total-recall-brain 3.43.3 → 3.44.0

package/scaffold/.agent/skills/total-recall/plugins/embeddings/package-lock.json

@@ -1,18 +1,18 @@
 {
   "name": "tr-plugin-embeddings",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-embeddings",
-      "version": "0.1.2",
+      "version": "0.1.3",
       "license": "MIT",
       "dependencies": {
-        "@gregiteen/ssss-cli": "0.14.4"
+        "@gregiteen/ssss-cli": "0.14.5"
       },
       "devDependencies": {
-        "total-recall-brain": "3.42.1"
+        "total-recall-brain": "3.43.3"
       }
     },
     "node_modules/@alcalzone/ansi-tokenize": {
@@ -715,9 +715,9 @@
       "license": "MIT"
     },
     "node_modules/@gregiteen/ssss-cli": {
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "license": "ISC",
       "bin": {
         "ssss": "scripts/ssss.mjs"
@@ -1590,9 +1590,9 @@
     },
     "node_modules/@ssss/cli": {
       "name": "@gregiteen/ssss-cli",
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -5539,9 +5539,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.42.1",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.42.1.tgz",
-      "integrity": "sha512-woH7mdkGwPFYlKPZurhE8L3BPe+cSeIruNGaPOjGZJm/O8C92Bbr1gsdOY0tTLg5QHlgPHcXG1GMtsm9lPDz8w==",
+      "version": "3.43.3",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.43.3.tgz",
+      "integrity": "sha512-yjfPN/BQxEEa+iodyFXQov/6fRt1pZg/7RcmgsbpALwBt6Ki3JJjT3tzArBC7NxHQmXgGYyKnCYId6xe/W2rPg==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -5572,6 +5572,7 @@
         "antigravity": "bin/antigravity.mjs",
         "total-recall": "bin/total-recall.mjs",
         "total-recall-memory": "bin/total-recall-memory.mjs",
+        "total-recall-server-release": "bin/total-recall-server-release.mjs",
         "vibebrain": "bin/total-recall.mjs"
       },
       "optionalDependencies": {

package/scaffold/.agent/skills/total-recall/plugins/embeddings/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-embeddings",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
   "description": "Local embedding model management: provider/model status, benchmark, index build and coverage",
   "scripts": {
@@ -16,9 +16,9 @@
     "ui/"
   ],
   "dependencies": {
-    "@gregiteen/ssss-cli": "0.14.4"
+    "@gregiteen/ssss-cli": "0.14.5"
   },
   "overrides": {
-    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.4"
+    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.5"
   }
 }

package/scaffold/.agent/skills/total-recall/plugins/embeddings/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "embeddings",
   "name": "Embeddings",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Local embedding model management: provider/model status, benchmark, index build and coverage",
   "license": "MIT",
   "branding": {

package/scaffold/.agent/skills/total-recall/plugins/git-sentinel/package-lock.json

@@ -1,18 +1,18 @@
 {
   "name": "tr-plugin-git-sentinel",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-git-sentinel",
-      "version": "1.1.4",
+      "version": "1.1.5",
       "license": "MIT",
       "dependencies": {
-        "@gregiteen/ssss-cli": "0.14.4"
+        "@gregiteen/ssss-cli": "0.14.5"
       },
       "devDependencies": {
-        "total-recall-brain": "3.42.1",
+        "total-recall-brain": "3.43.3",
         "vitest": "^4.1.10"
       }
     },
@@ -716,9 +716,9 @@
       "license": "MIT"
     },
     "node_modules/@gregiteen/ssss-cli": {
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "license": "ISC",
       "bin": {
         "ssss": "scripts/ssss.mjs"
@@ -1888,9 +1888,9 @@
     },
     "node_modules/@ssss/cli": {
       "name": "@gregiteen/ssss-cli",
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -6533,9 +6533,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.42.1",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.42.1.tgz",
-      "integrity": "sha512-woH7mdkGwPFYlKPZurhE8L3BPe+cSeIruNGaPOjGZJm/O8C92Bbr1gsdOY0tTLg5QHlgPHcXG1GMtsm9lPDz8w==",
+      "version": "3.43.3",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.43.3.tgz",
+      "integrity": "sha512-yjfPN/BQxEEa+iodyFXQov/6fRt1pZg/7RcmgsbpALwBt6Ki3JJjT3tzArBC7NxHQmXgGYyKnCYId6xe/W2rPg==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -6566,6 +6566,7 @@
         "antigravity": "bin/antigravity.mjs",
         "total-recall": "bin/total-recall.mjs",
         "total-recall-memory": "bin/total-recall-memory.mjs",
+        "total-recall-server-release": "bin/total-recall-server-release.mjs",
         "vibebrain": "bin/total-recall.mjs"
       },
       "optionalDependencies": {

