@pellux/goodvibes-agent 1.1.7 → 1.2.0

package/src/tools/agent-harness-metadata.ts

@@ -2,6 +2,7 @@ import type { ToolRegistry } from '@pellux/goodvibes-sdk/platform/tools';
 import type { CommandContext } from '../input/command-registry.ts';
 import { resolveAgentConnectedHostConnection } from '../agent/routine-schedule-promotion.ts';
 import { previewHarnessText } from './agent-harness-text.ts';
+export { describeCliCommandPolicy } from './agent-harness-cli-command-policy.ts';
 
 export interface CommandExecutionPolicy {
   readonly effect: 'read-only' | 'local-state' | 'connected-host-state' | 'external-network' | 'ui-navigation' | 'session-lifecycle' | 'delegated-work' | 'mixed' | 'unknown';
@@ -18,6 +19,14 @@ function agentHarnessModes(...modes: readonly string[]): string {
   return `agent_harness ${modes.map((mode) => `mode:"${mode}"`).join(', ')}`;
 }
 
+function settingsActions(...actions: readonly string[]): string {
+  return `settings ${actions.map((action) => `action:"${action}"`).join('|')}`;
+}
+
+function hostActions(...actions: readonly string[]): string {
+  return `host ${actions.map((action) => `action:"${action}"`).join('|')}`;
+}
+
 export function describeCommandPolicy(commandName: string): CommandExecutionPolicy {
   const root = commandName.replace(/^\//, '').trim().toLowerCase();
   const confirmation = 'agent_harness mode:"run_command" requires confirm:true and explicitUserRequest for every slash command invocation.';
@@ -34,7 +43,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
       effect: 'ui-navigation',
       confirmation,
       preferredModelTool: agentHarnessModes('workspace_actions', 'workspace_action', 'open_ui_surface'),
-      boundary: 'Setup opens the visible Agent workspace. Model-side changes should use setting modes or workspace actions.',
+      boundary: 'Setup opens the visible Agent workspace. Model-side changes should use settings or workspace actions.',
     };
   }
   if (root === 'commands' || root === 'help' || root === 'shortcuts') {
@@ -57,23 +66,23 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'mixed',
       confirmation,
-      preferredModelTool: agentHarnessModes('settings', 'get_setting', 'set_setting', 'reset_setting'),
-      boundary: 'Model-writable settings can be changed through agent_harness. Connected-host lifecycle/listener settings remain read-only.',
+      preferredModelTool: settingsActions('list', 'get', 'set', 'reset', 'import'),
+      boundary: 'Model-writable settings can be changed through the first-class settings adapter. Connected-host lifecycle/listener settings remain read-only.',
     };
   }
   if (root === 'model' || root === 'effort') {
     return {
       effect: 'mixed',
       confirmation,
-      preferredModelTool: agentHarnessModes('settings', 'get_setting', 'set_setting', 'open_ui_surface'),
-      boundary: 'Model and reasoning-effort changes affect the current Agent chat route. Prefer settings modes for concrete values and UI surface routing for visible pickers.',
+      preferredModelTool: `${settingsActions('get', 'set')} or ${agentHarnessModes('open_ui_surface')}`,
+      boundary: 'Model and reasoning-effort changes affect the current Agent chat route. Prefer settings for concrete values and UI surface routing for visible pickers.',
     };
   }
   if (root === 'provider' || root === 'providers') {
     return {
       effect: 'mixed',
       confirmation,
-      preferredModelTool: agentHarnessModes('settings', 'get_setting', 'set_setting', 'open_ui_surface'),
+      preferredModelTool: `${settingsActions('get', 'set')} or ${agentHarnessModes('open_ui_surface')}`,
       boundary: 'Provider selection and custom provider files belong to Agent provider configuration. Adding, removing, or switching providers requires explicit user intent.',
     };
   }
@@ -81,7 +90,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'external-network',
       confirmation,
-      preferredModelTool: agentHarnessModes('settings', 'tools'),
+      preferredModelTool: `${settingsActions('list', 'get')} or ${agentHarnessModes('tools')}`,
