create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/api/walle-bridge.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const { registerApiRoutes } = require('../api-router');
+const remoteMachineCatalog = require('../remote-machine-catalog');
 
 let _deps = null;
 
@@ -107,9 +108,16 @@ function _maybeNotifyDelegatePrefMutation(req, res, url) {
   });
 }
 
-function handleProxy(req, res, url) {
+async function handleProxy(req, res, url) {
   _maybeNotifyProviderMutation(req, res, url);
   _maybeNotifyDelegatePrefMutation(req, res, url);
+  // WP-3 read + WP-1 writes (docs/remote-session-delegate-pick-write-forward-2026-10-30.html): a
+  // box-owned session's delegate pick is read from — and its per-session / per-agent writes are
+  // stored on — the box that owns it.
+  if (url && (url.pathname === '/api/models/delegate-prefs' || DELEGATE_PREF_SCOPE_RE.test(url.pathname))) {
+    const id = String(url.searchParams.get('ctm_session_id') || '');
+    if (id && await remoteMachineCatalog.forwardDelegatePrefsRequest(req, res, id)) return undefined;
+  }
   return _deps.walleClient.proxyHttp(req, res, {
     port: _deps.wallePort,
     unavailableContext: () => _deps.getWalleSupervisorStatus(),

package/template/coding-task-manager/lib/attachment-reconciler-wiring.js

@@ -226,7 +226,10 @@ function createAuthorityReportReconcilerDispatch(deps = {}) {
     // caller that only cares about the diagnostic-only shape (WP-5's own tests) still works
     // unmodified.
     executeAttachmentTeardown = () => {},
-    // Route-dead rung: asks the client to re-run its own gated bootstrap request.
+    // Route-dead rung: asks the client to re-run its own gated bootstrap request. A bootstrap is
+    // lease-neutral (server.js:40958-40966: a ROUTE RESET, not a departure -- geometry lease,
+    // primary role and measured dims stay intact), so holding the lease is NOT part of the
+    // route-dead predicate; `leaseOwnerMatches` is only threaded through for the diagnostic.
     rebootstrapRoute = () => ({ sent: false }),
     now = () => Date.now(),
   } = deps;
@@ -243,7 +246,7 @@ function createAuthorityReportReconcilerDispatch(deps = {}) {
   function routeRebootstrapStep({ ws, sessionId, details, clientIdStr, leaseOwnerMatches, ptyAlive, lockedSinceMs }) {
     const key = _keyFor(clientIdStr, sessionId);
     const routeDead = details?.blocker === 'route_unavailable' && details?.routeLive === false
-      && ptyAlive === true && leaseOwnerMatches === true;
+      && ptyAlive === true;
     if (!routeDead) { routeEpisodes.delete(key); return null; }
     const t = now();
     for (const [k, e] of routeEpisodes) if (t - e.lastReportAt >= ROUTE_EPISODE_TTL_MS) routeEpisodes.delete(k);

package/template/coding-task-manager/lib/auth-rate-limit.js

@@ -5,6 +5,15 @@
 // low-level limiter behind the rule tables (and their consumers) for a one-string comparison.
 const PEER_CONTROL_SCOPE = 'peer-control';
 
+// WP-1 (docs/remote-relay-ack-rate-limit-typing-delay-2026-10-28.html §5 D-2, §9 S-2): the one
+// rate kind that is NOT a bucket. A rule row carrying `rateKind: 'credit'` declares a message that
+// is the sender's PERMISSION to keep sending (an SSH-style window/ack credit, RFC 4254 §5.2), so
+// charging it to a token bucket stalls the sender instead of protecting the box. Only the WS `ack`
+// row carries it today. `_rateLimitDecision` short-circuits this kind to `{ ok: true }`, so this
+// module deliberately HAS NO `credit` bucket and `AuthRateLimiter.check('credit', …)` is never
+// reached (see server.js `_rateLimitDecision`).
+const RATE_KIND_CREDIT = 'credit';
+
 const DEFAULT_LIMITS = Object.freeze({
   // Remote/mobile page bootstrap fans out across settings, sessions, standup,
   // auth state, WebSocket setup, and cached refresh probes. Keep read traffic
@@ -22,6 +31,13 @@ const DEFAULT_LIMITS = Object.freeze({
   // authenticated `peer-control` principal (see rateKindForRule below); every other caller keeps
   // the exact bucket it had before.
   peer: { refillPerMinute: 600, burst: 120 },
+  // receipt (WP-1, docs/remote-relay-ack-rate-limit-typing-delay-2026-10-28.html §5 D-3): the
+  // diagnostic frame receipts (`frame-receipt`). They are NOT credit — each one can persist a
+  // `maybePersistFrameApplyReceipt` row — but refusing one loses telemetry ONLY, so they get their
+  // own bucket instead of sharing the hub-wide `default` one, which is what let 153 relayed
+  // receipts in 33 min compete with the acks of the same principal. 3× the `default` refill
+  // because a frame carries up to 2 receipts versus 1 ack (§1c); burst 300 ≈ 5 s of 60 fps output.
+  receipt: { refillPerMinute: 1800, burst: 300 },
   // machine_pair (WP-3, docs/machine-pool-picker-pairing-dashboard-2026-10-24.html §6.3/D-13): the
   // PRE-AUTH POST /api/machine-pairing/join. `sync`'s own bucket. It is the ONLY bucket selected by
   // route rather than by principal: the join has no authenticated caller yet (the request carries the
@@ -168,6 +184,12 @@ class AuthRateLimiter {
  */
 function rateKindForRule(rule, pathname = '', auth = null) {
   if (pathname === '/api/auth/begin-step-up') return 'step_up';
+  // WP-1 (§5 D-2/D-3, §9 S-1): a rule that declares its own kind wins over the mutation-scope
+  // cascade below — `credit` (never charged; the caller short-circuits) and `receipt` (its own
+  // bucket). Checked BEFORE the `!rule.mutation → 'default'` line so a relayed read-shaped message
+  // is no longer dumped into the hub-wide `default` bucket keyed by the single hub principal (the
+  // root cause: 190 acks refused in 33 min). No HTTP rule carries `rateKind`, so HTTP is unchanged.
+  if (rule?.rateKind === RATE_KIND_CREDIT || rule?.rateKind === 'receipt') return rule.rateKind;
   if (!rule?.mutation) return 'default';
   const scopes = auth && auth.scopes;
   const isPeerControl = scopes instanceof Set
@@ -183,6 +205,7 @@ module.exports = {
   DEFAULT_FAILED_AUTH,
   DEFAULT_LIMITS,
   IP_LOCK_AUTH_FAILURE_CODES,
+  RATE_KIND_CREDIT,
   normalizeAuthFailureCode,
   normalizeIpLockKey,
   rateKindForRule,