package/scaffold/.agent/skills/total-recall/plugins/git-sentinel/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-git-sentinel",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "type": "module",
   "description": "Reports the state of the current git repository: branch, dirty files, unpushed commits and stashes.",
   "scripts": {
@@ -19,9 +19,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@gregiteen/ssss-cli": "0.14.4"
+    "@gregiteen/ssss-cli": "0.14.5"
   },
   "overrides": {
-    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.4"
+    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.5"
   }
 }

package/scaffold/.agent/skills/total-recall/plugins/git-sentinel/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "git-sentinel",
   "name": "Git Sentinel",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "description": "Worktree hygiene, branch inspection, unpushed commits, and stash tracker.",
   "author": "Total Recall",
   "license": "MIT",

package/scaffold/.agent/skills/total-recall/plugins/mesh/package-lock.json

@@ -1,21 +1,21 @@
 {
   "name": "tr-plugin-mesh",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-mesh",
-      "version": "0.2.8",
+      "version": "0.2.9",
       "license": "MIT",
       "dependencies": {
-        "@gregiteen/ssss-cli": "0.14.4",
+        "@gregiteen/ssss-cli": "0.14.5",
         "express": "^5.2.1"
       },
       "devDependencies": {
         "jsdom": "^29.1.1",
         "supertest": "^7.3.1",
-        "total-recall-brain": "3.42.1",
+        "total-recall-brain": "3.43.3",
         "vitest": "^4.1.12"
       }
     },
@@ -941,9 +941,9 @@
       }
     },
     "node_modules/@gregiteen/ssss-cli": {
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "license": "ISC",
       "bin": {
         "ssss": "scripts/ssss.mjs"
@@ -2136,9 +2136,9 @@
     },
     "node_modules/@ssss/cli": {
       "name": "@gregiteen/ssss-cli",
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -7177,9 +7177,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.42.1",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.42.1.tgz",
-      "integrity": "sha512-woH7mdkGwPFYlKPZurhE8L3BPe+cSeIruNGaPOjGZJm/O8C92Bbr1gsdOY0tTLg5QHlgPHcXG1GMtsm9lPDz8w==",
+      "version": "3.43.3",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.43.3.tgz",
+      "integrity": "sha512-yjfPN/BQxEEa+iodyFXQov/6fRt1pZg/7RcmgsbpALwBt6Ki3JJjT3tzArBC7NxHQmXgGYyKnCYId6xe/W2rPg==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -7210,6 +7210,7 @@
         "antigravity": "bin/antigravity.mjs",
         "total-recall": "bin/total-recall.mjs",
         "total-recall-memory": "bin/total-recall-memory.mjs",
+        "total-recall-server-release": "bin/total-recall-server-release.mjs",
         "vibebrain": "bin/total-recall.mjs"
       },
       "optionalDependencies": {

package/scaffold/.agent/skills/total-recall/plugins/mesh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-mesh",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "type": "module",
   "description": "Headscale and Tailscale SSH control-server mesh administration and node discovery",
   "scripts": {
@@ -10,7 +10,7 @@
   "license": "MIT",
   "dependencies": {
     "express": "^5.2.1",
-    "@gregiteen/ssss-cli": "0.14.4"
+    "@gregiteen/ssss-cli": "0.14.5"
   },
   "files": [
     "cli.mjs",
@@ -24,6 +24,6 @@
     "!src/**/*.test.mjs"
   ],
   "overrides": {
-    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.4"
+    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.5"
   }
 }

package/scaffold/.agent/skills/total-recall/plugins/mesh/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "mesh",
   "name": "Headscale",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "Control-server mesh administration, Tailscale SSH, and peer node discovery.",
   "license": "MIT",
   "requires": [

