@pellux/goodvibes-agent 1.0.34 → 1.0.36

package/src/tools/agent-harness-metadata.ts

@@ -1,6 +1,7 @@
 import type { ToolRegistry } from '@pellux/goodvibes-sdk/platform/tools';
 import type { CommandContext } from '../input/command-registry.ts';
 import { resolveAgentConnectedHostConnection } from '../agent/routine-schedule-promotion.ts';
+import { previewHarnessText } from './agent-harness-text.ts';
 
 export interface CommandExecutionPolicy {
   readonly effect: 'read-only' | 'local-state' | 'connected-host-state' | 'external-network' | 'ui-navigation' | 'session-lifecycle' | 'delegated-work' | 'mixed' | 'unknown';
@@ -13,6 +14,10 @@ export type ConnectedHostCapabilityResolution =
   | { readonly status: 'found'; readonly detail: Record<string, unknown> }
   | { readonly status: 'ambiguous'; readonly input: string; readonly candidates: readonly Record<string, unknown>[] };
 
+function agentHarnessModes(...modes: readonly string[]): string {
+  return `agent_harness ${modes.map((mode) => `mode:"${mode}"`).join(', ')}`;
+}
+
 export function describeCommandPolicy(commandName: string): CommandExecutionPolicy {
   const root = commandName.replace(/^\//, '').trim().toLowerCase();
   const confirmation = 'agent_harness mode:"run_command" requires confirm:true and explicitUserRequest for every slash command invocation.';
@@ -20,7 +25,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'ui-navigation',
       confirmation,
-      preferredModelTool: 'agent_harness workspace/workspace_categories/workspace_actions/workspace_action/run_workspace_action',
+      preferredModelTool: agentHarnessModes('workspace', 'workspace_categories', 'workspace_actions', 'workspace_action', 'run_workspace_action'),
       boundary: 'Agent workspace navigation is visible shell routing. Use workspace action modes for concrete model-readable operation.',
     };
   }
@@ -28,7 +33,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'ui-navigation',
       confirmation,
-      preferredModelTool: 'agent_harness workspace_actions/workspace_action/open_ui_surface',
+      preferredModelTool: agentHarnessModes('workspace_actions', 'workspace_action', 'open_ui_surface'),
       boundary: 'Setup opens the visible Agent onboarding or setup workspace. Model-side changes should use setting modes or workspace actions.',
     };
   }
@@ -36,7 +41,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'ui-navigation',
       confirmation,
-      preferredModelTool: root === 'shortcuts' ? 'agent_harness shortcuts/keybindings/keybinding' : 'agent_harness commands/command',
+      preferredModelTool: root === 'shortcuts' ? agentHarnessModes('shortcuts', 'keybindings', 'keybinding') : agentHarnessModes('commands', 'command'),
       boundary: 'Discovery commands open visible help surfaces. The model should inspect the matching harness catalog directly before invoking commands.',
     };
   }
@@ -44,7 +49,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'read-only',
       confirmation,
-      preferredModelTool: 'agent_harness shortcuts/keybindings/keybinding/run_keybinding/set_keybinding/reset_keybinding',
+      preferredModelTool: agentHarnessModes('shortcuts', 'keybindings', 'keybinding', 'run_keybinding', 'set_keybinding', 'reset_keybinding'),
       boundary: 'Keybinding inspection is read-only. Keybinding execution or edits require explicit confirmation through agent_harness keybinding modes.',
     };
   }
@@ -52,7 +57,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'mixed',
       confirmation,
-      preferredModelTool: 'agent_harness settings/get_setting/set_setting/reset_setting',
+      preferredModelTool: agentHarnessModes('settings', 'get_setting', 'set_setting', 'reset_setting'),
       boundary: 'Model-writable settings can be changed through agent_harness. Connected-host lifecycle/listener settings remain read-only.',
     };
   }
@@ -60,7 +65,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'mixed',
       confirmation,
-      preferredModelTool: 'agent_harness settings/get_setting/set_setting/open_ui_surface',
