diff --git a/.github/harness/prompts/review.md b/.github/harness/prompts/review.md
index 0a4f85fc7..d34c67b95 100644
--- a/.github/harness/prompts/review.md
+++ b/.github/harness/prompts/review.md
@@ -3,11 +3,16 @@ Review this GitHub PR: {pr_url}
 You have tools to fetch the PR diff, read files, search the web, and post comments on the PR.
 
 You have these repos cloned locally for context:
+
 - /opt/workspace/agentcore-cli — aws/agentcore-cli
 - /opt/workspace/agentcore-l3-cdk-constructs — aws/agentcore-l3-cdk-constructs
 
-Before reviewing, read all existing comments on the PR to understand what has already been discussed. Do not repeat or re-post issues that have already been raised in existing comments.
+Before reviewing, read all existing comments on the PR to understand what has already been discussed. Do not repeat or
+re-post issues that have already been raised in existing comments.
 
-Review the PR. If there are any serious issues that require code changes before merging, post a comment on the PR for each issue explaining the problem. If there are multiple ways to fix an issue, list the options so the author can choose. Skip style nits and minor suggestions — only flag things that actually need to change.
+Review the PR. If there are any serious issues that require code changes before merging, post a comment on the PR for
+each issue explaining the problem. If there are multiple ways to fix an issue, list the options so the author can
+choose. Skip style nits and minor suggestions — only flag things that actually need to change.
 
-If all serious issues have already been raised in existing comments, or if you found no new issues, post a single comment on the PR saying it looks good to merge (or that all issues have already been flagged).
+If all serious issues have already been raised in existing comments, or if you found no new issues, post a single
+comment on the PR saying it looks good to merge (or that all issues have already been flagged).
diff --git a/.github/harness/prompts/system.md b/.github/harness/prompts/system.md
index 963accb8a..52a3d2260 100644
--- a/.github/harness/prompts/system.md
+++ b/.github/harness/prompts/system.md
@@ -6,11 +6,13 @@ This workspace contains two repos for developing and testing the AgentCore CLI.
 
 ### agentcore-cli/ (`aws/agentcore-cli`)
 
-The terminal experience for creating, developing, and deploying AI agents to AgentCore. Node.js/TypeScript CLI built with Ink (React-based TUI).
+The terminal experience for creating, developing, and deploying AI agents to AgentCore. Node.js/TypeScript CLI built
+with Ink (React-based TUI).
 
 ### agentcore-l3-cdk-constructs/ (`aws/agentcore-l3-cdk-constructs`)
 
-AWS CDK L3 constructs for declaring and deploying AgentCore infrastructure. Used by agentcore-cli to vend CDK projects when users run `agentcore create`.
+AWS CDK L3 constructs for declaring and deploying AgentCore infrastructure. Used by agentcore-cli to vend CDK projects
+when users run `agentcore create`.
 
 ## How they relate
 
@@ -18,4 +20,6 @@ AWS CDK L3 constructs for declaring and deploying AgentCore infrastructure. Used
 
 ## Testing with a bundled distribution
 
-Run `npm run bundle` in `agentcore-cli/` to create a tar distribution that includes the packaged `agentcore-l3-cdk-constructs`. You can then install it globally with `npm install -g <path-to-tar>` to test the CLI end-to-end.
+Run `npm run bundle` in `agentcore-cli/` to create a tar distribution that includes the packaged
+`agentcore-l3-cdk-constructs`. You can then install it globally with `npm install -g <path-to-tar>` to test the CLI
+end-to-end.
diff --git a/.github/scripts/prompts/review.md b/.github/scripts/prompts/review.md
new file mode 100644
index 000000000..0a4f85fc7
--- /dev/null
+++ b/.github/scripts/prompts/review.md
@@ -0,0 +1,13 @@
+Review this GitHub PR: {pr_url}
+
+You have tools to fetch the PR diff, read files, search the web, and post comments on the PR.
+
+You have these repos cloned locally for context:
+- /opt/workspace/agentcore-cli — aws/agentcore-cli
+- /opt/workspace/agentcore-l3-cdk-constructs — aws/agentcore-l3-cdk-constructs
+
+Before reviewing, read all existing comments on the PR to understand what has already been discussed. Do not repeat or re-post issues that have already been raised in existing comments.
+
+Review the PR. If there are any serious issues that require code changes before merging, post a comment on the PR for each issue explaining the problem. If there are multiple ways to fix an issue, list the options so the author can choose. Skip style nits and minor suggestions — only flag things that actually need to change.
+
+If all serious issues have already been raised in existing comments, or if you found no new issues, post a single comment on the PR saying it looks good to merge (or that all issues have already been flagged).
diff --git a/.github/scripts/prompts/system.md b/.github/scripts/prompts/system.md
new file mode 100644
index 000000000..963accb8a
--- /dev/null
+++ b/.github/scripts/prompts/system.md
@@ -0,0 +1,21 @@
+# AgentCore CLI Development Workspace
+
+This workspace contains two repos for developing and testing the AgentCore CLI.
+
+## Repositories
+
+### agentcore-cli/ (`aws/agentcore-cli`)
+
+The terminal experience for creating, developing, and deploying AI agents to AgentCore. Node.js/TypeScript CLI built with Ink (React-based TUI).
+
+### agentcore-l3-cdk-constructs/ (`aws/agentcore-l3-cdk-constructs`)
+
+AWS CDK L3 constructs for declaring and deploying AgentCore infrastructure. Used by agentcore-cli to vend CDK projects when users run `agentcore create`.
+
+## How they relate
+
+`agentcore-cli` is the main product. It vends CDK projects using constructs from `agentcore-l3-cdk-constructs`.
+
+## Testing with a bundled distribution
+
+Run `npm run bundle` in `agentcore-cli/` to create a tar distribution that includes the packaged `agentcore-l3-cdk-constructs`. You can then install it globally with `npm install -g <path-to-tar>` to test the CLI end-to-end.
diff --git a/.github/scripts/python/harness_review.py b/.github/scripts/python/harness_review.py
new file mode 100644
index 000000000..fbfd0b0f9
--- /dev/null
+++ b/.github/scripts/python/harness_review.py
@@ -0,0 +1,217 @@
+"""Invoke Bedrock AgentCore Harness to review a GitHub PR.
+
+Reads PR_URL from the environment. Streams harness output to stdout.
+Uses raw HTTP with SigV4 signing — no custom service model needed.
+"""
+
+import json
+import os
+import sys
+import time
+import uuid
+
+import boto3
+from botocore.auth import SigV4Auth
+from botocore.awsrequest import AWSRequest
+from botocore.eventstream import EventStreamBuffer
+from urllib.parse import quote
+import urllib3
+
+# ANSI color codes
+CYAN = "\033[36m"
+YELLOW = "\033[33m"
+GREEN = "\033[32m"
+RED = "\033[31m"
+DIM = "\033[2m"
+RESET = "\033[0m"
+
+SCRIPTS_DIR = os.path.join(os.path.dirname(__file__), "..")
+
+
+def read_prompt(filename):
+    """Read a prompt template from the prompts directory."""
+    path = os.path.join(SCRIPTS_DIR, "prompts", filename)
+    with open(path) as f:
+        return f.read()
+
+
+def invoke_harness(harness_arn, body, region):
+    """Send a SigV4-signed request to the harness invoke endpoint. Returns a streaming response.
+
+    InvokeHarness is not in standard boto3, so we call the REST API directly.
+    boto3 is only used to resolve AWS credentials (from env vars, OIDC, etc.)
+    and sign the request with SigV4. The response is an AWS binary event stream.
+    """
+    session = boto3.Session(region_name=region)
+    credentials = session.get_credentials().get_frozen_credentials()
+    url = f"https://bedrock-agentcore.{region}.amazonaws.com/harnesses/invoke?harnessArn={quote(harness_arn, safe='')}"
+    request = AWSRequest(method="POST", url=url, data=body, headers={
+        "Content-Type": "application/json",
+        "Accept": "application/vnd.amazon.eventstream",
+    })
+    SigV4Auth(credentials, "bedrock-agentcore", region).add_auth(request)
+    return urllib3.PoolManager().urlopen(
+        "POST", url, body=body,
+        headers=dict(request.headers),
+        preload_content=False,
+        timeout=urllib3.Timeout(connect=10, read=600),
+    )
+
+
+def parse_events(http_response):
+    """Yield (event_type, payload) tuples from the harness binary event stream.
+
+    The response arrives as raw bytes in AWS binary event stream format.
+    EventStreamBuffer reassembles complete events from the 4KB chunks,
+    and we decode each event's JSON payload before yielding it.
+    """
+    event_buffer = EventStreamBuffer()
+    for chunk in http_response.stream(4096):
+        event_buffer.add_data(chunk)
+        for event in event_buffer:
+            if event.headers.get(":message-type") == "exception":
+                payload = json.loads(event.payload.decode("utf-8"))
+                print(f"\n{RED}ERROR: {payload}{RESET}", file=sys.stderr)
+                sys.exit(1)
+            event_type = event.headers.get(":event-type", "")
+            if event.payload:
+                yield event_type, json.loads(event.payload.decode("utf-8"))
+
+
+def print_stream(http_response):
+    """Display harness events with GitHub Actions log groups.
+
+    The harness streams events as the agent works:
+      contentBlockStart  — a new block begins (text or tool call)
+      contentBlockDelta  — incremental chunks of text or tool input JSON
+      contentBlockStop   — block complete, we now have full tool input to display
+      messageStop        — agent finished
+      internalServerException — server error
+
+    Tool calls are wrapped in ::group::/::endgroup:: for collapsible sections
+    in the GitHub Actions log UI. Agent reasoning text is printed inline in dim.
+    """
+    start_time = time.time()
+    iteration = 0
+    tool_name = None
+    tool_input = ""
+    tool_start = 0.0
+    in_group = False
+    text_buffer = ""
+
+    def close_group():
+        nonlocal in_group
+        if in_group:
+            print("::endgroup::", flush=True)
+            in_group = False
+
+    def flush_text():
+        nonlocal text_buffer
+        if text_buffer:
+            for line in text_buffer.splitlines():
+                print(f"{DIM}{line}{RESET}", flush=True)
+            text_buffer = ""
+
+    for event_type, payload in parse_events(http_response):
+
+        if event_type == "contentBlockStart":
+            start = payload.get("start", {})
+            if "toolUse" in start:
+                tool_name = start["toolUse"].get("name", "unknown")
+                tool_input = ""
+                tool_start = time.time()
+                iteration += 1
+
+        elif event_type == "contentBlockDelta":
+            delta = payload.get("delta", {})
+            if "text" in delta:
+                close_group()
+                text_buffer += delta["text"]
+            if "toolUse" in delta:
+                tool_input += delta["toolUse"].get("input", "")
+
+        elif event_type == "contentBlockStop":
+            flush_text()
+            if tool_name:
+                elapsed = time.time() - tool_start
+                try:
+                    parsed = json.loads(tool_input)
+                except (json.JSONDecodeError, TypeError):
+                    parsed = tool_input
+
+                close_group()
+
+                cmd = parsed.get("command") if isinstance(parsed, dict) else None
+                header = f"{CYAN}[{iteration}]{RESET} {YELLOW}{tool_name}{RESET} {DIM}({elapsed:.1f}s){RESET}"
+                if cmd:
+                    header += f": $ {cmd}"
+
+                print(f"::group::{header}", flush=True)
+                in_group = True
+
+                if isinstance(parsed, dict):
+                    for k, v in parsed.items():
+                        if k != "command":
+                            print(f"  {DIM}{k}:{RESET} {str(v)[:300]}", flush=True)
+
+            tool_name = None
+            tool_input = ""
+
+        elif event_type == "messageStop":
+            flush_text()
+            close_group()
+            if payload.get("stopReason") == "end_turn":
+                total = time.time() - start_time
+                print(f"\n\n{GREEN}{'=' * 50}", flush=True)
+                print(f"  Done ({int(total // 60)}m {int(total % 60)}s)", flush=True)
+                print(f"{'=' * 50}{RESET}", flush=True)
+
+        elif event_type == "internalServerException":
+            close_group()
+            print(f"\n{RED}ERROR: {payload}{RESET}", file=sys.stderr)
+            sys.exit(1)
+
+    close_group()
+    total = time.time() - start_time
+    print(f"\n{GREEN}Review complete.{RESET} {DIM}({iteration} tool calls, {int(total)}s total){RESET}")
+
+
+# --- Main ---
+
+# All config comes from environment variables (set via GitHub secrets/workflow)
+MODEL_ID = os.environ.get("HARNESS_MODEL_ID", "us.anthropic.claude-opus-4-7")
+HARNESS_ARN = os.environ.get("HARNESS_ARN", "")
+PR_URL = os.environ.get("PR_URL", "")
+
+for name, val in [("HARNESS_ARN", HARNESS_ARN), ("PR_URL", PR_URL)]:
+    if not val:
+        print(f"{RED}ERROR: {name} environment variable is required{RESET}", file=sys.stderr)
+        sys.exit(1)
+
+# Extract region from the ARN (arn:aws:bedrock-agentcore:{region}:{account}:harness/{id})
+REGION = HARNESS_ARN.split(":")[3]
+SESSION_ID = str(uuid.uuid4()).upper()
+
+print(f"{CYAN}Session:{RESET} {SESSION_ID}")
+print(f"{CYAN}PR:{RESET}      {PR_URL}")
+print(f"{CYAN}Harness:{RESET} {HARNESS_ARN}")
+print()
+
+SYSTEM_PROMPT = read_prompt("system.md")
+REVIEW_PROMPT = read_prompt("review.md").format(pr_url=PR_URL)
+
+request_body = json.dumps({
+    "runtimeSessionId": SESSION_ID,
+    "systemPrompt": [{"text": SYSTEM_PROMPT}],
+    "messages": [{"role": "user", "content": [{"text": REVIEW_PROMPT}]}],
+    "model": {"bedrockModelConfig": {"modelId": MODEL_ID}},
+})
+
+http_response = invoke_harness(HARNESS_ARN, request_body, REGION)
+
+if http_response.status != 200:
+    error = http_response.read().decode("utf-8")
+    print(f"{RED}ERROR: HTTP {http_response.status}: {error}{RESET}", file=sys.stderr)
+    sys.exit(1)
+
+print_stream(http_response)
diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 80b17f987..e6d7bf8cc 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -2,9 +2,9 @@ name: Build and Test
 
 on:
   push:
-    branches: ['main']
+    branches: ['main', 'preview']
   pull_request:
-    branches: ['main']
+    branches: ['main', 'preview']
 
 permissions:
   contents: read
@@ -12,7 +12,7 @@ permissions:
 # Cancel in-progress runs for PRs; never cancel runs on main (merges should not abort each other)
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/preview' }}
 
 jobs:
   build:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1e9b0a4bd..2a01ca7fa 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -2,16 +2,16 @@ name: CodeQL
 
 on:
   push:
-    branches: ['main']
+    branches: ['main', 'preview']
   pull_request:
-    branches: ['main']
+    branches: ['main', 'preview']
   pull_request_target:
-    branches: ['main']
+    branches: ['main', 'preview']
 
 # Cancel in-progress runs for PRs; never cancel runs on main (merges should not abort each other)
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/preview' }}
 
 jobs:
   analyze:
@@ -19,6 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
+      actions: read
       security-events: write
       contents: read
 
diff --git a/.github/workflows/e2e-tests-full.yml b/.github/workflows/e2e-tests-full.yml
index 14809a587..35f92ad59 100644
--- a/.github/workflows/e2e-tests-full.yml
+++ b/.github/workflows/e2e-tests-full.yml
@@ -8,7 +8,7 @@ on:
   schedule:
     - cron: '0 14 * * 1' # Every Monday at 9 AM EST (14:00 UTC)
   push:
-    branches: [main]
+    branches: [main, preview]
 
 concurrency:
   group: e2e-${{ github.event.pull_request.number || github.ref }}
@@ -27,10 +27,11 @@ jobs:
       fail-fast: false
       matrix:
         cdk-source: [npm, main]
+        shard: ['1/6', '2/6', '3/6', '4/6', '5/6', '6/6']
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.ref || 'main' }}
+          ref: ${{ github.sha }}
       - uses: actions/setup-node@v6
         with:
           node-version: '20.x'
@@ -49,7 +50,7 @@ jobs:
         id: aws
         run: echo "account_id=$(aws sts get-caller-identity --query Account --output text)" >> "$GITHUB_OUTPUT"
       - name: Get API keys from Secrets Manager
-        uses: aws-actions/aws-secretsmanager-get-secrets@v3
+        uses: aws-actions/aws-secretsmanager-get-secrets@v2
         with:
           secret-ids: |
             E2E,${{ secrets.E2E_SECRET_ARN }}
@@ -70,7 +71,7 @@ jobs:
           CDK_REPO: ${{ secrets.CDK_REPO_NAME }}
       - name: Install CLI globally
         run: npm install -g "$(npm pack | tail -1)"
-      - name: Run E2E tests (${{ matrix.cdk-source }})
+      - name: Run E2E tests (${{ matrix.cdk-source }}, shard ${{ matrix.shard }})
         env:
           AWS_ACCOUNT_ID: ${{ steps.aws.outputs.account_id }}
           AWS_REGION: ${{ inputs.aws_region || 'us-east-1' }}
@@ -78,7 +79,7 @@ jobs:
           OPENAI_API_KEY: ${{ env.E2E_OPENAI_API_KEY }}
           GEMINI_API_KEY: ${{ env.E2E_GEMINI_API_KEY }}
           CDK_TARBALL: ${{ env.CDK_TARBALL }}
-        run: npm run test:e2e
+        run: npx vitest run --project e2e --shard=${{ matrix.shard }}
   browser-tests:
     runs-on: ubuntu-latest
     environment: e2e-testing
@@ -86,7 +87,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.ref || 'main' }}
+          ref: ${{ github.sha }}
       - uses: actions/setup-node@v6
         with:
           node-version: '20.x'
diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
index e0ee36b5b..78f38eefd 100644
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -6,7 +6,7 @@ on:
         description: 'AWS region for deployment'
         default: 'us-east-1'
   pull_request_target:
-    branches: [main]
+    branches: [main, preview]
 
 concurrency:
   group: e2e-${{ github.event.pull_request.number || github.ref }}
@@ -70,7 +70,7 @@ jobs:
         id: aws
         run: echo "account_id=$(aws sts get-caller-identity --query Account --output text)" >> "$GITHUB_OUTPUT"
       - name: Get API keys from Secrets Manager
-        uses: aws-actions/aws-secretsmanager-get-secrets@v3
+        uses: aws-actions/aws-secretsmanager-get-secrets@v2
         with:
           secret-ids: |
             E2E,${{ secrets.E2E_SECRET_ARN }}
@@ -101,6 +101,7 @@ jobs:
           BASE_SHA=${{ github.event.pull_request.base.sha || 'HEAD~1' }}
           CHANGED=$(git diff --name-only "$BASE_SHA"..HEAD -- 'e2e-tests/*.test.ts' \
             | grep -v '^e2e-tests/strands-bedrock\.test\.ts$' \
+            | grep -v '^e2e-tests/harness-bedrock\.test\.ts$' \
             | tr '\n' ' ')
           echo "extra_tests=$CHANGED" >> "$GITHUB_OUTPUT"
           echo "Changed e2e tests: ${CHANGED:-none}"
@@ -113,5 +114,7 @@ jobs:
           OPENAI_API_KEY: ${{ env.E2E_OPENAI_API_KEY }}
           GEMINI_API_KEY: ${{ env.E2E_GEMINI_API_KEY }}
           CDK_TARBALL: ${{ env.CDK_TARBALL }}
-        # Always run strands-bedrock as baseline, plus any e2e test files changed in the PR
-        run: npx vitest run --project e2e e2e-tests/strands-bedrock.test.ts ${{ steps.changed.outputs.extra_tests }}
+        # Always run strands-bedrock and harness-bedrock as baseline, plus any e2e test files changed in the PR
+        run:
+          npx vitest run --project e2e e2e-tests/strands-bedrock.test.ts e2e-tests/harness-bedrock.test.ts ${{
+          steps.changed.outputs.extra_tests }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 24a9317f6..f310a776a 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -2,9 +2,9 @@ name: Quality and Safety Checks
 
 on:
   push:
-    branches: ['main']
+    branches: ['main', 'preview']
   pull_request:
-    branches: ['main']
+    branches: ['main', 'preview']
 
 permissions:
   contents: read
@@ -12,7 +12,7 @@ permissions:
 # Cancel in-progress runs for PRs; never cancel runs on main (merges should not abort each other)
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/preview' }}
 
 jobs:
   setup:
@@ -109,7 +109,7 @@ jobs:
           fetch-depth: 0
       - name: Reject schema changes outside release PRs
         run: |
-          if git diff --name-only origin/main...HEAD | grep -q '^schemas/agentcore\.schema\.v[0-9]*\.json$'; then
+          if git diff --name-only origin/${{ github.base_ref || github.ref_name }}...HEAD | grep -q '^schemas/agentcore\.schema\.v[0-9]*\.json$'; then
             echo ""
             echo "❌ schemas/ must not be modified directly."
             echo "The JSON schema is served live from the repo — changes are released automatically."
diff --git a/.github/workflows/pr-size.yml b/.github/workflows/pr-size.yml
index 792f0d728..520a44fe0 100644
--- a/.github/workflows/pr-size.yml
+++ b/.github/workflows/pr-size.yml
@@ -4,7 +4,7 @@ name: PR Size Check and Label
 # Safe because this workflow only reads PR metadata — it never checks out untrusted code.
 on:
   pull_request_target:
-    branches: [main]
+    branches: [main, preview]
 
 jobs:
   label-size:
diff --git a/.github/workflows/pr-tarball.yml b/.github/workflows/pr-tarball.yml
index 3c5c5c522..a901a2a6e 100644
--- a/.github/workflows/pr-tarball.yml
+++ b/.github/workflows/pr-tarball.yml
@@ -1,7 +1,7 @@
 name: PR Tarball
 on:
   pull_request_target:
-    branches: [main]
+    branches: [main, preview]
 
 permissions:
   contents: write
diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
index 4b0953754..d06a5e609 100644
--- a/.github/workflows/pr-title.yml
+++ b/.github/workflows/pr-title.yml
@@ -2,7 +2,7 @@ name: Validate PR Title
 
 on:
   pull_request_target:
-    branches: [main]
+    branches: [main, preview]
     types: [opened, edited, synchronize, reopened]
 
 permissions:
diff --git a/.github/workflows/slack-issue-notification.yml b/.github/workflows/slack-issue-notification.yml
index 758add1d1..1d3bbc4ee 100644
--- a/.github/workflows/slack-issue-notification.yml
+++ b/.github/workflows/slack-issue-notification.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send issue details to Slack
-        uses: slackapi/slack-github-action@v3.0.2
+        uses: slackapi/slack-github-action@v2.1.1
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
           webhook-type: webhook-trigger
diff --git a/.github/workflows/slack-open-prs-notification.yml b/.github/workflows/slack-open-prs-notification.yml
index 11641bed4..68dd1df49 100644
--- a/.github/workflows/slack-open-prs-notification.yml
+++ b/.github/workflows/slack-open-prs-notification.yml
@@ -40,7 +40,7 @@ jobs:
             );
 
       - name: Send open PRs summary to Slack
-        uses: slackapi/slack-github-action@v3.0.2
+        uses: slackapi/slack-github-action@v2.1.1
         with:
           webhook: ${{ secrets.SLACK_OPEN_PRS_WEBHOOK_URL }}
           webhook-type: webhook-trigger
diff --git a/.github/workflows/sync-from-public.yml b/.github/workflows/sync-from-public.yml
new file mode 100644
index 000000000..94e279079
--- /dev/null
+++ b/.github/workflows/sync-from-public.yml
@@ -0,0 +1,104 @@
+name: Sync from Public Repo
+
+on:
+  schedule:
+    - cron: '0 */6 * * *' # Every 6 hours
+  workflow_dispatch: # Manual trigger via Actions tab
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Configure Git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Fetch public main
+        run: |
+          git remote add public https://github.com/aws/agentcore-cli.git
+          git fetch public main
+
+      - name: Sync main with public/main
+        run: |
+          git checkout main
+          git reset --hard origin/main
+
+          # Check if public/main is already merged
+          if git merge-base --is-ancestor public/main HEAD; then
+            echo "✅ main is already up to date with public/main"
+            exit 0
+          fi
+
+          # Merge but exclude .github/workflows/ (GITHUB_TOKEN lacks workflow permission)
+          if git merge public/main --no-commit --no-ff; then
+            git checkout HEAD -- .github/workflows/ 2>/dev/null || true
+            git commit -m "chore: sync main with public/main"
+            git push origin main
+            echo "✅ main synced successfully"
+          else
+            echo "⚠️  Conflict detected in main"
+
+            # Capture conflicted files before aborting
+            conflicted_files=$(git diff --name-only --diff-filter=U 2>/dev/null || echo "Unable to determine conflicted files")
+            git merge --abort
+
+            # Check if a sync PR already exists
+            existing_pr=$(gh pr list --base "main" --search "Merge public/main" --state open --json number --jq '.[0].number' 2>/dev/null || echo "")
+
+            if [ -n "$existing_pr" ]; then
+              echo "ℹ️  PR #$existing_pr already exists, skipping"
+              exit 0
+            fi
+
+            conflict_branch="sync-conflict-main-$(date +%Y%m%d-%H%M%S)"
+            git checkout -b "$conflict_branch"
+
+            git merge public/main --no-commit --no-ff || true
+            git checkout HEAD -- .github/workflows/ 2>/dev/null || true
+            git add -A
+            git commit -m "chore: sync main with public/main (conflicts present)
+
+          This automated sync detected merge conflicts that require manual resolution.
+
+          Source: public/main (https://github.com/aws/agentcore-cli)
+          Target: main
+
+          Please resolve conflicts and merge this PR." || true
+
+            git push origin "$conflict_branch"
+
+            gh pr create \
+              --title "🔀 [Sync Conflict] Merge public/main → main" \
+              --body "## Automated Sync Conflict
+
+          This PR was automatically created because merging \`public/main\` into \`main\` encountered conflicts.
+
+          **Source:** \`main\` from [aws/agentcore-cli](https://github.com/aws/agentcore-cli)
+          **Target:** \`main\`
+
+          ### Action Required
+          1. \`git fetch origin && git checkout $conflict_branch\`
+          2. Resolve merge conflicts
+          3. \`git add . && git commit\`
+          4. \`git push origin $conflict_branch\`
+          5. Merge this PR
+
+          ### Files with Conflicts
+          \`\`\`
+          $conflicted_files
+          \`\`\`" \
+              --base "main" \
+              --head "$conflict_branch" || echo "⚠️  Failed to create PR"
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.gitignore b/.gitignore
index ac3d53fc4..6613a8f02 100644
--- a/.gitignore
+++ b/.gitignore
@@ -69,11 +69,6 @@ ProtocolTesting/
 .cdk-constructs-clone/
 .omc/
 
-# E2E test artifacts
-e2e-tests/fixtures/import/bugbash-resources.json
-
-# oh-my-claudecode
-.omc/
 # Browser tests
 browser-tests/.browser-test-env
 browser-tests/test-results/
diff --git a/.prettierignore b/.prettierignore
index 3b1452b18..8eda17e39 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -1,3 +1,3 @@
 CHANGELOG.md
 src/assets/**/*.md
-.github/harness/prompts/
+.github/scripts/prompts/
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b25ef328d..b99c235b1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,7 +2,18 @@
 
 All notable changes to this project will be documented in this file.
 
-## [0.12.2] - 2026-04-30
+## [1.0.0-preview.6] - 2026-05-01
+
+### Added
+- feat: replace credentialProviderName with outboundAuth for harness gateway tools (#1083) (f818286)
+
+### Fixed
+- fix: restore preview-specific package.json, lock, and changelog (#1084) (b873a49)
+
+### Other Changes
+- chore: sync main into preview — evo features (#1077) (aeb796a)
+
+## [1.0.0-preview.5] - 2026-04-30
 
 ### Added
 - feat: add telemetry audit mode with FileSystemSink (#1014) (397c187)
@@ -11,13 +22,20 @@ All notable changes to this project will be documented in this file.
 - fix: add Accept header to HTTP protocol invocation proxy (#1051) (821e4c3)
 
 ### Other Changes
+- Merge pull request #1057 from aws/sync-preview/merge-main-20260430-v2 (18fa2c9)
+- chore: merge main into preview (7590650)
+- Merge pull request #1058 from aws/release/v0.12.2 (68b25bf)
+- chore: bump version to 0.12.2 (5ce4bdc)
+- chore: merge main into preview (6e01e4e)
 - fix(harness): add error handling for invoke_harness API call (#1056) (9a6a5d0)
 - Merge pull request #1054 from aws/fix/remove-coauthor-reland (0afeaf5)
 - refactor: move harness resources to .github/harness/ and use boto3 invoke_harness (ad2ba9b)
 - Revert "refactor: move harness resources to .github/harness/ (#992)" (b8a90c9)
 - refactor: move harness resources to .github/harness/ (#992) (aef3890)
+- Merge pull request #1053 from aws/sync-preview/merge-main-20260430 (26b1c4c)
+- chore: merge main into preview (9f2702a)
 
-## [0.12.1] - 2026-04-29
+## [1.0.0-preview.4] - 2026-04-29
 
 ### Added
 - feat: add CloudWatch traces API for web UI (#997) (76b07aa)
@@ -26,9 +44,17 @@ All notable changes to this project will be documented in this file.
 - fix: remove CONFIG_DIR exclusion from zip stage to preserve dependency agentcore/ packages (#1015) (d1e5241)
 
 ### Other Changes
+- Merge pull request #1040 from aws/sync-preview/merge-main-20260429-v5 (dd76d17)
+- chore: merge main into preview (ecda10c)
+- fix(ci): install uv in release workflow prepare steps (#1038) (#1039) (01b3b7d)
 - fix(ci): install uv in release workflow prepare steps (#1038) (29ae8e5)
+- Merge pull request #1037 from aws/sync-preview/merge-main-20260429-v3 (7f315c6)
+- chore: merge main into preview (a951aed)
 - fix(ci): move snapshot update after build in release workflow (#1036) (227c840)
+- Merge pull request #1035 from aws/sync-preview/merge-main-20260429-v2 (451868a)
+- chore: merge main into preview (c44d8c1)
 - fix(ci): enable coverage collection in sharded unit test runs (#1034) (061b6b3)
+- ci: run all PR and merge workflows on preview branch (#1023) (fc1cd56)
 - fix(ci): update snapshots after CDK version sync in release workflow (#1033) (d3b412f)
 - chore(deps): bump @opentelemetry/sdk-metrics from 2.6.1 to 2.7.0 (#1030) (ad59fc0)
 - chore(deps-dev): bump secretlint from 12.2.0 to 12.3.1 (#1029) (36755e9)
@@ -36,22 +62,40 @@ All notable changes to this project will be documented in this file.
 - chore(deps): bump @opentelemetry/resources from 2.6.1 to 2.7.0 (#1026) (ad482cf)
 - chore(deps): bump the aws-cdk group with 2 updates (#1025) (1686e4d)
 - chore(deps): bump the aws-sdk group with 14 updates (#1024) (1fc366c)
+- Merge pull request #1018 from aws/sync-preview/real-merge-main-20260429 (8c4d6eb)
+- chore: merge main into preview (553a520)
+- sync-preview: merge main into preview (#1017) (1c726d8)
 - ci: add coordinated main + preview release workflow (#995) (7e8cae4)
+- chore: merge main into preview (#1013) (3e7e15b)
 - fix(import): use GatewayNameSchema for gateway import name validation (#1011) (29b6522)
 - test: remove 44 render-only and framework-testing tests (#998) (13b34a3)
+- chore: bump version to 0.12.0 (#1002) (dd9270d)
 
-## [0.12.0] - 2026-04-28
+## [1.0.0-preview.3] - 2026-04-28
 
 ### Added
 - feat: add gateway import command with executionRoleArn support (#855) (2df1387)
 - feat: runtime endpoint support in AgentCore CLI (#979) (41c59ef)
 - feat: add project-name option to create (#969) (9b46fbb)
+- feat: add project-name option to preview create (#970) (a19fc8f)
+- feat: add agentcore-cli User-Agent to all API calls (#960) (398dc50)
+- feat: add telemetry schemas and client (#941) (7c37fa6)
+- feat: add GitHub Action for automated PR review via AgentCore Harness (#934) (a365bf5)
 
 ### Fixed
 - fix: duplicate header flash and help menu truncation (closes #895, closes #637) (#955) (e7b85c1)
 - fix: show 'Computing diff changes...' step during deploy diff phase (#952) (a725d12)
+- fix: display session ID after CLI invoke completes (#957) (51e4a8e)
+- fix: lower eventExpiryDuration minimum from 7 to 3 days (closes #744) (#956) (8613657)
+- fix: use pull_request_target for fork PR support (#958) (933bac8)
+- fix: agentcore dev not working in windows (#951) (5271f55)
+- fix: add TTY detection before TUI fallbacks to prevent agent/CI hangs (#949) (c30ed54)
+- fix: allow code-based evaluators in online eval configs (#947) (3d2d671)
+- fix: buffer streaming text to avoid per-token log lines in GitHub Actions (#946) (cb1e81a)
 
 ### Other Changes
+- fix(tests): fix 2 test failures on preview branch (8a4ea58)
+- Merge main into preview (3fd6668)
 - fix(e2e): add debug logging for gateway import CI failures (#1001) (8012d6c)
 - fix(e2e): separate gateway import test and add PR-changed test detection (#999) (19b7d13)
 - fix(import): remove resourceName/executionRoleArn co-variance refine (#996) (ad0ee58)
@@ -67,9 +111,13 @@ All notable changes to this project will be documented in this file.
 - ci: bump the github-actions group across 1 directory with 4 updates (#964) (9962c3e)
 - test: configure git in browser tests workflow (#976) (17b5727)
 - fix(import): remove experimental warning from import command (#977) (fdd6631)
+- Remove inline container build from vended cdk-stack.ts (#954) (57ee733)
 - feat(invoke): add --prompt-file and stdin support for long prompts (#974) (f6a3e99)
 - test: split browser tests into its own job, fix logs path (#975) (acbfb9e)
 - fix(invoke): auto-generate session ID for bearer-token invocations (#953) (343fedc)
+- chore: bump version to 0.11.0 (#967) (f8dc490)
+- test: add browser tests for agent inspector (#938) (7a4104d)
+- chore: bump version to 0.10.0 (#944) (12275c3)
 
 ## [0.11.0] - 2026-04-24
 
diff --git a/README.md b/README.md
index 27dc204ce..af7769bfe 100644
--- a/README.md
+++ b/README.md
@@ -110,15 +110,29 @@ agentcore invoke
 
 ### Evaluations
 
-| Command              | Description                                   |
-| -------------------- | --------------------------------------------- |
-| `add evaluator`      | Add a custom LLM-as-a-Judge evaluator         |
-| `add online-eval`    | Add continuous evaluation for live traffic    |
-| `run eval`           | Run on-demand evaluation against agent traces |
-| `evals history`      | View past eval run results                    |
-| `pause online-eval`  | Pause a deployed online eval config           |
-| `resume online-eval` | Resume a paused online eval config            |
-| `logs evals`         | Stream or search online eval logs             |
+| Command                 | Description                                      |
+| ----------------------- | ------------------------------------------------ |
+| `add evaluator`         | Add a custom LLM-as-a-Judge evaluator            |
+| `add online-eval`       | Add continuous evaluation for live traffic       |
+| `run eval`              | Run on-demand evaluation against agent traces    |
+| `run batch-evaluation`  | Run evaluators across all sessions [preview]     |
+| `run recommendation`    | Optimize prompts and tool descriptions [preview] |
+| `evals history`         | View past eval run results                       |
+| `pause online-eval`     | Pause a deployed online eval config              |
+| `resume online-eval`    | Resume a paused online eval config               |
+| `stop batch-evaluation` | Stop a running batch evaluation [preview]        |
+| `logs evals`            | Stream or search online eval logs                |
+
+### Config Bundles [preview]
+
+| Command             | Description                               |
+| ------------------- | ----------------------------------------- |
+| `add config-bundle` | Add a versioned configuration bundle      |
+| `cb versions`       | List version history for a bundle         |
+| `cb diff`           | Diff two versions of a bundle             |
+| `cb create-branch`  | Create a new branch on an existing bundle |
+
+> Create agents with `--with-config-bundle` to auto-wire config bundle support into the generated template.
 
 ### Utilities
 
@@ -171,6 +185,9 @@ Projects use JSON schema files in the `agentcore/` directory:
 - [CLI Commands Reference](docs/commands.md) - Full command reference for scripting and CI/CD
 - [Configuration](docs/configuration.md) - Schema reference for config files
 - [Evaluations](docs/evals.md) - Evaluators, on-demand evals, and online monitoring
+- [Batch Evaluation](docs/batch-evaluation.md) - Run evaluators across sessions at scale [preview]
+- [Recommendations](docs/recommendations.md) - Optimize prompts and tool descriptions [preview]
+- [Config Bundles](docs/config-bundles.md) - Versioned runtime configurations [preview]
 - [Frameworks](docs/frameworks.md) - Supported frameworks and model providers
 - [Gateway](docs/gateway.md) - Gateway setup, targets, and authentication
 - [Memory](docs/memory.md) - Memory strategies and sharing
diff --git a/create-bundle.mjs b/create-bundle.mjs
new file mode 100644
index 000000000..89bf1d221
--- /dev/null
+++ b/create-bundle.mjs
@@ -0,0 +1,53 @@
+import { Sha256 } from '@aws-crypto/sha256-js';
+import { defaultProvider } from '@aws-sdk/credential-provider-node';
+import { SignatureV4 } from '@aws-sdk/signature-v4';
+import { randomUUID } from 'crypto';
+
+const region = 'us-east-1';
+const endpoint = `https://gamma.${region}.elcapcp.genesis-primitives.aws.dev`;
+
+const body = JSON.stringify({
+  bundleName: 'test_rec_bundle',
+  description: 'Test bundle for recommendation',
+  clientToken: randomUUID(),
+  components: {
+    ['arn:aws:bedrock-agentcore:us-east-1:998846730471:runtime/myproject_MyAgent-QMd093Gl4O']: {
+      configuration: {
+        system_prompt: 'You are a helpful assistant that helps users.',
+        modelId: 'anthropic.claude-sonnet-4-20250514',
+      },
+    },
+  },
+  branchName: 'mainline',
+  commitMessage: 'Initial version for rec test',
+});
+
+const signer = new SignatureV4({
+  credentials: defaultProvider(),
+  region,
+  service: 'bedrock-agentcore-control',
+  sha256: Sha256,
+});
+
+const url = new URL('/configuration-bundles/create', endpoint);
+const request = {
+  method: 'POST',
+  hostname: url.hostname,
+  path: url.pathname,
+  headers: {
+    'content-type': 'application/json',
+    host: url.hostname,
+  },
+  body,
+};
+
+const signed = await signer.sign(request);
+const resp = await fetch(`${endpoint}/configuration-bundles/create`, {
+  method: 'POST',
+  headers: signed.headers,
+  body,
+});
+
+const data = await resp.text();
+console.log(`Status: ${resp.status}`);
+console.log(data);
diff --git a/docs/PERMISSIONS.md b/docs/PERMISSIONS.md
index 53ed2958d..f041a4b0b 100644
--- a/docs/PERMISSIONS.md
+++ b/docs/PERMISSIONS.md
@@ -39,8 +39,10 @@ Attach this to every IAM user or role that will run AgentCore CLI commands. The
 - `sts:GetCallerIdentity`, `cloudformation:DescribeStacks`, `tag:GetResources` for basic operations
 - `bedrock-agentcore:Invoke*`, `bedrock-agentcore:Get*`, `bedrock-agentcore:List*` for invoking agents and checking
   status
+- Batch evaluation and recommendation actions for `run batch-eval` and `run recommend`
 - Credential provider and token vault actions for `deploy` when the project uses identity features
-- CloudWatch Logs, X-Ray, and Application Signals actions for `logs`, `traces`, and observability setup
+- CloudWatch Logs (including log group creation for batch eval results), X-Ray, and Application Signals actions for
+  `logs`, `traces`, and observability setup
 - Bedrock actions for agent import and AI-assisted code generation (optional, see
   [Scoping down by feature](#scoping-down-by-feature))
 
@@ -162,15 +164,16 @@ The policy files provided cover every AgentCore feature. If your team only uses
 corresponding statements to further tighten the policies. This table maps features to the policy statements that can be
 safely removed:
 
-| If your team does not use...    | Remove from user policy                                              | Remove from CFN execution policy                                                                       |
-| ------------------------------- | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
-| Container builds (CodeZip only) | _(no change)_                                                        | `EcrContainerBuilds`, `CodeBuildContainerBuilds`                                                       |
-| MCP Lambda compute              | _(no change)_                                                        | `LambdaMcpAndCustomResources` (keep if using container builds, which need Lambda for custom resources) |
-| Agent import from Bedrock       | `BedrockAgentImport`                                                 | _(no change)_                                                                                          |
-| AI-assisted code generation     | `BedrockModelInvocation`                                             | _(no change)_                                                                                          |
-| Identity/credential providers   | `IdentityCredentialManagement`, `TokenVaultKmsKeyCreation`           | `SecretsManagerForCredentials`                                                                         |
-| Policy engine                   | `PolicyGeneration`                                                   | Remove `*PolicyEngine*` and `*Policy` actions from `BedrockAgentCoreResources`                         |
-| Online evaluations              | Remove `UpdateOnlineEvaluationConfig` from `AgentCoreResourceStatus` | Remove `*OnlineEvaluationConfig*` actions from `BedrockAgentCoreResources`                             |
+| If your team does not use...    | Remove from user policy                                                                                                 | Remove from CFN execution policy                                                                       |
+| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
+| Container builds (CodeZip only) | _(no change)_                                                                                                           | `EcrContainerBuilds`, `CodeBuildContainerBuilds`                                                       |
+| MCP Lambda compute              | _(no change)_                                                                                                           | `LambdaMcpAndCustomResources` (keep if using container builds, which need Lambda for custom resources) |
+| Agent import from Bedrock       | `BedrockAgentImport`                                                                                                    | _(no change)_                                                                                          |
+| AI-assisted code generation     | `BedrockModelInvocation`                                                                                                | _(no change)_                                                                                          |
+| Identity/credential providers   | `IdentityCredentialManagement`, `TokenVaultKmsKeyCreation`                                                              | `SecretsManagerForCredentials`                                                                         |
+| Policy engine                   | `PolicyGeneration`                                                                                                      | Remove `*PolicyEngine*` and `*Policy` actions from `BedrockAgentCoreResources`                         |
+| Online evaluations              | Remove `UpdateOnlineEvaluationConfig` from `AgentCoreResourceStatus`                                                    | Remove `*OnlineEvaluationConfig*` actions from `BedrockAgentCoreResources`                             |
+| Batch eval / recommendations    | `BatchEvalAndRecommendations`; remove `CreateLogGroup`, `CreateLogStream`, `PutLogEvents` from `LogsStreamingAndSearch` | _(no change)_                                                                                          |
 
 ## Hardening with permission boundaries
 
@@ -335,6 +338,20 @@ Required for all deployment operations (`deploy`, `status`, `diff`).
 | `bedrock-agentcore:Evaluate`                     | `run evals`                               | Run on-demand evaluation against agent traces |
 | `bedrock-agentcore:UpdateOnlineEvaluationConfig` | `pause online-eval`, `resume online-eval` | Pause or resume online evaluation             |
 
+### Batch evaluation and recommendations
+
+| Action                                    | CLI Commands     | Purpose                        |
+| ----------------------------------------- | ---------------- | ------------------------------ |
+| `bedrock-agentcore:StartBatchEvaluation`  | `run batch-eval` | Start a batch evaluation job   |
+| `bedrock-agentcore:GetBatchEvaluation`    | `run batch-eval` | Poll batch evaluation status   |
+| `bedrock-agentcore:ListBatchEvaluations`  | `evals history`  | List past batch evaluations    |
+| `bedrock-agentcore:StopBatchEvaluation`   | `run batch-eval` | Stop an in-progress batch eval |
+| `bedrock-agentcore:DeleteBatchEvaluation` | `run batch-eval` | Delete a batch evaluation      |
+| `bedrock-agentcore:StartRecommendation`   | `run recommend`  | Start a recommendation job     |
+| `bedrock-agentcore:GetRecommendation`     | `run recommend`  | Poll recommendation status     |
+| `bedrock-agentcore:ListRecommendations`   | `run recommend`  | List past recommendations      |
+| `bedrock-agentcore:DeleteRecommendation`  | `run recommend`  | Stop/delete a recommendation   |
+
 ### Identity and credential management
 
 | Action                                             | CLI Commands | Purpose                                   |
@@ -361,14 +378,18 @@ Required for all deployment operations (`deploy`, `status`, `diff`).
 
 ### Logging, traces, and observability
 
-| Action                          | CLI Commands                             | Purpose                                       |
-| ------------------------------- | ---------------------------------------- | --------------------------------------------- |
-| `logs:StartLiveTail`            | `logs`                                   | Stream agent logs in real-time                |
-| `logs:FilterLogEvents`          | `logs`                                   | Search agent logs                             |
-| `logs:StartQuery`               | `traces list`, `traces get`, `run evals` | Run CloudWatch Logs Insights queries          |
-| `logs:GetQueryResults`          | `traces list`, `traces get`, `run evals` | Retrieve query results                        |
-| `logs:DescribeResourcePolicies` | `deploy`                                 | Check for X-Ray log resource policy           |
-| `logs:PutResourcePolicy`        | `deploy`                                 | Create resource policy for X-Ray trace access |
+| Action                          | CLI Commands                             | Purpose                                                 |
+| ------------------------------- | ---------------------------------------- | ------------------------------------------------------- |
+| `logs:StartLiveTail`            | `logs`                                   | Stream agent logs in real-time                          |
+| `logs:FilterLogEvents`          | `logs`                                   | Search agent logs                                       |
+| `logs:StartQuery`               | `traces list`, `traces get`, `run evals` | Run CloudWatch Logs Insights queries                    |
+| `logs:GetQueryResults`          | `traces list`, `traces get`, `run evals` | Retrieve query results                                  |
+| `logs:DescribeResourcePolicies` | `deploy`                                 | Check for X-Ray log resource policy                     |
+| `logs:PutResourcePolicy`        | `deploy`                                 | Create resource policy for X-Ray trace access           |
+| `logs:DescribeLogGroups`        | `run batch-eval`, `run recommend`        | Discover runtime log groups for evaluation data sources |
+| `logs:CreateLogGroup`           | `run batch-eval`                         | Create log group for batch evaluation results output    |
+| `logs:CreateLogStream`          | `run batch-eval`                         | Create log stream for batch evaluation results          |
+| `logs:PutLogEvents`             | `run batch-eval`                         | Write batch evaluation results to CloudWatch Logs       |
 
 ### Transaction search setup
 
diff --git a/docs/TESTING.md b/docs/TESTING.md
index 700ab3aae..9c70af6b3 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -415,6 +415,24 @@ Test configuration is in `vitest.config.ts` using Vitest projects:
 - Test timeout: 120 seconds
 - Hook timeout: 120 seconds
 
+## Troubleshooting
+
+### `Cannot find module '@playwright/test'`
+
+Playwright is not installed. Run:
+
+```bash
+npm install
+```
+
+### `browserType.launch: Executable doesn't exist` (Playwright browsers)
+
+Playwright browsers need to be downloaded after install. Run:
+
+```bash
+npx playwright install chromium
+```
+
 ## Integration Tests
 
 Integration tests require:
diff --git a/docs/batch-evaluation.md b/docs/batch-evaluation.md
new file mode 100644
index 000000000..ea13d3707
--- /dev/null
+++ b/docs/batch-evaluation.md
@@ -0,0 +1,143 @@
+# Batch Evaluation [preview]
+
+Batch evaluation runs evaluators across all agent sessions in CloudWatch, producing per-session scores and aggregate
+metrics. Use it to measure agent quality over time, compare before/after prompt changes, or validate ground truth
+expectations.
+
+## Quick Start
+
+```bash
+# Run a single evaluator across all sessions
+agentcore run batch-evaluation -r MyAgent -e Builtin.Correctness
+
+# Multiple evaluators
+agentcore run batch-evaluation -r MyAgent -e Builtin.Correctness Builtin.Helpfulness Builtin.Faithfulness
+
+# JSON output for scripting
+agentcore run batch-evaluation -r MyAgent -e Builtin.Helpfulness --json
+```
+
+## Available Evaluators
+
+Built-in evaluators provided by AgentCore:
+
+| Evaluator                           | What it measures                               |
+| ----------------------------------- | ---------------------------------------------- |
+| `Builtin.Correctness`               | Factual accuracy of responses                  |
+| `Builtin.Helpfulness`               | How well responses address the user's goal     |
+| `Builtin.Faithfulness`              | Grounding in tool results / provided context   |
+| `Builtin.GoalSuccessRate`           | Whether the agent achieved the user's goal     |
+| `Builtin.ToolSelectionAccuracy`     | Correct tool chosen for the task               |
+| `Builtin.Completeness`              | Whether all parts of the request were handled  |
+| `Builtin.TrajectoryExactOrderMatch` | Tool call sequence matches expected trajectory |
+
+Custom evaluators defined in your project (via `agentcore add evaluator`) can also be used.
+
+## Filtering Sessions
+
+### By time window
+
+```bash
+# Only sessions from the last 3 days
+agentcore run batch-evaluation -r MyAgent -e Builtin.Helpfulness --lookback-days 3
+```
+
+### By session ID
+
+```bash
+agentcore run batch-evaluation -r MyAgent -e Builtin.Correctness -s <session-id-1> <session-id-2>
+```
+
+## Ground Truth
+
+Provide expected responses, assertions, or expected tool trajectories for specific sessions:
+
+```bash
+agentcore run batch-evaluation \
+  -r MyAgent \
+  -e Builtin.Correctness Builtin.GoalSuccessRate \
+  -s <session-id> \
+  --ground-truth ./ground_truth.json
+```
+
+### Ground truth file format
+
+```json
+[
+  {
+    "sessionId": "<session-id>",
+    "groundTruth": {
+      "inline": {
+        "assertions": [{ "text": "Agent should use the lookup_order tool" }],
+        "expectedTrajectory": {
+          "toolNames": ["lookup_order"]
+        },
+        "turns": [
+          {
+            "input": "What's the status of order ORD-1001?",
+            "expectedResponse": { "text": "Order ORD-1001 has been delivered" }
+          }
+        ]
+      }
+    }
+  }
+]
+```
+
+All fields inside `inline` are optional — include only what's relevant:
+
+- `assertions` — free-text expectations evaluated by `Builtin.GoalSuccessRate`
+- `expectedTrajectory` — tool call sequence evaluated by `Builtin.TrajectoryExactOrderMatch`
+- `turns` — input/expected-response pairs evaluated by `Builtin.Correctness`
+
+## Custom Name
+
+```bash
+agentcore run batch-evaluation -r MyAgent -e Builtin.Helpfulness -n "weekly_quality_check"
+```
+
+Names must start with a letter and contain only letters, digits, and underscores (max 48 characters).
+
+## Stopping a Running Evaluation
+
+```bash
+agentcore stop batch-evaluation -i <batch-evaluation-id>
+```
+
+## Viewing Results
+
+### CLI output
+
+The CLI shows scores grouped by evaluator with average scores after the run completes.
+
+### Local history
+
+Results are saved in `.cli/eval-job-results/`. View past runs via the TUI:
+
+```bash
+agentcore
+# Navigate to: Evals → Batch Evaluation History
+```
+
+### JSON output
+
+```bash
+agentcore run batch-evaluation -r MyAgent -e Builtin.Helpfulness --json
+```
+
+Returns `batchEvaluationId`, `evaluationResults` with `numberOfSessionsCompleted`, `evaluatorSummaries` with
+per-evaluator `averageScore`.
+
+## TUI Wizard
+
+Run `agentcore` → Run → Batch Evaluation for a guided flow:
+
+1. Select agent
+2. Multi-select evaluators
+3. Set lookback days
+4. Optionally select specific sessions
+5. Optionally add ground truth
+6. Name the run (optional)
+7. Confirm and run
+
+The TUI shows real-time progress with elapsed time and step indicators.
diff --git a/docs/config-bundles.md b/docs/config-bundles.md
new file mode 100644
index 000000000..890ad7aaf
--- /dev/null
+++ b/docs/config-bundles.md
@@ -0,0 +1,114 @@
+# Configuration Bundles [preview]
+
+Config bundles are versioned configurations that store your agent's runtime settings — system prompt, tool descriptions,
+model parameters, or any custom keys. Instead of hardcoding values in your agent code, your agent reads its config at
+invocation time from whichever bundle version is active.
+
+## Concepts
+
+| Concept       | Description                                                                         |
+| ------------- | ----------------------------------------------------------------------------------- |
+| **Bundle**    | A named container for component configurations, stored in `agentcore.json`          |
+| **Version**   | An immutable snapshot of a bundle's configuration, created on each deploy or update |
+| **Branch**    | A named lineage within a bundle (e.g. `mainline`, `experiment-1`)                   |
+| **Component** | A runtime or gateway whose configuration is managed by the bundle                   |
+
+## Creating a Config Bundle
+
+### With agent creation
+
+Create an agent with a pre-wired config bundle that injects system prompt and tool descriptions at runtime:
+
+```bash
+agentcore create --name MyProject --defaults --with-config-bundle
+```
+
+This creates a `{AgentName}Config` bundle with smart defaults and generates a template that uses
+`BedrockAgentCoreContext.get_config_bundle()` to read config at runtime.
+
+### Standalone
+
+```bash
+agentcore add config-bundle \
+  --name MyBundle \
+  --description "Production configuration" \
+  --components '{"{{runtime:MyAgent}}": {"configuration": {"systemPrompt": "You are helpful.", "temperature": 0.7}}}' \
+  --branch mainline \
+  --commit-message "Initial config" \
+  --json
+```
+
+The `{{runtime:MyAgent}}` placeholder resolves to the real runtime ARN at deploy time.
+
+### Via TUI
+
+Run `agentcore` → Add → select "Configuration Bundle", or select "Config bundle" in the Advanced Configuration step when
+adding an agent.
+
+## Deploying
+
+```bash
+agentcore deploy
+```
+
+On deploy, the CLI creates or updates the config bundle in the API and stores the bundle ID, ARN, and version ID in
+`deployed-state.json`.
+
+## Managing Versions
+
+### List versions
+
+```bash
+agentcore cb versions --bundle MyBundle
+```
+
+Shows version history grouped by branch with commit messages, timestamps, and parent lineage.
+
+### Diff two versions
+
+```bash
+agentcore cb diff --bundle MyBundle --from <version-id-1> --to <version-id-2>
+```
+
+### Create a branch
+
+```bash
+agentcore cb create-branch --bundle MyBundle --branch experiment-1
+```
+
+Creates a new branch from the latest version (or a specific version with `--from`).
+
+## Updating Without Redeploying Code
+
+Edit the `systemPrompt` or other fields in `agentcore.json` under `configBundles`, then:
+
+```bash
+agentcore deploy
+```
+
+A new version is created in the API. The next invocation picks up the new config automatically — no code changes needed.
+
+## How It Works at Runtime
+
+When you invoke an agent with an associated config bundle, the CLI passes the bundle ARN and version as W3C baggage
+headers. The SDK's `BedrockAgentCoreContext.get_config_bundle()` reads the baggage, fetches the config from the API
+(cached per version), and makes it available to your agent code.
+
+The generated template uses a `ConfigBundleHook` (Strands) or `ConfigBundleCallback` (LangGraph) to inject the system
+prompt and tool descriptions before each invocation.
+
+## Bundle Name in agentcore.json
+
+The CLI prefixes your bundle name with the project name when creating it in the API (e.g. `MyProject` + `MyBundle` →
+`MyProjectMyBundle`). You always use the local name (`MyBundle`) in CLI commands — the CLI resolves the prefix
+automatically.
+
+## JSON Output
+
+All commands support `--json` for scripting:
+
+```bash
+agentcore cb versions --bundle MyBundle --json
+agentcore cb diff --bundle MyBundle --from v1 --to v2 --json
+agentcore cb create-branch --bundle MyBundle --branch exp-1 --json
+```
diff --git a/docs/harness.md b/docs/harness.md
new file mode 100644
index 000000000..db51d2b7f
--- /dev/null
+++ b/docs/harness.md
@@ -0,0 +1,263 @@
+# Harness
+
+A **harness** is a managed agent runtime that connects a foundation model to tools, memory, and configuration — without
+requiring you to write agent framework code. You define the model, tools, and settings; AgentCore handles the
+orchestration.
+
+Use a harness when you want a quick, config-driven agent. Use a traditional agent (with `--framework`) when you need
+custom code, a specific framework (Strands, LangChain, etc.), or full control over the agent loop.
+
+## Creating a Harness Project
+
+```bash
+# Minimal — defaults to Bedrock provider, Claude Sonnet
+agentcore create --name myharness
+
+# Specify provider and model
+agentcore create --name myharness --model-provider bedrock --model-id global.anthropic.claude-sonnet-4-6
+
+# OpenAI provider (requires --api-key-arn)
+agentcore create --name myharness --model-provider open_ai --model-id gpt-4o \
+  --api-key-arn arn:aws:secretsmanager:us-west-2:123456789012:secret:openai-key
+
+# Gemini provider
+agentcore create --name myharness --model-provider gemini --model-id gemini-2.5-flash \
+  --api-key-arn arn:aws:secretsmanager:us-west-2:123456789012:secret:gemini-key
+
+# Skip auto-created memory
+agentcore create --name myharness --no-harness-memory
+
+# With all optional settings
+agentcore create --name myharness \
+  --model-provider bedrock \
+  --max-iterations 10 \
+  --max-tokens 4096 \
+  --timeout 120 \
+  --truncation-strategy sliding_window \
+  --session-storage-mount-path /mnt/data
+```
+
+### Model Providers
+
+| Provider | `--model-provider` value | Requires `--api-key-arn` |
+| -------- | ------------------------ | ------------------------ |
+| Bedrock  | `bedrock`                | No                       |
+| OpenAI   | `open_ai` or `openai`    | Yes                      |
+| Gemini   | `gemini`                 | Yes                      |
+
+> Aliases `Bedrock`, `OpenAI`, `Gemini`, `Anthropic` (maps to bedrock) are also accepted.
+
+### Harness vs Agent
+
+If you pass `--framework`, `--language`, or other agent-specific flags, the CLI creates a traditional agent project
+instead. These flags cannot be mixed with harness-only flags (`--model-id`, `--max-iterations`, etc.).
+
+## Project Structure
+
+```
+myharness/
+  agentcore/                  # Config and CDK project
+    agentcore.json            # Project manifest (lists harnesses, memories, etc.)
+    aws-targets.json          # Deployment targets
+    cdk/                      # CDK infrastructure code
+  app/myharness/              # Harness configuration
+    harness.json              # Harness spec (model, tools, settings)
+    system-prompt.md          # System prompt (editable)
+```
+
+## Deployment Targets (`aws-targets.json`)
+
+Before deploying, ensure `aws-targets.json` has at least one target:
+
+```json
+[
+  {
+    "name": "default",
+    "account": "123456789012",
+    "region": "us-west-2"
+  }
+]
+```
+
+Fields:
+
+- `name` — target name (use `"default"` for the primary target)
+- `account` — AWS account ID (string)
+- `region` — AWS region
+
+## Adding a Harness to an Existing Project
+
+```bash
+agentcore add harness --name myharness --model-provider bedrock
+agentcore add harness --name myharness --model-provider bedrock --session-storage /mnt/data
+agentcore add harness --name myharness --model-provider bedrock --with-invoke-script
+```
+
+### Custom JWT Auth
+
+```bash
+agentcore add harness --name myharness --model-provider bedrock \
+  --authorizer-type CUSTOM_JWT \
+  --discovery-url https://example.auth0.com/.well-known/openid-configuration \
+  --allowed-audience myapp
+```
+
+## Tools
+
+Harnesses support four built-in tool types plus inline functions:
+
+### Adding Tools
+
+```bash
+# Remote MCP server
+agentcore add tool --harness myharness --type remote_mcp --name mytool \
+  --url https://mcp-server.example.com/sse
+
+# Browser tool
+agentcore add tool --harness myharness --type agentcore_browser --name browser
+
+# Code interpreter
+agentcore add tool --harness myharness --type agentcore_code_interpreter --name codeinterp
+
+# Gateway tool (by ARN)
+agentcore add tool --harness myharness --type agentcore_gateway --name gwtool \
+  --gateway-arn arn:aws:bedrock-agentcore:us-west-2:123456789012:gateway/gw-abc
+
+# Gateway tool (by project gateway name — resolves ARN from deployed state)
+agentcore add tool --harness myharness --type agentcore_gateway --name gwtool \
+  --gateway mygateway
+```
+
+### Removing Tools
+
+```bash
+agentcore remove tool --harness myharness --name mytool
+```
+
+## Session Storage
+
+Session storage provides a persistent filesystem mount for the harness runtime. Files written to the mount path persist
+across invocations within the same session.
+
+```bash
+# Via add harness
+agentcore add harness --name myharness --model-provider bedrock --session-storage /mnt/data
+
+# Via create
+agentcore create --name myharness --session-storage-mount-path /mnt/data
+```
+
+The path must be an absolute path under `/mnt/` (e.g., `/mnt/data`, `/mnt/workspace`).
+
+**Important:** Only files written to the configured mount path are persistent and visible to `--exec` commands. Files
+written to other paths (e.g., `/home`, `/tmp`) may be created in an ephemeral context and will not appear when
+inspecting the container via `--exec`. If your tools write files, configure them to use the session storage path.
+
+## Deploying
+
+```bash
+agentcore deploy          # Interactive — prompts for confirmation
+agentcore deploy -y       # Auto-confirm
+agentcore deploy --dry-run  # Preview without deploying
+agentcore deploy --diff   # Show CDK diff
+```
+
+Deploy creates:
+
+1. CloudFormation stack (IAM role, memory)
+2. Harness resource via AgentCore API
+
+## Checking Status
+
+```bash
+agentcore status                    # All resources
+agentcore status --type harness     # Harness resources only
+agentcore status --json             # JSON output
+```
+
+## Invoking
+
+```bash
+# Basic invoke
+agentcore invoke --harness myharness "What can you do?"
+
+# With session continuity
+agentcore invoke --harness myharness --session-id <id> "Follow up question"
+
+# Verbose — shows raw streaming events
+agentcore invoke --harness myharness --verbose "Hello"
+
+# JSON output
+agentcore invoke --harness myharness --json "Hello"
+```
+
+### Invoke Overrides
+
+These flags override harness settings for a single invocation only (they do not persist):
+
+| Flag                          | Description                           |
+| ----------------------------- | ------------------------------------- |
+| `--model-id <id>`             | Use a different model                 |
+| `--system-prompt <text>`      | Override the system prompt            |
+| `--max-iterations <n>`        | Override max agent loop iterations    |
+| `--max-tokens <n>`            | Override max tokens per iteration     |
+| `--harness-timeout <seconds>` | Override execution timeout            |
+| `--tools <tools>`             | Override tools (comma-separated)      |
+| `--allowed-tools <tools>`     | Restrict which tools can be used      |
+| `--skills <paths>`            | Skills to use (comma-separated paths) |
+| `--actor-id <id>`             | Override memory actor ID              |
+| `--bearer-token <token>`      | Bearer token for CUSTOM_JWT auth      |
+
+## Logs and Traces
+
+```bash
+# View logs
+agentcore logs --harness myharness --limit 20
+agentcore logs --harness myharness --since 1h --level error
+
+# List traces
+agentcore traces list --harness myharness
+agentcore traces list --harness myharness --since 30m --limit 10
+
+# Download a trace
+agentcore traces get --harness myharness <traceId>
+agentcore traces get --harness myharness <traceId> --output ./trace.json
+```
+
+## Fetching Access Info
+
+For harnesses with CUSTOM_JWT auth:
+
+```bash
+agentcore fetch access --name myharness --type harness
+agentcore fetch access --name myharness --type harness --json
+```
+
+## Removing a Harness
+
+```bash
+agentcore remove harness --name myharness -y
+agentcore deploy  # Apply removal to AWS
+```
+
+## Validating Configuration
+
+```bash
+agentcore validate
+```
+
+Checks:
+
+- Harness schema validity (model, tools, settings)
+- Cross-references (memory names exist in project)
+- Tool configuration completeness
+
+## Invoke Script
+
+Pass `--with-invoke-script` to generate a standalone Python script for invoking the harness outside the CLI:
+
+```bash
+agentcore add harness --name myharness --model-provider bedrock --with-invoke-script
+```
+
+This creates `app/myharness/invoke.py` which uses `boto3` to invoke the harness directly.
diff --git a/docs/policies/iam-policy-user.json b/docs/policies/iam-policy-user.json
index d2467a134..8e268824f 100644
--- a/docs/policies/iam-policy-user.json
+++ b/docs/policies/iam-policy-user.json
@@ -87,6 +87,22 @@
       "Action": ["kms:CreateKey", "kms:TagResource"],
       "Resource": "*"
     },
+    {
+      "Sid": "BatchEvalAndRecommendations",
+      "Effect": "Allow",
+      "Action": [
+        "bedrock-agentcore:StartBatchEvaluation",
+        "bedrock-agentcore:GetBatchEvaluation",
+        "bedrock-agentcore:ListBatchEvaluations",
+        "bedrock-agentcore:StopBatchEvaluation",
+        "bedrock-agentcore:DeleteBatchEvaluation",
+        "bedrock-agentcore:StartRecommendation",
+        "bedrock-agentcore:GetRecommendation",
+        "bedrock-agentcore:ListRecommendations",
+        "bedrock-agentcore:DeleteRecommendation"
+      ],
+      "Resource": "*"
+    },
     {
       "Sid": "LogsStreamingAndSearch",
       "Effect": "Allow",
@@ -96,7 +112,11 @@
         "logs:StartQuery",
         "logs:GetQueryResults",
         "logs:DescribeResourcePolicies",
-        "logs:PutResourcePolicy"
+        "logs:PutResourcePolicy",
+        "logs:DescribeLogGroups",
+        "logs:CreateLogGroup",
+        "logs:CreateLogStream",
+        "logs:PutLogEvents"
       ],
       "Resource": "*"
     },
diff --git a/docs/recommendations.md b/docs/recommendations.md
new file mode 100644
index 000000000..c5a5c4ac3
--- /dev/null
+++ b/docs/recommendations.md
@@ -0,0 +1,158 @@
+# Recommendations [preview]
+
+Recommendations optimize your agent's system prompt or tool descriptions using historical traces as signal. The
+recommendation service analyzes how your agent performed, then produces an improved version scored by an evaluator.
+
+## Quick Start
+
+```bash
+# Optimize a system prompt (inline)
+agentcore run recommendation \
+  -r MyAgent \
+  -e Builtin.Helpfulness \
+  --type system-prompt \
+  --inline "You are a helpful assistant."
+
+# Optimize tool descriptions
+agentcore run recommendation \
+  -r MyAgent \
+  --type tool-description \
+  --tools "search:Searches the web" "calc:Does math"
+```
+
+## System Prompt Recommendations
+
+### From inline text
+
+```bash
+agentcore run recommendation \
+  -r MyAgent \
+  -e Builtin.Helpfulness \
+  --type system-prompt \
+  --inline "You are a helpful assistant. Use tools when appropriate."
+```
+
+### From a file
+
+```bash
+agentcore run recommendation \
+  -r MyAgent \
+  -e Builtin.Helpfulness \
+  --type system-prompt \
+  --prompt-file ./system-prompt.txt
+```
+
+### From a config bundle
+
+Read the current prompt from a deployed config bundle, optimize it, and write the result back as a new bundle version:
+
+```bash
+agentcore run recommendation \
+  -r MyAgent \
+  -e Builtin.Helpfulness \
+  --type system-prompt \
+  --bundle-name MyBundle \
+  --bundle-version <version-id> \
+  --system-prompt-json-path systemPrompt
+```
+
+The `--system-prompt-json-path` is the field name under `configuration` in the bundle (e.g. `systemPrompt`). The CLI
+resolves it to the full path automatically using the component ARN from your deployed state.
+
+> **JSONPath format:** The API uses dot notation (`$.{ARN}.configuration.{field}`), not standard JSONPath bracket
+> notation. You don't need to worry about this — just pass the short field name and the CLI handles the resolution. If
+> you need the full path for direct API calls, use `$.arn:aws:...:runtime/MyAgent.configuration.systemPrompt` (no
+> brackets, no quotes around the ARN).
+
+On success, the recommendation writes a new config bundle version with the optimized prompt. The agent picks it up on
+the next invocation — no redeploy needed.
+
+## Tool Description Recommendations
+
+```bash
+agentcore run recommendation \
+  -r MyAgent \
+  --type tool-description \
+  --tools "add_numbers:Return the sum of two numbers" "search:Searches the web"
+```
+
+Returns optimized tool descriptions for each tool.
+
+## Trace Source
+
+By default, the recommendation service fetches traces from CloudWatch using a 7-day lookback. Customize with:
+
+```bash
+# Custom lookback window
+agentcore run recommendation ... --lookback 14
+
+# Specific sessions only
+agentcore run recommendation ... --session-id <id-1> <id-2>
+
+# From a local spans file (OTEL format)
+agentcore run recommendation ... --spans-file ./traces.json
+```
+
+## JSON Output
+
+```bash
+agentcore run recommendation -r MyAgent -e Builtin.Helpfulness --type system-prompt --inline "..." --json
+```
+
+Returns `recommendationId`, `status`, and `result` with `systemPromptRecommendationResult.recommendedSystemPrompt` or
+`toolDescriptionRecommendationResult.tools`.
+
+When using `--bundle-name`, the result also includes `configurationBundle.versionId` — the new bundle version.
+
+## End-to-End Workflow: Recommendation → Config Bundle → Invoke
+
+1. Create agent with config bundle:
+
+   ```bash
+   agentcore create --name MyAgent --defaults --with-config-bundle
+   agentcore deploy
+   ```
+
+2. Invoke a few times to generate traces:
+
+   ```bash
+   agentcore invoke --prompt "What is 2 + 3?"
+   agentcore invoke --prompt "Tell me about Paris"
+   ```
+
+3. Run recommendation from config bundle:
+
+   ```bash
+   agentcore run recommendation \
+     -r MyAgent -e Builtin.Helpfulness --type system-prompt \
+     --bundle-name MyAgentConfig --bundle-version <version-id> \
+     --system-prompt-json-path systemPrompt
+   ```
+
+4. Invoke again — the agent uses the optimized prompt without code changes:
+   ```bash
+   agentcore invoke --prompt "Who are you?"
+   ```
+
+## Viewing History
+
+Results are saved in `.cli/recommendations/`. View past runs via the TUI:
+
+```bash
+agentcore
+# Navigate to: Recommendations → History
+```
+
+## TUI Wizard
+
+Run `agentcore` → Run → Recommendation for a guided flow:
+
+1. Select recommendation type (system prompt or tool description)
+2. Select agent
+3. Select evaluator (system prompt only)
+4. Choose input source (inline, file, or config bundle)
+5. Choose trace source (CloudWatch or sessions)
+6. Confirm and run
+
+The TUI shows real-time progress and displays the recommended changes when complete, with an option to apply config
+bundle updates.
diff --git a/e2e-tests/ab-test-config-bundle.test.ts b/e2e-tests/ab-test-config-bundle.test.ts
new file mode 100644
index 000000000..9c18b2f31
--- /dev/null
+++ b/e2e-tests/ab-test-config-bundle.test.ts
@@ -0,0 +1,211 @@
+import { parseJsonOutput, retry } from '../src/test-utils/index.js';
+import {
+  baseCanRun,
+  hasAws,
+  installCdkTarball,
+  runAgentCoreCLI,
+  teardownE2EProject,
+  writeAwsTargets,
+} from './e2e-helper.js';
+import { randomUUID } from 'node:crypto';
+import { mkdir, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+const canRun = baseCanRun && hasAws;
+
+describe.sequential('e2e: config-bundle AB test lifecycle', () => {
+  let testDir: string;
+  let projectPath: string;
+  const agentName = `E2eCfgAB${String(Date.now()).slice(-8)}`;
+  const abTestName = 'ConfigBundleABTest';
+  const evalName = 'BundleEvaluator';
+  const onlineEvalName = 'BundleOnlineEval';
+
+  beforeAll(async () => {
+    if (!canRun) return;
+
+    testDir = join(tmpdir(), `agentcore-e2e-cfg-ab-${randomUUID()}`);
+    await mkdir(testDir, { recursive: true });
+
+    const result = await runAgentCoreCLI(
+      [
+        'create',
+        '--name',
+        agentName,
+        '--language',
+        'Python',
+        '--framework',
+        'Strands',
+        '--model-provider',
+        'Bedrock',
+        '--memory',
+        'none',
+        '--json',
+      ],
+      testDir
+    );
+    expect(result.exitCode, `Create failed: ${result.stderr}`).toBe(0);
+    projectPath = (parseJsonOutput(result.stdout) as { projectPath: string }).projectPath;
+
+    await writeAwsTargets(projectPath);
+    installCdkTarball(projectPath);
+  }, 300000);
+
+  afterAll(async () => {
+    if (projectPath && hasAws) {
+      await teardownE2EProject(projectPath, agentName, 'Bedrock');
+    }
+    if (testDir) await rm(testDir, { recursive: true, force: true, maxRetries: 3, retryDelay: 1000 });
+  }, 600000);
+
+  const run = (args: string[]) => runAgentCoreCLI(args, projectPath);
+
+  it.skipIf(!canRun)(
+    'adds evaluator and online eval config',
+    async () => {
+      let result = await run([
+        'add',
+        'evaluator',
+        '--name',
+        evalName,
+        '--level',
+        'SESSION',
+        '--model',
+        'us.anthropic.claude-sonnet-4-5-20250929-v1:0',
+        '--instructions',
+        'Evaluate session quality. Context: {context}',
+        '--json',
+      ]);
+      expect(result.exitCode, `Add evaluator failed: ${result.stdout}`).toBe(0);
+
+      result = await run([
+        'add',
+        'online-eval',
+        '--name',
+        onlineEvalName,
+        '--runtime',
+        agentName,
+        '--evaluator',
+        evalName,
+        '--sampling-rate',
+        '100',
+        '--enable-on-create',
+        '--json',
+      ]);
+      expect(result.exitCode, `Add online-eval failed: ${result.stdout}`).toBe(0);
+    },
+    60000
+  );
+
+  it.skipIf(!canRun)(
+    'deploys agent before AB test (needed for config bundles)',
+    async () => {
+      await retry(
+        async () => {
+          const result = await run(['deploy', '--yes', '--json']);
+          if (result.exitCode !== 0) {
+            console.log('Initial deploy stdout:', result.stdout);
+            console.log('Initial deploy stderr:', result.stderr);
+          }
+          expect(result.exitCode, `Initial deploy failed`).toBe(0);
+          const json = parseJsonOutput(result.stdout) as { success: boolean };
+          expect(json.success).toBe(true);
+        },
+        2,
+        30000
+      );
+    },
+    600000
+  );
+
+  it.skipIf(!canRun)(
+    'adds config-bundle AB test with 90/10 split',
+    async () => {
+      // Config bundles reference ARNs from deployed resources.
+      // Use placeholder bundle ARNs — the deploy step will validate or create them.
+      const controlBundle = `arn:aws:bedrock-agentcore:ap-southeast-2:998846730471:config-bundle/control-v1`;
+      const treatmentBundle = `arn:aws:bedrock-agentcore:ap-southeast-2:998846730471:config-bundle/treatment-v1`;
+
+      const result = await run([
+        'add',
+        'ab-test',
+        '--mode',
+        'config-bundle',
+        '--name',
+        abTestName,
+        '--runtime',
+        agentName,
+        '--control-bundle',
+        controlBundle,
+        '--control-version',
+        'v1',
+        '--treatment-bundle',
+        treatmentBundle,
+        '--treatment-version',
+        'v1',
+        '--control-weight',
+        '90',
+        '--treatment-weight',
+        '10',
+        '--online-eval',
+        onlineEvalName,
+        '--json',
+      ]);
+      expect(result.exitCode, `Add AB test failed: ${result.stdout}`).toBe(0);
+      const json = parseJsonOutput(result.stdout) as { success: boolean; abTestName: string };
+      expect(json.success).toBe(true);
+      expect(json.abTestName).toBe(abTestName);
+    },
+    60000
+  );
+
+  it.skipIf(!canRun)(
+    'status shows AB test in config',
+    async () => {
+      const result = await run(['status', '--json']);
+      expect(result.exitCode, `Status failed: ${result.stderr}`).toBe(0);
+
+      const json = parseJsonOutput(result.stdout) as {
+        success: boolean;
+        resources: { resourceType: string; name: string; deploymentState: string }[];
+      };
+      expect(json.success).toBe(true);
+
+      // Agent should be deployed
+      const agent = json.resources.find(r => r.resourceType === 'agent' && r.name === agentName);
+      expect(agent, `Agent "${agentName}" should appear in status`).toBeDefined();
+      expect(agent!.deploymentState).toBe('deployed');
+    },
+    120000
+  );
+
+  it.skipIf(!canRun)(
+    'invokes the deployed agent',
+    async () => {
+      await retry(
+        async () => {
+          const result = await run(['invoke', '--prompt', 'Say hello', '--runtime', agentName, '--json']);
+          expect(result.exitCode, `Invoke failed: ${result.stderr}`).toBe(0);
+          const json = parseJsonOutput(result.stdout) as { success: boolean };
+          expect(json.success).toBe(true);
+        },
+        3,
+        15000
+      );
+    },
+    180000
+  );
+
+  it.skipIf(!canRun)(
+    'removes config-bundle AB test',
+    async () => {
+      const result = await run(['remove', 'ab-test', '--name', abTestName, '--json']);
+      expect(result.exitCode, `Remove failed: ${result.stderr}`).toBe(0);
+      const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+      expect(json).toHaveProperty('success', true);
+    },
+    60000
+  );
+});
diff --git a/e2e-tests/ab-test-target-based.test.ts b/e2e-tests/ab-test-target-based.test.ts
new file mode 100644
index 000000000..ac687e4fb
--- /dev/null
+++ b/e2e-tests/ab-test-target-based.test.ts
@@ -0,0 +1,301 @@
+import { parseJsonOutput, retry } from '../src/test-utils/index.js';
+import {
+  baseCanRun,
+  hasAws,
+  installCdkTarball,
+  runAgentCoreCLI,
+  teardownE2EProject,
+  writeAwsTargets,
+} from './e2e-helper.js';
+import { randomUUID } from 'node:crypto';
+import { mkdir, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+const canRun = baseCanRun && hasAws;
+
+describe.sequential('e2e: target-based AB test lifecycle', () => {
+  let testDir: string;
+  let projectPath: string;
+  const agentName = `E2eTargAB${String(Date.now()).slice(-8)}`;
+  const abTestName = 'TargetABTest';
+  const evalName = 'ABTestEvaluator';
+  const controlEvalName = 'ControlEvalConfig';
+  const treatmentEvalName = 'TreatmentEvalConfig';
+
+  beforeAll(async () => {
+    if (!canRun) return;
+
+    testDir = join(tmpdir(), `agentcore-e2e-target-ab-${randomUUID()}`);
+    await mkdir(testDir, { recursive: true });
+
+    const result = await runAgentCoreCLI(
+      [
+        'create',
+        '--name',
+        agentName,
+        '--language',
+        'Python',
+        '--framework',
+        'Strands',
+        '--model-provider',
+        'Bedrock',
+        '--memory',
+        'none',
+        '--json',
+      ],
+      testDir
+    );
+    expect(result.exitCode, `Create failed: ${result.stderr}`).toBe(0);
+    projectPath = (parseJsonOutput(result.stdout) as { projectPath: string }).projectPath;
+
+    await writeAwsTargets(projectPath);
+    installCdkTarball(projectPath);
+  }, 300000);
+
+  afterAll(async () => {
+    if (projectPath && hasAws) {
+      await teardownE2EProject(projectPath, agentName, 'Bedrock');
+    }
+    if (testDir) await rm(testDir, { recursive: true, force: true, maxRetries: 3, retryDelay: 1000 });
+  }, 600000);
+
+  const run = (args: string[]) => runAgentCoreCLI(args, projectPath);
+
+  it.skipIf(!canRun)(
+    'adds runtime endpoints (prod v1, staging v1)',
+    async () => {
+      let result = await run([
+        'add',
+        'runtime-endpoint',
+        '--runtime',
+        agentName,
+        '--endpoint',
+        'prod',
+        '--version',
+        '1',
+        '--json',
+      ]);
+      expect(result.exitCode, `Add prod endpoint failed: ${result.stdout}`).toBe(0);
+
+      result = await run([
+        'add',
+        'runtime-endpoint',
+        '--runtime',
+        agentName,
+        '--endpoint',
+        'staging',
+        '--version',
+        '1',
+        '--json',
+      ]);
+      expect(result.exitCode, `Add staging endpoint failed: ${result.stdout}`).toBe(0);
+    },
+    60000
+  );
+
+  it.skipIf(!canRun)(
+    'adds evaluator and per-variant online eval configs',
+    async () => {
+      let result = await run([
+        'add',
+        'evaluator',
+        '--name',
+        evalName,
+        '--level',
+        'SESSION',
+        '--model',
+        'us.anthropic.claude-sonnet-4-5-20250929-v1:0',
+        '--instructions',
+        'Evaluate quality. Context: {context}',
+        '--json',
+      ]);
+      expect(result.exitCode, `Add evaluator failed: ${result.stdout}`).toBe(0);
+
+      result = await run([
+        'add',
+        'online-eval',
+        '--name',
+        controlEvalName,
+        '--runtime',
+        agentName,
+        '--evaluator',
+        evalName,
+        '--sampling-rate',
+        '100',
+        '--endpoint',
+        'prod',
+        '--enable-on-create',
+        '--json',
+      ]);
+      expect(result.exitCode, `Add control online-eval failed: ${result.stdout}`).toBe(0);
+
+      result = await run([
+        'add',
+        'online-eval',
+        '--name',
+        treatmentEvalName,
+        '--runtime',
+        agentName,
+        '--evaluator',
+        evalName,
+        '--sampling-rate',
+        '100',
+        '--endpoint',
+        'staging',
+        '--enable-on-create',
+        '--json',
+      ]);
+      expect(result.exitCode, `Add treatment online-eval failed: ${result.stdout}`).toBe(0);
+    },
+    60000
+  );
+
+  it.skipIf(!canRun)(
+    'adds target-based AB test with 90/10 split',
+    async () => {
+      const result = await run([
+        'add',
+        'ab-test',
+        '--mode',
+        'target-based',
+        '--name',
+        abTestName,
+        '--runtime',
+        agentName,
+        '--gateway',
+        `${abTestName}-gw`,
+        '--control-endpoint',
+        'prod',
+        '--treatment-endpoint',
+        'staging',
+        '--control-weight',
+        '90',
+        '--treatment-weight',
+        '10',
+        '--control-online-eval',
+        controlEvalName,
+        '--treatment-online-eval',
+        treatmentEvalName,
+        '--enable',
+        '--json',
+      ]);
+      expect(result.exitCode, `Add AB test failed: ${result.stdout}`).toBe(0);
+      const json = parseJsonOutput(result.stdout) as { success: boolean; abTestName: string };
+      expect(json.success).toBe(true);
+      expect(json.abTestName).toBe(abTestName);
+    },
+    60000
+  );
+
+  it.skipIf(!canRun)(
+    'deploys project (creates gateway, targets, AB test, eval configs)',
+    async () => {
+      await retry(
+        async () => {
+          const result = await run(['deploy', '--yes', '--json']);
+          if (result.exitCode !== 0) {
+            console.log('Deploy stdout:', result.stdout);
+            console.log('Deploy stderr:', result.stderr);
+          }
+          expect(result.exitCode, `Deploy failed (stderr: ${result.stderr})`).toBe(0);
+          const json = parseJsonOutput(result.stdout) as { success: boolean };
+          expect(json.success).toBe(true);
+        },
+        2,
+        30000
+      );
+    },
+    600000
+  );
+
+  it.skipIf(!canRun)(
+    'status shows all resources deployed',
+    async () => {
+      await retry(
+        async () => {
+          const result = await run(['status', '--json']);
+          expect(result.exitCode, `Status failed: ${result.stderr}`).toBe(0);
+
+          const json = parseJsonOutput(result.stdout) as {
+            success: boolean;
+            resources: { resourceType: string; name: string; deploymentState: string }[];
+          };
+          expect(json.success).toBe(true);
+
+          // Agent should be deployed
+          const agent = json.resources.find(r => r.resourceType === 'agent' && r.name === agentName);
+          expect(agent, `Agent "${agentName}" should appear in status`).toBeDefined();
+          expect(agent!.deploymentState).toBe('deployed');
+
+          // Gateway should be deployed
+          const gateway = json.resources.find(r => r.resourceType === 'http-gateway' && r.name === `${abTestName}-gw`);
+          expect(gateway, 'HTTP gateway should appear in status').toBeDefined();
+        },
+        3,
+        15000
+      );
+    },
+    120000
+  );
+
+  it.skipIf(!canRun)(
+    'pauses AB test',
+    async () => {
+      await retry(
+        async () => {
+          const result = await run(['pause', 'ab-test', abTestName, '--json']);
+          expect(result.exitCode, `Pause failed: ${result.stderr}`).toBe(0);
+          const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+          expect(json).toHaveProperty('success', true);
+          expect(json).toHaveProperty('executionStatus', 'PAUSED');
+        },
+        3,
+        10000
+      );
+    },
+    120000
+  );
+
+  it.skipIf(!canRun)(
+    'resumes AB test',
+    async () => {
+      await retry(
+        async () => {
+          const result = await run(['resume', 'ab-test', abTestName, '--json']);
+          expect(result.exitCode, `Resume failed: ${result.stderr}`).toBe(0);
+          const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+          expect(json).toHaveProperty('success', true);
+          expect(json).toHaveProperty('executionStatus', 'RUNNING');
+        },
+        3,
+        10000
+      );
+    },
+    120000
+  );
+
+  it.skipIf(!canRun)(
+    'promotes AB test (updates agentcore.json)',
+    async () => {
+      const result = await run(['promote', 'ab-test', abTestName, '--json']);
+      expect(result.exitCode, `Promote failed: ${result.stderr}`).toBe(0);
+      const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+      expect(json).toHaveProperty('success', true);
+      expect(json).toHaveProperty('promoted', true);
+    },
+    120000
+  );
+
+  it.skipIf(!canRun)(
+    'removes AB test from config',
+    async () => {
+      const result = await run(['remove', 'ab-test', '--name', abTestName, '--delete-gateway', '--json']);
+      expect(result.exitCode, `Remove failed: ${result.stderr}`).toBe(0);
+      const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+      expect(json).toHaveProperty('success', true);
+    },
+    60000
+  );
+});
diff --git a/e2e-tests/byo-custom-jwt.test.ts b/e2e-tests/byo-custom-jwt.test.ts
index b7391a522..64e534e20 100644
--- a/e2e-tests/byo-custom-jwt.test.ts
+++ b/e2e-tests/byo-custom-jwt.test.ts
@@ -48,7 +48,7 @@ const region = process.env.AWS_REGION ?? 'us-east-1';
  * Run the local CLI build without skipping install (needed for deploy).
  */
 function runLocalCLI(args: string[], cwd: string): Promise<RunResult> {
-  return runCLI(args, cwd, /* skipInstall */ false);
+  return runCLI(args, cwd, { skipInstall: false });
 }
 
