create-walle 0.10.2 → 0.10.3

package/template/wall-e/mcp-protocol-contract.js

@@ -29,6 +29,7 @@ const SERVER_INSTRUCTIONS = [
   "Keep the lead's own model and account.",
   'Read-only census and review work can be delegated the same way with `worker_profile: "review"`: the worker cannot edit files, and you keep the verdict.',
   'Wait on workers with walle_worker_wait and omit wait_ms; it wakes on a finished, failed, resumed or stuck worker, on a question, and when your user types -- never sleep-and-check or wrap it in a short-yield script.',
+  'To integrate finished work on a repo CTM manages, call walle_landing_submit; never merge or fast-forward the target yourself. The same action from a shell is `land submit`; `walle_landing_status` / `walle_landing_wait` report the queue.',
   '',
   'This guidance is advice, not enforcement: it never authorizes spawning extra agents on your own initiative, and Wall-E cannot intercept or reroute native `spawn_agent` calls you make without it.',
   '',
@@ -60,13 +61,36 @@ const EXPLORE_GUIDANCE = [
   "- Trust the report's file:line facts; re-read only the lines you will change.",
 ].join('\n');
 
+// WP-2 (design-hub-bridge-box-session-awareness-2026-10-31.html §5 R-4, §6.3, §8 WP-2): "where you
+// run". When the stdio proxy's initialize finds this session is a BOX session (R-1), the received
+// instructions start with this one block, before SERVER_INSTRUCTIONS. Codex reads only the first 512
+// characters as server-wide guidance, so the block is capped there (BOX_CONTEXT_MAX_CHARS) and the
+// two names are truncated to 48 characters each; the routing facts come first, the shared guidance
+// follows unchanged.
+const BOX_CONTEXT_MAX_CHARS = 512;
+const BOX_CONTEXT_NAME_MAX_CHARS = 48;
+
+function buildBoxContextBlock({ boxName = '', hubName = '', hubConnected } = {}) {
+  const box = String(boxName == null ? '' : boxName).slice(0, BOX_CONTEXT_NAME_MAX_CHARS);
+  const hub = String(hubName == null ? '' : hubName).slice(0, BOX_CONTEXT_NAME_MAX_CHARS);
+  const text = `Machine context: this session runs on the box '${box}'; the user works from the hub '${hub}'. `
+    + 'Your Bash/Read/Edit run on the box. walle_get_session takes a session link or id from any machine (hub or '
+    + 'box); hub_session_read reads the hub, hub_list/hub_read_file/hub_exec reach it (the user grants access), and '
+    + "hub_mcp_list_tools/hub_mcp_call drive the hub's browser. Try them before saying the hub is unreachable."
+    // R-4: the link state is a fact, not a guess -- said plainly, and only when it is known to be down.
+    + (hubConnected === false ? ' The hub link is down right now; calls answer hub_unreachable.' : '');
+  return text.slice(0, BOX_CONTEXT_MAX_CHARS);
+}
+
 // The one builder both transports call with the state their reader resolved; 'off' (and anything
 // unrecognized) serves SERVER_INSTRUCTIONS byte-for-byte, so the guidance is switchable per lead
-// harness without a restart and without a second copy of the text.
-function buildServerInstructions({ explore = 'on' } = {}) {
-  return (explore === 'on' || explore === 'probe')
+// harness without a restart and without a second copy of the text. WP-2: `hubContext` is PREPENDED
+// (the routing facts come first); with no hubContext the output is byte-identical to before.
+function buildServerInstructions({ explore = 'on', hubContext = null } = {}) {
+  const guidance = (explore === 'on' || explore === 'probe')
     ? `${SERVER_INSTRUCTIONS}\n\n${EXPLORE_GUIDANCE}`
     : SERVER_INSTRUCTIONS;
+  return hubContext ? `${buildBoxContextBlock(hubContext)}\n\n${guidance}` : guidance;
 }
 
