total-recall-brain 3.44.0 → 3.45.0

package/scaffold/.agent/skills/total-recall/plugins/mesh/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "tr-plugin-mesh",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-mesh",
-      "version": "0.2.9",
+      "version": "0.2.10",
       "license": "MIT",
       "dependencies": {
         "@gregiteen/ssss-cli": "0.14.5",
@@ -15,7 +15,7 @@
       "devDependencies": {
         "jsdom": "^29.1.1",
         "supertest": "^7.3.1",
-        "total-recall-brain": "3.43.3",
+        "total-recall-brain": "3.44.0",
         "vitest": "^4.1.12"
       }
     },
@@ -7177,9 +7177,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.43.3",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.43.3.tgz",
-      "integrity": "sha512-yjfPN/BQxEEa+iodyFXQov/6fRt1pZg/7RcmgsbpALwBt6Ki3JJjT3tzArBC7NxHQmXgGYyKnCYId6xe/W2rPg==",
+      "version": "3.44.0",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.44.0.tgz",
+      "integrity": "sha512-VNPaIO9zsSwoxAsJ5ByIQBP9zPpLq4RiQO7Vrex4rBOHFQJT50P7utcZiLMSZTyZJU4C/m5uB8qTCSBMp6+l6Q==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -7187,7 +7187,7 @@
       ],
       "dependencies": {
         "@simplewebauthn/server": "^13.3.2",
-        "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.4",
+        "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.5",
         "bcrypt": "^6.0.0",
         "better-sqlite3": "^12.11.1",
         "cookie-parser": "^1.4.7",

package/scaffold/.agent/skills/total-recall/plugins/mesh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-mesh",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "type": "module",
   "description": "Headscale and Tailscale SSH control-server mesh administration and node discovery",
   "scripts": {

package/scaffold/.agent/skills/total-recall/plugins/mesh/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "mesh",
   "name": "Headscale",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "description": "Control-server mesh administration, Tailscale SSH, and peer node discovery.",
   "license": "MIT",
   "requires": [

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/README.md

@@ -1,4 +1,4 @@
-# Meta Harness
+# Metaharness
 
 Built-in and validated custom adapters share one plugin. Use `dispatch` or
 `route --execute` for agent work. `runtime <agent> ...` accepts supported maintenance
@@ -17,10 +17,12 @@ is removed after execution. Setup failure or an unready context stops dispatch.
 `docs-refresh`, `docs-ensure`, `docs-status`, `docs-read` and `docs-search` manage
 downloaded official documentation rather than a list of links. Content is hashed,
 bounded and refreshed after 24 hours. Maintenance uses the existing Total Recall
-daemon's plugin task, refreshing one stale adapter per run. Failed pages remain
+daemon's plugin task, attempting every stale adapter per run. Failed pages remain
 visible as failures and cannot certify complete coverage; successful cached
 content remains readable. `setup --node <recorded-node>` selects maintenance
-placement without creating a second scheduler.
+placement for `maintenance`, `maintenance --models` and `alerts check` without
+creating a second scheduler. Each maintenance step reports its failures. A failed
+setup or gate install does not prevent documentation refresh for other harnesses.
 
 Standalone Total Recall owner for CLI-agent discovery and explicit mesh command execution. Install with `total-recall plugin install <path-or-private-git-url>`. Installation rebuilds the plugin inventory, CLI library and connected instruction surfaces. No model account is created or selected automatically.
 
@@ -43,7 +45,7 @@ The report separates native login and hook configuration from recent hook
 decisions and completed managed runs. Its run evidence is historical; use the
 timestamps and last attempt to see whether an agent has since stopped working.
 Native hook activity alone does not prove that an agent was launched through
-Meta Harness. A fleet report lists offline nodes, missing CLI access, and
+Metaharness. A fleet report lists offline nodes, missing CLI access, and
 installed versions that cannot provide adoption evidence.
 
 `request.json` selects one installed plugin operation, its literal arguments, a node and an agent:
@@ -61,7 +63,7 @@ installed versions that cannot provide adoption evidence.
 }
 ```
 
-For remote nodes, supply `execution.cwd` as an explicit absolute workspace. `agent: "direct"` runs the actual installed Total Recall CLI without a model. A remote agent task enters the destination's installed Meta Harness and records its receipt there. Remote access comes from recorded mesh entities and verified SSH configuration; unavailable nodes or binaries produce errors. Secrets are never accepted in an agent prompt. Existing account metadata is inspected without printing credentials or substituting provider API keys.
