create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/model-execution-recipe-metadata.js

@@ -1,5 +1,8 @@
 'use strict';
 
+// D-2 (docs/lead-model-id-rule-at-tilde-prefix-2026-10-28.html): a routed wire model id obeys the ONE
+// model-id rule; a stricter copy here silently dropped the recipe of a `~vendor/x-latest` lead.
+const { isValidOverrideModel } = require('./model-id-rule');
 const RECIPE_ENV_KEY = 'CTM_MODEL_EXECUTION_RECIPE';
 const MAX_RECIPE_BYTES = 4096;
 const RECIPE_KEYS = Object.freeze([
@@ -12,7 +15,6 @@ const RECIPE_KEYS = Object.freeze([
 const OPTIONAL_RECIPE_KEYS = Object.freeze(['sourceEnvironmentReference', 'nativeConfigReceipt']);
 const SOURCE_ENVIRONMENT_REFERENCES = new Set(['captured-empty', 'private-owner-required']);
 const ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
-const CANONICAL_MODEL_ID_PATTERN = /^[A-Za-z0-9@][A-Za-z0-9@._:/+-]{0,255}$/;
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const SHA256_PATTERN = /^[0-9a-f]{64}$/;
 
@@ -28,10 +30,6 @@ function boundedId(value) {
   return typeof value === 'string' && ID_PATTERN.test(value);
 }
 
-function boundedCanonicalModelId(value) {
-  return typeof value === 'string' && CANONICAL_MODEL_ID_PATTERN.test(value);
-}
-
 function validThreadId(value) {
   return value === null || (typeof value === 'string' && Buffer.byteLength(value, 'utf8') <= 256
     && (UUID_PATTERN.test(value) || /^[A-Za-z0-9][A-Za-z0-9._:/+-]{0,255}$/.test(value)));
@@ -57,7 +55,7 @@ function sanitizedRecipe(value, minimumGeneration = 1) {
   const native = value.routeId === null;
   if (native) {
     if (value.wireModelId !== null || value.profileFingerprint !== null || value.factsRevision !== null) return undefined;
-  } else if (!boundedId(value.routeId) || !boundedCanonicalModelId(value.wireModelId)
+  } else if (!boundedId(value.routeId) || !isValidOverrideModel(value.wireModelId)
     || typeof value.profileFingerprint !== 'string' || !SHA256_PATTERN.test(value.profileFingerprint)
     || typeof value.factsRevision !== 'string' || !SHA256_PATTERN.test(value.factsRevision)) return undefined;
 

package/template/coding-task-manager/lib/model-host-receipt.js

@@ -1,16 +1,19 @@
 'use strict';
 
-const { modelProcessGenerationMetadata, modelStorageRootsMetadata } = require('./host-handoff');
+const { modelProcessGenerationMetadata, modelStorageRootsMetadata, launchEnvironmentMetadata } = require('./host-handoff');
 const { modelExecutionRecipeMetadata } = require('./model-execution-recipe-metadata');
 
-function applyModelHostReceipt(target, { sessionId, modelProcessGeneration, modelStorageRoots, modelExecutionRecipe } = {}) {
+function applyModelHostReceipt(target, { sessionId, modelProcessGeneration, modelStorageRoots, modelExecutionRecipe, launchEnvironment } = {}) {
   if (!target || typeof target !== 'object') throw new TypeError('model host receipt target is required');
   delete target.modelExecutionRecipe;
   delete target._modelExecutionRecipe;
+  // WP-1 (S-12): a receipt without a valid record clears any stale one -- a host reply is authoritative.
+  delete target.launchEnvironment;
   Object.assign(target,
     modelProcessGenerationMetadata(modelProcessGeneration),
     modelStorageRootsMetadata(modelStorageRoots),
-    modelExecutionRecipeMetadata(modelExecutionRecipe, { sessionId, processGeneration: modelProcessGeneration }));
+    modelExecutionRecipeMetadata(modelExecutionRecipe, { sessionId, processGeneration: modelProcessGeneration }),
+    launchEnvironmentMetadata(launchEnvironment));
   return target;
 }
 