 // WP-2 correction (lead review): the managed agent-instruction block is the SECOND surface of the
@@ -147,6 +171,11 @@ function handleProtocolMessage(message, options = {}) {
   if (message.method === 'initialize') {
     const protocolVersion = selectProtocolVersion(message.params?.protocolVersion);
     const sessionIdFactory = typeof options.sessionIdFactory === 'function' ? options.sessionIdFactory : null;
+    // R-6 (WP-3): only the transport that really emits it advertises capabilities.tools.listChanged
+    // -- the stdio proxy passes options.listChanged === true; the daemon (HTTP /mcp, no stream) keeps
+    // today's empty `tools` capability. R-4 (WP-2): `hubContext` prepends the "where you run" block,
+    // with or without the lead-guidance option (the two are independent transport facts).
+    const hasHubContext = options.hubContext !== undefined && options.hubContext !== null;
     return {
       handled: true,
       result: {
@@ -154,14 +183,18 @@ function handleProtocolMessage(message, options = {}) {
         protocolVersion,
         response: mcpResponse(message.id, {
           protocolVersion,
-          capabilities: CAPABILITIES,
+          capabilities: options.listChanged === true
+            ? { ...CAPABILITIES, tools: { listChanged: true } }
+            : CAPABILITIES,
           serverInfo: SERVER_INFO,
           // WP-2: shared guidance every transport serves verbatim (MCP initialize result
           // instructions) -- never a per-transport variant, so stdio and HTTP cannot drift.
           // WP-4: the lead harness's exploration hand-off block rides on top ONLY when the
           // transport resolved its `explore` cell (options.leadGuidance); with no option the
           // reply is SERVER_INSTRUCTIONS, exactly as before this rule existed.
-          instructions: options.leadGuidance ? buildServerInstructions(options.leadGuidance) : SERVER_INSTRUCTIONS,
+          instructions: (options.leadGuidance || hasHubContext)
+            ? buildServerInstructions({ ...(options.leadGuidance || {}), hubContext: options.hubContext || null })
+            : SERVER_INSTRUCTIONS,
         }),
       },
     };
@@ -179,12 +212,14 @@ function handleProtocolMessage(message, options = {}) {
 }
 
 module.exports = {
+  BOX_CONTEXT_MAX_CHARS,
   CAPABILITIES,
   EXPLORE_GUIDANCE,
   PROTOCOL_VERSION,
   SERVER_INFO,
   SERVER_INSTRUCTIONS,
   SUPPORTED_PROTOCOL_VERSIONS,
+  buildBoxContextBlock,
   buildManagedAgentInstructions,
   buildServerInstructions,
   handleProtocolMessage,

