@forgezero/agent 0.1.73 → 0.1.75

package/README.md

@@ -35,48 +35,50 @@ Every row links to the detailed explanation and named-import/example area below.
 
 | public entry | short description | runtime | details |
 |---|---|---|---|
-| fz | The operator command: keys, status, genesis, unlock, run, and agent install. | Bun/Node host | [Details + example](#fz) |
-| fz run | The fallback for software that cannot read the local socket: start a process with scoped vault values in its environment. | Bun/Node host | [Details + example](#fz-run) |
-| fz agent install | Provision the same hardened agent service locally that the platform provisions remotely. | Bun/Node host | [Details + example](#fz-agent-install) |
-| fz-agent | The service entry point. Identity and private Git material arrive only as systemd credentials. A platform bootstrap may use a statically configured local control socket; an enrolled tenant guest builds each deployment manager from its signed server claim and reads all commands from the checked-out .fz definition. The signed enrolment binding constructs the exact project Vault replica scope, and an SNP guest completes its first live attestation before Vault synchronization begins. | Bun/Node host | [Details + example](#fz-agent) |
-| fz-agent (socket) | identity, sign, attest, get, sync and held — the whole interface an application sees. | Bun/Node host | [Details + example](#fz-agent-socket) |
-| @forgezero/agent/migration-pull | PQ-authenticated outbound lifecycle claims with fenced renewal, awaited async execution, idempotent acknowledgement and bounded shutdown drain. The executor reports local facts only. | Bun/Node host | [Details + example](#forgezero-agent-migration-pull) |
-| @forgezero/agent/lifecycle-helper | The root-owned fixed-operation boundary for migration work. Signed controller claims can request only private reachability probes, local health checks, or stops of units named in a root-owned profile; they cannot carry commands. | Bun/Node host | [Details + example](#forgezero-agent-lifecycle-helper) |
-| @forgezero/agent/provision | The install plan as data, with no transport — so `fz` running locally and the platform running over SSH provision an identical machine. | Bun/Node host | [Details + example](#forgezero-agent-provision) |
-| @forgezero/agent/platform-genesis | Offline authority adapter for the brief pre-API period. It validates exactly three reviewed generic guest requests and converts them to the same Metal claims the live API issues; environment and product tier are not provisioning inputs. | Bun/Node host | [Details + example](#forgezero-agent-platform-genesis) |
-| @forgezero/agent/subscribe | Realtime scope sync over a WebSocket, with the poll kept underneath it: the poll is what establishes freshness, and a change it finds that the socket never sent is proof the socket is lying. | Bun/Node host | [Details + example](#forgezero-agent-subscribe) |
-| @forgezero/agent/ssh-listen | The socket SSH_AUTH_SOCK points at. The protocol handler had nowhere to speak — an agent protocol with no socket is a parser. The containing directory is 0700 before anything binds, because the socket’s own mode is only corrected after it already exists. | Bun/Node host | [Details + example](#forgezero-agent-ssh-listen) |
-| @forgezero/agent/ssh-server | Serve the SSH agent protocol so SSH_AUTH_SOCK points at the vault — two operations implemented, and ADD_IDENTITY refused so no process can inject a key ssh would offer to every host. | Bun/Node host | [Details + example](#forgezero-agent-ssh-server) |
-| @forgezero/agent/pipeline | CI/CD on the compute: secrets reach the step that named them and nothing else, attestation gates the run, and a required attestation that fails is a refusal rather than a downgrade. | Bun/Node host | [Details + example](#forgezero-agent-pipeline) |
-| @forgezero/agent/agent-heartbeat | Signed node health publication with bounded renewal and shutdown withdrawal. | Bun/Node host | [Details + example](#forgezero-agent-agent-heartbeat) |
-| @forgezero/agent/agent-update | Verified Agent update planning against the platform release coordinate. | Bun/Node host | [Details + example](#forgezero-agent-agent-update) |
-| @forgezero/agent/agent-update-helper | Root-owned fixed update operations with registry origin and integrity validation. | Bun/Node host | [Details + example](#forgezero-agent-agent-update-helper) |
-| @forgezero/agent/bootstrap | Typed one-time platform bootstrap and internal API-driven enrolled-compute activation contracts. | Bun/Node host | [Details + example](#forgezero-agent-bootstrap) |
-| @forgezero/agent/bootstrap-bundle | Owner-only exact-revision Git bundle and SHA-256 manifest for credential-free release generation one. | Bun/Node host | [Details + example](#forgezero-agent-bootstrap-bundle) |
-| @forgezero/agent/operator-bootstrap | Pinned-host operator transport that stages owner-only handoffs and invokes the same typed platform bootstrap through the caller-approved SSH agent. | Bun/Node host | [Details + example](#forgezero-agent-operator-bootstrap) |
-| @forgezero/agent/host-maintenance | Closed host maintenance plans for staging transaction rehearsal and fleet-fenced schema consolidation through fixed transient systemd units. | Bun/Node host | [Details + example](#forgezero-agent-host-maintenance) |
-| @forgezero/agent/capacity-calibration | One-time target-local safe-concurrency calibration with private evidence. | Bun/Node host | [Details + example](#forgezero-agent-capacity-calibration) |
-| @forgezero/agent/cloudflare-bootstrap | Attended two-token Cloudflare Tunnel/DNS reconciliation and per-node connector/KV runtime handoff for existing KV resources. | Bun/Node host | [Details + example](#forgezero-agent-cloudflare-bootstrap) |
-| @forgezero/agent/cloudflare-edge | Strict Cloudflare REST operations used by the attended bootstrap controller. | Bun/Node host | [Details + example](#forgezero-agent-cloudflare-edge) |
-| @forgezero/agent/mesh-connector | Fixed Cloudflare Mesh/WARP connector enrollment using only the unit-loaded connector credential. | Bun/Node host | [Details + example](#forgezero-agent-mesh-connector) |
-| @forgezero/agent/compute | Compute claim, renewal, execution and completion client contracts. | Bun/Node host | [Details + example](#forgezero-agent-compute) |
-| @forgezero/agent/credential-schema | Canonical systemd credential names and validation shared by bootstrap and services. | Bun/Node host | [Details + example](#forgezero-agent-credential-schema) |
-| @forgezero/agent/definition | Legacy version 3 JSON deployment compatibility contract. | Bun/Node host | [Details + example](#forgezero-agent-definition) |
-| @forgezero/agent/deploy | Typed deployment authoring builders, built-in provider requirements and versioned action constructors. | Bun/Node host | [Details + example](#forgezero-agent-deploy) |
