@cairnkeep/cli 2.3.1 → 2.5.0

package/scripts/test-learning-docs.sh

@@ -7,13 +7,22 @@ cd "$ROOT"
 version=$(node -p "require('./package.json').version")
 landing=docs/learning/README.md
 production=docs/learning/PRODUCTION-PLAN.md
+coverage=docs/learning/CURRICULUM-MAP.md
+feature_guide=docs/learning/FEATURE-GUIDE.md
 
-[[ -f "$landing" && -f "$production" ]]
+[[ -f "$landing" && -f "$production" && -f "$coverage" && -f "$feature_guide" ]]
 grep -qF 'docs/learning/README.md' README.md
+grep -qF "**Baseline:** Cairnkeep $version" "$coverage"
+grep -qF "**Baseline:** Cairnkeep $version" "$feature_guide"
+grep -qF 'https://github.com/cairnkeep/cairnkeep-course-labs' "$landing"
+for checkpoint in course-00-app course-01-bootstrap course-02-memory course-03-quality \
+  course-04-operation course-05-evidence course-06-governance course-07-evaluation; do
+  grep -qF "\`$checkpoint\`" "$coverage"
+done
 
 ready=0
 brief=0
-for number in $(seq -w 0 12); do
+for number in $(seq -w 0 17); do
   matches=(docs/learning/lessons/L"$number"-*.md)
   [[ ${#matches[@]} -eq 1 && -f ${matches[0]} ]] || {
     echo "learning path must contain exactly one L$number lesson" >&2
@@ -41,17 +50,24 @@ for number in $(seq -w 0 12); do
   fi
 done
 
-[[ $ready -eq 4 && $brief -eq 9 ]] || {
+[[ $ready -eq 4 && $brief -eq 14 ]] || {
   echo "unexpected learning status totals: ready=$ready brief=$brief" >&2
   exit 1
 }
 
-for track in quickstart practitioner operator; do
+for track in quickstart practitioner evidence-and-evaluation operator; do
   file=docs/learning/tracks/$track.md
   [[ -f "$file" ]]
   grep -q '^# ' "$file"
 done
 
+while read -r command; do
+  grep -qF "\`cairn $command\`" "$coverage" || {
+    echo "top-level command has no curriculum owner: cairn $command" >&2
+    exit 1
+  }
+done < <(bin/cairn help | sed -n 's/^  cairn \([a-z-]*\).*/\1/p' | sort -u)
+
 node <<'NODE'
 const { existsSync, readdirSync, readFileSync } = require("node:fs");
 const { dirname, resolve } = require("node:path");

