62 lines
4.1 KiB
Markdown
62 lines
4.1 KiB
Markdown
# Session checkpoint — 2026-08-26
|
|
|
|
## Requested action
|
|
Rob requested that the current project state be written into the project folder and that the project cron jobs be stopped for today.
|
|
|
|
## Final state at pause
|
|
- Project: `meshcentral-openclaw-bridge`
|
|
- Status: **BLOCKED / PAUSED FOR TODAY**
|
|
- Live-test attempts/failures: **3 consecutive failures**
|
|
- Failure stage: `serverversion` (`protocol-or-connection`)
|
|
- Live testing: **STOPPED by configured failure-limit rule**
|
|
- Worker: no active worker process or lock at checkpoint
|
|
- Progress cron: being disabled for today; configuration is preserved
|
|
|
|
## Work completed this session
|
|
- Reviewed project folder, handoff, status, TODO, deployment, live-test, security, research, implementation, and review documents.
|
|
- Confirmed local implementation quality gate before the live attempts:
|
|
- Initial baseline: 90 tests passed, build passed, lint passed.
|
|
- After secure live-test runner: 91 tests passed, build passed, lint passed.
|
|
- After final runner/diagnostic changes: 12 suites, 91 tests passed, build passed, lint passed with no warnings.
|
|
- Corrected MeshCentral 1.2.5 protocol assumptions:
|
|
- `x-meshauth` uses comma-separated Base64 fields for username/password and optional TOTP.
|
|
- Requests/responses correlate using `responseid`, not the bridge's former numeric `id` field.
|
|
- Official server-version responses use fields including `result` and `tags`.
|
|
- Added `PROTOCOL-COMPARISON.md`.
|
|
- Added fixed-scope `implementation/src/live-readonly-test.ts` and `npm run live-test`.
|
|
- Runner reads the protected credential file internally and does not accept credential, operation, or target CLI arguments.
|
|
- Runner scope is fixed to server version, `Servers` group, `nodes`, and PVE3 `deviceinfo`.
|
|
- Added runner safety test and sanitized stage-level failure reporting.
|
|
- Reconciled stale authorization/status wording in project documentation.
|
|
- Added `PROJECT-PROGRESS.json`, `worker/run-worker.js`, and `worker/worker.log` as an attempted durable-worker/watchdog arrangement.
|
|
|
|
## Live-test result
|
|
- TLS and WebSocket setup reached the server successfully.
|
|
- The fixed-scope probe failed at the first `serverversion` request stage on three consecutive attempts.
|
|
- No groups, inventory, PVE3 metadata, commands, diagnostics, file transfer, power operations, administrative actions, or state changes completed.
|
|
- No credentials, authentication headers, tokens, or raw server error text were written to project files or logs.
|
|
|
|
## Worker/watchdog findings
|
|
- One-shot subagent workers exited before completing their intended checkpoints.
|
|
- A detached Node worker was then attempted; it did execute verification and live probes, but its log remained empty because child output was buffered and checkpoint logging was incomplete.
|
|
- `PROJECT-PROGRESS.json` is the authoritative persisted state; it records the third live failure and the stop rule.
|
|
- The watchdog cron was converted to a 15-minute watchdog but had intermittent setup timeouts. It is being paused for today per Rob's request.
|
|
|
|
## Current blocker and next action
|
|
**Blocker:** MeshCentral control-channel compatibility/authentication remains unresolved at `serverversion` after WebSocket connection setup.
|
|
|
|
Before resuming:
|
|
1. Inspect the exact sanitized close/error behavior and compare against deployed MeshCentral 1.2.5 server behavior.
|
|
2. Repair or replace the worker orchestration/logging so active work is observable and state updates are reliable.
|
|
3. Do not reset the live-failure count or retry live testing until the protocol hypothesis changes and the retry policy is explicitly reviewed.
|
|
4. Preserve read-only scope: `serverversion`, `meshes`, `nodes`, `deviceinfo`; PVE3 only.
|
|
|
|
## Safety boundaries
|
|
- MeshCentral access: read-only only.
|
|
- Approved target: PVE3 only.
|
|
- Prohibited: commands, diagnostics, power operations, file transfer, administration, state changes, PVE1, and PVE2.
|
|
- Credential file remains outside the project at the protected path and must not be copied, logged, or exposed.
|
|
|
|
## Resume note
|
|
The project may be resumed by explicitly reviewing this checkpoint and `PROJECT-PROGRESS.json`. The progress cron is disabled, not deleted, and can be re-enabled later without recreating it.
|