package/template/wall-e/mcp-server.js

@@ -34,6 +34,12 @@ const {
   resolveDelegateParentAgentSessionId, callerDoorResponse, callerDoorBearerOk,
   applyAdmissionHealth, normalizeWorkerExecutionOptions, resolveWorkerWaitResult, resolveWorkerStopResult,
 } = require('./llm/worker-mcp-routing');
+const {
+  callerLandingSessionId, executeLandingStatus, executeLandingSubmit, executeLandingWait, executeLandingConflicts,
+  landingHintForCaller,
+} = require('./lib/landing-mcp-tools'); // WP-4 (§6.4): landing-queue tools + the D-10 hint line
+const hubBridgeClient = require('./memory/hub-bridge-client'); // WP-1: the hub-bridge lane + its R-10 pool probe
+const sessionPool = require('./memory/session-pool'); // WP-4: the pool legs (hub context + pool search)
 const { queryEmbedCacheEnabled, getCachedQueryEmbedding, setCachedQueryEmbedding } = require('./lib/query-embed-cache');
 const { recordToolCall } = require('./lib/mcp-usage'); // WP-0: per-call usage counters, flushed by agent.js
 const DIRECT_SESSION_SOURCE_SCAN_BYTES = 4 * 1024 * 1024;
@@ -386,7 +392,12 @@ async function _maybeVerifyChosenIdentity(brainApi, resolved, identityCtx, args,
     return { resolved, identityVerified: false };
   }
   const identityVerified = Boolean(verifyResult && verifyResult.proposed > 0);
-  const freshCtx = await buildIdentityResolutionCtx(brainApi, { admissionTimeoutMs: args.timeout_ms || 5000 });
+  // WP-2 (§6): this second resolution must read the SAME origin verdicts as the first (the
+  // ctx the handler already carries) -- never a second fetch, and never a silent regress to
+  // the pre-WP-2 path if re-resolution happens after an identity verify correction.
+  const availability = identityCtx && identityCtx.availability;
+  const builtFreshCtx = await buildIdentityResolutionCtx(brainApi, { admissionTimeoutMs: args.timeout_ms || 5000 });
+  const freshCtx = builtFreshCtx ? { ...builtFreshCtx, availability } : (availability ? { availability } : null);
   const reresolved = resolveDelegateArgs(args, listing, registryModels, freshCtx, prefs);
   return { resolved: reresolved.ok ? reresolved : resolved, identityVerified };
 }
@@ -438,7 +449,7 @@ async function executeTool(name, args = {}, context = {}) {
           return buildDegradedContextHint(args, err, { route });
         }
       }
-      return buildContextHint(args);
+      return buildContextHint(args, context);
     }
     case 'walle_user_profile': {
       const workerResult = await maybeRunMcpToolInWorker('walle_user_profile', args, {
@@ -452,6 +463,34 @@ async function executeTool(name, args = {}, context = {}) {
     case 'walle_postflight_check': {
       return buildPostflightCheck(args);
     }
+    // WP-4 (§6.3/§6.4): the landing-queue tools. Thin shapers over ctm-context-client; the caller
+    // identity (`session`) defaults to the stdio proxy's injected parent_agent_session_id.
+    case 'walle_landing_status': {
+      return executeLandingStatus(ctmContextClient, args, context);
+    }
+    case 'walle_landing_submit': {
+      return executeLandingSubmit(ctmContextClient, args, context);
+    }
+    case 'walle_landing_wait': {
+      return executeLandingWait(ctmContextClient, args, context);
+    }
+    case 'walle_landing_conflicts': {
+      return executeLandingConflicts(ctmContextClient, args, context);
+    }
+    // WP-1/WP-2 (docs/remote-session-hub-bridge-2026-10-30.html §5 R-4/R-10, §6.4): the `hub_*` tools
+    // run an op on ANOTHER machine in this pool (normally the hub Mac driving this session) over the
+    // local CTM hub-bridge lane. The caller identity is the landing tools' one (D-13); CTM owns every
+    // refusal code, and memory/hub-bridge-client.js owns the tool -> op mapping.
+    case 'hub_session_read':
+    case 'hub_read_file':
+    case 'hub_list':
+    case 'hub_exec':
+    // WP-3 (docs/remote-session-hub-bridge-2026-10-30.html §3 P-2, D-4, §6.4, §8 WP-3): the two
+    // browser MCP tools ride the SAME lane and the SAME mapping table (HUB_TOOL_OPS) — no new
+    // switch body, so mcp-server.js's file-size ceiling is untouched.
+    case 'hub_mcp_list_tools':
+    case 'hub_mcp_call':
+      return hubBridgeClient.runHubTool(name, args, callerLandingSessionId(args, context));
     case 'search_memories': {
       const workerResult = await maybeRunMcpToolInWorker('search_memories', args, {
         timeoutMs: Number(args?.timeout_ms) || DEFAULT_MCP_SEARCH_TIMEOUT_MS,
@@ -762,7 +801,9 @@ async function executeTool(name, args = {}, context = {}) {
         needSession: !(args.route || args.model),
       });
       // Only a routed answer needs the route listing and identity tier; a native answer never reaches CTM.
-      const routed = Boolean(args.route || args.model) || foldDelegateLadder(prefs, execution.agent).effective.lane === 'routed';
+      // §9 S-16 (WP-5): the stored LADDER is keyed by the LEAD's agent (prefs.agent -- an OpenCode
+      // lead reads default:opencode), while the worker HARNESS stays execution.agent (claude|codex).
+      const routed = Boolean(args.route || args.model) || foldDelegateLadder(prefs, prefs.agent).effective.lane === 'routed';
       const { providers, registryModels } = routed
         ? await ctmContextClient.listWorkerRoutes({ timeoutMs: args.timeout_ms || 5000 })
         : { providers: [], registryModels: [] };
@@ -770,7 +811,24 @@ async function executeTool(name, args = {}, context = {}) {
       // Identity WP-3 (S-6): a phrase in `model` now resolves through the
       // identity tier (D-9) when the legacy tiers miss -- best-effort ctx,
       // never blocks delegation when the brain/identity read fails.
-      const identityCtx = routed ? await buildIdentityResolutionCtx(require('./brain'), { admissionTimeoutMs: args.timeout_ms || 5000 }) : null;
+      // WP-2 (§5 D-6/D-7, §6): a call that names no route/model resolves the lead's STORED
+      // pick -- so this machine's OWN origin-reachability verdicts ride the ctx, letting the
+      // resolver refuse a stored pick whose gateway this box cannot reach BEFORE any launch
+      // work (instead of CTM dying later as a raw 503 upstream_unready). Fetched in parallel
+      // with the identity ctx, over loopback, best-effort (null on any failure = no gate).
+      // Explicit route/model calls take the pre-WP-2 path and never fetch availability.
+      const storedPick = !(args.route || args.model);
+      let identityCtx = null;
+      if (routed) {
+        const [builtCtx, availability] = await Promise.all([
+          buildIdentityResolutionCtx(require('./brain'), { admissionTimeoutMs: args.timeout_ms || 5000 }),
+          storedPick ? ctmContextClient.modelAvailability({ timeoutMs: args.timeout_ms || 5000 }) : Promise.resolve(null),
+        ]);
+        // routeHealthRefusal guards circuitFor/admissionFor with typeof === 'function', so a
+        // `{ availability }` ctx (brain unavailable) is safe -- a missing identityCtx must
+        // never silently drop the origin gate.
+        identityCtx = builtCtx ? { ...builtCtx, availability } : (availability ? { availability } : null);
+      }
       const normalizedArgs = { ...args, agent: execution.agent };
       let resolved = resolveDelegateArgs(normalizedArgs, listing, registryModels, identityCtx, prefs);
       if (!resolved.ok) throw delegateArgsError(resolved.code, resolved);
@@ -890,8 +948,8 @@ async function executeTool(name, args = {}, context = {}) {
     case 'walle_search_sessions': {
       const limit = clampLimit(args.limit, 10, 50);
       const ctmResults = args.prefer_db === false
-        ? { ok: false, results: [], skipped: true, reason: 'prefer_db_false' }
-        : await safeCtmSearchSessions({ query: args.query, limit });
+        ? { ok: false, results: [], skipped: true, reason: 'prefer_db_false', machines: [] }
+        : await sessionPool.searchSessionsAcrossPool({ query: args.query, limit, args, context });
       const memorySearch = args.include_memory === false
         ? {
           results: [],
@@ -924,6 +982,9 @@ async function executeTool(name, args = {}, context = {}) {
       scheduleMemoryRecall(memoryResults, { toolName: 'walle_search_sessions', logger: console });
       return {
         results,
+        // WP-4 (R-7): which machines this answer heard from (self first when CTM labelled the search,
+        // plus the hub when the caller is a box session and the pool fan-out ran).
+        machines: Array.isArray(ctmResults.machines) ? ctmResults.machines : [],
         sources: {
           ctm_db: {
             ok: Boolean(ctmResults.ok),
@@ -973,12 +1034,12 @@ async function executeTool(name, args = {}, context = {}) {
         });
       }
       const wantsDb = args.prefer_db !== false;
-      const dbSessionIds = args.session_ids || args.session_id || args.source_id;
-      if (wantsDb && dbSessionIds) {
+      if (wantsDb && (args.session_ids || args.session_id || args.source_id || args.ref)) {
         const dbContext = await safeCtmSessionContext({
           session_ids: args.session_ids,
           session_id: args.session_id,
           source_id: args.source_id,
+          ref: args.ref, // WP-3 (§6.4, R-1): an identity string, not a session id — enough on its own
           limit: args.limit ?? 20,
           turn_limit: args.turn_limit,
           byte_limit: args.byte_limit ?? DEFAULT_SESSION_PAGE_BYTES,
@@ -991,10 +1052,8 @@ async function executeTool(name, args = {}, context = {}) {
           dedupe: args.dedupe !== false,
           format: args.format || 'messages',
         });
-        if (dbContext.ok && (dbContext.sessions.length > 0 || dbContext.messages.length > 0)) {
-          return dbContext;
-        }
-        if (args.session_id || args.session_ids) return dbContext;
+        if (dbContext.ok && (dbContext.sessions.length > 0 || dbContext.messages.length > 0)) return dbContext;
+        if (args.session_id || args.session_ids || args.ref) return sessionPool.sessionContextViaHub(dbContext, args, context);
       }
       if (!args.source_id) throw new Error('source_id is required when adapter_id and uri are not provided');
       return memorySessionPage(args.source_id, {
@@ -1094,6 +1153,26 @@ function routeWallEQuery(query, opts = {}) {
     };
   }
 
