diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f821cc1..6dfb4bc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -95,7 +95,7 @@ jobs:
       - name: Verify routing, observation, process, guarded, and conformance boundaries
         run: |
           PYTHONPATH=src python -W error::ResourceWarning -m unittest \
-            tests.test_router tests.test_native_v2_runtime \
+            tests.test_router tests.test_agent_discovery tests.test_native_v2_runtime \
             tests.test_executable_observation tests.test_foreground_process \
             tests.test_process_context tests.test_triage tests.test_json_input \
             tests.test_cost_recommendation \
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e45979f..cd161de 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -181,7 +181,7 @@ jobs:
       - name: Verify routing, observation, process, guarded, and conformance boundaries
         run: |
           PYTHONPATH=src python -W error::ResourceWarning -m unittest \
-            tests.test_router tests.test_native_v2_runtime \
+            tests.test_router tests.test_agent_discovery tests.test_native_v2_runtime \
             tests.test_executable_observation tests.test_foreground_process \
             tests.test_process_context tests.test_triage tests.test_json_input \
             tests.test_cost_recommendation \
diff --git a/README.md b/README.md
index 8ae9021..d8c66ff 100644
--- a/README.md
+++ b/README.md
@@ -68,10 +68,11 @@ ownership labels remain opaque caller declarations. See the
 `wclass --help` lists the whole surface:
 
 ```text
-wclass [-h] [--version] {classify,example-policy,review-preset,review-cost-profile,recommend,route,run,render,delegate,v2} ...
+wclass [-h] [--version] {discover,profile,classify,example-policy,review-preset,review-cost-profile,recommend,route,run,render,delegate,v2} ...
 ```
 
-`classify`, `recommend`, `route`, and `run` read the task from standard input. `render`
+`classify`, `recommend`, `route`, and `run` read the task from standard input. `discover`
+and `profile` are task-free local selection commands. `render`
 prints the command of a policy route named by a workflow descriptor and never
 reads a task. `example-policy` emits packaged policy JSON; `review-preset`
 prints every command and fingerprint in one packaged policy.
@@ -106,6 +107,71 @@ them:
 Code `1` is not weightclass's; it means the interpreter died on an unhandled
 exception, which is a bug worth reporting.
 
+## Discover installed agents and generate a policy
+
+`discover` checks only absolute directories in the current `PATH` for the four
+package-supported executable names. It does not start a vendor process, read
+vendor configuration or authentication files, make a network request, or read
+task standard input:
+
+```sh
+wclass discover
+wclass discover --agent grok
+```
+
+The JSON result distinguishes an executable detected on the local path from a
+usable subscription or model. `executable_detected` means only that a regular
+executable file was found. Subscription, pricing, and quota remain `unknown`.
+The package-owned effort catalog describes the command shapes weightclass can
+build; it is not a probe of the installed CLI version. The model catalog
+contains only `default`, meaning that no model override is emitted, and reports
+`availability_verified: false`. Cloud model entitlement is not a locally
+installed property that weightclass can safely infer.
+
+`profile` turns an agent, model, effort, and tier selection into a complete
+schema-1 policy, so the user does not have to assemble vendor argv manually:
+
+```sh
+wclass profile \
+  --agent codex \
+  --tier low \
+  --model default \
+  --effort low > worker-policy.json
+```
+
+Codex, Claude, and Grok accept an opaque `--model` selection through their
+closed package builders. `agy` currently accepts only `--model default`
+because weightclass has no reviewed model-override shape for it. Every
+non-default model label remains caller-supplied opaque configuration;
+weightclass does not verify that the account can use it. The generated policy
+contains the detected absolute executable path and exactly one tier route.
+The command writes nothing unless the caller explicitly redirects its output
+to a chosen file.
+
+For an intentional cross-vendor worker, add `--allow-cross-vendor`. This emits
+the existing schema-1 `allow_mixed_vendors: true` opt-in; it is deliberately
+not a directional grant, so use the generated single-worker policy only at the
+reviewed integration boundary:
+
+```sh
+wclass profile \
+  --agent grok \
+  --tier low \
+  --model default \
+  --effort low \
+  --allow-cross-vendor > worker-policy.json
+
+printf '%s' 'Fix a spelling typo.' | \
+  wclass route --policy worker-policy.json --source-vendor codex --tier low
+```
+
+Review the emitted route and pass its fingerprint to the ordinary `run`
+command. Discovery and profile generation never execute the selected agent;
+`run` still starts exactly one foreground child with no retry or fallback.
