# ADR 0155: Fifth Domain read-only discovery and AI tool boundary

## Status

Accepted for HoloLake Era 0.1.8.

## Context

The 0.1.7 channel shell registered `JD-FD-PRIMARY` but exposed only a placeholder. Direct API models were also given vault-tool instructions even though their native tool surface only advertised `create_note`. Some providers consequently invented `read_file`, and the backend converted that mismatch into a fatal chat error.

## Decision

HoloLake Era reads `https://guanghulab.com/.well-known/guanghu.json` without credentials and accepts it only when the schema is `guanghu.ai-discovery/v1`, access is `public-read-only`, and every route remains under trusted Guanghu HTTPS. The UI reports this as a public route connection, never as proof that the private control server is healthy.

AI context is capability-aware. Coding agents retain vault-tool guidance. Direct API models receive only embedded note context and are told not to invent unavailable tools. If a provider still requests an unknown tool, the backend performs no file access and returns a nonfatal explanatory response.

The system identity preamble now identifies the model as the current AI instance operating the Guanghu language-personality system inside HoloLake Era; it no longer presents Tolaria as the system authority.

## Consequences

- Fifth Domain navigation has a real, read-only discovery connection without credentials or write authority.
- Public discovery availability and private server health remain distinct facts.
- Unknown direct-model tools cannot terminate the conversation or touch files.
- A future authenticated identity/router client can extend this boundary through a separate ADR and human authorization flow.