+For remote nodes, supply `execution.cwd` as an explicit absolute workspace. `agent: "direct"` runs the actual installed Total Recall CLI without a model. A remote agent task enters the destination's installed Metaharness and records its receipt there. Remote access comes from recorded mesh entities and verified SSH configuration; unavailable nodes or binaries produce errors. Secrets are never accepted in an agent prompt. Existing account metadata is inspected without printing credentials or substituting provider API keys.
 
 The four permissions are strict boolean **command-effect admission controls**. They allow or deny the selected plugin command before dispatch. They are not a network policy or an OS sandbox for every action a model might propose. Supported adapter write modes are scoped through the vendor CLI; vendor approval and sandbox defaults stay enabled. The host's authenticated authorization still applies.
 
@@ -75,9 +77,9 @@ Run `total-recall meta-harness included-enforce` to limit this node's managed di
 
 To approve OpenRouter on this node, run `total-recall meta-harness openrouter-bind <harness> <auth-key-name> --model <openrouter-model-id> --json`. Then select that harness by name when dispatching. Automatic routing continues to choose from the included subscription pool.
 
-Run `total-recall harness dispatch codex "Run pwd and report the output" --json` to see the final reply and `toolResults`. Codex, Claude, DSH, Pi, Hermes and OpenClaw report native tool outcomes, available exit codes and bounded output. OpenClaw reports `toolEvidenceError` if its gateway cannot return the run's tool results. Adoption receipts retain the outcomes without the output text.
+Run `total-recall harness dispatch codex "Run pwd and report the output" --json` to see the final reply and `toolResults`. Codex, Claude, DSH, Pi, Hermes and OpenClaw report native tool outcomes, available exit codes and bounded output. OpenClaw reports `toolEvidenceError` if its gateway cannot return the run's tool results. For background jobs, run `total-recall meta-harness process logs <job-id> --json` and read `toolResults` in the completion record. Adoption receipts retain the outcomes without the output text.
 
-For Claude Max, sign in on the execution host with `claude auth login --claudeai`. Check that Usage credits are off in the account's Usage settings. Pass `{"organization":"<orgId from claude auth status>","usageCreditsEnabled":false}` to `included-bind-claude-plan --stdin`. Meta Harness prefers the bound plan and checks the native login on every turn. Keep Usage credits off on that account. Claude manages that switch and enforces the plan limits. [Claude's subscription and SDK billing](https://support.claude.com/en/articles/15036540-use-the-claude-agent-sdk-with-your-claude-plan)
+For Claude Max, sign in on the execution host with `claude auth login --claudeai`. Check that Usage credits are off in the account's Usage settings. Pass `{"organization":"<orgId from claude auth status>","usageCreditsEnabled":false}` to `included-bind-claude-plan --stdin`. Metaharness prefers the bound plan and checks the native login on every turn. Keep Usage credits off on that account. Claude manages that switch and enforces the plan limits. [Claude's subscription and SDK billing](https://support.claude.com/en/articles/15036540-use-the-claude-agent-sdk-with-your-claude-plan)
 
 Before using `included-bind-claude --stdin`, verify the Max credit grant, key hint and organization in Claude Console. Supply `keyName` (the Total Recall Auth entry), `organization`, the masked `keyHint`, `expiresAt`, `creditSource: "claude-max"`, `paidBalanceCents: 0` and false values for `autoReload`, `paymentMethod` and `invoiced`. The binding expires with the observed grant. Reverify after a key or billing change.
 
@@ -126,6 +128,20 @@ SSSS execution receipts. Actual process exit and finish metadata are distinct fr
 verification results; unavailable model metadata remains null. Thread operations
 include list, show, create, update, close and delete, using native SSSS state.
 
+Every review result is stored in an append-only SSSS ledger beside the thread
+store. It retains the selected diff, commit, reviewer, verdict and disposition,
+including failed reviews and `NO_DIFF`. `reviews --json` reads the ledger.
+Deleting a thread does not remove its reviews. A failed ledger write returns
+`ok: false` with `reviewStoreError` and the completed result.
+
+`learn` reports scorecards, walls and proposals from run receipts. Routing reads
+these receipts directly. The memory emit option has been removed.
+
+`threads cleanup-fixtures --dry-run` previews the one-time cleanup of exact test
+fixture titles. `threads cleanup-fixtures` applies it and stores the removed IDs,
+titles, statuses, source test files and retained IDs in the same SSSS operation.
+Real end-to-end job threads stay in place, including failed attempts.