+      preferredModelTool: agentHarnessModes('settings', 'get_setting', 'set_setting', 'open_ui_surface'),
       boundary: 'Model and reasoning-effort changes affect the current Agent chat route. Prefer settings modes for concrete values and UI surface routing for visible pickers.',
     };
   }
@@ -68,7 +73,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'mixed',
       confirmation,
-      preferredModelTool: 'agent_harness settings/get_setting/set_setting/open_ui_surface',
+      preferredModelTool: agentHarnessModes('settings', 'get_setting', 'set_setting', 'open_ui_surface'),
       boundary: 'Provider selection and custom provider files belong to Agent provider configuration. Adding, removing, or switching providers requires explicit user intent.',
     };
   }
@@ -76,7 +81,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'external-network',
       confirmation,
-      preferredModelTool: 'agent_harness settings/tools',
+      preferredModelTool: agentHarnessModes('settings', 'tools'),
       boundary: 'Model catalog refresh may call provider discovery routes and update local provider metadata. Do not run it without explicit user request.',
     };
   }
@@ -84,7 +89,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'local-state',
       confirmation,
-      preferredModelTool: 'agent_harness run_command',
+      preferredModelTool: agentHarnessModes('run_command'),
       boundary: 'Pinned model changes mutate local Agent provider preferences only and require an explicit model id.',
     };
   }
@@ -92,7 +97,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'local-state',
       confirmation,
-      preferredModelTool: 'agent_harness settings/get_setting/set_setting',
+      preferredModelTool: agentHarnessModes('settings', 'get_setting', 'set_setting'),
       boundary: 'Interaction-mode changes affect the current Agent operator notification posture and should be explicit.',
     };
   }
@@ -108,7 +113,9 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'read-only',
       confirmation,
-      preferredModelTool: root === 'compat' ? 'agent_harness service_posture/service_endpoint/connected_host_status' : 'agent_harness service_posture/service_endpoint/connected_host_status/settings/tools/open_ui_surface',
+      preferredModelTool: root === 'compat'
+        ? agentHarnessModes('service_posture', 'service_endpoint', 'connected_host_status')
+        : agentHarnessModes('service_posture', 'service_endpoint', 'connected_host_status', 'settings', 'tools', 'open_ui_surface'),
       boundary: 'Diagnostics and review commands inspect Agent, provider, MCP, security, and connected-host readiness without taking lifecycle ownership.',
     };
   }
@@ -116,7 +123,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'mixed',
       confirmation,
-      preferredModelTool: 'agent_harness run_command',
+      preferredModelTool: agentHarnessModes('run_command'),
       boundary: 'Review subcommands are read-only; bundle export/import or auth/trust bundle export writes local files and requires explicit confirmation.',
     };
   }
@@ -124,7 +131,9 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'mixed',
       confirmation,
-      preferredModelTool: root === 'secrets' || root === 'secret' ? 'agent_harness settings/get_setting/set_setting/reset_setting' : 'agent_harness workspace_actions/settings/open_ui_surface',
+      preferredModelTool: root === 'secrets' || root === 'secret'
+        ? agentHarnessModes('settings', 'get_setting', 'set_setting', 'reset_setting')
+        : agentHarnessModes('workspace_actions', 'settings', 'open_ui_surface'),
       boundary: 'Harness-owned configuration, secret, voice, subscription, and MCP commands can expose credentials or external account state. Mutations require explicit user intent and should prefer secret refs over raw values.',
     };
   }
@@ -150,7 +159,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'ui-navigation',
       confirmation,