package/template/coding-task-manager/lib/auth-rules.js

@@ -47,8 +47,17 @@ const WS_AUTH_RULES = Object.freeze({
   // State-sync render protocol: clients acknowledge frames, request bounded
   // keyframes, and report visible sessions. These only affect that viewer's
   // stream/backpressure state, not agent execution or persisted session data.
-  ack: peerControl('read', false, 'never'),
-  'frame-receipt': peerControl('read', false, 'never'),
+  //
+  // WP-1 (docs/remote-relay-ack-rate-limit-typing-delay-2026-10-28.html §5 D-2/D-3, §9 S-3): an
+  // `ack` is the flow-control CREDIT for a frame this box itself sent (it is a no-op unless
+  // `seq === inFlightSeq`), so it is never charged to a token bucket — refusing it stalls the
+  // sender, which is how 190 relayed acks were refused in 33 min on the Spark box and each
+  // refusal waited out the fixed 3 s lost-ack sweep. `frame-receipt` is diagnostics + a DB
+  // write (`maybePersistFrameApplyReceipt`), so it keeps a bucket, but its OWN (`receipt`), so
+  // receipt overflow can never starve acks or `input`. Both rows otherwise keep their §6.2
+  // tuple (read / no mutation / never step-up) — `rateKind` is additive.
+  ack: peerControl('read', false, 'never', { rateKind: 'credit' }),
+  'frame-receipt': peerControl('read', false, 'never', { rateKind: 'receipt' }),
   'keyframe-req': peerControl('read', false, 'never'),
   'restore-applied': rule('read', false, 'never'),
   // D-2/WP-2 verdict/adopt round-trip ack — same viewer-local render-protocol
@@ -62,7 +71,7 @@ const WS_AUTH_RULES = Object.freeze({
   'terminal-bootstrap': peerControl('read', false, 'never'),
   'terminal-bootstrap-ack': peerControl('read', false, 'never'),
   'session-inventory': rule('read', false, 'never'),
-  'terminal-geometry-claim-v2': rule('read', false, 'never'),
+  'terminal-geometry-claim-v2': peerControl('read', false, 'never'),
   'secondary-snapshot-retry': rule('read', false, 'never'),
   // Wake paint acknowledgement closes the viewer-local wake timing span. It
   // carries no PTY input and does not mutate durable session state.
@@ -129,6 +138,13 @@ const WS_AUTH_RULES = Object.freeze({
   'update-session-cwd': rule('admin', true, 'remote'),
   'session-surface-preference': rule('admin', true, 'remote'),
   'model-change': peerControl('admin', true, 'remote'),
+  // WP-0 (docs/remote-session-hub-bridge-2026-10-30.html §5 R-2, §6.1, §8 WP-0): the two frames a
+  // BOX receives on the socket the HUB dialled — the hub's own identity handshake and its reply to a
+  // box `hub-bridge-request`. Read scope, non-mutation, never step-up: they carry no command, only
+  // routing. `peerControl` is what admits them: an ordinary device/admin socket is refused, so only
+  // the hub's CONTROL link can register itself for the box -> hub lane.
+  'hub-bridge-hello': peerControl('read', false, 'never'),
+  'hub-bridge-response': peerControl('read', false, 'never'),
 });
 
