaining space and
+`available`, `near-limit` (80%) or `exhausted` status. These are diagnostics,
+not a guarantee that the next write fits. Records remain bounded at 32,768 and
+16 MiB. Ordinary audit admission is 99,000 events/16 MiB, with a separate local
+operator reserve of 1,000 events/256 KiB. Nothing is evicted automatically.
+Archiving audit does not free record capacity.
+
+## Offline, exact-digest archival
+
+Only the trusted local OS operator can archive. **Stop the team API and bridge
+writers first**, and use the matching new admin binary. Existing older server
+processes cannot be retroactively made schema-aware. Do not archive a store
+while an older service still has it open.
+
+Choose private paths outside source trees; ancestors must not be writable by
+other users/groups. Keep the backup and archive on durable protected storage.
+The following paths are placeholders, not production defaults:
+
+```sh
+CAIRN_TEAM=1 cairn team doctor --data /absolute/private/team
+CAIRN_TEAM=1 cairn team backup --data /absolute/private/team --read-only \
+  --output /absolute/private/backups/pre-archive.json
+CAIRN_TEAM=1 cairn team audit-export --data /absolute/private/team \
+  --backup /absolute/private/backups/pre-archive.json \
+  --output /absolute/private/backups/audit-segment.json
+CAIRN_TEAM=1 cairn team audit-verify \
+  --input /absolute/private/backups/audit-segment.json
+```
+
+`--read-only` makes a consistent backup without adding an audit event, including
+when the local reserve is full. Normal backup retains its existing audit event.
+The export verifies its backup against current state, writes exclusively with
+private permissions and file fsync (plus a directory flush on POSIX), and changes
+no database state. Node cannot flush directory handles on Windows; protect and
+retain the exported files on reliable storage before applying compaction.
+It contains audit
+metadata, not memory values or raw bearer tokens. Names and activity are still
+sensitive; an export is not a public report.
+
+Use the returned **archive_digest**, not a memory or backup digest:
+
+```sh
+# No-write plan:
+CAIRN_TEAM=1 cairn team audit-archive --data /absolute/private/team \
+  --input /absolute/private/backups/audit-segment.json \
+  --backup /absolute/private/backups/pre-archive.json --confirm ARCHIVE_DIGEST
+# Repeat the exact command with --apply to compact the verified active prefix.
+```
+
+Wrong/tampered/stale backups, archives or confirmation fail. Any intervening
+audited operation makes the plan stale: stop writers and produce a fresh pair.
+Apply atomically records the archive/backup digests and terminal sequence/hash,
+removes the active audit prefix, and appends an archival event. A failed database
+transaction rolls back checkpoint, schema change and removal together. No file
+is removed or overwritten. Keep **all segments and backups** under an explicit
+operator-owned retention policy; no background job or default expiry is added.
+
+## Compatibility, recovery and limits of evidence
+
+Unarchived stores and snapshots stay version 1. Explicit archival changes only
+this separate team store to version 2; subsequent snapshots carry its checkpoint.
+Older server/admin binaries reject reopening that store. Legacy remote clients
+can still use unchanged non-paged API calls with the new service. To roll back
+the server format, use the retained pre-archive v1 backup in a fresh location;
+never point an older binary at the compacted database. Restore continues to
+revoke every copied credential. Reissue credentials and approve reactivation
+explicitly; never overwrite a live store with a restore.
+
+Doctor and snapshot validation check the active audit suffix anchored at its
+checkpoint. They do **not** open external archives or prove full historical
+retention. Verify retained segments with `audit-verify`; pass `--previous FILE`
+to check the adjacent archive link. One successful segment check is not a claim
+that every earlier segment is present. Digests provide integrity, not publisher
+authenticity, independent timestamping or protection against a malicious OS owner.
+Compaction is not secure erasure: backups, archives and SQLite pages may retain
+data. Audit capacity still fails closed if operators take no action.
+
+## Synthetic continuity endurance
+
+From a matching built source checkout, in a private disposable lab:
+
+```sh
+lab=$(mktemp -d)
+CAIRN_TEAM_SOAK=1 node mcp-memory-server/scripts/run-team-continuity-soak.mjs \
+  --cycles 120 --duration-ms 1200000 --out "$lab/report.json"
+```
+
+This exercises two actual stdio MCP client processes across working folders,
+separate API process restarts (including an unclean termination), private
+token-file rotation, revoked credentials, audit
+archival and fresh restore. Its human-class reviewer is a **synthetic policy
+fixture**, not actual human consent. No paid model, provider, real memory or
+production configuration is used. Reports contain counts, digests and latency,
+not selected text or bearer credentials. This is transport/authorization
+continuity evidence, not a native-harness UI trial or a model-quality benchmark.