-      preferredModelTool: 'agent_harness workspace_actions/workspace_action/run_workspace_action or agent_local_registry',
+      preferredModelTool: `${agentHarnessModes('workspace_actions', 'workspace_action', 'run_workspace_action')} or agent_local_registry`,
       boundary: 'Notes workspace routing is visible navigation; note record mutations should use Agent-local registry or workspace action modes.',
     };
   }
@@ -198,7 +207,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'external-network',
       confirmation,
-      preferredModelTool: 'agent_harness open_ui_surface',
+      preferredModelTool: agentHarnessModes('open_ui_surface'),
       boundary: 'Image attachment reads a local image and submits a model turn with image content. Use only for explicit user-supplied files.',
     };
   }
@@ -206,7 +215,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'external-network',
       confirmation,
-      preferredModelTool: 'agent_harness settings/open_ui_surface',
+      preferredModelTool: agentHarnessModes('settings', 'open_ui_surface'),
       boundary: 'Live TTS submits a normal prompt and may call model and speech providers; stopping playback is local runtime control.',
     };
   }
@@ -222,7 +231,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'delegated-work',
       confirmation,
-      preferredModelTool: 'agent_harness workspace_actions/workspace_action/run_workspace_action',
+      preferredModelTool: agentHarnessModes('workspace_actions', 'workspace_action', 'run_workspace_action'),
       boundary: 'Delegation is explicit user-directed work only; no hidden background review or separate Agent job should be created implicitly.',
     };
   }
@@ -245,7 +254,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'session-lifecycle',
       confirmation,
-      preferredModelTool: 'agent_harness commands/command/run_command',
+      preferredModelTool: agentHarnessModes('commands', 'command', 'run_command'),
       boundary: 'Session and conversation commands operate on the visible harness session lifecycle.',
     };
   }
@@ -253,7 +262,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'local-state',
       confirmation,
-      preferredModelTool: 'agent_harness workspace_actions/workspace_action/run_workspace_action or agent_harness run_command',
+      preferredModelTool: `${agentHarnessModes('workspace_actions', 'workspace_action', 'run_workspace_action')} or ${agentHarnessModes('run_command')}`,
       boundary: 'Conversation export writes a local workspace file and requires an explicit output intent.',
     };
   }
@@ -261,7 +270,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'ui-navigation',
       confirmation,
-      preferredModelTool: root === 'bookmarks' ? 'agent_harness open_ui_surface' : 'agent_harness run_command',
+      preferredModelTool: root === 'bookmarks' ? `${agentHarnessModes('open_ui_surface')} or ${agentHarnessModes('run_command')}` : agentHarnessModes('run_command'),
       boundary: 'Conversation display navigation mutates only the visible transcript view or scroll position.',
     };
   }
@@ -269,7 +278,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'local-state',
       confirmation,
-      preferredModelTool: 'agent_harness run_keybinding',
+      preferredModelTool: agentHarnessModes('run_keybinding'),
       boundary: 'Paste reads the local clipboard and mutates the visible prompt or image attachment state.',
     };
   }
@@ -277,7 +286,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'mixed',
       confirmation,
-      preferredModelTool: 'agent_harness workspace_actions/workspace_action/run_workspace_action',
+      preferredModelTool: agentHarnessModes('workspace_actions', 'workspace_action', 'run_workspace_action'),
       boundary: 'Agent profile commands manage isolated Agent runtime profiles and starter templates. Mutations require explicit confirmation.',
     };
   }
@@ -285,7 +294,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'read-only',
       confirmation,
-      preferredModelTool: 'agent_harness run_command',