-| @forgezero/agent/deploy-plan | Runtime validation, canonicalization and semantic digest for inert deployment plans. | Bun/Node host | [Details + example](#forgezero-agent-deploy-plan) |
-| @forgezero/agent/deploy-plan-runner | Conditional DAG execution with bounded retry, compensation and failure policy over injected action handlers. | Bun/Node host | [Details + example](#forgezero-agent-deploy-plan-runner) |
-| @forgezero/agent/deploy-compiler | Explicit developer/CI compiler from forgezero.deploy.ts to canonical .fz/deploy.plan.json; never used to execute project TypeScript in production. | Bun/Node host | [Details + example](#forgezero-agent-deploy-compiler) |
-| @forgezero/agent/deploy-file | Read and validate a checked-out .fz deployment file without executing project input. | Bun/Node host | [Details + example](#forgezero-agent-deploy-file) |
-| @forgezero/agent/metal-bootstrap | Physical-metal bootstrap planning, application and status evidence. | Bun/Node host | [Details + example](#forgezero-agent-metal-bootstrap) |
-| @forgezero/agent/metal-provision | The single constrained compute materializer for platform genesis, platform scaling and tenant compute. It executes caller-supplied OS, CPU, memory, disk, bandwidth, network and confidentiality coordinates after capacity and image validation; it owns no environment or product-tier shape. | Bun/Node host | [Details + example](#forgezero-agent-metal-provision) |
-| @forgezero/agent/platform-bootstrap-runtime | Pure platform bootstrap validation, render and resumable phase-state contracts. | Bun/Node host | [Details + example](#forgezero-agent-platform-bootstrap-runtime) |
-| @forgezero/agent/project-context | Project identity and repository context validation for operator and managed runs. | Bun/Node host | [Details + example](#forgezero-agent-project-context) |
-| @forgezero/agent/provisioning-pull | Signed provisioning work claim, renewal, execution and acknowledgement. | Bun/Node host | [Details + example](#forgezero-agent-provisioning-pull) |
-| @forgezero/agent/schema/deploy-v3.json | Published JSON Schema for deployment definition version 3 with exact argv execution. | Bun/Node host | [Details + example](#forgezero-agent-schema-deploy-v3-json) |
-| @forgezero/agent/software | Exact managed-software inventory, requirement and evidence contracts. | Bun/Node host | [Details + example](#forgezero-agent-software) |
-| @forgezero/agent/software-helper | Root-owned fixed installation/update boundary for declared software. | Bun/Node host | [Details + example](#forgezero-agent-software-helper) |
-| @forgezero/agent/ubuntu | The closed guest-image view: pinned Ubuntu 26.04 LTS x64 supports ordinary or SEV-SNP compute, while pinned Ubuntu 24.04 LTS x64 is limited to ordinary non-confidential compute. Every other OS remains rejected until its own pinned strategy and acceptance evidence are added. | Bun/Node host | [Details + example](#forgezero-agent-ubuntu) |
-| fz-agent (replica) | The project-scoped vault replica: resident in RAM, never on disk, invalidated by cursor rather than by timer, and refusing a read it can no longer vouch for. | Bun/Node host | [Details + example](#fz-agent-replica) |
+| fz | The operator command: keys, status, genesis, unlock, run, and agent install. | Bun/Node host | [Reference + usage](#fz) |
+| fz run | The fallback for software that cannot read the local socket: start a process with scoped vault values in its environment. | Bun/Node host | [Reference + usage](#fz-run) |
+| fz agent install | Provision the same hardened agent service locally that the platform provisions remotely. | Bun/Node host | [Reference + usage](#fz-agent-install) |
+| fz-agent | The service entry point. Identity and private Git material arrive only as systemd credentials. A platform bootstrap may use a statically configured local control socket; an enrolled tenant guest builds each deployment manager from its signed server claim and reads all commands from the checked-out .fz definition. The signed enrolment binding constructs the exact project Vault replica scope, and an SNP guest completes its first live attestation before Vault synchronization begins. | Bun/Node host | [Reference + usage](#fz-agent) |
+| fz-agent (socket) | identity, sign, attest, get, sync and held — the whole interface an application sees. | Bun/Node host | [Reference + usage](#fz-agent-socket) |
+| @forgezero/agent/migration-pull | PQ-authenticated outbound lifecycle claims with fenced renewal, awaited async execution, idempotent acknowledgement and bounded shutdown drain. The executor reports local facts only. | Bun/Node host | [Reference + usage](#forgezero-agent-migration-pull) |
+| @forgezero/agent/lifecycle-helper | The root-owned fixed-operation boundary for migration work. Signed controller claims can request only private reachability probes, local health checks, or stops of units named in a root-owned profile; they cannot carry commands. | Bun/Node host | [Reference + usage](#forgezero-agent-lifecycle-helper) |
+| @forgezero/agent/provision | The install plan as data, with no transport — so `fz` running locally and the platform running over SSH provision an identical machine. | Bun/Node host | [Reference + usage](#forgezero-agent-provision) |
+| @forgezero/agent/platform-genesis | Offline authority adapter for the brief pre-API period. It validates exactly three reviewed generic guest requests and converts them to the same Metal claims the live API issues; environment and product tier are not provisioning inputs. | Bun/Node host | [Reference + usage](#forgezero-agent-platform-genesis) |
+| @forgezero/agent/subscribe | Realtime scope sync over a WebSocket, with the poll kept underneath it: the poll is what establishes freshness, and a change it finds that the socket never sent is proof the socket is lying. | Bun/Node host | [Reference + usage](#forgezero-agent-subscribe) |
+| @forgezero/agent/ssh-listen | The socket SSH_AUTH_SOCK points at. The protocol handler had nowhere to speak — an agent protocol with no socket is a parser. The containing directory is 0700 before anything binds, because the socket’s own mode is only corrected after it already exists. | Bun/Node host | [Reference + usage](#forgezero-agent-ssh-listen) |
+| @forgezero/agent/ssh-server | Serve the SSH agent protocol so SSH_AUTH_SOCK points at the vault — two operations implemented, and ADD_IDENTITY refused so no process can inject a key ssh would offer to every host. | Bun/Node host | [Reference + usage](#forgezero-agent-ssh-server) |
+| @forgezero/agent/pipeline | CI/CD on the compute: secrets reach the step that named them and nothing else, attestation gates the run, and a required attestation that fails is a refusal rather than a downgrade. | Bun/Node host | [Reference + usage](#forgezero-agent-pipeline) |
