total-recall-brain 3.41.6 → 3.42.0

package/scaffold/.agent/skills/total-recall/plugins/auth/src/secrets-store.mjs

@@ -80,6 +80,8 @@ export function mergeSecretMeta(prev = {}, patch = {}) {
   });
   assign('auto_rotate', (v) => !!v);
   assign('notes', (v) => (v == null || v === '' ? null : String(v)));
+  // The provider's id for the live key, so the next rotation can revoke it.
+  assign('provider_key_id', (v) => (v == null || v === '' ? null : String(v)));
   // The app-facing name a production key stands in for: GRO_CRM_TICKETS_SIGNING_SECRET
   // provides TICKETS_SIGNING_SECRET to the repos it is bound to (see resolveSecretKey).
   assign('provides', (v) => (v == null || v === '' ? null : String(v)));
@@ -270,6 +272,7 @@ export async function listSecretsMeta(brainDir) {
       provider: providerId,
       provider_name: catalog?.name || providerId,
       label: m.label || null,
+      provider_key_id: m.provider_key_id || null,
       repos,
       repo: repos.length === 1 ? repos[0] : null,
       multi_repo_error: false,

package/scaffold/.agent/skills/total-recall/plugins/code-quality/core/state.mjs

@@ -1,20 +1,28 @@
 /**
  * Where a repository keeps its code-quality state (config.json, reports, lock).
  * The runner itself lives in this plugin and is never copied into a repo.
- * TR_CODE_QUALITY_STATE overrides; otherwise the nearest enclosing
- * .agent/skills/code-quality directory, or one beside the current directory.
+ * TR_CODE_QUALITY_STATE overrides; otherwise state belongs to the nearest
+ * repository and is never inherited from another repository or the home skill.
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import os from 'node:os';
 
-export function stateDir(start = process.cwd()) {
-  if (process.env.TR_CODE_QUALITY_STATE) return path.resolve(process.env.TR_CODE_QUALITY_STATE);
-  let dir = path.resolve(start);
+export function stateDir(start = process.cwd(), env = process.env) {
+  if (env.TR_CODE_QUALITY_STATE) return path.resolve(env.TR_CODE_QUALITY_STATE);
+  const origin = path.resolve(start);
+  const home = path.resolve(env.HOME || os.homedir());
+  const stateAt = directory => path.join(directory, '.agent', 'skills', 'code-quality');
+  let dir = origin;
   for (;;) {
-    const candidate = path.join(dir, '.agent', 'skills', 'code-quality');
+    // A shared home skill supplies methods, never another project's configuration.
+    if (dir === home && dir !== origin) return stateAt(origin);
+    const candidate = stateAt(dir);
     if (fs.existsSync(candidate)) return candidate;
+    // Linked worktrees and submodules use a .git file instead of a directory.
+    if (fs.existsSync(path.join(dir, '.git'))) return candidate;
     const parent = path.dirname(dir);
-    if (parent === dir) return path.join(path.resolve(start), '.agent', 'skills', 'code-quality');
+    if (parent === dir) return stateAt(origin);
     dir = parent;
   }
 }

package/scaffold/.agent/skills/total-recall/plugins/code-quality/package-lock.json

@@ -12,7 +12,7 @@
         "@gregiteen/ssss-cli": "0.14.4"
       },
       "devDependencies": {
-        "total-recall-brain": "3.41.5"
+        "total-recall-brain": "3.41.6"
       }
     },
     "node_modules/@alcalzone/ansi-tokenize": {
@@ -5543,9 +5543,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.41.5",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.5.tgz",
-      "integrity": "sha512-gaW46xAtnFf+zfkv8LHYQLMzt27JjelyFggc8zAZafCnCJRbNSP8D02cbbcx49f3a70t/hkgA9RhJOY8HTqRFg==",
+      "version": "3.41.6",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.6.tgz",
+      "integrity": "sha512-ibJulU7/jxO9BwEzOaW54z9eBEQzanDfEFy8FS1yNnz/3QDhl9mqLFikLAXAlp34i5Ev4UC5KvjhNJa/sC49Rg==",
       "dev": true,
       "license": "MIT",
       "workspaces": [

package/scaffold/.agent/skills/total-recall/plugins/composable-cli/package-lock.json