+      preferredModelTool: agentHarnessModes('run_command'),
       boundary: 'Pairing details are displayed for explicit operator use; the Agent does not manage connected-host listener lifecycle.',
     };
   }
@@ -323,15 +332,17 @@ export function describeCliCommandPolicy(commandName: string): CommandExecutionP
     return {
       effect: 'unknown',
       confirmation,
-      boundary: 'Blocked package CLI token. Agent can launch its own TUI and use public connected-host routes, but it does not manage connected-host lifecycle, listeners, servers, bridges, remotes, web surfaces, or webhook listeners.',
+      boundary: 'Blocked package CLI token. Agent can launch its own TUI and use public connected-host routes, but it does not manage connected-host lifecycle, listeners, servers, route relays, remotes, web surfaces, or webhook listeners.',
     };
   }
   if (root === 'tui' || root === 'onboarding' || root === 'help' || root === 'version' || root === 'completion') {
     return {
       effect: root === 'tui' || root === 'onboarding' ? 'ui-navigation' : 'read-only',
       confirmation,
-      preferredModelTool: root === 'onboarding' || root === 'tui' ? 'agent_harness workspace/workspace_actions/workspace_action/run_workspace_action' : 'agent_harness cli_commands/cli_command',
-      boundary: 'Top-level CLI launch, setup, help, version, and completion commands are package entrypoint surfaces; use in-process workspace and slash-command bridges from the model when operating inside the TUI.',
+      preferredModelTool: root === 'onboarding' || root === 'tui'
+        ? agentHarnessModes('workspace', 'workspace_actions', 'workspace_action', 'run_workspace_action')
+        : agentHarnessModes('cli_commands', 'cli_command'),
+      boundary: 'Top-level CLI launch, setup, help, version, and completion commands are package entrypoint surfaces; use in-process workspace and slash-command routes from the model when operating inside the TUI.',
     };
   }
   if (root === 'run') {
@@ -346,7 +357,7 @@ export function describeCliCommandPolicy(commandName: string): CommandExecutionP
     return {
       effect: 'read-only',
       confirmation,
-      preferredModelTool: root === 'tasks' ? 'agent_operator_briefing' : 'agent_harness service_posture/service_endpoint/connected_host_status/connected_host/settings/tools',
+      preferredModelTool: root === 'tasks' ? 'agent_operator_briefing' : agentHarnessModes('service_posture', 'service_endpoint', 'connected_host_status', 'connected_host', 'settings', 'tools'),
       boundary: 'Diagnostics and posture commands are readable from Agent-owned settings, provider, model, and connected-host capability surfaces without taking connected-host lifecycle ownership.',
     };
   }
@@ -354,7 +365,7 @@ export function describeCliCommandPolicy(commandName: string): CommandExecutionP
     return {
       effect: 'local-state',
       confirmation,
-      preferredModelTool: root === 'profiles' ? 'agent_harness workspace_actions/workspace_action/run_workspace_action' : 'agent_local_registry',
+      preferredModelTool: root === 'profiles' ? agentHarnessModes('workspace_actions', 'workspace_action', 'run_workspace_action') : 'agent_local_registry',
       boundary: 'Local library/profile/session/bundle CLI commands operate on Agent-local data. Mutations require explicit user intent and should use first-class Agent-local tools where available.',
     };
   }
@@ -370,7 +381,7 @@ export function describeCliCommandPolicy(commandName: string): CommandExecutionP
     return {
       effect: 'delegated-work',
       confirmation,
-      preferredModelTool: 'agent_harness workspace_actions/workspace_action/run_workspace_action',
+      preferredModelTool: agentHarnessModes('workspace_actions', 'workspace_action', 'run_workspace_action'),
       boundary: 'Delegation is explicit user-directed work only; no hidden background review or separate Agent job should be created implicitly.',
     };
   }
@@ -378,7 +389,9 @@ export function describeCliCommandPolicy(commandName: string): CommandExecutionP