 describe.sequential('e2e: BYO agent with CUSTOM_JWT auth', () => {
diff --git a/e2e-tests/config-bundle-eval-rec.test.ts b/e2e-tests/config-bundle-eval-rec.test.ts
new file mode 100644
index 000000000..fcc95c5c7
--- /dev/null
+++ b/e2e-tests/config-bundle-eval-rec.test.ts
@@ -0,0 +1,633 @@
+/**
+ * E2E tests for Config Bundles, Batch Evaluation, and Recommendations.
+ *
+ * Flow: create project → add config bundle → add evaluator → deploy →
+ *       invoke → test config-bundle CLI → run batch-evaluation → run recommendation
+ *
+ * Prerequisites:
+ *   - AWS credentials
+ *   - npm, git, uv installed
+ */
+import { parseJsonOutput, retry } from '../src/test-utils/index.js';
+import {
+  baseCanRun,
+  hasAws,
+  installCdkTarball,
+  runAgentCoreCLI,
+  teardownE2EProject,
+  writeAwsTargets,
+} from './e2e-helper.js';
+import { randomUUID } from 'node:crypto';
+import { mkdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+const canRun = baseCanRun && hasAws;
+
+describe.sequential('e2e: config bundles, batch evaluation, and recommendations', () => {
+  let testDir: string;
+  let projectPath: string;
+  const agentName = `E2eCbEr${String(Date.now()).slice(-8)}`;
+  const bundleName = 'E2eTestBundle';
+  const evalName = 'E2eCustomEval';
+
+  beforeAll(async () => {
+    if (!canRun) return;
+
+    testDir = join(tmpdir(), `agentcore-e2e-cb-eval-rec-${randomUUID()}`);
+    await mkdir(testDir, { recursive: true });
+
+    // Create project with agent
+    const result = await runAgentCoreCLI(
+      [
+        'create',
+        '--name',
+        agentName,
+        '--language',
+        'Python',
+        '--framework',
+        'Strands',
+        '--model-provider',
+        'Bedrock',
+        '--memory',
+        'none',
+        '--json',
+      ],
+      testDir
+    );
+    expect(result.exitCode, `Create failed: ${result.stderr}`).toBe(0);
+    projectPath = (parseJsonOutput(result.stdout) as { projectPath: string }).projectPath;
+
+    await writeAwsTargets(projectPath);
+    installCdkTarball(projectPath);
+  }, 300000);
+
+  afterAll(async () => {
+    if (projectPath && hasAws) {
+      await teardownE2EProject(projectPath, agentName, 'Bedrock');
+    }
+    if (testDir) await rm(testDir, { recursive: true, force: true, maxRetries: 3, retryDelay: 1000 });
+  }, 600000);
+
+  const run = (args: string[]) => runAgentCoreCLI(args, projectPath);
+
+  // ════════════════════════════════════════════════════════════════════════
+  // Config Bundle — add to project
+  // ════════════════════════════════════════════════════════════════════════
+
+  it.skipIf(!canRun)(
+    'adds a config bundle to the project',
+    async () => {
+      const components = JSON.stringify({
+        [`{{runtime:${agentName}}}`]: {
+          configuration: {
+            systemPrompt: 'You are a helpful e2e test assistant.',
+            temperature: 0.7,
+          },
+        },
+      });
+
+      const result = await run([
+        'add',
+        'config-bundle',
+        '--name',
+        bundleName,
+        '--description',
+        'E2E test config bundle',
+        '--components',
+        components,
+        '--branch',
+        'mainline',
+        '--commit-message',
+        'Initial e2e bundle',
+        '--json',
+      ]);
+
+      expect(result.exitCode, `Add config-bundle failed: ${result.stdout}`).toBe(0);
+      const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+      expect(json.success).toBe(true);
+      expect(json.bundleName).toBe(bundleName);
+    },
+    60000
+  );
+
+  // ════════════════════════════════════════════════════════════════════════
+  // Evaluator — add to project
+  // ════════════════════════════════════════════════════════════════════════
+
+  it.skipIf(!canRun)(
+    'adds a custom evaluator to the project',
+    async () => {
+      const result = await run([
+        'add',
+        'evaluator',
+        '--name',
+        evalName,
+        '--level',
+        'SESSION',
+        '--model',
+        'us.anthropic.claude-sonnet-4-5-20250929-v1:0',
+        '--instructions',
+        'Evaluate the overall quality of this session. Context: {context}',
+        '--json',
+      ]);
+
+      expect(result.exitCode, `Add evaluator failed: ${result.stdout}`).toBe(0);
+      const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+      expect(json.success).toBe(true);
+      expect(json.evaluatorName).toBe(evalName);
+    },
+    60000
+  );
+
+  // ════════════════════════════════════════════════════════════════════════
+  // Deploy
+  // ════════════════════════════════════════════════════════════════════════
+
+  it.skipIf(!canRun)(
+    'deploys the project with config bundle and evaluator',
+    async () => {
+      const result = await run(['deploy', '--yes', '--json']);
+
+      if (result.exitCode !== 0) {
+        console.log('Deploy stdout:', result.stdout);
+        console.log('Deploy stderr:', result.stderr);
+      }
+
+      expect(result.exitCode, 'Deploy failed').toBe(0);
+      const json = parseJsonOutput(result.stdout) as { success: boolean };
+      expect(json.success).toBe(true);
+    },
+    600000
+  );
+
+  // ════════════════════════════════════════════════════════════════════════
+  // Invoke — generate traces for evaluation
+  // ════════════════════════════════════════════════════════════════════════
+
+  it.skipIf(!canRun)(
+    'invokes the deployed agent to generate traces',
+    async () => {
+      await retry(
+        async () => {
+          const result = await run(['invoke', '--prompt', 'Say hello', '--runtime', agentName, '--json']);
+          expect(result.exitCode, `Invoke failed: ${result.stderr}`).toBe(0);
+          const json = parseJsonOutput(result.stdout) as { success: boolean };
+          expect(json.success).toBe(true);
+        },
+        3,
+        15000
+      );
+    },
+    180000
+  );
+
+  // ════════════════════════════════════════════════════════════════════════
+  // Status — verify config bundle and evaluator deployed
+  // ════════════════════════════════════════════════════════════════════════
+
+  it.skipIf(!canRun)(
+    'status shows deployed config bundle and evaluator',
+    async () => {
+      const result = await run(['status', '--json']);
+
+      expect(result.exitCode, `Status failed: ${result.stderr}`).toBe(0);
+      const json = parseJsonOutput(result.stdout) as {
+        success: boolean;
+        resources: { resourceType: string; name: string; deploymentState: string }[];
+      };
+      expect(json.success).toBe(true);
+
+      const bundle = json.resources.find(r => r.resourceType === 'config-bundle' && r.name === bundleName);
+      expect(bundle, `Config bundle "${bundleName}" should appear in status`).toBeDefined();
+
+      const evaluator = json.resources.find(r => r.resourceType === 'evaluator' && r.name === evalName);
+      expect(evaluator, `Evaluator "${evalName}" should appear in status`).toBeDefined();
+    },
+    120000
+  );
+
+  // ════════════════════════════════════════════════════════════════════════
+  // Config Bundle — versions and diff via CLI
+  // ════════════════════════════════════════════════════════════════════════
+
+  let initialVersionId: string;
+
+  it.skipIf(!canRun)(
+    'config-bundle versions lists the deployed version',
+    async () => {
+      const result = await run(['config-bundle', 'versions', '--bundle', bundleName, '--json']);
+
+      expect(result.exitCode, `cb versions failed: ${result.stderr}`).toBe(0);
+      const json = parseJsonOutput(result.stdout) as {
+        versions: { versionId: string; lineageMetadata?: { branchName?: string; commitMessage?: string } }[];
+        bundleName: string;
+      };
+
+      expect(json.bundleName).toBe(bundleName);
+      expect(json.versions.length).toBeGreaterThanOrEqual(1);
+      initialVersionId = json.versions[0]!.versionId;
+      expect(initialVersionId).toBeTruthy();
+    },
+    120000
+  );
+
+  it.skipIf(!canRun)(
+    'config-bundle versions supports --branch filter',
+    async () => {
+      const result = await run(['config-bundle', 'versions', '--bundle', bundleName, '--branch', 'mainline', '--json']);
+
+      expect(result.exitCode, `cb versions --branch failed: ${result.stderr}`).toBe(0);
+      const json = parseJsonOutput(result.stdout) as {
+        versions: { versionId: string; lineageMetadata?: { branchName?: string } }[];
+      };
+
+      for (const v of json.versions) {
+        expect(v.lineageMetadata?.branchName).toBe('mainline');
+      }
+    },
+    120000
+  );
+
+  it.skipIf(!canRun)(
+    'updates config bundle by redeploying with changed components',
+    async () => {
+      // Update the config bundle in agentcore.json with new component values
+      const components = JSON.stringify({
+        [`{{runtime:${agentName}}}`]: {
+          configuration: {
+            systemPrompt: 'You are an UPDATED e2e test assistant.',
+            temperature: 0.9,
+            maxTokens: 2048,
+          },
+        },
+      });
+
+      // Remove old bundle, add new one with same name but different components
+      let result = await run(['remove', 'config-bundle', '--name', bundleName, '--json']);
+      expect(result.exitCode, `Remove config-bundle failed: ${result.stdout}`).toBe(0);
+
+      result = await run([
+        'add',
+        'config-bundle',
+        '--name',
+        bundleName,
+        '--description',
+        'E2E test config bundle - updated',
+        '--components',
+        components,
+        '--branch',
+        'mainline',
+        '--commit-message',
+        'Update system prompt and add maxTokens',
+        '--json',
+      ]);
+      expect(result.exitCode, `Re-add config-bundle failed: ${result.stdout}`).toBe(0);
+
+      // Redeploy to push the updated bundle
+      result = await run(['deploy', '--yes', '--json']);
+      expect(result.exitCode, `Redeploy failed: ${result.stdout}`).toBe(0);
+    },
+    600000
+  );
+
+  it.skipIf(!canRun)(
+    'config-bundle versions shows both versions after update',
+    async () => {
+      const result = await run(['config-bundle', 'versions', '--bundle', bundleName, '--json']);
+
+      expect(result.exitCode, `cb versions failed: ${result.stderr}`).toBe(0);
+      const json = parseJsonOutput(result.stdout) as {
+        versions: { versionId: string }[];
+      };
+
+      expect(json.versions.length).toBeGreaterThanOrEqual(2);
+    },
+    120000
+  );
+
+  it.skipIf(!canRun)(
+    'config-bundle diff shows changes between versions',
+    async () => {
+      // Get the latest two versions
+      const versionsResult = await run(['config-bundle', 'versions', '--bundle', bundleName, '--json']);
+      const versionsJson = parseJsonOutput(versionsResult.stdout) as {
+        versions: { versionId: string }[];
+      };
+
+      expect(versionsJson.versions.length).toBeGreaterThanOrEqual(2);
+      const newestVersion = versionsJson.versions[0]!.versionId;
+      const oldestVersion = versionsJson.versions[versionsJson.versions.length - 1]!.versionId;
+
+      const result = await run([
+        'config-bundle',
+        'diff',
+        '--bundle',
+        bundleName,
+        '--from',
+        oldestVersion,
+        '--to',
+        newestVersion,
+        '--json',
+      ]);
+
+      expect(result.exitCode, `cb diff failed: ${result.stderr}`).toBe(0);
+      const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+      expect(json).toHaveProperty('fromVersion');
+      expect(json).toHaveProperty('toVersion');
+      expect(json.diffs).toBeInstanceOf(Array);
+      expect((json.diffs as unknown[]).length).toBeGreaterThan(0);
+    },
+    120000
+  );
+
+  // ════════════════════════════════════════════════════════════════════════
+  // Batch Evaluation — run through CLI
+  // ════════════════════════════════════════════════════════════════════════
+
+  it.skipIf(!canRun)(
+    'runs batch evaluation with Builtin evaluator via CLI',
+    async () => {
+      await retry(
+        async () => {
+          const result = await run([
+            'run',
+            'batch-evaluation',
+            '--runtime',
+            agentName,
+            '--evaluator',
+            'Builtin.Faithfulness',
+            '--lookback-days',
+            '1',
+            '--json',
+          ]);
+
+          expect(result.exitCode, `batch-evaluation failed (stdout: ${result.stdout}, stderr: ${result.stderr})`).toBe(
+            0
+          );
+          const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+          expect(json).toHaveProperty('success', true);
+          expect(json).toHaveProperty('batchEvaluateId');
+          expect(json.status).toBeDefined();
+          expect(json.status).not.toBe('FAILED');
+        },
+        6,
+        15000
+      );
+    },
+    600000
+  );
+
+  it.skipIf(!canRun)(
+    'runs batch evaluation with ground truth file',
+    async () => {
+      // Invoke to get a real session ID for ground truth
+      const invokeResult = await run(['invoke', '--prompt', 'What is 2+2?', '--runtime', agentName, '--json']);
+      expect(invokeResult.exitCode).toBe(0);
+      const invokeJson = parseJsonOutput(invokeResult.stdout) as { sessionId: string };
+      expect(invokeJson.sessionId).toBeTruthy();
+
+      // Create ground truth file using the real session ID
+      const gtData = [
+        {
+          sessionId: invokeJson.sessionId,
+          groundTruth: {
+            inline: {
+              assertions: [{ text: 'Agent should provide a numerical answer' }],
+            },
+          },
+        },
+      ];
+      const gtPath = join(projectPath, 'ground-truth.json');
+      await writeFile(gtPath, JSON.stringify(gtData));
+
+      await retry(
+        async () => {
+          const result = await run([
+            'run',
+            'batch-evaluation',
+            '--runtime',
+            agentName,
+            '--evaluator',
+            'Builtin.Correctness',
+            '--ground-truth',
+            gtPath,
+            '--lookback-days',
+            '1',
+            '--json',
+          ]);
+
+          expect(result.exitCode, `batch-evaluation with GT failed: ${result.stdout}`).toBe(0);
+          const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+          expect(json).toHaveProperty('success', true);
+        },
+        6,
+        15000
+      );
+    },
+    600000
+  );
+
+  // ════════════════════════════════════════════════════════════════════════
+  // On-demand Eval — run eval via CLI (existing pattern)
+  // ════════════════════════════════════════════════════════════════════════
+
+  it.skipIf(!canRun)(
+    'runs on-demand eval with Builtin evaluator via CLI',
+    async () => {
+      // Retries needed: traces from invoke take time to propagate to CloudWatch
+      await retry(
+        async () => {
+          const result = await run([
+            'run',
+            'eval',
+            '--runtime',
+            agentName,
+            '--evaluator',
+            'Builtin.Faithfulness',
+            '--lookback',
+            '1',
+            '--json',
+          ]);
+
+          expect(result.exitCode, `run eval failed (stdout: ${result.stdout}, stderr: ${result.stderr})`).toBe(0);
+          const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+          expect(json).toHaveProperty('success', true);
+          expect(json).toHaveProperty('run');
+          expect(json).toHaveProperty('filePath');
+        },
+        10,
+        15000
+      );
+    },
+    300000
+  );
+
+  // ════════════════════════════════════════════════════════════════════════
+  // Recommendation — run through CLI
+  // ════════════════════════════════════════════════════════════════════════
+
+  it.skipIf(!canRun)(
+    'runs system prompt recommendation with inline content via CLI',
+    async () => {
+      await retry(
+        async () => {
+          const result = await run([
+            'run',
+            'recommendation',
+            '--runtime',
+            agentName,
+            '--evaluator',
+            'Builtin.Faithfulness',
+            '--inline',
+            'You are a helpful assistant for testing.',
+            '--lookback',
+            '1',
+            '--json',
+          ]);
+
+          expect(result.exitCode, `recommendation failed (stdout: ${result.stdout}, stderr: ${result.stderr})`).toBe(0);
+          const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+          expect(json).toHaveProperty('success', true);
+          expect(json).toHaveProperty('recommendationId');
+          expect(json.result).toBeDefined();
+          expect(json.result).not.toBe('');
+          expect(json.result).not.toBeNull();
+        },
+        6,
+        30000
+      );
+    },
+    600000
+  );
+
+  it.skipIf(!canRun)(
+    'runs system prompt recommendation with prompt file via CLI',
+    async () => {
+      const promptFile = join(projectPath, 'system-prompt.txt');
+      await writeFile(promptFile, 'You are a helpful customer support assistant. Answer politely.');
+
+      await retry(
+        async () => {
+          const result = await run([
+            'run',
+            'recommendation',
+            '--runtime',
+            agentName,
+            '--evaluator',
+            'Builtin.Helpfulness',
+            '--prompt-file',
+            promptFile,
+            '--lookback',
+            '1',
+            '--json',
+          ]);
+
+          expect(result.exitCode, `recommendation from file failed: ${result.stdout}`).toBe(0);
+          const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+          expect(json).toHaveProperty('success', true);
+          expect(json).toHaveProperty('recommendationId');
+        },
+        6,
+        30000
+      );
+    },
+    600000
+  );
+
+  it.skipIf(!canRun)(
+    'runs tool description recommendation via CLI',
+    async () => {
+      await retry(
+        async () => {
+          const result = await run([
+            'run',
+            'recommendation',
+            '--type',
+            'tool-description',
+            '--runtime',
+            agentName,
+            '--tools',
+            'search:Searches the web for information',
+            '--tools',
+            'calculator:Performs mathematical calculations',
+            '--lookback',
+            '1',
+            '--json',
+          ]);
+
+          expect(result.exitCode, `tool-desc recommendation failed: ${result.stdout}`).toBe(0);
+          const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+          expect(json).toHaveProperty('success', true);
+          expect(json).toHaveProperty('recommendationId');
+        },
+        6,
+        30000
+      );
+    },
+    600000
+  );
+
+  it.skipIf(!canRun)(
+    'runs recommendation with config bundle source via CLI',
+    async () => {
+      // Get the latest version ID for the bundle
+      const versionsResult = await run(['config-bundle', 'versions', '--bundle', bundleName, '--json']);
+      const versionsJson = parseJsonOutput(versionsResult.stdout) as {
+        versions: { versionId: string }[];
+      };
+      const latestVersion = versionsJson.versions[0]!.versionId;
+
+      await retry(
+        async () => {
+          const result = await run([
+            'run',
+            'recommendation',
+            '--runtime',
+            agentName,
+            '--evaluator',
+            'Builtin.Faithfulness',
+            '--bundle-name',
+            bundleName,
+            '--bundle-version',
+            latestVersion,
+            '--system-prompt-json-path',
+            'systemPrompt',
+            '--lookback',
+            '1',
+            '--json',
+          ]);
+
+          expect(result.exitCode, `bundle recommendation failed: ${result.stdout}`).toBe(0);
+          const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+          expect(json).toHaveProperty('success', true);
+          expect(json).toHaveProperty('recommendationId');
+        },
+        6,
+        30000
+      );
+    },
+    600000
+  );
+
+  // ════════════════════════════════════════════════════════════════════════
+  // Cleanup — remove config bundle from project
+  // ════════════════════════════════════════════════════════════════════════
+
+  it.skipIf(!canRun)(
+    'removes config bundle from project and redeploys (reconciliation deletes it)',
+    async () => {
+      let result = await run(['remove', 'config-bundle', '--name', bundleName, '--json']);
+      expect(result.exitCode, `Remove config-bundle failed: ${result.stdout}`).toBe(0);
+
+      const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+      expect(json.success).toBe(true);
+
+      // Redeploy triggers reconciliation (orphaned bundle deleted server-side)
+      result = await run(['deploy', '--yes', '--json']);
+      expect(result.exitCode, `Final deploy failed: ${result.stdout}`).toBe(0);
+    },
+    600000
+  );
+});
diff --git a/e2e-tests/fixtures/import/cleanup_resources.py b/e2e-tests/fixtures/import/cleanup_resources.py
index 0728b711e..120ced18f 100644
--- a/e2e-tests/fixtures/import/cleanup_resources.py
+++ b/e2e-tests/fixtures/import/cleanup_resources.py
@@ -51,10 +51,6 @@ def main():
         rid = val.get("id")
         if not rid:
             continue
-        # Gateway targets are deleted automatically when the parent gateway is deleted
-        if "gateway" in key and "target" in key:
-            print(f"Skipping {key} (deleted with parent gateway)")
-            continue
         try:
             if "runtime" in key:
                 client.delete_agent_runtime(agentRuntimeId=rid)
@@ -62,8 +58,6 @@ def main():
                 client.delete_memory(memoryId=rid)
             elif "evaluator" in key:
                 client.delete_evaluator(evaluatorId=rid)
-            elif "gateway" in key:
-                client.delete_gateway(gatewayIdentifier=rid)
             print(f"Deleted {key}: {rid}")
         except Exception as e:
             print(f"Could not delete {key} ({rid}): {e}")
diff --git a/e2e-tests/fixtures/import/common.py b/e2e-tests/fixtures/import/common.py
index 369ec0bb0..3573ed519 100644
--- a/e2e-tests/fixtures/import/common.py
+++ b/e2e-tests/fixtures/import/common.py
@@ -2,15 +2,20 @@
 import json
 import os
 import time
+import uuid
 import zipfile
 import tempfile
 
 import boto3
 
 REGION = os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION") or "us-east-1"
+RESOURCE_SUFFIX = os.environ.get("RESOURCE_SUFFIX", "")
+# Unique suffix for resource names — avoids collisions across parallel CI shards.
+NAME_SUFFIX = RESOURCE_SUFFIX or uuid.uuid4().hex[:12]
 SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
 APP_DIR = os.path.join(SCRIPT_DIR, "app")
-RESOURCES_FILE = os.path.join(SCRIPT_DIR, "bugbash-resources.json")
+_resources_name = f"bugbash-resources-{RESOURCE_SUFFIX}.json" if RESOURCE_SUFFIX else "bugbash-resources.json"
+RESOURCES_FILE = os.path.join(SCRIPT_DIR, _resources_name)
 INLINE_POLICY_NAME = "bugbash-agentcore-permissions"
 
 
@@ -35,6 +40,8 @@ def upload_code(prefix="bugbash"):
     """Zip APP_DIR and upload to S3. Returns (bucket, s3_key)."""
     bucket_name = get_code_bucket()
     s3 = boto3.client("s3", region_name=REGION)
+    if RESOURCE_SUFFIX:
+        prefix = f"{prefix}-{RESOURCE_SUFFIX}"
 
     # Create zip of app directory
     with tempfile.NamedTemporaryFile(suffix=".zip", delete=False) as tmp:
diff --git a/e2e-tests/fixtures/import/setup_evaluator.py b/e2e-tests/fixtures/import/setup_evaluator.py
index d49787d0e..e4573da45 100644
--- a/e2e-tests/fixtures/import/setup_evaluator.py
+++ b/e2e-tests/fixtures/import/setup_evaluator.py
@@ -8,10 +8,10 @@
 import os
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 
-import time
 from common import (
     get_control_client, save_resource, tag_resource,
     wait_for_evaluator, print_import_command,
+    NAME_SUFFIX,
 )
 
 DEFAULT_EVALUATOR_MODEL = os.environ.get("DEFAULT_EVALUATOR_MODEL", "us.anthropic.claude-sonnet-4-5-20250929-v1:0")
@@ -19,8 +19,7 @@
 
 def main():
     client = get_control_client()
-    ts = int(time.time())
-    evaluator_name = f"bugbash_eval_{ts}"
+    evaluator_name = f"bugbash_eval_{NAME_SUFFIX}"
 
     print(f"Creating evaluator: {evaluator_name}")
     resp = client.create_evaluator(
diff --git a/e2e-tests/fixtures/import/setup_gateway.py b/e2e-tests/fixtures/import/setup_gateway.py
index e190d0dfc..a846617aa 100644
--- a/e2e-tests/fixtures/import/setup_gateway.py
+++ b/e2e-tests/fixtures/import/setup_gateway.py
@@ -12,18 +12,17 @@
 import os
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 
-import time
 from common import (
     REGION, get_control_client, ensure_role, save_resource,
     tag_resource, wait_for_gateway, wait_for_gateway_target,
+    NAME_SUFFIX,
 )
 
 
 def main():
     role_arn = ensure_role()
     client = get_control_client()
-    ts = int(time.time())
-    gateway_name = f"bugbashGw{ts}"
+    gateway_name = f"bugbashGw{NAME_SUFFIX}"
 
     # ------------------------------------------------------------------
     # 1. Create gateway
diff --git a/e2e-tests/fixtures/import/setup_memory_full.py b/e2e-tests/fixtures/import/setup_memory_full.py
index 5df196524..277179cfb 100644
--- a/e2e-tests/fixtures/import/setup_memory_full.py
+++ b/e2e-tests/fixtures/import/setup_memory_full.py
@@ -8,22 +8,22 @@
 import os
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 
-import time
 from common import (
     ensure_role, get_control_client, wait_for_memory,
     save_resource, print_import_command, tag_resource,
+    NAME_SUFFIX,
 )
 
 
 def main():
     role_arn = ensure_role()
     client = get_control_client()
-    memory_name = f"bugbash_memory_{int(time.time())}"
+    memory_name = f"bugbash_memory_{NAME_SUFFIX}"
 
     print(f"Creating memory: {memory_name}")
     resp = client.create_memory(
         name=memory_name,
-        clientToken=f"bugbash-{int(time.time())}",
+        clientToken=f"bugbash-{NAME_SUFFIX}",
         eventExpiryDuration=30,
         memoryExecutionRoleArn=role_arn,
         memoryStrategies=[
diff --git a/e2e-tests/fixtures/import/setup_runtime_basic.py b/e2e-tests/fixtures/import/setup_runtime_basic.py
index 65e1585a1..d29ddbd1c 100644
--- a/e2e-tests/fixtures/import/setup_runtime_basic.py
+++ b/e2e-tests/fixtures/import/setup_runtime_basic.py
@@ -7,20 +7,19 @@
 import os
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 
-import time
 from common import (
     ensure_role, get_control_client, wait_for_runtime,
     save_resource, print_import_command, upload_code,
+    NAME_SUFFIX,
 )
 
 
 def main():
     role_arn = ensure_role()
     client = get_control_client()
-    ts = int(time.time())
-    runtime_name = f"bugbash_basic_{ts}"
+    runtime_name = f"bugbash_basic_{NAME_SUFFIX}"
 
-    bucket, s3_key = upload_code(f"bugbash-basic-{ts}")
+    bucket, s3_key = upload_code(f"bugbash-basic-{NAME_SUFFIX}")
 
     print(f"Creating basic runtime: {runtime_name}")
     resp = client.create_agent_runtime(
diff --git a/e2e-tests/harness-bedrock.test.ts b/e2e-tests/harness-bedrock.test.ts
new file mode 100644
index 000000000..7b53e18bb
--- /dev/null
+++ b/e2e-tests/harness-bedrock.test.ts
@@ -0,0 +1,3 @@
+import { createHarnessE2ESuite } from './harness-e2e-helper.js';
+
+createHarnessE2ESuite({ modelProvider: 'bedrock' });
diff --git a/e2e-tests/harness-e2e-helper.ts b/e2e-tests/harness-e2e-helper.ts
new file mode 100644
index 000000000..ca29ae4f3
--- /dev/null
+++ b/e2e-tests/harness-e2e-helper.ts
@@ -0,0 +1,163 @@
+import { hasAwsCredentials, parseJsonOutput, prereqs, retry, spawnAndCollect } from '../src/test-utils/index.js';
+import {
+  cleanupStaleCredentialProviders,
+  installCdkTarball,
+  runAgentCoreCLI,
+  teardownE2EProject,
+  writeAwsTargets,
+} from './e2e-helper.js';
+import { randomUUID } from 'node:crypto';
+import { mkdir, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+const hasAws = hasAwsCredentials();
+const baseCanRun = prereqs.npm && prereqs.git && hasAws;
+
+interface HarnessE2EConfig {
+  modelProvider: 'bedrock' | 'open_ai' | 'gemini';
+  requiredEnvVar?: string;
+  skipMemory?: boolean;
+}
+
+export function createHarnessE2ESuite(cfg: HarnessE2EConfig) {
+  const hasRequiredVar = !cfg.requiredEnvVar || !!process.env[cfg.requiredEnvVar];
+  const canRun = baseCanRun && hasRequiredVar;
+
+  const providerLabel =
+    cfg.modelProvider === 'open_ai' ? 'OpenAI' : cfg.modelProvider === 'gemini' ? 'Gemini' : 'Bedrock';
+
+  describe.sequential(`e2e: harness/${providerLabel} — create → deploy → invoke`, () => {
+    let testDir: string;
+    let projectPath: string;
+    let harnessName: string;
+
+    beforeAll(async () => {
+      if (!canRun) return;
+
+      await cleanupStaleCredentialProviders();
+
+      testDir = join(tmpdir(), `agentcore-e2e-harness-${randomUUID()}`);
+      await mkdir(testDir, { recursive: true });
+
+      const providerSlug = cfg.modelProvider.replace('_', '').slice(0, 4);
+      harnessName = `E2eHrns${providerSlug}${String(Date.now()).slice(-8)}`;
+
+      const createArgs = [
+        'create',
+        '--name',
+        harnessName,
+        '--model-provider',
+        cfg.modelProvider,
+        '--json',
+        '--skip-git',
+      ];
+
+      if (cfg.requiredEnvVar && process.env[cfg.requiredEnvVar]) {
+        createArgs.push('--api-key-arn', process.env[cfg.requiredEnvVar]!);
+      }
+
+      if (cfg.skipMemory) {
+        createArgs.push('--no-harness-memory');
+      }
+
+      const result = await runAgentCoreCLI(createArgs, testDir);
+
+      expect(result.exitCode, `Create failed: ${result.stderr}`).toBe(0);
+      const json = parseJsonOutput(result.stdout) as { projectPath: string };
+      projectPath = json.projectPath;
+
+      await writeAwsTargets(projectPath);
+      installCdkTarball(projectPath);
+    }, 300000);
+
+    afterAll(async () => {
+      if (projectPath && hasAws) {
+        await teardownE2EProject(projectPath, harnessName, cfg.modelProvider);
+      }
+      if (testDir) await rm(testDir, { recursive: true, force: true, maxRetries: 3, retryDelay: 1000 });
+    }, 600000);
+
+    it.skipIf(!canRun)(
+      'deploys to AWS successfully',
+      async () => {
+        expect(projectPath, 'Project should have been created').toBeTruthy();
+
+        await retry(
+          async () => {
+            const result = await runAgentCoreCLI(['deploy', '--yes', '--json'], projectPath);
+
+            if (result.exitCode !== 0) {
+              console.log('Deploy stdout:', result.stdout);
+              console.log('Deploy stderr:', result.stderr);
+            }
+
+            expect(result.exitCode, `Deploy failed (stderr: ${result.stderr}, stdout: ${result.stdout})`).toBe(0);
+
+            const json = parseJsonOutput(result.stdout) as { success: boolean };
+            expect(json.success, 'Deploy should report success').toBe(true);
+          },
+          1,
+          30000
+        );
+      },
+      600000
+    );
+
+    it.skipIf(!canRun)(
+      'invokes the deployed harness',
+      async () => {
+        expect(projectPath, 'Project should have been created').toBeTruthy();
+
+        await retry(
+          async () => {
+            const result = await runAgentCoreCLI(
+              ['invoke', '--harness', harnessName, '--prompt', 'Say hello', '--json'],
+              projectPath
+            );
+
+            if (result.exitCode !== 0) {
+              console.log('Invoke stdout:', result.stdout);
+              console.log('Invoke stderr:', result.stderr);
+            }
+
+            expect(result.exitCode, `Invoke failed: ${result.stderr}`).toBe(0);
+
+            const json = parseJsonOutput(result.stdout) as { success: boolean };
+            expect(json.success, 'Invoke should report success').toBe(true);
+          },
+          3,
+          15000
+        );
+      },
+      180000
+    );
+
+    it.skipIf(!canRun)(
+      'status shows the deployed harness',
+      async () => {
+        const statusResult = await spawnAndCollect('agentcore', ['status', '--json'], projectPath);
+
+        expect(statusResult.exitCode, `Status failed: ${statusResult.stderr}`).toBe(0);
+
+        const json = parseJsonOutput(statusResult.stdout) as {
+          success: boolean;
+          resources: {
+            resourceType: string;
+            name: string;
+            deploymentState: string;
+            identifier?: string;
+          }[];
+        };
+        expect(json.success).toBe(true);
+
+        const harness = json.resources.find(r => r.resourceType === 'harness' && r.name === harnessName);
+        expect(harness, `Harness "${harnessName}" should appear in status`).toBeDefined();
+        expect(harness!.deploymentState).toBe('deployed');
+        expect(harness!.identifier, 'Deployed harness should have a harnessArn').toBeTruthy();
+      },
+      120000
+    );
+  });
+}
diff --git a/e2e-tests/harness-gemini.test.ts b/e2e-tests/harness-gemini.test.ts
new file mode 100644
index 000000000..8fd024147
--- /dev/null
+++ b/e2e-tests/harness-gemini.test.ts
@@ -0,0 +1,3 @@
+import { createHarnessE2ESuite } from './harness-e2e-helper.js';
+
+createHarnessE2ESuite({ modelProvider: 'gemini', requiredEnvVar: 'GEMINI_API_KEY_ARN', skipMemory: true });
diff --git a/e2e-tests/harness-openai.test.ts b/e2e-tests/harness-openai.test.ts
new file mode 100644
index 000000000..bdb9c3772
--- /dev/null
+++ b/e2e-tests/harness-openai.test.ts
@@ -0,0 +1,3 @@
+import { createHarnessE2ESuite } from './harness-e2e-helper.js';
+
+createHarnessE2ESuite({ modelProvider: 'open_ai', requiredEnvVar: 'OPENAI_API_KEY_ARN', skipMemory: true });
diff --git a/e2e-tests/http-gateway-targets.test.ts b/e2e-tests/http-gateway-targets.test.ts
new file mode 100644
index 000000000..c2bef22fb
--- /dev/null
+++ b/e2e-tests/http-gateway-targets.test.ts
@@ -0,0 +1,228 @@
+import { parseJsonOutput, retry } from '../src/test-utils/index.js';
+import {
+  baseCanRun,
+  hasAws,
+  installCdkTarball,
+  runAgentCoreCLI,
+  teardownE2EProject,
+  writeAwsTargets,
+} from './e2e-helper.js';
+import { randomUUID } from 'node:crypto';
+import { mkdir, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+const canRun = baseCanRun && hasAws;
+
+describe.sequential('e2e: HTTP gateway with targets lifecycle', () => {
+  let testDir: string;
+  let projectPath: string;
+  const agentName = `E2eGwTgt${String(Date.now()).slice(-8)}`;
+  const gatewayName = 'e2e-target-gw';
+
+  beforeAll(async () => {
+    if (!canRun) return;
+
+    testDir = join(tmpdir(), `agentcore-e2e-gw-targets-${randomUUID()}`);
+    await mkdir(testDir, { recursive: true });
+
+    const result = await runAgentCoreCLI(
+      [
+        'create',
+        '--name',
+        agentName,
+        '--language',
+        'Python',
+        '--framework',
+        'Strands',
+        '--model-provider',
+        'Bedrock',
+        '--memory',
+        'none',
+        '--json',
+      ],
+      testDir
+    );
+    expect(result.exitCode, `Create failed: ${result.stderr}`).toBe(0);
+    projectPath = (parseJsonOutput(result.stdout) as { projectPath: string }).projectPath;
+
+    await writeAwsTargets(projectPath);
+    installCdkTarball(projectPath);
+  }, 300000);
+
+  afterAll(async () => {
+    if (projectPath && hasAws) {
+      await teardownE2EProject(projectPath, agentName, 'Bedrock');
+    }
+    if (testDir) await rm(testDir, { recursive: true, force: true, maxRetries: 3, retryDelay: 1000 });
+  }, 600000);
+
+  const run = (args: string[]) => runAgentCoreCLI(args, projectPath);
+
+  it.skipIf(!canRun)(
+    'adds runtime endpoints (prod, staging)',
+    async () => {
+      let result = await run([
+        'add',
+        'runtime-endpoint',
+        '--runtime',
+        agentName,
+        '--endpoint',
+        'prod',
+        '--version',
+        '1',
+        '--json',
+      ]);
+      expect(result.exitCode, `Add prod endpoint failed: ${result.stdout}`).toBe(0);
+
+      result = await run([
+        'add',
+        'runtime-endpoint',
+        '--runtime',
+        agentName,
+        '--endpoint',
+        'staging',
+        '--version',
+        '1',
+        '--json',
+      ]);
+      expect(result.exitCode, `Add staging endpoint failed: ${result.stdout}`).toBe(0);
+    },
+    60000
+  );
+
+  it.skipIf(!canRun)(
+    'adds HTTP gateway with name',
+    async () => {
+      const result = await run(['add', 'gateway', '--name', gatewayName, '--json']);
+      expect(result.exitCode, `Add gateway failed: ${result.stdout}`).toBe(0);
+      const json = parseJsonOutput(result.stdout) as { success: boolean };
+      expect(json.success).toBe(true);
+    },
+    60000
+  );
+
+  it.skipIf(!canRun)(
+    'adds gateway targets for prod and staging endpoints',
+    async () => {
+      let result = await run([
+        'add',
+        'gateway-target',
+        '--name',
+        `${agentName}-prod`,
+        '--type',
+        'mcp-server',
+        '--endpoint',
+        'https://placeholder-prod.example.com',
+        '--gateway',
+        gatewayName,
+        '--json',
+      ]);
+      expect(result.exitCode, `Add prod target failed: ${result.stdout}`).toBe(0);
+
+      result = await run([
+        'add',
+        'gateway-target',
+        '--name',
+        `${agentName}-staging`,
+        '--type',
+        'mcp-server',
+        '--endpoint',
+        'https://placeholder-staging.example.com',
+        '--gateway',
+        gatewayName,
+        '--json',
+      ]);
+      expect(result.exitCode, `Add staging target failed: ${result.stdout}`).toBe(0);
+    },
+    60000
+  );
+
+  it.skipIf(!canRun)(
+    'deploys project with gateway and targets',
+    async () => {
+      await retry(
+        async () => {
+          const result = await run(['deploy', '--yes', '--json']);
+          if (result.exitCode !== 0) {
+            console.log('Deploy stdout:', result.stdout);
+            console.log('Deploy stderr:', result.stderr);
+          }
+          expect(result.exitCode, `Deploy failed (stderr: ${result.stderr})`).toBe(0);
+          const json = parseJsonOutput(result.stdout) as { success: boolean };
+          expect(json.success).toBe(true);
+        },
+        2,
+        30000
+      );
+    },
+    600000
+  );
+
+  it.skipIf(!canRun)(
+    'status shows gateway deployed',
+    async () => {
+      await retry(
+        async () => {
+          const result = await run(['status', '--json']);
+          expect(result.exitCode, `Status failed: ${result.stderr}`).toBe(0);
+
+          const json = parseJsonOutput(result.stdout) as {
+            success: boolean;
+            resources: { resourceType: string; name: string; deploymentState: string; identifier?: string }[];
+          };
+          expect(json.success).toBe(true);
+
+          // Agent should be deployed
+          const agent = json.resources.find(r => r.resourceType === 'agent' && r.name === agentName);
+          expect(agent, `Agent "${agentName}" should appear in status`).toBeDefined();
+          expect(agent!.deploymentState).toBe('deployed');
+        },
+        3,
+        15000
+      );
+    },
+    120000
+  );
+
+  it.skipIf(!canRun)(
+    'invokes the deployed agent directly',
+    async () => {
+      await retry(
+        async () => {
+          const result = await run(['invoke', '--prompt', 'Say hello', '--runtime', agentName, '--json']);
+          expect(result.exitCode, `Invoke failed: ${result.stderr}`).toBe(0);
+          const json = parseJsonOutput(result.stdout) as { success: boolean };
+          expect(json.success).toBe(true);
+        },
+        3,
+        15000
+      );
+    },
+    180000
+  );
+
+  it.skipIf(!canRun)(
+    'removes gateway targets',
+    async () => {
+      let result = await run(['remove', 'gateway-target', '--name', `${agentName}-prod`, '--json']);
+      expect(result.exitCode, `Remove prod target failed: ${result.stderr}`).toBe(0);
+
+      result = await run(['remove', 'gateway-target', '--name', `${agentName}-staging`, '--json']);
+      expect(result.exitCode, `Remove staging target failed: ${result.stderr}`).toBe(0);
+    },
+    60000
+  );
+
+  it.skipIf(!canRun)(
+    'removes gateway',
+    async () => {
+      const result = await run(['remove', 'gateway', '--name', gatewayName, '--json']);
+      expect(result.exitCode, `Remove gateway failed: ${result.stderr}`).toBe(0);
+      const json = parseJsonOutput(result.stdout) as { success: boolean };
+      expect(json.success).toBe(true);
+    },
+    60000
+  );
+});
diff --git a/e2e-tests/import-gateway.test.ts b/e2e-tests/import-gateway.test.ts
index 2aea04f02..fd80ae967 100644
--- a/e2e-tests/import-gateway.test.ts
+++ b/e2e-tests/import-gateway.test.ts
@@ -43,6 +43,7 @@ describe.sequential('e2e: import gateway', () => {
 
     const result = await spawnAndCollect('uv', ['run', '--with', 'boto3', 'python3', 'setup_gateway.py'], fixtureDir, {
       AWS_REGION: region,
+      RESOURCE_SUFFIX: suffix,
     });
     if (result.exitCode !== 0) {
       throw new Error(
@@ -50,7 +51,7 @@ describe.sequential('e2e: import gateway', () => {
       );
     }
 
-    const resourcesPath = join(fixtureDir, 'bugbash-resources.json');
+    const resourcesPath = join(fixtureDir, `bugbash-resources-${suffix}.json`);
     const resources = JSON.parse(await readFile(resourcesPath, 'utf-8')) as Record<string, { arn: string; id: string }>;
     gatewayArn = resources.gateway!.arn;
 
@@ -80,6 +81,7 @@ describe.sequential('e2e: import gateway', () => {
     try {
       await spawnAndCollect('uv', ['run', '--with', 'boto3', 'python3', 'cleanup_resources.py'], fixtureDir, {
         AWS_REGION: region,
+        RESOURCE_SUFFIX: suffix,
       });
     } catch {
       /* ignore — resources may already be deleted by CFN teardown */
diff --git a/e2e-tests/import-resources.test.ts b/e2e-tests/import-resources.test.ts
index d51cbffac..72d9c253a 100644
--- a/e2e-tests/import-resources.test.ts
+++ b/e2e-tests/import-resources.test.ts
@@ -54,6 +54,7 @@ describe.sequential('e2e: import runtime/memory/evaluator', () => {
       const result = await spawnAndCollect('uv', ['run', '--with', 'boto3', 'python3', script], fixtureDir, {
         AWS_REGION: region,
         DEFAULT_EVALUATOR_MODEL,
+        RESOURCE_SUFFIX: suffix,
       });
       if (result.exitCode !== 0) {
         throw new Error(
@@ -63,7 +64,7 @@ describe.sequential('e2e: import runtime/memory/evaluator', () => {
     }
 
     // 2. Read resource ARNs from bugbash-resources.json
-    const resourcesPath = join(fixtureDir, 'bugbash-resources.json');
+    const resourcesPath = join(fixtureDir, `bugbash-resources-${suffix}.json`);
     const resources = JSON.parse(await readFile(resourcesPath, 'utf-8')) as Record<string, { arn: string; id: string }>;
     runtimeArn = resources['runtime-basic']!.arn;
     memoryArn = resources['memory-full']!.arn;
@@ -102,6 +103,7 @@ describe.sequential('e2e: import runtime/memory/evaluator', () => {
     try {
       await spawnAndCollect('uv', ['run', '--with', 'boto3', 'python3', 'cleanup_resources.py'], fixtureDir, {
         AWS_REGION: region,
+        RESOURCE_SUFFIX: suffix,
       });
     } catch {
       /* ignore — resources may already be deleted by CFN teardown */
diff --git a/esbuild.config.mjs b/esbuild.config.mjs
index 91e557270..2cbd5b81f 100644
--- a/esbuild.config.mjs
+++ b/esbuild.config.mjs
@@ -51,7 +51,7 @@ await esbuild.build({
   jsx: 'automatic',
   // Inject require shim for ESM compatibility with CommonJS dependencies
   banner: {
-    js: `import { createRequire } from 'module'; const require = createRequire(import.meta.url);`,
+    js: `import { createRequire } from 'module'; import { fileURLToPath as __ef } from 'url'; import { dirname as __ed } from 'path'; const require = createRequire(import.meta.url); const __filename = __ef(import.meta.url); const __dirname = __ed(__filename);`,
   },
   external: ['fsevents', '@aws-cdk/toolkit-lib'],
   plugins: [optionalDepsPlugin, textLoaderPlugin],
diff --git a/integ-tests/add-remove-ab-test-target-based.test.ts b/integ-tests/add-remove-ab-test-target-based.test.ts
new file mode 100644
index 000000000..8a77b1f06
--- /dev/null
+++ b/integ-tests/add-remove-ab-test-target-based.test.ts
@@ -0,0 +1,461 @@
+import {
+  type TestProject,
+  createTestProject,
+  parseJsonOutput,
+  readProjectConfig,
+  runCLI,
+} from '../src/test-utils/index.js';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+async function runSuccess(args: string[], cwd: string) {
+  const result = await runCLI(args, cwd);
+  expect(result.exitCode, `stdout: ${result.stdout}, stderr: ${result.stderr}`).toBe(0);
+  const json: unknown = parseJsonOutput(result.stdout);
+  expect(json).toHaveProperty('success', true);
+  return json as Record<string, unknown>;
+}
+
+async function runFailure(args: string[], cwd: string) {
+  const result = await runCLI(args, cwd);
+  expect(result.exitCode).toBe(1);
+  const json: unknown = parseJsonOutput(result.stdout);
+  expect(json).toHaveProperty('success', false);
+  expect(json).toHaveProperty('error');
+  return json as Record<string, unknown>;
+}
+
+describe('integration: add and remove target-based ab-test', () => {
+  let project: TestProject;
+  const gatewayName = 'my-test-gw';
+
+  beforeAll(async () => {
+    project = await createTestProject({
+      name: 'TargetABTest',
+      language: 'Python',
+      framework: 'Strands',
+      modelProvider: 'Bedrock',
+      memory: 'none',
+    });
+
+    // Add runtime endpoints (prod and staging) for the agent
+    await runSuccess(
+      ['add', 'runtime-endpoint', '--runtime', project.agentName, '--endpoint', 'prod', '--version', '1', '--json'],
+      project.projectPath
+    );
+    await runSuccess(
+      ['add', 'runtime-endpoint', '--runtime', project.agentName, '--endpoint', 'staging', '--version', '1', '--json'],
+      project.projectPath
+    );
+
+    // Add an evaluator and two online eval configs (one per variant)
+    await runSuccess(
+      [
+        'add',
+        'evaluator',
+        '--name',
+        'TestEval',
+        '--level',
+        'SESSION',
+        '--model',
+        'us.anthropic.claude-sonnet-4-5-20250929-v1:0',
+        '--instructions',
+        'Evaluate quality. Context: {context}',
+        '--json',
+      ],
+      project.projectPath
+    );
+    await runSuccess(
+      [
+        'add',
+        'online-eval',
+        '--name',
+        'ControlEval',
+        '--runtime',
+        project.agentName,
+        '--evaluator',
+        'TestEval',
+        '--sampling-rate',
+        '100',
+        '--endpoint',
+        'prod',
+        '--json',
+      ],
+      project.projectPath
+    );
+    await runSuccess(
+      [
+        'add',
+        'online-eval',
+        '--name',
+        'TreatmentEval',
+        '--runtime',
+        project.agentName,
+        '--evaluator',
+        'TestEval',
+        '--sampling-rate',
+        '100',
+        '--endpoint',
+        'staging',
+        '--json',
+      ],
+      project.projectPath
+    );
+  }, 120000);
+
+  afterAll(async () => {
+    await project.cleanup();
+  });
+
+  it('adds target-based AB test with --control-endpoint and --treatment-endpoint', async () => {
+    const json = await runSuccess(
+      [
+        'add',
+        'ab-test',
+        '--mode',
+        'target-based',
+        '--name',
+        'TargetTest1',
+        '--runtime',
+        project.agentName,
+        '--gateway',
+        gatewayName,
+        '--control-endpoint',
+        'prod',
+        '--treatment-endpoint',
+        'staging',
+        '--control-weight',
+        '90',
+        '--treatment-weight',
+        '10',
+        '--control-online-eval',
+        'ControlEval',
+        '--treatment-online-eval',
+        'TreatmentEval',
+        '--json',
+      ],
+      project.projectPath
+    );
+
+    expect(json.abTestName).toBe('TargetTest1');
+
+    // Verify agentcore.json has correct mode, targets, gateway auto-created
+    const spec = await readProjectConfig(project.projectPath);
+    const abTest = spec.abTests?.find((t: { name: string }) => t.name === 'TargetTest1');
+    expect(abTest).toBeDefined();
+    expect(abTest!.mode).toBe('target-based');
+    expect(abTest!.variants).toHaveLength(2);
+    expect(abTest!.variants[0]!.name).toBe('C');
+    expect(abTest!.variants[0]!.weight).toBe(90);
+    expect(abTest!.variants[0]!.variantConfiguration.target).toBeDefined();
+    expect(abTest!.variants[0]!.variantConfiguration.target!.targetName).toBe(`${project.agentName}-prod`);
+    expect(abTest!.variants[1]!.name).toBe('T1');
+    expect(abTest!.variants[1]!.weight).toBe(10);
+    expect(abTest!.variants[1]!.variantConfiguration.target!.targetName).toBe(`${project.agentName}-staging`);
+    expect(abTest!.gatewayRef).toBe(`{{gateway:${gatewayName}}}`);
+
+    // Verify gateway was auto-created with targets
+    const gw = spec.httpGateways?.find((g: { name: string }) => g.name === gatewayName);
+    expect(gw, 'HTTP gateway should have been auto-created').toBeDefined();
+    expect(gw!.targets).toBeDefined();
+    expect(gw!.targets!.length).toBeGreaterThanOrEqual(2);
+
+    const controlTarget = gw!.targets!.find((t: { name: string }) => t.name === `${project.agentName}-prod`);
+    expect(controlTarget).toBeDefined();
+    expect(controlTarget!.qualifier).toBe('prod');
+
+    const treatmentTarget = gw!.targets!.find((t: { name: string }) => t.name === `${project.agentName}-staging`);
+    expect(treatmentTarget).toBeDefined();
+    expect(treatmentTarget!.qualifier).toBe('staging');
+
+    // Verify per-variant evaluation config
+    const evalConfig = abTest!.evaluationConfig;
+    expect('perVariantOnlineEvaluationConfig' in evalConfig).toBe(true);
+    if ('perVariantOnlineEvaluationConfig' in evalConfig) {
+      expect(evalConfig.perVariantOnlineEvaluationConfig).toHaveLength(2);
+      const controlEval = evalConfig.perVariantOnlineEvaluationConfig.find(
+        (p: { treatmentName: string }) => p.treatmentName === 'C'
+      );
+      expect(controlEval?.onlineEvaluationConfigArn).toBe('ControlEval');
+      const treatmentEval = evalConfig.perVariantOnlineEvaluationConfig.find(
+        (p: { treatmentName: string }) => p.treatmentName === 'T1'
+      );
+      expect(treatmentEval?.onlineEvaluationConfigArn).toBe('TreatmentEval');
+    }
+  });
+
+  it('adds target-based AB test with existing gateway', async () => {
+    // TargetTest1 already created the gateway — reuse it
+    const json = await runSuccess(
+      [
+        'add',
+        'ab-test',
+        '--mode',
+        'target-based',
+        '--name',
+        'TargetTest2',
+        '--runtime',
+        project.agentName,
+        '--gateway',
+        gatewayName,
+        '--control-endpoint',
+        'prod',
+        '--treatment-endpoint',
+        'staging',
+        '--control-weight',
+        '50',
+        '--treatment-weight',
+        '50',
+        '--control-online-eval',
+        'ControlEval',
+        '--treatment-online-eval',
+        'TreatmentEval',
+        '--json',
+      ],
+      project.projectPath
+    );
+
+    expect(json.abTestName).toBe('TargetTest2');
+
+    const spec = await readProjectConfig(project.projectPath);
+    // Gateway should still exist (reused, not duplicated)
+    const gateways = spec.httpGateways?.filter((g: { name: string }) => g.name === gatewayName);
+    expect(gateways).toHaveLength(1);
+  });
+
+  it('rejects duplicate AB test name', async () => {
+    const json = await runFailure(
+      [
+        'add',
+        'ab-test',
+        '--mode',
+        'target-based',
+        '--name',
+        'TargetTest1',
+        '--runtime',
+        project.agentName,
+        '--gateway',
+        gatewayName,
+        '--control-endpoint',
+        'prod',
+        '--treatment-endpoint',
+        'staging',
+        '--control-weight',
+        '50',
+        '--treatment-weight',
+        '50',
+        '--control-online-eval',
+        'ControlEval',
+        '--treatment-online-eval',
+        'TreatmentEval',
+        '--json',
+      ],
+      project.projectPath
+    );
+
+    expect(json.error).toContain('already exists');
+  });
+
+  it('rejects weights that do not sum to 100', async () => {
+    const json = await runFailure(
+      [
+        'add',
+        'ab-test',
+        '--mode',
+        'target-based',
+        '--name',
+        'BadWeights',
+        '--runtime',
+        project.agentName,
+        '--gateway',
+        gatewayName,
+        '--control-endpoint',
+        'prod',
+        '--treatment-endpoint',
+        'staging',
+        '--control-weight',
+        '80',
+        '--treatment-weight',
+        '80',
+        '--control-online-eval',
+        'ControlEval',
+        '--treatment-online-eval',
+        'TreatmentEval',
+        '--json',
+      ],
+      project.projectPath
+    );
+
+    expect(json.error).toBeDefined();
+  });
+
+  it('errors when --control-endpoint is missing in target-based mode', async () => {
+    const json = await runFailure(
+      [
+        'add',
+        'ab-test',
+        '--mode',
+        'target-based',
+        '--name',
+        'MissingControl',
+        '--runtime',
+        project.agentName,
+        '--gateway',
+        gatewayName,
+        '--treatment-endpoint',
+        'staging',
+        '--control-weight',
+        '50',
+        '--treatment-weight',
+        '50',
+        '--control-online-eval',
+        'ControlEval',
+        '--treatment-online-eval',
+        'TreatmentEval',
+        '--json',
+      ],
+      project.projectPath
+    );
+
+    expect(json.error).toContain('--control-endpoint');
+  });
+
+  it('errors when --runtime is missing in target-based mode', async () => {
+    const json = await runFailure(
+      [
+        'add',
+        'ab-test',
+        '--mode',
+        'target-based',
+        '--name',
+        'MissingRuntime',
+        '--gateway',
+        gatewayName,
+        '--control-endpoint',
+        'prod',
+        '--treatment-endpoint',
+        'staging',
+        '--control-weight',
+        '50',
+        '--treatment-weight',
+        '50',
+        '--control-online-eval',
+        'ControlEval',
+        '--treatment-online-eval',
+        'TreatmentEval',
+        '--json',
+      ],
+      project.projectPath
+    );
+
+    expect(json.error).toContain('--runtime');
+  });
+
+  it('errors when endpoint does not exist on runtime', async () => {
+    const json = await runFailure(
+      [
+        'add',
+        'ab-test',
+        '--mode',
+        'target-based',
+        '--name',
+        'BadEndpoint',
+        '--runtime',
+        project.agentName,
+        '--gateway',
+        gatewayName,
+        '--control-endpoint',
+        'nonexistent',
+        '--treatment-endpoint',
+        'staging',
+        '--control-weight',
+        '50',
+        '--treatment-weight',
+        '50',
+        '--control-online-eval',
+        'ControlEval',
+        '--treatment-online-eval',
+        'TreatmentEval',
+        '--json',
+      ],
+      project.projectPath
+    );
+
+    expect(json.error).toContain('nonexistent');
+  });
+
+  it('deprecated --control-qualifier still works as alias for --control-endpoint', async () => {
+    const json = await runSuccess(
+      [
+        'add',
+        'ab-test',
+        '--mode',
+        'target-based',
+        '--name',
+        'QualifierAlias',
+        '--runtime',
+        project.agentName,
+        '--gateway',
+        gatewayName,
+        '--control-qualifier',
+        'prod',
+        '--treatment-qualifier',
+        'staging',
+        '--control-weight',
+        '60',
+        '--treatment-weight',
+        '40',
+        '--control-online-eval',
+        'ControlEval',
+        '--treatment-online-eval',
+        'TreatmentEval',
+        '--json',
+      ],
+      project.projectPath
+    );
+
+    expect(json.abTestName).toBe('QualifierAlias');
+
+    const spec = await readProjectConfig(project.projectPath);
+    const abTest = spec.abTests?.find((t: { name: string }) => t.name === 'QualifierAlias');
+    expect(abTest).toBeDefined();
+    expect(abTest!.mode).toBe('target-based');
+    expect(abTest!.variants[0]!.variantConfiguration.target!.targetName).toBe(`${project.agentName}-prod`);
+    expect(abTest!.variants[1]!.variantConfiguration.target!.targetName).toBe(`${project.agentName}-staging`);
+  });
+
+  it('removes target-based AB test without --delete-gateway', async () => {
+    const json = await runSuccess(['remove', 'ab-test', '--name', 'TargetTest2', '--json'], project.projectPath);
+    expect(json.success).toBe(true);
+
+    // Verify removal from agentcore.json
+    const spec = await readProjectConfig(project.projectPath);
+    const abTest = spec.abTests?.find((t: { name: string }) => t.name === 'TargetTest2');
+    expect(abTest).toBeUndefined();
+
+    // Gateway should still exist (other AB tests reference it)
+    const gw = spec.httpGateways?.find((g: { name: string }) => g.name === gatewayName);
+    expect(gw, 'Gateway should still exist when other AB tests reference it').toBeDefined();
+  });
+
+  it('removes target-based AB test with --delete-gateway flag', async () => {
+    // First remove QualifierAlias so only TargetTest1 is left referencing the gateway
+    await runSuccess(['remove', 'ab-test', '--name', 'QualifierAlias', '--json'], project.projectPath);
+
+    // Now remove TargetTest1 with --delete-gateway
+    const json = await runSuccess(
+      ['remove', 'ab-test', '--name', 'TargetTest1', '--delete-gateway', '--json'],
+      project.projectPath
+    );
+    expect(json.success).toBe(true);
+
+    // Verify gateway was also removed (no other AB tests reference it)
+    const spec = await readProjectConfig(project.projectPath);
+    const gw = spec.httpGateways?.find((g: { name: string }) => g.name === gatewayName);
+    expect(gw, 'Gateway should be removed with --delete-gateway when no other AB tests reference it').toBeUndefined();
+  });
+
+  it('remove returns error for non-existent test', async () => {
+    const json = await runFailure(['remove', 'ab-test', '--name', 'DoesNotExist', '--json'], project.projectPath);
+    expect(json.error).toContain('not found');
+  });
+});
diff --git a/integ-tests/add-remove-ab-test.test.ts b/integ-tests/add-remove-ab-test.test.ts
new file mode 100644
index 000000000..551c86010
--- /dev/null
+++ b/integ-tests/add-remove-ab-test.test.ts
@@ -0,0 +1,170 @@
+import {
+  type TestProject,
+  createTestProject,
+  parseJsonOutput,
+  readProjectConfig,
+  runCLI,
+} from '../src/test-utils/index.js';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+async function runSuccess(args: string[], cwd: string) {
+  const result = await runCLI(args, cwd);
+  expect(result.exitCode, `stdout: ${result.stdout}, stderr: ${result.stderr}`).toBe(0);
+  const json: unknown = parseJsonOutput(result.stdout);
+  expect(json).toHaveProperty('success', true);
+  return json as Record<string, unknown>;
+}
+
+async function runFailure(args: string[], cwd: string) {
+  const result = await runCLI(args, cwd);
+  expect(result.exitCode).toBe(1);
+  const json: unknown = parseJsonOutput(result.stdout);
+  expect(json).toHaveProperty('success', false);
+  expect(json).toHaveProperty('error');
+  return json as Record<string, unknown>;
+}
+
+describe('integration: add and remove ab-test', () => {
+  let project: TestProject;
+
+  beforeAll(async () => {
+    project = await createTestProject({
+      language: 'Python',
+      framework: 'Strands',
+      modelProvider: 'Bedrock',
+      memory: 'none',
+    });
+  });
+
+  afterAll(async () => {
+    await project.cleanup();
+  });
+
+  it('requires --name for JSON mode', async () => {
+    const json = await runFailure(['add', 'ab-test', '--json'], project.projectPath);
+    expect(json.error).toContain('--name');
+  });
+
+  it('requires --runtime when --name is provided', async () => {
+    const json = await runFailure(['add', 'ab-test', '--name', 'Test1', '--json'], project.projectPath);
+    expect(json.error).toContain('--runtime');
+  });
+
+  it('adds ab-test with all required flags', async () => {
+    const json = await runSuccess(
+      [
+        'add',
+        'ab-test',
+        '--name',
+        'MyIntegTest',
+        '--runtime',
+        project.agentName,
+        '--control-bundle',
+        'arn:bundle:control',
+        '--control-version',
+        'v1',
+        '--treatment-bundle',
+        'arn:bundle:treatment',
+        '--treatment-version',
+        'v1',
+        '--control-weight',
+        '80',
+        '--treatment-weight',
+        '20',
+        '--online-eval',
+        'arn:eval:config',
+        '--json',
+      ],
+      project.projectPath
+    );
+
+    expect(json.abTestName).toBe('MyIntegTest');
+
+    // Verify it's in agentcore.json with correct structure
+    const spec = await readProjectConfig(project.projectPath);
+    const abTest = spec.abTests?.find((t: { name: string }) => t.name === 'MyIntegTest');
+    expect(abTest).toBeDefined();
+    expect(abTest!.variants).toHaveLength(2);
+    expect(abTest!.variants[0]!.name).toBe('C');
+    expect(abTest!.variants[0]!.weight).toBe(80);
+    expect(abTest!.variants[1]!.name).toBe('T1');
+    expect(abTest!.variants[1]!.weight).toBe(20);
+  });
+
+  it('rejects duplicate AB test name', async () => {
+    const json = await runFailure(
+      [
+        'add',
+        'ab-test',
+        '--name',
+        'MyIntegTest',
+        '--runtime',
+        project.agentName,
+        '--control-bundle',
+        'arn:cb',
+        '--control-version',
+        'v1',
+        '--treatment-bundle',
+        'arn:tb',
+        '--treatment-version',
+        'v1',
+        '--control-weight',
+        '50',
+        '--treatment-weight',
+        '50',
+        '--online-eval',
+        'arn:eval',
+        '--json',
+      ],
+      project.projectPath
+    );
+
+    expect(json.error).toContain('already exists');
+  });
+
+  it('rejects weights that do not sum to 100', async () => {
+    const json = await runFailure(
+      [
+        'add',
+        'ab-test',
+        '--name',
+        'BadWeights',
+        '--runtime',
+        project.agentName,
+        '--control-bundle',
+        'arn:cb',
+        '--control-version',
+        'v1',
+        '--treatment-bundle',
+        'arn:tb',
+        '--treatment-version',
+        'v1',
+        '--control-weight',
+        '80',
+        '--treatment-weight',
+        '80',
+        '--online-eval',
+        'arn:eval',
+        '--json',
+      ],
+      project.projectPath
+    );
+
+    expect(json.error).toBeDefined();
+  });
+
+  it('removes ab-test', async () => {
+    const json = await runSuccess(['remove', 'ab-test', '--name', 'MyIntegTest', '--json'], project.projectPath);
+    expect(json.success).toBe(true);
+
+    // Verify removal from agentcore.json
+    const spec = await readProjectConfig(project.projectPath);
+    const abTest = spec.abTests?.find((t: { name: string }) => t.name === 'MyIntegTest');
+    expect(abTest).toBeUndefined();
+  });
+
+  it('remove returns error for non-existent test', async () => {
+    const json = await runFailure(['remove', 'ab-test', '--name', 'DoesNotExist', '--json'], project.projectPath);
+    expect(json.error).toContain('not found');
+  });
+});
diff --git a/integ-tests/add-remove-config-bundle.test.ts b/integ-tests/add-remove-config-bundle.test.ts
new file mode 100644
index 000000000..bd53e7f31
--- /dev/null
+++ b/integ-tests/add-remove-config-bundle.test.ts
@@ -0,0 +1,312 @@
+import {
+  type TestProject,
+  createTestProject,
+  parseJsonOutput,
+  readProjectConfig,
+  runCLI,
+  runFailure,
+  runSuccess,
+} from '../src/test-utils/index.js';
+import { writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+describe('integration: add and remove config-bundle', () => {
+  let project: TestProject;
+
+  beforeAll(async () => {
+    project = await createTestProject({ noAgent: true });
+  });
+
+  afterAll(async () => {
+    await project.cleanup();
+  });
+
+  // ── Add lifecycle ─────────────────────────────────────────────────────
+
+  describe('add config-bundle', () => {
+    it('adds a config bundle with inline --components', async () => {
+      const components = JSON.stringify({
+        'arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/rt-abc': {
+          configuration: { systemPrompt: 'You are a helpful assistant.' },
+        },
+      });
+
+      const json = await runSuccess(
+        ['add', 'config-bundle', '--name', 'InlineBundle', '--components', components, '--json'],
+        project.projectPath
+      );
+
+      expect(json.bundleName).toBe('InlineBundle');
+
+      const config = await readProjectConfig(project.projectPath);
+      const bundle = config.configBundles!.find(b => b.name === 'InlineBundle');
+      expect(bundle).toBeDefined();
+      expect(bundle!.type).toBe('ConfigurationBundle');
+      expect(bundle!.branchName).toBe('mainline');
+      expect(Object.keys(bundle!.components)).toHaveLength(1);
+    });
+
+    it('adds a config bundle with --components-file', async () => {
+      const componentsData = {
+        'arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/rt-def': {
+          configuration: { temperature: 0.7, maxTokens: 1024 },
+        },
+        'arn:aws:bedrock-agentcore:us-east-1:123456789012:gateway/gw-xyz': {
+          configuration: { rateLimit: 100 },
+        },
+      };
+
+      const filePath = join(project.projectPath, 'test-components.json');
+      await writeFile(filePath, JSON.stringify(componentsData));
+
+      const json = await runSuccess(
+        ['add', 'config-bundle', '--name', 'FileBundle', '--components-file', filePath, '--json'],
+        project.projectPath
+      );
+
+      expect(json.bundleName).toBe('FileBundle');
+
+      const config = await readProjectConfig(project.projectPath);
+      const bundle = config.configBundles!.find(b => b.name === 'FileBundle');
+      expect(bundle).toBeDefined();
+      expect(Object.keys(bundle!.components)).toHaveLength(2);
+    });
+
+    it('adds a config bundle with optional description, branch, and commit message', async () => {
+      const components = JSON.stringify({
+        '{{runtime:MyAgent}}': {
+          configuration: { systemPrompt: 'Placeholder-based bundle' },
+        },
+      });
+
+      const json = await runSuccess(
+        [
+          'add',
+          'config-bundle',
+          '--name',
+          'FullOptsBundle',
+          '--description',
+          'A bundle with all optional fields',
+          '--components',
+          components,
+          '--branch',
+          'feature-branch',
+          '--commit-message',
+          'initial config',
+          '--json',
+        ],
+        project.projectPath
+      );
+
+      expect(json.bundleName).toBe('FullOptsBundle');
+
+      const config = await readProjectConfig(project.projectPath);
+      const bundle = config.configBundles!.find(b => b.name === 'FullOptsBundle');
+      expect(bundle).toBeDefined();
+      expect(bundle!.description).toBe('A bundle with all optional fields');
+      expect(bundle!.branchName).toBe('feature-branch');
+      expect(bundle!.commitMessage).toBe('initial config');
+    });
+
+    it('adds a config bundle with placeholder component keys', async () => {
+      const components = JSON.stringify({
+        '{{runtime:AgentA}}': {
+          configuration: { systemPrompt: 'Runtime placeholder' },
+        },
+        '{{gateway:GatewayB}}': {
+          configuration: { rateLimitPerSecond: 50 },
+        },
+      });
+
+      const json = await runSuccess(
+        ['add', 'config-bundle', '--name', 'PlaceholderBundle', '--components', components, '--json'],
+        project.projectPath
+      );
+
+      expect(json.bundleName).toBe('PlaceholderBundle');
+
+      const config = await readProjectConfig(project.projectPath);
+      const bundle = config.configBundles!.find(b => b.name === 'PlaceholderBundle');
+      expect(bundle).toBeDefined();
+      const keys = Object.keys(bundle!.components);
+      expect(keys).toContain('{{runtime:AgentA}}');
+      expect(keys).toContain('{{gateway:GatewayB}}');
+    });
+  });
+
+  // ── Validation / error cases ──────────────────────────────────────────
+
+  describe('validation errors', () => {
+    it('rejects duplicate config bundle name', async () => {
+      const components = JSON.stringify({
+        'arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/rt-dup': {
+          configuration: { foo: 'bar' },
+        },
+      });
+
+      const json = await runFailure(
+        ['add', 'config-bundle', '--name', 'InlineBundle', '--components', components, '--json'],
+        project.projectPath
+      );
+
+      expect(json.error).toContain('already exists');
+    });
+
+    it('requires --name in non-interactive (JSON) mode', async () => {
+      const result = await runCLI(
+        ['add', 'config-bundle', '--components', '{"arn:test": {"configuration": {}}}', '--json'],
+        project.projectPath
+      );
+
+      expect(result.exitCode).toBe(1);
+      const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+      expect(json.success).toBe(false);
+      expect(json.error).toContain('--name');
+    });
+
+    it('requires --components or --components-file when --name is provided', async () => {
+      const json = await runFailure(['add', 'config-bundle', '--name', 'NoComponents', '--json'], project.projectPath);
+
+      expect(json.error).toContain('--components');
+    });
+
+    it('rejects invalid JSON in --components', async () => {
+      const result = await runCLI(
+        ['add', 'config-bundle', '--name', 'BadJson', '--components', '{not valid json}', '--json'],
+        project.projectPath
+      );
+
+      expect(result.exitCode).toBe(1);
+    });
+
+    it('rejects --components-file with non-existent file', async () => {
+      const result = await runCLI(
+        [
+          'add',
+          'config-bundle',
+          '--name',
+          'MissingFile',
+          '--components-file',
+          '/tmp/does-not-exist-xyz.json',
+          '--json',
+        ],
+        project.projectPath
+      );
+
+      expect(result.exitCode).toBe(1);
+    });
+
+    it('rejects bundle name with invalid characters', async () => {
+      const components = JSON.stringify({
+        'arn:test': { configuration: {} },
+      });
+
+      const json = await runFailure(
+        ['add', 'config-bundle', '--name', 'invalid-name!', '--components', components, '--json'],
+        project.projectPath
+      );
+
+      expect(json.error).toBeDefined();
+    });
+
+    it('rejects bundle name starting with a number', async () => {
+      const components = JSON.stringify({
+        'arn:test': { configuration: {} },
+      });
+
+      const json = await runFailure(
+        ['add', 'config-bundle', '--name', '1BadName', '--components', components, '--json'],
+        project.projectPath
+      );
+
+      expect(json.error).toBeDefined();
+    });
+  });
+
+  // ── Remove lifecycle ──────────────────────────────────────────────────
+
+  describe('remove config-bundle', () => {
+    it('removes an existing config bundle', async () => {
+      const json = await runSuccess(
+        ['remove', 'config-bundle', '--name', 'InlineBundle', '--json'],
+        project.projectPath
+      );
+
+      expect(json.success).toBe(true);
+
+      const config = await readProjectConfig(project.projectPath);
+      const bundle = config.configBundles!.find(b => b.name === 'InlineBundle');
+      expect(bundle).toBeUndefined();
+    });
+
+    it('returns error for non-existent bundle', async () => {
+      const json = await runFailure(
+        ['remove', 'config-bundle', '--name', 'DoesNotExist', '--json'],
+        project.projectPath
+      );
+
+      expect(json.error).toContain('not found');
+    });
+
+    it('removes all remaining config bundles one by one', async () => {
+      const configBefore = await readProjectConfig(project.projectPath);
+      const remaining = configBefore.configBundles!.map(b => b.name);
+
+      for (const name of remaining) {
+        await runSuccess(['remove', 'config-bundle', '--name', name, '--json'], project.projectPath);
+      }
+
+      const configAfter = await readProjectConfig(project.projectPath);
+      expect(configAfter.configBundles!).toHaveLength(0);
+    });
+  });
+
+  // ── Multiple bundles coexistence ──────────────────────────────────────
+
+  describe('multiple bundles coexistence', () => {
+    const bundleNames = ['BundleAlpha', 'BundleBeta', 'BundleGamma'];
+
+    it('can add multiple config bundles to the same project', async () => {
+      for (const name of bundleNames) {
+        const components = JSON.stringify({
+          [`arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/${name}`]: {
+            configuration: { bundleId: name },
+          },
+        });
+
+        await runSuccess(
+          ['add', 'config-bundle', '--name', name, '--components', components, '--json'],
+          project.projectPath
+        );
+      }
+
+      const config = await readProjectConfig(project.projectPath);
+      expect(config.configBundles!).toHaveLength(bundleNames.length);
+
+      for (const name of bundleNames) {
+        expect(config.configBundles!.find(b => b.name === name)).toBeDefined();
+      }
+    });
+
+    it('removing one bundle does not affect others', async () => {
+      await runSuccess(['remove', 'config-bundle', '--name', 'BundleBeta', '--json'], project.projectPath);
+
+      const config = await readProjectConfig(project.projectPath);
+      expect(config.configBundles!).toHaveLength(2);
+      expect(config.configBundles!.find(b => b.name === 'BundleAlpha')).toBeDefined();
+      expect(config.configBundles!.find(b => b.name === 'BundleGamma')).toBeDefined();
+      expect(config.configBundles!.find(b => b.name === 'BundleBeta')).toBeUndefined();
+    });
+
+    afterAll(async () => {
+      for (const name of bundleNames) {
+        try {
+          await runCLI(['remove', 'config-bundle', '--name', name, '--json'], project.projectPath);
+        } catch {
+          // already removed
+        }
+      }
+    });
+  });
+});
diff --git a/integ-tests/add-remove-harness.test.ts b/integ-tests/add-remove-harness.test.ts
new file mode 100644
index 000000000..2f69270db
--- /dev/null
+++ b/integ-tests/add-remove-harness.test.ts
@@ -0,0 +1,204 @@
+import { createTestProject, exists, readProjectConfig, runCLI } from '../src/test-utils/index.js';
+import type { TestProject } from '../src/test-utils/index.js';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+async function readHarnessSpec(projectPath: string, harnessName: string) {
+  return JSON.parse(await readFile(join(projectPath, `app/${harnessName}/harness.json`), 'utf-8'));
+}
+
+describe('integration: harness add/remove lifecycle', () => {
+  let project: TestProject;
+  const harnessName = 'TestHarness';
+
+  beforeAll(async () => {
+    project = await createTestProject({ noAgent: true });
+  });
+
+  afterAll(async () => {
+    await project.cleanup();
+  });
+
+  it('adds a harness with defaults', async () => {
+    const result = await runCLI(['add', 'harness', '--name', harnessName, '--json'], project.projectPath);
+
+    expect(result.exitCode, `stdout: ${result.stdout}, stderr: ${result.stderr}`).toBe(0);
+    const json = JSON.parse(result.stdout);
+    expect(json.success).toBe(true);
+
+    const config = await readProjectConfig(project.projectPath);
+    const harness = config.harnesses?.find((h: { name: string }) => h.name === harnessName);
+    expect(harness, `Harness "${harnessName}" should be in agentcore.json`).toBeTruthy();
+    expect(harness!.path).toBe(`app/${harnessName}`);
+  });
+
+  it('creates harness.json with correct model config', async () => {
+    const spec = await readHarnessSpec(project.projectPath, harnessName);
+    expect(spec.model).toBeDefined();
+    expect(spec.model.provider).toBe('bedrock');
+    expect(spec.model.modelId).toBeTruthy();
+  });
+
+  it('creates system-prompt.md', async () => {
+    const promptPath = join(project.projectPath, `app/${harnessName}/system-prompt.md`);
+    expect(await exists(promptPath), 'system-prompt.md should exist').toBe(true);
+  });
+
+  it('auto-creates memory resource', async () => {
+    const config = await readProjectConfig(project.projectPath);
+    const memories = config.memories ?? [];
+    expect(memories.length, 'Should have auto-created memory').toBeGreaterThan(0);
+  });
+
+  it('rejects duplicate harness name', async () => {
+    const result = await runCLI(['add', 'harness', '--name', harnessName, '--json'], project.projectPath);
+    expect(result.exitCode).not.toBe(0);
+  });
+
+  it('removes the harness', async () => {
+    const result = await runCLI(['remove', 'harness', '--name', harnessName, '--json'], project.projectPath);
+
+    expect(result.exitCode, `stdout: ${result.stdout}, stderr: ${result.stderr}`).toBe(0);
+    const json = JSON.parse(result.stdout);
+    expect(json.success).toBe(true);
+
+    const config = await readProjectConfig(project.projectPath);
+    const found = config.harnesses?.find((h: { name: string }) => h.name === harnessName);
+    expect(found, `Harness "${harnessName}" should be removed`).toBeFalsy();
+  });
+});
+
+describe('integration: harness configuration options', () => {
+  let project: TestProject;
+
+  beforeAll(async () => {
+    project = await createTestProject({ noAgent: true });
+  });
+
+  afterAll(async () => {
+    await project.cleanup();
+  });
+
+  it('adds harness with truncation strategy', async () => {
+    const name = 'TruncHarness';
+    const result = await runCLI(
+      ['add', 'harness', '--name', name, '--truncation-strategy', 'sliding_window', '--json'],
+      project.projectPath
+    );
+
+    expect(result.exitCode, `stdout: ${result.stdout}, stderr: ${result.stderr}`).toBe(0);
+
+    const spec = await readHarnessSpec(project.projectPath, name);
+    expect(spec.truncation?.strategy).toBe('sliding_window');
+  });
+
+  it('adds harness with lifecycle config', async () => {
+    const name = 'LifecycleHarness';
+    const result = await runCLI(
+      ['add', 'harness', '--name', name, '--idle-timeout', '300', '--max-lifetime', '3600', '--json'],
+      project.projectPath
+    );
+
+    expect(result.exitCode, `stdout: ${result.stdout}, stderr: ${result.stderr}`).toBe(0);
+
+    const spec = await readHarnessSpec(project.projectPath, name);
+    expect(spec.lifecycleConfig?.idleRuntimeSessionTimeout).toBe(300);
+    expect(spec.lifecycleConfig?.maxLifetime).toBe(3600);
+  });
+
+  it('adds harness without memory when --no-memory is set', async () => {
+    const name = 'NoMemHarness';
+    const configBefore = await readProjectConfig(project.projectPath);
+    const memoriesBefore = (configBefore.memories ?? []).length;
+
+    const result = await runCLI(['add', 'harness', '--name', name, '--no-memory', '--json'], project.projectPath);
+
+    expect(result.exitCode, `stdout: ${result.stdout}, stderr: ${result.stderr}`).toBe(0);
+
+    const configAfter = await readProjectConfig(project.projectPath);
+    const memoriesAfter = (configAfter.memories ?? []).length;
+    expect(memoriesAfter).toBe(memoriesBefore);
+  });
+
+  it('adds harness with non-bedrock model provider', async () => {
+    const name = 'OpenAIHarness';
+    const result = await runCLI(
+      [
+        'add',
+        'harness',
+        '--name',
+        name,
+        '--model-provider',
+        'open_ai',
+        '--model-id',
+        'gpt-5',
+        '--api-key-arn',
+        'arn:aws:secretsmanager:us-east-1:123456789012:secret:openai-key',
+        '--json',
+      ],
+      project.projectPath
+    );
+
+    expect(result.exitCode, `stdout: ${result.stdout}, stderr: ${result.stderr}`).toBe(0);
+
+    const spec = await readHarnessSpec(project.projectPath, name);
+    expect(spec.model.provider).toBe('open_ai');
+    expect(spec.model.modelId).toBe('gpt-5');
+    expect(spec.model.apiKeyArn).toBe('arn:aws:secretsmanager:us-east-1:123456789012:secret:openai-key');
+  });
+});
+
+describe('integration: harness validation errors', () => {
+  let project: TestProject;
+
+  beforeAll(async () => {
+    project = await createTestProject({ noAgent: true });
+  });
+
+  afterAll(async () => {
+    await project.cleanup();
+  });
+
+  it('rejects invalid harness name with special characters', async () => {
+    const result = await runCLI(['add', 'harness', '--name', 'bad-name!', '--json'], project.projectPath);
+    expect(result.exitCode).not.toBe(0);
+  });
+
+  it('rejects harness name starting with a number', async () => {
+    const result = await runCLI(['add', 'harness', '--name', '1BadName', '--json'], project.projectPath);
+    expect(result.exitCode).not.toBe(0);
+  });
+
+  it('rejects add harness without --name when --json is passed', async () => {
+    const result = await runCLI(['add', 'harness', '--json'], project.projectPath);
+    expect(result.exitCode).not.toBe(0);
+  });
+});
+
+describe('integration: create project with harness', () => {
+  let project: TestProject;
+  const harnessName = 'CreateHarness';
+
+  beforeAll(async () => {
+    project = await createTestProject({ name: harnessName, noAgent: true });
+    await runCLI(['add', 'harness', '--name', harnessName, '--json'], project.projectPath);
+  });
+
+  afterAll(async () => {
+    await project.cleanup();
+  });
+
+  it('has correct project scaffolding', async () => {
+    expect(await exists(join(project.projectPath, 'agentcore/agentcore.json'))).toBe(true);
+    expect(await exists(join(project.projectPath, 'agentcore/cdk'))).toBe(true);
+    expect(await exists(join(project.projectPath, `app/${harnessName}/harness.json`))).toBe(true);
+    expect(await exists(join(project.projectPath, `app/${harnessName}/system-prompt.md`))).toBe(true);
+  });
+
+  it('has harness registered in project config', async () => {
+    const config = await readProjectConfig(project.projectPath);
+    const harness = config.harnesses?.find((h: { name: string }) => h.name === harnessName);
+    expect(harness).toBeTruthy();
+  });
+});
diff --git a/integ-tests/add-remove-online-eval-endpoint.test.ts b/integ-tests/add-remove-online-eval-endpoint.test.ts
new file mode 100644
index 000000000..cb2a614c8
--- /dev/null
+++ b/integ-tests/add-remove-online-eval-endpoint.test.ts
@@ -0,0 +1,199 @@
+import {
+  type TestProject,
+  createTestProject,
+  parseJsonOutput,
+  readProjectConfig,
+  runCLI,
+} from '../src/test-utils/index.js';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+async function runSuccess(args: string[], cwd: string) {
+  const result = await runCLI(args, cwd);
+  expect(result.exitCode, `stdout: ${result.stdout}, stderr: ${result.stderr}`).toBe(0);
+  const json: unknown = parseJsonOutput(result.stdout);
+  expect(json).toHaveProperty('success', true);
+  return json as Record<string, unknown>;
+}
+
+async function runFailure(args: string[], cwd: string) {
+  const result = await runCLI(args, cwd);
+  expect(result.exitCode).toBe(1);
+  const json: unknown = parseJsonOutput(result.stdout);
+  expect(json).toHaveProperty('success', false);
+  expect(json).toHaveProperty('error');
+  return json as Record<string, unknown>;
+}
+
+describe('integration: add and remove online-eval with endpoint', () => {
+  let project: TestProject;
+
+  beforeAll(async () => {
+    project = await createTestProject({
+      name: 'OnlineEvalEP',
+      language: 'Python',
+      framework: 'Strands',
+      modelProvider: 'Bedrock',
+      memory: 'none',
+    });
+
+    // Add runtime endpoints (prod and staging) for the agent
+    await runSuccess(
+      ['add', 'runtime-endpoint', '--runtime', project.agentName, '--endpoint', 'prod', '--version', '1', '--json'],
+      project.projectPath
+    );
+    await runSuccess(
+      ['add', 'runtime-endpoint', '--runtime', project.agentName, '--endpoint', 'staging', '--version', '1', '--json'],
+      project.projectPath
+    );
+
+    // Add an evaluator to reference in online eval configs
+    await runSuccess(
+      [
+        'add',
+        'evaluator',
+        '--name',
+        'QualityEval',
+        '--level',
+        'SESSION',
+        '--model',
+        'us.anthropic.claude-sonnet-4-5-20250929-v1:0',
+        '--instructions',
+        'Evaluate quality. Context: {context}',
+        '--json',
+      ],
+      project.projectPath
+    );
+  }, 120000);
+
+  afterAll(async () => {
+    await project.cleanup();
+  });
+
+  it('adds online eval with --endpoint prod', async () => {
+    const json = await runSuccess(
+      [
+        'add',
+        'online-eval',
+        '--name',
+        'ProdEval',
+        '--runtime',
+        project.agentName,
+        '--evaluator',
+        'QualityEval',
+        '--sampling-rate',
+        '100',
+        '--endpoint',
+        'prod',
+        '--json',
+      ],
+      project.projectPath
+    );
+
+    expect(json.configName).toBe('ProdEval');
+
+    // Verify agentcore.json has endpoint field
+    const spec = await readProjectConfig(project.projectPath);
+    const evalConfig = spec.onlineEvalConfigs?.find((c: { name: string }) => c.name === 'ProdEval');
+    expect(evalConfig).toBeDefined();
+    expect(evalConfig!.endpoint).toBe('prod');
+    expect(evalConfig!.agent).toBe(project.agentName);
+    expect(evalConfig!.evaluators).toContain('QualityEval');
+    expect(evalConfig!.samplingRate).toBe(100);
+  });
+
+  it('adds online eval with --endpoint staging', async () => {
+    const json = await runSuccess(
+      [
+        'add',
+        'online-eval',
+        '--name',
+        'StagingEval',
+        '--runtime',
+        project.agentName,
+        '--evaluator',
+        'QualityEval',
+        '--sampling-rate',
+        '50',
+        '--endpoint',
+        'staging',
+        '--json',
+      ],
+      project.projectPath
+    );
+
+    expect(json.configName).toBe('StagingEval');
+
+    const spec = await readProjectConfig(project.projectPath);
+    const evalConfig = spec.onlineEvalConfigs?.find((c: { name: string }) => c.name === 'StagingEval');
+    expect(evalConfig).toBeDefined();
+    expect(evalConfig!.endpoint).toBe('staging');
+  });
+
+  it('adds online eval without --endpoint (no endpoint field in config)', async () => {
+    const json = await runSuccess(
+      [
+        'add',
+        'online-eval',
+        '--name',
+        'NoEndpointEval',
+        '--runtime',
+        project.agentName,
+        '--evaluator',
+        'QualityEval',
+        '--sampling-rate',
+        '100',
+        '--json',
+      ],
+      project.projectPath
+    );
+
+    expect(json.configName).toBe('NoEndpointEval');
+
+    const spec = await readProjectConfig(project.projectPath);
+    const evalConfig = spec.onlineEvalConfigs?.find((c: { name: string }) => c.name === 'NoEndpointEval');
+    expect(evalConfig).toBeDefined();
+    expect(evalConfig!.endpoint).toBeUndefined();
+  });
+
+  it('errors when endpoint does not exist on runtime', async () => {
+    const json = await runFailure(
+      [
+        'add',
+        'online-eval',
+        '--name',
+        'BadEndpointEval',
+        '--runtime',
+        project.agentName,
+        '--evaluator',
+        'QualityEval',
+        '--sampling-rate',
+        '100',
+        '--endpoint',
+        'nonexistent',
+        '--json',
+      ],
+      project.projectPath
+    );
+
+    expect(json.error).toContain('nonexistent');
+  });
+
+  it('removes online eval config', async () => {
+    const json = await runSuccess(['remove', 'online-eval', '--name', 'ProdEval', '--json'], project.projectPath);
+    expect(json.success).toBe(true);
+
+    // Verify removal from agentcore.json
+    const spec = await readProjectConfig(project.projectPath);
+    const evalConfig = spec.onlineEvalConfigs?.find((c: { name: string }) => c.name === 'ProdEval');
+    expect(evalConfig).toBeUndefined();
+
+    // Other eval configs should remain
+    const stagingEval = spec.onlineEvalConfigs?.find((c: { name: string }) => c.name === 'StagingEval');
+    expect(stagingEval).toBeDefined();
+  });
+
+  it('remove returns error for non-existent online eval', async () => {
+    const json = await runFailure(['remove', 'online-eval', '--name', 'DoesNotExist', '--json'], project.projectPath);
+    expect(json.error).toContain('not found');
+  });
+});
diff --git a/integ-tests/add-remove-resources.test.ts b/integ-tests/add-remove-resources.test.ts
index 57dd48483..a89c761dd 100644
--- a/integ-tests/add-remove-resources.test.ts
+++ b/integ-tests/add-remove-resources.test.ts
@@ -1,7 +1,10 @@
 import { createTestProject, readProjectConfig, runCLI } from '../src/test-utils/index.js';
 import type { TestProject } from '../src/test-utils/index.js';
+import { createTelemetryHelper } from '../src/test-utils/telemetry-helper.js';
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 
+const telemetry = createTelemetryHelper();
+
 describe('integration: add and remove resources', () => {
   let project: TestProject;
 
