total-recall-brain 3.44.0 → 3.46.0

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/remote-execution.md

@@ -0,0 +1,22 @@
+---
+type: ui-chunk:chunk
+title: Remote mesh execution result
+description: Run an explicit command on an enrolled peer and read its actual exit result.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: remote-execution
+intents: [execute mesh command, run command on peer, check remote exit code, remote shell command result]
+surfaces: [page]
+operations: [exec]
+data: ["exec:/success", "exec:/exitCode"]
+---
+
+<style>
+  .mesh-run { padding:var(--spacing-md); background:var(--color-surface); border-block-end:1px solid var(--color-border); }
+  .mesh-run h2 { margin-top:0; }
+  .mesh-run strong { color:var(--color-accent); }
+</style>
+<section class="mesh-run">
+  <h2>Read the command result</h2>
+  <p>Choose the peer and command explicitly. The <strong>exit code</strong> comes from the remote execution. Check it before treating a successful connection as a successful command.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/secret-grants.md

@@ -0,0 +1,26 @@
+---
+type: ui-chunk:chunk
+title: Mesh secret grants
+description: Review the selected node, user, or tag scope and verify the outcome of an explicit grant change.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: secret-grants
+intents: [list mesh secret grants, revoke mesh credential access, allow named keys on node, review Auth trust boundary]
+surfaces: [page]
+operations: [grants]
+data: ["grants:/ok"]
+---
+
+<style>
+  .mesh-grants { padding:var(--spacing-md); border-inline-start:3px solid var(--color-warn); background:var(--color-surface); }
+  .mesh-grants h2 { margin-top:0; }
+  .mesh-grants dt { color:var(--color-accent); }
+  .mesh-grants dd { margin:0 0 .45em; }
+</style>
+<section class="mesh-grants">
+  <h2>Review machine access to secrets</h2>
+  <dl>
+    <dt>Inspect</dt><dd>Read the grant inventory in Boundary.</dd>
+    <dt>Change</dt><dd>Select a node, tag, or user and confirm the permitted key names before adding or removing a grant.</dd>
+  </dl>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/{card.js → home.js}

@@ -1,4 +1,4 @@
-/** The mesh operator's five views. All observations arrive through the scoped host. */
+/** Mesh Home uses owner commands for independent fleet observations. */
 const DASH = '—';
 const words = value => typeof value === 'string' && value ? value : DASH;
 const list = value => Array.isArray(value) ? value : [];
@@ -65,9 +65,9 @@ export function capabilityState(node, column) {
 function hostName(url) { try { return new URL(url).host; } catch { return DASH; } }
 const sourceLabels = { grants: 'Secrets', plugins: 'Plugins', updates: 'Updates', tasks: 'Scheduled work', agents: 'Agents', alerts: 'Alerts', deployments: 'Deployments', policy: 'Policy', presence: 'Presence' };
 
-export class MeshlinkControlCard extends HTMLElement {
+export class MeshHome extends HTMLElement {
   constructor() {
-    super(); this.status = null; this.doctor = null; this.leader = null;
+    super(); this.status = null; this.nodes = null; this.credential = null; this.doctor = null; this.leader = null;
     this.errors = {}; this.views = {}; this.loading = {}; this.pings = {};
     this.screen = 'machines'; this.selected = null; this.filters = new Set();
     this.loginDrafts = {};
@@ -80,11 +80,8 @@ export class MeshlinkControlCard extends HTMLElement {
   connectedCallback() {
     if (!this.shadowRoot) this.attachShadow({ mode: 'open' });
     this.render();
-    this.onScreen = event => { if ((!event.detail?.pluginId || event.detail.pluginId === this.host?.pluginId) && this.screens.some(s => s.id === event.detail?.screen)) void this.show(event.detail.screen); };
-    window.addEventListener('plugin-show-screen', this.onScreen);
     void this.read();
   }
-  disconnectedCallback() { window.removeEventListener('plugin-show-screen', this.onScreen); }
   async call(operation, args = []) {
     if (!this.host?.run) throw new Error('Mesh command runner unavailable. Open this view in the dashboard.');
     const result = await this.host.run(operation, args);
@@ -96,19 +93,29 @@ export class MeshlinkControlCard extends HTMLElement {
     try {
       const value = asObject(await this.call(op, args));
       if (!value || key === 'doctor' && !Array.isArray(value) || key !== 'doctor' && Array.isArray(value)) throw new Error('Command returned an unreadable observation.');
+      if (key === 'nodes' && !Array.isArray(value.nodes)) throw new Error('Mesh did not return a node list.');
+      if (key === 'credential' && typeof value.present !== 'boolean') throw new Error('Auth did not return credential presence.');
       this[key] = value;
-    } catch (error) { this.errors[key] = error.message; }
+    } catch (error) { this.errors[key] = key === 'credential' ? 'Credential status is unavailable from Auth.' : error.message; }
     this.paint();
   }
   read() {
     if (this.busy) return this.readPromise;
+    if (!this.loading.doctor) { this.doctor = null; delete this.errors.doctor; }