package/template/coding-task-manager/lib/model-id-rule.js

@@ -0,0 +1,19 @@
+'use strict';
+
+// The ONE model-id rule (docs/lead-model-id-rule-at-tilde-prefix-2026-10-28.html D-1/D-2). A model id
+// rides argv as the operand of --model / -m, so the only argv hazard is a value the CLI would parse as
+// an option: a leading '-' (CWE-88). The first character is a letter, a digit, '@' (Portkey model
+// catalog: @slug/model) or '~' (OpenRouter latest alias: ~vendor/x-latest), never '-'. The agent is
+// spawned with an argv array and no shell, so '~' is never tilde-expanded.
+//
+// A leaf module that requires nothing: the session host validates recipes with it, and its closure is
+// bounded (tests-integration/host-socket-protocol.test.js), so it must not drag in launch-model-override's
+// Claude argv helpers.
+const MODEL_ID_RE = /^[A-Za-z0-9@~][A-Za-z0-9._:/@+~\-[\]]*$/;
+const MAX_MODEL_ID_LENGTH = 200;
+
+function isValidOverrideModel(model) {
+  return typeof model === 'string' && model.length > 0 && model.length <= MAX_MODEL_ID_LENGTH && MODEL_ID_RE.test(model);
+}
+
+module.exports = { isValidOverrideModel };

package/template/coding-task-manager/lib/model-proxy/anthropic-face.js

@@ -96,6 +96,10 @@ function anthropicErrorType(kind) {
   // must not collapse into api_error -- a permission denial is not an upstream fault.
   if (kind === 'model_not_invocable') return 'invalid_request_error';
   if (kind === 'model_access_denied') return 'permission_error';
+  // WP-1b (§12a rule 2): `model_not_found` split out of `invalid_prompt`, and the HTTP status is
+  // still the upstream one (404), so the client-visible envelope must be the one `invalid_prompt`
+  // produced for that status -- type `invalid_request_error`, status 404.
+  if (kind === 'model_not_found') return 'invalid_request_error';
   return 'api_error';
 }
 

package/template/coding-task-manager/lib/model-proxy/auto-mode-review.js

@@ -4,12 +4,17 @@
 // the two protocol-boundary decisions the installed Claude client's server-side
 // auto-mode review needs, kept as one cohesive, side-effect-free leaf.
 //
-//  * The client sends an own top-level `safeguards` field and, when a gateway
-//    answers 400 with a message naming safeguards, retries through its own billed
-//    client-side classifier. A route CTM is translating to a chat wire cannot
-//    carry that field, so it negotiates honestly (D-2) instead of silently
-//    dropping it and letting the request reach an upstream that cannot run the
-//    review. Native (passthrough) routes keep the original request untouched.
+//  * The client asks for server-side review with an own top-level `safeguards`
+//    field and/or a `dangerous-tool-use-` beta token. A route CTM is translating
+//    to a chat wire cannot carry that, so it negotiates honestly (D-2) instead of
+//    silently dropping it and letting the request reach an upstream that cannot run
+//    the review. The wording of that 400 is MEASURED (Claude Code 2.1.314,
+//    docs/auto-mode-native-lead-subagent-latch-2026-10-30.html §1.2): a message
+//    NAMING safeguards/dangerous-tool-use makes the client latch server review OFF
+//    for its whole SESSION (a subagent refusal poisons the lead process), while the
+//    registry's wording (lib/model-proxy/refusal-scope.js) is scoped to that one
+//    CONVERSATION. Never name those tokens here -- see refusal-scope.js and the doc.
+//    Native (passthrough) routes keep the original request untouched.
 //  * A caller-provided `anthropic-beta` and the route's configured `anthropic-beta`
 //    must be UNIONED, never replaced (D-5): a configured route could otherwise
 //    overwrite the client's dangerous-tool-use / future extension tokens.
@@ -29,9 +34,15 @@
 //    is checked BEFORE a chunk is retained. A chunk that does not fit is never held and
 //    immediately drops everything already held, so a crossing chunk can never be parsed
 //    and the observation stays "unobserved" instead of turning into a false negative.
+//
+// WP-0 (docs/auto-mode-native-lead-subagent-latch-2026-10-30.html §8) adds the REQUEST-side half of the
+// same line: `class=` (what kind of Claude Code request this was, read from the client's own headers, so
+// a lead that keeps sending subagent-class requests is visible) and the three fields later WPs fill
+// (`review=`, `refusal=`, `scope=`). It also names the native-lead lane (`path=native-lead`) and the one
+// predicate deciding whether a request asked for the server-side review at all (`serverReviewAsked`).
+
+const { refusalEntry, refusalResponse } = require('./refusal-scope');
 