+  // WP-4 (§6.4): the landing queue is CTM's, not Wall-E memory -- matched before session_context so
+  // "land my branch" (which also matches `\bbranch\b`) recommends the landing tools, not context packs.
+  const landingQueue = add('landing_queue', [
+    /\blanding queue\b/,
+    /\bmerge queue\b/,
+    /\bland (my|this|the) (branch|work|tip|commit)\b/,
+    /\bwho is blocking (the|my) (merge|landing|queue)\b/,
+  ]);
+  if (landingQueue) {
+    return {
+      route: 'landing_queue',
+      should_use_walle: true,
+      primary_tools: ['walle_landing_status', 'walle_landing_submit'],
+      secondary_tools: ['walle_landing_conflicts', 'walle_landing_wait'],
+      avoid_until_memory_miss: ['web_search', 'web_fetch'],
+      reason: 'The request is about integrating finished work into the repo CTM manages, which is the landing queue\'s job -- submit through it rather than merging by hand.',
+      matched,
+    };
+  }
+
   if (selfProfile) {
     return {
       route: 'walle_private_memory',
@@ -1241,7 +1320,7 @@ async function lookupWallEContext(args = {}) {
   if (includeSessions) {
     const sessionQuery = isProfileLookup ? 'thorough review fix issues commit high-agency' : query;
     const sessionSearchPromise = withMcpDeadline(
-      () => safeCtmSearchSessions({
+      () => sessionPool.safeSearchLocal({
         query: sessionQuery,
         limit,
         prefer_db: args.prefer_db !== false,
@@ -1695,7 +1774,7 @@ function renderPromptContext({ route, profile, lookup, budget }) {
   return rendered.length > budget ? rendered.slice(0, Math.max(0, budget - 18)).trimEnd() + '\n</wall-e-context>' : rendered;
 }
 
-async function buildContextHint(args = {}) {
+async function buildContextHint(args = {}, context = {}) {
   const query = String(args.query || '').trim();
   if (!query) throw new Error('query is required');
   const route = routeWallEQuery(query, { context: args.context });
@@ -1730,24 +1809,43 @@ async function buildContextHint(args = {}) {
     });
   }
 
