You are reading Nightly documentation for 0.12.4.dev0+g50bde75.

This documentation may describe behavior that differs from Stable.

Documentation version

0.12.4.dev0+g50bde75 · Nightly

0.12.4.dev0+g50bde75 Nightly

Stable Beta Nightly

Holaryn Agent capability matrix

Generated by scripts/generate_capabilities.py from
holaryn_agent.capabilities. Do not edit this page directly.

The installed package is the version authority. Run holaryn --version for the exact
build and holaryn capabilities for its release channel and capability counts.

Summary

Public capabilities: 70
Stable: 19
Beta: 44
Experimental: 7
Planned: 0

Maturity describes the Holaryn integration, not the availability, terms, or quality of
a third-party provider. A capability marked stable can still have the limitations
listed below.

Canonical sources

Api Schemas: typed Python API payloads and frontend TypeScript contracts
Commands: holaryn_agent.cli.build_parser
Feature Flags: typed Settings fields and runtime availability probes
Install Methods: README generated block and docs/install.md
Model Capabilities: provider registry model CapabilityDescriptor records
Platform Support: pyproject classifiers, CI operating-system matrix, and this registry
Providers: holaryn_agent.providers.catalog.PROVIDER_PRESETS
Release Channel: PEP 440 classification of the installed package version
Roadmap: Jira SA board; repository planning documents are dated snapshots
Settings: webui/frontend/src/settings/manifest.ts
Skills Plugins: skill and plugin runtime manifests
Tools: holaryn_agent.tools.native and holaryn_agent.tools.coding factories
Version: installed package metadata (holaryn_agent.version)

Matrix

Transparent adaptive model routing (`agent.adaptive-routing`)

An opt-in deterministic router chooses eligible models by task role, capability, privacy, reliability, latency, cost, cache opportunity, and explicit preference while preserving manual pins.

Area / maturity: Models / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: None
Network: provider-dependent
Privacy: Local-only and local-to-cloud rules are hard gates; retained decisions are content-free, aggregate outcome learning is off until consented, and all routing telemetry can be reset.
Approval: Enabling adaptive routing, changing policy, allowing local-to-cloud movement, and opting into aggregate learning are explicit operator settings actions.
Limitations: Routing metadata and price estimates are operator/provider inputs, unknown cost or latency becomes ineligible only when a corresponding hard ceiling is configured, and invocation recovery remains the separate failover subsystem.
Documentation: user-guide/adaptive-routing.md
Verification: tests/test_adaptive_routing.py, tests/test_routing_settings_api.py, src/holaryn_agent/webui/frontend/src/settings/models/ModelsPage.test.tsx, docs/adaptive-routing-adr.md
Inventory: Commands: holaryn routing
Inventory: Settings: models

Durable bounded goals (`agent.durable-goals`)

Versioned goals continue through the ordinary host boundary with leases, multidimensional budgets, explicit authority, evidence-driven completion, and conservative restart recovery.

Area / maturity: Core agent / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: Persistent Holaryn host for autonomous continuation
Network: provider-dependent
Privacy: Goal metadata, budget ledgers, evidence, blockers, and decisions persist locally; redacted export is the default.
Approval: Scope, budget, workspace, continuation, and authority expansion requires a named reviewer; underlying tools retain normal approval policy.
Limitations: Prepared attempts resume exactly once, but a non-journaled attempt interrupted after dispatch is paused as uncertain and must be reviewed.
Documentation: docs/durable-goals.md
Verification: tests/test_goals.py, tests/test_host_goals.py, tests/test_goal_operator_api.py, tests/test_cli_goal.py, src/holaryn_agent/webui/frontend/src/operator/GoalsPage.test.tsx, src/holaryn_agent/webui/frontend/e2e/goals.spec.ts
Inventory: Commands: holaryn goal

Local model lifecycle and hardware manager (`agent.local-model-lifecycle`)

Holaryn can assess local hardware, import or adopt models, supervise Ollama and llama.cpp endpoints, benchmark them, and route them through the ordinary provider registry.

Area / maturity: Core agent / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: Ollama or llama.cpp for managed serving; Enough disk and memory for the selected model
Network: optional
Privacy: Hardware inventory, model metadata, roles, health, and benchmark metrics stay local; only an explicit HTTPS download or adopted non-loopback provider can use the network.
Approval: Downloads, endpoint scans, launches, benchmarks, role changes, and owned-file removal are explicit operator actions; removal requires confirmation.
Limitations: Hardware fit is advisory, built-in catalog entries do not guess mutable artifact URLs, and Holaryn cannot safely stop processes it did not launch in the current host process.
Documentation: user-guide/local-models.md
Verification: tests/test_local_models.py, src/holaryn_agent/webui/frontend/src/settings/models/LocalModelsSection.test.tsx
Inventory: Commands: holaryn local-model
Inventory: Settings: models

Durable agent loop (`agent.loop`)

Typed streaming turns, crash-safe checkpoints, cursor reattachment, fenced host recovery, tool outcomes, cancellation, steering, and terminal trace export share one event model.

Area / maturity: Core agent / stable
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: None
Network: none
Privacy: Prompts and responses stay local except when sent to the selected model provider; durable events, checkpoints, tool evidence, artifacts, and trace exports are redacted and use optional state encryption.
Approval: Tool calls pass through the configured consequence-aware approval policy.
Limitations: A configured model is required for model-backed turns; an external side effect interrupted before its durable outcome requires explicit operator review unless the external system proves idempotency.
Documentation: docs/durable-runs.md
Verification: tests/test_loop.py, tests/test_run_journal_phase16.py, tests/test_run_durability_sa141.py, docs/crash-safe-runs-adr.md
Inventory: Commands: holaryn run, holaryn runs, holaryn status, holaryn resume, holaryn steer
Inventory: Settings: general

Resumable first-success onboarding (`agent.onboarding`)

Desktop, CLI, Compose, source, and offline activation paths share versioned recovery, provider setup, model roles, a safe posture, streamed verification, and an approval-gated reversible demo.

Area / maturity: Core agent / stable
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: None
Network: provider-dependent
Privacy: Milestones exclude credentials, prompts, responses, outputs, and user paths.
Approval: The generated-file demo always requires an explicit decision.
Limitations: The demo writes only beneath the generated onboarding state sandbox; external moderated-usability evidence is tracked separately.
Documentation: user-guide/onboarding.md
Verification: tests/test_onboarding.py, tests/test_onboarding_api.py, tests/test_onboarding_cli.py, src/holaryn_agent/webui/frontend/e2e/onboarding.spec.ts
Inventory: Commands: holaryn onboard

Prompt caching and deterministic prefix optimization (`agent.prompt-cache`)

Opt-in provider prefix caching uses canonical segments, provider-aware boundaries, complete authorization isolation, content-free diagnostics, and paired quality/cost/latency evidence.

Area / maturity: Core agent / beta
Owner: Holaryn Agent maintainers
Surfaces: web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: None
Network: provider-dependent
Privacy: Caching is off by default; provider retention requires explicit consent, restricted data stops the prefix, and local diagnostics contain only hashes, sizes, ids, token aggregates, latency, and estimates.
Approval: Changing cache mode or accepting provider retention is an operator model-settings action.
Limitations: Provider minimums, TTLs, reporting, prices, data policies, and cache availability vary by model and account; unknown metrics remain unknown.
Documentation: user-guide/prompt-caching.md
Verification: tests/test_prompt_caching.py, src/holaryn_agent/webui/frontend/src/settings/models/ModelsPage.test.tsx, docs/prompt-caching-adr.md
Inventory: Settings: models

Provider credential pools and fair capacity (`agent.provider-capacity`)

Authorized compatible connections share durable quota, rate, health, priority, and weighted-fair scheduling with sticky-account and drain/revoke controls.

Area / maturity: Core agent / beta
Owner: Holaryn Agent maintainers
Surfaces: web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: None
Network: provider-dependent
Privacy: Pool state stores opaque connection ids, safe aliases, content-free scope hashes, and aggregate usage only; raw credentials never enter the pool database or diagnostics.
Approval: Creating or changing a pool is an operator settings action; revocation requires a destructive confirmation and discards late results from cancelled leases.
Limitations: Pools coordinate one Holaryn state directory and compatible provider wire adapters; configured forecast accuracy bounds token and spend reservation accuracy.
Documentation: docs/credential-pools-adr.md
Verification: tests/test_credential_pools.py, src/holaryn_agent/webui/frontend/src/settings/models/CredentialPoolsSection.test.tsx
Inventory: Settings: models

Safe provider recovery and circuit breaking (`agent.provider-resilience`)

An opt-in provider-neutral coordinator applies normalized failure policy, bounded pre-response retries, eligible-model failover, partial-output retention, and durable single-probe circuit breakers without replaying consequential tools.

