diff --git a/docs-site/assets/kagent-docs/snippets/grpcurl-prerequisites.md b/docs-site/assets/kagent-docs/snippets/grpcurl-prerequisites.md
index dd9d5d62..a72daa21 100644
--- a/docs-site/assets/kagent-docs/snippets/grpcurl-prerequisites.md
+++ b/docs-site/assets/kagent-docs/snippets/grpcurl-prerequisites.md
@@ -1,4 +1,9 @@
+{{% version include-if="latest" %}}
 1. [Install kagent]({{< link path="setup/installation" >}}), and confirm that your installation sets `config.server.grpcReflection=true`. Reflection lets grpcurl discover the controller's methods without a local copy of kagent's protocol buffer definitions.
+{{% /version %}}
+{{% version include-if="main" %}}
+1. [Install kagent]({{< link path="setup/installation" >}}). {{< reuse "kagent-docs/snippets/grpcurl-reflection.md" >}}
+{{% /version %}}
 
 2. [Create your first agent]({{< link path="get-started/your-first-agent" >}}), then save the Agent's namespace and name to an environment variable, in the `<namespace>/<name>` form that the A2A `tenant` field takes. To list your Agents, run `kagent agent list`.
    ```bash
diff --git a/docs-site/assets/kagent-docs/snippets/grpcurl-reflection.md b/docs-site/assets/kagent-docs/snippets/grpcurl-reflection.md
new file mode 100644
index 00000000..22d811e1
--- /dev/null
+++ b/docs-site/assets/kagent-docs/snippets/grpcurl-reflection.md
@@ -0,0 +1 @@
+grpcurl uses gRPC server reflection to discover the controller's methods without a local copy of kagent's protocol buffer definitions. `kagent install` turns reflection on. A Helm installation must set `config.server.grpcReflection=true`. Reflection requires the same authentication as the other gRPC calls. In the default `insecure` [authentication mode]({{< link path="about/substrate-runtime/identity#controller-authentication-modes" >}}), grpcurl needs no credentials. When authentication is on, pass credentials on every grpcurl command, even one that only lists services, such as `-H "authorization: Bearer <token>"`.
diff --git a/docs-site/assets/kagent-docs/snippets/install-cli.md b/docs-site/assets/kagent-docs/snippets/install-cli.md
index 5a1ec64b..6dfb2257 100644
--- a/docs-site/assets/kagent-docs/snippets/install-cli.md
+++ b/docs-site/assets/kagent-docs/snippets/install-cli.md
@@ -1,5 +1,7 @@
-Download the kagent CLI. The `--version` flag matches the CLI to the release that these docs cover.
+Download the kagent CLI.
 
 ```bash
-curl https://raw.githubusercontent.com/kagent-dev/kagent/refs/heads/main/scripts/get-kagent | bash -s -- --version v{{< reuse "kagent-docs/versions/kagent.md" >}}
+curl -sL https://kagent.dev/install | bash
 ```
+
+The script installs the newest kagent release. To install the release that these docs cover instead, run `curl -sL https://kagent.dev/install | bash -s -- --version v{{< reuse "kagent-docs/versions/kagent.md" >}}`.
diff --git a/docs-site/content/kagent/main/about/substrate-runtime/identity.md b/docs-site/content/kagent/main/about/substrate-runtime/identity.md
index 6dfc0cd9..f6da90f1 100644
--- a/docs-site/content/kagent/main/about/substrate-runtime/identity.md
+++ b/docs-site/content/kagent/main/about/substrate-runtime/identity.md
@@ -57,7 +57,7 @@ config:
         authority: prod-cluster
 ```
 
-The workload sends a ServiceAccount token whose audience is `kagent-invocation` as a bearer token in the `Authorization` header. A workload usually mounts the token as a projected volume. To test from a terminal, create a token with `kubectl`, port-forward the controller's port `8083`, and call the API. The `grpcurl` command relies on gRPC reflection, so your installation must set `config.server.grpcReflection=true`.
+The workload sends a ServiceAccount token whose audience is `kagent-invocation` as a bearer token in the `Authorization` header. A workload usually mounts the token as a projected volume. To test from a terminal, create a token with `kubectl`, port-forward the controller's port `8083`, and call the API. The `grpcurl` command relies on gRPC reflection, which `kagent install` turns on and a Helm installation turns on with `config.server.grpcReflection=true`. Reflection requires the same authentication as the other gRPC calls, and the `-H` flag sends the token on the reflection requests as well as on the call.
 