+| @forgezero/agent/agent-heartbeat | Signed node health publication with bounded renewal and shutdown withdrawal. | Bun/Node host | [Reference + usage](#forgezero-agent-agent-heartbeat) |
+| @forgezero/agent/agent-update | Verified Agent update planning against the platform release coordinate. | Bun/Node host | [Reference + usage](#forgezero-agent-agent-update) |
+| @forgezero/agent/agent-update-helper | Root-owned fixed update operations with registry origin and integrity validation. | Bun/Node host | [Reference + usage](#forgezero-agent-agent-update-helper) |
+| @forgezero/agent/bootstrap | Typed one-time platform bootstrap and internal API-driven enrolled-compute activation contracts. | Bun/Node host | [Reference + usage](#forgezero-agent-bootstrap) |
+| @forgezero/agent/bootstrap-bundle | Owner-only exact-revision Git bundle and SHA-256 manifest for credential-free release generation one. | Bun/Node host | [Reference + usage](#forgezero-agent-bootstrap-bundle) |
+| @forgezero/agent/operator-bootstrap | Pinned-host operator transport that stages owner-only handoffs and invokes the same typed platform bootstrap through the caller-approved SSH agent. | Bun/Node host | [Reference + usage](#forgezero-agent-operator-bootstrap) |
+| @forgezero/agent/host-maintenance | Closed host maintenance plans for staging transaction rehearsal and fleet-fenced schema consolidation through fixed transient systemd units. | Bun/Node host | [Reference + usage](#forgezero-agent-host-maintenance) |
+| @forgezero/agent/capacity-calibration | One-time target-local safe-concurrency calibration with private evidence. | Bun/Node host | [Reference + usage](#forgezero-agent-capacity-calibration) |
+| @forgezero/agent/cloudflare-bootstrap | Attended two-token Cloudflare Tunnel/DNS reconciliation and per-node connector/KV runtime handoff for existing KV resources. | Bun/Node host | [Reference + usage](#forgezero-agent-cloudflare-bootstrap) |
+| @forgezero/agent/cloudflare-edge | Strict Cloudflare REST operations used by the attended bootstrap controller. | Bun/Node host | [Reference + usage](#forgezero-agent-cloudflare-edge) |
+| @forgezero/agent/mesh-connector | Fixed Cloudflare Mesh/WARP connector enrollment using only the unit-loaded connector credential. | Bun/Node host | [Reference + usage](#forgezero-agent-mesh-connector) |
+| @forgezero/agent/compute | Compute claim, renewal, execution and completion client contracts. | Bun/Node host | [Reference + usage](#forgezero-agent-compute) |
+| @forgezero/agent/credential-schema | Canonical systemd credential names and validation shared by bootstrap and services. | Bun/Node host | [Reference + usage](#forgezero-agent-credential-schema) |
+| @forgezero/agent/definition | Legacy version 3 JSON deployment compatibility contract. | Bun/Node host | [Reference + usage](#forgezero-agent-definition) |
+| @forgezero/agent/deploy | Typed deployment authoring builders, built-in provider requirements and versioned action constructors. | Bun/Node host | [Reference + usage](#forgezero-agent-deploy) |
+| @forgezero/agent/deployment-targets | Bounded input resolution and stable compute-target assignment for typed plans; emits requirements and slots rather than physical hostnames. | Bun/Node host | [Reference + usage](#forgezero-agent-deployment-targets) |
+| @forgezero/agent/deployment-connectivity | Root-owned application of per-target Cloudflare Tunnel or WARP connector capabilities without exposing the project management token to a compute. | Bun/Node host | [Reference + usage](#forgezero-agent-deployment-connectivity) |
+| @forgezero/agent/deploy-plan | Runtime validation, canonicalization and semantic digest for inert deployment plans. | Bun/Node host | [Reference + usage](#forgezero-agent-deploy-plan) |
+| @forgezero/agent/deploy-plan-runner | Conditional DAG execution with bounded retry, compensation and failure policy over injected action handlers. | Bun/Node host | [Reference + usage](#forgezero-agent-deploy-plan-runner) |
+| @forgezero/agent/deploy-compiler | Explicit developer/CI compiler from forgezero.deploy.ts to canonical .fz/deploy.plan.json; never used to execute project TypeScript in production. | Bun/Node host | [Reference + usage](#forgezero-agent-deploy-compiler) |
+| @forgezero/agent/deploy-file | Read and validate a checked-out .fz deployment file without executing project input. | Bun/Node host | [Reference + usage](#forgezero-agent-deploy-file) |
+| @forgezero/agent/metal-bootstrap | Physical-metal bootstrap planning, application and status evidence. | Bun/Node host | [Reference + usage](#forgezero-agent-metal-bootstrap) |
+| @forgezero/agent/metal-provision | The single constrained compute materializer for platform genesis, platform scaling and tenant compute. It executes caller-supplied OS, CPU, memory, disk, bandwidth, network and confidentiality coordinates after capacity and image validation; it owns no environment or product-tier shape. | Bun/Node host | [Reference + usage](#forgezero-agent-metal-provision) |
+| @forgezero/agent/platform-bootstrap-runtime | Pure platform bootstrap validation, render and resumable phase-state contracts. | Bun/Node host | [Reference + usage](#forgezero-agent-platform-bootstrap-runtime) |
+| @forgezero/agent/project-context | Project identity and repository context validation for operator and managed runs. | Bun/Node host | [Reference + usage](#forgezero-agent-project-context) |
+| @forgezero/agent/provisioning-pull | Signed provisioning work claim, renewal, execution and acknowledgement. | Bun/Node host | [Reference + usage](#forgezero-agent-provisioning-pull) |
+| @forgezero/agent/schema/deploy-v3.json | Published JSON Schema for deployment definition version 3 with exact argv execution. | Bun/Node host | [Reference + usage](#forgezero-agent-schema-deploy-v3-json) |
+| @forgezero/agent/software | Exact managed-software inventory, requirement and evidence contracts. | Bun/Node host | [Reference + usage](#forgezero-agent-software) |
+| @forgezero/agent/software-helper | Root-owned fixed installation/update boundary for declared software. | Bun/Node host | [Reference + usage](#forgezero-agent-software-helper) |
+| @forgezero/agent/ubuntu | The closed guest-image view: pinned Ubuntu 26.04 LTS x64 supports ordinary or SEV-SNP compute, while pinned Ubuntu 24.04 LTS x64 is limited to ordinary non-confidential compute. Every other OS remains rejected until its own pinned strategy and acceptance evidence are added. | Bun/Node host | [Reference + usage](#forgezero-agent-ubuntu) |
+| fz-agent (replica) | The project-scoped vault replica: resident in RAM, never on disk, invalidated by cursor rather than by timer, and refusing a read it can no longer vouch for. | Bun/Node host | [Reference + usage](#fz-agent-replica) |
 