+
 Custom adapter declarations preserve scoped credentials, optional authentication
 probes and HTTPS documentation URLs. IDs and paths reject traversal and symbolic
 links. Credentials reach only the declaring runner through the auth store. A
@@ -148,14 +164,14 @@ The active five-file suite and evidence live in
 owner/core suites, plugin/scaffold validation, real dashboard inspection and
 recorded acceptance evidence. Fixture tests do not certify live accounts, remote
 execution or recurring maintenance. The operator requires completing verification
-before Meta Harness runs task work.
+before Metaharness runs task work.
 
 Cloudroom setup material remains under `cloudroom/`. Its plugin implementation
 follows this foundation and requires its own current audit and plan.
 
 ### Installed and standalone verification
 
-Use the installed plugin for CLI execution and maintenance. The repository has a pure planning capability under `capability/`. The current manifest does not declare it for vendoring. See the [Meta Harness tracker](docs/projects/in-progress/META_HARNESS_UNIFICATION/META_HARNESS_UNIFICATION_PROJECT_TRACKER.md) for current package, execution and hook acceptance.
+Use the installed plugin for CLI execution and maintenance. The repository has a pure planning capability under `capability/`. The current manifest does not declare it for vendoring. See the [Metaharness tracker](docs/projects/in-progress/META_HARNESS_UNIFICATION/META_HARNESS_UNIFICATION_PROJECT_TRACKER.md) for current package, execution and hook acceptance.
 
 ## Using this from an agent
 

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/capability/BRICK.md

@@ -1,4 +1,4 @@
-# Meta Harness Capability Brick
+# Metaharness Capability Brick
 
 A zero-dependency, host-free pure ES module providing universal agent harness discovery, two-stage complexity classification, cost-vs-frontier routing, gate cascade evaluation, and execution envelope construction.
 

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/capability/index.mjs

@@ -1,5 +1,5 @@
 /**
- * Meta Harness Capability Brick
+ * Metaharness Capability Brick
  * Zero-dependency, host-free pure ES module for agent routing,
  * complexity classification, adapter discovery, gate cascades, and SSSS receipts.
  * Works identically in any standalone app, edge device, workstation, or cloud environment.
@@ -34,7 +34,7 @@ export const ADAPTER_CATALOG = {
     contextLimit: 200000,
     modalities: ['text', 'code'],
     features: ['subagents', 'mcp', 'headless', 'compact', 'plan_mode'],
-    flags: { prompt: '-p', nonInteractive: '--permission-mode acceptEdits', planMode: '--permission-mode plan', output: '--output-format json' }
+    flags: { prompt: '-p', nonInteractive: '--permission-mode bypassPermissions', planMode: '--permission-mode plan', output: '--output-format json' }
   },
   codex: {
     id: 'codex',
@@ -49,7 +49,7 @@ export const ADAPTER_CATALOG = {
     contextLimit: 128000,
     modalities: ['text', 'code'],
     features: ['mcp', 'headless', 'streaming'],
-    flags: { prompt: 'exec', nonInteractive: '--sandbox workspace-write', planMode: '--sandbox read-only', output: '--json' }
+    flags: { prompt: 'exec', nonInteractive: '--sandbox danger-full-access', planMode: '--sandbox read-only', output: '--json' }
   },
   grok: {
     id: 'grok',
@@ -256,15 +256,27 @@ export function classifyTaskComplexity(taskDescription, options = {}) {
     score += 30;
     factors.push('security-sensitive');
   }
-  if (/multi-file|across (all|every)|entire (repo|fleet)|worktree/.test(text)) {
+  if (/multi-file|across (all|every)|entire (repo|fleet)|worktree|every (mesh )?(node|machine|host|repo)|(all|several|multiple) (repos|repositories|nodes|machines)|\bmesh\b|\bfleet\b/.test(text)) {
     score += 25;
     factors.push('broad-blast-radius');
   }
+  if (/\bproduction\b|\bdeploy|roll ?out|\bdroplet\b|\bcore\b|\bmigration\b|\brelease\b/.test(text)) {
+    score += 15;
+    factors.push('production-or-core');
+  }
   if (/benchmark|telemetry|concurrency|race condition|memory leak/.test(text)) {
     score += 20;
     factors.push('complex-debugging');
   }
-  if (/typo|rename|docstring|comment|formatting|readme|lint fix/.test(text)) {
+  // Several distinct pieces of work (comma or semicolon separated clauses, phases) are not one edit.