@@ -16,13 +19,16 @@ describe('integration: add and remove resources', () => {
 
   afterAll(async () => {
     await project.cleanup();
+    telemetry.destroy();
   });
 
   describe('memory lifecycle', () => {
     const memoryName = `IntegMem${Date.now().toString().slice(-6)}`;
 
     it('adds a memory resource', async () => {
-      const result = await runCLI(['add', 'memory', '--name', memoryName, '--json'], project.projectPath);
+      const result = await runCLI(['add', 'memory', '--name', memoryName, '--json'], project.projectPath, {
+        env: telemetry.env,
+      });
 
       expect(result.exitCode, `stdout: ${result.stdout}, stderr: ${result.stderr}`).toBe(0);
       const json = JSON.parse(result.stdout);
@@ -34,13 +40,17 @@ describe('integration: add and remove resources', () => {
       expect(memories, 'memories should exist').toBeDefined();
       const found = memories!.some((m: Record<string, unknown>) => m.name === memoryName);
       expect(found, `Memory "${memoryName}" should be in config`).toBe(true);
+
+      // Verify telemetry
+      telemetry.assertMetricEmitted({ command: 'add.memory', exit_reason: 'success' });
     });
 
     it('adds a memory with EPISODIC strategy and verifies reflectionNamespaces', async () => {
       const episodicMemName = `EpiMem${Date.now().toString().slice(-6)}`;
       const result = await runCLI(
         ['add', 'memory', '--name', episodicMemName, '--strategies', 'EPISODIC', '--json'],
-        project.projectPath
+        project.projectPath,
+        { env: telemetry.env }
       );
 
       expect(result.exitCode, `stdout: ${result.stdout}, stderr: ${result.stderr}`).toBe(0);
@@ -61,6 +71,14 @@ describe('integration: add and remove resources', () => {
       expect(episodic!.reflectionNamespaces, 'Should have reflectionNamespaces').toBeDefined();
       expect(episodic!.reflectionNamespaces!.length).toBeGreaterThan(0);
 
+      // Verify telemetry
+      telemetry.assertMetricEmitted({
+        command: 'add.memory',
+        exit_reason: 'success',
+        strategy_count: '1',
+        strategy_episodic: 'true',
+      });
+
       // Clean up
       await runCLI(['remove', 'memory', '--name', episodicMemName, '--json'], project.projectPath);
     });
@@ -86,7 +104,8 @@ describe('integration: add and remove resources', () => {
     it('adds a credential resource', async () => {
       const result = await runCLI(
         ['add', 'credential', '--name', credentialName, '--api-key', 'test-key-integ-123', '--json'],
-        project.projectPath
+        project.projectPath,
+        { env: telemetry.env }
       );
 
       expect(result.exitCode, `stdout: ${result.stdout}, stderr: ${result.stderr}`).toBe(0);
@@ -99,6 +118,13 @@ describe('integration: add and remove resources', () => {
       expect(credentials, 'credentials should exist').toBeDefined();
       const found = credentials!.some((c: Record<string, unknown>) => c.name === credentialName);
       expect(found, `Credential "${credentialName}" should be in config`).toBe(true);
+
+      // Verify telemetry
+      telemetry.assertMetricEmitted({
+        command: 'add.credential',
+        exit_reason: 'success',
+        credential_type: 'api-key',
+      });
     });
 
     it('removes the credential resource', async () => {
@@ -115,4 +141,30 @@ describe('integration: add and remove resources', () => {
       expect(found, `Credential "${credentialName}" should be removed from config`).toBe(false);
     });
   });
+
+  describe('policy-engine', () => {
+    const engineName = `TestEngine${Date.now().toString().slice(-6)}`;
+
+    it('adds a policy engine resource', async () => {
+      const result = await runCLI(['add', 'policy-engine', '--name', engineName, '--json'], project.projectPath, {
+        env: telemetry.env,
+      });
+
+      expect(result.exitCode, `stdout: ${result.stdout}, stderr: ${result.stderr}`).toBe(0);
+      const json = JSON.parse(result.stdout);
+      expect(json.success).toBe(true);
+
+      telemetry.assertMetricEmitted({
+        command: 'add.policy-engine',
+        exit_reason: 'success',
+        attach_gateway_count: '0',
+      });
+    });
+
+    it('removes the policy engine resource', async () => {
+      const result = await runCLI(['remove', 'policy-engine', '--name', engineName, '--json'], project.projectPath);
+
+      expect(result.exitCode, `stdout: ${result.stdout}, stderr: ${result.stderr}`).toBe(0);
+    });
+  });
 });
diff --git a/integ-tests/create-edge-cases.test.ts b/integ-tests/create-edge-cases.test.ts
index 5d7a1b4e5..d1bbcf056 100644
--- a/integ-tests/create-edge-cases.test.ts
+++ b/integ-tests/create-edge-cases.test.ts
@@ -131,7 +131,10 @@ describe.skipIf(!prereqs.npm || !prereqs.git)('integration: create edge cases',
 
     it('--dry-run shows what would be created without writing files', async () => {
       const name = `DryRun${Date.now().toString().slice(-6)}`;
-      const result = await runCLI(['create', '--name', name, '--defaults', '--dry-run', '--json'], testDir);
+      const result = await runCLI(
+        ['create', '--name', name, '--framework', 'Strands', '--defaults', '--dry-run', '--json'],
+        testDir
+      );
 
       expect(result.exitCode).toBe(0);
       const json = JSON.parse(result.stdout);
diff --git a/integ-tests/create-frameworks.test.ts b/integ-tests/create-frameworks.test.ts
index dee93cc1e..82bbc0871 100644
--- a/integ-tests/create-frameworks.test.ts
+++ b/integ-tests/create-frameworks.test.ts
@@ -1,4 +1,3 @@
-/* eslint-disable security/detect-non-literal-fs-filename */
 import { exists, prereqs, readProjectConfig, runCLI } from '../src/test-utils/index.js';
 import { randomUUID } from 'node:crypto';
 import { mkdir, readFile, rm } from 'node:fs/promises';
diff --git a/integ-tests/create-memory.test.ts b/integ-tests/create-memory.test.ts
index 35cd4436d..ac80f1ba4 100644
--- a/integ-tests/create-memory.test.ts
+++ b/integ-tests/create-memory.test.ts
@@ -1,4 +1,3 @@
-/* eslint-disable security/detect-non-literal-fs-filename */
 import { prereqs, readProjectConfig, runCLI } from '../src/test-utils/index.js';
 import { randomUUID } from 'node:crypto';
 import { mkdir, rm } from 'node:fs/promises';
diff --git a/integ-tests/create-no-agent.test.ts b/integ-tests/create-no-agent.test.ts
index 4bcca2690..bcdf80eaa 100644
--- a/integ-tests/create-no-agent.test.ts
+++ b/integ-tests/create-no-agent.test.ts
@@ -32,7 +32,7 @@ describe('integration: create without agent', () => {
 
   it.skipIf(!hasNpm || !hasGit)('creates project with real npm install and git init', async () => {
     const name = `NoAgent${Date.now().toString().slice(-6)}`;
-    const result = await runCLI(['create', '--name', name, '--no-agent', '--json'], testDir, false);
+    const result = await runCLI(['create', '--name', name, '--no-agent', '--json'], testDir, { skipInstall: false });
 
     expect(result.exitCode, `stderr: ${result.stderr}`).toBe(0);
 
diff --git a/integ-tests/create-protocols.test.ts b/integ-tests/create-protocols.test.ts
index 30b707f8c..440050fdb 100644
--- a/integ-tests/create-protocols.test.ts
+++ b/integ-tests/create-protocols.test.ts
@@ -1,4 +1,3 @@
-/* eslint-disable security/detect-non-literal-fs-filename */
 import { exists, prereqs, readProjectConfig, runCLI } from '../src/test-utils/index.js';
 import { randomUUID } from 'node:crypto';
 import { mkdir, readFile, rm } from 'node:fs/promises';
diff --git a/integ-tests/create-with-agent.test.ts b/integ-tests/create-with-agent.test.ts
index 7fb20bdbf..69f0594b8 100644
--- a/integ-tests/create-with-agent.test.ts
+++ b/integ-tests/create-with-agent.test.ts
@@ -49,7 +49,7 @@ describe('integration: create with Python agent', () => {
         '--json',
       ],
       testDir,
-      false
+      { skipInstall: false }
     );
 
     expect(result.exitCode, `stderr: ${result.stderr}`).toBe(0);
diff --git a/integ-tests/dev-server.test.ts b/integ-tests/dev-server.test.ts
index 5f60976e7..4b07b7284 100644
--- a/integ-tests/dev-server.test.ts
+++ b/integ-tests/dev-server.test.ts
@@ -60,7 +60,7 @@ describe('integration: dev server', () => {
         '--json',
       ],
       testDir,
-      false
+      { skipInstall: false }
     );
 
     if (result.exitCode === 0) {
diff --git a/integ-tests/help.test.ts b/integ-tests/help.test.ts
index 052605c7a..7e2176e2f 100644
--- a/integ-tests/help.test.ts
+++ b/integ-tests/help.test.ts
@@ -1,10 +1,9 @@
 import { spawnAndCollect } from '../src/test-utils/cli-runner.js';
 import { runCLI } from '../src/test-utils/index.js';
+import { createTelemetryHelper } from '../src/test-utils/telemetry-helper.js';
 import { readdirSync } from 'node:fs';
-import { mkdir, readFile, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { afterAll, describe, expect, it } from 'vitest';
 
 const COMMANDS = [
   'create',
@@ -45,52 +44,46 @@ describe('CLI help', () => {
 });
 
 describe('help modes telemetry', () => {
-  let testConfigDir: string;
+  const telemetry = createTelemetryHelper();
   const cliPath = join(__dirname, '..', 'dist', 'cli', 'index.mjs');
 
-  beforeAll(async () => {
-    testConfigDir = join(tmpdir(), `agentcore-help-telemetry-${Date.now()}`);
-    await mkdir(testConfigDir, { recursive: true });
-  });
-  afterAll(() => rm(testConfigDir, { recursive: true, force: true }));
+  afterAll(() => telemetry.destroy());
 
   function run(args: string[], extraEnv: Record<string, string> = {}) {
-    return spawnAndCollect('node', [cliPath, ...args], tmpdir(), {
+    return spawnAndCollect('node', [cliPath, ...args], process.cwd(), {
       AGENTCORE_SKIP_INSTALL: '1',
-      AGENTCORE_CONFIG_DIR: testConfigDir,
+      ...telemetry.env,
       ...extraEnv,
     });
   }
 
   it('writes JSONL audit file when audit is enabled via env var', async () => {
-    const result = await run(['help', 'modes'], { AGENTCORE_TELEMETRY_AUDIT: '1' });
+    const result = await run(['help', 'modes']);
     expect(result.exitCode).toBe(0);
 
-    const telemetryDir = join(testConfigDir, 'telemetry');
-    const files = readdirSync(telemetryDir).filter(f => f.startsWith('help-'));
-    expect(files).toHaveLength(1);
-
-    const content = await readFile(join(telemetryDir, files[0]!), 'utf-8');
-    const entry = JSON.parse(content.trim());
-    expect(entry.attrs).toMatchObject({
-      'service.name': 'agentcore-cli',
-      'agentcore-cli.mode': 'cli',
+    const entries = telemetry.readEntries();
+    expect(entries).toHaveLength(1);
+    telemetry.assertMetricEmitted({
       command_group: 'help',
       command: 'help.modes',
       exit_reason: 'success',
     });
-    expect(entry.attrs['agentcore-cli.session_id']).toBeDefined();
-    expect(entry.attrs['os.type']).toBeDefined();
-    expect(entry.value).toBeGreaterThanOrEqual(0);
+    expect(entries[0]!.attrs['agentcore-cli.session_id']).toBeDefined();
+    expect(entries[0]!.attrs['os.type']).toBeDefined();
+    expect(entries[0]!.value).toBeGreaterThanOrEqual(0);
   });
 
   it('does not write audit file when audit is not enabled', async () => {
-    const telemetryDir = join(testConfigDir, 'telemetry');
-    await rm(telemetryDir, { recursive: true, force: true });
+    telemetry.clearEntries();
 
-    const result = await run(['help', 'modes']);
+    const noAuditCliPath = join(__dirname, '..', 'dist', 'cli', 'index.mjs');
+    const result = await spawnAndCollect('node', [noAuditCliPath, 'help', 'modes'], process.cwd(), {
+      AGENTCORE_SKIP_INSTALL: '1',
+      AGENTCORE_CONFIG_DIR: telemetry.dir,
+    });
     expect(result.exitCode).toBe(0);
 
+    const telemetryDir = join(telemetry.dir, 'telemetry');
     try {
       const files = readdirSync(telemetryDir);
       expect(files).toHaveLength(0);
diff --git a/integ-tests/json-output.test.ts b/integ-tests/json-output.test.ts
index e4ef5835f..c54033026 100644
--- a/integ-tests/json-output.test.ts
+++ b/integ-tests/json-output.test.ts
@@ -41,8 +41,8 @@ describe('JSON output structure', () => {
     });
 
     it('missing required options returns error JSON', async () => {
-      // Missing --language, --framework, etc without --no-agent
-      const result = await runCLI(['create', '--name', 'ValidName', '--json'], testDir);
+      // Missing --language, --model-provider, etc. on agent path
+      const result = await runCLI(['create', '--name', 'ValidName', '--framework', 'Strands', '--json'], testDir);
 
       expect(result.exitCode).toBe(1);
       const json = JSON.parse(result.stdout);
diff --git a/integ-tests/recommendation.test.ts b/integ-tests/recommendation.test.ts
new file mode 100644
index 000000000..dc3037a3e
--- /dev/null
+++ b/integ-tests/recommendation.test.ts
@@ -0,0 +1,290 @@
+import { type TestProject, createTestProject, parseJsonOutput, runCLI } from '../src/test-utils/index.js';
+import { writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+describe('integration: run recommendation CLI validation', () => {
+  let project: TestProject;
+
+  beforeAll(async () => {
+    project = await createTestProject({
+      language: 'Python',
+      framework: 'Strands',
+      modelProvider: 'Bedrock',
+      memory: 'none',
+    });
+  });
+
+  afterAll(async () => {
+    await project.cleanup();
+  });
+
+  describe('required flags', () => {
+    it('requires --runtime', async () => {
+      const result = await runCLI(
+        ['run', 'recommendation', '--evaluator', 'Builtin.Faithfulness', '--inline', 'test prompt', '--json'],
+        project.projectPath
+      );
+
+      expect(result.exitCode).toBe(1);
+      const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+      expect(json.success).toBe(false);
+      expect(json.error).toContain('--runtime');
+    });
+
+    it('requires --evaluator for system-prompt type', async () => {
+      const result = await runCLI(
+        ['run', 'recommendation', '--runtime', project.agentName, '--inline', 'test prompt', '--json'],
+        project.projectPath
+      );
+
+      expect(result.exitCode).toBe(1);
+      const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+      expect(json.success).toBe(false);
+      expect(json.error).toContain('--evaluator');
+    });
+
+    it('rejects invalid --type', async () => {
+      const result = await runCLI(
+        [
+          'run',
+          'recommendation',
+          '--type',
+          'invalid-type',
+          '--runtime',
+          project.agentName,
+          '--evaluator',
+          'Builtin.Faithfulness',
+          '--inline',
+          'test prompt',
+          '--json',
+        ],
+        project.projectPath
+      );
+
+      expect(result.exitCode).toBe(1);
+      const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+      expect(json.success).toBe(false);
+      expect(json.error).toContain('--type');
+    });
+  });
+
+  describe('system-prompt recommendation input validation', () => {
+    it('fails when agent not deployed (inline input)', async () => {
+      const result = await runCLI(
+        [
+          'run',
+          'recommendation',
+          '--runtime',
+          project.agentName,
+          '--evaluator',
+          'Builtin.Faithfulness',
+          '--inline',
+          'You are a helpful assistant.',
+          '--json',
+        ],
+        project.projectPath
+      );
+
+      expect(result.exitCode).toBe(1);
+      const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+      expect(json.success).toBe(false);
+      expect(json.error).toContain('deployed');
+    });
+
+    it('fails when agent not deployed (file input)', async () => {
+      const promptFile = join(project.projectPath, 'system-prompt.txt');
+      await writeFile(promptFile, 'You are a helpful assistant for testing.');
+
+      const result = await runCLI(
+        [
+          'run',
+          'recommendation',
+          '--runtime',
+          project.agentName,
+          '--evaluator',
+          'Builtin.Faithfulness',
+          '--prompt-file',
+          promptFile,
+          '--json',
+        ],
+        project.projectPath
+      );
+
+      expect(result.exitCode).toBe(1);
+      const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+      expect(json.success).toBe(false);
+      expect(json.error).toContain('deployed');
+    });
+
+    it('fails with non-existent prompt file', async () => {
+      const result = await runCLI(
+        [
+          'run',
+          'recommendation',
+          '--runtime',
+          project.agentName,
+          '--evaluator',
+          'Builtin.Faithfulness',
+          '--prompt-file',
+          '/tmp/nonexistent-prompt-file-xyz.txt',
+          '--json',
+        ],
+        project.projectPath
+      );
+
+      expect(result.exitCode).toBe(1);
+    });
+  });
+
+  describe('tool-description recommendation input validation', () => {
+    it('fails when agent not deployed (tool-description type with --tools)', async () => {
+      const result = await runCLI(
+        [
+          'run',
+          'recommendation',
+          '--type',
+          'tool-description',
+          '--runtime',
+          project.agentName,
+          '--tools',
+          'search:Searches the web for information',
+          '--tools',
+          'calculator:Performs math calculations',
+          '--json',
+        ],
+        project.projectPath
+      );
+
+      expect(result.exitCode).toBe(1);
+      const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+      expect(json.success).toBe(false);
+      expect(json.error).toContain('deployed');
+    });
+  });
+
+  describe('config bundle source validation', () => {
+    it('fails when bundle not found in deployed state', async () => {
+      const result = await runCLI(
+        [
+          'run',
+          'recommendation',
+          '--runtime',
+          project.agentName,
+          '--evaluator',
+          'Builtin.Faithfulness',
+          '--bundle-name',
+          'NonExistentBundle',
+          '--bundle-version',
+          'v1',
+          '--system-prompt-json-path',
+          'systemPrompt',
+          '--json',
+        ],
+        project.projectPath
+      );
+
+      expect(result.exitCode).toBe(1);
+      const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+      expect(json.success).toBe(false);
+      // Fails at agent resolution (not deployed) before bundle resolution
+      expect(json.error).toContain('deployed');
+    });
+  });
+
+  describe('spans file validation', () => {
+    it('fails when spans file does not exist', async () => {
+      const result = await runCLI(
+        [
+          'run',
+          'recommendation',
+          '--runtime',
+          project.agentName,
+          '--evaluator',
+          'Builtin.Faithfulness',
+          '--inline',
+          'You are a helpful assistant.',
+          '--spans-file',
+          '/tmp/nonexistent-spans-xyz.json',
+          '--json',
+        ],
+        project.projectPath
+      );
+
+      expect(result.exitCode).toBe(1);
+    });
+
+    it('fails when spans file contains invalid JSON', async () => {
+      const spansFile = join(project.projectPath, 'bad-spans.json');
+      await writeFile(spansFile, 'not valid json');
+
+      const result = await runCLI(
+        [
+          'run',
+          'recommendation',
+          '--runtime',
+          project.agentName,
+          '--evaluator',
+          'Builtin.Faithfulness',
+          '--inline',
+          'You are a helpful assistant.',
+          '--spans-file',
+          spansFile,
+          '--json',
+        ],
+        project.projectPath
+      );
+
+      expect(result.exitCode).toBe(1);
+    });
+  });
+
+  describe('lookback and session options', () => {
+    it('accepts --lookback flag (fails at deploy check, not parsing)', async () => {
+      const result = await runCLI(
+        [
+          'run',
+          'recommendation',
+          '--runtime',
+          project.agentName,
+          '--evaluator',
+          'Builtin.Faithfulness',
+          '--inline',
+          'You are a helpful assistant.',
+          '--lookback',
+          '14',
+          '--json',
+        ],
+        project.projectPath
+      );
+
+      expect(result.exitCode).toBe(1);
+      const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+      expect(json.error).toContain('deployed');
+    });
+
+    it('accepts --session-id flag (fails at deploy check, not parsing)', async () => {
+      const result = await runCLI(
+        [
+          'run',
+          'recommendation',
+          '--runtime',
+          project.agentName,
+          '--evaluator',
+          'Builtin.Faithfulness',
+          '--inline',
+          'You are a helpful assistant.',
+          '--session-id',
+          'sess-001',
+          'sess-002',
+          '--json',
+        ],
+        project.projectPath
+      );
+
+      expect(result.exitCode).toBe(1);
+      const json = parseJsonOutput(result.stdout) as Record<string, unknown>;
+      expect(json.error).toContain('deployed');
+    });
+  });
+});
diff --git a/integ-tests/tui/add-gateway-jwt.test.ts b/integ-tests/tui/add-gateway-jwt.test.ts
index e18ea5e22..15e1e7284 100644
--- a/integ-tests/tui/add-gateway-jwt.test.ts
+++ b/integ-tests/tui/add-gateway-jwt.test.ts
@@ -133,9 +133,9 @@ describe('Add Gateway JWT Flow', () => {
 
   it('Step 1c: navigates to Gateway and enters the wizard', async () => {
     // Add Resource list order:
-    //   0: Agent, 1: Memory, 2: Identity, 3: Evaluator,
-    //   4: Online Eval Config, 5: Gateway, 6: Gateway Target
-    for (let i = 0; i < 5; i++) {
+    //   0: Harness, 1: Agent, 2: Memory, 3: Credential, 4: Evaluator,
+    //   5: Online Eval Config, 6: Gateway, 7: Gateway Target, 8: Policy
+    for (let i = 0; i < 6; i++) {
       await session.sendSpecialKey('down');
     }
     await settle();
diff --git a/integ-tests/tui/add-memory-episodic.test.ts b/integ-tests/tui/add-memory-episodic.test.ts
index c4dd65d46..c2caad335 100644
--- a/integ-tests/tui/add-memory-episodic.test.ts
+++ b/integ-tests/tui/add-memory-episodic.test.ts
@@ -94,7 +94,8 @@ describe('Add Memory with EPISODIC Strategy', () => {
   });
 
   it('Step 3: selects Memory from the resource list', async () => {
-    // Add Resource list: 0: Agent, 1: Memory
+    // Add Resource list: 0: Harness, 1: Agent, 2: Memory
+    await session.sendSpecialKey('down');
     await session.sendSpecialKey('down');
     await settle();
 
diff --git a/integ-tests/tui/lifecycle-config.test.ts b/integ-tests/tui/lifecycle-config.test.ts
index c8cc5947b..12e69e03c 100644
--- a/integ-tests/tui/lifecycle-config.test.ts
+++ b/integ-tests/tui/lifecycle-config.test.ts
@@ -252,7 +252,8 @@ describe('Add Agent BYO Flow: Lifecycle Configuration via TUI', () => {
     expect(atAdd).toBe(true);
     saveTextScreenshot(session, 'byo-02-add-resource');
 
-    // Select Agent (first option)
+    // Select Agent (second option, after Harness)
+    await session.sendSpecialKey('down');
     await session.sendSpecialKey('enter');
 
     const atAgent = await safeWaitFor(session, /agent|Name/i, 5_000);
diff --git a/package-lock.json b/package-lock.json
index 45ad45ed3..e7c95133b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@aws/agentcore",
-  "version": "0.12.2",
+  "version": "1.0.0-preview.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@aws/agentcore",
-      "version": "0.12.2",
+      "version": "1.0.0-preview.6",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -24,7 +24,7 @@
         "@aws-sdk/client-sts": "^3.893.0",
         "@aws-sdk/client-xray": "^3.1003.0",
         "@aws-sdk/credential-providers": "^3.893.0",
-        "@aws/agent-inspector": "0.2.1",
+        "@aws/agent-inspector": "0.3.0",
         "@commander-js/extra-typings": "^14.0.0",
         "@opentelemetry/api": "^1.9.1",
         "@opentelemetry/exporter-metrics-otlp-http": "^0.214.0",
@@ -2903,9 +2903,9 @@
       }
     },
     "node_modules/@aws/agent-inspector": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/@aws/agent-inspector/-/agent-inspector-0.2.1.tgz",
-      "integrity": "sha512-kyL6RBcTj1hYIchtrHDlDyeqm2viVYMBxhZKVn8wJn058YhI52GIDuUFlKD1avd57X+LJKlHr5VcKvBZp7Sg6A==",
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@aws/agent-inspector/-/agent-inspector-0.3.0.tgz",
+      "integrity": "sha512-xD7QPr1WWkT9QWRWo6e9kq8kYxJLQ8egGscgSZ6jCyW3wNV5fcQ6THcAR/71hxxMFF2aleNUc3D8MoqgiS4DVw==",
       "license": "Apache-2.0",
       "dependencies": {
         "@ag-ui/core": "^0.0.52",
diff --git a/package.json b/package.json
index dda0501e2..6433f329d 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@aws/agentcore",
-  "version": "0.12.2",
+  "version": "1.0.0-preview.6",
   "description": "CLI for Amazon Bedrock AgentCore",
   "license": "Apache-2.0",
   "repository": {
@@ -87,7 +87,7 @@
     "@aws-sdk/client-sts": "^3.893.0",
     "@aws-sdk/client-xray": "^3.1003.0",
     "@aws-sdk/credential-providers": "^3.893.0",
-    "@aws/agent-inspector": "0.2.1",
+    "@aws/agent-inspector": "0.3.0",
     "@commander-js/extra-typings": "^14.0.0",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/exporter-metrics-otlp-http": "^0.214.0",
diff --git a/schemas/agentcore.schema.v1.json b/schemas/agentcore.schema.v1.json
index c2dd737a7..7434481f9 100644
--- a/schemas/agentcore.schema.v1.json
+++ b/schemas/agentcore.schema.v1.json
@@ -690,6 +690,10 @@
             "type": "string",
             "minLength": 1
           },
+          "endpoint": {
+            "type": "string",
+            "minLength": 1
+          },
           "evaluators": {
             "minItems": 1,
             "type": "array",
@@ -1840,6 +1844,330 @@
         "required": ["name"],
         "additionalProperties": false
       }
+    },
+    "harnesses": {
+      "default": [],
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 48,
+            "pattern": "^[a-zA-Z][a-zA-Z0-9_]{0,47}$"
+          },
+          "path": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "required": ["name", "path"],
+        "additionalProperties": false
+      }
+    },
+    "configBundles": {
+      "default": [],
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 100,
+            "pattern": "^[a-zA-Z][a-zA-Z0-9_]{0,99}$"
+          },
+          "type": {
+            "default": "ConfigurationBundle",
+            "type": "string",
+            "const": "ConfigurationBundle"
+          },
+          "description": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 500
+          },
+          "components": {
+            "type": "object",
+            "propertyNames": {
+              "type": "string"
+            },
+            "additionalProperties": {
+              "type": "object",
+              "properties": {
+                "configuration": {
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string"
+                  },
+                  "additionalProperties": {}
+                }
+              },
+              "required": ["configuration"],
+              "additionalProperties": false
+            }
+          },
+          "branchName": {
+            "type": "string",
+            "maxLength": 128
+          },
+          "commitMessage": {
+            "type": "string",
+            "maxLength": 500
+          }
+        },
+        "required": ["name", "components"],
+        "additionalProperties": false
+      }
+    },
+    "abTests": {
+      "default": [],
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 48,
+            "pattern": "^[a-zA-Z][a-zA-Z0-9_]{0,47}$"
+          },
+          "description": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 200
+          },
+          "mode": {
+            "default": "config-bundle",
+            "type": "string",
+            "enum": ["config-bundle", "target-based"]
+          },
+          "gatewayRef": {
+            "type": "string",
+            "minLength": 1
+          },
+          "roleArn": {
+            "type": "string",
+            "minLength": 1
+          },
+          "variants": {
+            "minItems": 2,
+            "maxItems": 2,
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "enum": ["C", "T1"]
+                },
+                "weight": {
+                  "type": "integer",
+                  "minimum": 1,
+                  "maximum": 100
+                },
+                "variantConfiguration": {
+                  "anyOf": [
+                    {
+                      "type": "object",
+                      "properties": {
+                        "configurationBundle": {
+                          "type": "object",
+                          "properties": {
+                            "bundleArn": {
+                              "type": "string",
+                              "minLength": 1
+                            },
+                            "bundleVersion": {
+                              "type": "string",
+                              "minLength": 1
+                            }
+                          },
+                          "required": ["bundleArn", "bundleVersion"],
+                          "additionalProperties": false
+                        },
+                        "target": {
+                          "not": {}
+                        }
+                      },
+                      "required": ["configurationBundle"],
+                      "additionalProperties": false
+                    },
+                    {
+                      "type": "object",
+                      "properties": {
+                        "configurationBundle": {
+                          "not": {}
+                        },
+                        "target": {
+                          "type": "object",
+                          "properties": {
+                            "targetName": {
+                              "type": "string",
+                              "minLength": 1,
+                              "maxLength": 100
+                            }
+                          },
+                          "required": ["targetName"],
+                          "additionalProperties": false
+                        }
+                      },
+                      "required": ["target"],
+                      "additionalProperties": false
+                    }
+                  ]
+                }
+              },
+              "required": ["name", "weight", "variantConfiguration"],
+              "additionalProperties": false
+            }
+          },
+          "evaluationConfig": {
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "onlineEvaluationConfigArn": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                "required": ["onlineEvaluationConfigArn"],
+                "additionalProperties": false
+              },
+              {
+                "type": "object",
+                "properties": {
+                  "perVariantOnlineEvaluationConfig": {
+                    "minItems": 2,
+                    "maxItems": 2,
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "treatmentName": {
+                          "type": "string",
+                          "enum": ["C", "T1"]
+                        },
+                        "onlineEvaluationConfigArn": {
+                          "type": "string",
+                          "minLength": 1
+                        }
+                      },
+                      "required": ["treatmentName", "onlineEvaluationConfigArn"],
+                      "additionalProperties": false
+                    }
+                  }
+                },
+                "required": ["perVariantOnlineEvaluationConfig"],
+                "additionalProperties": false
+              }
+            ]
+          },
+          "gatewayFilter": {
+            "type": "object",
+            "properties": {
+              "targetPaths": {
+                "maxItems": 1,
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 500
+                }
+              }
+            },
+            "required": ["targetPaths"],
+            "additionalProperties": false
+          },
+          "trafficAllocationConfig": {
+            "type": "object",
+            "properties": {
+              "routeOnHeader": {
+                "type": "object",
+                "properties": {
+                  "headerName": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                "required": ["headerName"],
+                "additionalProperties": false
+              }
+            },
+            "required": ["routeOnHeader"],
+            "additionalProperties": false
+          },
+          "maxDurationDays": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 90
+          },
+          "enableOnCreate": {
+            "type": "boolean"
+          },
+          "promoted": {
+            "type": "boolean"
+          }
+        },
+        "required": ["name", "gatewayRef", "variants", "evaluationConfig"],
+        "additionalProperties": false
+      }
+    },
+    "httpGateways": {
+      "default": [],
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 48,
+            "pattern": "^[a-zA-Z][a-zA-Z0-9-]{0,47}$"
+          },
+          "description": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 200
+          },
+          "runtimeRef": {
+            "type": "string",
+            "minLength": 1
+          },
+          "roleArn": {
+            "type": "string",
+            "minLength": 1
+          },
+          "targets": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 100
+                },
+                "runtimeRef": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "qualifier": {
+                  "default": "DEFAULT",
+                  "type": "string",
+                  "minLength": 1
+                }
+              },
+              "required": ["name", "runtimeRef"],
+              "additionalProperties": false
+            }
+          }
+        },
+        "required": ["name", "runtimeRef"],
+        "additionalProperties": false
+      }
     }
   },
   "required": ["name", "version"],
diff --git a/scripts/bundle.mjs b/scripts/bundle.mjs
index 0afdcf93d..ec46df8cc 100644
--- a/scripts/bundle.mjs
+++ b/scripts/bundle.mjs
@@ -1,5 +1,5 @@
 /**
- * bundle.mjs — Single command to build CLI + CDK constructs into one tarball.
+ * bundle.mjs — Single command to build CLI + CDK constructs + frontend into one tarball.
  *
  * This is a testing-only workflow. It does NOT modify the default build or
  * deployment flow. The normal `npm run build` + `npm pack` pipeline is unchanged.
@@ -9,12 +9,16 @@
  * At `agentcore create` time, CDKRenderer detects this tarball and installs it
  * after the normal `npm install`, overriding the registry version.
  *
+ * It also builds the @aws/agent-inspector frontend and copies its dist-assets
+ * into the CLI's dist/agent-inspector/ directory, overriding the npm registry version.
+ *
  * Usage:
  *   node scripts/bundle.mjs
  *   npm run bundle
  *
  * Environment variables:
- *   AGENTCORE_CDK_PATH — absolute path to the agentcore-l3-cdk-constructs repo
+ *   AGENTCORE_CDK_PATH       — absolute path to the agentcore-l3-cdk-constructs repo
+ *   AGENT_INSPECTOR_PATH     — absolute path to the agent-inspector repo
  */
 import { execFileSync } from 'node:child_process';
 import * as fs from 'node:fs';
@@ -75,13 +79,38 @@ function resolveCdkPath() {
   return cloneDir;
 }
 
+/**
+ * Resolve the agent-inspector repo path. Priority:
+ * 1. AGENT_INSPECTOR_PATH env var
+ * 2. Sibling directory ../agent-inspector
+ */
+function resolveInspectorPath() {
+  if (process.env.AGENT_INSPECTOR_PATH) {
+    const p = path.resolve(process.env.AGENT_INSPECTOR_PATH);
+    if (fs.existsSync(path.join(p, 'package.json'))) {
+      log(`Using agent-inspector from AGENT_INSPECTOR_PATH: ${p}`);
+      return p;
+    }
+    console.warn(`  WARNING: AGENT_INSPECTOR_PATH=${p} does not contain package.json, ignoring.`);
+  }
+
+  const sibling = path.resolve(cliRoot, '..', 'agent-inspector');
+  if (fs.existsSync(path.join(sibling, 'package.json'))) {
+    log(`Using agent-inspector from sibling directory: ${sibling}`);
+    return sibling;
+  }
+
+  return null;
+}
+
 // ---------------------------------------------------------------------------
 // Main
 // ---------------------------------------------------------------------------
 
 log('Starting bundle process...');
 
-const timestamp = Math.floor(Date.now() / 1000);
+const now = new Date();
+const timestamp = now.toISOString().replace(/[-:T]/g, '').slice(0, 14);
 log(`Bundle timestamp: ${timestamp}`);
 
 // Helper to bump a package version with a unique e2e timestamp tag.
@@ -91,7 +120,9 @@ function bumpVersion(pkgDir) {
   const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'));
   const originalVersion = pkg.version;
   const baseVersion = originalVersion.split('-')[0];
-  pkg.version = `${baseVersion}-${timestamp}`;
+  const prerelease = originalVersion.includes('-') ? originalVersion.split('-').slice(1).join('-') : '';
+  const tag = prerelease ? `${prerelease}-${timestamp}` : timestamp;
+  pkg.version = `${baseVersion}-${tag}`;
   fs.writeFileSync(pkgJsonPath, JSON.stringify(pkg, null, 2) + '\n');
   log(`Bumped ${pkg.name} version: ${originalVersion} -> ${pkg.version}`);
   return { pkgJsonPath, originalVersion, bumpedVersion: pkg.version };
@@ -141,7 +172,33 @@ const bundledTarballDest = path.join(cliRoot, 'dist', 'assets', 'bundled-agentco
 fs.copyFileSync(cdkTarballSrc, bundledTarballDest);
 log(`Placed CDK tarball at ${bundledTarballDest}`);
 
-// Step 5: Bump CLI version and pack into final tarball (includes the bundled CDK tarball)
+// Step 5: Build and bundle agent-inspector frontend (overrides the npm version)
+const inspectorPath = resolveInspectorPath();
+if (inspectorPath) {
+  log('Installing agent-inspector dependencies...');
+  run('npm', ['install'], { cwd: inspectorPath });
+
+  log('Building agent-inspector...');
+  run('npm', ['run', 'build'], { cwd: inspectorPath });
+
+  const inspectorDistSrc = path.join(inspectorPath, 'dist-assets');
+  const inspectorDistDest = path.join(cliRoot, 'dist', 'agent-inspector');
+
+  if (fs.existsSync(inspectorDistSrc)) {
+    if (fs.existsSync(inspectorDistDest)) {
+      fs.rmSync(inspectorDistDest, { recursive: true });
+    }
+    fs.cpSync(inspectorDistSrc, inspectorDistDest, { recursive: true });
+    log(`Copied agent-inspector frontend to ${inspectorDistDest}`);
+  } else {
+    console.error(`ERROR: agent-inspector build did not produce dist-assets/ at ${inspectorDistSrc}`);
+    process.exit(1);
+  }
+} else {
+  log('No local agent-inspector found — using npm registry version.');
+}
+
+// Step 6: Bump CLI version and pack into final tarball (includes the bundled CDK tarball + frontend)
 const cliVersionInfo = bumpVersion(cliRoot);
 try {
   log('Packing CLI tarball...');
diff --git a/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap b/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap
index 8fa17f318..30e9be0f4 100644
--- a/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap
+++ b/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap
@@ -99,6 +99,45 @@ async function main() {
     throw new Error('No deployment targets configured. Please define targets in agentcore/aws-targets.json');
   }
 
+  // Read harness configs for role creation.
+  // Harness fields may not yet be on the AgentCoreProjectSpec type from @aws/agentcore-cdk,
+  // so we read them dynamically via specAny (same pattern as gateways above).
+  // Harness paths in agentcore.json are relative to the project root (parent of agentcore/).
+  const projectRoot = path.resolve(configRoot, '..');
+  const harnessConfigs: {
+    name: string;
+    executionRoleArn?: string;
+    memoryName?: string;
+    containerUri?: string;
+    hasDockerfile?: boolean;
+    dockerfile?: string;
+    codeLocation?: string;
+    tools?: { type: string; name: string }[];
+    apiKeyArn?: string;
+  }[] = [];
+  for (const entry of specAny.harnesses ?? []) {
+    const harnessDir = path.resolve(projectRoot, entry.path);
+    const harnessPath = path.resolve(harnessDir, 'harness.json');
+    try {
+      const harnessSpec = JSON.parse(fs.readFileSync(harnessPath, 'utf-8'));
+      harnessConfigs.push({
+        name: entry.name,
+        executionRoleArn: harnessSpec.executionRoleArn,
+        memoryName: harnessSpec.memory?.name,
+        containerUri: harnessSpec.containerUri,
+        hasDockerfile: !!harnessSpec.dockerfile,
+        dockerfile: harnessSpec.dockerfile,
+        codeLocation: harnessSpec.dockerfile ? harnessDir : undefined,
+        tools: harnessSpec.tools,
+        apiKeyArn: harnessSpec.model?.apiKeyArn,
+      });
+    } catch (err) {
+      throw new Error(
+        \`Could not read harness.json for "\${entry.name}" at \${harnessPath}: \${err instanceof Error ? err.message : err}\`
+      );
+    }
+  }
+
   const app = new App();
 
   for (const target of targets) {
@@ -118,6 +157,7 @@ async function main() {
       spec,
       mcpSpec,
       credentials,
+      harnesses: harnessConfigs.length > 0 ? harnessConfigs : undefined,
       env,
       description: \`AgentCore stack for \${spec.name} deployed to \${target.name} (\${target.region})\`,
       tags: {
@@ -265,6 +305,18 @@ exports[`Assets Directory Snapshots > CDK assets > cdk/cdk/lib/cdk-stack.ts shou
 import { CfnOutput, Stack, type StackProps } from 'aws-cdk-lib';
 import { Construct } from 'constructs';
 
+export interface HarnessConfig {
+  name: string;
+  executionRoleArn?: string;
+  memoryName?: string;
+  containerUri?: string;
+  hasDockerfile?: boolean;
+  dockerfile?: string;
+  codeLocation?: string;
+  tools?: { type: string; name: string }[];
+  apiKeyArn?: string;
+}
+
 export interface AgentCoreStackProps extends StackProps {
   /**
    * The AgentCore project specification containing agents, memories, and credentials.
@@ -278,6 +330,14 @@ export interface AgentCoreStackProps extends StackProps {
    * Credential provider ARNs from deployed state, keyed by credential name.
    */
   credentials?: Record<string, { credentialProviderArn: string; clientSecretArn?: string }>;
+  /**
+   * Harness role configurations. Each entry creates an IAM execution role for a harness.
+   *
+   * When \`hasDockerfile\` is true and \`codeLocation\` is provided (without an explicit
+   * \`containerUri\`), the L3 construct builds and pushes a container image via CodeBuild
+   * and emits its URI as a stack output for the post-CDK harness deployer.
+   */
+  harnesses?: HarnessConfig[];
 }
 
 /**
@@ -293,11 +353,12 @@ export class AgentCoreStack extends Stack {
   constructor(scope: Construct, id: string, props: AgentCoreStackProps) {
     super(scope, id, props);
 
-    const { spec, mcpSpec, credentials } = props;
+    const { spec, mcpSpec, credentials, harnesses } = props;
 
-    // Create AgentCoreApplication with all agents
+    // Create AgentCoreApplication with all agents and harness roles
     this.application = new AgentCoreApplication(this, 'Application', {
       spec,
+      harnesses: harnesses?.length ? harnesses : undefined,
     });
 
     // Create AgentCoreMcp if there are gateways configured
@@ -382,6 +443,7 @@ test('AgentCoreStack synthesizes with empty spec', () => {
       credentials: [],
       evaluators: [],
       onlineEvalConfigs: [],
+      configBundles: [],
       policyEngines: [],
       agentCoreGateways: [],
       mcpRuntimeTools: [],
@@ -449,6 +511,7 @@ exports[`Assets Directory Snapshots > File listing > should match the expected f
   "evaluators/python-lambda/execution-role-policy.json",
   "evaluators/python-lambda/lambda_function.py",
   "evaluators/python-lambda/pyproject.toml",
+  "harness/invoke.py.template",
   "mcp/python-lambda/README.md",
   "mcp/python-lambda/handler.py",
   "mcp/python-lambda/pyproject.toml",
@@ -3700,9 +3763,15 @@ Thumbs.db
 
 exports[`Assets Directory Snapshots > Python framework assets > python/python/http/langchain_langgraph/base/main.py should match snapshot 1`] = `
 "import os
-from langchain_core.messages import HumanMessage
+from typing import Any
+
+from langchain_core.messages import HumanMessage{{#if hasConfigBundle}}, SystemMessage{{/if}}
 from langgraph.prebuilt import create_react_agent
 from langchain.tools import tool
+{{#if hasConfigBundle}}
+from langchain_core.callbacks import BaseCallbackHandler
+from bedrock_agentcore.runtime.context import BedrockAgentCoreContext
+{{/if}}
 from opentelemetry.instrumentation.langchain import LangchainInstrumentor
 from bedrock_agentcore.runtime import BedrockAgentCoreApp
 from model.load import load_model
@@ -3726,6 +3795,14 @@ def get_or_create_model():
     return _llm
 
 
+DEFAULT_SYSTEM_PROMPT = """
+You are a helpful assistant. Use tools when appropriate.
+{{#if sessionStorageMountPath}}
+You have persistent storage at {{sessionStorageMountPath}}. Use file tools to read and write files. Data persists across sessions.
+{{/if}}
+"""
+
+
 # Define a simple function tool
 @tool
 def add_numbers(a: int, b: int) -> int:
@@ -3789,13 +3866,28 @@ def list_files(directory: str = "") -> str:
 tools.extend([file_read, file_write, list_files])
 {{/if}}
 
-SYSTEM_PROMPT = """
-You are a helpful assistant. Use tools when appropriate.
-{{#if sessionStorageMountPath}}
-You have persistent storage at {{sessionStorageMountPath}}. Use file tools to read and write files. Data persists across sessions.
-{{/if}}
-"""
+{{#if hasConfigBundle}}
+
+class ConfigBundleCallback(BaseCallbackHandler):
+    """Injects config bundle values into LangGraph agent at runtime.
+
+    BedrockAgentCoreContext.get_config_bundle() fetches the component configuration
+    for the current runtime ARN from the config bundle service. The SDK caches the
+    result and refreshes on bundle version changes.
+    """
+
+    def on_chain_start(self, serialized: dict, inputs: dict, **kwargs: Any) -> None:
+        config = BedrockAgentCoreContext.get_config_bundle()
+        prompt = config.get("systemPrompt", DEFAULT_SYSTEM_PROMPT)
 
+        messages = inputs.get("messages", [])
+        if messages and isinstance(messages[0], SystemMessage):
+            messages[0] = SystemMessage(content=prompt)
+        else:
+            messages.insert(0, SystemMessage(content=prompt))
+        inputs["messages"] = messages
+
+{{/if}}
 
 @app.entrypoint
 async def invoke(payload, context):
@@ -3814,7 +3906,21 @@ async def invoke(payload, context):
         mcp_tools = await mcp_client.get_tools()
 
     # Define the agent using create_react_agent
-    graph = create_react_agent(get_or_create_model(), tools=mcp_tools + tools, prompt=SYSTEM_PROMPT)
+{{#if hasConfigBundle}}
+    graph = create_react_agent(get_or_create_model(), tools=mcp_tools + tools, prompt=DEFAULT_SYSTEM_PROMPT)
+    callback = ConfigBundleCallback()
+
+    # Process the user prompt
+    prompt = payload.get("prompt", "What can you help me with?")
+    log.info(f"Agent input: {prompt}")
+
+    # Run the agent with config bundle callback
+    result = await graph.ainvoke(
+        {"messages": [HumanMessage(content=prompt)]},
+        config={"callbacks": [callback]},
+    )
+{{else}}
+    graph = create_react_agent(get_or_create_model(), tools=mcp_tools + tools, prompt=DEFAULT_SYSTEM_PROMPT)
 
     # Process the user prompt
     prompt = payload.get("prompt", "What can you help me with?")
@@ -3822,6 +3928,7 @@ async def invoke(payload, context):
 
     # Run the agent
     result = await graph.ainvoke({"messages": [HumanMessage(content=prompt)]})
+{{/if}}
 
     # Return result
     output = result["messages"][-1].content
@@ -4596,7 +4703,13 @@ Thumbs.db"
 `;
 
 exports[`Assets Directory Snapshots > Python framework assets > python/python/http/strands/base/main.py should match snapshot 1`] = `
-"from strands import Agent, tool
+"from typing import Any
+
+from strands import Agent, tool
+{{#if hasConfigBundle}}
+from strands.hooks import HookProvider, HookRegistry, BeforeInvocationEvent, BeforeToolCallEvent
+from bedrock_agentcore.runtime.context import BedrockAgentCoreContext
+{{/if}}
 from bedrock_agentcore.runtime import BedrockAgentCoreApp
 from model.load import load_model
 {{#if hasGateway}}
@@ -4621,11 +4734,26 @@ mcp_clients = get_all_gateway_mcp_clients()
 mcp_clients = [get_streamable_http_mcp_client()]
 {{/if}}
 
+DEFAULT_SYSTEM_PROMPT = """
+You are a helpful assistant. Use tools when appropriate.
+{{#if sessionStorageMountPath}}
+You have persistent storage at {{sessionStorageMountPath}}. Use file tools to read and write files. Data persists across sessions.
+{{/if}}
+"""
+
+{{#if hasConfigBundle}}
+DEFAULT_TOOL_DESC = "Return the sum of two numbers"
+{{/if}}
+
 # Define a collection of tools used by the model
 tools = []
 
 # Define a simple function tool
+{{#if hasConfigBundle}}
+@tool(description=DEFAULT_TOOL_DESC)
+{{else}}
 @tool
+{{/if}}
 def add_numbers(a: int, b: int) -> int:
     """Return the sum of two numbers"""
     return a+b
@@ -4689,12 +4817,39 @@ for mcp_client in mcp_clients:
     if mcp_client:
         tools.append(mcp_client)
 
-SYSTEM_PROMPT = """
-You are a helpful assistant. Use tools when appropriate.
-{{#if sessionStorageMountPath}}
-You have persistent storage at {{sessionStorageMountPath}}. Use file tools to read and write files. Data persists across sessions.
+{{#if hasConfigBundle}}
+
+class ConfigBundleHook(HookProvider):
+    """Injects config bundle values (system prompt, tool descriptions) before each invocation.
+
+    BedrockAgentCoreContext.get_config_bundle() fetches the component configuration
+    for the current runtime ARN from the config bundle service. The SDK caches the
+    result and refreshes on bundle version changes.
+    """
+
+    def register_hooks(self, registry: HookRegistry, **kwargs: Any) -> None:
+        registry.add_callback(BeforeInvocationEvent, self._inject_system_prompt)
+        registry.add_callback(BeforeToolCallEvent, self._override_tool_desc)
+
+    def _inject_system_prompt(self, event: BeforeInvocationEvent) -> None:
+        config = BedrockAgentCoreContext.get_config_bundle()
+        prompt = config.get("systemPrompt", DEFAULT_SYSTEM_PROMPT)
+
+        if prompt != event.agent.system_prompt:
+            event.agent.system_prompt = prompt
+
+    def _override_tool_desc(self, event: BeforeToolCallEvent) -> None:
+        config = BedrockAgentCoreContext.get_config_bundle()
+        tool_descs = config.get("toolDescriptions", {})
+
+        tool_name = event.tool_use["name"]
+        override = tool_descs.get(tool_name)
+        if override and event.selected_tool:
+            spec = event.selected_tool.tool_spec
+            if spec and "description" in spec:
+                spec["description"] = override
+
 {{/if}}
-"""
 
 {{#if hasMemory}}
 def agent_factory():
@@ -4706,13 +4861,23 @@ def agent_factory():
             cache[key] = Agent(
                 model=load_model(),
                 session_manager=get_memory_session_manager(session_id, user_id),
-                system_prompt=SYSTEM_PROMPT,
-                tools=tools
+                system_prompt=DEFAULT_SYSTEM_PROMPT,
+                tools=tools{{#if hasConfigBundle}},
+                hooks=[ConfigBundleHook()]{{/if}}
             )
         return cache[key]
     return get_or_create_agent
 get_or_create_agent = agent_factory()
 {{else}}
+{{#if hasConfigBundle}}
+def create_agent():
+    return Agent(
+        model=load_model(),
+        system_prompt=DEFAULT_SYSTEM_PROMPT,
+        tools=tools,
+        hooks=[ConfigBundleHook()],
+    )
+{{else}}
 _agent = None
 
 def get_or_create_agent():
@@ -4720,11 +4885,12 @@ def get_or_create_agent():
     if _agent is None:
         _agent = Agent(
             model=load_model(),
-            system_prompt=SYSTEM_PROMPT,
+            system_prompt=DEFAULT_SYSTEM_PROMPT,
             tools=tools
         )
     return _agent
 {{/if}}
+{{/if}}
 
 
 @app.entrypoint
@@ -4735,8 +4901,12 @@ async def invoke(payload, context):
     session_id = getattr(context, 'session_id', 'default-session')
     user_id = getattr(context, 'user_id', 'default-user')
     agent = get_or_create_agent(session_id, user_id)
+{{else}}
+{{#if hasConfigBundle}}
+    agent = create_agent()
 {{else}}
     agent = get_or_create_agent()
+{{/if}}
 {{/if}}
 
     # Execute and format response
diff --git a/src/assets/cdk/bin/cdk.ts b/src/assets/cdk/bin/cdk.ts
index 7a78b71cd..1c010e19b 100644
--- a/src/assets/cdk/bin/cdk.ts
+++ b/src/assets/cdk/bin/cdk.ts
@@ -54,6 +54,45 @@ async function main() {
     throw new Error('No deployment targets configured. Please define targets in agentcore/aws-targets.json');
   }
 
+  // Read harness configs for role creation.
+  // Harness fields may not yet be on the AgentCoreProjectSpec type from @aws/agentcore-cdk,
+  // so we read them dynamically via specAny (same pattern as gateways above).
+  // Harness paths in agentcore.json are relative to the project root (parent of agentcore/).
+  const projectRoot = path.resolve(configRoot, '..');
+  const harnessConfigs: {
+    name: string;
+    executionRoleArn?: string;
+    memoryName?: string;
+    containerUri?: string;
+    hasDockerfile?: boolean;
+    dockerfile?: string;
+    codeLocation?: string;
+    tools?: { type: string; name: string }[];
+    apiKeyArn?: string;
+  }[] = [];
+  for (const entry of specAny.harnesses ?? []) {
+    const harnessDir = path.resolve(projectRoot, entry.path);
+    const harnessPath = path.resolve(harnessDir, 'harness.json');
+    try {
+      const harnessSpec = JSON.parse(fs.readFileSync(harnessPath, 'utf-8'));
+      harnessConfigs.push({
+        name: entry.name,
+        executionRoleArn: harnessSpec.executionRoleArn,
+        memoryName: harnessSpec.memory?.name,
+        containerUri: harnessSpec.containerUri,
+        hasDockerfile: !!harnessSpec.dockerfile,
+        dockerfile: harnessSpec.dockerfile,
+        codeLocation: harnessSpec.dockerfile ? harnessDir : undefined,
+        tools: harnessSpec.tools,
+        apiKeyArn: harnessSpec.model?.apiKeyArn,
+      });
+    } catch (err) {
+      throw new Error(
+        `Could not read harness.json for "${entry.name}" at ${harnessPath}: ${err instanceof Error ? err.message : err}`
+      );
+    }
+  }
+
   const app = new App();
 
   for (const target of targets) {
@@ -73,6 +112,7 @@ async function main() {
       spec,
       mcpSpec,
       credentials,
+      harnesses: harnessConfigs.length > 0 ? harnessConfigs : undefined,
       env,
       description: `AgentCore stack for ${spec.name} deployed to ${target.name} (${target.region})`,
       tags: {
diff --git a/src/assets/cdk/lib/cdk-stack.ts b/src/assets/cdk/lib/cdk-stack.ts
index a4d277821..a89efc850 100644
--- a/src/assets/cdk/lib/cdk-stack.ts
+++ b/src/assets/cdk/lib/cdk-stack.ts
@@ -7,6 +7,18 @@ import {
 import { CfnOutput, Stack, type StackProps } from 'aws-cdk-lib';
 import { Construct } from 'constructs';
 
+export interface HarnessConfig {
+  name: string;
+  executionRoleArn?: string;
+  memoryName?: string;
+  containerUri?: string;
+  hasDockerfile?: boolean;
+  dockerfile?: string;
+  codeLocation?: string;
+  tools?: { type: string; name: string }[];
+  apiKeyArn?: string;
+}
+
 export interface AgentCoreStackProps extends StackProps {
   /**
    * The AgentCore project specification containing agents, memories, and credentials.
@@ -20,6 +32,14 @@ export interface AgentCoreStackProps extends StackProps {
    * Credential provider ARNs from deployed state, keyed by credential name.
    */
   credentials?: Record<string, { credentialProviderArn: string; clientSecretArn?: string }>;
+  /**
+   * Harness role configurations. Each entry creates an IAM execution role for a harness.
+   *
+   * When `hasDockerfile` is true and `codeLocation` is provided (without an explicit
+   * `containerUri`), the L3 construct builds and pushes a container image via CodeBuild
+   * and emits its URI as a stack output for the post-CDK harness deployer.
+   */
+  harnesses?: HarnessConfig[];
 }
 
 /**
@@ -35,11 +55,12 @@ export class AgentCoreStack extends Stack {
   constructor(scope: Construct, id: string, props: AgentCoreStackProps) {
     super(scope, id, props);
 
-    const { spec, mcpSpec, credentials } = props;
+    const { spec, mcpSpec, credentials, harnesses } = props;
 
-    // Create AgentCoreApplication with all agents
+    // Create AgentCoreApplication with all agents and harness roles
     this.application = new AgentCoreApplication(this, 'Application', {
       spec,
+      harnesses: harnesses?.length ? harnesses : undefined,
     });
 
     // Create AgentCoreMcp if there are gateways configured
diff --git a/src/assets/cdk/test/cdk.test.ts b/src/assets/cdk/test/cdk.test.ts
index df5c767f9..79282f729 100644
--- a/src/assets/cdk/test/cdk.test.ts
+++ b/src/assets/cdk/test/cdk.test.ts
@@ -14,6 +14,7 @@ test('AgentCoreStack synthesizes with empty spec', () => {
       credentials: [],
       evaluators: [],
       onlineEvalConfigs: [],
+      configBundles: [],
       policyEngines: [],
       agentCoreGateways: [],
       mcpRuntimeTools: [],
diff --git a/src/assets/harness/invoke.py.template b/src/assets/harness/invoke.py.template
new file mode 100644
index 000000000..cf2527f44
--- /dev/null
+++ b/src/assets/harness/invoke.py.template
@@ -0,0 +1,74 @@
+"""
+Standalone invoke script for AgentCore Harness.
+Generated by: agentcore create --with-invoke-script
+
+Usage:
+  pip install boto3
+  export HARNESS_ARN="arn:aws:bedrock-agentcore:<region>:<account>:harness/<harness-id>"
+  python invoke.py "Hello, what can you do?"
+  python invoke.py --raw-events "Hello"
+"""
+
+import argparse
+import json
+import os
+import sys
+import uuid
+
+import boto3
+
+# --- Configuration ---
+HARNESS_ARN = os.environ.get("HARNESS_ARN", "{{HARNESS_ARN}}")
+REGION = os.environ.get("AWS_REGION", "{{REGION}}")
+SESSION_ID = os.environ.get("SESSION_ID", str(uuid.uuid4()))
+
+parser = argparse.ArgumentParser(description="Invoke an AgentCore Harness")
+parser.add_argument("prompt", nargs="?", default="Hello!", help="Prompt to send to the agent")
+parser.add_argument("--raw-events", action="store_true", help="Print raw streaming events as JSON")
+parser.add_argument("--session-id", default=SESSION_ID, help="Session ID for conversation continuity")
+args = parser.parse_args()
+
+client = boto3.client("bedrock-agentcore", region_name=REGION)
+
+response = client.invoke_harness(
+    harnessArn=HARNESS_ARN,
+    runtimeSessionId=args.session_id,
+    messages=[
+        {
+            "role": "user",
+            "content": [{"text": args.prompt}],
+        }
+    ],
+)
+
+for event in response["stream"]:
+    if args.raw_events:
+        print(json.dumps(event, default=str))
+    else:
+        if "contentBlockStart" in event:
+            start = event["contentBlockStart"].get("start", {})
+            if "toolUse" in start:
+                tool = start["toolUse"]
+                print(f"\n🔧 Tool: {tool.get('name', 'unknown')}", flush=True)
+        elif "contentBlockDelta" in event:
+            delta = event["contentBlockDelta"].get("delta", {})
+            if "text" in delta:
+                print(delta["text"], end="", flush=True)
+        elif "messageStop" in event:
+            stop_reason = event["messageStop"].get("stopReason", "")
+            if stop_reason == "end_turn":
+                print()
+        elif "metadata" in event:
+            usage = event["metadata"].get("usage", {})
+            metrics = event["metadata"].get("metrics", {})
+            latency = metrics.get("latencyMs", 0) / 1000
+            print(
+                f"\n⚡ {usage.get('inputTokens', 0)} in · "
+                f"{usage.get('outputTokens', 0)} out · "
+                f"{latency:.1f}s",
+                file=sys.stderr,
+            )
+        elif "internalServerException" in event:
+            print(f"\nError: {event['internalServerException']}", file=sys.stderr)
+
+print(f"\n🔗 Session: {args.session_id}", file=sys.stderr)
diff --git a/src/assets/python/http/langchain_langgraph/base/main.py b/src/assets/python/http/langchain_langgraph/base/main.py
index dcb9eb13c..773253da0 100644
--- a/src/assets/python/http/langchain_langgraph/base/main.py
+++ b/src/assets/python/http/langchain_langgraph/base/main.py
@@ -1,7 +1,13 @@
 import os
-from langchain_core.messages import HumanMessage
+from typing import Any
+
+from langchain_core.messages import HumanMessage{{#if hasConfigBundle}}, SystemMessage{{/if}}
 from langgraph.prebuilt import create_react_agent
 from langchain.tools import tool
+{{#if hasConfigBundle}}
+from langchain_core.callbacks import BaseCallbackHandler
+from bedrock_agentcore.runtime.context import BedrockAgentCoreContext
+{{/if}}
 from opentelemetry.instrumentation.langchain import LangchainInstrumentor
 from bedrock_agentcore.runtime import BedrockAgentCoreApp
 from model.load import load_model
@@ -25,6 +31,14 @@ def get_or_create_model():
     return _llm
 
 
+DEFAULT_SYSTEM_PROMPT = """
+You are a helpful assistant. Use tools when appropriate.
+{{#if sessionStorageMountPath}}
+You have persistent storage at {{sessionStorageMountPath}}. Use file tools to read and write files. Data persists across sessions.
+{{/if}}
+"""
+
+
 # Define a simple function tool
 @tool
 def add_numbers(a: int, b: int) -> int:
@@ -88,13 +102,28 @@ def list_files(directory: str = "") -> str:
 tools.extend([file_read, file_write, list_files])
 {{/if}}
 
-SYSTEM_PROMPT = """
-You are a helpful assistant. Use tools when appropriate.
-{{#if sessionStorageMountPath}}
-You have persistent storage at {{sessionStorageMountPath}}. Use file tools to read and write files. Data persists across sessions.
-{{/if}}
-"""
+{{#if hasConfigBundle}}
+
+class ConfigBundleCallback(BaseCallbackHandler):
+    """Injects config bundle values into LangGraph agent at runtime.
+
+    BedrockAgentCoreContext.get_config_bundle() fetches the component configuration
+    for the current runtime ARN from the config bundle service. The SDK caches the
+    result and refreshes on bundle version changes.
+    """
+
+    def on_chain_start(self, serialized: dict, inputs: dict, **kwargs: Any) -> None:
+        config = BedrockAgentCoreContext.get_config_bundle()
+        prompt = config.get("systemPrompt", DEFAULT_SYSTEM_PROMPT)
 
+        messages = inputs.get("messages", [])
+        if messages and isinstance(messages[0], SystemMessage):
+            messages[0] = SystemMessage(content=prompt)
+        else:
+            messages.insert(0, SystemMessage(content=prompt))
+        inputs["messages"] = messages
+
+{{/if}}
 
 @app.entrypoint
 async def invoke(payload, context):
@@ -113,7 +142,21 @@ async def invoke(payload, context):
         mcp_tools = await mcp_client.get_tools()
 
     # Define the agent using create_react_agent
-    graph = create_react_agent(get_or_create_model(), tools=mcp_tools + tools, prompt=SYSTEM_PROMPT)
+{{#if hasConfigBundle}}
+    graph = create_react_agent(get_or_create_model(), tools=mcp_tools + tools, prompt=DEFAULT_SYSTEM_PROMPT)
+    callback = ConfigBundleCallback()
+
+    # Process the user prompt
+    prompt = payload.get("prompt", "What can you help me with?")
+    log.info(f"Agent input: {prompt}")
+
+    # Run the agent with config bundle callback
+    result = await graph.ainvoke(
+        {"messages": [HumanMessage(content=prompt)]},
+        config={"callbacks": [callback]},
+    )
+{{else}}
+    graph = create_react_agent(get_or_create_model(), tools=mcp_tools + tools, prompt=DEFAULT_SYSTEM_PROMPT)
 
     # Process the user prompt
     prompt = payload.get("prompt", "What can you help me with?")
@@ -121,6 +164,7 @@ async def invoke(payload, context):
 
     # Run the agent
     result = await graph.ainvoke({"messages": [HumanMessage(content=prompt)]})
+{{/if}}
 
     # Return result
     output = result["messages"][-1].content
diff --git a/src/assets/python/http/strands/base/main.py b/src/assets/python/http/strands/base/main.py
index f7b69d3e4..0cc8771ad 100644
--- a/src/assets/python/http/strands/base/main.py
+++ b/src/assets/python/http/strands/base/main.py
@@ -1,4 +1,10 @@
+from typing import Any
+
 from strands import Agent, tool
+{{#if hasConfigBundle}}
+from strands.hooks import HookProvider, HookRegistry, BeforeInvocationEvent, BeforeToolCallEvent
+from bedrock_agentcore.runtime.context import BedrockAgentCoreContext
+{{/if}}
 from bedrock_agentcore.runtime import BedrockAgentCoreApp
 from model.load import load_model
 {{#if hasGateway}}
@@ -23,11 +29,26 @@
 mcp_clients = [get_streamable_http_mcp_client()]
 {{/if}}
 
+DEFAULT_SYSTEM_PROMPT = """
+You are a helpful assistant. Use tools when appropriate.
+{{#if sessionStorageMountPath}}
+You have persistent storage at {{sessionStorageMountPath}}. Use file tools to read and write files. Data persists across sessions.
+{{/if}}
+"""
+
+{{#if hasConfigBundle}}
+DEFAULT_TOOL_DESC = "Return the sum of two numbers"
+{{/if}}
+
 # Define a collection of tools used by the model
 tools = []
 
 # Define a simple function tool
+{{#if hasConfigBundle}}
+@tool(description=DEFAULT_TOOL_DESC)
+{{else}}
 @tool
+{{/if}}
 def add_numbers(a: int, b: int) -> int:
     """Return the sum of two numbers"""
     return a+b
@@ -91,12 +112,39 @@ def list_files(directory: str = "") -> str:
     if mcp_client:
         tools.append(mcp_client)
 
-SYSTEM_PROMPT = """
-You are a helpful assistant. Use tools when appropriate.
-{{#if sessionStorageMountPath}}
-You have persistent storage at {{sessionStorageMountPath}}. Use file tools to read and write files. Data persists across sessions.
+{{#if hasConfigBundle}}
+
+class ConfigBundleHook(HookProvider):
+    """Injects config bundle values (system prompt, tool descriptions) before each invocation.
+
+    BedrockAgentCoreContext.get_config_bundle() fetches the component configuration
+    for the current runtime ARN from the config bundle service. The SDK caches the
+    result and refreshes on bundle version changes.
+    """
+
+    def register_hooks(self, registry: HookRegistry, **kwargs: Any) -> None:
+        registry.add_callback(BeforeInvocationEvent, self._inject_system_prompt)
+        registry.add_callback(BeforeToolCallEvent, self._override_tool_desc)
+
+    def _inject_system_prompt(self, event: BeforeInvocationEvent) -> None:
+        config = BedrockAgentCoreContext.get_config_bundle()
+        prompt = config.get("systemPrompt", DEFAULT_SYSTEM_PROMPT)
+
+        if prompt != event.agent.system_prompt:
+            event.agent.system_prompt = prompt
+
+    def _override_tool_desc(self, event: BeforeToolCallEvent) -> None:
+        config = BedrockAgentCoreContext.get_config_bundle()
+        tool_descs = config.get("toolDescriptions", {})
+
+        tool_name = event.tool_use["name"]
+        override = tool_descs.get(tool_name)
+        if override and event.selected_tool:
+            spec = event.selected_tool.tool_spec
+            if spec and "description" in spec:
+                spec["description"] = override
+
 {{/if}}
-"""
 
 {{#if hasMemory}}
 def agent_factory():
@@ -108,13 +156,23 @@ def get_or_create_agent(session_id, user_id):
             cache[key] = Agent(
                 model=load_model(),
                 session_manager=get_memory_session_manager(session_id, user_id),
-                system_prompt=SYSTEM_PROMPT,
-                tools=tools
+                system_prompt=DEFAULT_SYSTEM_PROMPT,
+                tools=tools{{#if hasConfigBundle}},
+                hooks=[ConfigBundleHook()]{{/if}}
             )
         return cache[key]
     return get_or_create_agent
 get_or_create_agent = agent_factory()
 {{else}}
+{{#if hasConfigBundle}}
+def create_agent():
+    return Agent(
+        model=load_model(),
+        system_prompt=DEFAULT_SYSTEM_PROMPT,
+        tools=tools,
+        hooks=[ConfigBundleHook()],
+    )
+{{else}}
 _agent = None
 
 def get_or_create_agent():
@@ -122,11 +180,12 @@ def get_or_create_agent():
     if _agent is None:
         _agent = Agent(
             model=load_model(),
-            system_prompt=SYSTEM_PROMPT,
+            system_prompt=DEFAULT_SYSTEM_PROMPT,
             tools=tools
         )
     return _agent
 {{/if}}
+{{/if}}
 
 
 @app.entrypoint
@@ -137,8 +196,12 @@ async def invoke(payload, context):
     session_id = getattr(context, 'session_id', 'default-session')
     user_id = getattr(context, 'user_id', 'default-user')
     agent = get_or_create_agent(session_id, user_id)
+{{else}}
+{{#if hasConfigBundle}}
+    agent = create_agent()
 {{else}}
     agent = get_or_create_agent()
+{{/if}}
 {{/if}}
 
     # Execute and format response
diff --git a/src/cli/__tests__/global-config.test.ts b/src/cli/__tests__/global-config.test.ts
index 2851a13a4..6e2038973 100644
--- a/src/cli/__tests__/global-config.test.ts
+++ b/src/cli/__tests__/global-config.test.ts
@@ -1,4 +1,9 @@
-import { getOrCreateInstallationId, readGlobalConfig, updateGlobalConfig } from '../global-config';
+import {
+  getOrCreateInstallationId,
+  readGlobalConfig,
+  readGlobalConfigSync,
+  updateGlobalConfig,
+} from '../../lib/schemas/io/global-config';
 import { createTempConfig } from './helpers/temp-config';
 import { readFile, writeFile } from 'fs/promises';
 import { afterAll, beforeEach, describe, expect, it } from 'vitest';
@@ -21,10 +26,29 @@ describe('global-config', () => {
     it('returns empty object when file is missing or invalid', async () => {
       expect(await readGlobalConfig(tmp.testDir + '/nonexistent.json')).toEqual({});
 
-      await writeFile(tmp.configFile, JSON.stringify({ telemetry: { enabled: 'false' } }));
+      await writeFile(tmp.configFile, 'not json');
       expect(await readGlobalConfig(tmp.configFile)).toEqual({});
     });
 
+    it('drops invalid fields while preserving valid ones', async () => {
+      await writeFile(
+        tmp.configFile,
+        JSON.stringify({
+          transactionSearchIndexPercentage: 'not-a-number',
+          uvIndex: 'https://valid.url',
+          telemetry: { enabled: 'yes', endpoint: 'https://example.com' },
+        })
+      );
+
+      const config = await readGlobalConfig(tmp.configFile);
+
+      expect(config).toEqual({
+        transactionSearchIndexPercentage: undefined,
+        uvIndex: 'https://valid.url',
+        telemetry: { enabled: undefined, endpoint: 'https://example.com' },
+      });
+    });
+
     it('preserves unknown fields via passthrough', async () => {
       const full = {
         installationId: 'abc-123',
@@ -39,6 +63,21 @@ describe('global-config', () => {
     });
   });
 