-  const promptContext = mustUseWallE
+  let promptContext = mustUseWallE
     ? renderPromptContext({ route, profile: compactProfile, lookup, budget })
     : '';
 
+  // WP-4 (§6.4/D-10): when the caller has a CTM session id, one landing line is appended if that
+  // session has a NON-terminal job. The probe has a hard 300 ms budget (inside landingHintForCaller);
+  // on timeout/refusal/unreachable CTM the line is omitted and `sources.landing.ok === false`. With
+  // no caller session, or no job, nothing is added -- no `sources.landing` key (byte-identical to
+  // the pre-WP-4 hint).
+  const callerSessionId = callerLandingSessionId(args, context);
+  const landingHint = await landingHintForCaller(ctmContextClient, callerSessionId);
+  const sources = {
+    profile: { included: Boolean(compactProfile), evidence_count: compactProfile?.evidence?.length || 0 },
+    lookup: lookup?.sources || null,
+  };
+  let landingLine = '';
+  if (landingHint) {
+    if (landingHint.ok === false) {
+      sources.landing = { ok: false, error: landingHint.error };
+    } else if (landingHint.line) {
+      landingLine = landingHint.line;
+      promptContext = promptContext ? `${promptContext}\n${landingLine}` : landingLine;
+      sources.landing = { ok: true };
+    }
+  }
+
   return {
     route,
     confidence: routeConfidence(route),
     must_use_walle_before_answer: mustUseWallE,
-    should_inject_context: Boolean(mustUseWallE && promptContext),
+    should_inject_context: Boolean((mustUseWallE && promptContext) || landingLine),
     recommended_tools: recommendedTools,
     skipped_reason: mustUseWallE ? '' : route.reason,
     compact_profile: compactProfile,
     lookup,
     prompt_context: promptContext,
-    sources: {
-      profile: { included: Boolean(compactProfile), evidence_count: compactProfile?.evidence?.length || 0 },
-      lookup: lookup?.sources || null,
-    },
+    sources,
   };
 }
 
@@ -1945,14 +2043,6 @@ function stripRank(item) {
   return rest;
 }
 
-async function safeCtmSearchSessions(args) {
-  try {
-    return await ctmContextClient.searchSessions(args);
-  } catch (err) {
-    return { ok: false, source: 'ctm-db', results: [], reason: err.message };
-  }
-}
-
 async function safeCtmSessionContext(args) {
   try {
     return await ctmContextClient.getSessionContext(args);
@@ -2745,6 +2835,10 @@ async function handleMcpMessage(msg, context = {}) {
     // notification methods here instead of silently swallowing them.
     acceptAnyNotification: true,
     leadGuidance: leadGuidanceForMessage(msg, brain), // WP-4 §6.4: gates the exploration hand-off block
+    // R-1/R-2 (WP-0): the daemon answers tools/list too, but over HTTP it has no per-session caller
+    // id and no stream to push on, so it gates on role alone (sessionId ''). No listChanged, no
+    // hubContext here -- both are stdio-proxy behaviours (WP-2/WP-3).
+    hideTools: await hubBridgeClient.hideTools({ tools: MCP_TOOLS, sessionId: '' }),
   });
   if (control.handled) return control.result;
 
@@ -2788,7 +2882,12 @@ async function handleMcpMessage(msg, context = {}) {
         if (mcpPerfLogsEnabled()) {
           console.warn(`[mcp] tool ${toolName || 'unknown'} failed in ${Date.now() - startedAt}ms: ${err.message}`);
         }
-        return { response: mcpResponse(id, { content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true }) };
+        // D-9: a CTM refusal wrapped by ctm-context-client's _wrapCtmDelegateError keeps the
+        // parsed CTM body on err.body; surface its next_step instead of dropping it with err.message
+        // (unless the message already carries it, e.g. a refusal whose message IS the JSON body).
+        const nextStep = err && err.body && typeof err.body === 'object' && typeof err.body.next_step === 'string'
+          && !String(err.message).includes(err.body.next_step) ? err.body.next_step : '';
+        return { response: mcpResponse(id, { content: [{ type: 'text', text: nextStep ? `Error: ${err.message}\nnext_step: ${nextStep}` : `Error: ${err.message}` }], isError: true }) };
       }
     }
 