     this.busy = true; this.lastAttempt = new Date().toISOString(); this.pings = {}; this.paint();
     this.readPromise = Promise.all([
-      this.readOne('status', 'status', ['--json']), this.readOne('doctor', 'doctor', ['--json']),
+      this.readOne('status', 'status', ['--json']), this.readOne('nodes', 'nodes', ['--json']),
+      this.readOne('credential', 'token-status', ['--json']),
       this.readOne('leader', 'leader', ['--json']), this.readView(this.screen, true),
     ]).finally(() => { this.busy = false; this.paint(); });
     return this.readPromise;
   }
+  async readDoctor() {
+    if (this.loading.doctor) return;
+    this.loading.doctor = true;
+    try { await this.readOne('doctor', 'doctor', ['--json']); }
+    finally { delete this.loading.doctor; this.paint(); }
+  }
   async readView(screen, force = false) {
     if (this.loading[screen]) return this.loading[screen];
     if (this.views[screen] && !force) return;
@@ -126,7 +133,6 @@ export class MeshlinkControlCard extends HTMLElement {
   async show(screen) {
     if (!this.screens.some(s => s.id === screen)) return;
     this.screen = screen; this.confirmEnrollment = false; this.paint();
-    this.host?.screenChanged?.(screen);
     if (this.busy) await this.readPromise;
     await this.readView(screen);
   }
@@ -168,29 +174,92 @@ export class MeshlinkControlCard extends HTMLElement {
   render() {
     this.shadowRoot.innerHTML = `
       <style>
-      :host { --face-bg:var(--bg-primary,#0b1020); --face-panel:var(--bg-secondary,#121933); --face-line:var(--border,#26305a); --face-text:var(--text-primary,#e8ecff); --face-muted:var(--text-secondary,#aab5d7); --face-brand:var(--accent,#818cf8); --face-ok:#34d399; --face-warn:#fbbf24; --face-danger:#f87171; display:block; color:var(--face-text); background:var(--face-bg); font:14px/1.5 system-ui,sans-serif; padding:16px; container-type:inline-size; border:1px solid var(--face-line); border-radius:8px; }
-      * { box-sizing:border-box; min-width:0; } h2,h3,p { margin:0 0 8px; } h2 { font-size:18px; } h3 { font-size:14px; } button,input { font:inherit; min-height:44px; color:inherit; background:var(--face-bg); border:1px solid var(--face-line); border-radius:5px; padding:8px 12px; } button { cursor:pointer; text-align:left; } button:hover { border-color:var(--face-brand); } button:disabled { opacity:.65; cursor:wait; } button:focus-visible,input:focus-visible,summary:focus-visible { outline:2px solid var(--face-brand); outline-offset:2px; } [data-tone=ok] { color:var(--face-ok); } [data-tone=warn] { color:var(--face-warn); } [data-tone=danger] { color:var(--face-danger); } .muted,dt,small { color:var(--face-muted); } .strip { display:grid; grid-template-columns:repeat(3,minmax(0,1fr)); gap:12px; margin-bottom:14px; } .strip strong { display:block; overflow-wrap:anywhere; } .verdict { border-left:3px solid currentColor; padding:8px 12px; background:var(--face-panel); } nav { display:flex; flex-wrap:wrap; gap:6px; margin:14px 0; } nav button[aria-selected=true] { border-color:var(--face-brand); background:var(--face-panel); } .refresh { margin-left:auto; } .block { padding:14px; background:var(--face-panel); border:1px solid var(--face-line); border-radius:6px; margin-bottom:12px; overflow-wrap:anywhere; } .panes { display:grid; grid-template-columns:minmax(190px,.8fr) minmax(0,1.6fr); gap:12px; align-items:start; } .roster { display:grid; gap:6px; } .roster button { display:grid; gap:3px; width:100%; } .roster button[aria-pressed=true] { border-color:var(--face-brand); } .ladder { display:grid; gap:8px; } .rung { display:grid; grid-template-columns:70px 1fr; gap:8px; border:1px dashed var(--face-line); padding:10px; border-radius:4px; } .rung[data-state=passed] { border-style:solid; border-left:4px solid var(--face-ok); } .rung[data-state=failed] { border-style:double; border-left:4px solid var(--face-danger); } .rung[data-state=na] { border-style:dotted; color:var(--face-muted); } .actions,.filters { display:flex; flex-wrap:wrap; gap:8px; margin:10px 0; } .filters label { display:flex; align-items:center; gap:6px; min-height:44px; padding:0 8px; border:1px solid var(--face-line); border-radius:4px; } .filters input { min-height:20px; width:20px; } dl { display:grid; grid-template-columns:minmax(80px,.6fr) minmax(0,1.4fr); gap:5px 12px; margin:10px 0; } dd { margin:0; overflow-wrap:anywhere; } .command { white-space:pre-wrap; overflow-wrap:anywhere; font:12px/1.6 ui-monospace,monospace; background:var(--face-bg); padding:12px; border:1px solid var(--face-line); border-radius:4px; } .error { color:var(--face-danger); padding:10px; border:1px solid var(--face-danger); border-radius:4px; margin:8px 0; overflow-wrap:anywhere; } .flow { border-bottom:1px solid var(--face-line); padding:12px 0; } .flow:last-child { border:0; } .table-wrap { max-width:100%; overflow:auto; } table { border-collapse:collapse; width:100%; font-size:12px; } th,td { text-align:left; padding:9px; border:1px solid var(--face-line); vertical-align:top; } th { background:var(--face-bg); } summary { min-height:44px; cursor:pointer; padding:10px 0; } .recorded { margin-top:12px; } .login-form { display:grid; grid-template-columns:repeat(2,minmax(0,1fr)); gap:8px; } .login-form label { display:grid; gap:3px; } .login-form button { grid-column:1/-1; } .danger { border-color:var(--face-danger); } .foot { margin-top:12px; font-size:12px; color:var(--face-muted); }
