enigma-memory 0.1.15 → 0.1.16

package/README.md

@@ -2,96 +2,25 @@
 
 Enigma Memory is a local-first AI Memory Passport. It gives you one canonical local memory vault, receipt-backed proof for Enigma-controlled events, and MCP connections into assistants such as Claude Desktop, Cursor, Kimi Code, and generic MCP clients.
 
-Start with `enigma init --dry-run` below. You do not need to understand relay, gateway, mesh, browser, desktop, or hosted infrastructure before trying Enigma locally.
+Start with `enigma setup --overwrite` below. You do not need to understand relay, gateway, mesh, browser, desktop, hosted infrastructure, or the proof network before trying Enigma locally.
 
 The package path needs no database, provider credential, cloud credential, npm publishing token, or external account. Hosted cloud and BYOC operation are separate advanced modes that require real deployment credentials, domains, TLS, durable storage, KMS/secrets, monitoring, backups, and operator acceptance.
 
 Enigma does not claim that a closed provider deleted internal data, that model weights forgot, or that provider-native memory disappeared. It proves facts about Enigma-controlled vault state, receipts, checkpoints, and declared boundary operations.
 
-## First run: install and inspect the safe local plan
-
-The top public path is the published npm package plus the first-run planner:
-
-```sh
-npm install -g enigma-memory
-enigma init --dry-run
-```
-
-`enigma init --dry-run` prints a public-safe JSON plan with exact next commands. It does not write local artifacts or third-party client configs, does not require provider credentials, hosted Enigma SaaS, Solana, or a browser extension, and states `provider_credentials_required:false`, `hosted_saas_live:false`, and `raw_memory_printed:false`.
-
-When the plan looks right, create the local Memory Passport artifacts:
-
-```sh
-enigma init --overwrite
-```
-
-The execute path writes only local Enigma artifacts under the workspace `.enigma` path by default. It still does not write Claude, Cursor, Kimi, or other third-party app configs unless you explicitly add `--connect`.
-
-Public demo path, preserved for reviewers who want the isolated proof/demo bundle:
-
-```sh
-enigma test-drive --overwrite
-```
-
-`enigma test-drive --overwrite` needs no database, provider API key, cloud credential, npm publishing token, package registry account, or hosted Enigma account. It runs entirely on the local filesystem, does not call OpenAI, Anthropic, Cloudflare, hosted Enigma, or other external providers, and does not write Claude, Cursor, Kimi, or other third-party client configs.
-
-By default the command writes an isolated demo under `.enigma/test-drive`. Use `--dry-run` to print the plan without writing, or `--out-dir <path>` to choose another isolated demo directory. The default bundle and proof artifacts live inside that directory.
-
-The test-drive output is a single public-safe JSON summary. It points to the local setup artifacts, search/status output, cross-model demo report, and benchmark pointers, and it prints exact next commands for testers without printing raw private memory plaintext. The proof is bounded to the local demo: Enigma-controlled vault state, receipts, checkpoints, committed roots, exported bundle shape, and declared boundary operations. It is not evidence that hosted SaaS is live, that a closed provider deleted internal data, that model weights forgot, or that provider-native memory disappeared.
-
-When you are ready to connect real local clients that are already installed or already configured:
-
-```sh
-enigma init --connect --overwrite
-```
-
-`--connect` is the explicit first-run client-config write path. With default client selection it skips missing client configs instead of creating every default client config.
-
-## Enigma Proof Network
-
-Enigma Proof Network is the public proof layer for AI memory: local tools can package privacy-preserving roots, refs, counts, signatures, scoped capability grants, revocations, and benchmark attestations without exposing raw memory, prompts, transcripts, completions, embeddings, tenant names, private keys, provider responses, or provider credentials.
-
-The `enigma chain anchor|grant|revoke|attest|verify` commands are local planning and verification commands. They emit public-safe JSON with `transaction_submitted:false` and `raw_memory_on_chain:false`; they do not submit Solana transactions, deploy hosted SaaS, create accounts, or call external providers.
-
-Start with the category narrative in [`docs/market-category-narrative.md`](docs/market-category-narrative.md), then read the technical overview in [`docs/proof-network.md`](docs/proof-network.md), use its [Solana role](docs/proof-network.md#solana-role) section for the Solana-ready anchoring boundary, and read [`docs/proof-network-faq.md`](docs/proof-network-faq.md) for claim boundaries.
-
 ## Install once, use everywhere
 
 Prerequisites:
 
 - Node.js `>=24`
-- No database, package registry account, provider credential, or cloud credential for the local test-drive or setup paths
+- No database, package registry account, provider credential, cloud credential, hosted Enigma account, or external account for the local setup path
 - Git only when you choose the advanced source-checkout path
 