@@ -12,7 +12,7 @@
         "@gregiteen/ssss-cli": "0.14.4"
       },
       "devDependencies": {
-        "total-recall-brain": "3.41.5"
+        "total-recall-brain": "3.41.6"
       }
     },
     "node_modules/@alcalzone/ansi-tokenize": {
@@ -5543,9 +5543,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.41.5",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.5.tgz",
-      "integrity": "sha512-gaW46xAtnFf+zfkv8LHYQLMzt27JjelyFggc8zAZafCnCJRbNSP8D02cbbcx49f3a70t/hkgA9RhJOY8HTqRFg==",
+      "version": "3.41.6",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.6.tgz",
+      "integrity": "sha512-ibJulU7/jxO9BwEzOaW54z9eBEQzanDfEFy8FS1yNnz/3QDhl9mqLFikLAXAlp34i5Ev4UC5KvjhNJa/sC49Rg==",
       "dev": true,
       "license": "MIT",
       "workspaces": [

package/scaffold/.agent/skills/total-recall/plugins/embeddings/package-lock.json

@@ -12,7 +12,7 @@
         "@gregiteen/ssss-cli": "0.14.4"
       },
       "devDependencies": {
-        "total-recall-brain": "3.41.5"
+        "total-recall-brain": "3.41.6"
       }
     },
     "node_modules/@alcalzone/ansi-tokenize": {
@@ -5539,9 +5539,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.41.5",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.5.tgz",
-      "integrity": "sha512-gaW46xAtnFf+zfkv8LHYQLMzt27JjelyFggc8zAZafCnCJRbNSP8D02cbbcx49f3a70t/hkgA9RhJOY8HTqRFg==",
+      "version": "3.41.6",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.6.tgz",
+      "integrity": "sha512-ibJulU7/jxO9BwEzOaW54z9eBEQzanDfEFy8FS1yNnz/3QDhl9mqLFikLAXAlp34i5Ev4UC5KvjhNJa/sC49Rg==",
       "dev": true,
       "license": "MIT",
       "workspaces": [

package/scaffold/.agent/skills/total-recall/plugins/git-sentinel/package-lock.json

@@ -12,7 +12,7 @@
         "@gregiteen/ssss-cli": "0.14.4"
       },
       "devDependencies": {
-        "total-recall-brain": "3.41.5",
+        "total-recall-brain": "3.41.6",
         "vitest": "^4.1.10"
       }
     },
@@ -6533,9 +6533,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.41.5",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.5.tgz",
-      "integrity": "sha512-gaW46xAtnFf+zfkv8LHYQLMzt27JjelyFggc8zAZafCnCJRbNSP8D02cbbcx49f3a70t/hkgA9RhJOY8HTqRFg==",
+      "version": "3.41.6",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.6.tgz",
+      "integrity": "sha512-ibJulU7/jxO9BwEzOaW54z9eBEQzanDfEFy8FS1yNnz/3QDhl9mqLFikLAXAlp34i5Ev4UC5KvjhNJa/sC49Rg==",
       "dev": true,
       "license": "MIT",
       "workspaces": [

package/scaffold/.agent/skills/total-recall/plugins/mesh/package-lock.json

@@ -15,7 +15,7 @@
       "devDependencies": {
         "jsdom": "^29.1.1",
         "supertest": "^7.3.1",
-        "total-recall-brain": "3.41.5",
+        "total-recall-brain": "3.41.6",
         "vitest": "^4.1.12"
       }
     },
@@ -7177,9 +7177,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.41.5",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.5.tgz",
-      "integrity": "sha512-gaW46xAtnFf+zfkv8LHYQLMzt27JjelyFggc8zAZafCnCJRbNSP8D02cbbcx49f3a70t/hkgA9RhJOY8HTqRFg==",
+      "version": "3.41.6",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.6.tgz",
+      "integrity": "sha512-ibJulU7/jxO9BwEzOaW54z9eBEQzanDfEFy8FS1yNnz/3QDhl9mqLFikLAXAlp34i5Ev4UC5KvjhNJa/sC49Rg==",
       "dev": true,
       "license": "MIT",
       "workspaces": [

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/README.md

@@ -1,14 +1,16 @@
-# Command Fleet
+# Meta Harness
 
-All nine adapters share one plugin: Claude Code, Codex, Antigravity, Cursor,
-DSH, Grok, Muse, Pi and Hermes. `runtime <agent> ...` exposes their native runtime
-commands; DSH observations and Hermes gateway management live here as well.
+Built-in and validated custom adapters share one plugin. `runtime <agent> ...`
+exposes native runtime commands; DSH observations and Hermes gateway management
+live here as well. `meta-harness` is the primary namespace; `cli-agents` is an alias.
 