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/README.md

@@ -1,8 +1,10 @@
 # Meta Harness
 
-Built-in and validated custom adapters share one plugin. `runtime <agent> ...`
-exposes native runtime commands; DSH observations and Hermes gateway management
-live here as well. `meta-harness` is the primary namespace; `cli-agents` is an alias.
+Built-in and validated custom adapters share one plugin. Use `dispatch` or
+`route --execute` for agent work. `runtime <agent> ...` accepts supported maintenance
+commands such as `codex login status`, `hermes gateway status`, and `dsh models`.
+Manage gateway services through their owning plugins. `cli-agents` is an alias
+for `meta-harness`.
 
 `total-recall cli-agents setup` connects all nine native instruction surfaces.
 The declared setup operation also runs during daemon-owned plugin refresh.
@@ -29,6 +31,21 @@ total-recall cli-agents inspect --node <recorded-node> --json
 total-recall cli-agents run-command --stdin --json < request.json
 ```
 
+Check adoption without launching a model:
+
+```sh
+total-recall meta-harness adoption --json
+total-recall meta-harness adoption --node <recorded-node> --json
+total-recall meta-harness adoption --all --json
+```
+
+The report separates native login and hook configuration from recent hook
+decisions and completed managed runs. Its run evidence is historical; use the
+timestamps and last attempt to see whether an agent has since stopped working.
+Native hook activity alone does not prove that an agent was launched through
+Meta Harness. A fleet report lists offline nodes, missing CLI access, and
+installed versions that cannot provide adoption evidence.
+
 `request.json` selects one installed plugin operation, its literal arguments, a node and an agent:
 