-Use Enigma as a one-time AI Memory Passport setup: install the package, inspect the local plan, create the local Enigma workspace once, then use the same memory/search/context/verify/connect loop from any supported client.
+Use Enigma as a one-time AI Memory Passport setup: install the package, create the local Enigma workspace once, then use the same memory/search/context/verify/connect loop from any supported client.
 
 ```sh
 npm install -g enigma-memory
-enigma init --dry-run
-enigma init --overwrite
-```
-
-`enigma init --overwrite` is the safe default for creating a regular local workspace after reviewing the plan. It writes local Enigma artifacts under the workspace `.enigma` path and emits deterministic, public-safe JSON without printing raw memory plaintext. It does not write Claude, Cursor, Kimi, or other third-party app configs.
-
-To let first-run setup detect installed or already-configured clients and show the connector plan without mutating client configs:
-
-```sh
-enigma init --client auto --dry-run
-```
-
-`--client auto` selects clients found by connector detection and falls back to the default setup client list when none are present. The init output lists which clients were selected, which were skipped, and why.
-
-Only when you are ready to explicitly write connector entries for installed/config-present clients:
-
-```sh
-enigma init --connect --overwrite
-```
-
-`--connect` implies installed/config-present client selection when no explicit `--client` is supplied and is an explicit client-config write flag. It skips missing client configs instead of creating every default client config. Existing setup commands remain available: `enigma setup --overwrite`, `enigma setup --client auto --overwrite`, and `enigma setup --connect-installed --overwrite`. Existing explicit connector writes remain available through `enigma connect <client>` without `--dry-run`; keep `--dry-run` while reviewing a single planned MCP entry.
-
-After init or setup, use the same local vault from the CLI or connected clients:
-
-```sh
+enigma setup --overwrite
 enigma remember --text-file ./memory.txt
 enigma search --query "..."
 enigma context --query "..." --optimize
@@ -99,15 +28,18 @@ enigma verify --export ./.enigma/export.json
 enigma connect claude-desktop --dry-run
 ```
 
-`enigma context --query ...` automatically applies local relevance scoring; `--optimize` is still accepted when you want explicit optimizer evidence or token/cost bounds.
+`enigma setup --overwrite` writes local Enigma artifacts under the workspace `.enigma` path and emits deterministic, public-safe JSON without printing raw memory plaintext. It does not write Claude, Cursor, Kimi, or other third-party app configs. Client config writes happen only when you explicitly run `enigma connect <client>` without `--dry-run`; keep `--dry-run` while reviewing the planned MCP entry.
 
 The local Enigma vault remains canonical. Provider-native memory is non-canonical and should be treated as a convenience cache only. Enigma receipts prove Enigma-controlled vault state, receipts, checkpoints, and declared boundary operations; they do not prove provider deletion, provider model forgetting, provider-native memory removal, hosted availability, ROI/savings, or compliance certification.
 
-One-off public test drive without a global install:
+## Enigma Proof Network
+
+Enigma Proof Network is the public proof layer for AI memory: local tools can package privacy-preserving roots, refs, counts, signatures, scoped capability grants, revocations, and benchmark attestations without exposing raw memory, prompts, transcripts, completions, embeddings, tenant names, private keys, provider responses, or provider credentials.
+
+The `enigma chain anchor|grant|revoke|attest|verify` commands are local planning and verification commands. They emit public-safe JSON with `transaction_submitted:false` and `raw_memory_on_chain:false`; they do not submit Solana transactions, deploy hosted SaaS, create accounts, or call external providers.
+
+Start with the category narrative in [`docs/market-category-narrative.md`](docs/market-category-narrative.md), then read the technical overview in [`docs/proof-network.md`](docs/proof-network.md), use its [Solana role](docs/proof-network.md#solana-role) section for the Solana-ready anchoring boundary, and read [`docs/proof-network-faq.md`](docs/proof-network-faq.md) for claim boundaries.
 
-```sh
-npx --yes --package enigma-memory enigma test-drive --overwrite
-```
 
 ## Advanced/source-only path
 
@@ -214,7 +146,7 @@ Supported connector profiles are:
 - `opencode`
 - `generic-mcp`
 
-After `enigma init --dry-run` previews the local package path and `enigma init --overwrite` creates a regular local workspace, preview a client connection before writing anything:
+After `enigma setup --overwrite`, preview a client connection before writing anything:
 
 ```sh
 enigma connect claude-desktop --dry-run
@@ -223,11 +155,59 @@ enigma connect kimi-code --dry-run
 enigma connect generic-mcp --dry-run
 ```
 