 ## Commands
 
@@ -132,6 +134,14 @@ The fallback for software that cannot read the local socket: start a process wit
 fz run --help
 ```
 
+## fz run — Inspect before use
+
+This is a command entry. Read its typed option contract before an operation; apply-capable commands remain plans unless their explicit apply flag is supplied.
+
+```text
+fz run --help
+```
+
 <a id="fz-agent-install"></a>
 ## fz agent install
 
@@ -141,6 +151,14 @@ Provision the same hardened agent service locally that the platform provisions r
 fz agent install --help
 ```
 
+## fz agent install — Inspect before use
+
+This is a command entry. Read its typed option contract before an operation; apply-capable commands remain plans unless their explicit apply flag is supplied.
+
+```text
+fz agent install --help
+```
+
 <a id="fz-agent"></a>
 ## fz-agent
 
@@ -150,13 +168,22 @@ The service entry point. Identity and private Git material arrive only as system
 fz-agent --help
 ```
 
+## fz-agent — Inspect before use
+
+This is a command entry. Read its typed option contract before an operation; apply-capable commands remain plans unless their explicit apply flag is supplied.
+
+```text
+fz-agent --help
+```
+
 <a id="fz-agent-socket"></a>
 ## fz-agent (socket)
 
-identity, sign, attest, get, sync and held — the whole interface an application sees. This entry requires a Bun/Node host runtime. Run the command with `--help` before applying it.
+identity, sign, attest, get, sync and held — the whole interface an application sees. This entry requires a Bun/Node host runtime. This is a managed runtime interface label, not an import or standalone executable.
 
 ```text
-fz-agent (socket) --help
+fz-agent (socket)
+# Accessed through the installed Agent boundary.
 ```
 
 ## fz-agent (socket) — Outbound control boundary
@@ -190,6 +217,18 @@ import type {
 } from '@forgezero/agent/migration-pull';
 ```
 
+## @forgezero/agent/migration-pull — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  pullMigrationOnce,
+} from '@forgezero/agent/migration-pull';
+
+export const selectedCapability = pullMigrationOnce;
+```
+
 <a id="forgezero-agent-lifecycle-helper"></a>
 ## @forgezero/agent/lifecycle-helper
 
@@ -213,6 +252,18 @@ import type {
 } from '@forgezero/agent/lifecycle-helper';
 ```
 
+## @forgezero/agent/lifecycle-helper — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  DEFAULT_LIFECYCLE_HELPER_SOCKET,
+} from '@forgezero/agent/lifecycle-helper';
+
+export const selectedCapability = DEFAULT_LIFECYCLE_HELPER_SOCKET;
+```
+
 <a id="forgezero-agent-provision"></a>
 ## @forgezero/agent/provision
 
@@ -271,6 +322,18 @@ import type {
 } from '@forgezero/agent/provision';
 ```
 
+## @forgezero/agent/provision — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  AGENT_EGRESS_UNIT_PATH,
+} from '@forgezero/agent/provision';
+
+export const selectedCapability = AGENT_EGRESS_UNIT_PATH;
+```
+
 <a id="forgezero-agent-platform-genesis"></a>
 ## @forgezero/agent/platform-genesis
 