+  const clauses = text.split(/[,;]|\band then\b|\bthen\b|\bplus\b/).filter(part => part.trim().split(/\s+/).length >= 3).length;
+  if (clauses >= 4 || /phases? \d+ (and|&) \d+/.test(text)) {
+    score += 15;
+    factors.push('multi-part-work');
+  }
+  // An easy-sounding word ("rename", "readme") lowers the score only when nothing else carries risk:
+  // a rename across repositories or a credential change is not a typo fix.
+  if (/typo|rename|docstring|comment|formatting|readme|lint fix/.test(text) && factors.length === 0) {
     score -= 30;
     factors.push('low-complexity-edit');
   }
@@ -645,7 +657,7 @@ export function decomposeTask(taskDescription, options = {}) {
 }
 
 /**
- * Meta Harness Brick Factory
+ * Metaharness Brick Factory
  */
 export function createMetaHarness(customAdapters = {}) {
   const mergedAdapters = { ...ADAPTER_CATALOG, ...customAdapters };

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/cli.mjs

@@ -5,10 +5,11 @@ import { pathToFileURL } from 'node:url';
 import { configDir } from './src/paths.mjs';
 import { inspectAgents, getActiveAdapters, getCustomAdaptersDirs, loadCustomAdapters, validateCustomAdapter, adapterPath } from './src/worker.mjs';
 import { inspectNode, listTargets, executeCommand, executeOnNode } from './src/executor.mjs';
-import { DOC_SOURCES, documentationStatus, refreshDocumentation, ensureDocumentation, maintainDocumentation, readDocumentation, searchDocumentation } from './src/documentation.mjs';
+import { DOC_SOURCES, documentationStatus, refreshDocumentation, ensureDocumentation, readDocumentation, searchDocumentation } from './src/documentation.mjs';
 import { manageRuntime, validateRuntimeOperation } from './src/runtime.mjs';
 import { validateDispatchRequest } from './src/dispatch-request.mjs';
 import { setupIntegrations } from './src/setup.mjs';
+import { maintainIntegrations } from './src/maintenance.mjs';
 import { inspectUpstreamFleet, getAgentChangelog } from './src/tracker.mjs';
 import { inspectQuotas, getBenchmarks, routeTask } from './src/router.mjs';
 import { coordinateTask } from './src/coordinator.mjs';
@@ -18,11 +19,17 @@ import { resolvePool } from './src/pool.mjs';
 import { checkAlerts, notifyAlert } from './src/alerts.mjs';
 import { learnFromHistory, voidReceipts } from './src/learner.mjs';
 import { decomposeTask } from './capability/index.mjs';
-import { listThreads, getThread, createThread, updateThread, closeThread, deleteThread } from './src/threads.mjs';
+import { listThreads, getThread, createThread, updateThread, closeThread, deleteThread, cleanupFixtureThreads } from './src/threads.mjs';
+import { readReviews } from './src/reviews.mjs';
 import { executeCodeReview } from './src/review.mjs';
-import { stopOnTermination } from './src/termination.mjs';
+import { stopOnTermination, finishCancellation } from './src/termination.mjs';
+import { cancellationResult } from './src/worker.mjs';
+import { startJob, newJobId, cancelJob, resolveJob } from './src/jobs.mjs';
+import { appendCommand, waitingRequests } from './src/control.mjs';
+import { sessionOptions } from './src/session/run.mjs';
+import { continueJob } from './src/session-jobs.mjs';
 
-const VALUE_FLAGS = ['--node', '--mode', '--orchestrator', '--branch', '--reviewer', '--thread', '--status', '--platform', '--agent', '--url', '--query', '--tier', '--threshold', '--author', '--explorer', '--architect', '--implementer', '--verifier', '--title', '--summary', '--cwd', '--tools', '--setting-sources', '--model', '--name', '--tail', '--timeout-ms', '--void', '--reason'];
+const VALUE_FLAGS = ['--result-schema-json', '--goal', '--max-turns', '--max-budget-usd', '--max-tokens', '--result-schema', '--at', '--node', '--mode', '--orchestrator', '--branch', '--reviewer', '--thread', '--status', '--platform', '--agent', '--url', '--query', '--tier', '--threshold', '--author', '--explorer', '--architect', '--implementer', '--verifier', '--title', '--summary', '--cwd', '--tools', '--setting-sources', '--model', '--name', '--tail', '--timeout-ms', '--void', '--reason', '--approvals', '--question-timeout-ms'];
 export function parseArguments(args) {
   const positional = [];
   for (let index = 1; index < args.length; index += 1) {
@@ -38,30 +45,68 @@ export function parseArguments(args) {
   return { positional, value, has: name => args.includes(name) };
 }
 
-export async function run(argv = []) {
+export async function run(argv = [], { backgroundJobId } = {}) {
+  // MCP owns stdin/stdout for its whole lifetime. The CLI result wrapper must stay out of that stream.
