total-recall-brain 3.25.0 → 3.25.2

package/frontend/dist/index.html

@@ -17,7 +17,7 @@
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet" />
     <title>Total Recall — Portable Memory</title>
-    <script type="module" crossorigin src="/assets/index-wTl6WfEH.js"></script>
+    <script type="module" crossorigin src="/assets/index-wFSsoOKK.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-C7_Xpk27.css">
   </head>
   <body>

package/frontend/src/api/mesh.ts

@@ -1,4 +1,4 @@
-import { get, post } from './_base';
+import { get, post, apiFetch, API_BASE } from './_base';
 
 export interface MeshInterfaceSummary {
   name: string;
@@ -278,6 +278,31 @@ export interface EnrollResult {
 }
 
 /** Enrollment state of this node on the mesh control server. */
+export interface RegisteredNode {
+  success: boolean;
+  user?: string;
+  message: string;
+  node?: { id: string | null; name: string | null; ip_addresses: string[]; online: boolean } | null;
+}
+
+/**
+ * Approve a device that registered interactively.
+ *
+ * iOS has no other option: the upstream Tailscale app refuses pre-auth keys
+ * against a custom control server, so a phone always ends up on headscale's
+ * "run this on the server" page waiting for approval.
+ */
+export async function registerNode(authId: string, user?: string): Promise<RegisteredNode> {
+  const res = await apiFetch(`${API_BASE}/api/mesh/register-node`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ auth_id: authId, ...(user ? { user } : {}) }),
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(data.message || `register failed: ${res.status}`);
+  return data as RegisteredNode;
+}
+
 export async function fetchEnrollmentStatus(): Promise<EnrollmentStatus> {
   return get('/api/mesh/enrollment');
 }

package/frontend/src/components/TailnetEnroll.spec.tsx

@@ -4,9 +4,10 @@ import { TailnetEnroll } from './TailnetEnroll';
 
 vi.mock('../api/mesh', () => ({
   fetchNodes: vi.fn(),
+  fetchEnrollmentStatus: vi.fn(),
   mintPreAuthKey: vi.fn(),
 }));
-import { fetchNodes, mintPreAuthKey } from '../api/mesh';
+import { fetchNodes, fetchEnrollmentStatus, mintPreAuthKey } from '../api/mesh';
 
 const node = (over = {}) => ({
   hostname: 'laptop', ip: '100.64.0.3', online: true, self: false, os: 'macOS', ...over,
@@ -15,6 +16,7 @@ const node = (over = {}) => ({
 describe('TailnetEnroll', () => {
   beforeEach(() => {
     vi.mocked(fetchNodes).mockResolvedValue([node(), node({ hostname: 'macmini', ip: '100.64.0.2', self: true })] as never);
+    vi.mocked(fetchEnrollmentStatus).mockResolvedValue({ login_server: 'https://control.example.org' } as never);
     vi.mocked(mintPreAuthKey).mockResolvedValue({
       success: true,
       key: 'hskey-auth-TESTKEY',
@@ -26,17 +28,60 @@ describe('TailnetEnroll', () => {
     } as never);
   });
 
