From 7941ff7412245d0e9a9f6df4e846b635ee90c3e1 Mon Sep 17 00:00:00 2001
From: ymote <151983+ymote@users.noreply.github.com>
Date: Mon, 28 Sep 2026 10:20:41 -0700
Subject: [PATCH 1/2] =?UTF-8?q?toolbox-peers:=20offer=20the=20system=20too?=
 =?UTF-8?q?lbox=20to=20app=20agents=20(ADR=200002=20=C2=A76,=20M3/M5)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Behind features, off by default until octos#2567 is on the pin:

- app-peers `peer-tools`: every broker registers its peer's tool set
  (possibly empty) with `peer/tools/register` right after each successful
  `peer/prepare` and after every reconnect, on the link that drives its
  turns; a failed registration leaves the peer unbound, so no turn starts
  (issue #62). `peer/tool/call` runs `BrokerConfig::host_tools` once per
  occurrence, refuses unregistered tools, honours `peer/tool/cancel`, the
  call's deadline, release and link loss, and answers `peer/tool/result`.
- toolbox `peer` module: the tools.json entries per grant (`research`:
  workflow.run, workflow.fork, toolbox.search, toolbox.web_read; `crawl`
  with crawl limits: toolbox.deep_crawl; never deep_research), and
  `PeerToolbox::call`, which checks the grant again and runs with the
  app's AppContext; deep_crawl over `ResearchBackend::read_links`;
  `scope::narrow_crawl` (octos `crawl_args`, with a compat mirror).
- ai-host `toolbox-peers`: ToolboxTools (a worker thread per app for the
  non-Send toolbox), the OctosResearch backend, a ModelClient over
  `ModelHost::complete` (same ledger and daily budget as model.complete),
  grants from the manifest (TEMPORARY: os.* only until App Hub verifies
  research/crawl), results in `<apps root>/.host/toolbox/<app>`
  (`toolbox_folder`, always compiled, for #87).
- llm-service: host callers (system set) may send up to 256 KiB of input.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/apps.yml                    |   7 +
 Cargo.lock                                    |   4 +
 .../host-service/src/complete/mod.rs          |  13 +-
 .../host-service/tests/complete.rs            |  22 +
 crates/ai-host/Cargo.toml                     |  21 +
 crates/ai-host/README.md                      |  50 +-
 crates/ai-host/src/lib.rs                     |  43 ++
 crates/ai-host/src/toolbox_peers.rs           | 347 +++++++++
 crates/ai-host/tests/toolbox_peers.rs         | 457 ++++++++++++
 crates/ai-host/tests/toolbox_real_kernel.rs   | 134 ++++
 crates/app-peers/Cargo.toml                   |   8 +
 crates/app-peers/README.md                    |  42 ++
 crates/app-peers/src/broker.rs                | 165 ++++-
 crates/app-peers/src/hosted.rs                |  28 +-
 crates/app-peers/src/lib.rs                   |   2 +
 crates/app-peers/src/peer_tools.rs            | 471 ++++++++++++
 .../tests/fixtures/mock_agent_llm.py          |  15 +-
 crates/app-peers/tests/peer_tools.rs          | 478 ++++++++++++
 crates/app-peers/tests/real_kernel.rs         | 116 +++
 crates/toolbox/README.md                      |   4 +-
 crates/toolbox/src/lib.rs                     |   1 +
 crates/toolbox/src/peer.rs                    | 697 ++++++++++++++++++
 crates/toolbox/src/research/mod.rs            |  26 +
 crates/toolbox/src/research/octos.rs          |  99 ++-
 crates/toolbox/src/scope.rs                   |  71 ++
 crates/toolbox/src/scope/compat.rs            |  29 +-
 crates/toolbox/tests/peer.rs                  | 168 +++++
 27 files changed, 3505 insertions(+), 13 deletions(-)
 create mode 100644 crates/ai-host/src/toolbox_peers.rs
 create mode 100644 crates/ai-host/tests/toolbox_peers.rs
 create mode 100644 crates/ai-host/tests/toolbox_real_kernel.rs
 create mode 100644 crates/app-peers/src/peer_tools.rs
 create mode 100644 crates/app-peers/tests/peer_tools.rs
 create mode 100644 crates/toolbox/src/peer.rs
 create mode 100644 crates/toolbox/tests/peer.rs

diff --git a/.github/workflows/apps.yml b/.github/workflows/apps.yml
index 6b7dfb08..b52017c2 100644
--- a/.github/workflows/apps.yml
+++ b/.github/workflows/apps.yml
@@ -70,6 +70,10 @@ jobs:
           cargo test --locked -p octosense-app-peers --features octos-core,ws
           cargo clippy --locked -p octosense-app-peers --all-targets --no-deps -- -D warnings
           cargo clippy --locked -p octosense-app-peers --all-targets --features octos-core,ws --no-deps -- -D warnings
+          # Host-registered peer tools (octos#2567): off by default, tested
+          # against the scripted kernel.
+          cargo test --locked -p octosense-app-peers --features octos-core,ws,peer-tools
+          cargo clippy --locked -p octosense-app-peers --all-targets --features octos-core,ws,peer-tools --no-deps -- -D warnings
       - name: AI providers config
         run: cargo test --locked -p octosense-llm-config
       - name: System toolbox (workflow templates)
@@ -106,6 +110,9 @@ jobs:
           cargo test --locked -p octosense-ai-host
           cargo test --locked -p octosense-ai-host --features octos-core,llm
           cargo clippy --locked -p octosense-ai-host --all-targets --features octos-core,llm --no-deps -- -D warnings
+          # The system toolbox for app agents (octos#2567): off by default.
+          cargo test --locked -p octosense-ai-host --features toolbox-peers
+          cargo clippy --locked -p octosense-ai-host --all-targets --features toolbox-peers --no-deps -- -D warnings
       - name: AppCard runtime setup safeguards
         working-directory: apps/appcard
         run: PYTHONPATH=tools python3 -m unittest core.test_native_runtime
diff --git a/Cargo.lock b/Cargo.lock
index c74b3662..c7dd9fcd 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7271,9 +7271,13 @@ dependencies = [
  "makepad-app-module",
  "makepad-widgets",
  "octosense-app-peers",
+ "octosense-appstore",
  "octosense-kernel",
  "octosense-llm-config",
  "octosense-llm-service",
+ "octosense-toolbox",
+ "serde_json",
+ "tokio",
 ]
 
 [[package]]
diff --git a/apps/ai-providers/host-service/src/complete/mod.rs b/apps/ai-providers/host-service/src/complete/mod.rs
index b96449f7..8d0fe695 100644
--- a/apps/ai-providers/host-service/src/complete/mod.rs
+++ b/apps/ai-providers/host-service/src/complete/mod.rs
@@ -53,7 +53,9 @@
 //! to call it too, so direct calls and template calls share one budget per
 //! app: its `ModelRequest {system, user, output_schema}` maps onto a
 //! [`Request`] with `system` set and `input` the user document ([`host`]
-//! hands out the registered host).
+//! hands out the registered host). A host caller's input may be up to
+//! [`HOST_INPUT_MAX`] (a digest carries its articles' evidence); an app's
+//! stays at [`INPUT_MAX`].
 use crate::model::{effective_model, ProfileStore};
 use crate::probe;
 use crate::vault::Vault;
@@ -77,6 +79,10 @@ pub const FAMILY: &str = "model";
 pub const TASK_MAX: usize = 4 * 1024;
 /// The input, as compact JSON, in bytes.
 pub const INPUT_MAX: usize = 32 * 1024;
+/// The input of a host caller's call (`system` set: the toolbox's digests,
+/// whose user document carries the articles' evidence), which
+/// `host.request` can never make.
+pub const HOST_INPUT_MAX: usize = 256 * 1024;
 /// The model's reply text (after a code fence is removed), in bytes: the
 /// host's hard cap on what an app gets back.
 pub const OUTPUT_MAX: usize = 16 * 1024;
@@ -219,8 +225,9 @@ impl Request {
             return Err(bad(format!("task is over {TASK_MAX} bytes")));
         }
         let input = self.input.to_string().len();
-        if input > INPUT_MAX {
-            return Err(bad(format!("input is {input} bytes; the most is {INPUT_MAX}")));
+        let max = if self.system.is_some() { HOST_INPUT_MAX } else { INPUT_MAX };
+        if input > max {
+            return Err(bad(format!("input is {input} bytes; the most is {max}")));
         }
         if self.schema.is_null() {
             return Err(bad("schema is required".into()));
diff --git a/apps/ai-providers/host-service/tests/complete.rs b/apps/ai-providers/host-service/tests/complete.rs
index 975af1d3..779ff5bd 100644
--- a/apps/ai-providers/host-service/tests/complete.rs
+++ b/apps/ai-providers/host-service/tests/complete.rs
@@ -466,3 +466,25 @@ fn a_host_caller_shares_the_same_ledger() {
     assert_eq!(body["messages"][1]["content"], "{\"query\":\"x\"}");
     assert_eq!(Code::Budget.as_str(), "budget");
 }
+
+#[test]
+fn a_host_caller_may_send_a_larger_input_than_an_app() {
+    // A toolbox digest carries the articles' evidence (up to 6 KB each):
+    // over an app's 32 KiB, within the host's 256 KiB.
+    let rig = Rig::new("host-input", vec![deepseek("deepseek-v4-flash")]);
+    rig.fake.says(GOOD);
+    let big = "x".repeat(complete::INPUT_MAX + 1024);
+    let request = |system: Option<&str>| Request {
+        class: complete::Class::Fast,
+        task: if system.is_some() { String::new() } else { "t".into() },
+        input: json!(big),
+        schema: args()["schema"].clone(),
+        allow_urls: true,
+        system: system.map(str::to_owned),
+    };
+    let refused = rig.host.complete(APP, request(None)).unwrap_err();
+    assert_eq!(refused.code, Code::BadRequest);
+    rig.host.complete(APP, request(Some("You write a digest."))).unwrap();
+    let huge = Request { input: json!("x".repeat(complete::HOST_INPUT_MAX + 1)), ..request(Some("s")) };
+    assert_eq!(rig.host.complete(APP, huge).unwrap_err().code, Code::BadRequest);
+}
diff --git a/crates/ai-host/Cargo.toml b/crates/ai-host/Cargo.toml
index 5bd8ee3e..e334dcf1 100644
--- a/crates/ai-host/Cargo.toml
+++ b/crates/ai-host/Cargo.toml
@@ -21,6 +21,8 @@
 #   dependencies below): `cfg(kernel)` in the source, set by build.rs.
 # - `llm`: register the `llm` host service (a shell's `app-hub` feature turns
 #   it on; phones always).
+# - `toolbox-peers`: the system toolbox as app peers' host-registered tools
+#   (octos#2567); off by default, see below.
 #
 # The kernel is crates/kernel, the app-peers contract and broker
 # crates/app-peers, the `llm` service and its config apps/ai-providers/*;
@@ -38,6 +40,21 @@ license.workspace = true
 default = []
 octos-core = ["dep:octosense-kernel", "octosense-app-peers/octos-core", "octosense-llm-service?/octos-core"]
 llm = ["dep:octosense-llm-service"]
+# The system toolbox offered to app agents (ADR 0002 section 6, News M5):
+# every app peer registers its toolbox tools (possibly none) with the kernel
+# and the host runs their calls. Off by default: it needs a kernel with
+# octos#2567 (host-registered peer tools); a kernel without it refuses the
+# registration and the broker then starts no turns, Rinx's included.
+toolbox-peers = [
+    "octos-core",
+    "llm",
+    "octosense-app-peers/peer-tools",
+    "dep:octosense-toolbox",
+    "octosense-toolbox/octos-engine",
+    "dep:octosense-appstore",
+    "dep:serde_json",
+    "dep:tokio",
+]
 
 [dependencies]
 makepad-widgets = { workspace = true }
@@ -48,6 +65,10 @@ octosense-llm-config = { workspace = true }
 octosense-app-peers = { workspace = true }
 octosense-kernel = { workspace = true, optional = true }
 octosense-llm-service = { workspace = true, optional = true }
+octosense-toolbox = { workspace = true, optional = true }
+octosense-appstore = { workspace = true, optional = true }
+serde_json = { workspace = true, optional = true }
+tokio = { workspace = true, optional = true, features = ["rt", "sync", "macros"] }
 
 # Native mobile builds always carry the kernel (Android bundles liboctos.so,
 # OpenHarmony links the core in-process, iOS runs none) and, when the `llm`
diff --git a/crates/ai-host/README.md b/crates/ai-host/README.md
index c7e018bb..f80759f3 100644
--- a/crates/ai-host/README.md
+++ b/crates/ai-host/README.md
@@ -36,11 +36,55 @@ QrImport` (`platform()` or `paste_only()`); `policy: Policy`
 (`Policy::shipped()` grants Rinx the `octos.*` services).
 
 Features: `octos-core` (the kernel, app-peers broker, llm restart; native
-mobile targets always have it — `cfg(kernel)`, set by build.rs) and `llm`
-(register the `llm` service; a shell's `app-hub` turns it on).
+mobile targets always have it — `cfg(kernel)`, set by build.rs), `llm`
+(register the `llm` service; a shell's `app-hub` turns it on) and
+`toolbox-peers` (below; off by default).
+
+## The system toolbox for app agents (`toolbox-peers`)
+
+ADR 0002 section 6 and News M5: the toolbox's tools are registered with each
+app's peer (octos#2567, host-registered peer tools) and run by the host
+(`src/toolbox_peers.rs`, over `crates/toolbox`'s `peer` module).
+
+| The app's grant | Registered tools (risk) |
+| --- | --- |
+| none | the empty set (registration is mandatory) |
+| `research` | `workflow.run` (read), `workflow.fork` (act), `toolbox.search` (read), `toolbox.web_read` (read) |
+| `crawl`, with `max_depth` and `max_pages` above 0 in the scope | `toolbox.deep_crawl` (read) |
+
+octos's `deep_research` is never offered; `workflow.list` and
+`workflow.evaluate` are not either (the run tool's description lists the
+templates). All are `background`, none `outward`, `confirm: host`: none is
+gated by the kernel. A call is checked again against the grant (a forged
+`toolbox.deep_crawl` is refused), runs with the app's `AppContext` (id,
+grants, octos `Scope`, its own budget) on the octos research engine, and its
+model calls go through the `model` service's `ModelHost::complete`: the
+person's providers and the app's daily budget, in the same ledger as
+`model.complete`.
+
+Results are written to the host-owned `<apps root>/.host/toolbox/<app id>`
+(`toolbox_folder`, always compiled; run results under
+`toolbox/runs/<template>/<run>.json`, research items under `research/`),
+outside the app's jail, where the glance screen's `sys.digest` (OctoSense
+#87) reads them.
+
+**Grants.** `research`/`crawl` in the manifest's `capabilities`, the scope
+in octos's `Scope` shape under the manifest's `research` object
+(provisional: App Hub has no such capability yet). **Temporary:** until App
+Hub verifies these capabilities only system apps (`os.*`) get what they
+declare; any other app's declaration is ignored.
+
+**Turning it on** needs octos#2567 on the workspace's octos pin: a kernel
+without it refuses `peer/tools/register`, and the broker then starts no
+turns for any app, Rinx included. It also changes what a registered peer's
+turns get (see `crates/app-peers`'s README).
 
 Tests: `cargo test -p octosense-ai-host --features octos-core,llm` (and
-without features for a kernel-less desktop). The module-host tests that
+without features for a kernel-less desktop); `--features toolbox-peers` adds
+the toolbox's registration and routing against a scripted kernel with the
+toolbox's fixture backends, and, when `OCTOS_APP_PEERS_TEST_KERNEL` names an
+`octos` built with octos#2567, `tests/toolbox_real_kernel.rs` against the
+real kernel. The module-host tests that
 create real instances (Rinx included) live with each shell's
 `module_host.rs`.
 
diff --git a/crates/ai-host/src/lib.rs b/crates/ai-host/src/lib.rs
index 2de1fa9d..7bf83136 100644
--- a/crates/ai-host/src/lib.rs
+++ b/crates/ai-host/src/lib.rs
@@ -41,9 +41,16 @@
 //!   declares or is granted nothing gets nothing, and no peer is allocated.
 //!   Dropping the [`Assistant`] releases the instance's leases and
 //!   interrupts its peer's running work; the kernel and other apps go on.
+//! - **The system toolbox for app agents** (feature `toolbox-peers`, off by
+//!   default until octos#2567 is on the pin): every app peer registers its
+//!   toolbox tools with the kernel and the host runs their calls
+//!   ([`toolbox_peers`]). Its results live in each app's host-owned toolbox
+//!   folder ([`toolbox_folder`]), which exists with or without the feature.
 
 mod bridge;
 mod qr;
+#[cfg(feature = "toolbox-peers")]
+pub mod toolbox_peers;
 
 pub use bridge::{Bridge, Done};
 pub use qr::{ImageSource, PickError, QrImport, DROP_APP};
@@ -341,6 +348,32 @@ pub fn kernel_running() -> bool {
     false
 }
 
+// ---- the system toolbox's folders ------------------------------------------
+
+/// The host's folder for every app's toolbox, under the apps root:
+/// `<apps root>/.host/toolbox`. Outside every app's jail
+/// (`<apps root>/<app id>`), so an app cannot write a digest the glance
+/// screen would show as the host's.
+pub const TOOLBOX_HOST_DIR: [&str; 2] = [".host", "toolbox"];
+
+/// `<apps root>/.host/toolbox` ([`TOOLBOX_HOST_DIR`]). The glance screen's
+/// `sys.digest` resolver (OctoSense #87) reads run results under it.
+pub fn toolbox_root(apps_root: &std::path::Path) -> PathBuf {
+    TOOLBOX_HOST_DIR.iter().fold(apps_root.to_path_buf(), |dir, part| dir.join(part))
+}
+
+/// One app's toolbox folder, `<apps root>/.host/toolbox/<app id>`: run
+/// results in `toolbox/runs/<template>/<run>.json`, forks in
+/// `toolbox/templates/`, research items in `research/`. `None` for an id
+/// that is not one safe path segment.
+pub fn toolbox_folder(apps_root: &std::path::Path, app_id: &str) -> Option<PathBuf> {
+    let valid = !app_id.is_empty()
+        && app_id.len() <= 64
+        && !app_id.starts_with('.')
+        && app_id.bytes().all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'_' | b'-'));
+    valid.then(|| toolbox_root(apps_root).join(app_id))
+}
+
 // ---- apps' assistant access -------------------------------------------------
 