 `total-recall cli-agents setup` connects all nine native instruction surfaces.
 The declared setup operation also runs during daemon-owned plugin refresh.
-Every dispatched agent receives a freshly checked Total Recall context, complete
-core help, installed plugin operations and composed commands. Setup failure or
-an unready context stops dispatch.
+Every dispatched agent receives freshly assembled Total Recall task context and
+a preflight receipt. The configured context budget is honored. Complete CLI,
+plugin and composed-command inventories are supplied in a private temporary
+reference file, keeping their full metadata out of the inline prompt. That file
+is removed after execution. Setup failure or an unready context stops dispatch.
 
 `docs-refresh`, `docs-ensure`, `docs-status`, `docs-read` and `docs-search` manage
 downloaded official documentation rather than a list of links. Content is hashed,
@@ -63,3 +65,45 @@ A completed model turn is distinct from a completed plugin operation. Structured
 | Hermes | [Official command reference](https://github.com/NousResearch/hermes-agent/blob/main/website/docs/reference/cli-commands.md) |
 
 Cursor discovery uses `cursor-agent`; an ambiguous `agent` binary is not assumed to be Cursor. Missing installations are listed as unavailable. Unknown authentication requires explicit agent selection and remains unverified until a real run. Tests exercise literal stdin, bounded child-process cleanup, command admission, recorded SSH access, account checks and completed-result parsing. Run suites on the configured sanctioned test node.
+
+## Isolated task workflows
+
+```sh
+total-recall meta-harness route "describe the task" --json
+total-recall meta-harness route "describe the task" --execute --gate --background --json
+total-recall meta-harness coordinate "describe the task" --mode pipeline --execute --gate --background --json
+total-recall meta-harness review --staged --author <author-harness> --json
+```
+
+Pipeline stages use isolated branches and independent verification. Council
+assessments run concurrently; race candidates require a passing deterministic
+gate. Failed stages stop subsequent work and clean failed checkouts. Deliverable
+branches remain available for review and are never merged automatically. Empty
+diffs return `NO_DIFF`; unreadable reviews never become approvals. Unknown login
+state requires explicit `--allow-unknown-auth`.
+
+Single-agent remote commands use recorded mesh access and an explicit absolute
+workspace. Coordinated isolated work and gates reject unsupported remote placement;
+remote worktree/gate transport remains an acceptance gap.
+
+All agent dispatch paths, including agent-mediated plugin commands, append native
+SSSS execution receipts. Actual process exit and finish metadata are distinct from
+verification results; unavailable model metadata remains null. Thread operations
+include list, show, create, update, close and delete, using native SSSS state.
+
+Custom adapter declarations preserve scoped credentials, optional authentication
+probes and HTTPS documentation URLs. IDs and paths reject traversal and symbolic
+links. Credentials reach only the declaring runner through the auth store. A
+changed documentation URL invalidates old cache freshness.
+
+## Verification status
+
+The active five-file suite and evidence live in
+`docs/projects/in-progress/META_HARNESS_UNIFICATION/`. Completion requires current
+owner/core suites, plugin/scaffold validation, real dashboard inspection and
+recorded acceptance evidence. Fixture tests do not certify live accounts, remote
+execution or recurring maintenance. The operator requires completing verification
+before Meta Harness runs task work.
+
+Cloudroom setup material remains under `cloudroom/`. Its plugin implementation
+follows this foundation and requires its own current audit and plan.