+  it('shows the control server and phone steps BEFORE any key is minted', async () => {
+    // The regression: instructions lived inside the `minted` branch behind a
+    // collapsed <details>, so step one -- the URL you must enter on the phone
+    // -- was invisible until a 15-minute countdown was already running.
+    render(<TailnetEnroll />);
+    expect(await screen.findByTestId('enroll-instructions')).toBeTruthy();
+    expect((await screen.findByTestId('enroll-login-server')).textContent).toContain(
+      'https://control.example.org',
+    );
+    expect(screen.getByText('On a phone (iOS)')).toBeTruthy();
+    expect(mintPreAuthKey).not.toHaveBeenCalled();
+  });
+
+  it('takes the control server from config, not from a minted key', async () => {
+    render(<TailnetEnroll />);
+    await waitFor(() =>
+      expect(screen.getByTestId('enroll-login-server').textContent).toContain('control.example.org'),
+    );
+    expect(fetchEnrollmentStatus).toHaveBeenCalled();
+  });
+
+  it('says what to do when no control server is configured', async () => {
+    vi.mocked(fetchEnrollmentStatus).mockResolvedValue({ login_server: null } as never);
+    render(<TailnetEnroll />);
+    await waitFor(() =>
+      expect(screen.getByTestId('enroll-login-server').textContent).toMatch(/not configured/i),
+    );
+  });
+
+  it('keeps the Reset Keychain step visible — skipping it is why sign-in reverts to the public service', async () => {
+    render(<TailnetEnroll />);
+    expect(await screen.findByText(/Reset Keychain/i)).toBeTruthy();
+  });
+
   it('lists mesh nodes', async () => {
     render(<TailnetEnroll />);
     await waitFor(() => expect(screen.getByTestId('enroll-node-list')).toHaveTextContent('laptop'));
     expect(screen.getByTestId('enroll-node-list')).toHaveTextContent('macmini');
   });
 
-  it('mints a key and shows the control server plus a QR to scan', async () => {
+  it('mints a key and shows a QR to scan', async () => {
+    render(<TailnetEnroll />);
+    fireEvent.click(screen.getByTestId('enroll-mint'));
+    await waitFor(() => expect(screen.getByTestId('enroll-qr').querySelector('svg')).toBeTruthy());
+    expect(screen.getByTestId('enroll-copy')).toBeTruthy();
+  });
+
+  it('config wins over the minted key for the control server URL', async () => {
+    // Deliberate precedence: the key echoes back whatever server issued it,
+    // but config is the source of truth and is available before any mint.
     render(<TailnetEnroll />);
     fireEvent.click(screen.getByTestId('enroll-mint'));
-    await waitFor(() => expect(screen.getByTestId('enroll-login-server')).toHaveTextContent('headscale.example.com'));
-    expect(screen.getByTestId('enroll-qr').querySelector('svg')).toBeTruthy();
+    await waitFor(() => expect(screen.getByTestId('enroll-copy')).toBeTruthy());
+    expect(screen.getByTestId('enroll-login-server')).toHaveTextContent('control.example.org');
   });
 
   it('passes the reusable and ephemeral choices through to the API', async () => {

package/frontend/src/components/TailnetEnroll.tsx

@@ -1,6 +1,6 @@
 import { useEffect, useState } from 'react';
 import { QRCodeSVG } from 'qrcode.react';
-import { fetchNodes, mintPreAuthKey } from '../api/mesh';
+import { fetchNodes, fetchEnrollmentStatus, mintPreAuthKey, registerNode } from '../api/mesh';
 import type { MeshNode, PreAuthKey } from '../api/mesh';
 
 /**
@@ -19,12 +19,23 @@ export function TailnetEnroll() {
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [copied, setCopied] = useState(false);
+  const [serverCopied, setServerCopied] = useState(false);
   const [secondsLeft, setSecondsLeft] = useState<number | null>(null);
+  // The control-server URL is the FIRST thing you need on the phone, and it is
+  // config, not a property of a key. Reading it only off a minted key meant the
+  // URL stayed invisible until a 15-minute countdown was already running.
+  const [controlServer, setControlServer] = useState<string | null>(null);
+  const [authId, setAuthId] = useState('');
+  const [approving, setApproving] = useState(false);
+  const [approved, setApproved] = useState<string | null>(null);
 
   useEffect(() => {
     fetchNodes()
       .then(setNodes)
       .catch((e) => setError(e?.message ?? 'could not load nodes'));
+    fetchEnrollmentStatus()
+      .then((st) => setControlServer(st.login_server))
+      .catch(() => setControlServer(null));
   }, []);
 
   // An enrollment key is a bearer credential with a short TTL. Show the time
@@ -53,8 +64,28 @@ export function TailnetEnroll() {
     }
   };
 
