enigma-memory 0.1.17 → 0.1.22

package/docs/browser-extension-install.md

@@ -32,19 +32,21 @@ The ZIP command does not publish, sign, upload, or submit the extension.
 Install the npm package, create the local bundle, and let Enigma merge the MCP server entry into the selected client config. Pick the command for the client you use:
 
 ```sh
-npm install -g enigma-memory && enigma setup --client claude-desktop --write-connectors --overwrite
-npm install -g enigma-memory && enigma setup --client cursor --write-connectors --overwrite
-npm install -g enigma-memory && enigma setup --client kimi-code --write-connectors --overwrite
-npm install -g enigma-memory && enigma setup --client vscode-cline --write-connectors --overwrite
+PASSPHRASE_FILE="$HOME/.enigma/passphrase"
+test -s "$PASSPHRASE_FILE" || { printf '%s\n' 'Create the protected passphrase file before setup.' >&2; exit 1; }
+npm install -g enigma-memory && enigma setup --passphrase-file "$PASSPHRASE_FILE" --client claude-desktop --write-connectors --overwrite
+npm install -g enigma-memory && enigma setup --passphrase-file "$PASSPHRASE_FILE" --client cursor --write-connectors --overwrite
+npm install -g enigma-memory && enigma setup --passphrase-file "$PASSPHRASE_FILE" --client kimi-code --write-connectors --overwrite
+npm install -g enigma-memory && enigma setup --passphrase-file "$PASSPHRASE_FILE" --client vscode-cline --write-connectors --overwrite
 ```
 
 If you want Enigma to touch only client config files that already exist, use:
 
 ```sh
-npm install -g enigma-memory && enigma setup --client auto --connect-installed --overwrite
+npm install -g enigma-memory && enigma setup --passphrase-file "$HOME/.enigma/passphrase" --client auto --connect-installed --overwrite
 ```
 
-Set `ENIGMA_BUNDLE` for the browser-launched host process to the same bundle path reported by setup, or point the native-host manifest at a small local wrapper that sets `ENIGMA_BUNDLE=<absolute-bundle-path>` before launching `enigma-native-host`. Native messaging manifests require an absolute executable path; they do not expand shell aliases, `~`, `$HOME`, `%USERPROFILE%`, or command arguments.
+Set `ENIGMA_BUNDLE` and `ENIGMA_PASSPHRASE_FILE` for the browser-launched host process to the same bundle and protected passphrase file used by setup, or point the native-host manifest at a small owner-writable-only wrapper that sets both variables before launching `enigma-native-host`. Never put the passphrase contents in the wrapper or manifest. Native messaging manifests require an absolute executable path; they do not expand shell aliases, `~`, `$HOME`, `%USERPROFILE%`, or command arguments.
 
 Resolve the absolute host executable path:
 

package/docs/client-connectors.md

@@ -16,21 +16,25 @@ Supported connector IDs:
 
 ```sh
 npm install -g enigma-memory
-enigma init
-enigma setup --client auto --connect-installed --overwrite
-enigma drive health
-enigma status
-enigma remember --text-file ./memory.txt
-enigma search --query "project context"
-enigma context --query "project context" --optimize
+PASSPHRASE_FILE="$HOME/.enigma/passphrase"
+test -s "$PASSPHRASE_FILE" || { printf '%s\n' 'Create $HOME/.enigma/passphrase with an approved secret manager or secure editor, then restrict it to the current user.' >&2; exit 1; }
+enigma init --passphrase-file "$PASSPHRASE_FILE"
+enigma setup --passphrase-file "$PASSPHRASE_FILE" --client auto --connect-installed --overwrite
+enigma drive health --passphrase-file "$PASSPHRASE_FILE"
+enigma status --passphrase-file "$PASSPHRASE_FILE"
+enigma remember --passphrase-file "$PASSPHRASE_FILE" --text-file ./memory.txt
+enigma search --passphrase-file "$PASSPHRASE_FILE" --query "project context"
+enigma context --passphrase-file "$PASSPHRASE_FILE" --query "project context" --optimize
 enigma verify --export ./.enigma/export.json
 ```
 
