create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/session-create/worker-launch-sandbox.js

@@ -262,6 +262,22 @@ async function readLeadPosture({ parent, deps } = {}) {
   };
 }
 
+// WP-14 (docs/deepseek-harness-acp-agent-2026-10-28.html §9b W-9). A dsh worker is the ONE worker
+// harness with no argv at all: it is an ACP child (lib/acp/dsh-session-runtime.js) driven over
+// JSON-RPC, so neither Claude Code's `--settings` sandbox block nor Codex's `-c
+// sandbox_workspace_write...` override can express its confinement. The child's own permission mode
+// is the write rule that exists, so this is an EXPLICIT dsh branch rather than the claude-code
+// fallthrough (which would silently hand dsh a Claude-only settings shape nothing consumes):
+//   * a review worker is read-only (D-5: it owns no files and produces a report);
+//   * every other profile is workspace-write, which is also the runtime's own default
+//     (dsh-session-runtime.js DSH_PERMISSION_MODE) — stated here so the worker's rule is decided in
+//     the same place a claude/codex worker's is.
+// `cwd` is NOT re-derived: the caller (delegate-worker.js) already validated it inside the lead's
+// scope (checkCallerAuthority + workerCwdInScope) before any launch spec exists.
+function dshWorkerSandbox({ profile = 'implementation' } = {}) {
+  return { permissionMode: profile === 'review' ? 'read-only' : 'workspace-write' };
+}
+
 // WP-4's launch-time half (D-29 table): the argv each posture maps to, per harness.
 // `harness` is 'claude-code' or 'codex-cli'. No posture (null) is today's argv; an
 // unresolved caller never reaches a launch (D-10 refused it first). read-only throws --
@@ -336,11 +352,12 @@ function workerClaudeSettingsArgs({ settingSources, cleanupPeriodDays, sandbox }
 //
 // D-10 (caller-door doc): an unresolved caller is REFUSED -- 403 caller_unresolved with
 // reason no_caller (empty/blank input id) | unknown (resolution returns no parent id) |
-// lead_not_live (resolution is 'owner', or a 'live' id whose getSession returns null) |
-// row_unreadable (D-14: getSession or getWorkerSession threw). The 403 carries next_step
-// (worker-failure-classify NEXT_STEPS). Then the unchanged order: worker_nesting_refused
-// 403 -> worker_cwd_outside_lead 400 -> worker_exceeds_lead_sandbox 403. Only a LIVE lead
-// passes; there is no allowed anonymous delegate (closes F-2 and F-5).
+// lead_not_live (the resolved id -- 'owner' or 'live' -- is not in the live map, so its cwd
+// and posture cannot be read) | row_unreadable (D-14: getSession or getWorkerSession threw).
+// The 403 carries next_step (worker-failure-classify NEXT_STEPS). Then the unchanged order:
+// worker_nesting_refused 403 -> worker_cwd_outside_lead 400 -> worker_exceeds_lead_sandbox
+// 403. Only a LIVE lead passes, whatever the lookup path that named it (D-6); there is no
+// allowed anonymous delegate (closes F-2 and F-5).
 //
 // "Is a worker" = getSession(parentId) is a session with agentRole === 'worker' (lib/
 // session-class.js isWorkerSession) OR getWorkerSession(parentId) returns a row -- the row
@@ -372,10 +389,12 @@ async function checkCallerAuthority(deps, opts = {}, helpers = {}) {
   const parentId = resolved.parent_ctm_session_id;
   if (!parentId) throw _callerUnresolved('unknown');
 