+  const approve = async () => {
+    setApproving(true);
+    setError(null);
+    setApproved(null);
+    try {
+      // Accept a pasted whole command as well as a bare id — the device shows
+      // the id inside `headscale nodes register --user X --key <id>`, and
+      // making someone extract a substring by hand is a needless failure.
+      const match = authId.match(/hskey-authreq-[A-Za-z0-9._-]+/);
+      const res = await registerNode(match ? match[0] : authId.trim());
+      setApproved(res.message);
+      setAuthId('');
+      setNodes(await fetchNodes().catch(() => nodes));
+    } catch (e) {
+      setError(e instanceof Error ? e.message : 'could not approve device');
+    } finally {
+      setApproving(false);
+    }
+  };
+
   const expired = secondsLeft !== null && secondsLeft <= 0;
-  const loginServer = minted?.login_server ?? null;
+  const loginServer = controlServer ?? minted?.login_server ?? null;
   // `complete` is the resolver's own verdict: false when the login account is
   // unknown and the node would refuse you. No resolved access at all counts as
   // unknown too. (There is no `ssh_user` field — the account is `user`.)
@@ -64,9 +95,129 @@ export function TailnetEnroll() {
     <section data-testid="tailnet-enroll" style={{ marginTop: 24 }}>
       <h3 style={{ marginBottom: 4 }}>Add a device to the tailnet</h3>
       <p style={{ fontSize: 12, opacity: 0.75, marginTop: 0 }}>
-        Mints a short-lived enrollment key for a phone, tablet, or another machine.
+        Point the device at this control server, then authenticate it with a short-lived key.
       </p>
 