+  describe('readGlobalConfigSync', () => {
+    it('returns parsed config when file exists', async () => {
+      await writeFile(tmp.configFile, JSON.stringify({ telemetry: { enabled: false } }));
+
+      expect(readGlobalConfigSync(tmp.configFile)).toEqual({ telemetry: { enabled: false } });
+    });
+
+    it('returns empty object when file is missing or invalid', async () => {
+      expect(readGlobalConfigSync(tmp.testDir + '/nonexistent.json')).toEqual({});
+
+      await writeFile(tmp.configFile, 'not json');
+      expect(readGlobalConfigSync(tmp.configFile)).toEqual({});
+    });
+  });
+
   describe('updateGlobalConfig', () => {
     it('creates directory and writes config when none exists', async () => {
       const fresh = createTempConfig('gc-fresh');
diff --git a/src/cli/__tests__/update-notifier.test.ts b/src/cli/__tests__/update-notifier.test.ts
index 3713e51f2..27eb3f649 100644
--- a/src/cli/__tests__/update-notifier.test.ts
+++ b/src/cli/__tests__/update-notifier.test.ts
@@ -15,6 +15,12 @@ vi.mock('fs/promises', () => ({
 
 vi.mock('../constants.js', () => ({
   PACKAGE_VERSION: '1.0.0',
+  getDistroConfig: () => ({
+    packageName: '@aws/agentcore',
+    registryUrl: 'https://registry.npmjs.org',
+    distTag: 'latest',
+    installCommand: 'npm install -g @aws/agentcore@latest',
+  }),
 }));
 
 const { mockFetchLatestVersion, mockCompareVersions } = vi.hoisted(() => ({
diff --git a/src/cli/aws/__tests__/agentcore-ab-tests.test.ts b/src/cli/aws/__tests__/agentcore-ab-tests.test.ts
new file mode 100644
index 000000000..94dca3bdb
--- /dev/null
+++ b/src/cli/aws/__tests__/agentcore-ab-tests.test.ts
@@ -0,0 +1,345 @@
+import { createABTest, deleteABTest, getABTest, listABTests, updateABTest } from '../agentcore-ab-tests.js';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mockFetch = vi.fn();
+vi.stubGlobal('fetch', mockFetch);
+
+vi.mock('../account', () => ({
+  getCredentialProvider: vi.fn().mockReturnValue({
+    accessKeyId: 'AKID',
+    secretAccessKey: 'SECRET',
+    sessionToken: 'TOKEN',
+  }),
+}));
+
+vi.mock('@smithy/signature-v4', () => ({
+  SignatureV4: class {
+    // eslint-disable-next-line @typescript-eslint/require-await
+    async sign(request: { headers: Record<string, string> }) {
+      return { headers: { ...request.headers, Authorization: 'signed' } };
+    }
+  },
+}));
+
+vi.mock('@aws-crypto/sha256-js', () => ({
+  Sha256: class {},
+}));
+
+vi.mock('@aws-sdk/credential-provider-node', () => ({
+  defaultProvider: vi.fn(),
+}));
+
+function mockJsonResponse(body: unknown, status = 200) {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    headers: new Map([['x-amzn-requestid', 'test-request-id']]),
+    json: () => Promise.resolve(body),
+    text: () => Promise.resolve(JSON.stringify(body)),
+  };
+}
+
+describe('agentcore-ab-tests', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('createABTest', () => {
+    it('sends POST to /ab-tests with correct body', async () => {
+      mockFetch.mockResolvedValue(
+        mockJsonResponse({
+          abTestId: 'abt-001',
+          abTestArn: 'arn:abt:001',
+          name: 'MyTest',
+          status: 'CREATED',
+          executionStatus: 'STOPPED',
+          createdAt: '2026-01-01T00:00:00Z',
+        })
+      );
+
+      const result = await createABTest({
+        region: 'us-east-1',
+        name: 'MyTest',
+        gatewayArn: 'arn:aws:bedrock-agentcore:us-east-1:123:gateway/gw-1',
+        roleArn: 'arn:aws:iam::123:role/TestRole',
+        variants: [
+          {
+            name: 'C',
+            weight: 80,
+            variantConfiguration: { configurationBundle: { bundleArn: 'arn:bundle:c', bundleVersion: 'v1' } },
+          },
+          {
+            name: 'T1',
+            weight: 20,
+            variantConfiguration: { configurationBundle: { bundleArn: 'arn:bundle:t', bundleVersion: 'v1' } },
+          },
+        ],
+        evaluationConfig: { onlineEvaluationConfigArn: 'arn:eval:config' },
+      });
+
+      expect(result.abTestId).toBe('abt-001');
+      expect(mockFetch).toHaveBeenCalledWith(
+        expect.stringContaining('/ab-tests'),
+        expect.objectContaining({ method: 'POST' })
+      );
+
+      const body = JSON.parse(mockFetch.mock.calls[0]![1].body);
+      expect(body.name).toBe('MyTest');
+      expect(body.gatewayArn).toBe('arn:aws:bedrock-agentcore:us-east-1:123:gateway/gw-1');
+      expect(body.variants).toHaveLength(2);
+      expect(body.clientToken).toBeDefined();
+    });
+
+    it('omits optional fields when not provided', async () => {
+      mockFetch.mockResolvedValue(
+        mockJsonResponse({
+          abTestId: 'abt-002',
+          abTestArn: 'arn:abt:002',
+          status: 'CREATED',
+          executionStatus: 'STOPPED',
+          createdAt: '2026-01-01T00:00:00Z',
+        })
+      );
+
+      await createABTest({
+        region: 'us-east-1',
+        name: 'Test',
+        gatewayArn: 'arn:gw',
+        roleArn: 'arn:role',
+        variants: [],
+        evaluationConfig: { onlineEvaluationConfigArn: 'arn:eval' },
+      });
+
+      const body = JSON.parse(mockFetch.mock.calls[0]![1].body);
+      expect(body.description).toBeUndefined();
+      expect(body.trafficAllocationConfig).toBeUndefined();
+      expect(body.maxDurationDays).toBeUndefined();
+      expect(body.enableOnCreate).toBeUndefined();
+    });
+
+    it('includes optional fields when provided', async () => {
+      mockFetch.mockResolvedValue(
+        mockJsonResponse({
+          abTestId: 'abt-003',
+          abTestArn: 'arn:abt:003',
+          status: 'CREATED',
+          executionStatus: 'RUNNING',
+          createdAt: '2026-01-01T00:00:00Z',
+        })
+      );
+
+      await createABTest({
+        region: 'us-east-1',
+        name: 'Test',
+        description: 'A description',
+        gatewayArn: 'arn:gw',
+        roleArn: 'arn:role',
+        variants: [],
+        evaluationConfig: { onlineEvaluationConfigArn: 'arn:eval' },
+        trafficAllocationConfig: { routeOnHeader: { headerName: 'X-AB' } },
+        maxDurationDays: 30,
+        enableOnCreate: true,
+      });
+
+      const body = JSON.parse(mockFetch.mock.calls[0]![1].body);
+      expect(body.description).toBe('A description');
+      expect(body.trafficAllocationConfig).toEqual({ routeOnHeader: { headerName: 'X-AB' } });
+      expect(body.maxDurationDays).toBe(30);
+      expect(body.enableOnCreate).toBe(true);
+    });
+
+    it('throws on non-ok response', async () => {
+      mockFetch.mockResolvedValue({
+        ok: false,
+        status: 400,
+        headers: new Map([['x-amzn-requestid', 'test-request-id']]),
+        text: () => Promise.resolve('Bad Request'),
+      });
+
+      await expect(
+        createABTest({
+          region: 'us-east-1',
+          name: 'Test',
+          gatewayArn: 'arn:gw',
+          roleArn: 'arn:role',
+          variants: [],
+          evaluationConfig: { onlineEvaluationConfigArn: 'arn:eval' },
+        })
+      ).rejects.toThrow('ABTest API error (400)');
+    });
+  });
+
+  describe('getABTest', () => {
+    it('sends GET to /ab-tests/{id}', async () => {
+      mockFetch.mockResolvedValue(
+        mockJsonResponse({
+          abTestId: 'abt-123',
+          abTestArn: 'arn:abt:123',
+          name: 'MyTest',
+          status: 'ACTIVE',
+          executionStatus: 'RUNNING',
+          gatewayArn: 'arn:gw',
+          roleArn: 'arn:role',
+          variants: [],
+          evaluationConfig: { onlineEvaluationConfigArn: 'arn:eval' },
+          createdAt: '2026-01-01T00:00:00Z',
+          updatedAt: '2026-01-02T00:00:00Z',
+          results: {
+            analysisTimestamp: '2026-01-02T00:00:00Z',
+            evaluatorMetrics: [],
+          },
+        })
+      );
+
+      const result = await getABTest({ region: 'us-east-1', abTestId: 'abt-123' });
+
+      expect(result.abTestId).toBe('abt-123');
+      expect(result.results).toBeDefined();
+      expect(mockFetch).toHaveBeenCalledWith(
+        expect.stringContaining('/ab-tests/abt-123'),
+        expect.objectContaining({ method: 'GET' })
+      );
+    });
+  });
+
+  describe('updateABTest', () => {
+    it('sends PUT to /ab-tests/{id} with only defined fields', async () => {
+      mockFetch.mockResolvedValue(
+        mockJsonResponse({
+          abTestId: 'abt-123',
+          abTestArn: 'arn:abt:123',
+          status: 'ACTIVE',
+          executionStatus: 'PAUSED',
+          updatedAt: '2026-01-02T00:00:00Z',
+        })
+      );
+
+      await updateABTest({
+        region: 'us-east-1',
+        abTestId: 'abt-123',
+        executionStatus: 'PAUSED',
+      });
+
+      expect(mockFetch).toHaveBeenCalledWith(
+        expect.stringContaining('/ab-tests/abt-123'),
+        expect.objectContaining({ method: 'PUT' })
+      );
+
+      const body = JSON.parse(mockFetch.mock.calls[0]![1].body);
+      expect(body.executionStatus).toBe('PAUSED');
+      expect(body.clientToken).toBeDefined();
+      expect(body.name).toBeUndefined();
+      expect(body.description).toBeUndefined();
+      expect(body.variants).toBeUndefined();
+    });
+
+    it('includes all provided fields', async () => {
+      mockFetch.mockResolvedValue(
+        mockJsonResponse({
+          abTestId: 'abt-123',
+          abTestArn: 'arn:abt:123',
+          status: 'ACTIVE',
+          executionStatus: 'RUNNING',
+          updatedAt: '2026-01-02T00:00:00Z',
+        })
+      );
+
+      await updateABTest({
+        region: 'us-east-1',
+        abTestId: 'abt-123',
+        name: 'Updated',
+        description: 'New desc',
+        maxDurationDays: 60,
+        roleArn: 'arn:new-role',
+      });
+
+      const body = JSON.parse(mockFetch.mock.calls[0]![1].body);
+      expect(body.name).toBe('Updated');
+      expect(body.description).toBe('New desc');
+      expect(body.maxDurationDays).toBe(60);
+      expect(body.roleArn).toBe('arn:new-role');
+    });
+  });
+
+  describe('deleteABTest', () => {
+    it('sends DELETE to /ab-tests/{id} and returns success', async () => {
+      mockFetch.mockResolvedValue(mockJsonResponse({}, 204));
+
+      const result = await deleteABTest({ region: 'us-east-1', abTestId: 'abt-123' });
+
+      expect(result.success).toBe(true);
+      expect(mockFetch).toHaveBeenCalledWith(
+        expect.stringContaining('/ab-tests/abt-123'),
+        expect.objectContaining({ method: 'DELETE' })
+      );
+    });
+
+    it('returns error on 404', async () => {
+      mockFetch.mockResolvedValue({
+        ok: false,
+        status: 404,
+        headers: new Map([['x-amzn-requestid', 'test-request-id']]),
+        text: () => Promise.resolve('Not Found'),
+      });
+
+      const result = await deleteABTest({ region: 'us-east-1', abTestId: 'abt-999' });
+
+      expect(mockFetch).toHaveBeenCalledTimes(1);
+      expect(mockFetch.mock.calls[0]![0]).toContain('/ab-tests/abt-999');
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('ABTest API error (404)');
+    });
+
+    it('returns error on network failure', async () => {
+      mockFetch.mockRejectedValue(new Error('Network error'));
+
+      const result = await deleteABTest({ region: 'us-east-1', abTestId: 'abt-123' });
+
+      expect(result.success).toBe(false);
+      expect(result.error).toBe('Network error');
+    });
+  });
+
+  describe('listABTests', () => {
+    it('sends GET to /ab-tests', async () => {
+      mockFetch.mockResolvedValue(
+        mockJsonResponse({
+          abTests: [
+            {
+              abTestId: 'abt-1',
+              abTestArn: 'arn:abt:1',
+              name: 'Test1',
+              status: 'ACTIVE',
+              executionStatus: 'RUNNING',
+              createdAt: '2026-01-01T00:00:00Z',
+              updatedAt: '2026-01-01T00:00:00Z',
+            },
+          ],
+        })
+      );
+
+      const result = await listABTests({ region: 'us-east-1' });
+
+      expect(result.abTests).toHaveLength(1);
+      expect(result.abTests[0]!.name).toBe('Test1');
+    });
+
+    it('passes maxResults and nextToken as query params', async () => {
+      mockFetch.mockResolvedValue(mockJsonResponse({ abTests: [] }));
+
+      await listABTests({ region: 'us-east-1', maxResults: 10, nextToken: 'abc' });
+
+      const url = mockFetch.mock.calls[0]![0] as string;
+      expect(url).toContain('maxResults=10');
+      expect(url).toContain('nextToken=abc');
+    });
+
+    it('returns empty array when response has no abTests', async () => {
+      mockFetch.mockResolvedValue(mockJsonResponse({}));
+
+      const result = await listABTests({ region: 'us-east-1' });
+
+      expect(result.abTests).toEqual([]);
+    });
+  });
+});
diff --git a/src/cli/aws/__tests__/agentcore-harness.test.ts b/src/cli/aws/__tests__/agentcore-harness.test.ts
new file mode 100644
index 000000000..7d14d776c
--- /dev/null
+++ b/src/cli/aws/__tests__/agentcore-harness.test.ts
@@ -0,0 +1,451 @@
+import {
+  createHarness,
+  deleteHarness,
+  getHarness,
+  invokeHarness,
+  listAllHarnesses,
+  listHarnesses,
+  updateHarness,
+} from '../agentcore-harness.js';
+import { EventStreamCodec } from '@smithy/eventstream-codec';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { mockRequest, mockRequestRaw } = vi.hoisted(() => ({
+  mockRequest: vi.fn(),
+  mockRequestRaw: vi.fn(),
+}));
+
+vi.mock('../api-client', () => ({
+  AgentCoreApiClient: class {
+    request = mockRequest;
+    requestRaw = mockRequestRaw;
+  },
+  AgentCoreApiError: class extends Error {
+    statusCode: number;
+    requestId: string | undefined;
+    errorBody: string;
+    constructor(statusCode: number, errorBody: string, requestId?: string) {
+      super(`AgentCore API error (${statusCode}): ${errorBody}`);
+      this.statusCode = statusCode;
+      this.requestId = requestId;
+      this.errorBody = errorBody;
+    }
+  },
+}));
+
+describe('Harness control plane operations', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('createHarness', () => {
+    it('sends POST /harnesses with correct body', async () => {
+      const harness = { harnessId: 'h-123', harnessName: 'test', status: 'CREATING' };
+      mockRequest.mockResolvedValue({ harness });
+
+      const result = await createHarness({
+        region: 'us-west-2',
+        harnessName: 'test',
+        executionRoleArn: 'arn:aws:iam::123:role/TestRole',
+        model: { bedrockModelConfig: { modelId: 'us.anthropic.claude-sonnet-4-6-20250514-v1:0' } },
+        systemPrompt: [{ text: 'You are helpful.' }],
+        tools: [{ type: 'agentcore_browser', name: 'browser' }],
+        maxIterations: 75,
+      });
+
+      expect(result.harness.harnessId).toBe('h-123');
+      expect(mockRequest).toHaveBeenCalledWith(
+        expect.objectContaining({
+          method: 'POST',
+          path: '/harnesses',
+          body: expect.objectContaining({
+            harnessName: 'test',
+            executionRoleArn: 'arn:aws:iam::123:role/TestRole',
+            clientToken: expect.any(String),
+            model: { bedrockModelConfig: { modelId: 'us.anthropic.claude-sonnet-4-6-20250514-v1:0' } },
+            systemPrompt: [{ text: 'You are helpful.' }],
+            tools: [{ type: 'agentcore_browser', name: 'browser' }],
+            maxIterations: 75,
+          }),
+        })
+      );
+    });
+
+    it('omits optional fields when not provided', async () => {
+      mockRequest.mockResolvedValue({ harness: { harnessId: 'h-1' } });
+
+      await createHarness({
+        region: 'us-west-2',
+        harnessName: 'minimal',
+        executionRoleArn: 'arn:aws:iam::123:role/R',
+      });
+
+      const body = mockRequest.mock.calls[0]![0].body;
+      expect(body.model).toBeUndefined();
+      expect(body.tools).toBeUndefined();
+      expect(body.memory).toBeUndefined();
+      expect(body.maxIterations).toBeUndefined();
+    });
+  });
+
+  describe('getHarness', () => {
+    it('sends GET /harnesses/{harnessId}', async () => {
+      const harness = { harnessId: 'h-123', status: 'READY' };
+      mockRequest.mockResolvedValue({ harness });
+
+      const result = await getHarness({ region: 'us-west-2', harnessId: 'h-123' });
+
+      expect(result.harness.status).toBe('READY');
+      expect(mockRequest).toHaveBeenCalledWith(
+        expect.objectContaining({
+          method: 'GET',
+          path: '/harnesses/h-123',
+        })
+      );
+    });
+  });
+
+  describe('updateHarness', () => {
+    it('sends PATCH /harnesses/{harnessId}', async () => {
+      mockRequest.mockResolvedValue({ harness: { harnessId: 'h-123', status: 'UPDATING' } });
+
+      await updateHarness({
+        region: 'us-west-2',
+        harnessId: 'h-123',
+        model: { bedrockModelConfig: { modelId: 'new-model' } },
+        maxTokens: 4096,
+      });
+
+      expect(mockRequest).toHaveBeenCalledWith(
+        expect.objectContaining({
+          method: 'PATCH',
+          path: '/harnesses/h-123',
+          body: expect.objectContaining({
+            clientToken: expect.any(String),
+            model: { bedrockModelConfig: { modelId: 'new-model' } },
+            maxTokens: 4096,
+          }),
+        })
+      );
+    });
+
+    it('passes nullable wrapper fields for memory and environmentArtifact', async () => {
+      mockRequest.mockResolvedValue({ harness: { harnessId: 'h-123' } });
+
+      await updateHarness({
+        region: 'us-west-2',
+        harnessId: 'h-123',
+        memory: { optionalValue: null },
+        environmentArtifact: { optionalValue: null },
+      });
+
+      const body = mockRequest.mock.calls[0]![0].body;
+      expect(body.memory).toEqual({ optionalValue: null });
+      expect(body.environmentArtifact).toEqual({ optionalValue: null });
+    });
+  });
+
+  describe('deleteHarness', () => {
+    it('sends DELETE /harnesses/{harnessId} with clientToken query param', async () => {
+      mockRequest.mockResolvedValue({ harness: { harnessId: 'h-123', status: 'DELETING' } });
+
+      await deleteHarness({ region: 'us-west-2', harnessId: 'h-123' });
+
+      expect(mockRequest).toHaveBeenCalledWith(
+        expect.objectContaining({
+          method: 'DELETE',
+          path: '/harnesses/h-123',
+          query: { clientToken: expect.any(String) },
+        })
+      );
+    });
+  });
+
+  describe('listHarnesses', () => {
+    it('sends GET /harnesses with query params', async () => {
+      mockRequest.mockResolvedValue({
+        harnesses: [{ harnessId: 'h-1', harnessName: 'one' }],
+        nextToken: undefined,
+      });
+
+      const result = await listHarnesses({ region: 'us-west-2', maxResults: 10 });
+
+      expect(result.harnesses).toHaveLength(1);
+      expect(mockRequest).toHaveBeenCalledWith(
+        expect.objectContaining({
+          method: 'GET',
+          path: '/harnesses',
+          query: { maxResults: '10' },
+        })
+      );
+    });
+  });
+
+  describe('listAllHarnesses', () => {
+    it('auto-paginates across multiple pages', async () => {
+      mockRequest
+        .mockResolvedValueOnce({
+          harnesses: [{ harnessId: 'h-1' }],
+          nextToken: 'tok-1',
+        })
+        .mockResolvedValueOnce({
+          harnesses: [{ harnessId: 'h-2' }],
+          nextToken: undefined,
+        });
+
+      const all = await listAllHarnesses('us-west-2');
+
+      expect(all).toHaveLength(2);
+      expect(all[0]!.harnessId).toBe('h-1');
+      expect(all[1]!.harnessId).toBe('h-2');
+      expect(mockRequest).toHaveBeenCalledTimes(2);
+    });
+  });
+});
+
+describe('invokeHarness (streaming)', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  const toUtf8 = (input: Uint8Array) => new TextDecoder().decode(input);
+  const fromUtf8 = (input: string) => new TextEncoder().encode(input);
+  const codec = new EventStreamCodec(toUtf8, fromUtf8);
+
+  function encodeEvent(eventType: string, payload: Record<string, unknown>): Uint8Array {
+    return codec.encode({
+      headers: {
+        ':event-type': { type: 'string', value: eventType },
+        ':content-type': { type: 'string', value: 'application/json' },
+        ':message-type': { type: 'string', value: 'event' },
+      },
+      body: fromUtf8(JSON.stringify(payload)),
+    });
+  }
+
+  function makeStreamResponse(frames: Uint8Array[]): Response {
+    let totalLen = 0;
+    for (const f of frames) totalLen += f.length;
+    const combined = new Uint8Array(totalLen);
+    let off = 0;
+    for (const f of frames) {
+      combined.set(f, off);
+      off += f.length;
+    }
+    const stream = new ReadableStream({
+      start(controller) {
+        controller.enqueue(combined);
+        controller.close();
+      },
+    });
+    return new Response(stream, { status: 200 });
+  }
+
+  it('yields messageStart events', async () => {
+    mockRequestRaw.mockResolvedValue(makeStreamResponse([encodeEvent('messageStart', { role: 'assistant' })]));
+
+    const events = [];
+    for await (const event of invokeHarness({
+      region: 'us-west-2',
+      harnessArn: 'arn:aws:bedrock-agentcore:us-west-2:123:harness/h-123',
+      runtimeSessionId: 'sess-1',
+      messages: [{ role: 'user', content: [{ text: 'hello' }] }],
+    })) {
+      events.push(event);
+    }
+
+    expect(events).toHaveLength(1);
+    expect(events[0]).toEqual({ type: 'messageStart', role: 'assistant' });
+  });
+
+  it('yields text deltas', async () => {
+    mockRequestRaw.mockResolvedValue(
+      makeStreamResponse([
+        encodeEvent('contentBlockDelta', { contentBlockIndex: 0, delta: { text: 'Hello' } }),
+        encodeEvent('contentBlockDelta', { contentBlockIndex: 0, delta: { text: ' world' } }),
+      ])
+    );
+
+    const events = [];
+    for await (const event of invokeHarness({
+      region: 'us-west-2',
+      harnessArn: 'arn:harness',
+      runtimeSessionId: 'sess-1',
+      messages: [{ role: 'user', content: [{ text: 'hi' }] }],
+    })) {
+      events.push(event);
+    }
+
+    expect(events).toHaveLength(2);
+    expect(events[0]).toEqual({
+      type: 'contentBlockDelta',
+      contentBlockIndex: 0,
+      delta: { type: 'text', text: 'Hello' },
+    });
+    expect(events[1]).toEqual({
+      type: 'contentBlockDelta',
+      contentBlockIndex: 0,
+      delta: { type: 'text', text: ' world' },
+    });
+  });
+
+  it('yields tool use start events', async () => {
+    mockRequestRaw.mockResolvedValue(
+      makeStreamResponse([
+        encodeEvent('contentBlockStart', {
+          contentBlockIndex: 1,
+          start: { toolUse: { toolUseId: 'tu-1', name: 'exa_search', type: 'remote_mcp', serverName: 'exa' } },
+        }),
+      ])
+    );
+
+    const events = [];
+    for await (const event of invokeHarness({
+      region: 'us-west-2',
+      harnessArn: 'arn:harness',
+      runtimeSessionId: 'sess-1',
+      messages: [{ role: 'user', content: [{ text: 'search' }] }],
+    })) {
+      events.push(event);
+    }
+
+    expect(events).toHaveLength(1);
+    expect(events[0]).toEqual({
+      type: 'contentBlockStart',
+      contentBlockIndex: 1,
+      start: {
+        type: 'toolUse',
+        toolUse: { toolUseId: 'tu-1', name: 'exa_search', type: 'remote_mcp', serverName: 'exa' },
+      },
+    });
+  });
+
+  it('yields messageStop with stopReason', async () => {
+    mockRequestRaw.mockResolvedValue(makeStreamResponse([encodeEvent('messageStop', { stopReason: 'end_turn' })]));
+
+    const events = [];
+    for await (const event of invokeHarness({
+      region: 'us-west-2',
+      harnessArn: 'arn:harness',
+      runtimeSessionId: 'sess-1',
+      messages: [{ role: 'user', content: [{ text: 'hi' }] }],
+    })) {
+      events.push(event);
+    }
+
+    expect(events[0]).toEqual({ type: 'messageStop', stopReason: 'end_turn' });
+  });
+
+  it('yields metadata with token usage', async () => {
+    mockRequestRaw.mockResolvedValue(
+      makeStreamResponse([
+        encodeEvent('metadata', {
+          usage: { inputTokens: 100, outputTokens: 50, totalTokens: 150 },
+          metrics: { latencyMs: 1200 },
+        }),
+      ])
+    );
+
+    const events = [];
+    for await (const event of invokeHarness({
+      region: 'us-west-2',
+      harnessArn: 'arn:harness',
+      runtimeSessionId: 'sess-1',
+      messages: [{ role: 'user', content: [{ text: 'hi' }] }],
+    })) {
+      events.push(event);
+    }
+
+    expect(events[0]).toEqual({
+      type: 'metadata',
+      usage: { inputTokens: 100, outputTokens: 50, totalTokens: 150 },
+      metrics: { latencyMs: 1200 },
+    });
+  });
+
+  it('yields error events for exception event types', async () => {
+    mockRequestRaw.mockResolvedValue(
+      makeStreamResponse([encodeEvent('internalServerException', { message: 'Something broke' })])
+    );
+
+    const events = [];
+    for await (const event of invokeHarness({
+      region: 'us-west-2',
+      harnessArn: 'arn:harness',
+      runtimeSessionId: 'sess-1',
+      messages: [{ role: 'user', content: [{ text: 'hi' }] }],
+    })) {
+      events.push(event);
+    }
+
+    expect(events[0]).toEqual({
+      type: 'error',
+      errorType: 'internalServerException',
+      message: 'Something broke',
+    });
+  });
+
+  it('passes override options in request body', async () => {
+    mockRequestRaw.mockResolvedValue(makeStreamResponse([]));
+
+    for await (const _event of invokeHarness({
+      region: 'us-west-2',
+      harnessArn: 'arn:harness',
+      runtimeSessionId: 'sess-1',
+      messages: [{ role: 'user', content: [{ text: 'hi' }] }],
+      model: { bedrockModelConfig: { modelId: 'override-model' } },
+      maxIterations: 20,
+      skills: [{ path: './skills/research' }],
+    })) {
+      // drain
+    }
+
+    expect(mockRequestRaw).toHaveBeenCalledWith(
+      expect.objectContaining({
+        method: 'POST',
+        path: '/harnesses/invoke',
+        query: { harnessArn: 'arn:harness' },
+        headers: { 'X-Amzn-Bedrock-AgentCore-Runtime-Session-Id': 'sess-1' },
+        body: expect.objectContaining({
+          model: { bedrockModelConfig: { modelId: 'override-model' } },
+          maxIterations: 20,
+          skills: [{ path: './skills/research' }],
+        }),
+      })
+    );
+  });
+
+  it('handles multiple event types in sequence', async () => {
+    mockRequestRaw.mockResolvedValue(
+      makeStreamResponse([
+        encodeEvent('messageStart', { role: 'assistant' }),
+        encodeEvent('contentBlockDelta', { contentBlockIndex: 0, delta: { text: 'Hi' } }),
+        encodeEvent('contentBlockStop', { contentBlockIndex: 0 }),
+        encodeEvent('messageStop', { stopReason: 'end_turn' }),
+        encodeEvent('metadata', {
+          usage: { inputTokens: 10, outputTokens: 1, totalTokens: 11 },
+          metrics: { latencyMs: 100 },
+        }),
+      ])
+    );
+
+    const events = [];
+    for await (const event of invokeHarness({
+      region: 'us-west-2',
+      harnessArn: 'arn:harness',
+      runtimeSessionId: 'sess-1',
+      messages: [{ role: 'user', content: [{ text: 'hi' }] }],
+    })) {
+      events.push(event);
+    }
+
+    expect(events).toHaveLength(5);
+    expect(events.map(e => e.type)).toEqual([
+      'messageStart',
+      'contentBlockDelta',
+      'contentBlockStop',
+      'messageStop',
+      'metadata',
+    ]);
+  });
+});
diff --git a/src/cli/aws/__tests__/agentcore-http-gateways.test.ts b/src/cli/aws/__tests__/agentcore-http-gateways.test.ts
new file mode 100644
index 000000000..f9ace9a7a
--- /dev/null
+++ b/src/cli/aws/__tests__/agentcore-http-gateways.test.ts
@@ -0,0 +1,235 @@
+import { createHttpGatewayTarget, getHttpGateway, listHttpGatewayTargets } from '../agentcore-http-gateways.js';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mockFetch = vi.fn();
+vi.stubGlobal('fetch', mockFetch);
+
+vi.mock('../account', () => ({
+  getCredentialProvider: vi.fn().mockReturnValue({
+    accessKeyId: 'AKID',
+    secretAccessKey: 'SECRET',
+    sessionToken: 'TOKEN',
+  }),
+}));
+
+vi.mock('@smithy/signature-v4', () => ({
+  SignatureV4: class {
+    // eslint-disable-next-line @typescript-eslint/require-await
+    async sign(request: { headers: Record<string, string> }) {
+      return { headers: { ...request.headers, Authorization: 'signed' } };
+    }
+  },
+}));
+
+vi.mock('@aws-crypto/sha256-js', () => ({
+  Sha256: class {},
+}));
+
+vi.mock('@aws-sdk/credential-provider-node', () => ({
+  defaultProvider: vi.fn(),
+}));
+
+function mockJsonResponse(body: unknown, status = 200) {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    headers: new Map([['x-amzn-requestid', 'test-request-id']]),
+    json: () => Promise.resolve(body),
+    text: () => Promise.resolve(JSON.stringify(body)),
+  };
+}
+
+describe('agentcore-http-gateways', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('createHttpGatewayTarget', () => {
+    it('sends agentcoreRuntime in request body', async () => {
+      mockFetch.mockResolvedValue(
+        mockJsonResponse({
+          targetId: 'tgt-001',
+          name: 'my-target',
+          status: 'CREATING',
+        })
+      );
+
+      const result = await createHttpGatewayTarget({
+        region: 'us-east-1',
+        gatewayId: 'gw-123',
+        targetName: 'my-target',
+        runtimeArn: 'arn:aws:bedrock-agentcore:us-east-1:123:runtime/rt-1',
+        qualifier: 'DEFAULT',
+      });
+
+      expect(result.targetId).toBe('tgt-001');
+      expect(result.name).toBe('my-target');
+      expect(mockFetch).toHaveBeenCalledTimes(1);
+
+      const body = JSON.parse(mockFetch.mock.calls[0]![1].body);
+      expect(body.name).toBe('my-target');
+      expect(body.targetConfiguration.http.agentcoreRuntime).toEqual({
+        arn: 'arn:aws:bedrock-agentcore:us-east-1:123:runtime/rt-1',
+        qualifier: 'DEFAULT',
+      });
+      expect(body.credentialProviderConfigurations).toEqual([{ credentialProviderType: 'GATEWAY_IAM_ROLE' }]);
+      expect(body.clientToken).toBeDefined();
+    });
+
+    it('falls back to runtimeTargetConfiguration on ValidationException', async () => {
+      // First call fails with ValidationException
+      mockFetch.mockResolvedValueOnce({
+        ok: false,
+        status: 400,
+        headers: new Map([['x-amzn-requestid', 'test-request-id']]),
+        text: () => Promise.resolve('ValidationException: Unknown field agentcoreRuntime'),
+      });
+      // Second call (fallback) succeeds
+      mockFetch.mockResolvedValueOnce(
+        mockJsonResponse({
+          targetId: 'tgt-002',
+          name: 'my-target',
+          status: 'CREATING',
+        })
+      );
+
+      const result = await createHttpGatewayTarget({
+        region: 'us-east-1',
+        gatewayId: 'gw-123',
+        targetName: 'my-target',
+        runtimeArn: 'arn:aws:bedrock-agentcore:us-east-1:123:runtime/rt-1',
+      });
+
+      expect(result.targetId).toBe('tgt-002');
+      expect(mockFetch).toHaveBeenCalledTimes(2);
+
+      // Second call should use runtimeTargetConfiguration
+      const fallbackBody = JSON.parse(mockFetch.mock.calls[1]![1].body);
+      expect(fallbackBody.targetConfiguration.http.runtimeTargetConfiguration).toEqual({
+        arn: 'arn:aws:bedrock-agentcore:us-east-1:123:runtime/rt-1',
+        qualifier: 'DEFAULT',
+      });
+    });
+
+    it('falls back to runtimeTargetConfiguration on 400 status', async () => {
+      // First call fails with 400
+      mockFetch.mockResolvedValueOnce({
+        ok: false,
+        status: 400,
+        headers: new Map([['x-amzn-requestid', 'test-request-id']]),
+        text: () => Promise.resolve('400 Bad Request'),
+      });
+      // Second call (fallback) succeeds
+      mockFetch.mockResolvedValueOnce(
+        mockJsonResponse({
+          targetId: 'tgt-003',
+          name: 'my-target',
+          status: 'CREATING',
+        })
+      );
+
+      const result = await createHttpGatewayTarget({
+        region: 'us-east-1',
+        gatewayId: 'gw-123',
+        targetName: 'my-target',
+        runtimeArn: 'arn:runtime',
+      });
+
+      expect(result.targetId).toBe('tgt-003');
+      expect(mockFetch).toHaveBeenCalledTimes(2);
+    });
+
+    it('throws on non-validation errors (no fallback)', async () => {
+      mockFetch.mockResolvedValue({
+        ok: false,
+        status: 500,
+        headers: new Map([['x-amzn-requestid', 'test-request-id']]),
+        text: () => Promise.resolve('Internal Server Error'),
+      });
+
+      await expect(
+        createHttpGatewayTarget({
+          region: 'us-east-1',
+          gatewayId: 'gw-123',
+          targetName: 'my-target',
+          runtimeArn: 'arn:runtime',
+        })
+      ).rejects.toThrow('Failed to create target');
+
+      // Only one call — no fallback attempt
+      expect(mockFetch).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe('getHttpGateway', () => {
+    it('returns gateway details', async () => {
+      mockFetch.mockResolvedValue(
+        mockJsonResponse({
+          gatewayId: 'gw-123',
+          gatewayArn: 'arn:aws:bedrock-agentcore:us-east-1:123:gateway/gw-123',
+          gatewayUrl: 'https://gw-123.example.com',
+          name: 'my-gateway',
+          status: 'READY',
+          authorizerType: 'AWS_IAM',
+          roleArn: 'arn:aws:iam::123:role/GwRole',
+          createdAt: '2026-01-01T00:00:00Z',
+          updatedAt: '2026-01-02T00:00:00Z',
+        })
+      );
+
+      const result = await getHttpGateway({ region: 'us-east-1', gatewayId: 'gw-123' });
+
+      expect(result.gatewayId).toBe('gw-123');
+      expect(result.name).toBe('my-gateway');
+      expect(result.status).toBe('READY');
+      expect(result.gatewayUrl).toBe('https://gw-123.example.com');
+      expect(mockFetch).toHaveBeenCalledWith(
+        expect.stringContaining('/gateways/gw-123'),
+        expect.objectContaining({ method: 'GET' })
+      );
+    });
+  });
+
+  describe('listHttpGatewayTargets', () => {
+    it('returns targets array', async () => {
+      mockFetch.mockResolvedValue(
+        mockJsonResponse({
+          targets: [
+            { targetId: 'tgt-1', name: 'target-1', status: 'READY' },
+            { targetId: 'tgt-2', name: 'target-2', status: 'CREATING' },
+          ],
+        })
+      );
+
+      const result = await listHttpGatewayTargets({
+        region: 'us-east-1',
+        gatewayId: 'gw-123',
+      });
+
+      expect(result.targets).toHaveLength(2);
+      expect(result.targets[0]!.targetId).toBe('tgt-1');
+      expect(result.targets[0]!.name).toBe('target-1');
+      expect(result.targets[1]!.targetId).toBe('tgt-2');
+      expect(mockFetch).toHaveBeenCalledWith(
+        expect.stringContaining('/gateways/gw-123/targets'),
+        expect.objectContaining({ method: 'GET' })
+      );
+    });
+
+    it('handles response with items field instead of targets', async () => {
+      mockFetch.mockResolvedValue(
+        mockJsonResponse({
+          items: [{ targetId: 'tgt-1', name: 'target-1', status: 'READY' }],
+        })
+      );
+
+      const result = await listHttpGatewayTargets({
+        region: 'us-east-1',
+        gatewayId: 'gw-123',
+      });
+
+      expect(result.targets).toHaveLength(1);
+      expect(result.targets[0]!.targetId).toBe('tgt-1');
+    });
+  });
+});
diff --git a/src/cli/aws/__tests__/agentcore-recommendation.test.ts b/src/cli/aws/__tests__/agentcore-recommendation.test.ts
new file mode 100644
index 000000000..1b330cf30
--- /dev/null
+++ b/src/cli/aws/__tests__/agentcore-recommendation.test.ts
@@ -0,0 +1,295 @@
+import {
+  deleteRecommendation,
+  getRecommendation,
+  listRecommendations,
+  startRecommendation,
+} from '../agentcore-recommendation.js';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mockFetch = vi.fn();
+vi.stubGlobal('fetch', mockFetch);
+
+vi.mock('../account', () => ({
+  getCredentialProvider: vi.fn().mockReturnValue({
+    accessKeyId: 'AKID',
+    secretAccessKey: 'SECRET',
+    sessionToken: 'TOKEN',
+  }),
+}));
+
+vi.mock('@smithy/signature-v4', () => ({
+  SignatureV4: class {
+    // eslint-disable-next-line @typescript-eslint/require-await
+    async sign(request: { headers: Record<string, string> }) {
+      return { headers: { ...request.headers, Authorization: 'signed' } };
+    }
+  },
+}));
+
+vi.mock('@aws-crypto/sha256-js', () => ({
+  Sha256: class {},
+}));
+
+vi.mock('@aws-sdk/credential-provider-node', () => ({
+  defaultProvider: vi.fn(),
+}));
+
+function mockJsonResponse(body: unknown, status = 200) {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    headers: new Map([['x-amzn-requestid', 'test-request-id']]),
+    json: () => Promise.resolve(body),
+    text: () => Promise.resolve(JSON.stringify(body)),
+  };
+}
+
+describe('agentcore-recommendation', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('startRecommendation', () => {
+    it('sends POST to /recommendations with correct body', async () => {
+      mockFetch.mockResolvedValue(
+        mockJsonResponse({
+          recommendationId: 'rec-123',
+          recommendationArn: 'arn:rec-123',
+          name: 'MyRecommendation',
+          type: 'SYSTEM_PROMPT_RECOMMENDATION',
+          status: 'PENDING',
+        })
+      );
+
+      const result = await startRecommendation({
+        region: 'us-west-2',
+        name: 'MyRecommendation',
+        type: 'SYSTEM_PROMPT_RECOMMENDATION',
+        recommendationConfig: {
+          systemPromptRecommendationConfig: {
+            systemPrompt: { text: 'You are a helpful agent.' },
+            agentTraces: {
+              cloudwatchLogs: {
+                logGroupArns: ['arn:log-group'],
+                serviceNames: ['bedrock-agentcore'],
+                startTime: '2026-03-23T00:00:00.000Z',
+                endTime: '2026-03-30T00:00:00.000Z',
+              },
+            },
+            evaluationConfig: {
+              evaluators: [{ evaluatorArn: 'arn:aws:bedrock-agentcore:::evaluator/Builtin.Helpfulness' }],
+            },
+          },
+        },
+      });
+
+      expect(result.recommendationId).toBe('rec-123');
+      expect(mockFetch).toHaveBeenCalledWith(
+        expect.stringContaining('/recommendations'),
+        expect.objectContaining({ method: 'POST' })
+      );
+
+      const fetchCall = mockFetch.mock.calls[0]!;
+      const body = JSON.parse(fetchCall[1].body);
+      expect(body.name).toBe('MyRecommendation');
+      expect(body.type).toBe('SYSTEM_PROMPT_RECOMMENDATION');
+      expect(body.recommendationConfig.systemPromptRecommendationConfig).toBeDefined();
+    });
+
+    it('omits description when not provided', async () => {
+      mockFetch.mockResolvedValue(
+        mockJsonResponse({
+          recommendationId: 'r1',
+          recommendationArn: 'arn:1',
+          name: 'MyRec',
+          type: 'SYSTEM_PROMPT_RECOMMENDATION',
+          status: 'PENDING',
+        })
+      );
+
+      await startRecommendation({
+        region: 'us-west-2',
+        name: 'MyRec',
+        type: 'SYSTEM_PROMPT_RECOMMENDATION',
+        recommendationConfig: {
+          systemPromptRecommendationConfig: {
+            systemPrompt: { text: '' },
+            agentTraces: {
+              cloudwatchLogs: {
+                logGroupArns: [],
+                serviceNames: ['bedrock-agentcore'],
+                startTime: '2026-03-23T00:00:00.000Z',
+                endTime: '2026-03-30T00:00:00.000Z',
+              },
+            },
+            evaluationConfig: {
+              evaluators: [{ evaluatorArn: 'arn:aws:bedrock-agentcore:::evaluator/Builtin.Helpfulness' }],
+            },
+          },
+        },
+      });
+
+      const body = JSON.parse(mockFetch.mock.calls[0]![1].body);
+      expect(body.description).toBeUndefined();
+    });
+
+    it('includes description when provided', async () => {
+      mockFetch.mockResolvedValue(
+        mockJsonResponse({
+          recommendationId: 'r1',
+          recommendationArn: 'arn:1',
+          name: 'MyRec',
+          type: 'SYSTEM_PROMPT_RECOMMENDATION',
+          status: 'PENDING',
+        })
+      );
+
+      await startRecommendation({
+        region: 'us-west-2',
+        name: 'MyRec',
+        description: 'Test description',
+        type: 'SYSTEM_PROMPT_RECOMMENDATION',
+        recommendationConfig: {
+          systemPromptRecommendationConfig: {
+            systemPrompt: { text: '' },
+            agentTraces: {
+              cloudwatchLogs: {
+                logGroupArns: [],
+                serviceNames: ['bedrock-agentcore'],
+                startTime: '2026-03-23T00:00:00.000Z',
+                endTime: '2026-03-30T00:00:00.000Z',
+              },
+            },
+            evaluationConfig: {
+              evaluators: [{ evaluatorArn: 'arn:aws:bedrock-agentcore:::evaluator/Builtin.Helpfulness' }],
+            },
+          },
+        },
+      });
+
+      const body = JSON.parse(mockFetch.mock.calls[0]![1].body);
+      expect(body.description).toBe('Test description');
+    });
+
+    it('throws on non-ok response', async () => {
+      mockFetch.mockResolvedValue({
+        ok: false,
+        status: 400,
+        headers: new Map([['x-amzn-requestid', 'test-request-id']]),
+        text: () => Promise.resolve('Bad Request'),
+      });
+
+      await expect(
+        startRecommendation({
+          region: 'us-west-2',
+          name: 'MyRec',
+          type: 'SYSTEM_PROMPT_RECOMMENDATION',
+          recommendationConfig: {},
+        })
+      ).rejects.toThrow('Recommendation API error (400)');
+    });
+  });
+
+  describe('getRecommendation', () => {
+    it('sends GET to /recommendations/{id}', async () => {
+      mockFetch.mockResolvedValue(
+        mockJsonResponse({
+          recommendationId: 'rec-123',
+          recommendationArn: 'arn:rec-123',
+          name: 'MyRec',
+          type: 'SYSTEM_PROMPT_RECOMMENDATION',
+          status: 'COMPLETED',
+          recommendationResult: {
+            systemPromptRecommendationResult: {
+              recommendedSystemPrompt: 'Optimized prompt',
+              explanation: 'Made it better',
+            },
+          },
+        })
+      );
+
+      const result = await getRecommendation({ region: 'us-west-2', recommendationId: 'rec-123' });
+
+      expect(result.recommendationId).toBe('rec-123');
+      expect(result.name).toBe('MyRec');
+      expect(result.recommendationResult?.systemPromptRecommendationResult?.recommendedSystemPrompt).toBe(
+        'Optimized prompt'
+      );
+      expect(mockFetch).toHaveBeenCalledWith(
+        expect.stringContaining('/recommendations/rec-123'),
+        expect.objectContaining({ method: 'GET' })
+      );
+    });
+  });
+
+  describe('deleteRecommendation', () => {
+    it('sends DELETE to /recommendations/{id}', async () => {
+      mockFetch.mockResolvedValue(mockJsonResponse({ recommendationId: 'rec-123', status: 'DELETING' }, 200));
+
+      const result = await deleteRecommendation({ region: 'us-west-2', recommendationId: 'rec-123' });
+
+      expect(result.recommendationId).toBe('rec-123');
+      expect(result.status).toBe('DELETING');
+      expect(mockFetch).toHaveBeenCalledWith(
+        expect.stringContaining('/recommendations/rec-123'),
+        expect.objectContaining({ method: 'DELETE' })
+      );
+    });
+
+    it('throws on failure', async () => {
+      mockFetch.mockRejectedValue(new Error('Network error'));
+
+      await expect(deleteRecommendation({ region: 'us-west-2', recommendationId: 'rec-123' })).rejects.toThrow(
+        'Network error'
+      );
+    });
+  });
+
+  describe('listRecommendations', () => {
+    it('sends GET to /recommendations', async () => {
+      mockFetch.mockResolvedValue(
+        mockJsonResponse({
+          recommendationSummaries: [
+            {
+              recommendationId: 'r1',
+              recommendationArn: 'arn:r1',
+              name: 'Rec1',
+              type: 'SYSTEM_PROMPT_RECOMMENDATION',
+              status: 'COMPLETED',
+            },
+            {
+              recommendationId: 'r2',
+              recommendationArn: 'arn:r2',
+              name: 'Rec2',
+              type: 'TOOL_DESCRIPTION_RECOMMENDATION',
+              status: 'COMPLETED',
+            },
+          ],
+        })
+      );
+
+      const result = await listRecommendations({ region: 'us-west-2' });
+
+      expect(result.recommendationSummaries).toHaveLength(2);
+      expect(result.recommendationSummaries[0]!.name).toBe('Rec1');
+    });
+
+    it('passes maxResults and nextToken as query params', async () => {
+      mockFetch.mockResolvedValue(mockJsonResponse({ recommendationSummaries: [] }));
+
+      await listRecommendations({ region: 'us-west-2', maxResults: 10, nextToken: 'abc' });
+
+      const url = mockFetch.mock.calls[0]![0] as string;
+      expect(url).toContain('maxResults=10');
+      expect(url).toContain('nextToken=abc');
+    });
+
+    it('returns empty array when response has no recommendationSummaries', async () => {
+      mockFetch.mockResolvedValue(mockJsonResponse({}));
+
+      const result = await listRecommendations({ region: 'us-west-2' });
+
+      expect(result.recommendationSummaries).toEqual([]);
+    });
+  });
+});
diff --git a/src/cli/aws/__tests__/agentcore.test.ts b/src/cli/aws/__tests__/agentcore.test.ts
index e26e4324e..f23ff5c83 100644
--- a/src/cli/aws/__tests__/agentcore.test.ts
+++ b/src/cli/aws/__tests__/agentcore.test.ts
@@ -1,4 +1,4 @@
-import { extractResult, parseA2AResponse, parseSSE, parseSSELine } from '../agentcore.js';
+import { buildBearerInvokeHeaders, extractResult, parseA2AResponse, parseSSE, parseSSELine } from '../agentcore.js';
 import { describe, expect, it } from 'vitest';
 
 describe('parseSSELine', () => {
@@ -176,3 +176,43 @@ describe('parseA2AResponse', () => {
     expect(parseA2AResponse('not json')).toBe('not json');
   });
 });
+
+describe('buildBearerInvokeHeaders', () => {
+  it('includes custom headers from options.headers', () => {
+    const headers = buildBearerInvokeHeaders(
+      {
+        bearerToken: 'tok',
+        headers: {
+          'x-amzn-bedrock-agentcore-runtime-custom-foo': 'bar',
+          'x-amzn-bedrock-agentcore-runtime-custom-baz': 'qux',
+        },
+      },
+      'application/json'
+    );
+    expect(headers['x-amzn-bedrock-agentcore-runtime-custom-foo']).toBe('bar');
+    expect(headers['x-amzn-bedrock-agentcore-runtime-custom-baz']).toBe('qux');
+  });
+
+  it('sets Authorization, Content-Type, Accept, and default user ID', () => {
+    const headers = buildBearerInvokeHeaders({ bearerToken: 'tok' }, 'application/json');
+    expect(headers.Authorization).toBe('Bearer tok');
+    expect(headers['Content-Type']).toBe('application/json');
+    expect(headers.Accept).toBe('application/json');
+    expect(headers['X-Amzn-Bedrock-AgentCore-Runtime-User-Id']).toBe('default-user');
+  });
+
+  it('sets session ID header when provided', () => {
+    const headers = buildBearerInvokeHeaders({ bearerToken: 'tok', sessionId: 's1' }, 'application/json');
+    expect(headers['X-Amzn-Bedrock-AgentCore-Runtime-Session-Id']).toBe('s1');
+  });
+
+  it('omits session ID header when not provided', () => {
+    const headers = buildBearerInvokeHeaders({ bearerToken: 'tok' }, 'application/json');
+    expect(headers).not.toHaveProperty('X-Amzn-Bedrock-AgentCore-Runtime-Session-Id');
+  });
+
+  it('returns correct headers when options.headers is undefined', () => {
+    const headers = buildBearerInvokeHeaders({ bearerToken: 'tok' }, 'application/json');
+    expect(Object.keys(headers)).toHaveLength(4); // Authorization, Content-Type, Accept, User-Id
+  });
+});
diff --git a/src/cli/aws/__tests__/api-client.test.ts b/src/cli/aws/__tests__/api-client.test.ts
new file mode 100644
index 000000000..5ebc1ebd3
--- /dev/null
+++ b/src/cli/aws/__tests__/api-client.test.ts
@@ -0,0 +1,185 @@
+import { AgentCoreApiClient, AgentCoreApiError } from '../api-client.js';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { mockSign } = vi.hoisted(() => ({
+  mockSign: vi.fn(),
+}));
+
+vi.mock('../account', () => ({
+  getCredentialProvider: vi.fn().mockReturnValue({}),
+}));
+
+vi.mock('@smithy/signature-v4', () => ({
+  SignatureV4: class {
+    sign = mockSign;
+  },
+}));
+
+vi.mock('@smithy/protocol-http', () => ({
+  HttpRequest: class {
+    constructor(public opts: unknown) {}
+  },
+}));
+
+vi.mock('@aws-crypto/sha256-js', () => ({
+  Sha256: class {},
+}));
+
+vi.mock('@aws-sdk/credential-provider-node', () => ({
+  defaultProvider: vi.fn().mockReturnValue({}),
+}));
+
+const mockFetch = vi.fn();
+vi.stubGlobal('fetch', mockFetch);
+
+describe('AgentCoreApiClient', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    delete process.env.AGENTCORE_STAGE;
+    mockSign.mockResolvedValue({ headers: { host: 'example.com', 'content-type': 'application/json' } });
+  });
+
+  describe('endpoint resolution', () => {
+    it('uses control plane prod endpoint by default', async () => {
+      const client = new AgentCoreApiClient({ region: 'us-west-2', plane: 'control' });
+      mockFetch.mockResolvedValue(new Response(JSON.stringify({ ok: true }), { status: 200 }));
+
+      await client.request({ method: 'GET', path: '/test' });
+
+      expect(mockFetch).toHaveBeenCalledWith(
+        expect.stringContaining('bedrock-agentcore-control.us-west-2.amazonaws.com'),
+        expect.anything()
+      );
+    });
+
+    it('uses data plane prod endpoint', async () => {
+      const client = new AgentCoreApiClient({ region: 'us-east-1', plane: 'data' });
+      mockFetch.mockResolvedValue(new Response(JSON.stringify({}), { status: 200 }));
+
+      await client.request({ method: 'GET', path: '/test' });
+
+      expect(mockFetch).toHaveBeenCalledWith(
+        expect.stringContaining('bedrock-agentcore.us-east-1.amazonaws.com'),
+        expect.anything()
+      );
+    });
+
+    it('uses beta control plane endpoint when AGENTCORE_STAGE=beta', async () => {
+      process.env.AGENTCORE_STAGE = 'beta';
+      const client = new AgentCoreApiClient({ region: 'us-west-2', plane: 'control' });
+      mockFetch.mockResolvedValue(new Response(JSON.stringify({}), { status: 200 }));
+
+      await client.request({ method: 'GET', path: '/test' });
+
+      expect(mockFetch).toHaveBeenCalledWith(
+        expect.stringContaining('beta.us-west-2.elcapcp.genesis-primitives.aws.dev'),
+        expect.anything()
+      );
+    });
+
+    it('uses gamma data plane endpoint when AGENTCORE_STAGE=gamma', async () => {
+      process.env.AGENTCORE_STAGE = 'gamma';
+      const client = new AgentCoreApiClient({ region: 'us-west-2', plane: 'data' });
+      mockFetch.mockResolvedValue(new Response(JSON.stringify({}), { status: 200 }));
+
+      await client.request({ method: 'GET', path: '/test' });
+
+      expect(mockFetch).toHaveBeenCalledWith(
+        expect.stringContaining('gamma.us-west-2.elcapdp.genesis-primitives.aws.dev'),
+        expect.anything()
+      );
+    });
+  });
+
+  describe('request()', () => {
+    it('returns parsed JSON on success', async () => {
+      const client = new AgentCoreApiClient({ region: 'us-west-2', plane: 'control' });
+      mockFetch.mockResolvedValue(new Response(JSON.stringify({ harnessId: 'h-123' }), { status: 200 }));
+
+      const result = await client.request({ method: 'GET', path: '/harnesses/h-123' });
+
+      expect(result).toEqual({ harnessId: 'h-123' });
+    });
+
+    it('returns empty object on 204', async () => {
+      const client = new AgentCoreApiClient({ region: 'us-west-2', plane: 'control' });
+      mockFetch.mockResolvedValue(new Response(null, { status: 204 }));
+
+      const result = await client.request({ method: 'DELETE', path: '/harnesses/h-123' });
+
+      expect(result).toEqual({});
+    });
+
+    it('throws AgentCoreApiError on non-2xx', async () => {
+      const client = new AgentCoreApiClient({ region: 'us-west-2', plane: 'control' });
+      mockFetch.mockResolvedValue(
+        new Response('{"message":"Not found"}', {
+          status: 404,
+          headers: { 'x-amzn-requestid': 'req-abc' },
+        })
+      );
+
+      const err = await client.request({ method: 'GET', path: '/harnesses/bad' }).catch((e: unknown) => e);
+      expect(err).toBeInstanceOf(AgentCoreApiError);
+      const apiErr = err as AgentCoreApiError;
+      expect(apiErr.statusCode).toBe(404);
+      expect(apiErr.requestId).toBe('req-abc');
+      expect(apiErr.errorBody).toContain('Not found');
+    });
+
+    it('sends JSON body when provided', async () => {
+      const client = new AgentCoreApiClient({ region: 'us-west-2', plane: 'control' });
+      mockFetch.mockResolvedValue(new Response(JSON.stringify({ ok: true }), { status: 201 }));
+
+      await client.request({ method: 'POST', path: '/harnesses', body: { harnessName: 'test' } });
+
+      expect(mockFetch).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.objectContaining({ body: JSON.stringify({ harnessName: 'test' }) })
+      );
+    });
+
+    it('appends query parameters to URL', async () => {
+      const client = new AgentCoreApiClient({ region: 'us-west-2', plane: 'control' });
+      mockFetch.mockResolvedValue(new Response(JSON.stringify({}), { status: 200 }));
+
+      await client.request({ method: 'GET', path: '/harnesses', query: { maxResults: '10' } });
+
+      expect(mockFetch).toHaveBeenCalledWith(expect.stringContaining('maxResults=10'), expect.anything());
+    });
+  });
+
+  describe('requestRaw()', () => {
+    it('returns raw Response object', async () => {
+      const client = new AgentCoreApiClient({ region: 'us-west-2', plane: 'data' });
+      const mockResponse = new Response('streaming data', { status: 200 });
+      mockFetch.mockResolvedValue(mockResponse);
+
+      const response = await client.requestRaw({ method: 'POST', path: '/harnesses/invoke' });
+
+      expect(response).toBe(mockResponse);
+      expect(response.status).toBe(200);
+    });
+
+    it('passes custom headers through', async () => {
+      const client = new AgentCoreApiClient({ region: 'us-west-2', plane: 'data' });
+      mockFetch.mockResolvedValue(new Response('', { status: 200 }));
+
+      await client.requestRaw({
+        method: 'POST',
+        path: '/harnesses/invoke',
+        headers: { 'X-Amzn-Bedrock-AgentCore-Runtime-Session-Id': 'sess-123' },
+      });
+
+      expect(mockSign).toHaveBeenCalledWith(
+        expect.objectContaining({
+          opts: expect.objectContaining({
+            headers: expect.objectContaining({
+              'X-Amzn-Bedrock-AgentCore-Runtime-Session-Id': 'sess-123',
+            }),
+          }),
+        })
+      );
+    });
+  });
+});
diff --git a/src/cli/aws/__tests__/poll.test.ts b/src/cli/aws/__tests__/poll.test.ts
new file mode 100644
index 000000000..2894758d8
--- /dev/null
+++ b/src/cli/aws/__tests__/poll.test.ts
@@ -0,0 +1,92 @@
+import { PollFailureError, PollTimeoutError, pollUntilTerminal } from '../poll.js';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+interface MockStatus {
+  status: string;
+  reason?: string;
+}
+
+describe('pollUntilTerminal', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('returns immediately when first result is terminal', async () => {
+    const fn = vi.fn().mockResolvedValue({ status: 'READY' });
+
+    const result = await pollUntilTerminal<MockStatus>({
+      fn,
+      isTerminal: (r: MockStatus) => r.status === 'READY',
+    });
+
+    expect(result).toEqual({ status: 'READY' });
+    expect(fn).toHaveBeenCalledTimes(1);
+  });
+
+  it('polls until terminal status is reached', async () => {
+    const fn = vi
+      .fn()
+      .mockResolvedValueOnce({ status: 'CREATING' })
+      .mockResolvedValueOnce({ status: 'CREATING' })
+      .mockResolvedValueOnce({ status: 'READY' });
+
+    const result = await pollUntilTerminal<MockStatus>({
+      fn,
+      isTerminal: (r: MockStatus) => ['READY', 'FAILED'].includes(r.status),
+      intervalMs: 10,
+    });
+
+    expect(result).toEqual({ status: 'READY' });
+    expect(fn).toHaveBeenCalledTimes(3);
+  });
+
+  it('throws PollFailureError when failure state is detected', async () => {
+    const fn = vi.fn().mockResolvedValue({ status: 'FAILED', reason: 'bad config' });
+
+    await expect(
+      pollUntilTerminal<MockStatus>({
+        fn,
+        isTerminal: (r: MockStatus) => ['READY', 'FAILED'].includes(r.status),
+        isFailure: (r: MockStatus) => r.status === 'FAILED',
+        getFailureReason: (r: MockStatus) => `Harness failed: ${r.reason}`,
+        intervalMs: 10,
+      })
+    ).rejects.toThrow(PollFailureError);
+
+    await expect(
+      pollUntilTerminal<MockStatus>({
+        fn,
+        isTerminal: (r: MockStatus) => ['READY', 'FAILED'].includes(r.status),
+        isFailure: (r: MockStatus) => r.status === 'FAILED',
+        getFailureReason: (r: MockStatus) => `Harness failed: ${r.reason}`,
+        intervalMs: 10,
+      })
+    ).rejects.toThrow('Harness failed: bad config');
+  });
+
+  it('throws PollTimeoutError when maxWaitMs exceeded', async () => {
+    const fn = vi.fn().mockResolvedValue({ status: 'CREATING' });
+
+    await expect(
+      pollUntilTerminal<MockStatus>({
+        fn,
+        isTerminal: (r: MockStatus) => r.status === 'READY',
+        intervalMs: 10,
+        maxWaitMs: 50,
+      })
+    ).rejects.toThrow(PollTimeoutError);
+  });
+
+  it('uses default failure message when getFailureReason is not provided', async () => {
+    const fn = vi.fn().mockResolvedValue({ status: 'FAILED' });
+
+    await expect(
+      pollUntilTerminal<MockStatus>({
+        fn,
+        isTerminal: (r: MockStatus) => r.status === 'FAILED',
+        isFailure: (r: MockStatus) => r.status === 'FAILED',
+        intervalMs: 10,
+      })
+    ).rejects.toThrow('Resource entered a failed state');
+  });
+});
diff --git a/src/cli/aws/agentcore-ab-tests.ts b/src/cli/aws/agentcore-ab-tests.ts
new file mode 100644
index 000000000..4bcf0ce16
--- /dev/null
+++ b/src/cli/aws/agentcore-ab-tests.ts
@@ -0,0 +1,360 @@
+/**
+ * AWS client wrappers for AB Test data plane operations.
+ *
+ * Uses the AgentCore Evaluation DataPlane API (bedrock-agentcore)
+ * with direct HTTP requests and SigV4 signing.
+ */
+import { getCredentialProvider } from './account';
+import { dnsSuffix } from './partition';
+import { Sha256 } from '@aws-crypto/sha256-js';
+import { defaultProvider } from '@aws-sdk/credential-provider-node';
+import { HttpRequest } from '@smithy/protocol-http';
+import { SignatureV4 } from '@smithy/signature-v4';
+import { randomUUID } from 'node:crypto';
+
+// ============================================================================
+// Types
+// ============================================================================
+
+export interface ABTestVariant {
+  name: 'C' | 'T1';
+  weight: number;
+  variantConfiguration: {
+    configurationBundle?: {
+      bundleArn: string;
+      bundleVersion: string;
+    };
+    target?: {
+      name: string;
+    };
+  };
+}
+
+export type ABTestEvaluationConfig =
+  | { onlineEvaluationConfigArn: string }
+  | {
+      perVariantOnlineEvaluationConfig: {
+        name: 'C' | 'T1';
+        onlineEvaluationConfigArn: string;
+      }[];
+    };
+
+export interface GatewayFilter {
+  targetPaths: string[];
+}
+
+export interface TrafficAllocationConfig {
+  routeOnHeader: {
+    headerName: string;
+  };
+}
+
+export interface ConfidenceInterval {
+  lower?: number;
+  upper?: number;
+}
+
+export interface ControlStats {
+  treatmentName: string;
+  sampleSize: number;
+  mean: number;
+}
+
+export interface VariantResult {
+  treatmentName: string;
+  sampleSize: number;
+  mean: number;
+  absoluteChange?: number;
+  percentChange?: number;
+  pValue?: number;
+  confidenceInterval?: ConfidenceInterval;
+  isSignificant: boolean;
+}
+
+export interface EvaluatorMetric {
+  evaluatorArn: string;
+  controlStats: ControlStats;
+  variantResults: VariantResult[];
+}
+
+export interface ABTestResults {
+  analysisTimestamp?: string;
+  evaluatorMetrics: EvaluatorMetric[];
+}
+
+// ── Create ──────────────────────────────────────────────────────────────────
+
+export interface CreateABTestOptions {
+  region: string;
+  name: string;
+  description?: string;
+  gatewayArn: string;
+  roleArn: string;
+  variants: ABTestVariant[];
+  evaluationConfig: ABTestEvaluationConfig;
+  gatewayFilter?: GatewayFilter;
+  trafficAllocationConfig?: TrafficAllocationConfig;
+  maxDurationDays?: number;
+  enableOnCreate?: boolean;
+}
+
+export interface CreateABTestResult {
+  abTestId: string;
+  abTestArn: string;
+  name?: string;
+  status: string;
+  executionStatus: string;
+  createdAt: string;
+}
+
+// ── Get ─────────────────────────────────────────────────────────────────────
+
+export interface GetABTestOptions {
+  region: string;
+  abTestId: string;
+}
+
+export interface GetABTestResult {
+  abTestId: string;
+  abTestArn: string;
+  name: string;
+  description?: string;
+  status: string;
+  executionStatus: string;
+  gatewayArn: string;
+  roleArn: string;
+  variants: ABTestVariant[];
+  evaluationConfig: ABTestEvaluationConfig;
+  trafficAllocationConfig?: TrafficAllocationConfig;
+  maxDurationDays?: number;
+  currentRunId?: string;
+  stopReason?: string;
+  failureReason?: string;
+  startedAt?: string;
+  stoppedAt?: string;
+  maxDurationExpiresAt?: string;
+  createdAt: string;
+  updatedAt: string;
+  results?: ABTestResults;
+}
+
+// ── Update ──────────────────────────────────────────────────────────────────
+
+export interface UpdateABTestOptions {
+  region: string;
+  abTestId: string;
+  name?: string;
+  description?: string;
+  variants?: ABTestVariant[];
+  trafficAllocationConfig?: TrafficAllocationConfig;
+  evaluationConfig?: ABTestEvaluationConfig;
+  maxDurationDays?: number;
+  executionStatus?: 'PAUSED' | 'RUNNING' | 'STOPPED';
+  roleArn?: string;
+}
+
+export interface UpdateABTestResult {
+  abTestId: string;
+  abTestArn: string;
+  status: string;
+  executionStatus: string;
+  failureReason?: string;
+  updatedAt: string;
+}
+
+// ── Delete ──────────────────────────────────────────────────────────────────
+
+export interface DeleteABTestOptions {
+  region: string;
+  abTestId: string;
+}
+
+// ── List ────────────────────────────────────────────────────────────────────
+
+export interface ListABTestsOptions {
+  region: string;
+  maxResults?: number;
+  nextToken?: string;
+}
+
+export interface ABTestSummary {
+  abTestId: string;
+  abTestArn: string;
+  name: string;
+  description?: string;
+  status: string;
+  executionStatus: string;
+  gatewayArn?: string;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface ListABTestsResult {
+  abTests: ABTestSummary[];
+  nextToken?: string;
+}
+
+// ============================================================================
+// HTTP signing helpers
+// ============================================================================
+
+function getDataPlaneEndpoint(region: string): string {
+  const stage = process.env.AGENTCORE_STAGE?.toLowerCase();
+  if (stage === 'beta') return `https://beta.${region}.elcapdp.genesis-primitives.aws.dev`;
+  if (stage === 'gamma') return `https://gamma.${region}.elcapdp.genesis-primitives.aws.dev`;
+  return `https://bedrock-agentcore.${region}.${dnsSuffix(region)}`;
+}
+
+async function signedRequestToEndpoint(
+  endpoint: string,
+  options: {
+    region: string;
+    method: string;
+    path: string;
+    body?: string;
+  }
+): Promise<unknown> {
+  const { region, method, path, body } = options;
+  const url = new URL(path, endpoint);
+
+  const query: Record<string, string> = {};
+  url.searchParams.forEach((value, key) => {
+    query[key] = value;
+  });
+
+  const request = new HttpRequest({
+    method,
+    protocol: 'https:',
+    hostname: url.hostname,
+    path: url.pathname,
+    ...(Object.keys(query).length > 0 && { query }),
+    headers: {
+      'Content-Type': 'application/json',
+      host: url.hostname,
+    },
+    ...(body && { body }),
+  });
+
+  const credentials = getCredentialProvider() ?? defaultProvider();
+  const service = 'bedrock-agentcore';
+  const signer = new SignatureV4({
+    service,
+    region,
+    credentials,
+    sha256: Sha256,
+  });
+
+  const signedReq = await signer.sign(request);
+
+  const response = await fetch(`${endpoint}${path}`, {
+    method,
+    headers: signedReq.headers as Record<string, string>,
+    ...(body && { body }),
+  });
+
+  if (!response.ok) {
+    const errorBody = await response.text();
+    throw new Error(`ABTest API error (${response.status}): ${errorBody}`);
+  }
+
+  if (response.status === 204) return {};
+  return response.json();
+}
+
+/** Data plane request — used for GetABTest (includes results/metrics). */
+async function dpRequest(options: { region: string; method: string; path: string; body?: string }): Promise<unknown> {
+  return signedRequestToEndpoint(getDataPlaneEndpoint(options.region), options);
+}
+
+// ============================================================================
+// Control Plane Operations (CRUD)
+// ============================================================================
+
+export async function createABTest(options: CreateABTestOptions): Promise<CreateABTestResult> {
+  const body = JSON.stringify({
+    name: options.name,
+    clientToken: randomUUID(),
+    gatewayArn: options.gatewayArn,
+    roleArn: options.roleArn,
+    variants: options.variants,
+    evaluationConfig: options.evaluationConfig,
+    ...(options.description && { description: options.description }),
+    ...(options.gatewayFilter && { gatewayFilter: options.gatewayFilter }),
+    ...(options.trafficAllocationConfig && { trafficAllocationConfig: options.trafficAllocationConfig }),
+    ...(options.maxDurationDays !== undefined && { maxDurationDays: options.maxDurationDays }),
+    ...(options.enableOnCreate !== undefined && { enableOnCreate: options.enableOnCreate }),
+  });
+
+  const result = await dpRequest({
+    region: options.region,
+    method: 'POST',
+    path: '/ab-tests',
+    body,
+  });
+
+  return result as CreateABTestResult;
+}
+
+export async function getABTest(options: GetABTestOptions): Promise<GetABTestResult> {
+  // Data plane includes results/metrics in the response
+  const data = await dpRequest({
+    region: options.region,
+    method: 'GET',
+    path: `/ab-tests/${options.abTestId}`,
+  });
+
+  return data as GetABTestResult;
+}
+
+export async function updateABTest(options: UpdateABTestOptions): Promise<UpdateABTestResult> {
+  const body: Record<string, unknown> = { clientToken: randomUUID() };
+  if (options.name !== undefined) body.name = options.name;
+  if (options.description !== undefined) body.description = options.description;
+  if (options.variants !== undefined) body.variants = options.variants;
+  if (options.trafficAllocationConfig !== undefined) body.trafficAllocationConfig = options.trafficAllocationConfig;
+  if (options.evaluationConfig !== undefined) body.evaluationConfig = options.evaluationConfig;
+  if (options.maxDurationDays !== undefined) body.maxDurationDays = options.maxDurationDays;
+  if (options.executionStatus !== undefined) body.executionStatus = options.executionStatus;
+  if (options.roleArn !== undefined) body.roleArn = options.roleArn;
+
+  const data = await dpRequest({
+    region: options.region,
+    method: 'PUT',
+    path: `/ab-tests/${options.abTestId}`,
+    body: JSON.stringify(body),
+  });
+
+  return data as UpdateABTestResult;
+}
+
+export async function deleteABTest(options: DeleteABTestOptions): Promise<{ success: boolean; error?: string }> {
+  try {
+    await dpRequest({
+      region: options.region,
+      method: 'DELETE',
+      path: `/ab-tests/${options.abTestId}`,
+    });
+    return { success: true };
+  } catch (err) {
+    return { success: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+export async function listABTests(options: ListABTestsOptions): Promise<ListABTestsResult> {
+  const params = new URLSearchParams();
+  if (options.maxResults) params.set('maxResults', String(options.maxResults));
+  if (options.nextToken) params.set('nextToken', options.nextToken);
+  const query = params.toString();
+
+  const data = await dpRequest({
+    region: options.region,
+    method: 'GET',
+    path: `/ab-tests${query ? `?${query}` : ''}`,
+  });
+
+  const result = data as ListABTestsResult;
+  return {
+    abTests: result.abTests ?? [],
+    nextToken: result.nextToken,
+  };
+}
diff --git a/src/cli/aws/agentcore-batch-evaluation.ts b/src/cli/aws/agentcore-batch-evaluation.ts
new file mode 100644
index 000000000..9b0923753
--- /dev/null
+++ b/src/cli/aws/agentcore-batch-evaluation.ts
@@ -0,0 +1,411 @@
+/**
+ * AWS client wrappers for BatchEvaluation operations.
+ *
+ * The BatchEvaluation API is a flat, stateless model — no persistent "job" resource.
+ * Each batch evaluation is started, polled, and optionally stopped.
+ *
+ * Endpoints:
+ *   POST   /evaluations/batch-evaluate                       → StartBatchEvaluation
+ *   GET    /evaluations/batch-evaluate/{batchEvaluationId}    → GetBatchEvaluation
+ *   GET    /evaluations/batch-evaluate                        → ListBatchEvaluations
+ *   POST   /evaluations/batch-evaluate/{batchEvaluationId}/stop → StopBatchEvaluation
+ *   DELETE /evaluations/batch-evaluate/{batchEvaluationId}    → DeleteBatchEvaluation
+ *
+ * Uses direct HTTP requests with SigV4 signing (service: bedrock-agentcore).
+ */
+import { getCredentialProvider } from './account';
+import { dnsSuffix } from './partition';
+import { Sha256 } from '@aws-crypto/sha256-js';
+import { defaultProvider } from '@aws-sdk/credential-provider-node';
+import { HttpRequest } from '@smithy/protocol-http';
+import { SignatureV4 } from '@smithy/signature-v4';
+
+// ============================================================================
+// Types
+// ============================================================================
+
+export interface SessionFilterConfig {
+  startTime?: string;
+  endTime?: string;
+}
+
+export interface CloudWatchFilterConfig {
+  sessionIds?: string[];
+  timeRange?: SessionFilterConfig;
+}
+
+export interface CloudWatchLogsSource {
+  serviceNames: string[];
+  logGroupNames: string[];
+  filterConfig?: CloudWatchFilterConfig;
+}
+
+export interface DataSourceConfig {
+  cloudWatchLogs?: CloudWatchLogsSource;
+  onlineEvaluationConfigSource?: Record<string, unknown>;
+}
+
+export interface Evaluator {
+  evaluatorId: string;
+}
+
+export interface GroundTruthAssertion {
+  text: string;
+}
+
+export interface GroundTruthTurnInput {
+  prompt: string;
+}
+
+export interface GroundTruthTurnExpectedResponse {
+  text: string;
+}
+
+export interface GroundTruthTurn {
+  input: GroundTruthTurnInput;
+  expectedResponse: GroundTruthTurnExpectedResponse;
+}
+
+export interface ExpectedTrajectory {
+  toolNames: string[];
+}
+
+export interface InlineGroundTruth {
+  assertions?: GroundTruthAssertion[];
+  expectedTrajectory?: ExpectedTrajectory;
+  turns?: GroundTruthTurn[];
+}
+
+export interface GroundTruth {
+  inline: InlineGroundTruth;
+}
+
+export interface SessionMetadataEntry {
+  sessionId: string;
+  testScenarioId?: string;
+  groundTruth?: GroundTruth;
+  metadata?: Record<string, string>;
+}
+
+export interface EvaluationMetadata {
+  sessionMetadata?: SessionMetadataEntry[];
+}
+
+export interface StartBatchEvaluationOptions {
+  region: string;
+  name: string;
+  evaluators: Evaluator[];
+  dataSourceConfig: DataSourceConfig;
+  evaluationMetadata?: EvaluationMetadata;
+  description?: string;
+  clientToken?: string;
+}
+
+export interface StartBatchEvaluationResult {
+  batchEvaluationId: string;
+  batchEvaluationArn: string;
+  name: string;
+  status: string;
+  createdAt?: string;
+}
+
+export interface GetBatchEvaluationOptions {
+  region: string;
+  batchEvaluationId: string;
+}
+
+export interface CloudWatchOutputConfig {
+  logGroupName: string;
+  logStreamName: string;
+}
+
+export interface OutputConfig {
+  cloudWatchConfig?: CloudWatchOutputConfig;
+}
+
+export interface EvaluatorSummary {
+  evaluatorId: string;
+  statistics?: {
+    averageScore?: number;
+    averageTokenUsage?: {
+      inputTokens?: number;
+      outputTokens?: number;
+      totalTokens?: number;
+    };
+  };
+  totalEvaluated?: number;
+  totalFailed?: number;
+}
+
+export interface EvaluationResults {
+  evaluatorSummaries?: EvaluatorSummary[];
+  numberOfSessionsCompleted?: number;
+  numberOfSessionsFailed?: number;
+  numberOfSessionsInProgress?: number;
+  totalNumberOfSessions?: number;
+  numberOfSessionsIgnored?: number;
+}
+
+export interface GetBatchEvaluationResult {
+  batchEvaluationId: string;
+  batchEvaluationArn: string;
+  name: string;
+  status: string;
+  createdAt?: string;
+  updatedAt?: string;
+  evaluators?: Evaluator[];
+  dataSourceConfig?: DataSourceConfig;
+  outputConfig?: OutputConfig;
+  evaluationResults?: EvaluationResults;
+  errorDetails?: string[];
+  description?: string;
+}
+
+export interface BatchEvaluationResultEntry {
+  evaluatorId: string;
+  score?: number;
+  label?: string;
+  explanation?: string;
+  error?: string;
+}
+
+export interface ListBatchEvaluationsOptions {
+  region: string;
+  maxResults?: number;
+  nextToken?: string;
+}
+
+export interface BatchEvaluationSummary {
+  batchEvaluationId: string;
+  batchEvaluationArn: string;
+  name: string;
+  status: string;
+  createdAt?: string;
+  description?: string;
+  evaluators?: Evaluator[];
+  evaluationResults?: EvaluationResults;
+  errorDetails?: string[];
+}
+
+export interface ListBatchEvaluationsResult {
+  batchEvaluations: BatchEvaluationSummary[];
+  nextToken?: string;
+}
+
+export interface StopBatchEvaluationOptions {
+  region: string;
+  batchEvaluationId: string;
+}
+
+export interface StopBatchEvaluationResult {
+  batchEvaluationId: string;
+  batchEvaluationArn: string;
+  status: string;
+  description?: string;
+}
+
+export interface DeleteBatchEvaluationOptions {
+  region: string;
+  batchEvaluationId: string;
+}
+
+export interface DeleteBatchEvaluationResult {
+  batchEvaluationId: string;
+  batchEvaluationArn: string;
+  status: string;
+}
+
+// ============================================================================
+// HTTP signing helper
+// ============================================================================
+
+function getEndpoint(region: string): string {
+  const stage = process.env.AGENTCORE_STAGE?.toLowerCase();
+  if (stage === 'beta') return `https://beta.${region}.elcapdp.genesis-primitives.aws.dev`;
+  if (stage === 'gamma') return `https://gamma.${region}.elcapdp.genesis-primitives.aws.dev`;
+  return `https://bedrock-agentcore.${region}.${dnsSuffix(region)}`;
+}
+
+async function signedRequest(options: {
+  region: string;
+  method: string;
+  path: string;
+  body?: string;
+}): Promise<{ data: unknown; status: number }> {
+  const { region, method, path, body } = options;
+  const endpoint = getEndpoint(region);
+  const url = new URL(path, endpoint);
+
+  const request = new HttpRequest({
+    method,
+    protocol: 'https:',
+    hostname: url.hostname,
+    path: url.pathname + url.search,
+    headers: {
+      'Content-Type': 'application/json',
+      host: url.hostname,
+    },
+    ...(body && { body }),
+  });
+
+  const credentials = getCredentialProvider() ?? defaultProvider();
+  const signer = new SignatureV4({
+    service: 'bedrock-agentcore',
+    region,
+    credentials,
+    sha256: Sha256,
+  });
+
+  const signedReq = await signer.sign(request);
+
+  const response = await fetch(`${endpoint}${url.pathname}${url.search}`, {
+    method,
+    headers: signedReq.headers as Record<string, string>,
+    ...(body && { body }),
+  });
+
+  if (!response.ok) {
+    const errorBody = await response.text();
+    throw new Error(`BatchEvaluation API error (${response.status}): ${errorBody}`);
+  }
+
+  if (response.status === 204) return { data: {}, status: 204 };
+  return { data: await response.json(), status: response.status };
+}
+
+// ============================================================================
+// API Operations
+// ============================================================================
+
+/**
+ * Start a batch evaluation (async — returns immediately with an ID to poll).
+ */
+export async function startBatchEvaluation(options: StartBatchEvaluationOptions): Promise<StartBatchEvaluationResult> {
+  const body: Record<string, unknown> = {
+    batchEvaluationName: options.name,
+    evaluators: options.evaluators,
+    dataSourceConfig: options.dataSourceConfig,
+  };
+  if (options.evaluationMetadata) {
+    body.evaluationMetadata = options.evaluationMetadata;
+  }
+  if (options.description) {
+    body.description = options.description;
+  }
+  if (options.clientToken) {
+    body.clientToken = options.clientToken;
+  }
+
+  const { data } = await signedRequest({
+    region: options.region,
+    method: 'POST',
+    path: '/evaluations/batch-evaluate',
+    body: JSON.stringify(body),
+  });
+
+  const raw = data as Record<string, unknown>;
+  return {
+    batchEvaluationId: (raw.batchEvaluationId ?? '') as string,
+    batchEvaluationArn: (raw.batchEvaluationArn ?? '') as string,
+    name: (raw.batchEvaluationName ?? '') as string,
+    status: (raw.status ?? '') as string,
+    createdAt: raw.createdAt as string | undefined,
+  };
+}
+
+/**
+ * Get status and results of a batch evaluation.
+ */
+export async function getBatchEvaluation(options: GetBatchEvaluationOptions): Promise<GetBatchEvaluationResult> {
+  const { data } = await signedRequest({
+    region: options.region,
+    method: 'GET',
+    path: `/evaluations/batch-evaluate/${options.batchEvaluationId}`,
+  });
+
+  const raw = data as Record<string, unknown>;
+  return {
+    batchEvaluationId: (raw.batchEvaluationId ?? '') as string,
+    batchEvaluationArn: (raw.batchEvaluationArn ?? '') as string,
+    name: (raw.batchEvaluationName ?? '') as string,
+    status: (raw.status ?? '') as string,
+    createdAt: raw.createdAt as string | undefined,
+    updatedAt: raw.updatedAt as string | undefined,
+    evaluators: raw.evaluators as Evaluator[] | undefined,
+    dataSourceConfig: raw.dataSourceConfig as DataSourceConfig | undefined,
+    outputConfig: raw.outputConfig as OutputConfig | undefined,
+    evaluationResults: raw.evaluationResults as EvaluationResults | undefined,
+    errorDetails: raw.errorDetails as string[] | undefined,
+    description: raw.description as string | undefined,
+  };
+}
+
+/**
+ * List batch evaluations.
+ */
+export async function listBatchEvaluations(options: ListBatchEvaluationsOptions): Promise<ListBatchEvaluationsResult> {
+  const params = new URLSearchParams();
+  if (options.maxResults) params.set('maxResults', String(options.maxResults));
+  if (options.nextToken) params.set('nextToken', options.nextToken);
+
+  const query = params.toString();
+  const path = `/evaluations/batch-evaluate${query ? `?${query}` : ''}`;
+
+  const { data } = await signedRequest({
+    region: options.region,
+    method: 'GET',
+    path,
+  });
+
+  const result = data as ListBatchEvaluationsResult;
+  return {
+    batchEvaluations: result.batchEvaluations ?? [],
+    nextToken: result.nextToken,
+  };
+}
+
+/**
+ * Stop a running batch evaluation.
+ */
+export async function stopBatchEvaluation(options: StopBatchEvaluationOptions): Promise<StopBatchEvaluationResult> {
+  const { data } = await signedRequest({
+    region: options.region,
+    method: 'POST',
+    path: `/evaluations/batch-evaluate/${options.batchEvaluationId}/stop`,
+  });
+
+  const raw = data as Record<string, unknown>;
+  return {
+    batchEvaluationId: (raw.batchEvaluationId ?? '') as string,
+    batchEvaluationArn: (raw.batchEvaluationArn ?? '') as string,
+    status: (raw.status ?? '') as string,
+    description: raw.description as string | undefined,
+  };
+}
+
+/**
+ * Delete a batch evaluation.
+ */
+export async function deleteBatchEvaluation(
+  options: DeleteBatchEvaluationOptions
+): Promise<DeleteBatchEvaluationResult> {
+  const { data } = await signedRequest({
+    region: options.region,
+    method: 'DELETE',
+    path: `/evaluations/batch-evaluate/${options.batchEvaluationId}`,
+  });
+
+  const raw = data as Record<string, unknown>;
+  return {
+    batchEvaluationId: (raw.batchEvaluationId ?? '') as string,
+    batchEvaluationArn: (raw.batchEvaluationArn ?? '') as string,
+    status: (raw.status ?? '') as string,
+  };
+}
+
+/**
+ * Generate a client token for idempotency.
+ */
+export function generateClientToken(): string {
+  return crypto.randomUUID();
+}
diff --git a/src/cli/aws/agentcore-config-bundles.ts b/src/cli/aws/agentcore-config-bundles.ts
new file mode 100644
index 000000000..d890d95df
--- /dev/null
+++ b/src/cli/aws/agentcore-config-bundles.ts
@@ -0,0 +1,368 @@
+/**
+ * AWS client wrappers for Configuration Bundle control plane operations.
+ *
+ * NOTE: The ConfigurationBundle API is not yet available in the
+ * @aws-sdk/client-bedrock-agentcore-control SDK. These wrappers use
+ * direct HTTP requests with SigV4 signing as an interim solution.
+ * When the SDK adds ConfigurationBundle commands, migrate to the SDK client.
+ */
+import { getCredentialProvider } from './account';
+import { dnsSuffix } from './partition';
+import { Sha256 } from '@aws-crypto/sha256-js';
+import { defaultProvider } from '@aws-sdk/credential-provider-node';
+import { HttpRequest } from '@smithy/protocol-http';
+import { SignatureV4 } from '@smithy/signature-v4';
+import { randomUUID } from 'node:crypto';
+
+// ============================================================================
+// Types
+// ============================================================================
+
+/** Freeform configuration for a component within a bundle. */
+export interface ComponentConfiguration {
+  configuration: Record<string, unknown>;
+}
+
+/** Map of component identifier (ARN) to its configuration. */
+export type ComponentConfigurationMap = Record<string, ComponentConfiguration>;
+
+/** Version lineage metadata for git-like versioning. */
+export interface VersionLineageMetadata {
+  parentVersionIds?: string[];
+  branchName?: string;
+  createdBy?: { name: string; arn?: string };
+  commitMessage?: string;
+}
+
+// ── Create ──────────────────────────────────────────────────────────────────
+
+export interface CreateConfigurationBundleOptions {
+  region: string;
+  bundleName: string;
+  description?: string;
+  components: ComponentConfigurationMap;
+  branchName?: string;
+  commitMessage?: string;
+  createdBy?: { name: string; arn?: string };
+}
+
+export interface CreateConfigurationBundleResult {
+  bundleArn: string;
+  bundleId: string;
+  versionId: string;
+  createdAt: string;
+}
+
+// ── Get ─────────────────────────────────────────────────────────────────────
+
+export interface GetConfigurationBundleOptions {
+  region: string;
+  bundleId: string;
+  branchName?: string;
+}
+
+export interface GetConfigurationBundleResult {
+  bundleArn: string;
+  bundleId: string;
+  bundleName: string;
+  description?: string;
+  versionId: string;
+  components: ComponentConfigurationMap;
+  lineageMetadata?: VersionLineageMetadata;
+  createdAt: string;
+  updatedAt: string;
+}
+
+// ── Update ──────────────────────────────────────────────────────────────────
+
+export interface UpdateConfigurationBundleOptions {
+  region: string;
+  bundleId: string;
+  bundleName?: string;
+  description?: string;
+  components?: ComponentConfigurationMap;
+  parentVersionIds?: string[];
+  branchName?: string;
+  commitMessage?: string;
+  createdBy?: { name: string; arn?: string };
+}
+
+export interface UpdateConfigurationBundleResult {
+  bundleArn: string;
+  bundleId: string;
+  versionId: string;
+  updatedAt: string;
+}
+
+// ── Delete ──────────────────────────────────────────────────────────────────
+
+export interface DeleteConfigurationBundleOptions {
+  region: string;
+  bundleId: string;
+}
+
+// ── List ────────────────────────────────────────────────────────────────────
+
+export interface ListConfigurationBundlesOptions {
+  region: string;
+  maxResults?: number;
+  nextToken?: string;
+}
+
+export interface ConfigurationBundleSummary {
+  bundleArn: string;
+  bundleId: string;
+  bundleName: string;
+  description?: string;
+}
+
+export interface ListConfigurationBundlesResult {
+  bundles: ConfigurationBundleSummary[];
+  nextToken?: string;
+}
+
+// ── Get Version ─────────────────────────────────────────────────────────────
+
+export interface GetConfigurationBundleVersionOptions {
+  region: string;
+  bundleId: string;
+  versionId: string;
+}
+
+export interface GetConfigurationBundleVersionResult {
+  bundleArn: string;
+  bundleId: string;
+  bundleName: string;
+  description?: string;
+  versionId: string;
+  components: ComponentConfigurationMap;
+  lineageMetadata?: VersionLineageMetadata;
+  createdAt: string;
+  versionCreatedAt: string;
+}
+
+// ── List Versions ───────────────────────────────────────────────────────────
+
+export interface ListConfigurationBundleVersionsFilter {
+  branchName?: string;
+  latestPerBranch?: boolean;
+  createdByName?: string;
+}
+
+export interface ListConfigurationBundleVersionsOptions {
+  region: string;
+  bundleId: string;
+  maxResults?: number;
+  nextToken?: string;
+  filter?: ListConfigurationBundleVersionsFilter;
+}
+
+export interface ConfigurationBundleVersionSummary {
+  bundleArn: string;
+  bundleId: string;
+  versionId: string;
+  lineageMetadata?: VersionLineageMetadata;
+  versionCreatedAt: string;
+}
+
+export interface ListConfigurationBundleVersionsResult {
+  versions: ConfigurationBundleVersionSummary[];
+  nextToken?: string;
+}
+
+// ============================================================================
+// HTTP signing helper
+// ============================================================================
+
+// TODO: Remove beta/gamma endpoints before GA merge
+function getControlPlaneEndpoint(region: string): string {
+  const stage = process.env.AGENTCORE_STAGE?.toLowerCase();
+  if (stage === 'beta') return `https://beta.${region}.elcapcp.genesis-primitives.aws.dev`;
+  if (stage === 'gamma') return `https://gamma.${region}.elcapcp.genesis-primitives.aws.dev`;
+  return `https://bedrock-agentcore-control.${region}.${dnsSuffix(region)}`;
+}
+
+async function signedRequest(options: {
+  region: string;
+  method: string;
+  path: string;
+  body?: string;
+}): Promise<unknown> {
+  const { region, method, path, body } = options;
+  const endpoint = getControlPlaneEndpoint(region);
+  const url = new URL(path, endpoint);
+
+  const query: Record<string, string> = {};
+  url.searchParams.forEach((value, key) => {
+    query[key] = value;
+  });
+
+  const request = new HttpRequest({
+    method,
+    protocol: 'https:',
+    hostname: url.hostname,
+    path: url.pathname,
+    ...(Object.keys(query).length > 0 && { query }),
+    headers: {
+      'Content-Type': 'application/json',
+      host: url.hostname,
+    },
+    ...(body && { body }),
+  });
+
+  const credentials = getCredentialProvider() ?? defaultProvider();
+  const service = 'bedrock-agentcore';
+  const signer = new SignatureV4({
+    service,
+    region,
+    credentials,
+    sha256: Sha256,
+  });
+
+  const signedReq = await signer.sign(request);
+
+  const response = await fetch(`${endpoint}${path}`, {
+    method,
+    headers: signedReq.headers as Record<string, string>,
+    ...(body && { body }),
+  });
+
+  if (!response.ok) {
+    const errorBody = await response.text();
+    throw new Error(`ConfigurationBundle API error (${response.status}): ${errorBody}`);
+  }
+
+  if (response.status === 204) return {};
+  return response.json();
+}
+
+// ============================================================================
+// Control Plane Operations
+// ============================================================================
+
+export async function createConfigurationBundle(
+  options: CreateConfigurationBundleOptions
+): Promise<CreateConfigurationBundleResult> {
+  const body = JSON.stringify({
+    bundleName: options.bundleName,
+    clientToken: randomUUID(),
+    ...(options.description && { description: options.description }),
+    components: options.components,
+    ...(options.branchName && { branchName: options.branchName }),
+    ...(options.commitMessage && { commitMessage: options.commitMessage }),
+    ...(options.createdBy && { createdBy: options.createdBy }),
+  });
+
+  const result = await signedRequest({
+    region: options.region,
+    method: 'POST',
+    path: '/configuration-bundles/create',
+    body,
+  });
+
+  return result as CreateConfigurationBundleResult;
+}
+
+export async function getConfigurationBundle(
+  options: GetConfigurationBundleOptions
+): Promise<GetConfigurationBundleResult> {
+  const params = new URLSearchParams();
+  if (options.branchName) params.set('branchName', options.branchName);
+  const query = params.toString();
+  const path = `/configuration-bundles/${options.bundleId}${query ? `?${query}` : ''}`;
+
+  const data = await signedRequest({
+    region: options.region,
+    method: 'GET',
+    path,
+  });
+
+  return data as GetConfigurationBundleResult;
+}
+
+export async function updateConfigurationBundle(
+  options: UpdateConfigurationBundleOptions
+): Promise<UpdateConfigurationBundleResult> {
+  const body: Record<string, unknown> = { clientToken: randomUUID() };
+  if (options.bundleName !== undefined) body.bundleName = options.bundleName;
+  if (options.description !== undefined) body.description = options.description;
+  if (options.components !== undefined) body.components = options.components;
+  if (options.parentVersionIds !== undefined) body.parentVersionIds = options.parentVersionIds;
+  if (options.branchName !== undefined) body.branchName = options.branchName;
+  if (options.commitMessage !== undefined) body.commitMessage = options.commitMessage;
+  if (options.createdBy !== undefined) body.createdBy = options.createdBy;
+
+  const data = await signedRequest({
+    region: options.region,
+    method: 'PUT',
+    path: `/configuration-bundles/${options.bundleId}`,
+    body: JSON.stringify(body),
+  });
+
+  return data as UpdateConfigurationBundleResult;
+}
+
+export async function deleteConfigurationBundle(options: DeleteConfigurationBundleOptions): Promise<void> {
+  await signedRequest({
+    region: options.region,
+    method: 'DELETE',
+    path: `/configuration-bundles/${options.bundleId}`,
+  });
+}
+
+export async function listConfigurationBundles(
+  options: ListConfigurationBundlesOptions
+): Promise<ListConfigurationBundlesResult> {
+  const params = new URLSearchParams();
+  if (options.maxResults) params.set('maxResults', String(options.maxResults));
+  if (options.nextToken) params.set('nextToken', options.nextToken);
+  const query = params.toString();
+
+  const data = await signedRequest({
+    region: options.region,
+    method: 'POST',
+    path: `/configuration-bundles${query ? `?${query}` : ''}`,
+  });
+
+  const result = data as ListConfigurationBundlesResult;
+  return {
+    bundles: result.bundles ?? [],
+    nextToken: result.nextToken,
+  };
+}
+
+export async function getConfigurationBundleVersion(
+  options: GetConfigurationBundleVersionOptions
+): Promise<GetConfigurationBundleVersionResult> {
+  const data = await signedRequest({
+    region: options.region,
+    method: 'GET',
+    path: `/configuration-bundles/${options.bundleId}/versions/${options.versionId}`,
+  });
+
+  return data as GetConfigurationBundleVersionResult;
+}
+
+export async function listConfigurationBundleVersions(
+  options: ListConfigurationBundleVersionsOptions
+): Promise<ListConfigurationBundleVersionsResult> {
+  const params = new URLSearchParams();
+  if (options.maxResults) params.set('maxResults', String(options.maxResults));
+  if (options.nextToken) params.set('nextToken', options.nextToken);
+  const query = params.toString();
+
+  const body = options.filter ? JSON.stringify({ filter: options.filter }) : undefined;
+
+  const data = await signedRequest({
+    region: options.region,
+    method: 'POST',
+    path: `/configuration-bundles/${options.bundleId}/versions${query ? `?${query}` : ''}`,
+    body,
+  });
+
+  const result = data as ListConfigurationBundleVersionsResult;
+  return {
+    versions: result.versions ?? [],
+    nextToken: result.nextToken,
+  };
+}
diff --git a/src/cli/aws/agentcore-control.ts b/src/cli/aws/agentcore-control.ts
index 162c2b3a6..d2770bacf 100644
--- a/src/cli/aws/agentcore-control.ts
+++ b/src/cli/aws/agentcore-control.ts
@@ -1,4 +1,5 @@
 import type { EvaluationLevel } from '../../schema/schemas/primitives/evaluator';
+import { PACKAGE_VERSION } from '../constants';
 import { getCredentialProvider } from './account';
 import {
   BedrockAgentCoreControlClient,
@@ -27,6 +28,7 @@ export function createControlClient(region: string): BedrockAgentCoreControlClie
   return new BedrockAgentCoreControlClient({
     region,
     credentials: getCredentialProvider(),
+    customUserAgent: [['agentcore-cli', PACKAGE_VERSION]],
   });
 }
 