 /// The host policy in force: [`Policy::shipped`] until [`start`] installs
@@ -429,12 +462,22 @@ pub fn offer(module: &dyn AppModule, scope: &InstanceScope) -> Offer {
     let assistant = STATE.get().is_none_or(|s| s.kernel).then(|| {
         // Before `start` (a module host's own tests) the kernel keeps its
         // defaults; after it, only a shell that hosts a kernel offers.
+        #[cfg(not(feature = "toolbox-peers"))]
         let broker = octosense_app_peers::hosted::launch(
             module.id(),
             module.label(),
             module.capabilities().iter().copied(),
             host_policy(),
         )?;
+        // Every peer registers its toolbox tools, possibly none (octos#2567).
+        #[cfg(feature = "toolbox-peers")]
+        let broker = octosense_app_peers::hosted::launch_with_tools(
+            module.id(),
+            module.label(),
+            module.capabilities().iter().copied(),
+            host_policy(),
+            toolbox_peers::tools_for_module(module.id(), module.capabilities().iter().copied()),
+        )?;
         octosense_app_peers::hosted::offer(module.id(), &scope, &broker);
         Some(Assistant { broker })
     }).flatten();
diff --git a/crates/ai-host/src/toolbox_peers.rs b/crates/ai-host/src/toolbox_peers.rs
new file mode 100644
index 00000000..b8a8957c
--- /dev/null
+++ b/crates/ai-host/src/toolbox_peers.rs
@@ -0,0 +1,347 @@
+//! The system toolbox offered to app agents (ADR 0002 section 6, News M5;
+//! octos UPCR-2026-035 / octos#2567). Feature `toolbox-peers`.
+//!
+//! When the broker sets up an app's peer, it registers the toolbox tools the
+//! app's grants allow ([`octosense_toolbox::peer::tool_decls`]): `research`
+//! gives `workflow.run`, `workflow.fork`, `toolbox.search` and
+//! `toolbox.web_read`; `crawl` (with crawl limits in the scope) gives
+//! `toolbox.deep_crawl`; no grant gives the empty set, which the broker still
+//! registers. octos's `deep_research` is never offered.
+//!
+//! Each `peer/tool/call` runs [`ToolboxTools`]: the toolbox with the app's
+//! [`AppContext`] (id, grants, octos `Scope`, budget, and its host-owned
+//! folder), over the octos research engine (`OctosResearch`), with the
+//! templates' model calls going through the `model` service's host
+//! ([`ModelHostClient`] over `ModelHost::complete`), so they use the
+//! person's providers and count against the app's daily budget in the same
+//! ledger as `model.complete`.
+//!
+//! **Results** are written under [`crate::toolbox_folder`]
+//! (`<apps root>/.host/toolbox/<app>`), outside the app's jail
+//! (`<apps root>/<app>`), where the glance screen's `sys.digest` reads them
+//! (OctoSense #87): an app cannot forge a digest.
+//!
+//! **Where grants come from** ([`grant_from_manifest`],
+//! [`grant_from_capabilities`]): the app's manifest declares `research`
+//! and/or `crawl` among its `capabilities`, with its scope, in octos's
+//! `Scope` shape, under the manifest's [`SCOPE_KEY`] object (absent: no
+//! narrowing beyond octos's defaults, and no crawl limits, so no crawling).
+//!
+//! **TEMPORARY, until App Hub admits the `research` and `crawl` capabilities
+//! (checks, pins and lets the person grant them):** only system apps
+//! (`os.*`, shipped inside the shell and reviewed with it) get what they
+//! declare. Any other app's declaration is ignored, so a store app cannot
+//! grant itself research by writing it into its manifest. Remove
+//! [`system_app_only`] when App Hub verifies the grant, and read the verified
+//! grant instead.
+
+use crate::toolbox_folder;
+use octosense_app_peers::peer_tools::{Cancel, HostTools, Registration, ToolCall, ToolError, ToolFuture};
+use octosense_llm_service::complete::{self, Class, Code, ModelHost};
+use octosense_toolbox::host::{CallContext, HostError, HostFuture};
+use octosense_toolbox::peer::{self, PeerToolbox, CRAWL, RESEARCH};
+use octosense_toolbox::research::octos::{OctosConfig, OctosResearch};
+use octosense_toolbox::research::{ModelClient, ModelRequest};
+use octosense_toolbox::{scope, AppContext, Library, Scope};
+use serde_json::{json, Value};
+use std::collections::BTreeSet;
+use std::path::{Path, PathBuf};
+use std::rc::Rc;
+use std::sync::Arc;
+use tokio::sync::{mpsc, oneshot};
+
+/// The manifest object that holds the `research`/`crawl` scope (octos's
+/// `Scope` fields). Provisional: App Hub has no such capability yet; when it
+/// adds one, change this reader to its shape.
+pub const SCOPE_KEY: &str = "research";
+
+/// How long the kernel waits for one toolbox call: the most octos allows
+/// (a template's own `max_ms` is at most 300 s too).
+pub const CALL_TIMEOUT_MS: u64 = 300_000;
+/// The largest result the kernel accepts from the toolbox (octos's ceiling).
+pub const MAX_RESULT_BYTES: u64 = 1024 * 1024;
+
+/// An app's toolbox grant.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ToolboxGrant {
+    /// `research` and/or `crawl`.
+    pub grants: BTreeSet<String>,
+    pub scope: Scope,
+    /// Why a declaration was not granted, for the log.
+    pub notes: Vec<String>,
+}
+
+impl ToolboxGrant {
+    /// Nothing granted.
+    pub fn none(note: Option<String>) -> Self {
+        Self {
+            grants: BTreeSet::new(),
+            scope: scope::unrestricted(),
+            notes: note.into_iter().collect(),
+        }
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.grants.is_empty()
+    }
+}
+
+/// TEMPORARY (see the module docs): whether `app_id` may have what it
+/// declares without App Hub's check. System apps only.
+pub fn system_app_only(app_id: &str) -> bool {
+    app_id.starts_with("os.")
+}
+
+/// The grant an app's manifest declares: `research`/`crawl` in its
+/// `capabilities`, the scope under [`SCOPE_KEY`]. A manifest for another id,
+/// a scope octos refuses, or (for now) an app that is not a system app gets
+/// nothing.
+pub fn grant_from_manifest(app_id: &str, manifest: &Value) -> ToolboxGrant {
+    if manifest.get("id").and_then(Value::as_str) != Some(app_id) {
+        return ToolboxGrant::none(Some(format!("{app_id}: the manifest names another app")));
+    }
+    let declared = manifest["capabilities"]
+        .as_array()
+        .map(|c| c.iter().filter_map(Value::as_str).collect::<Vec<_>>())
+        .unwrap_or_default();
+    grant(app_id, declared, manifest.get(SCOPE_KEY))
+}
+
+/// The grant of a native module from its declared capabilities: it has no
+/// manifest scope, so octos's defaults and no crawl limits.
+pub fn grant_from_capabilities<'a>(app_id: &str, capabilities: impl IntoIterator<Item = &'a str>) -> ToolboxGrant {
+    grant(app_id, capabilities, None)
+}
+
+fn grant<'a>(app_id: &str, declared: impl IntoIterator<Item = &'a str>, scope: Option<&Value>) -> ToolboxGrant {
+    let declared: BTreeSet<String> = declared
+        .into_iter()
+        .filter(|c| *c == RESEARCH || *c == CRAWL)
+        .map(str::to_owned)
+        .collect();
+    if declared.is_empty() {
+        return ToolboxGrant::none(None);
+    }
+    if !system_app_only(app_id) {
+        return ToolboxGrant::none(Some(format!(
+            "{app_id} declares {declared:?}, but App Hub does not verify those capabilities yet: until it does only system apps (os.*) get them"
+        )));
+    }
+    match scope::parse(scope.unwrap_or(&json!({}))) {
+        Ok(scope) => ToolboxGrant { grants: declared, scope, notes: Vec::new() },
+        Err(why) => ToolboxGrant::none(Some(format!("{app_id}: its research scope is refused ({why})"))),
+    }
+}
+
+/// The toolbox's [`AppContext`] for an app: its grants and scope, and its
+/// host-owned folder under `apps_root`. `None` for an id that is not one
+/// path segment.
+pub fn app_context(app_id: &str, grant: &ToolboxGrant, apps_root: &Path) -> Option<AppContext> {
+    let folder = toolbox_folder(apps_root, app_id)?;
+    let mut app = AppContext::new(app_id, folder).with_scope(grant.scope.clone());
+    for g in &grant.grants {
+        app = app.grant(g.clone());
+    }
+    Some(app)
+}
+
+/// The toolbox's `ModelClient` over the `model` service's host: the
+/// person's providers, the app's daily budget, one ledger
+/// (`<apps root>/.host/model/ledger.json`).
+pub struct ModelHostClient {
+    host: Option<Arc<ModelHost>>,
+    /// `<apps root>/.host`, where the ledger lives.
+    host_dir: PathBuf,
+}
+
+impl ModelHostClient {
+    /// Over the host the shell registered (`complete::host()`, looked up at
+    /// each call: the `llm` service registers it at start).
+    pub fn registered(apps_root: &Path) -> Self {
+        Self { host: None, host_dir: apps_root.join(".host") }
+    }
+
+    /// Over this host (tests).
+    pub fn new(host: Arc<ModelHost>, apps_root: &Path) -> Self {
+        Self { host: Some(host), host_dir: apps_root.join(".host") }
+    }
+
+    /// The toolbox's request as a host caller's `model.complete`: the
+    /// template's prompt as the host-only `system`, its user document as the
+    /// input, its output schema, and URLs allowed (the toolbox's own
+    /// `validate_digest` checks the reply after).
+    pub fn request(request: &ModelRequest) -> complete::Request {
+        complete::Request {
+            // Both tasks are bounded by their schema; the fast class is what
+            // the templates were validated on (deepseek-v4-flash).
+            class: Class::Fast,
+            task: String::new(),
+            input: Value::String(request.user.clone()),
+            schema: request.output_schema.clone(),
+            allow_urls: true,
+            system: Some(request.system.clone()),
+        }
+    }
+}
+
+impl ModelClient for ModelHostClient {
+    fn complete<'a>(&'a self, ctx: &'a CallContext, request: ModelRequest) -> HostFuture<'a, Result<String, HostError>> {
+        Box::pin(async move {
+            let Some(host) = self.host.clone().or_else(complete::host) else {
+                return Err(HostError::Denied("no_provider: the model service is not running in this shell".into()));
+            };
+            host.attach(&self.host_dir);
+            let app = ctx.app.app_id.clone();
+            let request = Self::request(&request);
+            let answer = tokio::task::spawn_blocking(move || host.complete(&app, request))
+                .await
+                .map_err(|e| HostError::Failed(format!("model call: {e}")))?;
+            match answer {
+                Ok(done) => Ok(done.output.to_string()),
+                Err(refusal) => Err(match refusal.code {
+                    Code::Budget | Code::Rate | Code::Capability | Code::NoProvider => HostError::Denied(refusal.to_string()),
+                    _ => HostError::Failed(refusal.to_string()),
+                }),
+            }
+        })
+    }
+}
+
+type Job = (ToolCall, Cancel, oneshot::Sender<Result<Value, ToolError>>);
+
+/// One app's toolbox tools for its peer. The toolbox's futures are not
+/// `Send` (the template VM stays on its thread), so each app's toolbox lives
+/// on a worker thread of its own; the broker's calls reach it over a
+/// channel, and a call's cancel stops it there.
+pub struct ToolboxTools {
+    app_id: String,
+    registration: Registration,
+    jobs: mpsc::UnboundedSender<Job>,
+}
+
+impl ToolboxTools {
+    /// The tools of `app`, run by the toolbox `make` builds on the worker.
+    pub fn new(app: AppContext, make: impl FnOnce() -> Result<PeerToolbox, String> + Send + 'static) -> Self {
+        let registration = Registration {
+            tools: Library::builtin().map(|l| peer::tool_decls(&app, &l)).unwrap_or_default(),
+            generic_tools: Vec::new(),
+            call_timeout_ms: Some(CALL_TIMEOUT_MS),
+            max_result_bytes: Some(MAX_RESULT_BYTES),
+        };
+        let app_id = app.app_id.clone();
+        let (jobs, rx) = mpsc::unbounded_channel();
+        let spawned = std::thread::Builder::new()
+            .name(format!("toolbox-{app_id}"))
+            .spawn(move || worker(app, make, rx));
+        if let Err(e) = spawned {
+            makepad_widgets::log!("toolbox: no worker for {app_id}: {e}");
+        }
+        Self { app_id, registration, jobs }
+    }
+
+    /// The shell's toolbox for `app_id`: the octos research engine and the
+    /// person's providers through the `model` service. `None` without a
+    /// grant (the broker then registers the empty set).
+    pub fn shell(app_id: &str, grant: &ToolboxGrant, apps_root: &Path) -> Option<Self> {
+        for note in &grant.notes {
+            makepad_widgets::log!("toolbox: {note}");
+        }
+        if grant.is_empty() {
+            return None;
+        }
+        let app = app_context(app_id, grant, apps_root)?;
+        let root = apps_root.to_path_buf();
+        Some(Self::new(app, move || {
+            let library = Library::builtin().map_err(|e| e.to_string())?;
+            let backend = Arc::new(OctosResearch::new(OctosConfig::from_env()));
+            Ok(PeerToolbox::new(library, backend, Arc::new(ModelHostClient::registered(&root))))
+        }))
+    }
+
+    pub fn app_id(&self) -> &str {
+        &self.app_id
+    }
+}
+
+fn worker(
+    app: AppContext,
+    make: impl FnOnce() -> Result<PeerToolbox, String>,
+    mut jobs: mpsc::UnboundedReceiver<Job>,
+) {
+    let runtime = match tokio::runtime::Builder::new_current_thread().enable_all().build() {
+        Ok(rt) => rt,
+        Err(e) => {
+            makepad_widgets::log!("toolbox: no runtime for {}: {e}", app.app_id);
+            return;
+        }
+    };
+    let local = tokio::task::LocalSet::new();
+    local.block_on(&runtime, async move {
+        let toolbox = make().map(Rc::new);
+        if let Err(why) = &toolbox {
+            makepad_widgets::log!("toolbox: {} has no toolbox: {why}", app.app_id);
+        }
+        let app = Rc::new(app);
+        while let Some((call, cancel, reply)) = jobs.recv().await {
+            let toolbox = toolbox.clone();
+            let app = app.clone();
+            tokio::task::spawn_local(async move {
+                if cancel.is_cancelled() {
+                    return;
+                }
+                let result = match &toolbox {
+                    Err(why) => Err(ToolError::new("unavailable", why.clone())),
+                    Ok(toolbox) => {
+                        tokio::select! {
+                            result = toolbox.call(&app, &call.name, call.args) => {
+                                result.map_err(|e| ToolError::new(&e.kind, e.message))
+                            }
+                            // Never finish a call the kernel stopped waiting for.
+                            _ = cancel.cancelled() => return,
+                        }
+                    }
+                };
+                let _ = reply.send(result);
+            });
+        }
+    });
+}
+
+impl HostTools for ToolboxTools {
+    fn registration(&self) -> Registration {
+        self.registration.clone()
+    }
+
+    fn call(&self, call: ToolCall, cancel: Cancel) -> ToolFuture {
+        let (tx, rx) = oneshot::channel();
+        let sent = self.jobs.send((call, cancel, tx));
+        Box::pin(async move {
+            if sent.is_err() {
+                return Err(ToolError::new("unavailable", "the toolbox is not running"));
+            }
+            rx.await
+                .unwrap_or_else(|_| Err(ToolError::new("cancelled", "the toolbox call was stopped")))
+        })
+    }
+}
+
+/// The tools a contained app's peer gets from its manifest (OctoSense #106
+/// launches those peers): `None` without a grant or before the host knows
+/// its apps root.
+pub fn tools_for_manifest(app_id: &str, manifest: &Value) -> Option<Arc<dyn HostTools>> {
+    let root = octosense_appstore::data_root_if_set()?;
+    ToolboxTools::shell(app_id, &grant_from_manifest(app_id, manifest), &root).map(|t| Arc::new(t) as Arc<dyn HostTools>)
+}
+
+/// The tools a native module's peer gets from its declared capabilities.
+pub fn tools_for_module<'a>(app_id: &str, capabilities: impl IntoIterator<Item = &'a str>) -> Option<Arc<dyn HostTools>> {
+    let grant = grant_from_capabilities(app_id, capabilities);
+    if grant.is_empty() && grant.notes.is_empty() {
+        return None;
+    }
+    let Some(root) = octosense_appstore::data_root_if_set() else {
+        makepad_widgets::log!("toolbox: {app_id} is granted research, but the apps root is not known yet; no tools");
+        return None;
+    };
+    ToolboxTools::shell(app_id, &grant, &root).map(|t| Arc::new(t) as Arc<dyn HostTools>)
+}
diff --git a/crates/ai-host/tests/toolbox_peers.rs b/crates/ai-host/tests/toolbox_peers.rs
new file mode 100644
index 00000000..1c28886d
--- /dev/null
+++ b/crates/ai-host/tests/toolbox_peers.rs
@@ -0,0 +1,457 @@
+//! The system toolbox as app peers' host-registered tools (feature
+//! `toolbox-peers`), against a scripted kernel speaking octos
+//! UPCR-2026-034/035, with the toolbox's fixture backends (recorded
+//! searches and pages, `FakeModel`) or the `model` service's host over a
+//! fake provider. No network, no kernel binary.
+#![cfg(feature = "toolbox-peers")]
+
+use std::collections::{BTreeSet, VecDeque};
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU32, Ordering};
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant};
+
+use octosense_ai_host::app_peers::broker::{BoxFuture, Broker, BrokerConfig, Connector, Link};
+use octosense_ai_host::app_peers::peer_tools::HostTools;
+use octosense_ai_host::app_peers::{Deployment, OCTOS_SERVICES};
+use octosense_ai_host::toolbox_peers::{
+    app_context, grant_from_capabilities, grant_from_manifest, ModelHostClient, ToolboxGrant, ToolboxTools,
+};
+use octosense_llm_config::Provider;
+use octosense_llm_service::complete::{self, ledger::Limits, Candidate, ModelHost, Providers, Transport};
+use octosense_toolbox::fixture::{self, FixtureBackend, FixtureCase, FixtureData};
+use octosense_toolbox::host::CallContext;
+use octosense_toolbox::peer::{PeerToolbox, DEEP_CRAWL, FORK, RUN, SEARCH, WEB_READ};
+use octosense_toolbox::research::{ModelClient, ModelRequest, ModelTask};
+use octosense_toolbox::{AppContext, Library};
+use serde_json::{json, Value};
+use tokio::sync::mpsc;
+
+const TOKEN: &str = "fixture-host-token";
+const APP: &str = "os.news";
+
+// ---- a scripted kernel ---------------------------------------------------------
+
+#[derive(Default)]
+struct Script {
+    calls: Vec<(String, Value)>,
+    out: Option<mpsc::UnboundedSender<String>>,
+}
+
+struct FakeConnector(Arc<Mutex<Script>>);
+
+struct FakeLink {
+    to_kernel: mpsc::UnboundedSender<String>,
+    from_kernel: mpsc::UnboundedReceiver<String>,
+}
+
+impl Link for FakeLink {
+    fn send(&mut self, frame: String) -> Result<(), String> {
+        self.to_kernel.send(frame).map_err(|_| "gone".to_owned())
+    }
+    fn recv(&mut self) -> BoxFuture<'_, Result<String, String>> {
+        Box::pin(async move { self.from_kernel.recv().await.ok_or_else(|| "closed".to_owned()) })
+    }
+}
+
+impl Connector for FakeConnector {
+    fn available(&self) -> Result<(), String> {
+        Ok(())
+    }
+    fn connect(&self) -> BoxFuture<'static, Result<Box<dyn Link>, String>> {
+        let script = self.0.clone();
+        Box::pin(async move {
+            let (to_kernel, mut kernel_in) = mpsc::unbounded_channel::<String>();
+            let (kernel_out, from_kernel) = mpsc::unbounded_channel::<String>();
+            script.lock().unwrap().out = Some(kernel_out.clone());
+            tokio::spawn(async move {
+                while let Some(frame) = kernel_in.recv().await {
+                    let frame: Value = serde_json::from_str(&frame).unwrap();
+                    let method = frame["method"].as_str().unwrap().to_owned();
+                    let params = frame["params"].clone();
+                    script.lock().unwrap().calls.push((method.clone(), params.clone()));
+                    let result = match method.as_str() {
+                        "peer/prepare" => json!({"slug": "news-1", "cwd": "/kernel/ws",
+                            "memory_namespace": params["memory_namespace"], "host_token": TOKEN}),
+                        "peer/tools/register" => json!({"slug": "news-1", "version": 1, "applies": "next_turn"}),
+                        "peer/tool/result" => json!({"call_id": params["call_id"], "accepted": true}),
+                        _ => json!({}),
+                    };
+                    let _ = kernel_out.send(json!({"jsonrpc": "2.0", "id": frame["id"], "result": result}).to_string());
+                }
+            });
+            Ok(Box::new(FakeLink { to_kernel, from_kernel }) as Box<dyn Link>)
+        })
+    }
+    fn owns_runtime(&self) -> bool {
+        false
+    }
+    fn shutdown(&self) {}
+}
+
+/// A broker for `os.news` with `tools`, bound to its peer.
+fn bound(tools: Option<Arc<dyn HostTools>>) -> (Broker, Arc<Mutex<Script>>) {
+    let script = Arc::new(Mutex::new(Script::default()));
+    let services: BTreeSet<String> = OCTOS_SERVICES.iter().map(|s| s.to_string()).collect();
+    let mut cfg = BrokerConfig::new(Deployment::Hosted, "_main", "_main:api:octosense#system", APP, "News", services);
+    cfg.host_tools = tools;
+    let broker = Broker::new(cfg, Arc::new(FakeConnector(script.clone())));
+    octosense_ai_host::app_peers::OctosAppService::set_account(&broker, Some("device"));
+    broker.bind().unwrap();
+    (broker, script)
+}
+
+fn registered(script: &Arc<Mutex<Script>>) -> Vec<String> {
+    let calls = script.lock().unwrap().calls.clone();
+    let (_, params) = calls.iter().find(|(m, _)| m == "peer/tools/register").expect("a registration");
+    assert_eq!(params["host_token"], TOKEN);
+    params["tools"].as_array().unwrap().iter().map(|t| t["name"].as_str().unwrap().to_owned()).collect()
+}
+
+fn inject(script: &Arc<Mutex<Script>>, method: &str, params: Value) {
+    let out = script.lock().unwrap().out.clone().expect("a link");
+    out.send(json!({"jsonrpc": "2.0", "method": method, "params": params}).to_string()).unwrap();
+}
+
+static CALLS: AtomicU32 = AtomicU32::new(0);
+
+/// Sends one `peer/tool/call`; its call id.
+fn call(script: &Arc<Mutex<Script>>, name: &str, args: Value) -> String {
+    let n = CALLS.fetch_add(1, Ordering::Relaxed);
+    let call_id = format!("call-{n}");
+    inject(
+        script,
+        "peer/tool/call",
+        json!({"peer": "news-1", "session_id": "_main:api:octosense#peer-news-1", "context_id": null,
+               "turn_id": "turn-1", "call_id": call_id, "tool_call_id": format!("tc-{n}"), "args_digest": "d",
+               "name": name, "args": args, "risk": "read", "confirm_required": false,
+               "timeout_ms": 60_000, "tools_version": 1}),
+    );
+    call_id
+}
+
+fn result_of(script: &Arc<Mutex<Script>>, call_id: &str) -> Option<Value> {
+    script
+        .lock()
+        .unwrap()
+        .calls
+        .iter()
+        .find(|(m, p)| m == "peer/tool/result" && p["call_id"] == call_id)
+        .map(|(_, p)| p.clone())
+}
+
+fn wait(script: &Arc<Mutex<Script>>, call_id: &str) -> Value {
+    let deadline = Instant::now() + Duration::from_secs(20);
+    loop {
+        if let Some(result) = result_of(script, call_id) {
+            return result;
+        }
+        assert!(Instant::now() < deadline, "no result for {call_id}");
+        std::thread::sleep(Duration::from_millis(20));
+    }
+}
+