-      @container(max-width:690px) { .panes,.strip { grid-template-columns:1fr; } .strip { gap:6px; } .strip strong { display:inline; margin-right:8px; } .login-form { grid-template-columns:1fr; } } @media(prefers-reduced-motion:reduce) { * { animation:none; transition:none; } }
+      :host {
+        display:block; container-type:inline-size;
+        color:var(--color-text,CanvasText); background:var(--color-background,Canvas);
+        border:1px solid var(--color-border,currentColor); border-radius:var(--radius-md,8px);
+        padding:var(--spacing-md,16px); font:14px/1.5 var(--typography-body-font-family,system-ui,sans-serif);
+      }
+      * { box-sizing:border-box; min-width:0; }
+      h2,h3,p { margin:0 0 8px; }
+      h2 { font:600 clamp(1.5rem,5vw,2rem)/1.2 var(--typography-heading-font-family,Georgia,serif); }
+      h3 { font-size:1rem; }
+      header svg { width:1.1em; height:1.1em; vertical-align:middle; color:var(--color-accent,currentColor); }
+      button,input {
+        font:inherit; min-height:44px; color:inherit; background:var(--color-background,Canvas);
+        border:1px solid var(--color-border,currentColor); border-radius:var(--radius-md,8px); padding:8px 12px;
+      }
+      button { cursor:pointer; text-align:left; }
+      button:disabled { opacity:.65; cursor:wait; }
+      button:hover,nav button[aria-selected=true],.roster button[aria-pressed=true] { border-color:var(--color-accent,currentColor); }
+      button:focus-visible,input:focus-visible,summary:focus-visible { outline:2px solid var(--color-accent,currentColor); outline-offset:2px; }
+      [data-tone=ok] { color:var(--color-ok,currentColor); }
+      [data-tone=warn] { color:var(--color-warn,currentColor); }
+      [data-tone=danger],.error { color:var(--color-danger,currentColor); }
+      .muted,dt,small { color:var(--color-muted,currentColor); }
+      .strip { display:grid; grid-template-columns:repeat(4,minmax(0,1fr)); gap:12px; margin:14px 0; }
+      .strip div { border-top:1px solid var(--color-border,currentColor); padding-top:8px; }
+      .strip strong { display:block; overflow-wrap:anywhere; }
+      .verdict { border-inline-start:3px solid currentColor; padding:8px 12px; background:var(--color-surface,Canvas); }
+      nav,.actions,.filters { display:flex; flex-wrap:wrap; gap:8px; margin:12px 0; }
+      nav button[aria-selected=true] { background:var(--color-surface,Canvas); }
+      .block { padding:14px; background:var(--color-surface,Canvas); border:1px solid var(--color-border,currentColor); border-radius:var(--radius-md,8px); margin-bottom:12px; overflow-wrap:anywhere; }
+      .panes { display:grid; grid-template-columns:minmax(190px,.8fr) minmax(0,1.6fr); gap:12px; align-items:start; }
+      .roster,.ladder { display:grid; gap:8px; }
+      .roster button { display:grid; gap:3px; width:100%; }
+      .rung { display:grid; grid-template-columns:70px 1fr; gap:8px; border:1px dashed var(--color-border,currentColor); padding:10px; }
+      .rung[data-state=passed] { border-style:solid; border-inline-start:4px solid var(--color-ok,currentColor); }
+      .rung[data-state=failed] { border-style:double; border-inline-start:4px solid var(--color-danger,currentColor); }
+      .rung[data-state=na] { border-style:dotted; color:var(--color-muted,currentColor); }
+      .filters label { display:flex; align-items:center; gap:6px; min-height:44px; padding:0 8px; border:1px solid var(--color-border,currentColor); }
+      .filters input { min-height:20px; width:20px; }
+      dl { display:grid; grid-template-columns:minmax(80px,.6fr) minmax(0,1.4fr); gap:5px 12px; margin:10px 0; }
+      dd { margin:0; overflow-wrap:anywhere; }
+      .command { white-space:pre-wrap; overflow-wrap:anywhere; font:12px/1.6 var(--typography-mono-font-family,ui-monospace,monospace); background:var(--color-background,Canvas); padding:12px; border:1px solid var(--color-border,currentColor); }
+      .error { padding:10px; border:1px solid currentColor; margin:8px 0; overflow-wrap:anywhere; }
+      .flow { border-bottom:1px solid var(--color-border,currentColor); padding:12px 0; }
+      .flow:last-child { border:0; }
+      .table-wrap { max-width:100%; overflow:auto; }
+      table { border-collapse:collapse; width:100%; font-size:12px; }
+      th,td { text-align:left; padding:9px; border:1px solid var(--color-border,currentColor); vertical-align:top; }
+      th { background:var(--color-background,Canvas); }
+      summary { min-height:44px; cursor:pointer; padding:10px 0; }
+      .recorded,.foot { margin-top:12px; }
+      .login-form { display:grid; grid-template-columns:repeat(2,minmax(0,1fr)); gap:8px; }
+      .login-form label { display:grid; gap:3px; }
+      .login-form button { grid-column:1/-1; }
+      .danger { border-color:var(--color-danger,currentColor); }