Area / maturity: Models / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: None
Network: provider-dependent
Privacy: Circuit and attempt state is content-free and bounded; prompts, responses, tool arguments/results, credentials, and provider error bodies are excluded and diagnostics can be reset.
Approval: Recovery is disabled by default; enabling it, changing fallback/action policy, allowing fallback from a pinned model, and resetting circuits/traces are explicit operator settings actions.
Limitations: Automatic recovery is prohibited after visible output, cancellation, a safety refusal, invalid/auth/unknown failures, or consequential tool results; live provider behavior, billing, and registry metadata remain provider/operator inputs.
Documentation: user-guide/provider-recovery.md
Verification: tests/test_provider_resilience.py, tests/test_resilience_settings_api.py, src/holaryn_agent/webui/frontend/src/settings/models/ResilienceSection.test.tsx, docs/provider-resilience-adr.md, benchmarks/baselines/provider-resilience-v1.json
Inventory: Settings: models

Provider and model registry (`agent.providers`)

Curated API, subscription, aggregator, local, and custom connections feed capability-aware model routing.

Area / maturity: Core agent / stable
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api
Platforms: windows, macos, linux
Prerequisites: None
Network: provider-dependent
Privacy: Credentials use the write-only secret store or explicit environment variables.
Approval: Connection creation and sign-in are operator actions.
Limitations: Available models and terms remain controlled by each provider.
Documentation: user-guide/connections-and-models.md
Verification: tests/test_provider_catalog.py, tests/test_provider_foundation_phase23.py
Inventory: Commands: holaryn connection
Inventory: Settings: models
Inventory: Provider presets: openai, anthropic, gemini, mistral, deepseek, xai, groq, cerebras, together, fireworks, deepinfra, moonshot, qwen, zai, perplexity, nvidia-nim, sambanova, minimax, openrouter, huggingface, chatgpt, github-copilot, zai-coding, ollama, lmstudio, vllm, llamacpp, custom

Evidence-gated self-improvement (`agent.safe-self-improvement`)

Privacy-safe outcome clusters become complete hypotheses, isolated patches, reproducible gates, independent reviews, and deterministic bounded rollouts with automatic rollback.

Area / maturity: Core agent / experimental
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: Git worktree support for patch preparation; Independent reviewer for promotion authorization
Network: none
Privacy: Signals contain stable references and cluster keys rather than prompts or outputs; collection can be disabled and retained proposal data explicitly deleted.
Approval: Ordinary authority cannot mutate the active install or protected controls; protected, high-risk, and evaluation-control changes need two distinct elevated reviewers.
Limitations: Promotion records an authorization artifact only. Patch application, production deployment, online experimentation, and unsupervised control-plane mutation are not included.
Documentation: user-guide/self-improvement.md
Verification: tests/test_selfimprove_safe.py, tests/test_selfimprove_operator_api.py, tests/test_cli_self_improve.py, tests/test_selfimprove_wiring.py, src/holaryn_agent/webui/frontend/src/operator/SelfImprovementPage.test.tsx
Inventory: Commands: holaryn self-improve

Schema-constrained model outputs (`agent.structured-outputs`)

Versioned JSON Schema contracts provide provider-native enforcement when available, canonical local validation, bounded repair, typed failures, privacy-safe evidence, and accessible result rendering.

Area / maturity: Models / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: None
Network: provider-dependent
Privacy: Unvalidated response text is buffered; traces retain contract identity, validation state, usage, known cost, and hashes without raw candidate content by default.
Approval: Structured output does not bypass tool, connector, workflow, or artifact approval policy.
Limitations: Schema compliance does not prove factual correctness; native keyword support and limits vary by provider, while unsupported models require the bounded prompt fallback unless native enforcement is mandatory.
Documentation: docs/structured-outputs.md
Verification: tests/test_structured_outputs.py, src/holaryn_agent/webui/frontend/src/messages/ChatSurface.test.tsx

Privacy-reviewed training-data exports (`agent.trajectory-export`)

Operator-selected successful runs become deterministic OpenAI chat, ShareGPT, or versioned Holaryn episode JSONL through a stale-safe preview, redaction report, exact consent boundary, and digest-bound local provenance.

Area / maturity: Core agent / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: A durable completed run owned by the local operator; Explicit review of the privacy preview and exact export consent
Network: none
Privacy: System messages, context, and tool results are omitted by default; registered secrets, secret-like values, common PII, private paths, metadata, and operator-supplied exact private values are redacted without persisting match values. Hidden chain-of-thought is never collected or exported.
Approval: Preview has no side effect; export recomputes and binds the exact source, options, redaction report, and private-value fingerprints before accepting the exact consent phrase. Digest-safe deletion has a separate force confirmation for changed files.
Limitations: Export does not upload data, start fine-tuning, promote memory, or change routing; images are reduced to available alt text, historical compacted runs fail closed, and pattern redaction cannot replace operator review.
Documentation: user-guide/training-data.md
Verification: tests/trajectories/test_service.py, tests/trajectories/test_redaction.py, tests/test_trajectory_cli.py, tests/test_trajectory_api.py, src/holaryn_agent/webui/frontend/src/operator/TrainingDataPage.test.tsx, docs/trajectory-export-adr.md
Inventory: Commands: holaryn trajectories

Reusable declarative workflows and runbooks (`agent.workflows`)

Immutable typed workflow versions provide safe branching, bounded fan-out, approvals, waits, retries, durable restart recovery, triggers, imports, curated recipes, artifacts, and audited supervision.

Area / maturity: Core agent / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: Persistent Holaryn host for scheduled, event-driven, and restart-resilient execution; Configured models, tools, connectors, and secret handles required by a selected recipe
Network: provider-dependent
Privacy: Definitions and durable step state remain local; secret values are opaque handles, imported programs are disabled pending review, and dry-run performs no model, tool, connector, or artifact action.
Approval: Every consequential step still traverses canonical policy and approval; imports expose permission, dependency, secret, network, risk, trigger, and consequence changes before enablement.
Limitations: Expressions are a small non-executable language, loops and budgets are bounded, interrupted non-idempotent side effects require manual recovery, and irreversible third-party compensation cannot be guaranteed.
Documentation: user-guide/workflows.md
Verification: tests/workflows/test_models_io.py, tests/workflows/test_store.py, tests/workflows/test_runtime_service.py, tests/test_workflow_cli.py, tests/test_workflows_api.py, src/holaryn_agent/webui/frontend/src/operator/WorkflowsPage.test.tsx, docs/workflows.md
Inventory: Commands: holaryn workflow

Durable batch and dataset runner (`automation.batch-datasets`)

Versioned CSV, TSV, and JSONL datasets feed bounded, isolated per-row agent runs with preflight estimates, durable attempts, filtered retry, linked exports, and aggregate reports.

Area / maturity: Automation / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: Persistent Holaryn host for unattended batch execution
Network: provider-dependent
Privacy: Dataset rows, prompts, outputs, item errors, and usage are stored locally; selected providers receive each rendered row prompt, and cross-row memory is disabled by default.
Approval: Tools are unavailable unless explicitly allowlisted; every allowed tool still follows ordinary unattended approval and consequence policy.
Limitations: Inputs are local materialized files in this release. Parquet-ready export writes linked JSONL plus a schema sidecar rather than a binary Parquet file.
Documentation: user-guide/batch-datasets.md
Verification: tests/test_batch.py, tests/test_cli_batch.py, tests/test_batch_operator_api.py, tests/test_host_batch.py, src/holaryn_agent/webui/frontend/src/operator/BatchesPage.test.tsx, src/holaryn_agent/webui/frontend/e2e/batches.spec.ts
Inventory: Commands: holaryn batch

First-party browser agent (`automation.browser`)

A host-owned Chromium engine provides isolated or opt-in persistent sessions, semantic-first navigation and forms, bounded research, supervised takeover, quarantined downloads, and redacted traces without requiring Node or npx.

Area / maturity: Automation / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: None
Network: optional
Privacy: Ephemeral profiles are the default; persistent cookies are opt-in, page content is untrusted, credentials are never traced, and downloads remain quarantined artifacts.
Approval: Typing, uploads, final submission, browser control, and other interactions pass through consequence-aware approval; direct API actions require an explicit approval field.
Limitations: Chromium is the shipping engine; Firefox and WebKit can implement the engine contract later. CAPTCHAs, anti-bot bypass, and control of a user's existing browser are excluded.
Documentation: user-guide/browser-agent.md
Verification: tests/browser/test_manager.py, tests/browser/test_playwright_engine.py, tests/test_browser_api.py, src/holaryn_agent/webui/frontend/src/browser/BrowserApp.test.tsx
Inventory: Commands: holaryn browser
Inventory: Tools: browser_start, browser_navigate, browser_observe, browser_action, browser_research, browser_status, browser_control

Accessibility-native computer use (`automation.computer-use`)

A crash-isolated Windows UI Automation helper exposes bounded semantic application trees, expiring element identities, supervised controls, selected-window screenshots, approval-gated fallback, and redacted action traces.