+// ---- fixtures -------------------------------------------------------------------
+
+fn temp(tag: &str) -> PathBuf {
+    static N: AtomicU32 = AtomicU32::new(0);
+    let dir = std::env::temp_dir().join(format!("toolbox-peers-{tag}-{}-{}", std::process::id(), N.fetch_add(1, Ordering::Relaxed)));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    dir
+}
+
+fn case(template: &str, name: &str) -> FixtureCase {
+    let path = Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("../toolbox/templates")
+        .join(template)
+        .join("fixtures")
+        .join(format!("{name}.json"));
+    serde_json::from_str(&std::fs::read_to_string(path).unwrap()).unwrap()
+}
+
+fn manifest(capabilities: &[&str], scope: Option<Value>) -> Value {
+    let mut m = json!({"id": APP, "capabilities": capabilities});
+    if let Some(scope) = scope {
+        m["research"] = scope;
+    }
+    m
+}
+
+/// The toolbox over recorded searches and pages and the fake model.
+fn fixture_tools(app: AppContext, data: FixtureData) -> ToolboxTools {
+    ToolboxTools::new(app, move || {
+        let library = Library::builtin().map_err(|e| e.to_string())?;
+        let backend = Arc::new(FixtureBackend::new(data.clone()));
+        Ok(PeerToolbox::from_host(library, fixture::host(&data), backend))
+    })
+}
+
+fn news_app(root: &Path, grant: &ToolboxGrant) -> AppContext {
+    app_context(APP, grant, root).unwrap()
+}
+
+// ---- registration ---------------------------------------------------------------
+
+#[test]
+fn the_registration_follows_the_grant() {
+    let root = temp("register");
+    let data = case("news-digest", "city-infrastructure").fixture;
+    let names = |grant: ToolboxGrant| -> Vec<String> {
+        let tools = (!grant.is_empty())
+            .then(|| Arc::new(fixture_tools(news_app(&root, &grant), data.clone())) as Arc<dyn HostTools>);
+        let (_broker, script) = bound(tools);
+        registered(&script)
+    };
+    let crawl_scope = Some(json!({"max_depth": 2, "max_pages": 5}));
+    // research: the templates and the single research tools.
+    assert_eq!(names(grant_from_manifest(APP, &manifest(&["storage", "research"], None))), [RUN, FORK, SEARCH, WEB_READ]);
+    // research and crawl, with crawl limits.
+    assert_eq!(
+        names(grant_from_manifest(APP, &manifest(&["research", "crawl"], crawl_scope.clone()))),
+        [RUN, FORK, SEARCH, WEB_READ, DEEP_CRAWL]
+    );
+    // crawl alone: only the crawl.
+    assert_eq!(names(grant_from_manifest(APP, &manifest(&["crawl"], crawl_scope.clone()))), [DEEP_CRAWL]);
+    // crawl without limits in the scope: no crawling.
+    assert!(names(grant_from_manifest(APP, &manifest(&["research", "crawl"], None))).iter().all(|n| n != DEEP_CRAWL));
+    // No grant: the empty set is still registered.
+    assert!(names(grant_from_manifest(APP, &manifest(&["storage", "net"], None))).is_empty());
+    // A native module declaring nothing of the toolbox.
+    assert!(names(grant_from_capabilities("rinx", ["octos.turn.start"])).is_empty());
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+#[test]
+fn until_app_hub_verifies_the_grant_only_system_apps_get_it() {
+    let store = json!({"id": "com.example.news", "capabilities": ["research", "crawl"], "research": {"max_depth": 1, "max_pages": 3}});
+    let grant = grant_from_manifest("com.example.news", &store);
+    assert!(grant.is_empty());
+    assert!(grant.notes[0].contains("only system apps"), "{:?}", grant.notes);
+    assert!(grant_from_capabilities("rinx", ["research"]).is_empty());
+    // A manifest for another app, or a scope octos refuses, grants nothing.
+    assert!(grant_from_manifest("os.mail", &manifest(&["research"], None)).is_empty());
+    let bad = grant_from_manifest(APP, &manifest(&["research"], Some(json!({"languages": ["en"]}))));
+    assert!(bad.is_empty() && bad.notes[0].contains("old toolbox shape"), "{:?}", bad.notes);
+    let good = grant_from_manifest(APP, &manifest(&["research"], Some(json!({"langs": ["en"], "max_age_days": 2}))));
+    assert_eq!(good.grants, BTreeSet::from(["research".to_owned()]));
+    assert_eq!(good.scope.langs, ["en"]);
+}
+
+// ---- routing --------------------------------------------------------------------
+
+#[test]
+fn a_workflow_run_is_routed_to_the_toolbox_and_its_result_lands_in_the_host_folder() {
+    let root = temp("run");
+    let case = case("news-digest", "city-infrastructure");
+    let grant = grant_from_manifest(APP, &manifest(&["research"], None));
+    let tools = fixture_tools(news_app(&root, &grant), case.fixture.clone());
+    let (_broker, script) = bound(Some(Arc::new(tools)));
+    let id = call(&script, RUN, json!({"id": "news-digest", "params": case.params, "run_id": "glance"}));
+    let result = wait(&script, &id);
+    assert_eq!(result["ok"], true, "{result}");
+    let data = &result["data"];
+    assert_eq!(data["status"], "ready", "{data}");
+    assert_eq!(data["run_id"], "glance");
+    assert_eq!(data["result"], "toolbox/runs/news-digest/glance.json");
+    assert!(!data["sources"].as_array().unwrap().is_empty());
+    // In the host's folder, where sys.digest reads; never in the app's jail.
+    let file = octosense_ai_host::toolbox_folder(&root, APP).unwrap().join("toolbox/runs/news-digest/glance.json");
+    assert_eq!(file, root.join(".host/toolbox/os.news/toolbox/runs/news-digest/glance.json"));
+    let saved: Value = serde_json::from_str(&std::fs::read_to_string(&file).unwrap()).unwrap();
+    assert_eq!(saved["app_id"], APP);
+    assert!(!root.join(APP).exists(), "nothing is written into the app's jail");
+
+    // A fork is written there too, and is runnable by its new id.
+    let id = call(&script, FORK, json!({"id": "news-digest", "new_id": "my-digest"}));
+    let fork = wait(&script, &id);
+    assert_eq!(fork["ok"], true, "{fork}");
+    assert!(root.join(".host/toolbox/os.news/toolbox/templates/my-digest/template.json").exists());
+
+    // The single tools save their items in the host folder too.
+    let id = call(&script, SEARCH, json!({"query": "city infrastructure", "lang": "en", "count": 2}));
+    let search = wait(&script, &id);
+    assert_eq!(search["ok"], true, "{search}");
+    assert_eq!(search["data"]["items"].as_array().unwrap().len(), 2);
+    let saved = search["data"]["file"].as_str().unwrap();
+    assert!(saved.starts_with("research/search-"), "{saved}");
+    assert!(root.join(".host/toolbox/os.news").join(saved).exists());
+    let id = call(&script, WEB_READ, json!({"url": "https://example.invalid/news/buses"}));
+    let read = wait(&script, &id);
+    assert_eq!(read["ok"], true, "{read}");
+    assert!(read["data"]["text"].as_str().unwrap().contains("electric buses"));
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+#[test]
+fn calls_outside_the_scope_are_refused() {
+    let root = temp("scope");
+    let case = case("news-digest", "city-infrastructure");
+    let grant = grant_from_manifest(
+        APP,
+        &manifest(&["research"], Some(json!({"langs": ["en"], "domains_deny": ["example.invalid"]}))),
+    );
+    let (_broker, script) = bound(Some(Arc::new(fixture_tools(news_app(&root, &grant), case.fixture.clone()))));
+    let id = call(&script, SEARCH, json!({"query": "infrastructure", "lang": "fr"}));
+    let refused = wait(&script, &id);
+    assert_eq!(refused["ok"], false);
+    assert_eq!(refused["error"]["kind"], "denied");
+    assert!(refused["error"]["message"].as_str().unwrap().contains("not in this app's research grant"));
+    let id = call(&script, WEB_READ, json!({"url": "https://example.invalid/news/buses"}));
+    let refused = wait(&script, &id);
+    assert_eq!(refused["error"]["kind"], "denied", "{refused}");
+    // A template run keeps to the scope too: every read is refused, so the
+    // run has nothing to digest.
+    let id = call(&script, RUN, json!({"id": "news-digest", "params": case.params}));
+    let run = wait(&script, &id);
+    assert_eq!(run["ok"], true, "{run}");
+    assert_ne!(run["data"]["status"], "ready", "{run}");
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+#[test]
+fn an_app_without_crawl_cannot_crawl_even_with_a_forged_call() {
+    let root = temp("crawl");
+    let data = case("news-digest", "city-infrastructure").fixture;
+    let grant = grant_from_manifest(APP, &manifest(&["research"], Some(json!({"max_depth": 2, "max_pages": 5}))));
+    let app = news_app(&root, &grant);
+    let (_broker, script) = bound(Some(Arc::new(fixture_tools(app.clone(), data.clone()))));
+    assert!(!registered(&script).iter().any(|n| n == DEEP_CRAWL));
+    // The kernel would not send it; if it did, the broker refuses it.
+    let id = call(&script, DEEP_CRAWL, json!({"url": "https://example.invalid/"}));
+    let refused = wait(&script, &id);
+    assert_eq!(refused["ok"], false);
+    assert_eq!(refused["error"]["kind"], "not_registered");
+    // And the toolbox refuses it on its own, whoever asks.
+    let toolbox = PeerToolbox::from_host(
+        Library::builtin().unwrap(),
+        fixture::host(&data),
+        Arc::new(FixtureBackend::new(data.clone())),
+    );
+    let runtime = tokio::runtime::Builder::new_current_thread().enable_all().build().unwrap();
+    let refused = runtime
+        .block_on(toolbox.call(&app, DEEP_CRAWL, json!({"url": "https://example.invalid/"})))
+        .unwrap_err();
+    assert_eq!(refused.kind, "not_granted");
+    assert!(!root.join(".host/toolbox/os.news/research").exists());
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+#[test]
+fn a_cancelled_run_is_stopped_and_never_answered() {
+    let root = temp("cancel");
+    let case = case("news-digest", "city-infrastructure");
+    let mut data = case.fixture.clone();
+    for search in &mut data.searches {
+        search.delay_ms = 5_000;
+    }
+    let grant = grant_from_manifest(APP, &manifest(&["research"], None));
+    let (_broker, script) = bound(Some(Arc::new(fixture_tools(news_app(&root, &grant), data))));
+    let id = call(&script, RUN, json!({"id": "news-digest", "params": case.params, "run_id": "cancelled"}));
+    std::thread::sleep(Duration::from_millis(200));
+    inject(&script, "peer/tool/cancel", json!({"call_id": id, "reason": "cancelled"}));
+    std::thread::sleep(Duration::from_millis(800));
+    assert!(result_of(&script, &id).is_none());
+    assert!(!root.join(".host/toolbox/os.news/toolbox/runs/news-digest/cancelled.json").exists());
+    let _ = std::fs::remove_dir_all(&root);
+}
+
+// ---- model calls through the model service's host ----------------------------
+
+/// A provider answering OpenAI chat completions from a queue.
+#[derive(Default)]
+struct FakeProvider {
+    answers: Mutex<VecDeque<String>>,
+    seen: Mutex<Vec<Value>>,
+}
+
+impl Transport for FakeProvider {
+    fn post(&self, _url: &str, _headers: &[(String, String)], body: &str) -> Result<(u16, Vec<u8>), String> {
+        self.seen.lock().unwrap().push(serde_json::from_str(body).unwrap());
+        let content = self.answers.lock().unwrap().pop_front().ok_or("connection refused")?;
+        let reply = json!({"choices": [{"message": {"content": content}}], "usage": {"prompt_tokens": 100, "completion_tokens": 20}});
+        Ok((200, reply.to_string().into_bytes()))
+    }
+}
+
+struct Fixed;
+impl Providers for Fixed {
+    fn candidates(&self) -> Result<Vec<Candidate>, String> {
+        Ok(vec![Candidate {
+            provider: Provider::new("deepseek", Some("deepseek-v4-flash".into())),
+            key: Some("sk-test-deepseek-0000aaaa1234".into()),
+        }])
+    }
+}
+
+fn model_host(provider: Arc<FakeProvider>) -> Arc<ModelHost> {
+    Arc::new(ModelHost::new(
+        &complete::Options::default().providers(Arc::new(Fixed)).transport(provider).clock(|| 1_790_000_000_000),
+    ))
+}
+
+#[test]
+fn template_model_calls_use_the_model_service_and_the_apps_daily_budget() {
+    let root = temp("budget");
+    let provider = Arc::new(FakeProvider::default());
+    let host = model_host(provider.clone());
+    let client = ModelHostClient::new(host.clone(), &root);
+    let grant = grant_from_manifest(APP, &manifest(&["research"], None));
+    let app = news_app(&root, &grant);
+    let ctx = CallContext {
+        app: Arc::new(app.clone()),
+        run_id: "r".into(),
+        template_id: "news-digest".into(),
+        template_digest: String::new(),
+        budget: octosense_toolbox::Budget { max_calls: 8, max_model_calls: 2, max_reads: 4, max_ms: 60_000, max_concurrency: 1 },
+        remaining: octosense_toolbox::host::Remaining { calls: 8, model_calls: 2, reads: 4, ms: 60_000 },
+        call_index: 0,
+    };
+    let request = ModelRequest {
+        task: ModelTask::TranslateQuery,
+        system: "Translate the research query.".into(),
+        user: json!({"query": "typhoon", "language": "zh"}).to_string(),
+        max_output_tokens: None,
+        output_schema: json!({"type": "object", "required": ["query"], "properties": {"query": {"type": "string"}}}),
+    };
+    provider.answers.lock().unwrap().push_back(json!({"query": "台风"}).to_string());
+    let runtime = tokio::runtime::Builder::new_current_thread().enable_all().build().unwrap();
+    let reply = runtime.block_on(client.complete(&ctx, request.clone())).unwrap();
+    assert_eq!(serde_json::from_str::<Value>(&reply).unwrap()["query"], "台风");
+    // The template's own prompt and document went out, and no token cap.
+    let sent = provider.seen.lock().unwrap()[0].clone();
+    assert!(sent["messages"][0]["content"].as_str().unwrap().starts_with("Translate the research query."));
+    assert!(sent.get("max_tokens").is_none());
+    // Charged to the app in the model service's ledger, under the host dir.
+    assert_eq!(host.budget(APP).calls_today, 1);
+    assert_eq!(host.budget(APP).tokens_today, 120);
+    let ledger: Value = serde_json::from_str(&std::fs::read_to_string(root.join(".host/model/ledger.json")).unwrap()).unwrap();
+    assert_eq!(ledger["apps"][APP]["calls"], 1, "{ledger}");
+
+    // The day's budget is spent: the next model call is refused as budget.
+    host.set_limits(APP, Limits { per_minute: 6, calls_per_day: 1, tokens_per_day: 100_000 });
+    let refused = runtime.block_on(client.complete(&ctx, request)).unwrap_err();
+    assert!(refused.to_string().contains("budget"), "{refused}");
+    assert!(matches!(refused, octosense_toolbox::HostError::Denied(_)));
+
+    // A template run through the peer gets the refusal, not a digest.
+    let data = case("news-digest", "city-infrastructure");
+    let fixture = data.fixture.clone();
+    let root2 = root.clone();
+    let tools = ToolboxTools::new(app, move || {
+        let backend = Arc::new(FixtureBackend::new(fixture.clone()));
+        let model = Arc::new(ModelHostClient::new(host, &root2));
+        Ok(PeerToolbox::new(Library::builtin().map_err(|e| e.to_string())?, backend, model))
+    });
+    let (_broker, script) = bound(Some(Arc::new(tools)));
+    let id = call(&script, RUN, json!({"id": "news-digest", "params": data.params, "run_id": "over-budget"}));
+    let run = wait(&script, &id);
+    assert_eq!(run["ok"], true, "{run}");
+    // news-digest lists its sources without a digest when the model call
+    // fails: partial, and no model text.
+    assert_eq!(run["data"]["status"], "partial", "{run}");
+    assert!(run["data"]["data"]["digest"].is_null(), "{run}");
+    let saved = std::fs::read_to_string(root.join(".host/toolbox/os.news/toolbox/runs/news-digest/over-budget.json")).unwrap();
+    assert!(saved.contains("budget"), "the refusal is in the run's diagnostics: {saved}");
+    let _ = std::fs::remove_dir_all(&root);
+}
diff --git a/crates/ai-host/tests/toolbox_real_kernel.rs b/crates/ai-host/tests/toolbox_real_kernel.rs
new file mode 100644
index 00000000..e1a2e924
--- /dev/null
+++ b/crates/ai-host/tests/toolbox_real_kernel.rs
@@ -0,0 +1,134 @@
+//! The toolbox's registration and calls against a REAL octos kernel with
+//! host-registered peer tools (octos#2567, UPCR-2026-035), a scripted model
+//! (`crates/app-peers/tests/fixtures/mock_agent_llm.py`) and the toolbox's
+//! fixture backends. Runs when `OCTOS_APP_PEERS_TEST_KERNEL` names such an
+//! `octos` binary; otherwise it says so and passes (CI has none):
+//!
+//! ```sh
+//! OCTOS_APP_PEERS_TEST_KERNEL=<octos#2567 build>/octos \
+//!   cargo test -p octosense-ai-host --features toolbox-peers --test toolbox_real_kernel -- --nocapture
+//! ```
+#![cfg(feature = "toolbox-peers")]
+
+use std::collections::BTreeSet;
+use std::io::BufRead;
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use octosense_ai_host::app_peers::broker::{Broker, BrokerConfig};
+use octosense_ai_host::app_peers::connectors::CoreConnector;
+use octosense_ai_host::app_peers::{ContextEvent, ContextOp, ContextSpec, Deployment, OctosAppService, OCTOS_SERVICES};
+use octosense_ai_host::kernel::{Core, Options};
+use octosense_ai_host::toolbox_peers::{app_context, grant_from_manifest, ToolboxTools};
+use octosense_toolbox::fixture::{self, FixtureBackend, FixtureCase};
+use octosense_toolbox::peer::PeerToolbox;
+use octosense_toolbox::Library;
+use serde_json::json;
+
+struct Model(std::process::Child);
+impl Drop for Model {
+    fn drop(&mut self) {
+        let _ = self.0.kill();
+        let _ = self.0.wait();
+    }
+}
+
+#[test]
+fn a_real_turn_calls_the_toolbox_and_a_tool_outside_the_grant_is_not_offered() {
+    let Some(program) = std::env::var_os("OCTOS_APP_PEERS_TEST_KERNEL").map(PathBuf::from) else {
+        eprintln!("OCTOS_APP_PEERS_TEST_KERNEL is not set: skipping the real-kernel toolbox test");
+        return;
+    };
+    let script = Path::new(env!("CARGO_MANIFEST_DIR")).join("../app-peers/tests/fixtures/mock_agent_llm.py");
+    let mut child = std::process::Command::new("python3")
+        .arg(script)
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::inherit())
+        .spawn()
+        .expect("python3");
+    let mut line = String::new();
+    std::io::BufReader::new(child.stdout.take().unwrap()).read_line(&mut line).unwrap();
+    let port: u16 = line.trim().parse().unwrap();
+    let _model = Model(child);
+
+    let dir = std::env::temp_dir().join(format!("toolbox-real-kernel-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    let core_dir = dir.join("octos-home/.octos");
+    std::fs::create_dir_all(core_dir.join("profiles")).unwrap();
+    let profile = json!({
+        "id": "_main", "name": "Main", "enabled": true,
+        "created_at": "2026-09-28T00:00:00Z", "updated_at": "2026-09-28T00:00:00Z",
+        "config": {"llm": {"primary": {"family_id": "local", "model_id": "mock-model",
+            "route": {"base_url": format!("http://127.0.0.1:{port}/v1"), "api_type": "openai"}}}}
+    });
+    std::fs::write(core_dir.join("profiles/_main.json"), profile.to_string()).unwrap();
+    let core = Core::new(Options::default().core_dir(&core_dir).program(&program));
+
+    let apps_root = dir.join("apps");
+    let case: FixtureCase = serde_json::from_str(
+        &std::fs::read_to_string(
+            Path::new(env!("CARGO_MANIFEST_DIR")).join("../toolbox/templates/news-digest/fixtures/city-infrastructure.json"),
+        )
+        .unwrap(),
+    )
+    .unwrap();
+    let grant = grant_from_manifest("os.news", &json!({"id": "os.news", "capabilities": ["research"]}));
+    let app = app_context("os.news", &grant, &apps_root).unwrap();
+    let data = case.fixture.clone();
+    let tools = ToolboxTools::new(app, move || {
+        let backend = Arc::new(FixtureBackend::new(data.clone()));
+        Ok(PeerToolbox::from_host(Library::builtin().map_err(|e| e.to_string())?, fixture::host(&data), backend))
+    });
+
+    let services: BTreeSet<String> = OCTOS_SERVICES.iter().map(|s| s.to_string()).collect();
+    let mut cfg = BrokerConfig::new(Deployment::Hosted, "_main", "_main:api:octosense#system", "os.news", "News", services.clone());
+    cfg.state_dir = Some(dir.join("host-state"));
+    cfg.host_tools = Some(Arc::new(tools));
+    let news = Broker::new(cfg, Arc::new(CoreConnector::shared(core.clone())));
+    news.set_account(Some("device"));
+    // The real kernel accepts the toolbox's declarations (names, schemas,
+    // risk, flags) or this fails.
+    news.bind().expect("the peer binds and its tools are registered");
+    let ctx = news
+        .open_context(ContextSpec { account: "device".into(), instance: "news#1".into(), services })
+        .unwrap();
+    let turn = |text: String| -> String {
+        let (tx, rx) = std::sync::mpsc::channel();
+        let tx = Mutex::new(tx);
+        ctx.call(ContextOp::Turn { text }, Arc::new(move |e| {
+            let _ = tx.lock().unwrap().send(e);
+        }))
+        .unwrap();
+        loop {
+            match rx.recv_timeout(Duration::from_secs(90)).expect("the turn completes") {
+                ContextEvent::Complete(r) => return r.expect("the turn succeeds")["text"].as_str().unwrap_or_default().to_owned(),
+                ContextEvent::Data(_) => continue,
+            }
+        }
+    };
+
+    let searched = turn(r#"CALL_TOOL:toolbox_search {"query": "city infrastructure", "lang": "en", "count": 2}"#.into());
+    assert!(searched.starts_with("TOOL SAID"), "{searched}");
+    assert!(searched.contains("Harbor City approves electric bus order"), "{searched}");
+
+    let run = turn(format!(
+        "CALL_TOOL:workflow_run {}",
+        json!({"id": "news-digest", "params": case.params, "run_id": "real-kernel"})
+    ));
+    assert!(run.starts_with("TOOL SAID") && run.contains("\"status\":\"ready\""), "{run}");
+    assert!(apps_root.join(".host/toolbox/os.news/toolbox/runs/news-digest/real-kernel.json").exists());
+
+    // Not granted crawl: not offered, and the offered set is the toolbox's.
+    let crawl = turn(r#"CALL_TOOL:toolbox_deep_crawl {"url": "https://example.invalid/"}"#.into());
+    assert_eq!(
+        crawl.trim(),
+        "NO TOOL toolbox_deep_crawl AMONG toolbox_search,toolbox_web_read,workflow_fork,workflow_run",
+        "{crawl}"
+    );
+
+    news.release();
+    drop(news);
+    core.shutdown_within(Duration::from_secs(5));
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/app-peers/Cargo.toml b/crates/app-peers/Cargo.toml
index 2b6bc4db..3705d911 100644
--- a/crates/app-peers/Cargo.toml
+++ b/crates/app-peers/Cargo.toml
@@ -16,6 +16,8 @@
 # - `octos-core`: the broker over the shell's kernel (`octosense-kernel`),
 #   for shells and for a standalone app that owns its local runtime.
 # - `ws`: the broker over an explicit remote octos server (WebSocket).
+# - `peer-tools`: host-registered peer tools (octos#2567, UPCR-2026-035):
+#   registration after every prepare and reconnect, and tool-call routing.
 [package]
 name        = "octosense-app-peers"
 version     = "0.1.0"
@@ -31,6 +33,12 @@ default = []
 broker = ["dep:tokio", "dep:log", "dep:uuid"]
 octos-core = ["broker", "dep:octosense-kernel"]
 ws = ["broker", "dep:tokio-tungstenite", "dep:futures-util", "dep:url"]
+# Host-registered peer tools (octos UPCR-2026-035, octos#2567): every peer
+# registers its tool set (possibly empty) after each prepare and reconnect,
+# and the broker runs `peer/tool/call` through `BrokerConfig::host_tools`.
+# Off by default: it needs a kernel with octos#2567 (a kernel without it
+# refuses the registration, and the broker then starts no turns).
+peer-tools = ["broker"]
 