diff --git a/src/cli/aws/agentcore-harness.ts b/src/cli/aws/agentcore-harness.ts
new file mode 100644
index 000000000..cca371fbc
--- /dev/null
+++ b/src/cli/aws/agentcore-harness.ts
@@ -0,0 +1,625 @@
+/**
+ * Typed client wrappers for Harness control plane and data plane operations.
+ *
+ * Control plane: CreateHarness, GetHarness, UpdateHarness, DeleteHarness, ListHarnesses
+ * Data plane: InvokeHarness (streaming)
+ * TODO InvokeAgentRuntimeCommand
+ *
+ * Built on AgentCoreApiClient (shared SigV4 HTTP client).
+ * Migrate to @aws-sdk/client-bedrock-agentcore-control when Harness commands land in the SDK.
+ */
+import { AgentCoreApiClient, AgentCoreApiError, resolveEndpoint } from './api-client';
+import { randomUUID } from 'node:crypto';
+
+// ============================================================================
+// Shared Types (from Smithy service model)
+// ============================================================================
+
+export type HarnessStatus = 'CREATING' | 'READY' | 'UPDATING' | 'DELETING' | 'DELETED' | 'FAILED';
+
+export interface HarnessModelConfiguration {
+  bedrockModelConfig?: { modelId: string };
+  openAiModelConfig?: { modelId: string; apiKeyArn?: string };
+  geminiModelConfig?: { modelId: string; apiKeyArn?: string };
+}
+
+export type HarnessSystemPrompt = { text: string }[];
+
+export interface HarnessTool {
+  type: string;
+  name: string;
+  browserArn?: string;
+  codeInterpreterArn?: string;
+  config?: Record<string, unknown>;
+}
+
+export interface HarnessSkill {
+  path: string;
+}
+
+export interface HarnessMemoryConfiguration {
+  memoryArn?: string;
+}
+
+export interface HarnessTruncationConfiguration {
+  strategy: string;
+  config: { slidingWindow?: { messagesCount: number } };
+}
+
+export interface HarnessEnvironmentArtifact {
+  containerConfiguration?: { containerUri: string };
+}
+
+export interface HarnessAgentCoreRuntimeEnvironment {
+  agentRuntimeArn?: string;
+  agentRuntimeId?: string;
+  agentRuntimeName?: string;
+  lifecycleConfiguration?: Record<string, unknown>;
+  networkConfiguration?: Record<string, unknown>;
+  filesystemConfigurations?: Record<string, unknown>[];
+}
+
+export interface HarnessEnvironmentProvider {
+  agentCoreRuntimeEnvironment?: HarnessAgentCoreRuntimeEnvironment;
+}
+
+export interface Harness {
+  harnessId: string;
+  harnessName: string;
+  arn: string;
+  status: HarnessStatus;
+  executionRoleArn: string;
+  model?: HarnessModelConfiguration;
+  systemPrompt?: HarnessSystemPrompt;
+  tools?: HarnessTool[];
+  skills?: HarnessSkill[];
+  allowedTools?: string[];
+  memory?: HarnessMemoryConfiguration;
+  truncation?: HarnessTruncationConfiguration;
+  maxIterations?: number;
+  maxTokens?: number;
+  timeoutSeconds?: number;
+  environment?: HarnessEnvironmentProvider;
+  environmentArtifact?: HarnessEnvironmentArtifact;
+  environmentVariables?: Record<string, string>;
+  authorizerConfiguration?: Record<string, unknown>;
+  tags?: Record<string, string>;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface HarnessSummary {
+  harnessId: string;
+  harnessName: string;
+  arn: string;
+  status: HarnessStatus;
+  createdAt: string;
+  updatedAt: string;
+}
+
+// ============================================================================
+// CreateHarness
+// ============================================================================
+
+export interface CreateHarnessOptions {
+  region: string;
+  harnessName: string;
+  executionRoleArn: string;
+  environment?: HarnessEnvironmentProvider;
+  environmentArtifact?: HarnessEnvironmentArtifact;
+  environmentVariables?: Record<string, string>;
+  authorizerConfiguration?: Record<string, unknown>;
+  model?: HarnessModelConfiguration;
+  systemPrompt?: HarnessSystemPrompt;
+  tools?: HarnessTool[];
+  skills?: HarnessSkill[];
+  allowedTools?: string[];
+  memory?: HarnessMemoryConfiguration;
+  truncation?: HarnessTruncationConfiguration;
+  maxIterations?: number;
+  maxTokens?: number;
+  timeoutSeconds?: number;
+  tags?: Record<string, string>;
+}
+
+export interface CreateHarnessResult {
+  harness: Harness;
+}
+
+export async function createHarness(options: CreateHarnessOptions): Promise<CreateHarnessResult> {
+  const { region, ...rest } = options;
+  const client = new AgentCoreApiClient({ region, plane: 'control' });
+
+  const body: Record<string, unknown> = {
+    harnessName: rest.harnessName,
+    clientToken: randomUUID(),
+    executionRoleArn: rest.executionRoleArn,
+  };
+
+  if (rest.environment) body.environment = rest.environment;
+  if (rest.environmentArtifact) body.environmentArtifact = rest.environmentArtifact;
+  if (rest.environmentVariables) body.environmentVariables = rest.environmentVariables;
+  if (rest.authorizerConfiguration) body.authorizerConfiguration = rest.authorizerConfiguration;
+  if (rest.model) body.model = rest.model;
+  if (rest.systemPrompt) body.systemPrompt = rest.systemPrompt;
+  if (rest.tools) body.tools = rest.tools;
+  if (rest.skills) body.skills = rest.skills;
+  if (rest.allowedTools) body.allowedTools = rest.allowedTools;
+  if (rest.memory) body.memory = rest.memory;
+  if (rest.truncation) body.truncation = rest.truncation;
+  if (rest.maxIterations != null) body.maxIterations = rest.maxIterations;
+  if (rest.maxTokens != null) body.maxTokens = rest.maxTokens;
+  if (rest.timeoutSeconds != null) body.timeoutSeconds = rest.timeoutSeconds;
+  if (rest.tags) body.tags = rest.tags;
+
+  const result = await client.request({ method: 'POST', path: '/harnesses', body });
+  return result as CreateHarnessResult;
+}
+
+// ============================================================================
+// GetHarness
+// ============================================================================
+
+export interface GetHarnessOptions {
+  region: string;
+  harnessId: string;
+}
+
+export interface GetHarnessResult {
+  harness: Harness;
+}
+
+export async function getHarness(options: GetHarnessOptions): Promise<GetHarnessResult> {
+  const client = new AgentCoreApiClient({ region: options.region, plane: 'control' });
+  const result = await client.request({ method: 'GET', path: `/harnesses/${options.harnessId}` });
+  return result as GetHarnessResult;
+}
+
+// ============================================================================
+// UpdateHarness
+// ============================================================================
+
+export interface UpdateHarnessOptions {
+  region: string;
+  harnessId: string;
+  executionRoleArn?: string;
+  environment?: HarnessEnvironmentProvider;
+  environmentArtifact?: { optionalValue: HarnessEnvironmentArtifact | null };
+  environmentVariables?: Record<string, string>;
+  authorizerConfiguration?: { optionalValue: Record<string, unknown> | null };
+  model?: HarnessModelConfiguration;
+  systemPrompt?: HarnessSystemPrompt;
+  tools?: HarnessTool[];
+  skills?: HarnessSkill[];
+  allowedTools?: string[];
+  memory?: { optionalValue: HarnessMemoryConfiguration | null };
+  truncation?: HarnessTruncationConfiguration;
+  maxIterations?: number;
+  maxTokens?: number;
+  timeoutSeconds?: number;
+  tags?: Record<string, string>;
+}
+
+export interface UpdateHarnessResult {
+  harness: Harness;
+}
+
+export async function updateHarness(options: UpdateHarnessOptions): Promise<UpdateHarnessResult> {
+  const { region, harnessId, ...rest } = options;
+  const client = new AgentCoreApiClient({ region, plane: 'control' });
+
+  const body: Record<string, unknown> = {
+    clientToken: randomUUID(),
+  };
+
+  if (rest.executionRoleArn) body.executionRoleArn = rest.executionRoleArn;
+  if (rest.environment) body.environment = rest.environment;
+  if (rest.environmentArtifact !== undefined) body.environmentArtifact = rest.environmentArtifact;
+  if (rest.environmentVariables) body.environmentVariables = rest.environmentVariables;
+  if (rest.authorizerConfiguration !== undefined) body.authorizerConfiguration = rest.authorizerConfiguration;
+  if (rest.model) body.model = rest.model;
+  if (rest.systemPrompt) body.systemPrompt = rest.systemPrompt;
+  if (rest.tools) body.tools = rest.tools;
+  if (rest.skills) body.skills = rest.skills;
+  if (rest.allowedTools) body.allowedTools = rest.allowedTools;
+  if (rest.memory !== undefined) body.memory = rest.memory;
+  if (rest.truncation) body.truncation = rest.truncation;
+  if (rest.maxIterations != null) body.maxIterations = rest.maxIterations;
+  if (rest.maxTokens != null) body.maxTokens = rest.maxTokens;
+  if (rest.timeoutSeconds != null) body.timeoutSeconds = rest.timeoutSeconds;
+  if (rest.tags) body.tags = rest.tags;
+
+  const result = await client.request({ method: 'PATCH', path: `/harnesses/${harnessId}`, body });
+  return result as UpdateHarnessResult;
+}
+
+// ============================================================================
+// DeleteHarness
+// ============================================================================
+
+export interface DeleteHarnessOptions {
+  region: string;
+  harnessId: string;
+}
+
+export interface DeleteHarnessResult {
+  harness: Harness;
+}
+
+export async function deleteHarness(options: DeleteHarnessOptions): Promise<DeleteHarnessResult> {
+  const client = new AgentCoreApiClient({ region: options.region, plane: 'control' });
+  const result = await client.request({
+    method: 'DELETE',
+    path: `/harnesses/${options.harnessId}`,
+    query: { clientToken: randomUUID() },
+  });
+  return result as DeleteHarnessResult;
+}
+
+// ============================================================================
+// ListHarnesses
+// ============================================================================
+
+export interface ListHarnessesOptions {
+  region: string;
+  maxResults?: number;
+  nextToken?: string;
+}
+
+export interface ListHarnessesResult {
+  harnesses: HarnessSummary[];
+  nextToken?: string;
+}
+
+export async function listHarnesses(options: ListHarnessesOptions): Promise<ListHarnessesResult> {
+  const client = new AgentCoreApiClient({ region: options.region, plane: 'control' });
+  const query: Record<string, string> = {};
+  if (options.maxResults != null) query.maxResults = String(options.maxResults);
+  if (options.nextToken) query.nextToken = options.nextToken;
+
+  const result = await client.request({ method: 'GET', path: '/harnesses', query });
+  return result as ListHarnessesResult;
+}
+
+export async function listAllHarnesses(region: string): Promise<HarnessSummary[]> {
+  const all: HarnessSummary[] = [];
+  let nextToken: string | undefined;
+
+  do {
+    const result = await listHarnesses({ region, maxResults: 100, nextToken });
+    all.push(...result.harnesses);
+    nextToken = result.nextToken;
+  } while (nextToken);
+
+  return all;
+}
+
+// ============================================================================
+// InvokeHarness (streaming, data plane)
+// ============================================================================
+
+export interface InvokeHarnessOptions {
+  region: string;
+  harnessArn: string;
+  runtimeSessionId: string;
+  messages: { role: string; content: Record<string, unknown>[] }[];
+  model?: HarnessModelConfiguration;
+  systemPrompt?: HarnessSystemPrompt;
+  tools?: HarnessTool[];
+  skills?: HarnessSkill[];
+  allowedTools?: string[];
+  maxIterations?: number;
+  maxTokens?: number;
+  timeoutSeconds?: number;
+  actorId?: string;
+  /** Bearer token for CUSTOM_JWT auth (bypasses SigV4) */
+  bearerToken?: string;
+}
+
+// ── Stream event types ──────────────────────────────────────────────────────
+
+export type HarnessStopReason =
+  | 'end_turn'
+  | 'tool_use'
+  | 'tool_result'
+  | 'max_tokens'
+  | 'stop_sequence'
+  | 'content_filtered'
+  | 'malformed_model_output'
+  | 'malformed_tool_use'
+  | 'interrupted'
+  | 'partial_turn'
+  | 'model_context_window_exceeded'
+  | 'max_iterations_exceeded'
+  | 'max_output_tokens_exceeded'
+  | 'timeout_exceeded';
+
+export interface ToolUseBlockStart {
+  toolUseId: string;
+  name: string;
+  type?: string;
+  serverName?: string;
+}
+
+export interface ToolResultBlockStart {
+  toolUseId: string;
+  status?: string;
+}
+
+export type ContentBlockStart =
+  | { type: 'toolUse'; toolUse: ToolUseBlockStart }
+  | { type: 'toolResult'; toolResult: ToolResultBlockStart };
+
+export type ContentBlockDelta =
+  | { type: 'text'; text: string }
+  | { type: 'toolUse'; input: string }
+  | { type: 'toolResult'; results: Record<string, unknown>[] }
+  | { type: 'reasoningContent'; text?: string; signature?: string };
+
+export interface TokenUsage {
+  inputTokens: number;
+  outputTokens: number;
+  totalTokens: number;
+  cacheReadInputTokens?: number;
+  cacheWriteInputTokens?: number;
+}
+
+export interface StreamMetrics {
+  latencyMs: number;
+}
+
+export type HarnessStreamEvent =
+  | { type: 'messageStart'; role: string }
+  | { type: 'contentBlockStart'; contentBlockIndex: number; start: ContentBlockStart }
+  | { type: 'contentBlockDelta'; contentBlockIndex: number; delta: ContentBlockDelta }
+  | { type: 'contentBlockStop'; contentBlockIndex: number }
+  | { type: 'messageStop'; stopReason: HarnessStopReason }
+  | { type: 'metadata'; usage: TokenUsage; metrics: StreamMetrics }
+  | { type: 'error'; errorType: string; message: string };
+
+export async function* invokeHarness(options: InvokeHarnessOptions): AsyncGenerator<HarnessStreamEvent> {
+  const { region, harnessArn, runtimeSessionId, messages, bearerToken, ...overrides } = options;
+
+  const body: Record<string, unknown> = { messages };
+  if (overrides.model) body.model = overrides.model;
+  if (overrides.systemPrompt) body.systemPrompt = overrides.systemPrompt;
+  if (overrides.tools) body.tools = overrides.tools;
+  if (overrides.skills) body.skills = overrides.skills;
+  if (overrides.allowedTools) body.allowedTools = overrides.allowedTools;
+  if (overrides.maxIterations != null) body.maxIterations = overrides.maxIterations;
+  if (overrides.maxTokens != null) body.maxTokens = overrides.maxTokens;
+  if (overrides.timeoutSeconds != null) body.timeoutSeconds = overrides.timeoutSeconds;
+  if (overrides.actorId) body.actorId = overrides.actorId;
+
+  let response: Response;
+  if (bearerToken) {
+    response = await invokeHarnessWithBearerToken(region, harnessArn, runtimeSessionId, body, bearerToken);
+  } else {
+    const client = new AgentCoreApiClient({ region, plane: 'data' });
+    response = await client.requestRaw({
+      method: 'POST',
+      path: '/harnesses/invoke',
+      query: { harnessArn },
+      headers: { 'X-Amzn-Bedrock-AgentCore-Runtime-Session-Id': runtimeSessionId },
+      body,
+    });
+  }
+
+  if (!response.ok) {
+    const errorBody = await response.text();
+    const requestId = response.headers.get('x-amzn-requestid') ?? undefined;
+    throw new AgentCoreApiError(response.status, errorBody, requestId);
+  }
+
+  if (!response.body) return;
+
+  yield* parseEventStream(response.body);
+}
+
+async function invokeHarnessWithBearerToken(
+  region: string,
+  harnessArn: string,
+  runtimeSessionId: string,
+  body: Record<string, unknown>,
+  bearerToken: string
+): Promise<Response> {
+  const endpoint = resolveEndpoint(region, 'data');
+  const url = new URL('/harnesses/invoke', endpoint);
+  url.searchParams.set('harnessArn', harnessArn);
+
+  return fetch(url.toString(), {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${bearerToken}`,
+      'Content-Type': 'application/json',
+      'X-Amzn-Bedrock-AgentCore-Runtime-Session-Id': runtimeSessionId,
+    },
+    body: JSON.stringify(body),
+  });
+}
+
+async function* parseEventStream(body: ReadableStream<Uint8Array>): AsyncGenerator<HarnessStreamEvent> {
+  const { EventStreamCodec } = await import('@smithy/eventstream-codec');
+  const codec = new EventStreamCodec(toUtf8, fromUtf8);
+  const reader = body.getReader();
+  let buffer: Uint8Array<ArrayBuffer> = new Uint8Array(0);
+
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+
+      buffer = concatBuffers(buffer, new Uint8Array(value));
+
+      while (buffer.length >= 4) {
+        const view = new DataView(buffer.buffer, buffer.byteOffset, buffer.byteLength);
+        const totalLength = view.getUint32(0);
+        if (buffer.length < totalLength) break;
+
+        const frame = buffer.slice(0, totalLength);
+        buffer = buffer.slice(totalLength);
+
+        try {
+          const message = codec.decode(frame);
+          const headers: Record<string, string> = {};
+          for (const [key, val] of Object.entries(message.headers)) {
+            headers[key] = String(val.value);
+          }
+
+          if (headers[':message-type'] === 'error') {
+            yield {
+              type: 'error',
+              errorType: headers[':error-code'] ?? 'unknown',
+              message: headers[':error-message'] ?? 'Unknown error',
+            };
+            continue;
+          }
+
+          if (headers[':message-type'] === 'exception') {
+            const exBody = new TextDecoder().decode(message.body);
+            let msg = exBody;
+            try {
+              const parsed = JSON.parse(exBody) as { message?: string };
+              msg = parsed.message ?? exBody;
+            } catch {
+              // use raw body
+            }
+            yield {
+              type: 'error',
+              errorType: headers[':exception-type'] ?? 'exception',
+              message: msg,
+            };
+            continue;
+          }
+
+          const eventType = headers[':event-type'];
+          if (!eventType) continue;
+
+          const bodyText = new TextDecoder().decode(message.body);
+          if (!bodyText) continue;
+
+          const event = parseEventPayload(eventType, bodyText);
+          if (event) yield event;
+        } catch {
+          // skip malformed frames
+        }
+      }
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+function toUtf8(input: Uint8Array): string {
+  return new TextDecoder().decode(input);
+}
+
+function fromUtf8(input: string): Uint8Array {
+  return new TextEncoder().encode(input);
+}
+
+function concatBuffers(a: Uint8Array<ArrayBuffer>, b: Uint8Array<ArrayBuffer>): Uint8Array<ArrayBuffer> {
+  const result = new Uint8Array(a.length + b.length);
+  result.set(a, 0);
+  result.set(b, a.length);
+  return result;
+}
+
+function parseEventPayload(eventType: string, bodyText: string): HarnessStreamEvent | null {
+  let payload: Record<string, unknown>;
+  try {
+    payload = JSON.parse(bodyText) as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+
+  switch (eventType) {
+    case 'messageStart':
+      return { type: 'messageStart', role: (payload.role as string) ?? 'assistant' };
+
+    case 'contentBlockStart': {
+      const start = (payload.start as Record<string, unknown>) ?? payload;
+      return {
+        type: 'contentBlockStart',
+        contentBlockIndex: (payload.contentBlockIndex as number) ?? 0,
+        start: parseContentBlockStart(start),
+      };
+    }
+
+    case 'contentBlockDelta': {
+      const delta = (payload.delta as Record<string, unknown>) ?? payload;
+      return {
+        type: 'contentBlockDelta',
+        contentBlockIndex: (payload.contentBlockIndex as number) ?? 0,
+        delta: parseContentBlockDelta(delta),
+      };
+    }
+
+    case 'contentBlockStop':
+      return { type: 'contentBlockStop', contentBlockIndex: (payload.contentBlockIndex as number) ?? 0 };
+
+    case 'messageStop':
+      return { type: 'messageStop', stopReason: (payload.stopReason as HarnessStopReason) ?? 'end_turn' };
+
+    case 'metadata':
+      return {
+        type: 'metadata',
+        usage: (payload.usage as TokenUsage) ?? { inputTokens: 0, outputTokens: 0, totalTokens: 0 },
+        metrics: (payload.metrics as StreamMetrics) ?? { latencyMs: 0 },
+      };
+
+    case 'internalServerException':
+      return {
+        type: 'error',
+        errorType: 'internalServerException',
+        message: (payload.message as string) ?? 'Internal server error',
+      };
+
+    case 'validationException':
+      return {
+        type: 'error',
+        errorType: 'validationException',
+        message: (payload.message as string) ?? 'Validation error',
+      };
+
+    case 'runtimeClientError':
+      return {
+        type: 'error',
+        errorType: 'runtimeClientError',
+        message: (payload.message as string) ?? 'Runtime client error',
+      };
+
+    default:
+      return null;
+  }
+}
+
+function parseContentBlockStart(start: Record<string, unknown>): ContentBlockStart {
+  if ('toolUse' in start) {
+    const tu = start.toolUse as ToolUseBlockStart;
+    return { type: 'toolUse', toolUse: tu };
+  }
+  if ('toolResult' in start) {
+    const tr = start.toolResult as ToolResultBlockStart;
+    return { type: 'toolResult', toolResult: tr };
+  }
+  return { type: 'toolUse', toolUse: { toolUseId: '', name: 'unknown' } };
+}
+
+function parseContentBlockDelta(delta: Record<string, unknown>): ContentBlockDelta {
+  if ('text' in delta) {
+    return { type: 'text', text: delta.text as string };
+  }
+  if ('toolUse' in delta) {
+    const tu = delta.toolUse as { input: string };
+    return { type: 'toolUse', input: tu.input };
+  }
+  if ('toolResult' in delta) {
+    return { type: 'toolResult', results: delta.toolResult as Record<string, unknown>[] };
+  }
+  if ('reasoningContent' in delta) {
+    const rc = delta.reasoningContent as { text?: string; signature?: string };
+    return { type: 'reasoningContent', text: rc.text, signature: rc.signature };
+  }
+  return { type: 'text', text: '' };
+}
diff --git a/src/cli/aws/agentcore-http-gateways.ts b/src/cli/aws/agentcore-http-gateways.ts
new file mode 100644
index 000000000..674f090a0
--- /dev/null
+++ b/src/cli/aws/agentcore-http-gateways.ts
@@ -0,0 +1,519 @@
+/**
+ * AWS client wrappers for HTTP Gateway control plane operations.
+ *
+ * HTTP gateways are required for A/B testing because MCP gateways
+ * don't emit spans for treatment propagation. These wrappers use
+ * direct HTTP requests with SigV4 signing against the control plane.
+ */
+import { getCredentialProvider } from './account';
+import { dnsSuffix } from './partition';
+import { Sha256 } from '@aws-crypto/sha256-js';
+import { defaultProvider } from '@aws-sdk/credential-provider-node';
+import { HttpRequest } from '@smithy/protocol-http';
+import { SignatureV4 } from '@smithy/signature-v4';
+import { randomUUID } from 'node:crypto';
+
+// ============================================================================
+// Types
+// ============================================================================
+
+// ── Create Gateway ─────────────────────────────────────────────────────────
+
+export interface CreateHttpGatewayOptions {
+  region: string;
+  name: string;
+  roleArn: string;
+}
+
+export interface CreateHttpGatewayResult {
+  gatewayId: string;
+  gatewayArn: string;
+  name: string;
+  status: string;
+}
+
+// ── Create Gateway Target ──────────────────────────────────────────────────
+
+export interface CreateHttpGatewayTargetOptions {
+  region: string;
+  gatewayId: string;
+  targetName: string;
+  runtimeArn: string;
+  qualifier?: string;
+}
+
+export interface CreateHttpGatewayTargetResult {
+  targetId: string;
+  name: string;
+  status: string;
+}
+
+// ── Get Gateway ────────────────────────────────────────────────────────────
+
+export interface GetHttpGatewayOptions {
+  region: string;
+  gatewayId: string;
+}
+
+export interface GetHttpGatewayResult {
+  gatewayId: string;
+  gatewayArn: string;
+  gatewayUrl?: string;
+  name: string;
+  status: string;
+  authorizerType?: string;
+  roleArn?: string;
+  createdAt?: string;
+  updatedAt?: string;
+}
+
+// ── Get Gateway Target ─────────────────────────────────────────────────────
+
+export interface GetHttpGatewayTargetOptions {
+  region: string;
+  gatewayId: string;
+  targetId: string;
+}
+
+export interface GetHttpGatewayTargetResult {
+  targetId: string;
+  name: string;
+  status: string;
+  targetConfiguration?: unknown;
+  createdAt?: string;
+  updatedAt?: string;
+}
+
+// ── List Gateways ──────────────────────────────────────────────────────────
+
+export interface ListHttpGatewaysOptions {
+  region: string;
+  maxResults?: number;
+  nextToken?: string;
+}
+
+export interface HttpGatewaySummary {
+  gatewayId: string;
+  gatewayArn: string;
+  name: string;
+  status: string;
+}
+
+export interface ListHttpGatewaysResult {
+  gateways: HttpGatewaySummary[];
+  nextToken?: string;
+}
+
+// ── List Gateway Targets ──────────────────────────────────────────────────
+
+export interface ListHttpGatewayTargetsOptions {
+  region: string;
+  gatewayId: string;
+  maxResults?: number;
+}
+
+export interface HttpGatewayTargetSummary {
+  targetId: string;
+  name: string;
+  status: string;
+}
+
+export interface ListHttpGatewayTargetsResult {
+  targets: HttpGatewayTargetSummary[];
+}
+
+// ── Delete Gateway Target ──────────────────────────────────────────────────
+
+export interface DeleteHttpGatewayTargetOptions {
+  region: string;
+  gatewayId: string;
+  targetId: string;
+}
+
+// ── Delete Gateway ─────────────────────────────────────────────────────────
+
+export interface DeleteHttpGatewayOptions {
+  region: string;
+  gatewayId: string;
+}
+
+// ── Wait for Target Ready ──────────────────────────────────────────────────
+
+export interface WaitForTargetReadyOptions {
+  region: string;
+  gatewayId: string;
+  targetId: string;
+  /** Maximum time to wait in milliseconds. Defaults to 120000 (120s). */
+  timeoutMs?: number;
+}
+
+// ============================================================================
+// HTTP signing helper
+// ============================================================================
+
+function getControlPlaneEndpoint(region: string): string {
+  const stage = process.env.AGENTCORE_STAGE?.toLowerCase();
+  if (stage === 'beta') return `https://beta.${region}.elcapcp.genesis-primitives.aws.dev`;
+  if (stage === 'gamma') return `https://gamma.${region}.elcapcp.genesis-primitives.aws.dev`;
+  return `https://bedrock-agentcore-control.${region}.${dnsSuffix(region)}`;
+}
+
+async function signedRequest(options: {
+  region: string;
+  method: string;
+  path: string;
+  body?: string;
+}): Promise<unknown> {
+  const { region, method, path, body } = options;
+  const endpoint = getControlPlaneEndpoint(region);
+  const url = new URL(path, endpoint);
+
+  const query: Record<string, string> = {};
+  url.searchParams.forEach((value, key) => {
+    query[key] = value;
+  });
+
+  const request = new HttpRequest({
+    method,
+    protocol: 'https:',
+    hostname: url.hostname,
+    path: url.pathname,
+    ...(Object.keys(query).length > 0 && { query }),
+    headers: {
+      'Content-Type': 'application/json',
+      host: url.hostname,
+    },
+    ...(body && { body }),
+  });
+
+  const credentials = getCredentialProvider() ?? defaultProvider();
+  const service = 'bedrock-agentcore';
+  const signer = new SignatureV4({
+    service,
+    region,
+    credentials,
+    sha256: Sha256,
+  });
+
+  const signedReq = await signer.sign(request);
+
+  const response = await fetch(`${endpoint}${path}`, {
+    method,
+    headers: signedReq.headers as Record<string, string>,
+    ...(body && { body }),
+  });
+
+  if (!response.ok) {
+    const errorBody = await response.text();
+    throw new Error(`HttpGateway API error (${response.status}): ${errorBody}`);
+  }
+
+  if (response.status === 204) return {};
+  return response.json();
+}
+
+// ============================================================================
+// Control Plane Operations
+// ============================================================================
+
+export async function createHttpGateway(options: CreateHttpGatewayOptions): Promise<CreateHttpGatewayResult> {
+  const body = JSON.stringify({
+    name: options.name,
+    authorizerType: 'AWS_IAM',
+    roleArn: options.roleArn,
+    clientToken: randomUUID(),
+  });
+
+  try {
+    return (await signedRequest({
+      region: options.region,
+      method: 'POST',
+      path: '/gateways',
+      body,
+    })) as CreateHttpGatewayResult;
+  } catch (err) {
+    throw new Error(
+      `Failed to create HTTP gateway "${options.name}": ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+
+export async function createHttpGatewayTarget(
+  options: CreateHttpGatewayTargetOptions
+): Promise<CreateHttpGatewayTargetResult> {
+  const body = JSON.stringify({
+    name: options.targetName,
+    clientToken: randomUUID(),
+    targetConfiguration: {
+      http: {
+        agentcoreRuntime: {
+          arn: options.runtimeArn,
+          qualifier: options.qualifier ?? 'DEFAULT',
+        },
+      },
+    },
+    credentialProviderConfigurations: [{ credentialProviderType: 'GATEWAY_IAM_ROLE' }],
+  });
+
+  try {
+    return (await signedRequest({
+      region: options.region,
+      method: 'POST',
+      path: `/gateways/${options.gatewayId}/targets`,
+      body,
+    })) as CreateHttpGatewayTargetResult;
+  } catch (err) {
+    // Fallback: retry with legacy field name if the new name is not yet supported
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes('ValidationException') || msg.includes('400')) {
+      const legacyBody = JSON.stringify({
+        name: options.targetName,
+        clientToken: randomUUID(),
+        targetConfiguration: {
+          http: {
+            runtimeTargetConfiguration: {
+              arn: options.runtimeArn,
+              qualifier: options.qualifier ?? 'DEFAULT',
+            },
+          },
+        },
+        credentialProviderConfigurations: [{ credentialProviderType: 'GATEWAY_IAM_ROLE' }],
+      });
+      try {
+        return (await signedRequest({
+          region: options.region,
+          method: 'POST',
+          path: `/gateways/${options.gatewayId}/targets`,
+          body: legacyBody,
+        })) as CreateHttpGatewayTargetResult;
+      } catch {
+        // Fall through to original error
+      }
+    }
+    throw new Error(`Failed to create target "${options.targetName}" in gateway ${options.gatewayId}: ${msg}`);
+  }
+}
+
+export async function getHttpGateway(options: GetHttpGatewayOptions): Promise<GetHttpGatewayResult> {
+  const data = await signedRequest({
+    region: options.region,
+    method: 'GET',
+    path: `/gateways/${options.gatewayId}`,
+  });
+
+  return data as GetHttpGatewayResult;
+}
+
+export async function getHttpGatewayTarget(options: GetHttpGatewayTargetOptions): Promise<GetHttpGatewayTargetResult> {
+  const data = await signedRequest({
+    region: options.region,
+    method: 'GET',
+    path: `/gateways/${options.gatewayId}/targets/${options.targetId}`,
+  });
+
+  return data as GetHttpGatewayTargetResult;
+}
+
+export async function listHttpGateways(options: ListHttpGatewaysOptions): Promise<ListHttpGatewaysResult> {
+  const params = new URLSearchParams();
+  if (options.maxResults) params.set('maxResults', String(options.maxResults));
+  if (options.nextToken) params.set('nextToken', options.nextToken);
+  const query = params.toString();
+
+  const data = await signedRequest({
+    region: options.region,
+    method: 'GET',
+    path: `/gateways${query ? `?${query}` : ''}`,
+  });
+
+  const result = data as ListHttpGatewaysResult;
+  return {
+    gateways: result.gateways ?? [],
+    nextToken: result.nextToken,
+  };
+}
+
+/**
+ * List all HTTP gateways, paginating through all results.
+ */
+export async function listAllHttpGateways(options: { region: string }): Promise<HttpGatewaySummary[]> {
+  const all: HttpGatewaySummary[] = [];
+  let nextToken: string | undefined;
+
+  do {
+    const result = await listHttpGateways({ region: options.region, maxResults: 100, nextToken });
+    all.push(...result.gateways);
+    nextToken = result.nextToken;
+  } while (nextToken);
+
+  return all;
+}
+
+export async function listHttpGatewayTargets(
+  options: ListHttpGatewayTargetsOptions
+): Promise<ListHttpGatewayTargetsResult> {
+  const params = new URLSearchParams();
+  if (options.maxResults) params.set('maxResults', String(options.maxResults));
+  const query = params.toString();
+
+  const data = await signedRequest({
+    region: options.region,
+    method: 'GET',
+    path: `/gateways/${options.gatewayId}/targets${query ? `?${query}` : ''}`,
+  });
+
+  const result = data as Record<string, unknown>;
+  return {
+    targets: (result.items ?? result.targets ?? []) as HttpGatewayTargetSummary[],
+  };
+}
+
+export async function deleteHttpGatewayTarget(
+  options: DeleteHttpGatewayTargetOptions
+): Promise<{ success: boolean; error?: string }> {
+  try {
+    await signedRequest({
+      region: options.region,
+      method: 'DELETE',
+      path: `/gateways/${options.gatewayId}/targets/${options.targetId}`,
+    });
+
+    // Wait for target to be fully deleted before returning.
+    // Gateway deletion fails if targets still exist in DELETING state.
+    const timeoutMs = 60_000;
+    const startTime = Date.now();
+    let delayMs = 2_000;
+
+    while (Date.now() - startTime < timeoutMs) {
+      try {
+        await getHttpGatewayTarget({
+          region: options.region,
+          gatewayId: options.gatewayId,
+          targetId: options.targetId,
+        });
+        // Target still exists — keep waiting
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg.includes('(404)') || msg.includes('not found')) {
+          return { success: true }; // Target confirmed deleted
+        }
+        // Transient error — keep polling
+      }
+
+      const remaining = timeoutMs - (Date.now() - startTime);
+      if (remaining <= 0) break;
+      await new Promise(resolve => setTimeout(resolve, Math.min(delayMs, remaining)));
+      delayMs = Math.min(delayMs * 2, 8_000);
+    }
+
+    // Polling timed out — target may still be deleting
+    return { success: false, error: `Timed out waiting for target ${options.targetId} to be fully deleted` };
+  } catch (err) {
+    return { success: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+export async function deleteHttpGateway(
+  options: DeleteHttpGatewayOptions
+): Promise<{ success: boolean; error?: string }> {
+  try {
+    await signedRequest({
+      region: options.region,
+      method: 'DELETE',
+      path: `/gateways/${options.gatewayId}`,
+    });
+    return { success: true };
+  } catch (err) {
+    return { success: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+/** Terminal states that indicate a resource will never become READY. */
+const TERMINAL_FAILURE_STATES = ['FAILED', 'CREATE_FAILED', 'UPDATE_FAILED', 'DELETING', 'DELETED'] as const;
+
+export async function waitForGatewayReady(options: {
+  region: string;
+  gatewayId: string;
+  timeoutMs?: number;
+}): Promise<GetHttpGatewayResult> {
+  const timeoutMs = options.timeoutMs ?? 120_000;
+  const startTime = Date.now();
+  let delayMs = 2_000;
+
+  while (Date.now() - startTime < timeoutMs) {
+    const gateway = await getHttpGateway({
+      region: options.region,
+      gatewayId: options.gatewayId,
+    });
+
+    if (gateway.status === 'READY') return gateway;
+
+    if ((TERMINAL_FAILURE_STATES as readonly string[]).includes(gateway.status)) {
+      throw new Error(
+        `Gateway ${options.gatewayId} reached terminal state '${gateway.status}' and will not become READY`
+      );
+    }
+
+    const remaining = timeoutMs - (Date.now() - startTime);
+    if (remaining <= 0) break;
+
+    await new Promise(resolve => setTimeout(resolve, Math.min(delayMs, remaining)));
+    delayMs = Math.min(delayMs * 2, 16_000);
+  }
+
+  throw new Error(
+    `Timed out waiting for gateway ${options.gatewayId} to become READY after ${Math.round(timeoutMs / 1000)}s`
+  );
+}
+
+export async function waitForTargetReady(options: WaitForTargetReadyOptions): Promise<GetHttpGatewayTargetResult> {
+  const timeoutMs = options.timeoutMs ?? 120_000;
+  const startTime = Date.now();
+  let delayMs = 2_000;
+
+  while (Date.now() - startTime < timeoutMs) {
+    let target;
+    try {
+      target = await getHttpGatewayTarget({
+        region: options.region,
+        gatewayId: options.gatewayId,
+        targetId: options.targetId,
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg.includes('(404)')) {
+        throw new Error(
+          `Target ${options.targetId} not found during readiness poll — it may have been deleted externally`
+        );
+      }
+      // Retry on transient server errors
+      if (/\(5\d\d\)/.test(msg)) {
+        // Continue polling — transient error
+        const remaining = timeoutMs - (Date.now() - startTime);
+        if (remaining <= 0) break;
+        await new Promise(resolve => setTimeout(resolve, delayMs));
+        delayMs = Math.min(delayMs * 2, 16_000);
+        continue;
+      }
+      throw err;
+    }
+
+    if (target.status === 'READY') return target;
+
+    if ((TERMINAL_FAILURE_STATES as readonly string[]).includes(target.status)) {
+      throw new Error(
+        `Target ${options.targetId} in gateway ${options.gatewayId} reached terminal state '${target.status}' and will not become READY`
+      );
+    }
+
+    const remaining = timeoutMs - (Date.now() - startTime);
+    if (remaining <= 0) break;
+
+    await new Promise(resolve => setTimeout(resolve, Math.min(delayMs, remaining)));
+    delayMs = Math.min(delayMs * 2, 16_000);
+  }
+
+  throw new Error(
+    `Timed out waiting for target ${options.targetId} to become READY after ${Math.round(timeoutMs / 1000)}s`
+  );
+}
diff --git a/src/cli/aws/agentcore-recommendation.ts b/src/cli/aws/agentcore-recommendation.ts
new file mode 100644
index 000000000..55242fdcd
--- /dev/null
+++ b/src/cli/aws/agentcore-recommendation.ts
@@ -0,0 +1,371 @@
+/**
+ * AWS client wrappers for Recommendation API operations.
+ *
+ * NOTE: The Recommendation API is not yet available in the AWS SDK.
+ * These wrappers use direct HTTP requests with SigV4 signing as an
+ * interim solution. When the SDK adds Recommendation commands, migrate
+ * to the SDK client.
+ *
+ * TEMPORARY: All Recommendation endpoints are on the Data Plane (DP),
+ * not the Control Plane. This is the current API shape as of 2026-03-30.
+ * The API may move to CP in the future — update endpoints accordingly.
+ *
+ * Recommendations are one-shot, immutable resources. There is no Update
+ * operation and no runs sub-resource. You start a recommendation with
+ * StartRecommendation, poll via GetRecommendation, and stop via
+ * DeleteRecommendation (stop-via-delete pattern).
+ */
+import { getCredentialProvider } from './account';
+import { dnsSuffix } from './partition';
+import { Sha256 } from '@aws-crypto/sha256-js';
+import { defaultProvider } from '@aws-sdk/credential-provider-node';
+import { HttpRequest } from '@smithy/protocol-http';
+import { SignatureV4 } from '@smithy/signature-v4';
+
+// ============================================================================
+// Types — Recommendation Type Enum
+// ============================================================================
+
+export type RecommendationType = 'SYSTEM_PROMPT_RECOMMENDATION' | 'TOOL_DESCRIPTION_RECOMMENDATION';
+
+// ============================================================================
+// Types — Input Config (tag-union per type)
+// ============================================================================
+
+/** System prompt source — either inline text or a ConfigBundle reference. */
+export interface SystemPromptSource {
+  text?: string;
+  configurationBundle?: {
+    bundleArn: string;
+    versionId?: string;
+    systemPromptJsonPath?: string;
+  };
+}
+
+/** A single OTEL-style span for inline session traces. */
+export interface SessionSpan {
+  scope?: { name: string };
+  body?: {
+    input?: { messages?: { content: unknown; role: string }[] };
+    output?: { messages?: { content: unknown; role: string }[] };
+  };
+  attributes?: Record<string, unknown>;
+  traceId: string;
+  spanId: string;
+}
+
+/** Agent trace source — inline spans or CloudWatch Logs. */
+export interface AgentTracesSource {
+  sessionSpans?: SessionSpan[];
+  cloudwatchLogs?: {
+    logGroupArns: string[];
+    serviceNames: string[];
+    startTime: string;
+    endTime: string;
+    limit?: number;
+    sessionIds?: string[];
+  };
+}
+
+/** Evaluation config — exactly one evaluator as objective signal (API constraint: min 1, max 1). */
+export interface RecommendationEvaluationConfig {
+  evaluators: [{ evaluatorArn: string }];
+}
+
+/** Config for SYSTEM_PROMPT_RECOMMENDATION type. */
+export interface SystemPromptRecommendationConfig {
+  systemPrompt: SystemPromptSource;
+  agentTraces: AgentTracesSource;
+  evaluationConfig: RecommendationEvaluationConfig;
+}
+
+/** Config for TOOL_DESCRIPTION_RECOMMENDATION type. */
+export interface ToolDescriptionRecommendationConfig {
+  toolDescription: {
+    toolDescriptionText?: {
+      tools: { toolName: string; toolDescription: { text: string } }[];
+    };
+    configurationBundle?: {
+      bundleArn: string;
+      versionId?: string;
+      tools: { toolName: string; toolDescriptionJsonPath: string }[];
+    };
+  };
+  agentTraces: AgentTracesSource;
+}
+
+/** Tag-union recommendation config — only populate the member matching the type. */
+export interface RecommendationConfig {
+  systemPromptRecommendationConfig?: SystemPromptRecommendationConfig;
+  toolDescriptionRecommendationConfig?: ToolDescriptionRecommendationConfig;
+}
+
+// ============================================================================
+// Types — Result (tag-union per type)
+// ============================================================================
+
+export interface RecommendationResultConfigurationBundle {
+  bundleArn: string;
+  versionId: string;
+}
+
+export interface SystemPromptRecommendationResult {
+  recommendedSystemPrompt?: string;
+  configurationBundle?: RecommendationResultConfigurationBundle;
+  errorCode?: string;
+  errorMessage?: string;
+}
+
+export interface ToolDescriptionRecommendationToolResult {
+  toolName: string;
+  recommendedToolDescription: string;
+}
+
+export interface ToolDescriptionRecommendationResult {
+  tools?: ToolDescriptionRecommendationToolResult[];
+  configurationBundle?: RecommendationResultConfigurationBundle;
+  errorCode?: string;
+  errorMessage?: string;
+}
+
+export interface RecommendationResult {
+  systemPromptRecommendationResult?: SystemPromptRecommendationResult;
+  toolDescriptionRecommendationResult?: ToolDescriptionRecommendationResult;
+}
+
+// ============================================================================
+// Types — API Options & Results
+// ============================================================================
+
+export interface StartRecommendationOptions {
+  region: string;
+  name: string;
+  description?: string;
+  type: RecommendationType;
+  recommendationConfig: RecommendationConfig;
+  kmsKeyArn?: string;
+  clientToken?: string;
+}
+
+export interface StartRecommendationResult {
+  recommendationId: string;
+  recommendationArn: string;
+  name: string;
+  type: string;
+  status: string;
+  createdAt?: string;
+  updatedAt?: string;
+  requestId?: string;
+}
+
+export interface GetRecommendationOptions {
+  region: string;
+  recommendationId: string;
+}
+
+export interface GetRecommendationResult {
+  recommendationId: string;
+  recommendationArn: string;
+  name: string;
+  description?: string;
+  type: string;
+  recommendationConfig?: RecommendationConfig;
+  status: string;
+  statusReasons?: string[];
+  createdAt?: string;
+  updatedAt?: string;
+  completedAt?: string;
+  recommendationResult?: RecommendationResult;
+  requestId?: string;
+}
+
+export interface ListRecommendationsOptions {
+  region: string;
+  status?: string;
+  maxResults?: number;
+  nextToken?: string;
+}
+
+export interface RecommendationSummary {
+  recommendationId: string;
+  recommendationArn: string;
+  name: string;
+  description?: string;
+  type: string;
+  status: string;
+  createdAt?: string;
+  updatedAt?: string;
+}
+
+export interface ListRecommendationsResult {
+  recommendationSummaries: RecommendationSummary[];
+  nextToken?: string;
+}
+
+export interface DeleteRecommendationOptions {
+  region: string;
+  recommendationId: string;
+}
+
+export interface DeleteRecommendationResult {
+  recommendationId: string;
+  status: string;
+}
+
+// ============================================================================
+// HTTP signing helper
+// ============================================================================
+
+/**
+ * Resolve the DP endpoint for the Recommendation API.
+ *
+ * TEMPORARY: All Recommendation endpoints are on the Data Plane.
+ * Set AGENTCORE_STAGE=beta|gamma to target pre-release environments.
+ */
+function getDataPlaneEndpoint(region: string): string {
+  const stage = process.env.AGENTCORE_STAGE?.toLowerCase();
+  if (stage === 'beta') return `https://beta.${region}.elcapdp.genesis-primitives.aws.dev`;
+  if (stage === 'gamma') return `https://gamma.${region}.elcapdp.genesis-primitives.aws.dev`;
+  return `https://bedrock-agentcore.${region}.${dnsSuffix(region)}`;
+}
+
+async function signedRequest(options: {
+  region: string;
+  method: string;
+  path: string;
+  body?: string;
+}): Promise<{ data: unknown; status: number; requestId?: string }> {
+  const { region, method, path, body } = options;
+  const endpoint = getDataPlaneEndpoint(region);
+  const url = new URL(path, endpoint);
+
+  const query: Record<string, string> = {};
+  url.searchParams.forEach((value, key) => {
+    query[key] = value;
+  });
+
+  const request = new HttpRequest({
+    method,
+    protocol: 'https:',
+    hostname: url.hostname,
+    path: url.pathname,
+    ...(Object.keys(query).length > 0 && { query }),
+    headers: {
+      'Content-Type': 'application/json',
+      host: url.hostname,
+    },
+    ...(body && { body }),
+  });
+
+  const credentials = getCredentialProvider() ?? defaultProvider();
+  const signer = new SignatureV4({
+    service: 'bedrock-agentcore',
+    region,
+    credentials,
+    sha256: Sha256,
+  });
+
+  const signedReq = await signer.sign(request);
+
+  const response = await fetch(`${endpoint}${path}`, {
+    method,
+    headers: signedReq.headers as Record<string, string>,
+    ...(body && { body }),
+  });
+
+  const requestId = response.headers.get('x-amzn-requestid') ?? 'unknown';
+
+  if (!response.ok) {
+    const errorBody = await response.text();
+    throw new Error(`Recommendation API error (${response.status}): ${errorBody} [requestId: ${requestId}]`);
+  }
+
+  if (response.status === 204) return { data: {}, status: 204, requestId };
+  return { data: await response.json(), status: response.status, requestId };
+}
+
+// ============================================================================
+// API Operations
+// ============================================================================
+
+/**
+ * Start a new recommendation (async — returns 202).
+ * Creates an ARN-able resource that progresses through:
+ *   PENDING → IN_PROGRESS → COMPLETED | FAILED
+ */
+export async function startRecommendation(options: StartRecommendationOptions): Promise<StartRecommendationResult> {
+  const body = JSON.stringify({
+    name: options.name,
+    ...(options.description && { description: options.description }),
+    type: options.type,
+    recommendationConfig: options.recommendationConfig,
+    ...(options.kmsKeyArn && { kmsKeyArn: options.kmsKeyArn }),
+    ...(options.clientToken && { clientToken: options.clientToken }),
+  });
+
+  const { data, requestId } = await signedRequest({
+    region: options.region,
+    method: 'POST',
+    path: '/recommendations',
+    body,
+  });
+
+  const result = data as StartRecommendationResult;
+  if (requestId) result.requestId = requestId;
+  return result;
+}
+
+/**
+ * Get recommendation status and results.
+ * When status is COMPLETED, recommendationResult contains the optimized artifact.
+ */
+export async function getRecommendation(options: GetRecommendationOptions): Promise<GetRecommendationResult> {
+  const { data, requestId } = await signedRequest({
+    region: options.region,
+    method: 'GET',
+    path: `/recommendations/${options.recommendationId}`,
+  });
+
+  const result = data as GetRecommendationResult;
+  if (requestId) result.requestId = requestId;
+  return result;
+}
+
+/**
+ * List recommendations with optional filtering and pagination.
+ */
+export async function listRecommendations(options: ListRecommendationsOptions): Promise<ListRecommendationsResult> {
+  const params = new URLSearchParams();
+  if (options.status) params.set('status', options.status);
+  if (options.maxResults) params.set('maxResults', String(options.maxResults));
+  if (options.nextToken) params.set('nextToken', options.nextToken);
+
+  const query = params.toString();
+  const path = `/recommendations${query ? `?${query}` : ''}`;
+
+  const { data } = await signedRequest({
+    region: options.region,
+    method: 'GET',
+    path,
+  });
+
+  const result = data as ListRecommendationsResult;
+  return {
+    recommendationSummaries: result.recommendationSummaries ?? [],
+    nextToken: result.nextToken,
+  };
+}
+
+/**
+ * Delete a recommendation. Also stops in-progress recommendations
+ * (stop-via-delete pattern — no separate Stop API).
+ */
+export async function deleteRecommendation(options: DeleteRecommendationOptions): Promise<DeleteRecommendationResult> {
+  const { data } = await signedRequest({
+    region: options.region,
+    method: 'DELETE',
+    path: `/recommendations/${options.recommendationId}`,
+  });
+
+  return data as DeleteRecommendationResult;
+}
diff --git a/src/cli/aws/agentcore.ts b/src/cli/aws/agentcore.ts
index 55c19d2d0..4c50a0330 100644
--- a/src/cli/aws/agentcore.ts
+++ b/src/cli/aws/agentcore.ts
@@ -1,11 +1,11 @@
 import { parseJsonRpcResponse } from '../../lib/utils/json-rpc';
+import { PACKAGE_VERSION } from '../constants';
 import { getCredentialProvider } from './account';
 import { parseAguiSSEStream } from './agui-parser';
 import { serviceEndpoint } from './partition';
 import {
   BedrockAgentCoreClient,
   EvaluateCommand,
-  type EvaluationReferenceInput,
   InvokeAgentRuntimeCommand,
   InvokeAgentRuntimeCommandCommand,
   StopRuntimeSessionCommand,
@@ -13,13 +13,31 @@ import {
 import type { HttpRequest } from '@smithy/protocol-http';
 import type { DocumentType } from '@smithy/types';
 
+/** Local definition — SDK does not yet export this type. */
+export interface EvaluationReferenceInput {
+  context: { spanContext: { sessionId: string; traceId?: string } };
+  expectedTrajectory?: { toolNames: string[] };
+  assertions?: { text: string }[];
+  expectedResponse?: { text: string };
+}
+
 /**
  * Create a BedrockAgentCoreClient with optional custom header injection middleware.
  */
-function createAgentCoreClient(region: string, headers?: Record<string, string>): BedrockAgentCoreClient {
+function resolveDataPlaneEndpoint(region: string): string | undefined {
+  const stage = process.env.AGENTCORE_STAGE?.toLowerCase();
+  if (stage === 'beta') return `https://beta.${region}.elcapdp.genesis-primitives.aws.dev`;
+  if (stage === 'gamma') return `https://gamma.${region}.elcapdp.genesis-primitives.aws.dev`;
+  return undefined;
+}
+
+export function createAgentCoreClient(region: string, headers?: Record<string, string>): BedrockAgentCoreClient {
+  const endpoint = resolveDataPlaneEndpoint(region);
   const client = new BedrockAgentCoreClient({
     region,
     credentials: getCredentialProvider(),
+    customUserAgent: [['agentcore-cli', PACKAGE_VERSION]],
+    ...(endpoint && { endpoint }),
   });
 
   if (headers && Object.keys(headers).length > 0) {
@@ -59,6 +77,8 @@ export interface InvokeAgentRuntimeOptions {
   headers?: Record<string, string>;
   /** Bearer token for CUSTOM_JWT auth. When provided, uses raw HTTP with Authorization header instead of SigV4. */
   bearerToken?: string;
+  /** W3C baggage header value (e.g. config bundle ref for runtime) */
+  baggage?: string;
 }
 
 export interface InvokeAgentRuntimeResult {
@@ -151,20 +171,40 @@ function buildInvokeUrl(region: string, runtimeArn: string): string {
 }
 
 /**
- * Invoke an AgentCore Runtime using bearer token auth (raw HTTP, no SigV4).
- * Used when the runtime has CUSTOM_JWT authorizer configured.
+ * Build headers for bearer-token invoke requests.
+ * Shared by both streaming and non-streaming invoke paths.
  */
-async function invokeWithBearerTokenStreaming(options: InvokeAgentRuntimeOptions): Promise<StreamingInvokeResult> {
-  const url = buildInvokeUrl(options.region, options.runtimeArn);
+export function buildBearerInvokeHeaders(
+  options: Pick<InvokeAgentRuntimeOptions, 'bearerToken' | 'sessionId' | 'userId' | 'headers' | 'baggage'>,
+  accept: string
+): Record<string, string> {
   const headers: Record<string, string> = {
     Authorization: `Bearer ${options.bearerToken}`,
     'Content-Type': 'application/json',
-    Accept: 'application/json, text/event-stream',
+    Accept: accept,
   };
   if (options.sessionId) {
     headers['X-Amzn-Bedrock-AgentCore-Runtime-Session-Id'] = options.sessionId;
   }
   headers['X-Amzn-Bedrock-AgentCore-Runtime-User-Id'] = options.userId ?? DEFAULT_RUNTIME_USER_ID;
+  if (options.baggage) {
+    headers.baggage = options.baggage;
+  }
+  if (options.headers) {
+    for (const [name, value] of Object.entries(options.headers)) {
+      headers[name] = value;
+    }
+  }
+  return headers;
+}
+
+/**
+ * Invoke an AgentCore Runtime using bearer token auth (raw HTTP, no SigV4).
+ * Used when the runtime has CUSTOM_JWT authorizer configured.
+ */
+async function invokeWithBearerTokenStreaming(options: InvokeAgentRuntimeOptions): Promise<StreamingInvokeResult> {
+  const url = buildInvokeUrl(options.region, options.runtimeArn);
+  const headers = buildBearerInvokeHeaders(options, 'application/json, text/event-stream');
 
   const res = await fetch(url, {
     method: 'POST',
@@ -250,15 +290,7 @@ async function invokeWithBearerTokenStreaming(options: InvokeAgentRuntimeOptions
  */
 async function invokeWithBearerToken(options: InvokeAgentRuntimeOptions): Promise<InvokeAgentRuntimeResult> {
   const url = buildInvokeUrl(options.region, options.runtimeArn);
-  const headers: Record<string, string> = {
-    Authorization: `Bearer ${options.bearerToken}`,
-    'Content-Type': 'application/json',
-    Accept: 'application/json',
-  };
-  if (options.sessionId) {
-    headers['X-Amzn-Bedrock-AgentCore-Runtime-Session-Id'] = options.sessionId;
-  }
-  headers['X-Amzn-Bedrock-AgentCore-Runtime-User-Id'] = options.userId ?? DEFAULT_RUNTIME_USER_ID;
+  const headers = buildBearerInvokeHeaders(options, 'application/json');
 
   const res = await fetch(url, {
     method: 'POST',
@@ -300,6 +332,7 @@ export async function invokeAgentRuntimeStreaming(options: InvokeAgentRuntimeOpt
     accept: 'application/json',
     runtimeSessionId: options.sessionId,
     runtimeUserId: options.userId ?? DEFAULT_RUNTIME_USER_ID,
+    ...(options.baggage && { baggage: options.baggage }),
   });
 
   const response = await client.send(command);
@@ -395,6 +428,7 @@ export async function invokeAgentRuntime(options: InvokeAgentRuntimeOptions): Pr
     accept: 'application/json',
     runtimeSessionId: options.sessionId,
     runtimeUserId: options.userId ?? DEFAULT_RUNTIME_USER_ID,
+    ...(options.baggage && { baggage: options.baggage }),
   });
 
   const response = await client.send(command);
@@ -464,6 +498,7 @@ export async function evaluate(options: EvaluateOptions): Promise<EvaluateResult
   const client = new BedrockAgentCoreClient({
     region: options.region,
     credentials: getCredentialProvider(),
+    customUserAgent: [['agentcore-cli', PACKAGE_VERSION]],
   });
 
   const evaluationTarget = options.targetSpanIds
@@ -1057,6 +1092,7 @@ export async function stopRuntimeSession(options: StopRuntimeSessionOptions): Pr
   const client = new BedrockAgentCoreClient({
     region: options.region,
     credentials: getCredentialProvider(),
+    customUserAgent: [['agentcore-cli', PACKAGE_VERSION]],
   });
 
   const command = new StopRuntimeSessionCommand({
diff --git a/src/cli/aws/api-client.ts b/src/cli/aws/api-client.ts
new file mode 100644
index 000000000..1354615a3
--- /dev/null
+++ b/src/cli/aws/api-client.ts
@@ -0,0 +1,128 @@
+/**
+ * Shared SigV4-signed HTTP client for AgentCore control plane and data plane APIs.
+ * When the SDK adds native commands for new APIs, we will migrate callers to the SDK client.
+ */
+import { getCredentialProvider } from './account';
+import { dnsSuffix } from './partition';
+import { Sha256 } from '@aws-crypto/sha256-js';
+import { defaultProvider } from '@aws-sdk/credential-provider-node';
+import { HttpRequest } from '@smithy/protocol-http';
+import { SignatureV4 } from '@smithy/signature-v4';
+
+const SERVICE = 'bedrock-agentcore';
+
+export type ApiPlane = 'control' | 'data';
+
+export interface ApiClientOptions {
+  region: string;
+  plane: ApiPlane;
+}
+
+export interface RequestOptions {
+  method: string;
+  path: string;
+  body?: unknown;
+  query?: Record<string, string>;
+  headers?: Record<string, string>;
+}
+
+export class AgentCoreApiError extends Error {
+  readonly statusCode: number;
+  readonly requestId: string | undefined;
+  readonly errorBody: string;
+
+  constructor(statusCode: number, errorBody: string, requestId?: string) {
+    const reqIdSuffix = requestId ? ` [requestId: ${requestId}]` : '';
+    super(`AgentCore API error (${statusCode}): ${errorBody}${reqIdSuffix}`);
+    this.name = 'AgentCoreApiError';
+    this.statusCode = statusCode;
+    this.requestId = requestId;
+    this.errorBody = errorBody;
+  }
+}
+
+export class AgentCoreApiClient {
+  private readonly region: string;
+  private readonly endpoint: string;
+
+  constructor(options: ApiClientOptions) {
+    this.region = options.region;
+    this.endpoint = resolveEndpoint(options.region, options.plane);
+  }
+
+  async request(options: RequestOptions): Promise<unknown> {
+    const response = await this.requestRaw(options);
+
+    if (!response.ok) {
+      const errorBody = await response.text();
+      const requestId = response.headers.get('x-amzn-requestid') ?? undefined;
+      throw new AgentCoreApiError(response.status, errorBody, requestId);
+    }
+
+    if (response.status === 204) return {};
+    return response.json();
+  }
+
+  async requestRaw(options: RequestOptions): Promise<Response> {
+    const { method, path, body, query, headers: extraHeaders } = options;
+
+    const url = new URL(path, this.endpoint);
+    if (query) {
+      for (const [key, value] of Object.entries(query)) {
+        url.searchParams.set(key, value);
+      }
+    }
+
+    const queryRecord: Record<string, string> = {};
+    url.searchParams.forEach((value, key) => {
+      queryRecord[key] = value;
+    });
+
+    const serializedBody = body != null ? JSON.stringify(body) : undefined;
+
+    const httpRequest = new HttpRequest({
+      method,
+      protocol: 'https:',
+      hostname: url.hostname,
+      path: url.pathname,
+      ...(Object.keys(queryRecord).length > 0 && { query: queryRecord }),
+      headers: {
+        'Content-Type': 'application/json',
+        host: url.hostname,
+        ...extraHeaders,
+      },
+      ...(serializedBody && { body: serializedBody }),
+    });
+
+    const credentials = getCredentialProvider() ?? defaultProvider();
+    const signer = new SignatureV4({
+      service: SERVICE,
+      region: this.region,
+      credentials,
+      sha256: Sha256,
+    });
+
+    const signed = await signer.sign(httpRequest);
+
+    const fullUrl = `${this.endpoint}${url.pathname}${url.search}`;
+    return fetch(fullUrl, {
+      method,
+      headers: signed.headers as Record<string, string>,
+      ...(serializedBody && { body: serializedBody }),
+    });
+  }
+}
+
+export function resolveEndpoint(region: string, plane: ApiPlane): string {
+  const stage = process.env.AGENTCORE_STAGE?.toLowerCase();
+
+  if (plane === 'control') {
+    if (stage === 'beta') return `https://beta.${region}.elcapcp.genesis-primitives.aws.dev`;
+    if (stage === 'gamma') return `https://gamma.${region}.elcapcp.genesis-primitives.aws.dev`;
+    return `https://bedrock-agentcore-control.${region}.${dnsSuffix(region)}`;
+  }
+
+  if (stage === 'beta') return `https://beta.${region}.elcapdp.genesis-primitives.aws.dev`;
+  if (stage === 'gamma') return `https://gamma.${region}.elcapdp.genesis-primitives.aws.dev`;
+  return `https://bedrock-agentcore.${region}.${dnsSuffix(region)}`;
+}
diff --git a/src/cli/aws/index.ts b/src/cli/aws/index.ts
index 5ce91528a..d306a80e1 100644
--- a/src/cli/aws/index.ts
+++ b/src/cli/aws/index.ts
@@ -26,7 +26,37 @@ export {
   type GetPolicyGenerationOptions,
   type GetPolicyGenerationResult,
 } from './policy-generation';
+export { AgentCoreApiClient, AgentCoreApiError, type ApiClientOptions, type ApiPlane } from './api-client';
+export { pollUntilTerminal, PollTimeoutError, PollFailureError, type PollOptions } from './poll';
 export {
+  createHarness,
+  getHarness,
+  updateHarness,
+  deleteHarness,
+  listHarnesses,
+  listAllHarnesses,
+  invokeHarness,
+  type Harness,
+  type HarnessSummary,
+  type HarnessStatus,
+  type HarnessStreamEvent,
+  type HarnessStopReason,
+  type TokenUsage,
+  type StreamMetrics,
+  type CreateHarnessOptions,
+  type CreateHarnessResult,
+  type GetHarnessOptions,
+  type GetHarnessResult,
+  type UpdateHarnessOptions,
+  type UpdateHarnessResult,
+  type DeleteHarnessOptions,
+  type DeleteHarnessResult,
+  type ListHarnessesOptions,
+  type ListHarnessesResult,
+  type InvokeHarnessOptions,
+} from './agentcore-harness';
+export {
+  createAgentCoreClient,
   DEFAULT_RUNTIME_USER_ID,
   executeBashCommand,
   invokeA2ARuntime,
@@ -48,6 +78,24 @@ export {
   type StopRuntimeSessionOptions,
   type StopRuntimeSessionResult,
 } from './agentcore';
+export {
+  startRecommendation,
+  getRecommendation,
+  listRecommendations,
+  deleteRecommendation,
+  type StartRecommendationOptions,
+  type StartRecommendationResult,
+  type GetRecommendationOptions,
+  type GetRecommendationResult,
+  type ListRecommendationsOptions,
+  type ListRecommendationsResult,
+  type DeleteRecommendationOptions,
+  type DeleteRecommendationResult,
+  type RecommendationSummary,
+  type RecommendationType,
+  type RecommendationConfig,
+  type RecommendationResult,
+} from './agentcore-recommendation';
 export {
   AguiEventType,
   AguiErrorCode,
diff --git a/src/cli/aws/policy-generation.ts b/src/cli/aws/policy-generation.ts
index da58edf81..86eb76aa5 100644
--- a/src/cli/aws/policy-generation.ts
+++ b/src/cli/aws/policy-generation.ts
@@ -1,6 +1,5 @@
-import { getCredentialProvider } from './account';
+import { createControlClient } from './agentcore-control';
 import {
-  BedrockAgentCoreControlClient,
   GetPolicyGenerationCommand,
   ListPolicyGenerationAssetsCommand,
   StartPolicyGenerationCommand,
@@ -33,10 +32,7 @@ export interface GetPolicyGenerationResult {
 export async function startPolicyGeneration(
   options: StartPolicyGenerationOptions
 ): Promise<StartPolicyGenerationResult> {
-  const client = new BedrockAgentCoreControlClient({
-    region: options.region,
-    credentials: getCredentialProvider(),
-  });
+  const client = createControlClient(options.region);
 
   const command = new StartPolicyGenerationCommand({
     policyEngineId: options.policyEngineId,
@@ -57,10 +53,7 @@ export async function startPolicyGeneration(
 }
 
 export async function getPolicyGeneration(options: GetPolicyGenerationOptions): Promise<GetPolicyGenerationResult> {
-  const client = new BedrockAgentCoreControlClient({
-    region: options.region,
-    credentials: getCredentialProvider(),
-  });
+  const client = createControlClient(options.region);
 
   // Use the SDK waiter to poll until generation completes
   const waiterResult = await waitUntilPolicyGenerationCompleted(
diff --git a/src/cli/aws/poll.ts b/src/cli/aws/poll.ts
new file mode 100644
index 000000000..0adfaca23
--- /dev/null
+++ b/src/cli/aws/poll.ts
@@ -0,0 +1,47 @@
+/**
+ * Generic polling utility for async AWS resource status transitions.
+ */
+
+export interface PollOptions<T> {
+  fn: () => Promise<T>;
+  isTerminal: (result: T) => boolean;
+  isFailure?: (result: T) => boolean;
+  getFailureReason?: (result: T) => string;
+  intervalMs?: number;
+  maxWaitMs?: number;
+}
+
+export class PollTimeoutError extends Error {
+  constructor(maxWaitMs: number) {
+    super(`Polling timed out after ${maxWaitMs}ms`);
+    this.name = 'PollTimeoutError';
+  }
+}
+
+export class PollFailureError extends Error {
+  constructor(reason: string) {
+    super(reason);
+    this.name = 'PollFailureError';
+  }
+}
+
+export async function pollUntilTerminal<T>(options: PollOptions<T>): Promise<T> {
+  const { fn, isTerminal, isFailure, getFailureReason, intervalMs = 3000, maxWaitMs = 120_000 } = options;
+  const start = Date.now();
+
+  while (Date.now() - start < maxWaitMs) {
+    const result = await fn();
+
+    if (isTerminal(result)) {
+      if (isFailure?.(result)) {
+        const reason = getFailureReason?.(result) ?? 'Resource entered a failed state';
+        throw new PollFailureError(reason);
+      }
+      return result;
+    }
+
+    await new Promise(resolve => setTimeout(resolve, intervalMs));
+  }
+
+  throw new PollTimeoutError(maxWaitMs);
+}
diff --git a/src/cli/cli.ts b/src/cli/cli.ts
index b8100c0d8..98692639c 100644
--- a/src/cli/cli.ts
+++ b/src/cli/cli.ts
@@ -1,4 +1,8 @@
+import { getOrCreateInstallationId } from '../lib/schemas/io/global-config';
+import { registerABTestCommand } from './commands/abtest';
 import { registerAdd } from './commands/add';
+import { registerAddTool } from './commands/add/tool-command';
+import { registerConfigBundle } from './commands/config-bundle';
 import { registerCreate } from './commands/create';
 import { registerDeploy } from './commands/deploy';
 import { registerDev } from './commands/dev';
@@ -9,17 +13,19 @@ import { registerImport } from './commands/import';
 import { registerInvoke } from './commands/invoke';
 import { registerLogs } from './commands/logs';
 import { registerPackage } from './commands/package';
-import { registerPause } from './commands/pause';
+import { registerPause, registerPromote } from './commands/pause';
+import { registerRecommendations } from './commands/recommendations';
 import { registerRemove } from './commands/remove';
+import { registerRemoveTool } from './commands/remove/tool-command';
 import { registerResume } from './commands/resume';
 import { registerRun } from './commands/run';
 import { registerStatus } from './commands/status';
+import { registerStop } from './commands/stop';
 import { registerTelemetry } from './commands/telemetry';
 import { registerTraces } from './commands/traces';
 import { registerUpdate } from './commands/update';
 import { registerValidate } from './commands/validate';
 import { PACKAGE_VERSION } from './constants';
-import { getOrCreateInstallationId } from './global-config';
 import { ALL_PRIMITIVES } from './primitives';
 import { TelemetryClientAccessor } from './telemetry';
 import { App } from './tui/App';
@@ -182,19 +188,30 @@ export function registerCommands(program: Command) {
   registerLogs(program);
   registerPackage(program);
   registerPause(program);
+  registerRecommendations(program);
   const removeCmd = registerRemove(program);
   registerResume(program);
   registerRun(program);
   registerStatus(program);
+  registerStop(program);
+  registerPromote(program);
   registerTelemetry(program);
   registerTraces(program);
   registerUpdate(program);
   registerValidate(program);
+  registerConfigBundle(program);
 
   // Register primitive subcommands (add agent, remove agent, add memory, etc.)
   for (const primitive of ALL_PRIMITIVES) {
     primitive.registerCommands(addCmd, removeCmd);
   }
+
+  // Register standalone add/remove subcommands
+  registerAddTool(addCmd);
+  registerRemoveTool(removeCmd);
+
+  // Register AB test detail command
+  registerABTestCommand(program);
 }
 
 export const main = async (argv: string[]) => {
@@ -208,7 +225,7 @@ export const main = async (argv: string[]) => {
 
   const args = argv.slice(2);
 
-  // Fire off non-blocking update check (skip for `update` command)
+  // Fire off non-blocking update check (skip for `update` command itself)
   const isUpdateCommand = args[0] === 'update';
   const updateCheck = isUpdateCommand ? Promise.resolve(null) : checkForUpdate();
 
diff --git a/src/cli/cloudformation/__tests__/outputs-extended.test.ts b/src/cli/cloudformation/__tests__/outputs-extended.test.ts
index cbe82085e..1f48faa96 100644
--- a/src/cli/cloudformation/__tests__/outputs-extended.test.ts
+++ b/src/cli/cloudformation/__tests__/outputs-extended.test.ts
@@ -364,7 +364,7 @@ describe('parseOnlineEvalOutputs', () => {
         'arn:aws:bedrock:us-east-1:123:online-evaluation-config/proj_TestConfig-xyz',
     };
 
-    const result = parseOnlineEvalOutputs(outputs, ['TestConfig']);
+    const result = parseOnlineEvalOutputs(outputs, [{ name: 'TestConfig' }]);
     expect(result.TestConfig).toBeDefined();
     expect(result.TestConfig!.onlineEvaluationConfigId).toBe('proj_TestConfig-xyz');
     expect(result.TestConfig!.onlineEvaluationConfigArn).toBe(
@@ -380,7 +380,7 @@ describe('parseOnlineEvalOutputs', () => {
       ApplicationOnlineEvalConfigBArnOutputD: 'arn:b',
     };
 
-    const result = parseOnlineEvalOutputs(outputs, ['ConfigA', 'ConfigB']);
+    const result = parseOnlineEvalOutputs(outputs, [{ name: 'ConfigA' }, { name: 'ConfigB' }]);
     expect(Object.keys(result)).toHaveLength(2);
     expect(result.ConfigA!.onlineEvaluationConfigId).toBe('id-a');
     expect(result.ConfigB!.onlineEvaluationConfigId).toBe('id-b');
@@ -391,12 +391,12 @@ describe('parseOnlineEvalOutputs', () => {
       ApplicationOnlineEvalTestConfigArnOutputDEF: 'arn:config',
     };
 
-    const result = parseOnlineEvalOutputs(outputs, ['TestConfig']);
+    const result = parseOnlineEvalOutputs(outputs, [{ name: 'TestConfig' }]);
     expect(result.TestConfig).toBeUndefined();
   });
 
   it('returns empty record for empty outputs', () => {
-    const result = parseOnlineEvalOutputs({}, ['TestConfig']);
+    const result = parseOnlineEvalOutputs({}, [{ name: 'TestConfig' }]);
     expect(result).toEqual({});
   });
 });
diff --git a/src/cli/cloudformation/__tests__/outputs.test.ts b/src/cli/cloudformation/__tests__/outputs.test.ts
index d12ddb689..24f39b451 100644
--- a/src/cli/cloudformation/__tests__/outputs.test.ts
+++ b/src/cli/cloudformation/__tests__/outputs.test.ts
@@ -469,3 +469,117 @@ describe('buildDeployedState with policy data', () => {
     expect(result.targets.default!.resources?.policyEngines).toBeUndefined();
   });
 });
+
+describe('buildDeployedState carry-forward', () => {
+  it('carries forward abTests from existing state', () => {
+    const existingState = {
+      targets: {
+        default: {
+          resources: {
+            stackName: 'TestStack',
+            abTests: {
+              TestExperiment: {
+                abTestId: 'abt-123',
+                abTestArn: 'arn:aws:bedrock:us-east-1:123456789012:ab-test/abt-123',
+              },
+            },
+          },
+        },
+      },
+    };
+
+    const result = buildDeployedState({
+      targetName: 'default',
+      stackName: 'TestStack',
+      agents: {},
+      gateways: {},
+      existingState,
+    });
+
+    expect(result.targets.default!.resources?.abTests).toEqual({
+      TestExperiment: {
+        abTestId: 'abt-123',
+        abTestArn: 'arn:aws:bedrock:us-east-1:123456789012:ab-test/abt-123',
+      },
+    });
+  });
+
+  it('carries forward httpGateways from existing state', () => {
+    const existingState = {
+      targets: {
+        default: {
+          resources: {
+            stackName: 'TestStack',
+            httpGateways: {
+              MyHttpGw: {
+                gatewayId: 'hgw-456',
+                gatewayArn: 'arn:aws:bedrock:us-east-1:123456789012:http-gateway/hgw-456',
+              },
+            },
+          },
+        },
+      },
+    };
+
+    const result = buildDeployedState({
+      targetName: 'default',
+      stackName: 'TestStack',
+      agents: {},
+      gateways: {},
+      existingState,
+    });
+
+    expect(result.targets.default!.resources?.httpGateways).toEqual({
+      MyHttpGw: {
+        gatewayId: 'hgw-456',
+        gatewayArn: 'arn:aws:bedrock:us-east-1:123456789012:http-gateway/hgw-456',
+      },
+    });
+  });
+
+  it('does not carry forward empty abTests', () => {
+    const existingState = {
+      targets: {
+        default: {
+          resources: {
+            stackName: 'TestStack',
+            abTests: {},
+          },
+        },
+      },
+    };
+
+    const result = buildDeployedState({
+      targetName: 'default',
+      stackName: 'TestStack',
+      agents: {},
+      gateways: {},
+      existingState,
+    });
+
+    expect(result.targets.default!.resources?.abTests).toBeUndefined();
+  });
+
+  it('does not carry forward empty httpGateways', () => {
+    const existingState = {
+      targets: {
+        default: {
+          resources: {
+            stackName: 'TestStack',
+            httpGateways: {},
+          },
+        },
+      },
+    };
+
+    const result = buildDeployedState({
+      targetName: 'default',
+      stackName: 'TestStack',
+      agents: {},
+      gateways: {},
+      existingState,
+    });
+
+    expect(result.targets.default!.resources?.httpGateways).toBeUndefined();
+  });
+});
diff --git a/src/cli/cloudformation/outputs.ts b/src/cli/cloudformation/outputs.ts
index 28ced03c1..5f574aefe 100644
--- a/src/cli/cloudformation/outputs.ts
+++ b/src/cli/cloudformation/outputs.ts
@@ -2,6 +2,7 @@ import type {
   AgentCoreDeployedState,
   DeployedState,
   EvaluatorDeployedState,
+  HarnessDeployedState,
   MemoryDeployedState,
   OnlineEvalDeployedState,
   PolicyDeployedState,
@@ -250,13 +251,13 @@ export function parseEvaluatorOutputs(
  */
 export function parseOnlineEvalOutputs(
   outputs: StackOutputs,
-  onlineEvalNames: string[]
+  onlineEvalSpecs: { name: string; agent?: string; endpoint?: string }[]
 ): Record<string, OnlineEvalDeployedState> {
   const configs: Record<string, OnlineEvalDeployedState> = {};
   const outputKeys = Object.keys(outputs);
 
-  for (const configName of onlineEvalNames) {
-    const pascal = toPascalId('OnlineEval', configName);
+  for (const spec of onlineEvalSpecs) {
+    const pascal = toPascalId('OnlineEval', spec.name);
     const idPrefix = `Application${pascal}IdOutput`;
     const arnPrefix = `Application${pascal}ArnOutput`;
 
@@ -264,9 +265,11 @@ export function parseOnlineEvalOutputs(
     const arnKey = outputKeys.find(k => k.startsWith(arnPrefix));
 
     if (idKey && arnKey) {
-      configs[configName] = {
+      configs[spec.name] = {
         onlineEvaluationConfigId: outputs[idKey]!,
         onlineEvaluationConfigArn: outputs[arnKey]!,
+        ...(spec.agent && { agent: spec.agent }),
+        ...(spec.endpoint && { endpoint: spec.endpoint }),
       };
     }
   }
@@ -386,6 +389,7 @@ export interface BuildDeployedStateOptions {
   onlineEvalConfigs?: Record<string, OnlineEvalDeployedState>;
   policyEngines?: Record<string, PolicyEngineDeployedState>;
   policies?: Record<string, PolicyDeployedState>;
+  harnesses?: Record<string, HarnessDeployedState>;
   runtimeEndpoints?: Record<string, RuntimeEndpointDeployedState>;
 }
 
@@ -406,6 +410,7 @@ export function buildDeployedState(opts: BuildDeployedStateOptions): DeployedSta
     onlineEvalConfigs,
     policyEngines,
     policies,
+    harnesses,
     runtimeEndpoints,
   } = opts;
   const targetState: TargetDeployedState = {
@@ -441,11 +446,34 @@ export function buildDeployedState(opts: BuildDeployedStateOptions): DeployedSta
     targetState.resources!.onlineEvalConfigs = onlineEvalConfigs;
   }
 
+  // Add harness state if harnesses exist
+  if (harnesses && Object.keys(harnesses).length > 0) {
+    targetState.resources!.harnesses = harnesses;
+  }
+
   // Add runtime endpoint state if endpoints exist
   if (runtimeEndpoints && Object.keys(runtimeEndpoints).length > 0) {
     targetState.resources!.runtimeEndpoints = runtimeEndpoints;
   }
 