package/scripts/test-notes-cli.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# Public CLI contract for opt-in deterministic note distillation and lookup.
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+fail() { echo "FAIL: $1" >&2; exit 1; }
+
+cairn="$ROOT/bin/cairn"
+fixture="$ROOT/mcp-memory-server/scripts/fixtures/notes/lifecycle-sessions.json"
+project_a="$tmp/PARA/Projects/project-a"
+project_b="$tmp/PARA/Projects/project-b"
+project_c="$tmp/PARA/Projects/project-c"
+store="$tmp/store"
+mkdir -p "$project_a" "$project_b" "$project_c"
+
+put_session() {
+  local name=$1 project=$2 session_id=${3:-}
+  (cd "$ROOT/mcp-memory-server" && PROJECT="$project" NAME="$name" SESSION_ID="$session_id" FIXTURE="$fixture" node --input-type=module - <<'EOF'
+import { readFileSync } from "node:fs";
+import { getTrajectoryLimits, trajectorySessionSchema } from "./dist/trajectory-schema.js";
+import { putTrajectory } from "./dist/trajectory-store.js";
+const all = JSON.parse(readFileSync(process.env.FIXTURE, "utf8"));
+const raw = JSON.parse(JSON.stringify(all[process.env.NAME]).replaceAll("$PROJECT_ROOT", process.env.PROJECT));
+if (process.env.SESSION_ID) raw.session_id = process.env.SESSION_ID;
+await putTrajectory(process.env.PROJECT, trajectorySessionSchema.parse(raw), getTrajectoryLimits());
+EOF
+  )
+}
+
+"$cairn" help | grep -q "cairn notes" || fail "help missing notes"
+
+# Disabled means no notes root, lock, manifest, or trajectory mutation.
+put_session failure "$project_a"
+before=$(sha256sum "$project_a/.agentfs/trajectory.db" | cut -d' ' -f1)
+CAIRN_AGENTFS_BASE_DIR="$store" env -u CAIRN_NOTE_DISTILLATION \
+  "$cairn" notes distill --project "$project_a" --json >"$tmp/disabled.json"
+node -e 'const j=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));if(j.enabled!==false)process.exit(1)' "$tmp/disabled.json" \
+  || fail "disabled result is not explicit"
+[[ ! -e "$store/notes" ]] || fail "disabled command created notes data"
+after=$(sha256sum "$project_a/.agentfs/trajectory.db" | cut -d' ' -f1)
+[[ "$before" == "$after" ]] || fail "disabled command changed trajectory bytes"
+
+export CAIRN_AGENTFS_BASE_DIR="$store"
+export CAIRN_NOTE_DISTILLATION=1
+unset CAIRN_NOTE_ENRICHMENT CAIRN_LLM_API_KEY CAIRN_LLM_API_URL CAIRN_NOTE_ENRICHMENT_MODEL
+
+"$cairn" notes distill --project "$project_a" --session note-failure-001 --json >"$tmp/created.json"
+note_a=$(node -e 'const j=require(process.argv[1]);if(j.created.length!==1||j.created[0].status!=="unresolved")process.exit(1);process.stdout.write(j.created[0].id)' "$tmp/created.json") \
+  || fail "exact-session distillation did not create one unresolved note"
+path_a=$(node -e 'process.stdout.write(require(process.argv[1]).created[0].path)' "$tmp/created.json")
+printf '\n## Maintainer notes\n\nPreserve this operator sentence.\n' >>"$path_a"
+
+put_session fix "$project_a"
+"$cairn" notes distill --project "$project_a" --json >"$tmp/fixed.json"
+node -e 'const j=require(process.argv[1]);if(!j.updated.some(x=>x.status==="resolved"))process.exit(1)' "$tmp/fixed.json" \
+  || fail "incremental current-project run did not resolve the note"
+grep -q 'Preserve this operator sentence.' "$path_a" || fail "managed update removed manual content"
+
+printf '%s\n' "TypeError: Cannot read properties of undefined (reading 'name')" \
+  "    at loadUser (/another/root/src/user.ts:999:1)" \