 const HTTP_AUTH_RULES = Object.freeze([
@@ -174,11 +190,17 @@ const HTTP_AUTH_RULES = Object.freeze([
   // image-draft family a hub forwards for a MIRROR session. Only the `peerControl` flag is added —
   // scope, mutation and step-up are unchanged for every other caller — exactly like the hub §6.2 rows.
   regex('GET', /^\/api\/sessions\/[^/]+\/image-drafts(?:\/[^/]+\/content)?$/, 'read', false, 'never', { peerControl: true }),
-  regex('GET', /^\/api\/sessions\/[^/]+\/native-subagents\/[^/]+\/messages$/, 'read', false, 'never'),
+  // WP-1 (docs/remote-session-child-transcript-model-truth-and-restart-2026-10-27.html §5 D-2, §8
+  // WP-1, §9 S-6): the child transcript and the native runtime live on the BOX that owns a mirror
+  // session, so the review read is forwarded over the peer bearer. Flag only — scope/mutation/step-up
+  // are byte-for-byte what every other caller is evaluated against.
+  regex('GET', /^\/api\/sessions\/[^/]+\/native-subagents\/[^/]+\/messages$/, 'read', false, 'never', { peerControl: true }),
   // WP-0 (docs/exited-worker-transcript-view-2026-10-17.html §6c): a routed worker's own read-only
   // transcript page. Same posture as its native sibling -- GET, read scope, non-mutation, never
   // step-up. Worker lifecycle (resume/kill/retire) stays on its own stronger rules.
-  regex('GET', /^\/api\/sessions\/[^/]+\/worker-transcript\/messages$/, 'read', false, 'never'),
+  // WP-1 (docs/remote-session-child-transcript-model-truth-and-restart-2026-10-27.html §5 D-2): a
+  // BOX-owned lead's routed-worker transcript is read on the box too, over the same peer bearer.
+  regex('GET', /^\/api\/sessions\/[^/]+\/worker-transcript\/messages$/, 'read', false, 'never', { peerControl: true }),
   regex('POST', /^\/api\/sessions\/[^/]+\/image-drafts$/, 'respond', true, 'remote', { peerControl: true }),
   regex('PUT', /^\/api\/sessions\/[^/]+\/image-drafts\/[^/]+$/, 'respond', true, 'remote', { peerControl: true }),
   regex('DELETE', /^\/api\/sessions\/[^/]+\/image-drafts$/, 'respond', true, 'remote', { peerControl: true }),
@@ -215,6 +237,41 @@ const HTTP_AUTH_RULES = Object.freeze([
   exact('GET', '/api/machines', 'read', false, 'never'),
   exact('POST', '/api/machines', 'admin', true, 'remote'),
   regex('POST', /^\/api\/machines\/[^/]+\/remove$/, 'admin', true, 'remote'),
+  // WP-8 (docs/remote-agent-skills-bundles-2026-10-25.html §5 D-12/D-13, §6.5, AC-8a..AC-8d): the
+  // ONE-SKILL exchange, hub side. Import WRITES into the hub user's own skill root (D-12: an explicit,
+  // reviewed act, with a backup) and retire moves the box's copy aside (D-13) — so both are the same
+  // admin + step-up remote tuple as POST /api/machines, NOT loopbackOnly (a phone reaches a member
+  // through the hub's ?machine= proxy), and NOT peerControl (the peer bearer is for machine-to-machine
+  // calls; these are hub-local user acts — pinning it false is what keeps
+  // tests/peer-control-auth.test.js's exact set honest). The exclude-plugins row edits one hub-side
+  // file's list for this machine, so it carries the same tuple.
+  regex('POST', /^\/api\/machines\/[^/]+\/skills\/(?:import|retire)$/, 'admin', true, 'remote'),
+  regex('PUT', /^\/api\/machines\/[^/]+\/skills\/exclude-plugins$/, 'admin', true, 'remote'),
+  // WP-4 (docs/remote-box-model-access-2026-10-26.html §6.4): the HUB end of "Remove from <box>" —
+  // it deletes rows on ANOTHER machine (which is exactly why the hub must not do it locally), so it
+  // is the same admin + step-up remote tuple as its neighbours and NOT peerControl: the peer bearer
+  // is for machine-to-machine calls, and this is a hub-local user act (the human did the passkey
+  // ceremony on the hub; tests/peer-control-auth.test.js pins the unflagged set). The regex is
+  // byte-identical to lib/api/machines.js's registration.
+  regex('POST', /^\/api\/machines\/[^/]+\/models\/remove$/, 'admin', true, 'remote'),
+  // WP-5 (docs/remote-box-model-access-2026-10-26.html §5.1 R-5/R-6, §6.4): the HUB end of "Use on
+  // <box>" — it moves ONE route's credential to ANOTHER machine, so it is the same admin + step-up
+  // remote tuple as the remove row above and NOT peerControl (the human did the passkey ceremony on
+  // the hub, and the peer bearer is for machine-to-machine calls). The regex is byte-identical to
+  // lib/api/machines.js's registration.
+  regex('POST', /^\/api\/machines\/[^/]+\/models\/copy$/, 'admin', true, 'remote'),
+  // …and the list it is driven by: read-only (nothing is written on either machine, no key is
+  // returned — the hub's own list already strips them), so no ceremony, exactly like the skills
+  // preview row above. Same regex spelling as the registration.
+  regex('GET', /^\/api\/machines\/[^/]+\/models\/copyable$/, 'admin', false, 'never'),
+  // WP-9 (docs/remote-agent-skills-bundles-2026-10-25.html §9 S-9, AC-9b): the REVIEW dialog's diff
+  // source — the box's copy of one skill and the hub's own, read side by side. It WRITES nothing on
+  // either side (mutation false) and needs no ceremony (stepUp 'never'), but it does read both
+  // machines' skill trees into a response the browser renders, so it is not a plain `read` scope: the
+  // same admin shape as its neighbours, minus the step-up. NOT peerControl — the peer bearer is for
+  // machine-to-machine calls, and the dialog is a hub-local user act (tests/peer-control-auth.test.js
+  // pins the unflagged set). The regex is byte-identical to lib/api/machines.js's registration.
+  regex('GET', /^\/api\/machines\/[^/]+\/skills\/preview$/, 'admin', false, 'never'),
   // WP-3 (machine-pool-picker-pairing-dashboard-2026-10-24.html §6.3, D-13, §9 S-16): the MEMBER
   // side of pairing — this machine joins a pool by redeeming the box's code. It mints nothing and
   // reads nothing back, but it adopts a shared secret and rewrites this member's roster, so it is
@@ -233,6 +290,19 @@ const HTTP_AUTH_RULES = Object.freeze([
   // bearer — peerControl: true. Guest/user scope is `read`/never on GET (nothing here is a secret)
   // and admin + step-up remote on POST. lib/api/machine-pool.js refuses a non-peer on the pool rows.
   exact('GET', '/api/machine-self', 'read', false, 'never', { peerControl: true }),
+  // WP-0 (docs/fleet-auto-update-pooled-machines-2026-10-26.html §6, §8 WP-0, §9 S-4): this
+  // machine's own checkout status (channel/branch/clean + the restart guard's blocking count). A hub
+  // reads it to decide whether the box may be updated, so the row must admit the peer bearer —
+  // peerControl: true. Read scope, no step-up, NOT loopbackOnly: the payload is a git branch name and
+  // a count, and the caller is a paired machine. Non-mutating, so no step-up substitution is in play
+  // (nothing here writes).
+  exact('GET', '/api/fleet/status', 'read', false, 'never', { peerControl: true }),
+  // WP-1 (docs/fleet-auto-update-pooled-machines-2026-10-26.html §6, §8 WP-1, §9 S-6): the hub PUSHES
+  // one fast-forward bundle (D-3) for this box to apply (D-4). The most powerful write in the fleet —
+  // it moves a git ref and spawns the detached apply helper — so it is `admin` + step-up 'remote',
+  // exactly like every other peerControl MUTATION row (auth-stepup-matrix.test.js pins that a human
+  // admin still needs a passkey for it); the paired-machine peer bearer is the intended caller.
+  exact('POST', '/api/fleet/bundle', 'admin', true, 'remote', { peerControl: true }),
   exact('POST', '/api/machine-self', 'admin', true, 'remote', { peerControl: true }),
   // WP-2a D-13/S-27: the pool routes. There is no dedicated "peer-only" rule mechanism in this
   // codebase (peerControl ADDS the peer bearer to the row's normal reach), so the roster/rotate rows
@@ -249,6 +319,65 @@ const HTTP_AUTH_RULES = Object.freeze([
   // and the payload is hardware counters, not secrets. peerControl: true is the one reach delta this
   // WP adds (tests/peer-control-auth.test.js pins it).
   exact('GET', '/api/host/stats', 'read', false, 'never', { peerControl: true }),
+  // WP-0 (docs/remote-session-hub-bridge-2026-10-30.html §6.2, §8 WP-0): the BOX-side hub-bridge
+  // lane. The caller is a LOCAL box process (Wall-E / the agent) reaching the box CTM over loopback,
+  // so both rows are `loopbackOnly` and carry NO peerControl — a paired hub must never read this
+  // box's link status or drive the lane through the peer bearer; it already owns the CONTROL socket
+  // this reports. `status` is a read (role + the connected hubs' display names, nothing secret);
+  // `call` is admin + step-up remote like any other privileged local action. Bridge FAILURES are
+  // data with HTTP 200 (lib/api/hub-bridge.js), so the row never has to express them.
+  exact('GET', '/api/hub-bridge/status', 'read', false, 'never', { loopbackOnly: true }),
+  exact('POST', '/api/hub-bridge/call', 'admin', true, 'never', { loopbackOnly: true }),
+  // WP-2 (docs/remote-session-hub-bridge-2026-10-30.html §5 R-4/R-5/R-9/R-11, §6.2, §8 WP-2): the
+  // HUB-side access surface — grants, pending denies, the trust policy and the audit tail.
+  // Every row is a USER-principal act: `admin` + step-up 'remote' and, critically, NO peerControl.
+  // authorize() therefore refuses the box's peer bearer with insufficient_scope (the peer credential
+  // cannot perform the passkey ceremony), which is R-4's whole point: a box agent can never mint
+  // itself a grant, and R-11's policy can never be rewritten by the machine it governs.
+  exact('GET', '/api/hub-bridge/grants', 'admin', false, 'remote'),
+  exact('POST', '/api/hub-bridge/grants', 'admin', true, 'remote'),
+  exact('DELETE', '/api/hub-bridge/grants', 'admin', true, 'remote'),
+  regex('POST', /^\/api\/hub-bridge\/pending\/[^/]+\/deny$/, 'admin', true, 'remote'),
+  exact('GET', '/api/hub-bridge/trust', 'admin', false, 'remote'),
+  exact('PUT', '/api/hub-bridge/trust', 'admin', true, 'remote'),
+  exact('GET', '/api/hub-bridge/audit', 'admin', false, 'remote'),
+  // WP-2 (docs/remote-agent-skills-bundles-2026-10-25.html §5 D-1/D-2/D-5, §6.2, §6.3): the box-side
+  // bundle ingress — the hub pushes its skills to the machine that will run a forwarded session.
+  //   POST /api/agent-bundles/missing          the "what do you already hold" probe
+  //   POST /api/agent-bundles/blobs            a batch of blobs in one request (WP-4/§6.2, D-6)
+  //   PUT  /api/agent-bundles/blobs/<sha256>   one content-addressed blob
+  //   PUT  /api/agent-bundles/manifests/<treeHash>  the tree hash + entry list
+  // All four are machine-to-machine: the caller is the paired hub's peer bearer, and the box keys
+  // every bundle by the AUTHENTICATED peer identity (req.ctmAuth.peerInstanceId), never by a body
+  // field — see lib/api/agent-bundles.js. `admin` + step-up 'remote' is the tuple a human admin token
+  // still needs (they write files outside ~/.claude under the box's data dir), and it is exactly the
+  // posture of the peer-forwarded image-draft PUT rows above; the peer bearer itself is admitted by
+  // the `peerControl` flag, which authorize() evaluates in full WITHOUT the passkey step-up a machine
+  // credential cannot perform (proved through real HTTP in
+  // tests-integration/agent-bundles-route.test.js). Explicit rows are load-bearing: a route with no
+  // rule is 403 auth_rule_missing, so these must land with the registrations in server.js.
+  exact('POST', '/api/agent-bundles/missing', 'admin', true, 'remote', { peerControl: true }),
+  // WP-4 (docs/remote-skills-hub-peer-identity-2026-10-26.html §5 D-6/D-7, §6.2): the batch upload
+  // leg. Same tuple as the per-blob row below — it writes the same store, one blob at a time, so it
+  // is the same risk class, just fewer requests (the peer bucket is per-hub and shared with the live
+  // relay; D-7).
+  exact('POST', '/api/agent-bundles/blobs', 'admin', true, 'remote', { peerControl: true }),
+  regex('PUT', /^\/api\/agent-bundles\/blobs\/[0-9a-f]{64}$/, 'admin', true, 'remote', { peerControl: true }),
+  regex('PUT', /^\/api\/agent-bundles\/manifests\/[^/]+$/, 'admin', true, 'remote', { peerControl: true }),
+  // WP-7 (docs/remote-agent-skills-bundles-2026-10-25.html §5 D-11, §6.2, §9 AC-7a/AC-7d): the
+  // RETURN path of the same exchange — the hub reads what the box already holds so it can classify
+  // it (never copy). A READ: `mutation: false` / step-up 'never' (like the image-draft GET row), but
+  // ADMIN scope rather than `read` — it lists the box user's skill roots, and the box keys the reported
+  // `base` by the AUTHENTICATED caller (req.ctmAuth.peerInstanceId), so nothing but the paired hub's
+  // peer bearer (or a human admin) is meant to reach it.
+  exact('GET', '/api/agent-skills/inventory', 'admin', false, 'never', { peerControl: true }),
+  // WP-8 (§5 D-12/D-13, §6.2): the BOX side of the one-skill exchange. `export` ships one item's
+  // BYTES and `retire` MOVES that item aside on this box — both are machine-to-machine, keyed by
+  // req.ctmAuth.peerInstanceId (lib/api/agent-bundles.js), never by a body field. `export` is a READ
+  // (same tuple as the inventory row above); `retire` MOVES a folder, so it is a mutation the peer
+  // performs without a passkey ceremony (reviewed in tests/auth-stepup-matrix.test.js).
+  exact('GET', '/api/agent-skills/export', 'admin', false, 'never', { peerControl: true }),
+  exact('POST', '/api/agent-skills/retire', 'admin', true, 'remote', { peerControl: true }),
   exact('GET', '/api/setup/network/microsoft-dev-tunnel/probe', 'admin', false, 'never'),
   // Go-Live wizard read view (design doc §Bootstrap & Auth): same posture as
   // GET /api/setup/network — admin scope, no step-up, remote-readable. The
@@ -268,7 +397,9 @@ const HTTP_AUTH_RULES = Object.freeze([
   // unchanged, from anywhere.
   regex('POST', /^\/api\/setup\//, 'admin', true, 'remote', { bootstrapLocal: true }),
 