Area / maturity: Automation / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api
Platforms: windows
Prerequisites: None
Network: none
Privacy: Only the explicitly selected application window is observed; credential values and sensitive titles are redacted, whole-desktop continuous capture is disabled, and secure desktop is never automated.
Approval: Application launch, value entry, keyboard input, sensitive controls, close operations, and every visual fallback pass through consequence-aware approval.
Limitations: Windows UI Automation ships first. macOS AX and Linux AT-SPI can implement the conformance-tested platform contract later. Elevated/secure desktops, credential managers, games, DRM, and anti-automation bypass are excluded.
Documentation: user-guide/computer-use.md
Verification: tests/computer_use/test_manager.py, tests/computer_use/test_conformance.py, tests/computer_use/test_windows_uia.py, tests/test_computer_api.py, src/holaryn_agent/webui/frontend/src/computer/ComputerApp.test.tsx
Inventory: Commands: holaryn computer
Inventory: Tools: computer_start, computer_observe, computer_action, computer_status, computer_control

Durable proactive event sources (`automation.event-sources`)

Webhooks, folder changes, timers, and connector deltas share cursors, deduplication, filtering, source-local circuits, and replayable delivery traces.

Area / maturity: Automation / stable
Owner: Holaryn Agent maintainers
Surfaces: web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: Persistent Holaryn host for polling and unattended execution
Network: optional
Privacy: Events store bounded provenance metadata and payload references; folder events never store file content.
Approval: Detection never grants authority; every triggered run follows its profile, policy, budget, and ordinary approvals.
Limitations: Connector adapters must supply their delta events; uncertain crash outcomes require operator review before replay.
Documentation: user-guide/event-sources.md
Verification: tests/test_event_sources.py, tests/test_operator_api.py, tests/test_webhooks.py
Inventory: Settings: networking

Secure lifecycle hooks (`automation.lifecycle-hooks`)

Versioned blocking and observational hooks add deterministic policy, formatting, tests, notifications, webhooks, and audit automation at agent lifecycle boundaries.

Area / maturity: Automation / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: Explicit trust for project hook files
Network: optional
Privacy: Handlers receive a bounded, redacted event payload and a minimal environment; project process hooks require an isolated execution backend.
Approval: Hooks may deny, mutate explicitly allowlisted fields, or request ordinary approval, but every resulting action is revalidated by normal tool, path, governance, and approval policy.
Limitations: Project hook trust is bound to the exact file digest; changed files stop executing until reviewed and trusted again.
Documentation: user-guide/lifecycle-hooks.md
Verification: tests/hooks/test_models_store.py, tests/hooks/test_executor_service.py, tests/test_hook_cli.py, tests/test_hooks_api.py, tests/test_worktree_sessions.py, src/holaryn_agent/webui/frontend/src/settings/pages/HooksPage.test.tsx
Inventory: Commands: holaryn hook
Inventory: Settings: hooks

Durable scheduler (`automation.scheduler`)

Cron, interval, one-shot, and natural-language schedules survive host restarts and support profiles and team posts.

Area / maturity: Automation / stable
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, service
Platforms: windows, macos, linux
Prerequisites: Persistent Holaryn host for unattended execution
Network: provider-dependent
Privacy: Schedule definitions are local; a run follows the selected provider and tool privacy rules.
Approval: Unattended actions that need approval park in the operator inbox.
Limitations: The host must be running when a schedule becomes due.
Documentation: user-guide/scheduler-and-automation.md
Verification: tests/test_cli_schedule_phase13.py, tests/test_scheduler_nl_model.py
Inventory: Commands: holaryn schedule

Authenticated webhook triggers (`automation.webhooks`)

Stable webhook events enter a durable deduplicated trigger lifecycle; legacy scheduled-job firing remains compatible.

Area / maturity: Automation / stable
Owner: Holaryn Agent maintainers
Surfaces: web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: Explicit listener exposure; Configured webhook token
Network: required
Privacy: Bounded metadata and a payload reference are stored locally; raw payloads and credentials are not stored in the event database.
Approval: Webhook runs use unattended approval rules and park sensitive actions.
Limitations: No public relay or managed ingress is included; keep the dedicated token behind HTTPS.
Documentation: docs/webhooks.md
Verification: tests/test_webhooks.py, tests/test_event_sources.py
Inventory: Settings: networking

Evidence-driven code validation (`coding.validation`)

Deterministic discovery builds tiered lint, format, type, test, and package plans; execution records revision-bound diagnostics, honest unverified states, and bounded repair attempts.

Area / maturity: Coding / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: None
Network: none
Privacy: Validation runs only in the selected workspace with a minimal environment; secret-like variables are withheld and persisted output is redacted.
Approval: Fixed checks may run under validation policy; repository-provided commands show their exact argv, cwd, and provenance and require explicit project-command trust.
Limitations: Validation proves only the recorded gates for one exact workspace state; it does not prove complete program correctness.
Documentation: user-guide/automatic-validation.md
Verification: tests/test_coding_validation.py, src/holaryn_agent/webui/frontend/src/code/ValidationPanel.test.tsx, benchmarks/baselines/validation-evidence-v1.json
Inventory: Commands: holaryn validate

Secure mobile and edge device capabilities (`collaboration.device-nodes`)

A paired phone or edge node advertises narrow OS-mediated capabilities with independent permissions and grants, exact approval-bound invocations, expiring nonces, provenance, and resumable integrity-checked artifacts.

Area / maturity: Collaboration / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, mobile, api, service
Platforms: windows, macos, linux
Prerequisites: Mobile supervision enabled and the device explicitly paired; HTTPS outside loopback and a trusted private network path; A supported device/browser capability and its local OS permission
Network: required
Privacy: The server journals bounded invocation/provenance metadata; camera, location, notification, and selected-file content move only after an exact device-side confirmation.
Approval: The canonical invoke tool uses ordinary approval policy bound to the exact device, capability, parameters, data movement, and expiry; OS permission and server grant remain independent.
Limitations: The reference PWA provides camera, location, notification, and selected-file capabilities; it is not an agent runtime and cannot execute arbitrary tools.
Documentation: user-guide/device-capability-nodes.md
Verification: tests/test_device_nodes.py, tests/test_device_node_api.py, tests/test_cli_device.py, src/holaryn_agent/webui/frontend/src/mobile/DeviceNodePanel.test.tsx
Inventory: Commands: holaryn device
Inventory: Settings: networking

Mobile supervision pocket console (`collaboration.mobile-supervision`)

A paired installable PWA monitors active and recent work, presents exact approval evidence, answers questions, controls runs, opens artifacts, and delivers privacy-safe Web Push alerts.

Area / maturity: Collaboration / beta
Owner: Holaryn Agent maintainers
Surfaces: web, desktop, mobile, api, service
Platforms: windows, macos, linux
Prerequisites: Persistent Holaryn host with mobile supervision explicitly enabled; HTTPS outside loopback and a trusted private network path; A browser with IndexedDB; Web Push support is optional
Network: required
Privacy: Device credentials and cached summaries are encrypted in browser-local non-extractable storage; lock-screen previews hide sensitive content by default.
Approval: Decisions are bound to the exact request digest and an idempotency key; high-impact categories remain desktop-only until verified step-up authentication is available.
Limitations: No public tunnel, native background service, arbitrary phone tool execution, mobile terminal/editor, or mobile high-impact approval is included; narrow device capabilities have a separate boundary.
Documentation: user-guide/mobile-supervision.md
Verification: tests/test_mobile.py, tests/test_mobile_api.py, src/holaryn_agent/webui/frontend/src/mobile/MobileApp.test.tsx, src/holaryn_agent/webui/frontend/e2e/mobile.spec.ts

Paired peer agents (`collaboration.peers`)

LAN discovery, authenticated pairing, enable/disable controls, remote targets, and ask/send bridge agents across machines.

Area / maturity: Collaboration / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: Reachable peer host; Explicit pairing
Network: required
Privacy: Only addressed peer traffic crosses the authenticated link.
Approval: Pairing and re-enabling a peer are explicit operator actions.
Limitations: Discovery is LAN-scoped; internet routing is user-managed.
Documentation: docs/peers.md
Verification: tests/test_peers_phase1.py, tests/test_peers_phase3.py
Inventory: Commands: holaryn peer
Inventory: Settings: networking

Delegated subagents (`collaboration.subagents`)

Child runs support live progress, questions, steering, cancellation, and bounded budgets.

Area / maturity: Collaboration / stable
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api
Platforms: windows, macos, linux
Prerequisites: None
Network: provider-dependent
Privacy: Each child shares only the context and workspace explicitly assigned to it.
Approval: Child tools remain subject to policy; questions return to the operator.
Limitations: Parallel capacity depends on provider and host limits.
Documentation: user-guide/subagents.md
Verification: tests/test_subagents_phase15.py, tests/test_host_questions_phase151.py
Inventory: Commands: holaryn question

Durable multi-agent task graphs (`collaboration.task-graphs`)

Typed DAGs coordinate ready-only parallel work, joins, retries, recovery, evidence, and explicit integration across Agent Teams.

Area / maturity: Collaboration / beta
Owner: Holaryn Agent maintainers
Surfaces: web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: Persistent Holaryn host; An active Agent Team
Network: provider-dependent
Privacy: Graph state and evidence persist locally; assigned work follows the selected team member's provider policy.
Approval: Graph expansion and uncertain-attempt recovery require explicit operator decisions; member tools retain normal approval policy.
Limitations: Cross-host peer members are not eligible until a durable remote completion and lease protocol ships.
Documentation: docs/task-graphs.md
Verification: tests/test_task_graphs.py

Shareable reproducible task packages (`collaboration.task-packages`)

Versioned template, snapshot, and diagnostic packages preserve immutable provenance while supporting reviewed redaction, deterministic archives, signatures, clean-profile dependency planning, local remaps, registries, and sandbox evidence reruns.

