@cairnkeep/cli 2.9.0 → 2.12.0

package/scripts/sync-pi-assets.sh

@@ -21,6 +21,7 @@ SOURCE_ROOT="$ROOT_DIR/pi"
 LIVE_ROOT="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
 MODE="check"
 ASSETS=(
+  "extensions/cairnkeep-memory.ts"
   "extensions/cairnkeep-trajectory.ts"
   "prompts/graphify.md"
 )
@@ -37,7 +38,7 @@ done
 
 render_asset() {
   local rel="$1"
-  if [[ "$rel" == "extensions/cairnkeep-trajectory.ts" ]]; then
+  if [[ "$rel" == extensions/*.ts ]]; then
     sed "s|@@INFRA_ROOT@@|$ROOT_DIR|g" "$SOURCE_ROOT/$rel"
   else
     cat "$SOURCE_ROOT/$rel"
@@ -74,20 +75,34 @@ ensure_sources
 if [[ "$MODE" == "apply" ]]; then
   updated=0
   unchanged=0
+  memory_updated=0
+  memory_unchanged=0
   for rel in "${ASSETS[@]}"; do
     mkdir -p "$(dirname "$LIVE_ROOT/$rel")"
     if [[ -f "$LIVE_ROOT/$rel" ]] && cmp -s <(render_asset "$rel") "$LIVE_ROOT/$rel"; then
-      unchanged=$((unchanged + 1))
+      if [[ "$rel" == "extensions/cairnkeep-memory.ts" ]]; then
+        memory_unchanged=1
+      else
+        unchanged=$((unchanged + 1))
+      fi
       continue
     fi
     rendered_tmp=$(mktemp)
     render_asset "$rel" > "$rendered_tmp"
     install -m 0644 "$rendered_tmp" "$LIVE_ROOT/$rel"
     rm -f "$rendered_tmp"
-    updated=$((updated + 1))
+    if [[ "$rel" == "extensions/cairnkeep-memory.ts" ]]; then
+      memory_updated=1
+    else
+      updated=$((updated + 1))
+    fi
   done
   printf 'Applied %s Pi asset(s); %s already matched.\n' "$updated" "$unchanged"
+  printf 'Pi memory extension: %s updated; %s already matched.\n' "$memory_updated" "$memory_unchanged"
 fi
 
-check_assets
+if ! check_assets; then
+  echo "Recovery: sync-pi-assets.sh --apply --live-root PATH" >&2
+  exit 1
+fi
 printf 'Pi extension and graph prompt are in sync under %s\n' "$LIVE_ROOT"

package/scripts/test-bootstrap-untracked.sh

@@ -55,6 +55,7 @@ git -C "$tmp/repo" init -q
 [[ -f "$tmp/repo/.ai/start-claude.sh" ]] || fail "scaffold missing"
 [[ -x "$tmp/repo/.ai/start-kimi.sh" ]] || fail "Kimi launcher missing"
 [[ -x "$tmp/repo/.ai/start-qwen.sh" ]] || fail "Qwen launcher missing"
+[[ -x "$tmp/repo/.ai/start-codex.sh" ]] || fail "Codex launcher missing"
 [[ -f "$tmp/repo/.planning/config.json" ]] || fail "planning layer missing"
 graph_policy="$tmp/repo/.planning/graphs/policy.md"
 grep -qF '`uv tool install graphifyy`' "$graph_policy" ||
@@ -89,7 +90,7 @@ grep -qxF "/.agentfs/" "$tmp/repo/.git/info/exclude" || fail "missing /.agentfs/
 printf '%s\n' '{"schema_version":1,"capabilities":{"wiki":false},"logging":{"callbacks":true}}' >"$tmp/repo/.ai/capabilities.json"
 chmod 600 "$tmp/repo/.ai/capabilities.json"
 printf '%s\n' '# operator-owned environment' >"$tmp/repo/.ai/env.example"
-asset_paths='.ai/start-claude.sh .ai/start-opencode.sh .ai/start-pi.sh .ai/start-kimi.sh .ai/start-qwen.sh .ai/env.example .ai/trajectory-redaction.json .ai/capabilities.json .agentfs/.gitignore .planning/config.json .planning/wiki/index.md .planning/wiki/policy.md .planning/wiki/CONTRADICTIONS.md .planning/wiki/LOG.md .planning/alignment/policy.md .planning/alignment/gap-register.yaml .planning/graphs/policy.md .planning/graphs/.gitignore .planning/security/policy.md'
+asset_paths='.ai/start-claude.sh .ai/start-opencode.sh .ai/start-pi.sh .ai/start-kimi.sh .ai/start-qwen.sh .ai/start-codex.sh .ai/env.example .ai/trajectory-redaction.json .ai/capabilities.json .agentfs/.gitignore .planning/config.json .planning/wiki/index.md .planning/wiki/policy.md .planning/wiki/CONTRADICTIONS.md .planning/wiki/LOG.md .planning/alignment/policy.md .planning/alignment/gap-register.yaml .planning/graphs/policy.md .planning/graphs/.gitignore .planning/security/policy.md'
 mkdir -p "$tmp/assets-before"
 for path in $asset_paths; do
   cp "$tmp/repo/$path" "$tmp/assets-before/${path//\//__}"