 ```bash
 kubectl create namespace ci-bots
@@ -181,7 +181,7 @@ actorJwt:
   audiences: [ticket-api, kagent-agent-info]
 ```
 
-The service sends the token that it received as a bearer token, with an empty request. In the following command, `$ACTOR_TOKEN` holds that token. The `grpcurl` command relies on gRPC reflection, so your installation must set `config.server.grpcReflection=true`. The `-rpc-header` flag keeps the token off the reflection requests.
+The service sends the token that it received as a bearer token, with an empty request. In the following command, `$ACTOR_TOKEN` holds that token. The `grpcurl` command relies on gRPC reflection, which `kagent install` turns on and a Helm installation turns on with `config.server.grpcReflection=true`. The `-rpc-header` flag sends the Actor token on the call only, so the reflection requests that grpcurl makes first carry no token. Reflection requires the same authentication as the other user calls. In the default `insecure` mode it needs no credentials. When authentication is on, also pass a user credential with `-reflect-header`, such as `-reflect-header "authorization: Bearer <token>"`.
 
 ```bash
 grpcurl -plaintext -rpc-header "Authorization: Bearer $ACTOR_TOKEN" -d '{}' \
diff --git a/docs-site/content/kagent/main/agents/agent-memory.md b/docs-site/content/kagent/main/agents/agent-memory.md
index 20664752..036839fe 100644
--- a/docs-site/content/kagent/main/agents/agent-memory.md
+++ b/docs-site/content/kagent/main/agents/agent-memory.md
@@ -220,7 +220,7 @@ No CLI command manages memories, so these examples call the service with [grpcur
 
 Each call also takes the `agent_name` exactly as the memory table stores it. An incorrect name fails silently, so copy the value from the table instead of typing it by hand.
 
-1. Port-forward the controller's gRPC port, and confirm that your kagent installation sets `config.server.grpcReflection=true`.
+1. Port-forward the controller's gRPC port. {{< reuse "kagent-docs/snippets/grpcurl-reflection.md" >}}
    ```bash
    kubectl port-forward -n kagent svc/kagent-controller 8083:8083
    ```
diff --git a/docs-site/content/kagent/main/agents/scheduled-runs.md b/docs-site/content/kagent/main/agents/scheduled-runs.md
index 23c17934..7bdaff57 100644
--- a/docs-site/content/kagent/main/agents/scheduled-runs.md
+++ b/docs-site/content/kagent/main/agents/scheduled-runs.md
@@ -11,7 +11,7 @@ kagent stores schedules in its database, not as Kubernetes resources. You manage
 
 ## Before you begin
 
-1. [Install kagent]({{< link path="setup/installation" >}}). To call the API with grpcurl, set `config.server.grpcReflection=true`. grpcurl uses server reflection to find the `ScheduledRunService` methods.
+1. [Install kagent]({{< link path="setup/installation" >}}). If you call the `ScheduledRunService` API with grpcurl rather than the UI, note the following. {{< reuse "kagent-docs/snippets/grpcurl-reflection.md" >}}
 2. Create an Agent that answers a prompt, such as the one in [Your first agent]({{< link path="get-started/your-first-agent" >}}).
 
 ## Create a schedule in the UI
diff --git a/docs-site/content/kagent/main/examples/agents-via-mcp.md b/docs-site/content/kagent/main/examples/agents-via-mcp.md
index 9e5c7435..11a33573 100644
--- a/docs-site/content/kagent/main/examples/agents-via-mcp.md
+++ b/docs-site/content/kagent/main/examples/agents-via-mcp.md
@@ -23,7 +23,7 @@ The MCP server runs on the controller's HTTP port, so a default installation alr
 
 ## Before you begin
 
-1. [Install kagent]({{< link path="setup/installation" >}}), and confirm that your installation sets `config.server.grpcReflection=true`. Reflection lets a gRPC client discover the controller's methods without a local copy of kagent's protocol buffer definitions.
+1. [Install kagent]({{< link path="setup/installation" >}}). {{< reuse "kagent-docs/snippets/grpcurl-reflection.md" >}}
 
 2. [Create your first agent]({{< link path="get-started/your-first-agent" >}}), so that the cluster has an {{< gloss "Agent" >}}Agent{{< /gloss >}} to invoke.
 
