Integrate upstream-compatible read-only MeshCentral transport

TODO.md

@@ -41,36 +41,32 @@
 
 ## Verification Status (Complete)
 
-- [x] Test suite passes: 90/90 tests
+- [x] Test suite passes: 91/91 tests
 - [x] TypeScript build passes with no errors
 - [x] ESLint passes with no warnings
 - [x] Security review findings reconciled in `review/FINAL-HARDENING-REVIEW.md`
 
-## Remaining Live-Test Gates
+## Live Verification (Complete)
 
-### Pre-Live Requirements (Must Complete Before Any Live Test)
+- [x] `mesh.ledrew.me` resolves to the intended MeshCentral endpoint
+- [x] TLS validation and `/control.ashx` WSS upgrade verified
+- [x] `sa_clawdia` authenticated successfully with the protected credential file
+- [x] `Servers` group inventory returned successfully
+- [x] PVE3 was found in the `Servers` group
+- [x] Real adapter mapped the live node correctly
+- [x] No credentials, tokens, commands, diagnostics, or state-changing operations were exposed or performed
 
-1. **Security Review Address Findings**
-   - [x] Review findings in `review/LIVE-ADAPTER-REVIEW.md` reconciled against the current source
-   - [x] Address or accept all high-severity findings
-   - [x] Document risk acceptance for deferred non-blocking items in `review/FINAL-HARDENING-REVIEW.md`
+The live probe uses the upstream-compatible transport in `implementation/src/upstream-transport.ts`. MeshCentral's `serverversion` action is not used as the least-privilege health check because it requires server-upgrade capability; authenticated `meshes` inventory is the health check instead.
 
-2. **Live-Test Checklist (See DEPLOYMENT.md)**
-   - [ ] Confirm mesh.ledrew.me resolves to intended MeshCentral instance
-   - [ ] Verify control.ashx WebSocket endpoint availability
-   - [ ] Confirm sa_clawdia has read-only permissions only
-   - [ ] Verify PVE3 is the sole allowlisted test target
-   - [ ] Test secret retrieval mechanism (no credentials in code/logs)
-   - [ ] Verify audit logging captures all security events
+## Remaining Deployment/Review Work
 
-3. **Explicit Approval**
-   - [x] Rob's project-level authorization for read-only live access (2026-08-26)
-   - [ ] No credentials stored in prompts, commands, or logs
-
-### Deployment/ Rollback Checklist
+1. Review the uncommitted diff and commit on a feature branch.
+2. Complete an independent final security review against the newly integrated transport.
+3. Complete deployment/rollback documentation for a future non-production deployment.
+4. Add an OpenClaw-facing tool/MCP wrapper only after the read-only adapter contract is finalized.
 
 **Deployment:**
-1. Deploy bridge to host with restricted firewall (outbound only to mesh.ledrew.me:80)
+1. Deploy bridge to an approved trusted host with restricted firewall (outbound only to the MeshCentral endpoint)
 2. Configure runtime secrets via protected environment file (mode 0600)
 3. Start bridge service with audit logging enabled
 4. Verify health endpoint returns healthy=true