+  // Carry forward config bundles from existing state (managed post-deploy, not via CFN outputs)
+  const existingConfigBundles = existingState?.targets?.[targetName]?.resources?.configBundles;
+  if (existingConfigBundles && Object.keys(existingConfigBundles).length > 0) {
+    targetState.resources!.configBundles = existingConfigBundles;
+  }
+
+  // Carry forward AB tests from existing state (managed post-deploy, not via CFN outputs)
+  const existingABTests = existingState?.targets?.[targetName]?.resources?.abTests;
+  if (existingABTests && Object.keys(existingABTests).length > 0) {
+    targetState.resources!.abTests = existingABTests;
+  }
+
+  // Carry forward HTTP gateways from existing state (managed post-deploy, not via CFN outputs)
+  const existingHttpGateways = existingState?.targets?.[targetName]?.resources?.httpGateways;
+  if (existingHttpGateways && Object.keys(existingHttpGateways).length > 0) {
+    targetState.resources!.httpGateways = existingHttpGateways;
+  }
+
   return {
     targets: {
       ...existingState?.targets,
diff --git a/src/cli/commands/abtest/command.ts b/src/cli/commands/abtest/command.ts
new file mode 100644
index 000000000..cc236cdb3
--- /dev/null
+++ b/src/cli/commands/abtest/command.ts
@@ -0,0 +1,199 @@
+/**
+ * AB Test commands.
+ *
+ * `agentcore ab-test <name>` — fetches and displays full AB test details
+ * from the data plane API, including evaluation scores/metrics.
+ */
+import { ConfigIO } from '../../../lib';
+import { getABTest, listABTests } from '../../aws/agentcore-ab-tests';
+import type { GetABTestResult } from '../../aws/agentcore-ab-tests';
+import { dnsSuffix } from '../../aws/partition';
+import { getErrorMessage } from '../../errors';
+import type { Command } from '@commander-js/extra-typings';
+
+// ============================================================================
+// Helpers
+// ============================================================================
+
+async function getRegion(cliRegion?: string): Promise<string> {
+  if (cliRegion) return cliRegion;
+  try {
+    const configIO = new ConfigIO();
+    const targets = await configIO.resolveAWSDeploymentTargets();
+    if (targets.length > 0) return targets[0]!.region;
+  } catch {
+    // Fall through to env vars
+  }
+  return process.env.AWS_DEFAULT_REGION ?? process.env.AWS_REGION ?? 'us-east-1';
+}
+
+async function resolveABTestId(
+  testName: string,
+  region: string
+): Promise<{ abTestId: string; region: string; error?: string }> {
+  let projectName: string | undefined;
+  try {
+    const configIO = new ConfigIO();
+    const deployedState = await configIO.readDeployedState();
+    const awsTargets = await configIO.readAWSDeploymentTargets();
+
+    try {
+      const projectSpec = await configIO.readProjectSpec();
+      projectName = projectSpec.name;
+    } catch {
+      // Project spec unavailable
+    }
+
+    for (const [targetName, target] of Object.entries(deployedState.targets ?? {})) {
+      const abTests = target.resources?.abTests;
+      if (abTests?.[testName]) {
+        const targetConfig = awsTargets.find(t => t.name === targetName);
+        const resolvedRegion = targetConfig?.region ?? region;
+        return { abTestId: abTests[testName].abTestId, region: resolvedRegion };
+      }
+    }
+  } catch {
+    // No deployed state available
+  }
+
+  try {
+    const result = await listABTests({ region, maxResults: 100 });
+    // Match against both prefixed name ({projectName}_{testName}) and bare testName (backwards compat)
+    const prefixedName = projectName ? `${projectName}_${testName}` : undefined;
+    // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing -- boolean OR, not nullish coalescing
+    const match = result.abTests.find(t => (prefixedName && t.name === prefixedName) || t.name === testName);
+    if (match) {
+      return { abTestId: match.abTestId, region };
+    }
+  } catch {
+    // API call failed
+  }
+
+  return { abTestId: '', region, error: `AB test "${testName}" not found in deployed state or API.` };
+}
+
+function gatewayUrlFromArn(arn: string): string {
+  const parts = arn.split(':');
+  const region = parts[3];
+  const gatewayId = parts[5]?.split('/')[1];
+  if (region && gatewayId) {
+    return `https://${gatewayId}.gateway.bedrock-agentcore.${region}.${dnsSuffix(region)}`;
+  }
+  return arn;
+}
+
+function formatABTestDetails(test: GetABTestResult): string {
+  const lines: string[] = [];
+  lines.push(`AB Test: ${test.name}`);
+  lines.push(`  Status: ${test.status}`);
+  lines.push(`  Execution: ${test.executionStatus}`);
+  lines.push(`  Invocation URL: ${gatewayUrlFromArn(test.gatewayArn)}/<target>/invocations`);
+  lines.push(
+    `  Online Eval: ${'onlineEvaluationConfigArn' in test.evaluationConfig ? test.evaluationConfig.onlineEvaluationConfigArn : 'per-variant'}`
+  );
+  if (test.description) lines.push(`  Description: ${test.description}`);
+
+  for (const variant of test.variants) {
+    const bundleRef = variant.variantConfiguration.configurationBundle;
+    const targetRef = variant.variantConfiguration.target;
+    if (targetRef) {
+      lines.push(`  Variant ${variant.name}: weight=${variant.weight}, target=${targetRef.name}`);
+    } else if (bundleRef) {
+      lines.push(
+        `  Variant ${variant.name}: weight=${variant.weight}, bundle=${bundleRef.bundleArn}, version=${bundleRef.bundleVersion}`
+      );
+    }
+  }
+
+  // TODO(post-preview): Re-enable max duration display once configurable duration is launched.
+  // if (test.maxDurationDays) lines.push(`  Max Duration: ${test.maxDurationDays} days`);
+  if (test.startedAt) lines.push(`  Started: ${test.startedAt}`);
+  if (test.stoppedAt) lines.push(`  Stopped: ${test.stoppedAt}`);
+  if (test.failureReason) lines.push(`  Failure: ${test.failureReason}`);
+
+  if (test.results) {
+    lines.push('  Results:');
+    if (test.results.analysisTimestamp) {
+      lines.push(`    Analysis Time: ${test.results.analysisTimestamp}`);
+    }
+    for (const metric of test.results.evaluatorMetrics) {
+      lines.push(`    Evaluator: ${metric.evaluatorArn}`);
+      lines.push(
+        `      Control: samples=${metric.controlStats.sampleSize}, mean=${metric.controlStats.mean.toFixed(4)}`
+      );
+      for (const vr of metric.variantResults) {
+        lines.push(
+          `      ${vr.treatmentName}: samples=${vr.sampleSize}, mean=${vr.mean.toFixed(4)}, significant=${vr.isSignificant}`
+        );
+        if (vr.absoluteChange !== undefined)
+          lines.push(`        Change: ${vr.absoluteChange.toFixed(4)} (${(vr.percentChange ?? 0).toFixed(2)}%)`);
+        if (vr.pValue !== undefined) lines.push(`        p-value: ${vr.pValue.toFixed(6)}`);
+        if (vr.confidenceInterval) {
+          lines.push(
+            `        CI: [${vr.confidenceInterval.lower?.toFixed(4)}, ${vr.confidenceInterval.upper?.toFixed(4)}]`
+          );
+        }
+      }
+    }
+  }
+
+  return lines.join('\n');
+}
+
+// ============================================================================
+// Command registration
+// ============================================================================
+
+export function registerABTestCommand(program: Command): void {
+  program
+    .command('ab-test')
+    .description('[preview] View A/B test details and results')
+    .argument('<name>', 'AB test name')
+    .option('--region <region>', 'AWS region')
+    .option('--json', 'Output as JSON')
+    .action(async (name: string, cliOptions: { region?: string; json?: boolean }) => {
+      try {
+        const region = await getRegion(cliOptions.region);
+        const { abTestId, error } = await resolveABTestId(name, region);
+        if (error) {
+          if (cliOptions.json) {
+            console.log(JSON.stringify({ success: false, error }));
+          } else {
+            console.error(error);
+          }
+          process.exit(1);
+        }
+        const result = await getABTest({ region, abTestId });
+
+        if (cliOptions.json) {
+          console.log(JSON.stringify(result));
+          process.exit(0);
+        } else if (process.stdout.isTTY) {
+          // Render TUI detail screen with key bindings
+          const [{ render }, { default: React }, { ABTestDetailScreen }] = await Promise.all([
+            import('ink'),
+            import('react'),
+            import('../../tui/screens/ab-test'),
+          ]);
+          render(
+            React.createElement(ABTestDetailScreen, {
+              abTestId,
+              region,
+              onExit: () => process.exit(0),
+            })
+          );
+          return;
+        } else {
+          console.log(formatABTestDetails(result));
+          process.exit(0);
+        }
+      } catch (error) {
+        if (cliOptions.json) {
+          console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+        } else {
+          console.error(`Error: ${getErrorMessage(error)}`);
+        }
+        process.exit(1);
+      }
+    });
+}
diff --git a/src/cli/commands/abtest/index.ts b/src/cli/commands/abtest/index.ts
new file mode 100644
index 000000000..0ff25efc5
--- /dev/null
+++ b/src/cli/commands/abtest/index.ts
@@ -0,0 +1 @@
+export { registerABTestCommand } from './command';
diff --git a/src/cli/commands/add/__tests__/validate-harness.test.ts b/src/cli/commands/add/__tests__/validate-harness.test.ts
new file mode 100644
index 000000000..6309ab623
--- /dev/null
+++ b/src/cli/commands/add/__tests__/validate-harness.test.ts
@@ -0,0 +1,97 @@
+import type { AddHarnessCliOptions } from '../types';
+import { validateAddHarnessOptions } from '../validate';
+import { describe, expect, it } from 'vitest';
+
+describe('validateAddHarnessOptions', () => {
+  it('returns valid for no auth options', () => {
+    const options: AddHarnessCliOptions = {};
+    expect(validateAddHarnessOptions(options)).toEqual({ valid: true });
+  });
+
+  it('returns valid for AWS_IAM', () => {
+    const options: AddHarnessCliOptions = { authorizerType: 'AWS_IAM' };
+    expect(validateAddHarnessOptions(options)).toEqual({ valid: true });
+  });
+
+  it('returns valid for CUSTOM_JWT with all required fields', () => {
+    const options: AddHarnessCliOptions = {
+      authorizerType: 'CUSTOM_JWT',
+      discoveryUrl: 'https://cognito-idp.us-east-1.amazonaws.com/us-east-1_abc123/.well-known/openid-configuration',
+      allowedAudience: 'aud1,aud2',
+    };
+    expect(validateAddHarnessOptions(options)).toEqual({ valid: true });
+  });
+
+  it('rejects invalid authorizer type', () => {
+    const options: AddHarnessCliOptions = { authorizerType: 'INVALID' as any };
+    const result = validateAddHarnessOptions(options);
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('Invalid authorizer type');
+  });
+
+  it('rejects CUSTOM_JWT without discoveryUrl', () => {
+    const options: AddHarnessCliOptions = { authorizerType: 'CUSTOM_JWT' };
+    const result = validateAddHarnessOptions(options);
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('--discovery-url is required');
+  });
+
+  it('rejects clientId without CUSTOM_JWT', () => {
+    const options: AddHarnessCliOptions = { clientId: 'abc' };
+    const result = validateAddHarnessOptions(options);
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('OAuth client credentials are only valid with CUSTOM_JWT authorizer');
+  });
+
+  it('rejects unknown tool name', () => {
+    const result = validateAddHarnessOptions({ tools: 'agentcore_browser,foo_tool' });
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain("Unknown tool 'foo_tool'");
+  });
+
+  it('rejects remote_mcp without --mcp-name', () => {
+    const result = validateAddHarnessOptions({ tools: 'remote_mcp', mcpUrl: 'https://example.com' });
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('--mcp-name is required');
+  });
+
+  it('rejects remote_mcp without --mcp-url', () => {
+    const result = validateAddHarnessOptions({ tools: 'remote_mcp', mcpName: 'my-mcp' });
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('--mcp-url is required');
+  });
+
+  it('rejects agentcore_gateway without --gateway-arn', () => {
+    const result = validateAddHarnessOptions({ tools: 'agentcore_gateway' });
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('--gateway-arn is required');
+  });
+
+  it('rejects invalid --gateway-outbound-auth value', () => {
+    const result = validateAddHarnessOptions({ gatewayOutboundAuth: 'iam' });
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain("Invalid --gateway-outbound-auth 'iam'");
+  });
+
+  it('rejects oauth gateway auth without --gateway-provider-arn', () => {
+    const result = validateAddHarnessOptions({ gatewayOutboundAuth: 'oauth', gatewayScopes: 'read' });
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('--gateway-provider-arn is required');
+  });
+
+  it('rejects oauth gateway auth without --gateway-scopes', () => {
+    const result = validateAddHarnessOptions({ gatewayOutboundAuth: 'oauth', gatewayProviderArn: 'arn:aws:...' });
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('--gateway-scopes is required');
+  });
+
+  it('accepts valid tools with required companion flags', () => {
+    const result = validateAddHarnessOptions({
+      tools: 'agentcore_browser,remote_mcp,agentcore_gateway',
+      mcpName: 'my-mcp',
+      mcpUrl: 'https://mcp.example.com',
+      gatewayArn: 'arn:aws:bedrock:us-east-1:123456789012:gateway/gw',
+    });
+    expect(result).toEqual({ valid: true });
+  });
+});
diff --git a/src/cli/commands/add/tool-action.ts b/src/cli/commands/add/tool-action.ts
new file mode 100644
index 000000000..cced82d81
--- /dev/null
+++ b/src/cli/commands/add/tool-action.ts
@@ -0,0 +1,177 @@
+import { ConfigIO } from '../../../lib';
+import type { HarnessGatewayOutboundAuth, HarnessSpec } from '../../../schema';
+import type { HarnessToolType } from '../../../schema/schemas/primitives/harness';
+
+export interface AddToolOptions {
+  harness: string;
+  type: string;
+  name: string;
+  url?: string;
+  browserArn?: string;
+  codeInterpreterArn?: string;
+  gatewayArn?: string;
+  gateway?: string;
+  outboundAuth?: string;
+  providerArn?: string;
+  scopes?: string;
+  grantType?: string;
+  json?: boolean;
+}
+
+const VALID_OUTBOUND_AUTH_TYPES = ['awsIam', 'none', 'oauth'] as const;
+const VALID_GRANT_TYPES = ['CLIENT_CREDENTIALS', 'USER_FEDERATION'] as const;
+const ARN_PATTERN = /^arn:[^:]+:/;
+
+export interface AddToolResult {
+  success: boolean;
+  error?: string;
+  harnessName?: string;
+  toolName?: string;
+}
+
+const VALID_TOOL_TYPES: HarnessToolType[] = [
+  'agentcore_browser',
+  'agentcore_code_interpreter',
+  'remote_mcp',
+  'agentcore_gateway',
+  'inline_function',
+];
+
+export async function handleAddTool(options: AddToolOptions): Promise<AddToolResult> {
+  const { harness, type, name } = options;
+
+  if (!VALID_TOOL_TYPES.includes(type as HarnessToolType)) {
+    return {
+      success: false,
+      error: `Invalid tool type '${type}'. Valid types: ${VALID_TOOL_TYPES.join(', ')}`,
+    };
+  }
+
+  const toolType = type as HarnessToolType;
+
+  if (toolType === 'remote_mcp' && !options.url) {
+    return { success: false, error: '--url is required for remote_mcp tools' };
+  }
+
+  if (toolType === 'agentcore_gateway' && !options.gatewayArn && !options.gateway) {
+    return { success: false, error: '--gateway-arn or --gateway is required for agentcore_gateway tools' };
+  }
+
+  let outboundAuth: HarnessGatewayOutboundAuth | undefined;
+  if (options.outboundAuth !== undefined) {
+    if (toolType !== 'agentcore_gateway') {
+      return { success: false, error: '--outbound-auth is only valid for agentcore_gateway tools' };
+    }
+    if (!VALID_OUTBOUND_AUTH_TYPES.includes(options.outboundAuth as (typeof VALID_OUTBOUND_AUTH_TYPES)[number])) {
+      return {
+        success: false,
+        error: `Invalid --outbound-auth '${options.outboundAuth}'. Valid: ${VALID_OUTBOUND_AUTH_TYPES.join(', ')}`,
+      };
+    }
+    if (options.outboundAuth === 'awsIam' || options.outboundAuth === 'none') {
+      if (options.providerArn || options.scopes || options.grantType) {
+        return {
+          success: false,
+          error: '--provider-arn, --scopes, and --grant-type are only valid with --outbound-auth oauth',
+        };
+      }
+      outboundAuth = options.outboundAuth === 'awsIam' ? { awsIam: {} } : { none: {} };
+    } else {
+      if (!options.providerArn) {
+        return { success: false, error: '--provider-arn is required when --outbound-auth oauth' };
+      }
+      if (!ARN_PATTERN.test(options.providerArn)) {
+        return { success: false, error: `Invalid --provider-arn '${options.providerArn}': must be a valid ARN` };
+      }
+      if (!options.scopes) {
+        return { success: false, error: '--scopes is required when --outbound-auth oauth' };
+      }
+      const scopes = options.scopes
+        .split(',')
+        .map(s => s.trim())
+        .filter(Boolean);
+      if (scopes.length === 0) {
+        return { success: false, error: '--scopes must contain at least one scope' };
+      }
+      if (
+        options.grantType !== undefined &&
+        !VALID_GRANT_TYPES.includes(options.grantType as (typeof VALID_GRANT_TYPES)[number])
+      ) {
+        return {
+          success: false,
+          error: `Invalid --grant-type '${options.grantType}'. Valid: ${VALID_GRANT_TYPES.join(', ')}`,
+        };
+      }
+      outboundAuth = {
+        oauth: {
+          providerArn: options.providerArn,
+          scopes,
+          ...(options.grantType && { grantType: options.grantType as (typeof VALID_GRANT_TYPES)[number] }),
+        },
+      };
+    }
+  }
+
+  const configIO = new ConfigIO();
+
+  // Resolve --gateway (project name) to ARN from deployed-state
+  let resolvedGatewayArn = options.gatewayArn;
+  if (toolType === 'agentcore_gateway' && options.gateway && !resolvedGatewayArn) {
+    try {
+      const deployedState = await configIO.readDeployedState();
+      const targetNames = Object.keys(deployedState.targets);
+      if (targetNames.length === 0) {
+        return { success: false, error: 'No deployed targets found. Deploy the gateway first.' };
+      }
+      const targetState = deployedState.targets[targetNames[0]!];
+      const gatewayState = targetState?.resources?.mcp?.gateways?.[options.gateway];
+      if (!gatewayState) {
+        return {
+          success: false,
+          error: `Gateway '${options.gateway}' not found in deployed state. Deploy it first or use --gateway-arn.`,
+        };
+      }
+      resolvedGatewayArn = gatewayState.gatewayArn;
+    } catch {
+      return { success: false, error: 'Could not read deployed state. Deploy the gateway first or use --gateway-arn.' };
+    }
+  }
+
+  let harnessSpec: HarnessSpec;
+  try {
+    harnessSpec = await configIO.readHarnessSpec(harness);
+  } catch {
+    return {
+      success: false,
+      error: `Harness '${harness}' not found. Check the name or run 'agentcore add harness' first.`,
+    };
+  }
+
+  const existingTool = harnessSpec.tools.find(t => t.name === name);
+  if (existingTool) {
+    return { success: false, error: `Tool '${name}' already exists in harness '${harness}'` };
+  }
+
+  const toolEntry: HarnessSpec['tools'][number] = { type: toolType, name };
+
+  if (toolType === 'remote_mcp') {
+    toolEntry.config = { remoteMcp: { url: options.url! } };
+  } else if (toolType === 'agentcore_browser' && options.browserArn) {
+    toolEntry.config = { agentCoreBrowser: { browserArn: options.browserArn } };
+  } else if (toolType === 'agentcore_code_interpreter' && options.codeInterpreterArn) {
+    toolEntry.config = { agentCoreCodeInterpreter: { codeInterpreterArn: options.codeInterpreterArn } };
+  } else if (toolType === 'agentcore_gateway') {
+    toolEntry.config = {
+      agentCoreGateway: {
+        gatewayArn: resolvedGatewayArn!,
+        ...(outboundAuth && { outboundAuth }),
+      },
+    };
+  }
+
+  harnessSpec.tools.push(toolEntry);
+
+  await configIO.writeHarnessSpec(harness, harnessSpec);
+
+  return { success: true, harnessName: harness, toolName: name };
+}
diff --git a/src/cli/commands/add/tool-command.ts b/src/cli/commands/add/tool-command.ts
new file mode 100644
index 000000000..252c6a286
--- /dev/null
+++ b/src/cli/commands/add/tool-command.ts
@@ -0,0 +1,82 @@
+import { findConfigRoot } from '../../../lib';
+import { getErrorMessage } from '../../errors';
+import { handleAddTool } from './tool-action';
+import type { Command } from '@commander-js/extra-typings';
+
+export function registerAddTool(addCmd: Command): void {
+  addCmd
+    .command('tool')
+    .description('Add a tool to a harness')
+    .requiredOption('--harness <name>', 'Target harness name')
+    .requiredOption(
+      '--type <type>',
+      'Tool type: agentcore_browser, agentcore_code_interpreter, remote_mcp, agentcore_gateway, inline_function'
+    )
+    .requiredOption('--name <name>', 'Tool name')
+    .option('--url <url>', 'MCP server URL (required for remote_mcp)')
+    .option('--browser-arn <arn>', 'Custom browser ARN (optional for agentcore_browser)')
+    .option('--code-interpreter-arn <arn>', 'Custom code interpreter ARN (optional for agentcore_code_interpreter)')
+    .option('--gateway-arn <arn>', 'Gateway ARN (for agentcore_gateway)')
+    .option('--gateway <name>', 'Project gateway name — resolves ARN from deployed state (for agentcore_gateway)')
+    .option(
+      '--outbound-auth <type>',
+      'Gateway outbound auth: awsIam, none, or oauth (default: awsIam if omitted) [agentcore_gateway]'
+    )
+    .option('--provider-arn <arn>', 'OAuth credential provider ARN (required when --outbound-auth oauth)')
+    .option(
+      '--scopes <scopes>',
+      'Comma-separated OAuth scopes (required when --outbound-auth oauth), e.g. "openid,profile" or "https://api.example.com/read"'
+    )
+    .option(
+      '--grant-type <type>',
+      'OAuth grant type: CLIENT_CREDENTIALS or USER_FEDERATION (for --outbound-auth oauth)'
+    )
+    .option('--json', 'Output as JSON')
+    .action(async cliOptions => {
+      if (!findConfigRoot()) {
+        console.error('No agentcore project found. Run `agentcore create` first.');
+        process.exit(1);
+      }
+
+      try {
+        const result = await handleAddTool({
+          harness: cliOptions.harness,
+          type: cliOptions.type,
+          name: cliOptions.name,
+          url: cliOptions.url,
+          browserArn: cliOptions.browserArn,
+          codeInterpreterArn: cliOptions.codeInterpreterArn,
+          gatewayArn: cliOptions.gatewayArn,
+          gateway: cliOptions.gateway,
+          outboundAuth: cliOptions.outboundAuth,
+          providerArn: cliOptions.providerArn,
+          scopes: cliOptions.scopes,
+          grantType: cliOptions.grantType,
+          json: cliOptions.json,
+        });
+
+        if (!result.success) {
+          if (cliOptions.json) {
+            console.log(JSON.stringify(result));
+          } else {
+            console.error(result.error);
+          }
+          process.exit(1);
+        }
+
+        if (cliOptions.json) {
+          console.log(JSON.stringify(result));
+        } else {
+          console.log(`Added tool '${result.toolName}' to harness '${result.harnessName}'.`);
+          console.log(`Run 'agentcore deploy' to apply changes.`);
+        }
+      } catch (error) {
+        if (cliOptions.json) {
+          console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+        } else {
+          console.error(getErrorMessage(error));
+        }
+        process.exit(1);
+      }
+    });
+}
diff --git a/src/cli/commands/add/types.ts b/src/cli/commands/add/types.ts
index ad3b531b4..47e7c0ad9 100644
--- a/src/cli/commands/add/types.ts
+++ b/src/cli/commands/add/types.ts
@@ -37,6 +37,7 @@ export interface AddAgentOptions extends VpcOptions {
   idleTimeout?: number | string;
   maxLifetime?: number | string;
   sessionStorageMountPath?: string;
+  withConfigBundle?: boolean;
   json?: boolean;
 }
 
@@ -106,6 +107,44 @@ export interface AddGatewayTargetResult {
   error?: string;
 }
 
+// Harness types
+export interface AddHarnessCliOptions {
+  name?: string;
+  modelProvider?: string;
+  modelId?: string;
+  apiKeyArn?: string;
+  container?: string;
+  memory?: boolean;
+  maxIterations?: number;
+  maxTokens?: number;
+  timeout?: number;
+  truncationStrategy?: string;
+  networkMode?: string;
+  subnets?: string;
+  securityGroups?: string;
+  idleTimeout?: number;
+  maxLifetime?: number;
+  sessionStorage?: string;
+  withInvokeScript?: boolean;
+  systemPrompt?: string;
+  tools?: string;
+  mcpName?: string;
+  mcpUrl?: string;
+  gatewayArn?: string;
+  gatewayOutboundAuth?: string;
+  gatewayProviderArn?: string;
+  gatewayScopes?: string;
+  authorizerType?: RuntimeAuthorizerType;
+  discoveryUrl?: string;
+  allowedAudience?: string;
+  allowedClients?: string;
+  allowedScopes?: string;
+  customClaims?: string;
+  clientId?: string;
+  clientSecret?: string;
+  json?: boolean;
+}
+
 // Memory types (v2: no owner/user concept)
 export interface AddMemoryOptions {
   name?: string;
diff --git a/src/cli/commands/add/validate.ts b/src/cli/commands/add/validate.ts
index 15ec081ab..32f858c0f 100644
--- a/src/cli/commands/add/validate.ts
+++ b/src/cli/commands/add/validate.ts
@@ -27,6 +27,7 @@ import type {
   AddCredentialOptions,
   AddGatewayOptions,
   AddGatewayTargetOptions,
+  AddHarnessCliOptions,
   AddMemoryOptions,
 } from './types';
 import { existsSync, readFileSync } from 'fs';
@@ -791,3 +792,80 @@ export function validateAddCredentialOptions(options: AddCredentialOptions): Val
 
   return { valid: true };
 }
+
+const VALID_HARNESS_TOOLS = [
+  'agentcore_browser',
+  'agentcore_code_interpreter',
+  'remote_mcp',
+  'agentcore_gateway',
+] as const;
+
+const VALID_GATEWAY_OUTBOUND_AUTH = ['awsIam', 'none', 'oauth'] as const;
+
+// Harness validation
+export function validateAddHarnessOptions(options: AddHarnessCliOptions): ValidationResult {
+  if (options.tools) {
+    const toolNames = options.tools.split(',').map(s => s.trim());
+    for (const tool of toolNames) {
+      if (!VALID_HARNESS_TOOLS.includes(tool as (typeof VALID_HARNESS_TOOLS)[number])) {
+        return {
+          valid: false,
+          error: `Unknown tool '${tool}'. Valid tools: ${VALID_HARNESS_TOOLS.join(', ')}`,
+        };
+      }
+    }
+
+    if (toolNames.includes('remote_mcp')) {
+      if (!options.mcpName) {
+        return { valid: false, error: '--mcp-name is required when --tools includes remote_mcp' };
+      }
+      if (!options.mcpUrl) {
+        return { valid: false, error: '--mcp-url is required when --tools includes remote_mcp' };
+      }
+    }
+
+    if (toolNames.includes('agentcore_gateway')) {
+      if (!options.gatewayArn) {
+        return { valid: false, error: '--gateway-arn is required when --tools includes agentcore_gateway' };
+      }
+    }
+  }
+
+  if (options.gatewayOutboundAuth) {
+    if (
+      !VALID_GATEWAY_OUTBOUND_AUTH.includes(options.gatewayOutboundAuth as (typeof VALID_GATEWAY_OUTBOUND_AUTH)[number])
+    ) {
+      return {
+        valid: false,
+        error: `Invalid --gateway-outbound-auth '${options.gatewayOutboundAuth}'. Use: ${VALID_GATEWAY_OUTBOUND_AUTH.join(', ')}`,
+      };
+    }
+
+    if (options.gatewayOutboundAuth === 'oauth') {
+      if (!options.gatewayProviderArn) {
+        return { valid: false, error: '--gateway-provider-arn is required when --gateway-outbound-auth is oauth' };
+      }
+      if (!options.gatewayScopes) {
+        return { valid: false, error: '--gateway-scopes is required when --gateway-outbound-auth is oauth' };
+      }
+    }
+  }
+
+  if (options.authorizerType) {
+    const authResult = RuntimeAuthorizerTypeSchema.safeParse(options.authorizerType);
+    if (!authResult.success) {
+      return { valid: false, error: 'Invalid authorizer type. Use AWS_IAM or CUSTOM_JWT' };
+    }
+
+    if (options.authorizerType === 'CUSTOM_JWT') {
+      const jwtResult = validateJwtAuthorizerOptions(options);
+      if (!jwtResult.valid) return jwtResult;
+    }
+  }
+
+  if (options.clientId && options.authorizerType !== 'CUSTOM_JWT') {
+    return { valid: false, error: 'OAuth client credentials are only valid with CUSTOM_JWT authorizer' };
+  }
+
+  return { valid: true };
+}
diff --git a/src/cli/commands/config-bundle/command.tsx b/src/cli/commands/config-bundle/command.tsx
new file mode 100644
index 000000000..ce72f2a4b
--- /dev/null
+++ b/src/cli/commands/config-bundle/command.tsx
@@ -0,0 +1,347 @@
+import {
+  getConfigurationBundleVersion,
+  listConfigurationBundleVersions,
+  updateConfigurationBundle,
+} from '../../aws/agentcore-config-bundles';
+import type {
+  ConfigurationBundleVersionSummary,
+  ListConfigurationBundleVersionsFilter,
+} from '../../aws/agentcore-config-bundles';
+import { getErrorMessage } from '../../errors';
+import { deepDiff } from '../../operations/config-bundle/diff-versions';
+import { resolveBundleByName } from '../../operations/config-bundle/resolve-bundle';
+import { requireProject } from '../../tui/guards';
+import type { Command } from '@commander-js/extra-typings';
+import { Box, Text, render } from 'ink';
+
+// ============================================================================
+// Helpers
+// ============================================================================
+
+function formatTimestamp(ts: string): string {
+  const num = Number(ts);
+  if (isNaN(num)) return ts;
+  // API returns epoch seconds; convert to ms if needed
+  const ms = num < 1e12 ? num * 1000 : num;
+  return new Date(ms)
+    .toISOString()
+    .replace('T', ' ')
+    .replace(/\.\d+Z$/, 'Z');
+}
+
+async function resolveRegion(): Promise<string> {
+  const { ConfigIO } = await import('../../../lib');
+  const configIO = new ConfigIO();
+  const targets = await configIO.resolveAWSDeploymentTargets();
+  if (targets.length === 0) {
+    throw new Error('No AWS deployment targets configured. Run `agentcore deploy` first.');
+  }
+  return targets[0]!.region;
+}
+
+// ============================================================================
+// Version list
+// ============================================================================
+
+async function handleVersions(options: {
+  bundle: string;
+  branch?: string;
+  latestPerBranch?: boolean;
+  createdBy?: string;
+  region?: string;
+  json?: boolean;
+}) {
+  const region = options.region ?? (await resolveRegion());
+  const resolved = await resolveBundleByName(options.bundle, region);
+
+  const filter: ListConfigurationBundleVersionsFilter = {};
+  if (options.branch) filter.branchName = options.branch;
+  if (options.latestPerBranch) filter.latestPerBranch = true;
+  if (options.createdBy) filter.createdByName = options.createdBy;
+  const hasFilter = Object.keys(filter).length > 0;
+
+  // Paginate to collect all versions
+  const allVersions: ConfigurationBundleVersionSummary[] = [];
+  let nextToken: string | undefined;
+  do {
+    const result = await listConfigurationBundleVersions({
+      region,
+      bundleId: resolved.bundleId,
+      maxResults: 50,
+      nextToken,
+      ...(hasFilter && { filter }),
+    });
+    allVersions.push(...result.versions);
+    nextToken = result.nextToken;
+  } while (nextToken);
+
+  // Sort by creation time, newest first
+  allVersions.sort((a, b) => Number(b.versionCreatedAt) - Number(a.versionCreatedAt));
+
+  return { versions: allVersions, bundleName: options.bundle, bundleId: resolved.bundleId };
+}
+
+// ============================================================================
+// Diff
+// ============================================================================
+
+async function handleDiff(options: { bundle: string; from: string; to: string; region?: string }) {
+  const region = options.region ?? (await resolveRegion());
+  const resolved = await resolveBundleByName(options.bundle, region);
+
+  const [fromVersion, toVersion] = await Promise.all([
+    getConfigurationBundleVersion({ region, bundleId: resolved.bundleId, versionId: options.from }),
+    getConfigurationBundleVersion({ region, bundleId: resolved.bundleId, versionId: options.to }),
+  ]);
+
+  const diffs = deepDiff(fromVersion.components, toVersion.components);
+
+  return { fromVersion, toVersion, diffs };
+}
+
+// ============================================================================
+// Command registration
+// ============================================================================
+
+export const registerConfigBundle = (program: Command) => {
+  const cmd = program
+    .command('config-bundle')
+    .alias('cb')
+    .description('[preview] Manage configuration bundles (use bundle name from agentcore.json, not the ID)');
+
+  // --- versions ---
+  cmd
+    .command('versions')
+    .description('List version history for a configuration bundle')
+    .requiredOption('--bundle <name>', 'Bundle name as defined in agentcore.json (e.g. "MyBundle")')
+    .option('--branch <name>', 'Filter by branch name')
+    .option('--latest-per-branch', 'Show only the latest version per branch')
+    .option('--created-by <name>', 'Filter by creator name (e.g. "user", "recommendation")')
+    .option('--region <region>', 'AWS region override')
+    .option('--json', 'Output as JSON')
+    .action(
+      async (cliOptions: {
+        bundle: string;
+        branch?: string;
+        latestPerBranch?: boolean;
+        createdBy?: string;
+        region?: string;
+        json?: boolean;
+      }) => {
+        requireProject();
+        try {
+          const result = await handleVersions(cliOptions);
+
+          if (cliOptions.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+          }
+
+          if (result.versions.length === 0) {
+            render(<Text color="yellow">No versions found for bundle &quot;{cliOptions.bundle}&quot;.</Text>);
+            return;
+          }
+
+          // Group by branch
+          const byBranch = new Map<string, ConfigurationBundleVersionSummary[]>();
+          for (const v of result.versions) {
+            const branch = v.lineageMetadata?.branchName ?? 'unknown';
+            if (!byBranch.has(branch)) byBranch.set(branch, []);
+            byBranch.get(branch)!.push(v);
+          }
+
+          render(
+            <Box flexDirection="column">
+              <Text bold>
+                {result.bundleName} — {result.versions.length} version(s)
+              </Text>
+              <Text> </Text>
+              {[...byBranch.entries()].map(([branch, versions]) => (
+                <Box key={branch} flexDirection="column" marginBottom={1}>
+                  <Text bold color="cyan">
+                    Branch: {branch}
+                  </Text>
+                  {versions.map((v, i) => {
+                    const meta = v.lineageMetadata;
+                    const creator = meta?.createdBy?.name ?? 'unknown';
+                    const message = meta?.commitMessage ?? '';
+                    const isLast = i === versions.length - 1;
+                    const connector = isLast ? '└' : '├';
+                    return (
+                      <Box key={v.versionId} flexDirection="column">
+                        <Text>
+                          {connector} <Text color="green">{v.versionId}</Text>{' '}
+                          <Text dimColor>{formatTimestamp(v.versionCreatedAt)}</Text>{' '}
+                          {message && <Text>&quot;{message}&quot;</Text>}
+                        </Text>
+                        <Text>
+                          {isLast ? ' ' : '│'} <Text dimColor>by: {creator}</Text>
+                          {meta?.parentVersionIds?.length ? (
+                            <Text dimColor> (parent: {meta.parentVersionIds.join(', ')})</Text>
+                          ) : null}
+                        </Text>
+                      </Box>
+                    );
+                  })}
+                </Box>
+              ))}
+              <Text dimColor>Use --json for complete output</Text>
+            </Box>
+          );
+        } catch (error) {
+          render(<Text color="red">Error: {getErrorMessage(error)}</Text>);
+          process.exit(1);
+        }
+      }
+    );
+
+  // --- diff ---
+  cmd
+    .command('diff')
+    .description('Diff two versions of a configuration bundle (get version IDs from `cb versions`)')
+    .requiredOption('--bundle <name>', 'Bundle name as defined in agentcore.json (e.g. "MyBundle")')
+    .requiredOption('--from <id>', 'Source version ID (from `config-bundle versions --json`)')
+    .requiredOption('--to <id>', 'Target version ID (from `config-bundle versions --json`)')
+    .option('--region <region>', 'AWS region override')
+    .option('--json', 'Output as JSON')
+    .action(async (cliOptions: { bundle: string; from: string; to: string; region?: string; json?: boolean }) => {
+      requireProject();
+      try {
+        const result = await handleDiff(cliOptions);
+
+        if (cliOptions.json) {
+          console.log(JSON.stringify(result, null, 2));
+          return;
+        }
+
+        const fromMeta = result.fromVersion.lineageMetadata;
+        const toMeta = result.toVersion.lineageMetadata;
+
+        render(
+          <Box flexDirection="column">
+            <Text bold>
+              Diff: {result.fromVersion.versionId} → {result.toVersion.versionId}
+            </Text>
+            <Text dimColor>
+              From: {fromMeta?.commitMessage ?? '(no message)'} ({formatTimestamp(result.fromVersion.versionCreatedAt)})
+            </Text>
+            <Text dimColor>
+              To: {toMeta?.commitMessage ?? '(no message)'} ({formatTimestamp(result.toVersion.versionCreatedAt)})
+            </Text>
+            <Text> </Text>
+            {result.diffs.length === 0 ? (
+              <Text color="green">No differences found.</Text>
+            ) : (
+              <>
+                <Text>{result.diffs.length} change(s):</Text>
+                <Text> </Text>
+                {result.diffs.map((d, i) => (
+                  <Box key={i} flexDirection="column" marginBottom={1}>
+                    <Text bold>{d.path}</Text>
+                    {d.type === 'added' && <Text color="green">+ {JSON.stringify(d.newValue)}</Text>}
+                    {d.type === 'removed' && <Text color="red">- {JSON.stringify(d.oldValue)}</Text>}
+                    {d.type === 'changed' && (
+                      <>
+                        <Text color="red">- {JSON.stringify(d.oldValue)}</Text>
+                        <Text color="green">+ {JSON.stringify(d.newValue)}</Text>
+                      </>
+                    )}
+                  </Box>
+                ))}
+              </>
+            )}
+          </Box>
+        );
+      } catch (error) {
+        render(<Text color="red">Error: {getErrorMessage(error)}</Text>);
+        process.exit(1);
+      }
+    });
+
+  // --- create-branch ---
+  cmd
+    .command('create-branch')
+    .description('Create a new branch on an existing configuration bundle')
+    .requiredOption('--bundle <name>', 'Bundle name as defined in agentcore.json (e.g. "MyBundle")')
+    .requiredOption('--branch <name>', 'Name for the new branch')
+    .option('--from <versionId>', 'Parent version ID to branch from (defaults to latest version)')
+    .option('--commit-message <text>', 'Commit message for the branch point')
+    .option('--region <region>', 'AWS region override')
+    .option('--json', 'Output as JSON')
+    .action(
+      async (cliOptions: {
+        bundle: string;
+        branch: string;
+        from?: string;
+        commitMessage?: string;
+        region?: string;
+        json?: boolean;
+      }) => {
+        requireProject();
+        try {
+          const region = cliOptions.region ?? (await resolveRegion());
+          const resolved = await resolveBundleByName(cliOptions.bundle, region);
+
+          // Determine parent version
+          let parentVersionId = cliOptions.from;
+          if (!parentVersionId) {
+            const versions = await listConfigurationBundleVersions({
+              region,
+              bundleId: resolved.bundleId,
+              maxResults: 50,
+            });
+            if (versions.versions.length === 0) {
+              throw new Error(`No versions found for bundle "${cliOptions.bundle}".`);
+            }
+            // Sort descending by creation time to get the latest version
+            const sorted = [...versions.versions].sort(
+              (a, b) => new Date(b.versionCreatedAt).getTime() - new Date(a.versionCreatedAt).getTime()
+            );
+            parentVersionId = sorted[0]!.versionId;
+          }
+
+          // Get the parent version's components to carry forward
+          const parentVersion = await getConfigurationBundleVersion({
+            region,
+            bundleId: resolved.bundleId,
+            versionId: parentVersionId,
+          });
+
+          const result = await updateConfigurationBundle({
+            region,
+            bundleId: resolved.bundleId,
+            components: parentVersion.components,
+            parentVersionIds: [parentVersionId],
+            branchName: cliOptions.branch,
+            commitMessage: cliOptions.commitMessage ?? `Create branch ${cliOptions.branch}`,
+          });
+
+          if (cliOptions.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+          }
+
+          render(
+            <Box flexDirection="column">
+              <Text bold color="green">
+                Branch &quot;{cliOptions.branch}&quot; created on bundle &quot;{cliOptions.bundle}&quot;
+              </Text>
+              <Text>
+                Version: <Text color="green">{result.versionId}</Text>
+              </Text>
+              <Text dimColor>Parent: {parentVersionId}</Text>
+            </Box>
+          );
+        } catch (error) {
+          if (cliOptions.json) {
+            console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+          } else {
+            render(<Text color="red">Error: {getErrorMessage(error)}</Text>);
+          }
+          process.exit(1);
+        }
+      }
+    );
+
+  return cmd;
+};
diff --git a/src/cli/commands/config-bundle/index.ts b/src/cli/commands/config-bundle/index.ts
new file mode 100644
index 000000000..2ebcc4c68
--- /dev/null
+++ b/src/cli/commands/config-bundle/index.ts
@@ -0,0 +1 @@
+export { registerConfigBundle } from './command';
diff --git a/src/cli/commands/create/__tests__/create.test.ts b/src/cli/commands/create/__tests__/create.test.ts
index 72ab2c64f..729cce707 100644
--- a/src/cli/commands/create/__tests__/create.test.ts
+++ b/src/cli/commands/create/__tests__/create.test.ts
@@ -82,7 +82,8 @@ describe('create command', () => {
     });
 
     it('requires all options without --no-agent', async () => {
-      const result = await runCLI(['create', '--name', 'Incomplete', '--json'], testDir);
+      // --framework triggers the agent path, which requires --language, --model-provider, etc.
+      const result = await runCLI(['create', '--name', 'Incomplete', '--framework', 'Strands', '--json'], testDir);
 
       expect(result.exitCode).toBe(1);
       const json = JSON.parse(result.stdout);
@@ -196,6 +197,44 @@ describe('create command', () => {
     });
   });
 
+  describe('with harness', () => {
+    it('uses --project-name for project and --name for harness resource', async () => {
+      const projectName = `HarnessProj${Date.now().toString().slice(-6)}`;
+      const harnessName = `HarnessResource${randomUUID().replace(/-/g, '').slice(0, 16)}`;
+      const result = await runCLI(
+        ['create', '--project-name', projectName, '--name', harnessName, '--skip-git', '--skip-install', '--json'],
+        testDir
+      );
+
+      expect(result.exitCode, `stdout: ${result.stdout}, stderr: ${result.stderr}`).toBe(0);
+
+      const json = JSON.parse(result.stdout);
+      expect(json.success).toBe(true);
+      expect(json.projectPath).toMatch(new RegExp(`/${projectName}$`));
+      expect(await exists(join(json.projectPath, 'app', harnessName, 'harness.json'))).toBeTruthy();
+
+      const projectSpec = JSON.parse(await readFile(join(json.projectPath, 'agentcore/agentcore.json'), 'utf-8'));
+      expect(projectSpec.name).toBe(projectName);
+      expect(projectSpec.harnesses[0].name).toBe(harnessName);
+      expect(projectSpec.harnesses[0].path).toBe(`app/${harnessName}`);
+    });
+
+    it('rejects long harness name without --project-name but accepts it with --project-name', async () => {
+      const harnessName = `Harness${'A'.repeat(30)}`;
+      const rejected = await runCLI(['create', '--name', harnessName, '--skip-install', '--json'], testDir);
+      expect(rejected.exitCode).toBe(1);
+      expect(JSON.parse(rejected.stdout).success).toBe(false);
+
+      const projectName = `ShortProj${Date.now().toString().slice(-6)}`;
+      const accepted = await runCLI(
+        ['create', '--project-name', projectName, '--name', harnessName, '--skip-git', '--skip-install', '--json'],
+        testDir
+      );
+      expect(accepted.exitCode, `stdout: ${accepted.stdout}, stderr: ${accepted.stderr}`).toBe(0);
+      expect(JSON.parse(accepted.stdout).success).toBe(true);
+    });
+  });
+
   describe('--defaults', () => {
     it('creates project with defaults', async () => {
       const name = `Defaults${Date.now()}`;
@@ -211,7 +250,11 @@ describe('create command', () => {
   describe('--dry-run', () => {
     it('shows files without creating', async () => {
       const name = `DryRun${Date.now()}`;
-      const result = await runCLI(['create', '--name', name, '--defaults', '--dry-run'], testDir);
+      // --framework triggers agent path where --dry-run is supported
+      const result = await runCLI(
+        ['create', '--name', name, '--defaults', '--framework', 'Strands', '--dry-run'],
+        testDir
+      );
 
       expect(result.exitCode).toBe(0);
       expect(result.stdout.includes('would create') || result.stdout.includes('Dry run')).toBeTruthy();
@@ -222,7 +265,18 @@ describe('create command', () => {
       const projectName = `DryProj${Date.now().toString().slice(-6)}`;
       const agentName = `DryAgent${Date.now().toString().slice(-6)}`;
       const result = await runCLI(
-        ['create', '--project-name', projectName, '--name', agentName, '--defaults', '--dry-run', '--json'],
+        [
+          'create',
+          '--project-name',
+          projectName,
+          '--name',
+          agentName,
+          '--defaults',
+          '--framework',
+          'Strands',
+          '--dry-run',
+          '--json',
+        ],
         testDir
       );
 
diff --git a/src/cli/commands/create/__tests__/harness-action.test.ts b/src/cli/commands/create/__tests__/harness-action.test.ts
new file mode 100644
index 000000000..73d26d13a
--- /dev/null
+++ b/src/cli/commands/create/__tests__/harness-action.test.ts
@@ -0,0 +1,126 @@
+import { exists } from '../../../../test-utils/index.js';
+import { createProjectWithHarness } from '../harness-action.js';
+import { randomUUID } from 'node:crypto';
+import { rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+describe('createProjectWithHarness', () => {
+  let testDir: string;
+
+  beforeAll(() => {
+    testDir = join(tmpdir(), `harness-action-${randomUUID()}`);
+  });
+
+  afterAll(async () => {
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  it('creates project with harness', async () => {
+    const name = `TestH${randomUUID().slice(0, 6)}`;
+    const result = await createProjectWithHarness({
+      name,
+      cwd: testDir,
+      modelProvider: 'bedrock',
+      modelId: 'global.anthropic.claude-sonnet-4-6',
+      skipGit: true,
+      skipInstall: true,
+    });
+
+    expect(result.success, `Error: ${result.error}`).toBe(true);
+    expect(result.projectPath).toBeTruthy();
+
+    const projectPath = result.projectPath!;
+    const configDir = join(projectPath, 'agentcore');
+    const harnessDir = join(projectPath, 'app', name);
+
+    await expect(exists(projectPath)).resolves.toBe(true);
+    await expect(exists(configDir)).resolves.toBe(true);
+    await expect(exists(harnessDir)).resolves.toBe(true);
+    await expect(exists(join(harnessDir, 'harness.json'))).resolves.toBe(true);
+    await expect(exists(join(harnessDir, 'system-prompt.md'))).resolves.toBe(true);
+  });
+
+  it('uses projectName for project scaffold and name for harness resource', async () => {
+    const projectName = `Proj${randomUUID().slice(0, 6)}`;
+    const name = `HarnessName${randomUUID().replace(/-/g, '').slice(0, 12)}`;
+    const result = await createProjectWithHarness({
+      name,
+      projectName,
+      cwd: testDir,
+      modelProvider: 'bedrock',
+      modelId: 'global.anthropic.claude-sonnet-4-6',
+      skipGit: true,
+      skipInstall: true,
+    });
+
+    expect(result.success, `Error: ${result.error}`).toBe(true);
+    expect(result.projectPath).toBe(join(testDir, projectName));
+
+    await expect(exists(join(result.projectPath!, 'agentcore'))).resolves.toBe(true);
+    await expect(exists(join(result.projectPath!, 'app', name, 'harness.json'))).resolves.toBe(true);
+  });
+
+  it('creates harness with custom options', async () => {
+    const name = `CustomH${randomUUID().slice(0, 6)}`;
+    const result = await createProjectWithHarness({
+      name,
+      cwd: testDir,
+      modelProvider: 'open_ai',
+      modelId: 'gpt-4',
+      apiKeyArn: 'arn:aws:secretsmanager:us-east-1:123456789012:secret:my-key',
+      skipMemory: true,
+      maxIterations: 10,
+      maxTokens: 2000,
+      timeoutSeconds: 300,
+      truncationStrategy: 'sliding_window',
+      networkMode: 'PUBLIC',
+      skipGit: true,
+      skipInstall: true,
+    });
+
+    expect(result.success, `Error: ${result.error}`).toBe(true);
+    expect(result.projectPath).toBeTruthy();
+
+    const harnessJsonPath = join(result.projectPath!, 'app', name, 'harness.json');
+    await expect(exists(harnessJsonPath)).resolves.toBe(true);
+  });
+
+  it('reports progress during creation', async () => {
+    const name = `ProgH${randomUUID().slice(0, 6)}`;
+    const progressSteps: string[] = [];
+
+    const result = await createProjectWithHarness({
+      name,
+      cwd: testDir,
+      modelProvider: 'bedrock',
+      modelId: 'global.anthropic.claude-sonnet-4-6',
+      skipGit: true,
+      skipInstall: true,
+      onProgress: (step, status) => {
+        if (status === 'done') {
+          progressSteps.push(step);
+        }
+      },
+    });
+
+    expect(result.success, `Error: ${result.error}`).toBe(true);
+    expect(progressSteps).toContain('Add harness to project');
+  });
+
+  it('handles errors gracefully', async () => {
+    const name = '!!!invalid-name!!!';
+    const result = await createProjectWithHarness({
+      name,
+      cwd: testDir,
+      modelProvider: 'bedrock',
+      modelId: 'global.anthropic.claude-sonnet-4-6',
+      skipGit: true,
+      skipInstall: true,
+    });
+
+    expect(result.success).toBe(false);
+    expect(result.error).toBeTruthy();
+  });
+});
diff --git a/src/cli/commands/create/__tests__/harness-validate.test.ts b/src/cli/commands/create/__tests__/harness-validate.test.ts
new file mode 100644
index 000000000..78acc0446
--- /dev/null
+++ b/src/cli/commands/create/__tests__/harness-validate.test.ts
@@ -0,0 +1,179 @@
+import { validateCreateHarnessOptions } from '../harness-validate.js';
+import { randomUUID } from 'node:crypto';
+import { mkdirSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+describe('validateCreateHarnessOptions', () => {
+  let testDir: string;
+
+  beforeAll(() => {
+    testDir = join(tmpdir(), `harness-create-validate-${randomUUID()}`);
+    mkdirSync(testDir, { recursive: true });
+    mkdirSync(join(testDir, 'existingHarness'), { recursive: true });
+    mkdirSync(join(testDir, 'existingProject'), { recursive: true });
+  });
+
+  afterAll(() => {
+    rmSync(testDir, { recursive: true, force: true });
+  });
+
+  it('requires name', () => {
+    const result = validateCreateHarnessOptions({}, testDir);
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('--name');
+  });
+
+  it('rejects invalid harness name starting with digit', () => {
+    const result = validateCreateHarnessOptions({ name: '1invalid' }, testDir);
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('letter');
+  });
+
+  it('rejects invalid harness name with special characters', () => {
+    const result = validateCreateHarnessOptions({ name: 'invalid-name!' }, testDir);
+    expect(result.valid).toBe(false);
+  });
+
+  it('rejects existing directory', () => {
+    const result = validateCreateHarnessOptions({ name: 'existingHarness' }, testDir);
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('already exists');
+  });
+
+  it('accepts valid bedrock options with defaults', () => {
+    const result = validateCreateHarnessOptions({ name: 'myHarness' }, testDir);
+    expect(result.valid).toBe(true);
+  });
+
+  it('accepts explicit model provider and id', () => {
+    const result = validateCreateHarnessOptions(
+      {
+        name: 'myHarness2',
+        modelProvider: 'bedrock',
+        modelId: 'us.anthropic.claude-sonnet-4-5-20250514-v1:0',
+      },
+      testDir
+    );
+    expect(result.valid).toBe(true);
+  });
+
+  it('requires api-key-arn for non-bedrock providers', () => {
+    const result = validateCreateHarnessOptions(
+      {
+        name: 'myHarness3',
+        modelProvider: 'open_ai',
+        modelId: 'gpt-4',
+      },
+      testDir
+    );
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('--api-key-arn');
+  });
+
+  it('accepts non-bedrock provider with api-key-arn', () => {
+    const result = validateCreateHarnessOptions(
+      {
+        name: 'myHarness4',
+        modelProvider: 'open_ai',
+        modelId: 'gpt-4',
+        apiKeyArn: 'arn:aws:secretsmanager:us-east-1:123456789012:secret:my-key',
+      },
+      testDir
+    );
+    expect(result.valid).toBe(true);
+  });
+
+  it('normalizes titlecase model provider to lowercase', () => {
+    const options: any = {
+      name: 'myHarness5',
+      modelProvider: 'Bedrock',
+      modelId: 'test-model',
+    };
+    const result = validateCreateHarnessOptions(options, testDir);
+    expect(result.valid).toBe(true);
+    expect(options.modelProvider).toBe('bedrock');
+  });
+
+  it('normalizes OpenAI to open_ai', () => {
+    const options: any = {
+      name: 'myHarness6',
+      modelProvider: 'OpenAI',
+      modelId: 'gpt-4',
+      apiKeyArn: 'arn:aws:secretsmanager:us-east-1:123456789012:secret:my-key',
+    };
+    const result = validateCreateHarnessOptions(options, testDir);
+    expect(result.valid).toBe(true);
+    expect(options.modelProvider).toBe('open_ai');
+  });
+
+  it('normalizes Gemini to gemini', () => {
+    const options: any = {
+      name: 'myHarness7',
+      modelProvider: 'Gemini',
+      modelId: 'gemini-pro',
+      apiKeyArn: 'arn:aws:secretsmanager:us-east-1:123456789012:secret:my-key',
+    };
+    const result = validateCreateHarnessOptions(options, testDir);
+    expect(result.valid).toBe(true);
+    expect(options.modelProvider).toBe('gemini');
+  });
+
+  it('rejects invalid model provider', () => {
+    const result = validateCreateHarnessOptions(
+      {
+        name: 'myHarness8',
+        modelProvider: 'azure',
+        modelId: 'test-model',
+      },
+      testDir
+    );
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('provider');
+  });
+
+  it('applies default model provider and id', () => {
+    const options: any = { name: 'myHarness9' };
+    const result = validateCreateHarnessOptions(options, testDir);
+    expect(result.valid).toBe(true);
+    expect(options.modelProvider).toBe('bedrock');
+    expect(options.modelId).toBe('global.anthropic.claude-sonnet-4-6');
+  });
+
+  it('accepts valid harness name with underscores when project-name is valid', () => {
+    const result = validateCreateHarnessOptions(
+      { name: 'my_valid_harness_123', projectName: 'myValidHarness123' },
+      testDir
+    );
+    expect(result.valid).toBe(true);
+  });
+
+  it('rejects harness name longer than 48 characters', () => {
+    const result = validateCreateHarnessOptions({ name: 'a'.repeat(49) }, testDir);
+    expect(result.valid).toBe(false);
+  });
+
+  it('allows long harness name when project-name is valid', () => {
+    const result = validateCreateHarnessOptions(
+      { name: `Harness${'A'.repeat(30)}`, projectName: 'ShortProject' },
+      testDir
+    );
+    expect(result.valid).toBe(true);
+  });
+
+  it('validates project-name separately from harness name', () => {
+    const result = validateCreateHarnessOptions(
+      { name: 'ValidHarness', projectName: 'ProjectNameTooLongForCli' },
+      testDir
+    );
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('Project name');
+  });
+
+  it('checks folder existence using project-name', () => {
+    const result = validateCreateHarnessOptions({ name: 'ValidHarness2', projectName: 'existingProject' }, testDir);
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('existingProject');
+  });
+});
diff --git a/src/cli/commands/create/action.ts b/src/cli/commands/create/action.ts
index dbfc215d7..a00397f38 100644
--- a/src/cli/commands/create/action.ts
+++ b/src/cli/commands/create/action.ts
@@ -11,6 +11,7 @@ import type {
 import { getErrorMessage } from '../../errors';
 import { checkCreateDependencies } from '../../external-requirements';
 import { initGitRepo, setupPythonProject, writeEnvFile, writeGitignore } from '../../operations';
+import { createConfigBundleForAgent } from '../../operations/agent/config-bundle-defaults';
 import {
   mapGenerateConfigToRenderConfig,
   mapModelProviderToIdentityProviders,
@@ -131,6 +132,7 @@ export interface CreateWithAgentOptions {
   idleTimeout?: number;
   maxLifetime?: number;
   sessionStorageMountPath?: string;
+  withConfigBundle?: boolean;
   skipGit?: boolean;
   skipInstall?: boolean;
   skipPythonSetup?: boolean;
@@ -156,6 +158,7 @@ export async function createProjectWithAgent(options: CreateWithAgentOptions): P
     idleTimeout,
     maxLifetime: maxLifetimeOpt,
     sessionStorageMountPath,
+    withConfigBundle,
     skipGit,
     skipInstall,
     skipPythonSetup,
@@ -245,6 +248,7 @@ export async function createProjectWithAgent(options: CreateWithAgentOptions): P
       ...(idleTimeout !== undefined && { idleRuntimeSessionTimeout: idleTimeout }),
       ...(maxLifetimeOpt !== undefined && { maxLifetime: maxLifetimeOpt }),
       ...(sessionStorageMountPath && { sessionStorageMountPath }),
+      ...(withConfigBundle && { withConfigBundle }),
     };
 
     // Resolve credential strategy FIRST (new project has no existing credentials)
@@ -286,6 +290,11 @@ export async function createProjectWithAgent(options: CreateWithAgentOptions): P
     }
     onProgress?.('Add agent to project', 'done');
 
+    // Auto-create config bundle when opted in
+    if (withConfigBundle) {
+      await createConfigBundleForAgent(agentName, configBaseDir);
+    }
+
     // Set up Python environment if needed (unless skipped)
     if (language === 'Python' && !skipPythonSetup && !skipInstall) {
       onProgress?.('Set up Python environment', 'start');
diff --git a/src/cli/commands/create/command.tsx b/src/cli/commands/create/command.tsx
index ac9d4b3ae..9be7e7bf0 100644
--- a/src/cli/commands/create/command.tsx
+++ b/src/cli/commands/create/command.tsx
@@ -1,6 +1,7 @@
 import { getWorkingDirectory } from '../../../lib';
 import type {
   BuildType,
+  HarnessModelProvider,
   ModelProvider,
   NetworkMode,
   ProtocolMode,
@@ -9,16 +10,42 @@ import type {
 } from '../../../schema';
 import { LIFECYCLE_TIMEOUT_MAX, LIFECYCLE_TIMEOUT_MIN } from '../../../schema';
 import { getErrorMessage } from '../../errors';
+import { harnessPrimitive } from '../../primitives/registry';
 import { COMMAND_DESCRIPTIONS } from '../../tui/copy';
 import { requireTTY } from '../../tui/guards';
 import { CreateScreen } from '../../tui/screens/create';
 import { parseCommaSeparatedList } from '../shared/vpc-utils';
 import { type ProgressCallback, createProject, createProjectWithAgent, getDryRunInfo } from './action';
+import { createProjectWithHarness } from './harness-action';
+import { normalizeHarnessModelProvider, validateCreateHarnessOptions } from './harness-validate';
 import type { CreateOptions } from './types';
 import { validateCreateOptions } from './validate';
 import type { Command } from '@commander-js/extra-typings';
 import { Text, render } from 'ink';
 
+/** Flags that trigger the agent/runtime path */
+const AGENT_PATH_FLAGS = ['framework', 'language', 'build', 'protocol', 'type', 'agentId', 'agentAliasId'] as const;
+
+/** Flags that are harness-only */
+const HARNESS_ONLY_FLAGS = [
+  'modelId',
+  'apiKeyArn',
+  'maxIterations',
+  'maxTokens',
+  'timeout',
+  'truncationStrategy',
+] as const;
+
+/** Determines if the agent path should be taken based on provided flags */
+function isAgentPath(options: CreateOptions): boolean {
+  return AGENT_PATH_FLAGS.some(flag => options[flag] !== undefined);
+}
+
+/** Determines if any harness-only flags are present */
+function hasHarnessOnlyFlags(options: CreateOptions): boolean {
+  return HARNESS_ONLY_FLAGS.some(flag => options[flag] !== undefined);
+}
+
 /** Render CreateScreen for interactive TUI mode */
 function handleCreateTUI(): void {
   const cwd = getWorkingDirectory();
@@ -73,8 +100,115 @@ function printCreateSummary(
   console.log('');
 }
 
-/** Handle CLI mode with progress output */
-async function handleCreateCLI(options: CreateOptions): Promise<void> {
+/** Print completion summary after successful harness create */
+function printCreateHarnessSummary(projectName: string, harnessName: string): void {
+  const green = '\x1b[32m';
+  const cyan = '\x1b[36m';
+  const dim = '\x1b[2m';
+  const reset = '\x1b[0m';
+
+  console.log('');
+
+  // Created summary
+  console.log(`${dim}Created:${reset}`);
+  console.log(`  ${projectName}/`);
+  console.log(`    agentcore/              ${dim}Config and CDK project${reset}`);
+  console.log(`    app/${harnessName}/  ${dim}Harness config${reset}`);
+  console.log('');
+
+  // Success and next steps
+  console.log(`${green}Harness project created successfully!${reset}`);
+  console.log('');
+  console.log('To continue:');
+  console.log(`  ${cyan}cd ${projectName}${reset}`);
+  console.log(`  ${cyan}agentcore deploy${reset}`);
+  console.log('');
+}
+
+/** Handle CLI mode for the harness path */
+async function handleCreateHarnessCLI(options: CreateOptions): Promise<void> {
+  const cwd = options.outputDir ?? getWorkingDirectory();
+  const name = options.name ?? options.projectName;
+  const projectName = options.projectName ?? name;
+
+  const validation = validateCreateHarnessOptions(
+    {
+      name,
+      projectName,
+      modelProvider: options.modelProvider,
+      modelId: options.modelId,
+      apiKeyArn: options.apiKeyArn,
+    },
+    cwd
+  );
+  if (!validation.valid) {
+    if (options.json) {
+      console.log(JSON.stringify({ success: false, error: validation.error }));
+    } else {
+      console.error(validation.error);
+    }
+    process.exit(1);
+  }
+
+  // Progress callback
+  const green = '\x1b[32m';
+  const reset = '\x1b[0m';
+  const onProgress: ProgressCallback | undefined = options.json
+    ? undefined
+    : (step, status) => {
+        if (status === 'done') console.log(`${green}[done]${reset}  ${step}`);
+        else if (status === 'error') console.log(`\x1b[31m[error]${reset} ${step}`);
+      };
+
+  const provider = (
+    options.modelProvider ? normalizeHarnessModelProvider(options.modelProvider) : 'bedrock'
+  ) as HarnessModelProvider;
+  const defaultModelIds: Record<string, string> = {
+    bedrock: 'global.anthropic.claude-sonnet-4-6',
+    open_ai: 'gpt-5',
+    gemini: 'gemini-2.5-flash',
+  };
+  const modelId = options.modelId ?? defaultModelIds[provider] ?? 'global.anthropic.claude-sonnet-4-6';
+
+  const containerOption = harnessPrimitive.parseContainerFlag(options.container);
+
+  const result = await createProjectWithHarness({
+    name: name!,
+    projectName: projectName!,
+    cwd,
+    modelProvider: provider,
+    modelId,
+    apiKeyArn: options.apiKeyArn,
+    containerUri: containerOption.containerUri,
+    dockerfilePath: containerOption.dockerfilePath,
+    skipMemory: options.harnessMemory === false,
+    maxIterations: options.maxIterations ? Number(options.maxIterations) : undefined,
+    maxTokens: options.maxTokens ? Number(options.maxTokens) : undefined,
+    timeoutSeconds: options.timeout ? Number(options.timeout) : undefined,
+    truncationStrategy: options.truncationStrategy as 'sliding_window' | 'summarization' | undefined,
+    networkMode: options.networkMode as NetworkMode | undefined,
+    subnets: parseCommaSeparatedList(options.subnets),
+    securityGroups: parseCommaSeparatedList(options.securityGroups),
+    idleTimeout: options.idleTimeout ? Number(options.idleTimeout) : undefined,
+    maxLifetime: options.maxLifetime ? Number(options.maxLifetime) : undefined,
+    sessionStoragePath: options.sessionStorageMountPath,
+    skipGit: options.skipGit,
+    skipInstall: options.skipInstall,
+    onProgress,
+  });
+
+  if (options.json) {
+    console.log(JSON.stringify(result));
+  } else if (result.success) {
+    printCreateHarnessSummary(projectName!, name!);
+  } else {
+    console.error(result.error);
+  }
+  process.exit(result.success ? 0 : 1);
+}
+
+/** Handle CLI mode with progress output for the agent/runtime path */
+async function handleCreateAgentCLI(options: CreateOptions): Promise<void> {
   const cwd = options.outputDir ?? getWorkingDirectory();
   const name = options.name ?? options.projectName;
   const projectName = options.projectName ?? name;
@@ -91,7 +225,7 @@ async function handleCreateCLI(options: CreateOptions): Promise<void> {
 
   // Handle dry-run mode
   if (options.dryRun) {
-    const result = getDryRunInfo({ name: name!, projectName, cwd, language: options.language });
+    const result = getDryRunInfo({ name: name!, projectName: projectName!, cwd, language: options.language });
     if (options.json) {
       console.log(JSON.stringify(result));
     } else {
@@ -131,7 +265,7 @@ async function handleCreateCLI(options: CreateOptions): Promise<void> {
       })
     : await createProjectWithAgent({
         name: name!,
-        projectName,
+        projectName: projectName!,
         cwd,
         type: options.type as 'create' | 'import' | undefined,
         buildType: (options.build as BuildType) ?? 'CodeZip',
@@ -150,6 +284,7 @@ async function handleCreateCLI(options: CreateOptions): Promise<void> {
         idleTimeout: options.idleTimeout ? Number(options.idleTimeout) : undefined,
         maxLifetime: options.maxLifetime ? Number(options.maxLifetime) : undefined,
         sessionStorageMountPath: options.sessionStorageMountPath,
+        withConfigBundle: options.withConfigBundle,
         skipGit: options.skipGit,
         skipInstall: options.skipInstall,
         skipPythonSetup: options.skipPythonSetup,
@@ -182,14 +317,14 @@ export const registerCreate = (program: Command) => {
       'Project name (start with letter, alphanumeric only, max 23 chars) [non-interactive]'
     )
     .option('--no-agent', 'Skip agent creation [non-interactive]')
-    .option('--defaults', 'Use defaults (Python, Strands, Bedrock, no memory) [non-interactive]')
+    .option('--defaults', 'Use defaults [non-interactive]')
     .option('--build <type>', 'Build type: CodeZip or Container (default: CodeZip) [non-interactive]')
     .option('--language <language>', 'Target language (default: Python) [non-interactive]')
     .option(
       '--framework <framework>',
-      'Agent framework (Strands, LangChain_LangGraph, GoogleADK, OpenAIAgents) [non-interactive]'
+      'Agent framework (Strands, LangChain_LangGraph, GoogleADK, OpenAIAgents); triggers agent/runtime path [non-interactive]'
     )
-    .option('--model-provider <provider>', 'Model provider (Bedrock, Anthropic, OpenAI, Gemini) [non-interactive]')
+    .option('--model-provider <provider>', 'Model provider: bedrock, open_ai, gemini (harness path) [non-interactive]')
     .option('--api-key <key>', 'API key for non-Bedrock providers [non-interactive]')
     .option('--memory <option>', 'Memory option (none, shortTerm, longAndShortTerm) [non-interactive]')
     .option('--protocol <protocol>', 'Protocol: HTTP, MCP, A2A, AGUI (default: HTTP) [non-interactive]')
@@ -212,23 +347,26 @@ export const registerCreate = (program: Command) => {
       '--session-storage-mount-path <path>',
       'Absolute mount path for session filesystem storage under /mnt (e.g. /mnt/data) [non-interactive]'
     )
+    .option('--with-config-bundle', 'Create a config bundle wired into the agent template [preview] [non-interactive]')
     .option('--output-dir <dir>', 'Output directory (default: current directory) [non-interactive]')
     .option('--skip-git', 'Skip git repository initialization [non-interactive]')
     .option('--skip-python-setup', 'Skip Python virtual environment setup [non-interactive]')
     .option('--skip-install', 'Skip all dependency installation (npm install, uv sync) [non-interactive]')
     .option('--dry-run', 'Preview what would be created without making changes [non-interactive]')
     .option('--json', 'Output as JSON [non-interactive]')
+    .option('--model-id <id>', 'Model ID for harness [non-interactive]')
+    .option('--api-key-arn <arn>', 'API key ARN for non-Bedrock harness providers [non-interactive]')
+    .option('--no-harness-memory', 'Skip auto-creating memory for harness [non-interactive]')
+    .option('--max-iterations <n>', 'Max agent loop iterations (harness) [non-interactive]')
+    .option('--max-tokens <n>', 'Max tokens per iteration (harness) [non-interactive]')
+    .option('--timeout <seconds>', 'Max execution duration in seconds (harness) [non-interactive]')
+    .option(
+      '--truncation-strategy <strategy>',
+      'Truncation strategy: sliding_window or summarization (harness) [non-interactive]'
+    )
+    .option('--container <uri-or-path>', 'Container image URI or Dockerfile path (harness) [non-interactive]')
     .action(async options => {
       try {
-        // Apply defaults if --defaults flag is set
-        if (options.defaults) {
-          options.language = options.language ?? 'Python';
-          options.build = options.build ?? 'CodeZip';
-          options.framework = options.framework ?? 'Strands';
-          options.modelProvider = options.modelProvider ?? 'Bedrock';
-          options.memory = options.memory ?? 'none';
-        }
-
         // Any flag triggers non-interactive CLI mode
         const hasAnyFlag = Boolean(
           options.name ??
@@ -241,22 +379,78 @@ export const registerCreate = (program: Command) => {
           options.modelProvider ??
           options.apiKey ??
           options.memory ??
+          options.protocol ??
+          options.type ??
+          options.agentId ??
+          options.agentAliasId ??
+          options.region ??
+          options.networkMode ??
+          options.subnets ??
+          options.securityGroups ??
+          options.idleTimeout ??
+          options.maxLifetime ??
           options.outputDir ??
           options.skipGit ??
           options.skipPythonSetup ??
           options.skipInstall ??
           options.dryRun ??
-          options.json
+          options.json ??
+          options.modelId ??
+          options.apiKeyArn ??
+          (options.harnessMemory === false ? true : null) ??
+          options.maxIterations ??
+          options.maxTokens ??
+          options.timeout ??
+          options.truncationStrategy
         );
 
-        if (hasAnyFlag) {
-          // Default language to Python (only supported option) for CLI mode
-          options.language = options.language ?? 'Python';
-          await handleCreateCLI(options as CreateOptions);
-        } else {
+        if (!hasAnyFlag) {
           requireTTY();
           handleCreateTUI();
+          return;
+        }
+
+        // CLI mode: fork between harness and agent paths
+        const opts = options as CreateOptions;
+
+        // Conflict detection: agent-path flags + harness-only flags
+        if (isAgentPath(opts) && hasHarnessOnlyFlags(opts)) {
+          const error =
+            'Cannot mix agent-path flags (--framework, --language, etc.) with harness-only flags (--model-id, --max-iterations, etc.)';
+          if (opts.json) {
+            console.log(JSON.stringify({ success: false, error }));
+          } else {
+            console.error(error);
+          }
+          process.exit(1);
+        }
+
+        // --no-agent: bare project (no harness, no agent)
+        if (opts.agent === false) {
+          await handleCreateAgentCLI(opts);
+          return;
+        }
+
+        // Agent path: any agent-specific flag triggers it
+        if (isAgentPath(opts)) {
+          // Apply agent defaults if --defaults
+          if (opts.defaults) {
+            opts.language = opts.language ?? 'Python';
+            opts.build = opts.build ?? 'CodeZip';
+            opts.framework = opts.framework ?? 'Strands';
+            opts.modelProvider = opts.modelProvider ?? 'Bedrock';
+            opts.memory = opts.memory ?? 'none';
+          }
+          opts.language = opts.language ?? 'Python';
+          await handleCreateAgentCLI(opts);
+          return;
+        }
+
+        // Harness path (default)
+        if (!opts.json && !opts.modelProvider && !hasHarnessOnlyFlags(opts)) {
+          console.log('Creating a harness project (pass --framework to create an agent project instead).');
         }
+        await handleCreateHarnessCLI(opts);
       } catch (error) {
         render(<Text color="red">Error: {getErrorMessage(error)}</Text>);
         process.exit(1);
diff --git a/src/cli/commands/create/harness-action.ts b/src/cli/commands/create/harness-action.ts
new file mode 100644
index 000000000..6733a780d
--- /dev/null
+++ b/src/cli/commands/create/harness-action.ts
@@ -0,0 +1,100 @@
+import { CONFIG_DIR } from '../../../lib';
+import type { HarnessModelProvider, NetworkMode } from '../../../schema';
+import { getErrorMessage } from '../../errors';
+import { harnessPrimitive } from '../../primitives/registry';
+import { type ProgressCallback, createProject } from './action';
+import type { CreateResult } from './types';
+import { join } from 'path';
+
+export interface CreateHarnessProjectOptions {
+  name: string;
+  projectName?: string;
+  cwd: string;
+  modelProvider: HarnessModelProvider;
+  modelId: string;
+  apiKeyArn?: string;
+  skipMemory?: boolean;
+  containerUri?: string;
+  dockerfilePath?: string;
+  maxIterations?: number;
+  maxTokens?: number;
+  timeoutSeconds?: number;
+  truncationStrategy?: 'sliding_window' | 'summarization';
+  networkMode?: NetworkMode;
+  subnets?: string[];
+  securityGroups?: string[];
+  idleTimeout?: number;
+  maxLifetime?: number;
+  sessionStoragePath?: string;
+  skipGit?: boolean;
+  skipInstall?: boolean;
+  onProgress?: ProgressCallback;
+}
+
+export async function createProjectWithHarness(options: CreateHarnessProjectOptions): Promise<CreateResult> {
+  const { name, projectName: explicitProjectName, cwd, skipGit, skipInstall, onProgress } = options;
+  const projectName = explicitProjectName ?? name;
+
+  const projectResult = await createProject({
+    name: projectName,
+    cwd,
+    skipGit,
+    skipInstall,
+    onProgress,
+  });
+
+  if (!projectResult.success) {
+    return projectResult;
+  }
+
+  const projectRoot = projectResult.projectPath!;
+  const configBaseDir = join(projectRoot, CONFIG_DIR);
+
+  try {
+    onProgress?.('Add harness to project', 'start');
+
+    const harnessResult = await harnessPrimitive.add({
+      name: options.name,
+      modelProvider: options.modelProvider,
+      modelId: options.modelId,
+      apiKeyArn: options.apiKeyArn,
+      containerUri: options.containerUri,
+      dockerfilePath: options.dockerfilePath,
+      skipMemory: options.skipMemory,
+      maxIterations: options.maxIterations,
+      maxTokens: options.maxTokens,
+      timeoutSeconds: options.timeoutSeconds,
+      truncationStrategy: options.truncationStrategy,
+      networkMode: options.networkMode,
+      subnets: options.subnets,
+      securityGroups: options.securityGroups,
+      idleTimeout: options.idleTimeout,
+      maxLifetime: options.maxLifetime,
+      sessionStoragePath: options.sessionStoragePath,
+      configBaseDir,
+    });
+
+    if (!harnessResult.success) {
+      onProgress?.('Add harness to project', 'error');
+      return {
+        success: false,
+        error: harnessResult.error,
+        warnings: projectResult.warnings,
+      };
+    }
+
+    onProgress?.('Add harness to project', 'done');
+
+    return {
+      success: true,
+      projectPath: projectRoot,
+      warnings: projectResult.warnings,
+    };
+  } catch (err) {
+    return {
+      success: false,
+      error: getErrorMessage(err),
+      warnings: projectResult.warnings,
+    };
+  }
+}
diff --git a/src/cli/commands/create/harness-validate.ts b/src/cli/commands/create/harness-validate.ts
new file mode 100644
index 000000000..52f84d6e2
--- /dev/null
+++ b/src/cli/commands/create/harness-validate.ts
@@ -0,0 +1,94 @@
+import { HarnessNameSchema, ProjectNameSchema } from '../../../schema';
+import { validateFolderNotExists } from './validate';
+
+export interface CreateHarnessCliOptions {
+  name?: string;
+  projectName?: string;
+  modelProvider?: string;
+  modelId?: string;
+  apiKeyArn?: string;
+  container?: string;
+  noMemory?: boolean;
+  maxIterations?: string;
+  maxTokens?: string;
+  timeout?: string;
+  truncationStrategy?: string;
+  networkMode?: string;
+  subnets?: string;
+  securityGroups?: string;
+  idleTimeout?: string;
+  maxLifetime?: string;
+  outputDir?: string;
+  skipGit?: boolean;
+  skipInstall?: boolean;
+  dryRun?: boolean;
+  json?: boolean;
+}
+
+export interface ValidationResult {
+  valid: boolean;
+  error?: string;
+}
+
+const MODEL_PROVIDER_MAPPING: Record<string, string> = {
+  bedrock: 'bedrock',
+  Bedrock: 'bedrock',
+  open_ai: 'open_ai',
+  openai: 'open_ai',
+  OpenAI: 'open_ai',
+  anthropic: 'bedrock',
+  Anthropic: 'bedrock',
+  gemini: 'gemini',
+  Gemini: 'gemini',
+};
+
+export function normalizeHarnessModelProvider(raw: string): string | undefined {
+  return MODEL_PROVIDER_MAPPING[raw];
+}
+
+export function validateCreateHarnessOptions(options: CreateHarnessCliOptions, cwd?: string): ValidationResult {
+  if (!options.name) {
+    return { valid: false, error: '--name is required' };
+  }
+
+  const projectName = options.projectName ?? options.name;
+  const projectNameResult = ProjectNameSchema.safeParse(projectName);
+  if (!projectNameResult.success) {
+    return { valid: false, error: projectNameResult.error.issues[0]?.message ?? 'Invalid project name' };
+  }
+
+  const nameResult = HarnessNameSchema.safeParse(options.name);
+  if (!nameResult.success) {
+    return { valid: false, error: nameResult.error.issues[0]?.message ?? 'Invalid harness name' };
+  }
+
+  const folderCheck = validateFolderNotExists(projectName, cwd ?? process.cwd());
+  if (folderCheck !== true) {
+    return { valid: false, error: folderCheck };
+  }
+
+  if (options.modelProvider) {
+    const normalized = normalizeHarnessModelProvider(options.modelProvider);
+    if (!normalized) {
+      return {
+        valid: false,
+        error: `Invalid model provider: ${options.modelProvider}. Use bedrock, open_ai, or gemini`,
+      };
+    }
+    options.modelProvider = normalized;
+  }
+  options.modelProvider ??= 'bedrock';
+
+  const defaultModelIds: Record<string, string> = {
+    bedrock: 'global.anthropic.claude-sonnet-4-6',
+    open_ai: 'gpt-5',
+    gemini: 'gemini-2.5-flash',
+  };
+  options.modelId ??= defaultModelIds[options.modelProvider] ?? 'global.anthropic.claude-sonnet-4-6';
+
+  if (options.modelProvider !== 'bedrock' && !options.apiKeyArn) {
+    return { valid: false, error: `--api-key-arn is required for ${options.modelProvider} provider` };
+  }
+
+  return { valid: true };
+}
diff --git a/src/cli/commands/create/types.ts b/src/cli/commands/create/types.ts
index f870ec1fc..a46a85885 100644
--- a/src/cli/commands/create/types.ts
+++ b/src/cli/commands/create/types.ts
@@ -19,12 +19,22 @@ export interface CreateOptions extends VpcOptions {
   idleTimeout?: number | string;
   maxLifetime?: number | string;
   sessionStorageMountPath?: string;
+  withConfigBundle?: boolean;
   outputDir?: string;
   skipGit?: boolean;
   skipPythonSetup?: boolean;
   skipInstall?: boolean;
   dryRun?: boolean;
   json?: boolean;
+  // Harness-specific
+  modelId?: string;
+  apiKeyArn?: string;
+  container?: string;
+  harnessMemory?: boolean;
+  maxIterations?: string;
+  maxTokens?: string;
+  timeout?: string;
+  truncationStrategy?: string;
 }
 
 export interface CreateResult {
diff --git a/src/cli/commands/deploy/__tests__/progress.test.ts b/src/cli/commands/deploy/__tests__/progress.test.ts
new file mode 100644
index 000000000..8cf902d51
--- /dev/null
+++ b/src/cli/commands/deploy/__tests__/progress.test.ts
@@ -0,0 +1,69 @@
+import { SPINNER_FRAMES, createSpinnerProgress } from '../progress';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+describe('createSpinnerProgress', () => {
+  let writeSpy: ReturnType<typeof vi.spyOn>;
+  let logSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    vi.useFakeTimers();
+    writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    logSpy = vi.spyOn(console, 'log').mockImplementation(() => {
+      // Mock implementation
+    });
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+    vi.restoreAllMocks();
+  });
+
+  it('exports SPINNER_FRAMES array', () => {
+    expect(SPINNER_FRAMES).toHaveLength(10);
+    expect(SPINNER_FRAMES[0]).toBe('⠋');
+  });
+
+  it('shows spinner on start', () => {
+    const { onProgress } = createSpinnerProgress();
+    onProgress('Building', 'start');
+    expect(writeSpy).toHaveBeenCalledWith(expect.stringContaining('Building...'));
+  });
+
+  it('rotates spinner frames on interval', () => {
+    const { onProgress } = createSpinnerProgress();
+    onProgress('Building', 'start');
+    vi.advanceTimersByTime(80);
+    expect(writeSpy).toHaveBeenCalledWith(expect.stringContaining(SPINNER_FRAMES[1]!));
+  });
+
+  it('prints checkmark on success', () => {
+    const { onProgress } = createSpinnerProgress();
+    onProgress('Building', 'start');
+    onProgress('Building', 'success');
+    expect(logSpy).toHaveBeenCalledWith('✓ Building');
+  });
+
+  it('prints cross on error', () => {
+    const { onProgress } = createSpinnerProgress();
+    onProgress('Building', 'start');
+    onProgress('Building', 'error');
+    expect(logSpy).toHaveBeenCalledWith('✗ Building');
+  });
+
+  it('cleanup clears active spinner', () => {
+    const { onProgress, cleanup } = createSpinnerProgress();
+    onProgress('Building', 'start');
+    cleanup();
+    expect(writeSpy).toHaveBeenCalledWith('\r\x1b[K');
+  });
+
+  it('handles sequential steps', () => {
+    const { onProgress } = createSpinnerProgress();
+    onProgress('Step 1', 'start');
+    onProgress('Step 1', 'success');
+    onProgress('Step 2', 'start');
+    onProgress('Step 2', 'success');
+    expect(logSpy).toHaveBeenCalledWith('✓ Step 1');
+    expect(logSpy).toHaveBeenCalledWith('✓ Step 2');
+  });
+});
diff --git a/src/cli/commands/deploy/actions.ts b/src/cli/commands/deploy/actions.ts
index ed88c1dfe..410e3c2b2 100644
--- a/src/cli/commands/deploy/actions.ts
+++ b/src/cli/commands/deploy/actions.ts
@@ -1,7 +1,8 @@
 import { ConfigIO, SecureCredentials } from '../../../lib';
-import type { AgentCoreMcpSpec, DeployedState } from '../../../schema';
+import type { AgentCoreMcpSpec, DeployedState, HarnessDeployedState } from '../../../schema';
 import { applyTargetRegionToEnv } from '../../aws';
 import { validateAwsCredentials } from '../../aws/account';
+import type { DeployMessage } from '../../cdk/toolkit-lib';
 import { createSwitchableIoHost } from '../../cdk/toolkit-lib';
 import {
   buildDeployedState,
@@ -32,7 +33,9 @@ import {
   synthesizeCdk,
   validateProject,
 } from '../../operations/deploy';
+import { computeProjectDeployHash } from '../../operations/deploy/change-detection';
 import { formatTargetStatus, getGatewayTargetStatuses } from '../../operations/deploy/gateway-status';
+import { createDeploymentManager } from '../../operations/deploy/imperative';
 import type { DeployResult } from './types';
 
 export interface ValidatedDeployOptions {
@@ -43,6 +46,7 @@ export interface ValidatedDeployOptions {
   diff?: boolean;
   onProgress?: (step: string, status: 'start' | 'success' | 'error') => void;
   onResourceEvent?: (message: string) => void;
+  onDeployMessage?: (message: DeployMessage) => void;
 }
 
 const AGENT_NEXT_STEPS = ['agentcore invoke', 'agentcore status'];
@@ -225,7 +229,7 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
 
     // Synthesize CloudFormation templates
     startStep('Synthesize CloudFormation');
-    const switchableIoHost = options.verbose ? createSwitchableIoHost() : undefined;
+    const switchableIoHost = options.verbose || options.onDeployMessage ? createSwitchableIoHost() : undefined;
     const synthResult = await synthesizeCdk(
       context.cdkProject,
       switchableIoHost ? { ioHost: switchableIoHost.ioHost } : undefined
@@ -321,13 +325,19 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
 
     // Deploy
     const hasGateways = (mcpSpec?.agentCoreGateways?.length ?? 0) > 0;
-    const deployStepName = hasGateways ? 'Deploying gateways...' : 'Deploy to AWS';
+    const hasHarnessResources = (context.projectSpec.harnesses ?? []).length > 0;
+    const deployStepName = hasGateways
+      ? 'Deploying gateways...'
+      : hasHarnessResources
+        ? 'Deploy stack'
+        : 'Deploy to AWS';
     startStep(deployStepName);
 
     // Enable verbose output for resource-level events
-    if (switchableIoHost && options.onResourceEvent) {
+    if (switchableIoHost && (options.onResourceEvent || options.onDeployMessage)) {
       switchableIoHost.setOnMessage(msg => {
-        options.onResourceEvent!(msg.message);
+        options.onResourceEvent?.(msg.message);
+        options.onDeployMessage?.(msg);
       });
       switchableIoHost.setVerbose(true);
     }
@@ -343,6 +353,34 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
     endStep('success');
 
     if (context.isTeardownDeploy) {
+      // Teardown imperative resources before CDK stack destroy
+      const imperativeManager = createDeploymentManager();
+      const existingTeardownState = await configIO.readDeployedState().catch(() => ({ targets: {} }) as DeployedState);
+      const teardownContext = {
+        projectSpec: context.projectSpec,
+        target,
+        configIO,
+        deployedState: existingTeardownState,
+        onProgress: (step: string, status: 'start' | 'done' | 'error') => {
+          logger.log(`${step}: ${status}`);
+        },
+      };
+
+      if (imperativeManager.hasDeployersForPhase('post-cdk', teardownContext)) {
+        startStep('Tear down imperative resources');
+        const teardownResult = await imperativeManager.teardownAll(teardownContext);
+        if (!teardownResult.success) {
+          endStep('error', teardownResult.error);
+          logger.finalize(false);
+          return {
+            success: false,
+            error: `Imperative teardown failed: ${teardownResult.error}`,
+            logPath: logger.getRelativeLogPath(),
+          };
+        }
+        endStep('success');
+      }
+
       // After deploying the empty spec, destroy the stack entirely
       startStep('Tear down stack');
       const teardown = await performStackTeardown(target.name);
@@ -390,8 +428,12 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
     const evaluators = parseEvaluatorOutputs(outputs, evaluatorNames);
 