+Generated `agy` and Grok policies retain `task_delivery: argv` and its local
+process-inspection exposure. Schema 1 binds the lexical executable path in the
+route fingerprint but does not provide schema-2 executable reobservation.
+
 Code `7` carries the real status in its diagnostic, as
 `{"error": "executor_failed", "executor_exit_code": N}` or, for a command killed
 by a signal, `{"error": "executor_failed", "executor_signal": N}`. A selected
diff --git a/docs/integrations.md b/docs/integrations.md
index 73231d4..0fd57bc 100644
--- a/docs/integrations.md
+++ b/docs/integrations.md
@@ -15,6 +15,27 @@ the project directory after installing `weightclass`.
 3. Keep a Codex-originated task on Codex and a Claude-originated task on Claude
    unless a reviewed policy explicitly enables cross-vendor routing.
 
+## Local discovery and profile selection
+
+Use `wclass discover` to list package-supported agent executable names found in
+absolute `PATH` entries. It performs filesystem checks only: no agent is
+started, no task is read, and no vendor configuration, authentication file, or
+network service is accessed. The result does not prove subscription access,
+model entitlement, price, quota, or installed-CLI compatibility. Model and
+effort catalogs are package declarations with availability explicitly
+unverified.
+
+Use `wclass profile --agent <agent> --tier <tier> --model <label> --effort
+<effort>` to generate one schema-1 policy on standard output. `default` omits a
+model override; another accepted model label is opaque user configuration, not
+an availability claim. `agy` supports only `default` because it has no reviewed
+model-override builder. Add `--allow-cross-vendor` only for an intentional
+boundary change, then review the generated policy through the ordinary
+fingerprint-bound `route`/`run` workflow. The generated policy uses the
+detected absolute lexical executable path, starts nothing by itself, and is
+never persisted unless the caller explicitly writes its stdout to a selected
+file.
+
 Do not put credentials, tokens, or personal information on a command line, in
 a policy, or in vendor-global configuration. Task text is a deliberate
 exception to that rule, not an oversight: the built-in `agy` and `grok` routes,
diff --git a/src/weightclass/agent_discovery.py b/src/weightclass/agent_discovery.py
new file mode 100644
index 0000000..67ca3dc
--- /dev/null
+++ b/src/weightclass/agent_discovery.py
@@ -0,0 +1,202 @@
+"""Task-free discovery of package-supported native agent executables."""
+
+from __future__ import annotations
+
+import os
+import unicodedata
+from dataclasses import dataclass
+from typing import Literal
+
+from .router import CLAUDE_COMMAND_PREFIX, agy_command, codex_command, grok_command
+
+DiscoveryTaskDelivery = Literal["stdin", "argv"]
+
+MAX_PATH_BYTES = 32_768
+MAX_PATH_ENTRIES = 256
+
+
+class AgentDiscoveryError(ValueError):
+    """A value-free local discovery failure."""
+
+
+class AgentUnavailableError(LookupError):
+    """Raised when a selected package-supported executable is not detected."""
+
+
+@dataclass(frozen=True, slots=True)
+class AgentAdapter:
+    agent: str
+    executable_name: str
+    task_delivery: DiscoveryTaskDelivery
+    accepts_opaque_model_override: bool
+
+
+AGENT_ADAPTERS = (
+    AgentAdapter("agy", "agy", "argv", False),
+    AgentAdapter("claude", "claude", "stdin", True),
+    AgentAdapter("codex", "codex", "stdin", True),
+    AgentAdapter("grok", "grok", "argv", True),
+)
+AGENT_IDS = tuple(adapter.agent for adapter in AGENT_ADAPTERS)
+TIERS = ("low", "standard", "high")
+EFFORTS = ("low", "medium", "high")
+MAX_MODEL_LABEL_BYTES = 240
+
+
+def _path_entries(path_value: str) -> tuple[str, ...]:
+    try:
+        encoded = path_value.encode("utf-8", errors="strict")
+    except UnicodeEncodeError:
+        raise AgentDiscoveryError() from None
+    entries = path_value.split(os.pathsep)
+    if len(encoded) > MAX_PATH_BYTES or len(entries) > MAX_PATH_ENTRIES:
+        raise AgentDiscoveryError()
+    return tuple(entry for entry in entries if entry and os.path.isabs(entry))
+
+
+def _reviewable_path(value: str) -> bool:
+    return value == value.strip(" ") and not any(
+        unicodedata.category(character).startswith("C")
+        or (character.isspace() and character != " ")
+        for character in value
+    )
+
+
+def _find_executable(name: str, entries: tuple[str, ...]) -> str | None:
+    for directory in entries:
+        candidate = os.path.join(directory, name)
+        if not _reviewable_path(candidate):
+            continue
+        try:
+            if os.path.isfile(candidate) and os.access(candidate, os.X_OK):
+                return candidate
+        except OSError:
+            continue
+    return None
+
+
+def render_agent_discovery(
+    path_value: str | None = None,
+    *,
+    agent: str | None = None,
+) -> dict[str, object]:
+    """Describe locally detected built-in agents without starting a process."""
