enigma-memory 0.1.13 → 0.1.14

package/docs/hosted-cloud-product.md

@@ -49,6 +49,16 @@ Hosted cloud remains blocked until an operator wires and records evidence for al
 
 A `provided` operator evidence ref means the contract can point to external evidence. It still does not by itself make hosted cloud sellable; an operator must complete the release checklist and issue go-live approval. A `blocked_external_dependency` ref is an explicit blocker, not fake evidence.
 
+## Consolidated unblocker report
+
+Before treating hosted cloud as sellable, run the consolidated public-safe unblocker report:
+
+```sh
+npm run production:unblocker -- --out .enigma/production-unblocker.json
+```
+
+The report emits `enigma.production_unblocker.v1` with hosted cloud, Solana proof rail, benchmark claim, installer distribution, npm install, and monitoring/ops status in one place. It is dry-run/planning by default, requires no credentials, and does not create accounts, deploy infrastructure, submit transactions, call providers, or mutate external systems. Hosted cloud should remain `blocked_external_dependency` until real external provider evidence and operator go-live approval exist.
+
 ## Customer lifecycle packet
 
 `npm run production:hosted-customer -- --tenant <id> --domain <domain> --environment <env> --out <file>` builds `enigma.hosted_cloud.customer_lifecycle_packet.v1` readiness evidence for a tenant launch packet. Operators may pass repeatable `--evidence-ref <key=status:ref>` values and `--operator-go-live-ref <ref>` when real external evidence exists. The command writes public-safe validation evidence only: it creates no hosted account, tenant, vault, API key, invoice, support ticket, backup, Cloudflare resource, provider resource, secret, or deployment.

package/docs/install-anywhere.md

@@ -1,8 +1,8 @@
 # Install Enigma anywhere
 
-Start with the published npm package path for `enigma-memory`: install once, run the local-only public test drive, then connect real local clients only when you explicitly choose to. Use a source checkout only when you need source-only docs, Docker assets, browser-extension scaffolding, package development, or release scripts.
+Start with the published npm package path for `enigma-memory`: install once, run `enigma init --dry-run` to inspect the local plan, then execute local setup and connect real local clients only when you explicitly choose to. Use a source checkout only when you need source-only docs, Docker assets, browser-extension scaffolding, package development, or release scripts.
 
-Hosted cloud and BYOC operation require real deployment credentials, domains, TLS, durable storage, KMS/secrets, monitoring, backups, and operator/customer infrastructure; they are not activated by installing the package or running the test drive.
+Hosted cloud and BYOC operation require real deployment credentials, domains, TLS, durable storage, KMS/secrets, monitoring, backups, and operator/customer infrastructure; they are not activated by installing the package, running init, or running the test drive.
 
 ## Requirements
 
@@ -12,12 +12,28 @@ Hosted cloud and BYOC operation require real deployment credentials, domains, TL
 - Git only for the advanced source-checkout path
 - Optional: Docker for source-checkout containerized relay/gateway operation
 
-## Public test drive: what is live today
+## First run: inspect the safe local plan
 
 Use the published package as the primary path:
 
 ```sh
 npm install -g enigma-memory
+enigma init --dry-run
+```
+
+`enigma init --dry-run` emits a public-safe JSON plan with exact next commands. It writes no local artifacts, writes no third-party client configs, does not call external providers, does not contact hosted Enigma SaaS, and does not require provider credentials, Solana, or browser extension installation. The output states `provider_credentials_required:false`, `hosted_saas_live:false`, and `raw_memory_printed:false`.
+
+When the plan looks right, create the regular local workspace:
+
+```sh
+enigma init --overwrite
+```
+
+`enigma init --overwrite` writes the local bundle, context pack, export, and verify report under `.enigma` by default. It does not write Claude, Cursor, Kimi, or other third-party client configs unless you explicitly add `--connect`.
+
+The isolated proof/demo command is still available for public reviewers:
+
+```sh
 enigma test-drive --overwrite
 ```
 
@@ -30,31 +46,32 @@ Keep the claim bounded: the test drive proves local Enigma-controlled vault stat
 To connect real local clients that are already installed or already configured:
 
 ```sh
-enigma setup --connect-installed --overwrite
+enigma init --connect --overwrite
 ```
 
-`--connect-installed` implies auto client selection and is the setup-time write flag for client configs. It skips missing client configs instead of creating every default client config.
+`--connect` is the init-time write flag for client configs. With default client selection it skips missing client configs instead of creating every default client config.
 