     // Parse online eval config outputs
-    const onlineEvalNames = (context.projectSpec.onlineEvalConfigs ?? []).map(c => c.name);
-    const onlineEvalConfigs = parseOnlineEvalOutputs(outputs, onlineEvalNames);
+    const onlineEvalSpecs = (context.projectSpec.onlineEvalConfigs ?? []).map(c => ({
+      name: c.name,
+      agent: c.agent,
+      endpoint: c.endpoint,
+    }));
+    const onlineEvalConfigs = parseOnlineEvalOutputs(outputs, onlineEvalSpecs);
 
     // Parse policy engine outputs
     const policyEngineSpecs = context.projectSpec.policyEngines ?? [];
@@ -426,7 +468,46 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
       ) ?? {};
     const gateways = parseGatewayOutputs(outputs, gatewaySpecs);
 
-    const existingState = await configIO.readDeployedState().catch(() => undefined);
+    endStep('success');
+
+    // Post-CDK: deploy imperative resources (harness)
+    let deployedHarnesses: Record<string, HarnessDeployedState> | undefined;
+    const imperativeManager = createDeploymentManager();
+    const existingState = await configIO.readDeployedState().catch(() => ({ targets: {} }) as DeployedState);
+    const imperativeContext = {
+      projectSpec: context.projectSpec,
+      target,
+      configIO,
+      deployedState: existingState,
+      cdkOutputs: outputs,
+      onProgress: (step: string, status: 'start' | 'done' | 'error') => {
+        logger.log(`${step}: ${status}`);
+      },
+    };
+
+    let harnessDeployError: string | undefined;
+    if (imperativeManager.hasDeployersForPhase('post-cdk', imperativeContext)) {
+      startStep('Deploy harnesses');
+      const postCdkResult = await imperativeManager.runPhase('post-cdk', imperativeContext);
+      const harnessResult = postCdkResult.results.get('harness');
+      if (harnessResult?.state) {
+        deployedHarnesses = harnessResult.state as Record<string, HarnessDeployedState>;
+      }
+      if (!postCdkResult.success) {
+        endStep('error', postCdkResult.error);
+        harnessDeployError = postCdkResult.error;
+      } else {
+        endStep('success');
+      }
+    }
+
+    let deployHash: string | undefined;
+    try {
+      deployHash = await computeProjectDeployHash(configIO);
+    } catch {
+      // hash computation is best-effort
+    }
+
     const deployedState = buildDeployedState({
       targetName: target.name,
       stackName,
@@ -440,10 +521,28 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
       onlineEvalConfigs,
       policyEngines,
       policies,
+      harnesses: deployedHarnesses,
       runtimeEndpoints,
     });
+
+    if (deployHash) {
+      const targetState = deployedState.targets[target.name];
+      if (targetState?.resources) {
+        targetState.resources.deployHash = deployHash;
+      }
+    }
+
     await configIO.writeDeployedState(deployedState);
 
+    if (harnessDeployError) {
+      logger.finalize(false);
+      return {
+        success: false,
+        error: `Harness deployment failed: ${harnessDeployError}`,
+        logPath: logger.getRelativeLogPath(),
+      };
+    }
+
     // Show gateway URLs and target sync status
     if (Object.keys(gateways).length > 0) {
       const gatewayUrls = Object.entries(gateways)
@@ -460,10 +559,10 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
       }
     }
 
-    endStep('success');
-
     // Post-deploy: Enable CloudWatch Transaction Search (non-blocking, silent)
-    const nextSteps = agentNames.length > 0 ? [...AGENT_NEXT_STEPS] : [...MEMORY_ONLY_NEXT_STEPS];
+    const hasHarnesses = (context.projectSpec.harnesses ?? []).length > 0;
+    const hasInvokable = agentNames.length > 0 || hasHarnesses;
+    const nextSteps = hasInvokable ? [...AGENT_NEXT_STEPS] : [...MEMORY_ONLY_NEXT_STEPS];
     const notes: string[] = [];
     if (agentNames.length > 0 || hasGateways) {
       try {
@@ -497,6 +596,9 @@ export async function handleDeploy(options: ValidatedDeployOptions): Promise<Dep
       notes,
     };
   } catch (err: unknown) {
+    if (currentStepName) {
+      endStep('error', getErrorMessage(err));
+    }
     logger.log(getErrorMessage(err), 'error');
     logger.finalize(false);
     return { success: false, error: getErrorMessage(err), logPath: logger.getRelativeLogPath() };
diff --git a/src/cli/commands/deploy/command.tsx b/src/cli/commands/deploy/command.tsx
index 5870c7ff8..fc235ac51 100644
--- a/src/cli/commands/deploy/command.tsx
+++ b/src/cli/commands/deploy/command.tsx
@@ -3,14 +3,13 @@ import { COMMAND_DESCRIPTIONS } from '../../tui/copy';
 import { requireProject, requireTTY } from '../../tui/guards';
 import { DeployScreen } from '../../tui/screens/deploy/DeployScreen';
 import { handleDeploy } from './actions';
+import { createSpinnerProgress } from './progress';
 import type { DeployOptions } from './types';
 import { validateDeployOptions } from './validate';
 import type { Command } from '@commander-js/extra-typings';
 import { Text, render } from 'ink';
 import React from 'react';
 
-const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
-
 function handleDeployTUI(options: { autoConfirm?: boolean; diffMode?: boolean } = {}): void {
   requireProject();
 
@@ -38,30 +37,8 @@ async function handleDeployCLI(options: DeployOptions): Promise<void> {
     process.exit(1);
   }
 
-  let spinner: NodeJS.Timeout | undefined;
-
-  // Progress callback for --progress mode
-  const onProgress = options.progress
-    ? (step: string, status: 'start' | 'success' | 'error') => {
-        if (spinner) {
-          clearInterval(spinner);
-          process.stdout.write('\r\x1b[K'); // Clear line
-        }
-
-        if (status === 'start') {
-          let i = 0;
-          process.stdout.write(`${SPINNER_FRAMES[0]} ${step}...`);
-          spinner = setInterval(() => {
-            i = (i + 1) % SPINNER_FRAMES.length;
-            process.stdout.write(`\r${SPINNER_FRAMES[i]} ${step}...`);
-          }, 80);
-        } else if (status === 'success') {
-          console.log(`✓ ${step}`);
-        } else {
-          console.log(`✗ ${step}`);
-        }
-      }
-    : undefined;
+  const progressUtil = options.progress ? createSpinnerProgress() : undefined;
+  const onProgress = progressUtil?.onProgress;
 
   const onResourceEvent = options.verbose
     ? (message: string) => {
@@ -79,10 +56,7 @@ async function handleDeployCLI(options: DeployOptions): Promise<void> {
     onResourceEvent,
   });
 
-  if (spinner) {
-    clearInterval(spinner);
-    process.stdout.write('\r\x1b[K');
-  }
+  progressUtil?.cleanup();
 
   if (options.json) {
     console.log(JSON.stringify(result));
@@ -103,6 +77,13 @@ async function handleDeployCLI(options: DeployOptions): Promise<void> {
         }
       }
 
+      if (result.postDeployWarnings && result.postDeployWarnings.length > 0) {
+        console.log('\n⚠ Post-deploy warnings:');
+        for (const warning of result.postDeployWarnings) {
+          console.log(`  ${warning}`);
+        }
+      }
+
       if (result.notes && result.notes.length > 0) {
         for (const note of result.notes) {
           console.log(`\nNote: ${note}`);
@@ -124,7 +105,8 @@ async function handleDeployCLI(options: DeployOptions): Promise<void> {
     }
   }
 
-  process.exit(result.success ? 0 : 1);
+  const hasPostDeployWarnings = result.success && result.postDeployWarnings && result.postDeployWarnings.length > 0;
+  process.exit(result.success ? (hasPostDeployWarnings ? 2 : 0) : 1);
 }
 
 export const registerDeploy = (program: Command) => {
diff --git a/src/cli/commands/deploy/progress.ts b/src/cli/commands/deploy/progress.ts
new file mode 100644
index 000000000..a8dff1cd0
--- /dev/null
+++ b/src/cli/commands/deploy/progress.ts
@@ -0,0 +1,104 @@
+import { ConfigIO } from '../../../lib';
+import { detectAwsContext } from '../../aws/aws-context';
+import { getErrorMessage } from '../../errors';
+import { canSkipDeploy } from '../../operations/deploy/change-detection';
+import { handleDeploy } from './actions';
+
+export const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+
+export interface SpinnerProgress {
+  onProgress: (step: string, status: 'start' | 'success' | 'error') => void;
+  cleanup: () => void;
+}
+
+export function createSpinnerProgress(): SpinnerProgress {
+  let spinner: NodeJS.Timeout | undefined;
+
+  const clearSpinner = () => {
+    if (spinner) {
+      clearInterval(spinner);
+      spinner = undefined;
+      process.stdout.write('\r\x1b[K');
+    }
+  };
+
+  const onProgress = (step: string, status: 'start' | 'success' | 'error') => {
+    clearSpinner();
+
+    if (status === 'start') {
+      let i = 0;
+      process.stdout.write(`${SPINNER_FRAMES[0]} ${step}...`);
+      spinner = setInterval(() => {
+        i = (i + 1) % SPINNER_FRAMES.length;
+        process.stdout.write(`\r${SPINNER_FRAMES[i]} ${step}...`);
+      }, 80);
+    } else if (status === 'success') {
+      console.log(`✓ ${step}`);
+    } else {
+      console.log(`✗ ${step}`);
+    }
+  };
+
+  return { onProgress, cleanup: clearSpinner };
+}
+
+export async function runCliDeploy(): Promise<void> {
+  console.log('Deploying project resources...');
+  const { onProgress, cleanup } = createSpinnerProgress();
+
+  try {
+    // Auto-populate aws-targets.json if empty
+    const configIO = new ConfigIO();
+    try {
+      const targets = await configIO.readAWSDeploymentTargets();
+      if (targets.length === 0) {
+        const ctx = await detectAwsContext();
+        if (ctx.accountId) {
+          await configIO.writeAWSDeploymentTargets([{ name: 'default', account: ctx.accountId, region: ctx.region }]);
+        }
+      }
+    } catch {
+      // aws-targets.json doesn't exist — try to create it
+      try {
+        const ctx = await detectAwsContext();
+        if (ctx.accountId) {
+          await configIO.writeAWSDeploymentTargets([{ name: 'default', account: ctx.accountId, region: ctx.region }]);
+        }
+      } catch {
+        // Can't detect — let handleDeploy fail with a clear error
+      }
+    }
+
+    const noChanges = await canSkipDeploy(configIO);
+    if (noChanges) {
+      onProgress('No changes detected — skipping deploy', 'success');
+      cleanup();
+      console.log('');
+      return;
+    }
+
+    const result = await handleDeploy({
+      target: 'default',
+      autoConfirm: true,
+      onProgress,
+    });
+    cleanup();
+
+    if (result.success) {
+      console.log('Deploy complete.');
+      if (result.logPath) {
+        console.log(`Deploy log: ${result.logPath}`);
+      }
+      console.log('');
+    } else {
+      console.warn(`\x1b[33mDeploy failed: ${result.error}. Starting dev server anyway...\x1b[0m`);
+      if (result.logPath) {
+        console.warn(`Deploy log: ${result.logPath}`);
+      }
+      console.log('');
+    }
+  } catch (deployErr) {
+    cleanup();
+    console.warn(`\x1b[33mDeploy failed: ${getErrorMessage(deployErr)}. Starting dev server anyway...\x1b[0m\n`);
+  }
+}
diff --git a/src/cli/commands/deploy/types.ts b/src/cli/commands/deploy/types.ts
index 16d4f39a2..44cdc7847 100644
--- a/src/cli/commands/deploy/types.ts
+++ b/src/cli/commands/deploy/types.ts
@@ -16,6 +16,7 @@ export interface DeployResult {
   logPath?: string;
   nextSteps?: string[];
   notes?: string[];
+  postDeployWarnings?: string[];
   error?: string;
 }
 
diff --git a/src/cli/commands/dev/browser-mode.ts b/src/cli/commands/dev/browser-mode.ts
index c35113e6d..77342e7f1 100644
--- a/src/cli/commands/dev/browser-mode.ts
+++ b/src/cli/commands/dev/browser-mode.ts
@@ -8,10 +8,15 @@ import {
   type RetrieveMemoryRecordsHandler,
   runWebUI,
 } from '../../operations/dev/web-ui';
+import type { HarnessInfo } from '../../operations/dev/web-ui/constants';
 import { listMemoryRecords, retrieveMemoryRecords } from '../../operations/memory';
-import { loadDeployedProjectConfig, resolveAgent } from '../../operations/resolve-agent';
+import { loadDeployedProjectConfig, resolveAgentOrHarness } from '../../operations/resolve-agent';
 import { fetchTraceRecords, listTraces } from '../../operations/traces';
+import { LayoutProvider } from '../../tui/context';
+import { runCliDeploy } from '../deploy/progress';
+import { render } from 'ink';
 import path from 'node:path';
+import React from 'react';
 
 interface DeployedHandlers {
   onListMemoryRecords?: ListMemoryRecordsHandler;
@@ -96,6 +101,7 @@ export interface BrowserModeOptions {
   project: AgentCoreProjectSpec;
   port: number;
   agentName?: string;
+  harnessName?: string;
   /** OTEL env vars to pass to dev servers (set by the dev command when collector is active) */
   otelEnvVars?: Record<string, string>;
   /** OTEL collector instance for local trace collection */
@@ -110,11 +116,21 @@ export async function launchBrowserDev(): Promise<void> {
   const workingDir = getWorkingDirectory();
   const project = await loadProjectConfig(workingDir);
 
-  if (!project?.runtimes || project.runtimes.length === 0) {
-    console.error('Error: No agents defined in project.');
+  if (!project) {
+    console.error('Error: No agents or harnesses defined in project.');
     process.exit(1);
   }
 
+  const hasRuntimes = project.runtimes.length > 0;
+  const hasHarnesses = (project.harnesses ?? []).length > 0;
+
+  if (!hasRuntimes && !hasHarnesses) {
+    console.error('Error: No agents or harnesses defined in project.');
+    process.exit(1);
+  }
+
+  await runCliDeploy();
+
   const configRoot = findConfigRoot(workingDir);
   const persistTracesDir = path.join(configRoot ?? workingDir, '.cli', 'traces');
   const { collector, otelEnvVars } = await startOtelCollector(persistTracesDir);
@@ -129,14 +145,15 @@ export async function launchBrowserDev(): Promise<void> {
 }
 
 export async function runBrowserMode(opts: BrowserModeOptions): Promise<void> {
-  const { workingDir, project, agentName, otelEnvVars = {}, collector } = opts;
+  const { workingDir, project, agentName, harnessName, otelEnvVars = {}, collector } = opts;
 
   const configRoot = findConfigRoot(workingDir);
   const { envVars } = await loadDevEnv(workingDir);
 
   const supportedAgents = getDevSupportedAgents(project);
+  const projectHasHarnesses = (project.harnesses ?? []).length > 0;
 
-  if (supportedAgents.length === 0) {
+  if (supportedAgents.length === 0 && !projectHasHarnesses) {
     console.error('Error: No dev-supported agents found.');
     process.exit(1);
   }
@@ -163,13 +180,50 @@ export async function runBrowserMode(opts: BrowserModeOptions): Promise<void> {
   // Handlers re-resolve on each call so newly deployed memories are picked up.
   const baseDir = configRoot ?? workingDir;
 
+  // Discover deployed harnesses from project config + deployed state
+  const harnessInfoList: HarnessInfo[] = [];
+  try {
+    const configIO = new ConfigIO({ baseDir });
+    if (configIO.configExists('state') && configIO.configExists('awsTargets')) {
+      const deployedState = await configIO.readDeployedState();
+      const awsTargets = await configIO.readAWSDeploymentTargets();
+      const targetName = Object.keys(deployedState.targets)[0];
+      if (targetName) {
+        const targetState = deployedState.targets[targetName];
+        const targetConfig = awsTargets.find(t => t.name === targetName);
+        if (targetConfig) {
+          for (const harness of project.harnesses ?? []) {
+            const state = targetState?.resources?.harnesses?.[harness.name];
+            if (state) {
+              harnessInfoList.push({
+                name: harness.name,
+                harnessArn: state.harnessArn,
+                region: targetConfig.region,
+              });
+            }
+          }
+          if (harnessInfoList.length > 0) {
+            onLog(
+              'info',
+              `Found ${harnessInfoList.length} deployed harness(es): ${harnessInfoList.map(h => h.name).join(', ')}`
+            );
+          }
+        }
+      }
+    }
+  } catch {
+    // Harness discovery is best-effort — local dev works without it
+  }
+
   await runWebUI({
     logLabel: 'dev',
     onLog,
     serverOptions: {
       mode: 'dev',
       agents: agentInfoList,
+      harnesses: harnessInfoList,
       selectedAgent: agentName,
+      selectedHarness: harnessName,
       envVars: mergedEnvVars,
       getEnvVars: async () => {
         const { envVars: freshEnvVars } = await loadDevEnv(workingDir);
@@ -194,11 +248,11 @@ export async function runBrowserMode(opts: BrowserModeOptions): Promise<void> {
         ? (agentNameParam, startTime, endTime) => collector.listTraces(agentNameParam, startTime, endTime)
         : undefined,
       onGetTrace: collector ? (agentNameParam, traceId) => collector.getTraceSpans(agentNameParam, traceId) : undefined,
-      onListCloudWatchTraces: async (agentName, _harnessName, startTime, endTime) => {
+      onListCloudWatchTraces: async (agentName, harnessName, startTime, endTime) => {
         try {
           const configIO = new ConfigIO({ baseDir });
           const context = await loadDeployedProjectConfig(configIO);
-          const resolved = resolveAgent(context, { runtime: agentName });
+          const resolved = await resolveAgentOrHarness(context, { runtime: agentName, harness: harnessName });
           if (!resolved.success) return { success: false, error: resolved.error };
           return listTraces({
             region: resolved.agent.region,
@@ -214,11 +268,11 @@ export async function runBrowserMode(opts: BrowserModeOptions): Promise<void> {
           };
         }
       },
-      onGetCloudWatchTrace: async (agentName, _harnessName, traceId, startTime, endTime) => {
+      onGetCloudWatchTrace: async (agentName, harnessName, traceId, startTime, endTime) => {
         try {
           const configIO = new ConfigIO({ baseDir });
           const context = await loadDeployedProjectConfig(configIO);
-          const resolved = resolveAgent(context, { runtime: agentName });
+          const resolved = await resolveAgentOrHarness(context, { runtime: agentName, harness: harnessName });
           if (!resolved.success) return { success: false, error: resolved.error };
           return fetchTraceRecords({
             region: resolved.agent.region,
@@ -248,3 +302,51 @@ export async function runBrowserMode(opts: BrowserModeOptions): Promise<void> {
     },
   });
 }
+
+const ENTER_ALT_SCREEN = '\x1B[?1049h\x1B[H';
+const EXIT_ALT_SCREEN = '\x1B[?1049l';
+const SHOW_CURSOR = '\x1B[?25h';
+
+interface TuiPickerResult {
+  agentName?: string;
+  harnessName?: string;
+}
+
+export async function launchTuiDevScreenWithPicker(
+  workingDir: string,
+  options?: { skipDeploy?: boolean }
+): Promise<TuiPickerResult | undefined> {
+  process.stdout.write(ENTER_ALT_SCREEN);
+
+  const exitAltScreen = () => {
+    process.stdout.write(EXIT_ALT_SCREEN);
+    process.stdout.write(SHOW_CURSOR);
+  };
+
+  let pickerResult: TuiPickerResult | undefined;
+  const { DevScreen } = await import('../../tui/screens/dev/DevScreen');
+  const { unmount, waitUntilExit } = render(
+    React.createElement(
+      LayoutProvider,
+      null,
+      React.createElement(DevScreen, {
+        onBack: () => {
+          exitAltScreen();
+          unmount();
+          process.exit(0);
+        },
+        workingDir,
+        skipDeploy: options?.skipDeploy,
+        onLaunchBrowser: (selection?: { agentName?: string; harnessName?: string }) => {
+          pickerResult = selection ?? {};
+          exitAltScreen();
+          unmount();
+        },
+      })
+    )
+  );
+
+  await waitUntilExit();
+  exitAltScreen();
+  return pickerResult;
+}
diff --git a/src/cli/commands/dev/command.tsx b/src/cli/commands/dev/command.tsx
index eac485d8c..6f136cb79 100644
--- a/src/cli/commands/dev/command.tsx
+++ b/src/cli/commands/dev/command.tsx
@@ -22,8 +22,9 @@ import { FatalError } from '../../tui/components';
 import { LayoutProvider } from '../../tui/context';
 import { COMMAND_DESCRIPTIONS } from '../../tui/copy';
 import { requireProject, requireTTY } from '../../tui/guards';
+import { runCliDeploy } from '../deploy/progress';
 import { parseHeaderFlags } from '../shared/header-utils';
-import { runBrowserMode } from './browser-mode';
+import { launchTuiDevScreenWithPicker, runBrowserMode } from './browser-mode';
 import type { Command } from '@commander-js/extra-typings';
 import { spawn } from 'child_process';
 import { Text, render } from 'ink';
@@ -178,6 +179,7 @@ export const registerDev = (program: Command) => {
     .option('--exec', 'Execute a shell command in the running dev container (Container agents only) [non-interactive]')
     .option('--tool <name>', 'MCP tool name (used with "call-tool" prompt) [non-interactive]')
     .option('--input <json>', 'MCP tool arguments as JSON (used with --tool) [non-interactive]')
+    .option('--skip-deploy', 'Skip automatic resource deployment before starting dev server')
     .option(
       '-H, --header <header>',
       'Custom header to forward to the agent (format: "Name: Value", repeatable) [non-interactive]',
@@ -268,8 +270,13 @@ export const registerDev = (program: Command) => {
           process.exit(1);
         }
 
-        if (!project.runtimes || project.runtimes.length === 0) {
-          render(<FatalError message="No agents defined in project." suggestedCommand="agentcore add agent" />);
+        const hasRuntimes = project.runtimes && project.runtimes.length > 0;
+        const hasHarnesses = project.harnesses && project.harnesses.length > 0;
+
+        if (!hasRuntimes && !hasHarnesses) {
+          render(
+            <FatalError message="No agents or harnesses defined in project." suggestedCommand="agentcore add agent" />
+          );
           process.exit(1);
         }
 
@@ -282,9 +289,9 @@ export const registerDev = (program: Command) => {
         }
 
         const supportedAgents = getDevSupportedAgents(project);
-        if (supportedAgents.length === 0) {
+        if (supportedAgents.length === 0 && !hasHarnesses) {
           render(
-            <FatalError message="No agents support dev mode. Dev mode requires Python agents with an entrypoint." />
+            <FatalError message="No agents support dev mode. Dev mode requires Python agents with an entrypoint or a harness." />
           );
           process.exit(1);
         }
@@ -304,6 +311,23 @@ export const registerDev = (program: Command) => {
 
         // If --logs provided, run non-interactive mode
         if (opts.logs) {
+          if (supportedAgents.length === 0 && hasHarnesses) {
+            // Harnesses run in the cloud — no local server to tail.
+            // Deploy if needed, then print the config change warning and invoke instructions.
+            if (!opts.skipDeploy) {
+              await runCliDeploy();
+            }
+            const harnessNames = (project.harnesses ?? []).map(h => h.name);
+            console.log('Harness dev runs against the deployed service (no local server).');
+            console.log(`If you changed the harness config, redeploy to pick up changes: agentcore deploy`);
+            console.log(`\nInvoke your harness:`);
+            for (const name of harnessNames) {
+              console.log(`  agentcore invoke --harness ${name} "your prompt"`);
+            }
+            console.log(`\nOr use the interactive TUI: agentcore dev`);
+            process.exit(0);
+          }
+
           // Require --agent if multiple agents
           if (project.runtimes.length > 1 && !opts.runtime) {
             const names = project.runtimes.map(a => a.name).join(', ');
@@ -341,6 +365,11 @@ export const registerDev = (program: Command) => {
           // Get provider info from agent config
           const providerInfo = '(see agent code)';
 
+          // Deploy resources before starting dev server
+          if (!opts.skipDeploy) {
+            await runCliDeploy();
+          }
+
           console.log(`Starting dev server...`);
           console.log(`Agent: ${config.agentName}`);
           if (config.protocol !== 'MCP') {
@@ -405,6 +434,7 @@ export const registerDev = (program: Command) => {
                 port={port}
                 agentName={opts.runtime}
                 headers={headers}
+                skipDeploy={opts.skipDeploy}
               />
             </LayoutProvider>
           );
@@ -414,15 +444,22 @@ export const registerDev = (program: Command) => {
           return;
         }
 
-        // Default: launch web UI in browser
-        await runBrowserMode({
-          workingDir,
-          project,
-          port,
-          agentName: opts.runtime,
-          otelEnvVars,
-          collector,
+        // Show TUI deploy progress, then launch Agent Inspector in the browser
+        const pickerResult = await launchTuiDevScreenWithPicker(workingDir, {
+          skipDeploy: opts.skipDeploy,
         });
+
+        if (pickerResult != null) {
+          await runBrowserMode({
+            workingDir,
+            project,
+            port,
+            agentName: pickerResult.agentName,
+            harnessName: pickerResult.harnessName,
+            otelEnvVars,
+            collector,
+          });
+        }
       } catch (error) {
         render(<Text color="red">Error: {getErrorMessage(error)}</Text>);
         process.exit(1);
diff --git a/src/cli/commands/fetch/action.ts b/src/cli/commands/fetch/action.ts
index c8bd44091..839cc0a39 100644
--- a/src/cli/commands/fetch/action.ts
+++ b/src/cli/commands/fetch/action.ts
@@ -1,5 +1,6 @@
 import { fetchGatewayToken, fetchRuntimeToken, listGateways } from '../../operations/fetch-access';
 import type { OAuthTokenResult, TokenFetchResult } from '../../operations/fetch-access';
+import { fetchHarnessToken } from '../../operations/fetch-access/fetch-harness-token';
 import type { FetchAccessOptions } from './types';
 
 export interface FetchAccessResult {
@@ -16,6 +17,10 @@ export async function handleFetchAccess(options: FetchAccessOptions): Promise<Fe
     return handleFetchAgentAccess(options);
   }
 
+  if (resourceType === 'harness') {
+    return handleFetchHarnessAccess(options);
+  }
+
   return handleFetchGatewayAccess(options);
 }
 
@@ -64,3 +69,28 @@ async function handleFetchAgentAccess(options: FetchAccessOptions): Promise<Fetc
     },
   };
 }
+
+async function handleFetchHarnessAccess(options: FetchAccessOptions): Promise<FetchAccessResult> {
+  if (!options.name) {
+    return { success: false, error: 'Missing required option: --name <harness>' };
+  }
+
+  let tokenResult: OAuthTokenResult;
+  try {
+    tokenResult = await fetchHarnessToken(options.name, {
+      deployTarget: options.target,
+    });
+  } catch (err) {
+    return { success: false, error: err instanceof Error ? err.message : String(err) };
+  }
+
+  return {
+    success: true,
+    result: {
+      url: '',
+      authType: 'CUSTOM_JWT',
+      token: tokenResult.token,
+      expiresIn: tokenResult.expiresIn,
+    },
+  };
+}
diff --git a/src/cli/commands/fetch/command.tsx b/src/cli/commands/fetch/command.tsx
index 3b93dd924..2d6753a00 100644
--- a/src/cli/commands/fetch/command.tsx
+++ b/src/cli/commands/fetch/command.tsx
@@ -12,9 +12,9 @@ export const registerFetch = (program: Command) => {
 
   fetchCmd
     .command('access')
-    .description('Fetch access info (URL, token, auth guidance) for a deployed gateway or agent.')
-    .option('--name <resource>', 'Gateway or agent name [non-interactive]')
-    .option('--type <type>', 'Resource type: gateway (default) or agent [non-interactive]', 'gateway')
+    .description('Fetch access info (URL, token, auth guidance) for a deployed gateway, agent, or harness.')
+    .option('--name <resource>', 'Gateway, agent, or harness name [non-interactive]')
+    .option('--type <type>', 'Resource type: gateway (default), agent, or harness [non-interactive]', 'gateway')
     .option('--target <target>', 'Deployment target [non-interactive]')
     .option('--identity-name <name>', 'Identity credential name for token fetch [non-interactive]')
     .option('--json', 'Output as JSON [non-interactive]')
diff --git a/src/cli/commands/fetch/types.ts b/src/cli/commands/fetch/types.ts
index 43b12d9cc..c507a05a7 100644
--- a/src/cli/commands/fetch/types.ts
+++ b/src/cli/commands/fetch/types.ts
@@ -1,4 +1,4 @@
-export type FetchResourceType = 'gateway' | 'agent';
+export type FetchResourceType = 'gateway' | 'agent' | 'harness';
 
 export interface FetchAccessOptions {
   name?: string;
diff --git a/src/cli/commands/import/command.ts b/src/cli/commands/import/command.ts
index df4c3c0c7..381167aaa 100644
--- a/src/cli/commands/import/command.ts
+++ b/src/cli/commands/import/command.ts
@@ -13,7 +13,7 @@ const { green, yellow, cyan, dim, reset } = ANSI;
 export const registerImport = (program: Command) => {
   const importCmd = program
     .command('import')
-    .description('Import a runtime, memory, gateway, or starter toolkit into this project.');
+    .description('Import a runtime, memory, or starter toolkit into this project.');
 
   // Existing YAML flow: agentcore import --source <path>
   importCmd
diff --git a/src/cli/commands/import/import-evaluator.ts b/src/cli/commands/import/import-evaluator.ts
index be85829f3..7c6c8b0d2 100644
--- a/src/cli/commands/import/import-evaluator.ts
+++ b/src/cli/commands/import/import-evaluator.ts
@@ -10,6 +10,7 @@ import { ANSI } from './constants';
 import { failResult, parseAndValidateArn } from './import-utils';
 import { executeResourceImport } from './resource-import';
 import type { ImportResourceOptions, ImportResourceResult, ResourceImportDescriptor } from './types';
+import { ResourceNotFoundException } from '@aws-sdk/client-bedrock-agentcore-control';
 import type { Command } from '@commander-js/extra-typings';
 
 /**
@@ -92,11 +93,18 @@ const evaluatorDescriptor: ResourceImportDescriptor<GetEvaluatorResult, Evaluato
 
     const oecSummaries = await listAllOnlineEvaluationConfigs({ region: target.region });
     if (oecSummaries.length > 0) {
-      const oecDetails = await Promise.all(
-        oecSummaries.map(s =>
-          getOnlineEvaluationConfig({ region: target.region, configId: s.onlineEvaluationConfigId })
+      // Configs can be deleted between list and get (TOCTOU race).
+      // Skip ResourceNotFoundException — a deleted config can't be locking our evaluator.
+      const oecDetails = (
+        await Promise.all(
+          oecSummaries.map(s =>
+            getOnlineEvaluationConfig({ region: target.region, configId: s.onlineEvaluationConfigId }).catch(err => {
+              if (err instanceof ResourceNotFoundException) return null;
+              throw err;
+            })
+          )
         )
-      );
+      ).filter(r => r !== null);
 
       const referencingOec = oecDetails.find(oec => oec.evaluatorIds?.includes(detail.evaluatorId));
 
diff --git a/src/cli/commands/index.ts b/src/cli/commands/index.ts
index c8c1bd68b..a7eda0787 100644
--- a/src/cli/commands/index.ts
+++ b/src/cli/commands/index.ts
@@ -11,6 +11,7 @@ export { registerPause } from './pause';
 export { registerRemove } from './remove';
 export { registerResume } from './resume';
 export { registerRun } from './run';
+export { registerStop } from './stop';
 export { registerStatus } from './status';
 export { registerTraces } from './traces';
 export { registerUpdate } from './update';
diff --git a/src/cli/commands/invoke/__tests__/validate.test.ts b/src/cli/commands/invoke/__tests__/validate.test.ts
index 301d15e6c..5361d93ad 100644
--- a/src/cli/commands/invoke/__tests__/validate.test.ts
+++ b/src/cli/commands/invoke/__tests__/validate.test.ts
@@ -61,4 +61,24 @@ describe('validateInvokeOptions', () => {
   it('returns valid with exec and prompt', () => {
     expect(validateInvokeOptions({ exec: true, prompt: 'ls -la' })).toEqual({ valid: true });
   });
+
+  it('returns invalid when --harness and --runtime are both specified', () => {
+    const result = validateInvokeOptions({ harnessName: 'h1', agentName: 'a1', prompt: 'hi' });
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('cannot be used together');
+  });
+
+  it('returns invalid when --verbose is used without --harness', () => {
+    const result = validateInvokeOptions({ verbose: true, prompt: 'hi' });
+    expect(result.valid).toBe(false);
+    expect(result.error).toContain('only supported with --harness');
+  });
+
+  it('returns valid with --harness and prompt', () => {
+    expect(validateInvokeOptions({ harnessName: 'h1', prompt: 'hi' })).toEqual({ valid: true });
+  });
+
+  it('returns valid with --harness and --verbose', () => {
+    expect(validateInvokeOptions({ harnessName: 'h1', verbose: true, prompt: 'hi' })).toEqual({ valid: true });
+  });
 });
diff --git a/src/cli/commands/invoke/action.ts b/src/cli/commands/invoke/action.ts
index 77d7fdccd..07537202d 100644
--- a/src/cli/commands/invoke/action.ts
+++ b/src/cli/commands/invoke/action.ts
@@ -11,11 +11,23 @@ import {
   mcpInitSession,
   mcpListTools,
 } from '../../aws';
+import { invokeHarness } from '../../aws/agentcore-harness';
 import { InvokeLogger } from '../../logging';
 import { formatMcpToolList } from '../../operations/dev/utils';
-import { canFetchRuntimeToken, fetchRuntimeToken } from '../../operations/fetch-access';
+import {
+  canFetchHarnessToken,
+  canFetchRuntimeToken,
+  fetchHarnessToken,
+  fetchRuntimeToken,
+} from '../../operations/fetch-access';
 import { generateSessionId } from '../../operations/session';
 import type { InvokeOptions, InvokeResult } from './types';
+import { randomUUID } from 'node:crypto';
+
+const TOOL_TYPE_DEFAULT_NAMES: Record<string, string> = {
+  agentcore_browser: 'browser',
+  agentcore_code_interpreter: 'code-interpreter',
+};
 
 export interface InvokeContext {
   project: AgentCoreProjectSpec;
@@ -59,8 +71,30 @@ export async function handleInvoke(context: InvokeContext, options: InvokeOption
     return { success: false, error: `Target config '${selectedTargetName}' not found in aws-targets` };
   }
 
+  // ── Route to harness or runtime ─────────────────────────────────────────
+  const harnessEntries = project.harnesses ?? [];
+  const hasBoth = project.runtimes.length > 0 && harnessEntries.length > 0;
+
+  if (hasBoth && !options.harnessName && !options.agentName) {
+    const allNames = [
+      ...project.runtimes.map(r => `--runtime ${r.name}`),
+      ...harnessEntries.map(h => `--harness ${h.name}`),
+    ];
+    return {
+      success: false,
+      error: `Project has both runtimes and harnesses. Specify one:\n  ${allNames.join('\n  ')}`,
+    };
+  }
+
+  const isHarnessInvoke = options.harnessName != null || (harnessEntries.length > 0 && project.runtimes.length === 0);
+
+  if (isHarnessInvoke) {
+    return handleHarnessInvoke(project, targetState, targetConfig, selectedTargetName, options);
+  }
+
+  // ── Runtime invoke path ────────────────────────────────────────────────
   if (project.runtimes.length === 0) {
-    return { success: false, error: 'No agents defined in configuration' };
+    return { success: false, error: 'No runtimes or harnesses defined in configuration' };
   }
 
   // Resolve agent
@@ -94,6 +128,20 @@ export async function handleInvoke(context: InvokeContext, options: InvokeOption
     return { success: false, error: `Agent '${agentSpec.name}' is not deployed to target '${selectedTargetName}'` };
   }
 
+  // Build config bundle baggage if a bundle is associated with this agent
+  const deployedBundles = targetState?.resources?.configBundles ?? {};
+  let baggage: string | undefined;
+  const bundleSpec = project.configBundles?.find(b => {
+    const keys = Object.keys(b.components ?? {});
+    return keys.some(k => k === `{{runtime:${agentSpec.name}}}`);
+  });
+  if (bundleSpec) {
+    const bundleState = deployedBundles[bundleSpec.name];
+    if (bundleState?.bundleArn && bundleState?.versionId) {
+      baggage = `aws.agentcore.configbundle_arn=${encodeURIComponent(bundleState.bundleArn)},aws.agentcore.configbundle_version=${encodeURIComponent(bundleState.versionId)}`;
+    }
+  }
+
   // Auto-fetch bearer token for CUSTOM_JWT agents when not provided
   if (agentSpec.authorizerType === 'CUSTOM_JWT' && !options.bearerToken) {
     const canFetch = await canFetchRuntimeToken(agentSpec.name);
@@ -230,6 +278,7 @@ export async function handleInvoke(context: InvokeContext, options: InvokeOption
       userId: options.userId,
       headers: options.headers,
       bearerToken: options.bearerToken,
+      baggage,
     };
 
     // list-tools: list available MCP tools
@@ -410,6 +459,7 @@ export async function handleInvoke(context: InvokeContext, options: InvokeOption
         logger,
         headers: options.headers,
         bearerToken: options.bearerToken,
+        baggage,
       });
 
       for await (const chunk of result.stream) {
@@ -443,6 +493,7 @@ export async function handleInvoke(context: InvokeContext, options: InvokeOption
     userId: options.userId,
     headers: options.headers,
     bearerToken: options.bearerToken,
+    baggage,
   });
 
   logger.logResponse(response.content);
@@ -456,3 +507,360 @@ export async function handleInvoke(context: InvokeContext, options: InvokeOption
     logFilePath: logger.logFilePath,
   };
 }
+
+// ============================================================================
+// Harness Invoke
+// ============================================================================
+
+async function handleHarnessInvoke(
+  project: AgentCoreProjectSpec,
+  targetState: DeployedState['targets'][string] | undefined,
+  targetConfig: { region: string; name: string },
+  selectedTargetName: string,
+  options: InvokeOptions
+): Promise<InvokeResult> {
+  const harnessEntries = project.harnesses ?? [];
+
+  if (harnessEntries.length === 0) {
+    return { success: false, error: 'No harnesses defined in configuration' };
+  }
+
+  // Resolve harness name — explicit flag, or auto-infer if only one
+  let harnessName = options.harnessName;
+  if (!harnessName) {
+    if (harnessEntries.length > 1) {
+      const names = harnessEntries.map(h => h.name);
+      return {
+        success: false,
+        error: `Multiple harnesses found. Use --harness to specify one: ${names.join(', ')}`,
+      };
+    }
+    harnessName = harnessEntries[0]!.name;
+  }
+
+  const harnessEntry = harnessEntries.find(h => h.name === harnessName);
+  if (!harnessEntry) {
+    const names = harnessEntries.map(h => h.name);
+    return {
+      success: false,
+      error: `Harness '${harnessName}' not found. Available: ${names.join(', ')}`,
+    };
+  }
+
+  // Get deployed state for this harness
+  const harnessState = targetState?.resources?.harnesses?.[harnessName];
+  if (!harnessState) {
+    return {
+      success: false,
+      error: `Harness '${harnessName}' is not deployed to target '${selectedTargetName}'. Run \`agentcore deploy\` first.`,
+    };
+  }
+
+  // Read harness spec for auth config
+  const configIO = new ConfigIO();
+  let harnessSpec;
+  try {
+    harnessSpec = await configIO.readHarnessSpec(harnessName);
+  } catch {
+    // If we can't read the spec, continue without auto-fetch
+  }
+
+  // Auto-fetch bearer token for CUSTOM_JWT harnesses when not provided
+  if (harnessSpec?.authorizerType === 'CUSTOM_JWT' && !options.bearerToken) {
+    const canFetch = await canFetchHarnessToken(harnessName);
+    if (canFetch) {
+      try {
+        const tokenResult = await fetchHarnessToken(harnessName, { deployTarget: selectedTargetName });
+        options = { ...options, bearerToken: tokenResult.token };
+      } catch (err) {
+        return {
+          success: false,
+          error: `CUSTOM_JWT harness requires a bearer token. Auto-fetch failed: ${err instanceof Error ? err.message : String(err)}\nProvide one manually with --bearer-token.`,
+        };
+      }
+    } else {
+      return {
+        success: false,
+        error: `Harness '${harnessName}' is configured for CUSTOM_JWT but no bearer token is available.\nEither provide --bearer-token or re-add the harness with --client-id and --client-secret to enable auto-fetch.`,
+      };
+    }
+  }
+
+  // Exec mode: run shell command on harness VM via InvokeAgentRuntimeCommand
+  if (options.exec) {
+    const command = options.prompt;
+    if (!command) {
+      return {
+        success: false,
+        error: '--exec requires a command. Usage: agentcore invoke --exec --harness <name> "ls -la"',
+      };
+    }
+
+    try {
+      const result = await executeBashCommand({
+        region: targetConfig.region,
+        runtimeArn: harnessState.harnessArn,
+        command,
+        sessionId: options.sessionId,
+        timeout: options.timeout,
+      });
+
+      let stdout = '';
+      let stderr = '';
+      let exitCode: number | undefined;
+      let status: string | undefined;
+
+      for await (const event of result.stream) {
+        switch (event.type) {
+          case 'stdout':
+            if (event.data) {
+              stdout += event.data;
+              if (!options.json) process.stdout.write(event.data);
+            }
+            break;
+          case 'stderr':
+            if (event.data) {
+              stderr += event.data;
+              if (!options.json) process.stderr.write(event.data);
+            }
+            break;
+          case 'stop':
+            exitCode = event.exitCode;
+            status = event.status;
+            break;
+        }
+      }
+
+      if (options.json) {
+        return {
+          success: exitCode === 0,
+          targetName: selectedTargetName,
+          response: JSON.stringify({ stdout, stderr, exitCode, status }),
+        };
+      }
+
+      if (exitCode !== 0) {
+        return {
+          success: false,
+          targetName: selectedTargetName,
+          error: `Command exited with code ${exitCode}${status === 'TIMED_OUT' ? ' (timed out)' : ''}`,
+        };
+      }
+
+      return { success: true, targetName: selectedTargetName };
+    } catch (err) {
+      return { success: false, error: `Exec failed: ${err instanceof Error ? err.message : String(err)}` };
+    }
+  }
+
+  if (!options.prompt) {
+    return { success: false, error: 'No prompt provided. Usage: agentcore invoke --harness <name> "your prompt"' };
+  }
+
+  const sessionId = options.sessionId ?? randomUUID();
+  const region = targetConfig.region;
+
+  const logger = new InvokeLogger({
+    agentName: harnessName,
+    runtimeArn: harnessState.harnessArn,
+    region,
+    sessionId,
+  });
+  logger.logPrompt(options.prompt, sessionId, options.userId);
+
+  let fullResponse = '';
+  const dim = '\x1b[2m';
+  const reset = '\x1b[0m';
+  const cyan = '\x1b[36m';
+
+  const SPINNER = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+  let spinnerInterval: NodeJS.Timeout | undefined;
+  let spinnerIdx = 0;
+  if (!options.json && !options.verbose) {
+    process.stderr.write(`${dim}${SPINNER[0]} Thinking...${reset}`);
+    spinnerInterval = setInterval(() => {
+      spinnerIdx = (spinnerIdx + 1) % SPINNER.length;
+      process.stderr.write(`\r${dim}${SPINNER[spinnerIdx]} Thinking...${reset}`);
+    }, 80);
+  }
+
+  let spinnerCleared = false;
+  const clearSpinner = () => {
+    if (spinnerInterval && !spinnerCleared) {
+      clearInterval(spinnerInterval);
+      spinnerCleared = true;
+      process.stderr.write('\r\x1b[K');
+    }
+  };
+
+  try {
+    const messages: { role: string; content: Record<string, unknown>[] }[] = [
+      { role: 'user', content: [{ text: options.prompt }] },
+    ];
+
+    const baseOpts: Partial<import('../../aws/agentcore-harness').InvokeHarnessOptions> = {};
+    if (options.modelId || options.modelProvider || options.apiKeyArn) {
+      const provider = options.modelProvider ?? harnessSpec?.model?.provider;
+      const modelId = options.modelId ?? harnessSpec?.model?.modelId ?? '';
+      const apiKeyArn = options.apiKeyArn ?? harnessSpec?.model?.apiKeyArn;
+      switch (provider) {
+        case 'open_ai':
+          baseOpts.model = { openAiModelConfig: { modelId, ...(apiKeyArn && { apiKeyArn }) } };
+          break;
+        case 'gemini':
+          baseOpts.model = { geminiModelConfig: { modelId, ...(apiKeyArn && { apiKeyArn }) } };
+          break;
+        default:
+          baseOpts.model = { bedrockModelConfig: { modelId } };
+          break;
+      }
+    }
+    if (options.tools) {
+      baseOpts.tools = options.tools.split(',').map(t => {
+        const type = t.trim();
+        return { type, name: TOOL_TYPE_DEFAULT_NAMES[type] ?? type };
+      });
+    }
+    if (options.maxIterations != null) baseOpts.maxIterations = options.maxIterations;
+    if (options.maxTokens != null) baseOpts.maxTokens = options.maxTokens;
+    if (options.harnessTimeout != null) baseOpts.timeoutSeconds = options.harnessTimeout;
+    if (options.skills) baseOpts.skills = options.skills.split(',').map(p => ({ path: p.trim() }));
+    if (options.systemPrompt) baseOpts.systemPrompt = [{ text: options.systemPrompt }];
+    if (options.allowedTools) baseOpts.allowedTools = options.allowedTools.split(',').map(t => t.trim());
+    if (options.actorId) baseOpts.actorId = options.actorId;
+
+    let pendingToolUseId: string | undefined;
+    let pendingToolName: string | undefined;
+    let pendingToolInput = '';
+
+    let continueLoop = true;
+    while (continueLoop) {
+      continueLoop = false;
+
+      const stream = invokeHarness({
+        region,
+        harnessArn: harnessState.harnessArn,
+        runtimeSessionId: sessionId,
+        messages,
+        bearerToken: options.bearerToken,
+        ...baseOpts,
+      });
+
+      pendingToolUseId = undefined;
+      pendingToolName = undefined;
+      pendingToolInput = '';
+
+      for await (const event of stream) {
+        if (options.verbose) {
+          clearSpinner();
+          console.log(JSON.stringify(event));
+          continue;
+        }
+
+        switch (event.type) {
+          case 'contentBlockDelta':
+            if (event.delta.type === 'text') {
+              clearSpinner();
+              fullResponse += event.delta.text;
+              if (!options.json) {
+                process.stdout.write(event.delta.text);
+              }
+            } else if (event.delta.type === 'toolUse') {
+              pendingToolInput += event.delta.input;
+            } else if (event.delta.type === 'toolResult') {
+              const results = event.delta.results;
+              for (const r of results) {
+                const text = (r.text as string) ?? (r.json ? JSON.stringify(r.json) : '');
+                if (text) {
+                  logger.logInfo(`Tool output: ${text.slice(0, 200)}`);
+                }
+              }
+            }
+            break;
+          case 'contentBlockStart':
+            if (event.start.type === 'toolUse') {
+              pendingToolUseId = event.start.toolUse.toolUseId;
+              pendingToolName = event.start.toolUse.name;
+              pendingToolInput = '';
+              logger.logInfo(`Tool call: ${pendingToolName} (id: ${pendingToolUseId})`);
+              if (!options.json) {
+                const serverName = event.start.toolUse.serverName;
+                const label = serverName ? `${serverName}/${pendingToolName}` : pendingToolName;
+                process.stderr.write(`\n${dim}🔧 Tool: ${label}${reset}\n`);
+              }
+            } else if (event.start.type === 'toolResult') {
+              const status = event.start.toolResult.status ?? 'success';
+              logger.logInfo(`Tool result (${pendingToolName}): status=${status}`);
+              if (!options.json) {
+                const icon = status === 'error' ? '❌' : '✓';
+                process.stderr.write(`${dim}  ${icon} `);
+              }
+            }
+            break;
+          case 'messageStop':
+            if (event.stopReason === 'tool_use' && pendingToolUseId) {
+              clearSpinner();
+              let inputObj: Record<string, unknown> = {};
+              try {
+                inputObj = JSON.parse(pendingToolInput) as Record<string, unknown>;
+              } catch {
+                // use empty
+              }
+              logger.logInfo(`Tool input (${pendingToolName}): ${JSON.stringify(inputObj)}`);
+            } else if (event.stopReason === 'tool_result') {
+              if (!options.json) {
+                process.stderr.write(`${reset}\n`);
+              }
+            } else if (!options.json) {
+              process.stdout.write('\n');
+            }
+            break;
+          case 'metadata':
+            logger.logInfo(
+              `Tokens: ${event.usage.inputTokens} in, ${event.usage.outputTokens} out | Latency: ${event.metrics.latencyMs}ms`
+            );
+            if (!options.json) {
+              const { inputTokens, outputTokens } = event.usage;
+              const latency = (event.metrics.latencyMs / 1000).toFixed(1);
+              process.stderr.write(
+                `\n${dim}⚡ ${cyan}${inputTokens}${dim} in · ${cyan}${outputTokens}${dim} out · ${cyan}${latency}s${reset}\n`
+              );
+              process.stderr.write(
+                `${dim}🔗 Session: ${cyan}${sessionId}${dim} (use --session-id to continue)${reset}\n`
+              );
+            }
+            break;
+          case 'error':
+            clearSpinner();
+            logger.logError(new Error(`${event.errorType}: ${event.message}`), 'stream error');
+            if (options.json) {
+              return { success: false, error: `${event.errorType}: ${event.message}` };
+            }
+            process.stderr.write(`\nError: ${event.message}\n`);
+            break;
+        }
+      }
+    }
+
+    logger.logResponse(fullResponse);
+
+    if (options.json) {
+      return {
+        success: true,
+        targetName: selectedTargetName,
+        response: JSON.stringify({ text: fullResponse, sessionId }),
+        logFilePath: logger.logFilePath,
+      };
+    }
+
+    return { success: true, targetName: selectedTargetName, logFilePath: logger.logFilePath };
+  } catch (err) {
+    clearSpinner();
+    logger.logError(err, 'harness invoke failed');
+    return {
+      success: false,
+      error: `Harness invoke failed: ${err instanceof Error ? err.message : String(err)}`,
+      logFilePath: logger.logFilePath,
+    };
+  }
+}
diff --git a/src/cli/commands/invoke/command.tsx b/src/cli/commands/invoke/command.tsx
index cc0cd1e35..13e91ccfb 100644
--- a/src/cli/commands/invoke/command.tsx
+++ b/src/cli/commands/invoke/command.tsx
@@ -44,7 +44,11 @@ async function handleInvokeCLI(options: InvokeOptions): Promise<void> {
     const context = await loadInvokeConfig();
 
     // Show spinner for non-streaming, non-json, non-exec invocations
-    if (!options.stream && !options.json && !options.exec) {
+    // Harness invoke always streams directly to stdout, so skip spinner for harness
+    const isHarness =
+      options.harnessName != null ||
+      ((context.project.harnesses ?? []).length > 0 && context.project.runtimes.length === 0);
+    if (!options.stream && !options.json && !options.exec && !isHarness) {
       spinner = startSpinner('Invoking agent...');
     }
 
@@ -126,6 +130,22 @@ export const registerInvoke = (program: Command) => {
       [] as string[]
     )
     .option('--bearer-token <token>', 'Bearer token for CUSTOM_JWT auth (bypasses SigV4) [non-interactive]')
+    .option('--harness <name>', 'Select specific harness to invoke [non-interactive]')
+    .option('--verbose', 'Print verbose streaming JSON events (harness only) [non-interactive]')
+    .option('--model-id <id>', 'Override model for this invocation (harness only) [non-interactive]')
+    .option(
+      '--model-provider <provider>',
+      'Override model provider: bedrock, open_ai, gemini (harness only) [non-interactive]'
+    )
+    .option('--api-key-arn <arn>', 'Override API key ARN for open_ai/gemini (harness only) [non-interactive]')
+    .option('--tools <tools>', 'Override tools, comma-separated (harness only) [non-interactive]')
+    .option('--max-iterations <n>', 'Override max iterations (harness only) [non-interactive]', parseInt)
+    .option('--max-tokens <n>', 'Override max tokens (harness only) [non-interactive]', parseInt)
+    .option('--harness-timeout <seconds>', 'Override timeout seconds (harness only) [non-interactive]', parseInt)
+    .option('--skills <paths>', 'Skills to use, comma-separated paths (harness only) [non-interactive]')
+    .option('--system-prompt <text>', 'Override system prompt (harness only) [non-interactive]')
+    .option('--allowed-tools <tools>', 'Override allowed tools, comma-separated (harness only) [non-interactive]')
+    .option('--actor-id <id>', 'Override memory actor ID (harness only) [non-interactive]')
     .action(
       async (
         positionalPrompt: string | undefined,
@@ -144,6 +164,19 @@ export const registerInvoke = (program: Command) => {
           timeout?: number;
           header?: string[];
           bearerToken?: string;
+          harness?: string;
+          verbose?: boolean;
+          modelId?: string;
+          modelProvider?: string;
+          apiKeyArn?: string;
+          tools?: string;
+          maxIterations?: number;
+          maxTokens?: number;
+          harnessTimeout?: number;
+          skills?: string;
+          systemPrompt?: string;
+          allowedTools?: string;
+          actorId?: string;
         }
       ) => {
         try {
@@ -180,11 +213,14 @@ export const registerInvoke = (program: Command) => {
             cliOptions.runtime ||
             cliOptions.tool ||
             cliOptions.exec ||
-            cliOptions.bearerToken
+            cliOptions.bearerToken ||
+            cliOptions.harness ||
+            cliOptions.verbose
           ) {
             await handleInvokeCLI({
               prompt,
               agentName: cliOptions.runtime,
+              harnessName: cliOptions.harness,
               targetName: cliOptions.target ?? 'default',
               sessionId: cliOptions.sessionId,
               userId: cliOptions.userId,
@@ -196,14 +232,40 @@ export const registerInvoke = (program: Command) => {
               timeout: cliOptions.timeout,
               headers,
               bearerToken: cliOptions.bearerToken,
+              verbose: cliOptions.verbose,
+              modelId: cliOptions.modelId,
+              modelProvider: cliOptions.modelProvider,
+              apiKeyArn: cliOptions.apiKeyArn,
+              tools: cliOptions.tools,
+              maxIterations: cliOptions.maxIterations,
+              maxTokens: cliOptions.maxTokens,
+              harnessTimeout: cliOptions.harnessTimeout,
+              skills: cliOptions.skills,
+              systemPrompt: cliOptions.systemPrompt,
+              allowedTools: cliOptions.allowedTools,
+              actorId: cliOptions.actorId,
             });
           } else {
             // No CLI options - interactive TUI mode (headers still passed if provided)
             requireTTY();
+            const ENTER_ALT_SCREEN = '\x1B[?1049h\x1B[H';
+            const EXIT_ALT_SCREEN = '\x1B[?1049l';
+            const SHOW_CURSOR = '\x1B[?25h';
+
+            process.stdout.write(ENTER_ALT_SCREEN);
+
+            const exitAltScreen = () => {
+              process.stdout.write(EXIT_ALT_SCREEN);
+              process.stdout.write(SHOW_CURSOR);
+            };
+
             const { waitUntilExit, unmount } = render(
               <InvokeScreen
                 isInteractive={true}
-                onExit={() => unmount()}
+                onExit={() => {
+                  exitAltScreen();
+                  unmount();
+                }}
                 initialSessionId={cliOptions.sessionId}
                 initialUserId={cliOptions.userId}
                 initialHeaders={headers}
diff --git a/src/cli/commands/invoke/types.ts b/src/cli/commands/invoke/types.ts
index 61401c332..12698c280 100644
--- a/src/cli/commands/invoke/types.ts
+++ b/src/cli/commands/invoke/types.ts
@@ -1,5 +1,6 @@
 export interface InvokeOptions {
   agentName?: string;
+  harnessName?: string;
   targetName?: string;
   prompt?: string;
   /** Path to a file containing the prompt (alternative to --prompt / positional) */
@@ -20,6 +21,30 @@ export interface InvokeOptions {
   headers?: Record<string, string>;
   /** Bearer token for CUSTOM_JWT auth (bypasses SigV4) */
   bearerToken?: string;
+  /** Print verbose streaming JSON events instead of formatted text (harness only) */
+  verbose?: boolean;
+  /** Override model ID for this invocation (harness only) */
+  modelId?: string;
+  /** Override model provider for this invocation (harness only): bedrock, open_ai, gemini */
+  modelProvider?: string;
+  /** Override API key ARN for this invocation (harness only, open_ai/gemini) */
+  apiKeyArn?: string;
+  /** Override tools for this invocation (harness only, comma-separated) */
+  tools?: string;
+  /** Override max iterations (harness only) */
+  maxIterations?: number;
+  /** Override timeout seconds (harness only) */
+  harnessTimeout?: number;
+  /** Override max tokens (harness only) */
+  maxTokens?: number;
+  /** Skills to use (harness only, comma-separated paths) */
+  skills?: string;
+  /** Override system prompt (harness only) */
+  systemPrompt?: string;
+  /** Override allowed tools (harness only, comma-separated) */
+  allowedTools?: string;
+  /** Override memory actor ID (harness only) */
+  actorId?: string;
 }
 
 export interface InvokeResult {
diff --git a/src/cli/commands/invoke/validate.ts b/src/cli/commands/invoke/validate.ts
index dd97241b8..c931acc2a 100644
--- a/src/cli/commands/invoke/validate.ts
+++ b/src/cli/commands/invoke/validate.ts
@@ -6,6 +6,12 @@ export interface ValidationResult {
 }
 
 export function validateInvokeOptions(options: InvokeOptions): ValidationResult {
+  if (options.harnessName && options.agentName) {
+    return { valid: false, error: '--harness and --runtime cannot be used together' };
+  }
+  if (options.verbose && !options.harnessName) {
+    return { valid: false, error: '--verbose is only supported with --harness' };
+  }
   if (options.exec && !options.prompt) {
     return { valid: false, error: 'A command is required with --exec. Usage: agentcore invoke --exec "ls -la"' };
   }
diff --git a/src/cli/commands/logs/__tests__/action.test.ts b/src/cli/commands/logs/__tests__/action.test.ts
index 039acfb67..842fa333a 100644
--- a/src/cli/commands/logs/__tests__/action.test.ts
+++ b/src/cli/commands/logs/__tests__/action.test.ts
@@ -60,6 +60,10 @@ describe('resolveAgentContext', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     },
     deployedState: {
       targets: {
@@ -80,8 +84,8 @@ describe('resolveAgentContext', () => {
     ...overrides,
   });
 
-  it('auto-selects single agent', () => {
-    const result = resolveAgentContext(makeContext(), {});
+  it('auto-selects single agent', async () => {
+    const result = await resolveAgentContext(makeContext(), {});
     expect(result.success).toBe(true);
     if (result.success) {
       expect(result.agentContext.agentName).toBe('MyAgent');
@@ -91,7 +95,7 @@ describe('resolveAgentContext', () => {
     }
   });
 
-  it('errors for multiple agents without --agent flag', () => {
+  it('errors for multiple agents without --agent flag', async () => {
     const context = makeContext({
       project: {
         name: 'TestProject',
@@ -121,9 +125,13 @@ describe('resolveAgentContext', () => {
         onlineEvalConfigs: [],
         agentCoreGateways: [],
         policyEngines: [],
+        harnesses: [],
+        configBundles: [],
+        abTests: [],
+        httpGateways: [],
       },
     });
-    const result = resolveAgentContext(context, {});
+    const result = await resolveAgentContext(context, {});
     expect(result.success).toBe(false);
     if (!result.success) {
       expect(result.error).toContain('Multiple runtimes found');
@@ -132,7 +140,7 @@ describe('resolveAgentContext', () => {
     }
   });
 
-  it('selects correct agent with --agent flag from multiple agents', () => {
+  it('selects correct agent with --agent flag from multiple agents', async () => {
     const context = makeContext({
       project: {
         name: 'TestProject',
@@ -162,6 +170,10 @@ describe('resolveAgentContext', () => {
         onlineEvalConfigs: [],
         agentCoreGateways: [],
         policyEngines: [],
+        harnesses: [],
+        configBundles: [],
+        abTests: [],
+        httpGateways: [],
       },
       deployedState: {
         targets: {
@@ -184,7 +196,7 @@ describe('resolveAgentContext', () => {
         },
       },
     });
-    const result = resolveAgentContext(context, { runtime: 'AgentB' });
+    const result = await resolveAgentContext(context, { runtime: 'AgentB' });
     expect(result.success).toBe(true);
     if (result.success) {
       expect(result.agentContext.agentName).toBe('AgentB');
@@ -192,15 +204,15 @@ describe('resolveAgentContext', () => {
     }
   });
 
-  it('errors for unknown agent name', () => {
-    const result = resolveAgentContext(makeContext(), { runtime: 'UnknownAgent' });
+  it('errors for unknown agent name', async () => {
+    const result = await resolveAgentContext(makeContext(), { runtime: 'UnknownAgent' });
     expect(result.success).toBe(false);
     if (!result.success) {
       expect(result.error).toContain("Runtime 'UnknownAgent' not found");
     }
   });
 
-  it('errors when no agents defined', () => {
+  it('errors when no agents defined', async () => {
     const context = makeContext({
       project: {
         name: 'TestProject',
@@ -213,16 +225,20 @@ describe('resolveAgentContext', () => {
         onlineEvalConfigs: [],
         agentCoreGateways: [],
         policyEngines: [],
+        harnesses: [],
+        configBundles: [],
+        abTests: [],
+        httpGateways: [],
       },
     });
-    const result = resolveAgentContext(context, {});
+    const result = await resolveAgentContext(context, {});
     expect(result.success).toBe(false);
     if (!result.success) {
-      expect(result.error).toContain('No runtimes defined');
+      expect(result.error).toContain('No runtimes or harnesses defined');
     }
   });
 
-  it('errors when agent is not deployed', () => {
+  it('errors when agent is not deployed', async () => {
     const context = makeContext({
       deployedState: {
         targets: {
@@ -234,7 +250,7 @@ describe('resolveAgentContext', () => {
         },
       },
     });
-    const result = resolveAgentContext(context, {});
+    const result = await resolveAgentContext(context, {});
     expect(result.success).toBe(false);
     if (!result.success) {
       expect(result.error).toContain('is not deployed');
diff --git a/src/cli/commands/logs/action.ts b/src/cli/commands/logs/action.ts
index 72be2c864..26d48f6f0 100644
--- a/src/cli/commands/logs/action.ts
+++ b/src/cli/commands/logs/action.ts
@@ -2,7 +2,7 @@ import { parseTimeString } from '../../../lib/utils';
 import { searchLogs, streamLogs } from '../../aws/cloudwatch';
 import { DEFAULT_ENDPOINT_NAME } from '../../constants';
 import type { DeployedProjectConfig } from '../../operations/resolve-agent';
-import { loadDeployedProjectConfig, resolveAgent } from '../../operations/resolve-agent';
+import { loadDeployedProjectConfig, resolveAgentOrHarness } from '../../operations/resolve-agent';
 import { VALID_LEVELS, buildFilterPattern } from './filter-pattern';
 import type { LogsOptions } from './types';
 
@@ -44,13 +44,14 @@ export function formatLogLine(event: { timestamp: number; message: string }, jso
 }
 
 /**
- * Resolve agent context from config + options
+ * Resolve agent context from config + options.
+ * Supports --harness to resolve a harness's underlying runtime.
  */
-export function resolveAgentContext(
+export async function resolveAgentContext(
   context: DeployedProjectConfig,
   options: LogsOptions
-): { success: true; agentContext: AgentContext } | { success: false; error: string } {
-  const result = resolveAgent(context, options);
+): Promise<{ success: true; agentContext: AgentContext } | { success: false; error: string }> {
+  const result = await resolveAgentOrHarness(context, options);
   if (!result.success) {
     return { success: false, error: result.error };
   }
@@ -83,7 +84,7 @@ export async function handleLogs(options: LogsOptions): Promise<LogsResult> {
   }
 
   const context = await loadDeployedProjectConfig();
-  const resolution = resolveAgentContext(context, options);
+  const resolution = await resolveAgentContext(context, options);
 
   if (!resolution.success) {
     return { success: false, error: resolution.error };
diff --git a/src/cli/commands/logs/command.tsx b/src/cli/commands/logs/command.tsx
index 05649887d..12728d995 100644
--- a/src/cli/commands/logs/command.tsx
+++ b/src/cli/commands/logs/command.tsx
@@ -21,6 +21,7 @@ export const registerLogs = (program: Command) => {
     .passThroughOptions()
     .description(COMMAND_DESCRIPTIONS.logs)
     .option('--runtime <name>', 'Select specific runtime')
+    .option('--harness <name>', 'Select specific harness')
     .option('--since <time>', 'Start time — defaults to 1h ago in search mode (e.g. "1h", "30m", "2d", ISO 8601)')
     .option('--until <time>', 'End time — defaults to now in search mode (e.g. "now", ISO 8601)')
     .option('--level <level>', 'Filter by log level (error, warn, info, debug)')
diff --git a/src/cli/commands/logs/types.ts b/src/cli/commands/logs/types.ts
index 9b8df48f9..73a58e024 100644
--- a/src/cli/commands/logs/types.ts
+++ b/src/cli/commands/logs/types.ts
@@ -1,5 +1,6 @@
 export interface LogsOptions {
   runtime?: string;
+  harness?: string;
   since?: string;
   until?: string;
   level?: string;
diff --git a/src/cli/commands/pause/command.tsx b/src/cli/commands/pause/command.tsx
index 5a3183ea9..82a79bccf 100644
--- a/src/cli/commands/pause/command.tsx
+++ b/src/cli/commands/pause/command.tsx
@@ -1,3 +1,6 @@
+import { ConfigIO } from '../../../lib';
+import { listABTests, updateABTest } from '../../aws/agentcore-ab-tests';
+import { stopBatchEvaluation } from '../../aws/agentcore-batch-evaluation';
 import { getErrorMessage } from '../../errors';
 import { handlePauseResume } from '../../operations/eval';
 import type { OnlineEvalActionOptions } from '../../operations/eval';
@@ -67,12 +70,267 @@ function registerOnlineEvalSubcommand(parent: Command, action: 'pause' | 'resume
     });
 }
 
+async function getRegion(cliRegion?: string): Promise<string> {
+  if (cliRegion) return cliRegion;
+  try {
+    const configIO = new ConfigIO();
+    const targets = await configIO.resolveAWSDeploymentTargets();
+    if (targets.length > 0) return targets[0]!.region;
+  } catch {
+    // Fall through to env vars
+  }
+  return process.env.AWS_DEFAULT_REGION ?? process.env.AWS_REGION ?? 'us-east-1';
+}
+
+async function resolveABTestId(
+  testName: string,
+  region: string
+): Promise<{ abTestId: string; region: string; error?: string }> {
+  let projectName: string | undefined;
+  try {
+    const configIO = new ConfigIO();
+    const deployedState = await configIO.readDeployedState();
+    const awsTargets = await configIO.readAWSDeploymentTargets();
+
+    try {
+      const projectSpec = await configIO.readProjectSpec();
+      projectName = projectSpec.name;
+    } catch {
+      // Project spec unavailable
+    }
+
+    for (const [targetName, target] of Object.entries(deployedState.targets ?? {})) {
+      const abTests = target.resources?.abTests;
+      if (abTests?.[testName]) {
+        const targetConfig = awsTargets.find(t => t.name === targetName);
+        const resolvedRegion = targetConfig?.region ?? region;
+        return { abTestId: abTests[testName].abTestId, region: resolvedRegion };
+      }
+    }
+  } catch {
+    // No deployed state
+  }
+
+  try {
+    const result = await listABTests({ region, maxResults: 100 });
+    // Match against both prefixed name ({projectName}_{testName}) and bare testName (backwards compat)
+    const prefixedName = projectName ? `${projectName}_${testName}` : undefined;
+    const match =
+      result.abTests.find(t => prefixedName != null && t.name === prefixedName) ??
+      result.abTests.find(t => t.name === testName);
+    if (match) return { abTestId: match.abTestId, region };
+  } catch {
+    // API call failed
+  }
+
+  return { abTestId: '', region, error: `AB test "${testName}" not found in deployed state or API.` };
+}
+
+function registerABTestSubcommand(parent: Command, action: 'pause' | 'resume') {
+  const executionStatus = action === 'pause' ? 'PAUSED' : 'RUNNING';
+  const pastTense = action === 'pause' ? 'Paused' : 'Resumed';
+
+  parent
+    .command('ab-test')
+    .description(`[preview] ${action === 'pause' ? 'Pause' : 'Resume'} a deployed A/B test`)
+    .argument('<name>', 'AB test name')
+    .option('--region <region>', 'AWS region')
+    .option('--json', 'Output as JSON')
+    .action(async (name: string, cliOptions: { region?: string; json?: boolean }) => {
+      try {
+        const region = await getRegion(cliOptions.region);
+        const { abTestId, error } = await resolveABTestId(name, region);
+        if (error) {
+          if (cliOptions.json) {
+            console.log(JSON.stringify({ success: false, error }));
+          } else {
+            console.error(error);
+          }
+          process.exit(1);
+        }
+
+        const result = await updateABTest({
+          region,
+          abTestId,
+          executionStatus,
+        });
+
+        if (cliOptions.json) {
+          console.log(JSON.stringify({ success: true, ...result }));
+        } else {
+          console.log(`${pastTense} AB test "${name}" (execution: ${result.executionStatus})`);
+        }
+        process.exit(0);
+      } catch (error) {
+        if (cliOptions.json) {
+          console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+        } else {
+          console.error(`Error: ${getErrorMessage(error)}`);
+        }
+        process.exit(1);
+      }
+    });
+}
+
 export const registerPause = (program: Command) => {
   const pauseCmd = program.command('pause').description(COMMAND_DESCRIPTIONS.pause);
   registerOnlineEvalSubcommand(pauseCmd, 'pause');
+  registerABTestSubcommand(pauseCmd, 'pause');
 };
 
 export const registerResume = (program: Command) => {
   const resumeCmd = program.command('resume').description(COMMAND_DESCRIPTIONS.resume);
   registerOnlineEvalSubcommand(resumeCmd, 'resume');
+  registerABTestSubcommand(resumeCmd, 'resume');
+};
+
+export const registerStop = (program: Command) => {
+  const stopCmd = program.command('stop').description('Stop resources');
+
+  stopCmd
+    .command('ab-test')
+    .description('[preview] Stop a deployed A/B test permanently')
+    .argument('<name>', 'AB test name')
+    .option('--region <region>', 'AWS region')
+    .option('--json', 'Output as JSON')
+    .action(async (name: string, cliOptions: { region?: string; json?: boolean }) => {
+      try {
+        const region = await getRegion(cliOptions.region);
+        const { abTestId, error } = await resolveABTestId(name, region);
+        if (error) {
+          if (cliOptions.json) {
+            console.log(JSON.stringify({ success: false, error }));
+          } else {
+            console.error(error);
+          }
+          process.exit(1);
+        }
+
+        const result = await updateABTest({
+          region,
+          abTestId,
+          executionStatus: 'STOPPED',
+        });
+
+        if (cliOptions.json) {
+          console.log(JSON.stringify({ success: true, ...result }));
+        } else {
+          console.log(`Stopped AB test "${name}" (execution: ${result.executionStatus})`);
+        }
+        process.exit(0);
+      } catch (error) {
+        if (cliOptions.json) {
+          console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+        } else {
+          console.error(`Error: ${getErrorMessage(error)}`);
+        }
+        process.exit(1);
+      }
+    });
+
+  stopCmd
+    .command('batch-evaluation')
+    .description('[preview] Stop a running batch evaluation')
+    .requiredOption('-i, --id <id>', 'Batch evaluation ID to stop')
+    .option('--region <region>', 'AWS region (auto-detected if omitted)')
+    .option('--json', 'Output as JSON')
+    .action(async (cliOptions: { id: string; region?: string; json?: boolean }) => {
+      try {
+        const region = await getRegion(cliOptions.region);
+
+        const result = await stopBatchEvaluation({
+          region,
+          batchEvaluationId: cliOptions.id,
+        });
+
+        if (cliOptions.json) {
+          console.log(JSON.stringify({ success: true, ...result }));
+        } else {
+          console.log(`\nBatch evaluation stopped successfully`);
+          console.log(`ID: ${result.batchEvaluationId}`);
+          console.log(`Status: ${result.status}\n`);
+        }
+
+        process.exit(0);
+      } catch (error) {
+        if (cliOptions.json) {
+          console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+        } else {
+          render(<Text color="red">Error: {getErrorMessage(error)}</Text>);
+        }
+        process.exit(1);
+      }
+    });
+};
+
+export const registerPromote = (program: Command) => {
+  const promoteCmd = program.command('promote').description('Promote resources');
+
+  promoteCmd
+    .command('ab-test')
+    .description('Promote the winning treatment of an A/B test')
+    .argument('<name>', 'AB test name')
+    .option('--region <region>', 'AWS region')
+    .option('--json', 'Output as JSON')
+    .action(async (name: string, cliOptions: { region?: string; json?: boolean }) => {
+      try {
+        const region = await getRegion(cliOptions.region);
+        const { abTestId, error } = await resolveABTestId(name, region);
+        if (error) {
+          if (cliOptions.json) {
+            console.log(JSON.stringify({ success: false, error }));
+          } else {
+            console.error(error);
+          }
+          process.exit(1);
+        }
+
+        // Stop the AB test
+        const result = await updateABTest({
+          region,
+          abTestId,
+          executionStatus: 'STOPPED',
+        });
+
+        // Apply promotion to agentcore.json
+        const { promoteABTestConfig } = await import('../../operations/ab-test/promote');
+        let promoted = false;
+        let mode: string | undefined;
+        let promotionDetail = '';
+        try {
+          const promoResult = await promoteABTestConfig(abTestId, name);
+          promoted = promoResult.promoted;
+          mode = promoResult.mode;
+          promotionDetail = promoResult.promotionDetail;
+        } catch {
+          // Config read/write failed
+        }
+
+        if (cliOptions.json) {
+          console.log(
+            JSON.stringify({
+              success: true,
+              ...result,
+              ...(mode && { mode }),
+              promoted,
+              ...(promotionDetail && { promotionDetail }),
+            })
+          );
+        } else {
+          console.log(`AB test "${name}" stopped.`);
+          if (promoted) {
+            console.log(`\n${promotionDetail}`);
+            console.log(`\nRun: agentcore deploy`);
+          }
+        }
+        process.exit(0);
+      } catch (error) {
+        if (cliOptions.json) {
+          console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+        } else {
+          console.error(`Error: ${getErrorMessage(error)}`);
+        }
+        process.exit(1);
+      }
+    });
 };
diff --git a/src/cli/commands/pause/index.ts b/src/cli/commands/pause/index.ts
index 858054fd2..1bc38e3be 100644
--- a/src/cli/commands/pause/index.ts
+++ b/src/cli/commands/pause/index.ts
@@ -1 +1 @@
-export { registerPause } from './command';
+export { registerPause, registerPromote } from './command';
diff --git a/src/cli/commands/recommendations/command.tsx b/src/cli/commands/recommendations/command.tsx
new file mode 100644
index 000000000..bcf3b2784
--- /dev/null
+++ b/src/cli/commands/recommendations/command.tsx
@@ -0,0 +1,63 @@
+import { getErrorMessage } from '../../errors';
+import { listAllRecommendations } from '../../operations/recommendation';
+import { COMMAND_DESCRIPTIONS } from '../../tui/copy';
+import { requireProject } from '../../tui/guards';
+import type { Command } from '@commander-js/extra-typings';
+import { Text, render } from 'ink';
+import React from 'react';
+
+export const registerRecommendations = (program: Command) => {
+  const recCmd = program.command('recommendations').description(COMMAND_DESCRIPTIONS.recommendations);
+
+  recCmd
+    .command('history')
+    .description('Show past recommendation runs saved locally')
+    .option('--json', 'Output as JSON')
+    .action((cliOptions: { json?: boolean }) => {
+      requireProject();
+
+      try {
+        const records = listAllRecommendations();
+
+        if (cliOptions.json) {
+          console.log(JSON.stringify({ success: true, recommendations: records }));
+          process.exit(0);
+          return;
+        }
+
+        if (records.length === 0) {
+          console.log('No recommendation runs found. Run `agentcore run recommendation` to create one.');
+          return;
+        }
+
+        console.log(
+          `\n${'Date'.padEnd(22)} ${'Type'.padEnd(20)} ${'Agent'.padEnd(20)} ${'Recommendation ID'.padEnd(40)}`
+        );
+        console.log('─'.repeat(105));
+
+        for (const record of records) {
+          const date = record.startedAt
+            ? new Date(record.startedAt).toLocaleString([], {
+                year: 'numeric',
+                month: 'short',
+                day: 'numeric',
+                hour: '2-digit',
+                minute: '2-digit',
+              })
+            : 'unknown';
+          console.log(
+            `${date.padEnd(22)} ${(record.type ?? 'unknown').padEnd(20)} ${(record.agent ?? 'unknown').padEnd(20)} ${record.recommendationId.padEnd(40)}`
+          );
+        }
+
+        console.log('');
+      } catch (error) {
+        if (cliOptions.json) {
+          console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+        } else {
+          render(<Text color="red">Error: {getErrorMessage(error)}</Text>);
+        }
+        process.exit(1);
+      }
+    });
+};
diff --git a/src/cli/commands/recommendations/index.ts b/src/cli/commands/recommendations/index.ts
new file mode 100644
index 000000000..8c0a96809
--- /dev/null
+++ b/src/cli/commands/recommendations/index.ts
@@ -0,0 +1 @@
+export { registerRecommendations } from './command';
diff --git a/src/cli/commands/remove/command.tsx b/src/cli/commands/remove/command.tsx
index e978e9793..3705c523f 100644
--- a/src/cli/commands/remove/command.tsx
+++ b/src/cli/commands/remove/command.tsx
@@ -34,6 +34,10 @@ async function handleRemoveAll(_options: RemoveAllOptions): Promise<RemoveResult
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     });
 
     // Preserve aws-targets.json and deployed-state.json so that
diff --git a/src/cli/commands/remove/tool-command.ts b/src/cli/commands/remove/tool-command.ts
new file mode 100644
index 000000000..91e2b69fb
--- /dev/null
+++ b/src/cli/commands/remove/tool-command.ts
@@ -0,0 +1,65 @@
+import { ConfigIO, findConfigRoot } from '../../../lib';
+import { getErrorMessage } from '../../errors';
+import type { Command } from '@commander-js/extra-typings';
+
+export function registerRemoveTool(removeCmd: Command): void {
+  removeCmd
+    .command('tool')
+    .description('Remove a tool from a harness')
+    .requiredOption('--harness <name>', 'Target harness name')
+    .requiredOption('--name <name>', 'Tool name to remove')
+    .option('--json', 'Output as JSON')
+    .action(async cliOptions => {
+      if (!findConfigRoot()) {
+        console.error('No agentcore project found. Run `agentcore create` first.');
+        process.exit(1);
+      }
+
+      try {
+        const configIO = new ConfigIO();
+        let harnessSpec;
+        try {
+          harnessSpec = await configIO.readHarnessSpec(cliOptions.harness);
+        } catch {
+          const error = `Harness '${cliOptions.harness}' not found.`;
+          if (cliOptions.json) {
+            console.log(JSON.stringify({ success: false, error }));
+          } else {
+            console.error(error);
+          }
+          process.exit(1);
+          return;
+        }
+
+        const toolIndex = harnessSpec.tools.findIndex(t => t.name === cliOptions.name);
+        if (toolIndex === -1) {
+          const error = `Tool '${cliOptions.name}' not found in harness '${cliOptions.harness}'`;
+          if (cliOptions.json) {
+            console.log(JSON.stringify({ success: false, error }));
+          } else {
+            console.error(error);
+          }
+          process.exit(1);
+          return;
+        }
+
+        harnessSpec.tools.splice(toolIndex, 1);
+        await configIO.writeHarnessSpec(cliOptions.harness, harnessSpec);
+
+        const result = { success: true, harnessName: cliOptions.harness, toolName: cliOptions.name };
+        if (cliOptions.json) {
+          console.log(JSON.stringify(result));
+        } else {
+          console.log(`Removed tool '${cliOptions.name}' from harness '${cliOptions.harness}'.`);
+          console.log(`Run 'agentcore deploy' to apply changes.`);
+        }
+      } catch (error) {
+        if (cliOptions.json) {
+          console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+        } else {
+          console.error(getErrorMessage(error));
+        }
+        process.exit(1);
+      }
+    });
+}
diff --git a/src/cli/commands/remove/types.ts b/src/cli/commands/remove/types.ts
index 82d5ec89e..06089bfeb 100644
--- a/src/cli/commands/remove/types.ts
+++ b/src/cli/commands/remove/types.ts
@@ -2,13 +2,16 @@ export type ResourceType =
   | 'agent'
   | 'gateway'
   | 'gateway-target'
+  | 'harness'
   | 'runtime-endpoint'
   | 'memory'
   | 'credential'
   | 'evaluator'
   | 'online-eval'
   | 'policy-engine'
-  | 'policy';
+  | 'policy'
+  | 'config-bundle'
+  | 'ab-test';
 
 export interface RemoveOptions {
   resourceType: ResourceType;
diff --git a/src/cli/commands/run/command.tsx b/src/cli/commands/run/command.tsx
index fffe23a5a..e5ba8ca59 100644
--- a/src/cli/commands/run/command.tsx
+++ b/src/cli/commands/run/command.tsx
@@ -1,12 +1,29 @@
+import type { RecommendationType } from '../../aws/agentcore-recommendation';
 import { getErrorMessage } from '../../errors';
 import { handleRunEval } from '../../operations/eval';
 import type { RunEvalOptions } from '../../operations/eval';
+import { saveBatchEvalRun } from '../../operations/eval/batch-eval-storage';
+import { runBatchEvaluationCommand } from '../../operations/eval/run-batch-evaluation';
+import type {
+  BatchEvaluationResult,
+  RunBatchEvaluationCommandResult,
+} from '../../operations/eval/run-batch-evaluation';
+import {
+  applyRecommendationToBundle,
+  runRecommendationCommand,
+  saveRecommendationRun,
+} from '../../operations/recommendation';
 import { COMMAND_DESCRIPTIONS } from '../../tui/copy';
 import { requireProject } from '../../tui/guards';
 import type { Command } from '@commander-js/extra-typings';
 import { Text, render } from 'ink';
 import React from 'react';
 
+const RECOMMENDATION_TYPE_MAP: Record<string, RecommendationType> = {
+  'system-prompt': 'SYSTEM_PROMPT_RECOMMENDATION',
+  'tool-description': 'TOOL_DESCRIPTION_RECOMMENDATION',
+};
+
 function formatRunOutput(result: Awaited<ReturnType<typeof handleRunEval>>): void {
   if (!result.run) return;
 