 [dependencies]
 serde_json = "1"
diff --git a/crates/app-peers/README.md b/crates/app-peers/README.md
index a15b4fd2..9ea9996f 100644
--- a/crates/app-peers/README.md
+++ b/crates/app-peers/README.md
@@ -21,6 +21,7 @@ ordinary session with the profile's memory.
 | `broker` | `broker::Broker`: peer binding, contexts, a lease check on every request and before every reply, event routing, stale-reply dropping | via the features below |
 | `octos-core` | `connectors::CoreConnector` (the shell's kernel, or an owned one) and `hosted` (`HostPolicy`, `launch`, `offer`) | shells; a standalone app's local runtime |
 | `ws` | `connectors::WsConnector`: an explicit remote octos server | a standalone app's remote mode |
+| `peer-tools` | host-registered peer tools (octos UPCR-2026-035, octos#2567): `peer_tools::HostTools`, `BrokerConfig::host_tools`, `hosted::launch_with_tools`; registration after every prepare and reconnect, `peer/tool/call` routing | `crates/ai-host`'s `toolbox-peers`; off by default |
 
 ## A shell
 
@@ -68,12 +69,53 @@ service.release();                            // app closed
   interrupts the peer's running turn. The peer and its memory stay for the
   next launch.
 
+## Host-registered tools (`peer-tools`)
+
+With the feature, every broker follows OctoSense issue #62's rules for
+octos#2567:
+
+- **Register on every prepare and reconnect.** Right after each successful
+  `peer/prepare`, on the same link that later opens contexts and starts
+  turns, the broker calls `peer/tools/register` with the app's set
+  (`BrokerConfig::host_tools`), or the **empty set** when it has none (Rinx
+  today). A lost link unbinds the peer, so the next request prepares and
+  registers again before any turn.
+- **No turns without registration.** If registering fails the peer stays
+  unbound: no context opens, no turn starts, and `availability()` is
+  `Failed` with the reason.
+- **Calls.** `peer/tool/call` for the bound peer runs the host's
+  `HostTools::call`, at most once per `(session, turn, tool call, args
+  digest)` (a repeat gets the first result), and answers `peer/tool/result`.
+  A tool that was not registered is refused (`not_registered`) without
+  running. `peer/tool/cancel`, the call's `timeout_ms`, a release or a lost
+  link cancel the call: its future is dropped after its `Cancel` fires, and
+  it is never answered.
+
+**What changes for a peer that registers** (octos#2567, by design): its
+turns get exactly the registered tools (the empty set means none, not the
+profile's roster), app memory and context reach only turns driven by the
+registering connection, and kernel-internal continuations (a system agent's
+`peer_send_input`) get no tools. The four real-kernel tests of system agent
+to peer exchanges are therefore ignored with the feature on; see
+`tests/real_kernel.rs`.
+
+Without the feature none of this is compiled and the broker behaves as
+before.
+
 ## Testing
 
 From the repository root:
 
 ```sh
 cargo test --locked -p octosense-app-peers --features octos-core,ws   # unit + scripted-kernel tests
+cargo test --locked -p octosense-app-peers --features octos-core,ws,peer-tools   # + registration and tool calls
 # The real kernel (UPCR-2026-034) with a scripted local model (python3):
 OCTOS_APP_PEERS_TEST_KERNEL=/path/to/octos cargo test -p octosense-app-peers --features octos-core --test real_kernel -- --nocapture
+# A kernel with octos#2567 (host-registered peer tools), the feature on:
+OCTOS_APP_PEERS_TEST_KERNEL=/path/to/octos cargo test -p octosense-app-peers --features octos-core,peer-tools --test real_kernel -- --nocapture
 ```
+
+On 28 Sep 2026 against an `octos` built from octos#2567 (e270d039 and again at 31c51064): without
+the feature 6 passed; with it 3 passed (the new
+`a_registered_host_tool_is_called_by_a_real_turn` included) and 4 are
+ignored as above.
diff --git a/crates/app-peers/src/broker.rs b/crates/app-peers/src/broker.rs
index a6993e56..7d5984d5 100644
--- a/crates/app-peers/src/broker.rs
+++ b/crates/app-peers/src/broker.rs
@@ -85,6 +85,11 @@ pub struct BrokerConfig {
     /// it created. `None` keeps tokens in memory, so a peer created by this
     /// process cannot be resumed after a restart.
     pub state_dir: Option<std::path::PathBuf>,
+    /// The tools the host registers for the app's peer and runs for it
+    /// (octos UPCR-2026-035). `None` registers the empty set: with the
+    /// feature every peer registers, tools or not.
+    #[cfg(feature = "peer-tools")]
+    pub host_tools: Option<Arc<dyn crate::peer_tools::HostTools>>,
 }
 
 impl BrokerConfig {
@@ -118,6 +123,8 @@ impl BrokerConfig {
             },
             turn_timeout: Duration::from_secs(180),
             state_dir: None,
+            #[cfg(feature = "peer-tools")]
+            host_tools: None,
         }
     }
 }
@@ -274,6 +281,9 @@ struct State {
     contexts: Vec<Weak<ContextInner>>,
     model: Option<ModelInfo>,
     last_error: Option<String>,
+    /// Host tool calls in flight and the registered set (UPCR-2026-035).
+    #[cfg(feature = "peer-tools")]
+    tools: crate::peer_tools::Calls,
 }
 
 struct Inner {
@@ -318,6 +328,8 @@ impl Broker {
                 contexts: Vec::new(),
                 model: None,
                 last_error: None,
+                #[cfg(feature = "peer-tools")]
+                tools: Default::default(),
             }),
             connecting: tokio::sync::Mutex::new(()),
             binding: tokio::sync::Mutex::new(()),
@@ -502,6 +514,13 @@ impl Inner {
             st.peer = None;
             st.peer_turn = None;
             st.last_error = Some(why.to_owned());
+            // A call sent on this link can only be answered on it: stop
+            // them all; the next link registers again.
+            #[cfg(feature = "peer-tools")]
+            {
+                st.tools.cancel_all();
+                st.tools.registered.clear();
+            }
             let pending: Vec<Reply> = st.pending.drain().map(|(_, r)| r).collect();
             let contexts: Vec<Arc<ContextInner>> =
                 st.contexts.iter().filter_map(Weak::upgrade).collect();
@@ -530,7 +549,7 @@ impl Inner {
         }
     }
 
-    fn inbound(&self, frame: &str) {
+    fn inbound(self: &Arc<Self>, frame: &str) {
         if std::env::var_os("APP_PEERS_TRACE").is_some() {
             eprintln!("app-peers <- {}", frame);
         }
@@ -557,6 +576,11 @@ impl Inner {
             return;
         };
         let params = value.get("params").cloned().unwrap_or(Value::Null);
+        #[cfg(feature = "peer-tools")]
+        if matches!(method, crate::peer_tools::CALL | crate::peer_tools::CANCEL) {
+            self.tool_notification(method, &params);
+            return;
+        }
         let Some(session_id) = params.get("session_id").and_then(Value::as_str) else {
             return;
         };
@@ -712,6 +736,14 @@ impl Inner {
             }
             None => known_token,
         };
+        // octos UPCR-2026-035 / OctoSense #62: register on this link after
+        // every successful prepare, before anything can start a turn; a
+        // failure leaves the peer unbound, so no turn starts.
+        #[cfg(feature = "peer-tools")]
+        if let Err(err) = self.register_tools(&slug, token.as_deref()).await {
+            self.fail(&err);
+            return Err(err);
+        }
         let session = format!(
             "{}#peer-{slug}",
             self.cfg
@@ -741,6 +773,135 @@ impl Inner {
         Ok((generation, peer))
     }
 
+    /// `peer/tools/register` for the bound peer, on this broker's link.
+    #[cfg(feature = "peer-tools")]
+    async fn register_tools(
+        self: &Arc<Self>,
+        slug: &str,
+        token: Option<&str>,
+    ) -> Result<(), String> {
+        let registration = self
+            .cfg
+            .host_tools
+            .as_ref()
+            .map(|t| t.registration())
+            .unwrap_or_default();
+        let params = registration.params(&self.cfg.profile_id, &self.cfg.originator, slug, token);
+        match self.request(crate::peer_tools::REGISTER, params).await {
+            Ok(_) => {
+                self.lock().tools.registered = registration.names();
+                Ok(())
+            }
+            Err(err) => Err(format!(
+                "The assistant could not take this app's tools ({err}); it stays unavailable until they are registered"
+            )),
+        }
+    }
+
+    /// `peer/tool/call` and `peer/tool/cancel` from the kernel.
+    #[cfg(feature = "peer-tools")]
+    fn tool_notification(self: &Arc<Self>, method: &str, params: &Value) {
+        use crate::peer_tools::{Admit, ToolCall, ToolError, CANCEL};
+        if method == CANCEL {
+            if let Some(call_id) = params["call_id"].as_str() {
+                self.lock().tools.cancel(call_id);
+            }
+            return;
+        }
+        let call = match ToolCall::from_params(params) {
+            Ok(call) => call,
+            Err(err) => {
+                log::warn!("app-peers: {err}");
+                return;
+            }
+        };
+        let (peer, admit) = {
+            let mut st = self.lock();
+            let peer = match &st.peer {
+                Some((_, peer)) if peer.slug == call.peer && !st.released => peer.clone(),
+                // Not this broker's peer: it cannot answer for it.
+                _ => return,
+            };
+            let admit = if !st.tools.registered.contains(&call.name) {
+                Admit::Answer(Err(ToolError::new(
+                    "not_registered",
+                    format!("{} is not among this app's tools", call.name),
+                )))
+            } else {
+                st.tools.admit(&call)
+            };
+            (peer, admit)
+        };
+        match admit {
+            Admit::Wait => {}
+            Admit::Answer(result) => {
+                self.send_tool_result(&peer, call.call_id.clone(), result);
+            }
+            Admit::Start(cancel) => {
+                let Some(tools) = self.cfg.host_tools.clone() else {
+                    let result = Err(ToolError::new("not_registered", "this app has no tools"));
+                    let waiters = self.lock().tools.finish(&call.occurrence(), &result);
+                    for call_id in waiters {
+                        self.send_tool_result(&peer, call_id, result.clone());
+                    }
+                    return;
+                };
+                let inner = self.clone();
+                let deadline = Duration::from_millis(call.timeout_ms.max(1));
+                let occurrence = call.occurrence();
+                self.rt().spawn(async move {
+                    let outcome = {
+                        let run = tools.call(call, cancel.clone());
+                        tokio::pin!(run);
+                        let outcome = tokio::select! {
+                            result = &mut run => Some(result),
+                            _ = cancel.cancelled() => None,
+                            _ = tokio::time::sleep(deadline) => None,
+                        };
+                        // Fire the cancel before the call's future is dropped,
+                        // so work it handed elsewhere stops too.
+                        if outcome.is_none() {
+                            cancel.cancel();
+                        }
+                        outcome
+                    };
+                    let Some(result) = outcome.filter(|_| !cancel.is_cancelled()) else {
+                        // Never answered after a cancel or the deadline.
+                        inner.lock().tools.abandon(&occurrence);
+                        return;
+                    };
+                    let waiters = inner.lock().tools.finish(&occurrence, &result);
+                    for call_id in waiters {
+                        inner.send_tool_result(&peer, call_id, result.clone());
+                    }
+                });
+            }
+        }
+    }
+
+    #[cfg(feature = "peer-tools")]
+    fn send_tool_result(
+        self: &Arc<Self>,
+        peer: &PeerInfo,
+        call_id: String,
+        result: Result<Value, crate::peer_tools::ToolError>,
+    ) {
+        let params = crate::peer_tools::result_params(
+            &self.cfg.profile_id,
+            &self.cfg.originator,
+            &peer.slug,
+            peer.token.as_deref(),
+            &call_id,
+            &result,
+        );
+        let inner = self.clone();
+        self.rt().spawn(async move {
+            if let Err(err) = inner.request(crate::peer_tools::RESULT, params).await {
+                log::warn!("app-peers: the answer to tool call {call_id} was refused: {err}");
+            }
+        });
+    }
+
     fn close_context_on_kernel(
         self: &Arc<Self>,
         peer: String,
@@ -1290,6 +1451,8 @@ impl OctosAppService for Broker {
                 return;
             }
             st.released = true;
+            #[cfg(feature = "peer-tools")]
+            st.tools.cancel_all();
             let turn = st.peer_turn.take();
             turn.zip(st.peer.as_ref().map(|(_, p)| p.session.clone()))
         };
diff --git a/crates/app-peers/src/hosted.rs b/crates/app-peers/src/hosted.rs
index e5f4bea8..ce988b74 100644
--- a/crates/app-peers/src/hosted.rs
+++ b/crates/app-peers/src/hosted.rs
@@ -73,6 +73,32 @@ pub fn launch<'a>(
     declared: impl IntoIterator<Item = &'a str>,
     policy: &HostPolicy,
 ) -> Option<Broker> {
+    let cfg = config(module, label, declared, policy)?;
+    Some(Broker::new(cfg, Arc::new(CoreConnector::shell())))
+}
+
+/// [`launch`], with the tools the host registers for the app's peer and
+/// runs for it (octos UPCR-2026-035). Every peer registers with the
+/// feature; `None` registers the empty set, like [`launch`].
+#[cfg(feature = "peer-tools")]
+pub fn launch_with_tools<'a>(
+    module: &str,
+    label: &str,
+    declared: impl IntoIterator<Item = &'a str>,
+    policy: &HostPolicy,
+    tools: Option<Arc<dyn crate::peer_tools::HostTools>>,
+) -> Option<Broker> {
+    let mut cfg = config(module, label, declared, policy)?;
+    cfg.host_tools = tools;
+    Some(Broker::new(cfg, Arc::new(CoreConnector::shell())))
+}
+
+fn config<'a>(
+    module: &str,
+    label: &str,
+    declared: impl IntoIterator<Item = &'a str>,
+    policy: &HostPolicy,
+) -> Option<BrokerConfig> {
     let services = effective_services(module, declared, policy);
     if services.is_empty() || !is_namespace_segment(module) {
         return None;
@@ -88,7 +114,7 @@ pub fn launch<'a>(
     // The shell keeps each app peer's host token beside its kernel's core
     // dir, outside every app's reach.
     cfg.state_dir = octosense_kernel::core_dir().map(|dir| host_state_dir(&dir));
-    Some(Broker::new(cfg, Arc::new(CoreConnector::shell())))
+    Some(cfg)
 }
 
 /// Where a shell keeps app peers' host tokens for the kernel at `core_dir`.
diff --git a/crates/app-peers/src/lib.rs b/crates/app-peers/src/lib.rs
index ab326898..c60ceaaa 100644
--- a/crates/app-peers/src/lib.rs
+++ b/crates/app-peers/src/lib.rs
@@ -28,6 +28,8 @@ pub mod broker;
 pub mod connectors;
 #[cfg(feature = "octos-core")]
 pub mod hosted;
+#[cfg(feature = "peer-tools")]
+pub mod peer_tools;
 
 pub use contract::*;
 