+      .foot { font-size:12px; color:var(--color-muted,currentColor); }
+      @container(max-width:690px) {
+        .panes,.login-form { grid-template-columns:1fr; }
+        .strip { grid-template-columns:repeat(2,minmax(0,1fr)); }
+      }
       </style>
-      <header><h2><svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" aria-hidden="true"><circle cx="12" cy="4" r="3"/><circle cx="4" cy="19" r="3"/><circle cx="20" cy="19" r="3"/><path d="M10 7 5 16m9-9 5 9M7 19h10"/></svg> HEADSCALE <small>· Your machines</small></h2><div id="strip" class="strip"></div><p id="verdict" class="verdict"></p></header>
-      <nav id="tabs" role="tablist" aria-label="Mesh views"></nav><div id="errors" role="status"></div><main id="body" role="tabpanel"></main><footer id="foot" class="foot"></footer>`;
+      <header><h2><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" aria-hidden="true"><circle cx="12" cy="4" r="3"/><circle cx="4" cy="19" r="3"/><circle cx="20" cy="19" r="3"/><path d="M10 7 5 16m9-9 5 9M7 19h10"/></svg> Network atlas</h2><div id="strip" class="strip"></div><p id="verdict" class="verdict"></p></header>
+      <div id="controls" class="actions"></div><nav id="tabs" role="tablist" aria-label="Mesh views"></nav><div id="errors" role="status"></div><main id="body" role="tabpanel"></main><footer id="foot" class="foot"></footer>`;
     this.paint();
   }
   paint() {
     const root = this.shadowRoot; if (!root?.querySelector('#body')) return;
     const focused = root.activeElement;
     const focusKey = focused && ['id', 'aria-label', 'name'].map(attribute => [attribute, focused.getAttribute(attribute)]).find(([, value]) => value);
-    const verdict = meshVerdict(this.status, this.doctor, this.leader);
+    const roster = this.nodes ? { ...this.status, nodes: this.nodes.nodes } : this.status;
+    const verdict = meshVerdict(this.status && roster, this.doctor, this.leader);
     root.querySelector('#verdict').textContent = verdict.text; root.querySelector('#verdict').dataset.tone = verdict.tone;
     const status = this.status;
     root.querySelector('#strip').replaceChildren(...[
       ['Control', `${hostName(status?.control?.url)} · ${status?.control?.verified === true ? 'Verified' : 'Not verified'}`],
+      ['Auth credential', this.credential?.present === true ? 'Saved in Auth' : this.credential?.present === false ? 'Missing' : this.errors.credential ? 'Unavailable' : 'Checking'],
       ['Leader', `${words(this.leader?.leader?.hostname)} · ${words(this.leader?.leader?.strategy)}`],
       ['This machine', `${words(status?.enrollment?.hostname)} · ${words(status?.enrollment?.state)}`],
     ].map(([title, value]) => this.el('div', {}, this.el('strong', { text: title }), this.el('span', { text: value }))));
-    root.querySelector('#tabs').replaceChildren(...this.screens.map(screen => this.button(screen.label, () => void this.show(screen.id), { role: 'tab', id: `tab-${screen.id}`, 'aria-selected': String(this.screen === screen.id), 'aria-controls': 'body' })), this.button(this.busy ? 'Reading…' : 'Refresh', () => void this.read(), { class: 'refresh', ...(this.busy ? { disabled: '' } : {}) }));
+    root.querySelector('#tabs').replaceChildren(...this.screens.map(screen => this.button(screen.label, () => void this.show(screen.id), { role: 'tab', id: `tab-${screen.id}`, 'aria-selected': String(this.screen === screen.id), 'aria-controls': 'body' })));
+    root.querySelector('#controls').replaceChildren(
+      this.button(this.busy ? 'Reading…' : 'Refresh network', () => void this.read(), { id: 'refresh', ...(this.busy ? { disabled: '' } : {}) }),
+      ...(this.canRun('doctor') ? [this.button(this.loading.doctor ? 'Verifying…' : 'Verify fleet execution', () => void this.readDoctor(), { id: 'verify-fleet', ...(this.loading.doctor ? { disabled: '' } : {}) })] : [])
+    );
     root.querySelector('#errors').replaceChildren(...Object.entries(this.errors).map(([key, error]) => this.text(`${key}: ${error}`, 'error')), ...(status?.control?.error || status?.control?.reason ? [this.text(`Control: ${status.control.error || status.control.reason}`, 'error')] : []), ...(this.actionMessage ? [this.text(this.actionMessage)] : []));
-    const nodes = joinNodes(status, this.doctor);
+    const nodes = joinNodes(roster, this.doctor);
     const body = root.querySelector('#body'); body.setAttribute('aria-labelledby', `tab-${this.screen}`);
     const firstRun = status?.configured === false && ['no-headscale-api-key', 'no-control-url'].includes(status.control?.reason);
     body.replaceChildren(firstRun ? this.firstRun() : this.screen === 'machines' ? this.machines(nodes) : this.screen === 'flows' ? this.flows() : this.screen === 'placement' ? this.placement(nodes) : this.screen === 'boundary' ? this.boundary(nodes) : this.join());
@@ -216,7 +285,8 @@ export class MeshlinkControlCard extends HTMLElement {
     [...roster.children].forEach((button, index) => button.append(this.el('strong', { text: words(live[index].hostname) }), this.el('span', { text: live[index].label, dataset: { tone: live[index].tone } }), this.el('small', { text: this.presenceFor(live[index]) })));