-One command connects every installed client: `enigma setup --client auto --connect-installed --overwrite` writes the `mcpServers.enigma` entry into every installed/config-present client it detects (Claude Desktop, Cursor, Kimi Code, VS Code/Cline, Roo, OpenCode, generic MCP). It skips clients that are not installed and never creates configs from scratch; preview with `--dry-run` first. `enigma drive health` reports a SMART-style memory-drive health packet (freshness, tombstone backlog, stale derived artifacts, receipt coverage, connector health) from local metadata only — it is part of the Memory Drive surface in this release, and `enigma status` plus `enigma doctor` cover local passport counts, roots, and connector readiness in every build. No setup command prints raw memory plaintext.
+One command connects every installed client: `enigma setup --passphrase-file "$HOME/.enigma/passphrase" --client auto --connect-installed --overwrite` writes the `mcpServers.enigma` entry into every installed/config-present client it detects (Claude Desktop, Cursor, Kimi Code, VS Code/Cline, Roo, OpenCode, generic MCP). It skips clients that are not installed and never creates configs from scratch; preview with `--dry-run` first. Normal setup is encrypted and requires `ENIGMA_PASSPHRASE` or `--passphrase-file`; never put the passphrase itself in shell arguments. `enigma drive health` reports a SMART-style memory-drive health packet from local metadata only. No setup command prints raw memory plaintext.
+
+Run setup or quickstart before using `enigma doctor` as the final green check. Doctor reads existing client configs as well as the local environment, so an already-present `generic-mcp` or other MCP config can make doctor red on a fresh install if its `ENIGMA_BUNDLE` points to a bundle that does not exist yet, or to a different bundle than the one passed to doctor. That is expected first-run connector state, not an npm install failure. After securely creating `./.enigma/passphrase`, use `enigma quickstart --bundle ./.enigma/bundle.json --passphrase-file ./.enigma/passphrase --overwrite` or `enigma setup --bundle ./.enigma/bundle.json --passphrase-file ./.enigma/passphrase --overwrite`, then rerun `enigma doctor --bundle ./.enigma/bundle.json`.
 
 For a single client, or to preview before writing, use `enigma connect <client> --dry-run` and then drop `--dry-run`.
 
-Provider-native memory is non-canonical cache only in this architecture. The Enigma vault remains canonical, and Enigma receipts prove Enigma-controlled lifecycle events; they do not prove that a hosted provider deleted hidden copies or that a model forgot anything.
+Provider-native memory is non-canonical cache only in this architecture. The Enigma vault remains canonical, and Enigma receipts prove Enigma-controlled lifecycle events; they do not prove that a hosted provider deleted hidden copies or that a model forgot anything. Hosted cloud and BYOC operation are waitlist/operator-deploy only; the relay and gateway binaries are local bootstrap probes, not a live hosted service.
 
 From a source checkout, use this only for package development or source-only docs:
 
@@ -68,13 +72,13 @@ enigma connect generic-mcp
 Optional setup-time planning for installed/config-present connector targets remains available:
 
 ```sh
-enigma setup --client auto --overwrite
+enigma setup --passphrase-file "$HOME/.enigma/passphrase" --client auto --overwrite
 ```
 
 Use the explicit setup-time write flag only when you want setup to write all installed/config-present client configs it discovers:
 
 ```sh
-enigma setup --connect-installed --overwrite
+enigma setup --passphrase-file "$HOME/.enigma/passphrase" --connect-installed --overwrite
 ```
 
 `--connect-installed` skips missing client configs instead of creating every default client config. It is for installed/config-present clients only. Existing `enigma setup --write-connectors` behavior for explicit/default clients is unchanged.
@@ -107,7 +111,7 @@ Connector writes are semantic and idempotent. Enigma preserves unrelated client
 
