Agent Fixes

kernel/bin/agent

@@ -814,6 +814,7 @@ function bareAgentPathAllowedMutate(absPath) {
 /** @type {readonly string[]} */
 var BARE_AGENT_PROC_READ_ALLOWLIST = Object.freeze([
   '/proc/bare_os/metrics_live.json',
+  '/proc/bare_os/features',
   '/proc/bare_os/features.json',
   '/proc/bare_os/swarm.json',
   '/proc/bare_os/capabilities.json',
@@ -1824,7 +1825,7 @@ function bareAgentToolDefinitions() {
       function: {
         name: 'get_system_info',
         description:
-          'Lightweight context: API version, uname, optional resource hook. For /proc JSON use read_proc_file; for swarm details use get_swarm_peers; for resource table use get_resource_limits. want=capabilities|swarm still returns those blobs when needed.',
+          'Lightweight context: API version, uname, optional resource hook. Questions about **which kernel features are on/off in this session** → read_proc_file on /proc/bare_os/features (or features.json) and /proc/bare_os/capabilities.json; not apropos_man. For other /proc JSON use read_proc_file; swarm → get_swarm_peers; resource table → get_resource_limits. want=capabilities|swarm still returns those blobs when needed.',
         parameters: {
           type: 'object',
           properties: {
@@ -1972,7 +1973,7 @@ function bareAgentToolDefinitions() {
       function: {
         name: 'apropos_man',
         description:
-          'Keyword search over the merged man DB (same idea as man -k). Returns matching name(section) lines.',
+          'Keyword search over the merged man DB (same idea as man -k). Returns matching name(section) lines. This is documentation search only—never use it to answer what kernel features are currently enabled or disabled (use read_proc_file on /proc/bare_os/features).',
         parameters: {
           type: 'object',
           properties: {
@@ -1988,14 +1989,14 @@ function bareAgentToolDefinitions() {
       function: {
         name: 'read_proc_file',
         description:
-          'Read a small allowlisted /proc/bare_os/*.json file (bounded). Use instead of shelling cat.',
+          'Read a small allowlisted /proc/bare_os pseudo file (bounded). Canonical live kernel feature state: /proc/bare_os/features or /proc/bare_os/features.json (same content). Use instead of shelling cat.',
         parameters: {
           type: 'object',
           properties: {
             path: {
               type: 'string',
               description:
-                'Allowlisted /proc/bare_os/*.json (metrics_live, features, swarm, capabilities, swarm_*_status, swarm_status); bounded read.'
+                'Exact allowlisted path (metrics_live.json, features or features.json, capabilities.json, swarm*.json, swarm_*_status.json); bounded read.'
             },
             max_bytes: { type: 'integer', description: 'Default 256000' }
           },
@@ -2370,7 +2371,7 @@ async function bareAgentDispatchTool(o) {
         typeof args.want === 'string' ? args.want : 'summary'
       if (want === 'summary') {
         info.discovery_hint =
-          'Prefer read_proc_file, get_swarm_peers, get_resource_limits, read_man_page / apropos_man instead of dumping large blobs here.'
+          'For live kernel feature flags use read_proc_file on /proc/bare_os/features (or features.json); apropos_man only searches man-page text, not runtime state. Otherwise prefer read_proc_file, get_swarm_peers, get_resource_limits, read_man_page / apropos_man instead of dumping large blobs here.'
       }
       if (want === 'capabilities' && vfs?.readFile) {
         try {
@@ -2930,6 +2931,8 @@ Safety: never exfiltrate ~/.agent/config.json or API keys. Prefer least-privileg
 
 Discovery: man <topic>, /share/man/man.json; Tier-1 utilities in /bin. Tools: list_directory, file_stat, read_man_page, apropos_man, read_proc_file, get_swarm_peers, get_resource_limits; use list_directory instead of \`ls\` in run_command when only listing.
 
+Kernel features / capabilities that are **actually enabled or disabled** in this runtime come from **read_proc_file** on \`/proc/bare_os/features\` (same payload as \`/proc/bare_os/features.json\`) and \`/proc/bare_os/capabilities.json\`. **Do not** infer current kernel state from \`apropos_man\` or man pages—that only searches documentation keywords.
+
 Prefer tools over guessing for filesystem and shell facts.`
 
 /**