     const recorded = nodes.filter(node => node.vaultOnly);
     if (recorded.length) roster.append(this.el('details', { class: 'recorded' }, this.el('summary', { text: `${recorded.length} recorded-only record${recorded.length === 1 ? '' : 's'}` }), recorded.map(node => this.text(`${words(node.hostname)} · recorded ${words(node.last_heartbeat)}`, 'muted'))));
-    return this.el('div', { class: 'panes' }, this.section(`${this.status ? live.length : DASH} members`, roster), selected ? this.machineDetail(selected) : this.section('Machines', this.text(this.status ? 'No member machines returned.' : 'Machine inventory is unreadable.')));
+    const inventoryRead = Boolean(this.nodes || this.status);
+    return this.el('div', { class: 'panes' }, this.section(`${inventoryRead ? live.length : DASH} members`, roster), selected ? this.machineDetail(selected) : this.section('Machines', this.text(inventoryRead ? 'No member machines returned.' : 'Machine inventory is unreadable.')));
   }
   machineDetail(node) {
     const ping = this.pings[node.ip];
@@ -227,11 +297,12 @@ export class MeshlinkControlCard extends HTMLElement {
       ['Login', node.self || !applicable ? 'na' : node.access_state === 'configured' ? 'passed' : 'failed', node.self ? 'Not applicable · local execution' : !applicable ? 'Not applicable · no remote shell on this device' : node.access_state === 'configured' ? `Recorded ${words(node.access?.ssh_user)} · verified ${words(node.access?.verified_at)}` : 'No SSH login recorded'],
       ['Run', !applicable ? 'na' : node.reach === 'reachable' ? 'passed' : node.reach === 'unreachable' ? 'failed' : 'checking', !applicable ? 'Not applicable' : node.reach === 'reachable' ? 'Probe command executed' : node.reason || 'Not yet checked'],
     ];
-    const actions = this.el('div', { class: 'actions' }, !node.self && node.ip ? this.button('Ping now', () => void this.ping(node)) : null, applicable ? this.button('Verify execution', () => void this.readOne('doctor', 'doctor', ['--json'])) : null);
+    const actions = !node.self && node.ip && this.canRun('ping')
+      ? this.el('div', { class: 'actions' }, this.button('Ping now', () => void this.ping(node))) : null;
     const detail = this.section(words(node.hostname), this.text(`${words(node.ip)} · ${words(node.os)}`, 'muted'), this.el('div', { class: 'ladder' }, rungs.map(([name, state, evidence]) => this.el('div', { class: 'rung', dataset: { state } }, this.el('strong', { text: name }), this.el('div', {}, this.el('b', { text: state === 'na' ? 'Not applicable' : state === 'checking' ? 'Not yet checked' : state === 'passed' ? 'Passed' : 'Failed' }), this.text(evidence, 'muted'))))), actions);
     if (node.loginApplicable && node.access_state !== 'configured') {
       if (this.canRun('access')) detail.append(this.button('Find a login', () => void this.action('access', ['discover', node.ip], 'Login discovery')), this.loginForm(node));
-      else detail.append(this.text('This card is read-only. Find or record a login through the CLI.'), this.command(`total-recall mesh access discover ${node.ip}\ntotal-recall mesh access ${node.ip} --user <login>`));
+      else detail.append(this.text('This Home is read-only. Find or record a login through the CLI.'), this.command(`total-recall mesh access discover ${node.ip}\ntotal-recall mesh access ${node.ip} --user <login>`));
     }
     if (node.reach === 'reachable' && !node.self) detail.append(this.text('SSH handoff'), this.command(`total-recall mesh ssh ${node.ip}`));
     detail.append(this.el('h3', { text: 'Recorded earlier' }), this.fields([
@@ -362,8 +433,8 @@ export class MeshlinkControlCard extends HTMLElement {
       view.append(this.button(`Re-enroll ${target}`, () => { this.confirmEnrollment = true; this.paint(); }, { class: 'danger' }));
       if (this.confirmEnrollment) view.append(this.text(`Re-enroll ${target}? This may interrupt its mesh connection.`, 'error'), this.button(`Confirm re-enrollment of ${target}`, () => { this.confirmEnrollment = false; void this.action('enroll', ['--force'], 'Re-enrollment'); }, { class: 'danger', 'data-action': 'confirm-enroll' }), this.button('Cancel', () => { this.confirmEnrollment = false; this.paint(); }));
     }
-    else if (enrollment.hostname) view.append(this.text(`This card is read-only. Re-enrolling ${target} can interrupt its connection; use the CLI after confirming that target.`), this.command('total-recall mesh enroll --force'));
+    else if (enrollment.hostname) view.append(this.text(`This Home is read-only. Re-enrolling ${target} can interrupt its connection. Use the CLI after confirming that target.`), this.command('total-recall mesh enroll --force'));
     return view;
   }
 }
-if (!customElements.get('tr-mesh-card')) customElements.define('tr-mesh-card', MeshlinkControlCard);
+customElements.define('mesh-home', MeshHome);

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/DESIGN.md

@@ -0,0 +1,86 @@
+---
+name: Metaharness
+description: A clear handoff from Total Recall's brain selection to the operator's chosen Chat harness.