+  | "$cairn" notes search-error --project "$project_a" --json >"$tmp/search.json"
+node -e 'const j=require(process.argv[1]);if(j.results[0]?.id!==process.argv[2]||j.results[0]?.status!=="resolved")process.exit(1)' "$tmp/search.json" "$note_a" \
+  || fail "fresh public search did not return resolved note first"
+
+"$cairn" notes distill --project "$project_a" --session note-fix-001 --json >"$tmp/repeat.json"
+node -e 'const j=require(process.argv[1]);if(j.already_processed.length!==1)process.exit(1)' "$tmp/repeat.json" \
+  || fail "exact reprocessing is not idempotent"
+
+put_session failure "$project_b" note-failure-project-b
+"$cairn" notes distill --all-projects --para-root "$tmp/PARA" --json >"$tmp/all.json"
+node -e 'const j=require(process.argv[1]);if(j.projects_scanned<2)process.exit(1)' "$tmp/all.json" \
+  || fail "all-project mode did not scan both trajectory projects"
+note_b=$(node -e 'const j=require(process.argv[1]);const c=j.results.flatMap(x=>x.created||[]).find(x=>x.project_id!==process.argv[2]);if(!c)process.exit(1);process.stdout.write(c.id)' "$tmp/all.json" "$(basename "$(dirname "$(dirname "$path_a")")")") \
+  || fail "all-project mode did not create the corroborating note"
+
+if "$cairn" notes promote "$note_a" --with "$note_b" --json >"$tmp/unconfirmed.out" 2>&1; then
+  fail "promotion succeeded without --confirm"
+fi
+if "$cairn" notes promote "$note_a" --with "$note_a" --confirm --json >"$tmp/same.out" 2>&1; then
+  fail "promotion accepted one-project evidence"
+fi
+"$cairn" notes promote "$note_a" --with "$note_b" --confirm --json >"$tmp/promoted.json"
+node -e 'const j=require(process.argv[1]);if(j.status!=="promoted"||!j.shared_path)process.exit(1)' "$tmp/promoted.json" \
+  || fail "confirmed cross-project promotion failed"
+[[ $(find "$store/notes/shared" -type f -name '*.md' | wc -l | tr -d ' ') == 1 ]] \
+  || fail "promotion did not leave exactly one shared canonical note"
+grep -q 'node_type: provenance' "$path_a" || fail "project note did not become provenance"
+
+# A live lock and an unmanaged replacement both fail without changing bytes.
+put_session failure "$project_c" note-failure-project-c
+"$cairn" notes distill --project "$project_c" --json >"$tmp/project-c.json"
+path_c=$(node -e 'process.stdout.write(require(process.argv[1]).created[0].path)' "$tmp/project-c.json")
+project_id_c=$(basename "$(dirname "$(dirname "$path_c")")")
+mkdir -p "$store/notes/.cairnkeep/locks/$project_id_c.lock"
+if "$cairn" notes distill --project "$project_c" --json >"$tmp/locked.out" 2>&1; then
+  fail "distillation ignored a live project lock"
+fi
+rm -rf "$store/notes/.cairnkeep/locks/$project_id_c.lock"
+printf 'manual unmanaged bytes\n' >"$path_c"
+collision_before=$(sha256sum "$path_c" | cut -d' ' -f1)
+put_session recurrence "$project_c" note-recurrence-project-c
+if "$cairn" notes distill --project "$project_c" --json >"$tmp/collision.out" 2>&1; then
+  fail "distillation overwrote an unmanaged collision"
+fi
+collision_after=$(sha256sum "$path_c" | cut -d' ' -f1)
+[[ "$collision_before" == "$collision_after" ]] || fail "collision changed unmanaged bytes"
+
+"$cairn" notes doctor --json >"$tmp/doctor.json"
+node -e 'const j=require(process.argv[1]);if(j.schema_version!==1||j.ok!==true)process.exit(1)' "$tmp/doctor.json" \
+  || fail "notes doctor did not validate the generated tree"
+
+echo "PASS: cairn notes CLI, disabled path, promotion, lock and collision contracts"