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/cli.mjs

@@ -3,7 +3,7 @@ import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { pathToFileURL } from 'node:url';
 import { configDir } from './src/paths.mjs';
-import { inspectAgents, getActiveAdapters, getCustomAdaptersDirs, loadCustomAdapters } from './src/worker.mjs';
+import { inspectAgents, getActiveAdapters, getCustomAdaptersDirs, loadCustomAdapters, validateCustomAdapter, adapterPath } from './src/worker.mjs';
 import { inspectNode, listTargets, executeCommand, executeOnNode } from './src/executor.mjs';
 import { DOC_SOURCES, documentationStatus, refreshDocumentation, ensureDocumentation, maintainDocumentation, readDocumentation, searchDocumentation } from './src/documentation.mjs';
 import { manageRuntime } from './src/runtime.mjs';
@@ -15,12 +15,13 @@ import { executeRoutedTask } from './src/cascade.mjs';
 import { dispatchWithReceipt } from './src/dispatch.mjs';
 import { resolvePool } from './src/pool.mjs';
 import { checkAlerts, notifyAlert } from './src/alerts.mjs';
-import { learnFromHistory } from './src/learner.mjs';
+import { learnFromHistory, voidReceipts } from './src/learner.mjs';
 import { decomposeTask } from './capability/index.mjs';
-import { listThreads, getThread, createThread, closeThread, deleteThread } from './src/threads.mjs';
+import { listThreads, getThread, createThread, updateThread, closeThread, deleteThread } from './src/threads.mjs';
 import { executeCodeReview } from './src/review.mjs';
+import { stopOnTermination } from './src/termination.mjs';
 
-const VALUE_FLAGS = ['--node', '--mode', '--orchestrator', '--branch', '--reviewer', '--thread', '--status', '--platform', '--agent', '--url', '--query', '--tier', '--threshold', '--author', '--explorer', '--architect', '--implementer', '--verifier'];
+const VALUE_FLAGS = ['--node', '--mode', '--orchestrator', '--branch', '--reviewer', '--thread', '--status', '--platform', '--agent', '--url', '--query', '--tier', '--threshold', '--author', '--explorer', '--architect', '--implementer', '--verifier', '--title', '--summary', '--cwd', '--tools', '--setting-sources', '--model', '--name', '--tail', '--timeout-ms', '--void', '--reason'];
 export function parseArguments(args) {
   const positional = [];
   for (let index = 1; index < args.length; index += 1) {
@@ -37,6 +38,7 @@ export function parseArguments(args) {
 }
 
 export async function run(argv = []) {
+  stopOnTermination();
   try { await runOperation(argv); }
   catch (error) {
     const message = String(error?.message || error);
@@ -47,22 +49,30 @@ export async function run(argv = []) {
 }
 
 /** The host stops a plugin command after 10 minutes, so long runs detach and report through their thread and log. */
-function detachRun(argv) {
+async function detachRun(argv) {
   const directory = path.join(configDir(), 'jobs');
   fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
   const log = path.join(directory, `${Date.now().toString(36)}.log`);
   const output = fs.openSync(log, 'a', 0o600);
   const entry = new URL('./cli.mjs', import.meta.url).href;
   const child = spawn(process.execPath, ['--input-type=module', '-e', `import(${JSON.stringify(entry)}).then(m=>m.run(${JSON.stringify(argv.filter(arg => arg !== '--background'))}))`], { cwd: process.cwd(), detached: true, stdio: ['ignore', output, output], env: process.env });
-  child.unref();
-  fs.closeSync(output);
-  return { ok: true, background: true, pid: child.pid, log, follow: 'total-recall meta-harness threads list --json' };
+  try {
+    await new Promise((resolve, reject) => { child.once('spawn', resolve); child.once('error', reject); });
+    child.unref();
+  } finally { fs.closeSync(output); }
+  return { ok: true, background: true, pid: child.pid, log, follow: `The final JSON result is written to ${log}; a pipeline also records a thread.` };
 }
 