diff --git a/docs-site/content/kagent/main/get-started/your-first-agent.md b/docs-site/content/kagent/main/get-started/your-first-agent.md
index f0b19a7c..f8b20cdf 100644
--- a/docs-site/content/kagent/main/get-started/your-first-agent.md
+++ b/docs-site/content/kagent/main/get-started/your-first-agent.md
@@ -42,6 +42,9 @@ Three resources define a runnable agent: a Harness holds the runtime, an AgentTe
          location: s3://ate-snapshots/kagent/
    ```
 
+   > [!TIP]
+   > Your installation also comes with the `kagent-default`, `codex-default`, and `claude-default` Harnesses in the kagent namespace, for the kagent, Codex, and Claude runtimes. An Agent in the kagent namespace can name one of them in `spec.harnessRef` instead of a Harness of your own. `spec.harnessRef` is namespace-local, so an Agent in another namespace needs its own Harness. This guide creates its own Harness so that you can see each field, and because later guides build on it.
+
 2. Apply an `AgentTemplate`. The `modelConfig` field references the `default-model-config` {{< gloss "ModelConfig" >}}ModelConfig{{< /gloss >}} that was automatically created for the model provider API key that you provided during kagent installation.
    ```yaml
    apiVersion: api.kagent.dev/v1alpha3
diff --git a/docs-site/content/kagent/main/operations/debug.md b/docs-site/content/kagent/main/operations/debug.md
index 6a707203..9304af00 100644
--- a/docs-site/content/kagent/main/operations/debug.md
+++ b/docs-site/content/kagent/main/operations/debug.md
@@ -72,7 +72,7 @@ Compatible=False  Blocked: blocked by ResolvedRefs
 Ready=False  Blocked: blocked by ResolvedRefs
 ```
 
-A failed golden snapshot is not final. When Agent Substrate fails to build the golden snapshot, kagent deletes the failed ActorTemplate and rebuilds it after about 15 seconds, 1 minute, and 4 minutes, and then about every 10 minutes indefinitely. While a rebuild waits, `Ready` is `False` with the reason `ActorTemplateRetrying` and a message such as `golden build failed (GoldenActorCrashed), retry 1 at <time>`. The message omits Agent Substrate's full error, because that error can quote your configuration. Read the full error in the controller log. When a configuration fault causes the failure, kagent retries until you edit the Agent or the SandboxTemplate.
+A failed golden snapshot is not final. When Agent Substrate fails to build the golden snapshot, kagent deletes the failed ActorTemplate and rebuilds it after about 15 seconds, 1 minute, and 4 minutes, and then about every 10 minutes indefinitely. While a rebuild waits, `Ready` is `False` with the reason `ActorTemplateRetrying` and a message such as `golden build failed (GoldenActorCrashed), retry 1 at <time>`. When the build failed because a node could not pull an image, the message names the image, such as `golden build failed (GoldenActorCrashed): could not pull image ghcr.io/example/agent:v1, retry 1 at <time>`. Check that the image reference is correct and that the cluster can pull it. Otherwise, the message omits Agent Substrate's full error, because that error can quote your configuration. Read the full error in the controller log. When a configuration fault causes the failure, kagent retries until you edit the Agent or the SandboxTemplate.
 
 ```bash
 kubectl logs -n kagent deploy/kagent-controller | grep "golden build failed"
diff --git a/docs-site/content/kagent/main/operations/export-to-helm.md b/docs-site/content/kagent/main/operations/export-to-helm.md
index 72682cac..67ec2c25 100644
--- a/docs-site/content/kagent/main/operations/export-to-helm.md
+++ b/docs-site/content/kagent/main/operations/export-to-helm.md
@@ -15,7 +15,7 @@ The export contains only the Helm releases. `kagent install` also creates the Ag
 
 ## Before you begin
 
-1. Install kagent with the kagent CLI, as described in [Install with the CLI]({{< link path="setup/installation#install-kagent" >}}). Keep the CLI configuration file that passes Helm values to `kagent install`, and the values files that it references. The CLI reads the configuration file from one of the following locations:
+1. Install kagent with the kagent CLI, as described in [Install with the CLI]({{< link path="setup/installation#install-kagent" >}}). If you [passed your own Helm values]({{< link path="setup/installation#cli-helm-values" >}}), keep the CLI configuration file that passes Helm values to `kagent install`, and the values files that it references. The CLI reads the configuration file from one of the following locations:
    * The path that you passed with the `--config` flag, such as `kagent-config.yaml`.
    * When you omit `--config`, `$XDG_CONFIG_HOME/kagent/config.yaml` on Linux, or `~/.config/kagent/config.yaml` when `XDG_CONFIG_HOME` is not set. On macOS, `~/Library/Application Support/kagent/config.yaml`.
 