package/scripts/test-package-install.sh

@@ -8,6 +8,23 @@ tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' EXIT
 fail() { echo "FAIL: $1" >&2; exit 1; }
 
+manifest_field() {
+  node -e 'const value=require(process.argv[1]); process.stdout.write(JSON.stringify(value[process.argv[2]] ?? null))' "$1" "$2"
+}
+
+root_version_before=$(manifest_field "$ROOT/package.json" version)
+root_dependencies_before=$(manifest_field "$ROOT/package.json" dependencies)
+server_dependencies_before=$(manifest_field "$ROOT/mcp-memory-server/package.json" dependencies)
+server_dev_dependencies_before=$(manifest_field "$ROOT/mcp-memory-server/package.json" devDependencies)
+root_lock_before=$(sha256sum "$ROOT/package-lock.json" | cut -d' ' -f1)
+server_lock_before=$(sha256sum "$ROOT/mcp-memory-server/package-lock.json" | cut -d' ' -f1)
+node "$ROOT/mcp-memory-server/dist/eval-cli.js" --help >"$tmp/source-eval-help"
+env -u CAIRN_EVAL "$ROOT/bin/cairn" eval validate \
+  --task-set "$tmp/source-unread-task-set" \
+  --adapter "$tmp/source-unread-adapter" \
+  --output "$tmp/source-unwritten-output" --json >"$tmp/source-eval-disabled.json"
+[[ ! -e "$tmp/source-unwritten-output" ]] || fail "source disabled eval created output"
+
 cd "$ROOT"
 npm pack --silent --pack-destination "$tmp" --dry-run=false >/dev/null
 tarballs=("$tmp"/*.tgz)
@@ -25,12 +42,249 @@ bootstrap_output=$(cairn bootstrap "$tmp/project")
 [[ "$bootstrap_output" == *"cairn memory-server"* ]] || fail "bootstrap printed invalid memory-server setup instructions"
 [[ "$bootstrap_output" == *"cairn sync --apply"* ]] || fail "bootstrap printed invalid operating-layer setup instructions"
 [[ -x "$tmp/project/.ai/start-claude.sh" ]] || fail "bootstrap did not install an executable Claude launcher"
+[[ -x "$tmp/project/.ai/start-pi.sh" ]] || fail "bootstrap did not install an executable Pi launcher"
+[[ -x "$tmp/project/.ai/start-kimi.sh" ]] || fail "bootstrap did not install an executable Kimi launcher"
 [[ -f "$tmp/project/.planning/config.json" ]] || fail "bootstrap did not install the planning scaffold"
 
 (cd "$tmp/project" && cairn doctor) >/dev/null || fail "installed package failed cairn doctor"
+env -u CAIRN_NOTE_DISTILLATION cairn notes --help >/dev/null \
+  || fail "installed package omitted the notes command"
 