     return {
       effect: root === 'pair' ? 'external-network' : 'mixed',
       confirmation,
-      preferredModelTool: root === 'pair' ? 'agent_harness workspace_actions/workspace_action/run_workspace_action' : 'agent_harness settings/get_setting/set_setting/reset_setting or workspace_actions',
+      preferredModelTool: root === 'pair'
+        ? agentHarnessModes('workspace_actions', 'workspace_action', 'run_workspace_action')
+        : `${agentHarnessModes('settings', 'get_setting', 'set_setting', 'reset_setting')} or ${agentHarnessModes('workspace_actions')}`,
       boundary: 'Provider subscription, secret, and pairing flows can expose credentials or external account state. Use only explicit user-directed flows and prefer secret refs over raw values.',
     };
   }
@@ -393,9 +406,30 @@ function toolIsAvailable(toolRegistry: ToolRegistry, toolName: string): boolean
   return toolRegistry.getToolDefinitions().some((tool) => tool.name === toolName);
 }
 
+function connectedHostCapabilityModelRoute(capability: Record<string, unknown>): string {
+  const modelTools = Array.isArray(capability.modelTools)
+    ? capability.modelTools.filter((tool): tool is string => typeof tool === 'string')
+    : [];
+  if (modelTools.length > 0) return previewHarnessText(modelTools.join(' or '));
+  return 'agent_harness mode:"connected_host_capability"';
+}
+
+function blockedConnectedHostModelRoute(): string {
+  return 'agent_harness mode:"service_posture" or mode:"connected_host_status"';
+}
+
 export function connectedHostCapabilityMap(toolRegistry: ToolRegistry): readonly Record<string, unknown>[] {
   const withAvailability = (capability: Record<string, unknown> & { readonly modelTools: readonly string[] }): Record<string, unknown> => ({
     ...capability,
+    modelRoute: connectedHostCapabilityModelRoute(capability),
+    harnessRoute: 'agent_harness mode:"connected_host_capability"',
+    modelAccess: {
+      inspectCapability: 'agent_harness mode:"connected_host_capability"',
+      liveStatus: 'agent_harness mode:"connected_host_status"',
+      endpointPosture: 'agent_harness mode:"service_posture"',
+      routeFamilies: 'agent_harness mode:"connected_host" includeParameters:true',
+      operate: connectedHostCapabilityModelRoute(capability),
+    },
     available: capability.modelTools.every((toolName) => toolIsAvailable(toolRegistry, toolName)),
   });
   return [
@@ -498,6 +532,7 @@ export function connectedHostRouteFamilies(): readonly Record<string, unknown>[]
       id: 'agent-knowledge',
       prefixes: ['/api/goodvibes-agent/knowledge/*'],
       modelTools: ['agent_knowledge', 'agent_knowledge_ingest'],
+      modelRoute: 'agent_knowledge or agent_knowledge_ingest',
       boundary: 'Agent-owned knowledge segment only; no fallback to default or non-Agent knowledge.',
     },
     {
@@ -510,24 +545,28 @@ export function connectedHostRouteFamilies(): readonly Record<string, unknown>[]
         '/api/runtime/scheduler',
       ],
       modelTools: ['agent_operator_briefing'],
+      modelRoute: 'agent_operator_briefing',
       boundary: 'Read-only public operator briefing routes.',
     },
     {
       id: 'operator-actions',
       routes: ['public operator action methods for approvals, automation jobs, automation runs, and schedules'],
       modelTools: ['agent_operator_action'],
+      modelRoute: 'agent_operator_action',
       boundary: 'Allowlisted confirmed mutations only; no arbitrary route invocation.',
     },
     {
       id: 'delivery',
       routes: ['configured channel, notification, and delivery targets'],
       modelTools: ['agent_channel_send', 'agent_notify'],
+      modelRoute: 'agent_channel_send or agent_notify',
       boundary: 'Explicit user-approved delivery only; no route/account creation.',
     },
     {
       id: 'connected-schedules',
       routes: ['public schedule creation/run routes'],
       modelTools: ['agent_reminder_schedule', 'agent_operator_action'],
+      modelRoute: 'agent_reminder_schedule or agent_operator_action',