-const SAFEGUARDS_UNSUPPORTED_MESSAGE =
-  'safeguards: server-side auto-mode review is unsupported by this translated route; use the client-side classifier.';
 const BETA_HEADER = 'anthropic-beta';
 
 function _isPlainObject(value) {
@@ -54,20 +65,18 @@ function reviewRequested(body) {
 /**
  * The honest negotiation for a translated route: `mode` is the transport
  * routes.selectUpstream already selected for this exact request, so only
- * 'chat-translate' (the mode that cannot represent the field) refuses.
+ * 'chat-translate' (the mode that cannot represent the field) refuses. The
+ * wording is the registry's conversation-scoped refusal (refusal-scope.js),
+ * never a literal here -- a 400 that names the review tokens makes the client
+ * latch server review off for its whole session (§1.2).
  * @param {unknown} body
  * @param {string|null|undefined} mode
+ * @param {unknown} headers
  * @returns {{status:number, body:{type:string, error:{type:string, message:string}}}|null}
  */
-function unsupportedSafeguards(body, mode) {
-  if (mode !== 'chat-translate' || !reviewRequested(body)) return null;
-  return {
-    status: 400,
-    body: {
-      type: 'error',
-      error: { type: 'invalid_request_error', message: SAFEGUARDS_UNSUPPORTED_MESSAGE },
-    },
-  };
+function unsupportedSafeguards(body, mode, headers) {
+  if (mode !== 'chat-translate' || !serverReviewAsked(body, headers)) return null;
+  return refusalResponse(refusalEntry('claude-code', 'server-review'));
 }
 
 // One header map contributes only its `anthropic-beta` values (any spelling),
@@ -88,6 +97,49 @@ function _betaTokens(source) {
   return tokens;
 }
 