 ## Copy-paste MCP snippets
 
-Use an absolute bundle path. The MCP process inherits client environment in some apps and not in others; setting `ENIGMA_BUNDLE` directly in the entry is the portable path. The command defaults to `enigma-mcp`; if a GUI app cannot find shell-installed binaries, render an absolute command with `--mcp-command` (alias: `--command`).
+Use an absolute bundle path. The MCP process inherits client environment in some apps and not in others; setting `ENIGMA_BUNDLE` directly in the entry is the portable path. For an encrypted bundle, arrange for the client process to receive `ENIGMA_PASSPHRASE` from an approved OS credential manager or secure launcher. Never put its value in MCP JSON, source, documentation, or shell arguments. The command defaults to `enigma-mcp`; if a GUI app cannot find shell-installed binaries, render an absolute command with `--mcp-command` (alias: `--command`).
 
 Claude Desktop:
 

package/docs/demo-proof-network.md

@@ -1,275 +1,275 @@
-# Proof Network demo scripts
-
-Use these scripts to show Enigma's Proof Network with a local package install. They create and verify public-safe JSON proof artifacts only. They do not submit Solana transactions, call hosted Enigma, call model providers, write client configs, or place raw memory on chain.
-
-Requirements:
-
-- Node.js `>=24`
-- `enigma-memory` available through npm or a local package install
-- No provider credentials for the three default demos
-
-Run the commands from a writable demo directory after installing the package, for example `npm install -g enigma-memory`. For a one-off public npm run, prefix each `enigma` command with `npx --yes --package enigma-memory`. From a source checkout, replace `enigma` with `node apps/cli/bin/enigma.mjs`.
-
-Public-safety rule: proof artifacts may contain hashes, roots, refs, counts, timestamps, public authority refs, signatures, and boolean claim boundaries. They must not contain raw memory, prompts, transcripts, completions, embeddings, ACL bodies, tenant names, private keys, API keys, seed phrases, or provider responses.
-
-## Demo 1 — public npm test-drive + proof anchor plan
-
-Goal: run the public local test drive, then produce a Solana-ready anchor batch that commits only opaque roots and refs. The batch is a transaction plan, not a submitted transaction.
-
-```sh
-node -e "require('node:fs').mkdirSync('.enigma/proof-network',{recursive:true})"
-
-enigma test-drive \
-  --out-dir .enigma/proof-network/test-drive \
-  --overwrite
-
-enigma chain anchor \
-  --root sha256:1111111111111111111111111111111111111111111111111111111111111111 \
-  --root sha256:2222222222222222222222222222222222222222222222222222222222222222 \
-  --root sha256:3333333333333333333333333333333333333333333333333333333333333333 \
-  --ref npm-test-drive:bundle-root:v1 \
-  --ref npm-test-drive:receipt-root:v1 \
-  --ref npm-test-drive:context-root:v1 \
-  --authority did:web:enigma.example#local-demo \
-  --batch-ref proof-network-demo-anchor-001 \
-  --out .enigma/proof-network/anchor-batch.json
-
-enigma chain verify \
-  --file .enigma/proof-network/anchor-batch.json
-```
-
-Expected public-safe output shape from `chain anchor`:
-
-```json
-{
-  "ok": true,
-  "artifact_type": "enigma.proof_network.anchor_batch.v1",
-  "transaction_submitted": false,
-  "raw_memory_on_chain": false,
-  "batch_ref": "proof-network-demo-anchor-001",
-  "roots": [
-    "sha256:1111111111111111111111111111111111111111111111111111111111111111",
-    "sha256:2222222222222222222222222222222222222222222222222222222222222222",
-    "sha256:3333333333333333333333333333333333333333333333333333333333333333"
-  ],
-  "refs": [
-    "npm-test-drive:bundle-root:v1",
-    "npm-test-drive:receipt-root:v1",
-    "npm-test-drive:context-root:v1"
-  ],
-  "solana_ready": true,