 async function runOperation(argv) {
   const args = argv.slice(3); const operation = args[0] || 'status';
   const { positional, value, has } = parseArguments(args);
-  if (has('--background') && ['route', 'coordinate', 'orchestrate'].includes(operation) && has('--execute')) { console.log(JSON.stringify(detachRun(argv))); return; }
+  const remoteTimeout = () => {
+    const raw = value('--timeout-ms');
+    if (raw === undefined) return {};
+    const timeoutMs = Number(raw);
+    if (!Number.isInteger(timeoutMs)) throw new Error('--timeout-ms must be a whole number of milliseconds');
+    return { timeoutMs };
+  };
   // Help anywhere in the arguments prints usage; it must never run an operation.
   if (operation === 'help' || args.some(arg => arg === '--help' || arg === '-h')) {
     const manifest=JSON.parse(fs.readFileSync(new URL('./plugin.json',import.meta.url),'utf8'));
@@ -70,8 +80,9 @@ async function runOperation(argv) {
     for(const command of manifest.cli.subcommands)console.log(`  ${command.name} ${(command.args || []).map(arg=>arg.flag?`${arg.flag} <${arg.name}>`:`<${arg.name}>`).join(' ')} — ${command.description}`);
     return;
   }
+  if (has('--background') && ['route', 'coordinate', 'orchestrate'].includes(operation) && has('--execute')) { console.log(JSON.stringify(await detachRun(argv))); return; }
   let result;
-  if (operation === 'status') result = {...await inspectAgents(),documentation:documentationStatus()};
+  if (operation === 'status') result = {...await inspectNode(value('--node') || 'local'),documentation:documentationStatus()};
   else if (operation === 'catalog') result = { adapters: getActiveAdapters(), permissions: ['read', 'write', 'send', 'destructive'] };
   else if (operation === 'nodes') result = await listTargets();
   else if (operation === 'quota') result = await inspectQuotas({ node: value('--node') || 'local' });
@@ -79,14 +90,14 @@ async function runOperation(argv) {
   else if (operation === 'route') {
     const task = positional.join(' ');
     if (!task) throw new Error('route requires a task description');
-    const options = { jev: has('--jev'), preferLocal: has('--prefer-local'), preferFrontier: has('--prefer-frontier') };
+    const options = { jev: has('--jev'), preferLocal: has('--prefer-local'), preferFrontier: has('--prefer-frontier'), node: value('--node'), cwd: value('--cwd'), allowUnknownAuth: has('--allow-unknown-auth'), ...remoteTimeout() };
     result = has('--execute') ? await executeRoutedTask(task, { ...options, gate: has('--gate'), gateOptions: { tier: value('--tier') || 'fast' } }) : await routeTask(task, options);
     if (!result.ok) process.exitCode = 1;
   }
   else if (operation === 'decompose') {
     const task = positional.join(' ');
     if (!task) throw new Error('decompose requires a task description');
-    const pool = await resolvePool();
+    const pool = await resolvePool({ allowUnknownAuth: has('--allow-unknown-auth') });
     result = { ...decomposeTask(task, { availableHarnesses: pool.ready.map(h => h.id) }), excluded: pool.excluded };
   }
   else if (operation === 'coordinate' || operation === 'orchestrate') {
@@ -95,6 +106,7 @@ async function runOperation(argv) {
     result = await coordinateTask(task, {
       mode: value('--mode') || 'pipeline', execute: has('--execute'), orchestrator: value('--orchestrator'), explorer: value('--explorer'), architect: value('--architect'), implementer: value('--implementer'), verifier: value('--verifier'),
       branch: value('--branch'), subagents: !has('--no-subagents'), autoReview: has('--auto-review'), gate: has('--gate'), gateOptions: { tier: value('--tier') || 'fast' }, allowSameFamily: has('--allow-same-family'), reviewer: value('--reviewer'),
+      node: value('--node') || 'local', cwd: value('--cwd'), allowUnknownAuth: has('--allow-unknown-auth'), ...remoteTimeout(),
     });
     if (!result.ok) process.exitCode = 1;
   }
@@ -113,14 +125,18 @@ async function runOperation(argv) {
       result = getThread(id);
       if (!result) throw new Error(`Thread not found: ${id}`);
     } else if (sub === 'create') {
-      const title = args.slice(2).filter(a => !a.startsWith('--')).join(' ');
-      const platformIdx = args.indexOf('--platform');
-      const branchIdx = args.indexOf('--branch');
+      const title = value('--title') || positional.slice(1).join(' ');
       result = createThread({
         title: title || 'New Agent Thread',
-        platform: platformIdx >= 0 ? args[platformIdx + 1] : 'universal',
-        branch: branchIdx >= 0 ? args[branchIdx + 1] : null
+        platform: value('--platform') || 'universal',
+        branch: value('--branch') || null
       });
+    } else if (sub === 'update') {
+      const id = positional[1];
+      if (!id) throw new Error('threads update requires a thread id');
+      const patch = Object.fromEntries(['title', 'status', 'platform', 'branch', 'summary'].map(key => [key, value(`--${key}`)]).filter(([, entry]) => entry !== undefined));
+      if (!Object.keys(patch).length) throw new Error('threads update requires at least one field');