+// One header value by case-insensitive name, or `undefined`. Node lower-cases incoming header names,
+// but a caller-built map may spell them any way, so the lookup never relies on that.
+function _headerValue(source, name) {
+  if (!_isPlainObject(source)) return undefined;
+  for (const [key, value] of Object.entries(source)) {
+    if (key.toLowerCase() === name) return value;
+  }
+  return undefined;
+}
+
+/**
+ * The request class the CLIENT stated for itself, read only from the two headers Claude Code sets:
+ * `x-claude-code-request-class` (present only when the gateway hint headers are on) and
+ * `x-claude-code-agent-id` (always non-empty on a subagent request).
+ *
+ * Closed by construction: the stated class is returned only when it is EXACTLY a member of
+ * REQUEST_CLASSES, an agent-id-bearing request with no valid stated class is 'subagent', and anything
+ * else -- an unrecognized class, a whitespace-only agent id, a non-object header map -- is 'unknown'.
+ * No caller-supplied string is ever returned or interpolated.
+ * @param {unknown} headers
+ * @returns {string} one of REQUEST_CLASSES, or 'unknown'
+ */
+function requestClassFromHeaders(headers) {
+  const stated = _headerValue(headers, REQUEST_CLASS_HEADER);
+  if (_label(stated, REQUEST_CLASSES, null) !== null) return stated;
+  const agentId = _headerValue(headers, AGENT_ID_HEADER);
+  if (typeof agentId === 'string' && agentId.trim() !== '') return REQUEST_CLASS_SUBAGENT;
+  return REVIEW_LABEL_UNKNOWN;
+}
+
+/**
+ * Did this very request ask for the SERVER-SIDE review? Two client-side spellings mean the same thing
+ * and both are answered from this one predicate: the own top-level `safeguards` field (`reviewRequested`)
+ * and an `anthropic-beta` token in the `dangerous-tool-use-` family (`_betaTokens`). The nested,
+ * unrelated uses of the word -- a tool result, a message content block -- are not this feature.
+ * @param {unknown} body
+ * @param {unknown} headers
+ * @returns {boolean}
+ */
+function serverReviewAsked(body, headers) {
+  return reviewRequested(body) || _betaTokens(headers).some((token) => token.startsWith(DANGEROUS_TOOL_USE_BETA_PREFIX));
+}
+
 /**
  * Union the beta tokens of every source map, in CALL ORDER, then keep any beta token the
  * destination already carries that no source named (appended last, so an unnamed caller's
@@ -129,10 +181,24 @@ function mergeAnthropicBetas(headers, ...sources) {
 // The observation vocabulary is CLOSED. Every value below is normalized through these
 // lists before it can reach the log line, so an unknown/fallback/hostile value degrades to
 // a fixed label instead of being interpolated.
-const REVIEW_PATH_KINDS = ['legacy', 'routed'];
+const REVIEW_PATH_KINDS = ['legacy', 'routed', 'native-lead'];
 const REVIEW_TRANSPORTS = ['native', 'translated'];
 const REVIEW_RESULTS = ['present', 'absent', 'unobserved', 'unsupported'];
 const REVIEW_COMPLETIONS = ['complete', 'incomplete', 'unobserved'];
+// WP-0 (docs/auto-mode-native-lead-subagent-latch-2026-10-30.html §8): the REQUEST-SIDE labels. A
+// request class is what the Claude client itself stated (its own `x-claude-code-request-class`
+// header, sent only when the gateway hint headers are on), never something inferred from a body; an
+// agent-id-bearing request with no stated class is a subagent, and everything else is `unknown`.
+const REQUEST_CLASSES = ['main', 'subagent', 'workflow', 'compaction', 'auxiliary', 'side_reply'];
+const REQUEST_CLASS_SUBAGENT = 'subagent';
+const REQUEST_CLASS_HEADER = 'x-claude-code-request-class';
+const AGENT_ID_HEADER = 'x-claude-code-agent-id';
+// The prefix of the `anthropic-beta` token the client sends when it wants the server-side review on
+// its own request (the same capability the own top-level `safeguards` field asks for).
+const DANGEROUS_TOOL_USE_BETA_PREFIX = 'dangerous-tool-use-';
+const REVIEW_DECISIONS = ['requested', 'not_requested'];
+const REVIEW_REFUSALS = ['conversation', 'none'];
+const REVIEW_SCOPES = ['verified', 'unverified', 'unknown', 'none'];
 const REVIEW_LABEL_UNKNOWN = 'unknown';
 const REVIEW_LABEL_UNOBSERVED = 'unobserved';
 // Same bound as the routed native usage side copy (§6, anthropic-face.js): one
@@ -165,15 +231,34 @@ function _boundedStatus(status) {
  * A result is only ever present/absent together with completion=complete: the two axes are
  * one claim about the observation, never a claim about a tool decision or a billing effect.
  *
- * @param {{pathKind?:string,transport?:string,status?:number,results?:string,completion?:string}} fields
+ * The four REQUEST-side labels append after `completion=`, always, in this fixed order:
+ *
+ *   class     the client's own stated request class (see requestClassFromHeaders); 'unknown' when it
+ *             stated none, or stated one outside the closed set
+ *   review    'requested' the request itself asked for the server-side review (own `safeguards`
+ *             field, or a `dangerous-tool-use-` beta token); 'not_requested' otherwise. The default
+ *             is 'requested', so a caller that reports a review cycle without saying cannot
+ *             under-report one.
+ *   refusal   'conversation' a conversation-scoped refusal was applied; 'none' otherwise
+ *   scope     'verified' | 'unverified' | 'unknown' | 'none' -- the scope a later WP fills
+ *
+ * Like every other field these are normalized through closed lists: a caller-supplied string is never
+ * echoed, only ever replaced by the documented default.
+ *
+ * @param {{pathKind?:string,transport?:string,status?:number,results?:string,completion?:string,
+ *   requestClass?:string,review?:string,refusal?:string,scope?:string}} fields
  * @returns {string} a string built only from the fixed labels above
  */
-function reviewDiagnostic({ pathKind, transport, status, results, completion } = {}) {
+function reviewDiagnostic({ pathKind, transport, status, results, completion, requestClass, review, refusal, scope } = {}) {
   return `[model-proxy] auto_review path=${_label(pathKind, REVIEW_PATH_KINDS, REVIEW_LABEL_UNKNOWN)}`
     + ` transport=${_label(transport, REVIEW_TRANSPORTS, REVIEW_LABEL_UNKNOWN)}`
     + ` status=${_boundedStatus(status)}`
     + ` results=${_label(results, REVIEW_RESULTS, REVIEW_LABEL_UNOBSERVED)}`
-    + ` completion=${_label(completion, REVIEW_COMPLETIONS, REVIEW_LABEL_UNOBSERVED)}`;
+    + ` completion=${_label(completion, REVIEW_COMPLETIONS, REVIEW_LABEL_UNOBSERVED)}`
+    + ` class=${_label(requestClass, REQUEST_CLASSES, REVIEW_LABEL_UNKNOWN)}`
+    + ` review=${_label(review, REVIEW_DECISIONS, 'requested')}`
+    + ` refusal=${_label(refusal, REVIEW_REFUSALS, 'none')}`
+    + ` scope=${_label(scope, REVIEW_SCOPES, 'none')}`;
 }
 