-For the one-time setup flow, `enigma init --client auto --dry-run` reports the installed/config-present clients that connector detection selected and the clients it skipped with reasons. It remains read-only for client configs. `enigma init --connect --overwrite` is the explicit init-time write path for installed/config-present clients by default; missing configs are skipped rather than created. The older `enigma setup --client auto --overwrite` and `enigma setup --connect-installed --overwrite` commands remain available.
+Remove `--dry-run` from `enigma connect <client>` only after you are ready for Enigma to merge the `mcpServers.enigma` entry into that specific client config. The safe default setup command never writes third-party app configs.
+
+Copy-paste MCP snippets:
+
+Claude Desktop:
+
+```json
+{
+  "mcpServers": {
+    "enigma": {
+      "command": "enigma-mcp",
+      "args": [],
+      "env": {
+        "ENIGMA_BUNDLE": "/absolute/path/to/.enigma/bundle.json"
+      }
+    }
+  }
+}
+```
+
+Cursor:
+
+```json
+{
+  "mcpServers": {
+    "enigma": {
+      "command": "enigma-mcp",
+      "args": [],
+      "env": {
+        "ENIGMA_BUNDLE": "/absolute/path/to/.enigma/bundle.json"
+      }
+    }
+  }
+}
+```
+
+Kimi Code:
 
-Remove `--dry-run` from `enigma connect <client>` only after you are ready for Enigma to merge the `mcpServers.enigma` entry into that specific client config. The safe default init/setup command never writes third-party app configs.
+```json
+{
+  "mcpServers": {
+    "enigma": {
+      "command": "enigma-mcp",
+      "args": [],
+      "env": {
+        "ENIGMA_BUNDLE": "/absolute/path/to/.enigma/bundle.json"
+      }
+    }
+  }
+}
+```
 