+colors:
+  canvas: '#0c1427'
+  background: '{colors.canvas}'
+  surface: '#1e293b'
+  text: '#f1f5f9'
+  muted: '#94a3b8'
+  signal: '#38bdf8'
+  primary: '#3b82f6'
+  line: '#334155'
+  success: '#10b981'
+  warning: '#f59e0b'
+  danger: '#ef4444'
+typography:
+  title:
+    fontFamily: system-ui, sans-serif
+    fontSize: 18px
+    fontWeight: 650
+    lineHeight: 1.2
+  body:
+    fontFamily: system-ui, sans-serif
+    fontSize: 14px
+    lineHeight: 1.5
+  label:
+    fontFamily: ui-monospace, monospace
+    fontSize: 11px
+    fontWeight: 600
+    letterSpacing: 0.08em
+rounded:
+  frame: 8px
+spacing:
+  inset: 16px
+  row: 12px
+components:
+  chat-handoff:
+    backgroundColor: '{colors.canvas}'
+    textColor: '{colors.text}'
+    typography: '{typography.body}'
+    rounded: '{rounded.frame}'
+    padding: '{spacing.inset}'
+---
+
+## Overview
+
+Metaharness works like a dispatch board. Readers should understand the selected
+harness, the brain scope and the next action from a quick scan.
+
+## Colors
+
+Use the deep navy {colors.canvas} under pale {colors.text}. Reserve blue
+{colors.signal} for the route between the brain selection and its destination.
+Use status colors for verified outcomes from the host.
+
+## Typography
+
+Use the quiet, compact {typography.label} for handoff stages. Use
+{typography.title} for the section heading and {typography.body} for instructions.
+
+## Layout
+
+Give the heading and route a full-width row at narrow drawer sizes. Stack route
+stages when their labels would wrap. In a wider drawer, use one route line.
+
+## Elevation & Depth
+
+Separate the saved route from its controls with a single border. Keep the
+workflow blocks flat so their order stays clear when combined in a drawer.
+
+## Shapes
+
+Use compact rounded frames and controls. Label the route stages with text.
+
+## Components
+
+The Chat handoff block explains the route. The native Home shows the saved
+harness, registered choices and the optional destination. The bottom drawer
+supplies brain selection and the launch and copy controls. Each operational
+block describes one separate workflow and its observed owner data.
+
+## Do's and Don'ts
+
+Show the route in reading order. Keep operational state sourced from Metaharness.
+Keep the handoff marker still and show clear focus and loading states. Use text
+to distinguish saved configuration, draft behavior and unavailable reads.

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/README.md

@@ -1,4 +1,4 @@
-# Meta Harness
+# Metaharness
 
 Built-in and validated custom adapters share one plugin. Use `dispatch` or
 `route --execute` for agent work. `runtime <agent> ...` accepts supported maintenance
@@ -17,10 +17,12 @@ is removed after execution. Setup failure or an unready context stops dispatch.
 `docs-refresh`, `docs-ensure`, `docs-status`, `docs-read` and `docs-search` manage
 downloaded official documentation rather than a list of links. Content is hashed,
 bounded and refreshed after 24 hours. Maintenance uses the existing Total Recall
-daemon's plugin task, refreshing one stale adapter per run. Failed pages remain
+daemon's plugin task, attempting every stale adapter per run. Failed pages remain
 visible as failures and cannot certify complete coverage; successful cached
 content remains readable. `setup --node <recorded-node>` selects maintenance
-placement without creating a second scheduler.
+placement for `maintenance`, `maintenance --models` and `alerts check` without
+creating a second scheduler. Each maintenance step reports its failures. A failed
+setup or gate install does not prevent documentation refresh for other harnesses.
 
 Standalone Total Recall owner for CLI-agent discovery and explicit mesh command execution. Install with `total-recall plugin install <path-or-private-git-url>`. Installation rebuilds the plugin inventory, CLI library and connected instruction surfaces. No model account is created or selected automatically.
 
@@ -43,7 +45,7 @@ The report separates native login and hook configuration from recent hook
 decisions and completed managed runs. Its run evidence is historical; use the
 timestamps and last attempt to see whether an agent has since stopped working.
 Native hook activity alone does not prove that an agent was launched through
-Meta Harness. A fleet report lists offline nodes, missing CLI access, and
+Metaharness. A fleet report lists offline nodes, missing CLI access, and
 installed versions that cannot provide adoption evidence.
 
 `request.json` selects one installed plugin operation, its literal arguments, a node and an agent:
@@ -61,7 +63,7 @@ installed versions that cannot provide adoption evidence.
 }
 ```
 
-For remote nodes, supply `execution.cwd` as an explicit absolute workspace. `agent: "direct"` runs the actual installed Total Recall CLI without a model. A remote agent task enters the destination's installed Meta Harness and records its receipt there. Remote access comes from recorded mesh entities and verified SSH configuration; unavailable nodes or binaries produce errors. Secrets are never accepted in an agent prompt. Existing account metadata is inspected without printing credentials or substituting provider API keys.