diff --git a/crates/app-peers/src/peer_tools.rs b/crates/app-peers/src/peer_tools.rs
new file mode 100644
index 00000000..0ac01cc4
--- /dev/null
+++ b/crates/app-peers/src/peer_tools.rs
@@ -0,0 +1,471 @@
+//! Host-registered peer tools (octos UPCR-2026-035, octos#2567), the host
+//! side. Feature `peer-tools`.
+//!
+//! With the feature, a [`crate::broker::Broker`] follows the registration
+//! rules of OctoSense issue #62 and the UPCR's host obligations:
+//!
+//! 1. **Register on every prepare and reconnect.** Right after every
+//!    successful `peer/prepare`, on the same link that later sends
+//!    `peer/context/open` and `turn/start`, the broker calls
+//!    `peer/tools/register` with the app's set from its [`HostTools`], or an
+//!    **empty set** when it has none (Rinx's case today). A reconnect drops
+//!    the bound peer, so the next request prepares and registers again
+//!    before any turn.
+//! 2. **No turns without registration.** When registering fails, the peer is
+//!    not bound: no context opens and no turn starts, and the service reports
+//!    `Availability::Failed` with the reason. It never falls back to
+//!    memory-less turns.
+//! 3. **One link per broker**: every peer registers on the link its turns
+//!    use.
+//!
+//! The kernel then sends `peer/tool/call` for a registered tool to this
+//! link. The broker:
+//!
+//! - refuses a call whose peer is not its bound peer (ignored: it cannot
+//!   authenticate an answer) or whose tool is not in the set it registered
+//!   (`not_registered`), whatever the kernel sent;
+//! - runs a call at most once per `(session_id, turn_id, tool_call_id,
+//!   args_digest)`, answering a repeat with the first result;
+//! - never runs a call after `peer/tool/cancel` or after its `timeout_ms`:
+//!   the call's future is dropped and its [`Cancel`] fires, and no result is
+//!   sent; a release or a lost link cancels every call in flight;
+//! - answers with `peer/tool/result` (`ok` with `data`, or `error: {kind,
+//!   message}` with `kind` in `[a-z0-9_]{1,32}`).
+//!
+//! Without the feature none of this exists and the broker behaves exactly
+//! as before.
+
+use std::collections::{BTreeSet, HashMap, VecDeque};
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Arc;
+
+use serde_json::{json, Value};
+use tokio::sync::Notify;
+
+/// Host → kernel: declare the peer's tools.
+pub const REGISTER: &str = "peer/tools/register";
+/// Kernel → host: run one call.
+pub const CALL: &str = "peer/tool/call";
+/// Kernel → host: stop a call.
+pub const CANCEL: &str = "peer/tool/cancel";
+/// Host → kernel: one call's answer.
+pub const RESULT: &str = "peer/tool/result";
+
+/// What the broker registers for its peer.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct Registration {
+    /// `tools.json` entries: `{name, description, input_schema, risk,
+    /// background?, outward?, confirm?, …}`.
+    pub tools: Vec<Value>,
+    /// Kernel tools from octos's allowlist the app may use.
+    pub generic_tools: Vec<String>,
+    /// How long the kernel waits for one call (1–300 000 ms).
+    pub call_timeout_ms: Option<u64>,
+    /// Largest serialized result the kernel accepts (up to 1 MiB).
+    pub max_result_bytes: Option<u64>,
+}
+
+impl Registration {
+    /// The empty set: no tools at all.
+    pub fn empty() -> Self {
+        Self::default()
+    }
+
+    /// The registered tool names.
+    pub fn names(&self) -> BTreeSet<String> {
+        self.tools
+            .iter()
+            .filter_map(|t| t["name"].as_str().map(str::to_owned))
+            .collect()
+    }
+
+    /// `peer/tools/register` params for `peer`, authorized by its host token.
+    pub fn params(
+        &self,
+        profile: &str,
+        originator: &str,
+        peer: &str,
+        token: Option<&str>,
+    ) -> Value {
+        let mut params = json!({
+            "profile_id": profile,
+            "session_id": originator,
+            "peer": peer,
+            "host_token": token,
+            "tools": self.tools,
+            "generic_tools": self.generic_tools,
+        });
+        if let Some(ms) = self.call_timeout_ms {
+            params["call_timeout_ms"] = json!(ms);
+        }
+        if let Some(bytes) = self.max_result_bytes {
+            params["max_result_bytes"] = json!(bytes);
+        }
+        params
+    }
+}
+
+/// One `peer/tool/call`.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ToolCall {
+    pub peer: String,
+    /// The calling session: the peer's own, or one of its request contexts.
+    pub session_id: String,
+    pub context_id: Option<String>,
+    pub turn_id: String,
+    pub call_id: String,
+    pub tool_call_id: String,
+    pub args_digest: String,
+    /// The declared name (`toolbox.search`).
+    pub name: String,
+    pub args: Value,
+    pub risk: String,
+    pub confirm_required: bool,
+    /// How long the kernel waits for the answer.
+    pub timeout_ms: u64,
+    pub tools_version: u64,
+}
+
+impl ToolCall {
+    /// Parses the notification's params.
+    pub fn from_params(params: &Value) -> Result<ToolCall, String> {
+        let text = |key: &str| -> Result<String, String> {
+            params[key]
+                .as_str()
+                .map(str::to_owned)
+                .ok_or_else(|| format!("peer/tool/call without {key}"))
+        };
+        Ok(ToolCall {
+            peer: text("peer")?,
+            session_id: text("session_id")?,
+            context_id: params["context_id"].as_str().map(str::to_owned),
+            turn_id: params["turn_id"].as_str().unwrap_or_default().to_owned(),
+            call_id: text("call_id")?,
+            tool_call_id: params["tool_call_id"]
+                .as_str()
+                .unwrap_or_default()
+                .to_owned(),
+            args_digest: params["args_digest"]
+                .as_str()
+                .unwrap_or_default()
+                .to_owned(),
+            name: text("name")?,
+            args: params.get("args").cloned().unwrap_or(Value::Null),
+            risk: params["risk"].as_str().unwrap_or_default().to_owned(),
+            confirm_required: params["confirm_required"].as_bool().unwrap_or(false),
+            timeout_ms: params["timeout_ms"].as_u64().unwrap_or(30_000),
+            tools_version: params["tools_version"].as_u64().unwrap_or(0),
+        })
+    }
+
+    /// The call's occurrence: a host runs each at most once.
+    pub fn occurrence(&self) -> Occurrence {
+        (
+            self.session_id.clone(),
+            self.turn_id.clone(),
+            self.tool_call_id.clone(),
+            self.args_digest.clone(),
+        )
+    }
+}
+
+/// `(session_id, turn_id, tool_call_id, args_digest)`.
+pub type Occurrence = (String, String, String, String);
+
+/// A call's error, as the kernel accepts it.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ToolError {
+    /// `[a-z0-9_]{1,32}`; anything else becomes `error`.
+    pub kind: String,
+    pub message: String,
+}
+
+impl ToolError {
+    pub fn new(kind: &str, message: impl Into<String>) -> Self {
+        let valid = !kind.is_empty()
+            && kind.len() <= 32
+            && kind
+                .bytes()
+                .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'_');
+        let mut message: String = message.into();
+        if message.len() > 4096 {
+            let mut end = 4096;
+            while !message.is_char_boundary(end) {
+                end -= 1;
+            }
+            message.truncate(end);
+        }
+        Self {
+            kind: if valid {
+                kind.to_owned()
+            } else {
+                "error".into()
+            },
+            message,
+        }
+    }
+}
+
+/// A call's cancellation: fired by `peer/tool/cancel`, the call's deadline,
+/// a release or a lost link. A [`HostTools`] implementation may watch it to
+/// stop early; the broker drops the call's future either way.
+#[derive(Clone, Default)]
+pub struct Cancel(Arc<CancelInner>);
+
+#[derive(Default)]
+struct CancelInner {
+    fired: AtomicBool,
+    notify: Notify,
+}
+
+impl Cancel {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn cancel(&self) {
+        self.0.fired.store(true, Ordering::Release);
+        self.0.notify.notify_waiters();
+    }
+
+    pub fn is_cancelled(&self) -> bool {
+        self.0.fired.load(Ordering::Acquire)
+    }
+
+    /// Resolves once cancelled.
+    pub async fn cancelled(&self) {
+        loop {
+            let notified = self.0.notify.notified();
+            tokio::pin!(notified);
+            notified.as_mut().enable();
+            if self.is_cancelled() {
+                return;
+            }
+            notified.await;
+        }
+    }
+}
+
+/// A future a [`HostTools`] call returns.
+pub type ToolFuture = Pin<Box<dyn Future<Output = Result<Value, ToolError>> + Send + 'static>>;
+
+/// What a host offers one app's peer and runs for it.
+pub trait HostTools: Send + Sync {
+    /// The set to register (asked again at every registration).
+    fn registration(&self) -> Registration;
+    /// Runs one call of a registered tool. `cancel` fires when the kernel no
+    /// longer waits; the broker then drops the future.
+    fn call(&self, call: ToolCall, cancel: Cancel) -> ToolFuture;
+}
+
+impl std::fmt::Debug for dyn HostTools {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str("HostTools")
+    }
+}
+
+/// Results kept for answering repeats of a finished occurrence.
+const DONE_KEPT: usize = 256;
+
+enum Run {
+    /// Running; the call ids waiting for it.
+    Running(Vec<String>),
+    Done(Result<Value, ToolError>),
+}
+
+/// The broker's calls in flight and recent results.
+#[derive(Default)]
+pub(crate) struct Calls {
+    /// The registered names, once registered on the current link.
+    pub(crate) registered: BTreeSet<String>,
+    /// Call id → (occurrence, its cancel).
+    by_call: HashMap<String, (Occurrence, Cancel)>,
+    runs: HashMap<Occurrence, Run>,
+    done: VecDeque<Occurrence>,
+}
+
+/// What to do with a new call.
+pub(crate) enum Admit {
+    /// Start it: this call's cancel.
+    Start(Cancel),
+    /// The same occurrence is running; this call waits for it.
+    Wait,
+    /// The same occurrence finished: answer with its result.
+    Answer(Result<Value, ToolError>),
+}
+
+impl Calls {
+    pub(crate) fn admit(&mut self, call: &ToolCall) -> Admit {
+        let occurrence = call.occurrence();
+        match self.runs.get_mut(&occurrence) {
+            Some(Run::Done(result)) => Admit::Answer(result.clone()),
+            Some(Run::Running(waiters)) => {
+                waiters.push(call.call_id.clone());
+                let cancel = self
+                    .by_call
+                    .values()
+                    .find(|(o, _)| *o == occurrence)
+                    .map(|(_, c)| c.clone())
+                    .unwrap_or_default();
+                self.by_call
+                    .insert(call.call_id.clone(), (occurrence, cancel));
+                Admit::Wait
+            }
+            None => {
+                let cancel = Cancel::new();
+                self.runs
+                    .insert(occurrence.clone(), Run::Running(vec![call.call_id.clone()]));
+                self.by_call
+                    .insert(call.call_id.clone(), (occurrence, cancel.clone()));
+                Admit::Start(cancel)
+            }
+        }
+    }
+
+    /// `peer/tool/cancel` for `call_id`: it is not answered; the run stops
+    /// when nobody else waits for it.
+    pub(crate) fn cancel(&mut self, call_id: &str) {
+        let Some((occurrence, cancel)) = self.by_call.remove(call_id) else {
+            return;
+        };
+        if let Some(Run::Running(waiters)) = self.runs.get_mut(&occurrence) {
+            waiters.retain(|w| w != call_id);
+            if waiters.is_empty() {
+                self.runs.remove(&occurrence);
+                cancel.cancel();
+            }
+        }
+    }
+
+    /// Cancels everything in flight (release, lost link).
+    pub(crate) fn cancel_all(&mut self) {
+        for (_, (_, cancel)) in self.by_call.drain() {
+            cancel.cancel();
+        }
+        self.runs.retain(|_, run| matches!(run, Run::Done(_)));
+    }
+
+    /// A run ended: the call ids to answer (none when it was cancelled).
+    pub(crate) fn finish(
+        &mut self,
+        occurrence: &Occurrence,
+        result: &Result<Value, ToolError>,
+    ) -> Vec<String> {
+        let Some(Run::Running(waiters)) = self.runs.remove(occurrence) else {
+            return Vec::new();
+        };
+        for id in &waiters {
+            self.by_call.remove(id);
+        }
+        self.runs
+            .insert(occurrence.clone(), Run::Done(result.clone()));
+        self.done.push_back(occurrence.clone());
+        while self.done.len() > DONE_KEPT {
+            if let Some(old) = self.done.pop_front() {
+                self.runs.remove(&old);
+            }
+        }
+        waiters
+    }
+
+    /// A run ended without a result (cancelled or timed out): forget it, so
+    /// a later dispatch of a `read` may run again.
+    pub(crate) fn abandon(&mut self, occurrence: &Occurrence) {
+        if let Some(Run::Running(waiters)) = self.runs.remove(occurrence) {
+            for id in waiters {
+                self.by_call.remove(&id);
+            }
+        }
+    }
+}
+
+/// `peer/tool/result` params for one answer.
+pub(crate) fn result_params(
+    profile: &str,
+    originator: &str,
+    peer: &str,
+    token: Option<&str>,
+    call_id: &str,
+    result: &Result<Value, ToolError>,
+) -> Value {
+    let mut params = json!({
+        "profile_id": profile,
+        "session_id": originator,
+        "peer": peer,
+        "host_token": token,
+        "call_id": call_id,
+    });
+    match result {
+        Ok(data) => {
+            params["ok"] = json!(true);
+            params["data"] = data.clone();
+        }
+        Err(error) => {
+            params["ok"] = json!(false);
+            params["error"] = json!({"kind": error.kind, "message": error.message});
+        }
+    }
+    params
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn call(call_id: &str, tool_call_id: &str) -> ToolCall {
+        ToolCall::from_params(&json!({
+            "peer": "news-1", "session_id": "s", "turn_id": "t", "call_id": call_id,
+            "tool_call_id": tool_call_id, "args_digest": "d", "name": "toolbox.search",
+            "args": {}, "risk": "read", "confirm_required": false, "timeout_ms": 1000, "tools_version": 1
+        }))
+        .unwrap()
+    }
+
+    #[test]
+    fn an_occurrence_runs_once_and_repeats_get_its_result() {
+        let mut calls = Calls::default();
+        let a = call("c1", "tc1");
+        assert!(matches!(calls.admit(&a), Admit::Start(_)));
+        assert!(matches!(calls.admit(&call("c2", "tc1")), Admit::Wait));
+        let waiters = calls.finish(&a.occurrence(), &Ok(json!(1)));
+        assert_eq!(waiters, ["c1", "c2"]);
+        assert!(matches!(
+            calls.admit(&call("c3", "tc1")),
+            Admit::Answer(Ok(_))
+        ));
+        assert!(matches!(calls.admit(&call("c4", "tc2")), Admit::Start(_)));
+    }
+
+    #[test]
+    fn a_cancelled_call_stops_only_when_nobody_waits() {
+        let mut calls = Calls::default();
+        let a = call("c1", "tc1");
+        let Admit::Start(cancel) = calls.admit(&a) else {
+            panic!()
+        };
+        calls.admit(&call("c2", "tc1"));
+        calls.cancel("c1");
+        assert!(!cancel.is_cancelled());
+        calls.cancel("c2");
+        assert!(cancel.is_cancelled());
+        assert!(calls.finish(&a.occurrence(), &Ok(json!(1))).is_empty());
+    }
+
+    #[test]
+    fn error_kinds_are_what_the_kernel_accepts() {
+        assert_eq!(ToolError::new("not_granted", "x").kind, "not_granted");
+        assert_eq!(ToolError::new("Bad-Kind", "x").kind, "error");
+        assert_eq!(ToolError::new("", "x").kind, "error");
+        assert!(ToolError::new("x", "é".repeat(3000)).message.len() <= 4096);
+    }
+
+    #[test]
+    fn the_empty_registration_registers_no_tools() {
+        let params = Registration::empty().params("_main", "o", "p", Some("t"));
+        assert_eq!(params["tools"], json!([]));
+        assert_eq!(params["generic_tools"], json!([]));
+        assert!(params.get("call_timeout_ms").is_none());
+    }
+}
diff --git a/crates/app-peers/tests/fixtures/mock_agent_llm.py b/crates/app-peers/tests/fixtures/mock_agent_llm.py
index 62b6a879..e8e202a3 100644
--- a/crates/app-peers/tests/fixtures/mock_agent_llm.py
+++ b/crates/app-peers/tests/fixtures/mock_agent_llm.py
@@ -3,8 +3,12 @@
 peer for the question/answer test. No network, no keys; standard library.
 
 Rules, looking at the request's messages and offered tools:
-  - after a tool result: finish with text ("PEER GOT <answer>" when the
-    result carries the system agent's answer, else "OK");
+  - after a tool result: finish with text ("TOOL SAID <result>" after a
+    CALL_TOOL, "PEER GOT <answer>" when the result carries the system agent's
+    answer, else "OK");
+  - "CALL_TOOL:<model name> <json args>": call that tool when it is offered
+    (a host-registered peer tool, UPCR-2026-035), else say "NO TOOL <name>
+    AMONG <offered tools>";
   - a user text "TELL_PEER:<slug>" with peer_send_input offered: send the peer
     "QUESTION_ME" ("TELL_PEER_HOLD:<slug>": "QUESTION_HOLD", never answered);
   - "TELL_PEER_AGAIN:<slug>": send the peer "SECOND_INPUT";
@@ -45,6 +49,8 @@ def decide(body):
     everything = "\n".join(text_of(m) for m in messages)
     if last.get("role") == "tool":
         result = text_of(last)
+        if "CALL_TOOL:" in everything:
+            return {"text": "TOOL SAID " + result}
         if "42" in result and "QUESTION_ME" in everything:
             return {"text": "PEER GOT 42"}
         return {"text": "OK"}
@@ -53,6 +59,11 @@ def decide(body):
         if m.get("role") == "user":
             last_user = text_of(m)
             break
+    host_tool = re.search(r"CALL_TOOL:([a-z0-9_]+) (\{.*\})", last_user)
+    if host_tool:
+        if host_tool.group(1) in tools:
+            return {"tool": host_tool.group(1), "args": json.loads(host_tool.group(2))}
+        return {"text": "NO TOOL " + host_tool.group(1) + " AMONG " + ",".join(sorted(t for t in tools if t))}
     again = re.search(r"TELL_PEER_AGAIN:([a-z0-9-]+)", last_user)
     if again and "peer_send_input" in tools:
         return {"tool": "peer_send_input", "args": {"slug": again.group(1), "message": "SECOND_INPUT"}}
diff --git a/crates/app-peers/tests/peer_tools.rs b/crates/app-peers/tests/peer_tools.rs
new file mode 100644
index 00000000..f3f75b72
--- /dev/null
+++ b/crates/app-peers/tests/peer_tools.rs
@@ -0,0 +1,478 @@
+//! Host-registered peer tools (octos UPCR-2026-035) against a scripted
+//! kernel: the registration rules of OctoSense issue #62 and the routing of
+//! `peer/tool/call`.
+#![cfg(feature = "peer-tools")]
+
+use std::collections::BTreeSet;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant};
+
+use octosense_app_peers::broker::{BoxFuture, Broker, BrokerConfig, Connector, Link};
+use octosense_app_peers::peer_tools::{
+    Cancel, HostTools, Registration, ToolCall, ToolError, ToolFuture,
+};
+use octosense_app_peers::*;
+use serde_json::{json, Value};
+use tokio::sync::mpsc;
+
+const TOKEN: &str = "fixture-host-token";
+const CLOSE: &str = "__close__";
+
+#[derive(Default)]
+struct Script {
+    calls: Vec<(String, Value)>,
+    fail_register: bool,
+    /// The newest link's kernel → host sender.
+    out: Option<mpsc::UnboundedSender<String>>,
+}
+
+struct FakeConnector(Arc<Mutex<Script>>);
+
+struct FakeLink {
+    to_kernel: mpsc::UnboundedSender<String>,
+    from_kernel: mpsc::UnboundedReceiver<String>,
+}
+
+impl Link for FakeLink {
+    fn send(&mut self, frame: String) -> Result<(), String> {
+        self.to_kernel.send(frame).map_err(|_| "gone".to_owned())
+    }
+    fn recv(&mut self) -> BoxFuture<'_, Result<String, String>> {
+        Box::pin(async move {
+            match self.from_kernel.recv().await {
+                Some(frame) if frame == CLOSE => Err("closed".to_owned()),
+                Some(frame) => Ok(frame),
+                None => Err("closed".to_owned()),
+            }
+        })
+    }
+}
+
+impl Connector for FakeConnector {
+    fn available(&self) -> Result<(), String> {
+        Ok(())
+    }
+    fn connect(&self) -> BoxFuture<'static, Result<Box<dyn Link>, String>> {
+        let script = self.0.clone();
+        Box::pin(async move {
+            let (to_kernel, mut kernel_in) = mpsc::unbounded_channel::<String>();
+            let (kernel_out, from_kernel) = mpsc::unbounded_channel::<String>();
+            script.lock().unwrap().out = Some(kernel_out.clone());
+            tokio::spawn(async move {
+                while let Some(frame) = kernel_in.recv().await {
+                    let frame: Value = serde_json::from_str(&frame).unwrap();
+                    let method = frame["method"].as_str().unwrap().to_owned();
+                    let params = frame["params"].clone();
+                    let id = frame["id"].clone();
+                    let fail_register = {
+                        let mut s = script.lock().unwrap();
+                        s.calls.push((method.clone(), params.clone()));
+                        s.fail_register
+                    };
+                    let reply = |result: Value| {
+                        json!({"jsonrpc": "2.0", "id": id, "result": result}).to_string()
+                    };
+                    let error = |kind: &str| {
+                        json!({"jsonrpc": "2.0", "id": id, "error": {"code": -32601, "message": "refused", "data": {"kind": kind}}})
+                            .to_string()
+                    };
+                    let answer = match method.as_str() {
+                        "peer/prepare" => {
+                            let mut result = json!({"slug": "news-1", "cwd": "/kernel/ws",
+                                "memory_namespace": params["memory_namespace"]});
+                            if params.get("host_token").is_none() {
+                                result["host_token"] = json!(TOKEN);
+                            }
+                            reply(result)
+                        }
+                        "peer/tools/register" if fail_register => error("method_not_found"),
+                        "peer/tools/register" if params["host_token"] != TOKEN => {
+                            error("peer_host_token_mismatch")
+                        }
+                        "peer/tools/register" => {
+                            reply(json!({"slug": "news-1", "version": 1, "applies": "next_turn"}))
+                        }
+                        "peer/context/open" => {
+                            let session = format!(
+                                "_main:api:octosense#peerctx-news-1.{}",
+                                params["context_id"].as_str().unwrap()
+                            );
+                            reply(json!({"session_id": session}))
+                        }
+                        "turn/start" => {
+                            let note = json!({"jsonrpc": "2.0", "method": "turn/completed",
+                                "params": {"session_id": params["session_id"], "turn_id": params["turn_id"]}});
+                            let _ = kernel_out.send(reply(json!({"accepted": true})));
+                            note.to_string()
+                        }
+                        "session/hydrate" => reply(json!({"messages": []})),
+                        "peer/tool/result" => {
+                            reply(json!({"call_id": params["call_id"], "accepted": true}))
+                        }
+                        _ => reply(json!({})),
+                    };
+                    let _ = kernel_out.send(answer);
+                }
+            });
+            Ok(Box::new(FakeLink {
+                to_kernel,
+                from_kernel,
+            }) as Box<dyn Link>)
+        })
+    }
+    fn owns_runtime(&self) -> bool {
+        false
+    }
+    fn shutdown(&self) {}
+}
+
+/// `demo.echo` answers its arguments; `demo.slow` waits for its cancel.
+#[derive(Default)]
+struct Demo {
+    runs: AtomicUsize,
+    cancelled: AtomicUsize,
+}
+
+struct DemoTools(Arc<Demo>);
+
+impl HostTools for DemoTools {
+    fn registration(&self) -> Registration {
+        Registration {
+            tools: vec![
+                json!({"name": "demo.echo", "description": "Echo.", "input_schema": {"type": "object"}, "risk": "read", "background": true}),
+                json!({"name": "demo.slow", "description": "Slow.", "input_schema": {"type": "object"}, "risk": "read", "background": true}),
+            ],
+            generic_tools: Vec::new(),
+            call_timeout_ms: Some(300_000),
+            max_result_bytes: None,
+        }
+    }
+    fn call(&self, call: ToolCall, cancel: Cancel) -> ToolFuture {
+        let demo = self.0.clone();
+        demo.runs.fetch_add(1, Ordering::SeqCst);
+        Box::pin(async move {
+            match call.name.as_str() {
+                "demo.echo" => Ok(json!({"echo": call.args, "context": call.context_id})),
+                _ => {
+                    struct Seen(Arc<Demo>, Cancel);
+                    impl Drop for Seen {
+                        fn drop(&mut self) {
+                            if self.1.is_cancelled() {
+                                self.0.cancelled.fetch_add(1, Ordering::SeqCst);
+                            }
+                        }
+                    }
+                    let _seen = Seen(demo.clone(), cancel.clone());
+                    tokio::time::sleep(Duration::from_secs(5)).await;
+                    Err(ToolError::new("late", "should never be answered"))
+                }
+            }
+        })
+    }
+}
+
+fn broker(tools: Option<Arc<dyn HostTools>>) -> (Broker, Arc<Mutex<Script>>) {
+    let script = Arc::new(Mutex::new(Script::default()));
+    let services: BTreeSet<String> = OCTOS_SERVICES.iter().map(|s| s.to_string()).collect();
+    let mut cfg = BrokerConfig::new(
+        Deployment::Hosted,
+        "_main",
+        "_main:api:octosense#system",
+        "news",
+        "News",
+        services,
+    );
+    cfg.host_tools = tools;
+    (
+        Broker::new(cfg, Arc::new(FakeConnector(script.clone()))),
+        script,
+    )
+}
+
+fn methods(script: &Arc<Mutex<Script>>) -> Vec<String> {
+    script
+        .lock()
+        .unwrap()
+        .calls
+        .iter()
+        .map(|(m, _)| m.clone())
+        .collect()
+}
+
+fn position(methods: &[String], method: &str, nth: usize) -> usize {
+    methods
+        .iter()
+        .enumerate()
+        .filter(|(_, m)| *m == method)
+        .nth(nth)
+        .unwrap_or_else(|| panic!("no {method} #{nth} in {methods:?}"))
+        .0
+}
+
+fn turn(broker: &Broker, text: &str) -> Result<Value, String> {
+    let ctx = broker
+        .open_context(ContextSpec {
+            account: "device".into(),
+            instance: "news#1".into(),
+            services: OCTOS_SERVICES.iter().map(|s| s.to_string()).collect(),
+        })
+        .unwrap();
+    let (tx, rx) = std::sync::mpsc::channel();
+    let tx = Mutex::new(tx);
+    ctx.call(
+        ContextOp::Turn { text: text.into() },
+        Arc::new(move |e| {
+            let _ = tx.lock().unwrap().send(e);
+        }),
+    )
+    .unwrap();
+    loop {
+        match rx
+            .recv_timeout(Duration::from_secs(10))
+            .expect("a completion")
+        {
+            ContextEvent::Complete(r) => return r,
+            ContextEvent::Data(_) => continue,
+        }
+    }
+}
+
+fn inject(script: &Arc<Mutex<Script>>, method: &str, params: Value) {
+    let out = script.lock().unwrap().out.clone().expect("a link");
+    out.send(json!({"jsonrpc": "2.0", "method": method, "params": params}).to_string())
+        .unwrap();
+}
+
+fn tool_call(call_id: &str, tool_call_id: &str, name: &str, args: Value, timeout_ms: u64) -> Value {
+    json!({"peer": "news-1", "session_id": "_main:api:octosense#peer-news-1", "context_id": null,
+           "turn_id": "turn-1", "call_id": call_id, "tool_call_id": tool_call_id, "args_digest": "d1",
+           "name": name, "args": args, "risk": "read", "confirm_required": false,
+           "timeout_ms": timeout_ms, "tools_version": 1})
+}
+
+/// The `peer/tool/result`s sent so far, by call id.
+fn results(script: &Arc<Mutex<Script>>) -> Vec<Value> {
+    script
+        .lock()
+        .unwrap()
+        .calls
+        .iter()
+        .filter(|(m, _)| m == "peer/tool/result")
+        .map(|(_, p)| p.clone())
+        .collect()
+}
+
+fn wait_for_result(script: &Arc<Mutex<Script>>, call_id: &str) -> Value {
+    let deadline = Instant::now() + Duration::from_secs(5);
+    loop {
+        if let Some(r) = results(script)
+            .into_iter()
+            .find(|r| r["call_id"] == call_id)
+        {
+            return r;
+        }
+        assert!(Instant::now() < deadline, "no result for {call_id}");
+        std::thread::sleep(Duration::from_millis(20));
+    }
+}
+
+fn bound(tools: Option<Arc<dyn HostTools>>) -> (Broker, Arc<Mutex<Script>>) {
+    let (broker, script) = broker(tools);
+    broker.set_account(Some("device"));
+    broker.bind().unwrap();
+    (broker, script)
+}
+
+#[test]
+fn every_prepare_registers_before_any_turn_and_again_after_a_reconnect() {
+    let (broker, script) = broker(None);
+    broker.set_account(Some("device"));
+    turn(&broker, "hello").unwrap();
+    let seen = methods(&script);
+    let prepare = position(&seen, "peer/prepare", 0);
+    let register = position(&seen, "peer/tools/register", 0);
+    assert_eq!(register, prepare + 1, "right after prepare: {seen:?}");
+    assert!(register < position(&seen, "peer/context/open", 0));
+    assert!(register < position(&seen, "turn/start", 0));
+    // No tools: the empty set, with the peer's token, on the same link.
+    let (_, params) = script.lock().unwrap().calls[register].clone();
+    assert_eq!(params["tools"], json!([]));
+    assert_eq!(params["generic_tools"], json!([]));
+    assert_eq!(params["peer"], "news-1");
+    assert_eq!(params["host_token"], TOKEN);
+    assert_eq!(params["session_id"], "_main:api:octosense#system");
+
+    // The link drops: the next turn prepares and registers again first.
+    let out = script.lock().unwrap().out.clone().unwrap();
+    out.send(CLOSE.into()).unwrap();
+    std::thread::sleep(Duration::from_millis(100));
+    let before = methods(&script).len();
+    let result = turn(&broker, "again");
+    let result = match result {
+        Ok(r) => r,
+        // The context was bound to the old link: a fresh one is opened.
+        Err(_) => turn(&broker, "again").unwrap(),
+    };
+    assert!(result["turn_id"].is_string());
+    let seen = methods(&script);
+    let after: Vec<String> = seen[before..].to_vec();
+    let prepare = position(&after, "peer/prepare", 0);
+    let register = position(&after, "peer/tools/register", 0);
+    assert_eq!(register, prepare + 1, "{after:?}");
+    assert!(register < position(&after, "turn/start", 0), "{after:?}");
+}
+
+#[test]
+fn a_failed_registration_starts_no_turn_and_says_so() {
+    let (broker, script) = broker(None);
+    script.lock().unwrap().fail_register = true;
+    broker.set_account(Some("device"));
+    let error = turn(&broker, "hello").unwrap_err();
+    assert!(error.contains("could not take this app's tools"), "{error}");
+    let seen = methods(&script);
+    assert!(seen.contains(&"peer/tools/register".to_owned()));
+    assert!(!seen.contains(&"turn/start".to_owned()), "{seen:?}");
+    assert!(!seen.contains(&"peer/context/open".to_owned()), "{seen:?}");
+    match broker.availability() {
+        Availability::Failed(why) => assert!(why.contains("tools"), "{why}"),
+        other => panic!("{other:?}"),
+    }
+    assert!(broker.bind().is_err());
+}
+
+#[test]
+fn the_apps_tools_are_registered_and_a_call_is_answered_by_the_host() {
+    let demo = Arc::new(Demo::default());
+    let (_broker, script) = bound(Some(Arc::new(DemoTools(demo.clone()))));
+    let register = script
+        .lock()
+        .unwrap()
+        .calls
+        .iter()
+        .find(|(m, _)| m == "peer/tools/register")
+        .unwrap()
+        .1
+        .clone();
+    let names: Vec<&str> = register["tools"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|t| t["name"].as_str().unwrap())
+        .collect();
+    assert_eq!(names, ["demo.echo", "demo.slow"]);
+    assert_eq!(register["call_timeout_ms"], 300_000);
+
+    inject(
+        &script,
+        "peer/tool/call",
+        tool_call("c1", "tc1", "demo.echo", json!({"q": 1}), 5000),
+    );
+    let result = wait_for_result(&script, "c1");
+    assert_eq!(result["ok"], true);
+    assert_eq!(result["data"]["echo"], json!({"q": 1}));
+    assert_eq!(result["peer"], "news-1");
+    assert_eq!(result["host_token"], TOKEN);
+    assert_eq!(result["session_id"], "_main:api:octosense#system");
+
+    // A repeat of the same occurrence is answered with the first result
+    // and never run again; a new tool-call id is a new occurrence.
+    inject(
+        &script,
+        "peer/tool/call",
+        tool_call("c2", "tc1", "demo.echo", json!({"q": 1}), 5000),
+    );
+    assert_eq!(
+        wait_for_result(&script, "c2")["data"]["echo"],
+        json!({"q": 1})
+    );
+    assert_eq!(demo.runs.load(Ordering::SeqCst), 1);
+    inject(
+        &script,
+        "peer/tool/call",
+        tool_call("c3", "tc2", "demo.echo", json!({"q": 2}), 5000),
+    );
+    assert_eq!(
+        wait_for_result(&script, "c3")["data"]["echo"],
+        json!({"q": 2})
+    );
+    assert_eq!(demo.runs.load(Ordering::SeqCst), 2);
+}
+
+#[test]
+fn a_tool_that_was_not_registered_is_refused_without_running() {
+    let demo = Arc::new(Demo::default());
+    let (_broker, script) = bound(Some(Arc::new(DemoTools(demo.clone()))));
+    inject(
+        &script,
+        "peer/tool/call",
+        tool_call(
+            "c1",
+            "tc1",
+            "toolbox.deep_crawl",
+            json!({"url": "https://example.org/"}),
+            5000,
+        ),
+    );
+    let result = wait_for_result(&script, "c1");
+    assert_eq!(result["ok"], false);
+    assert_eq!(result["error"]["kind"], "not_registered");
+    assert_eq!(demo.runs.load(Ordering::SeqCst), 0);
+    // A call for another peer is not this broker's to answer.
+    let mut other = tool_call("c2", "tc2", "demo.echo", json!({}), 5000);
+    other["peer"] = json!("mail-1");
+    inject(&script, "peer/tool/call", other);
+    std::thread::sleep(Duration::from_millis(200));
+    assert!(results(&script).iter().all(|r| r["call_id"] != "c2"));
+    assert_eq!(demo.runs.load(Ordering::SeqCst), 0);
+}
+
+#[test]
+fn a_cancelled_or_timed_out_call_is_stopped_and_never_answered() {
+    let demo = Arc::new(Demo::default());
+    let (_broker, script) = bound(Some(Arc::new(DemoTools(demo.clone()))));
+    inject(
+        &script,
+        "peer/tool/call",
+        tool_call("c1", "tc1", "demo.slow", json!({}), 60_000),
+    );
+    std::thread::sleep(Duration::from_millis(100));
+    inject(
+        &script,
+        "peer/tool/cancel",
+        json!({"call_id": "c1", "reason": "cancelled"}),
+    );
+    // Past its deadline: the kernel no longer waits.
+    inject(
+        &script,
+        "peer/tool/call",
+        tool_call("c2", "tc2", "demo.slow", json!({}), 150),
+    );
+    let deadline = Instant::now() + Duration::from_secs(3);
+    while demo.cancelled.load(Ordering::SeqCst) < 2 {
+        assert!(Instant::now() < deadline, "both calls stop");
+        std::thread::sleep(Duration::from_millis(20));
+    }
+    std::thread::sleep(Duration::from_millis(200));
+    assert!(results(&script).is_empty(), "{:?}", results(&script));
+    assert_eq!(demo.runs.load(Ordering::SeqCst), 2);
+}
+
+#[test]
+fn releasing_the_app_stops_its_calls() {
+    let demo = Arc::new(Demo::default());
+    let (broker, script) = bound(Some(Arc::new(DemoTools(demo.clone()))));
+    inject(
+        &script,
+        "peer/tool/call",
+        tool_call("c1", "tc1", "demo.slow", json!({}), 60_000),
+    );
+    std::thread::sleep(Duration::from_millis(100));
+    broker.release();
+    let deadline = Instant::now() + Duration::from_secs(3);
+    while demo.cancelled.load(Ordering::SeqCst) < 1 {
+        assert!(Instant::now() < deadline, "the call stops");
+        std::thread::sleep(Duration::from_millis(20));
+    }
+    assert!(results(&script).is_empty());
+}
diff --git a/crates/app-peers/tests/real_kernel.rs b/crates/app-peers/tests/real_kernel.rs
index 588792c5..87f96bd7 100644
--- a/crates/app-peers/tests/real_kernel.rs
+++ b/crates/app-peers/tests/real_kernel.rs
@@ -306,6 +306,10 @@ fn an_account_change_drops_a_late_reply_and_resume_keeps_the_peer_across_restart
 /// app peer input, the peer asks a question, the kernel wakes the system
 /// agent, which answers, and the peer continues with the answer.
 #[test]
+#[cfg_attr(
+    feature = "peer-tools",
+    ignore = "octos#2567: a peer that registered its tools gets none in kernel-internal continuations (peer_send_input), so the system agent's input no longer reaches a tool-using peer turn"
+)]
 fn the_system_agent_and_the_app_peer_exchange_a_question_and_answer() {
     let Some(program) = kernel() else { return };
     let script = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/mock_agent_llm.py");
@@ -385,6 +389,10 @@ fn uuid_like() -> String {
 /// on a question nobody answers; closing the app stops the peer's turn (the
 /// conservative background policy) without stopping the kernel.
 #[test]
+#[cfg_attr(
+    feature = "peer-tools",
+    ignore = "octos#2567: a peer that registered its tools gets none in kernel-internal continuations (peer_send_input), so the system agent's input no longer reaches a tool-using peer turn"
+)]
 fn closing_the_app_interrupts_its_peers_running_work() {
     let Some(program) = kernel() else { return };
     let script = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/mock_agent_llm.py");
@@ -467,6 +475,10 @@ fn closing_the_app_interrupts_its_peers_running_work() {
 /// `peer_send_input` against the first and dropped it while reporting
 /// success. SECOND_DELAY_SECS waits before the second send.
 #[test]
+#[cfg_attr(
+    feature = "peer-tools",
+    ignore = "octos#2567: a peer that registered its tools gets none in kernel-internal continuations (peer_send_input), so the system agent's input no longer reaches a tool-using peer turn"
+)]
 fn a_second_input_to_an_answered_peer_runs() {
     let Some(program) = kernel() else { return };
     let script = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/mock_agent_llm.py");
@@ -559,6 +571,10 @@ fn a_second_input_to_an_answered_peer_runs() {
 /// agent tries to approve it anyway with `peer_respond` the kernel refuses.
 /// The approval stays pending until the person answers it through the host.
 #[test]
+#[cfg_attr(
+    feature = "peer-tools",
+    ignore = "octos#2567: a peer that registered its tools gets none in kernel-internal continuations (peer_send_input), so the system agent's input no longer reaches a tool-using peer turn"
+)]
 fn the_system_agent_cannot_approve_an_app_peers_tool() {
     let Some(program) = kernel() else { return };
     let script = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/mock_agent_llm.py");
@@ -683,3 +699,103 @@ fn the_system_agent_cannot_approve_an_app_peers_tool() {
     assert!(ran, "the peer ran the command once the person approved it");
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+/// octos UPCR-2026-035 (feature `peer-tools`): the broker registers the
+/// app's tools on the link that drives its turns, a real turn's call of one
+/// reaches the host and its answer reaches the model; an app with the empty
+/// set gets no tools at all, never the default roster.
+#[cfg(feature = "peer-tools")]
+#[test]
+fn a_registered_host_tool_is_called_by_a_real_turn() {
+    use octosense_app_peers::peer_tools::{Cancel, HostTools, Registration, ToolCall, ToolFuture};
+    struct Echo;
+    impl HostTools for Echo {
+        fn registration(&self) -> Registration {
+            Registration {
+                tools: vec![
+                    json!({"name": "demo.echo", "description": "Echo the arguments.",
+                    "input_schema": {"type": "object", "required": ["q"], "properties": {"q": {"type": "integer"}}},
+                    "risk": "read", "background": true, "outward": false, "confirm": "host"}),
+                ],
+                ..Registration::default()
+            }
+        }
+        fn call(&self, call: ToolCall, _cancel: Cancel) -> ToolFuture {
+            Box::pin(async move { Ok(json!({"echoed": call.args, "by": "host"})) })
+        }
+    }
+    let Some(program) = kernel() else { return };
+    let script = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/mock_agent_llm.py");
+    let mut child = std::process::Command::new("python3")
+        .arg(script)
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::inherit())
+        .spawn()
+        .unwrap();
+    let mut line = String::new();
+    std::io::BufReader::new(child.stdout.take().unwrap())
+        .read_line(&mut line)
+        .unwrap();
+    let model = Model(child, line.trim().parse().unwrap());
+    let dir = temp("host-tools");
+    let core_dir = dir.join("octos-home/.octos");
+    write_profile(&core_dir, model.1);
+    let core = Core::new(Options::default().core_dir(&core_dir).program(&program));
+
+    let services: BTreeSet<String> = OCTOS_SERVICES.iter().map(|s| s.to_string()).collect();
+    let mut cfg = BrokerConfig::new(
+        Deployment::Hosted,
+        "_main",
+        "_main:api:octosense#system",
+        "news",
+        "News",
+        services,
+    );
+    cfg.state_dir = core
+        .core_dir()
+        .map(|d| d.parent().unwrap().join("host-state"));
+    cfg.host_tools = Some(Arc::new(Echo));
+    let news = Broker::new(cfg, Arc::new(CoreConnector::shared(core.clone())));
+    news.set_account(Some("device"));
+    let ctx = news.open_context(spec("device", "news#1")).unwrap();
+    let reply = run(
+        &ctx,
+        ContextOp::Turn {
+            text: r#"CALL_TOOL:demo_echo {"q": 7}"#.into(),
+        },
+        Duration::from_secs(60),
+    )
+    .expect("the turn completes")
+    .expect("the turn succeeds");
+    let text = reply["text"].as_str().unwrap_or_default();
+    assert!(text.starts_with("TOOL SAID"), "{reply}");
+    assert!(
+        text.contains("echoed") && text.contains('7') && text.contains("host"),
+        "{reply}"
+    );
+
+    // The empty set: no tools at all, not the profile's.
+    let rinx = broker(&core, "rinx", "Rinx");
+    rinx.set_account(Some("device"));
+    let ctx = rinx.open_context(spec("device", "rinx#1")).unwrap();
+    let reply = run(
+        &ctx,
+        ContextOp::Turn {
+            text: "CALL_TOOL:shell {}".into(),
+        },
+        Duration::from_secs(60),
+    )
+    .expect("the turn completes")
+    .expect("the turn succeeds");
+    assert_eq!(
+        reply["text"].as_str().map(str::trim),
+        Some("NO TOOL shell AMONG"),
+        "{reply}"
+    );
+
+    news.release();
+    rinx.release();
+    drop((news, rinx));
+    core.shutdown_within(Duration::from_secs(5));
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/toolbox/README.md b/crates/toolbox/README.md
index 1be9e458..e1171c65 100644
--- a/crates/toolbox/README.md
+++ b/crates/toolbox/README.md
@@ -228,6 +228,8 @@ The tests show this rule deciding real cases:
 