       boundary: 'Model catalog refresh may call provider discovery routes and update local provider metadata. Do not run it without explicit user request.',
     };
   }
@@ -97,10 +106,18 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'local-state',
       confirmation,
-      preferredModelTool: agentHarnessModes('settings', 'get_setting', 'set_setting'),
+      preferredModelTool: settingsActions('get', 'set'),
       boundary: 'Interaction-mode changes affect the current Agent operator notification posture and should be explicit.',
     };
   }
+  if (root === 'vibe' || root === 'vibes') {
+    return {
+      effect: 'local-state',
+      confirmation,
+      preferredModelTool: 'vibe or agent_local_registry',
+      boundary: 'VIBE.md status/show are read-only; init writes a local personality file and import-persona writes an Agent-local persona after explicit confirmation.',
+    };
+  }
   if (root === 'brief') {
     return {
       effect: 'read-only',
@@ -114,8 +131,8 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
       effect: 'read-only',
       confirmation,
       preferredModelTool: root === 'compat'
-        ? agentHarnessModes('service_posture', 'service_endpoint', 'connected_host_status')
-        : agentHarnessModes('service_posture', 'service_endpoint', 'connected_host_status', 'settings', 'tools', 'open_ui_surface'),
+        ? hostActions('services', 'service', 'status')
+        : `${hostActions('services', 'service', 'status')} or ${settingsActions('list', 'get')} or ${agentHarnessModes('tools', 'open_ui_surface')}`,
       boundary: 'Diagnostics and review commands inspect Agent, provider, MCP, security, and connected-host readiness without taking lifecycle ownership.',
     };
   }
@@ -132,8 +149,8 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
       effect: 'mixed',
       confirmation,
       preferredModelTool: root === 'secrets' || root === 'secret'
-        ? agentHarnessModes('settings', 'get_setting', 'set_setting', 'reset_setting')
-        : agentHarnessModes('workspace_actions', 'settings', 'open_ui_surface'),
+        ? settingsActions('list', 'get', 'set', 'reset')
+        : `${agentHarnessModes('workspace_actions', 'open_ui_surface')} or ${settingsActions('list', 'get', 'set')}`,
       boundary: 'Harness-owned configuration, secret, voice, subscription, and MCP commands can expose credentials or external account state. Mutations require explicit user intent and should prefer secret refs over raw values.',
     };
   }
@@ -183,7 +200,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'connected-host-state',
       confirmation,
-      preferredModelTool: 'agent_reminder_schedule or agent_operator_action',
+      preferredModelTool: 'schedule',
       boundary: 'Connected schedules require an explicit user request and do not create hidden Agent jobs or local schedulers.',
     };
   }
@@ -215,7 +232,7 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
     return {
       effect: 'external-network',
       confirmation,
-      preferredModelTool: agentHarnessModes('settings', 'open_ui_surface'),
+      preferredModelTool: `${settingsActions('get', 'set')} or ${agentHarnessModes('open_ui_surface')}`,
       boundary: 'Live TTS submits a normal prompt and may call model and speech providers; stopping playback is local runtime control.',
     };
   }
@@ -305,103 +322,6 @@ export function describeCommandPolicy(commandName: string): CommandExecutionPoli
   };
 }
 
-export function describeCliCommandPolicy(commandName: string): CommandExecutionPolicy {
-  const root = commandName.trim().toLowerCase();
-  const confirmation = 'agent_harness CLI command modes are discovery-only. Use first-class model tools, workspace actions, slash-command mirrors, or an explicit external shell request to execute equivalent CLI workflows.';
-  if ([
-    'app',
-    'bridge',
-    'control-plane',
-    'controlplane',
-    'cp',
-    'daemon',
-    'http-listener',
-    'launch',
-    'listener',
-    'remote',