+For remote nodes, supply `execution.cwd` as an explicit absolute workspace. `agent: "direct"` runs the actual installed Total Recall CLI without a model. A remote agent task enters the destination's installed Metaharness and records its receipt there. Remote access comes from recorded mesh entities and verified SSH configuration; unavailable nodes or binaries produce errors. Secrets are never accepted in an agent prompt. Existing account metadata is inspected without printing credentials or substituting provider API keys.
 
 The four permissions are strict boolean **command-effect admission controls**. They allow or deny the selected plugin command before dispatch. They are not a network policy or an OS sandbox for every action a model might propose. Supported adapter write modes are scoped through the vendor CLI; vendor approval and sandbox defaults stay enabled. The host's authenticated authorization still applies.
 
@@ -75,9 +77,9 @@ Run `total-recall meta-harness included-enforce` to limit this node's managed di
 
 To approve OpenRouter on this node, run `total-recall meta-harness openrouter-bind <harness> <auth-key-name> --model <openrouter-model-id> --json`. Then select that harness by name when dispatching. Automatic routing continues to choose from the included subscription pool.
 
-Run `total-recall harness dispatch codex "Run pwd and report the output" --json` to see the final reply and `toolResults`. Codex, Claude, DSH, Pi, Hermes and OpenClaw report native tool outcomes, available exit codes and bounded output. OpenClaw reports `toolEvidenceError` if its gateway cannot return the run's tool results. Adoption receipts retain the outcomes without the output text.
+Run `total-recall harness dispatch codex "Run pwd and report the output" --json` to see the final reply and `toolResults`. Codex, Claude, DSH, Pi, Hermes and OpenClaw report native tool outcomes, available exit codes and bounded output. OpenClaw reports `toolEvidenceError` if its gateway cannot return the run's tool results. For background jobs, run `total-recall meta-harness process logs <job-id> --json` and read `toolResults` in the completion record. Adoption receipts retain the outcomes without the output text.
 
-For Claude Max, sign in on the execution host with `claude auth login --claudeai`. Check that Usage credits are off in the account's Usage settings. Pass `{"organization":"<orgId from claude auth status>","usageCreditsEnabled":false}` to `included-bind-claude-plan --stdin`. Meta Harness prefers the bound plan and checks the native login on every turn. Keep Usage credits off on that account. Claude manages that switch and enforces the plan limits. [Claude's subscription and SDK billing](https://support.claude.com/en/articles/15036540-use-the-claude-agent-sdk-with-your-claude-plan)
+For Claude Max, sign in on the execution host with `claude auth login --claudeai`. Check that Usage credits are off in the account's Usage settings. Pass `{"organization":"<orgId from claude auth status>","usageCreditsEnabled":false}` to `included-bind-claude-plan --stdin`. Metaharness prefers the bound plan and checks the native login on every turn. Keep Usage credits off on that account. Claude manages that switch and enforces the plan limits. [Claude's subscription and SDK billing](https://support.claude.com/en/articles/15036540-use-the-claude-agent-sdk-with-your-claude-plan)
 
 Before using `included-bind-claude --stdin`, verify the Max credit grant, key hint and organization in Claude Console. Supply `keyName` (the Total Recall Auth entry), `organization`, the masked `keyHint`, `expiresAt`, `creditSource: "claude-max"`, `paidBalanceCents: 0` and false values for `autoReload`, `paymentMethod` and `invoiced`. The binding expires with the observed grant. Reverify after a key or billing change.
 
@@ -126,6 +128,20 @@ SSSS execution receipts. Actual process exit and finish metadata are distinct fr
 verification results; unavailable model metadata remains null. Thread operations
 include list, show, create, update, close and delete, using native SSSS state.
 
+Every review result is stored in an append-only SSSS ledger beside the thread
+store. It retains the selected diff, commit, reviewer, verdict and disposition,
+including failed reviews and `NO_DIFF`. `reviews --json` reads the ledger.
+Deleting a thread does not remove its reviews. A failed ledger write returns
+`ok: false` with `reviewStoreError` and the completed result.
+
+`learn` reports scorecards, walls and proposals from run receipts. Routing reads
+these receipts directly. The memory emit option has been removed.
+
+`threads cleanup-fixtures --dry-run` previews the one-time cleanup of exact test
+fixture titles. `threads cleanup-fixtures` applies it and stores the removed IDs,
+titles, statuses, source test files and retained IDs in the same SSSS operation.
+Real end-to-end job threads stay in place, including failed attempts.
+
 Custom adapter declarations preserve scoped credentials, optional authentication
 probes and HTTPS documentation URLs. IDs and paths reject traversal and symbolic
 links. Credentials reach only the declaring runner through the auth store. A
@@ -148,14 +164,33 @@ The active five-file suite and evidence live in
 owner/core suites, plugin/scaffold validation, real dashboard inspection and
 recorded acceptance evidence. Fixture tests do not certify live accounts, remote
 execution or recurring maintenance. The operator requires completing verification
-before Meta Harness runs task work.
+before Metaharness runs task work.
 
 Cloudroom setup material remains under `cloudroom/`. Its plugin implementation
 follows this foundation and requires its own current audit and plan.
 
 ### Installed and standalone verification
 
-Use the installed plugin for CLI execution and maintenance. The repository has a pure planning capability under `capability/`. The current manifest does not declare it for vendoring. See the [Meta Harness tracker](docs/projects/in-progress/META_HARNESS_UNIFICATION/META_HARNESS_UNIFICATION_PROJECT_TRACKER.md) for current package, execution and hook acceptance.