 `handle_json(app, {"tool": "workflow.run", "arguments": {…}})` routes the same calls as JSON and returns errors as `{"error": {kind, message}}`. `api::tool_descriptors()` gives the four tools' names, risk and input schemas for registration with a peer. The risk levels are the ones octos#2567 and App Hub's `tools.json` accept: `workflow.list`, `workflow.run` and `workflow.evaluate` are `read`, and `workflow.fork` is `act` (it writes only into the calling app's folder). The descriptors carry no `confirm` field.
 
+`peer` is what an app's peer is actually offered (octos#2567): `peer::tool_decls(app, library)` gives the `tools.json` entries from the app's grants alone (`research`: `workflow.run`, `workflow.fork`, `toolbox.search`, `toolbox.web_read`; `crawl` with crawl limits in the scope: `toolbox.deep_crawl`; octos's `deep_research` never), each `background`, not `outward`, `confirm: host`. `peer::PeerToolbox::call(app, name, args)` checks the name against the grants again (`not_granted` otherwise) and runs it: the two workflow tools through `handle_json` (the agent gets the data, sources and the result's path; the trace stays in the file), the single tools on the same `ResearchBackend` as `mod.research`, narrowed by the scope (`scope::narrow_search`, `check_domain`, `scope::narrow_crawl`), with their items saved under `research/` in the app's folder. `toolbox.deep_crawl` reads pages with `ResearchBackend::read_links` (the octos engine keeps each page's HTML for its links) and stays on the start's site, under `path_prefix`, inside the domains and within `max_depth` and `max_pages`.
+
 ## How an app agent will use it
 
 This flow needs the wiring in [What remains](#what-remains):
@@ -366,7 +368,7 @@ After the [status rules](#status) and the [summary check](#modresearch-v1): four
 