Area / maturity: Collaboration / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: Explicit review of every export scan finding; Local dependency and permission resolution before activation
Network: optional
Privacy: Raw secrets and account credentials are prohibited; export canaries are supplied by environment-variable name, findings show only redacted samples, and local model/path/account/SecretRef mappings stay outside the immutable package.
Approval: Export requires per-finding decisions; imported bundles default to dry-run and sandbox, cannot silently install executable dependencies, and reference reruns require an exact digest confirmation.
Limitations: A valid signature proves integrity and publisher-key identity, not package safety; model prose is not expected to be byte-identical, filesystem registry sharing is local, and organization governance remains deployment-specific.
Documentation: user-guide/task-packages.md
Verification: tests/test_task_packages.py, tests/test_task_package_cli.py, tests/test_task_packages_api.py, src/holaryn_agent/webui/frontend/src/operator/TaskPackagesPage.test.tsx, src/holaryn_agent/webui/frontend/e2e/task-packages.spec.ts
Inventory: Commands: holaryn task-package

Agent Teams (`collaboration.teams`)

Named local, coding-CLI, and remote members coordinate through routing, contracts, budgets, and shared team memory.

Area / maturity: Collaboration / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: None
Network: provider-dependent
Privacy: Team messages are persisted locally and cross a peer/provider boundary only when routed there.
Approval: Members retain their configured approval and contract boundaries.
Limitations: Cross-machine members require explicit peer pairing.
Documentation: docs/teams.md
Verification: tests/test_teams.py
Inventory: Commands: holaryn team

Extensible slash commands (`extensions.commands`)

Built-ins, TOML prompts, macro sequences, gated scripts, packs, skills, and MCP prompts share one command surface.

Area / maturity: Extensions / stable
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, telegram
Platforms: windows, macos, linux
Prerequisites: None
Network: none
Privacy: Prompt commands stay local until invoked; their resulting model request follows provider policy.
Approval: Script commands and nested tools remain approval-gated.
Limitations: Control-plane commands are intentionally unavailable on untrusted channel surfaces.
Documentation: user-guide/slash-commands.md
Verification: tests/test_commands.py, tests/test_commands_gated.py
Inventory: Settings: commands

Sandboxed executable extensions (`extensions.executable`)

A versioned language-neutral protocol and Python SDK add reviewed tools and settings schemas through crash-isolated, default-deny Docker processes without importing third-party code into Holaryn core.

Area / maturity: Extensions / experimental
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, service
Platforms: windows, macos, linux
Prerequisites: Docker with an independently reviewed extension image available locally; HOLARYN_EXTENSIONS_ENABLED=true after package and permission review
Network: optional
Privacy: The extension sees only its read-only package, bounded scratch space, call input/config, and exact resources mediated by declared file, HTTPS, SecretRef, or canonical-tool permissions.
Approval: Install is disabled by default; enablement and every permission expansion require explicit operator review and consent.
Limitations: The initial production vertical integrates tools and generic settings; other versioned extension-point descriptors remain catalog-only until their host adapters ship. Docker is required and images are never pulled automatically.
Documentation: user-guide/extensions.md
Verification: tests/test_extensions.py, tests/test_extensions_api.py, tests/test_extensions_docker.py, docs/extension-protocol-v1.md
Inventory: Commands: holaryn extension
Inventory: Settings: system

Trusted capability marketplace (`extensions.marketplace`)

Signed public, private, mirrored, and offline registries distribute skills, content plugins, command and MCP bundles, connectors, themes, assets, and isolated executable extensions through transparent trust tiers.

Area / maturity: Extensions / experimental
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, service
Platforms: windows, macos, linux
Prerequisites: An organization marketplace policy with pinned registry and publisher trust roots; HOLARYN_MARKETPLACE_ENABLED=true for remote refresh and download
Network: optional
Privacy: Catalog browsing uses signed cached metadata; remote refresh/download contacts only organization-approved registry locations. Reports remain queued locally until explicitly submitted.
Approval: Every package is inspected before install; activation and permission expansion require explicit review. Locked organization allowlists cannot be bypassed locally.
Limitations: Review, signatures, popularity, and sandboxing are separate signals and none proves safety. The first release supplies a local registry/client and publication vertical slice rather than a hosted billing or revenue-sharing service.
Documentation: user-guide/marketplace.md
Verification: tests/test_marketplace.py, tests/test_marketplace_api.py, tests/test_marketplace_cli.py, docs/marketplace-adr.md, docs/marketplace-package-v1.md
Inventory: Commands: holaryn marketplace
Inventory: Settings: plugins

Model Context Protocol client (`extensions.mcp`)

Negotiated stdio and HTTP/SSE sessions contribute policy-filtered tools, prompts, resources, roots, logging, bounded sampling, and typed elicitation with conformance diagnostics.

Area / maturity: Extensions / stable
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, service
Platforms: windows, macos, linux
Prerequisites: A compatible MCP server
Network: optional
Privacy: Data is disclosed only to configured servers under explicit capability and item policy; sampling cannot import Holaryn context or tools.
Approval: New server capabilities remain pending; tools, sampling, elicitation, roots, and resources retain independent policy boundaries.
Limitations: Server quality and schemas are controlled by the MCP provider; interactive OAuth refresh remains separate roadmap work.
Documentation: user-guide/tools-and-mcp.md
Verification: tests/test_mcp_client.py, tests/test_mcp_conformance.py
Inventory: Commands: holaryn mcp
Inventory: Settings: mcp

Sandboxed MCP Apps (`extensions.mcp-apps`)

Compatible MCP tools can attach an interactive app that loads on demand in a double-iframe, isolated-origin sandbox with pinned resources, explicit authority, and an accessible structured fallback.

Area / maturity: Extensions / beta
Owner: Holaryn Agent maintainers
Surfaces: web, desktop
Platforms: windows, macos, linux
Prerequisites: A server implementing the MCP Apps 2026-01-26 extension; The server's apps capability explicitly approved in Settings
Network: optional
Privacy: Tool input, structured results, and approved host actions are shared only with the selected app; pinned HTML and integrity metadata persist with the local chat.
Approval: App tool calls and host actions re-enter the canonical approval gate; declared CSP domains and permissions grant no authority by themselves.
Limitations: Apps run only on the local web/desktop host; arbitrary external networking, ambient credentials, top-level navigation, and direct filesystem access are denied.
Documentation: user-guide/mcp-apps.md
Verification: tests/test_mcp_apps.py, src/holaryn_agent/webui/frontend/src/mcpApps/MCPAppHost.test.tsx, src/holaryn_agent/webui/frontend/src/mcpApps/sandboxTransport.test.ts
Inventory: Settings: mcp

Skills and plugins (`extensions.skills-plugins`)

SKILL.md-compatible skills and reviewed plugin bundles can add instructions, tools, commands, assets, and runtime integrations.

Area / maturity: Extensions / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop
Platforms: windows, macos, linux
Prerequisites: Explicit install
Network: optional
Privacy: Installed content is local; plugin-declared external integrations may use network or credentials.
Approval: Plugins require an execution review before enablement.
Limitations: Third-party extensions are not security-reviewed by Holaryn maintainers.
Documentation: docs/skill-hub.md
Verification: tests/test_skills_runtime.py, tests/test_plugins.py
Inventory: Commands: holaryn skill, holaryn plugin
Inventory: Settings: plugins

A2A agent interoperability (`interfaces.agent-a2a`)

Explicitly paired external A2A 1.0 agents can advertise approved skills and exchange authenticated, policy-bounded tasks, progress, cancellation, and untrusted artifacts.

Area / maturity: Interfaces / experimental
Owner: Holaryn Agent maintainers
Surfaces: cli, api, service
Platforms: windows, macos, linux
Prerequisites: An operator-reviewed HTTPS Agent Card trust binding; Transport authentication and outbound-data policy; A host-supplied Agent Card signature verifier when signatures are required
Network: required
Privacy: The outbound policy authorizes the exact redacted message; credentials remain transport-only, and diagnostics omit messages, artifact content, prompts, credentials, and signing material.
Approval: Pairing, Agent Card verification, approved skill policy, session authorization, and consequence approval remain independent deny-by-default gates; card metadata never grants authority.
Limitations: Private preview supports the A2A 1.0 HTTP+JSON binding. Push notifications are not enabled, URL artifacts are not fetched automatically, and the standalone server adapter is not mounted unless explicitly configured.
Documentation: docs/a2a-interoperability.md
Verification: tests/a2a/test_models.py, tests/a2a/test_discovery.py, tests/a2a/test_client.py, tests/a2a/test_http_transport.py, tests/a2a/test_server.py, tests/a2a/test_artifacts.py, tests/a2a/test_protocol_isolation.py
Inventory: Commands: holaryn a2a

Versioned inline review annotations (`interfaces.annotations`)

Reviewers can anchor threaded notes to exact messages, plan steps, diff ranges, and artifact regions, then assign, resolve, remap, export, or queue scoped agent work.