-  "claim_boundaries": {
-    "provider_calls": false,
-    "hosted_enigma_calls": false,
-    "transaction_submitted": false,
-    "raw_memory_on_chain": false
-  }
-}
-```
-
-Expected public-safe output shape from `chain verify`:
-
-```json
-{
-  "ok": true,
-  "artifact_type": "enigma.proof_network.anchor_batch.v1",
-  "valid": true,
-  "transaction_submitted": false,
-  "raw_memory_on_chain": false,
-  "private_payload_detected": false
-}
-```
-
-Presenter notes:
-
-1. The test drive proves local Enigma-controlled state only.
-2. The anchor batch is Solana-ready because it is an opaque commitment payload, but it is not a transaction and it is not submitted.
-3. Replace the demo roots with roots emitted by your own local Enigma run when presenting a real local artifact. Do not paste memory text, prompts, embeddings, provider responses, or tenant/customer names into `--root`, `--ref`, or `--authority`.
-
-## Demo 2 — cross-model memory receipt demo
-
-Goal: show one local Enigma bundle producing public receipt summaries for multiple model/client profiles, then issue a scoped capability grant and revocation for one public subject ref. No model provider is contacted.
-
-```sh
-node -e "require('node:fs').mkdirSync('.enigma/proof-network',{recursive:true})"
-
-enigma test-drive \
-  --out-dir .enigma/proof-network/cross-model \
-  --overwrite
-
-enigma demo cross-model \
-  --bundle .enigma/proof-network/cross-model/bundle.json \
-  --out .enigma/proof-network/cross-model-report.json
-
-enigma chain grant \
-  --subject agent:claude-desktop:local-demo \
-  --capability memory.context.read \
-  --scope context-pack:cross-model-demo:v1 \
-  --expires-at 2026-12-31T00:00:00.000Z \
-  --grant-ref proof-network-demo-grant-001 \
-  --out .enigma/proof-network/capability-grant.json
-
-enigma chain revoke \
-  --grant-hash sha256:4444444444444444444444444444444444444444444444444444444444444444 \
-  --reason demo-complete \
-  --revocation-ref proof-network-demo-revocation-001 \
-  --out .enigma/proof-network/capability-revocation.json
-
-enigma chain verify \
-  --file .enigma/proof-network/capability-grant.json
-
-enigma chain verify \
-  --file .enigma/proof-network/capability-revocation.json
-```
-
-Expected public-safe output shape from `demo cross-model`:
-
-```json
-{
-  "ok": true,
-  "demo": "cross-model-memory",
-  "provider_calls": false,
-  "raw_memory_included": false,
-  "profiles": [
-    {
-      "client": "claude-desktop",
-      "context_pack_hash": "sha256:...",
-      "receipt_refs": ["receipt:..."]
-    },
-    {
-      "client": "cursor",
-      "context_pack_hash": "sha256:...",
-      "receipt_refs": ["receipt:..."]
-    },
-    {
-      "client": "kimi-code",
-      "context_pack_hash": "sha256:...",
-      "receipt_refs": ["receipt:..."]
-    }
-  ]
-}
-```
-
-Expected public-safe output shape from `chain grant`:
-
-```json
-{
-  "ok": true,
-  "artifact_type": "enigma.proof_network.capability_grant.v1",
-  "transaction_submitted": false,
-  "raw_memory_on_chain": false,
-  "subject": "agent:claude-desktop:local-demo",
-  "capability": "memory.context.read",
-  "scope": "context-pack:cross-model-demo:v1",
-  "expires_at": "2026-12-31T00:00:00.000Z",
-  "grant_ref": "proof-network-demo-grant-001",
-  "private_payload_detected": false
-}
-```
-
-Expected public-safe output shape from `chain revoke`:
-
-```json
-{
-  "ok": true,
-  "artifact_type": "enigma.proof_network.capability_revocation.v1",
-  "transaction_submitted": false,
-  "raw_memory_on_chain": false,
-  "grant_hash": "sha256:4444444444444444444444444444444444444444444444444444444444444444",
-  "reason": "demo-complete",
-  "revocation_ref": "proof-network-demo-revocation-001",
-  "private_payload_detected": false
-}
-```
-
-Presenter notes:
-