 ## Default path: install once, use everywhere
 
-After the test drive, create a regular local workspace when you want to use Enigma day to day:
+After reviewing the first-run plan, create a regular local workspace when you want to use Enigma day to day:
 
 ```sh
 npm install -g enigma-memory
-enigma setup --overwrite
+enigma init --dry-run
+enigma init --overwrite
 ```
 
-`enigma setup --overwrite` is the safe default for a regular local workspace. It writes local Enigma artifacts under the workspace `.enigma` path and emits deterministic, public-safe JSON without printing raw memory plaintext. It does not write Claude, Cursor, Kimi, or other third-party app configs.
+`enigma init --overwrite` is the safe default for a regular local workspace. It writes local Enigma artifacts under the workspace `.enigma` path and emits deterministic, public-safe JSON without printing raw memory plaintext. It does not write Claude, Cursor, Kimi, or other third-party app configs.
 
-To let setup auto-detect installed or already-configured clients and show the connector plan without mutating client configs:
+To let init auto-detect installed or already-configured clients and show the connector plan without mutating client configs:
 
 ```sh
-enigma setup --client auto --overwrite
+enigma init --client auto --dry-run
 ```
 
-`--client auto` selects clients found by connector detection and falls back to the default setup client list when none are present. The setup output lists which clients were selected, which were skipped, and why.
+`--client auto` selects clients found by connector detection and falls back to the default setup client list when none are present. The init output lists which clients were selected, which were skipped, and why. Existing setup commands remain available: `enigma setup --overwrite`, `enigma setup --client auto --overwrite`, and `enigma setup --connect-installed --overwrite`.
 
-After setup, use the same local vault from the CLI or connected clients:
+After init or setup, use the same local vault from the CLI or connected clients:
 
 ```sh
 enigma remember --text-file ./memory.txt
@@ -213,13 +230,13 @@ Npm-first connector flow:
 
 ```sh
 npm install -g enigma-memory
-enigma test-drive --overwrite
-enigma setup --overwrite
-enigma setup --client auto --overwrite
-enigma setup --connect-installed --overwrite
+enigma init --dry-run
+enigma init --overwrite
+enigma init --client auto --dry-run
+enigma init --connect --overwrite
 ```
 
-Run `enigma test-drive --overwrite` first when you want to prove what is live today without credentials, hosted SaaS, provider calls, or client-config writes. Run the setup command for a regular local workspace. Use `--client auto` when you want setup to report installed/config-present connector targets without writing client configs. Use `--connect-installed` only when you explicitly want setup to merge Enigma into installed/config-present client configs; missing configs are skipped with reasons instead of created. Existing `enigma setup --write-connectors` behavior for explicit/default clients is unchanged. For a single client, replace `claude-desktop` with `cursor`, `kimi-code`, `vscode-cline`, `roo`, `opencode`, or `generic-mcp` and run `enigma connect <client> --dry-run`. `--dry-run` is read-only: it reports the target config path, the planned Enigma MCP entry, and whether a write would be needed. Remove `--dry-run` only after reviewing the target path and planned entry.
+Run `enigma init --dry-run` first to inspect the safe local plan without credentials, hosted SaaS, provider calls, raw memory output, or client-config writes. Run `enigma init --overwrite` for a regular local workspace. Use `--client auto --dry-run` when you want init to report installed/config-present connector targets without writing client configs. Use `--connect` only when you explicitly want init to merge Enigma into installed/config-present client configs by default; missing configs are skipped with reasons instead of created. Existing `enigma setup --overwrite`, `enigma setup --client auto --overwrite`, `enigma setup --connect-installed --overwrite`, and `enigma setup --write-connectors` behavior remains available. For a single client, replace `claude-desktop` with `cursor`, `kimi-code`, `vscode-cline`, `roo`, `opencode`, or `generic-mcp` and run `enigma connect <client> --dry-run` before writing.
 
 Copy-paste MCP entry for Claude Desktop, Cursor, Kimi Code, or a generic MCP client:
 

package/docs/installers-and-desktop.md

@@ -8,11 +8,13 @@ Use the published package path when you want the current supported local install
 
