total-recall-brain 3.45.0 → 3.46.0

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/credential-readiness.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: Mesh credential readiness
+description: Check whether Auth has the shared mesh credential, and use Auth to manage its value.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: credential-readiness
+intents: [is mesh key configured, check mesh token status, save shared mesh credential, refresh Headscale auth]
+surfaces: [page, right]
+operations: [token-status, token]
+data: ["token-status:/present", "token:/present"]
+---
+
+<style>
+  .mesh-auth { padding:var(--spacing-md); background:var(--color-surface); border-radius:var(--radius-md); }
+  .mesh-auth h2 { margin:.25em 0; }
+  .mesh-auth small { color:var(--color-accent); font-weight:600; }
+</style>
+<section class="mesh-auth">
+  <small>Total Recall Auth</small>
+  <h2>Read credential presence</h2>
+  <p>Mesh Home reports whether the shared credential is saved. Check control verification separately. Use the credential setup panel to manage the value through Auth.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/elected-leader.md

@@ -0,0 +1,22 @@
+---
+type: ui-chunk:chunk
+title: Elected mesh leader
+description: Inspect the election strategy, leader server port, and this machine's leader role.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: elected-leader
+intents: [who is mesh leader, mesh leader election, leader port, is this machine leader]
+surfaces: [page, right]
+operations: [leader]
+data: ["leader:/leader/strategy", "leader:/leader/port", "leader:/is_current_node_leader"]
+---
+
+<style>
+  .mesh-leader { padding:var(--spacing-md); background:var(--color-surface); border-radius:var(--radius-md); }
+  .mesh-leader h2 { margin-top:0; }
+  .mesh-leader p { color:var(--color-muted); margin-bottom:0; }
+</style>
+<section class="mesh-leader">
+  <h2>Read the election</h2>
+  <p>See how the leader was selected, which server port was reported, and whether this machine leads the fleet.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/enrollment-key.md

@@ -0,0 +1,22 @@
+---
+type: ui-chunk:chunk
+title: Mesh enrollment key handoff
+description: Issue an enrollment credential in an interactive terminal for the intended new machine.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: enrollment-key
+intents: [create mesh enrollment key, add a device to private mesh, issue preauth key, terminal enrollment credential]
+surfaces: [page]
+operations: [preauthkey]
+---
+
+<style>
+  .mesh-key { padding:var(--spacing-md); border:1px dashed var(--color-border); background:var(--color-surface); }
+  .mesh-key h2 { margin-top:0; }
+  .mesh-key code { color:var(--color-accent); overflow-wrap:anywhere; }
+</style>
+<section class="mesh-key">
+  <h2>Issue the key in a terminal</h2>
+  <p>Run <code>total-recall mesh preauthkey</code> in the interactive terminal and pass the credential directly to the intended machine.</p>
+  <p>Choose reusable or ephemeral enrollment only when it matches that machine’s role.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/file-receipt.md

@@ -0,0 +1,25 @@
+---
+type: ui-chunk:chunk
+title: Verified mesh file transfer
+description: Send one bounded file and verify the destination byte count and SHA-256.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: file-receipt
+intents: [copy file to mesh peer, verify mesh file transfer, check destination checksum, send file through mesh]
+surfaces: [page]
+operations: [file]
+data: ["file:/ok", "file:/bytes", "file:/sha256"]
+---
+
+<style>
+  .mesh-receipt { padding:var(--spacing-md); background:var(--color-surface); border:1px solid var(--color-border); }
+  .mesh-receipt h2 { margin-top:0; }
+  .mesh-receipt li::marker { color:var(--color-ok); }
+</style>
+<section class="mesh-receipt">
+  <h2>Read a transfer receipt</h2>
+  <ol>
+    <li>Choose a peer, source file, and destination explicitly.</li>
+    <li>Read the destination byte count and SHA-256 after the transfer.</li>
+  </ol>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/fleet-execution.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: Fleet execution and capabilities
+description: Verify which configured nodes can run a probe and which runtimes or harnesses they expose.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: fleet-execution
+intents: [verify mesh execution, find node with Docker, check available harnesses, diagnose fleet compute capability]
+surfaces: [page]
+operations: [doctor]
+data: ["doctor:/0/reachable", "doctor:/0/runtimes", "doctor:/0/harnesses"]
+---
+
+<style>
+  .mesh-execution { padding:var(--spacing-md); border-inline-start:3px solid var(--color-ok); background:var(--color-surface); }
+  .mesh-execution h2 { margin-top:0; }
+  .mesh-execution em { color:var(--color-muted); }
+</style>
+<section class="mesh-execution">
+  <h2>Verify where work can run</h2>
+  <p>Request the execution probe before using the Placement matrix. An answering node can report the runtimes and harnesses it found.</p>
+  <p><em>A failed probe leaves that node’s capabilities unknown.</em></p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/fleet-presence.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: Fresh mesh presence
+description: Observe recent activity evidence from reachable peers and check when the fleet observation was made.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: fleet-presence
+intents: [check fleet presence, find active mesh device, see idle evidence, last peer activity]
+surfaces: [page, right, bottom]
+operations: [presence]
+data: ["presence:/success", "presence:/timestamp", "presence:/peers/0/state"]
+---
+
+<style>
+  .mesh-presence { padding:var(--spacing-md); background:var(--color-surface); border-block-end:1px solid var(--color-border); }
+  .mesh-presence h2 { margin-top:0; }
+  .mesh-presence em { color:var(--color-muted); }
+</style>
+<section class="mesh-presence">
+  <h2>Read current device activity</h2>
+  <p>Check whether the peer answered with a fresh activity observation. Use the observation time to distinguish fresh presence from an earlier record.</p>
+  <p><em>Unavailable presence remains unknown.</em></p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/interactive-ssh.md