-1. The cross-model report is a receipt demo, not proof that a provider remembered or forgot anything.
-2. Capability grants are public authorization receipts. Scopes must be public refs, not ACL JSON, tenant names, or private policy bodies.
-3. Revocations should point to grant hashes or nullifiers. Do not include the original private grant context.
-
-## Demo 3 — benchmark attestation demo
-
-Goal: turn a benchmark report hash or local report file into a public benchmark attestation. This demo uses deterministic refs and scores only; the proof artifact does not include dataset rows, questions, answers, prompts, completions, provider responses, or credentials.
-
-Package-only path with a precomputed public report hash:
-
-```sh
-node -e "require('node:fs').mkdirSync('.enigma/proof-network',{recursive:true})"
-
-enigma chain attest \
-  --report-hash sha256:5555555555555555555555555555555555555555555555555555555555555555 \
-  --dataset-ref enigma-fixture:deterministic-local:v1 \
-  --runner-ref enigma-memory:local-benchmark-runner:v1 \
-  --package-ref npm:enigma-memory@0.1.17 \
-  --score recall_at_5=1 \
-  --score p95_latency_ms=14 \
-  --out .enigma/proof-network/benchmark-attestation.json
-
-enigma chain verify \
-  --file .enigma/proof-network/benchmark-attestation.json
-```
-
-Source-checkout path when you have a local benchmark report file:
-
-```sh
-node scripts/run-memory-benchmarks.mjs
-
-enigma chain attest \
-  --report-file .enigma/benchmarks/report.json \
-  --dataset-ref enigma-fixture:deterministic-local:v1 \
-  --runner-ref enigma-memory:scripts/run-memory-benchmarks.mjs \
-  --package-ref npm:enigma-memory@0.1.17 \
-  --score recall_at_5=1 \
-  --score p95_latency_ms=14 \
-  --out .enigma/proof-network/benchmark-attestation.json
-```
-
-Expected public-safe output shape from `chain attest`:
-
-```json
-{
-  "ok": true,
-  "artifact_type": "enigma.proof_network.benchmark_attestation.v1",
-  "transaction_submitted": false,
-  "raw_memory_on_chain": false,
-  "report_hash": "sha256:5555555555555555555555555555555555555555555555555555555555555555",
-  "dataset_ref": "enigma-fixture:deterministic-local:v1",
-  "runner_ref": "enigma-memory:local-benchmark-runner:v1",
-  "package_ref": "npm:enigma-memory@0.1.17",
-  "scores": {
-    "recall_at_5": 1,
-    "p95_latency_ms": 14
-  },
-  "private_payload_detected": false
-}
-```
-
-Optional full-answer benchmark note: a separate full-answer benchmark runner may require provider credentials for the model being evaluated. Keep those credentials in local environment variables or a secret manager only. The public proof artifact should still contain only `report_hash`, `dataset_ref`, `runner_ref`, `package_ref`, scores, roots, refs, signatures, and claim boundaries. Never include provider requests, provider responses, prompts, answers, dataset rows, account ids, API keys, tenant names, or raw memory in the attestation.
-
-Presenter notes:
-
-1. A benchmark attestation proves that a named report hash, dataset ref, runner ref, package ref, and score set were committed together.
-2. It is not a leaderboard claim unless the named benchmark protocol, dataset access, runner, scoring rules, and comparison set are independently published and reproducible.
-3. `chain verify` validates the artifact shape and public-safety boundaries; it does not rerun the benchmark.
-
-## Close the demo
-
-Verify every generated artifact before sharing it:
-
-```sh
-enigma chain verify --file .enigma/proof-network/anchor-batch.json
-enigma chain verify --file .enigma/proof-network/capability-grant.json
-enigma chain verify --file .enigma/proof-network/capability-revocation.json
-enigma chain verify --file .enigma/proof-network/benchmark-attestation.json
-```
-
-Safe closing claim: Enigma can create local, public-safe proof-network artifacts that are ready for chain anchoring without exposing memory contents or submitting a transaction.