Area / maturity: Interfaces / beta
Owner: Holaryn Agent maintainers
Surfaces: web, desktop, api
Platforms: windows, macos, linux
Prerequisites: None
Network: none
Privacy: Annotation visibility and target visibility are enforced independently; annotation text remains untrusted review content.
Approval: Agent actions created from annotations enter the normal context, policy, and approval boundaries.
Limitations: Conservative remapping can leave an annotation visibly orphaned when the selected target cannot be identified uniquely.
Documentation: user-guide/annotations.md
Verification: tests/test_annotations.py, tests/test_annotations_api.py, src/holaryn_agent/webui/frontend/src/annotations/AnnotationsApp.test.tsx, src/holaryn_agent/webui/frontend/e2e/annotations.spec.ts

Professional document and artifact workspace (`interfaces.artifact-workspace`)

Chat, code, canvas, desktop, WebUI, and public API share immutable, previewed, validated, comparable DOCX, XLSX, PPTX, and PDF artifacts.

Area / maturity: Interfaces / beta
Owner: Holaryn Agent maintainers
Surfaces: web, desktop, api
Platforms: windows, macos, linux
Prerequisites: Document adapters (bundled in desktop and official Compose builds)
Network: provider-dependent
Privacy: Artifact content and previews remain local after model generation and use optional state encryption; identifiers, formats, sizes, timestamps, status, and digests can remain visible.
Approval: Create and revise are reversible artifact writes governed by normal tool policy; exact base versions prevent silent overwrite.
Limitations: Deterministic semantic previews are not every Office or PDF viewer; arbitrary macro-enabled or external-linked templates are not imported.
Documentation: user-guide/artifacts.md
Verification: tests/artifacts/test_workspace.py, tests/test_artifacts.py, src/holaryn_agent/webui/frontend/src/ArtifactWorkspaceDialog.test.tsx, src/holaryn_agent/webui/frontend/src/canvas/canvas.test.tsx, docs/artifact-workspace.md

Accessible live canvas (`interfaces.canvas`)

Agents can render updating dashboards, boards, and tables beside a conversation with semantic screen-reader output.

Area / maturity: Interfaces / beta
Owner: Holaryn Agent maintainers
Surfaces: web, desktop, api
Platforms: windows, macos, linux
Prerequisites: None
Network: none
Privacy: Canvas state is local and follows transcript retention rules.
Approval: Canvas rendering does not bypass tool approval.
Limitations: The supported schema is intentionally smaller than arbitrary web content.
Documentation: user-guide/canvas.md
Verification: tests/test_canvas.py, src/holaryn_agent/webui/frontend/src/canvas/canvas.test.tsx

Screen-reader-first coding workspace (`interfaces.code`)

Plan/build sessions share chat and approvals while durable isolated worktrees separate files, checkpoints, terminals, indexes, validation evidence, and reviewed integration.

Area / maturity: Interfaces / beta
Owner: Holaryn Agent maintainers
Surfaces: web, desktop, api, cli
Platforms: windows, macos, linux
Prerequisites: A selected workspace
Network: provider-dependent
Privacy: Repository source, worktree metadata, and disposable revision-keyed indexes remain local except excerpts explicitly included in model or coding-CLI requests; untracked secrets are not copied into new worktrees.
Approval: Index reads and rebuildable cache maintenance are reversible; target-branch integration requires exact-plan review and approval, while writes, shell commands, cancellation, and checkpoint reversal retain explicit safety controls.
Limitations: Interactive terminals are local PTY/ConPTY sessions; remote attachment and replay across a host restart are not yet supported.
Documentation: user-guide/worktree-sessions.md
Verification: tests/test_code_plan_mode.py, tests/test_coding_instructions.py, tests/test_repository_intelligence.py, tests/test_cli_repository.py, tests/test_worktree_sessions.py, tests/test_worktree_api.py, tests/test_cli_worktree.py, tests/test_coding_jobs.py, tests/test_code_api.py, tests/test_code_terminal.py, src/holaryn_agent/webui/frontend/src/code/CodeApp.test.tsx, src/holaryn_agent/webui/frontend/src/code/IndexPanel.test.tsx, src/holaryn_agent/webui/frontend/src/code/WorktreePanel.test.tsx, src/holaryn_agent/webui/frontend/src/code/terminal/TerminalPanel.test.tsx
Inventory: Commands: holaryn coding-jobs, holaryn instructions, holaryn repository, holaryn worktree
Inventory: Tools: repo_context, repo_index, repo_query

Connected Apps and first-party productivity connectors (`interfaces.connected-apps`)

Versioned connector contracts normalize scoped accounts, external resources, pagination, subscriptions, health, safe action previews, idempotent results, and final-boundary credential leases across first-party and remote capability sources.

Area / maturity: Interfaces / beta
Owner: Holaryn Agent maintainers
Surfaces: web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: Encrypted scoped-secret storage for live accounts; Provider OAuth client configuration for live accounts
Network: provider-dependent
Privacy: OAuth values remain behind opaque encrypted-secret references; search/fetch results are lazy, bounded, provenance-labeled, and untrusted; activity excludes resource content.
Approval: Read scopes are separate from write, send, share, delete, and admin scopes; every consequential tool shows its exact account, tenant, recipients or resource, content or permission, consequence, scopes, and idempotency identity.
Limitations: The bundled release supplies Gmail, Google Calendar, and Google Drive through one Google Workspace transport, not every SaaS provider; live provider OAuth client registration remains deployment configuration.
Documentation: docs/account-authorization.md
Verification: tests/connectors/test_authorization.py, tests/connectors/test_oauth.py, tests/connectors/test_google.py, tests/connectors/test_google_oauth.py, tests/connectors/test_runtime.py, tests/connectors/test_subscriptions.py, tests/connectors/test_tools.py, tests/test_connected_apps_api.py, tests/test_connected_apps_host.py, src/holaryn_agent/webui/frontend/src/settings/pages/ConnectedAppsPage.test.tsx, src/holaryn_agent/webui/frontend/e2e/settings.spec.ts
Inventory: Settings: connected-apps

Accessible web and native desktop app (`interfaces.desktop-web`)

One responsive React application provides chat, settings, approvals, operators, help, tray integration, native menus, and updates.

Area / maturity: Interfaces / stable
Owner: Holaryn Agent maintainers
Surfaces: web, desktop, api
Platforms: windows, macos, linux
Prerequisites: None
Network: optional
Privacy: The UI is served locally by default; remote listening requires explicit configuration and authentication.
Approval: All surfaces share the same approval broker and policy.
Limitations: Desktop packaging and updater support vary by operating-system signing availability.
Documentation: user-guide/web-interface.md
Verification: tests/test_webui.py, src/holaryn_agent/webui/frontend/src/settings/SettingsApp.test.tsx, src/holaryn_agent/webui/frontend/e2e/chat.spec.ts, src/holaryn_agent/webui/frontend/e2e/code.spec.ts, src/holaryn_agent/webui/frontend/e2e/approvals.spec.ts
Inventory: Settings: appearance, accessibility, keyboard, sounds, advanced, about

ACP v1 IDE integration (`interfaces.ide-acp`)

A stable ACP v1 adapter and reference Visual Studio Code extension create, reattach, steer, cancel, and stream durable Holaryn coding sessions without the Web UI.

Area / maturity: Interfaces / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, editor
Platforms: windows, macos, linux
Prerequisites: A configured Holaryn chat model for prompts; Visual Studio Code 1.96 or newer for the reference client
Network: provider-dependent
Privacy: The reference editor sends bounded, redacted workspace context to the local Holaryn process; only the selected provider receives context used in a model turn, and provider credentials never enter the extension.
Approval: File, tool, and terminal consequences remain server-owned and use one-shot keyboard-accessible editor prompts; the client cannot widen path policy or forge a lower consequence.
Limitations: Stable ACP v1 uses local stdio. The optional Holaryn TCP transport is non-standard, requires TLS 1.3 and mutual TLS, and requires explicit opt-in for non-loopback listening.
Documentation: docs/acp-protocol.md
Verification: tests/acp/test_backend.py, tests/acp/test_context.py, tests/acp/test_protocol.py, tests/acp/test_reference_client.py, tests/fixtures/acp/reference_client.py, editors/vscode/test/cursor.test.ts, editors/vscode/test/jsonLine.test.ts, editors/vscode/test/render.test.ts, editors/vscode/test/security.test.ts, docs/acp-conformance.md
Inventory: Commands: holaryn acp

Internationalized and RTL-ready interfaces (`interfaces.localization`)

Versioned ICU-compatible message catalogs, reviewed Spanish and French core translations, deterministic regional formats, and expansion/RTL pseudo-locales span the web, desktop, CLI, channels, and exports.