@@ -0,0 +1,22 @@
+---
+type: ui-chunk:chunk
+title: Interactive mesh SSH
+description: Open a terminal session to a peer using its recorded login and authenticated mesh access.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: interactive-ssh
+intents: [SSH to mesh node, open peer terminal, interactive remote shell, log into fleet machine]
+surfaces: [page, bottom]
+operations: [ssh]
+---
+
+<style>
+  .mesh-shell { padding:var(--spacing-md); background:var(--color-surface); }
+  .mesh-shell h2 { margin-top:0; }
+  .mesh-shell code { display:block; overflow-wrap:anywhere; padding:.55em; background:var(--color-background); color:var(--color-accent); }
+</style>
+<section class="mesh-shell">
+  <h2>Continue in a terminal</h2>
+  <p>Use the peer’s recorded access to open an interactive session.</p>
+  <code>total-recall mesh ssh &lt;peer&gt;</code>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/local-enrollment.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: This machine's mesh enrollment
+description: Inspect local enrollment and backend state and determine whether unattended enrollment is enabled.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: local-enrollment
+intents: [check mesh enrollment, join private mesh, re-enroll local machine, inspect mesh backend]
+surfaces: [page, right]
+operations: [enroll]
+data: ["enroll:/state", "enroll:/backend_state", "enroll:/auto_enroll_enabled"]
+---
+
+<style>
+  .mesh-join { padding:var(--spacing-md); background:var(--color-surface); border-inline-start:3px solid var(--color-warn); }
+  .mesh-join h2 { margin-top:0; }
+  .mesh-join small { color:var(--color-muted); }
+</style>
+<section class="mesh-join">
+  <h2>Check how this machine joined</h2>
+  <p>Read <code>enroll --status</code> for the local enrollment state, backend state, and unattended enrollment setting.</p>
+  <small>Re-enrollment can interrupt this machine’s connection. Confirm the target before changing it.</small>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/mesh-policy.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: Mesh access policy
+description: Inspect whether the control server has a policy and when its current policy was recorded.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: mesh-policy
+intents: [inspect mesh policy, audit network ACL, review SSH grants, change mesh trust policy]
+surfaces: [page]
+operations: [policy]
+data: ["policy:/configured", "policy:/updatedAt"]
+---
+
+<style>
+  .mesh-policy { padding:var(--spacing-md); border-block:1px solid var(--color-border); background:var(--color-surface); }
+  .mesh-policy h2 { margin-top:0; }
+  .mesh-policy code { color:var(--color-warn); }
+</style>
+<section class="mesh-policy">
+  <h2>Review the trust boundary</h2>
+  <p>Read the control server policy with <code>policy get</code>. Review who can reach each destination before replacing a policy.</p>
+  <p>The Boundary view presents policy and secret grants as separate observations.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/network-atlas.md