+      result = updateThread(id, patch);
     } else if (sub === 'close') {
       const id = args[2];
       if (!id) throw new Error('threads close requires a thread id');
@@ -134,11 +150,13 @@ async function runOperation(argv) {
     }
   }
   else if (operation === 'review') {
-    result = await executeCodeReview({ target: positional[0] || null, reviewer: value('--reviewer'), author: value('--author'), threadId: value('--thread'), staged: has('--staged') });
+    result = await executeCodeReview({ target: positional[0] || null, reviewer: value('--reviewer'), author: value('--author'), threadId: value('--thread'), staged: has('--staged'), node: value('--node') || 'local', cwd: value('--cwd'), allowUnknownAuth: has('--allow-unknown-auth'), ...remoteTimeout() });
     if (!result.ok) process.exitCode = 1;
   }
   else if (operation === 'learn') {
-    result = await learnFromHistory({ emit: has('--emit') });
+    result = value('--void') !== undefined
+      ? await voidReceipts({ ids: String(value('--void')).split(',').map(id => id.trim()).filter(Boolean), reason: value('--reason') })
+      : await learnFromHistory({ emit: has('--emit') });
     if (!result.ok) process.exitCode = 1;
   }
   else if (operation === 'alerts') {
@@ -165,11 +183,11 @@ async function runOperation(argv) {
       } catch {
         throw new Error('Invalid adapter JSON specification');
       }
-      if (!spec.id || !spec.binary) throw new Error('Adapter specification must define id and binary');
+      spec = validateCustomAdapter(spec);
       const dirs = getCustomAdaptersDirs();
       fs.mkdirSync(dirs[0], { recursive: true });
-      const dest = path.join(dirs[0], `${spec.id}.json`);
-      fs.writeFileSync(dest, JSON.stringify(spec, null, 2), 'utf8');
+      const dest = adapterPath(dirs[0], spec.id);
+      fs.writeFileSync(dest, JSON.stringify(spec, null, 2), { encoding: 'utf8', mode: 0o600, flag: 'wx' });
       result = { ok: true, added: spec.id, path: dest };
     } else if (sub === 'remove') {
       const id = args[2];
@@ -177,14 +195,15 @@ async function runOperation(argv) {
       const dirs = getCustomAdaptersDirs();
       let removed = false;
       for (const d of dirs) {
-        const dest = path.join(d, `${id}.json`);
+        const dest = adapterPath(d, id);
         if (fs.existsSync(dest)) {
           fs.unlinkSync(dest);
           removed = true;
         }
       }
       result = { ok: removed, removed: id };
-    }
+      if (!removed) process.exitCode = 1;
+    } else throw new Error(`Unsupported adapter operation: ${sub}`);
   }
   else if(operation==='docs-sources')result={sources:DOC_SOURCES};
   else if(operation==='docs-read' || operation==='docs-search') {
@@ -218,8 +237,31 @@ async function runOperation(argv) {
     result = node==='local' ? await manageRuntime(agent,runtimeArgs) : await executeOnNode(node,{operation:'direct',cwd:process.cwd(),argv:['total-recall','meta-harness','runtime',agent,...runtimeArgs,'--json']});
     if(!result.ok)process.exitCode=1;
   }
+  else if (operation === 'process') {
+    const processes = await import('./src/process-manager.mjs');
+    const [action = 'list', target, ...task] = positional;
+    if (action === 'list') result = { ok: true, agents: processes.listAgents() };
+    else if (action === 'status') {
+      result = processes.listAgents().find(record => record.id === target || String(record.pid) === target);
+      if (!result) throw new Error('Managed process not found');
+    } else if (action === 'spawn') {
+      if (!target || !task.length) throw new Error('process spawn requires a harness and task');
+      result = await processes.spawnAgent(target, task.join(' '), {
+        node: value('--node') || 'local', cwd: value('--cwd'), name: value('--name'),
+        tools: value('--tools'), settingSources: value('--setting-sources'), model: value('--model'),
+        detach: !has('--no-detach'), write: !has('--read-only'), allowUnknownAuth: has('--allow-unknown-auth'),
+      });
+      if (result.status === 'failed') process.exitCode = 1;
+    } else if (action === 'kill') {
+      if (!target) throw new Error('process kill requires a managed process id');
+      result = await processes.killAgent(target);
+    } else if (action === 'logs') {
+      if (!target) throw new Error('process logs requires a managed process id');
+      result = { ok: true, logs: await processes.getAgentLogs(target, Number(value('--tail') || 50)) };
+    } else throw new Error(`Unsupported process operation: ${action}`);
+  }
   else if(operation==='dispatch') {
-    if(!args.includes('--stdin'))throw new Error('Task requests must arrive through stdin');
+    if(!args.includes('--stdin'))throw new Error('Task requests must arrive through stdin: pass --stdin with JSON {agent, cwd, prompt}');
     const input=fs.readFileSync(0,'utf8');if(Buffer.byteLength(input)>65536)throw new Error('Task request too large');
     const request=JSON.parse(input);
     result=await dispatchWithReceipt({...request,allowUnknownAuth:request.allowUnknownAuth===true},{node:request.node || 'local',role:'Dispatch'});