Area / maturity: Interfaces / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: None
Network: none
Privacy: Locale preferences contain language identifiers only; translated content follows the privacy boundary of its original message.
Approval: Safety-critical translations are version-reviewed and fall back to reviewed English whenever review metadata is missing or stale.
Limitations: Spanish and French cover the reviewed core flows in this release; untranslated legacy surfaces use English while the no-new-raw-string policy drives incremental extraction.
Documentation: user-guide/language-and-region.md
Verification: tests/test_localization.py, tests/test_frontend_i18n_policy.py, src/holaryn_agent/webui/frontend/src/i18n/i18n.test.tsx, src/holaryn_agent/webui/frontend/e2e/localization.spec.ts
Inventory: Commands: holaryn locale
Inventory: Settings: appearance

Multi-channel conversation ecosystem (`interfaces.messaging-channels`)

Channel API 1.0 normalizes identity, threads, edits, attachments, approvals, policy, health, and retry-safe delivery across Telegram, Slack, and Discord reference adapters.

Area / maturity: Interfaces / beta
Owner: Holaryn Agent maintainers
Surfaces: telegram, slack, discord, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: Explicit external workspace/channel/user binding; A credential-bearing provider transport for live Slack or Discord
Network: provider-dependent
Privacy: Provider messages and attachment metadata are untrusted; the durable store keeps identity metadata and digests, not credentials or attachment bytes.
Approval: Bindings carry explicit Holaryn authority; approvals preserve exact consequences and explicit decisions or a visible fallback; revoke and emergency stop require typed confirmation.
Limitations: Telegram retains its bundled live polling service. Slack and Discord ship as authenticated Channel API reference adapters and require an explicitly attached host or executable-extension transport.
Documentation: user-guide/messaging-channels.md
Verification: tests/channels/test_framework.py, tests/test_channels_api.py, tests/test_channels_telegram.py, src/holaryn_agent/webui/frontend/src/settings/pages/pages.test.tsx, src/holaryn_agent/webui/frontend/e2e/settings.spec.ts
Inventory: Settings: messaging

Versioned public automation API and official SDKs (`interfaces.public-api`)

A tenant-scoped API, Python sync/async SDK, and TypeScript promise client automate sessions, runs, durable events, approvals, artifacts, discovery, webhooks, and administration.

Area / maturity: Interfaces / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, api, service
Platforms: windows, macos, linux
Prerequisites: Explicitly enable the public API and create a scoped service credential
Network: optional
Privacy: Bearer credentials are header-only, API keys are stored as digests, resource access is tenant-bound, and audit/webhook records omit prompt and credential content.
Approval: Automated clients answer the same durable approval requests as interactive surfaces and cannot bypass application-service scope checks.
Limitations: Remote access requires an operator-managed TLS reverse proxy; secret-bearing administration responses are shown once and cannot be replayed.
Documentation: docs/public-api.md
Verification: tests/test_public_api.py, sdks/typescript/test/client.test.ts
Inventory: Commands: holaryn api-key

Telegram channel (`interfaces.telegram`)

A long-polling Telegram bot supports per-chat allowlists, conversations, coding notifications, and team escalation.

Area / maturity: Interfaces / beta
Owner: Holaryn Agent maintainers
Surfaces: telegram, service, web, desktop
Platforms: windows, macos, linux
Prerequisites: Telegram bot token; Allowed chat identifiers
Network: required
Privacy: Messages cross Telegram and the configured model provider when a model turn runs.
Approval: Unattended sensitive actions park for operator review.
Limitations: Telegram remains the bundled live third-party channel; Slack and Discord Channel API reference adapters require an explicitly attached transport.
Documentation: user-guide/messaging-channels.md
Verification: tests/test_channels_telegram.py
Inventory: Settings: messaging

Real-time local voice conversations (`interfaces.voice`)

Ordered local STT, live captions, automatic/wake/continuous turn modes, privacy-bounded incremental speech, barge-in, recovery, and replay-safe decisions wrap the canonical agent loop.

Area / maturity: Interfaces / beta
Owner: Holaryn Agent maintainers
Surfaces: web, desktop
Platforms: windows, macos, linux
Prerequisites: Optional speech engine extra; Microphone permission
Network: none
Privacy: Raw audio is discarded by default; opt-in audio requires bounded expiry, exports omit bytes, captions/text-only are independent, and narration omits raw arguments/output.
Approval: Capture starts explicitly; deny binds to the exact pending request, low-impact approval is opt-in and two-step, and high-impact approval requires visual review.
Limitations: Browser/OS/hardware determine latency and voice/device quality; no phone, cloud STT, biometric identity, native speech-to-speech, or background OS wake service.
Documentation: docs/voice.md
Verification: tests/test_voice_engines.py, tests/test_voice_multimodal.py, tests/test_realtime_voice.py, tests/test_realtime_voice_api.py, src/holaryn_agent/webui/frontend/src/voice/VoiceSessionPanel.test.tsx, src/holaryn_agent/webui/frontend/src/voice/turnDetector.test.ts
Inventory: Settings: voice

Hybrid local memory (`memory.hybrid`)

Versioned scoped memory combines relational, full-text, and optional vector recall with explainable decisions, provenance, citations, review, and verified controls.

Area / maturity: Memory / stable
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, service
Platforms: windows, macos, linux
Prerequisites: Optional embedder or external vector/database backend for non-default modes
Network: optional
Privacy: The default store is local; external database, vector, or embedding endpoints receive configured memory data.
Approval: Learning can be automatic, paused, or review-gated by scope/category/source; edits, lifecycle controls, source forget, export, and external backend setup are explicit operator actions.
Limitations: Semantic quality depends on the selected embedder and model. Feedback weighting and automatic consolidation are deferred; prior exported copies and deployment backups are outside live-store deletion.
Documentation: user-guide/memory.md
Verification: tests/test_memory.py, tests/test_memory_control_phase31.py, tests/test_memory_store_factory.py, tests/test_settings_api.py
Inventory: Commands: holaryn memory
Inventory: Settings: memory

Image generation (`models.image-generation`)

Image-capable configured providers can generate raster artifacts through a typed tool path.

Area / maturity: Models / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop
Platforms: windows, macos, linux
Prerequisites: A configured image-capable model
Network: provider-dependent
Privacy: Prompts and reference images are sent to the selected image provider.
Approval: Provider calls follow the active tool policy.
Limitations: Supported sizes, formats, edits, pricing, and safety policy are provider-specific.
Documentation: user-guide/tools-and-mcp.md
Verification: tests/test_image_generation.py

Versioned custom agents and Agent Builder (`personalization.agent-builder`)

Typed content-only manifests move through draft, validation, profile-bound HolarynBench smoke, immutable publication, version pinning, rollback, and secret-safe import/export.

Area / maturity: Personalization / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: None
Network: provider-dependent
Privacy: Definitions and validation evidence are local; exports preserve secret references but reject secret values.
Approval: Organization policy is a non-bypassable compiler ceiling; overlays can narrow permissions and autonomy but cannot widen them.
Limitations: Marketplace distribution, hosted organization authoring, executable manifest code, and dependency installation are deferred; unavailable declared dependencies block publication.
Documentation: docs/versioned-agent-builder.md
Verification: tests/test_agent_profiles.py, tests/test_cli_agent.py, tests/test_profiles_api.py, tests/test_profiles_web.py
Inventory: Commands: holaryn agent
Inventory: Settings: profiles

Profiles and persona (`personalization.profiles`)

Named profiles bundle model, reasoning effort, autonomy, settings, routing, and a reusable persona.

Area / maturity: Personalization / stable
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, service, telegram
Platforms: windows, macos, linux
Prerequisites: None
Network: none
Privacy: Profile and persona content is stored locally and may be included in model context when active.
Approval: Changing the default or channel routing is an explicit configuration action.
Limitations: Mid-run profile replacement requires a new session.
Documentation: docs/config-profiles.md
Verification: tests/test_profiles.py, tests/test_persona.py
Inventory: Commands: holaryn profile, holaryn persona
Inventory: Settings: profiles

Optional HACP platform connection (`platform.hacp`)

The standalone core can attach to Holaryn Space through the open HACP boundary without importing Platform code.

Area / maturity: Platform (optional) / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, service
Platforms: windows, macos, linux
Prerequisites: HACP endpoint and credentials
Network: required
Privacy: Only configured HACP messages and requested capabilities cross the platform boundary.
Approval: Platform-contributed capabilities register through the same local policy seams.
Limitations: The standalone agent does not bundle or require Holaryn Space.
Documentation: docs/holaryn-agent-control-protocol-v0.md
Verification: tests/test_controllink_phase12.py
Inventory: Commands: holaryn hacp
Inventory: Settings: platform

HolarynBench and extended quality gates (`quality.benchmarks`)

Versioned no-network capability scenarios, parser properties, critical browser flows, fault soaks, and noise-aware performance workloads produce reproducible release evidence.

Area / maturity: Quality / stable
Owner: Holaryn Agent maintainers
Surfaces: cli
Platforms: windows, macos, linux
Prerequisites: Docker only for live shell benchmark scenarios
Network: optional
Privacy: Deterministic suites use synthetic fixtures and omit prompts, outputs, secrets, and user paths from private reports.
Approval: Benchmark manifests declare and bound every tool and approval decision.
Limitations: Offline results measure runtime behavior, not competitor or live-model quality; manual assistive-technology sign-off still supplements automated accessibility checks.
Documentation: docs/quality-gates.md
Verification: tests/test_evals.py, tests/test_performance.py, tests/quality/test_parser_properties.py, tests/quality/test_quality_contract.py, src/holaryn_agent/webui/frontend/e2e/accessibility-harness.spec.ts, src/holaryn_agent/webui/frontend/e2e/canvas.spec.ts, src/holaryn_agent/webui/frontend/e2e/onboarding.spec.ts
Inventory: Commands: holaryn bench

Living capability and documentation contract (`quality.capability-matrix`)

One versioned registry drives deterministic JSON, user documentation, CLI diagnostics, and in-product About data while CI rejects drift and contradictions.