package/docs/team.md

@@ -214,13 +214,19 @@ store are refused before any uninstall changes; a store selected only through
 
 ## Bounded preview and admission
 
+From 2.27.0, optional pagination, capacity diagnostics and explicitly confirmed
+audit archival are available in [team operations](team-operations.md). Upgrade
+the client, API and admin binary before using these operations.
+
 Selected values are at most 64 KiB UTF-8; requests 512 KiB; responses 2 MiB;
 snapshots 64 MiB. Records are capped at 32,768 and 16 MiB of stored JSON;
-audit at 100,000 events and 16 MiB, with a 1,000-event/256 KiB OS-operator reserve.
+ordinary audit at 99,000 events and 16 MiB, with a separate
+1,000-event/256 KiB OS-operator reserve.
 Limits fail closed rather than discarding records. Back up and review retention
-before approaching them; the preview has no audit archival/compaction command.
-Retrieval is bounded (100 list/history items, ten search results); the API
-currently has no pagination. HTTP separately limits malformed authentication
+before approaching them; archival is offline, manual and backup-bound, never
+automatic. Retrieval is bounded (100 list/history items, ten search results);
+optional authenticated paging is available from 2.27.0. HTTP separately limits
+malformed authentication
 per connection address and authenticated requests per subject to 120 per minute;
 invalid token-shaped credentials receive ten attempts per token digest. Each
 budget holds at most 512 identities, and invalid authentication cannot consume

package/examples/eval/bundled-fake.json

@@ -1 +1 @@
-{"identifier":"cairn-offline-fake-v1","package_version":"2.26.0","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}
+{"identifier":"cairn-offline-fake-v1","package_version":"2.27.0","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}

package/mcp-memory-server/dist/team-audit.js

@@ -0,0 +1,41 @@
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { TeamError } from './team-errors.js';
+const id = z.string().regex(/^[a-z0-9][a-z0-9-]{0,63}$/);
+const digest = z.string().regex(/^[a-f0-9]{64}$/);
+export const teamAuditCheckpointSchema = z.object({ sequence: z.number().int().positive(), digest, archive_digest: digest, backup_digest: digest, previous_archive_digest: digest.nullable() }).strict();
+export const teamAuditRowSchema = z.object({ sequence: z.number().int().positive(), organization: id, project: id.or(z.literal('')), value: z.string().max(4096), digest }).strict();
+export const teamAuditEntrySchema = z.object({ schema_version: z.literal(1), sequence: z.number().int().positive(), organization: id, project: id.or(z.literal('')), subject: id, credential_class: z.enum(['human', 'workload', 'local-os']), operation: z.enum(['project-create', 'member-set', 'credential-revoke', 'credential-issue', 'memory-delete', 'list', 'audit', 'read', 'history', 'search', 'propose', 'proposals', 'proposal-show', 'review', 'snapshot', 'restore', 'connection-check', 'audit-archive']), result: z.enum(['accepted', 'denied', 'conflict', 'invalid']), object_digest: digest.nullable(), previous_digest: digest.nullable(), request_id: z.string().uuid(), at: z.iso.datetime() }).strict();
+const archiveSchema = z.object({ schema_version: z.literal(1), organization: id, backup_digest: digest, previous_checkpoint: teamAuditCheckpointSchema.nullable(), entries: z.array(teamAuditRowSchema).min(1).max(100000), digest }).strict();
+const hash = (text) => createHash('sha256').update(text).digest('hex');
+export function verifyTeamAuditRows(organization, rows, checkpoint) {
+    try {
+        let sequence = checkpoint?.sequence ?? 0, previous = checkpoint?.digest ?? null, bytes = 0;
+        for (const row of rows) {
+            const entry = teamAuditEntrySchema.parse(JSON.parse(row.value));
+            bytes += Buffer.byteLength(row.value);
+            if (row.organization !== organization || row.sequence !== ++sequence || entry.sequence !== sequence || entry.organization !== organization || entry.project !== row.project || entry.previous_digest !== previous || hash(row.value) !== row.digest)
+                throw new Error();
+            previous = row.digest;
+        }
+        if (bytes > 16 * 1024 * 1024 + 256 * 1024)
+            throw new Error();
+    }
+    catch {
+        throw new TeamError('integrity');
+    }
+}
+export function verifyTeamAuditArchive(input) {
+    try {
+        if (Buffer.byteLength(JSON.stringify(input)) > 64 * 1024 * 1024)
+            throw new Error();
+        const archive = archiveSchema.parse(input), { digest, ...body } = archive;
+        if (hash(JSON.stringify(body)) !== digest)
+            throw new Error();
+        verifyTeamAuditRows(archive.organization, archive.entries, archive.previous_checkpoint);
+        return archive;
+    }
+    catch {
+        throw new TeamError('integrity');
+    }
+}