-
-Unsafe claims to avoid:
-
-- "A Solana transaction was submitted" unless you separately submitted one outside these local planning commands.
-- "Raw memory is on chain"; that should never be true for these demos.
-- "Providers deleted or forgot the memory."
-- "Provider-native memory is canonical."
-- "Benchmark leadership is proven" unless a reproducible comparison protocol and artifacts are published.
+# Proof Network demo scripts
+
+Use these scripts to show Enigma's Proof Network with a local package install. They create and verify public-safe JSON proof artifacts only. They do not submit Solana transactions, call hosted Enigma, call model providers, write client configs, or place raw memory on chain.
+
+Requirements:
+
+- Node.js `>=24`
+- `enigma-memory` available through npm or a local package install
+- No provider credentials for the three default demos
+
+Run the commands from a writable demo directory after installing the package, for example `npm install -g enigma-memory`. For a one-off public npm run, prefix each `enigma` command with `npx --yes --package enigma-memory`. From a source checkout, replace `enigma` with `node apps/cli/bin/enigma.mjs`.
+
+Public-safety rule: proof artifacts may contain hashes, roots, refs, counts, timestamps, public authority refs, signatures, and boolean claim boundaries. They must not contain raw memory, prompts, transcripts, completions, embeddings, ACL bodies, tenant names, private keys, API keys, seed phrases, or provider responses.
+
+## Demo 1 — public npm test-drive + proof anchor plan
+
+Goal: run the public local test drive, then produce a Solana-ready anchor batch that commits only opaque roots and refs. The batch is a transaction plan, not a submitted transaction.
+
+```sh
+node -e "require('node:fs').mkdirSync('.enigma/proof-network',{recursive:true})"
+
+enigma test-drive \
+  --out-dir .enigma/proof-network/test-drive \
+  --overwrite
+
+enigma chain anchor \
+  --root sha256:1111111111111111111111111111111111111111111111111111111111111111 \
+  --root sha256:2222222222222222222222222222222222222222222222222222222222222222 \
+  --root sha256:3333333333333333333333333333333333333333333333333333333333333333 \
+  --ref npm-test-drive:bundle-root:v1 \
+  --ref npm-test-drive:receipt-root:v1 \
+  --ref npm-test-drive:context-root:v1 \
+  --authority did:web:enigma.example#local-demo \
+  --batch-ref proof-network-demo-anchor-001 \
+  --out .enigma/proof-network/anchor-batch.json
+
+enigma chain verify \
+  --file .enigma/proof-network/anchor-batch.json
+```
+
+Expected public-safe output shape from `chain anchor`:
+
+```json
+{
+  "ok": true,
+  "artifact_type": "enigma.proof_network.anchor_batch.v1",
+  "transaction_submitted": false,
+  "raw_memory_on_chain": false,
+  "batch_ref": "proof-network-demo-anchor-001",
+  "roots": [
+    "sha256:1111111111111111111111111111111111111111111111111111111111111111",
+    "sha256:2222222222222222222222222222222222222222222222222222222222222222",
+    "sha256:3333333333333333333333333333333333333333333333333333333333333333"
+  ],
+  "refs": [
+    "npm-test-drive:bundle-root:v1",
+    "npm-test-drive:receipt-root:v1",
+    "npm-test-drive:context-root:v1"
+  ],
+  "solana_ready": true,
+  "claim_boundaries": {
+    "provider_calls": false,
+    "hosted_enigma_calls": false,
+    "transaction_submitted": false,
+    "raw_memory_on_chain": false
+  }
+}
+```
+
+Expected public-safe output shape from `chain verify`:
+
+```json
+{
+  "ok": true,
+  "artifact_type": "enigma.proof_network.anchor_batch.v1",
+  "valid": true,
+  "transaction_submitted": false,
+  "raw_memory_on_chain": false,
+  "private_payload_detected": false
+}
+```
+
+Presenter notes:
+