-  // D-10 reason 3: the resolution is not a LIVE lead ('owner' names a Codex thread whose
-  // CTM session is not in the live map -- its cwd and posture cannot be read, closes F-5),
-  // or the 'live' id's session row itself is gone.
-  if (resolved.parent_resolution !== 'live') throw _callerUnresolved('lead_not_live');
+  // D-10 reason 3: the resolved lead is not in the live map. An 'owner' resolution (a Codex
+  // thread id whose owning CTM session is not live) is refused HERE, and so is a 'live' id
+  // whose session row has gone -- in both cases the cwd and posture cannot be read (closes
+  // F-5). D-6: the resolution LABEL is not the gate -- a live owner is a valid caller, since
+  // the bearer is one shared runtime token, so presenting an owner's thread id grants exactly
+  // what presenting that owner's own CTM id already grants.
   let parentSession = null;
   try {
     parentSession = typeof deps.getSession === 'function' ? deps.getSession(parentId) : null;
@@ -418,7 +437,16 @@ async function checkCallerAuthority(deps, opts = {}, helpers = {}) {
     throw _authorityError('worker_exceeds_lead_sandbox', 403, READ_ONLY_LEAD_MESSAGE, { lead_posture: leadPosture });
   }
 
-  return { parent_ctm_session_id: parentId, parent_resolution: 'live', leadPosture };
+  // D-6: the authorised resolution label is carried through, not flattened to 'live' -- a
+  // caller named by its Codex thread id records the owner CTM session it resolved to
+  // ('owner'), which is what the worker row/launch record then shows. Only the two
+  // resolvable labels can reach here (an empty parent id was refused as 'unknown'), and a
+  // resolver returning anything else is recorded as the authorised 'live' it now is.
+  return {
+    parent_ctm_session_id: parentId,
+    parent_resolution: resolved.parent_resolution === 'owner' ? 'owner' : 'live',
+    leadPosture,
+  };
 }
 
 module.exports = {
@@ -434,5 +462,6 @@ module.exports = {
   workerClaudeSettingsArgs,
   readLeadPosture,
   workerSandboxArgs,
+  dshWorkerSandbox,
   checkCallerAuthority,
 };

package/template/coding-task-manager/lib/session-create/worker-observability.js

@@ -339,7 +339,7 @@ function stampRestoredWorkerMarkers(session, row) {
   session._parentAgentSessionId = workerRow.parent_ctm_session_id || '';
   session._workerAlias = workerRow.route_alias || '';
   session._workerAgent = workerRow.agent || '';
-  session._workerHarness = recipe.harness || (workerRow.agent === 'codex' ? 'codex-cli' : 'claude-code');
+  session._workerHarness = recipe.harness || (workerRow.agent === 'codex' ? 'codex-cli' : workerRow.agent === 'dsh' ? 'dsh-acp' : 'claude-code');
   session._workerProfile = recipe.workerProfile || 'legacy';
   session._workerTerminalAt = String(workerRow.terminal_at || '');
   if (workerRow.model) session.model_selected = workerRow.model;
@@ -671,7 +671,7 @@ function createWorkerObservability({ getDeps, readWorkerRuntime, getBaseStatus }
       generation,
       model: boundedText(workerRow?.model || recipe.model || session?.model_selected || ''),
       route: boundedText(workerRow?.route_alias || recipe.route || session?._workerAlias || ''),
-      harness: boundedText(recipe.harness || session?._workerHarness || (workerRow?.agent === 'codex' ? 'codex-cli' : 'claude-code'), 32),
+      harness: boundedText(recipe.harness || session?._workerHarness || (workerRow?.agent === 'codex' ? 'codex-cli' : workerRow?.agent === 'dsh' ? 'dsh-acp' : 'claude-code'), 32),
       worker_profile: boundedText(recipe.workerProfile || session?._workerProfile || 'legacy', 32),
       evidence: safeEvidence,
     };

package/template/coding-task-manager/lib/session-empty.js

@@ -13,6 +13,13 @@ function agentSessionUserMsgCount(agent) {
   return maxUserMsgCount(agent.userMsgCount, agent.user_msg_count, agent.message_count);
 }
 