-Manual MCP entry for Claude Desktop, Cursor, Kimi Code, or any generic MCP client:
+Generic MCP:
 
 ```json
 {

package/apps/cli/bin/enigma.mjs

@@ -53,7 +53,7 @@ export const DEFAULT_GATEWAY_PORT = 8797;
 const DEFAULT_QUICKSTART_MEMORY = 'Enigma quickstart demo memory: local proof bundles can be created and verified without provider or cloud credentials.';
 const DEFAULT_CROSS_MODEL_DEMO_BUNDLE = '.enigma/cross-model-demo-bundle.json';
 const DEFAULT_CROSS_MODEL_MEMORY = 'Enigma cross-model demo memory: a local encrypted memory can be packaged for ChatGPT, Claude, Kimi, Cursor, and a local LLM without provider credentials.';
-const DEFAULT_SETUP_CLIENTS = Object.freeze(['generic-mcp', 'claude-desktop', 'cursor', 'kimi-code']);
+const DEFAULT_SETUP_CLIENTS = Object.freeze(['generic-mcp', 'claude-desktop', 'cursor', 'kimi-code', 'vscode-cline']);
 const SETUP_CLAIM_BOUNDARIES = Object.freeze({
   local_only: true,
   provider_credentials_required: false,
@@ -1043,6 +1043,20 @@ function publicSetupError(error, rawDisplays, publicDisplays) {
   return new Error(message);
 }
 
+function oneCommandInstallConnect(bundleDisplay = DEFAULT_BUNDLE, outDirDisplay = dirname(bundleDisplay)) {
+  const parts = ['npm install -g enigma-memory && enigma setup'];
+  if (bundleDisplay !== DEFAULT_BUNDLE) parts.push(`--bundle ${commandPath(bundleDisplay)}`);
+  if (outDirDisplay !== dirname(bundleDisplay)) parts.push(`--out-dir ${commandPath(outDirDisplay)}`);
+  const base = parts.join(' ');
+  return {
+    installed_clients: `${base} --client auto --connect-installed --overwrite`,
+    claude_desktop: `${base} --client claude-desktop --write-connectors --overwrite`,
+    cursor: `${base} --client cursor --write-connectors --overwrite`,
+    kimi_code: `${base} --client kimi-code --write-connectors --overwrite`,
+    vscode_cline: `${base} --client vscode-cline --write-connectors --overwrite`,
+  };
+}
+
 function setupNextCommands(bundleInput, exportDisplay, clients, writeConnectors) {
   const primaryClient = clients[0] ?? DEFAULT_SETUP_CLIENTS[0];
   const commands = [
@@ -1297,6 +1311,7 @@ export async function setupCommand(flags, io) {
     client_selection: publicSetupClientSelection(selection),
     connector_write_skips: connectorWriteSkips(connectors),
     connectors,
+    one_command_install_connect: oneCommandInstallConnect(displays.bundle, publicPathDisplay(outDirInput, 'out-dir')),
     mcp_config_snippets: Object.fromEntries(connectors.map((connector) => [connector.client_id, connector.mcp_config_snippet])),
     connect_plans: Object.fromEntries(connectors.map((connector) => [connector.client_id, connector.connect_plan])),
     next_commands: setupNextCommands(displays.bundle, displays.export, clients, connectorWritesRequested && (!connectInstalled || anyConnectorWritePerformed)),
@@ -1938,7 +1953,7 @@ export async function testDriveCommand(flags, io) {
     out_dir: outDirInput,
     bundle: bundleInput,
     install_command: `npm install -g ${packageJson.name ?? 'enigma-memory'}`,
-    release_target: '0.1.15',
+    release_target: '0.1.16',
     artifacts_written: !dryRun,
     client_configs_written: false,
     client_config_write_required: false,
@@ -2122,6 +2137,7 @@ export async function installCommand(flags, io) {
     mcp_command: connectorOptions(flags).mcpCommand ?? 'enigma-mcp',
     clients: profiles,
     mcp_config_snippets: snippets,
+    one_command_install_connect: oneCommandInstallConnect(bundlePath, dirname(bundlePath)),
     out: out && out !== true ? resolve(String(out)) : undefined,
   }, io);
   return 0;
@@ -2445,11 +2461,11 @@ async function readSolanaKeypair(path) {
   } catch {
     throw new Error('Unable to read a valid Solana --keypair JSON array.');
   }
-  if (!Array.isArray(parsed) || parsed.length === 0) throw new Error('Solana --keypair must be a JSON array of secret-key bytes.');
+  if (!Array.isArray(parsed) || parsed.length !== 64) throw new Error('Solana --keypair must be a JSON array of 64 secret-key bytes.');
   const bytes = new Uint8Array(parsed.length);
   for (let i = 0; i < parsed.length; i += 1) {
     const value = parsed[i];
-    if (!Number.isInteger(value) || value < 0 || value > 255) throw new Error('Solana --keypair must be a JSON array of secret-key bytes.');
+    if (!Number.isInteger(value) || value < 0 || value > 255) throw new Error('Solana --keypair must be a JSON array of 64 secret-key bytes.');
     bytes[i] = value;
   }
   return bytes;
@@ -2955,6 +2971,15 @@ function usage() {
       '--dry-run': 'Plan setup without writing local artifacts or client configs.',
       '--write-connectors': 'Also write selected client MCP config files. Defaults to false.',
     },
+    install_options: {
+      'one-command installed clients': 'npm install -g enigma-memory && enigma setup --client auto --connect-installed --overwrite',
+      'one-command Claude Desktop': 'npm install -g enigma-memory && enigma setup --client claude-desktop --write-connectors --overwrite',
+      'one-command Cursor': 'npm install -g enigma-memory && enigma setup --client cursor --write-connectors --overwrite',
+      'one-command Kimi Code': 'npm install -g enigma-memory && enigma setup --client kimi-code --write-connectors --overwrite',
+      'one-command VS Code Cline': 'npm install -g enigma-memory && enigma setup --client vscode-cline --write-connectors --overwrite',
+      '--client <id>': 'Limit generated MCP snippets to one supported client.',
+      '--out <path>': 'Write generated MCP snippets to a JSON file for review without hand-editing client config JSON.',
+    },
     quickstart_options: {
       '--bundle <path>': 'Bundle JSON to create. Defaults to .enigma/bundle.json.',
       '--out-dir <path>': 'Directory for context-pack.json, export.json, and verify-report.json. Defaults to the bundle directory.',
@@ -3022,7 +3047,7 @@ function usage() {
       revoke: 'enigma chain revoke --grant-hash <sha256:...> --reason <public-reason-code> [--revocation-ref <public-ref>] [--out <file>]',
       attest: 'enigma chain attest (--report-hash <sha256:...> | --report-file <report.json>) --dataset-ref <sha256:...> --runner-ref <public-runner-ref> --package-ref <public-package-ref> [--score name=value] [--out <file>]',
       verify: 'enigma chain verify --file <proof-artifact.json>',
-      submit_solana: 'enigma chain submit-solana --file <proof-artifact.json> --cluster <devnet|testnet|mainnet-beta|localnet> [--rpc <url>] [--execute --keypair <solana-keypair.json>]',
+      submit_solana: 'enigma chain submit-solana --file <proof-artifact.json> --cluster <devnet|testnet|mainnet-beta|localnet> [--rpc <url>] [--execute --keypair <solana-cli-64-byte-keypair.json>]',
       boundary: 'Proof Network chain commands default to local planning and dry-run validation. submit-solana only submits a Solana Memo transaction when --execute is passed; it carries compact public-safe commitment/ref JSON, never raw memory or artifact bodies.',
     },
     relay_gateway_options: {

package/apps/native-host/README.md

@@ -55,6 +55,26 @@ The CLI manifest generator and install-plan preview are the recommended path bec
 
 4. If your browser does not inherit the `ENIGMA_BUNDLE` user environment, create a small local wrapper that sets `ENIGMA_BUNDLE` and then execs the absolute `enigma-native-host` path. Point the manifest `path` to that wrapper. Keep the wrapper owner-writable only.
 
+
+## Fast MCP client setup
+
+For Claude Desktop, Cursor, Kimi Code, and VS Code Cline, avoid hand-editing MCP JSON. After installing the package, use the CLI to create the local bundle and merge only the Enigma MCP server entry into the selected client config:
+
+```sh
+npm install -g enigma-memory && enigma setup --client claude-desktop --write-connectors --overwrite
+npm install -g enigma-memory && enigma setup --client cursor --write-connectors --overwrite
+npm install -g enigma-memory && enigma setup --client kimi-code --write-connectors --overwrite
+npm install -g enigma-memory && enigma setup --client vscode-cline --write-connectors --overwrite
+```
+
+To connect only clients whose config files already exist, use:
+
+```sh
+npm install -g enigma-memory && enigma setup --client auto --connect-installed --overwrite
+```
+
+The generated MCP entry uses `enigma-mcp` with `ENIGMA_BUNDLE` pointing at the local bundle. Existing sibling MCP servers are preserved; changed configs are backed up by `enigma connect`.
+
 ## Generate a manifest
 
 Use the CLI generator instead of hand-editing JSON:

package/deploy/SIMULATION.md

@@ -103,50 +103,46 @@ and are non-empty.
   `sim.enigmamemory.com`, `relay.sim.enigmamemory.com`,
   `gateway.sim.enigmamemory.com`, and `*.sim.enigmamemory.com`.
 
-## Collect hosted backend live evidence
+## Shortest path from local simulation to hosted readiness
 
-The simulation can be probed as if it were a public hosted deployment by
-using the public-looking domain `sim.enigmamemory.com`. Because the domain
-has no real DNS record, the collector resolves it to `127.0.0.1` locally and
-accepts the self-signed certificate.
+The local simulation proves that the relay, gateway, fail-closed readiness
+checks, hosted-live collector, and hosted-live validator can interoperate. It
+does **not** produce production go-live evidence because it uses loopback DNS,
+self-signed TLS, mocked KMS/SIEM services, and fixture operator approval.
 
-1. Build a simulation operator acceptance packet:
+Run the local proof without external credentials:
 