-    'serve',
-    'server',
-    'service',
-    'services',
-    'start',
-    'surface',
-    'surfaces',
-    'web',
-    'webhook',
-  ].includes(root)) {
-    return {
-      effect: 'unknown',
-      confirmation,
-      boundary: 'Blocked package CLI token. Agent can launch its own TUI and use public connected-host routes, but it does not manage connected-host lifecycle, listeners, servers, route relays, remotes, web surfaces, or webhook listeners.',
-    };
-  }
-  if (root === 'tui' || root === 'onboarding' || root === 'help' || root === 'version' || root === 'completion') {
-    return {
-      effect: root === 'tui' || root === 'onboarding' ? 'ui-navigation' : 'read-only',
-      confirmation,
-      preferredModelTool: root === 'onboarding' || root === 'tui'
-        ? agentHarnessModes('workspace', 'workspace_actions', 'workspace_action', 'run_workspace_action')
-        : agentHarnessModes('cli_commands', 'cli_command'),
-      boundary: 'Top-level CLI launch, setup, help, version, and completion commands are package entrypoint surfaces; use in-process workspace and slash-command routes from the model when operating inside the TUI.',
-    };
-  }
-  if (root === 'run') {
-    return {
-      effect: 'mixed',
-      confirmation,
-      preferredModelTool: 'current Agent conversation response; do not invoke hidden nested CLI run',
-      boundary: 'The CLI run command starts a non-interactive Agent turn from a process entrypoint. Do not create hidden nested turns from agent_harness; answer the user directly in the current conversation.',
-    };
-  }
-  if (root === 'status' || root === 'doctor' || root === 'auth' || root === 'compat' || root === 'models' || root === 'providers' || root === 'tasks') {
-    return {
-      effect: 'read-only',
-      confirmation,
-      preferredModelTool: root === 'tasks' ? 'agent_operator_briefing' : agentHarnessModes('service_posture', 'service_endpoint', 'connected_host_status', 'connected_host', 'settings', 'tools'),
-      boundary: 'Diagnostics and posture commands are readable from Agent-owned settings, provider, model, and connected-host capability surfaces without taking connected-host lifecycle ownership.',
-    };
-  }
-  if (root === 'profiles' || root === 'personas' || root === 'skills' || root === 'memory' || root === 'routines' || root === 'sessions' || root === 'bundle') {
-    return {
-      effect: 'local-state',
-      confirmation,
-      preferredModelTool: root === 'profiles' ? agentHarnessModes('workspace_actions', 'workspace_action', 'run_workspace_action') : 'agent_local_registry',
-      boundary: 'Local library/profile/session/bundle CLI commands operate on Agent-local data. Mutations require explicit user intent and should use first-class Agent-local tools where available.',
-    };
-  }
-  if (root === 'knowledge' || root === 'ask' || root === 'search') {
-    return {
-      effect: 'mixed',
-      confirmation,
-      preferredModelTool: root === 'knowledge' ? 'agent_knowledge or agent_knowledge_ingest' : 'agent_knowledge',
-      boundary: 'Agent Knowledge CLI commands must stay on isolated Agent Knowledge routes and never fall back to default or non-Agent knowledge spaces.',
-    };
-  }
-  if (root === 'delegate') {
-    return {
-      effect: 'delegated-work',
-      confirmation,
-      preferredModelTool: agentHarnessModes('workspace_actions', 'workspace_action', 'run_workspace_action'),
-      boundary: 'Delegation is explicit user-directed work only; no hidden background review or separate Agent job should be created implicitly.',
-    };
-  }
-  if (root === 'subscription' || root === 'secrets' || root === 'pair') {
-    return {
-      effect: root === 'pair' ? 'external-network' : 'mixed',
-      confirmation,
-      preferredModelTool: root === 'pair'
-        ? agentHarnessModes('workspace_actions', 'workspace_action', 'run_workspace_action')
-        : `${agentHarnessModes('settings', 'get_setting', 'set_setting', 'reset_setting')} or ${agentHarnessModes('workspace_actions')}`,