package/scripts/test-completion.sh

@@ -87,10 +87,12 @@ grep -q '#compdef cairn' "$tmp/zsh"
 grep -q 'complete -c cairn' "$tmp/fish"
 for shell in bash zsh; do
   grep -q 'sync-pi' "$tmp/$shell"
+  grep -q 'codex' "$tmp/$shell"
   grep -q 'sync-kimi' "$tmp/$shell"
   grep -q -- '--live-root' "$tmp/$shell"
 done
 grep -q 'sync-pi' "$tmp/fish"
+grep -q 'codex' "$tmp/fish"
 grep -q 'sync-kimi' "$tmp/fish"
 grep -q 'not __fish_seen_subcommand_from .*sync-pi sync-kimi' "$tmp/fish"
 grep -q -- '-l live-root' "$tmp/fish"
@@ -118,5 +120,44 @@ if "$ROOT/bin/cairn" completion unsupported >/dev/null 2>&1; then
   exit 1
 fi
 
+completion_surface_complete=true
+for shell in bash zsh fish; do
+  if ! grep -qw 'setup' "$tmp/$shell"; then
+    completion_surface_complete=false
+  fi
+done
+"$ROOT/bin/cairn" completion powershell >"$tmp/powershell"
+if ! grep -qE "['\"]setup['\"]" "$tmp/powershell"; then
+  completion_surface_complete=false
+fi
+
+if [[ "$completion_surface_complete" != true ]]; then
+  if [[ "${CAIRN_PHASE26_RED:-0}" == 1 ]]; then
+    echo "PHASE26_RED:SETUP_COMPLETION_MISSING"
+    exit 86
+  fi
+  echo "SKIP: guided setup completion surface is not complete"
+  git -C "$ROOT" diff --check
+  echo "PASS: shell completion generation"
+  exit 0
+fi
+
+setup_flags='--git --harness --memory --policy --yes --json'
+setup_values='init existing none claude opencode pi kimi qwen local'
+for shell in bash zsh fish powershell; do
+  for flag in $setup_flags; do
+    grep -q -- "$flag\|${flag#--}" "$tmp/$shell" || {
+      echo "setup completion omitted $flag for $shell" >&2
+      exit 1
+    }
+  done
+  for value in $setup_values; do
+    grep -qF "$value" "$tmp/$shell" || {
+      echo "setup completion omitted $value for $shell" >&2
+      exit 1
+    }
+  done
+done
+
 git -C "$ROOT" diff --check
 echo "PASS: shell completion generation"

package/scripts/test-doctor.sh

@@ -454,3 +454,69 @@ for sentinel in prompt-sentinel model-output-sentinel adapter-stderr-sentinel en
 done
 