 ```sh
 npm install -g enigma-memory
-enigma quickstart --bundle ./.enigma/bundle.json --overwrite
+enigma test-drive --dry-run
+enigma setup --overwrite
 enigma doctor
+enigma connect <client> --dry-run
 ```
 
-The package exposes the CLI bins `enigma`, `enigma-verify`, `enigma-mcp`, `enigma-relay`, `enigma-gateway`, and `enigma-native-host`. Node.js `>=24` is required. The local quickstart writes Enigma-controlled local artifacts only; it does not prove provider deletion, model forgetting, hosted availability, compliance certification, savings, or provider-native memory removal.
+The package exposes the CLI bins `enigma`, `enigma-verify`, `enigma-mcp`, `enigma-relay`, `enigma-gateway`, and `enigma-native-host`. Node.js `>=24` is required. The installer smoke path keeps `enigma test-drive --dry-run` and `enigma connect <client> --dry-run` non-mutating; `enigma setup --overwrite` writes Enigma-controlled local artifacts only and does not write third-party app configs. It does not prove provider deletion, model forgetting, hosted availability, compliance certification, savings, or provider-native memory removal.
 
 ## Tier 2: generated source installer assets
 
@@ -30,14 +32,14 @@ node scripts/build-installer-assets.mjs --out-dir dist/installer-assets --write
 
 Generated asset paths are listed in deterministic code-point lexical order:
 
-- `homebrew/enigma-memory.rb` — Homebrew formula draft. It is not submitted to a tap by the generator; release engineering must replace the source archive URL and SHA before any tap workflow.
-- `install-linux.sh` — POSIX shell source installer. It previews by default and only mutates global npm/local quickstart files when called with `--execute`.
-- `install-windows.ps1` — PowerShell source installer. It previews by default and only runs `npm install -g enigma-memory`, `enigma quickstart`, and `enigma doctor` when called with `-Execute`.
+- `homebrew/enigma-memory.rb` — Homebrew formula draft. It is not submitted to a tap by the generator; release engineering must replace the source archive URL and SHA before any tap workflow. Its test metadata exercises `enigma test-drive --dry-run`, `enigma setup --dry-run`, and `enigma doctor`, then prints the next client-connect preview command.
+- `install-linux.sh` — POSIX shell source installer. It previews by default and only mutates global npm/local setup files when called with `--execute`. Its preview includes package install, `enigma test-drive --dry-run`, `enigma setup --bundle <bundle> --overwrite`, `enigma doctor`, and `enigma connect <client> --dry-run` as the next client-connect command.
+- `install-windows.ps1` — PowerShell source installer. It previews by default and only runs `npm install -g enigma-memory`, `enigma test-drive --dry-run`, `enigma setup --bundle <bundle> --overwrite`, and `enigma doctor` when called with `-Execute`; it then prints `enigma connect <client> --dry-run` as the next client-connect command.
 - `installer-assets-manifest.json` — deterministic public manifest with checksums for the generated source assets.
 - `macos-pkgbuild/README.md` — macOS package source plan and blockers, not a signed package.
 - `macos-pkgbuild/manifest.json` — macOS package source metadata and blockers, not a signed package.
 
-The generator intentionally redacts the requested output directory in its public manifest as `<requested-output-dir>`. The generated content must not embed tokens, local absolute paths, account identifiers, raw memory, provider transcripts, signing identities, or hosted credentials.
+The generator intentionally redacts the requested output directory in its public manifest as `<requested-output-dir>`. The manifest records only deterministic asset metadata, the public installer smoke commands, explicit execute gates, and blocker codes. The generated content must not embed tokens, local absolute paths, account identifiers, raw memory, provider transcripts, signing identities, or hosted credentials.
 
 ## Native `.exe` and `.pkg` blockers
 
@@ -60,7 +62,7 @@ Until those blockers are cleared, use npm or generated source scripts only.
 
 ## Homebrew path
 
-The formula generated under `homebrew/enigma-memory.rb` is a draft for a future tap workflow. It records the intended package name, license, Node dependency, command shims, and test shape. Before publication, release engineering must replace the placeholder tarball URL and SHA with a real release archive and confirm the formula installs only the intended package files.
+The formula generated under `homebrew/enigma-memory.rb` is a draft for a future tap workflow. It records the intended package name, license, Node dependency, command shims, and installer smoke test shape: `enigma test-drive --dry-run`, `enigma setup --dry-run`, `enigma doctor`, and the printed next command `enigma connect <client> --dry-run`. Before publication, release engineering must replace the placeholder tarball URL and SHA with a real release archive and confirm the formula installs only the intended package files.
 
 ## Desktop tray model boundary