-  exact('GET', '/api/models/available-agents', 'read', false, 'never'),
+  // WP-13b (deepseek-harness-acp-agent-2026-10-28 D-15): a hub reads its box's agent presence here
+  // (lib/machine-registry.js keeps only the dsh boolean).
+  exact('GET', '/api/models/available-agents', 'read', false, 'never', { peerControl: true }),
   exact('GET', '/api/models/agent-versions', 'read', false, 'never'),
   exact('GET', '/api/models/agent-versions/plan', 'read', false, 'never'),
   exact('GET', '/api/models/agent-versions/upgrade-jobs', 'admin', false, 'never'),
@@ -277,10 +408,41 @@ const HTTP_AUTH_RULES = Object.freeze([
   exact('POST', '/api/models/agent-versions/auto-update', 'admin', false, 'never'),
   exact('POST', '/api/models/agent-versions/check', 'read', false, 'never'),
   exact('POST', '/api/models/agent-versions/upgrade', 'admin', true, 'remote'),
+  // WP-1 (docs/remote-box-model-access-2026-10-26.html §6.1, §5.3 D-2/D-3): the BOX answers what it
+  // can serve, to the paired hub that asks with the peer bearer — a peer READ, copied from the
+  // /api/agent-skills/inventory row's style (admin scope: it enumerates this machine's route rows,
+  // which are configuration, not a browser surface). MUST stay ABOVE the /^\/api\/models/ catch-all
+  // below: `getHttpAuthRule` returns the FIRST match, and the catch-all carries no peerControl.
+  exact('GET', '/api/models/availability', 'admin', false, 'never', { peerControl: true }),
+  // WP-4 (docs/remote-box-model-access-2026-10-26.html §6.4): the BOX end of "Remove from <box>" —
+  // the paired hub asks THIS machine to delete its own route rows. A MUTATION, and the same tuple as
+  // POST /api/agent-skills/retire: admin + step-up remote with peerControl, because the caller is the
+  // hub's peer bearer (the human did the step-up on the hub route; tests/auth-stepup-matrix.test.js's
+  // REVIEWED_PEER_CONTROL_WITHOUT_STEPUP carries the reason). MUST stay ABOVE the /^\/api\/models/
+  // catch-all below for the same first-match reason as the availability row.
+  exact('POST', '/api/models/remove', 'admin', true, 'remote', { peerControl: true }),
+  // WP-5 (docs/remote-box-model-access-2026-10-26.html §5.1 R-5/R-6, §6.4): the BOX end of "Use on
+  // <box>" — the paired hub asks THIS machine to write ONE route the hub holds. Same tuple as the
+  // remove row above and for the same reason: the caller is the hub's peer bearer (the human did the
+  // step-up on the hub route; tests/auth-stepup-matrix.test.js's REVIEWED_PEER_CONTROL_WITHOUT_STEPUP
+  // carries the reason). This is the one peer row whose body carries a credential — ONE route's key,
+  // by the user's explicit click (R-5), never a bulk export (R-6). MUST stay ABOVE the
+  // /^\/api\/models/ catch-all below for the same first-match reason as the rows above it.
+  exact('POST', '/api/models/import', 'admin', true, 'remote', { peerControl: true }),
+  // WP-3 (docs/remote-session-child-transcript-model-truth-and-restart-2026-10-27.html §5 D-4, §8
+  // WP-3): the Delegate pane of a BOX-owned session reads the BOX's own delegate ladder, so the hub
+  // asks that machine over the peer bearer. A plain peer READ — read scope, no mutation, no step-up;
+  // `peerControl: true` is the only addition, exactly like the /api/models/availability row above.
+  // MUST stay ABOVE the /^\/api\/models/ catch-all below: `getHttpAuthRule` returns the FIRST match,
+  // and the catch-all carries no peerControl.
+  exact('GET', '/api/models/delegate-prefs', 'read', false, 'never', { peerControl: true }),
   regex('GET', /^\/api\/models(?:\/|$)/, 'read', false, 'never'),
   // Delegate model prefs (session / per-agent default scope rows): same class as the other model-config writes.
-  exact('PUT', '/api/models/delegate-prefs', 'admin', true, 'remote'),
-  regex('DELETE', /^\/api\/models\/delegate-prefs\/[^/]+$/, 'admin', true, 'remote'),
+  // WP-1 (docs/remote-session-delegate-pick-write-forward-2026-10-30.html D-1/D-2/D-7): the hub
+  // forwards a write for a BOX-owned session to the box that owns it over the peer bearer, exactly
+  // like the read row above; scope/mutation/step-up are unchanged (`peerControl` is the only addition).
+  exact('PUT', '/api/models/delegate-prefs', 'admin', true, 'remote', { peerControl: true }),
+  regex('DELETE', /^\/api\/models\/delegate-prefs\/[^/]+$/, 'admin', true, 'remote', { peerControl: true }),
   exact('PUT', '/api/models/workflows', 'admin', true, 'remote'),
   regex('DELETE', /^\/api\/models\/workflows\/[^/]+$/, 'admin', true, 'remote'),
   exact('POST', '/api/models/workflows/import', 'admin', true, 'remote'),
@@ -310,7 +472,10 @@ const HTTP_AUTH_RULES = Object.freeze([
   exact('GET', '/api/sessions/standup', 'read', false, 'never'),
   exact('GET', '/api/sessions/git-status', 'read', false, 'never'),
   exact('GET', '/api/session/prompts', 'read', false, 'never'),
-  exact('GET', '/api/session/messages', 'read', false, 'never'),
+  // WP-13 (deepseek-harness-acp-agent-2026-10-28 D-25): the hub forwards a box-owned session's Conv
+  // read here (lib/remote-session-forward.js), and with a box selected the Recent review reads it too
+  // (docs/recent-sessions-follow-computer-filter-2026-10-31.html §5 D-6), so the box grants it to the peer bearer.
+  exact('GET', '/api/session/messages', 'read', false, 'never', { peerControl: true }),
   exact('GET', '/api/session/message-content', 'read', false, 'never'),
   exact('GET', '/api/session/runtime-diagnostics', 'read', false, 'never'),
   exact('GET', '/api/diagnostics/client-health/ping', 'read', false, 'never'),
@@ -318,6 +483,9 @@ const HTTP_AUTH_RULES = Object.freeze([
   exact('GET', '/api/diagnostics/lifecycle', 'read', false, 'never'),
   exact('GET', '/api/diagnostics/session-resources', 'read', false, 'never'),
   exact('GET', '/api/diagnostics/uploads', 'read', false, 'never'),
+  // WP-3 (box-idle-sleep-remote-typing-freezes-2026-11-01.html §8 WP-3): the frame-receipt exit
+  // counters readout -- read-only observation, exact same shape as the uploads row above.
+  exact('GET', '/api/diagnostics/receipt-exits', 'read', false, 'never'),
   exact('GET', '/api/diagnostics/submissions', 'read', false, 'never'),
   exact('GET', '/api/diagnostics/perf-summary', 'read', false, 'never'),
   exact('POST', '/api/diagnostics/client-health', 'read', false, 'never'),
@@ -328,10 +496,18 @@ const HTTP_AUTH_RULES = Object.freeze([
   exact('GET', '/api/session/export', 'read', false, 'never'),
   exact('GET', '/api/debug/clients', 'read', false, 'never', { loopbackOnly: true }),
   exact('GET', '/api/session/prompts', 'read', false, 'never'),
-  exact('POST', '/api/session/image-refs', 'respond', true, 'never'),
+  // WP-1 (docs/composer-image-chip-stuck-submission-recovery-2026-10-30.html §5 R-1, §6, §9): the
+  // image-ref recording call is session-scoped in its path and forwarded to the box that owns a
+  // MIRROR session (the draft lives there), so the row gains peerControl. Scope/mutation/step-up are
+  // unchanged — respond + no step-up for every other caller. The singular /api/session/image-refs
+  // row is REMOVED, not aliased; that path now falls to the /api/session/ catch-all below.
+  regex('POST', /^\/api\/sessions\/[^/]+\/image-refs$/, 'respond', true, 'never', { peerControl: true }),
   exact('GET', '/api/sessions/integrity', 'read', false, 'never'),
   exact('GET', '/api/sessions/relink-audit', 'read', false, 'never'),
-  exact('GET', '/api/sessions/search', 'read', false, 'never'),
+  // WP-0 (docs/recent-sessions-follow-computer-filter-2026-10-31.html §5 D-6, §6): with a box
+  // selected the Recent search runs ON that box, over the same peer leg as /api/recent-sessions
+  // above. Flag only — `read`/never is what every other caller already had.
+  exact('GET', '/api/sessions/search', 'read', false, 'never', { peerControl: true }),
   exact('GET', '/api/sessions/search-status', 'read', false, 'never'),
   exact('GET', '/api/sessions/analysis', 'read', false, 'never'),
   exact('GET', '/api/stream/status', 'read', false, 'never'),
@@ -349,20 +525,52 @@ const HTTP_AUTH_RULES = Object.freeze([
   // mirrored box session. Previously had NO rule (loopback-only in practice) — the explicit read row
   // is what makes it reachable for the peer bearer; scope read / no step-up / no mutation.
   regex('GET', /^\/api\/sessions\/[^/]+\/transcripts$/, 'read', false, 'never', { peerControl: true }),