+    if agent is not None and agent not in AGENT_IDS:
+        raise AgentDiscoveryError()
+    entries = _path_entries(os.environ.get("PATH", "") if path_value is None else path_value)
+    agents: list[dict[str, object]] = []
+    for adapter in AGENT_ADAPTERS:
+        if agent is not None and adapter.agent != agent:
+            continue
+        executable = _find_executable(adapter.executable_name, entries)
+        agents.append(
+            {
+                "agent": adapter.agent,
+                "executable": executable,
+                "executable_detected": executable is not None,
+                "task_delivery": adapter.task_delivery,
+                "model_catalog": {
+                    "source": "package_default_only",
+                    "values": ["default"],
+                    "accepts_opaque_override": adapter.accepts_opaque_model_override,
+                    "availability_verified": False,
+                },
+                "effort_catalog": {
+                    "source": "package_catalog",
+                    "values": ["low", "medium", "high"],
+                    "availability_verified": False,
+                },
+                "subscription": "unknown",
+                "pricing": "unknown",
+                "quota": "unknown",
+            }
+        )
+    return {
+        "schema_version": 1,
+        "discovery_mode": "local_path_only",
+        "network_used": False,
+        "vendor_processes_started": False,
+        "agents": agents,
+    }
+
+
+def _model_label(value: object) -> str:
+    if not isinstance(value, str):
+        raise AgentDiscoveryError()
+    try:
+        encoded = value.encode("utf-8", errors="strict")
+    except UnicodeEncodeError:
+        raise AgentDiscoveryError() from None
+    if (
+        not 1 <= len(encoded) <= MAX_MODEL_LABEL_BYTES
+        or value.startswith("-")
+        or any(character.isspace() or not character.isprintable() for character in value)
+    ):
+        raise AgentDiscoveryError()
+    return value
+
+
+def _selected_command(
+    adapter: AgentAdapter,
+    executable: str,
+    model: str,
+    effort: str,
+) -> list[str]:
+    if adapter.agent == "codex":
+        command = list(codex_command(effort))
+        if model != "default":
+            command[command.index("-c") : command.index("-c")] = ["--model", model]
+    elif adapter.agent == "claude":
+        command = list(CLAUDE_COMMAND_PREFIX + (effort,))
+        if model != "default":
+            insertion = command.index("--effort")
+            command[insertion:insertion] = ["--model", model]
+    elif adapter.agent == "agy":
+        if model != "default":
+            raise AgentDiscoveryError()
+        command = list(agy_command(effort))
+    elif adapter.agent == "grok":
+        command = list(grok_command(effort))
+        if model != "default":
+            insertion = command.index("--reasoning-effort")
+            command[insertion:insertion] = ["--model", model]
+    else:
+        raise AgentDiscoveryError()
+    command[0] = executable
+    return command
+
+
+def generate_selected_policy(
+    *,
+    agent: str,
+    tier: str,
+    model: str,
+    effort: str,
+    allow_cross_vendor: bool,
+    path_value: str | None = None,
+) -> dict[str, object]:
+    """Compile one selected built-in agent profile into a schema-1 policy."""