 ```json
@@ -44,13 +61,29 @@ total-recall cli-agents run-command --stdin --json < request.json
 }
 ```
 
-For remote nodes, supply `execution.cwd` as an explicit absolute workspace. `agent: "direct"` runs the actual installed Total Recall CLI without a model. Remote access comes from recorded mesh entities and verified SSH configuration; unavailable nodes or binaries produce errors. Secrets are never accepted in an agent prompt. Existing account metadata is inspected without printing credentials or substituting provider API keys.
+For remote nodes, supply `execution.cwd` as an explicit absolute workspace. `agent: "direct"` runs the actual installed Total Recall CLI without a model. A remote agent task enters the destination's installed Meta Harness and records its receipt there. Remote access comes from recorded mesh entities and verified SSH configuration; unavailable nodes or binaries produce errors. Secrets are never accepted in an agent prompt. Existing account metadata is inspected without printing credentials or substituting provider API keys.
 
 The four permissions are strict boolean **command-effect admission controls**. They allow or deny the selected plugin command before dispatch. They are not a network policy or an OS sandbox for every action a model might propose. Supported adapter write modes are scoped through the vendor CLI; vendor approval and sandbox defaults stay enabled. The host's authenticated authorization still applies.
 
 The foreground `dispatch --stdin` request accepts `timeoutMs` from 1 to 540000, defaulting to 300000. Use the managed process or background execution commands for longer jobs. A Claude write request can include explicit `allowedTools` rules such as `["Bash(git status *)"]`. Native permission denials surface as failed dispatch receipts. Agent turn completion and command verification are separate fields.
 
-A completed model turn is distinct from a completed plugin operation. Structured results return `commandExecutionVerified: false` for agent turns; only direct CLI execution returns a command exit receipt. Muse preserves its actual headless JSONL log and documented process exit status rather than treating session-protocol notifications as headless output. Do not infer working accounts, provider delivery or successful mutations from discovery or fixture tests.
+A native login probe reads account metadata. A headless request can still fail if the provider rejects that login. Signed-out and expired Claude subscription sessions produce a failed receipt with `failureKind: "auth"`. Renew the subscription sign-in on the dispatch node and retry a scoped dispatch to verify execution. See [Claude Code authentication](https://code.claude.com/docs/en/iam#renew-an-expiring-login).
+
+### Included usage
+
+Run `total-recall meta-harness included-enforce` to limit this node's managed dispatches to included usage. Use `included-status --probe --json` to see the Claude billing bindings and read current Codex allowance without an agent turn. Codex uses the built-in ChatGPT route and requires the signed-in plan to report no paid credit.
+
+To approve OpenRouter on this node, run `total-recall meta-harness openrouter-bind <harness> <auth-key-name> --model <openrouter-model-id> --json`. Then select that harness by name when dispatching. Automatic routing continues to choose from the included subscription pool.
+
+Run `total-recall harness dispatch codex "Run pwd and report the output" --json` to see the final reply and `toolResults`. Codex, Claude, DSH, Pi, Hermes and OpenClaw report native tool outcomes, available exit codes and bounded output. OpenClaw reports `toolEvidenceError` if its gateway cannot return the run's tool results. Adoption receipts retain the outcomes without the output text.
+
+For Claude Max, sign in on the execution host with `claude auth login --claudeai`. Check that Usage credits are off in the account's Usage settings. Pass `{"organization":"<orgId from claude auth status>","usageCreditsEnabled":false}` to `included-bind-claude-plan --stdin`. Meta Harness prefers the bound plan and checks the native login on every turn. Keep Usage credits off on that account. Claude manages that switch and enforces the plan limits. [Claude's subscription and SDK billing](https://support.claude.com/en/articles/15036540-use-the-claude-agent-sdk-with-your-claude-plan)
+
+Before using `included-bind-claude --stdin`, verify the Max credit grant, key hint and organization in Claude Console. Supply `keyName` (the Total Recall Auth entry), `organization`, the masked `keyHint`, `expiresAt`, `creditSource: "claude-max"`, `paidBalanceCents: 0` and false values for `autoReload`, `paymentMethod` and `invoiced`. The binding expires with the observed grant. Reverify after a key or billing change.
+