+  // WP-1 (docs/remote-session-history-reads-and-box-status-hooks-2026-10-26.html WP-1 / D-2): the three
+  // terminal-history reads the hub forwards to the box for a BOX-owned (mirror) session — the paged
+  // scrollback archive, the rendered rollout-history window, and the painted-row store. Previously had
+  // NO rule (loopback-only in practice), so a forwarded read died on the box as a bare 403; the explicit
+  // read row is what makes them reachable for the peer bearer. Scope read / no mutation / no step-up,
+  // the §6.2 read class. SINGULAR `/api/session/` — they are registered as
+  // `/^\/api\/session\/([^/]+)\/(scrollback|history-window|painted-rows)$/` in lib/api/sessions.js.
+  regex('GET', /^\/api\/session\/[^/]+\/(?:history-window|scrollback|painted-rows)$/, 'read', false, 'never', { peerControl: true }),
   // Lead-model switch (picker design WP-2): same class as the WS 'model-change' it replaces for
-  // Claude/Codex tabs (admin + step-up); reading the request state is a plain read.
-  regex('POST', /^\/api\/sessions\/[^/]+\/lead-model$/, 'admin', true, 'remote'),
-  regex('GET', /^\/api\/sessions\/[^/]+\/lead-model\/(?:request|options)$/, 'read', false, 'never'),
-  regex('DELETE', /^\/api\/sessions\/[^/]+\/lead-model\/request$/, 'admin', true, 'remote'),
+  // Claude/Codex tabs (admin + step-up); reading the request state is a plain read. WP-2
+  // (docs/remote-box-model-access-2026-10-26.html §6.3, §5.1 R-4): the hub forwards all four
+  // lead-model calls of a MIRROR session to the box that owns it, over the same peer bearer the
+  // lifecycle rows above use — so the three rows gain the flag and keep their scope/mutation/stepUp
+  // exactly as they were.
+  regex('POST', /^\/api\/sessions\/[^/]+\/lead-model$/, 'admin', true, 'remote', { peerControl: true }),
+  regex('GET', /^\/api\/sessions\/[^/]+\/lead-model\/(?:request|options)$/, 'read', false, 'never', { peerControl: true }),
+  regex('DELETE', /^\/api\/sessions\/[^/]+\/lead-model\/request$/, 'admin', true, 'remote', { peerControl: true }),
   regex('POST', /^\/api\/sessions\/[^/]+\/workflow-(?:match|route|outcome)$/, 'respond', true, 'never'),
   exact('POST', '/api/sessions/ai-search', 'read', false, 'never'),
   exact('POST', '/api/sessions/analyze', 'read', false, 'never'),
   exact('POST', '/api/sessions/resume', 'create', true, 'remote'),
+  // WP-2 (docs/external-causality-kill-session-loss-2026-10-27.html §6, §8 WP-2): the dead adopted
+  // host's "Resume N sessions" control. Same class as the resume POST beside it — it starts PTYs.
+  exact('POST', '/api/sessions/resume-deferred', 'create', true, 'remote'),
   exact('POST', '/api/sessions/attach', 'create', true, 'remote'),
   exact('POST', '/api/sessions/repoint', 'admin', true, 'remote'),
-  exact('POST', '/api/sessions/rename', 'respond', true, 'never'),
-  exact('POST', '/api/sessions/workers/retire', 'respond', true, 'never'),
-  regex('POST', /^\/api\/sessions\/[^/]+\/native-subagents\/clear$/, 'respond', true, 'never'),
+  // WP-1 (docs/remote-session-rename-forward-and-empty-rows-2026-10-30.html §5 D-1, §9 S-4): a
+  // BOX-owned session's rename is forwarded to the box's own route on the peer bearer, so the box
+  // row must declare the flag (scope/mutation/step-up unchanged for every other caller).
+  exact('POST', '/api/sessions/rename', 'respond', true, 'never', { peerControl: true }),
+  // WP-1 (docs/remote-session-rename-forward-and-empty-rows-2026-10-30.html §5 D-1, §9 S-4):
+  // POST /api/session/star had NO row and fell to the singular catch-all below
+  // (regex('POST', /^\/api\/session\//, 'admin', true, 'remote')). It is declared explicitly — with
+  // that catch-all's own admin/step-up posture plus the flag — because a BOX-owned session's star is
+  // forwarded to the box's own route on the peer bearer. The catch-all itself stays unflagged.
+  exact('POST', '/api/session/star', 'admin', true, 'remote', { peerControl: true }),
+  // WP-1 (docs/remote-session-child-transcript-model-truth-and-restart-2026-10-27.html §5 D-2/D-3, §8
+  // WP-1/AC-1h, §9 S-6/S-15): the sidebar's "Clear N finished" retires a BOX-owned lead's finished
+  // workers on the box that holds those worker_sessions rows, and the native clear cutoff writes the
+  // box's own runtime. Unlike the per-session forwards above, the retire row is a COLLECTION route
+  // whose ids arrive in the BODY (lib/api/sessions.js forwards it keyed on the parsed body via
+  // remoteMachineCatalog.forwardWorkersRetireRequest) — hence its presence here without a
+  // FORWARDED_SESSION_ROUTES member in lib/remote-session-forward.js. Flag only: scope/mutation/
+  // step-up are unchanged for every other caller.
+  exact('POST', '/api/sessions/workers/retire', 'respond', true, 'never', { peerControl: true }),
+  regex('POST', /^\/api\/sessions\/[^/]+\/native-subagents\/clear$/, 'respond', true, 'never', { peerControl: true }),
   // usage-ledger read model (WP-4 §6d): the session usage page and its raw call page are
   // plain reads of <dataDir>/usage.db. POST /api/usage/backfill starts a local, idempotent
   // re-ingest of transcripts already on this host — it writes only CTM's own usage.db, sends
@@ -393,13 +601,48 @@ const HTTP_AUTH_RULES = Object.freeze([
   exact('POST', '/api/sync/apply', 'sync', true, 'never'),
   exact('POST', '/api/sync/purge', 'sync', true, 'never'),
   exact('POST', '/api/sync/resync', 'sync', true, 'never'),
+  // WP-3 (docs/shared-memory-every-machine-2026-10-31.html §5 D-9/D-12, §6.6): the box-side v2 brain
+  // replica front routes (lib/api/memory-sync-routes.js). The hub dials a member's CTM with the pool
+  // credential (scopes sync + peer-control, lib/auth-context.js) and the member forwards to its own
+  // loopback Wall-E. Scope `sync`, no step-up — the same machine-to-machine class as the /api/sync/*
+  // rows above, and like them NOT peerControl-flagged (sync scope already authorizes the hub). MUST stay ABOVE the /^\/api\/sync\// catch-alls (there is no generic
+  // /api/sync/ catch-all today, but the four literals are declared here, next to their siblings).
+  exact('GET', '/api/sync/brain/v2/vector', 'sync', false, 'never'),
+  exact('POST', '/api/sync/brain/v2/changes', 'sync', true, 'never'),
+  exact('POST', '/api/sync/brain/v2/apply', 'sync', true, 'never'),
+  exact('GET', '/api/sync/brain/v2/digest', 'sync', false, 'never'),
+  // WP-4 (docs/shared-memory-every-machine-2026-10-31.html §5 D-6, §6.7): the JOIN family. The hub
+  // ships its consistent snapshot to a member that has never taken its origin, in 4 MiB chunks the
+  // member CTM assembles on its own disk. Same machine-to-machine class as the four rows above —
+  // scope `sync`, no step-up, NOT peerControl-flagged — so the same pool credential the hub already
+  // dials `/api/sync/brain/v2/*` with carries it. The two POSTs are reviewed in
+  // tests/auth-stepup-matrix.test.js alongside their brain/v2 siblings.
+  exact('POST', '/api/sync/brain/v2/join/chunk', 'sync', true, 'never'),
+  exact('GET', '/api/sync/brain/v2/join/transfer', 'sync', false, 'never'),
+  exact('POST', '/api/sync/brain/v2/join/import', 'sync', true, 'never'),
+  exact('GET', '/api/sync/brain/v2/join/status', 'sync', false, 'never'),
+  // WP-5 (docs/shared-memory-every-machine-2026-10-31.html §5 D-3, §6.8): the conversation-history
+  // feed (lib/api/conversation-sync-routes.js). Unlike the brain/v2 family these are served by CTM
+  // itself — transcription history lives in task-manager.db, so there is no Wall-E hop — but they
+  // are the same machine-to-machine class: scope `sync`, no step-up, NOT peerControl-flagged, so
+  // the pool credential the hub already dials `/api/sync/brain/v2/*` with carries them. The POSTs
+  // are reviewed in tests/auth-stepup-matrix.test.js alongside their brain/v2 siblings.
+  exact('GET', '/api/sync/conversation/v2/vector', 'sync', false, 'never'),
+  exact('POST', '/api/sync/conversation/v2/changes', 'sync', true, 'never'),
+  exact('POST', '/api/sync/conversation/v2/apply', 'sync', true, 'never'),
   regex('POST', /^\/api\/sync\/handoff\/[^/]+\/(?:offer|accept|cancel)$/, 'admin', true, 'remote'),
   exact('POST', '/api/instance/funnel/toggle', 'admin', true, 'remote'),
   regex('POST', /^\/api\/sessions\//, 'admin', true, 'remote'),
   regex('POST', /^\/api\/session\//, 'admin', true, 'remote'),
   exact('DELETE', '/api/session', 'admin', true, 'remote'),
 