+function hasTranscriptBytes(value) {
+  // D-6: a session NAME (title/rename_name/displayTitle) is not conversation content, but
+  // real transcript bytes on disk are. 2048 matches lib/recent-session-visibility.js:11 and
+  // lib/session-empty-file-selection.js:19.
+  return Number(value) > 2048;
+}
+
 function agentSessionHasConversationSignal(agent) {
   if (!agent) return false;
   return !!(
@@ -23,11 +30,9 @@ function agentSessionHasConversationSignal(agent) {
     hasText(agent.last_user_content) ||
     hasText(agent.firstAssistantText) ||
     hasText(agent.first_assistant_text) ||
-    hasText(agent.renameName) ||
-    hasText(agent.rename_name) ||
-    hasText(agent.displayTitle) ||
     hasText(agent.aiTitle) ||
-    hasText(agent.title)
+    hasTranscriptBytes(agent.fileSize) ||
+    hasTranscriptBytes(agent.file_size)
   );
 }
 
@@ -53,16 +58,14 @@ function recentSessionHasConversationSignal(session, dbRow) {
     hasText(session?.last_user_content) ||
     hasText(session?.firstAssistantText) ||
     hasText(session?.first_assistant_text) ||
-    hasText(session?.renameName) ||
-    hasText(session?.rename_name) ||
-    hasText(session?.displayTitle) ||
     hasText(session?.aiTitle) ||
-    hasText(session?.title) ||
+    hasTranscriptBytes(session?.fileSize) ||
+    hasTranscriptBytes(session?.file_size) ||
     hasText(dbRow?.first_message) ||
     hasText(dbRow?.last_user_content) ||
     hasText(dbRow?.first_assistant_text) ||
-    hasText(dbRow?.rename_name) ||
-    hasText(dbRow?.title) ||
+    hasTranscriptBytes(dbRow?.file_size) ||
+    hasTranscriptBytes(dbRow?.fileSize) ||
     agents.some(agentSessionHasConversationSignal)
   );
 }

package/template/coding-task-manager/lib/session-host-manager.js

@@ -28,6 +28,10 @@ const { sanitizeSessionOps, createOverdueEdgeTrigger } = require('./headless-inf
 const { dialHostState, shutdownHostSession } = require('./host-adopt-dial');
 const handoffOrchestrator = require('./host-handoff-orchestrator');
 const { applyModelHostReceipt, applyStartedModelHostReceipt } = require('./model-host-receipt');
+// WP-1 (S-5): the host-carried launch-environment record is validated at the manager boundary with the
+// same `{}`-or-`{launchEnvironment}` shape the other host-carried fields use.
+const { moveToOwnScope, scopeMoveEnabled } = require('./systemd-scope');
+const { launchEnvironmentMetadata } = require('./launch-environment');
 