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/package-lock.json

@@ -11,7 +11,7 @@
         "@gregiteen/ssss-cli": "0.14.4"
       },
       "devDependencies": {
-        "total-recall-brain": "3.41.5"
+        "total-recall-brain": "3.41.6"
       }
     },
     "node_modules/@alcalzone/ansi-tokenize": {
@@ -5546,9 +5546,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.41.5",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.5.tgz",
-      "integrity": "sha512-gaW46xAtnFf+zfkv8LHYQLMzt27JjelyFggc8zAZafCnCJRbNSP8D02cbbcx49f3a70t/hkgA9RhJOY8HTqRFg==",
+      "version": "3.41.6",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.6.tgz",
+      "integrity": "sha512-ibJulU7/jxO9BwEzOaW54z9eBEQzanDfEFy8FS1yNnz/3QDhl9mqLFikLAXAlp34i5Ev4UC5KvjhNJa/sC49Rg==",
       "dev": true,
       "license": "MIT",
       "workspaces": [

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/plugin.json

@@ -308,7 +308,12 @@
             "flag": "--tier",
             "type": "string",
             "label": "Gate tier: fast | full | remote"
-          }
+          },
+          { "name": "cwd", "flag": "--cwd", "type": "string", "label": "Explicit workspace on the selected node" },
+          { "name": "node", "flag": "--node", "type": "string", "label": "Selected mesh node" },
+          { "name": "allowUnknownAuth", "flag": "--allow-unknown-auth", "type": "boolean", "label": "Explicitly allow a runner without a login probe" },
+          { "name": "background", "flag": "--background", "type": "boolean", "label": "Return the owned job and log for a long run" },
+          { "name": "timeoutMs", "flag": "--timeout-ms", "type": "number", "label": "Remote wall-clock limit in milliseconds" }
         ]
       },
       {
@@ -353,7 +358,12 @@
             "flag": "--allow-same-family",
             "type": "boolean",
             "label": "Accept a Verifier from the Implementer's model family"
-          }
+          },
+          { "name": "cwd", "flag": "--cwd", "type": "string", "label": "Explicit workspace on the selected node" },
+          { "name": "node", "flag": "--node", "type": "string", "label": "Selected mesh node" },
+          { "name": "allowUnknownAuth", "flag": "--allow-unknown-auth", "type": "boolean", "label": "Explicitly allow a runner without a login probe" },
+          { "name": "background", "flag": "--background", "type": "boolean", "label": "Return the owned job and log for a long run" },
+          { "name": "timeoutMs", "flag": "--timeout-ms", "type": "number", "label": "Remote wall-clock limit in milliseconds" }
         ],
         "timeout_ms": 600000
       },
@@ -368,7 +378,9 @@
             "flag": "--emit",
             "type": "boolean",
             "label": "Write proposals through the memory owner"
-          }
+          },
+          { "name": "void", "flag": "--void", "type": "string", "label": "Comma-separated receipt ids to void" },
+          { "name": "reason", "flag": "--reason", "type": "string", "label": "Why the receipts are void" }
         ]
       },
       {
@@ -467,7 +479,7 @@
           {
             "name": "action",
             "type": "string",
-            "label": "list | show | create | close | delete",
+            "label": "list | show | create | update | close | delete",
             "required": true,
             "positional": true
           },
@@ -476,7 +488,34 @@
             "type": "string",
             "label": "Thread ID or title",
             "positional": true
-          }
+          },
+          { "name": "title", "flag": "--title", "type": "string", "label": "Thread title" },
+          { "name": "summary", "flag": "--summary", "type": "string", "label": "Thread summary" },
+          { "name": "status", "flag": "--status", "type": "string", "label": "Lifecycle status or list filter" },
+          { "name": "platform", "flag": "--platform", "type": "string", "label": "Harness platform or list filter" },
+          { "name": "branch", "flag": "--branch", "type": "string", "label": "Deliverable branch" }
+        ]
+      },
+      {
+        "name": "process",
+        "description": "Manage owned agent processes through isolated dispatch and SSSS lifecycle records",
+        "effect": "write",
+        "output": "json",