       boundary: 'Connected schedules only; no hidden local scheduler or separate Agent job.',
     },
   ];
@@ -570,6 +609,9 @@ function describeConnectedHostCapabilityCandidates(
     capabilityId: typeof entry.capability.id === 'string' ? entry.capability.id : '',
     purpose: typeof entry.capability.purpose === 'string' ? entry.capability.purpose : undefined,
     reason: typeof entry.capability.reason === 'string' ? entry.capability.reason : undefined,
+    modelRoute: entry.status === 'allowed'
+      ? connectedHostCapabilityModelRoute(entry.capability)
+      : blockedConnectedHostModelRoute(),
   }));
 }
 
@@ -578,18 +620,36 @@ function connectedHostCapabilityDetail(entry: { readonly status: 'allowed' | 'bl
     return {
       status: 'allowed',
       capability: entry.capability,
+      modelRoute: connectedHostCapabilityModelRoute(entry.capability),
+      harnessRoute: 'agent_harness mode:"connected_host_capability"',
       relatedRouteFamilies: relatedConnectedHostRouteFamilies(entry.capability),
+      modelAccess: {
+        inspectCapability: 'agent_harness mode:"connected_host_capability"',
+        connectedHostInventory: 'agent_harness mode:"connected_host" includeParameters:true',
+        liveStatus: 'agent_harness mode:"connected_host_status"',
+        endpointPosture: 'agent_harness mode:"service_posture"',
+        operate: connectedHostCapabilityModelRoute(entry.capability),
+      },
       operatorMethodMode: 'Use agent_harness mode:"operator_methods" for the public operator and Agent Knowledge method catalog. Use mode:"operator_method" for one method.',
       servicePostureMode: 'Use agent_harness mode:"service_posture" for endpoint binding, network-facing posture, issue, and redacted-log diagnostics. Use mode:"service_endpoint" for one endpoint.',
-      statusMode: 'Use agent_harness mode:"connected_host_status" for live read-only reachability, SDK compatibility, token posture, and Agent Knowledge route readiness.',
-      boundary: 'Use only the listed first-class model tools, slash-command families, and workspace categories. Mutations still require explicit confirmation through those tools or command bridges.',
+      statusMode: 'Use agent_harness mode:"connected_host_status" for live read-only reachability, token posture, and Agent Knowledge route readiness.',
+      boundary: 'Use only the listed first-class model tools, slash-command families, and workspace categories. Mutations still require explicit confirmation through those tools or command routes.',
     };
   }
   return {
     status: 'blocked',
     capability: entry.capability,
+    modelRoute: blockedConnectedHostModelRoute(),
+    harnessRoute: 'agent_harness mode:"connected_host_capability"',
     allowed: false,
     available: false,
+    modelAccess: {
+      inspectCapability: 'agent_harness mode:"connected_host_capability"',
+      connectedHostInventory: 'agent_harness mode:"connected_host" includeParameters:true',
+      liveStatus: 'agent_harness mode:"connected_host_status"',
+      endpointPosture: 'agent_harness mode:"service_posture"',
+      operate: 'not exposed',
+    },
     boundary: 'This connected-host surface is intentionally not exposed to the model as an Agent operation.',
     servicePostureMode: 'Use agent_harness mode:"service_posture" or mode:"service_endpoint" only for read-only endpoint diagnostics.',
     statusMode: 'Use agent_harness mode:"connected_host_status" only for read-only readiness diagnostics.',
@@ -636,10 +696,21 @@ export function connectedHostSummary(
     ownership: 'external-connected-host',
     lifecycle: 'GoodVibes Agent can use public connected-host operator routes, but does not start, stop, restart, install, expose, or mutate the host listener.',
     modes: {
-      servicePosture: 'service_posture/service_endpoint',
-      operatorMethods: 'operator_methods/operator_method',
-      liveStatus: 'connected_host_status',
-      capabilityDetail: 'connected_host_capability',