 installed_root="$tmp/prefix/lib/node_modules/@cairnkeep/cli"
+cairn eval --help >"$tmp/installed-eval-help"
+cmp -s "$tmp/source-eval-help" "$tmp/installed-eval-help" || \
+  fail "source and installed eval help differ"
+env -u CAIRN_EVAL cairn eval validate \
+  --task-set "$tmp/installed-unread-task-set" \
+  --adapter "$tmp/installed-unread-adapter" \
+  --output "$tmp/installed-unwritten-output" --json >"$tmp/installed-eval-disabled.json"
+cmp -s "$tmp/source-eval-disabled.json" "$tmp/installed-eval-disabled.json" || \
+  fail "source and installed disabled eval identity differ"
+[[ ! -e "$tmp/installed-unwritten-output" ]] || fail "installed disabled eval created output"
+
+for required in \
+  schemas/capability-contract.schema.json \
+  schemas/capability-callback.schema.json \
+  templates/capabilities.json.template \
+  mcp-memory-server/dist/capability-schema.js \
+  mcp-memory-server/dist/capability-registry.js \
+  mcp-memory-server/dist/capability-config.js \
+  mcp-memory-server/dist/capability-store.js \
+  mcp-memory-server/dist/capability-adapter.js \
+  mcp-memory-server/dist/capability-cli.js \
+  claude/capability-contract/hooks/capability-command-start.sh \
+  claude/capability-contract/hooks/capability-command-finish.sh \
+  opencode/capability-contract/plugins/capability-command.ts
+do
+  [[ -f "$installed_root/$required" ]] || fail "npm tarball omitted $required"
+done
+
+for required in \
+  schemas/eval-task-set.schema.json \
+  schemas/eval-adapter.schema.json \
+  schemas/eval-protocol.schema.json \
+  schemas/eval-report.schema.json \
+  mcp-memory-server/dist/eval-schema.js \
+  mcp-memory-server/dist/eval-process.js \
+  mcp-memory-server/dist/eval-workspace.js \
+  mcp-memory-server/dist/eval-plan.js \
+  mcp-memory-server/dist/eval-statistics.js \
+  mcp-memory-server/dist/eval-report.js \
+  mcp-memory-server/dist/eval-runner.js \
+  mcp-memory-server/dist/eval-cli.js \
+  scripts/fake-eval-adapter.mjs \
+  examples/eval/task-set.json \
+  examples/eval/bundled-fake.json \
+  examples/eval/adapter.json \
+  examples/eval/README.md
+do
+  [[ -f "$installed_root/$required" ]] || fail "npm tarball omitted $required"
+done
+[[ -x "$installed_root/scripts/fake-eval-adapter.mjs" ]] || \
+  fail "installed fake adapter is not executable"
+for asset in \
+  schemas/eval-task-set.schema.json \
+  schemas/eval-adapter.schema.json \
+  schemas/eval-protocol.schema.json \
+  schemas/eval-report.schema.json \
+  examples/eval/task-set.json \
+  examples/eval/bundled-fake.json \
+  examples/eval/adapter.json \
+  examples/eval/README.md
+do
+  [[ ! -x "$installed_root/$asset" ]] || \
+    fail "installed public eval data asset is unexpectedly executable: $asset"
+done
+eval_assets=$(cd "$installed_root/examples/eval" && find . -type f -print | LC_ALL=C sort)
+[[ "$eval_assets" == $'./README.md\n./adapter.json\n./bundled-fake.json\n./task-set.json' ]] || \
+  fail "installed eval examples contain an unexpected path"
+
+node - "$installed_root/examples/eval/adapter.json" <<'NODE'
+const value = require(process.argv[2]);
+if (JSON.stringify(Object.keys(value).sort()) !== JSON.stringify(["command", "id", "schema_version", "turn_semantics"])) process.exit(1);
+if (value.id !== "cairn-offline-fake" || value.command.program !== "../../scripts/fake-eval-adapter.mjs") process.exit(1);
+if (!Array.isArray(value.command.args) || value.command.args.length !== 0) process.exit(1);
+NODE
+if grep -R -E 'https?://|CAIRN_LLM_API_KEY|CAIRN_LLM_ENDPOINT' \
+  "$installed_root/examples/eval" "$installed_root/scripts/fake-eval-adapter.mjs" >/dev/null; then
+  fail "installed eval fixture contains a live endpoint or credential default"
+fi
+
+installed_task_set="$installed_root/examples/eval/task-set.json"
+installed_adapter="$installed_root/examples/eval/adapter.json"
+installed_output="$tmp/installed-eval-output"
+CAIRN_EVAL=1 cairn eval validate \
+  --task-set "$installed_task_set" --adapter "$installed_adapter" \
+  --output "$installed_output" --seed installed-package-seed --json >"$tmp/installed-eval-validate.json"
+[[ ! -e "$installed_output" ]] || fail "installed eval validation created output"
+CAIRN_EVAL=1 cairn eval run \
+  --task-set "$installed_task_set" --adapter "$installed_adapter" \
+  --output "$installed_output" --seed installed-package-seed --yes --json \
+  >"$tmp/installed-eval-run.json" 2>"$tmp/installed-eval-run.err"