+  if (argv[3] === 'mcp' && !argv.includes('--help') && !argv.includes('-h')) {
+    try { await runOperation(argv); }
+    catch (error) { console.error(`Metaharness MCP: ${error.message}`); process.exitCode = 1; }
+    return;
+  }
   stopOnTermination();
-  try { await runOperation(argv); }
+  let job, result;
+  const previousJob = process.env.TR_METAHARNESS_JOB;
+  try {
+    const args = argv.slice(3), operation = args[0];
+    if (!args.includes('--help') && !args.includes('-h') && !args.includes('--background') &&
+        (['dispatch', 'fork', 'resume'].includes(operation) || (['route', 'coordinate', 'orchestrate'].includes(operation) && args.includes('--execute')))) {
+      job = startJob(operation, backgroundJobId ? { id: backgroundJobId } : {});
+      process.env.TR_METAHARNESS_JOB = job.job;
+    }
+    result = await runOperation(argv);
+  }
   catch (error) {
     const message = String(error?.message || error);
-    if (argv.includes('--json')) console.log(JSON.stringify({ ok: false, error: message }));
-    else console.error(`meta-harness: ${message}`);
+    result = { ok: false, error: message };
+    if (!argv.includes('--json')) console.error(`meta-harness: ${message}`);
     process.exitCode = 1;
   }
+  result = finishCancellation(result);
+  if (result !== undefined) {
+    if (job) {
+      if (result.execution?.remote && result.job) result.execution = { ...result.execution, remoteJob: result.job };
+      result = { ...result, job: job.job };
+    }
+    job?.finish(result);
+    if (!backgroundJobId) console.log(JSON.stringify(result));
+  }
+  if (previousJob === undefined) delete process.env.TR_METAHARNESS_JOB;
+  else process.env.TR_METAHARNESS_JOB = previousJob;
 }
 
 /** The host stops a plugin command after 10 minutes, so long runs detach and report through their thread and log. */
 async function detachRun(argv) {
   const directory = path.join(configDir(), 'jobs');
   fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
-  const log = path.join(directory, `${Date.now().toString(36)}.log`);
+  const id = newJobId();
+  const log = path.join(directory, `${id}.log`);
   const output = fs.openSync(log, 'a', 0o600);
   const entry = new URL('./cli.mjs', import.meta.url).href;
-  const child = spawn(process.execPath, ['--input-type=module', '-e', `import(${JSON.stringify(entry)}).then(m=>m.run(${JSON.stringify(argv.filter(arg => arg !== '--background'))}))`], { cwd: process.cwd(), detached: true, stdio: ['ignore', output, output], env: process.env });
+  const input = argv[3] === 'dispatch' ? fs.readFileSync(0, 'utf8') : null;
+  const child = spawn(process.execPath, ['--input-type=module', '-e', `import(${JSON.stringify(entry)}).then(m=>m.run(${JSON.stringify(argv.filter(arg => arg !== '--background'))}, {backgroundJobId:${JSON.stringify(id)}}))`], { cwd: process.cwd(), detached: true, stdio: [input === null ? 'ignore' : 'pipe', output, output], env: process.env });
+  if (input !== null) { child.stdin.on('error', () => {}); child.stdin.end(input); }
   try {
     await new Promise((resolve, reject) => { child.once('spawn', resolve); child.once('error', reject); });
+    const deadline = Date.now() + 10_000;
+    while (!fs.statSync(log).size) {
+      if (child.exitCode !== null || Date.now() > deadline) {
+        child.kill('SIGTERM');
+        throw new Error(`The background job did not record its PID. Log: ${log}`);
+      }
+      await new Promise(resolve => setTimeout(resolve, 20));
+    }
     child.unref();
   } finally { fs.closeSync(output); }
-  return { ok: true, background: true, pid: child.pid, log, follow: `The final JSON result is written to ${log}; a pipeline also records a thread.` };
+  return { ok: true, background: true, job: id, pid: child.pid, log, follow: `The final JSON result is written to ${log}; a pipeline also records a thread.` };
 }
 
 async function runOperation(argv) {
@@ -81,7 +126,12 @@ async function runOperation(argv) {
     for(const command of manifest.cli.subcommands)console.log(`  ${command.name} ${(command.args || []).map(arg=>arg.flag?`${arg.flag} <${arg.name}>`:`<${arg.name}>`).join(' ')} — ${command.description}`);
     return;