+Use the installed plugin for CLI execution and maintenance. The repository has a pure planning capability under `capability/`. The current manifest does not declare it for vendoring. See the [Metaharness tracker](docs/projects/in-progress/META_HARNESS_UNIFICATION/META_HARNESS_UNIFICATION_PROJECT_TRACKER.md) for current package, execution and hook acceptance.
+
+## Default Chat
+
+Open **Metaharness** from the dashboard's Plugins folder to select and save a
+default harness. The Chat drawer uses that default with the selected brains.
+Customize the native Home in `DESIGN.md`. The owner blocks in `ui/chunks/`
+cover execution, routing, usage, documentation, maintenance and run evidence.
+
+`total-recall meta-harness chat-default codex --json` sets the host's default
+Chat harness. Choose an adapter from the catalog or from the choices returned
+by `total-recall meta-harness chat-target --json`. The default applies to every
+brain selection.
+
+For example, `total-recall meta-harness chat-target --brains global,project:docs --json`
+returns the chosen harness and draft context for those two brain IDs. A Codex
+target opens a native draft that the operator can review before sending. Other
+harnesses can use an explicit HTTPS launch URL configured with `--url` and
+copyable context. Use a launch URL without embedded credentials, a query, or a
+fragment. Omitting `--url` selects the adapter's built-in handoff, if available.
 
 ## Using this from an agent
 

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/capability/BRICK.md

@@ -1,4 +1,4 @@
-# Meta Harness Capability Brick
+# Metaharness Capability Brick
 
 A zero-dependency, host-free pure ES module providing universal agent harness discovery, two-stage complexity classification, cost-vs-frontier routing, gate cascade evaluation, and execution envelope construction.
 

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/capability/index.mjs

@@ -1,5 +1,5 @@
 /**
- * Meta Harness Capability Brick
+ * Metaharness Capability Brick
  * Zero-dependency, host-free pure ES module for agent routing,
  * complexity classification, adapter discovery, gate cascades, and SSSS receipts.
  * Works identically in any standalone app, edge device, workstation, or cloud environment.
@@ -34,7 +34,7 @@ export const ADAPTER_CATALOG = {
     contextLimit: 200000,
     modalities: ['text', 'code'],
     features: ['subagents', 'mcp', 'headless', 'compact', 'plan_mode'],
-    flags: { prompt: '-p', nonInteractive: '--permission-mode acceptEdits', planMode: '--permission-mode plan', output: '--output-format json' }
+    flags: { prompt: '-p', nonInteractive: '--permission-mode bypassPermissions', planMode: '--permission-mode plan', output: '--output-format json' }
   },
   codex: {
     id: 'codex',
@@ -49,7 +49,7 @@ export const ADAPTER_CATALOG = {
     contextLimit: 128000,
     modalities: ['text', 'code'],
     features: ['mcp', 'headless', 'streaming'],
-    flags: { prompt: 'exec', nonInteractive: '--sandbox workspace-write', planMode: '--sandbox read-only', output: '--json' }
+    flags: { prompt: 'exec', nonInteractive: '--sandbox danger-full-access', planMode: '--sandbox read-only', output: '--json' }
   },
   grok: {
     id: 'grok',
@@ -256,15 +256,27 @@ export function classifyTaskComplexity(taskDescription, options = {}) {
     score += 30;
     factors.push('security-sensitive');
   }
-  if (/multi-file|across (all|every)|entire (repo|fleet)|worktree/.test(text)) {
+  if (/multi-file|across (all|every)|entire (repo|fleet)|worktree|every (mesh )?(node|machine|host|repo)|(all|several|multiple) (repos|repositories|nodes|machines)|\bmesh\b|\bfleet\b/.test(text)) {
     score += 25;
     factors.push('broad-blast-radius');
   }
+  if (/\bproduction\b|\bdeploy|roll ?out|\bdroplet\b|\bcore\b|\bmigration\b|\brelease\b/.test(text)) {
+    score += 15;
+    factors.push('production-or-core');
+  }
   if (/benchmark|telemetry|concurrency|race condition|memory leak/.test(text)) {
     score += 20;
     factors.push('complex-debugging');
   }
-  if (/typo|rename|docstring|comment|formatting|readme|lint fix/.test(text)) {
+  // Several distinct pieces of work (comma or semicolon separated clauses, phases) are not one edit.
+  const clauses = text.split(/[,;]|\band then\b|\bthen\b|\bplus\b/).filter(part => part.trim().split(/\s+/).length >= 3).length;
+  if (clauses >= 4 || /phases? \d+ (and|&) \d+/.test(text)) {
+    score += 15;
+    factors.push('multi-part-work');
+  }
+  // An easy-sounding word ("rename", "readme") lowers the score only when nothing else carries risk:
+  // a rename across repositories or a credential change is not a typo fix.
+  if (/typo|rename|docstring|comment|formatting|readme|lint fix/.test(text) && factors.length === 0) {
     score -= 30;
     factors.push('low-complexity-edit');
   }
@@ -645,7 +657,7 @@ export function decomposeTask(taskDescription, options = {}) {
 }
 
 /**
- * Meta Harness Brick Factory
+ * Metaharness Brick Factory
  */
 export function createMetaHarness(customAdapters = {}) {
   const mergedAdapters = { ...ADAPTER_CATALOG, ...customAdapters };