+      {/*
+        Instructions come BEFORE the key and are open by default. They used to
+        live inside the `minted` branch behind a collapsed <details>, so the
+        control-server URL -- step one, and the thing you cannot proceed
+        without -- was invisible until a 15-minute countdown was already
+        running. Nothing here is hardcoded: the URL is whatever the brain's
+        config resolves to.
+      */}
+      <div
+        data-testid="enroll-instructions"
+        style={{ margin: '12px 0', padding: 14, borderRadius: 8, border: '1px solid var(--border)', background: 'var(--bg-secondary)' }}
+      >
+        <div style={{ fontSize: 12, marginBottom: 10 }}>
+          <strong>Control server</strong>
+          <div style={{ display: 'flex', gap: 8, alignItems: 'center', marginTop: 4 }}>
+            <code data-testid="enroll-login-server" style={{ wordBreak: 'break-all', flex: 1 }}>
+              {loginServer ?? 'not configured — set the Headscale URL in Secrets first'}
+            </code>
+            {loginServer && (
+              <button
+                type="button"
+                data-testid="enroll-copy-server"
+                onClick={() => { navigator.clipboard?.writeText(loginServer); setServerCopied(true); }}
+              >
+                {serverCopied ? 'Copied' : 'Copy'}
+              </button>
+            )}
+          </div>
+        </div>
+
+        {/*
+          Approving an interactively-registered device is the ONLY route that
+          works for iOS: the upstream Tailscale app refuses a pre-auth key when
+          pointed at a custom control server, so a phone always lands on
+          headscale's "run this command on the server" page. Until this panel
+          existed, finishing that required SSH and a CLI -- on the machine you
+          are not holding.
+        */}
+        <div
+          data-testid="enroll-approve"
+          style={{ margin: '0 0 12px', padding: 12, borderRadius: 8, border: '1px solid var(--border)' }}
+        >
+          <strong style={{ fontSize: 12 }}>Device waiting for approval?</strong>
+          <p style={{ fontSize: 12, opacity: 0.75, margin: '4px 0 8px' }}>
+            If a device shows “run the command below in the headscale server”, paste that whole line
+            (or just the <code>hskey-authreq-…</code> part) here.
+          </p>
+          <div style={{ display: 'flex', gap: 8, flexWrap: 'wrap' }}>
+            <input
+              type="text"
+              value={authId}
+              onChange={(e) => setAuthId(e.target.value)}
+              placeholder="hskey-authreq-…"
+              data-testid="enroll-authid"
+              style={{ flex: 1, minWidth: 220, fontFamily: 'var(--font-mono)', fontSize: 12 }}
+            />
+            <button
+              type="button"
+              onClick={approve}
+              disabled={approving || !authId.trim()}
+              data-testid="enroll-approve-btn"
+            >
+              {approving ? 'Approving…' : 'Approve device'}
+            </button>
+          </div>
+          {approved && (
+            <p data-testid="enroll-approved" style={{ fontSize: 12, color: '#10b981', margin: '8px 0 0' }}>
+              {approved}
+            </p>
+          )}
+        </div>
+
+        <details open style={{ fontSize: 12 }}>
+          <summary style={{ cursor: 'pointer', fontWeight: 600 }}>On a phone (iOS)</summary>
+          <ol style={{ paddingLeft: 18, lineHeight: 1.7, marginBottom: 6 }}>
+            <li>Install <strong>Tailscale</strong> from the App Store — <strong>1.38.1 or newer</strong>, the first release that supports an alternate control server.</li>
+            <li>
+              <strong>Sign out of Tailscale first.</strong> The alternate-server setting is only read while
+              the app is logged out.
+            </li>
+            <li>
+              Open <strong>iOS Settings</strong>, scroll past Game Center and TV Provider to{' '}
+              <strong>Tailscale</strong>, and put the control server above into{' '}
+              <strong>Alternate Coordination Server URL</strong>.
+            </li>
+            <li>
+              <strong>Turn on “Reset Keychain”.</strong> Treat this as required, not optional. The app keeps
+              its node key in the iOS keychain and will otherwise replay an old registration id forever —
+              force-quitting does not clear it, and the server rejects the stale id every time while the
+              phone keeps showing a page that looks perfectly valid.
+            </li>
+            <li>Force-quit Tailscale from the app switcher, then reopen it — the setting is read at launch.</li>
+            <li>Tap the plain <strong>Sign in</strong> option (not SSO). It should open this control server's page.</li>
+            <li>
+              The page will say <em>“run the command below in the headscale server”</em>. That is expected —
+              copy the line it shows and paste it into <strong>Device waiting for approval?</strong> above.
+              <strong> Do not use the enrollment key below on a phone:</strong> the Tailscale iOS app does not
+              accept pre-auth keys against a custom control server, so interactive sign-in plus approval here
+              is the only route that works.
+            </li>
+          </ol>
+          <p style={{ opacity: 0.75, margin: 0 }}>
+            The in-app route — account icon → <strong>Log in…</strong> → options menu →{' '}
+            <strong>Use custom coordination server</strong> — reaches the same place when it works, but that
+            menu has been reported unresponsive on some builds. The Settings route above is the reliable one.
+          </p>
+        </details>
+
+        <details style={{ fontSize: 12, marginTop: 8 }}>
+          <summary style={{ cursor: 'pointer', fontWeight: 600 }}>On Android</summary>
+          <ol style={{ paddingLeft: 18, lineHeight: 1.7, margin: '4px 0 0' }}>
+            <li>Install Tailscale from Google Play and make sure it is signed out.</li>
+            <li>Open the app, tap the account icon, then <strong>Log in…</strong>.</li>
+            <li>Open the top-right options menu → <strong>Use custom coordination server</strong>.</li>
+            <li>Enter the control server above. If it accepts the key below, use it; if it shows a
+                “run this command” page instead, approve it above like iOS.</li>
+          </ol>
+        </details>
+      </div>
+
       {error && (
         <div
           role="alert"
@@ -87,7 +238,7 @@ export function TailnetEnroll() {
           Ephemeral (drops off the list when offline)
         </label>
         <button type="button" onClick={mint} disabled={busy} data-testid="enroll-mint" style={{ cursor: busy ? 'wait' : 'pointer' }}>
-          {busy ? 'Minting…' : minted ? 'Mint another key' : 'Get enrollment key'}
+          {busy ? 'Minting…' : minted ? 'Mint another key' : 'Get enrollment key (computers)'}
         </button>
       </div>
 