diff --git a/docs-site/content/kagent/main/operations/tune-agent-substrate.md b/docs-site/content/kagent/main/operations/tune-agent-substrate.md
index 90a7b827..274d16a1 100644
--- a/docs-site/content/kagent/main/operations/tune-agent-substrate.md
+++ b/docs-site/content/kagent/main/operations/tune-agent-substrate.md
@@ -11,7 +11,7 @@ The single Worker reports capacity for 1000 Actors, so a default pool serves man
 
 ## Before you begin
 
-1. [Install kagent]({{< link path="setup/installation" >}}), and confirm that your installation sets `config.server.grpcReflection=true`. Reflection lets a gRPC client discover the controller's methods without a local copy of kagent's protocol buffer definitions.
+1. [Install kagent]({{< link path="setup/installation" >}}). {{< reuse "kagent-docs/snippets/grpcurl-reflection.md" >}}
 
 2. Confirm that you have administrative access to the cluster, because this guide scales WorkerPools and reads cluster-scoped resources.
 
diff --git a/docs-site/content/kagent/main/operations/upgrade-from-0x.md b/docs-site/content/kagent/main/operations/upgrade-from-0x.md
index 53eedd5e..fb6cd5bc 100644
--- a/docs-site/content/kagent/main/operations/upgrade-from-0x.md
+++ b/docs-site/content/kagent/main/operations/upgrade-from-0x.md
@@ -66,7 +66,7 @@ Export your resources before you uninstall 0.10.x. Some resources convert to 1.0
 
 Install 1.0 against the empty database that you provisioned. kagent and Agent Substrate both store their state in that database, each with an owner login that applies migrations and a read/write login that serves runtime queries. `kagent install` normally creates a development database for both. When you pass `--skip-database-setup`, `kagent install` does not create the development database. The kagent and Agent Substrate charts then read the connection Secrets that you create in this section.
 
-Before you start, complete the [Before you begin]({{< link path="setup/installation#before-you-begin" >}}) steps of the installation guide. Those steps prepare a cluster at Kubernetes 1.37 or later and your provider API key. Then install the CLI tools in step 1 of [Install with the CLI]({{< link path="setup/installation#install-kagent" >}}).
+Before you start, complete the [Before you begin]({{< link path="setup/installation#before-you-begin" >}}) steps of the installation guide, which prepare a cluster at Kubernetes 1.37 or later and the `kubectl` and `helm` tools. Then set your provider API key and install the kagent CLI as described in [Install with the CLI]({{< link path="setup/installation#install-kagent" >}}), without running `kagent install` yet.
 
 1. Create the namespaces that contain the connection Secrets. If a namespace already exists, `kagent install` uses it.
    ```bash
@@ -129,7 +129,7 @@ Before you start, complete the [Before you begin]({{< link path="setup/installat
    | `database.postgres.ownerConnectionStringSecretRef.name` and `database.postgres.readWriteConnectionStringSecretRef.name` | Read the two connection strings from the Secrets that you created. The keys default to `ownerConnectionString` and `readWriteConnectionString`. |
    | `config.database.owner.role` and `config.database.readWrite.role` | The roles that the kagent setup script created. If you passed other role names to the script, set those names instead. |
    | `config.database.vectorEnabled` | Applies the pgvector migrations, which [long-term memory]({{< link path="agents/agent-memory" >}}) depends on. If your database does not have the pgvector extension installed, omit the value. |
-   | `config.server.grpcReflection` | Lets the guides that use `grpcurl` discover the controller API, as in the installation guide. |
+   | `config.server.grpcReflection` | Lets the guides that use `grpcurl` discover the controller API. `kagent install` enables it by default, so this value only keeps the setting explicit in the values file. |
 