+`usage-queue --json` lists deferred jobs. Use `usage-retry <id>` after the reported reset to run a replayable job through the same policy, or `usage-cancel <id>` to cancel it. Review a job marked `needsReview` in the original workspace before resubmitting it. A queued result has `queued: true` and a `queueId` and has not succeeded.
+
+A completed model turn is distinct from a completed plugin operation. `commandExecutionVerified` requires a successful native shell result. Direct CLI execution returns the CLI process's exit receipt. Muse preserves its actual headless JSONL log and documented process exit status. Verify accounts, provider delivery and mutations through the real runtime.
 
 ## Primary contracts checked 2026-10-14
 

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/cli.mjs

@@ -6,7 +6,8 @@ import { configDir } from './src/paths.mjs';
 import { inspectAgents, getActiveAdapters, getCustomAdaptersDirs, loadCustomAdapters, validateCustomAdapter, adapterPath } from './src/worker.mjs';
 import { inspectNode, listTargets, executeCommand, executeOnNode } from './src/executor.mjs';
 import { DOC_SOURCES, documentationStatus, refreshDocumentation, ensureDocumentation, maintainDocumentation, readDocumentation, searchDocumentation } from './src/documentation.mjs';
-import { manageRuntime } from './src/runtime.mjs';
+import { manageRuntime, validateRuntimeOperation } from './src/runtime.mjs';
+import { validateDispatchRequest } from './src/dispatch-request.mjs';
 import { setupIntegrations } from './src/setup.mjs';
 import { inspectUpstreamFleet, getAgentChangelog } from './src/tracker.mjs';
 import { inspectQuotas, getBenchmarks, routeTask } from './src/router.mjs';
@@ -76,7 +77,7 @@ async function runOperation(argv) {
   // Help anywhere in the arguments prints usage; it must never run an operation.
   if (operation === 'help' || args.some(arg => arg === '--help' || arg === '-h')) {
     const manifest=JSON.parse(fs.readFileSync(new URL('./plugin.json',import.meta.url),'utf8'));
-    console.log('Usage: total-recall meta-harness <operation> [options]  (alias: cli-agents)\nEvery agent receives Total Recall bootstrap before dispatch. Runtime syntax: runtime <agent> <native-command...> [--node ID].\n');
+    console.log('Usage: total-recall meta-harness <operation> [options]  (alias: cli-agents)\nEvery agent receives Total Recall bootstrap before dispatch. Runtime syntax: runtime <agent> <maintenance-command...> [--node ID].\n');
     for(const command of manifest.cli.subcommands)console.log(`  ${command.name} ${(command.args || []).map(arg=>arg.flag?`${arg.flag} <${arg.name}>`:`<${arg.name}>`).join(' ')} — ${command.description}`);
     return;
   }
@@ -85,7 +86,38 @@ async function runOperation(argv) {
   if (operation === 'status') result = {...await inspectNode(value('--node') || 'local'),documentation:documentationStatus()};
   else if (operation === 'catalog') result = { adapters: getActiveAdapters(), permissions: ['read', 'write', 'send', 'destructive'] };
   else if (operation === 'nodes') result = await listTargets();
+  else if (operation === 'adoption') {
+    const node = value('--node');
+    if (node && has('--all')) throw new Error('Choose either --node or --all');
+    const { inspectLocalAdoption, inspectFleetAdoption } = await import('./src/adoption.mjs');
+    result = has('--all') || (node && node !== 'local') ? await inspectFleetAdoption({ node }) : await inspectLocalAdoption();
+    if (!result.ok) process.exitCode = 1;
+  }
   else if (operation === 'quota') result = await inspectQuotas({ node: value('--node') || 'local' });
+  else if (operation === 'openrouter-bind') {
+    const { bindOpenRouter } = await import('./src/included-usage.mjs');
+    result = await bindOpenRouter(positional[0], positional[1], value('--model'));
+  }
+  else if (['included-status', 'included-enforce', 'included-bind-claude', 'included-bind-claude-plan'].includes(operation)) {
+    const usage = await import('./src/included-usage.mjs');
+    if (operation === 'included-status') result = await usage.includedUsageStatus({ probe: has('--probe') });
+    else if (operation === 'included-enforce') result = await usage.enforceIncludedUsage();
+    else {
+      if (!has('--stdin')) throw new Error('Pass verified Claude billing evidence as JSON on stdin.');
+      const input = fs.readFileSync(0, 'utf8');
+      if (Buffer.byteLength(input) > 4096) throw new Error('Claude billing evidence is too large.');
+      const evidence = JSON.parse(input);
+      result = await (operation === 'included-bind-claude-plan' ? usage.bindClaudeMaxPlan : usage.bindClaudeIncludedKey)(evidence);
+    }
+  }
+  else if (['usage-queue', 'usage-retry', 'usage-cancel'].includes(operation)) {
+    const queue = await import('./src/usage-queue.mjs');