+1. The test drive proves local Enigma-controlled state only.
+2. The anchor batch is Solana-ready because it is an opaque commitment payload, but it is not a transaction and it is not submitted.
+3. Replace the demo roots with roots emitted by your own local Enigma run when presenting a real local artifact. Do not paste memory text, prompts, embeddings, provider responses, or tenant/customer names into `--root`, `--ref`, or `--authority`.
+
+## Demo 2 — cross-model memory receipt demo
+
+Goal: show one local Enigma bundle producing public receipt summaries for multiple model/client profiles, then issue a scoped capability grant and revocation for one public subject ref. No model provider is contacted.
+
+```sh
+node -e "require('node:fs').mkdirSync('.enigma/proof-network',{recursive:true})"
+
+enigma test-drive \
+  --out-dir .enigma/proof-network/cross-model \
+  --overwrite
+
+enigma demo cross-model \
+  --bundle .enigma/proof-network/cross-model/bundle.json \
+  --out .enigma/proof-network/cross-model-report.json
+
+enigma chain grant \
+  --subject agent:claude-desktop:local-demo \
+  --capability memory.context.read \
+  --scope context-pack:cross-model-demo:v1 \
+  --expires-at 2026-12-31T00:00:00.000Z \
+  --grant-ref proof-network-demo-grant-001 \
+  --out .enigma/proof-network/capability-grant.json
+
+enigma chain revoke \
+  --grant-hash sha256:4444444444444444444444444444444444444444444444444444444444444444 \
+  --reason demo-complete \
+  --revocation-ref proof-network-demo-revocation-001 \
+  --out .enigma/proof-network/capability-revocation.json
+
+enigma chain verify \
+  --file .enigma/proof-network/capability-grant.json
+
+enigma chain verify \
+  --file .enigma/proof-network/capability-revocation.json
+```
+
+Expected public-safe output shape from `demo cross-model`:
+
+```json
+{
+  "ok": true,
+  "demo": "cross-model-memory",
+  "provider_calls": false,
+  "raw_memory_included": false,
+  "profiles": [
+    {
+      "client": "claude-desktop",
+      "context_pack_hash": "sha256:...",
+      "receipt_refs": ["receipt:..."]
+    },
+    {
+      "client": "cursor",
+      "context_pack_hash": "sha256:...",
+      "receipt_refs": ["receipt:..."]
+    },
+    {
+      "client": "kimi-code",
+      "context_pack_hash": "sha256:...",
+      "receipt_refs": ["receipt:..."]
+    }
+  ]
+}
+```
+
+Expected public-safe output shape from `chain grant`:
+
+```json
+{
+  "ok": true,
+  "artifact_type": "enigma.proof_network.capability_grant.v1",
+  "transaction_submitted": false,
+  "raw_memory_on_chain": false,
+  "subject": "agent:claude-desktop:local-demo",
+  "capability": "memory.context.read",
+  "scope": "context-pack:cross-model-demo:v1",
+  "expires_at": "2026-12-31T00:00:00.000Z",
+  "grant_ref": "proof-network-demo-grant-001",
+  "private_payload_detected": false
+}
+```
+
+Expected public-safe output shape from `chain revoke`:
+
+```json
+{
+  "ok": true,
+  "artifact_type": "enigma.proof_network.capability_revocation.v1",
+  "transaction_submitted": false,
+  "raw_memory_on_chain": false,
+  "grant_hash": "sha256:4444444444444444444444444444444444444444444444444444444444444444",
+  "reason": "demo-complete",
+  "revocation_ref": "proof-network-demo-revocation-001",
+  "private_payload_detected": false
+}
+```
+
+Presenter notes:
+
+1. The cross-model report is a receipt demo, not proof that a provider remembered or forgot anything.
+2. Capability grants are public authorization receipts. Scopes must be public refs, not ACL JSON, tenant names, or private policy bodies.
+3. Revocations should point to grant hashes or nullifiers. Do not include the original private grant context.
+
+## Demo 3 — benchmark attestation demo
+