package/template/wall-e/mcp-worker-schemas.js

@@ -20,7 +20,7 @@ const WORKER_ROUTE_ENTRY_SCHEMA = {
     models: { type: 'array', items: { type: 'string' }, description: 'Every enabled model_registry model id for this provider (GET /api/models/registry); empty when the provider has none' },
     kind: { type: 'string' },
     upstream_apis: { type: 'array', items: { type: 'string', enum: ['anthropic-messages', 'openai-responses', 'openai-chat'] } },
-    agents: { type: 'array', items: { type: 'string', enum: ['claude', 'codex'] } },
+    agents: { type: 'array', items: { type: 'string', enum: ['claude', 'codex', 'dsh'] } },
     // Admission WP-4 (worker-admission-no-cap-throttle-truth-2026-10-10.html D-3): 'throttled'
     // means GET /api/sessions/delegate/admission names this route with a live hold
     // (throttled_until or quota_held), with its reason and refusal count.
@@ -124,7 +124,7 @@ const LIST_WORKER_ROUTES_OUTPUT_SCHEMA = {
       properties: {
         route: { type: 'string' },
         model: { type: 'string' },
-        agents: { type: 'array', items: { type: 'string', enum: ['claude', 'codex'] } }, // WP-4 D-18
+        agents: { type: 'array', items: { type: 'string', enum: ['claude', 'codex', 'dsh'] } }, // WP-4 D-18
       },
       required: ['route', 'model'],
       additionalProperties: true,
@@ -146,7 +146,7 @@ const LIST_WORKER_ROUTES_OUTPUT_SCHEMA = {
 // pin field at all. One definition per enum, so the shape rules can never drift from the whitelist.
 const NATIVE_LAUNCH_FIELD_SCHEMAS = {
   state: { type: 'string', enum: ['known', 'unknown'] },
-  agent: { type: 'string', enum: ['codex', 'claude'], description: 'The lead\'s own harness -- a native helper always runs on it; present whenever the resolved live lead reported one, even with an unknown pin' },
+  agent: { type: 'string', enum: ['codex', 'claude', 'opencode'], description: 'The lead\'s own harness (opencode = an OpenCode lead, whose native helper runs inside OpenCode) -- a native helper always runs on it; present whenever the resolved live lead reported one, even with an unknown pin' },
   kind: { type: 'string', enum: ['native', 'routed', 'inherit'], description: 'The launch class this lead was launched with: native = a model override, routed = the reserved worker alias, inherit = the lead\'s own model' },
   model: { type: 'string', description: 'The model the launch was configured with (empty = no model override was configured, which is not proof the lead will run the requested model; a routed class records the launch-time target snapshot, not the alias its role actually forces)' },
   effort: { type: ['string', 'null'], description: 'The configured Codex role effort: a bounded token, \'\' for a known "no role override", null when unknown or not applicable (Claude applies none)' },
@@ -166,7 +166,7 @@ const DELEGATE_IMPLEMENTATION_OUTPUT_SCHEMA = {
     ok: { type: 'boolean', description: 'true on a native answer (nothing was launched)' },
     lane: { type: 'string', enum: ['routed', 'native'], description: 'routed = a worker session was launched; native = the lead spawns the helper itself with `model`' },
     source: { type: 'string', enum: ['explicit', 'session', 'default', 'vendor'], description: 'The rung that decided the model: named in the call, the lead\'s session pick, the agent default, or the vendor default' },
-    harness: { type: ['string', 'null'], enum: ['claude-code', 'codex-cli', null] },
+    harness: { type: ['string', 'null'], enum: ['claude-code', 'codex-cli', 'dsh-acp', null] },
     worker_profile: { type: ['string', 'null'], enum: ['legacy', 'implementation', 'review', null] },
     original_brief_sha256: { type: ['string', 'null'] },
     rendered_brief_sha256: { type: ['string', 'null'] },
@@ -319,7 +319,7 @@ const WORKER_STATUS_OUTPUT_SCHEMA = {
   properties: {
     status: { type: 'string', enum: ['starting', 'working', 'throttled', 'report_ready', 'failed', 'exited'] },
     generation: { type: 'integer' },
-    harness: { type: ['string', 'null'], enum: ['claude-code', 'codex-cli', null] },
+    harness: { type: ['string', 'null'], enum: ['claude-code', 'codex-cli', 'dsh-acp', null] },
     worker_profile: { type: ['string', 'null'], enum: ['legacy', 'implementation', 'review', null] },
     parent_ctm_session_id: { type: 'string' },
     report_path: { type: 'string' },

package/template/wall-e/memory/ctm-context-client.js

@@ -38,6 +38,9 @@ async function searchSessions(args = {}, options = {}) {
   const params = new URLSearchParams();
   if (args.query !== undefined) params.set('q', String(args.query || ''));
   if (args.limit !== undefined) params.set('limit', String(args.limit));
+  // WP-4 (docs/cross-machine-session-context-2026-10-31.html §6.2/§6.4, R-7): `scope=pool` lets CTM
+  // fan the search out to every dialable member and merge by RRF; omitted, CTM's own default applies.
+  if (args.scope !== undefined) params.set('scope', String(args.scope));
   return apiFirst({
     path: `/api/ctm/session-memory/search?${params.toString()}`,
     fallback: () => ctmSessionContext.searchCtmSessions({ ...args, ...directOptions(options) }),
@@ -49,6 +52,10 @@ async function getSessionContext(args = {}, options = {}) {
   const params = new URLSearchParams();
   for (const id of normalizeIds(args.session_ids || args.ids)) params.append('session_id', id);
   if (args.session_id || args.source_id) params.append('session_id', args.session_id || args.source_id);
+  // WP-3 (docs/cross-machine-session-context-2026-10-31.html §6.2/§6.4, R-1): `ref` is any identity
+  // string the search box's parser understands (`…#session=<id>`, `review=<id>`, or a bare id) and
+  // CTM merges it into the read's session ids. It rides ALONGSIDE session_id, never as one.
+  if (args.ref) params.set('ref', String(args.ref));
   for (const [key, value] of Object.entries({
     limit: args.limit,
     cursor: args.cursor,
@@ -483,6 +490,22 @@ async function listWorkerRoutes(options = {}) {
   };
 }
 