+    if (operation === 'usage-queue') result = { ok: true, jobs: await queue.listIncludedJobs() };
+    else if (!positional[0]) throw new Error('Choose a queued job ID.');
+    else if (operation === 'usage-cancel') result = { ok: true, job: await queue.cancelIncludedJob(positional[0]) };
+    else result = await queue.retryIncludedJob(positional[0]);
+    if (!result.ok) process.exitCode = 1;
+  }
   else if (operation === 'benchmarks') result = await getBenchmarks();
   else if (operation === 'route') {
     const task = positional.join(' ');
@@ -237,7 +269,8 @@ async function runOperation(argv) {
     const runtimeArgs=args.slice(1).filter(arg=>arg!=='--json'), agent=runtimeArgs.shift();
     const index=runtimeArgs.indexOf('--node'); let node='local';
     if(index>=0){node=runtimeArgs[index+1];if(!node || node.startsWith('-'))throw new Error('--node requires an identifier');runtimeArgs.splice(index,2);}
-    result = node==='local' ? await manageRuntime(agent,runtimeArgs) : await executeOnNode(node,{operation:'direct',cwd:process.cwd(),argv:['total-recall','meta-harness','runtime',agent,...runtimeArgs,'--json']});
+    const command = validateRuntimeOperation(agent, runtimeArgs);
+    result = node==='local' ? await manageRuntime(agent,command) : await executeOnNode(node,{operation:'direct',useHome:true,argv:['total-recall','meta-harness','runtime',agent,...command,'--json']});
     if(!result.ok)process.exitCode=1;
   }
   else if (operation === 'process') {
@@ -266,10 +299,8 @@ async function runOperation(argv) {
   else if(operation==='dispatch') {
     if(!args.includes('--stdin'))throw new Error('Task requests must arrive through stdin: pass --stdin with JSON {agent, cwd, prompt}');
     const input=fs.readFileSync(0,'utf8');if(Buffer.byteLength(input)>65536)throw new Error('Task request too large');
-    const request=JSON.parse(input);
-    const timeoutMs = request.timeoutMs ?? 300000;
-    if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 540000) throw new Error('Foreground dispatch timeout must be 1..540000 ms');
-    result=await dispatchWithReceipt({...request,timeoutMs,allowUnknownAuth:request.allowUnknownAuth===true},{node:request.node || 'local',role:'Dispatch'});
+    const request=validateDispatchRequest(JSON.parse(input));
+    result=await dispatchWithReceipt(request,{node:request.node || 'local',role:'Dispatch'});
     if(!result.ok)process.exitCode=1;
   }
   else if (operation === 'inspect') {

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/package-lock.json

@@ -1,17 +1,17 @@
 {
   "name": "tr-plugin-meta-harness",
-  "version": "0.3.4",
+  "version": "0.3.9",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-meta-harness",
-      "version": "0.3.4",
+      "version": "0.3.9",
       "dependencies": {
-        "@gregiteen/ssss-cli": "0.14.4"
+        "@gregiteen/ssss-cli": "0.14.5"
       },
       "devDependencies": {
-        "total-recall-brain": "3.42.1"
+        "total-recall-brain": "3.43.3"
       }
     },
     "node_modules/@alcalzone/ansi-tokenize": {
@@ -714,9 +714,9 @@
       "license": "MIT"
     },
     "node_modules/@gregiteen/ssss-cli": {
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "license": "ISC",
       "bin": {
         "ssss": "scripts/ssss.mjs"
@@ -1589,9 +1589,9 @@
     },
     "node_modules/@ssss/cli": {
       "name": "@gregiteen/ssss-cli",
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -5546,9 +5546,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.42.1",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.42.1.tgz",
-      "integrity": "sha512-woH7mdkGwPFYlKPZurhE8L3BPe+cSeIruNGaPOjGZJm/O8C92Bbr1gsdOY0tTLg5QHlgPHcXG1GMtsm9lPDz8w==",
+      "version": "3.43.3",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.43.3.tgz",
+      "integrity": "sha512-yjfPN/BQxEEa+iodyFXQov/6fRt1pZg/7RcmgsbpALwBt6Ki3JJjT3tzArBC7NxHQmXgGYyKnCYId6xe/W2rPg==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -5579,6 +5579,7 @@
         "antigravity": "bin/antigravity.mjs",
         "total-recall": "bin/total-recall.mjs",
         "total-recall-memory": "bin/total-recall-memory.mjs",
+        "total-recall-server-release": "bin/total-recall-server-release.mjs",
         "vibebrain": "bin/total-recall.mjs"
       },
       "optionalDependencies": {

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-meta-harness",
-  "version": "0.3.4",
+  "version": "0.3.9",
   "description": "Total Recall Meta Harness plugin",
   "type": "module",
   "scripts": {
@@ -22,9 +22,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@gregiteen/ssss-cli": "0.14.4"
+    "@gregiteen/ssss-cli": "0.14.5"
   },
   "overrides": {
-    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.4"
+    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.5"
   }
 }