-  regex('GET', /^\/api\/ctm\/session-memory\/(?:health|search|context)$/, 'read', false, 'never'),
+  // WP-2 (docs/cross-machine-session-context-2026-10-31.html §6.2, §5 R-8): the hub forwards a
+  // single-session context read (and, in WP-4, a pool search) to the member that OWNS the session,
+  // over the same peer-bearer leg as every row above — so those two GETs admit the peer bearer.
+  // `health` reports THIS machine's own tables and is deliberately NOT flagged: the combined regex
+  // is SPLIT, not widened. Scope/mutation/step-up are unchanged for every other caller.
+  regex('GET', /^\/api\/ctm\/session-memory\/(?:search|context)$/, 'read', false, 'never', { peerControl: true }),
+  exact('GET', '/api/ctm/session-memory/health', 'read', false, 'never'),
   regex('GET', /^\/api\/sessions\/[^/]+\/messages\/range$/, 'read', false, 'never'),
   exact('POST', '/api/ctm/session-memory/context-pack', 'read', false, 'never'),
   // WP-0 conversation change feed (one-transcript-ingestor §6.1): subscriber reads
@@ -456,6 +699,28 @@ const HTTP_AUTH_RULES = Object.freeze([
   regex('POST', /^\/api\/worktrees\//, 'admin', true, 'remote'),
   regex('DELETE', /^\/api\/worktrees\//, 'admin', true, 'remote'),
 