 echo "PASS: cairn doctor (existing probes plus value-free capability/evaluation diagnostics)"
+
+phase26_doctor_complete=true
+for required in \
+  "$ROOT/scripts/setup.mjs" \
+  "$ROOT/schemas/cairnkeep-setup.schema.json" \
+  "$ROOT/pi/extensions/cairnkeep-memory.ts"; do
+  [[ -f "$required" ]] || phase26_doctor_complete=false
+done
+grep -qF 'cairnkeep.json' "$doctor" || phase26_doctor_complete=false
+grep -qF 'cairnkeep-memory.ts' "$doctor" || phase26_doctor_complete=false
+
+if [[ "$phase26_doctor_complete" != true ]]; then
+  if [[ "${CAIRN_PHASE26_RED:-0}" == 1 ]]; then
+    echo "PHASE26_RED:SETUP_DOCTOR_MISSING"
+    exit 86
+  fi
+  echo "SKIP: setup and Pi doctor diagnostics are not complete"
+  exit 0
+fi
+
+setup_home="$tmp/setup-home"
+setup_pi="$setup_home/.pi/agent"
+mkdir -p "$setup_home" "$setup_pi"
+HOME="$setup_home" "$ROOT/scripts/sync-pi-assets.sh" --apply --live-root "$setup_pi" >/dev/null
+
+complete_project="$tmp/setup-complete"
+HOME="$setup_home" "$ROOT/bin/cairn" setup "$complete_project" \
+  --git init --harness claude,pi --memory local --yes --json >/dev/null
+(cd "$complete_project" && HOME="$setup_home" PI_CODING_AGENT_DIR="$setup_pi" "$doctor") >"$tmp/setup-complete.out" 2>&1 \
+  || fail "doctor rejected complete guided setup"
+grep -Eq '\[PASS\].*(project )?setup.*complete' "$tmp/setup-complete.out" || fail "doctor omitted complete setup state"
+
+limited_project="$tmp/setup-limited"
+HOME="$setup_home" "$ROOT/bin/cairn" setup "$limited_project" \
+  --git none --harness claude --memory none --yes --json >/dev/null
+(cd "$limited_project" && HOME="$setup_home" PI_CODING_AGENT_DIR="$setup_pi" "$doctor") >"$tmp/setup-limited.out" 2>&1 \
+  || fail "doctor treated intentional Git-less setup as fatal"
+grep -Eq '\[WARN\].*(setup.*limited|Git-less)' "$tmp/setup-limited.out" || fail "doctor omitted Git-less limited state"
+
+incomplete_project="$tmp/setup-incomplete"
+mkdir -p "$incomplete_project/.ai"
+printf '%s\n' '{"schema_version":1,"git":"existing","memory":"local","harnesses":["pi"],"assets":{}}' >"$incomplete_project/.ai/cairnkeep.json"
+set +e
+(cd "$incomplete_project" && HOME="$setup_home" PI_CODING_AGENT_DIR="$setup_pi" "$doctor") >"$tmp/setup-incomplete.out" 2>&1
+incomplete_status=$?
+set -e
+[[ "$incomplete_status" -ne 0 ]] || fail "doctor accepted incomplete setup state"
+grep -Eq '\[FAIL\].*(setup.*incomplete|setup state)' "$tmp/setup-incomplete.out" || fail "doctor omitted incomplete setup diagnosis"
+grep -Eq 'cairn setup .*--git|cairn setup --git' "$tmp/setup-incomplete.out" || fail "incomplete setup lacks exact setup recovery"
+
+rm -f "$setup_pi/extensions/cairnkeep-memory.ts"
+set +e
+(cd "$complete_project" && HOME="$setup_home" PI_CODING_AGENT_DIR="$setup_pi" "$doctor") >"$tmp/setup-pi-drift.out" 2>&1
+pi_drift_status=$?
+set -e
+[[ "$pi_drift_status" -ne 0 ]] || fail "doctor accepted missing selected Pi memory extension"
+grep -Eq '\[FAIL\].*Pi.*memory extension|\[FAIL\].*cairnkeep-memory' "$tmp/setup-pi-drift.out" || fail "doctor omitted Pi drift diagnosis"
+grep -qF 'cairn sync-pi --apply' "$tmp/setup-pi-drift.out" || fail "Pi drift lacks exact sync recovery"
+
+for output in "$tmp/setup-complete.out" "$tmp/setup-limited.out" "$tmp/setup-incomplete.out" "$tmp/setup-pi-drift.out"; do
+  if grep -Eqi 'token[=:]|secret[=:]|credential[=:]|https?://' "$output"; then
+    fail "setup doctor exposed unbounded private values"
+  fi
+done
+
+echo "PASS: complete, limited, incomplete, Pi drift, and recovery doctor contract"