@@ -104,11 +255,6 @@ export function TailnetEnroll() {
           </div>
 
           <div style={{ flex: 1, minWidth: 260 }}>
-            <div style={{ fontSize: 12, marginBottom: 6 }}>
-              <strong>Control server</strong>
-              <div><code data-testid="enroll-login-server">{loginServer ?? 'not configured'}</code></div>
-            </div>
-
             <div style={{ fontSize: 12, marginBottom: 6 }}>
               <strong>Enrollment key</strong>{' '}
               <span data-testid="enroll-ttl" style={{ opacity: 0.7 }}>
@@ -127,20 +273,6 @@ export function TailnetEnroll() {
               </div>
             </div>
 
-            <details style={{ fontSize: 12, marginTop: 10 }}>
-              <summary style={{ cursor: 'pointer' }}>On a phone (iOS / Android)</summary>
-              <ol style={{ paddingLeft: 18, lineHeight: 1.6 }}>
-                <li>Install Tailscale (iOS needs 1.38.1 or newer).</li>
-                <li>Account icon → <strong>Log in</strong> → options menu → <strong>Use custom coordination server</strong>.</li>
-                <li>Enter <code>{loginServer ?? 'your control server URL'}</code>.</li>
-                <li>Scan the QR or paste the key above when asked to authenticate.</li>
-              </ol>
-              <p style={{ opacity: 0.75 }}>
-                If that menu does not respond (reported on some 2026 iOS builds), set the same URL under
-                iOS Settings → Tailscale → <em>Alternate coordination server URL</em>.
-              </p>
-            </details>
-
             <details style={{ fontSize: 12, marginTop: 6 }}>
               <summary style={{ cursor: 'pointer' }}>On a computer</summary>
               <pre style={{ whiteSpace: 'pre-wrap', wordBreak: 'break-all' }}>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "total-recall-brain",
-  "version": "3.25.0",
+  "version": "3.25.2",
   "description": "Personal AI system — database-free, SSSS-powered intelligence engine deployable to any POSIX host.",
   "type": "module",
   "workspaces": [

package/scaffold/.agent/skills/total-recall/scripts/sync-repo.mjs

@@ -135,16 +135,30 @@ function writePreservingInjectedBlock(srcFile, dstFile) {
   return 'updated';
 }
 
+// Per-brain state a template must NEVER overwrite. memory-vault was always
+// here; the rest were not, and a sync across repos would have destroyed one
+// repo's 7 queued research topics and its 68-line skills catalog. If a file
+// records what THIS brain has done, it is state, not a template.
+const STATE_DIRS = new Set([
+  'memory-vault', 'memory-derived', 'memory-inbox', 'sessions', 'logs',
+  'scheduler', 'config', 'backups', 'browser-profile', 'skills-registry',
+  '.snapshots', '.git', 'node_modules',
+]);
+const STATE_FILES = new Set([
+  'research-queue.jsonl', 'daemon.pid', '.extension-connected', 'graph.canvas',
+]);
+
 function walk(dir) {
   const out = [];
   for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
     const p = path.join(dir, e.name);
     if (e.isDirectory()) {
-      // memory-vault is the user's own memory. A template must never overwrite it.
-      if (e.name === 'memory-vault' || e.name === 'memory-derived' || e.name === 'sessions') continue;
-      if (e.name === '.git' || e.name === 'node_modules') continue;
+      if (STATE_DIRS.has(e.name)) continue;
       out.push(...walk(p));
-    } else out.push(p);
+    } else {
+      if (STATE_FILES.has(e.name) || e.name.endsWith('.enc')) continue;
+      out.push(p);
+    }
   }
   return out;
 }

package/src/server/route-manifest.json

@@ -351,6 +351,10 @@
     "method": "POST",
     "path": "/api/mesh/preauthkey"
   },
+  {
+    "method": "POST",
+    "path": "/api/mesh/register-node"
+  },
   {
     "method": "GET",
     "path": "/api/network/audit"