   }
-  if (has('--background') && ['route', 'coordinate', 'orchestrate'].includes(operation) && has('--execute')) { console.log(JSON.stringify(await detachRun(argv))); return; }
+  if (has('--background') && (['dispatch', 'fork', 'resume'].includes(operation) || (['route', 'coordinate', 'orchestrate'].includes(operation) && has('--execute')))) return detachRun(argv);
+  const controls = () => sessionOptions({ cwd: value('--cwd') || process.cwd(),
+    ...(value('--result-schema-json') !== undefined ? { resultSchema: JSON.parse(value('--result-schema-json')) } : {}),
+    ...Object.fromEntries([['goal', '--goal'], ['maxTurns', '--max-turns'], ['maxBudgetUsd', '--max-budget-usd'], ['maxTokens', '--max-tokens'],
+      ['resultSchema', '--result-schema'], ['approvalPolicy', '--approvals'], ['questionTimeoutMs', '--question-timeout-ms']]
+      .filter(([, flag]) => value(flag) !== undefined).map(([key, flag]) => [key, ['maxTurns', 'maxBudgetUsd', 'maxTokens', 'questionTimeoutMs'].includes(key) ? Number(value(flag)) : value(flag)])) });
   let result;
   if (operation === 'status') result = {...await inspectNode(value('--node') || 'local'),documentation:documentationStatus()};
   else if (operation === 'catalog') result = { adapters: getActiveAdapters(), permissions: ['read', 'write', 'send', 'destructive'] };
@@ -122,7 +172,7 @@ async function runOperation(argv) {
   else if (operation === 'route') {
     const task = positional.join(' ');
     if (!task) throw new Error('route requires a task description');
-    const options = { jev: has('--jev'), preferLocal: has('--prefer-local'), preferFrontier: has('--prefer-frontier'), node: value('--node'), cwd: value('--cwd'), allowUnknownAuth: has('--allow-unknown-auth'), ...remoteTimeout() };
+    const options = { ...controls(), jev: has('--jev'), preferLocal: has('--prefer-local'), preferFrontier: has('--prefer-frontier'), node: value('--node'), cwd: value('--cwd'), allowUnknownAuth: has('--allow-unknown-auth'), ...remoteTimeout() };
     result = has('--execute') ? await executeRoutedTask(task, { ...options, gate: has('--gate'), gateOptions: { tier: value('--tier') || 'fast' } }) : await routeTask(task, options);
     if (!result.ok) process.exitCode = 1;
   }
@@ -136,7 +186,7 @@ async function runOperation(argv) {
     const task = positional.join(' ');
     if (!task) throw new Error(`${operation} requires a task description`);
     result = await coordinateTask(task, {
-      mode: value('--mode') || 'pipeline', execute: has('--execute'), orchestrator: value('--orchestrator'), explorer: value('--explorer'), architect: value('--architect'), implementer: value('--implementer'), verifier: value('--verifier'),
+      ...controls(), mode: value('--mode') || 'pipeline', execute: has('--execute'), orchestrator: value('--orchestrator'), explorer: value('--explorer'), architect: value('--architect'), implementer: value('--implementer'), verifier: value('--verifier'),
       branch: value('--branch'), subagents: !has('--no-subagents'), autoReview: has('--auto-review'), gate: has('--gate'), gateOptions: { tier: value('--tier') || 'fast' }, allowSameFamily: has('--allow-same-family'), reviewer: value('--reviewer'),
       node: value('--node') || 'local', cwd: value('--cwd'), allowUnknownAuth: has('--allow-unknown-auth'), ...remoteTimeout(),
     });
@@ -151,6 +201,8 @@ async function runOperation(argv) {
         status: statusIdx >= 0 ? args[statusIdx + 1] : undefined,
         platform: platformIdx >= 0 ? args[platformIdx + 1] : undefined
       });
+    } else if (sub === 'cleanup-fixtures') {
+      result = cleanupFixtureThreads({ dryRun: has('--dry-run') });
     } else if (sub === 'show' || sub === 'get') {
       const id = args[2];
       if (!id) throw new Error('threads show requires a thread id');
@@ -181,14 +233,16 @@ async function runOperation(argv) {
       throw new Error(`Unsupported threads operation: ${sub}`);
     }
   }
+  else if (operation === 'reviews') result = { ok: true, reviews: readReviews() };
   else if (operation === 'review') {