package/scripts/test-harness-registry.sh

@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+node --input-type=module - "$ROOT" "$tmp" <<'NODE'
+import assert from "node:assert/strict";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+import { pathToFileURL } from "node:url";
+
+const [root, sandbox] = process.argv.slice(2);
+const registry = await import(pathToFileURL(join(root, "scripts", "harness-registry.mjs")).href);
+assert.deepEqual(registry.HARNESS_IDS, ["claude", "opencode", "pi", "kimi", "qwen", "codex"]);
+assert.equal(new Set(registry.HARNESS_IDS).size, registry.HARNESS_IDS.length);
+for (const id of registry.HARNESS_IDS) {
+  const definition = registry.harnessDefinition(id);
+  assert.equal(definition.id, id);
+  assert.ok(definition.title);
+  assert.match(definition.launcher.path, new RegExp(`^\\.ai/start-${id}\\.sh$`));
+}
+assert.deepEqual(registry.harnessProjectAssets("codex", "local").map(({ path }) => path), [
+  ".ai/start-codex.sh",
+  ".codex/config.toml",
+]);
+assert.deepEqual(registry.requiredHarnessAssetPaths(["codex"], "local"), [".ai/start-codex.sh"]);
+assert.deepEqual(registry.requiredHarnessAssetPaths(["codex"], "none"), [".ai/start-codex.sh"]);
+assert.equal(registry.machineSyncCommand(["codex"]), null);
+
+const schema = JSON.parse(readFileSync(join(root, "schemas", "cairnkeep-setup.schema.json"), "utf8"));
+assert.deepEqual(schema.properties.harnesses.items.enum, registry.HARNESS_IDS, "setup schema drifted from harness registry");
+const policySchema = JSON.parse(readFileSync(join(root, "schemas", "cairnkeep-setup-policy.schema.json"), "utf8"));
+assert.deepEqual(policySchema.properties.defaults.properties.harnesses.items.enum, registry.HARNESS_IDS);
+assert.deepEqual(policySchema.properties.constraints.properties.harnesses.items.enum, registry.HARNESS_IDS);
+assert.deepEqual(policySchema.properties.constraints.properties.required_harnesses.items.enum, registry.HARNESS_IDS);
+
+const target = join(sandbox, "codex-project");
+const setup = spawnSync(join(root, "bin", "cairn"), [
+  "setup", target, "--git", "init", "--harness", "codex", "--memory", "local", "--yes", "--json",
+], { encoding: "utf8", shell: false });
+assert.equal(setup.status, 0, setup.stderr);
+const result = JSON.parse(setup.stdout);
+assert.deepEqual(result.harnesses, ["codex"]);
+assert.equal(result.machine_sync.command, null);
+assert.deepEqual(result.launch_commands, [".ai/start-codex.sh"]);
+assert.match(readFileSync(join(target, ".codex", "config.toml"), "utf8"), /\[mcp_servers\.cairn-memory\][\s\S]*command = "cairn"[\s\S]*args = \["memory-server"\]/);
+
+const fakeBin = join(sandbox, "bin");
+mkdirSync(fakeBin);
+const fakeCodex = join(fakeBin, "codex");
+writeFileSync(fakeCodex, "#!/bin/sh\nprintf '%s\\n' \"$PWD\" \"${CAIRN_REGISTRY_TEST:-}\" \"$*\"\n");
+chmodSync(fakeCodex, 0o755);
+writeFileSync(join(target, ".ai", ".env"), "CAIRN_REGISTRY_TEST=loaded\n", { mode: 0o600 });
+const launch = spawnSync(join(target, ".ai", "start-codex.sh"), ["--fixture"], {
+  encoding: "utf8",
+  shell: false,
+  env: { ...process.env, PATH: `${fakeBin}:${process.env.PATH}` },
+});
+assert.equal(launch.status, 0, launch.stderr);
+assert.deepEqual(launch.stdout.trim().split("\n"), [target, "loaded", "--fixture"]);
+
+const noMemory = join(sandbox, "codex-no-memory");
+const noMemorySetup = spawnSync(join(root, "bin", "cairn"), [
+  "setup", noMemory, "--git", "init", "--harness", "codex", "--memory", "none", "--yes",
+], { encoding: "utf8", shell: false });
+assert.equal(noMemorySetup.status, 0, noMemorySetup.stderr);
+assert.throws(() => readFileSync(join(noMemory, ".codex", "config.toml")), /ENOENT/);
+
+const collision = join(sandbox, "codex-existing-config");
+mkdirSync(join(collision, ".codex"), { recursive: true });
+writeFileSync(join(collision, ".codex", "config.toml"), "[features]\nfixture = true\n");
+const collisionSetup = spawnSync(join(root, "bin", "cairn"), [
+  "setup", collision, "--git", "init", "--harness", "codex", "--memory", "local", "--yes", "--json",
+], { encoding: "utf8", shell: false });
+assert.equal(collisionSetup.status, 0, collisionSetup.stderr);
+assert.equal(JSON.parse(collisionSetup.stdout).counts.skipped, 1);
+assert.equal(readFileSync(join(collision, ".codex", "config.toml"), "utf8"), "[features]\nfixture = true\n");
+const setupModule = await import(pathToFileURL(join(root, "scripts", "setup.mjs")).href);
+assert.equal(setupModule.diagnoseSetup(collision).status, "incomplete");
+writeFileSync(join(collision, ".codex", "config.toml"), [
+  "[features]", "fixture = true", "", "[mcp_servers.cairn-memory]", 'command = "cairn"', 'args = ["memory-server"]', "",
+].join("\n"));
+assert.equal(setupModule.diagnoseSetup(collision).status, "complete");
+const uninstall = spawnSync(join(root, "bin", "cairn"), ["uninstall", "--yes", collision], {
+  encoding: "utf8", shell: false, env: { ...process.env, HOME: join(sandbox, "home") },
+});
+assert.equal(uninstall.status, 0, uninstall.stderr);
+assert.match(readFileSync(join(collision, ".codex", "config.toml"), "utf8"), /fixture = true/);
+NODE
+
+echo "PASS: declarative harness registry and first-class Codex setup contract"