+
+node - \
+  "$installed_root/mcp-memory-server/dist/eval-schema.js" \
+  "$installed_root/package.json" \
+  "$installed_task_set" \
+  "$installed_root/examples/eval/bundled-fake.json" \
+  "$tmp/installed-eval-validate.json" \
+  "$tmp/installed-eval-run.json" <<'NODE'
+const { readFileSync } = require("node:fs");
+const { pathToFileURL } = require("node:url");
+(async () => {
+  const [schemaPath, packagePath, taskSetPath, bindingPath, validationPath, runPath] = process.argv.slice(2);
+  const { canonicalDigest } = await import(pathToFileURL(schemaPath).href);
+  const manifest = JSON.parse(readFileSync(taskSetPath, "utf8"));
+  const binding = JSON.parse(readFileSync(bindingPath, "utf8"));
+  const installedPackage = JSON.parse(readFileSync(packagePath, "utf8"));
+  const validation = JSON.parse(readFileSync(validationPath, "utf8"));
+  const run = JSON.parse(readFileSync(runPath, "utf8"));
+  const digest = canonicalDigest(manifest);
+  if (binding.identifier !== "cairn-offline-fake-v1") process.exit(1);
+  if (binding.package_version !== installedPackage.version || binding.task_set_digest !== digest) process.exit(1);
+  if (validation.operation !== "validate" || validation.invocation_count !== manifest.tasks.length * 2) process.exit(1);
+  if (validation.plan.source.identifier !== binding.identifier
+      || validation.plan.source.package_version !== installedPackage.version
+      || validation.plan.task_set_digest !== digest) process.exit(1);
+  if (run.operation !== "run" || run.status !== "final" || run.invocation_count !== manifest.tasks.length * 2) process.exit(1);
+  const report = JSON.parse(readFileSync(run.report_path, "utf8"));
+  if (report.task_set_digest !== digest || report.evidence.task_set_digest !== digest) process.exit(1);
+  if (report.evidence.package_version !== installedPackage.version
+      || report.evidence.evidence_scope !== "offline-framework"
+      || report.observations.length !== manifest.tasks.length * 2) process.exit(1);
+})().catch((error) => { console.error(error); process.exit(1); });
+NODE
+
+binding_path="$installed_root/examples/eval/bundled-fake.json"
+cp "$binding_path" "$tmp/original-bundled-fake.json"
+for field in identifier package_version task_set_digest; do
+  node - "$binding_path" "$field" <<'NODE'
+const { readFileSync, writeFileSync } = require("node:fs");
+const [path, field] = process.argv.slice(2);
+const value = JSON.parse(readFileSync(path, "utf8"));
+value[field] = field === "task_set_digest" ? "0".repeat(64) : `mutated-${field}`;
+writeFileSync(path, `${JSON.stringify(value)}\n`);
+NODE
+  if CAIRN_EVAL=1 cairn eval validate \
+    --task-set "$installed_task_set" --adapter "$installed_adapter" \
+    --output "$tmp/rejected-eval-output" --json >/dev/null 2>&1; then
+    fail "installed eval accepted mutated $field binding"
+  fi
+  cp "$tmp/original-bundled-fake.json" "$binding_path"
+done
+[[ ! -e "$tmp/rejected-eval-output" ]] || fail "rejected installed eval fixture created output"
+chmod -R u+w "$installed_output"
+
+if find \
+  "$installed_root/claude/capability-contract/commands" \
+  "$installed_root/opencode/capability-contract/command" \
+  "$installed_root/opencode/capability-contract/workflows" \
+  -type f -print 2>/dev/null | grep -q .; then
+  fail "npm tarball included a retired capability prompt owner"
+fi
+
+CAIRN_CAPABILITY_CONTRACT=1 cairn capabilities status --json >"$tmp/capability-status.json" \
+  || fail "installed package capability status failed"
+node - "$tmp/capability-status.json" <<'NODE'
+const fs = require("fs")
+const value = JSON.parse(fs.readFileSync(process.argv[2], "utf8"))
+const expected = ["memory.write", "memory.search", "notes.distill", "wiki", "graph", "security.audit", "route.check", "context.explore"]
+if (value.schema_version !== 1 || value.contract_enabled !== true) process.exit(1)
+if (JSON.stringify(value.capabilities.map((row) => row.id)) !== JSON.stringify(expected)) process.exit(1)
+if (!/^[0-9a-f]{64}$/.test(value.configuration_digest)) process.exit(1)
+NODE
 [[ -f "$installed_root/examples/anythingllm/sync_to_anythingllm.py" ]] || \
   fail "npm tarball omitted the default AnythingLLM sync script"
+[[ -f "$installed_root/pi/extensions/cairnkeep-trajectory.ts" ]] || \
+  fail "npm tarball omitted the Pi trajectory extension"
+[[ -x "$installed_root/scripts/sync-pi-assets.sh" ]] || \