+      servicePosture: agentHarnessModes('service_posture', 'service_endpoint'),
+      operatorMethods: agentHarnessModes('operator_methods', 'operator_method'),
+      liveStatus: agentHarnessModes('connected_host_status'),
+      capabilityDetail: agentHarnessModes('connected_host_capability'),
+      daemonAliases: agentHarnessModes('daemon', 'daemon_status'),
+    },
+    modelRoute: 'agent_harness mode:"connected_host" or mode:"connected_host_capability"',
+    modelAccess: {
+      inventory: 'agent_harness mode:"connected_host" includeParameters:true',
+      liveStatus: 'agent_harness mode:"connected_host_status"',
+      capabilityDetail: 'agent_harness mode:"connected_host_capability" capabilityId:"..."',
+      servicePosture: 'agent_harness mode:"service_posture"',
+      daemonAliases: 'agent_harness mode:"daemon" or mode:"daemon_status"',
+      daemonStatusAlias: 'agent_harness mode:"daemon_status"',
+      lifecycleBlocked: 'start, stop, restart, install, upgrade, expose-listener, and listener mutation are not exposed through Agent.',
     },
     counts: {
       routeFamilies: routeFamilies.length,
@@ -660,22 +731,54 @@ export function blockedConnectedHostCapabilities(): readonly Record<string, unkn
     {
       id: 'connected-host-lifecycle',
       blocked: ['start', 'stop', 'restart', 'install', 'upgrade', 'expose-listener', 'mutate-listener'],
+      modelRoute: blockedConnectedHostModelRoute(),
+      harnessRoute: 'agent_harness mode:"connected_host_capability"',
+      modelAccess: {
+        inspectCapability: 'agent_harness mode:"connected_host_capability"',
+        liveStatus: 'agent_harness mode:"connected_host_status"',
+        endpointPosture: 'agent_harness mode:"service_posture"',
+        operate: 'not exposed',
+      },
       reason: 'The connected host and listener are externally owned by GoodVibes; Agent can use public operator routes but not manage hosting.',
     },
     {
       id: 'non-agent-knowledge',
       blocked: ['default-knowledge', 'non-agent-knowledge-segments', 'fallback-knowledge'],
+      modelRoute: blockedConnectedHostModelRoute(),
+      harnessRoute: 'agent_harness mode:"connected_host_capability"',
+      modelAccess: {
+        inspectCapability: 'agent_harness mode:"connected_host_capability"',
+        allowedAgentKnowledge: 'agent_knowledge or agent_knowledge_ingest',
+        liveStatus: 'agent_harness mode:"connected_host_status"',
+        operate: 'not exposed',
+      },
       reason: 'Agent model tools must stay inside the isolated Agent Knowledge route family.',
     },
     {
       id: 'hidden-background-work',
       blocked: ['separate-agent-jobs', 'implicit-delegated-review', 'local-schedulers'],
+      modelRoute: blockedConnectedHostModelRoute(),
+      harnessRoute: 'agent_harness mode:"connected_host_capability"',
+      modelAccess: {
+        inspectCapability: 'agent_harness mode:"connected_host_capability"',
+        allowedDelegation: 'agent_harness mode:"delegation_posture"',
+        liveStatus: 'agent_harness mode:"connected_host_status"',
+        operate: 'not exposed',
+      },
       reason: 'All model work is serial and visible unless the user explicitly requests delegation through an exposed surface.',
     },
     {
       id: 'arbitrary-connected-host-mutations',
       blocked: ['route-discovery-mutation', 'account-creation', 'automation-definition-creation'],
-      reason: 'Only the documented allowlisted model tools and slash-command bridges are exposed.',
+      modelRoute: blockedConnectedHostModelRoute(),
+      harnessRoute: 'agent_harness mode:"connected_host_capability"',
+      modelAccess: {
+        inspectCapability: 'agent_harness mode:"connected_host_capability"',
+        allowedActions: 'agent_operator_action for documented allowlisted mutations only',
+        liveStatus: 'agent_harness mode:"connected_host_status"',
+        operate: 'not exposed',
+      },
+      reason: 'Only the documented allowlisted model tools and slash-command routes are exposed.',
     },
   ];
 }