@@ -289,6 +352,18 @@ import type {
 } from '@forgezero/agent/platform-genesis';
 ```
 
+## @forgezero/agent/platform-genesis — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  platformCommunityRehearsalClaims,
+} from '@forgezero/agent/platform-genesis';
+
+export const selectedCapability = platformCommunityRehearsalClaims;
+```
+
 <a id="forgezero-agent-subscribe"></a>
 ## @forgezero/agent/subscribe
 
@@ -308,6 +383,18 @@ import type {
 } from '@forgezero/agent/subscribe';
 ```
 
+## @forgezero/agent/subscribe — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  backoffMs,
+} from '@forgezero/agent/subscribe';
+
+export const selectedCapability = backoffMs;
+```
+
 <a id="forgezero-agent-ssh-listen"></a>
 ## @forgezero/agent/ssh-listen
 
@@ -324,6 +411,18 @@ import type {
 } from '@forgezero/agent/ssh-listen';
 ```
 
+## @forgezero/agent/ssh-listen — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  MAX_MESSAGE_BYTES,
+} from '@forgezero/agent/ssh-listen';
+
+export const selectedCapability = MAX_MESSAGE_BYTES;
+```
+
 <a id="forgezero-agent-ssh-server"></a>
 ## @forgezero/agent/ssh-server
 
@@ -349,6 +448,18 @@ import type {
 } from '@forgezero/agent/ssh-server';
 ```
 
+## @forgezero/agent/ssh-server — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  MAX_MESSAGE_BYTES,
+} from '@forgezero/agent/ssh-server';
+
+export const selectedCapability = MAX_MESSAGE_BYTES;
+```
+
 <a id="forgezero-agent-pipeline"></a>
 ## @forgezero/agent/pipeline
 
@@ -371,10 +482,22 @@ import type {
 } from '@forgezero/agent/pipeline';
 ```
 
+## @forgezero/agent/pipeline — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  PipelineError,
+} from '@forgezero/agent/pipeline';
+
+export const selectedCapability = PipelineError;
+```
+
 <a id="forgezero-agent-agent-heartbeat"></a>
 ## @forgezero/agent/agent-heartbeat
 
-Signed node health publication with bounded renewal and shutdown withdrawal. This entry exposes 3 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Signed node health publication with bounded renewal and shutdown withdrawal. This entry exposes 3 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
 import {
@@ -386,10 +509,23 @@ import {
 import type {
   AgentHeartbeatOptions,
   AgentHeartbeatResponse,
+  AgentHostMetrics,
   AgentObservation,
 } from '@forgezero/agent/agent-heartbeat';
 ```
 
+## @forgezero/agent/agent-heartbeat — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  heartbeatAgentOnce,
+} from '@forgezero/agent/agent-heartbeat';
+
+export const selectedCapability = heartbeatAgentOnce;
+```
+
 <a id="forgezero-agent-agent-update"></a>
 ## @forgezero/agent/agent-update
 
@@ -415,6 +551,18 @@ import type {
 } from '@forgezero/agent/agent-update';
 ```
 
+## @forgezero/agent/agent-update — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  DEFAULT_AGENT_RELEASE_ROOT,
+} from '@forgezero/agent/agent-update';
+
+export const selectedCapability = DEFAULT_AGENT_RELEASE_ROOT;
+```
+
 <a id="forgezero-agent-agent-update-helper"></a>
 ## @forgezero/agent/agent-update-helper
 
@@ -442,6 +590,18 @@ import type {
 } from '@forgezero/agent/agent-update-helper';
 ```
 
+## @forgezero/agent/agent-update-helper — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  AGENT_UPDATE_GROUP,
+} from '@forgezero/agent/agent-update-helper';
+
+export const selectedCapability = AGENT_UPDATE_GROUP;
+```
+
 <a id="forgezero-agent-bootstrap"></a>
 ## @forgezero/agent/bootstrap
 
@@ -486,6 +646,18 @@ import type {
 } from '@forgezero/agent/bootstrap';
 ```
 
+## @forgezero/agent/bootstrap — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  BOOTSTRAP_STATE_PATH,
+} from '@forgezero/agent/bootstrap';
+
+export const selectedCapability = BOOTSTRAP_STATE_PATH;
+```
+
 <a id="forgezero-agent-bootstrap-bundle"></a>
 ## @forgezero/agent/bootstrap-bundle
 
@@ -641,6 +813,18 @@ import type {
 } from '@forgezero/agent/capacity-calibration';
 ```
 
+## @forgezero/agent/capacity-calibration — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  calibrateHttpConcurrency,
+} from '@forgezero/agent/capacity-calibration';
+
+export const selectedCapability = calibrateHttpConcurrency;
+```
+
 <a id="forgezero-agent-cloudflare-bootstrap"></a>
 ## @forgezero/agent/cloudflare-bootstrap
 
@@ -685,6 +869,18 @@ import type {
 } from '@forgezero/agent/cloudflare-bootstrap';
 ```
 
+## @forgezero/agent/cloudflare-bootstrap — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  applyCloudflareBootstrap,
+} from '@forgezero/agent/cloudflare-bootstrap';
+
+export const selectedCapability = applyCloudflareBootstrap;
+```
+
 <a id="forgezero-agent-cloudflare-edge"></a>
 ## @forgezero/agent/cloudflare-edge
 
@@ -720,6 +916,18 @@ import type {
 } from '@forgezero/agent/cloudflare-edge';
 ```
 
+## @forgezero/agent/cloudflare-edge — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  configureCloudflareEdge,
+} from '@forgezero/agent/cloudflare-edge';
+
+export const selectedCapability = configureCloudflareEdge;
+```
+
 <a id="forgezero-agent-mesh-connector"></a>
 ## @forgezero/agent/mesh-connector
 
@@ -737,6 +945,18 @@ import type {
 } from '@forgezero/agent/mesh-connector';
 ```
 
+## @forgezero/agent/mesh-connector — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  configureMeshConnector,
+} from '@forgezero/agent/mesh-connector';
+
+export const selectedCapability = configureMeshConnector;
+```
+
 <a id="forgezero-agent-compute"></a>
 ## @forgezero/agent/compute
 
@@ -761,6 +981,18 @@ import type {
 } from '@forgezero/agent/compute';
 ```
 