 /**
@@ -332,8 +417,10 @@ function trackDownstreamClose(req, res) {
 }
 
 module.exports = {
-  SAFEGUARDS_UNSUPPORTED_MESSAGE,
   reviewRequested,
+  serverReviewAsked,
+  requestClassFromHeaders,
+  REQUEST_CLASSES,
   unsupportedSafeguards,
   mergeAnthropicBetas,
   MAX_OBSERVED_JSON_BYTES,

package/template/coding-task-manager/lib/model-proxy/chat-response-translators.js

@@ -23,6 +23,9 @@ function createChatResponseTranslators({ normalizeUpstreamOutcome, firstString,
     // WP-2 D-5: same two mappings as anthropic-face.js (HTTP 400 / 403 respectively).
     if (kind === 'model_not_invocable') return 'invalid_request_error';
     if (kind === 'model_access_denied') return 'permission_error';
+    // WP-1b (§12a rule 2): `model_not_found` maps exactly as `invalid_prompt` did, so a client that
+    // saw `invalid_request_error` on an upstream 404 still sees it.
+    if (kind === 'model_not_found') return 'invalid_request_error';
     return 'api_error';
   }
 

package/template/coding-task-manager/lib/model-proxy/generation-probe.js

@@ -2,13 +2,35 @@
 
 const upstreamHttp = require('./upstream-http');
 const { classifyFailure } = require('../worker-failure-classify');
+// WP-1b (docs/lead-route-model-invocability-preflight-2026-10-28.html §12a rule 1): a probe that
+// names the wire by its own preference can contradict the wire the CALLER's harness will actually
+// use (`selectUpstream(route, face, model)`), so a face-carrying probe asks the route table the
+// same question the live request path does. `./routes` requires nothing from this module, so this
+// stays a one-way edge.
+const { selectUpstream } = require('./routes');
+// WP-1 (docs/lead-route-model-invocability-preflight-2026-10-28.html §6.1): the probe's own
+// verdict has to speak the proxy's classification, because that is the vocabulary that names a
+// route/model pair as unable to run (`model_not_invocable` / `model_access_denied`). The worker
+// taxonomy (`classifyFailure` above) is kept as-is for its existing consumers.
+const { normalizeUpstreamOutcome } = require('./upstream-outcome');
 
 const DEFAULT_TIMEOUT_MS = 30_000;
 const MAX_TIMEOUT_MS = 30_000;
 const MAX_RESPONSE_BYTES = 64 * 1024;
 const PROBE_PROMPT = 'Reply OK.';
 
-function _wireFor(route) {
+// The two lead faces (§12a rule 1). Any other value, `undefined` included, keeps the legacy
+// preference order below, so every existing caller dials exactly what it dials today.
+const FACED_WIRES = new Set(['anthropic', 'responses']);
+
+function _wireFor(route, face, model) {
+  if (FACED_WIRES.has(face)) {
+    // The face's own wire, chosen by the SAME function the request path uses. A route that cannot
+    // serve this face at all answers null, which the caller turns into `probe_unsupported_wire`
+    // (http_status null) rather than guessing at another wire.
+    const upstream = selectUpstream(route, face, String(model).trim());
+    return upstream && upstream.api ? upstream.api : null;
+  }
   const apis = route && route.upstreamApis || [];
   if (apis.includes('openai-chat')) return 'openai-chat';
   if (apis.includes('anthropic-messages')) return 'anthropic-messages';
@@ -36,15 +58,32 @@ function _validResponse(wire, value) {
   return false;
 }
 
-function _failure(status, observedText, fallbackCode = 'probe_failed', now = Date.now) {
-  const classified = classifyFailure({ http_status: status, message: observedText, now });
+// The proxy's own classification for one probe response, reduced to the four fields a caller may
+// act on. Provider prose (`message`/`error`) is deliberately NOT copied: `normalizeUpstreamOutcome`
+// already redacts it, and this narrowing keeps that guarantee at the seam.
+function _outcomeOf(status, value) {
+  const outcome = normalizeUpstreamOutcome({ body: value == null ? null : value, status });
   return {
+    kind: outcome.kind,
+    upstreamStatus: outcome.upstreamStatus,
+    upstreamCode: outcome.upstreamCode,
+    retryable: outcome.retryable,
+  };
+}
+
+function _failure(status, observedText, fallbackCode = 'probe_failed', now = Date.now, value = null) {
+  const classified = classifyFailure({ http_status: status, message: observedText, now });
+  const failure = {
     class: classified.class,
     code: classified.code || fallbackCode,
     http_status: status == null ? null : status,
     retry_after_ms: classified.retry_after_ms,
     message: 'Generation probe failed',
   };
+  // A failure with an actual HTTP response carries the proxy's classification of it. A transport,
+  // timeout or unknown-wire failure (`http_status: null`) has no upstream outcome at all.
+  if (Number.isInteger(status)) failure.upstream_outcome = _outcomeOf(status, value);
+  return failure;
 }
 
 async function _readBodyBufferBounded(readable) {
@@ -75,10 +114,14 @@ function _requestFor(wire, model) {
   return { suffix: '/responses', body: { model, input: PROBE_PROMPT, max_output_tokens: 16, stream: false } };
 }
 
-async function probeGeneration(route, { model, timeoutMs = DEFAULT_TIMEOUT_MS, now = Date.now } = {}) {
-  const wire = _wireFor(route);
+async function probeGeneration(route, { model, timeoutMs = DEFAULT_TIMEOUT_MS, now = Date.now, face } = {}) {
+  const wire = _wireFor(route, face, model);
+  // Rule 4 needs both facts on EVERY result, success or failure: which wire this verdict is about,
+  // and how many wires the route offers (a verdict is only reportable when the route offers one).
+  const routeWireCount = route && Array.isArray(route.upstreamApis) ? route.upstreamApis.length : 0;
+  const withWire = (result) => ({ ...result, probe_wire: wire, route_wire_count: routeWireCount });
   if (!wire) {
-    return {
+    return withWire({
       generation_succeeded: false,
       http_status: null,
       failure: {
@@ -88,7 +131,7 @@ async function probeGeneration(route, { model, timeoutMs = DEFAULT_TIMEOUT_MS, n
         retry_after_ms: null,
         message: 'Generation probe failed',
       },
-    };
+    });
   }
   const timeout = Math.max(1, Math.min(Number(timeoutMs) || DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS));
   const request = _requestFor(wire, String(model).trim());
@@ -108,11 +151,11 @@ async function probeGeneration(route, { model, timeoutMs = DEFAULT_TIMEOUT_MS, n
       caPem: route.caPem,
     });
   } catch {
-    return {
+    return withWire({
       generation_succeeded: false,
       http_status: null,
       failure: _failure(null, '', 'probe_failed', now),
-    };
+    });
   }
 
   let raw;
@@ -120,11 +163,11 @@ async function probeGeneration(route, { model, timeoutMs = DEFAULT_TIMEOUT_MS, n
     raw = (await _readBodyBufferBounded(resp.body)).toString('utf8');
   } catch (err) {
     const tooLarge = err && err.code === 'probe_response_too_large';
-    return {
+    return withWire({
       generation_succeeded: false,
       http_status: resp.status,
       failure: _failure(resp.status, '', tooLarge ? 'probe_response_too_large' : 'probe_failed', now),
-    };
+    });
   }
   try {
     let value = null;
@@ -133,19 +176,19 @@ async function probeGeneration(route, { model, timeoutMs = DEFAULT_TIMEOUT_MS, n
     if (okStatus && _validResponse(wire, value)) {
       const result = { generation_succeeded: true, http_status: resp.status };
       if (typeof value.model === 'string' && value.model) result.upstream_model = value.model;
-      return result;
+      return withWire(result);
     }
-    return {
+    return withWire({
       generation_succeeded: false,
       http_status: resp.status,
-      failure: _failure(resp.status, raw, okStatus ? 'probe_invalid_response' : 'probe_failed', now),
-    };
+      failure: _failure(resp.status, raw, okStatus ? 'probe_invalid_response' : 'probe_failed', now, value),
+    });
   } catch {
-    return {
+    return withWire({
       generation_succeeded: false,
       http_status: null,
       failure: _failure(null, '', 'probe_failed', now),
-    };
+    });
   }
 }
 

package/template/coding-task-manager/lib/model-proxy/historical-tool-declarations.js

@@ -0,0 +1,37 @@
+'use strict';
+
+const CODEX_HISTORICAL_TOOLS_FILTER_RECEIPT = 'ctm-proxy-historical-tools-v1';
+
+function normalizeHistoricalAdditionalTools(body, { trustedRoutedCodexLead = false } = {}) {
+  if (!trustedRoutedCodexLead || !Array.isArray(body?.tools) || !Array.isArray(body?.input)) {
+    return { ok: true, body, removedCount: 0 };
+  }
+
+  let removedCount = 0;
+  const input = [];
+  for (const item of body.input) {
+    if (!item || typeof item !== 'object' || !Object.hasOwn(item, 'type') || item.type !== 'additional_tools') {
+      input.push(item);
+      continue;
+    }
+
+    const keys = Reflect.ownKeys(item);
+    const allowed = new Set(['type', 'role', 'tools', 'id']);
+    if (keys.some((key) => typeof key !== 'string' || !allowed.has(key)) ||
+        !Object.hasOwn(item, 'role') || !Object.hasOwn(item, 'tools') ||
+        item.role !== 'developer' || !Array.isArray(item.tools) ||
+        (Object.hasOwn(item, 'id') && item.id !== null &&
+          (typeof item.id !== 'string' || item.id.length === 0))) {
+      return { ok: false, reason: 'historical_tool_declaration_invalid' };
+    }
+    removedCount += 1;
+  }
+
+  if (removedCount === 0) return { ok: true, body, removedCount: 0 };
+  return { ok: true, body: { ...body, input }, removedCount };
+}
+
+module.exports = {
+  CODEX_HISTORICAL_TOOLS_FILTER_RECEIPT,
+  normalizeHistoricalAdditionalTools,
+};

package/template/coding-task-manager/lib/model-proxy/lead-request-validation.js

@@ -28,6 +28,7 @@ const SAFE_LEAD_REFUSAL_REASONS = Object.freeze([
   'forged_identity_fields',
   'primary_binding_mismatch',
   'unsupported_token_purpose',
+  'historical_tool_declaration_invalid',
 ]);
 const _SAFE_REASONS = new Set(SAFE_LEAD_REFUSAL_REASONS);
 

package/template/coding-task-manager/lib/model-proxy/lead-token-admin.js

@@ -0,0 +1,130 @@
+'use strict';
+
+// WP-1 §6.4/§6.5 registration lifecycle, extracted out of oauth-proxy.js (review item 3): the one
+// bounded transaction that answers `POST /_admin/tokens` with kind:'lead'. The refusal paths, the
+// registry-owned ticket, the abort window and the 409 codes below are the ones oauth-proxy.js has
+// always run, moved verbatim -- the transaction stays whole instead of being spread across the
+// request dispatcher.
+//
+// The seam this cluster needs from its host is the lead-token registry in ./tokens
+// (registerLeadToken, beginLeadTokenRegistration, LEAD_TOKEN_REVOKED_CODE, NATIVE_TRANSPORT_MTLS) and
+// nothing else: the response `res`, the parsed `registration` and the per-instance `ctx` carrying
+// this server's OWN native listener are all passed IN by the caller, so this module never requires
+// oauth-proxy.js back -- there is no cycle.
+
+const tokens = require('./tokens');
+
+// ── WP-1 §6.4/§6.5: the TLS-ready acknowledgment of an mtls-v1 registration ─────────────────────
+//
+// A legacy (or routed-primary) registration is unchanged: it is synchronous, creates no listener and
+// never loads the CA. An `mtls-v1` registration is the one thing that starts this transport, and it is
+// acknowledged ONLY once BOTH of these are true:
+//
+//   1. the strict HTTPS listener is bound and ready, and
+//   2. the pending registration has committed against the live registry.
+//
+// The order matters, and so does the ticket. Between "the registration is well formed" and "the
+// listener is ready" the caller is awaiting, which is exactly when a `DELETE /_admin/tokens` can land:
+// a plain revalidation would still see the token as absent (it was never live) and commit a grant the
+// caller already gave up on. The registry-owned ticket fences that operation, so commit refuses with a
+// bounded code and no token is created. A failed bind cancels the ticket and leaves no grant either.
+//
+// Review item 3 adds the OTHER half of that window: the caller can also simply GO AWAY. The supervisor's
+// admin fetch has a 2s budget, and the child's TLS bind can outlive it — so an interrupted registration
+// must not leave a live owner behind that the parent never learned about. The response is therefore
+// watched from BEFORE the await (a `res.close` listener installed up front, not after the fact), the
+// ticket is cancelled the moment the response can no longer be written, and the commit is guarded by a
+// re-check on both sides of the await. Nothing is ever written to a closed response.
+function _responseIsGone(res) {
+  if (!res) return true;
+  if (res.writableEnded) return true; // we already answered
+  if (res.destroyed) return true; // the socket went away
+  return false;
+}
+
+async function handleLeadTokenRegistration(res, registration, ctx) {
+  const sendJson = (status, payload) => {
+    // Never write on a response whose client is gone: a torn-down socket has no reader, and writing
+    // would surface as an unhandled error rather than as the honest "this registration was abandoned".
+    if (_responseIsGone(res)) return;
+    res.writeHead(status, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(payload));
+  };
+  // §5 D-4 / §9 S6: the ONE refusal that is not a malformed registration is the revoked-identity
+  // tombstone, and it answers 409 with a static code (never the underlying message, never a caller
+  // value) from all three of this handler's exits: the synchronous branch, the ticket's entry check and
+  // the ticket's commit.
+  const sendRegistrationRefusal = (err) => {
+    if (err && err.code === tokens.LEAD_TOKEN_REVOKED_CODE) sendJson(409, { error: tokens.LEAD_TOKEN_REVOKED_CODE });
+    else sendJson(400, { error: err && err.message });
+  };
+  if (registration.nativeTransport !== tokens.NATIVE_TRANSPORT_MTLS) {
+    // Existing synchronous contract, byte-for-byte: no listener, no CA, no await.
+    try {
+      const result = tokens.registerLeadToken(registration);
+      sendJson(200, { token: result.token });
+    } catch (err) {
+      sendRegistrationRefusal(err);
+    }
+    return;
+  }
+  let ticket;
+  try {
+    // Validated, conflict-checked read-only against the live registry, and captured BEFORE the first
+    // await: the caller's own object cannot change what commits, a malformed OR already-conflicting
+    // registration never reaches the listener (no CA load, no bind), and the ticket exists before any
+    // await can be interrupted.
+    ticket = tokens.beginLeadTokenRegistration(registration);
+  } catch (err) {
+    sendRegistrationRefusal(err);
+    return;
+  }
+  let settled = false;
+  const cancelOwnTicket = () => {
+    if (settled) return;
+    settled = true;
+    ticket.cancel();
+  };
+  // Installed BEFORE the await, so a disconnect that happens while the listener is still binding is
+  // observed rather than discovered later as an orphaned owner.
+  const onClientGone = () => {
+    if (!res.writableEnded) cancelOwnTicket();
+  };
+  res.on('close', onClientGone);
+  try {
+    // Entry check: a caller that vanished before we even started has already given up on this attempt.
+    if (_responseIsGone(res)) return;
+    // This server's OWN controller, never another live server's.
+    if (!ctx.nativeListener) {
+      cancelOwnTicket();
+      sendJson(503, { error: 'native_lead_listener_unavailable' });
+      return;
+    }
+    await ctx.nativeListener.ensureReady();
+    // Re-check after the await: the interruption window is exactly the one the ticket exists for.
+    if (_responseIsGone(res)) return;
+    // The commit is synchronous and happens while the response is still writable, so the ticket is
+    // retired from the cancellation path here: from this point the grant is real and the only remaining
+    // hazard is a LOST acknowledgment, which the caller (the supervisor) owns via its pending-revoke
+    // obligation — the child cannot distinguish "the parent read it" from "the parent timed out".
+    settled = true;
+    const committed = ticket.commit();
+    if (!committed.ok) {
+      // A revoke/reset/cancel landed while the listener was starting, or the live revalidation found a
+      // concurrent owner: no grant, and the caller is told why by bounded code only.
+      sendJson(409, { error: committed.code });
+      return;
+    }
+    sendJson(200, { token: committed.token });
+  } catch (err) {
+    cancelOwnTicket();
+    sendJson(503, { error: (err && err.code) || 'native_lead_listener_unavailable' });
+  } finally {
+    // The response is no longer ours to reason about, so the listener and any unsettled ticket are
+    // released here. An already-committed ticket is untouched (cancel() only moves a PENDING ticket).
+    res.removeListener('close', onClientGone);
+    cancelOwnTicket();
+  }
+}
+
+module.exports = { handleLeadTokenRegistration };