+    if tier not in TIERS or effort not in EFFORTS or not isinstance(allow_cross_vendor, bool):
+        raise AgentDiscoveryError()
+    selected_model = _model_label(model)
+    adapter = next((item for item in AGENT_ADAPTERS if item.agent == agent), None)
+    if adapter is None:
+        raise AgentDiscoveryError()
+    entries = _path_entries(os.environ.get("PATH", "") if path_value is None else path_value)
+    executable = _find_executable(adapter.executable_name, entries)
+    if executable is None:
+        raise AgentUnavailableError()
+    command = _selected_command(adapter, executable, selected_model, effort)
+    return {
+        "schema_version": 1,
+        "allow_mixed_vendors": allow_cross_vendor,
+        "posture": "balanced",
+        "routes": [
+            {
+                "id": f"selected-{adapter.agent}-{tier}",
+                "vendor": adapter.agent,
+                "tier": tier,
+                "command": command,
+            }
+        ],
+    }
diff --git a/src/weightclass/cli.py b/src/weightclass/cli.py
index 6728362..db82ff7 100644
--- a/src/weightclass/cli.py
+++ b/src/weightclass/cli.py
@@ -12,6 +12,13 @@
 from typing import Any, Final, NoReturn, cast
 
 from . import __version__
+from .agent_discovery import (
+    AGENT_IDS,
+    AgentDiscoveryError,
+    AgentUnavailableError,
+    generate_selected_policy,
+    render_agent_discovery,
+)
 from .classification import (
     InvalidTaskError,
     Tier,
@@ -619,6 +626,23 @@ def build_parser() -> argparse.ArgumentParser:
     parser.add_argument("--version", action="store_true")
     subcommands = parser.add_subparsers(dest="command")
 
+    discover = subcommands.add_parser(
+        "discover",
+        allow_abbrev=False,
+        description="List locally detected supported agent CLIs without starting them.",
+    )
+    discover.add_argument("--agent", choices=AGENT_IDS)
+    profile = subcommands.add_parser(
+        "profile",
+        allow_abbrev=False,
+        description="Generate a schema-1 policy from an installed agent selection.",
+    )
+    profile.add_argument("--agent", required=True, choices=AGENT_IDS)
+    profile.add_argument("--tier", required=True, choices=("low", "standard", "high"))
+    profile.add_argument("--model", default="default")
+    profile.add_argument("--effort", required=True, choices=("low", "medium", "high"))
+    profile.add_argument("--allow-cross-vendor", action="store_true")
+
     classify = subcommands.add_parser(
         "classify",
         allow_abbrev=False,
@@ -1704,6 +1728,32 @@ def main(argv: Sequence[str] | None = None) -> int:
         print(json.dumps({"error": "invalid_input"}), file=sys.stderr)
         return 2
 
+    if arguments.command == "discover":
+        try:
+            receipt = render_agent_discovery(agent=arguments.agent)
+        except AgentDiscoveryError:
+            print(json.dumps({"error": "invalid_input"}), file=sys.stderr)
+            return 2
+        print(json.dumps(receipt))
+        return 0
+    if arguments.command == "profile":
+        try:
+            policy = generate_selected_policy(
+                agent=arguments.agent,
+                tier=arguments.tier,
+                model=arguments.model,
+                effort=arguments.effort,
+                allow_cross_vendor=arguments.allow_cross_vendor,
+            )
+        except AgentDiscoveryError:
+            print(json.dumps({"error": "invalid_input"}), file=sys.stderr)
+            return 2
+        except AgentUnavailableError:
+            print(json.dumps({"error": "unsupported_route"}), file=sys.stderr)
+            return 3
+        print(json.dumps(policy))
+        return 0
+
     # 라벨이 열려 있으므로 argparse 가 오타를 잡아주지 못한다. 형식만이라도
     # 여기서 닫아, 잘못된 라벨이 라우트 선택까지 내려가지 않게 한다.
     source_vendor = getattr(arguments, "source_vendor", None)
diff --git a/tests/test_agent_discovery.py b/tests/test_agent_discovery.py
new file mode 100644
index 0000000..dbe4326
--- /dev/null
+++ b/tests/test_agent_discovery.py
@@ -0,0 +1,409 @@
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+
+class AgentDiscoveryCliTests(unittest.TestCase):
+    def test_discovers_known_executables_without_starting_them(self) -> None:
+        """Breaks if local discovery executes a vendor or overstates availability."""