+Goal: turn a benchmark report hash or local report file into a public benchmark attestation. This demo uses deterministic refs and scores only; the proof artifact does not include dataset rows, questions, answers, prompts, completions, provider responses, or credentials.
+
+Package-only path with a precomputed public report hash:
+
+```sh
+node -e "require('node:fs').mkdirSync('.enigma/proof-network',{recursive:true})"
+
+enigma chain attest \
+  --report-hash sha256:5555555555555555555555555555555555555555555555555555555555555555 \
+  --dataset-ref enigma-fixture:deterministic-local:v1 \
+  --runner-ref enigma-memory:local-benchmark-runner:v1 \
+  --package-ref npm:enigma-memory@0.1.17 \
+  --score recall_at_5=1 \
+  --score p95_latency_ms=14 \
+  --out .enigma/proof-network/benchmark-attestation.json
+
+enigma chain verify \
+  --file .enigma/proof-network/benchmark-attestation.json
+```
+
+Source-checkout path when you have a local benchmark report file:
+
+```sh
+node scripts/run-memory-benchmarks.mjs
+
+enigma chain attest \
+  --report-file .enigma/benchmarks/report.json \
+  --dataset-ref enigma-fixture:deterministic-local:v1 \
+  --runner-ref enigma-memory:scripts/run-memory-benchmarks.mjs \
+  --package-ref npm:enigma-memory@0.1.17 \
+  --score recall_at_5=1 \
+  --score p95_latency_ms=14 \
+  --out .enigma/proof-network/benchmark-attestation.json
+```
+
+Expected public-safe output shape from `chain attest`:
+
+```json
+{
+  "ok": true,
+  "artifact_type": "enigma.proof_network.benchmark_attestation.v1",
+  "transaction_submitted": false,
+  "raw_memory_on_chain": false,
+  "report_hash": "sha256:5555555555555555555555555555555555555555555555555555555555555555",
+  "dataset_ref": "enigma-fixture:deterministic-local:v1",
+  "runner_ref": "enigma-memory:local-benchmark-runner:v1",
+  "package_ref": "npm:enigma-memory@0.1.17",
+  "scores": {
+    "recall_at_5": 1,
+    "p95_latency_ms": 14
+  },
+  "private_payload_detected": false
+}
+```
+
+Optional full-answer benchmark note: a separate full-answer benchmark runner may require provider credentials for the model being evaluated. Keep those credentials in local environment variables or a secret manager only. The public proof artifact should still contain only `report_hash`, `dataset_ref`, `runner_ref`, `package_ref`, scores, roots, refs, signatures, and claim boundaries. Never include provider requests, provider responses, prompts, answers, dataset rows, account ids, API keys, tenant names, or raw memory in the attestation.
+
+Presenter notes:
+
+1. A benchmark attestation proves that a named report hash, dataset ref, runner ref, package ref, and score set were committed together.
+2. It is not a leaderboard claim unless the named benchmark protocol, dataset access, runner, scoring rules, and comparison set are independently published and reproducible.
+3. `chain verify` validates the artifact shape and public-safety boundaries; it does not rerun the benchmark.
+
+## Close the demo
+
+Verify every generated artifact before sharing it:
+
+```sh
+enigma chain verify --file .enigma/proof-network/anchor-batch.json
+enigma chain verify --file .enigma/proof-network/capability-grant.json
+enigma chain verify --file .enigma/proof-network/capability-revocation.json
+enigma chain verify --file .enigma/proof-network/benchmark-attestation.json
+```
+
+Safe closing claim: Enigma can create local, public-safe proof-network artifacts that are ready for chain anchoring without exposing memory contents or submitting a transaction.
+
+Unsafe claims to avoid:
+
+- "A Solana transaction was submitted" unless you separately submitted one outside these local planning commands.
+- "Raw memory is on chain"; that should never be true for these demos.
+- "Providers deleted or forgot the memory."
+- "Provider-native memory is canonical."
+- "Benchmark leadership is proven" unless a reproducible comparison protocol and artifacts are published.