 6. Save a CLI configuration file that references `kagent-values.yaml`. The `kagent db` commands read `database.vectorEnabled` from this file, not from the Helm values. Set `database.vectorEnabled` to match `config.database.vectorEnabled`. If you omitted `config.database.vectorEnabled`, omit `database.vectorEnabled` too.
    ```bash
diff --git a/docs-site/content/kagent/main/setup/installation.md b/docs-site/content/kagent/main/setup/installation.md
index 4ef9e8ac..0cf75ed5 100644
--- a/docs-site/content/kagent/main/setup/installation.md
+++ b/docs-site/content/kagent/main/setup/installation.md
@@ -40,44 +40,57 @@ author: kagent.dev
    {{% /tab %}}
    {{< /tabs >}}
 
-2. Set your model provider API key. The examples in this guide use OpenAI. For other providers, see [Configure model providers]({{< link path="setup/model-providers" >}}).
-   ```bash
-   export OPENAI_API_KEY="your-api-key-here"
-   ```
-
-3. Choose an installation method.
-   * **CLI**: For an evaluation, use the `kagent install` command of the kagent CLI. The CLI also deploys a development PostgreSQL database. Follow the steps in [Install with the CLI](#install-kagent).
-   * **Helm**: For a production installation that Helm manages from the start, install each Helm chart yourself, against a PostgreSQL database that you provide. Follow the steps in [Install with Helm](#install-with-helm).
+2. Install [`kubectl`](https://kubernetes.io/docs/tasks/tools/#kubectl) and [`helm`](https://helm.sh/docs/intro/install/) 3. The kagent CLI runs `helm` to install each chart.
 
 ## Install with the CLI {#install-kagent}
 
-The kagent CLI installs the CRDs, Agent Substrate, the Agent Substrate PodCertificate controller, a development PostgreSQL database, and kagent in the correct order. The CLI also creates the Agent Substrate identity material and database connection Secrets that the releases need.
+Set your OpenAI API key, then install the kagent CLI and run it.
 
-1. Install the following CLI tools. The kagent CLI runs `helm` to install each chart.
-   * [`helm`](https://helm.sh/docs/intro/install/), the Kubernetes package manager. Use Helm 3.
-   * [`kubectl`](https://kubernetes.io/docs/tasks/tools/#kubectl), the Kubernetes command line tool.
-   * `kagent`, the command line tool of the same version as the kagent release that you want to install.
-     ```bash
-     curl https://raw.githubusercontent.com/kagent-dev/kagent/refs/heads/main/scripts/get-kagent | bash -s -- --version v{{< reuse "kagent-docs/versions/kagent.md" >}}
-     kagent version
-     ```
+```bash
+export OPENAI_API_KEY="your-api-key-here"
+curl -sL https://kagent.dev/install | bash && kagent install
+```
+
+When `kagent install` finishes, it prints the next steps. To open the UI, run `kagent dashboard`. To create an agent, continue with [Your first agent]({{< link path="get-started/your-first-agent" >}}).
+
+The CLI installation suits evaluation, because it deploys a development PostgreSQL database. For a production installation that Helm manages from the start, [install with Helm](#install-with-helm) instead. To use another model provider, pin a release, or pass your own chart values, see [Customize the CLI installation](#customize-the-cli-installation).
+
+## Customize the CLI installation
+
+### Use another model provider
 