+        "timeout_ms": 600000,
+        "args": [
+          { "name": "action", "type": "string", "positional": true, "label": "list | status | spawn | kill | logs" },
+          { "name": "target", "type": "string", "positional": true, "label": "Harness to spawn or managed process ID" },
+          { "name": "task", "type": "string", "positional": true, "label": "Task for a spawned agent" },
+          { "name": "node", "type": "string", "flag": "--node", "label": "Recorded mesh node" },
+          { "name": "cwd", "type": "string", "flag": "--cwd", "label": "Explicit workspace on the selected node" },
+          { "name": "name", "type": "string", "flag": "--name", "label": "Managed process label" },
+          { "name": "tools", "type": "string", "flag": "--tools", "label": "Supported tool restriction" },
+          { "name": "settingSources", "type": "string", "flag": "--setting-sources", "label": "Supported instruction setting sources" },
+          { "name": "model", "type": "string", "flag": "--model", "label": "Explicit configured model selection" },
+          { "name": "tail", "type": "number", "flag": "--tail", "label": "Log tail line count" },
+          { "name": "readOnly", "type": "boolean", "flag": "--read-only", "label": "Disable code writes" },
+          { "name": "noDetach", "type": "boolean", "flag": "--no-detach", "label": "Await the managed process result" },
+          { "name": "allowUnknownAuth", "type": "boolean", "flag": "--allow-unknown-auth", "label": "Explicitly allow an unknown login state" }
         ]
       },
       {
@@ -514,7 +553,11 @@
             "flag": "--thread",
             "type": "string",
             "label": "Thread to attach the review to"
-          }
+          },
+          { "name": "cwd", "flag": "--cwd", "type": "string", "label": "Explicit workspace on the selected node" },
+          { "name": "node", "flag": "--node", "type": "string", "label": "Selected mesh node" },
+          { "name": "allowUnknownAuth", "flag": "--allow-unknown-auth", "type": "boolean", "label": "Explicitly allow a runner without a login probe" },
+          { "name": "timeoutMs", "flag": "--timeout-ms", "type": "number", "label": "Remote wall-clock limit in milliseconds" }
         ],
         "timeout_ms": 600000
       }
@@ -526,6 +569,9 @@
       "documentation": "src/documentation.mjs",
       "agent-runtime": "src/runtime.mjs",
       "tracker": "src/tracker.mjs",
+      "harness-compat": "src/compat-harness.mjs",
+      "reasoning-runtime": "src/reasoning.mjs",
+      "process-manager": "src/process-manager.mjs",
       "gate-adapters": "src/gate-adapters/index.mjs"
     },
     "setup_command": "setup"

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/skills/meta-harness/SKILL.md

@@ -12,7 +12,7 @@ Coordinates coding agent harnesses across mesh nodes. `cli-agents` is an alias o
 1. **Believe the status words.** `ready` was proved by a login probe. `unverified` has no probe, so only a completed run proves it. `needs_auth`, `blocked` and `exhausted` cannot take work; the reason is in `quotaNote` and in `excluded`.
 2. **No figure without a source.** `benchmarks` shows only fetched figures with their source and time. A dash means nobody measured it. Adapter quality and cost scores are configured priors, not measurements.
 3. **Writing happens on a branch.** `route --execute`, `coordinate --execute` and race work in their own worktree on a `meta-harness/...` branch. Nothing merges into your branch; review the branch and merge it yourself.
-4. **Long runs go to the background.** The host stops plugin commands after 10 minutes, so add `--background` to any multi-stage `--execute` and follow it with `threads list`.
+4. **Long runs go to the background.** The host stops plugin commands after 10 minutes, so add `--background` to any multi-stage `--execute`. It prints a log path that receives the final JSON, and a pipeline also records a thread. Stopping a run stops its agents and removes its worktrees, unfinished branches and open thread. A remote job (`--node` with an absolute `--cwd`) has a one-hour budget; `--timeout-ms` changes it.
 5. **Cost.** dsh, hermes and other metered harnesses bill per token, and `route` warns when it picks one. `--jev` also makes a metered call.
 
 ## Commands