 ## What remains
 
-- **Peer tool wiring**, after octos#2567 (host-registered peer tools): register `tool_descriptors()` for granted peers in `crates/ai-host`, route each call to `Toolbox::handle_json` with the peer's `AppContext`, and supply the real `ModelClient` from the person's providers.
+- **Peer tool wiring** is in place behind `crates/ai-host`'s `toolbox-peers` feature (the `peer` module here: the tools per grant, `PeerToolbox::call`, and `toolbox.deep_crawl` over `ResearchBackend::read_links`). Turning it on waits for octos#2567 on the octos pin and App Hub's `research`/`crawl` capabilities.
 - **Engine**: the octos research engine is behind `ResearchBackend` (`octos-engine`). Still to do:
   - drop the interim adapter once the shells use it;
   - add metasearch (octos#2582) and publisher feeds (octos#2585);
diff --git a/crates/toolbox/src/lib.rs b/crates/toolbox/src/lib.rs
index 29a0260d..f0530680 100644
--- a/crates/toolbox/src/lib.rs
+++ b/crates/toolbox/src/lib.rs
@@ -33,6 +33,7 @@ pub mod json;
 pub mod library;
 pub mod manifest;
 pub mod modules;
+pub mod peer;
 pub mod research;
 pub mod runner;
 pub mod scope;
diff --git a/crates/toolbox/src/peer.rs b/crates/toolbox/src/peer.rs
new file mode 100644
index 00000000..70595d56
--- /dev/null
+++ b/crates/toolbox/src/peer.rs
@@ -0,0 +1,697 @@
+//! The toolbox as an app peer's host-registered tools (ADR 0002 section 6;
+//! octos UPCR-2026-035, octos#2567).
+//!
+//! The kernel offers an app's peer only the tools its host registers, and
+//! sends every call back to the host. This module is what the host
+//! registers and runs for the toolbox, whoever carries the calls
+//! (`crates/ai-host` with its `toolbox-peers` feature):
+//!
+//! - [`tool_decls`]: the `tools.json` entries of an app, **from its grants
+//!   alone**. `research` gives `workflow.run` and `workflow.fork` (the
+//!   template library, [`crate::api`]), `toolbox.search` and
+//!   `toolbox.web_read`; `crawl` gives `toolbox.deep_crawl`, and only while
+//!   the scope's crawl limits are not 0 (0 means crawling is not granted).
+//!   octos's `deep_research` is never offered: the templates replace it.
+//!   `workflow.list` and `workflow.evaluate` are not offered either; the run
+//!   tool's description lists the templates. No grant, no tools.
+//! - [`PeerToolbox::call`]: one call, checked **again** against the grants
+//!   (a call the registration did not offer is refused as `not_granted`,
+//!   whatever the kernel sent) and run with the app's [`AppContext`]: its
+//!   id, grants, octos `Scope`, budget and folder.
+//!
+//! Tool names are `<app>.<tool>` for octos (2–4 `.`-separated segments), so
+//! the single research tools are `toolbox.search`, `toolbox.web_read` and
+//! `toolbox.deep_crawl`; the model sees them as `toolbox_search`, …
+//!
+//! **Risk**: `read` for everything except `workflow.fork` (`act`: it writes a
+//! copy into the app's own toolbox folder). None is `outward` or
+//! `destructive`, so the kernel never gates them and `confirm` (`host`, the
+//! default: the host runs them, the app has no sheet for them) never comes
+//! into play. All are `background`: an app's agent runs them on its own
+//! triggers (News M3), with nobody present.
+//!
+//! **Results** go where the app cannot write: the app's toolbox folder is
+//! the host's (`<apps root>/.host/toolbox/<app>`, chosen by the caller), so
+//! run results (`toolbox/runs/<template>/<run>.json`, read by the glance
+//! screen's `sys.digest`) and research items (`research/*.json`) cannot be
+//! forged by the app. Each reply carries the file's path relative to that
+//! folder and a compact summary for the agent.
+
+use crate::api::Toolbox;
+use crate::host::{url_host, AppContext, CallContext, HostError, Remaining};
+use crate::library::{hex, Library};
+use crate::manifest::Budget;
+use crate::research::{
+    cap_evidence, item_id, FoundItem, ModelClient, ResearchBackend, ResearchHost, SearchQuery,
+    MAX_EVIDENCE_BYTES, MAX_EXCERPT_BYTES, MAX_SEARCH_FETCHES,
+};
+use crate::scope;
+use serde_json::{json, Value};
+use sha2::{Digest, Sha256};
+use std::collections::{BTreeSet, VecDeque};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+/// The capability that grants the research tools and the templates.
+pub const RESEARCH: &str = "research";
+/// The capability that grants `toolbox.deep_crawl`.
+pub const CRAWL: &str = "crawl";
+
+pub const RUN: &str = "workflow.run";
+pub const FORK: &str = "workflow.fork";
+pub const SEARCH: &str = "toolbox.search";
+pub const WEB_READ: &str = "toolbox.web_read";
+pub const DEEP_CRAWL: &str = "toolbox.deep_crawl";
+
+/// Results one `toolbox.search` returns when the call asks for no count.
+pub const DEFAULT_SEARCH_COUNT: u32 = 10;
+/// Page text one `toolbox.web_read` returns to the agent (the whole text is
+/// in the saved file).
+pub const WEB_READ_TEXT_MAX: usize = 16 * 1024;
+/// Links queued per crawl page at most, and the whole frontier.
+const CRAWL_LINKS_PER_PAGE: usize = 200;
+const CRAWL_FRONTIER_MAX: usize = 2000;
+/// How long one single research call may take (a run's own `max_ms` bounds
+/// the templates).
+const TOOL_MS: u64 = 120_000;
+
+/// Whether the app's scope lets it crawl at all.
+pub fn crawl_allowed(app: &AppContext) -> bool {
+    app.grants.contains(CRAWL) && app.scope.max_depth > 0 && app.scope.max_pages > 0
+}
+
+/// The tool names an app with these grants is offered.
+pub fn tool_names(app: &AppContext) -> BTreeSet<&'static str> {
+    let mut names = BTreeSet::new();
+    if app.grants.contains(RESEARCH) {
+        names.extend([RUN, FORK, SEARCH, WEB_READ]);
+    }
+    if crawl_allowed(app) {
+        names.insert(DEEP_CRAWL);
+    }
+    names
+}
+
+/// The `tools.json` entries (octos `peer/tools/register` `tools`) of an app
+/// with these grants, in a fixed order. Empty without a grant.
+pub fn tool_decls(app: &AppContext, library: &Library) -> Vec<Value> {
+    let names = tool_names(app);
+    let mut decls = Vec::new();
+    let decl = |name: &str, risk: &str, description: String, input_schema: Value| {
+        json!({
+            "name": name,
+            "description": description,
+            "input_schema": input_schema,
+            "risk": risk,
+            "background": true,
+            "outward": false,
+            "confirm": "host",
+        })
+    };
+    let workflow = crate::api::tool_descriptors();
+    let schema_of = |name: &str| {
+        workflow
+            .as_array()
+            .and_then(|tools| tools.iter().find(|t| t["name"] == name))
+            .map(|t| t["input_schema"].clone())
+            .unwrap_or_else(|| json!({"type": "object"}))
+    };
+    if names.contains(RUN) {
+        let mut listed = String::new();
+        for t in library.templates() {
+            let line = format!("{} ({}); ", t.manifest.id, t.manifest.title);
+            if listed.len() + line.len() > 1200 {
+                break;
+            }
+            listed.push_str(&line);
+        }
+        decls.push(decl(
+            RUN,
+            "read",
+            format!(
+                "Run a toolbox workflow template with parameters (each template's `params` schema is in its manifest). \
+                 The result, with its sources, is saved in this app's toolbox folder and summarized here. \
+                 Templates: {}or a fork of one made with workflow.fork.",
+                listed
+            ),
+            schema_of(RUN),
+        ));
+    }
+    if names.contains(FORK) {
+        decls.push(decl(
+            FORK,
+            "act",
+            "Copy a library template into this app's toolbox folder to change it; the copy keeps lineage to its parent and never gains more than it had.".into(),
+            schema_of(FORK),
+        ));
+    }
+    if names.contains(SEARCH) {
+        decls.push(decl(
+            SEARCH,
+            "read",
+            "Search free news sources (Google News, GDELT, publisher feeds) within this app's granted languages, regions, domains and recency; returns dated items with their sources, saved in this app's toolbox folder.".into(),
+            json!({
+                "type": "object", "required": ["query"], "additionalProperties": false,
+                "properties": {
+                    "query": {"type": "string", "minLength": 1, "maxLength": 300},
+                    "lang": {"type": "string", "description": "BCP-47 language to search in (must be granted to the app)"},
+                    "region": {"type": "string", "description": "ISO 3166-1 alpha-2 region"},
+                    "max_age_days": {"type": "integer", "minimum": 1, "description": "only material this recent"},
+                    "count": {"type": "integer", "minimum": 1, "maximum": 30}
+                }
+            }),
+        ));
+    }
+    if names.contains(WEB_READ) {
+        decls.push(decl(
+            WEB_READ,
+            "read",
+            "Read one page (rendered by a real browser when needed) inside this app's granted domains and return its main text; the page is saved in this app's toolbox folder.".into(),
+            json!({
+                "type": "object", "required": ["url"], "additionalProperties": false,
+                "properties": {"url": {"type": "string", "minLength": 1, "maxLength": 2048}}
+            }),
+        ));
+    }
+    if names.contains(DEEP_CRAWL) {
+        decls.push(decl(
+            DEEP_CRAWL,
+            "read",
+            format!(
+                "Crawl one site within this app's limits (same site, at most {} link hops and {} pages, optionally under a path prefix); the pages are saved in this app's toolbox folder.",
+                app.scope.max_depth, app.scope.max_pages
+            ),
+            json!({
+                "type": "object", "required": ["url"], "additionalProperties": false,
+                "properties": {
+                    "url": {"type": "string", "minLength": 1, "maxLength": 2048},
+                    "max_depth": {"type": "integer", "minimum": 1},
+                    "max_pages": {"type": "integer", "minimum": 1},
+                    "path_prefix": {"type": "string"}
+                }
+            }),
+        ));
+    }
+    decls
+}
+
+/// A refused or failed call: `kind` is `[a-z0-9_]{1,32}` (octos passes it to
+/// the model as `host:<kind>`).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PeerError {
+    pub kind: String,
+    pub message: String,
+}
+
+impl PeerError {
+    pub fn new(kind: &str, message: impl Into<String>) -> Self {
+        Self {
+            kind: kind.to_owned(),
+            message: message.into(),
+        }
+    }
+}
+
+impl std::fmt::Display for PeerError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}: {}", self.kind, self.message)
+    }
+}
+
+fn host_error(e: HostError) -> PeerError {
+    match e {
+        HostError::Denied(m) => PeerError::new("denied", m),
+        HostError::Failed(m) => PeerError::new("failed", m),
+        HostError::TimedOut(m) => PeerError::new("timeout", m),
+    }
+}
+
+/// The toolbox one host runs for app peers: the template library over
+/// `mod.research`, and the same research backend for the single tools.
+pub struct PeerToolbox {
+    toolbox: Toolbox<ResearchHost>,
+    backend: Arc<dyn ResearchBackend>,
+    clock: Arc<dyn Fn() -> chrono::DateTime<chrono::Utc>>,
+}
+
+impl PeerToolbox {
+    /// The toolbox over `backend` (the octos research engine in a shell) with
+    /// `model` for the templates' model calls (the person's providers).
+    pub fn new(
+        library: Library,
+        backend: Arc<dyn ResearchBackend>,
+        model: Arc<dyn ModelClient>,
+    ) -> Self {
+        let host = ResearchHost::new(backend.clone(), model);
+        Self::from_host(library, host, backend)
+    }
+
+    /// The toolbox over an already built `mod.research` host (fixtures set
+    /// its clock); `backend` must be the one `host` uses.
+    pub fn from_host(
+        library: Library,
+        host: ResearchHost,
+        backend: Arc<dyn ResearchBackend>,
+    ) -> Self {
+        Self {
+            toolbox: Toolbox::new(library, host),
+            backend,
+            clock: Arc::new(chrono::Utc::now),
+        }
+    }
+
+    /// Replaces the clock of saved research items (tests).
+    pub fn with_clock(
+        mut self,
+        clock: impl Fn() -> chrono::DateTime<chrono::Utc> + 'static,
+    ) -> Self {
+        self.clock = Arc::new(clock);
+        self
+    }
+
+    pub fn library(&self) -> &Library {
+        self.toolbox.library()
+    }
+
+    /// The app's `tools.json` entries ([`tool_decls`]).
+    pub fn decls(&self, app: &AppContext) -> Vec<Value> {
+        tool_decls(app, self.library())
+    }
+
+    /// Runs one peer tool call for `app`. The call is checked against the
+    /// app's grants again: a tool it was not offered is `not_granted`.
+    pub async fn call(
+        &self,
+        app: &AppContext,
+        name: &str,
+        args: Value,
+    ) -> Result<Value, PeerError> {
+        if !tool_names(app).contains(name) {
+            return Err(PeerError::new(
+                "not_granted",
+                format!("{name} is not among this app's toolbox tools"),
+            ));
+        }
+        if !args.is_object() {
+            return Err(PeerError::new("bad_request", "arguments must be an object"));
+        }
+        match name {
+            RUN | FORK => self.workflow(app, name, args).await,
+            SEARCH => self.search(app, &args).await,
+            WEB_READ => self.web_read(app, &args).await,
+            DEEP_CRAWL => self.deep_crawl(app, &args).await,
+            _ => Err(PeerError::new(
+                "not_granted",
+                format!("no toolbox tool {name}"),
+            )),
+        }
+    }
+
+    async fn workflow(
+        &self,
+        app: &AppContext,
+        name: &str,
+        args: Value,
+    ) -> Result<Value, PeerError> {
+        let reply = self
+            .toolbox
+            .handle_json(app, json!({"tool": name, "arguments": args}))
+            .await;
+        if let Some(error) = reply.get("error") {
+            let kind = error["kind"].as_str().unwrap_or("failed");
+            return Err(PeerError::new(
+                kind,
+                error["message"]
+                    .as_str()
+                    .unwrap_or("the toolbox refused the call"),
+            ));
+        }
+        if name == FORK {
+            return Ok(json!({
+                "id": reply["template"]["id"],
+                "version": reply["template"]["version"],
+                "lineage": reply["template"]["lineage"],
+                "path": reply["path"],
+            }));
+        }
+        // The agent gets the data and where the full result is; the trace,
+        // diagnostics and evidence stay in the file.
+        let sources: Vec<Value> = reply["provenance"]
+            .as_array()
+            .map(|p| {
+                p.iter()
+                    .map(|s| {
+                        json!({"id": s["id"], "url": s["url"], "title": s["title"],
+                               "source": s["source"], "published_at": s["published_at"]})
+                    })
+                    .collect()
+            })
+            .unwrap_or_default();
+        Ok(json!({
+            "run_id": reply["run_id"],
+            "template": reply["template"],
+            "status": reply["status"],
+            "status_reasons": reply["status_reasons"],
+            "data": reply["data"],
+            "sources": sources,
+            "stats": reply["stats"],
+            "result": reply["result_path"],
+        }))
+    }
+
+    fn context(&self, app: &AppContext, tool: &str, reads: u32) -> CallContext {
+        CallContext {
+            app: Arc::new(app.clone()),
+            run_id: format!("{tool}-{}", (self.clock)().format("%Y%m%dT%H%M%S%3fZ")),
+            template_id: tool.to_owned(),
+            template_digest: String::new(),
+            budget: Budget {
+                max_calls: reads.max(1),
+                max_model_calls: 0,
+                max_reads: reads,
+                max_ms: TOOL_MS,
+                max_concurrency: 1,
+            },
+            remaining: Remaining {
+                calls: reads.max(1),
+                model_calls: 0,
+                reads,
+                ms: TOOL_MS,
+            },
+            call_index: 0,
+        }
+    }
+
+    async fn search(&self, app: &AppContext, args: &Value) -> Result<Value, PeerError> {
+        let query = args["query"].as_str().unwrap_or("").trim();
+        let lang = args["lang"].as_str();
+        let region = args["region"].as_str();
+        let max_age_hours = args["max_age_days"]
+            .as_u64()
+            .map(|d| d.min(3650) as u32 * 24);
+        let count = args["count"]
+            .as_u64()
+            .map_or(DEFAULT_SEARCH_COUNT, |c| c.clamp(1, 30) as u32);
+        let narrowed = scope::narrow_search(&app.scope, query, lang, region, max_age_hours, count)
+            .map_err(|e| PeerError::new("denied", e))?;
+        let ctx = self.context(app, SEARCH, 0);
+        let found = self
+            .backend
+            .search(
+                &ctx,
+                SearchQuery {
+                    topic: query.to_owned(),
+                    language: lang.map(str::to_owned).filter(|l| !l.is_empty()),
+                    region: region.map(str::to_owned).filter(|r| !r.is_empty()),
+                    limit: narrowed.limit,
+                    max_age_hours: narrowed.max_age_hours,
+                    max_fetches: MAX_SEARCH_FETCHES,
+                },
+            )
+            .await
+            .map_err(host_error)?;
+        let mut notes = narrowed.notes;
+        notes.extend(found.notes);
+        let items: Vec<Value> = found
+            .items
+            .iter()
+            .filter(|i| app.scope.check_domain(&i.url).is_ok())
+            .take(narrowed.limit as usize)
+            .enumerate()
+            .map(|(n, i)| {
+                json!({"n": n + 1, "id": item_id(&i.url), "title": i.title, "url": i.url,
+                       "source": i.source, "language": i.language, "published_at": i.published_at,
+                       "readable": i.readable, "via": i.via})
+            })
+            .collect();
+        let now = self.stamp();
+        let doc = json!({
+            "kind": "search", "app_id": app.app_id, "query": query, "retrieved_at": now,
+            "items": items, "providers": found.providers, "partial": found.partial, "notes": notes,
+        });
+        let file = save(&app.folder, "search", query, &doc)?;
+        let mut reply = doc;
+        reply["file"] = json!(file);
+        Ok(reply)
+    }
+
+    async fn web_read(&self, app: &AppContext, args: &Value) -> Result<Value, PeerError> {
+        let url = args["url"].as_str().unwrap_or("").trim();
+        if url_host(url).is_none() {
+            return Err(PeerError::new("bad_request", "url must be an http(s) URL"));
+        }
+        app.scope
+            .check_domain(url)
+            .map_err(|e| PeerError::new("denied", e))?;
+        let ctx = self.context(app, WEB_READ, 1);
+        let item = FoundItem {
+            url: url.to_owned(),
+            title: String::new(),
+            source: url_host(url).unwrap_or_default(),
+            language: String::new(),
+            published_at: String::new(),
+            via: "web_read".into(),
+            readable: true,
+            snippet: String::new(),
+        };
+        let page = self.backend.read(&ctx, &item).await.map_err(host_error)?;
+        let sha = hex(&Sha256::digest(page.text.as_bytes()));
+        let (text, truncated) = cap_evidence(&page.text, WEB_READ_TEXT_MAX);
+        let now = self.stamp();
+        let doc = json!({
+            "kind": "read", "app_id": app.app_id, "url": url, "id": item_id(url),
+            "title": page.title, "retrieved_at": now, "evidence_sha256": sha, "text": page.text,
+        });
+        let file = save(&app.folder, "read", url, &doc)?;
+        Ok(json!({
+            "url": url, "id": item_id(url), "title": page.title, "retrieved_at": now,
+            "evidence_sha256": sha, "text": text, "truncated": truncated, "file": file,
+        }))
+    }
+
+    async fn deep_crawl(&self, app: &AppContext, args: &Value) -> Result<Value, PeerError> {
+        let narrowed =
+            scope::narrow_crawl(&app.scope, args).map_err(|e| PeerError::new("denied", e))?;
+        let site = url_host(&narrowed.url)
+            .ok_or_else(|| PeerError::new("bad_request", "url must be an http(s) URL"))?;
+        let site = site.strip_prefix("www.").unwrap_or(&site).to_owned();
+        let same_site = |link: &str| {
+            url_host(link).is_some_and(|h| h.strip_prefix("www.").unwrap_or(&h) == site)
+        };
+        let under_prefix = |link: &str| match &narrowed.path_prefix {
+            None => true,
+            Some(prefix) => url_path(link).is_some_and(|p| p.starts_with(prefix.as_str())),
+        };
+        let ctx = self.context(app, DEEP_CRAWL, narrowed.max_pages);
+        let mut frontier = VecDeque::from([(narrowed.url.clone(), 0u32)]);
+        let mut seen = BTreeSet::from([narrowed.url.clone()]);
+        let mut pages = Vec::new();
+        let mut failures = Vec::new();
+        let mut attempts = 0;
+        while let Some((url, depth)) = frontier.pop_front() {
+            if attempts >= narrowed.max_pages {
+                break;
+            }
+            attempts += 1;
+            match self.backend.read_links(&ctx, &url).await {
+                Ok(linked) => {
+                    let (evidence, _) = cap_evidence(&linked.page.text, MAX_EVIDENCE_BYTES);
+                    let (excerpt, _) = cap_evidence(&linked.page.text, MAX_EXCERPT_BYTES);
+                    pages.push(json!({
+                        "n": pages.len() + 1, "url": linked.final_url, "id": item_id(&linked.final_url),
+                        "title": linked.page.title, "depth": depth, "excerpt": excerpt, "text": evidence,
+                        "evidence_sha256": hex(&Sha256::digest(linked.page.text.as_bytes())),
+                    }));
+                    if depth < narrowed.max_depth {
+                        for link in linked.links.into_iter().take(CRAWL_LINKS_PER_PAGE) {
+                            if frontier.len() >= CRAWL_FRONTIER_MAX {
+                                break;
+                            }
+                            if same_site(&link)
+                                && under_prefix(&link)
+                                && app.scope.check_domain(&link).is_ok()
+                                && seen.insert(link.clone())
+                            {
+                                frontier.push_back((link, depth + 1));
+                            }
+                        }
+                    }
+                }
+                Err(e) if pages.is_empty() && frontier.is_empty() => return Err(host_error(e)),
+                Err(e) => failures.push(json!({"url": url, "error": e.to_string()})),
+            }
+        }
+        let now = self.stamp();
+        let doc = json!({
+            "kind": "crawl", "app_id": app.app_id, "url": narrowed.url, "retrieved_at": now,
+            "max_depth": narrowed.max_depth, "max_pages": narrowed.max_pages,
+            "path_prefix": narrowed.path_prefix, "pages": pages, "failures": failures,
+        });
+        let file = save(&app.folder, "crawl", &narrowed.url, &doc)?;
+        let listed: Vec<Value> = pages
+            .iter()
+            .map(|p| json!({"n": p["n"], "url": p["url"], "title": p["title"], "depth": p["depth"], "excerpt": p["excerpt"]}))
+            .collect();
+        Ok(json!({
+            "url": narrowed.url, "retrieved_at": now, "pages": listed,
+            "failures": doc["failures"], "file": file,
+        }))
+    }
+
+    fn stamp(&self) -> String {
+        (self.clock)().to_rfc3339_opts(chrono::SecondsFormat::Secs, true)
+    }
+}
+
+/// Writes `doc` to `<folder>/research/<kind>-<slug>-<hash>.json` and returns
+/// the path relative to the folder.
+fn save(folder: &Path, kind: &str, subject: &str, doc: &Value) -> Result<String, PeerError> {
+    let dir = folder.join("research");
+    std::fs::create_dir_all(&dir)
+        .map_err(|e| PeerError::new("io", format!("toolbox folder: {e}")))?;
+    let body = serde_json::to_vec_pretty(doc).map_err(|e| PeerError::new("io", e.to_string()))?;
+    let hash = &hex(&Sha256::digest(&body))[..12];
+    let name = format!("{kind}-{}-{hash}.json", slug(subject));
+    let path: PathBuf = dir.join(&name);
+    let tmp = path.with_extension("json.tmp");
+    std::fs::write(&tmp, &body)
+        .and_then(|_| std::fs::rename(&tmp, &path))
+        .map_err(|e| PeerError::new("io", format!("write {name}: {e}")))?;
+    Ok(format!("research/{name}"))
+}
+
+/// The path of an `http(s)` URL (`/` when it has none).
+fn url_path(url: &str) -> Option<&str> {
+    let rest = url
+        .strip_prefix("https://")
+        .or_else(|| url.strip_prefix("http://"))?;
+    let rest = rest.split(['?', '#']).next()?;
+    Some(rest.find('/').map_or("/", |at| &rest[at..]))
+}
+
+fn slug(text: &str) -> String {
+    let mut out = String::new();
+    for c in text.chars() {
+        if c.is_ascii_alphanumeric() {
+            out.push(c.to_ascii_lowercase());
+        } else if !out.ends_with('-') {
+            out.push('-');
+        }
+        if out.len() >= 40 {
+            break;
+        }
+    }
+    let out = out.trim_matches('-');
+    if out.is_empty() {
+        "item".into()
+    } else {
+        out.to_owned()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn app(grants: &[&str], scope: Value) -> AppContext {
+        let mut app =
+            AppContext::new("os.news", "/nonexistent").with_scope(scope::parse(&scope).unwrap());
+        for g in grants {
+            app = app.grant(*g);
+        }
+        app
+    }
+
+    fn names(app: &AppContext) -> Vec<String> {
+        tool_decls(app, &Library::builtin().unwrap())
+            .iter()
+            .map(|d| d["name"].as_str().unwrap().to_owned())
+            .collect()
+    }
+
+    #[test]
+    fn registration_follows_the_grants() {
+        assert!(names(&app(&[], json!({}))).is_empty());
+        assert_eq!(
+            names(&app(&["research"], json!({}))),
+            [RUN, FORK, SEARCH, WEB_READ]
+        );
+        // `crawl` without crawl limits is no crawl.
+        assert_eq!(names(&app(&["crawl"], json!({}))), Vec::<String>::new());
+        assert_eq!(
+            names(&app(&["crawl"], json!({"max_depth": 2, "max_pages": 10}))),
+            [DEEP_CRAWL]
+        );
+        assert_eq!(
+            names(&app(
+                &["research", "crawl"],
+                json!({"max_depth": 2, "max_pages": 10})
+            )),
+            [RUN, FORK, SEARCH, WEB_READ, DEEP_CRAWL]
+        );
+        // The limits alone grant nothing.
+        assert!(names(&app(&[], json!({"max_depth": 2, "max_pages": 10}))).is_empty());
+    }
+
+    #[test]
+    fn declarations_are_octos_tools_json_entries() {
+        let decls = tool_decls(
+            &app(
+                &["research", "crawl"],
+                json!({"max_depth": 2, "max_pages": 10}),
+            ),
+            &Library::builtin().unwrap(),
+        );
+        let allowed: BTreeSet<&str> = [
+            "name",
+            "description",
+            "input_schema",
+            "risk",
+            "background",
+            "outward",
+            "confirm",
+        ]
+        .into();
+        for d in &decls {
+            let name = d["name"].as_str().unwrap();
+            // `<app>.<tool>`: 2–4 segments of [a-z][a-z0-9_]{0,31}.
+            let segments: Vec<&str> = name.split('.').collect();
+            assert!((2..=4).contains(&segments.len()), "{name}");
+            assert!(segments.iter().all(|s| s.len() <= 32
+                && s.starts_with(|c: char| c.is_ascii_lowercase())
+                && s.bytes()
+                    .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'_')));
+            assert!(
+                d.as_object()
+                    .unwrap()
+                    .keys()
+                    .all(|k| allowed.contains(k.as_str())),
+                "{d}"
+            );
+            assert!(d["description"].as_str().unwrap().len() <= 2048, "{name}");
+            assert_eq!(d["input_schema"]["type"], "object");
+            let risk = if name == FORK { "act" } else { "read" };
+            assert_eq!(d["risk"], risk, "{name}");
+            assert_eq!(d["outward"], false);
+            assert_eq!(d["background"], true);
+            assert_eq!(d["confirm"], "host");
+        }
+        assert!(!decls
+            .iter()
+            .any(|d| d["name"].as_str().unwrap().contains("deep_research")));
+        // The run tool lists the templates.
+        assert!(decls[0]["description"]
+            .as_str()
+            .unwrap()
+            .contains("news-digest"));
+    }
+
+    #[test]
+    fn saved_names_are_slugged_and_relative() {
+        assert_eq!(slug("https://Example.org/a b?c"), "https-example-org-a-b-c");
+        assert_eq!(slug("台风"), "item");
+        assert_eq!(url_path("https://example.org/a/b?c#d"), Some("/a/b"));
+        assert_eq!(url_path("https://example.org"), Some("/"));
+        assert_eq!(url_path("ftp://example.org/a"), None);
+    }
+}
diff --git a/crates/toolbox/src/research/mod.rs b/crates/toolbox/src/research/mod.rs
index 37803cfa..982214db 100644
--- a/crates/toolbox/src/research/mod.rs
+++ b/crates/toolbox/src/research/mod.rs
@@ -152,6 +152,32 @@ pub trait ResearchBackend {
         ctx: &'a CallContext,
         item: &'a FoundItem,
     ) -> HostFuture<'a, Result<PageText, HostError>>;
+
+    /// Reads one page of a crawl (`deep_crawl`, the `crawl` capability): its
+    /// main text, the URL it was finally read from, and the absolute
+    /// `http(s)` links on it. Backends that cannot list links refuse, which
+    /// is the default.
+    fn read_links<'a>(
+        &'a self,
+        _ctx: &'a CallContext,
+        _url: &'a str,
+    ) -> HostFuture<'a, Result<LinkedPage, HostError>> {
+        Box::pin(async {
+            Err(HostError::Denied(
+                "this research backend cannot crawl".into(),
+            ))
+        })
+    }
+}
+
+/// One page of a crawl.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct LinkedPage {
+    /// Where the page was read from, after redirects.
+    pub final_url: String,
+    pub page: PageText,
+    /// Absolute `http(s)` links, in page order, without fragments.
+    pub links: Vec<String>,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
diff --git a/crates/toolbox/src/research/octos.rs b/crates/toolbox/src/research/octos.rs
index 19c9768c..ba9b2df8 100644
--- a/crates/toolbox/src/research/octos.rs
+++ b/crates/toolbox/src/research/octos.rs
@@ -44,7 +44,9 @@
 //!   say `readable: false` and templates skip them.
 