 // WP-1 (pty-survival design doc, deliverable 1): a host process must survive the
 // manager's own death (crash, restart) -- fork() alone still ties the child's
@@ -121,6 +125,24 @@ function _stampMainArrival(message) {
 //
 // State carries headlessReady so adoption can rebuild a missing mirror without waiting for snapshots.
 const ADOPT_DIAL_TIMEOUT_MS = 3000;
+// WP-1 (session-host-cgroup-survival design doc, D-1..D-6): on a systemd service host, move a freshly forked
+// survivor (dedicated host or pool) into its own transient scope. Returns null when the move is not applicable
+// (launchd, dev shell, flag off) so callers keep today's synchronous behaviour. The returned promise never
+// rejects; `onSettled(result)` runs first (before any gated frame), and a failed move is REPORTED once.
+function _startScopeMove(child, label, hostId, logger, onSettled) {
+  if (!scopeMoveEnabled()) return null;
+  return moveToOwnScope(child.pid, { label }).then((result) => {
+    if (!result.moved) {
+      (logger?.warn ? logger.warn.bind(logger) : console.warn)(`[host-scope] move failed host=${hostId} pid=${child.pid} reason=${result.reason}`);
+    }
+    try { onSettled(result); } catch (err) {
+      // REPORT: a bookkeeping failure must not strand the gated frames.
+      (logger?.warn ? logger.warn.bind(logger) : console.warn)(`[host-scope] bookkeeping failed host=${hostId}: ${err && err.message}`);
+    }
+    return result;
+  });
+}
+
 class HostedPtyAdapter {
   constructor(options = {}) {
     if (!options.sessionId) throw new Error('HostedPtyAdapter requires sessionId');
@@ -129,6 +151,9 @@ class HostedPtyAdapter {
     this.args = Array.isArray(options.args) ? options.args : [];
     this.cwd = options.cwd;
     this.env = options.env;
+    // WP-1 (S-5): the per-spawn launch-environment record this host is told to carry (undefined when the
+    // spawn sent none -- an older CTM, or a legacy adapter).
+    this.launchEnvironment = launchEnvironmentMetadata(options.launchEnvironment).launchEnvironment;
     this.cols = Number(options.cols || 120) || 120;
     this.rows = Number(options.rows || 30) || 30;
     this.initialHeadlessData = typeof options.initialHeadlessData === 'string' ? options.initialHeadlessData : '';
@@ -171,6 +196,7 @@ class HostedPtyAdapter {
       args: this.args,
       cwd: this.cwd,
       env: this.env,
+      launchEnvironment: this.launchEnvironment,
       cols: this.cols,
       rows: this.rows,
       initialHeadlessData: this.initialHeadlessData,
@@ -245,6 +271,16 @@ class HostedPtyAdapter {
     this._child = child;
     this.hostPid = child.pid || 0;
     this.pid = this.hostPid;
+    // WP-1 (S-1): own scope; frames are held until it settles (D-6: cgroup membership is inherited at fork).
+    this.scopeUnit = null;
+    this.scopeReason = null;
+    this._scopePending = false;
+    this._scopeMove = _startScopeMove(child, `host-${this._hostId}`, this._hostId, this._logger, (r) => {
+      this._scopePending = false;
+      this.scopeUnit = r.unit;
+      this.scopeReason = r.reason;
+    });
+    this._scopePending = !!this._scopeMove;
 
     child.stdout?.on('data', (buf) => {
       const text = String(buf || '').trimEnd();
@@ -331,6 +367,7 @@ class HostedPtyAdapter {
       args: this.args,
       cwd: this.cwd,
       env: this.env,
+      launchEnvironment: this.launchEnvironment,
       cols: this.cols,
       rows: this.rows,
       initialHeadlessData: this.initialHeadlessData,
@@ -341,6 +378,11 @@ class HostedPtyAdapter {
   }
 
   _post(message) {
+    // WP-1 D-6: hold every frame (order preserved: then-callbacks run in registration order) until the scope move settled.
+    if (!this._pooled && this._scopePending) {
+      this._scopeMove.then(() => { this._post(message); });
+      return true;
+    }
     if (this._pooled) {
       // A1: only a truly ABSENT manager refuses here; a present manager keeps its COPY + forwarded scope.
       if (this._manager === undefined || this._manager === null) { notePostRefusal(message); return false; }
@@ -606,6 +648,11 @@ class SessionHostManager extends EventEmitter {
     this.poolPath = options.poolPath || path.resolve(__dirname, '..', 'workers', 'session-host-pool-process.js');
     this.usePool = options.usePool === true;
     this.logger = options.logger || console; this.isRecoveryProtectedHost = options.isRecoveryProtectedHost;
+    // WP-3a (live-defer-wake-adopted-host-death R-6): how the manager stops a host
+    // process it has just declared dead. Injected exactly like
+    // isRecoveryProtectedHost above -- this lib never learns how to kill a host
+    // (server.js owns that), it just asks. Null when the caller supplies none.
+    this.retireDeadHost = typeof options.retireDeadHost === 'function' ? options.retireDeadHost : null;
     this._adoptDialTimeoutMs = Number(options.adoptDialTimeoutMs) > 0 ? Number(options.adoptDialTimeoutMs) : ADOPT_DIAL_TIMEOUT_MS; // test seam (B-4)
     // WP-0 (pty-survival design doc): registry/socket wiring is entirely
     // conditional on the caller supplying a dataDir -- this lib never reads
@@ -1623,6 +1670,14 @@ class SessionHostManager extends EventEmitter {
     this._poolChild = child;
     this._poolClosed = false;
     this._poolHostId = `pool-${child.pid}`;
+    // WP-1 (S-2): own scope; no frame reaches the pool until it settles (D-6).
+    this._poolScopeUnit = null;
+    this._poolScopeReason = null;
+    this._poolScopePending = false;
+    this._poolScopeMove = _startScopeMove(child, `pool-${child.pid}`, this._poolHostId, this.logger, (r) => {
+      if (this._poolChild === child) { this._poolScopePending = false; this._poolScopeUnit = r.unit; this._poolScopeReason = r.reason; }
+    });
+    this._poolScopePending = !!this._poolScopeMove;
     this._poolSocketPath = socketPath;
     // WP-1 (deliverable 2): pool-wide control flip, same shape as the dedicated
     // host's per-adapter dial in _startDedicated.
@@ -1750,6 +1805,11 @@ class SessionHostManager extends EventEmitter {
 