-      boundary: 'Provider subscription, secret, and pairing flows can expose credentials or external account state. Use only explicit user-directed flows and prefer secret refs over raw values.',
-    };
-  }
-  return {
-    effect: 'unknown',
-    confirmation,
-    boundary: 'Inspect the CLI help, parser result, and preferred model routes before using an equivalent command path.',
-  };
-}
-
 function toolIsAvailable(toolRegistry: ToolRegistry, toolName: string): boolean {
   return toolRegistry.getToolDefinitions().some((tool) => tool.name === toolName);
 }
@@ -411,11 +331,11 @@ function connectedHostCapabilityModelRoute(capability: Record<string, unknown>):
     ? capability.modelTools.filter((tool): tool is string => typeof tool === 'string')
     : [];
   if (modelTools.length > 0) return previewHarnessText(modelTools.join(' or '));
-  return 'agent_harness mode:"connected_host_capability"';
+  return 'host action:"capability"';
 }
 
 function blockedConnectedHostModelRoute(): string {
-  return 'agent_harness mode:"service_posture" or mode:"connected_host_status"';
+  return hostActions('services', 'status');
 }
 
 export function connectedHostCapabilityMap(toolRegistry: ToolRegistry): readonly Record<string, unknown>[] {
@@ -424,10 +344,10 @@ export function connectedHostCapabilityMap(toolRegistry: ToolRegistry): readonly
     modelRoute: connectedHostCapabilityModelRoute(capability),
     harnessRoute: 'agent_harness mode:"connected_host_capability"',
     modelAccess: {
-      inspectCapability: 'agent_harness mode:"connected_host_capability"',
-      liveStatus: 'agent_harness mode:"connected_host_status"',
-      endpointPosture: 'agent_harness mode:"service_posture"',
-      routeFamilies: 'agent_harness mode:"connected_host" includeParameters:true',
+      inspectCapability: 'host action:"capability"',
+      liveStatus: 'host action:"status"',
+      endpointPosture: 'host action:"services"',
+      routeFamilies: 'host action:"capabilities" includeParameters:true',
       operate: connectedHostCapabilityModelRoute(capability),
     },
     available: capability.modelTools.every((toolName) => toolIsAvailable(toolRegistry, toolName)),
@@ -455,10 +375,22 @@ export function connectedHostCapabilityMap(toolRegistry: ToolRegistry): readonly
         'automation.jobs.resume',
         'automation.runs.cancel',
         'automation.runs.retry',
+        'schedules.delete',
+        'schedules.disable',
+        'schedules.enable',
         'schedules.run',
       ],
       purpose: 'Perform one explicit allowlisted approval, automation, run, or schedule action.',
     }),
+    withAvailability({
+      id: 'schedule-edit',
+      effect: 'confirmed-connected-host-state',
+      modelTools: ['schedule', 'agent_schedule_edit'],
+      workspaceCategories: ['automation', 'personal-ops'],
+      slashCommandFamilies: ['schedule'],
+      methodIds: ['automation.jobs.patch'],
+      purpose: 'Edit one explicit connected schedule name, cadence, or prompt.',
+    }),
     withAvailability({
       id: 'agent-knowledge-read',
       effect: 'read-only-network',
@@ -509,11 +441,11 @@ export function connectedHostCapabilityMap(toolRegistry: ToolRegistry): readonly
     withAvailability({
       id: 'reminders-and-schedules',
       effect: 'confirmed-connected-host-state',
-      modelTools: ['agent_reminder_schedule'],
+      modelTools: ['schedule', 'agent_autonomy_schedule', 'agent_reminder_schedule'],
       workspaceCategories: ['automation', 'routines'],
       slashCommandFamilies: ['schedule', 'reminder'],
       scheduleKinds: ['at', 'every', 'cron'],
-      purpose: 'Create one connected reminder schedule from a direct user request.',
+      purpose: 'Create one connected reminder or autonomous Agent schedule from a direct user request.',
     }),
     withAvailability({
       id: 'voice-media',
@@ -564,9 +496,9 @@ export function connectedHostRouteFamilies(): readonly Record<string, unknown>[]
     },
     {
       id: 'connected-schedules',
-      routes: ['public schedule creation/run routes'],