+## @forgezero/agent/compute — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  ComputeError,
+} from '@forgezero/agent/compute';
+
+export const selectedCapability = ComputeError;
+```
+
 <a id="forgezero-agent-credential-schema"></a>
 ## @forgezero/agent/credential-schema
 
@@ -784,6 +1016,18 @@ import type {
 } from '@forgezero/agent/credential-schema';
 ```
 
+## @forgezero/agent/credential-schema — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  AGENT_CREDENTIAL_LOCATIONS,
+} from '@forgezero/agent/credential-schema';
+
+export const selectedCapability = AGENT_CREDENTIAL_LOCATIONS;
+```
+
 <a id="forgezero-agent-definition"></a>
 ## @forgezero/agent/definition
 
@@ -808,10 +1052,22 @@ import type {
 } from '@forgezero/agent/definition';
 ```
 
+## @forgezero/agent/definition — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  DEPLOY_SCHEMA_URL,
+} from '@forgezero/agent/definition';
+
+export const selectedCapability = DEPLOY_SCHEMA_URL;
+```
+
 <a id="forgezero-agent-deploy"></a>
 ## @forgezero/agent/deploy
 
-Typed deployment authoring builders, built-in provider requirements and versioned action constructors. This entry exposes 14 named value exports and 35 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Typed deployment authoring builders, built-in provider requirements and versioned action constructors. This entry exposes 14 named value exports and 41 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
 import {
@@ -838,17 +1094,22 @@ import type {
   BunProviderConfig,
   CloudflaredProviderConfig,
   ComponentDefinition,
+  ComputeConnectivityDefinition,
+  ComputePoolDefinition,
   Condition,
   ConditionOperand,
+  ContainerdProviderConfig,
   CredentialDefinition,
   DatabaseComponent,
   DeploymentSource,
   DockerProviderConfig,
   HealthDefinition,
   InputDefinition,
+  IntegerValue,
   JsonObject,
   JsonPrimitive,
   JsonValue,
+  KataProviderConfig,
   NetworkDefinition,
   NginxProviderConfig,
   OpenSshProviderConfig,
@@ -860,6 +1121,7 @@ import type {
   StageDefinition,
   StepScope,
   StorageMount,
+  StringValue,
   SystemdProviderConfig,
   TargetDefinition,
   UfwProviderConfig,
@@ -870,16 +1132,19 @@ import type {
 } from '@forgezero/agent/deploy';
 ```
 
-## @forgezero/agent/deploy — Author a typed native or Docker deployment
+## @forgezero/agent/deploy — Author a typed, placed containerd deployment
 
-TypeScript is authoring only. The checked-in canonical plan is what Agents validate and execute. Docker is additive: native Bun/ArangoDB remains available, while container applications must declare hard CPU, memory and PID limits, storage class, loopback ingress and a fixed health gate.
+TypeScript is authoring only. The checked-in canonical plan is what Agents validate and execute. Targets declare bounded resource/cardinality intent, not hostnames. The API reserves eligible project capacity or provisions only under the reviewed plan and spend ceiling, assigns stable slots, and the Agent runs only its exact assignment. runc containers must declare hard CPU, memory and PID limits, bounded storage, loopback ingress and a health-gated rollout; select Kata QEMU SNP when the workload needs host isolation.
 