-2. Save a Helm values file that enables gRPC server reflection, so that guides that use `grpcurl` can discover the controller API.
+`kagent install` uses OpenAI by default. To use another provider, set that provider's API key variable and pass its name in the `--provider` flag. For the supported providers, see [Configure model providers]({{< link path="setup/model-providers" >}}).
+
+```bash
+export ANTHROPIC_API_KEY="your-api-key-here"
+kagent install --provider Anthropic
+```
+
+### Install a specific release
+
+The install script installs the newest kagent release, and the CLI installs the kagent release of its own version. To install a specific release instead, such as the release that these docs cover, pass `--version` to the script.
+
+```bash
+curl -sL https://kagent.dev/install | bash -s -- --version v{{< reuse "kagent-docs/versions/kagent.md" >}}
+kagent version --client
+```
+
+The script supports macOS and Linux on `amd64` and `arm64`, and Windows on `amd64` from Git Bash or MSYS, where it installs `kagent.exe`.
+
+### Pass Helm values to the kagent chart {#cli-helm-values}
+
+`kagent install` does not take Helm flags of its own. To pass your own values to the kagent chart, list the values files in a CLI configuration file and pass the file with `--config`.
+
+For example, if your cluster uses a DNS domain other than `cluster.local`, set `global.clusterDomain`. The chart builds the URLs of the controller and the built-in `kagent-tool-server` MCP server from this domain, so agents cannot reach either service when the value is wrong. `kagent install` does not detect the domain.
+
+1. Save a Helm values file.
    ```bash
    cat > kagent-values.yaml <<EOF
-   config:
-     server:
-       grpcReflection: true
-   EOF
-   ```
-
-   If your cluster uses a DNS domain other than `cluster.local`, also set `global.clusterDomain` in this file. The chart builds the URLs of the controller and the built-in `kagent-tool-server` MCP server from this domain, so agents cannot reach either service when the value is wrong.
-   ```yaml
    global:
      clusterDomain: corp.example
+   EOF
    ```
-
-3. Save a CLI configuration file that points the installer at those values. `kagent install` does not take Helm flags of its own, so chart values reach it through this file. A relative path in `valuesFiles` resolves against the configuration file's own directory.
+2. Save a CLI configuration file that lists the values file. A relative path in `valuesFiles` resolves against the configuration file's own directory.
    ```bash
    cat > kagent-config.yaml <<EOF
    install:
@@ -89,25 +102,22 @@ The kagent CLI installs the CRDs, Agent Substrate, the Agent Substrate PodCertif
    | Field | Description |
    | --- | --- |
    | `install.kagent.valuesFiles` | The Helm values files that the installer passes to the kagent chart, in order. The last file wins. |
+   | `install.defaultModelProvider` | Optional. The provider to install with when you omit `--provider`. Defaults to `OpenAI`. |
    | `install.bundledPostgresImage` | Optional. The image of the development PostgreSQL database that the installer deploys, for both the database container and its TLS reloader. Defaults to `postgres:18-alpine`, pinned by digest. To pull the image from a mirror, such as in an air-gapped cluster, set the full image reference, such as `mirror.example.com/library/postgres:18-alpine`. |
-
-4. Install kagent.
+3. Install kagent with the configuration file.
    ```bash
-   kagent --config kagent-config.yaml install --namespace kagent
+   kagent --config kagent-config.yaml install
    ```
 
-   The command reads your provider API key, installs Agent Substrate into `ate-system`, and deploys PostgreSQL as `kagent-postgresql` in the kagent namespace. It then connects kagent and Agent Substrate to that database with Pod Certificates. The development database runs the stock `postgres` image. That image does not include the `pgvector` extension that [long-term memory]({{< link path="agents/agent-memory" >}}) needs.
+### What the CLI installs
 
-5. Wait for the controller to roll out.
-   ```bash
-   kubectl rollout status deployment/kagent-controller -n kagent --timeout=300s
-   ```
-   Example output:
-   ```console
-   deployment "kagent-controller" successfully rolled out
-   ```
+`kagent install` installs the CRDs, Agent Substrate into `ate-system`, the Agent Substrate PodCertificate controller, and kagent into the `kagent` namespace, in the correct order. It also sets up the following.
+
+* A development PostgreSQL database, `kagent-postgresql` in the kagent namespace. kagent and Agent Substrate connect to it with Pod Certificates. The database runs the stock `postgres` image, which does not include the `pgvector` extension that [long-term memory]({{< link path="agents/agent-memory" >}}) needs. For production database requirements, see [Operational considerations]({{< link path="operations/operational-considerations#choose-a-database" >}}).
+* The `kagent-default` WorkerPool, and the `kagent-default`, `codex-default`, and `claude-default` Harnesses that run on it. An Agent in the kagent namespace can set `spec.harnessRef` to one of these Harnesses without you writing your own. `spec.harnessRef` is namespace-local, so an Agent in another namespace needs its own Harness.
+* gRPC server reflection on the controller, so that guides that use `grpcurl` can discover the controller API.
 
-   For production database requirements, see [Operational considerations]({{< link path="operations/operational-considerations#choose-a-database" >}}).
+To check each component, see [Verify the installation](#verify-the-installation).
 
 ## Install with Helm {#install-with-helm}
 
@@ -403,8 +413,9 @@ Agent Substrate installs as two releases in the `ate-system` namespace. The `sub
 
 Install the kagent control plane into the `kagent` namespace. The controller applies its database migrations when it starts.
 