+        with tempfile.TemporaryDirectory() as directory:
+            bin_directory = Path(directory) / "bin"
+            bin_directory.mkdir()
+            marker = Path(directory) / "vendor-started"
+            for executable_name in ("codex", "grok"):
+                executable = bin_directory / executable_name
+                executable.write_text(
+                    '#!/bin/sh\n: > "$DISCOVERY_MARKER"\n',
+                    encoding="utf-8",
+                )
+                executable.chmod(0o755)
+            environment = os.environ.copy()
+            environment["PATH"] = str(bin_directory)
+            environment["DISCOVERY_MARKER"] = str(marker)
+
+            result = subprocess.run(
+                [sys.executable, "-m", "weightclass", "discover"],
+                capture_output=True,
+                check=False,
+                env=environment,
+                input="private task that discovery must not read",
+                text=True,
+            )
+            vendor_was_started = marker.exists()
+
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stderr, "")
+        self.assertFalse(vendor_was_started)
+        payload = json.loads(result.stdout)
+        self.assertEqual(
+            {
+                "schema_version": payload["schema_version"],
+                "discovery_mode": payload["discovery_mode"],
+                "network_used": payload["network_used"],
+                "vendor_processes_started": payload["vendor_processes_started"],
+            },
+            {
+                "schema_version": 1,
+                "discovery_mode": "local_path_only",
+                "network_used": False,
+                "vendor_processes_started": False,
+            },
+        )
+        agents = {agent["agent"]: agent for agent in payload["agents"]}
+        self.assertEqual(
+            [agent["agent"] for agent in payload["agents"]],
+            ["agy", "claude", "codex", "grok"],
+        )
+        self.assertEqual(set(agents), {"agy", "claude", "codex", "grok"})
+        self.assertEqual(agents["codex"]["executable"], str(bin_directory / "codex"))
+        self.assertTrue(agents["codex"]["executable_detected"])
+        self.assertEqual(agents["grok"]["task_delivery"], "argv")
+        self.assertEqual(agents["claude"]["executable"], None)
+        self.assertFalse(agents["claude"]["executable_detected"])
+        for agent in agents.values():
+            self.assertEqual(
+                agent["effort_catalog"],
+                {
+                    "availability_verified": False,
+                    "source": "package_catalog",
+                    "values": ["low", "medium", "high"],
+                },
+            )
+            self.assertEqual(agent["model_catalog"]["values"], ["default"])
+            self.assertFalse(agent["model_catalog"]["availability_verified"])
+            self.assertEqual(agent["subscription"], "unknown")
+            self.assertEqual(agent["pricing"], "unknown")
+            self.assertEqual(agent["quota"], "unknown")
+        self.assertNotIn("private task", result.stdout)
+
+    def test_selected_agent_model_and_effort_generate_a_routable_policy(self) -> None:
+        """Breaks if profile selection stops compiling the exact reviewed command."""
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            bin_directory = root / "bin"
+            bin_directory.mkdir()
+            marker = root / "vendor-started"
+            executable = bin_directory / "codex"
+            executable.write_text(
+                '#!/bin/sh\n: > "$DISCOVERY_MARKER"\n',
+                encoding="utf-8",
+            )
+            executable.chmod(0o755)
+            environment = os.environ.copy()
+            environment["PATH"] = str(bin_directory)
+            environment["DISCOVERY_MARKER"] = str(marker)
+
+            generated = subprocess.run(
+                [
+                    sys.executable,
+                    "-m",
+                    "weightclass",
+                    "profile",
+                    "--agent",
+                    "codex",
+                    "--tier",
+                    "low",
+                    "--model",
+                    "user-selected-model",
+                    "--effort",
+                    "low",
+                    "--allow-cross-vendor",
+                ],
+                capture_output=True,
+                check=False,
+                env=environment,
+                input="private task that profile generation must not read",
+                text=True,
+            )
+            vendor_was_started = marker.exists()
+
+            self.assertEqual(generated.returncode, 0, generated.stderr)
+            self.assertEqual(generated.stderr, "")
+            self.assertFalse(vendor_was_started)
+            policy = json.loads(generated.stdout)
+            expected_command = [
+                str(executable),
+                "exec",
+                "--ephemeral",
+                "--sandbox",
+                "workspace-write",
+                "--model",
+                "user-selected-model",
+                "-c",
+                "model_reasoning_effort=low",
+                "-",
+            ]
+            self.assertEqual(
+                policy,
+                {
+                    "schema_version": 1,
+                    "allow_mixed_vendors": True,
+                    "posture": "balanced",
+                    "routes": [
+                        {
+                            "id": "selected-codex-low",
+                            "vendor": "codex",
+                            "tier": "low",
+                            "command": expected_command,
+                        }
+                    ],
+                },
+            )
+            policy_path = root / "selected-policy.json"
+            policy_path.write_text(generated.stdout, encoding="utf-8")
+            reviewed = subprocess.run(
+                [
+                    sys.executable,
+                    "-m",
+                    "weightclass",
+                    "route",
+                    "--policy",
+                    str(policy_path),
+                    "--source-vendor",
+                    "claude",
+                    "--tier",
+                    "low",
+                ],
+                capture_output=True,
+                check=False,
+                env=environment,
+                input="Fix a spelling typo.",
+                text=True,
+            )
+
+        self.assertEqual(reviewed.returncode, 0, reviewed.stderr)
+        self.assertEqual(json.loads(reviewed.stdout)["command"], expected_command)
+        self.assertNotIn("Fix a spelling typo.", reviewed.stdout)
+
+    def test_every_supported_adapter_builds_its_reviewed_command_shape(self) -> None:
+        """Breaks if selection generates a command that differs from a built-in adapter."""