+// WP-2 (docs/remote-session-child-transcript-model-truth-and-restart-2026-10-27.html §5 D-6): this
+// machine's own origin-reachability verdicts, read over loopback with the same bearer as the route
+// listing. Best-effort: any failure (refused, 403, timeout, non-JSON) answers null, never throws --
+// an unknown verdict is "no gate", exactly like a missing identityCtx. `_ctmDelegateCall` throws on
+// every non-2xx/transport failure and returns whatever the endpoint body parsed to, so ONLY a
+// well-formed `{ ok: true, routes: [...] }` is returned; anything else (an error body, a partial
+// shape) answers null.
+async function modelAvailability(options = {}) {
+  const env = options.env || process.env;
+  const timeoutMs = options.timeoutMs ?? 5000;
+  try {
+    const body = await _ctmDelegateCall('/api/models/availability', { timeoutMs, env });
+    return body && body.ok === true && Array.isArray(body.routes) ? body : null;
+  } catch { return null; } // expected: availability is advisory; the health gate degrades to "unknown"
+}
+
 // POST /api/sessions/delegate (§6.2). `body` is the exact request body shape sessions.js's
 // handleDelegateSession reads (brief_path, cwd, route, model, agent,
 // parent_agent_session_id, allowed_tools, max_turns, title) -- the caller (mcp-server.js)
@@ -694,6 +717,65 @@ async function stopWorker(ctmSessionId, { mode = 'after_turn', reason = '', grac
   }
 }
 
+// WP-4 (local-landing-queue-multi-session-integration-2026-10-26.html §6.3, §6.4): the landing
+// queue's two CTM calls. Same authenticated helper as every other worker/delegate call
+// (`_ctmDelegateCall`) -- never a second hand-rolled client, and (like the delegated-worker calls)
+// no apiFirst() direct-DB fallback: there is no local equivalent of "what is in this repo's queue"
+// to fall back to.
+//
+// The status route answers 200 with the read model, or a non-2xx `{ ok:false, error }` body (404
+// repo_unknown, 502 landing_probe_failed). A structured non-2xx body is a FIRST-CLASS result,
+// relayed verbatim (the D-8 pattern resumeWorker/stopWorker already use); only a transport failure
+// (unreachable CTM, abort, timeout) throws.
+function _landingQuery({ repo, session, cached }) {
+  const params = new URLSearchParams();
+  if (typeof repo === 'string' && repo) params.set('repo', repo);
+  if (typeof session === 'string' && session) params.set('session', session);
+  if (cached === true) params.set('cached', '1');
+  const query = params.toString();
+  return query ? `?${query}` : '';
+}
+
+// `cached: true` asks CTM for the session's view as its last sweep left it (no CLI child); it needs
+// `session` and answers `{ ok, cached:true, repo, forSession }`.
+async function landingStatus({ repo, session, cached, timeoutMs } = {}, options = {}) {
+  const env = options.env || process.env;
+  try {
+    return await _ctmDelegateCall(`/api/landing/status${_landingQuery({ repo, session, cached })}`, {
+      timeoutMs: timeoutMs ?? 6000,
+      env,
+    });
+  } catch (err) {
+    if (err && err.body && typeof err.body === 'object') return err.body; // structured refusal is a result
+    throw err; // RETHROW: a transport failure is not a status answer.
+  }
+}
+
+// POST /api/landing/submit { session, priority?, reason? }: the CLI's own `land submit --json`
+// payload on 200, or a typed refusal body on 409 (the caller's branch is not landable) / 400
+// (usage). Both are relayed verbatim; only a transport failure throws.
+// WP-4 (§6.4): `priority` and `reason` are optional passthroughs -- CTM hands them to the CLI's
+// `--priority` / `--reason`, which is the one validator. Only a non-empty string is sent, so a call
+// without them still posts exactly `{session}` (byte-for-byte the pre-WP-4 body).
+async function landingSubmit({ session, priority, reason, timeoutMs } = {}, options = {}) {
+  const env = options.env || process.env;
+  const body = {};
+  if (typeof session === 'string' && session) body.session = session;
+  if (typeof priority === 'string' && priority) body.priority = priority;
+  if (typeof reason === 'string' && reason) body.reason = reason;
+  try {
+    return await _ctmDelegateCall('/api/landing/submit', {
+      method: 'POST',
+      body,
+      timeoutMs: timeoutMs ?? 30000,
+      env,
+    });
+  } catch (err) {
+    if (err && err.body && typeof err.body === 'object') return err.body; // structured refusal is a result
+    throw err; // RETHROW: a transport failure is not a submit answer.
+  }
+}
+
 function annotateFallback(result, apiTransport) {
   return {
     ...(result || {}),
@@ -734,6 +816,7 @@ module.exports = {
   getConversationItems,
   ackConversationChanges,
   listWorkerRoutes,
+  modelAvailability,
   expandWorkerRegistry,
   fetchWorkerRegistry,
   delegateWorker,
@@ -741,6 +824,8 @@ module.exports = {
   delegateParent,
   workerStatus,
   waitForWorkers,
+  landingStatus,
+  landingSubmit,
   resumeWorker,
   stopWorker,
   resetApiState,