-   ```bash
-   node scripts/build-operator-acceptance-packet.mjs \
-     --complete-fixture --decision go --packet-id sim-operator-acceptance \
-     --tenant enigma-sim --deployment-mode hosted --environment local-simulation \
-     --target-regions local --requested-go-live-date 2026-06-25 \
-     --evidence-repository https://github.com/enigma-memory/evidence/sim \
-     --packet-owner "Simulation Owner" \
-     --last-updated 2026-06-25T00:00:00.000Z \
-     --owners-json .enigma/sim-owner-overrides.json \
-     --evidence-refs .enigma/sim-evidence-overrides.json \
-     --out .enigma/sim-operator-acceptance.json --validate
-   ```
+```bash
+node --test test/enigma-hosted-go-live-simulation.test.mjs
+```
 
-2. Collect and validate live evidence:
+That test starts `deploy/docker-compose.local-production-simulation.yml`,
+builds a simulation-only operator acceptance packet, collects relay/gateway
+`/livez` and `/readyz` evidence, validates it with
+`scripts/validate-hosted-backend-live.mjs`, and tears the stack down. For manual
+simulation probing, `production:hosted-collect -- --local-simulation-loopback`
+is restricted to `https://*.sim.enigmamemory.com` loopback probes with
+self-signed TLS and must not be used as production evidence.
 