 use super::chrome::{Chrome, ChromeConfig};
-use super::{same_language, FoundItem, PageText, ResearchBackend, SearchQuery, SearchResults};
+use super::{
+    same_language, FoundItem, LinkedPage, PageText, ResearchBackend, SearchQuery, SearchResults,
+};
 use crate::host::{url_host, CallContext, HostError, HostFuture};
 use octos_research::metasearch::{
     EngineReport, EngineStatus, MetaItem, Metasearch, ReqwestFetch, SearchRequest,
@@ -182,6 +184,9 @@ impl OctosResearch {
             timeout: config.timeout,
             respect_robots: config.respect_robots,
             renderer,
+            // `deep_crawl` lists a page's links from its HTML
+            // ([`ResearchBackend::read_links`]).
+            keep_html: true,
             ..ReaderConfig::default()
         });
         Self {
@@ -490,6 +495,82 @@ impl ResearchBackend for OctosResearch {
             })
         })
     }
+
+    fn read_links<'a>(
+        &'a self,
+        ctx: &'a CallContext,
+        url: &'a str,
+    ) -> HostFuture<'a, Result<LinkedPage, HostError>> {
+        Box::pin(async move {
+            let scope = &ctx.app.scope;
+            scope.check_domain(url).map_err(HostError::Denied)?;
+            let page = self.reader.read(url).await.map_err(read_error)?;
+            scope
+                .check_domain(&page.final_url)
+                .map_err(HostError::Denied)?;
+            let links = extract_links(&page.html, &page.final_url);
+            Ok(LinkedPage {
+                final_url: page.final_url,
+                page: PageText {
+                    text: page.text,
+                    title: page.meta.title.filter(|t| !t.trim().is_empty()),
+                },
+                links,
+            })
+        })
+    }
+}
+
+/// The absolute `http(s)` links of `<a href>`s in `html`, resolved against
+/// `base`, without fragments, deduplicated in page order. A plain scan, not
+/// a parser: it only has to find links, never to render.
+pub fn extract_links(html: &str, base: &str) -> Vec<String> {
+    let Ok(base) = url::Url::parse(base) else {
+        return Vec::new();
+    };
+    let lower = html.to_ascii_lowercase();
+    let mut links = Vec::new();
+    let mut seen = BTreeSet::new();
+    let mut from = 0;
+    while let Some(at) = lower[from..].find("href") {
+        let start = from + at + 4;
+        from = start;
+        let rest = &html[start..];
+        let trimmed = rest.trim_start();
+        let Some(after_eq) = trimmed.strip_prefix('=') else {
+            continue;
+        };
+        let after_eq = after_eq.trim_start();
+        let value = match after_eq.chars().next() {
+            Some(q @ ('"' | '\'')) => match after_eq[1..].find(q) {
+                Some(end) => &after_eq[1..1 + end],
+                None => continue,
+            },
+            Some(_) => {
+                let end = after_eq
+                    .find(|c: char| c.is_whitespace() || c == '>')
+                    .unwrap_or(after_eq.len());
+                &after_eq[..end]
+            }
+            None => continue,
+        };
+        let value = value.trim().replace("&amp;", "&");
+        if value.is_empty() || value.starts_with('#') {
+            continue;
+        }
+        let Ok(mut link) = base.join(&value) else {
+            continue;
+        };
+        if !matches!(link.scheme(), "http" | "https") {
+            continue;
+        }
+        link.set_fragment(None);
+        let link = link.to_string();
+        if seen.insert(link.clone()) {
+            links.push(link);
+        }
+    }
+    links
 }
 
 #[cfg(test)]
@@ -512,6 +593,22 @@ mod tests {
         }
     }
 
+    #[test]
+    fn links_are_absolute_http_without_fragments_or_repeats() {
+        let html = r##"<a href="/a">A</a> <A HREF='b?x=1&amp;y=2#top'>B</A>
+            <a href=https://other.example/c>C</a> <a href="#frag">F</a>
+            <a href="mailto:x@example.org">M</a> <a href="/a#again">A2</a>"##;
+        assert_eq!(
+            extract_links(html, "https://example.org/dir/page"),
+            [
+                "https://example.org/a",
+                "https://example.org/dir/b?x=1&y=2",
+                "https://other.example/c",
+            ]
+        );
+        assert!(extract_links(html, "not a url").is_empty());
+    }
+
     #[test]
     fn google_news_links_are_readable_only_with_a_browser() {
         let gn = "https://news.google.com/rss/articles/CBMiXYZ?oc=5";
diff --git a/crates/toolbox/src/scope.rs b/crates/toolbox/src/scope.rs
index 05cc8b72..fb2c0387 100644
--- a/crates/toolbox/src/scope.rs
+++ b/crates/toolbox/src/scope.rs
@@ -152,6 +152,41 @@ pub fn narrow_search(
     compat::narrow_search(scope, topic, language, region, max_age_hours, limit)
 }
 
+/// A `deep_crawl` narrowed to the grant (the `crawl` capability's limits).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct NarrowedCrawl {
+    pub url: String,
+    /// Link hops from `url`, at least 1, at most the grant's `max_depth`.
+    pub max_depth: u32,
+    /// Pages read, at least 1, at most the grant's `max_pages`.
+    pub max_pages: u32,
+    /// Only URLs whose path starts with this, if set.
+    pub path_prefix: Option<String>,
+}
+
+/// Narrows one `deep_crawl` call (`{url, max_depth?, max_pages?,
+/// path_prefix?}`) to the grant, or refuses it: crawling not granted
+/// (`max_depth` or `max_pages` 0), no `url`, or a site outside the domain
+/// lists. Depth defaults to 1 and pages to 10, both clamped to the grant.
+/// With the feature this is `Scope::crawl_args`.
+pub fn narrow_crawl(scope: &Scope, args: &Value) -> Result<NarrowedCrawl, String> {
+    #[cfg(feature = "octos-engine")]
+    let narrowed = scope.crawl_args(args)?;
+    #[cfg(not(feature = "octos-engine"))]
+    let narrowed = compat::crawl_args(scope, args)?;
+    let number = |key: &str| narrowed.get(key).and_then(Value::as_u64).unwrap_or(1) as u32;
+    Ok(NarrowedCrawl {
+        url: narrowed["url"].as_str().unwrap_or_default().to_owned(),
+        max_depth: number("max_depth"),
+        max_pages: number("max_pages"),
+        path_prefix: narrowed
+            .get("path_prefix")
+            .and_then(Value::as_str)
+            .filter(|p| !p.is_empty())
+            .map(str::to_owned),
+    })
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -215,6 +250,30 @@ mod tests {
         assert!(allows_language(&unrestricted(), "en"));
     }
 
+    #[test]
+    fn crawls_need_the_crawl_limits_and_stay_within_them() {
+        let none = parse(&json!({})).unwrap();
+        let error = narrow_crawl(&none, &json!({"url": "https://example.org/"})).unwrap_err();
+        assert!(
+            error.contains("crawling is not in this app's grant"),
+            "{error}"
+        );
+        let scope =
+            parse(&json!({"max_depth": 2, "max_pages": 5, "domains_deny": ["bad.example.org"]}))
+                .unwrap();
+        let narrowed = narrow_crawl(
+            &scope,
+            &json!({"url": "https://example.org/", "max_depth": 9, "max_pages": 90, "path_prefix": "/a"}),
+        )
+        .unwrap();
+        assert_eq!((narrowed.max_depth, narrowed.max_pages), (2, 5));
+        assert_eq!(narrowed.path_prefix.as_deref(), Some("/a"));
+        let defaults = narrow_crawl(&scope, &json!({"url": "https://example.org/"})).unwrap();
+        assert_eq!((defaults.max_depth, defaults.max_pages), (1, 5));
+        assert!(narrow_crawl(&scope, &json!({"url": "https://bad.example.org/"})).is_err());
+        assert!(narrow_crawl(&scope, &json!({})).is_err());
+    }
+
     #[test]
     fn reads_are_checked_against_the_domains() {
         let scope = parse(&json!({
@@ -294,6 +353,18 @@ mod tests {
                     "{grant} {tag}"
                 );
             }
+            for args in [
+                json!({"url": "https://example.org/a"}),
+                json!({"url": "https://example.org/a", "max_depth": 9, "max_pages": 900, "path_prefix": "/news"}),
+                json!({"url": "https://bad.example.org/a", "max_depth": 1}),
+                json!({"max_depth": 1}),
+            ] {
+                assert_eq!(
+                    octos.crawl_args(&args),
+                    compat::crawl_args(&thin, &args),
+                    "{grant} {args}"
+                );
+            }
             for (language, region, hours, limit) in searches {
                 let a = narrow_search(&octos, "topic", language, region, hours, limit);
                 let b = compat::narrow_search(&thin, "topic", language, region, hours, limit);
diff --git a/crates/toolbox/src/scope/compat.rs b/crates/toolbox/src/scope/compat.rs
index 6ef3051f..e127083d 100644
--- a/crates/toolbox/src/scope/compat.rs
+++ b/crates/toolbox/src/scope/compat.rs
@@ -8,7 +8,7 @@
 use super::{NarrowedSearch, SEARCH_CATEGORY};
 use crate::host::url_host;
 use serde::{Deserialize, Serialize};
-use serde_json::Value;
+use serde_json::{json, Value};
 
 /// octos's metasearch categories.
 const CATEGORIES: &[&str] = &["general", "news", "science", "it", "social"];
@@ -222,3 +222,30 @@ pub fn narrow_search(
         notes,
     })
 }
+
+/// `Scope::crawl_args`: a `deep_crawl` call narrowed to the crawl limits.
+pub fn crawl_args(scope: &Scope, args: &Value) -> Result<Value, String> {
+    if scope.max_pages == 0 || scope.max_depth == 0 {
+        return Err("crawling is not in this app's grant".into());
+    }
+    let url = args
+        .get("url")
+        .and_then(Value::as_str)
+        .ok_or("url is required")?;
+    scope.check_domain(url)?;
+    let depth = args
+        .get("max_depth")
+        .and_then(Value::as_u64)
+        .unwrap_or(1)
+        .clamp(1, scope.max_depth as u64);
+    let pages = args
+        .get("max_pages")
+        .and_then(Value::as_u64)
+        .unwrap_or(10)
+        .clamp(1, scope.max_pages as u64);
+    let mut out = json!({"url": url, "max_depth": depth, "max_pages": pages});
+    if let Some(p) = args.get("path_prefix").and_then(Value::as_str) {
+        out["path_prefix"] = json!(p);
+    }
+    Ok(out)
+}
diff --git a/crates/toolbox/tests/peer.rs b/crates/toolbox/tests/peer.rs
new file mode 100644
index 00000000..ac25e867
--- /dev/null
+++ b/crates/toolbox/tests/peer.rs
@@ -0,0 +1,168 @@
+//! `toolbox.deep_crawl` through `PeerToolbox` over a scripted site: the
+//! crawl stays on the site, under the path prefix and inside the grant's
+//! domains and limits.
+
+mod common;
+
+use octosense_toolbox::fixture::{FakeModel, FakeModelConfig};
+use octosense_toolbox::host::{CallContext, HostError, HostFuture};
+use octosense_toolbox::peer::{PeerToolbox, DEEP_CRAWL};
+use octosense_toolbox::research::{
+    FoundItem, LinkedPage, PageText, ResearchBackend, SearchQuery, SearchResults,
+};
+use octosense_toolbox::{scope, AppContext, Library};
+use serde_json::{json, Value};
+use std::collections::BTreeMap;
+use std::sync::{Arc, Mutex};
+
+/// A site: each page's links.
+struct Site {
+    links: BTreeMap<&'static str, Vec<&'static str>>,
+    read: Mutex<Vec<String>>,
+}
+
+impl ResearchBackend for Site {
+    fn search<'a>(
+        &'a self,
+        _: &'a CallContext,
+        _: SearchQuery,
+    ) -> HostFuture<'a, Result<SearchResults, HostError>> {
+        Box::pin(async { Ok(SearchResults::default()) })
+    }
+    fn read<'a>(
+        &'a self,
+        _: &'a CallContext,
+        _: &'a FoundItem,
+    ) -> HostFuture<'a, Result<PageText, HostError>> {
+        Box::pin(async { Err(HostError::Failed("not used".into())) })
+    }
+    fn read_links<'a>(
+        &'a self,
+        ctx: &'a CallContext,
+        url: &'a str,
+    ) -> HostFuture<'a, Result<LinkedPage, HostError>> {
+        Box::pin(async move {
+            ctx.app.scope.check_domain(url).map_err(HostError::Denied)?;
+            self.read.lock().unwrap().push(url.to_owned());
+            let links = self
+                .links
+                .get(url)
+                .ok_or_else(|| HostError::Failed(format!("404 {url}")))?;
+            Ok(LinkedPage {
+                final_url: url.to_owned(),
+                page: PageText {
+                    text: format!("The page at {url}."),
+                    title: Some(url.to_owned()),
+                },
+                links: links.iter().map(|l| l.to_string()).collect(),
+            })
+        })
+    }
+}
+
+fn app(folder: &std::path::Path, scope: Value) -> AppContext {
+    AppContext::new("os.news", folder)
+        .grant("crawl")
+        .with_scope(scope::parse(&scope).unwrap())
+}
+
+#[tokio::test]
+async fn a_crawl_stays_on_the_site_and_within_its_limits() {
+    let site = Arc::new(Site {
+        links: BTreeMap::from([
+            (
+                "https://example.org/news/",
+                vec![
+                    "https://example.org/news/a",
+                    "https://example.org/about",
+                    "https://other.example/news/x",
+                    "https://bad.example.org/news/y",
+                    "https://www.example.org/news/b",
+                ],
+            ),
+            (
+                "https://example.org/news/a",
+                vec!["https://example.org/news/c"],
+            ),
+            ("https://www.example.org/news/b", vec![]),
+            ("https://example.org/news/c", vec![]),
+        ]),
+        read: Mutex::new(Vec::new()),
+    });
+    let model = Arc::new(FakeModel::new(BTreeMap::new(), FakeModelConfig::default()));
+    let toolbox = PeerToolbox::new(Library::builtin().unwrap(), site.clone(), model);
+    let dir = common::temp_dir("crawl");
+    let app = app(
+        &dir,
+        json!({"max_depth": 1, "max_pages": 10, "domains_deny": ["bad.example.org"]}),
+    );
+    let out = toolbox
+        .call(
+            &app,
+            DEEP_CRAWL,
+            json!({"url": "https://example.org/news/", "max_depth": 5, "path_prefix": "/news"}),
+        )
+        .await
+        .unwrap();
+    // Depth 1 (the grant's): the start and its on-site links under /news,
+    // never another site or a denied subdomain; not `c` (depth 2).
+    assert_eq!(
+        *site.read.lock().unwrap(),
+        [
+            "https://example.org/news/",
+            "https://example.org/news/a",
+            "https://www.example.org/news/b"
+        ]
+    );
+    assert_eq!(out["pages"].as_array().unwrap().len(), 3);
+    let file = out["file"].as_str().unwrap();
+    assert!(file.starts_with("research/crawl-"), "{file}");
+    let saved: Value =
+        serde_json::from_str(&std::fs::read_to_string(dir.join(file)).unwrap()).unwrap();
+    assert_eq!(saved["max_depth"], 1);
+    assert_eq!(
+        saved["pages"][0]["text"],
+        "The page at https://example.org/news/."
+    );
+
+    // The page limit holds.
+    site.read.lock().unwrap().clear();
+    let app = self::app(&dir, json!({"max_depth": 3, "max_pages": 2}));
+    toolbox
+        .call(
+            &app,
+            DEEP_CRAWL,
+            json!({"url": "https://example.org/news/", "max_pages": 50}),
+        )
+        .await
+        .unwrap();
+    assert_eq!(site.read.lock().unwrap().len(), 2);
+
+    // Without crawl limits, or outside the domains: refused before reading.
+    site.read.lock().unwrap().clear();
+    let none = AppContext::new("os.news", &dir).grant("crawl");
+    let refused = toolbox
+        .call(
+            &none,
+            DEEP_CRAWL,
+            json!({"url": "https://example.org/news/"}),
+        )
+        .await
+        .unwrap_err();
+    assert_eq!(refused.kind, "not_granted");
+    let narrow = self::app(
+        &dir,
+        json!({"max_depth": 1, "max_pages": 2, "domains_allow": ["example.org"]}),
+    );
+    let refused = toolbox
+        .call(
+            &narrow,
+            DEEP_CRAWL,
+            json!({"url": "https://other.example/"}),
+        )
+        .await
+        .unwrap_err();
+    assert_eq!(refused.kind, "denied");
+    assert!(site.read.lock().unwrap().is_empty());
+    let _ = std::fs::remove_dir_all(&dir);
+}

From eaecd61d783b51ae1f542a599bf00081febbc6b2 Mon Sep 17 00:00:00 2001
From: ymote <151983+ymote@users.noreply.github.com>
Date: Mon, 28 Sep 2026 10:44:08 -0700
Subject: [PATCH 2/2] toolbox-peers: merge main; App Hub #26's research scope;
 host-managed real-kernel check

The manifest's top-level research object is App Hub #26's shape; the os.*
fallback stays until the shells' App Hub pin has #26. The host-tool
round trip also runs on the host-managed server (host-token WebSocket).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/ai-host/README.md              |  8 ++++----
 crates/ai-host/src/toolbox_peers.rs   | 10 ++++++----
 crates/app-peers/tests/real_kernel.rs | 24 +++++++++++++++++++++++-
 3 files changed, 33 insertions(+), 9 deletions(-)

diff --git a/crates/ai-host/README.md b/crates/ai-host/README.md
index f80759f3..733d26ad 100644
--- a/crates/ai-host/README.md
+++ b/crates/ai-host/README.md
@@ -69,10 +69,10 @@ outside the app's jail, where the glance screen's `sys.digest` (OctoSense
 #87) reads them.
 
 **Grants.** `research`/`crawl` in the manifest's `capabilities`, the scope
-in octos's `Scope` shape under the manifest's `research` object
-(provisional: App Hub has no such capability yet). **Temporary:** until App
-Hub verifies these capabilities only system apps (`os.*`) get what they
-declare; any other app's declaration is ignored.
+in octos's `Scope` shape under the manifest's top-level `research` object
+(App Hub #26's shape). **Temporary:** until the shells' App Hub pin includes
+#26 and the host reads its verified grant, only system apps (`os.*`) get
+what they declare; any other app's declaration is ignored.
 
 **Turning it on** needs octos#2567 on the workspace's octos pin: a kernel
 without it refuses `peer/tools/register`, and the broker then starts no
diff --git a/crates/ai-host/src/toolbox_peers.rs b/crates/ai-host/src/toolbox_peers.rs
index b8a8957c..5a6daa4e 100644
--- a/crates/ai-host/src/toolbox_peers.rs
+++ b/crates/ai-host/src/toolbox_peers.rs
@@ -27,8 +27,10 @@
 //! `Scope` shape, under the manifest's [`SCOPE_KEY`] object (absent: no
 //! narrowing beyond octos's defaults, and no crawl limits, so no crawling).
 //!
-//! **TEMPORARY, until App Hub admits the `research` and `crawl` capabilities
-//! (checks, pins and lets the person grant them):** only system apps
+//! **TEMPORARY, until the shells' App Hub pin includes App Hub #26 (which
+//! admits the `research` and `crawl` capabilities: checks, pins and lets the
+//! person grant them) and the host reads its verified `AppPolicy::research`:**
+//! only system apps
 //! (`os.*`, shipped inside the shell and reviewed with it) get what they
 //! declare. Any other app's declaration is ignored, so a store app cannot
 //! grant itself research by writing it into its manifest. Remove
@@ -51,8 +53,8 @@ use std::sync::Arc;
 use tokio::sync::{mpsc, oneshot};
 
 /// The manifest object that holds the `research`/`crawl` scope (octos's
-/// `Scope` fields). Provisional: App Hub has no such capability yet; when it
-/// adds one, change this reader to its shape.
+/// `Scope` fields): App Hub #26's shape (`capabilities: ["research",
+/// "crawl"]` plus one top-level `research` object).
 pub const SCOPE_KEY: &str = "research";
 
 /// How long the kernel waits for one toolbox call: the most octos allows
diff --git a/crates/app-peers/tests/real_kernel.rs b/crates/app-peers/tests/real_kernel.rs
index 87f96bd7..5cdac87f 100644
--- a/crates/app-peers/tests/real_kernel.rs
+++ b/crates/app-peers/tests/real_kernel.rs
@@ -707,6 +707,20 @@ fn the_system_agent_cannot_approve_an_app_peers_tool() {
 #[cfg(feature = "peer-tools")]
 #[test]
 fn a_registered_host_tool_is_called_by_a_real_turn() {
+    host_tool_round_trip(false);
+}
+
+/// The same over the host-managed server (`serve --host-managed`, Talk to
+/// Octos on): the broker's link is the host-token WebSocket connection, and
+/// registration and results work there too.
+#[cfg(feature = "peer-tools")]
+#[test]
+fn a_registered_host_tool_is_called_by_a_real_turn_on_the_host_managed_server() {
+    host_tool_round_trip(true);
+}
+
+#[cfg(feature = "peer-tools")]
+fn host_tool_round_trip(host_managed: bool) {
     use octosense_app_peers::peer_tools::{Cancel, HostTools, Registration, ToolCall, ToolFuture};
     struct Echo;
     impl HostTools for Echo {
@@ -737,10 +751,18 @@ fn a_registered_host_tool_is_called_by_a_real_turn() {
         .read_line(&mut line)
         .unwrap();
     let model = Model(child, line.trim().parse().unwrap());
-    let dir = temp("host-tools");
+    let dir = temp(if host_managed {
+        "host-tools-managed"
+    } else {
+        "host-tools"
+    });
     let core_dir = dir.join("octos-home/.octos");
     write_profile(&core_dir, model.1);
     let core = Core::new(Options::default().core_dir(&core_dir).program(&program));
+    if host_managed {
+        core.set_external_access(true)
+            .expect("the host-managed server");
+    }
 
     let services: BTreeSet<String> = OCTOS_SERVICES.iter().map(|s| s.to_string()).collect();
     let mut cfg = BrokerConfig::new(