 ```text
 import {
   actions,
-  application,
-  defineDeployment,
-  providers,
+	  application,
+	  credential,
+	  defineDeployment,
+	  input,
+	  providers,
+	  ref,
   stage,
   target,
   workflow,
@@ -889,24 +1154,117 @@ export default defineDeployment({
   apiVersion: 'deploy.forgezero.net/v1', kind: 'Deployment',
   metadata: { name: 'orders-api' },
   spec: {
-    targets: { api: target.compute({ selector: { profiles: ['api'] }, cardinality: { minimum: 1, desired: 2, maximum: 16 } }) },
-    requirements: { docker: providers.docker.require(), nginx: providers.nginx.require() },
+	inputs: {
+	  replicas: input.integer({ minimum: 1, maximum: 16, default: 1 }),
+	  cpuCores: input.integer({ minimum: 1, maximum: 32, default: 1 }),
+	  memoryMiB: input.integer({ minimum: 256, maximum: 131072, default: 512 }),
+	  storageGiB: input.integer({ minimum: 4, maximum: 2048, default: 8 })
+	},
+	credentials: {
+	  cloudflare: credential.vault({ schema: 'forgezero.cloudflare/management@1', name: 'cloudflare-management' })
+	},
+	targets: { api: target.compute({
+	  profiles: ['api'], replicas: { minimum: 1, desired: input.ref('replicas'), maximum: 16 },
+	  resources: { cpuCores: input.ref('cpuCores'), memoryMiB: input.ref('memoryMiB'), storageGiB: input.ref('storageGiB') },
+	  os: 'ubuntu-24.04', runtime: 'oci-runc', sharing: 'shared', reuse: 'prefer',
+	  provisioning: {
+	    planKey: 'app-small', regionKey: 'default', imageKey: 'ubuntu-24.04-x64',
+	    environmentKey: 'production', ownership: 'platform', maxMonthlySpendMinor: '25000'
+	  },
+	  connectivity: {
+	    private: { mode: 'private-lan' },
+	    public: { mode: 'cloudflare-tunnel', credential: 'cloudflare', zone: 'example.com', hostname: { mode: 'indexed', prefix: 'api' } }
+	  }
+	}) },
+	requirements: {
+	  containerd: providers.containerd.require(), nginx: providers.nginx.require(),
+	  cloudflared: providers.cloudflared.require()
+	},
     components: {
       api: application({
         target: 'api',
-        runtime: { kind: 'container', provider: 'forgezero.docker', requirement: 'docker', image: { source: { kind: 'build', context: '.', dockerfile: 'Dockerfile' } }, security: { privileged: false, noNewPrivileges: true, root: 'read-only', dropCapabilities: ['ALL'] } },
+		runtime: { kind: 'container', provider: 'forgezero.containerd', requirement: 'containerd', runtimeClass: 'runc', image: { source: { kind: 'build', context: '.', dockerfile: 'Dockerfile' } }, security: { privileged: false, noNewPrivileges: true, root: 'read-only', dropCapabilities: ['ALL'] } },
         service: { protocol: 'http', port: 3000, health: { protocol: 'http', method: 'GET', path: '/health', expectedStatus: [200], timeoutMs: 2000 } },
-        resources: { cpu: { limit: 2 }, memory: { limitMiB: 2048, swap: 'disabled' }, pids: { limit: 256 } },
+		resources: { cpu: { limit: 1 }, memory: { limitMiB: 512, swap: 'disabled' }, pids: { limit: 256 } },
         storage: [{ class: 'ephemeral', path: '/tmp', type: 'tmpfs', sizeMiB: 128 }],
-        network: { ingress: { exposure: 'loopback', stablePort: 3000 }, container: { mode: 'bridge', network: 'api' } },
+	        network: {
+	          ingress: { exposure: 'public', stablePort: 3000 },
+	          public: { mode: 'cloudflare-tunnel' },
+	          container: { mode: 'bridge', network: 'api' }
+	        },
         rollout: { strategy: 'blue-green', proxy: 'nginx', automaticRollback: true }
       })
     },
-    workflows: { deploy: workflow({ stages: { prepare: stage({ strategy: { mode: 'sequential' }, steps: { software: actions.software.ensure({ requirements: ['docker', 'nginx'] }, { scope: { kind: 'each-target', target: 'api' } }) } }) } }) }
+	workflows: { deploy: workflow({ stages: {
+	  prepare: stage({ strategy: { mode: 'sequential' }, steps: {
+		    software: actions.software.ensure({ requirements: ['containerd', 'nginx', 'cloudflared'] }, { scope: { kind: 'each-target', target: 'api' } }),
+		    network: actions.network.ensure({ target: 'api' }, { scope: { kind: 'each-target', target: 'api' } }),
+		    image: actions.container.build({ component: 'api' }, { scope: { kind: 'each-target', target: 'api' } })
+	  } }),
+	  release: stage({ dependsOn: ['prepare'], strategy: { mode: 'blue-green' }, steps: {
+	    promote: actions.service.promote({ component: 'api', imageDigest: ref.stepOutput('image', 'digest') }, { scope: { kind: 'each-target', target: 'api' } })
+	  } })
+	} }) }
   }
 });
 ```
 
+<a id="forgezero-agent-deployment-targets"></a>
+## @forgezero/agent/deployment-targets
+
+Bounded input resolution and stable compute-target assignment for typed plans; emits requirements and slots rather than physical hostnames. This entry exposes 3 named value exports and 0 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  DeploymentInputError,
+  resolveDeploymentInputs,
+  resolveDeploymentTargets,
+} from '@forgezero/agent/deployment-targets';
+```
+
+## @forgezero/agent/deployment-targets — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  DeploymentInputError,
+} from '@forgezero/agent/deployment-targets';
+
+export const selectedCapability = DeploymentInputError;
+```
+
+<a id="forgezero-agent-deployment-connectivity"></a>
+## @forgezero/agent/deployment-connectivity
+
+Root-owned application of per-target Cloudflare Tunnel or WARP connector capabilities without exposing the project management token to a compute. This entry exposes 1 named value export and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  applyDeploymentConnectivity,
+} from '@forgezero/agent/deployment-connectivity';
+
+import type {
+  DeploymentConnectivityCapabilities,
+  DeploymentConnectivityEvidence,
+  DeploymentConnectivityHost,
+  DeploymentConnectivityIntent,
+  DeploymentConnectivityRequest,
+} from '@forgezero/agent/deployment-connectivity';
+```
+
+## @forgezero/agent/deployment-connectivity — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  applyDeploymentConnectivity,
+} from '@forgezero/agent/deployment-connectivity';
+
+export const selectedCapability = applyDeploymentConnectivity;
+```
+
 <a id="forgezero-agent-deploy-plan"></a>
 ## @forgezero/agent/deploy-plan
 
@@ -932,6 +1290,18 @@ import type {
 } from '@forgezero/agent/deploy-plan';
 ```
 
+## @forgezero/agent/deploy-plan — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  DEPLOY_PLAN_FORMAT,
+} from '@forgezero/agent/deploy-plan';
+
+export const selectedCapability = DEPLOY_PLAN_FORMAT;
+```
+
 <a id="forgezero-agent-deploy-plan-runner"></a>
 ## @forgezero/agent/deploy-plan-runner
 
@@ -1000,6 +1370,18 @@ import type {
 } from '@forgezero/agent/deploy-compiler';
 ```
 
+## @forgezero/agent/deploy-compiler — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  DEPLOY_PLAN_FILE,
+} from '@forgezero/agent/deploy-compiler';
+
+export const selectedCapability = DEPLOY_PLAN_FILE;
+```
+
 <a id="forgezero-agent-deploy-file"></a>
 ## @forgezero/agent/deploy-file
 
@@ -1022,6 +1404,18 @@ import type {
 } from '@forgezero/agent/deploy-file';
 ```
 
+## @forgezero/agent/deploy-file — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  DEPLOY_FILE,
+} from '@forgezero/agent/deploy-file';
+
+export const selectedCapability = DEPLOY_FILE;
+```
+
 <a id="forgezero-agent-metal-bootstrap"></a>
 ## @forgezero/agent/metal-bootstrap
 