-   ```bash
-   node .enigma/collect-sim-evidence.mjs \
-     --relay-url https://sim.enigmamemory.com:8443 \
-     --gateway-url https://sim.enigmamemory.com:9443 \
-     --refs-json .enigma/sim-hosted-refs.json \
-     --domain sim.enigmamemory.com --environment-id local-simulation \
-     --cloud-provider local --region local --owner enigma-sim \
-     --operator-decision go \
-     --operator-packet-ref .enigma/sim-operator-acceptance.json \
-     --operator-approved-at <iso8601> --operator-approved-by enigma-sim \
-     --out .enigma/hosted-backend-live-collection.json \
-     --evidence-out .enigma/hosted-backend-live-simulated.json
-
-   node scripts/validate-hosted-backend-live.mjs \
-     --evidence .enigma/hosted-backend-live-simulated.json
-   ```
+Move from that local proof to real hosted relay/gateway readiness with the same
+script chain, replacing every template with operator-owned production evidence:
+
+```bash
+npm run production:evidence-starter -- --out-dir <evidence-dir> --domain enigmamemory.com --tenant <tenant-id> --environment production
+npm run production:backend-env -- --out-dir <backend-env-kit-dir> --domain enigmamemory.com --tenant <tenant-id> --environment production
+# Operator deploys relay/gateway from deploy/docker-compose.production.example.yml or deploy/kubernetes/enigma-backend.example.yaml using private filled env/secrets.
+npm run production:manifests -- --out <evidence-dir>/production-manifests.json
+npm run production:storage -- --out <evidence-dir>/production-storage-migration.json
+npm run infrastructure:readiness -- --manifest <evidence-dir>/infrastructure-readiness-manifest.json --live --cloudflare-live required > <evidence-dir>/infrastructure-readiness-live.json
+npm run production:hosted-collect -- --relay-url https://relay.enigmamemory.com --gateway-url https://gateway.enigmamemory.com --refs-json <evidence-dir>/hosted-refs.json --domain enigmamemory.com --environment-id production --cloud-provider <provider> --region <region> --owner <owner> --operator-decision go --operator-packet-ref <operator-packet-ref> --operator-approved-at <iso8601> --operator-approved-by <operator> --out <evidence-dir>/hosted-backend-live-collection.json --evidence-out <evidence-dir>/hosted-backend-live.json
+npm run production:hosted-live -- --evidence <evidence-dir>/hosted-backend-live.json
+npm run production:acceptance:packet -- --out <evidence-dir>/operator-acceptance-packet.json --owners-json <evidence-dir>/owner-approval-refs.json --evidence-refs <evidence-dir>/evidence-refs.json --readiness <evidence-dir>/infrastructure-readiness-live.json --manifest <evidence-dir>/infrastructure-readiness-manifest.json --storage <evidence-dir>/production-storage-migration.json --release-audit .enigma/release-audit-current.json --production-manifests <evidence-dir>/production-manifests.json --decision go --tenant <tenant-id> --target-regions <regions> --requested-go-live-date <date> --evidence-repository <evidence-repository> --packet-owner <operator> --validate
+npm run production:acceptance -- --packet <evidence-dir>/operator-acceptance-packet.json
+```
 
-The expected result is `status: accepted` with all four probes observed and no
-blockers. The wrapper does not mutate DNS or deploy infrastructure and never
-sends credentials.
+Hosted readiness remains blocked until the production commands above observe
+public HTTPS relay/gateway probes, all required hosted refs, and operator
+acceptance `go` for the exact target environment.
 
 Never commit `deploy/secrets-simulation/` or `*.pem` files. Both are
 `.gitignore`d.

package/docs/benchmark-attestation-network.md

@@ -169,7 +169,7 @@ Minimum public-safe attestation skeleton:
   "track": "public_practice",
   "program": {
     "name": "enigma_benchmark_attestation_network",
-    "version": "0.1.15",
+    "version": "0.1.16",
     "policy_ref": "sha256:policy-root"
   },
   "run": {
@@ -177,7 +177,7 @@ Minimum public-safe attestation skeleton:
     "nonce": "sha256:run-nonce-commitment",
     "status": "completed",
     "runner_ref": "sha256:runner-root",
-    "package_ref": "npm:enigma-memory@0.1.15",
+    "package_ref": "npm:enigma-memory@0.1.16",
     "adapter_ref": "local:enigma-relevance",
     "environment_ref": "sha256:environment-summary-root"
   },

package/docs/benchmark-reproducibility.md

@@ -4,7 +4,7 @@ This guide explains how to reproduce the current local Enigma memory benchmark,
 
 ## What is reproducible today
 
-The current planned package is `enigma-memory@0.1.15`. Two benchmark paths are reproducible without provider credentials:
+The current planned package is `enigma-memory@0.1.16`. Two benchmark paths are reproducible without provider credentials:
 
 1. The local deterministic memory suite, available through the package script and the script file it wraps:
 
@@ -20,12 +20,15 @@ The current planned package is `enigma-memory@0.1.15`. Two benchmark paths are r
 2. The official-dataset standard runner, which consumes locally downloaded LoCoMo and/or LongMemEval JSON files:
 
    ```sh
+   node scripts/run-standard-memory-benchmarks.mjs --locomo .enigma/benchmarks/datasets/locomo10.json --longmemeval .enigma/benchmarks/datasets/longmemeval_s_cleaned.json --max-locomo-qa 25 --max-longmemeval-items 25 --top-k 5 --dry-run
    node scripts/run-standard-memory-benchmarks.mjs --locomo .enigma/benchmarks/datasets/locomo10.json --longmemeval .enigma/benchmarks/datasets/longmemeval_s_cleaned.json --max-locomo-qa 25 --max-longmemeval-items 25 --top-k 5 --out .enigma/standard-memory-benchmark-sample.json
    ```
 
-   The standard report schema is `enigma.standard_memory_benchmark_suite.v1`. It scores retrieval/evidence coverage over official dataset records with local deterministic methods only. It does not call LLM providers, generate final answers, grade natural-language answer correctness, call competitor SDKs, or create provider/competitor scores.
+   The `--dry-run` command emits `enigma.standard_memory_benchmark_plan.v1`: a public-safe offline plan with file names, sample caps, top-k, local method rows, a requirements-only Mem0 adapter row, and explicit boundaries. It does not read dataset files, hash data, produce scores, call APIs, run Mem0 or competitor adapters, generate answers, or spend provider budget.
 
-   In that standard report, `keyword_filter` is intentionally the simpler lexical baseline. `enigma_relevance` is the deterministic Enigma retrieval approximation: it uses deterministic query expansion, term normalization and stemming, task/category and temporal/date hints, role/session metadata, phrase/proximity scoring, and final reranking for evidence diversity. It does not use raw answer text, evidence labels, or `has_answer` flags to choose records. It must be interpreted only as retrieval/evidence proxy scoring over the local dataset file named in the report, not as LLM answer accuracy, provider performance, competitor performance, or leaderboard standing.
+   The scored standard report schema is `enigma.standard_memory_benchmark_suite.v1`. It scores retrieval/evidence coverage over official dataset records with local deterministic methods only and includes a requirements-only Mem0 row with `scores_included:false`. It does not call LLM providers, generate final answers, grade natural-language answer correctness, call Mem0 or other competitor SDKs, or create provider/competitor scores.
+
+   In that standard report, `keyword_filter` is intentionally the simpler lexical baseline. `enigma_relevance` is the deterministic Enigma retrieval approximation: it uses deterministic query expansion, term normalization and stemming, task/category and temporal/date hints, role/session metadata, phrase/proximity scoring, and final reranking for evidence diversity. It does not use raw answer text, evidence labels, or `has_answer` flags to choose records. It must be interpreted only as retrieval/evidence proxy scoring over the local dataset file named in the report, not as LLM answer accuracy, provider performance, Mem0/competitor performance, or leaderboard standing.
 
    | Standard-runner row | Retrieval boundary |
    | --- | --- |
@@ -64,7 +67,7 @@ Do not commit downloaded files or raw benchmark conversations. The package `.git
 
 ## Reproduce and save local fixture JSON
 
-1. Use a clean checkout containing `enigma-memory@0.1.15`.
+1. Use a clean checkout containing `enigma-memory@0.1.16`.
 2. From a repository root that contains `enigma/package.json`, enter the package directory:
 
    ```sh
@@ -94,7 +97,15 @@ Interpret improvements as local fixture behavior. Enigma reduces context-pack es
 
 ## Run the official-dataset standard benchmark
 
-The standard runner reads local dataset files produced by the downloader and writes a public-safe proxy report to the path supplied with `--out`. A bounded sample is the safest first run:
+The standard runner reads local dataset files produced by the downloader and writes a public-safe proxy report to the path supplied with `--out`. Preview the exact offline boundary first:
+
+```sh
+node scripts/run-standard-memory-benchmarks.mjs --locomo .enigma/benchmarks/datasets/locomo10.json --longmemeval .enigma/benchmarks/datasets/longmemeval_s_cleaned.json --max-locomo-qa 25 --max-longmemeval-items 25 --top-k 5 --dry-run
+```
+
+That command proves only the planned local files, sample bounds, `--top-k`, deterministic local rows, and no-API/no-Mem0/no-competitor/no-score boundary. It does not prove the files exist, hash the datasets, or report accuracy.
+
+A bounded scored sample is the safest first run:
 