-1. Store your model provider API key in the Secret that the chart reads by default. You create this Secret, so Helm does not own it, and you rotate the key by updating the Secret.
+1. Store your model provider API key in the Secret that the chart reads by default. You create this Secret, so Helm does not own it, and you rotate the key by updating the Secret. For other providers, see [Configure model providers]({{< link path="setup/model-providers" >}}).
    ```bash
+   export OPENAI_API_KEY="your-api-key-here"
    kubectl create secret generic kagent-openai -n kagent \
      --from-literal=OPENAI_API_KEY="${OPENAI_API_KEY}"
    ```
@@ -417,18 +428,27 @@ Install the kagent control plane into the `kagent` namespace. The controller app
 3. Install kagent. The command sets the following values.
    * `controller.substrateClientCertificate.enabled` mounts the certificates that the controller presents to the Agent Substrate API server, and the trust bundle that verifies the server.
    * `substrateWorkerPool` creates the `kagent-default` WorkerPool. `workerImage` tags the Worker image with the Agent Substrate version, because the Agent Substrate controller starts each Worker with the flags of its own version.
+   * `harnesses.enabled` creates the `kagent-default`, `codex-default`, and `claude-default` Harnesses on that WorkerPool, which `kagent install` also creates. The chart leaves them off by default. Each Harness stores its snapshots at `harnesses.snapshotLocation`, which defaults to `s3://ate-snapshots/kagent/` in the bundled object store of Agent Substrate. To skip one runtime, set `harnesses.kagent.enabled`, `harnesses.codex.enabled`, or `harnesses.claude.enabled` to `false`.
+   * `config.server.grpcReflection` enables gRPC server reflection, so that guides that use `grpcurl` can discover the controller API.
+
+   If your cluster uses a DNS domain other than `cluster.local`, also set `global.clusterDomain`. The chart builds the URLs of the controller and the built-in `kagent-tool-server` MCP server from this domain, so agents cannot reach either service when the value is wrong.
    ```bash
    helm upgrade --install kagent \
      {{< reuse "kagent-docs/snippets/helm-path.md" >}}/{{< reuse "kagent-docs/snippets/helm-kagent.md" >}} \
      --version {{< reuse "kagent-docs/versions/kagent.md" >}} \
      --namespace kagent --timeout 12m \
      -f - <<EOF
+   config:
+     server:
+       grpcReflection: true
    controller:
      substrateClientCertificate:
        enabled: true
    substrateWorkerPool:
      create: true
      workerImage: "{{< reuse "kagent-docs/snippets/image-substrate.md" >}}/ateworker-gvisor:v{{< reuse "kagent-docs/versions/agent-substrate-chart.md" >}}"
+   harnesses:
+     enabled: true
    EOF
    ```
 
@@ -471,7 +491,12 @@ Before you create an agent, confirm that kagent and Agent Substrate are running,
    kagent-default   1         1          1       gvisor-default   True       2m
    ```
 
-3. Get the address to reach the kagent gRPC API, which serves Agent, AgentTemplate, Session, and conversation calls. The guide to [create your first agent]({{< link path="get-started/your-first-agent" >}}) assumes port-forwarding.
+3. Confirm that the default Harnesses exist. The output lists `kagent-default`, `codex-default`, and `claude-default`.
+   ```bash
+   kubectl get harnesses -n kagent
+   ```
+
+4. Get the address to reach the kagent gRPC API, which serves Agent, AgentTemplate, Session, and conversation calls. The guide to [create your first agent]({{< link path="get-started/your-first-agent" >}}) assumes port-forwarding.
    {{< tabs >}}
    {{% tab name="Port-forward for local testing" %}}
    Forward the controller port and leave the command running. The API is then available at `localhost:8083`.
@@ -493,7 +518,7 @@ Before you create an agent, confirm that kagent and Agent Substrate are running,
    {{% /tab %}}
    {{< /tabs >}}
 