@@ -0,0 +1,25 @@
+---
+type: ui-chunk:chunk
+title: Mesh network atlas
+description: Read current network, control API, and enrollment observations for the private fleet.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: network-atlas
+intents: [mesh overview, fleet connectivity, check mesh network, control server verified, inspect enrolled machines]
+surfaces: [page, right]
+panel: network
+operations: [status]
+data: ["status:/state", "status:/control/verified", "status:/enrollment/state", "status:/observed_at"]
+---
+
+<style>
+  .mesh-atlas { color:var(--color-text); background:var(--color-surface); padding:var(--spacing-md); border-inline-start:3px solid var(--color-accent); }
+  .mesh-atlas h2 { margin:.3em 0; font:600 clamp(1.6rem,5vw,2.3rem) var(--typography-heading-font-family,Georgia,serif); }
+  .mesh-atlas p { margin:0; }
+  .mesh-atlas small { letter-spacing:.12em; text-transform:uppercase; color:var(--color-accent); }
+</style>
+<header class="mesh-atlas">
+  <small>Mesh field atlas</small>
+  <h2>Read the fleet</h2>
+  <p>Open a machine to inspect membership, path, recorded login, and execution separately.</p>
+</header>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/node-roster.md

@@ -0,0 +1,26 @@
+---
+type: ui-chunk:chunk
+title: Mesh node roster
+description: Inspect current fleet observations and distinguish members from recorded-only nodes.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: node-roster
+intents: [list mesh nodes, show enrolled peers, which machines are online, recorded mesh node]
+surfaces: [page, right]
+operations: [nodes]
+data: ["nodes:/nodes/0/network_state", "nodes:/nodes/0/access_state", "nodes:/nodes/0/vault_only"]
+---
+
+<style>
+  .mesh-roster { padding:var(--spacing-md); border-block:1px solid var(--color-border); background:var(--color-surface); }
+  .mesh-roster h2 { margin:0 0 .5rem; }
+  .mesh-roster dt { color:var(--color-accent); font-weight:600; }
+  .mesh-roster dd { margin:0 0 .6rem; }
+</style>
+<section class="mesh-roster">
+  <h2>Compare node records</h2>
+  <dl>
+    <dt>Membership</dt><dd>Read current network state for enrolled machines.</dd>
+    <dt>Recorded only</dt><dd>Keep an earlier record separate from current membership and liveness.</dd>
+  </dl>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/node-selection-proof.md

@@ -0,0 +1,17 @@
+---
+type: ui-chunk:chunk
+plugin: mesh
+id: node-selection-proof
+title: Choose a mesh node with verified capabilities
+description: Use current reachability and installed harness observations to narrow the list of candidate execution nodes.
+timestamp: "2026-11-08T23:12:00Z"
+intents: [choose a mesh node for work, check which peer has a harness, verify a node can run the required runtime]
+surfaces: [page]
+panel: network
+operations: [nodes, doctor]
+data: ["doctor:/0/reachable", "doctor:/0/runtimes", "doctor:/0/harnesses"]
+---
+<section>
+  <h2>Check a node against the work it needs to run</h2>
+  <p>Start with the enrolled roster, then inspect the fleet execution probe. Filter to reachable nodes with the required runtime and harness. Recheck the selected peer before dispatch.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/owner-observations.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: Mesh owner observations
+description: Read the selected fleet view and inspect its source evidence and observation time.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: owner-observations
+intents: [read mesh view, mesh flows evidence, placement source observations, inspect boundary sources]
+surfaces: [page, right]
+operations: [view]
+data: ["view:/screen", "view:/observed_at", "view:/sources/status/ok"]
+---
+
+<style>
+  .mesh-sources { padding:var(--spacing-md); background:var(--color-surface); }
+  .mesh-sources h2 { margin-top:0; }
+  .mesh-sources small { color:var(--color-muted); }
+</style>
+<section class="mesh-sources">
+  <h2>Trace a fleet observation</h2>
+  <p>Select Machines, Flows, Placement, Boundary, or Join. Each view reports when its owner commands ran and whether each source answered.</p>
+  <small>A source can fail while the other observations remain available.</small>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/peer-path.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: Mesh peer path and latency
+description: Probe a named peer and report whether its network path answered, with timing when available.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: peer-path
+intents: [ping mesh peer, check node path, measure mesh latency, test reachability]
+surfaces: [page, right]
+operations: [ping]
+data: ["ping:/reachable", "ping:/latency_ms"]
+---
+
+<style>
+  .mesh-path { padding:var(--spacing-md); border:1px dashed var(--color-border); background:var(--color-surface); }
+  .mesh-path h2 { margin-top:0; }
+  .mesh-path strong { color:var(--color-accent); }
+</style>
+<section class="mesh-path">
+  <h2>Check the path to a peer</h2>
+  <p>Ping a named machine. A response proves the path from this machine at the time of the test.</p>
+  <p><strong>Round-trip time</strong> appears when the probe can measure it.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/pinned-leader.md