   _postToPool(message) {
     const child = this._ensurePool();
+    // WP-1 D-6: hold frames for a pool whose scope move is still in flight (registration order preserved).
+    if (child && this._poolScopePending && this._poolScopeMove) {
+      this._poolScopeMove.then(() => { this._postToPool(message); });
+      return true;
+    }
     // A1: an absent/closed pool posts nothing -- recorded as a refusal, joined CONSERVATIVELY below.
     if (!child || this._poolClosed) { notePostRefusal(message); return false; }
     // WP-1 (deliverable 2): once the pool's control flip has succeeded, ALL

package/template/coding-task-manager/lib/session-jobs.js

@@ -916,7 +916,9 @@ function registerSessionJobs(scheduler, deps) {
       const scans = [];
       const statPaths = new Set();
       for (const [id, session] of sessions) {
-        if (!String(session.cmd || '').toLowerCase().includes('claude')) continue;
+        // S-6 (D-5): gate on the ONE detector, not a substring — a non-Claude tab under a
+        // `claude`-containing path (e.g. an opencode binary under a claude-tools dir) no longer enters.
+        if (detectAgentType(session.cmd) !== 'claude') continue;
         if (!session._claudeSessionId || !session._claudeProjectDir) continue;
         if (session.type === 'walle') continue;
         const currentJsonl = path.join(session._claudeProjectDir, `${session._claudeSessionId}.jsonl`);

