Integrate upstream-compatible read-only MeshCentral transport

RESUME-HANDOFF.md

@@ -1,8 +1,21 @@
 # MeshCentral ↔ OpenClaw Bridge — Resume Handoff
 
-**Checkpoint:** 2026-08-25 09:18 EDT
+**Checkpoint:** 2026-09-03 18:25 EDT
 **Owner:** Rob / Clawdia
-**Project state:** Active. Rob authorized read-only MeshCentral access for this project on 2026-08-26. A corrected live test is pending.
+**Project state:** Read-only inventory path verified live. Local changes are uncommitted and require review before any push or deployment.
+
+## Current verified result
+
+- Authenticated WSS connection to `mesh.ledrew.me`: passed.
+- `meshes` inventory request: passed; `Servers` group found.
+- `nodes` request for `Servers`: passed; PVE3 found.
+- Real adapter end-to-end check: passed; 3 groups, 5 `Servers` devices, PVE3 mapped as online.
+- Local gate: 91 tests passed, TypeScript build passed, ESLint passed.
+- No commands, diagnostics, file transfer, power operations, administration, or state changes were performed.
+
+## Transport decision
+
+MeshCentral 1.2.5 sends unsolicited `serverinfo`, `userinfo`, and event messages after login. Its `meshes` response omits `responseid`, and its `nodes` response is grouped by mesh ID. The project now uses `upstream-transport.ts`, which follows the working upstream `meshctrl.js` connection timing and response handling while retaining typed validation at the bridge boundary.
 
 ## What was completed in the resumed work session
 
@@ -49,17 +62,14 @@ Last successful result:
 
 ## Current phase
 
-Post-hardening protocol compatibility validation. The implementation is authorized for the narrow read-only live test described in `LIVE-TEST-PROCEDURE.md`.
+Read-only inventory MVP verified. Diagnostics remain mock-only and state-changing actions remain disabled.
 
 ## Remaining work, in order
 
-1. Add bounded request concurrency/rate limiting to the MeshCtrl client.
-2. Add structured audit logging for authentication, requests, targets, results, timestamps, and failures; never log passwords, TOTP tokens, session tokens, or raw sensitive output.
-3. Add negative/security tests for retries, timeouts, connection failures, allowlist enforcement, and logging redaction.
-4. Finish deployment and rollback documentation, including the live-test checklist.
-5. Run an independent security review against the updated source and address findings.
-6. Execute the authorized read-only live-test procedure; do not expand its scope.
-7. Keep diagnostics mock-only; do not add remote commands or state-changing actions until separately designed and reviewed.
+1. Review the uncommitted diff and commit on a feature branch.
+2. Add/complete transport-level regression tests for bootstrap messages and grouped node responses.
+3. Reconcile the final implementation with the security review and deployment documentation.
+4. Keep diagnostics mock-only; do not add remote commands or state-changing actions until separately designed and reviewed.
 
 ## Live-test facts already documented