 ```sh
 node scripts/run-standard-memory-benchmarks.mjs --locomo .enigma/benchmarks/datasets/locomo10.json --longmemeval .enigma/benchmarks/datasets/longmemeval_s_cleaned.json --max-locomo-qa 25 --max-longmemeval-items 25 --top-k 5 --out .enigma/standard-memory-benchmark-sample.json
@@ -106,6 +117,7 @@ Useful runner options:
 - `--longmemeval <path>` supplies a local LongMemEval JSON file. Use one cleaned split per run when you want split-specific evidence.
 - `--max-locomo-qa <n>` and `--max-longmemeval-items <n>` bound the sample size.
 - `--top-k <n>` controls retrieval depth; the default is `5`.
+- `--dry-run` prints the public-safe offline plan and does not read dataset files or produce scores.
 - `--out <path>` writes public-safe JSON to that path. Without `--out`, the report is printed to stdout.
 
 If only `--locomo` or only `--longmemeval` is supplied, the runner scores only that dataset.
@@ -130,7 +142,7 @@ Public sharing should include the generated benchmark report JSON and generated
 
 ## Proof-network benchmark attestations
 
-For the planned 0.1.15 proof-network layer, benchmark results should be represented as a public-safe local attestation rather than by publishing raw benchmark inputs. The attestation JSON uses `schema: "enigma.proof_network.benchmark_attestation.v1"` and may be bundled in `enigma.proof_network.packet.v1` for review. The benchmark proof-release flow is local planning only: it does not call APIs, submit transactions, or claim hosted SaaS behavior, and generated artifacts must keep `transaction_submitted: false` and `raw_memory_on_chain: false`.
+For the planned 0.1.16 proof-network layer, benchmark results should be represented as a public-safe local attestation rather than by publishing raw benchmark inputs. The attestation JSON uses `schema: "enigma.proof_network.benchmark_attestation.v1"` and may be bundled in `enigma.proof_network.packet.v1` for review. The benchmark proof-release flow is local planning only: it does not call APIs, submit transactions, or claim hosted SaaS behavior, and generated artifacts must keep `transaction_submitted: false` and `raw_memory_on_chain: false`.
 