+  // WP-3 (docs/local-landing-queue-multi-session-integration-2026-10-26.html §6.3/§8 WP-3): the
+  // landing-queue surface. All three rows are LOOPBACK-ONLY, deliberately — the landing queue is
+  // per-repository state on THIS host reachable only by a local child process (`bin/land.js`), so
+  // there is no remote or hub leg to serve, and `{ loopbackOnly: true }` is the strictest posture
+  // available (authorize() answers 403 `loopback_only` for every non-loopback caller regardless of
+  // scope). Reading the queue is a plain read; `run` starts the local runner and `submit` enqueues
+  // this session's branch, so both are `write`. Step-up is unreachable on a loopback caller
+  // (authorize() only demands it for non-loopback requests), so 'never' is the honest column.
+  exact('GET', '/api/landing/status', 'read', false, 'never', { loopbackOnly: true }),
+  exact('POST', '/api/landing/run', 'write', false, 'never', { loopbackOnly: true }),
+  exact('POST', '/api/landing/submit', 'write', false, 'never', { loopbackOnly: true }),
+
+  // WP-4 (docs/fleet-session-lists-hub-search-2026-11-01.html §6.3, §9 S-13/S-14/S-15): the PE
+  // "Search conversations" list and its single-conversation view are read on the BOX that owns the
+  // rows, over the same `?machine=` + peer-bearer leg as /api/recent-sessions (:471) and
+  // /api/sessions/search (:510) — hence `peerControl: true` and nothing else: scope/step-up are
+  // exactly what the broad `/api/conversations` read regex below gives every other caller. Declared
+  // here, BEFORE that regex, so the peer flag is on the row the matcher returns first. The `:id`
+  // shape is the spelling api-prompts.js matches (`/^\/api\/conversations\/[a-f0-9-]+$/`).
+  exact('GET', '/api/conversations', 'read', false, 'never', { peerControl: true }),
+  regex('GET', /^\/api\/conversations\/[a-f0-9-]+$/, 'read', false, 'never', { peerControl: true }),
+
   regex('GET', /^\/api\/(?:prompts?|folders|images|chains|permissions|conversations|templates|session-prompts|settings|hotkey|backups|tool-permissions|auto-approvals|approval-rules|approval-decisions|approval-escalations|approval\/blocklist|hooks\/status|queues|queue-linked-prompts|queue-draft|harvest|autocomplete|palette|ghost-complete|similar|patterns|copilot|prompt-quality|prompt-executions|prompt-execution-(?:pairs|sessions)|frequent-questions|session-trajectory|skills\/(?:autocomplete|resolve-intent))(?:\/|$)/, 'read', false, 'never'),
   exact('GET', '/api/runtime/approvals', 'read', false, 'never'),
   exact('GET', '/api/runtime/registry', 'read', false, 'never'),
@@ -495,6 +760,10 @@ const HTTP_AUTH_RULES = Object.freeze([
   regex('DELETE', /^\/api\/feedback(?:\/|$)/, 'admin', true, 'remote'),
 