package/scripts/test-learning-docs.sh

@@ -16,13 +16,13 @@ grep -qF "**Baseline:** Cairnkeep $version" "$feature_guide"
 grep -qF 'https://github.com/cairnkeep/cairnkeep-course-labs' "$landing"
 for checkpoint in course-00-app course-01-bootstrap course-02-memory course-03-quality \
   course-04-operation course-05-evidence course-06-governance course-07-evaluation \
-  course-08-graph course-09-skill course-10-trust-context; do
+  course-08-graph course-09-skill course-10-trust-context course-11-windows; do
   grep -qF "\`$checkpoint\`" "$coverage"
 done
 
 ready=0
 brief=0
-for number in $(seq -w 0 21); do
+for number in $(seq -w 0 22); do
   matches=(docs/learning/lessons/L"$number"-*.md)
   [[ ${#matches[@]} -eq 1 && -f ${matches[0]} ]] || {
     echo "learning path must contain exactly one L$number lesson" >&2
@@ -53,7 +53,7 @@ grep -qF '`cairn sync-kimi --apply`' "$graph_lesson"
 grep -qF '`cairn sync-pi --apply`' "$graph_lesson"
 grep -qF '`graphify-out/`' "$graph_lesson"
 
-[[ $ready -eq 7 && $brief -eq 15 ]] || {
+[[ $ready -eq 8 && $brief -eq 15 ]] || {
   echo "unexpected learning status totals: ready=$ready brief=$brief" >&2
   exit 1
 }
@@ -94,4 +94,53 @@ for (const file of markdownFiles("docs/learning")) {
 }
 NODE
 
+l23=docs/learning/lessons/L23-guided-setup.md
+quickstart=docs/learning/tracks/quickstart.md
+operator=docs/learning/tracks/operator.md
+phase26_learning_complete=true
+[[ -f "$l23" ]] || phase26_learning_complete=false
+grep -qF 'L23-guided-setup.md' "$quickstart" || phase26_learning_complete=false
+grep -qF 'L23-guided-setup.md' "$operator" || phase26_learning_complete=false
+
+if [[ "$phase26_learning_complete" != true ]]; then
+  if [[ "${CAIRN_PHASE26_RED:-0}" == 1 ]]; then
+    echo "PHASE26_RED:GUIDED_SETUP_LEARNING_MISSING"
+    exit 86
+  fi
+  echo "SKIP: Ready L23 guided-setup lesson and track routing are not complete"
+  echo "PASS: public learning path structure, readiness, links, and version alignment"
+  exit 0
+fi
+
+grep -q '^\*\*Status:\*\* Ready' "$l23"
+grep -qF "Tested with:** Cairnkeep $version" "$l23"
+for heading in '## Outcome' '## Exercise' '## Recovery exercise' '## Common failures' '## Privacy and trust boundary'; do
+  grep -qxF "$heading" "$l23" || {
+    echo "L23 missing required heading: $heading" >&2
+    exit 1
+  }
+done
+for command in \
+  'cairn setup' \
+  '--git init' \
+  '--git none' \
+  '--harness' \
+  '--memory' \
+  '--yes' \
+  'cairn sync-pi --apply' \
+  'cairn doctor' \
+  'cairn uninstall'; do
+  grep -qF -- "$command" "$l23" || {
+    echo "L23 missing guided setup command or mode: $command" >&2
+    exit 1
+  }
+done
+grep -Eqi 'missing|empty' "$l23"
+grep -Eqi 'deterministic|non-interactive|non-TTY' "$l23"
+grep -Eqi 'local.*stdio|stdio.*local' "$l23"
+grep -Eqi 'limited|Git-less' "$l23"
+grep -Eqi 'cancel|shutdown|child process' "$l23"
+grep -Eqi '0\.84\.1' "$l23"
+grep -Eqi 'credentials|secrets|private state' "$l23"
+
 echo "PASS: public learning path structure, readiness, links, and version alignment"