@@ -1052,6 +1446,18 @@ import type {
 } from '@forgezero/agent/metal-bootstrap';
 ```
 
+## @forgezero/agent/metal-bootstrap — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  METAL_BOOTSTRAP_STATE_PATH,
+} from '@forgezero/agent/metal-bootstrap';
+
+export const selectedCapability = METAL_BOOTSTRAP_STATE_PATH;
+```
+
 <a id="forgezero-agent-metal-provision"></a>
 ## @forgezero/agent/metal-provision
 
@@ -1082,6 +1488,18 @@ import type {
 } from '@forgezero/agent/metal-provision';
 ```
 
+## @forgezero/agent/metal-provision — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  MetalProvisionError,
+} from '@forgezero/agent/metal-provision';
+
+export const selectedCapability = MetalProvisionError;
+```
+
 <a id="forgezero-agent-platform-bootstrap-runtime"></a>
 ## @forgezero/agent/platform-bootstrap-runtime
 
@@ -1119,6 +1537,18 @@ import type {
 } from '@forgezero/agent/platform-bootstrap-runtime';
 ```
 
+## @forgezero/agent/platform-bootstrap-runtime — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  activatePlatformRelease,
+} from '@forgezero/agent/platform-bootstrap-runtime';
+
+export const selectedCapability = activatePlatformRelease;
+```
+
 <a id="forgezero-agent-project-context"></a>
 ## @forgezero/agent/project-context
 
@@ -1145,6 +1575,18 @@ import type {
 } from '@forgezero/agent/project-context';
 ```
 
+## @forgezero/agent/project-context — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  PROJECT_CONTEXT_VERSION,
+} from '@forgezero/agent/project-context';
+
+export const selectedCapability = PROJECT_CONTEXT_VERSION;
+```
+
 <a id="forgezero-agent-provisioning-pull"></a>
 ## @forgezero/agent/provisioning-pull
 
@@ -1167,6 +1609,18 @@ import type {
 } from '@forgezero/agent/provisioning-pull';
 ```
 
+## @forgezero/agent/provisioning-pull — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  pullProvisioningOnce,
+} from '@forgezero/agent/provisioning-pull';
+
+export const selectedCapability = pullProvisioningOnce;
+```
+
 <a id="forgezero-agent-schema-deploy-v3-json"></a>
 ## @forgezero/agent/schema/deploy-v3.json
 
@@ -1191,11 +1645,14 @@ if (!validate(deploymentDefinition)) throw new Error(JSON.stringify(validate.err
 <a id="forgezero-agent-software"></a>
 ## @forgezero/agent/software
 
-Exact managed-software inventory, requirement and evidence contracts. This entry exposes 10 named value exports and 10 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Exact managed-software inventory, requirement and evidence contracts. This entry exposes 13 named value exports and 10 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
 import {
+  BUILDKIT_VERSION,
   BUN_RELEASE_SHA256,
+  KATA_CONTAINERS_VERSION,
+  NERDCTL_VERSION,
   OS_CATALOG,
   PINNED_BUN_VERSION,
   SOFTWARE_CATALOG,
@@ -1221,10 +1678,22 @@ import type {
 } from '@forgezero/agent/software';
 ```
 
+## @forgezero/agent/software — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  BUILDKIT_VERSION,
+} from '@forgezero/agent/software';
+
+export const selectedCapability = BUILDKIT_VERSION;
+```
+
 <a id="forgezero-agent-software-helper"></a>
 ## @forgezero/agent/software-helper
 
-Root-owned fixed installation/update boundary for declared software. This entry exposes 8 named value exports and 0 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Root-owned fixed installation/update boundary for declared software. This entry exposes 9 named value exports and 0 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
 import {
@@ -1233,12 +1702,25 @@ import {
   SOFTWARE_HELPER_UNIT_PATH,
   requestContainerActivation,
   requestContainerBuild,
+  requestDeploymentConnectivity,
   requestServiceActivation,
   requestSoftware,
   startSoftwareHelper,
 } from '@forgezero/agent/software-helper';
 ```
 
+## @forgezero/agent/software-helper — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  DEFAULT_SOFTWARE_HELPER_SOCKET,
+} from '@forgezero/agent/software-helper';
+
+export const selectedCapability = DEFAULT_SOFTWARE_HELPER_SOCKET;
+```
+
 <a id="forgezero-agent-ubuntu"></a>
 ## @forgezero/agent/ubuntu
 
@@ -1253,13 +1735,35 @@ import {
 } from '@forgezero/agent/ubuntu';
 ```
 
+## @forgezero/agent/ubuntu — Use this entry point
+
+This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
+
+```text
+import {
+  SUPPORTED_GUEST_IMAGE,
+} from '@forgezero/agent/ubuntu';
+
+export const selectedCapability = SUPPORTED_GUEST_IMAGE;
+```
+
 <a id="fz-agent-replica"></a>
 ## fz-agent (replica)
 
-The project-scoped vault replica: resident in RAM, never on disk, invalidated by cursor rather than by timer, and refusing a read it can no longer vouch for. Run the command with `--help` before applying it.
+The project-scoped vault replica: resident in RAM, never on disk, invalidated by cursor rather than by timer, and refusing a read it can no longer vouch for. This is a managed runtime interface label, not an import or standalone executable.
+
+```text
+fz-agent (replica)
+# Accessed through the installed Agent boundary.
+```
+
+## fz-agent (replica) — Operational interface
+
+This inventory entry names an Agent-owned runtime interface, not an importable namespace or a command to paste. Applications reach it through the installed Agent and the documented Vault client.
 
 ```text
-fz-agent (replica) --help
+fz-agent (replica)
+# Managed by the installed fz-agent service; no direct executable entry.
 ```
 
 ## Install both machine commands