package/template/coding-task-manager/lib/session-lifecycle.js

@@ -124,7 +124,6 @@ function lifecycleConfigFromEnv(env = process.env) {
     resourceSampleMs: envInt(env, 'CTM_RESOURCE_SAMPLE_MS', 60_000),
     parkPreSignalGraceMs: envInt(env, 'CTM_PARK_PRE_SIGNAL_GRACE_MS', 50),
     parkTermGraceMs: envInt(env, 'CTM_PARK_TERM_GRACE_MS', 8_000),
-    draftTtlMs: envInt(env, 'CTM_PARK_DRAFT_TTL_MS', 24 * 60 * 60_000),
     prewarm: envBool(env, 'CTM_PREWARM', false),
     prewarmTtlMs: envInt(env, 'CTM_PREWARM_TTL_MS', 60_000, 1_000),
     prewarmTopK: envInt(env, 'CTM_PREWARM_TOP_K', 1, 1),
@@ -230,9 +229,12 @@ function evaluatePark(session, host, config) {
   if (session?.hasPendingInput) protections.push('input');
   if (Number(session?.queueDepth) > 0) protections.push('queue');
   if (Number(session?.queueDepth) < 0) protections.push('queue-unknown');
-  const lastDraftAt = Number(session?.lastDraftAt) || 0;
-  const draftTtlMs = Math.max(0, Number(config?.draftTtlMs) || 0);
-  if (session?.hasDraft || (lastDraftAt > 0 && draftTtlMs > 0 && lastDraftAt > now - draftTtlMs)) protections.push('draft');
+  // WP-1 (park-draft-truth-from-screen §5 D-1/D-4): `composerDraft` is the verdict the caller read
+  // from the agent's own composer row (lib/park-composer-draft.js) — 'text' protects, 'unknown' gets
+  // its own protection so only a user-requested park (evaluateManualPark) treats it as no draft.
+  // Browser presence and the old keystroke stamp are no longer inputs here (D-5 deleted them).
+  if (session?.composerDraft === 'text') protections.push('draft');
+  if (session?.composerDraft === 'unknown') protections.push('composer-unknown');
   if (session?.pinned) protections.push('pinned');
   if (session?.isActiveTab) protections.push('active-tab');
   if (session?.isMru) {
@@ -276,6 +278,9 @@ function evaluateManualPark(session, host, config) {
     isMru: false,
     recentNonStatusActivityAt: 0,
     lastActivatedAt: 0,
+    // D-4: the user who asked is present, so an unreadable composer is not evidence of a draft --
+    // same reason the manual view already drops active-tab and MRU.
+    composerDraft: session?.composerDraft === 'text' ? 'text' : 'empty',
   };
   return evaluatePark(view, host, {
     ...config,
@@ -328,6 +333,7 @@ const PARK_PROTECTION_PRIORITY = [
   'queue',
   'queue-unknown',
   'draft',
+  'composer-unknown',
   'active-tab',
   'visibility-grace',
   'pinned',

package/template/coding-task-manager/lib/session-model-action-preconditions.js

@@ -25,6 +25,8 @@ const {
   validateSessionModelIntentRequest,
   DTO_BYTE_LIMIT,
 } = require('./session-model-intent-contract');
+// WP-8 (§9b M-10): the owner agent-type list is the ONE declaration in lib/coding-session-model-owner.js.
+const { OWNER_AGENT_TYPES } = require('./coding-session-model-owner');
 
 // The EXACT public request body: the four retained target/precondition fields plus the THREE
 // preconditions (client id, owner, revision). `scope` is NOT a precondition: a missing/invalid scope
@@ -34,7 +36,8 @@ const ACTION_KEYS = Object.freeze([
 ]);
 const PRECONDITION_KEYS = Object.freeze(['client_request_id', 'expected_owner', 'expected_intent_revision']);
 const OWNER_KEYS = Object.freeze(['ctmSessionId', 'agentType', 'providerSessionId', 'processGeneration']);
-const AGENT_TYPES = Object.freeze(['claude', 'codex', 'gemini', 'opencode']);
+// Derived from the ONE owner declaration (never a private copy of the four-agent literal).
+const AGENT_TYPES = OWNER_AGENT_TYPES;
 const SCOPES = Object.freeze(['session', 'session+default']);
 const CLIENT_REQUEST_ID_MAX = 128;
 // The ACTUAL accepted approval reference grammar (lib/session-model-intent-contract.js
@@ -145,10 +148,11 @@ function historyPreparationMessage(reason, suppliedMessage = '', { postPark = fa
     compaction_hash_mismatch: 'The source and target history compaction settings disagree, so the move cannot be verified safely. The current session is still running unchanged.',
     native_transition_policy_unknown: 'The Codex permission policy for the source or the target could not be read. The current session is still running unchanged.',
     native_transition_policy_mismatch: 'The Codex permission policy on the target differs from the source, so the history cannot be moved safely. The current session is still running unchanged.',
-    native_fork_adapter_unqualified: 'This Codex installation or adapter is not qualified to carry this history over. The current session is still running unchanged.',
+    native_fork_adapter_unqualified: 'The Codex adapter or version metadata this history move needs is unavailable, so it cannot be carried over. The current session is still running unchanged.',
     native_policy_override_unqualified: 'This source session uses a Codex policy override that cannot yet be reproduced safely for history transfer. The current session is still running unchanged.',
     native_token_usage_record_invalid: 'The Codex usage record for this session could not be verified, so the history size cannot be trusted. The current session is still running unchanged.',
     history_media_not_portable: 'This history contains an image, and the target model cannot receive images. The current session is still running unchanged.',
+    history_configuration_not_portable: 'This history contains Codex configuration records that the target model cannot carry over. The current session is still running unchanged.',
     // WP-2 (docs/codex-lead-routed-switch-history-handoff-2026-10-21.html §5 D-5/D-6, §6.5): the
     // encrypted-compaction path. The source model writes a plaintext handoff before the switch, and
     // each way that handoff can fail says which one it was.