   exact('GET', '/api/storage/conversation-migration/status', 'read', false, 'never'),
+  // Backup retention setting (docs/backup-retention-days-setting-2026-10-31.html §6): reading the
+  // window is a read; changing it alters what the next backup deletes, so it is an admin write.
+  exact('GET', '/api/storage/backup-retention', 'read', false, 'never'),
+  exact('PUT', '/api/storage/backup-retention', 'admin', true, 'remote'),
   exact('GET', '/api/wall-e/memories/search', 'read', false, 'never'),
   exact('GET', '/api/wall-e/prompt-purge/legacy-migration', 'admin', false, 'remote'),
   exact('POST', '/api/wall-e/prompt-purge/legacy-migration-intents', 'admin', true, 'remote'),
@@ -534,8 +803,10 @@ function rule(scope, mutation, stepUp, extra = {}) {
 // distinct flag rather than a scope union so `scope` (and everything that reads it — the
 // step-up matrix, the owner manifest, /api/auth/rules consumers) keeps its existing meaning;
 // authorize() consults the flag directly.
-function peerControl(scope, mutation, stepUp) {
-  return rule(scope, mutation, stepUp, { peerControl: true });
+// WP-1 (§9 S-4): `extra` passes through so a peer-control row can carry the same additive flags
+// (`rateKind`) an ordinary `rule(...)` row can, without a second constructor.
+function peerControl(scope, mutation, stepUp, extra = {}) {
+  return rule(scope, mutation, stepUp, { ...extra, peerControl: true });
 }
 
 function exact(method, path, scope, mutation, stepUp, extra = {}) {