package/src/server/routes/mesh.mjs

@@ -16,7 +16,15 @@ import {
   readSshConfig,
   resolveNodeAccess,
 } from '../../core/mesh-access.mjs';
-import { createHeadscalePreAuthKey, resolveHeadscaleConfig } from '../../core/headscale-client.mjs';
+import {
+  createHeadscalePreAuthKey,
+  resolveHeadscaleConfig,
+  resolveHeadscaleUser,
+  headscaleFetch,
+} from '../../core/headscale-client.mjs';
+
+// headscale rejects anything else with a 500; validate up front instead.
+const AUTH_REQUEST_PREFIX = 'hskey-authreq-';
 import { throttledFetch } from '../../core/throttled-fetch.mjs';
 import { defaultVaultRoot } from '../../core/vfs-documents.mjs';
 import {
@@ -304,6 +312,63 @@ router.post('/api/mesh/preauthkey', requireAuth, requireScope('config:write'), a
   }
 });
 
+/**
+ * POST /api/mesh/register-node
+ * Approve a device that registered interactively.
+ *
+ * This is the ONLY path that works for iOS. The upstream Tailscale iOS app
+ * does not accept a pre-auth key when pointed at a custom control server, so a
+ * phone always lands on headscale's "run this command on the server" page and
+ * waits for server-side approval. Without this endpoint that approval was only
+ * reachable over SSH + CLI, which is exactly the machine the user is not
+ * holding.
+ *
+ * Body: { auth_id, user? }
+ */
+router.post('/api/mesh/register-node', requireAuth, requireScope('config:write'), async (req, res) => {
+  try {
+    const authId = String(req.body?.auth_id || '').trim();
+    if (!authId) {
+      return res.status(400).json({ success: false, message: 'auth_id is required (the hskey-authreq-… value shown on the device)' });
+    }
+    // Fail with the fix rather than passing a malformed id through to a 500.
+    if (!authId.startsWith(AUTH_REQUEST_PREFIX)) {
+      return res.status(400).json({
+        success: false,
+        message: `that does not look like a registration id — expected it to start with "${AUTH_REQUEST_PREFIX}". `
+          + 'Copy the whole value from the device screen, not the surrounding command.',
+      });
+    }
+
+    const user = await resolveHeadscaleUser(BRAIN_DIR, req.body?.user);
+    const query = `?user=${encodeURIComponent(user)}&key=${encodeURIComponent(authId)}`;
+    const result = await headscaleFetch(`/api/v1/node/register${query}`, { method: 'POST' }, BRAIN_DIR);
+    const node = (typeof result === 'string' ? JSON.parse(result) : result)?.node ?? null;
+
+    res.json({
+      success: true,
+      user,
+      node: node && {
+        id: node.id ?? null,
+        name: node.name ?? node.givenName ?? null,
+        ip_addresses: node.ipAddresses ?? [],
+        online: node.online ?? false,
+      },
+      message: node?.name ? `${node.name} joined the tailnet.` : 'Device registered.',
+    });
+  } catch (err) {
+    const msg = String(err?.message || '');
+    // headscale answers 500 for an expired/unknown id; say so in those terms.
+    const stale = /not found|expired|invalid/i.test(msg);
+    res.status(stale ? 409 : 500).json({
+      success: false,
+      message: stale
+        ? 'That registration id is no longer valid — it expires quickly. Reopen sign-in on the device to get a fresh one.'
+        : msg || 'could not register device',
+    });
+  }
+});
+
 /**
  * This host's I/O capability profile for agent UI generation
  * (screen, touch, mic, speaker, keyboard, camera, headless, …).