Area / maturity: Quality / stable
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api
Platforms: windows, macos, linux
Prerequisites: None
Network: none
Privacy: Capability diagnostics contain product metadata only and never inspect credentials, prompts, outputs, account identifiers, or user paths.
Approval: Reading or generating capability metadata is non-mutating; artifact updates remain reviewed source changes.
Limitations: Maturity describes the Holaryn integration and does not certify third-party services or security compliance.
Documentation: user-guide/capabilities.md
Verification: tests/test_capabilities.py, tests/test_docs_contract.py
Inventory: Commands: holaryn capabilities

Sandboxed advanced capability workflows (`runtime.advanced-workflows`)

An explicitly enabled typed interpreter composes authorized capability handles with bounded parallel maps, conditions, retries, reductions, schemas, evidence, checkpoints, and inspectable approval pauses.

Area / maturity: Runtime / experimental
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: None
Network: provider-dependent
Privacy: The interpreter has no ambient host access; checkpoints retain bounded structured results and evidence, while traces omit arguments, outputs, prompts, credentials, and private chain-of-thought.
Approval: Consequential or approval-required calls pause before dispatch; every prepared and resumed call re-enters current Capability Fabric authorization and the canonical host executor.
Limitations: Private preview and disabled by default. Workflows use declarative calls, maps, conditions, and reductions only; no arbitrary code, ambient filesystem/network/process access, package installation, recursion, or unbounded fan-out.
Documentation: docs/advanced-capability-workflows.md
Verification: tests/capability_fabric/test_workflow_runtime.py, tests/test_bounded_tool_code.py, tests/test_evals_structured_reasoning.py

Format-aware attachment ingestion and citations (`runtime.attachments`)

Hostile files become immutable structured blocks with page, slide, sheet/cell, section, line, image, and archive-path citations; bounded search selects only relevant evidence.

Area / maturity: Runtime / beta
Owner: Holaryn Agent maintainers
Surfaces: web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: The documents extra for Office, PDF rendering, image decoding, and OCR
Network: optional
Privacy: Originals, reports, jobs, and derived blocks use local authenticated state encryption; one-time decryption values are never stored and URL credentials/query data are not retained.
Approval: Attachment reads are chat-authorized and never grant action authority; extracted content is always untrusted and prompt-injection indicators remain visible.
Limitations: The source limit is 5 MiB; perfect OCR and format fidelity are not claimed; legacy binary Office files and executable attachments are unsupported.
Documentation: user-guide/attachments.md
Verification: tests/attachments/test_extractors.py, tests/attachments/test_workspace.py, tests/test_attachments.py, src/holaryn_agent/webui/frontend/src/messages/AttachmentReviewDialog.test.tsx, docs/attachment-ingestion.md

Capability Center and effective authority projection (`runtime.capability-center`)

One canonical live projection explains catalog, source/account, policy/model, runtime, and approval state across Web, API, and CLI surfaces.

Area / maturity: Runtime / experimental
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: None
Network: none
Privacy: Responses contain bounded capability metadata and authority digests; they omit prompts, tool arguments and outputs, credential values, account subjects, and principal identifiers.
Approval: Search, inspection, explanation, and schema loading grant no authority; source actions require current authorization, catalog revision checks, permission-diff review, and confirmation when consequential.
Limitations: Private preview and disabled by default; the previous stable runtime remains the execution and approval authority, and the documented readiness gaps must close before public beta.
Documentation: user-guide/capability-center.md
Verification: tests/capability_fabric/test_center.py, tests/test_capability_center_api.py, tests/test_capability_cli.py, tests/capability_fabric/test_preview.py, tests/capability_fabric/test_migration.py, tests/capability_fabric/test_observability.py, tests/capability_fabric/test_release_gate.py, src/holaryn_agent/webui/frontend/src/settings/pages/CapabilityCenterPage.test.tsx, src/holaryn_agent/webui/frontend/e2e/settings.spec.ts
Inventory: Commands: holaryn capability
Inventory: Settings: tools

Production Docker Compose self-host deployment (`runtime.compose-deployment`)

A hardened one-command stack provides authenticated first-run onboarding, pinned non-root containers, durable named volumes, optional database/vector/model/worker/proxy/observability profiles, diagnostics, encrypted backup, tested upgrade, and rollback.

Area / maturity: Runtime / stable
Owner: Holaryn Agent maintainers
Surfaces: cli, web, service
Platforms: windows, macos, linux
Prerequisites: A supported Docker Engine with the Compose v2 plugin; DNS plus inbound TCP 80/443 for automatic public TLS; Operator-managed backup storage and recovery material
Network: optional
Privacy: The minimal profile runs locally with a loopback-only application port; production exposes only the TLS proxy. Secrets use mounted files, support bundles redact values, and deployment status reports metadata and configuration shape only.
Approval: Bootstrap, production exposure, profile enablement, upgrades, backup, restore, rollback, and secret changes are explicit operator actions.
Limitations: The reference production topology targets one Linux host; external databases, orchestrators, high availability, enterprise identity, off-host backup retention, and capacity scaling remain operator-owned.
Documentation: user-guide/self-host-compose.md
Verification: tests/test_compose_deployment_assets.py, tests/test_deployment.py, tests/test_deployment_cli.py, deploy/compose/drill.py, .github/workflows/ci.yml, .github/workflows/container.yml
Inventory: Commands: holaryn deployment

Typed contextual references and provenance (`runtime.context`)

Versioned references resolve files, attachments, artifacts, URLs, memory, prior work, and canvases at send time with freshness, trust, taint, budgets, and validated citations.

Area / maturity: Runtime / beta
Owner: Holaryn Agent maintainers
Surfaces: web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: None
Network: optional
Privacy: External URLs drop credentials and query data before persistence; source content remains bounded and labeled in the local transcript.
Approval: References never grant authority; current workspace, chat, store, and connector permissions are rechecked on every resolution.
Limitations: Diagnostics, git objects, model/profile, and peer kinds are schema-reserved but need a concrete resolver before their content can be included.
Documentation: user-guide/context-references.md
Verification: tests/test_context_references.py, tests/test_context_types_generated.py, tests/test_attachments.py

Dynamic tool discovery and bounded code mode (`runtime.dynamic-tools`)

A versioned policy-aware catalog exposes only a bounded discovery core, loads exact schemas after inspection, and can optionally compose approved capability handles in a no-eval restricted runtime.

Area / maturity: Runtime / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: None
Network: provider-dependent
Privacy: Catalog metadata is sanitized and bounded; discovery audit events omit tool arguments, outputs, prompts, credentials, and secret values.
Approval: Search and schema loading never grant permission; direct, alias, handle, script, and bounded-code invocation all recheck the canonical registry and normal approval path.
Limitations: The restricted language supports sequential call assignments and literals, not arbitrary Python/JavaScript, loops, packages, imports, ambient filesystem/network access, or automatic tool installation.
Documentation: user-guide/tool-discovery.md
Verification: tests/test_tool_discovery.py, tests/test_bounded_tool_code.py, tests/capability_fabric/test_model_negotiation.py, src/holaryn_agent/webui/frontend/src/settings/SettingsApp.test.tsx
Inventory: Tools: run_tool_code, tool_inspect, tool_list, tool_search

Encrypted local state and recovery backups (`runtime.encrypted-state`)

Versioned per-domain envelope encryption protects classified local records, files, and path-independent recovery archives with fail-closed key handling, resumable migration, rotation, and restore validation.

Area / maturity: Runtime / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: OS credential vault or operator-held recovery material; Stopped host for enablement, migration, key maintenance, backup, and restore
Network: none
Privacy: Covered secrets, journal and memory fields, chat/device artifacts, and backup payloads use authenticated encryption; ids, timestamps, states, sizes, digests, embeddings, excluded stores, and explicit exports can remain visible as documented.
Approval: Encryption is opt-in pending independent review; key mutations and recovery are explicit stopped-host CLI operations and recovery material is never accepted as a command argument.
Limitations: It does not protect an authorized running process, uncovered control-plane/workspace content, external stores, OS swap or crash dumps; losing both key-provider access and recovery material can make data unrecoverable.
Documentation: user-guide/encrypted-local-state.md
Verification: tests/test_state_crypto.py, tests/test_encryption_cli.py, tests/test_settings_api.py, src/holaryn_agent/webui/frontend/src/settings/pages/pages.test.tsx
Inventory: Commands: holaryn encryption
Inventory: Settings: system

Durable local, Docker, and SSH execution (`runtime.execution`)

Workspace-confined one-shot tools and opt-in durable sessions share typed policy, replay, cancellation, artifact, and recovery contracts across local, persistent Docker, and pinned-host SSH backends.