package/scripts/test-package-install.sh

@@ -46,6 +46,7 @@ bootstrap_output=$(cairn bootstrap "$tmp/project")
 [[ -x "$tmp/project/.ai/start-pi.sh" ]] || fail "bootstrap did not install an executable Pi launcher"
 [[ -x "$tmp/project/.ai/start-kimi.sh" ]] || fail "bootstrap did not install an executable Kimi launcher"
 [[ -x "$tmp/project/.ai/start-qwen.sh" ]] || fail "bootstrap did not install an executable Qwen launcher"
+[[ -x "$tmp/project/.ai/start-codex.sh" ]] || fail "bootstrap did not install an executable Codex launcher"
 [[ -f "$tmp/project/.planning/config.json" ]] || fail "bootstrap did not install the planning scaffold"
 
 (cd "$tmp/project" && cairn doctor) >/dev/null || fail "installed package failed cairn doctor"
@@ -267,6 +268,10 @@ NODE
   fail "npm tarball omitted the Kimi launcher template"
 [[ -f "$installed_root/templates/start-qwen.sh.template" ]] || \
   fail "npm tarball omitted the Qwen launcher template"
+[[ -f "$installed_root/templates/start-codex.sh.template" ]] || \
+  fail "npm tarball omitted the Codex launcher template"
+[[ -f "$installed_root/templates/codex-config.toml.template" ]] || \
+  fail "npm tarball omitted the Codex MCP configuration template"
 [[ -f "$installed_root/schemas/note.schema.json" ]] || \
   fail "npm tarball omitted the note schema"
 [[ -f "$installed_root/schemas/memory-node.schema.json" ]] || \
@@ -331,4 +336,68 @@ fi
 [[ "$(sha256sum "$ROOT/package-lock.json" | cut -d' ' -f1)" == "$root_lock_before" ]] || fail "root lockfile changed during pack/install"
 [[ "$(sha256sum "$ROOT/mcp-memory-server/package-lock.json" | cut -d' ' -f1)" == "$server_lock_before" ]] || fail "server lockfile changed during pack/install"
 