+  fail "npm tarball omitted the Pi sync command"
+[[ -f "$installed_root/templates/start-pi.sh.template" ]] || \
+  fail "npm tarball omitted the Pi launcher template"
+[[ -f "$installed_root/templates/start-kimi.sh.template" ]] || \
+  fail "npm tarball omitted the Kimi launcher template"
+[[ -f "$installed_root/schemas/note.schema.json" ]] || \
+  fail "npm tarball omitted the note schema"
+[[ -f "$installed_root/schemas/memory-node.schema.json" ]] || \
+  fail "npm tarball omitted the typed memory-node schema"
+[[ -f "$installed_root/schemas/artifact.schema.json" ]] || \
+  fail "npm tarball omitted the artifact schema"
+for module in node-schema node-store node-cli; do
+  [[ -f "$installed_root/mcp-memory-server/dist/$module.js" ]] || \
+    fail "npm tarball omitted compiled $module"
+done
+[[ -f "$installed_root/mcp-memory-server/dist/note-cli.js" ]] || \
+  fail "npm tarball omitted the compiled note CLI"
+[[ -f "$installed_root/mcp-memory-server/dist/note-enrichment.js" ]] || \
+  fail "npm tarball omitted optional note enrichment"
+[[ -f "$installed_root/mcp-memory-server/dist/note-store.js" ]] || \
+  fail "npm tarball omitted the deterministic note store"
+for module in artifact-schema artifact-store compaction-normalize artifact-cli; do
+  [[ -f "$installed_root/mcp-memory-server/dist/$module.js" ]] || \
+    fail "npm tarball omitted compiled $module"
+done
+[[ -x "$installed_root/claude/hooks/compaction-capture.sh" ]] || \
+  fail "npm tarball omitted the executable Claude compaction hook"
+[[ -f "$installed_root/opencode/plugins/memory-capture.ts" ]] || \
+  fail "npm tarball omitted the OpenCode capture plugin"
+[[ -f "$installed_root/opencode/plugins/memory-wakeup.ts" ]] || \
+  fail "npm tarball omitted the OpenCode recovery plugin"
+for fixture in \
+  compaction-claude-code-2.1.219.json \
+  compaction-claude-code-2.1.220.json \
+  compaction-opencode-1.17.20-event.json \
+  compaction-opencode-1.17.20-messages.json
+do
+  [[ -f "$installed_root/mcp-memory-server/scripts/fixtures/$fixture" ]] || \
+    fail "npm tarball omitted versioned fixture $fixture"
+done
+if find "$installed_root" -type f \( \
+  -path '*/.ai/capabilities.json' \
+  -o -name 'manifest-v1.json' \
+  -o -name '*.db' -o -name '*.db-wal' -o -name '*.db-shm' \
+  -o -path '*/notes/projects/*' -o -path '*/transactions/*' -o -path '*/backups/*' \
+  -o -path '*/runtime-evidence/*' -o -path '*/generated-artifacts/*' \
+  -o -path '*/artifacts/projects/*' -o -path '*/artifacts/sessions/*' -o -path '*/artifacts/data/*' \
+  -o -path '*/capability-callback/*' -o -path '*/test-tmp/*' \
+  -o -path '*/.agentfs/*' -o -path '*/eval/experiments/*' \
+  -o -path '*/eval/reports/*' -o -path '*/eval/snapshots/*' \
+  -o -path '*/eval/runtime-evidence/*' -o -path '*/eval/evidence/*' \
+  -o -path '*/eval/user-data/*' \
+\) | grep -q .; then
+  fail "npm tarball included generated capability, callback, eval evidence, or user data"
+fi
+
+if find "$installed_root" -type f \( -name 'token_miser' -o -name 'token-miser' -o -name 'token_miser.*' -o -name 'token-miser.*' \) | grep -q .; then
+  fail "npm tarball included a token-miser implementation instead of the existing delegate boundary"
+fi
+[[ -f "$installed_root/mcp-memory-server/dist/index.js" ]] || fail "npm tarball omitted the existing MCP delegate owner"
+[[ -x "$installed_root/scripts/sync-opencode-explore-assets.sh" ]] || fail "npm tarball omitted the existing explore asset delegate"
+
+[[ "$(manifest_field "$ROOT/package.json" version)" == "$root_version_before" ]] || fail "package version changed during pack/install"
+[[ "$(manifest_field "$ROOT/package.json" dependencies)" == "$root_dependencies_before" ]] || fail "root dependencies changed during pack/install"
+[[ "$(manifest_field "$ROOT/mcp-memory-server/package.json" dependencies)" == "$server_dependencies_before" ]] || fail "server dependencies changed during pack/install"
+[[ "$(manifest_field "$ROOT/mcp-memory-server/package.json" devDependencies)" == "$server_dev_dependencies_before" ]] || fail "server devDependencies changed during pack/install"
+[[ "$(sha256sum "$ROOT/package-lock.json" | cut -d' ' -f1)" == "$root_lock_before" ]] || fail "root lockfile changed during pack/install"
+[[ "$(sha256sum "$ROOT/mcp-memory-server/package-lock.json" | cut -d' ' -f1)" == "$server_lock_before" ]] || fail "server lockfile changed during pack/install"
 