 Hash the generated benchmark report and companion dataset manifest, then attest only the report hash, schema name, dataset refs, runner refs, package refs, score commitments, record counts, top-k/sample bounds, and timestamps needed for review. The public artifacts must not contain raw dataset rows, raw conversations, prompts, private questions, private answers, provider responses, embeddings, credentials, tenant names, account ids, local absolute paths, unpublished benchmark scores, or the raw benchmark report body.
 
@@ -139,12 +151,12 @@ Use a `sha256:<hex>` commitment for the report and manifest. The proof-release s
 After running one of the benchmark commands above and confirming the report is public-safe, create a local proof release:
 
 ```sh
-npm run benchmark:proof-release -- --report .enigma/standard-memory-benchmark-sample.json --dataset-ref "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" --runner-ref "runner:run-standard-memory-benchmarks.mjs@reviewed-revision" --package-ref "enigma-memory@0.1.15" --score "retrieval_evidence_proxy=<value-copied-from-report>" --out-dir .enigma/benchmark-proof-release
+npm run benchmark:proof-release -- --report .enigma/standard-memory-benchmark-sample.json --dataset-ref "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" --runner-ref "runner:run-standard-memory-benchmarks.mjs@reviewed-revision" --package-ref "enigma-memory@0.1.16" --score "retrieval_evidence_proxy=<value-copied-from-report>" --out-dir .enigma/benchmark-proof-release
 ```
 
-The command writes `benchmark-attestation.json`, `benchmark-proof-packet.json`, and `benchmark-proof-release.json` in the output directory. The release manifest uses `schema: "enigma.benchmark_proof_release.v1"` and records explicit boundaries: local benchmark attestation only, no API calls, no provider answer-accuracy claim, no competitor performance claim, no Solana submission claim, no hosted SaaS claim, and no ROI/profit/provider-savings claim.
+The command writes `benchmark-attestation.json`, `benchmark-proof-packet.json`, and `benchmark-proof-release.json` in the output directory. The release manifest uses `schema: "enigma.benchmark_proof_release.v1"` and records explicit boundaries: local benchmark attestation only, local report file hashing only, no network calls, no provider APIs, no API spend, no provider answer-accuracy claim, no competitor performance claim, no Solana submission claim, no hosted SaaS claim, and no ROI/profit/provider-savings claim.
 
-When a report file is supplied, the generated attestation is a reproducibility receipt for a specific local report hash and explicitly supplied aggregate score commitments. It is not evidence of provider answer accuracy, competitor performance, Solana settlement, ROI, hosted-cloud readiness, provider deletion, model forgetting, or live model behavior.
+When a report file is supplied, the generated attestation is a reproducibility receipt for a specific local report hash and explicitly supplied aggregate score commitments. The proof builder now requires a compatible benchmark schema plus explicit offline `benchmark_boundaries`, and rejects scored external adapter rows. It is not evidence of provider answer accuracy, Mem0 or competitor performance, Solana settlement, ROI, hosted-cloud readiness, provider deletion, model forgetting, or live model behavior.
 
 ## Local baseline rows in the report
 

package/docs/browser-extension-install.md

@@ -27,21 +27,24 @@ node scripts/package-browser-extension.mjs --zip ./dist/enigma-browser-extension
 
 The ZIP command does not publish, sign, upload, or submit the extension.
 
-## Install the native host first
+## Install the native host and MCP connector first
 
-Install the npm package so both `enigma` and `enigma-native-host` are available:
+Install the npm package, create the local bundle, and let Enigma merge the MCP server entry into the selected client config. Pick the command for the client you use:
 
 ```sh
-npm install -g enigma-memory
+npm install -g enigma-memory && enigma setup --client claude-desktop --write-connectors --overwrite
+npm install -g enigma-memory && enigma setup --client cursor --write-connectors --overwrite
+npm install -g enigma-memory && enigma setup --client kimi-code --write-connectors --overwrite
+npm install -g enigma-memory && enigma setup --client vscode-cline --write-connectors --overwrite
 ```
 
-Create or select a local bundle:
+If you want Enigma to touch only client config files that already exist, use:
 
 ```sh
-enigma init --bundle <absolute-bundle-path> --subject local-user --display-name "Local user"
+npm install -g enigma-memory && enigma setup --client auto --connect-installed --overwrite
 ```
 
-Set `ENIGMA_BUNDLE` for the browser-launched host process, or point the native-host manifest at a small local wrapper that sets `ENIGMA_BUNDLE=<absolute-bundle-path>` before launching `enigma-native-host`. Native messaging manifests require an absolute executable path; they do not expand shell aliases, `~`, `$HOME`, `%USERPROFILE%`, or command arguments.
+Set `ENIGMA_BUNDLE` for the browser-launched host process to the same bundle path reported by setup, or point the native-host manifest at a small local wrapper that sets `ENIGMA_BUNDLE=<absolute-bundle-path>` before launching `enigma-native-host`. Native messaging manifests require an absolute executable path; they do not expand shell aliases, `~`, `$HOME`, `%USERPROFILE%`, or command arguments.
 
 Resolve the absolute host executable path: