wolfpack-tailnet-controllisted

# Wolfpack Session Control Use the canonical CLI. Do not discover or reconstruct browser/private HTTP flows. Wolfpack uses its ordinary global API auth policy and adds no inter-session authorization layer. ## Fast path A **top-level** project session: ```bash wolfpack session create <project> --harness <pi|claude|codex|gemini|cursor> --prompt '<instruction>' --json ``` A same-harness **child** of the current agent (full-startup assignment): ```bash # Pi parent: resolve the role model explicitly; use the reviewer setting for review. IMPLEMENTER_MODEL="${WOLFPACK_IMPLEMENTER_MODEL:-openai-codex/gpt-5.6-terra}" REVIEWER_MODEL="${WOLFPACK_REVIEWER_MODEL:-openai-codex/gpt-5.6-sol}" wolfpack agent spawn <project> --name 200-implementation --model "$IMPLEMENTER_MODEL" --plan .plans/000-task.md --notify-parent --json # Non-Pi parent: --model is unsupported; omit it. ``` `wolfpack session open` is only a deprecated child-spawn alias. Never use it for a top-level request. Replace `<project>` with `--project-dir <path>` when the user selects an existing directory outside the configured projects root; never pass both selectors. The CLI resolves relative paths and the server validates/canonicalizes the directory. Both creation commands perform one server-owned request and pass startup instructions without inheriting parent transcript/context. `--model` is child-only and Pi-parent-only; an explicit user/project model overrides the role environment/default. Use `--name <session>` fo