package/template/wall-e/memory/ctm-session-context.js

@@ -23,6 +23,7 @@ const CTM_SESSION_TABLES = [
   'conversation_item_placement_v2',
   'conversation_text_fts_v2',
 ];
+const { createReplicaOriginLookup: replicaLookup } = require('./replica-origin'); // WP-5/R-6 replica_origin
 let Database = null;
 
 function requireBetterSqlite3() {
@@ -345,6 +346,7 @@ function getCtmSessionContext({
     }
 
     const bundles = identifiers.map((id) => resolveSessionBundle(conn, id)).filter(Boolean);
+    const replicaOriginOf = replicaLookup(conn, hasTable); // WP-5: one cursor read per call
     const seenBundles = new Set();
     const uniqueBundles = bundles.filter((bundle) => {
       const key = bundle.ctm_session_id || bundle.requested_id;
@@ -371,7 +373,7 @@ function getCtmSessionContext({
       const conversationId = selectBoundedConversationId(conn, bundle);
       const conversations = getConversationRows(conn, bundle);
       if (!conversationId) {
-        sessions.push(formatSessionSummary(bundle, conversations, []));
+        sessions.push(formatSessionSummary(bundle, conversations, [], replicaOriginOf));
         continue;
       }
       const pageCursor = cursorForConversation(cursor, conversationId, bundle, uniqueBundles.length);
@@ -402,7 +404,7 @@ function getCtmSessionContext({
         row, bundle, conversationId, index,
       }));
       const selectedMessages = dedupe ? dedupeMessages(sessionMessages) : sessionMessages;
-      sessions.push(formatSessionSummary(bundle, conversations, selectedMessages));
+      sessions.push(formatSessionSummary(bundle, conversations, selectedMessages, replicaOriginOf));
       allMessages.push(...selectedMessages);
       ranges[bundle.ctm_session_id] = page.range;
       generations[bundle.ctm_session_id] = page.generation;
@@ -885,6 +887,7 @@ function quoteIdent(value) {
 function searchSessionMessagesFts(db, query, limit) {
   const ftsQueries = buildFtsQueries(query);
   if (!ftsQueries.length) return [];
+  const replicaOriginOf = replicaLookup(db, hasTable); // WP-5: one cursor read per call
   if (hasTable(db, 'conversation_text_items_v2')
       && hasTable(db, 'conversation_item_placement_v2')
       && hasTable(db, 'conversation_text_fts_v2')) {
@@ -907,6 +910,7 @@ function searchSessionMessagesFts(db, query, limit) {
           source_table: 'conversation_text_fts_v2',
           rank: index,
           score: row.rank,
+          replicaOriginOf,
         }));
       }
     }
@@ -935,6 +939,7 @@ function enrichSearchRow(db, row, extra = {}) {
     snippet: snippetAround(row.content || '', 800),
     content_hash: contentFingerprint(row.content || ''),
     rank: extra.rank || 0,
+    replica_origin: extra.replicaOriginOf ? extra.replicaOriginOf([row.conversation_id, resolved.ctm_session_id]) : '',
   };
 }
 
@@ -1130,7 +1135,7 @@ function messageText(raw) {
   return '';
 }
 
-function formatSessionSummary(bundle, conversations, messages) {
+function formatSessionSummary(bundle, conversations, messages, replicaOriginOf) {
   const firstConversation = conversations[0] || {};
   return {
     session_id: bundle.ctm_session_id,
@@ -1146,6 +1151,7 @@ function formatSessionSummary(bundle, conversations, messages) {
     message_count: messages.length,
     user_msg_count: firstConversation.user_msg_count || messages.filter((msg) => msg.role === 'user').length,
     assistant_msg_count: firstConversation.assistant_msg_count || messages.filter((msg) => msg.role === 'assistant').length,
+    replica_origin: replicaOriginOf ? replicaOriginOf([bundle.ctm_session_id, ...(bundle.agent_session_ids || [])]) : '',
   };
 }