-      modelTools: ['agent_reminder_schedule', 'agent_operator_action'],
-      modelRoute: 'agent_reminder_schedule or agent_operator_action',
+      routes: ['public schedule creation, patch, run, toggle, and delete routes'],
+      modelTools: ['schedule', 'agent_autonomy_schedule', 'agent_reminder_schedule', 'agent_schedule_edit', 'agent_operator_action'],
+      modelRoute: 'schedule action:"list|create|remind|edit|run|pause|resume|delete"',
       boundary: 'Connected schedules only; no hidden local scheduler or separate Agent job.',
     },
   ];
@@ -624,15 +556,15 @@ function connectedHostCapabilityDetail(entry: { readonly status: 'allowed' | 'bl
       harnessRoute: 'agent_harness mode:"connected_host_capability"',
       relatedRouteFamilies: relatedConnectedHostRouteFamilies(entry.capability),
       modelAccess: {
-        inspectCapability: 'agent_harness mode:"connected_host_capability"',
-        connectedHostInventory: 'agent_harness mode:"connected_host" includeParameters:true',
-        liveStatus: 'agent_harness mode:"connected_host_status"',
-        endpointPosture: 'agent_harness mode:"service_posture"',
+        inspectCapability: 'host action:"capability"',
+        connectedHostInventory: 'host action:"capabilities" includeParameters:true',
+        liveStatus: 'host action:"status"',
+        endpointPosture: 'host action:"services"',
         operate: connectedHostCapabilityModelRoute(entry.capability),
       },
-      operatorMethodMode: 'Use agent_harness mode:"operator_methods" for the public operator and Agent Knowledge method catalog. Use mode:"operator_method" for one method.',
-      servicePostureMode: 'Use agent_harness mode:"service_posture" for endpoint binding, network-facing posture, issue, and redacted-log diagnostics. Use mode:"service_endpoint" for one endpoint.',
-      statusMode: 'Use agent_harness mode:"connected_host_status" for live read-only reachability, token posture, and Agent Knowledge route readiness.',
+      operatorMethodMode: 'Use host action:"methods" for the public operator and Agent Knowledge method catalog. Use action:"method" for one method.',
+      servicePostureMode: 'Use host action:"services" for endpoint binding, network-facing posture, issue, and redacted-log diagnostics. Use action:"service" for one endpoint.',
+      statusMode: 'Use host action:"status" for live read-only reachability, token posture, and Agent Knowledge route readiness.',
       boundary: 'Use only the listed first-class model tools, slash-command families, and workspace categories. Mutations still require explicit confirmation through those tools or command routes.',
     };
   }
@@ -644,15 +576,15 @@ function connectedHostCapabilityDetail(entry: { readonly status: 'allowed' | 'bl
     allowed: false,
     available: false,
     modelAccess: {
-      inspectCapability: 'agent_harness mode:"connected_host_capability"',
-      connectedHostInventory: 'agent_harness mode:"connected_host" includeParameters:true',
-      liveStatus: 'agent_harness mode:"connected_host_status"',
-      endpointPosture: 'agent_harness mode:"service_posture"',
+      inspectCapability: 'host action:"capability"',
+      connectedHostInventory: 'host action:"capabilities" includeParameters:true',
+      liveStatus: 'host action:"status"',
+      endpointPosture: 'host action:"services"',
       operate: 'not exposed',
     },
     boundary: 'This connected-host surface is intentionally not exposed to the model as an Agent operation.',
-    servicePostureMode: 'Use agent_harness mode:"service_posture" or mode:"service_endpoint" only for read-only endpoint diagnostics.',
-    statusMode: 'Use agent_harness mode:"connected_host_status" only for read-only readiness diagnostics.',
+    servicePostureMode: 'Use host action:"services" or action:"service" only for read-only endpoint diagnostics.',
+    statusMode: 'Use host action:"status" only for read-only readiness diagnostics.',
   };
 }
 
@@ -693,8 +625,8 @@ export function connectedHostSummary(
     baseUrl: connection.baseUrl,