-4. Optional: Open the kagent UI. The UI is a separate `{{< reuse "kagent-docs/snippets/name-ui.md" >}}` service, so it needs its own port-forward in a second terminal. The UI is then available at [http://localhost:8082](http://localhost:8082). For the `kagent dashboard` shortcut and a tour of the UI, see [Launch the UI]({{< link path="ui/launch-ui" >}}).
+5. Optional: Open the kagent UI. The UI is a separate `{{< reuse "kagent-docs/snippets/name-ui.md" >}}` service, so it needs its own port-forward in a second terminal. The UI is then available at [http://localhost:8082](http://localhost:8082). For the `kagent dashboard` shortcut and a tour of the UI, see [Launch the UI]({{< link path="ui/launch-ui" >}}).
    ```bash
    kubectl port-forward -n kagent svc/{{< reuse "kagent-docs/snippets/name-ui.md" >}} 8082:8080
    ```
diff --git a/docs-site/content/kagent/main/ui/launch-ui.md b/docs-site/content/kagent/main/ui/launch-ui.md
index 1b4bfc26..604fcf1d 100644
--- a/docs-site/content/kagent/main/ui/launch-ui.md
+++ b/docs-site/content/kagent/main/ui/launch-ui.md
@@ -77,7 +77,7 @@ The left menu groups the console pages by the resource that each page reads.
 | **Dashboard** | Counts of agents, model configurations, MCP servers, and discovered tools, plus recent conversations. |
 | **Agents** | Every {{< gloss "Agent" >}}Agent{{< /gloss >}}, {{< gloss "AgentTemplate" >}}AgentTemplate{{< /gloss >}}, and {{< gloss "Harness" >}}Harness{{< /gloss >}}, and the conversations held with each Agent. |
 | **Schedules** | Agents that receive a fixed prompt on a cron schedule. Each execution starts a new conversation. For more information, see [Scheduled runs]({{< link path="agents/scheduled-runs" >}}). |
-| **Models** | The {{< gloss "ModelConfig" >}}ModelConfig{{< /gloss >}} resources that agents reference, and the providers behind them. |
+| **Models** | The {{< gloss "ModelConfig" >}}ModelConfig{{< /gloss >}} resources that agents reference, and the providers behind them. The ModelConfig form offers `apiFormat` and `reasoningEffort` as lists of the accepted values. |
 | **MCP Servers** | Connected {{< gloss "RemoteMCPServer" >}}RemoteMCPServer{{< /gloss >}} resources and the tools discovered from each. |
 | **Prompts** | Prompt libraries, which store reusable fragments that an AgentTemplate includes in its instructions. |
 | **Substrate** | WorkerPools, Actors, and Workers, read from both Kubernetes and the Agent Substrate API. |
@@ -89,6 +89,10 @@ Start at the **Agents** page to review your agents and the resources behind them
 
 The **Agents** tab authors the Agent custom resource directly. Create one to pair a template with a Harness, edit one to change either side, and delete one to retire the pairing. Deleting an Agent leaves its Sessions in place, along with the AgentTemplate and Harness that it referenced. For CLI steps, see [Create your first agent]({{< link path="get-started/your-first-agent" >}}).
 
+The Agent form asks for the Harness first and preselects one. When no suitable Harness exists, **Create harness** opens the Harness form inline, and the Agent form keeps what you entered. The form warns you when the chosen Harness and ModelConfig are incompatible, and it shows every validation error at once rather than one at a time. When the last update of an Agent failed, the agent's page shows the reason.
+
+The **Harnesses** tab creates Harnesses and edits them in place. For the kagent, Codex, and Claude runtimes, the image is optional, because each runtime has a default. The worker pool field suggests the WorkerPools in the cluster as you type, and the snapshot location starts with a default value that you can change.
+
 ## Read a conversation
 
 Opening an agent and sending a message creates a {{< gloss "Session" >}}Session{{< /gloss >}}, which is one conversation scheduled onto an Agent Substrate {{< gloss "Actor" >}}Actor{{< /gloss >}}. The conversation view shows the transcript, the tool calls that the agent made along the way, and the checkpoint controls for the conversation.
diff --git a/src/blogContent/anthropic-self-managed-sandboxes.mdx b/src/blogContent/anthropic-self-managed-sandboxes.mdx
index 6e165b00..fef6c3d5 100644
--- a/src/blogContent/anthropic-self-managed-sandboxes.mdx
+++ b/src/blogContent/anthropic-self-managed-sandboxes.mdx
@@ -29,7 +29,7 @@ You will need Kind, the kagent CLI, and the Anthropic `ant` CLI to follow these
 Install the kagent CLI.
 
 ```
-curl https://raw.githubusercontent.com/kagent-dev/kagent/refs/heads/main/scripts/get-kagent | bash -s -- --version v1.0.0
+curl -sL https://kagent.dev/install | bash -s -- --version v1.0.0
 kagent version
 ```