package/scaffold/.agent/skills/total-recall/research-queue.jsonl

@@ -1,7 +0,0 @@
-{"id":"7478a515-ea8e-4360-93b8-a10cf0642d88","topic":"npm Registry API documentation and developer endpoints","status":"pending","priority":"medium","notes":"Consult official npm documentation for registry APIs, authentication, and package metadata without using raw key strings.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:58:08.631Z","updated_at":"2026-08-18T20:58:08.631Z","completed_at":null,"summary":{"id":"7478a515-ea8e-4360-93b8-a10cf0642d88","topic":"npm Registry API documentation and developer endpoints","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:58:08.631Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
-{"id":"f9757282-dad8-4c3b-b44d-c796555468c5","topic":"Supabase Client, Auth, and REST APIs","status":"pending","priority":"medium","notes":"Use official Supabase documentation to understand authentication, database, and storage API surfaces.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:57:04.280Z","updated_at":"2026-08-18T20:57:04.280Z","completed_at":null,"summary":{"id":"f9757282-dad8-4c3b-b44d-c796555468c5","topic":"Supabase Client, Auth, and REST APIs","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:57:04.280Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
-{"id":"e196b27d-c799-4e60-88d0-585c479b6053","topic":"Supabase Database, Auth, Storage, and Management APIs","status":"pending","priority":"medium","notes":"Consult official Supabase documentation for REST API, SDK, and platform integration; do not use raw secret key string.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:56:34.347Z","updated_at":"2026-08-18T20:56:34.347Z","completed_at":null,"summary":{"id":"e196b27d-c799-4e60-88d0-585c479b6053","topic":"Supabase Database, Auth, Storage, and Management APIs","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:56:34.347Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
-{"id":"f6c787c9-212c-4468-a276-5af7d7d78dbc","topic":"Supabase REST API and Client SDKs","status":"pending","priority":"medium","notes":"Use official Supabase documentation for client SDKs, REST API, Database, and Auth endpoints. Do not search using raw key values.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:56:21.400Z","updated_at":"2026-08-18T20:56:21.400Z","completed_at":null,"summary":{"id":"f6c787c9-212c-4468-a276-5af7d7d78dbc","topic":"Supabase REST API and Client SDKs","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:56:21.400Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
-{"id":"c95b76a3-9bd3-42fd-8c37-0765cabef6a8","topic":"Documenso document signing and template REST API","status":"pending","priority":"medium","notes":"Consult official Documenso documentation for REST API endpoints, document signing workflows, and API key authentication. Do not query using the raw key string.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:55:37.372Z","updated_at":"2026-08-18T20:55:37.372Z","completed_at":null,"summary":{"id":"c95b76a3-9bd3-42fd-8c37-0765cabef6a8","topic":"Documenso document signing and template REST API","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:55:37.372Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
-{"id":"9b1f9703-76c3-4743-916a-a3340c2b74f4","topic":"Claude Code messaging API and CLI integration","status":"pending","priority":"medium","notes":"Consult official Anthropic Claude Code documentation for API and integration details; do not use the raw key string.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:55:25.048Z","updated_at":"2026-08-18T20:55:25.048Z","completed_at":null,"summary":{"id":"9b1f9703-76c3-4743-916a-a3340c2b74f4","topic":"Claude Code messaging API and CLI integration","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:55:25.048Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
-{"id":"0efa65c2-0231-4267-a304-e0285e50011e","topic":"Total Recall repository improvement research: SSSS validated write pipeline, filesystem-native memory engines, local-first semantic indexing, Express 5 API hardening, 2026 agent memory architecture patterns","status":"pending","priority":"high","notes":"Queued from repo-wide analysis request on 2026-06-01. Focus on current best practices and meta-patterns for filesystem-native memory OS, validated operation envelopes, append-only logs, cache invalidation, research queue architecture, and secure local-first AI tools.","node_slug":null,"research_phase":"acquisition","created_at":"2026-06-01T06:07:40.102Z","updated_at":"2026-06-01T06:07:40.126Z","completed_at":null,"summary":{"id":"0efa65c2-0231-4267-a304-e0285e50011e","topic":"Total Recall repository improvement research: SSSS validated write pipeline, filesystem-native memory engines, local-first semantic indexing, Express 5 API hardening, 2026 agent memory architecture patterns","status":"pending","phase":"acquisition","last_updated":"2026-06-01T06:07:40.126Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}