 echo "PASS: npm tarball installs a self-contained CLI and MCP server"

package/scripts/test-phase16-node-lifecycle.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+MARKER="PHASE16_RED:PACKAGE_UNINSTALL_CONTRACT_MISSING"
+
+case "${1:-}" in
+  "")
+    test "$#" -eq 0 || exit 2
+    "$ROOT/scripts/test-package-install.sh" || exit 1
+    "$ROOT/scripts/test-uninstall.sh" || exit 1
+    echo "PASS: Phase 16 package/uninstall baseline"
+    ;;
+  --expect-red)
+    test "$#" -eq 1 || exit 2
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+
+    mkdir -p "$tmp/expected/schemas" "$tmp/expected/mcp-memory-server/dist"
+    mkdir -p "$tmp/store/notes/.cairnkeep/transactions/txn-prepared/history"
+    printf '%s\n' '{"schema_version":1,"node_type":"knowledge","tags":["release"]}' >"$tmp/store/identity-node-metadata.json"
+    printf '%s\n' '{"schema_version":1,"import_id":"package-fixture","batch_digest":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}' >"$tmp/store/identity-import-replay.json"
+    printf '%s\n' '{"schema_version":1,"state":"prepared"}' >"$tmp/store/notes/.cairnkeep/transactions/txn-prepared/journal.json"
+    printf '%s\n' 'history bytes' >"$tmp/store/notes/.cairnkeep/transactions/txn-prepared/history/note.json"
+
+    expected="schemas/memory-node.schema.json mcp-memory-server/dist/node-schema.js mcp-memory-server/dist/node-store.js mcp-memory-server/dist/node-cli.js"
+    listing=$(cd "$ROOT" && npm pack --dry-run --json --ignore-scripts 2>/dev/null) || exit 1
+    missing=0
+    for path in $expected; do
+      if ! printf '%s\n' "$listing" | grep -Fq "\"path\": \"$path\""; then
+        missing=$((missing + 1))
+      fi
+    done
+    test "$missing" -gt 0 || {
+      echo "Phase 16 package artifacts are already present; expected RED is stale" >&2
+      exit 1
+    }
+    grep -q -- '--purge-memory' "$ROOT/scripts/uninstall.sh" || exit 1
+    if grep -q 'identity-node-metadata\|txn-prepared' "$ROOT/scripts/test-uninstall.sh"; then
+      echo "Phase 16 uninstall fixtures are already covered; expected RED is stale" >&2
+      exit 1
+    fi
+    printf '%s\n' "$MARKER" >&2
+    exit 86
+    ;;
+  *)
+    echo "Usage: $0 [--expect-red]" >&2
+    exit 2
+    ;;
+esac