     operatorToken: connection.token ? 'configured' : 'missing',
     tokenPath: connection.tokenPath,
-    ownership: 'external-connected-host',
-    lifecycle: 'GoodVibes Agent can use public connected-host operator routes, but does not start, stop, restart, install, expose, or mutate the host listener.',
+    ownership: 'goodvibes-daemon',
+    lifecycle: 'GoodVibes Agent can inspect daemon posture and use confirmed operator methods for supported service lifecycle/listener changes.',
     modes: {
       servicePosture: agentHarnessModes('service_posture', 'service_endpoint'),
       operatorMethods: agentHarnessModes('operator_methods', 'operator_method'),
@@ -702,15 +634,15 @@ export function connectedHostSummary(
       capabilityDetail: agentHarnessModes('connected_host_capability'),
       daemonAliases: agentHarnessModes('daemon', 'daemon_status'),
     },
-    modelRoute: 'agent_harness mode:"connected_host" or mode:"connected_host_capability"',
+    modelRoute: hostActions('capabilities', 'capability'),
     modelAccess: {
-      inventory: 'agent_harness mode:"connected_host" includeParameters:true',
-      liveStatus: 'agent_harness mode:"connected_host_status"',
-      capabilityDetail: 'agent_harness mode:"connected_host_capability" capabilityId:"..."',
-      servicePosture: 'agent_harness mode:"service_posture"',
+      inventory: 'host action:"capabilities" includeParameters:true',
+      liveStatus: 'host action:"status"',
+      capabilityDetail: 'host action:"capability" capabilityId:"..."',
+      servicePosture: 'host action:"services"',
       daemonAliases: 'agent_harness mode:"daemon" or mode:"daemon_status"',
       daemonStatusAlias: 'agent_harness mode:"daemon_status"',
-      lifecycleBlocked: 'start, stop, restart, install, upgrade, expose-listener, and listener mutation are not exposed through Agent.',
+      lifecycle: 'use setup or agent_operator_method with confirm:true and explicitUserRequest for supported daemon service methods.',
     },
     counts: {
       routeFamilies: routeFamilies.length,
@@ -730,16 +662,16 @@ export function blockedConnectedHostCapabilities(): readonly Record<string, unkn
   return [
     {
       id: 'connected-host-lifecycle',
-      blocked: ['start', 'stop', 'restart', 'install', 'upgrade', 'expose-listener', 'mutate-listener'],
-      modelRoute: blockedConnectedHostModelRoute(),
+      confirmationGated: ['start', 'stop', 'restart', 'install', 'upgrade', 'expose-listener', 'mutate-listener'],
+      modelRoute: 'agent_operator_method',
       harnessRoute: 'agent_harness mode:"connected_host_capability"',
       modelAccess: {
-        inspectCapability: 'agent_harness mode:"connected_host_capability"',
-        liveStatus: 'agent_harness mode:"connected_host_status"',
-        endpointPosture: 'agent_harness mode:"service_posture"',
-        operate: 'not exposed',
+        inspectCapability: 'host action:"capability"',
+        liveStatus: 'host action:"status"',
+        endpointPosture: 'host action:"services"',
+        operate: 'agent_operator_method with confirm:true and explicitUserRequest when the daemon contract exposes the method',
       },
-      reason: 'The connected host and listener are externally owned by GoodVibes; Agent can use public operator routes but not manage hosting.',
+      reason: 'Lifecycle changes are powerful daemon operations. They are available only through explicit setup or confirmed operator methods, never as ambient background side effects.',
     },
     {
       id: 'non-agent-knowledge',
@@ -747,48 +679,48 @@ export function blockedConnectedHostCapabilities(): readonly Record<string, unkn
       modelRoute: blockedConnectedHostModelRoute(),
       harnessRoute: 'agent_harness mode:"connected_host_capability"',
       modelAccess: {
-        inspectCapability: 'agent_harness mode:"connected_host_capability"',
+        inspectCapability: 'host action:"capability"',
         allowedAgentKnowledge: 'agent_knowledge or agent_knowledge_ingest',
-        liveStatus: 'agent_harness mode:"connected_host_status"',