package/template/coding-task-manager/lib/session-model-intent-contract.js

@@ -18,9 +18,13 @@
 
 const { createHash } = require('node:crypto');
 const { CLAUDE_ALIASES } = require('./claude-model-selection-vocabulary');
+// D-2 (docs/lead-model-id-rule-at-tilde-prefix-2026-10-28.html §5): there is exactly ONE model-id
+// rule, and it lives in lib/model-id-rule.js. A second copy here already diverged once.
+const { isValidOverrideModel } = require('./model-id-rule');
+// WP-8 (§9b M-10): the owner agent-type list is the ONE declaration in lib/coding-session-model-owner.js.
+const { OWNER_AGENT_TYPES } = require('./coding-session-model-owner');
 
 const DTO_BYTE_LIMIT = 4 * 1024;
-const MODEL_ID_MAX = 200;
 const OWNER_TEXT_MAX_BYTES = 256;
 const EVIDENCE_MAX_BYTES = 256;
 const TRANSITION_ID_MAX = 128;
@@ -28,16 +32,17 @@ const CLIENT_REQUEST_ID_MAX = 128;
 const ROUTE_ID_MAX_BYTES = 256;
 const TRANSITION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
 
-// The existing journal request grammar for a model id, including the `[1m]` decoration.
-const MODEL_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:/@+\-\[\]]*$/;
 // The existing journal effort grammar.
 const EFFORT_RE = /^[a-z]{2,12}$/;
 // The existing journal bounded ASCII reference grammar (transition ids, client request ids).
 const BOUNDED_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 
-const AGENT_TYPES = Object.freeze(['claude', 'codex', 'gemini', 'opencode']);
-const HARNESS_AGENT_TYPES = Object.freeze({ 'claude-code': 'claude', 'codex-cli': 'codex' });
+// WP-8 (§9b M-10): derived from the ONE owner declaration in lib/coding-session-model-owner.js.
+const AGENT_TYPES = OWNER_AGENT_TYPES;
+// The harness name a worker profile declares for each agent (lib/create/worker-role-profile.js).
+// WP-8: a dsh worker dispatches over ACP as 'dsh-acp'.
+const HARNESS_AGENT_TYPES = Object.freeze({ 'claude-code': 'claude', 'codex-cli': 'codex', 'dsh-acp': 'dsh' });
 const SELECTION_KINDS = Object.freeze(['concrete', 'alias', 'policy', 'default']);
 const EFFORT_ACTIONS = Object.freeze(['none', 'set', 'delete']);
 const OPERATIONS = Object.freeze(['set-selection', 'effort-only']);
@@ -118,9 +123,7 @@ function requireOwnerText(value, label) {
 }
 
 function requireModelId(value, label) {
-  if (typeof value !== 'string' || value.length < 1 || value.length > MODEL_ID_MAX || !MODEL_ID_RE.test(value)) {
-    throw invalid(`${label} is not a bounded model id`);
-  }
+  if (!isValidOverrideModel(value)) throw invalid(`${label} is not a bounded model id`);
   return value;
 }