     result = await executeCodeReview({ target: positional[0] || null, reviewer: value('--reviewer'), author: value('--author'), threadId: value('--thread'), staged: has('--staged'), node: value('--node') || 'local', cwd: value('--cwd'), allowUnknownAuth: has('--allow-unknown-auth'), ...remoteTimeout() });
     if (!result.ok) process.exitCode = 1;
   }
   else if (operation === 'learn') {
+    if (has('--emit')) throw new Error('learn --emit was removed. Routing reads run receipts directly.');
     result = value('--void') !== undefined
       ? await voidReceipts({ ids: String(value('--void')).split(',').map(id => id.trim()).filter(Boolean), reason: value('--reason') })
-      : await learnFromHistory({ emit: has('--emit') });
+      : await learnFromHistory();
     if (!result.ok) process.exitCode = 1;
   }
   else if (operation === 'alerts') {
@@ -196,7 +250,7 @@ async function runOperation(argv) {
     if (sub === 'check') {
       const { quotas } = await inspectQuotas({});
       result = await checkAlerts({ quotas, threshold: Number(value('--threshold')) || 85, dryRun: has('--dry-run') });
-    } else if (sub === 'test') result = await notifyAlert({ title: 'Meta Harness: test alert', message: 'Alert delivery check.', dryRun: has('--dry-run') });
+    } else if (sub === 'test') result = await notifyAlert({ title: 'Metaharness: test alert', message: 'Alert delivery check.', dryRun: has('--dry-run') });
     else throw new Error(`Unsupported alerts operation: ${sub}`);
     if (!result.ok) process.exitCode = 1;
   }
@@ -256,11 +310,7 @@ async function runOperation(argv) {
         const { syncModelCatalog } = await import('./src/model-catalog.mjs');
         result = await syncModelCatalog();
       } else {
-        const setup=await setupIntegrations();
-        const { installAll } = await import('./src/gate-adapters/index.mjs');
-        const gates=await installAll();
-        const docs=await maintainDocumentation(options);
-        result={...docs,ok:docs.ok!==false&&gates.ok,setup,gates};
+        result=await maintainIntegrations(options);
       }
     } else result = operation==='docs-status' ? documentationStatus(options) : operation==='docs-ensure' ? await ensureDocumentation(options) : await refreshDocumentation(options);
     if(!result.ok)process.exitCode=1;
@@ -296,11 +346,60 @@ async function runOperation(argv) {
       result = { ok: true, logs: await processes.getAgentLogs(target, Number(value('--tail') || 50)) };
     } else throw new Error(`Unsupported process operation: ${action}`);
   }
+  else if (operation === 'fork' || operation === 'resume') {
+    if (positional.length !== (operation === 'fork' ? 1 : 2)) throw new Error(`${operation} requires a job${operation === 'resume' ? ' and quoted text' : ''}.`);
+    result = await continueJob(positional[0], operation === 'fork' ? 'Continue from this session.' : positional[1], { fork: operation === 'fork', atTurn: value('--at') });
+    if (!result.ok) process.exitCode = 1;
+  }
+  else if (operation === 'cancel') {
+    result = await cancelJob(positional[0]);
+  }
+  else if (['reply', 'approve', 'interrupt', 'goal'].includes(operation)) {
+    if (!positional[0]) throw new Error(`${operation} requires a job ID.`);
+    if (positional.length !== (operation === 'approve' ? 3 : operation === 'interrupt' ? 1 : 2)) {
+      throw new Error(`${operation}: supply a job${operation === 'approve' ? ', request ID, and allow or deny' : operation === 'interrupt' ? '' : ' and quoted text'}.`);
+    }
+    result = await appendCommand(positional[0], { type: operation,
+      ...(operation === 'approve' ? { requestId: positional[1], value: positional[2] } : operation === 'interrupt' ? {} : { text: positional[1] }) },
+    { local: has('--local-delivery') });
+  }
+  else if (operation === 'mcp') {
+    const { runMcpServer, QUESTION_TIMEOUT_MS } = await import('./src/mcp-server.mjs');
+    await runMcpServer({ approvalPolicy: value('--approvals') || 'auto',
+      questionTimeoutMs: value('--question-timeout-ms') === undefined ? QUESTION_TIMEOUT_MS : Number(value('--question-timeout-ms')) });
+    return;
+  }
+  else if (operation === 'watch') {
+    // A-107: a dispatched agent's live status and latest events, by log path or job prefix.