Area / maturity: Runtime / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, service
Platforms: windows, macos, linux
Prerequisites: Docker only when persistent container execution is selected; A pinned SSH profile and remote Holaryn worker for strong remote replay
Network: optional
Privacy: Filesystem access is root-confined, journals are redacted and encrypted when state encryption is configured, and backend network authority is explicit.
Approval: Every command is admitted against an immutable session policy before provisioning or launching a side effect.
Limitations: Managed serverless execution is not bundled; raw SSH remains a documented degraded mode without strong remote process identity.
Documentation: docs/execution-backends.md
Verification: tests/test_tools_native.py, tests/test_execution_docker.py, tests/test_execution_sessions.py, tests/test_execution_cli.py, tests/test_execution_operator_api.py
Inventory: Commands: holaryn execution
Inventory: Tools: bash, code.validate, create_artifact, edit_file, fetch_attachment_blocks, glob_files, grep_files, list_attachments, list_dir, publish_artifact, read_file, revise_artifact, run_shell, search_attachment, validate_code, write_file
Inventory: Settings: tools

Enterprise identity, governance, audit, and policy (`runtime.governance`)

Provider-neutral tenant scopes, revocable identity sessions, RBAC, deny-overrides organization policy, legal-hold-aware retention, and tamper-evident audit protect consequential actions.

Area / maturity: Runtime / beta
Owner: Holaryn Agent maintainers
Surfaces: web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: An injected governance service and authenticated authorization context; Deployment-owned identity, directory, key custody, audit archive, and deletion adapters as applicable
Network: optional
Privacy: Audit details are minimized and sensitive-looking values are redacted; exports are tenant-filtered and written beneath a trusted host directory.
Approval: Organization deny is non-overridable, review forces one-action approval, and allow never weakens local autonomy or information-flow policy.
Limitations: Ordinary standalone hosts remain explicitly unattached; this foundation supplies adapter contracts rather than a bundled live IdP, KMS/HSM, WORM archive, compliance certification, or remote resource deleters.
Documentation: docs/enterprise-governance.md
Verification: tests/test_governance.py, tests/test_governance_audit.py, tests/test_governance_retention.py, tests/test_governance_loop.py, tests/test_governance_api.py, tests/test_subagents_phase15.py
Inventory: Settings: governance

Agent migration (`runtime.migration`)

A reviewable importer brings supported skills, memory, and persona data from OpenClaw or Hermes into local Holaryn state.

Area / maturity: Runtime / beta
Owner: Holaryn Agent maintainers
Surfaces: cli
Platforms: windows, macos, linux
Prerequisites: Readable source-agent directory
Network: none
Privacy: Migration is local and supports dry-run before writes.
Approval: The importer previews and confirms changes unless --yes is explicit.
Limitations: Only documented portable data shapes are imported; source-specific runtime state is not.
Documentation: docs/migration.md
Verification: tests/test_migrate.py
Inventory: Commands: holaryn migrate

Privacy-safe usage diagnostics (`runtime.observability`)

Canonical run/model/tool/approval traces, normalized usage, optional cost, bounded OTLP export, Prometheus metrics, and provisioned dashboards support local and fleet diagnosis.

Area / maturity: Runtime / stable
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: The optional otel dependency when network export is enabled
Network: optional
Privacy: Usage records and OTLP signals exclude prompts, responses, thinking, tool arguments/output, paths, URLs, recipients, exception messages, and secrets; exporter destinations are explicitly allowlisted.
Approval: Viewing diagnostics is read-only; network export, insecure private transport, authentication secret changes, and external destinations require explicit operator configuration.
Limitations: Token and cost fields may be unavailable when a provider does not report them; exporter buffering is deliberately bounded and may drop signals under backpressure.
Documentation: docs/observability.md
Verification: tests/test_observability.py, tests/test_otel_export.py, tests/test_otel_cli.py, tests/test_compose_deployment_assets.py
Inventory: Commands: holaryn otel
Inventory: Settings: diagnostics

Autonomy policy and staged plans (`runtime.policy`)

Ask, selective, allow-all, and unrestricted postures combine with consequence rules and reviewable dry-run plans.

Area / maturity: Runtime / stable
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: None
Network: none
Privacy: Policy evaluation is local and content-free audit metadata is retained.
Approval: Unattended runs never auto-approve held actions; unrestricted is always explicit.
Limitations: Policy cannot eliminate risk from an intentionally approved external action.
Documentation: user-guide/autonomy-and-approvals.md
Verification: tests/test_approval_policy.py, tests/test_staged_plans.py
Inventory: Commands: holaryn policy, holaryn plan
Inventory: Settings: autonomy

Scoped secret broker and just-in-time credential delivery (`runtime.secret-broker`)

Opaque references resolve through exact, expiring, use-bounded leases only inside trusted provider, connector, signing, request, or process adapters, with encrypted metadata, rotation, revocation, audit, and transformed-form redaction.

Area / maturity: Runtime / beta
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: Encrypted local state initialized; An authorized usage policy with exact principal, run, tool, destination, purpose, and injection mode
Network: provider-dependent
Privacy: Values stay in the selected secure backend and trusted injection boundary; authenticated metadata views expose aliases, scopes, versions, policy bindings, and usage timestamps. Redaction is defence-in-depth and cannot undo arbitrary exfiltration after disclosure.
Approval: Default deny; policies can require review, break-glass requires a distinct reviewer and exact confirmation, and permanent deletion requires prior revocation plus alias confirmation.
Limitations: Local metadata reveals opaque ids, states, version/count/timestamp fields, backend ids, and SQLite size. Provider adapters may retain a credential for their bounded runtime after lease consumption; arbitrary third-party code is never a trusted injection adapter.
Documentation: user-guide/scoped-secret-broker.md
Verification: tests/test_secret_broker.py, tests/test_secret_cli.py, tests/test_settings_api.py, src/holaryn_agent/webui/frontend/src/settings/pages/pages.test.tsx
Inventory: Commands: holaryn secret
Inventory: Settings: system

Secret storage and layered injection defense (`runtime.security`)

Write-only secrets, typed provenance/taint, versioned detectors, and information-flow policy protect trust and action boundaries.

Area / maturity: Runtime / stable
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service, telegram
Platforms: windows, macos, linux
Prerequisites: None
Network: none
Privacy: Secrets are redacted; findings retain bounded plain-text evidence, and offline evaluation reports omit evaluated content.
Approval: Keywordless untrusted-to-action flows require review; suspected injection and tainted secret egress are non-overridable blocks.
Limitations: Detection and provenance reduce risk but cannot prove content is safe; managed DLP classifiers and their content-handling contracts remain deployment responsibilities.
Documentation: docs/prompt-injection-guardrail.md
Verification: tests/test_injection.py, tests/test_security_evaluation.py, tests/test_settings_api.py

Cross-platform host service and installation (`runtime.service-install`)

CLI, per-user install, persistent host, systemd, launchd, Windows service, desktop packages, and channel-aware updates share release metadata.

Area / maturity: Runtime / stable
Owner: Holaryn Agent maintainers
Surfaces: cli, desktop, service
Platforms: windows, macos, linux
Prerequisites: Platform service permissions when installing a service
Network: optional
Privacy: Update checks disclose only ordinary release request metadata to the configured release host.
Approval: Install, uninstall, service registration, and update actions are explicit operator actions.
Limitations: Windows tags require Authenticode credentials and run the automated NSIS lifecycle plus atomic checksum, CycloneDX, attestation, and clean-runner verification; native package execution on macOS and Linux remains platform-dependent.
Documentation: docs/install.md
Verification: tests/test_windows_service_phase141.py, tests/test_service_phase14.py, tests/test_windows_package_lifecycle.py, tests/test_release_integrity.py, tests/test_release_integrity_workflow.py, tests/test_packaging_update_channel.py
Inventory: Commands: holaryn serve, holaryn service, holaryn install-cli, holaryn uninstall-cli
Inventory: Settings: system

Browser-independent web search, fetch, and citations (`runtime.web-retrieval`)

Stable model-facing search and safe page/PDF extraction work across verified tool-calling models without Chrome or provider-specific prompts.

Area / maturity: Runtime / experimental
Owner: Holaryn Agent maintainers
Surfaces: cli, web, desktop, api, service
Platforms: windows, macos, linux
Prerequisites: A configured search backend for web_search; direct HTTPS fetch needs no browser
Network: required
Privacy: URLs are normalized without credentials or fragments; authorization headers, cookies, local paths, unrelated context, and backend exception details never enter results.
Approval: Every request is admitted by HTTPS/domain/network policy and Capability Fabric authorization; discovery, fetched instructions, and citations never grant tool authority.
Limitations: Public static HTML, text, and PDFs are supported; use browser automation for authenticated, interactive, rendered, download, or user-takeover flows. Live tests remain opt-in.
Documentation: docs/web-retrieval.md
Verification: tests/web_retrieval/test_service.py, tests/web_retrieval/test_http_backend.py
Inventory: Tools: web_fetch, web_search

← Previous Canvas Next → Capability Center

Holaryn Agent capability matrix