Initial project documentation and status

2026-08-30 14:46:23 -04:00
commit 765f372c72
50 changed files with 12916 additions and 0 deletions
@@ -0,0 +1,28 @@
+# MeshCentral 1.2.5 protocol comparison
+
+**Date:** 2026-08-26
+**Reference:** deployed-version-pinned `meshctrl.js` source at commit
+`b09b1d60328de8e2d2f7387561ed51c64011c82a`.
+
+## Findings
+
+| Area | Official MeshCtrl 1.2.5 | Bridge before this change | Decision |
+|---|---|---|---|
+| Password authentication | `base64(username),base64(password)` comma-separated header; optional third comma-separated base64 token | Base64 of `username:password[:totp]` | Correct bridge to official wire format |
+| Request correlation | `responseid: "meshctrl"` | Numeric `id` | Use unique `responseid` values and match echoed `responseid` |
+| Server-version response | `action: "serverversion"`, `responseid`, `result`, `tags` | Expected optional `ver` and numeric `id` | Accept protocol envelope and preserve response fields |
+| First application message | No special handshake message; request is sent after `open` | Request sent after `open` | No extra handshake required |
+| TLS | Official client disables certificate verification | Bridge requires verification | Keep bridge's safer behavior; do not copy upstream TLS weakness |
+
+## Scope
+
+This comparison covers only the read-only control-channel operations used by the
+MVP. Remote commands, diagnostics, events, power operations, file transfer, and
+administrative actions remain out of scope.
+
+## Compatibility consequence
+
+The previous implementation could complete the WebSocket upgrade but was not
+wire-compatible with MeshCentral's request/response correlation format. The
+authentication-header and response-correlation corrections are now covered by
+the local protocol tests before any further live read-only attempt.