+        with tempfile.TemporaryDirectory() as directory:
+            bin_directory = Path(directory) / "bin"
+            bin_directory.mkdir()
+            for executable_name in ("agy", "claude", "grok"):
+                executable = bin_directory / executable_name
+                executable.write_text("#!/bin/sh\nexit 91\n", encoding="utf-8")
+                executable.chmod(0o755)
+            environment = os.environ.copy()
+            environment["PATH"] = str(bin_directory)
+            cases = (
+                (
+                    "claude",
+                    "selected-claude-model",
+                    "medium",
+                    [
+                        str(bin_directory / "claude"),
+                        "--print",
+                        "--no-session-persistence",
+                        "--permission-mode",
+                        "acceptEdits",
+                        "--model",
+                        "selected-claude-model",
+                        "--effort",
+                        "medium",
+                    ],
+                ),
+                (
+                    "agy",
+                    "default",
+                    "low",
+                    [
+                        str(bin_directory / "agy"),
+                        "--print",
+                        "{{task}}",
+                        "--mode",
+                        "accept-edits",
+                        "--effort",
+                        "low",
+                    ],
+                ),
+                (
+                    "grok",
+                    "selected-grok-model",
+                    "high",
+                    [
+                        str(bin_directory / "grok"),
+                        "-p",
+                        "{{task}}",
+                        "--permission-mode",
+                        "acceptEdits",
+                        "--model",
+                        "selected-grok-model",
+                        "--reasoning-effort",
+                        "high",
+                    ],
+                ),
+            )
+            for agent, model, effort, expected_command in cases:
+                with self.subTest(agent=agent):
+                    result = subprocess.run(
+                        [
+                            sys.executable,
+                            "-m",
+                            "weightclass",
+                            "profile",
+                            "--agent",
+                            agent,
+                            "--tier",
+                            "low",
+                            "--model",
+                            model,
+                            "--effort",
+                            effort,
+                        ],
+                        capture_output=True,
+                        check=False,
+                        env=environment,
+                        input="",
+                        text=True,
+                    )
+
+                    self.assertEqual(result.returncode, 0, result.stderr)
+                    self.assertEqual(
+                        json.loads(result.stdout)["routes"][0]["command"],
+                        expected_command,
+                    )
+
+    def test_discovery_can_select_one_agent_catalog(self) -> None:
+        """Breaks if callers must infer one selection from an unrelated full inventory."""
+        with tempfile.TemporaryDirectory() as directory:
+            executable = Path(directory) / "grok"
+            executable.write_text("#!/bin/sh\nexit 92\n", encoding="utf-8")
+            executable.chmod(0o755)
+            environment = os.environ.copy()
+            environment["PATH"] = directory
+
+            result = subprocess.run(
+                [
+                    sys.executable,
+                    "-m",
+                    "weightclass",
+                    "discover",
+                    "--agent",
+                    "grok",
+                ],
+                capture_output=True,
+                check=False,
+                env=environment,
+                input="",
+                text=True,
+            )
+
+        self.assertEqual(result.returncode, 0, result.stderr)
+        agents = json.loads(result.stdout)["agents"]
+        self.assertEqual(len(agents), 1)
+        self.assertEqual(agents[0]["agent"], "grok")
+        self.assertEqual(agents[0]["executable"], str(executable))
+
+    def test_profile_fails_closed_when_the_selected_executable_is_absent(self) -> None:
+        """Breaks if an undetected agent produces a policy that can run another binary."""