+phase26_surface_complete=true
+for required in \
+  scripts/setup.mjs \
+  scripts/setup-core.mjs \
+  scripts/setup-reconcile.mjs \
+  schemas/cairnkeep-setup.schema.json \
+  schemas/cairnkeep-setup-policy.schema.json \
+  mcp-memory-server/dist/pi-mcp-bridge.js \
+  pi/extensions/cairnkeep-memory.ts \
+  docs/operating.md \
+  docs/harness-compatibility.md \
+  docs/native-windows.md \
+  docs/building-an-overlay.md
+do
+  [[ -f "$ROOT/$required" ]] || phase26_surface_complete=false
+done
+
+if [[ "$phase26_surface_complete" != true ]]; then
+  if [[ "${CAIRN_PHASE26_RED:-0}" == 1 ]]; then
+    echo "PHASE26_RED:SETUP_PACKAGE_MISSING"
+    exit 86
+  fi
+  echo "SKIP: packaged guided setup and Pi bridge surface is not complete"
+  echo "PASS: npm tarball installs a self-contained CLI and MCP server"
+  exit 0
+fi
+
+for required in \
+  scripts/setup.mjs \
+  scripts/setup-core.mjs \
+  scripts/setup-reconcile.mjs \
+  schemas/cairnkeep-setup.schema.json \
+  schemas/cairnkeep-setup-policy.schema.json \
+  mcp-memory-server/dist/pi-mcp-bridge.js \
+  pi/extensions/cairnkeep-memory.ts \
+  docs/operating.md \
+  docs/harness-compatibility.md \
+  docs/native-windows.md \
+  docs/building-an-overlay.md
+do
+  [[ -f "$installed_root/$required" ]] || fail "npm tarball omitted Phase 26 asset $required"
+done
+
+installed_setup_target="$tmp/Installed Setup – Unicode"
+(cd "$tmp" && cairn setup "$installed_setup_target" \
+  --git none --harness claude,pi --memory local --yes --json) >"$tmp/installed-setup.json" \
+  || fail "installed cairn setup failed outside the source checkout"
+node - "$tmp/installed-setup.json" "$installed_setup_target" <<'NODE'
+const fs = require("fs");
+const [resultPath, target] = process.argv.slice(2);
+const result = JSON.parse(fs.readFileSync(resultPath, "utf8"));
+if (result.schema_version !== 1 || result.status !== "limited") process.exit(1);
+if (result.git !== "none" || result.memory !== "local") process.exit(1);
+if (JSON.stringify(result.harnesses) !== JSON.stringify(["claude", "pi"])) process.exit(1);
+if (!fs.existsSync(`${target}/.ai/cairnkeep.json`)) process.exit(1);
+NODE
+
+if find "$installed_root" -type f \( \
+  -name '.env' -o -name '*.tmp' -o -name '*.bak' -o -name 'cairnkeep.json' \
+  -o -path '*/.planning/*' -o -path '*/.agentfs/*' \
+\) | grep -q .; then
+  fail "npm tarball included temporary or project-private setup state"
+fi
+
 echo "PASS: npm tarball installs a self-contained CLI and MCP server"

package/scripts/test-phase17-artifact-lifecycle.sh

@@ -48,7 +48,7 @@ run_shell_syntax_baseline() {
   local script
   while IFS= read -r script; do
     bash -n "$script" || return 1
-  done < <(find "$ROOT/bin" "$ROOT/scripts" -type f \( -name '*.sh' -o -name 'cairn' \) | sort)
+  done < <(find "$ROOT/bin" "$ROOT/scripts" -type f -name '*.sh' | sort)
 }
 
 run_baseline() {

package/scripts/test-phase18-capability-lifecycle.sh

@@ -142,7 +142,7 @@ run_baseline() {
   run_baseline_check "$ROOT/scripts/test-completion.sh"
   run_baseline_check "$ROOT/scripts/test-package-install.sh"
   run_baseline_check "$ROOT/scripts/test-uninstall.sh"
-  run_baseline_check bash -n "$ROOT/bin/cairn"
+  run_baseline_check node --check "$ROOT/bin/cairn"
   run_master_off_identity
   echo "PASS: Phase 18 master-off CLI/package/lifecycle identity baseline"
 }

package/scripts/test-phase19-eval-lifecycle.sh

@@ -336,8 +336,18 @@ const cancelTask={...tasks[0],id:"task-cancel",input:"cancel"};
 const cancelPlan=makePlan([cancelTask]);
 const cancelStore=await reports.createEvalReportStore({root:join(fixtureRoot,"reports"),experiment_id:"cancel-fixture"});
 const controller=new AbortController();
-setTimeout(()=>controller.abort(),100);
-const cancelled=await runner.runTwoPassExperiment({plan:cancelPlan,report_store:cancelStore,temporary_root:fixtureRoot,signal:controller.signal,distill_command:{program:process.execPath,args:[distillerScript]}});
+const cancellation=runner.runTwoPassExperiment({plan:cancelPlan,report_store:cancelStore,temporary_root:fixtureRoot,signal:controller.signal,distill_command:{program:process.execPath,args:[distillerScript]}});
+let adapterStarted=false;
+for (let attempt=0; attempt<200; attempt+=1) {
+  await new Promise((resolve)=>setTimeout(resolve,25));
+  if (existsSync(invocationLog) && readFileSync(invocationLog,"utf8").includes("task-cancel:run1")) {
+    adapterStarted=true;
+    break;
+  }
+}
+assert.equal(adapterStarted,true,"cancellation fixture adapter did not start");
+controller.abort();
+const cancelled=await cancellation;
 assert.equal(cancelled.report.status,"partial");
 assert.deepEqual(cancelled.report.observations.map(({terminal_state})=>terminal_state),["cancelled"]);
 assert.equal(cancelled.report.observations[0].process.cleanup!=="pending",true);