+    const target = positional[0];
+    const jobs = path.join(configDir(), 'jobs');
+    let file = target && target.endsWith('.events.jsonl') ? path.resolve(target) : null;
+    if (target && !file) {
+      try {
+        const job = resolveJob(target);
+        const canonical = path.join(jobs, `${job.id}.events.jsonl`);
+        if (fs.existsSync(canonical)) file = canonical;
+      } catch (error) {
+        if (!error.message.startsWith('No job log matches')) throw error;
+      }
+    }
+    if (!file) {
+      const names = fs.existsSync(jobs) ? fs.readdirSync(jobs).filter(name => name.endsWith('.events.jsonl') && (!target || name.startsWith(target))) : [];
+      const newest = names.map(name => ({ name, at: fs.statSync(path.join(jobs, name)).mtimeMs })).sort((a, b) => b.at - a.at)[0];
+      if (!newest) throw new Error(target ? `No job log matches ${target}` : 'No dispatched job has a live log yet');
+      file = path.join(jobs, newest.name);
+    }
+    const { readProgress } = await import('./src/worker.mjs');
+    result = { ok: true, file, ...readProgress(file, Number(value('--tail') || 20)), waiting: waitingRequests(file) };
+  }
   else if(operation==='dispatch') {
     if(!args.includes('--stdin'))throw new Error('Task requests must arrive through stdin: pass --stdin with JSON {agent, cwd, prompt}');
     const input=fs.readFileSync(0,'utf8');if(Buffer.byteLength(input)>65536)throw new Error('Task request too large');
-    const request=validateDispatchRequest(JSON.parse(input));
-    result=await dispatchWithReceipt(request,{node:request.node || 'local',role:'Dispatch'});
+    const request=validateDispatchRequest({...JSON.parse(input),...controls()});
+    // A-107: a local dispatch streams its agent's events to a live log, announced before it starts.
+    const progressFile=(request.node||'local')==='local'?path.join(configDir(),'jobs',`${process.env.TR_METAHARNESS_JOB || `dispatch-${Date.now().toString(36)}-${request.agent}`}.events.jsonl`):undefined;
+    if(progressFile)console.error(JSON.stringify({progress:progressFile,agent:request.agent}));
+    result=await dispatchWithReceipt(progressFile?{...request,progressFile}:request,{node:request.node || 'local',role:'Dispatch',manageWrites:true});
     if(!result.ok)process.exitCode=1;
   }
   else if (operation === 'inspect') {
@@ -321,6 +420,7 @@ async function runOperation(argv) {
     result = await executeCommand({ ...request, plugin });
     if (!result.ok) process.exitCode = 1;
   } else throw new Error(`Unknown operation: ${operation}`);
-  console.log(JSON.stringify(result));
+  if (cancellationResult()) process.exitCode = cancellationResult().exitCode;
+  return result;
 }
 export default run;

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/package-lock.json

@@ -1,17 +1,17 @@
 {
   "name": "tr-plugin-meta-harness",
-  "version": "0.3.9",
+  "version": "0.3.13",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-meta-harness",
-      "version": "0.3.9",
+      "version": "0.3.13",
       "dependencies": {
         "@gregiteen/ssss-cli": "0.14.5"
       },
       "devDependencies": {
-        "total-recall-brain": "3.43.3"
+        "total-recall-brain": "3.44.0"
       }
     },
     "node_modules/@alcalzone/ansi-tokenize": {
@@ -5546,9 +5546,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.43.3",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.43.3.tgz",
-      "integrity": "sha512-yjfPN/BQxEEa+iodyFXQov/6fRt1pZg/7RcmgsbpALwBt6Ki3JJjT3tzArBC7NxHQmXgGYyKnCYId6xe/W2rPg==",
+      "version": "3.44.0",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.44.0.tgz",
+      "integrity": "sha512-VNPaIO9zsSwoxAsJ5ByIQBP9zPpLq4RiQO7Vrex4rBOHFQJT50P7utcZiLMSZTyZJU4C/m5uB8qTCSBMp6+l6Q==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -5556,7 +5556,7 @@
       ],
       "dependencies": {
         "@simplewebauthn/server": "^13.3.2",
-        "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.4",
+        "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.5",
         "bcrypt": "^6.0.0",
         "better-sqlite3": "^12.11.1",
         "cookie-parser": "^1.4.7",

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tr-plugin-meta-harness",
-  "version": "0.3.9",
-  "description": "Total Recall Meta Harness plugin",
+  "version": "0.3.13",
+  "description": "Total Recall Metaharness plugin",
   "type": "module",
   "scripts": {
     "test": "node --import ./test/isolate.mjs --test test/*.test.mjs",