+        with tempfile.TemporaryDirectory() as directory:
+            environment = os.environ.copy()
+            environment["PATH"] = directory
+            result = subprocess.run(
+                [
+                    sys.executable,
+                    "-m",
+                    "weightclass",
+                    "profile",
+                    "--agent",
+                    "claude",
+                    "--tier",
+                    "low",
+                    "--effort",
+                    "low",
+                ],
+                capture_output=True,
+                check=False,
+                env=environment,
+                input="private absent-agent task",
+                text=True,
+            )
+
+        self.assertEqual(result.returncode, 3)
+        self.assertEqual(result.stdout, "")
+        self.assertEqual(json.loads(result.stderr), {"error": "unsupported_route"})
+        self.assertNotIn("private absent-agent task", result.stderr)
+
+    def test_profile_rejects_unreviewable_or_unsupported_model_overrides(self) -> None:
+        """Breaks if a model label can become an option or an unsupported agy argument."""
+        with tempfile.TemporaryDirectory() as directory:
+            for executable_name in ("agy", "codex"):
+                executable = Path(directory) / executable_name
+                executable.write_text("#!/bin/sh\nexit 93\n", encoding="utf-8")
+                executable.chmod(0o755)
+            environment = os.environ.copy()
+            environment["PATH"] = directory
+            for agent, model in (("codex", "--unsafe-option"), ("agy", "opaque-model")):
+                with self.subTest(agent=agent, model=model):
+                    result = subprocess.run(
+                        [
+                            sys.executable,
+                            "-m",
+                            "weightclass",
+                            "profile",
+                            "--agent",
+                            agent,
+                            "--tier",
+                            "low",
+                            "--model",
+                            model,
+                            "--effort",
+                            "low",
+                        ],
+                        capture_output=True,
+                        check=False,
+                        env=environment,
+                        input="",
+                        text=True,
+                    )
+
+                    self.assertEqual(result.returncode, 2)
+                    self.assertEqual(result.stdout, "")
+                    self.assertEqual(json.loads(result.stderr), {"error": "invalid_input"})
+
+    def test_profile_ignores_relative_path_entries(self) -> None:
+        """Breaks if the current directory can silently supply the selected executable."""
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            relative_bin = root / "relative-bin"
+            relative_bin.mkdir()
+            executable = relative_bin / "codex"
+            executable.write_text("#!/bin/sh\nexit 94\n", encoding="utf-8")
+            executable.chmod(0o755)
+            environment = os.environ.copy()
+            environment["PATH"] = "relative-bin"
+            environment["PYTHONPATH"] = str(Path(__file__).resolve().parents[1] / "src")
+            result = subprocess.run(
+                [
+                    sys.executable,
+                    "-m",
+                    "weightclass",
+                    "profile",
+                    "--agent",
+                    "codex",
+                    "--tier",
+                    "low",
+                    "--effort",
+                    "low",
+                ],
+                capture_output=True,
+                check=False,
+                cwd=root,
+                env=environment,
+                input="",
+                text=True,
+            )
+
+        self.assertEqual(result.returncode, 3)
+        self.assertEqual(json.loads(result.stderr), {"error": "unsupported_route"})
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_ci_workflow_structure.py b/tests/test_ci_workflow_structure.py
index bcc7b9e..c6db149 100644
--- a/tests/test_ci_workflow_structure.py
+++ b/tests/test_ci_workflow_structure.py
@@ -6,6 +6,7 @@
 
 MACOS_BOUNDARY_MODULES = (
     "tests.test_router",
+    "tests.test_agent_discovery",
     "tests.test_native_v2_runtime",
     "tests.test_executable_observation",
     "tests.test_foreground_process",
diff --git a/tests/test_router.py b/tests/test_router.py
index b47745c..3cb4048 100644
--- a/tests/test_router.py
+++ b/tests/test_router.py
@@ -1663,6 +1663,8 @@ def test_help_lists_every_reachable_subcommand(self) -> None:
         self.assertEqual(result.returncode, 0, result.stderr)
         for subcommand in (
             "classify",
+            "discover",
+            "profile",
             "review-preset",
             "route",
             "run",
@@ -1856,6 +1858,16 @@ def test_no_subcommand_echoes_any_word_of_the_task(self) -> None:
             ]
 
             for arguments in (
+                ["discover"],
+                [
+                    "profile",
+                    "--agent",
+                    "codex",
+                    "--tier",
+                    "low",
+                    "--effort",
+                    "low",
+                ],
                 ["classify"],
                 ["route"],
                 ["route", "--source-vendor", "codex"],