@@ -0,0 +1,24 @@
+---
+type: ui-chunk:chunk
+title: Pin the mesh leader
+description: Record an explicit mesh address and optional server port as the leader pin.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: pinned-leader
+intents: [pin mesh leader, choose leadership address, set leader server port]
+surfaces: [page]
+operations: [leader-pin]
+data: ["leader-pin:/ok", "leader-pin:/leaderPort"]
+---
+
+<style>
+  .mesh-pin { padding:var(--spacing-md); border-inline-start:3px solid var(--color-warn); background:var(--color-surface); }
+  .mesh-pin h2 { margin-top:0; }
+</style>
+<section class="mesh-pin">
+  <h2>Change the leader pin</h2>
+  <ol>
+    <li>Select the intended mesh address and optional server port.</li>
+    <li>Check the write result, then read the elected leader separately.</li>
+  </ol>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/reachability-evidence-ladder.md

@@ -0,0 +1,17 @@
+---
+type: ui-chunk:chunk
+plugin: mesh
+id: reachability-evidence-ladder
+title: Trace where a mesh operation failed
+description: Compare control verification, peer latency and recorded login evidence to distinguish control, network and access failures.
+timestamp: "2026-11-08T23:12:00Z"
+intents: [diagnose why mesh execution failed, separate mesh control and login failure, compare peer reachability with SSH access]
+surfaces: [page, right]
+panel: network
+operations: [probe, ping, access, doctor]
+data: ["probe:/control/verified", "ping:/reachable", "ping:/latency_ms", "access:/complete", "doctor:/0/reachable"]
+---
+<section>
+  <h2>Follow the mesh evidence ladder</h2>
+  <ol><li>Verify the controller independently.</li><li>Probe the named peer from this machine.</li><li>Review the recorded login and the execution probe before dispatching work.</li></ol>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/recorded-login.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: Recorded mesh login
+description: Inspect whether the selected node has a complete login record and when it was verified.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: recorded-login
+intents: [inspect mesh login, record node access, verify recorded SSH account, discover working login]
+surfaces: [page]
+operations: [access]
+data: ["access:/complete", "access:/verified_at"]
+---
+
+<style>
+  .mesh-login { padding:var(--spacing-md); background:var(--color-surface); border-radius:var(--radius-md); }
+  .mesh-login h2 { margin-top:0; }
+  .mesh-login b { color:var(--color-accent); }
+</style>
+<section class="mesh-login">
+  <h2>Review how the fleet reaches a node</h2>
+  <p>Inspect the resolved access record for the selected machine. A complete record gives the fleet a login target.</p>
+  <p>Compare the <b>recorded verification time</b> with a new execution probe.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/remote-execution.md

@@ -0,0 +1,22 @@
+---
+type: ui-chunk:chunk
+title: Remote mesh execution result
+description: Run an explicit command on an enrolled peer and read its actual exit result.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: remote-execution
+intents: [execute mesh command, run command on peer, check remote exit code, remote shell command result]
+surfaces: [page]
+operations: [exec]
+data: ["exec:/success", "exec:/exitCode"]
+---
+
+<style>
+  .mesh-run { padding:var(--spacing-md); background:var(--color-surface); border-block-end:1px solid var(--color-border); }
+  .mesh-run h2 { margin-top:0; }
+  .mesh-run strong { color:var(--color-accent); }
+</style>
+<section class="mesh-run">
+  <h2>Read the command result</h2>
+  <p>Choose the peer and command explicitly. The <strong>exit code</strong> comes from the remote execution. Check it before treating a successful connection as a successful command.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/secret-grants.md

@@ -0,0 +1,26 @@
+---
+type: ui-chunk:chunk
+title: Mesh secret grants
+description: Review the selected node, user, or tag scope and verify the outcome of an explicit grant change.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: secret-grants
+intents: [list mesh secret grants, revoke mesh credential access, allow named keys on node, review Auth trust boundary]
+surfaces: [page]
+operations: [grants]
+data: ["grants:/ok"]
+---
+
+<style>
+  .mesh-grants { padding:var(--spacing-md); border-inline-start:3px solid var(--color-warn); background:var(--color-surface); }
+  .mesh-grants h2 { margin-top:0; }
+  .mesh-grants dt { color:var(--color-accent); }
+  .mesh-grants dd { margin:0 0 .45em; }
+</style>
+<section class="mesh-grants">
+  <h2>Review machine access to secrets</h2>
+  <dl>
+    <dt>Inspect</dt><dd>Read the grant inventory in Boundary.</dd>
+    <dt>Change</dt><dd>Select a node, tag, or user and confirm the permitted key names before adding or removing a grant.</dd>
+  </dl>
+</section>