+        liveStatus: 'host action:"status"',
         operate: 'not exposed',
       },
       reason: 'Agent model tools must stay inside the isolated Agent Knowledge route family.',
     },
     {
       id: 'hidden-background-work',
-      blocked: ['separate-agent-jobs', 'implicit-delegated-review', 'local-schedulers'],
+      blocked: ['hidden-agent-jobs', 'implicit-delegated-review', 'untracked-local-schedulers'],
       modelRoute: blockedConnectedHostModelRoute(),
       harnessRoute: 'agent_harness mode:"connected_host_capability"',
       modelAccess: {
-        inspectCapability: 'agent_harness mode:"connected_host_capability"',
-        allowedDelegation: 'agent_harness mode:"delegation_posture"',
-        liveStatus: 'agent_harness mode:"connected_host_status"',
-        operate: 'not exposed',
+        inspectCapability: 'host action:"capability"',
+        allowedAutonomy: 'agent tool spawn/batch-spawn, schedules, automation jobs, or confirmed delegation with visible status/cancel routes',
+        liveStatus: 'host action:"status"',
+        operate: 'use a visible autonomy route',
       },
-      reason: 'All model work is serial and visible unless the user explicitly requests delegation through an exposed surface.',
+      reason: 'Autonomy is allowed when it is visible, statused, and cancellable. Hidden jobs are blocked.',
     },
     {
       id: 'arbitrary-connected-host-mutations',
-      blocked: ['route-discovery-mutation', 'account-creation', 'automation-definition-creation'],
-      modelRoute: blockedConnectedHostModelRoute(),
+      confirmationGated: ['route-discovery-mutation', 'account-creation', 'automation-definition-creation'],
+      modelRoute: 'agent_operator_method',
       harnessRoute: 'agent_harness mode:"connected_host_capability"',
       modelAccess: {
-        inspectCapability: 'agent_harness mode:"connected_host_capability"',
-        allowedActions: 'agent_operator_action for documented allowlisted mutations only',
-        liveStatus: 'agent_harness mode:"connected_host_status"',
-        operate: 'not exposed',
+        inspectCapability: 'host action:"capability"',
+        allowedActions: 'agent_operator_action for simple allowlisted mutations or agent_operator_method for exact confirmed daemon contract methods',
+        liveStatus: 'host action:"status"',
+        operate: 'agent_operator_method with confirm:true and explicitUserRequest',
       },
-      reason: 'Only the documented allowlisted model tools and slash-command routes are exposed.',
+      reason: 'Daemon mutations must resolve to a documented SDK operator method and carry explicit user authorization.',
     },
   ];
 }
 
 export function settingsPolicySummary(): Record<string, unknown> {
   return {
-    discovery: 'Use mode:"settings" for the setting catalog and mode:"get_setting" with key, target, or query for one setting. Hidden/scriptable settings require includeHidden:true unless the exact key is supplied.',
-    mutation: 'Use mode:"set_setting" or mode:"reset_setting" with key, target, or query plus confirm:true and explicitUserRequest; ambiguous setting lookups are refused.',
+    discovery: 'Use settings action:"list" for the setting catalog and action:"get" with key, target, or query for one setting. Hidden/scriptable settings require includeHidden:true unless the exact key is supplied.',
+    mutation: 'Use settings action:"set" or action:"reset" with key, target, or query plus confirm:true and explicitUserRequest; ambiguous setting lookups are refused.',
     secretHandling: 'Raw secret values are persisted through the secret manager; config receives only a secret reference and tool output is redacted.',
     writablePolicy: 'Each setting descriptor includes writable, visibleInWorkspace, and lockReason when applicable.',
-    readOnlyHostOwnedPrefixes: ['service.*', 'controlPlane.*', 'httpListener.*', 'web.*', 'danger.daemon.*', 'danger.httpListener.*'],
+    protectedRawDangerKeys: ['danger.daemon', 'danger.httpListener'],
   };
 }