@@ -59,7 +76,7 @@ export const registerRun = (program: Command) => {
     )
     .option('-r, --runtime <name>', 'Runtime name from project config')
     .option('--runtime-arn <arn>', 'Runtime ARN — run outside a project directory')
-    .option('-e, --evaluator <names...>', 'Evaluator name(s) from project or Builtin.* IDs')
+    .option('-e, --evaluator <names...>', 'Evaluator name(s) — project evaluators or Builtin.* IDs')
     .option('--evaluator-arn <arns...>', 'Evaluator ARN(s) — use with --runtime-arn for standalone mode')
     .option('--region <region>', 'AWS region (required with --runtime-arn, auto-detected otherwise)')
     .option('-s, --session-id <id>', 'Evaluate a specific session only')
@@ -69,9 +86,9 @@ export const registerRun = (program: Command) => {
       'Runtime endpoint name (e.g. PROMPT_V1). Defaults to AGENTCORE_RUNTIME_ENDPOINT env var, then DEFAULT'
     )
     .option('--days <days>', 'Lookback window in days', '7')
-    .option('-A, --assertion <text...>', 'Assertion the agent should satisfy (repeatable)')
-    .option('--expected-trajectory <names>', 'Expected tool calls in order (comma-separated)')
-    .option('--expected-response <text>', 'Expected agent response text')
+    .option('-A, --assertion <text...>', 'Ground truth assertion the agent response must satisfy (repeatable)')
+    .option('--expected-trajectory <names>', 'Ground truth: expected tool call names in order (comma-separated)')
+    .option('--expected-response <text>', 'Ground truth: expected agent response text to compare against')
     .option('--output <path>', 'Custom output file path for results')
     .option('--json', 'Output as JSON')
     .action(
@@ -148,4 +165,386 @@ export const registerRun = (program: Command) => {
         }
       }
     );
+
+  runCmd
+    .command('batch-evaluation')
+    .description('[preview] Run evaluators in batch across all agent sessions in CloudWatch')
+    .requiredOption('-r, --runtime <name>', 'Runtime name from project config')
+    .requiredOption('-e, --evaluator <ids...>', 'Evaluator name(s) — Builtin.* IDs')
+    .option('-n, --name <name>', 'Name for the batch evaluation (auto-generated if omitted)')
+    .option('-d, --lookback-days <days>', 'Lookback window in days (filters sessions by time range)')
+    .option('-s, --session-ids <ids...>', 'Specific session IDs to evaluate')
+    .option(
+      '-g, --ground-truth <path>',
+      'JSON file with session metadata and ground truth (assertions, expected trajectory, turns)'
+    )
+    .option('--region <region>', 'AWS region (auto-detected if omitted)')
+    .option('--json', 'Output as JSON')
+    .action(
+      async (cliOptions: {
+        runtime: string;
+        evaluator: string[];
+        name?: string;
+        lookbackDays?: string;
+        sessionIds?: string[];
+        groundTruth?: string;
+        region?: string;
+        json?: boolean;
+      }) => {
+        requireProject();
+
+        try {
+          // Parse ground truth file if provided
+          let sessionMetadata: import('../../aws/agentcore-batch-evaluation').SessionMetadataEntry[] | undefined;
+          if (cliOptions.groundTruth) {
+            const { readFileSync } = await import('node:fs');
+            const gtContent = readFileSync(cliOptions.groundTruth, 'utf-8');
+            const gtData = JSON.parse(gtContent) as Record<string, unknown>;
+            // Accept either a raw array or an object with a sessionMetadata key
+            sessionMetadata = Array.isArray(gtData)
+              ? (gtData as import('../../aws/agentcore-batch-evaluation').SessionMetadataEntry[])
+              : (gtData.sessionMetadata as import('../../aws/agentcore-batch-evaluation').SessionMetadataEntry[]);
+            if (!Array.isArray(sessionMetadata)) {
+              throw new Error(
+                'Ground truth file must be a JSON array of session metadata entries, or an object with a "sessionMetadata" key'
+              );
+            }
+          }
+
+          const lookbackDays = cliOptions.lookbackDays ? parseInt(cliOptions.lookbackDays, 10) : undefined;
+          const result = await runBatchEvaluationCommand({
+            agent: cliOptions.runtime,
+            evaluators: cliOptions.evaluator,
+            name: cliOptions.name,
+            region: cliOptions.region,
+            sessionIds: cliOptions.sessionIds,
+            lookbackDays: lookbackDays && !isNaN(lookbackDays) ? lookbackDays : undefined,
+            sessionMetadata,
+            onProgress: cliOptions.json
+              ? undefined
+              : (_status, message) => {
+                  console.log(message);
+                },
+          });
+
+          // Save results locally
+          if (result.success) {
+            try {
+              const filePath = saveBatchEvalRun(result);
+              if (!cliOptions.json) {
+                console.log(`\nResults saved to: ${filePath}`);
+              }
+            } catch {
+              // Non-fatal — skip saving
+            }
+          }
+
+          if (cliOptions.json) {
+            console.log(JSON.stringify(result));
+          } else if (result.success) {
+            formatBatchEvalOutput(result);
+          } else {
+            render(<Text color="red">{result.error}</Text>);
+            if (result.logFilePath) {
+              console.error(`\nLog: ${result.logFilePath}`);
+            }
+          }
+
+          process.exit(result.success ? 0 : 1);
+        } catch (error) {
+          if (cliOptions.json) {
+            console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+          } else {
+            render(<Text color="red">Error: {getErrorMessage(error)}</Text>);
+          }
+          process.exit(1);
+        }
+      }
+    );
+
+  runCmd
+    .command('recommendation')
+    .description('[preview] Optimize a system prompt or tool descriptions using agent traces as signal')
+    .option('-t, --type <type>', 'What to optimize: system-prompt or tool-description (default: system-prompt)')
+    .option('-r, --runtime <name>', 'Runtime name from project config')
+    .option('-e, --evaluator <name>', 'Evaluator name — required for system-prompt (exactly one)')
+    .option('--prompt-file <path>', 'Load the current system prompt from a file')
+    .option('--inline <content>', 'Provide the current system prompt or tool descriptions inline')
+    .option('--bundle-name <name>', 'Read current content from a deployed config bundle')
+    .option('--bundle-version <version>', 'Config bundle version (used with --bundle-name)')
+    .option(
+      '--system-prompt-json-path <path>',
+      'Field name under "configuration" in the bundle (e.g. "systemPrompt"). The CLI resolves it to the full path automatically. Do not use bracket notation — use dot notation only.'
+    )
+    .option(
+      '--tool-desc-json-path <pair...>',
+      'Tool name:field pairs for tool descriptions in a config bundle (e.g. --tool-desc-json-path "search:searchDesc"). The CLI resolves each to the full path automatically.'
+    )
+    .option(
+      '--tools <pair...>',
+      'Tool name:description pairs (repeatable, e.g. --tools "search:Searches the web" --tools "calc:Does math")'
+    )
+    .option('--spans-file <path>', 'JSON file with OTEL session spans (use instead of CloudWatch traces)')
+    .option('--lookback <days>', 'How far back to search for traces in CloudWatch (days)', '7')
+    .option('-s, --session-id <ids...>', 'Limit trace collection to specific session IDs')
+    .option('-n, --run <name>', 'Run name prefix for the recommendation')
+    .option('--region <region>', 'AWS region')
+    .option('--json', 'Output as JSON')
+    .action(
+      async (cliOptions: {
+        type?: string;
+        runtime?: string;
+        evaluator?: string;
+        promptFile?: string;
+        inline?: string;
+        bundleName?: string;
+        bundleVersion?: string;
+        systemPromptJsonPath?: string;
+        toolDescJsonPath?: string[];
+        tools?: string[];
+        spansFile?: string;
+        lookback: string;
+        sessionId?: string[];
+        run?: string;
+        region?: string;
+        json?: boolean;
+      }) => {
+        requireProject();
+
+        const typeKey = cliOptions.type ?? 'system-prompt';
+        const recType = RECOMMENDATION_TYPE_MAP[typeKey];
+        if (!recType) {
+          const error = `Invalid --type "${typeKey}". Must be one of: ${Object.keys(RECOMMENDATION_TYPE_MAP).join(', ')}`;
+          if (cliOptions.json) {
+            console.log(JSON.stringify({ success: false, error }));
+          } else {
+            render(<Text color="red">{error}</Text>);
+          }
+          process.exit(1);
+        }
+
+        const agent = cliOptions.runtime;
+        const evaluator = cliOptions.evaluator;
+
+        if (!agent) {
+          const error = '--runtime is required';
+          if (cliOptions.json) {
+            console.log(JSON.stringify({ success: false, error }));
+          } else {
+            render(<Text color="red">{error}</Text>);
+          }
+          process.exit(1);
+        }
+
+        // Evaluator is required for system-prompt recs, optional for tool-description
+        if (recType === 'SYSTEM_PROMPT_RECOMMENDATION' && !evaluator) {
+          const error = '--evaluator is required for system-prompt recommendations';
+          if (cliOptions.json) {
+            console.log(JSON.stringify({ success: false, error }));
+          } else {
+            render(<Text color="red">{error}</Text>);
+          }
+          process.exit(1);
+        }
+
+        try {
+          const inputSource = cliOptions.promptFile
+            ? ('file' as const)
+            : cliOptions.inline
+              ? ('inline' as const)
+              : cliOptions.bundleName
+                ? ('config-bundle' as const)
+                : ('inline' as const);
+
+          const traceSource = cliOptions.spansFile
+            ? ('spans-file' as const)
+            : cliOptions.sessionId
+              ? ('sessions' as const)
+              : ('cloudwatch' as const);
+
+          // Parse --tool-desc-json-path pairs ("toolName:$.json.path") into structured format
+          const toolDescJsonPaths = cliOptions.toolDescJsonPath
+            ?.map(pair => {
+              const colonIdx = pair.indexOf(':');
+              if (colonIdx <= 0) return undefined;
+              return {
+                toolName: pair.slice(0, colonIdx),
+                toolDescriptionJsonPath: pair.slice(colonIdx + 1),
+              };
+            })
+            .filter((p): p is { toolName: string; toolDescriptionJsonPath: string } => p !== undefined);
+
+          const result = await runRecommendationCommand({
+            type: recType,
+            agent,
+            evaluators: evaluator ? [evaluator] : [],
+            promptFile: cliOptions.promptFile,
+            inlineContent: cliOptions.inline,
+            bundleName: cliOptions.bundleName,
+            bundleVersion: cliOptions.bundleVersion,
+            systemPromptJsonPath: cliOptions.systemPromptJsonPath,
+            toolDescJsonPaths: toolDescJsonPaths?.length ? toolDescJsonPaths : undefined,
+            tools: cliOptions.tools,
+            lookbackDays: parseInt(cliOptions.lookback, 10),
+            sessionIds: cliOptions.sessionId,
+            spansFile: cliOptions.spansFile,
+            recommendationName: cliOptions.run,
+            region: cliOptions.region,
+            inputSource,
+            traceSource,
+            onProgress: cliOptions.json
+              ? undefined
+              : (_status, message) => {
+                  console.log(message);
+                },
+          });
+
+          if (!result.success) {
+            if (cliOptions.json) {
+              console.log(JSON.stringify(result));
+            } else {
+              render(<Text color="red">{result.error}</Text>);
+              if (result.logFilePath) {
+                console.error(`\nLog: ${result.logFilePath}`);
+              }
+            }
+            process.exit(1);
+          }
+
+          // Save results locally
+          let savedFilePath: string | undefined;
+          try {
+            if (result.recommendationId) {
+              savedFilePath = saveRecommendationRun(
+                result.recommendationId,
+                result,
+                recType,
+                agent,
+                evaluator ? [evaluator] : []
+              );
+            }
+          } catch {
+            // Non-fatal — skip saving
+          }
+
+          if (cliOptions.json) {
+            console.log(JSON.stringify(result));
+          } else {
+            console.log(`\nRecommendation ID: ${result.recommendationId}`);
+
+            if (result.result) {
+              const sysResult = result.result.systemPromptRecommendationResult;
+              const toolResult = result.result.toolDescriptionRecommendationResult;
+
+              if (sysResult) {
+                if (sysResult.recommendedSystemPrompt) {
+                  console.log('\n+++ Recommended System Prompt +++');
+                  console.log(sysResult.recommendedSystemPrompt);
+                }
+              } else if (toolResult?.tools) {
+                for (const tool of toolResult.tools) {
+                  console.log(`\nTool: ${tool.toolName}`);
+                  console.log(`Recommended: ${tool.recommendedToolDescription}`);
+                }
+              }
+            }
+
+            if (savedFilePath) {
+              console.log(`\nResults saved to: ${savedFilePath}`);
+            }
+
+            // Sync local config bundle after server-side recommendation apply
+            if (inputSource === 'config-bundle' && cliOptions.bundleName && result.result && result.region) {
+              try {
+                const applyResult = await applyRecommendationToBundle({
+                  bundleName: cliOptions.bundleName,
+                  result: result.result,
+                  region: result.region,
+                });
+                if (applyResult.success) {
+                  console.log(
+                    `\nA new config bundle version (${applyResult.newVersionId}) was created with the recommended changes.`
+                  );
+                  console.log(`Local config for "${cliOptions.bundleName}" has been updated to match.`);
+                } else {
+                  console.log(`\nCould not sync config bundle: ${applyResult.error}`);
+                }
+              } catch {
+                // Non-fatal — user can manually sync
+              }
+            }
+            console.log('');
+          }
+
+          process.exit(0);
+        } catch (error) {
+          if (cliOptions.json) {
+            console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+          } else {
+            render(<Text color="red">Error: {getErrorMessage(error)}</Text>);
+          }
+          process.exit(1);
+        }
+      }
+    );
 };
+
+function formatBatchEvalOutput(result: RunBatchEvaluationCommandResult): void {
+  console.log(`\nBatch Evaluation: ${result.name ?? result.batchEvaluationId}`);
+  console.log(`ID: ${result.batchEvaluationId}`);
+  console.log(`Status: ${result.status}`);
+
+  // Show session stats from API if available
+  const evalResults = result.evaluationResults;
+  if (evalResults) {
+    const parts: string[] = [];
+    if (evalResults.totalNumberOfSessions != null) parts.push(`${evalResults.totalNumberOfSessions} sessions`);
+    if (evalResults.numberOfSessionsCompleted != null) parts.push(`${evalResults.numberOfSessionsCompleted} completed`);
+    if (evalResults.numberOfSessionsFailed) parts.push(`${evalResults.numberOfSessionsFailed} failed`);
+    if (parts.length > 0) console.log(`Sessions: ${parts.join(', ')}`);
+  }
+
+  console.log('');
+
+  // Prefer API evaluatorSummaries over local computation
+  const summaries = evalResults?.evaluatorSummaries;
+  if (summaries && summaries.length > 0) {
+    for (const s of summaries) {
+      const avg = s.statistics?.averageScore;
+      const avgStr = avg != null ? avg.toFixed(2) : 'N/A';
+      const failSuffix = s.totalFailed ? ` (${s.totalFailed} failed)` : '';
+      const evalCount = s.totalEvaluated != null ? ` [${s.totalEvaluated} evaluated]` : '';
+      console.log(`  ${s.evaluatorId}: ${avgStr} avg${failSuffix}${evalCount}`);
+    }
+  } else if (result.results.length > 0) {
+    // Fall back to local computation from CloudWatch results
+    const byEvaluator = new Map<string, BatchEvaluationResult[]>();
+    for (const r of result.results) {
+      const group = byEvaluator.get(r.evaluatorId) ?? [];
+      group.push(r);
+      byEvaluator.set(r.evaluatorId, group);
+    }
+
+    for (const [evalId, evalGroup] of byEvaluator) {
+      const scores = evalGroup.filter(r => !r.error).map(r => r.score!);
+      const avg = scores.length > 0 ? scores.reduce((a, b) => a + b, 0) / scores.length : 0;
+      const errors = evalGroup.filter(r => r.error).length;
+      const errorSuffix = errors > 0 ? ` (${errors} errors)` : '';
+
+      console.log(`  ${evalId}: ${avg.toFixed(2)} avg${errorSuffix}`);
+
+      for (const r of evalGroup) {
+        if (r.error) {
+          console.log(`    ERROR: ${r.error.slice(0, 80)}`);
+        } else {
+          const labelStr = r.label ? ` (${r.label})` : '';
+          console.log(`    ${r.score?.toFixed(2)}${labelStr}`);
+        }
+      }
+    }
+  } else {
+    console.log('  No evaluation results found.');
+  }
+
+  console.log('');
+}
diff --git a/src/cli/commands/status/action.ts b/src/cli/commands/status/action.ts
index 11d535e3e..1ef72aaca 100644
--- a/src/cli/commands/status/action.ts
+++ b/src/cli/commands/status/action.ts
@@ -2,6 +2,8 @@ import { ConfigIO } from '../../../lib';
 import type { AgentCoreProjectSpec, AwsDeploymentTargets, DeployedResourceState, DeployedState } from '../../../schema';
 import { getAgentRuntimeStatus } from '../../aws';
 import { getEvaluator, getOnlineEvaluationConfig } from '../../aws/agentcore-control';
+import { getHarness } from '../../aws/agentcore-harness';
+import { dnsSuffix } from '../../aws/partition';
 import { getErrorMessage } from '../../errors';
 import { ExecLogger } from '../../logging';
 import type { ResourceDeploymentState } from './constants';
@@ -12,6 +14,7 @@ export type { ResourceDeploymentState };
 export interface ResourceStatusEntry {
   resourceType:
     | 'agent'
+    | 'harness'
     | 'memory'
     | 'credential'
     | 'gateway'
@@ -19,6 +22,8 @@ export interface ResourceStatusEntry {
     | 'online-eval'
     | 'policy-engine'
     | 'policy'
+    | 'config-bundle'
+    | 'ab-test'
     | 'runtime-endpoint';
   name: string;
   deploymentState: ResourceDeploymentState;
@@ -124,6 +129,30 @@ function diffResourceSet<TLocal extends { name: string }, TDeployed>({
   return entries;
 }
 
+/**
+ * Build the full gateway invocation URL for an AB test.
+ * Appends the runtime target name and /invocations path to the gateway base URL.
+ */
+function buildGatewayInvocationUrl(
+  gwState: { gatewayId: string; gatewayArn: string; gatewayUrl?: string },
+  gwName: string,
+  project: AgentCoreProjectSpec
+): string | undefined {
+  // Use stored URL or derive from ARN: arn:aws:bedrock-agentcore:{region}:{account}:gateway/{id}
+  const baseUrl =
+    gwState.gatewayUrl ??
+    (() => {
+      const region = gwState.gatewayArn.split(':')[3];
+      return region
+        ? `https://${gwState.gatewayId}.gateway.bedrock-agentcore.${region}.${dnsSuffix(region)}`
+        : undefined;
+    })();
+  if (!baseUrl) return undefined;
+  const gwSpec = (project.httpGateways ?? []).find(gw => gw.name === gwName);
+  if (!gwSpec) return baseUrl;
+  return `${baseUrl}/${gwSpec.runtimeRef}/invocations`;
+}
+
 export function computeResourceStatuses(
   project: AgentCoreProjectSpec,
   resources: DeployedResourceState | undefined
@@ -135,6 +164,13 @@ export function computeResourceStatuses(
     getIdentifier: deployed => deployed.runtimeArn,
   });
 
+  const harnesses = diffResourceSet({
+    resourceType: 'harness',
+    localItems: project.harnesses ?? [],
+    deployedRecord: resources?.harnesses ?? {},
+    getIdentifier: deployed => deployed.harnessArn,
+  });
+
   const credentials = diffResourceSet({
     resourceType: 'credential',
     localItems: project.credentials,
@@ -210,6 +246,37 @@ export function computeResourceStatuses(
     getDeployedKey: item => `${item.engineName}/${item.name}`,
   });
 
+  const configBundles = diffResourceSet({
+    resourceType: 'config-bundle',
+    localItems: project.configBundles ?? [],
+    deployedRecord: resources?.configBundles ?? {},
+    getIdentifier: deployed => deployed.bundleArn,
+    getLocalDetail: item => item.description,
+  });
+
+  const abTests = diffResourceSet({
+    resourceType: 'ab-test',
+    localItems: project.abTests ?? [],
+    deployedRecord: resources?.abTests ?? {},
+    getIdentifier: deployed => deployed.abTestArn,
+    getLocalDetail: item => item.description,
+  });
+
+  // Enrich deployed AB tests with gateway invocation URL
+  const httpGatewayState = resources?.httpGateways ?? {};
+  for (const entry of abTests) {
+    if (entry.deploymentState !== 'deployed') continue;
+    const testSpec = (project.abTests ?? []).find(t => t.name === entry.name);
+    if (!testSpec) continue;
+    const gwMatch = /^\{\{gateway:(.+)\}\}$/.exec(testSpec.gatewayRef);
+    const gwName = gwMatch?.[1];
+    if (!gwName) continue;
+    const gwState = httpGatewayState[gwName];
+    if (!gwState) continue;
+    const url = buildGatewayInvocationUrl(gwState, gwName, project);
+    if (url) entry.invocationUrl = url;
+  }
+
   // Flatten runtime endpoints for diffing against deployed state
   const localEndpoints: { name: string; agentName: string; version: number; description?: string }[] = [];
   for (const runtime of project.runtimes) {
@@ -237,6 +304,7 @@ export function computeResourceStatuses(
 
   return [
     ...agents,
+    ...harnesses,
     ...runtimeEndpoints,
     ...credentials,
     ...memories,
@@ -245,6 +313,8 @@ export function computeResourceStatuses(
     ...onlineEvalConfigs,
     ...policyEngines,
     ...policies,
+    ...configBundles,
+    ...abTests,
   ];
 }
 
@@ -343,6 +413,42 @@ export async function handleProjectStatus(
       logger.endStep(hasErrors ? 'error' : 'success');
     }
 
+    // Enrich deployed harnesses with live status
+    const harnessStates = targetResources?.harnesses ?? {};
+    const deployedHarnesses = resources.filter(
+      e => e.resourceType === 'harness' && e.deploymentState === 'deployed' && harnessStates[e.name]
+    );
+
+    if (deployedHarnesses.length > 0) {
+      logger.startStep(
+        `Fetch harness status (${deployedHarnesses.length} harness${deployedHarnesses.length !== 1 ? 'es' : ''})`
+      );
+
+      await Promise.all(
+        resources.map(async (entry, i) => {
+          if (entry.resourceType !== 'harness' || entry.deploymentState !== 'deployed') return;
+
+          const harnessState = harnessStates[entry.name];
+          if (!harnessState) return;
+
+          try {
+            const result = await getHarness({ region: targetConfig.region, harnessId: harnessState.harnessId });
+            const runtimeArn = result.harness.environment?.agentCoreRuntimeEnvironment?.agentRuntimeArn;
+            const detail = runtimeArn ? `${result.harness.status} · Runtime: ${runtimeArn}` : result.harness.status;
+            resources[i] = { ...entry, detail };
+            logger.log(`  ${entry.name}: ${result.harness.status} (${harnessState.harnessId})`);
+          } catch (error) {
+            const errorMsg = getErrorMessage(error);
+            resources[i] = { ...entry, error: errorMsg };
+            logger.log(`  ${entry.name}: ERROR - ${errorMsg}`, 'error');
+          }
+        })
+      );
+
+      const hasHarnessErrors = resources.some(r => r.resourceType === 'harness' && r.error);
+      logger.endStep(hasHarnessErrors ? 'error' : 'success');
+    }
+
     // Enrich deployed evaluators with live status
     const evaluatorStates = targetResources?.evaluators ?? {};
     const deployedEvaluators = resources.filter(
diff --git a/src/cli/commands/status/command.tsx b/src/cli/commands/status/command.tsx
index 76c4580ea..bd997a999 100644
--- a/src/cli/commands/status/command.tsx
+++ b/src/cli/commands/status/command.tsx
@@ -9,6 +9,7 @@ import { Box, Text, render } from 'ink';
 
 const VALID_RESOURCE_TYPES = [
   'agent',
+  'harness',
   'runtime-endpoint',
   'memory',
   'credential',
@@ -17,6 +18,8 @@ const VALID_RESOURCE_TYPES = [
   'online-eval',
   'policy-engine',
   'policy',
+  'config-bundle',
+  'ab-test',
 ] as const;
 const VALID_STATES = ['deployed', 'local-only', 'pending-removal'] as const;
 
@@ -59,7 +62,7 @@ export const registerStatus = (program: Command) => {
     .option('--target <name>', 'Select deployment target')
     .option(
       '--type <type>',
-      'Filter by resource type (agent, runtime-endpoint, memory, credential, gateway, evaluator, online-eval, policy-engine, policy)'
+      'Filter by resource type (agent, harness, runtime-endpoint, memory, credential, gateway, evaluator, online-eval, policy-engine, policy, config-bundle, ab-test)'
     )
     .option('--state <state>', 'Filter by deployment state (deployed, local-only, pending-removal)')
     .option('--runtime <name>', 'Filter to a specific runtime')
@@ -136,6 +139,7 @@ export const registerStatus = (program: Command) => {
 
         const filtered = filterResources(result.resources, cliOptions);
         const agents = filtered.filter(r => r.resourceType === 'agent');
+        const harnesses = filtered.filter(r => r.resourceType === 'harness');
         const runtimeEndpoints = filtered.filter(r => r.resourceType === 'runtime-endpoint');
         const credentials = filtered.filter(r => r.resourceType === 'credential');
         const memories = filtered.filter(r => r.resourceType === 'memory');
@@ -144,11 +148,14 @@ export const registerStatus = (program: Command) => {
         const onlineEvals = filtered.filter(r => r.resourceType === 'online-eval');
         const policyEngines = filtered.filter(r => r.resourceType === 'policy-engine');
         const policies = filtered.filter(r => r.resourceType === 'policy');
+        const configBundles = filtered.filter(r => r.resourceType === 'config-bundle');
+        const abTests = filtered.filter(r => r.resourceType === 'ab-test');
+        // TODO: Add http-gateway resource type when diffResourceSet for HTTP gateways is added to action.ts
 
         render(
           <Box flexDirection="column">
             <Text bold>
-              AgentCore Status (target: {result.targetName}
+              AgentCore Status (target: {result.targetName || 'No target configured'}
               {result.targetRegion ? `, ${result.targetRegion}` : ''})
             </Text>
 
@@ -194,6 +201,15 @@ export const registerStatus = (program: Command) => {
               </Box>
             )}
 
+            {harnesses.length > 0 && (
+              <Box flexDirection="column" marginTop={1}>
+                <Text bold>Harnesses</Text>
+                {harnesses.map(entry => (
+                  <ResourceEntry key={`${entry.resourceType}-${entry.name}`} entry={entry} />
+                ))}
+              </Box>
+            )}
+
             {memories.length > 0 && (
               <Box flexDirection="column" marginTop={1}>
                 <Text bold>Memories</Text>
@@ -257,6 +273,33 @@ export const registerStatus = (program: Command) => {
               </Box>
             )}
 
+            {configBundles.length > 0 && (
+              <Box flexDirection="column" marginTop={1}>
+                <Text bold>Config Bundles</Text>
+                {configBundles.map(entry => (
+                  <ResourceEntry key={`${entry.resourceType}-${entry.name}`} entry={entry} />
+                ))}
+              </Box>
+            )}
+
+            {abTests.length > 0 && (
+              <Box flexDirection="column" marginTop={1}>
+                <Text bold>AB Tests</Text>
+                {abTests.map(entry => (
+                  <Box key={`${entry.resourceType}-${entry.name}`} flexDirection="column">
+                    <ResourceEntry entry={entry} />
+                    {entry.invocationUrl && (
+                      <Text dimColor>
+                        {'  '}Invocation URL: {entry.invocationUrl}
+                      </Text>
+                    )}
+                  </Box>
+                ))}
+              </Box>
+            )}
+
+            {/* TODO: Add HTTP Gateways render section when diffResourceSet is added to action.ts */}
+
             {filtered.length === 0 && <Text dimColor>No resources match the given filters.</Text>}
           </Box>
         );
diff --git a/src/cli/commands/stop/command.tsx b/src/cli/commands/stop/command.tsx
new file mode 100644
index 000000000..7a29dd8da
--- /dev/null
+++ b/src/cli/commands/stop/command.tsx
@@ -0,0 +1,57 @@
+import { ConfigIO } from '../../../lib';
+import { stopBatchEvaluation } from '../../aws/agentcore-batch-evaluation';
+import { getErrorMessage } from '../../errors';
+import { COMMAND_DESCRIPTIONS } from '../../tui/copy';
+import type { Command } from '@commander-js/extra-typings';
+import { Text, render } from 'ink';
+import React from 'react';
+
+async function getRegion(cliRegion?: string): Promise<string> {
+  if (cliRegion) return cliRegion;
+  try {
+    const configIO = new ConfigIO();
+    const targets = await configIO.resolveAWSDeploymentTargets();
+    if (targets.length > 0) return targets[0]!.region;
+  } catch {
+    // Fall through to env vars
+  }
+  return process.env.AWS_DEFAULT_REGION ?? process.env.AWS_REGION ?? 'us-east-1';
+}
+
+export const registerStop = (program: Command) => {
+  const stopCmd = program.command('stop').description(COMMAND_DESCRIPTIONS.stop);
+
+  stopCmd
+    .command('batch-evaluation')
+    .description('[preview] Stop a running batch evaluation')
+    .requiredOption('-i, --id <id>', 'Batch evaluation ID to stop')
+    .option('--region <region>', 'AWS region (auto-detected if omitted)')
+    .option('--json', 'Output as JSON')
+    .action(async (cliOptions: { id: string; region?: string; json?: boolean }) => {
+      try {
+        const region = await getRegion(cliOptions.region);
+
+        const result = await stopBatchEvaluation({
+          region,
+          batchEvaluationId: cliOptions.id,
+        });
+
+        if (cliOptions.json) {
+          console.log(JSON.stringify({ success: true, ...result }));
+        } else {
+          console.log(`\nBatch evaluation stopped successfully`);
+          console.log(`ID: ${result.batchEvaluationId}`);
+          console.log(`Status: ${result.status}\n`);
+        }
+
+        process.exit(0);
+      } catch (error) {
+        if (cliOptions.json) {
+          console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+        } else {
+          render(<Text color="red">Error: {getErrorMessage(error)}</Text>);
+        }
+        process.exit(1);
+      }
+    });
+};
diff --git a/src/cli/commands/stop/index.ts b/src/cli/commands/stop/index.ts
new file mode 100644
index 000000000..1f1a5e1e2
--- /dev/null
+++ b/src/cli/commands/stop/index.ts
@@ -0,0 +1 @@
+export { registerStop } from '../pause/command';
diff --git a/src/cli/commands/telemetry/__tests__/telemetry.test.ts b/src/cli/commands/telemetry/__tests__/telemetry.test.ts
index b0e615fcd..efdfd2f23 100644
--- a/src/cli/commands/telemetry/__tests__/telemetry.test.ts
+++ b/src/cli/commands/telemetry/__tests__/telemetry.test.ts
@@ -1,5 +1,5 @@
+import { readGlobalConfig } from '../../../../lib/schemas/io/global-config';
 import { createTempConfig } from '../../../__tests__/helpers/temp-config';
-import { readGlobalConfig } from '../../../global-config';
 import { handleTelemetryDisable, handleTelemetryEnable, handleTelemetryStatus } from '../actions';
 import { chmod, mkdir, rm, writeFile } from 'fs/promises';
 import { afterAll, afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
diff --git a/src/cli/commands/telemetry/actions.ts b/src/cli/commands/telemetry/actions.ts
index 90750a0f6..696608e01 100644
--- a/src/cli/commands/telemetry/actions.ts
+++ b/src/cli/commands/telemetry/actions.ts
@@ -1,4 +1,4 @@
-import { GLOBAL_CONFIG_DIR, GLOBAL_CONFIG_FILE, updateGlobalConfig } from '../../global-config.js';
+import { GLOBAL_CONFIG_DIR, GLOBAL_CONFIG_FILE, updateGlobalConfig } from '../../../lib/schemas/io/global-config.js';
 import { resolveTelemetryPreference } from '../../telemetry/config.js';
 
 export async function handleTelemetryDisable(
diff --git a/src/cli/commands/traces/action.ts b/src/cli/commands/traces/action.ts
index d761cd4b7..719245480 100644
--- a/src/cli/commands/traces/action.ts
+++ b/src/cli/commands/traces/action.ts
@@ -1,6 +1,6 @@
 import { parseTimeString } from '../../../lib/utils';
 import type { DeployedProjectConfig } from '../../operations/resolve-agent';
-import { resolveAgent } from '../../operations/resolve-agent';
+import { resolveAgentOrHarness } from '../../operations/resolve-agent';
 import { buildTraceConsoleUrl, getTrace, listTraces } from '../../operations/traces';
 import type { TracesGetOptions, TracesListOptions } from './types';
 
@@ -17,7 +17,7 @@ export async function handleTracesList(
   context: DeployedProjectConfig,
   options: TracesListOptions
 ): Promise<TracesListResult> {
-  const resolved = resolveAgent(context, options);
+  const resolved = await resolveAgentOrHarness(context, options);
   if (!resolved.success) {
     return { success: false, error: resolved.error };
   }
@@ -82,7 +82,7 @@ export async function handleTracesGet(
   traceId: string,
   options: TracesGetOptions
 ): Promise<TracesGetResult> {
-  const resolved = resolveAgent(context, options);
+  const resolved = await resolveAgentOrHarness(context, options);
   if (!resolved.success) {
     return { success: false, error: resolved.error };
   }
diff --git a/src/cli/commands/traces/command.tsx b/src/cli/commands/traces/command.tsx
index 0222ce419..a25b8a613 100644
--- a/src/cli/commands/traces/command.tsx
+++ b/src/cli/commands/traces/command.tsx
@@ -22,8 +22,9 @@ export const registerTraces = (program: Command) => {
 
   traces
     .command('list')
-    .description('List recent traces for a deployed runtime')
+    .description('List recent traces for a deployed runtime or harness')
     .option('--runtime <name>', 'Select specific runtime')
+    .option('--harness <name>', 'Select specific harness')
     .option('--limit <n>', 'Maximum number of traces to display', '20')
     .option('--since <time>', 'Start time — defaults to 12h ago (e.g. 5m, 1h, 2d, ISO 8601, epoch ms)')
     .option('--until <time>', 'End time — defaults to now (e.g. now, 1h, ISO 8601, epoch ms)')
@@ -96,6 +97,7 @@ export const registerTraces = (program: Command) => {
     .command('get <traceId>')
     .description('Download a trace to a JSON file')
     .option('--runtime <name>', 'Select specific runtime')
+    .option('--harness <name>', 'Select specific harness')
     .option('--output <path>', 'Output file path')
     .option('--since <time>', 'Start time — defaults to 12h ago (e.g. 5m, 1h, 2d, ISO 8601, epoch ms)')
     .option('--until <time>', 'End time — defaults to now (e.g. now, 1h, ISO 8601, epoch ms)')
diff --git a/src/cli/commands/traces/types.ts b/src/cli/commands/traces/types.ts
index 7e7ea4c24..662e92712 100644
--- a/src/cli/commands/traces/types.ts
+++ b/src/cli/commands/traces/types.ts
@@ -1,5 +1,6 @@
 export interface TracesListOptions {
   runtime?: string;
+  harness?: string;
   limit?: string;
   since?: string;
   until?: string;
@@ -7,6 +8,7 @@ export interface TracesListOptions {
 
 export interface TracesGetOptions {
   runtime?: string;
+  harness?: string;
   output?: string;
   since?: string;
   until?: string;
diff --git a/src/cli/commands/update/__tests__/update-action.test.ts b/src/cli/commands/update/__tests__/update-action.test.ts
index aa3170911..c54fa12d4 100644
--- a/src/cli/commands/update/__tests__/update-action.test.ts
+++ b/src/cli/commands/update/__tests__/update-action.test.ts
@@ -14,6 +14,7 @@ vi.mock('../../../constants.js', () => ({
   getDistroConfig: () => ({
     packageName: '@aws/agentcore',
     registryUrl: 'https://registry.npmjs.org',
+    distTag: 'latest',
     installCommand: 'npm install -g @aws/agentcore@latest',
   }),
 }));
diff --git a/src/cli/commands/update/action.ts b/src/cli/commands/update/action.ts
index a32f57610..ee3fb60bc 100644
--- a/src/cli/commands/update/action.ts
+++ b/src/cli/commands/update/action.ts
@@ -4,7 +4,7 @@ import { execSync } from 'child_process';
 const distroConfig = getDistroConfig();
 
 export async function fetchLatestVersion(): Promise<string> {
-  const registryUrl = `${distroConfig.registryUrl}/${distroConfig.packageName}/latest`;
+  const registryUrl = `${distroConfig.registryUrl}/${distroConfig.packageName}/${distroConfig.distTag}`;
   const response = await fetch(registryUrl);
   if (!response.ok) {
     throw new Error(`Failed to fetch latest version: ${response.statusText}`);
diff --git a/src/cli/commands/update/command.tsx b/src/cli/commands/update/command.tsx
index cd7d3b70a..06bb9ebad 100644
--- a/src/cli/commands/update/command.tsx
+++ b/src/cli/commands/update/command.tsx
@@ -3,11 +3,54 @@ import { COMMAND_DESCRIPTIONS } from '../../tui/copy';
 import { handleUpdate } from './action';
 import type { Command } from '@commander-js/extra-typings';
 import { Text, render } from 'ink';
+import React from 'react';
 
 export const registerUpdate = (program: Command) => {
-  program
-    .command('update')
-    .description(COMMAND_DESCRIPTIONS.update)
+  const updateCmd = program.command('update').description(COMMAND_DESCRIPTIONS.update);
+
+  // Default action for bare `agentcore update` - backwards compatibility with CLI self-update
+  updateCmd.option('-c, --check', 'Check for updates without installing').action(async options => {
+    try {
+      render(<Text>Checking for updates...</Text>);
+      const result = await handleUpdate(options.check ?? false);
+
+      switch (result.status) {
+        case 'up-to-date':
+          render(<Text color="green">You are already on the latest version ({result.currentVersion})</Text>);
+          break;
+        case 'newer-local':
+          render(
+            <Text color="yellow">
+              Your version ({result.currentVersion}) is newer than the published version ({result.latestVersion})
+            </Text>
+          );
+          break;
+        case 'update-available':
+          render(
+            <Text>
+              Update available: {result.currentVersion} → <Text color="green">{result.latestVersion}</Text>
+            </Text>
+          );
+          render(<Text>Run `agentcore update` to install the update.</Text>);
+          break;
+        case 'updated':
+          render(<Text color="green">Successfully updated to {result.latestVersion}</Text>);
+          break;
+        case 'update-failed':
+          render(<Text color="red">Failed to install update. Try running: npm install -g @aws/agentcore@latest</Text>);
+          process.exit(1);
+          break;
+      }
+    } catch (error) {
+      render(<Text color="red">Error: {getErrorMessage(error)}</Text>);
+      process.exit(1);
+    }
+  });
+
+  // CLI self-update subcommand
+  updateCmd
+    .command('cli')
+    .description('Update the AgentCore CLI to the latest version')
     .option('-c, --check', 'Check for updates without installing')
     .action(async options => {
       try {
@@ -31,7 +74,7 @@ export const registerUpdate = (program: Command) => {
                 Update available: {result.currentVersion} → <Text color="green">{result.latestVersion}</Text>
               </Text>
             );
-            render(<Text>Run `agentcore update` to install the update.</Text>);
+            render(<Text>Run `agentcore update cli` to install the update.</Text>);
             break;
           case 'updated':
             render(<Text color="green">Successfully updated to {result.latestVersion}</Text>);
diff --git a/src/cli/commands/validate/__tests__/action.test.ts b/src/cli/commands/validate/__tests__/action.test.ts
index d6774f252..a27894f64 100644
--- a/src/cli/commands/validate/__tests__/action.test.ts
+++ b/src/cli/commands/validate/__tests__/action.test.ts
@@ -5,12 +5,14 @@ const {
   mockReadProjectSpec,
   mockReadAWSDeploymentTargets,
   mockReadDeployedState,
+  mockReadHarnessSpec,
   mockConfigExists,
   mockFindConfigRoot,
 } = vi.hoisted(() => ({
   mockReadProjectSpec: vi.fn(),
   mockReadAWSDeploymentTargets: vi.fn(),
   mockReadDeployedState: vi.fn(),
+  mockReadHarnessSpec: vi.fn(),
   mockConfigExists: vi.fn(),
   mockFindConfigRoot: vi.fn(),
 }));
@@ -54,6 +56,7 @@ vi.mock('../../../../lib/index.js', () => {
       readProjectSpec = mockReadProjectSpec;
       readAWSDeploymentTargets = mockReadAWSDeploymentTargets;
       readDeployedState = mockReadDeployedState;
+      readHarnessSpec = mockReadHarnessSpec;
       configExists = mockConfigExists;
     },
     ConfigValidationError,
@@ -204,4 +207,135 @@ describe('handleValidate', () => {
     expect(result.success).toBe(false);
     expect(result.error).toBe('string error');
   });
+
+  describe('harness validation', () => {
+    const projectWithHarness = {
+      name: 'Test',
+      version: 1,
+      managedBy: 'CDK' as const,
+      runtimes: [],
+      memories: [{ name: 'myMemory', eventExpiryDuration: 30, strategies: [] }],
+      harnesses: [{ name: 'myHarness', path: './harnesses/myHarness' }],
+    };
+
+    const validHarnessSpec = {
+      name: 'myHarness',
+      model: { provider: 'bedrock', modelId: 'anthropic.claude-3-5-sonnet-20241022-v2:0' },
+      tools: [],
+      skills: [],
+    };
+
+    it('validates harness specs when project has harnesses', async () => {
+      mockFindConfigRoot.mockReturnValue('/project/agentcore');
+      mockReadProjectSpec.mockResolvedValue(projectWithHarness);
+      mockReadAWSDeploymentTargets.mockResolvedValue([]);
+      mockConfigExists.mockReturnValue(false);
+      mockReadHarnessSpec.mockResolvedValue(validHarnessSpec);
+
+      const result = await handleValidate({});
+
+      expect(result.success).toBe(true);
+      expect(mockReadHarnessSpec).toHaveBeenCalledWith('myHarness');
+    });
+
+    it('returns error when harness spec is invalid', async () => {
+      mockFindConfigRoot.mockReturnValue('/project/agentcore');
+      mockReadProjectSpec.mockResolvedValue(projectWithHarness);
+      mockReadAWSDeploymentTargets.mockResolvedValue([]);
+      mockConfigExists.mockReturnValue(false);
+      mockReadHarnessSpec.mockRejectedValue(new Error('invalid harness'));
+
+      const result = await handleValidate({});
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('invalid harness');
+    });
+
+    it('returns error when harness references non-existent memory', async () => {
+      mockFindConfigRoot.mockReturnValue('/project/agentcore');
+      mockReadProjectSpec.mockResolvedValue(projectWithHarness);
+      mockReadAWSDeploymentTargets.mockResolvedValue([]);
+      mockConfigExists.mockReturnValue(false);
+      mockReadHarnessSpec.mockResolvedValue({
+        ...validHarnessSpec,
+        memory: { name: 'nonExistent' },
+      });
+
+      const result = await handleValidate({});
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('references memory "nonExistent"');
+      expect(result.error).toContain('not defined in the project');
+    });
+
+    it('passes when harness references existing memory', async () => {
+      mockFindConfigRoot.mockReturnValue('/project/agentcore');
+      mockReadProjectSpec.mockResolvedValue(projectWithHarness);
+      mockReadAWSDeploymentTargets.mockResolvedValue([]);
+      mockConfigExists.mockReturnValue(false);
+      mockReadHarnessSpec.mockResolvedValue({
+        ...validHarnessSpec,
+        memory: { name: 'myMemory' },
+      });
+
+      const result = await handleValidate({});
+
+      expect(result.success).toBe(true);
+    });
+
+    it('passes when harness memory uses arn instead of name', async () => {
+      mockFindConfigRoot.mockReturnValue('/project/agentcore');
+      mockReadProjectSpec.mockResolvedValue(projectWithHarness);
+      mockReadAWSDeploymentTargets.mockResolvedValue([]);
+      mockConfigExists.mockReturnValue(false);
+      mockReadHarnessSpec.mockResolvedValue({
+        ...validHarnessSpec,
+        memory: { arn: 'arn:aws:bedrock:us-east-1:123456789012:memory/abc' },
+      });
+
+      const result = await handleValidate({});
+
+      expect(result.success).toBe(true);
+    });
+
+    it('skips harness validation when project has no harnesses', async () => {
+      mockFindConfigRoot.mockReturnValue('/project/agentcore');
+      mockReadProjectSpec.mockResolvedValue({
+        name: 'Test',
+        version: 1,
+        managedBy: 'CDK' as const,
+        runtimes: [],
+        memories: [],
+      });
+      mockReadAWSDeploymentTargets.mockResolvedValue([]);
+      mockConfigExists.mockReturnValue(false);
+
+      const result = await handleValidate({});
+
+      expect(result.success).toBe(true);
+      expect(mockReadHarnessSpec).not.toHaveBeenCalled();
+    });
+
+    it('validates multiple harnesses and fails on first error', async () => {
+      mockFindConfigRoot.mockReturnValue('/project/agentcore');
+      mockReadProjectSpec.mockResolvedValue({
+        ...projectWithHarness,
+        harnesses: [
+          { name: 'harness1', path: './harnesses/harness1' },
+          { name: 'harness2', path: './harnesses/harness2' },
+        ],
+      });
+      mockReadAWSDeploymentTargets.mockResolvedValue([]);
+      mockConfigExists.mockReturnValue(false);
+      mockReadHarnessSpec.mockImplementation((name: string) => {
+        if (name === 'harness1') return Promise.resolve(validHarnessSpec);
+        return Promise.reject(new Error('harness2 invalid'));
+      });
+
+      const result = await handleValidate({});
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('harness2 invalid');
+    });
+  });
 });
diff --git a/src/cli/commands/validate/action.ts b/src/cli/commands/validate/action.ts
index 572f5cf7d..410056750 100644
--- a/src/cli/commands/validate/action.ts
+++ b/src/cli/commands/validate/action.ts
@@ -7,6 +7,7 @@ import {
   NoProjectError,
   findConfigRoot,
 } from '../../../lib';
+import type { AgentCoreProjectSpec } from '../../../schema';
 
 export interface ValidateOptions {
   directory?: string;
@@ -36,8 +37,9 @@ export async function handleValidate(options: ValidateOptions): Promise<Validate
   const configIO = new ConfigIO({ baseDir: configRoot });
 
   // Validate project spec (agentcore.json)
+  let projectSpec: AgentCoreProjectSpec;
   try {
-    await configIO.readProjectSpec();
+    projectSpec = await configIO.readProjectSpec();
   } catch (err) {
     return { success: false, error: formatError(err, 'agentcore.json') };
   }
@@ -58,6 +60,27 @@ export async function handleValidate(options: ValidateOptions): Promise<Validate
     }
   }
 
+  // Validate harness specs
+  const harnesses = projectSpec.harnesses ?? [];
+  const memoryNames = new Set((projectSpec.memories ?? []).map(m => m.name));
+
+  for (const harness of harnesses) {
+    const harnessFile = `harnesses/${harness.name}/harness.json`;
+
+    try {
+      const harnessSpec = await configIO.readHarnessSpec(harness.name);
+
+      if (harnessSpec.memory?.name && !memoryNames.has(harnessSpec.memory.name)) {
+        return {
+          success: false,
+          error: `Harness "${harness.name}" references memory "${harnessSpec.memory.name}" which is not defined in the project`,
+        };
+      }
+    } catch (err) {
+      return { success: false, error: formatError(err, harnessFile) };
+    }
+  }
+
   return { success: true };
 }
 
diff --git a/src/cli/constants.ts b/src/cli/constants.ts
index 48c3e0375..85d053817 100644
--- a/src/cli/constants.ts
+++ b/src/cli/constants.ts
@@ -30,11 +30,21 @@ export const DISTRO_CONFIG = {
   },
 } as const;
 
+export function getNpmDistTag(): string {
+  return PACKAGE_VERSION.includes('-') ? 'preview' : 'latest';
+}
+
 /**
  * Get the current distribution configuration.
  */
 export function getDistroConfig() {
-  return DISTRO_CONFIG[DISTRO_MODE];
+  const base = DISTRO_CONFIG[DISTRO_MODE];
+  const distTag = getNpmDistTag();
+  return {
+    ...base,
+    distTag,
+    installCommand: base.installCommand.replace('@latest', `@${distTag}`),
+  };
 }
 
 /**
diff --git a/src/cli/external-requirements/__tests__/checks-extended.test.ts b/src/cli/external-requirements/__tests__/checks-extended.test.ts
index 535d1b929..ecd4fe526 100644
--- a/src/cli/external-requirements/__tests__/checks-extended.test.ts
+++ b/src/cli/external-requirements/__tests__/checks-extended.test.ts
@@ -53,6 +53,10 @@ describe('requiresUv', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
     expect(requiresUv(project)).toBe(true);
   });
@@ -78,6 +82,10 @@ describe('requiresUv', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
     expect(requiresUv(project)).toBe(false);
   });
@@ -94,6 +102,10 @@ describe('requiresUv', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
     expect(requiresUv(project)).toBe(false);
   });
@@ -121,6 +133,10 @@ describe('requiresContainerRuntime', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
     expect(requiresContainerRuntime(project)).toBe(true);
   });
@@ -146,6 +162,10 @@ describe('requiresContainerRuntime', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
     expect(requiresContainerRuntime(project)).toBe(false);
   });
@@ -162,6 +182,10 @@ describe('requiresContainerRuntime', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
     expect(requiresContainerRuntime(project)).toBe(false);
   });
@@ -195,6 +219,10 @@ describe('requiresContainerRuntime', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
     expect(requiresContainerRuntime(project)).toBe(true);
   });
@@ -262,6 +290,10 @@ describe('checkDependencyVersions', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     const result = await checkDependencyVersions(project);
@@ -282,6 +314,10 @@ describe('checkDependencyVersions', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     const result = await checkDependencyVersions(project);
@@ -310,6 +346,10 @@ describe('checkDependencyVersions', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     const result = await checkDependencyVersions(project);
diff --git a/src/cli/logging/remove-logger.ts b/src/cli/logging/remove-logger.ts
index 9ec7e43ad..4f659c089 100644
--- a/src/cli/logging/remove-logger.ts
+++ b/src/cli/logging/remove-logger.ts
@@ -9,6 +9,7 @@ export interface RemoveLoggerOptions {
   /** Type of resource being removed */
   resourceType:
     | 'agent'
+    | 'harness'
     | 'memory'
     | 'credential'
     | 'gateway'
@@ -17,7 +18,9 @@ export interface RemoveLoggerOptions {
     | 'evaluator'
     | 'online-eval'
     | 'policy-engine'
-    | 'policy';
+    | 'policy'
+    | 'config-bundle'
+    | 'ab-test';
   /** Name of the resource being removed */
   resourceName: string;
 }
diff --git a/src/cli/operations/ab-test/__tests__/promote.test.ts b/src/cli/operations/ab-test/__tests__/promote.test.ts
new file mode 100644
index 000000000..2abf8583c
--- /dev/null
+++ b/src/cli/operations/ab-test/__tests__/promote.test.ts
@@ -0,0 +1,270 @@
+import { promoteABTestConfig } from '../promote';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+// Mock ConfigIO — vi.hoisted ensures these are available before the hoisted vi.mock runs
+const { mockReadProjectSpec, mockWriteProjectSpec, mockReadDeployedState } = vi.hoisted(() => ({
+  mockReadProjectSpec: vi.fn(),
+  mockWriteProjectSpec: vi.fn(),
+  mockReadDeployedState: vi.fn(),
+}));
+
+vi.mock('../../../../lib', () => {
+  class MockConfigIO {
+    readProjectSpec = mockReadProjectSpec;
+    writeProjectSpec = mockWriteProjectSpec;
+    readDeployedState = mockReadDeployedState;
+  }
+  return { ConfigIO: MockConfigIO };
+});
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function makeConfigBundleProject(testName = 'myTest') {
+  return {
+    name: 'TestProject',
+    runtimes: [],
+    httpGateways: [],
+    onlineEvalConfigs: [],
+    abTests: [
+      {
+        name: testName,
+        mode: 'config-bundle' as const,
+        gatewayRef: '{{gateway:my-gw}}',
+        variants: [
+          {
+            name: 'C' as const,
+            weight: 50,
+            variantConfiguration: {
+              configurationBundle: { bundleArn: 'arn:aws:bundle:control', bundleVersion: 'v1' },
+            },
+          },
+          {
+            name: 'T1' as const,
+            weight: 50,
+            variantConfiguration: {
+              configurationBundle: { bundleArn: 'arn:aws:bundle:treatment', bundleVersion: 'v2' },
+            },
+          },
+        ],
+        evaluationConfig: { onlineEvaluationConfigArn: 'arn:aws:eval:config' },
+      },
+    ],
+  };
+}
+
+function makeTargetBasedProject(testName = 'targetTest') {
+  return {
+    name: 'TestProject',
+    runtimes: [
+      {
+        name: 'my-runtime',
+        endpoints: {
+          control: { version: '1.0' },
+          treatment: { version: '2.0' },
+        },
+      },
+    ],
+    httpGateways: [
+      {
+        name: 'my-gw',
+        targets: [
+          { name: 'ctrl-target', runtimeRef: 'my-runtime', qualifier: 'control' },
+          { name: 'treat-target', runtimeRef: 'my-runtime', qualifier: 'treatment' },
+        ],
+      },
+    ],
+    onlineEvalConfigs: [],
+    abTests: [
+      {
+        name: testName,
+        mode: 'target-based' as const,
+        gatewayRef: '{{gateway:my-gw}}',
+        variants: [
+          {
+            name: 'C' as const,
+            weight: 50,
+            variantConfiguration: { target: { targetName: 'ctrl-target' } },
+          },
+          {
+            name: 'T1' as const,
+            weight: 50,
+            variantConfiguration: { target: { targetName: 'treat-target' } },
+          },
+        ],
+        evaluationConfig: {
+          perVariantOnlineEvaluationConfig: [
+            { treatmentName: 'C' as const, onlineEvaluationConfigArn: 'eval-c' },
+            { treatmentName: 'T1' as const, onlineEvaluationConfigArn: 'eval-t1' },
+          ],
+        },
+      },
+    ],
+  };
+}
+
+function makeDeployedState(specName: string, abTestId: string) {
+  return {
+    targets: {
+      default: {
+        resources: {
+          abTests: {
+            [specName]: { abTestId, abTestArn: `arn:aws:ab-test:${abTestId}` },
+          },
+        },
+      },
+    },
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('promoteABTestConfig', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockWriteProjectSpec.mockResolvedValue(undefined);
+  });
+
+  describe('target-based promote', () => {
+    it('updates control endpoint version to treatment version', async () => {
+      const project = makeTargetBasedProject();
+      mockReadProjectSpec.mockResolvedValue(project);
+      mockReadDeployedState.mockResolvedValue(makeDeployedState('targetTest', 'ab-123'));
+
+      const result = await promoteABTestConfig('ab-123');
+
+      expect(result.promoted).toBe(true);
+      expect(result.mode).toBe('target-based');
+      expect(result.promotionDetail).toContain('control');
+      expect(result.promotionDetail).toContain('2.0');
+
+      // Verify the project was written with updated control version
+      expect(mockWriteProjectSpec).toHaveBeenCalledOnce();
+      const writtenProject = mockWriteProjectSpec.mock.calls[0]![0];
+      expect(writtenProject.runtimes[0].endpoints.control.version).toBe('2.0');
+    });
+  });
+
+  describe('config-bundle promote', () => {
+    it('copies treatment bundle ref to control', async () => {
+      const project = makeConfigBundleProject();
+      mockReadProjectSpec.mockResolvedValue(project);
+      mockReadDeployedState.mockResolvedValue(makeDeployedState('myTest', 'ab-456'));
+
+      const result = await promoteABTestConfig('ab-456');
+
+      expect(result.promoted).toBe(true);
+      expect(result.mode).toBe('config-bundle');
+      expect(result.promotionDetail).toContain('arn:aws:bundle:treatment');
+      expect(result.promotionDetail).toContain('v2');
+
+      // Verify the control bundle was updated
+      expect(mockWriteProjectSpec).toHaveBeenCalledOnce();
+      const writtenProject = mockWriteProjectSpec.mock.calls[0]![0];
+      const controlVariant = writtenProject.abTests[0].variants.find((v: { name: string }) => v.name === 'C');
+      expect(controlVariant.variantConfiguration.configurationBundle.bundleArn).toBe('arn:aws:bundle:treatment');
+      expect(controlVariant.variantConfiguration.configurationBundle.bundleVersion).toBe('v2');
+    });
+  });
+
+  describe('not found', () => {
+    it('returns promoted=false with message when AB test not found', async () => {
+      const project = makeConfigBundleProject();
+      mockReadProjectSpec.mockResolvedValue(project);
+      mockReadDeployedState.mockResolvedValue({ targets: { default: { resources: { abTests: {} } } } });
+
+      const result = await promoteABTestConfig('nonexistent-id');
+
+      expect(result.promoted).toBe(false);
+      expect(result.promotionDetail).toContain('not found');
+      expect(mockWriteProjectSpec).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('ID-based lookup from deployed state', () => {
+    it('resolves spec name from deployed state using abTestId', async () => {
+      const project = makeConfigBundleProject('mySpecTest');
+      mockReadProjectSpec.mockResolvedValue(project);
+      mockReadDeployedState.mockResolvedValue(makeDeployedState('mySpecTest', 'ab-789'));
+
+      const result = await promoteABTestConfig('ab-789');
+
+      expect(result.promoted).toBe(true);
+      expect(result.mode).toBe('config-bundle');
+      // Should have resolved without needing testNameFallback
+      expect(mockWriteProjectSpec).toHaveBeenCalledOnce();
+    });
+
+    it('searches across multiple targets in deployed state', async () => {
+      const project = makeConfigBundleProject('crossTarget');
+      mockReadProjectSpec.mockResolvedValue(project);
+      mockReadDeployedState.mockResolvedValue({
+        targets: {
+          'us-east-1': { resources: { abTests: {} } },
+          'us-west-2': {
+            resources: {
+              abTests: {
+                crossTarget: { abTestId: 'ab-cross', abTestArn: 'arn:aws:ab-test:ab-cross' },
+              },
+            },
+          },
+        },
+      });
+
+      const result = await promoteABTestConfig('ab-cross');
+
+      expect(result.promoted).toBe(true);
+    });
+  });
+
+  describe('name fallback when deployed state missing', () => {
+    it('falls back to name-based lookup when deployed state throws', async () => {
+      const project = makeConfigBundleProject('fallbackTest');
+      mockReadProjectSpec.mockResolvedValue(project);
+      mockReadDeployedState.mockRejectedValue(new Error('No deployed state'));
+
+      const warnSpy = vi.spyOn(console, 'warn').mockImplementation(vi.fn());
+
+      const result = await promoteABTestConfig('unknown-id', 'fallbackTest');
+
+      expect(result.promoted).toBe(true);
+      expect(result.mode).toBe('config-bundle');
+      expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('falling back to name'));
+
+      warnSpy.mockRestore();
+    });
+
+    it('falls back to prefixed name match', async () => {
+      const project = makeConfigBundleProject('myTest');
+      mockReadProjectSpec.mockResolvedValue(project);
+      mockReadDeployedState.mockRejectedValue(new Error('No deployed state'));
+
+      const warnSpy = vi.spyOn(console, 'warn').mockImplementation(vi.fn());
+
+      // testNameFallback uses the prefixed format {projectName}_{testName}
+      const result = await promoteABTestConfig('unknown-id', 'TestProject_myTest');
+
+      expect(result.promoted).toBe(true);
+
+      warnSpy.mockRestore();
+    });
+
+    it('returns not found when neither deployed state nor name matches', async () => {
+      const project = makeConfigBundleProject('myTest');
+      mockReadProjectSpec.mockResolvedValue(project);
+      mockReadDeployedState.mockRejectedValue(new Error('No deployed state'));
+
+      const warnSpy = vi.spyOn(console, 'warn').mockImplementation(vi.fn());
+
+      const result = await promoteABTestConfig('unknown-id', 'nonexistent');
+
+      expect(result.promoted).toBe(false);
+      expect(result.promotionDetail).toContain('not found');
+
+      warnSpy.mockRestore();
+    });
+  });
+});
diff --git a/src/cli/operations/ab-test/promote.ts b/src/cli/operations/ab-test/promote.ts
new file mode 100644
index 000000000..5f98e52f6
--- /dev/null
+++ b/src/cli/operations/ab-test/promote.ts
@@ -0,0 +1,124 @@
+import { ConfigIO } from '../../../lib';
+
+export interface PromoteABTestResult {
+  promoted: boolean;
+  mode?: string;
+  promotionDetail: string;
+}
+
+/**
+ * Resolve the spec-level AB test name from a deployed abTestId.
+ * Looks up which entry in deployed state has that abTestId and returns
+ * the spec name (the key in the abTests record).
+ */
+function resolveSpecNameFromDeployedState(
+  configIO: ConfigIO,
+  deployedState: { targets: Record<string, { resources?: { abTests?: Record<string, { abTestId: string }> } }> },
+  abTestId: string
+): string | undefined {
+  for (const target of Object.values(deployedState.targets)) {
+    const abTests = target.resources?.abTests;
+    if (!abTests) continue;
+    for (const [specName, entry] of Object.entries(abTests)) {
+      if (entry.abTestId === abTestId) {
+        return specName;
+      }
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Apply AB test promotion to agentcore.json.
+ * Updates the control variant's config to match the treatment variant.
+ * Does NOT stop the AB test — caller is responsible for that.
+ *
+ * @param abTestId - The deployed AB test ID
+ * @param testNameFallback - Optional name fallback when deployed state is unavailable
+ */
+export async function promoteABTestConfig(abTestId: string, testNameFallback?: string): Promise<PromoteABTestResult> {
+  const configIO = new ConfigIO();
+  const project = await configIO.readProjectSpec();
+
+  // Try to resolve spec name from deployed state
+  let specName: string | undefined;
+  try {
+    const deployedState = await configIO.readDeployedState();
+    specName = resolveSpecNameFromDeployedState(configIO, deployedState, abTestId);
+  } catch {
+    // Deployed state unavailable
+  }
+
+  // Fall back to name-based lookup if deployed state didn't resolve
+  if (!specName && testNameFallback) {
+    console.warn(
+      `[promote] Could not resolve AB test ID "${abTestId}" from deployed state; falling back to name "${testNameFallback}".`
+    );
+    const lowerName = testNameFallback.toLowerCase();
+    const match = (project.abTests ?? []).find(
+      t => t.name.toLowerCase() === lowerName || `${project.name}_${t.name}`.toLowerCase() === lowerName
+    );
+    specName = match?.name;
+  }
+
+  const abTest = specName ? (project.abTests ?? []).find(t => t.name === specName) : undefined;
+
+  if (!abTest) {
+    return { promoted: false, promotionDetail: `AB test with ID "${abTestId}" not found in project config.` };
+  }
+
+  const mode = abTest.mode ?? 'config-bundle';
+
+  if (abTest.mode === 'target-based') {
+    const treatmentVariant = abTest.variants.find(v => v.name === 'T1');
+    const controlVariant = abTest.variants.find(v => v.name === 'C');
+    const controlTargetName = controlVariant?.variantConfiguration.target?.targetName;
+    const treatmentTargetName = treatmentVariant?.variantConfiguration.target?.targetName;
+
+    const gwMatch = /^\{\{gateway:(.+)\}\}$/.exec(abTest.gatewayRef);
+    const gwName = gwMatch?.[1];
+    if (gwName) {
+      const gw = (project.httpGateways ?? []).find(g => g.name === gwName);
+      if (gw?.targets) {
+        const controlTarget = gw.targets.find(t => t.name === controlTargetName);
+        const treatmentTarget = gw.targets.find(t => t.name === treatmentTargetName);
+
+        if (controlTarget && treatmentTarget) {
+          const runtime = project.runtimes.find(r => r.name === controlTarget.runtimeRef);
+          const controlEp = runtime?.endpoints?.[controlTarget.qualifier];
+          const treatmentEp = runtime?.endpoints?.[treatmentTarget.qualifier];
+          if (controlEp && treatmentEp) {
+            controlEp.version = treatmentEp.version;
+            await configIO.writeProjectSpec(project);
+            return {
+              promoted: true,
+              mode,
+              promotionDetail: `Control endpoint "${controlTarget.qualifier}" updated to version ${treatmentEp.version} (from treatment "${treatmentTarget.qualifier}").`,
+            };
+          }
+        }
+      }
+    }
+    return { promoted: false, mode, promotionDetail: 'Could not resolve target endpoints for promotion.' };
+  }
+
+  // Config-bundle mode
+  const controlVariant = abTest.variants.find(v => v.name === 'C');
+  const treatmentVariant = abTest.variants.find(v => v.name === 'T1');
+  if (
+    controlVariant?.variantConfiguration.configurationBundle &&
+    treatmentVariant?.variantConfiguration.configurationBundle
+  ) {
+    controlVariant.variantConfiguration.configurationBundle = {
+      ...treatmentVariant.variantConfiguration.configurationBundle,
+    };
+    await configIO.writeProjectSpec(project);
+    return {
+      promoted: true,
+      mode,
+      promotionDetail: `Control bundle updated to "${treatmentVariant.variantConfiguration.configurationBundle.bundleArn}" version "${treatmentVariant.variantConfiguration.configurationBundle.bundleVersion}".`,
+    };
+  }
+
+  return { promoted: false, mode, promotionDetail: 'Could not resolve config bundles for promotion.' };
+}
diff --git a/src/cli/operations/agent/config-bundle-defaults.ts b/src/cli/operations/agent/config-bundle-defaults.ts
new file mode 100644
index 000000000..25db93003
--- /dev/null
+++ b/src/cli/operations/agent/config-bundle-defaults.ts
@@ -0,0 +1,30 @@
+import { ConfigIO } from '../../../lib';
+
+export async function createConfigBundleForAgent(agentName: string, configBaseDir: string): Promise<void> {
+  const configIO = new ConfigIO({ baseDir: configBaseDir });
+  const project = await configIO.readProjectSpec();
+
+  const bundleName = `${agentName}Config`;
+  if ((project.configBundles ?? []).some(b => b.name === bundleName)) return;
+
+  project.configBundles ??= [];
+  project.configBundles.push({
+    type: 'ConfigurationBundle',
+    name: bundleName,
+    description: `Configuration for ${agentName} — managed by agentcore CLI`,
+    components: {
+      [`{{runtime:${agentName}}}`]: {
+        configuration: {
+          systemPrompt: 'You are a helpful assistant. Use tools when appropriate.',
+          toolDescriptions: {
+            add_numbers: 'Return the sum of two numbers',
+          },
+        },
+      },
+    },
+    branchName: 'mainline',
+    commitMessage: 'Initial configuration',
+  });
+
+  await configIO.writeProjectSpec(project);
+}
diff --git a/src/cli/operations/agent/generate/schema-mapper.ts b/src/cli/operations/agent/generate/schema-mapper.ts
index 6d8ca15ab..3ed449236 100644
--- a/src/cli/operations/agent/generate/schema-mapper.ts
+++ b/src/cli/operations/agent/generate/schema-mapper.ts
@@ -284,5 +284,6 @@ export async function mapGenerateConfigToRenderConfig(
     dockerfile: config.dockerfile,
     sessionStorageMountPath: config.sessionStorageMountPath,
     enableOtel,
+    hasConfigBundle: config.withConfigBundle,
   };
 }
diff --git a/src/cli/operations/agent/generate/write-agent-to-project.ts b/src/cli/operations/agent/generate/write-agent-to-project.ts
index 26750d279..728236e54 100644
--- a/src/cli/operations/agent/generate/write-agent-to-project.ts
+++ b/src/cli/operations/agent/generate/write-agent-to-project.ts
@@ -72,6 +72,10 @@ export async function writeAgentToProject(config: GenerateConfig, options?: Writ
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     await configIO.writeProjectSpec(project);
diff --git a/src/cli/operations/config-bundle/__tests__/bundle-name-variants.test.ts b/src/cli/operations/config-bundle/__tests__/bundle-name-variants.test.ts
new file mode 100644
index 000000000..5c753cb52
--- /dev/null
+++ b/src/cli/operations/config-bundle/__tests__/bundle-name-variants.test.ts
@@ -0,0 +1,22 @@
+import { getBundleNameVariants } from '../bundle-name-variants';
+import { describe, expect, it } from 'vitest';
+
+describe('getBundleNameVariants', () => {
+  it('returns only the bundle name when no project name', () => {
+    expect(getBundleNameVariants('MyBundle')).toEqual(['MyBundle']);
+  });
+
+  it('returns only the bundle name when project name is undefined', () => {
+    expect(getBundleNameVariants('MyBundle', undefined)).toEqual(['MyBundle']);
+  });
+
+  it('returns three variants when project name is provided', () => {
+    const variants = getBundleNameVariants('MyBundle', 'testevo');
+    expect(variants).toEqual(['MyBundle', 'testevoMyBundle', 'testevo_MyBundle']);
+  });
+
+  it('filters out empty bundle name', () => {
+    const variants = getBundleNameVariants('', 'proj');
+    expect(variants).toEqual(['proj', 'proj_']);
+  });
+});
diff --git a/src/cli/operations/config-bundle/__tests__/resolve-bundle.test.ts b/src/cli/operations/config-bundle/__tests__/resolve-bundle.test.ts
new file mode 100644
index 000000000..6ecbeb71e
--- /dev/null
+++ b/src/cli/operations/config-bundle/__tests__/resolve-bundle.test.ts
@@ -0,0 +1,103 @@
+import { resolveBundleByName } from '../resolve-bundle';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { mockListConfigurationBundles, mockListConfigurationBundleVersions } = vi.hoisted(() => ({
+  mockListConfigurationBundles: vi.fn(),
+  mockListConfigurationBundleVersions: vi.fn(),
+}));
+
+vi.mock('../../../aws/agentcore-config-bundles', () => ({
+  listConfigurationBundles: mockListConfigurationBundles,
+  listConfigurationBundleVersions: mockListConfigurationBundleVersions,
+}));
+
+const mockConfigIO = {
+  readDeployedState: vi.fn(),
+  readProjectSpec: vi.fn(),
+} as any;
+
+const REGION = 'us-east-1';
+
+describe('resolveBundleByName', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockConfigIO.readDeployedState.mockResolvedValue({ targets: {} });
+    mockConfigIO.readProjectSpec.mockResolvedValue({ name: 'testproj' });
+  });
+
+  it('resolves via deployed state fast path', async () => {
+    mockConfigIO.readDeployedState.mockResolvedValue({
+      targets: {
+        'us-east-1': {
+          resources: {
+            configBundles: {
+              MyBundle: { bundleId: 'bundle-123', bundleArn: 'arn:bundle', versionId: 'v1' },
+            },
+          },
+        },
+      },
+    });
+    mockListConfigurationBundleVersions.mockResolvedValue({
+      versions: [{ versionId: 'v2', versionCreatedAt: '2026-01-01T00:00:00Z' }],
+    });
+
+    const result = await resolveBundleByName('MyBundle', REGION, mockConfigIO);
+    expect(result.bundleId).toBe('bundle-123');
+    expect(result.versionId).toBe('v2');
+    expect(mockListConfigurationBundles).not.toHaveBeenCalled();
+  });
+
+  it('falls back to API when deployed state is empty', async () => {
+    mockListConfigurationBundles.mockResolvedValue({
+      bundles: [{ bundleId: 'bundle-456', bundleArn: 'arn:bundle-456', bundleName: 'testprojMyBundle' }],
+      nextToken: undefined,
+    });
+    mockListConfigurationBundleVersions.mockResolvedValue({
+      versions: [{ versionId: 'v1', versionCreatedAt: '2026-01-01T00:00:00Z' }],
+    });
+
+    const result = await resolveBundleByName('MyBundle', REGION, mockConfigIO);
+    expect(result.bundleId).toBe('bundle-456');
+  });
+
+  it('matches legacy underscore-prefixed name', async () => {
+    mockListConfigurationBundles.mockResolvedValue({
+      bundles: [{ bundleId: 'bundle-789', bundleArn: 'arn:bundle-789', bundleName: 'testproj_MyBundle' }],
+      nextToken: undefined,
+    });
+    mockListConfigurationBundleVersions.mockResolvedValue({
+      versions: [{ versionId: 'v1', versionCreatedAt: '2026-01-01T00:00:00Z' }],
+    });
+
+    const result = await resolveBundleByName('MyBundle', REGION, mockConfigIO);
+    expect(result.bundleId).toBe('bundle-789');
+  });
+
+  it('paginates through multiple pages to find bundle', async () => {
+    mockListConfigurationBundles
+      .mockResolvedValueOnce({
+        bundles: [{ bundleId: 'other-1', bundleArn: 'arn:other', bundleName: 'OtherBundle' }],
+        nextToken: 'page2',
+      })
+      .mockResolvedValueOnce({
+        bundles: [{ bundleId: 'bundle-found', bundleArn: 'arn:found', bundleName: 'testprojMyBundle' }],
+        nextToken: undefined,
+      });
+    mockListConfigurationBundleVersions.mockResolvedValue({
+      versions: [{ versionId: 'v1', versionCreatedAt: '2026-01-01T00:00:00Z' }],
+    });
+
+    const result = await resolveBundleByName('MyBundle', REGION, mockConfigIO);
+    expect(result.bundleId).toBe('bundle-found');
+    expect(mockListConfigurationBundles).toHaveBeenCalledTimes(2);
+  });
+
+  it('throws when bundle not found after all pages', async () => {
+    mockListConfigurationBundles.mockResolvedValue({
+      bundles: [{ bundleId: 'other', bundleArn: 'arn:other', bundleName: 'SomeOtherBundle' }],
+      nextToken: undefined,
+    });
+
+    await expect(resolveBundleByName('MyBundle', REGION, mockConfigIO)).rejects.toThrow('not found');
+  });
+});
diff --git a/src/cli/operations/config-bundle/bundle-name-variants.ts b/src/cli/operations/config-bundle/bundle-name-variants.ts
new file mode 100644
index 000000000..a282b9ad3
--- /dev/null
+++ b/src/cli/operations/config-bundle/bundle-name-variants.ts
@@ -0,0 +1,11 @@
+/**
+ * Returns all possible API-side names for a config bundle.
+ * The API stores bundles with a project-name prefix, but users reference them by local name.
+ */
+export function getBundleNameVariants(bundleName: string, projectName?: string): string[] {
+  return [
+    bundleName,
+    projectName ? `${projectName}${bundleName}` : undefined,
+    projectName ? `${projectName}_${bundleName}` : undefined,
+  ].filter((x): x is string => Boolean(x));
+}
diff --git a/src/cli/operations/config-bundle/diff-versions.ts b/src/cli/operations/config-bundle/diff-versions.ts
new file mode 100644
index 000000000..cc9ae6ed9
--- /dev/null
+++ b/src/cli/operations/config-bundle/diff-versions.ts
@@ -0,0 +1,63 @@
+/**
+ * Client-side deep diff between two config bundle version components.
+ */
+
+export interface DiffEntry {
+  path: string;
+  type: 'added' | 'removed' | 'changed';
+  oldValue?: unknown;
+  newValue?: unknown;
+}
+
+/**
+ * Deep diff two JSON objects, returning a flat list of changes with dot-notation paths.
+ */
+export function deepDiff(from: unknown, to: unknown, prefix = ''): DiffEntry[] {
+  const entries: DiffEntry[] = [];
+
+  if (from === to) return entries;
+
+  if (from === null || to === null || typeof from !== typeof to) {
+    if (from === undefined) {
+      entries.push({ path: prefix, type: 'added', newValue: to });
+    } else if (to === undefined) {
+      entries.push({ path: prefix, type: 'removed', oldValue: from });
+    } else {
+      entries.push({ path: prefix, type: 'changed', oldValue: from, newValue: to });
+    }
+    return entries;
+  }
+
+  if (typeof from !== 'object') {
+    entries.push({ path: prefix, type: 'changed', oldValue: from, newValue: to });
+    return entries;
+  }
+
+  if (Array.isArray(from) || Array.isArray(to)) {
+    if (!Array.isArray(from) || !Array.isArray(to) || from.length !== to.length) {
+      entries.push({ path: prefix, type: 'changed', oldValue: from, newValue: to });
+      return entries;
+    }
+    for (let i = 0; i < from.length; i++) {
+      entries.push(...deepDiff(from[i], to[i], `${prefix}[${i}]`));
+    }
+    return entries;
+  }
+
+  const fromObj = from as Record<string, unknown>;
+  const toObj = to as Record<string, unknown>;
+  const allKeys = new Set([...Object.keys(fromObj), ...Object.keys(toObj)]);
+
+  for (const key of allKeys) {
+    const childPath = prefix ? `${prefix}.${key}` : key;
+    if (!(key in fromObj)) {
+      entries.push({ path: childPath, type: 'added', newValue: toObj[key] });
+    } else if (!(key in toObj)) {
+      entries.push({ path: childPath, type: 'removed', oldValue: fromObj[key] });
+    } else {
+      entries.push(...deepDiff(fromObj[key], toObj[key], childPath));
+    }
+  }
+
+  return entries;
+}
diff --git a/src/cli/operations/config-bundle/resolve-bundle.ts b/src/cli/operations/config-bundle/resolve-bundle.ts
new file mode 100644
index 000000000..964c705c1
--- /dev/null
+++ b/src/cli/operations/config-bundle/resolve-bundle.ts
@@ -0,0 +1,91 @@
+/**
+ * Resolves a config bundle name to its bundle ID.
+ *
+ * Fast path: reads deployed-state.json for known bundle IDs.
+ * Fallback: calls listConfigurationBundles API to find by name.
+ */
+import { ConfigIO } from '../../../lib';
+import { listConfigurationBundleVersions, listConfigurationBundles } from '../../aws/agentcore-config-bundles';
+import { getBundleNameVariants } from './bundle-name-variants';
+
+export interface ResolvedBundle {
+  bundleId: string;
+  bundleArn?: string;
+  versionId?: string;
+  region: string;
+}
+
+/**
+ * Resolve a bundle name to its API identifiers.
+ * Tries deployed-state.json first, then falls back to list API.
+ */
+export async function resolveBundleByName(
+  bundleName: string,
+  region: string,
+  configIO: ConfigIO = new ConfigIO()
+): Promise<ResolvedBundle> {
+  // Fast path: check deployed state
+  const deployedState = await configIO.readDeployedState();
+  for (const targetName of Object.keys(deployedState.targets ?? {})) {
+    const target = deployedState.targets?.[targetName];
+    const bundles = target?.resources?.configBundles;
+    const bundle = bundles?.[bundleName];
+    if (bundle) {
+      // Verify the bundle still exists by listing versions (branch-agnostic)
+      try {
+        const versions = await listConfigurationBundleVersions({
+          region,
+          bundleId: bundle.bundleId,
+          maxResults: 1,
+        });
+        const latestVersion = versions.versions[0];
+        return {
+          bundleId: bundle.bundleId,
+          bundleArn: bundle.bundleArn,
+          versionId: latestVersion?.versionId ?? bundle.versionId,
+          region,
+        };
+      } catch {
+        // Stale deployed-state entry — fall through to API lookup
+      }
+    }
+  }
+
+  // Fallback: search via API
+  // The API stores bundles with a prefixed name: {projectName}{bundleName}
+  let projectName: string | undefined;
+  try {
+    const projectSpec = await configIO.readProjectSpec();
+    projectName = projectSpec.name;
+  } catch {
+    // Project spec may not be available
+  }
+
+  const nameVariants = getBundleNameVariants(bundleName, projectName);
+  let nextToken: string | undefined;
+  let match: { bundleId: string; bundleArn: string; bundleName: string } | undefined;
+  do {
+    const page = await listConfigurationBundles({ region, maxResults: 100, nextToken });
+    match = page.bundles.find(b => nameVariants.includes(b.bundleName));
+    nextToken = page.nextToken;
+  } while (!match && nextToken);
+
+  if (!match) {
+    throw new Error(`Configuration bundle "${bundleName}" not found. Has it been deployed?`);
+  }
+
+  // Get the latest version ID (branch-agnostic)
+  const versions = await listConfigurationBundleVersions({
+    region,
+    bundleId: match.bundleId,
+    maxResults: 1,
+  });
+  const latestVersion = versions.versions[0];
+
+  return {
+    bundleId: match.bundleId,
+    bundleArn: match.bundleArn,
+    versionId: latestVersion?.versionId,
+    region,
+  };
+}
diff --git a/src/cli/operations/deploy/__tests__/change-detection.test.ts b/src/cli/operations/deploy/__tests__/change-detection.test.ts
new file mode 100644
index 000000000..779a98615
--- /dev/null
+++ b/src/cli/operations/deploy/__tests__/change-detection.test.ts
@@ -0,0 +1,135 @@
+import { canSkipDeploy, computeProjectDeployHash } from '../change-detection';
+import { describe, expect, it, vi } from 'vitest';
+
+describe('computeProjectDeployHash', () => {
+  it('produces same hash for identical input', async () => {
+    const configIO = mockConfigIO({
+      projectSpec: { name: 'test', runtimes: [], harnesses: [], memories: [] },
+      awsTargets: [{ name: 'default', account: '123', region: 'us-west-2' }],
+    });
+
+    const hash1 = await computeProjectDeployHash(configIO as any);
+    const hash2 = await computeProjectDeployHash(configIO as any);
+    expect(hash1).toBe(hash2);
+  });
+
+  it('changes hash when project spec changes', async () => {
+    const configIO1 = mockConfigIO({
+      projectSpec: { name: 'test', runtimes: [], harnesses: [], memories: [] },
+      awsTargets: [{ name: 'default', account: '123', region: 'us-west-2' }],
+    });
+
+    const configIO2 = mockConfigIO({
+      projectSpec: { name: 'test-changed', runtimes: [], harnesses: [], memories: [] },
+      awsTargets: [{ name: 'default', account: '123', region: 'us-west-2' }],
+    });
+
+    const hash1 = await computeProjectDeployHash(configIO1 as any);
+    const hash2 = await computeProjectDeployHash(configIO2 as any);
+    expect(hash1).not.toBe(hash2);
+  });
+
+  it('changes hash when aws targets change', async () => {
+    const configIO1 = mockConfigIO({
+      projectSpec: { name: 'test', runtimes: [], harnesses: [], memories: [] },
+      awsTargets: [{ name: 'default', account: '123', region: 'us-west-2' }],
+    });
+
+    const configIO2 = mockConfigIO({
+      projectSpec: { name: 'test', runtimes: [], harnesses: [], memories: [] },
+      awsTargets: [{ name: 'default', account: '123', region: 'us-east-1' }],
+    });
+
+    const hash1 = await computeProjectDeployHash(configIO1 as any);
+    const hash2 = await computeProjectDeployHash(configIO2 as any);
+    expect(hash1).not.toBe(hash2);
+  });
+
+  it('returns a 16-character hex string', async () => {
+    const configIO = mockConfigIO({
+      projectSpec: { name: 'test', runtimes: [], harnesses: [], memories: [] },
+      awsTargets: [{ name: 'default', account: '123', region: 'us-west-2' }],
+    });
+
+    const hash = await computeProjectDeployHash(configIO as any);
+    expect(hash).toMatch(/^[a-f0-9]{16}$/);
+  });
+});
+
+describe('canSkipDeploy', () => {
+  it('returns false when project has runtimes', async () => {
+    const configIO = mockConfigIO({
+      projectSpec: { name: 'test', runtimes: [{ name: 'agent1' }], harnesses: [], memories: [] },
+      awsTargets: [{ name: 'default', account: '123', region: 'us-west-2' }],
+      deployedState: { targets: { default: { resources: { deployHash: 'abc' } } } },
+    });
+
+    expect(await canSkipDeploy(configIO as any)).toBe(false);
+  });
+
+  it('returns false when no deployed state', async () => {
+    const configIO = mockConfigIO({
+      projectSpec: { name: 'test', runtimes: [], harnesses: [], memories: [] },
+      awsTargets: [{ name: 'default', account: '123', region: 'us-west-2' }],
+      deployedState: { targets: {} },
+    });
+
+    expect(await canSkipDeploy(configIO as any)).toBe(false);
+  });
+
+  it('returns false when hash differs', async () => {
+    const configIO = mockConfigIO({
+      projectSpec: { name: 'test', runtimes: [], harnesses: [], memories: [] },
+      awsTargets: [{ name: 'default', account: '123', region: 'us-west-2' }],
+      deployedState: { targets: { default: { resources: { deployHash: 'stale-hash' } } } },
+    });
+
+    expect(await canSkipDeploy(configIO as any)).toBe(false);
+  });
+
+  it('returns true when hash matches for harness-only project', async () => {
+    const projectSpec = { name: 'test', runtimes: [], harnesses: [], memories: [] };
+    const awsTargets = [{ name: 'default', account: '123', region: 'us-west-2' }];
+
+    const configIO = mockConfigIO({ projectSpec, awsTargets, deployedState: { targets: {} } });
+    const hash = await computeProjectDeployHash(configIO as any);
+
+    const configIO2 = mockConfigIO({
+      projectSpec,
+      awsTargets,
+      deployedState: { targets: { default: { resources: { deployHash: hash } } } },
+    });
+
+    expect(await canSkipDeploy(configIO2 as any)).toBe(true);
+  });
+
+  it('returns false when any target has mismatched hash', async () => {
+    const projectSpec = { name: 'test', runtimes: [], harnesses: [], memories: [] };
+    const awsTargets = [{ name: 'default', account: '123', region: 'us-west-2' }];
+
+    const configIO = mockConfigIO({ projectSpec, awsTargets, deployedState: { targets: {} } });
+    const hash = await computeProjectDeployHash(configIO as any);
+
+    const configIO2 = mockConfigIO({
+      projectSpec,
+      awsTargets,
+      deployedState: {
+        targets: {
+          default: { resources: { deployHash: hash } },
+          staging: { resources: { deployHash: 'wrong' } },
+        },
+      },
+    });
+
+    expect(await canSkipDeploy(configIO2 as any)).toBe(false);
+  });
+});
+
+function mockConfigIO(opts: { projectSpec: any; awsTargets: any; deployedState?: any }) {
+  return {
+    readProjectSpec: vi.fn().mockResolvedValue(opts.projectSpec),
+    readAWSDeploymentTargets: vi.fn().mockResolvedValue(opts.awsTargets),
+    readDeployedState: vi.fn().mockResolvedValue(opts.deployedState ?? { targets: {} }),
+    getConfigRoot: vi.fn().mockReturnValue('/fake/agentcore'),
+  };
+}
diff --git a/src/cli/operations/deploy/__tests__/post-deploy-ab-tests.test.ts b/src/cli/operations/deploy/__tests__/post-deploy-ab-tests.test.ts
new file mode 100644
index 000000000..ef23302cb
--- /dev/null
+++ b/src/cli/operations/deploy/__tests__/post-deploy-ab-tests.test.ts
@@ -0,0 +1,597 @@
+import type { AgentCoreProjectSpec, DeployedResourceState } from '../../../../schema';
+import { deleteOrphanedABTests, setupABTests } from '../post-deploy-ab-tests.js';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+// ── Hoisted mocks ──────────────────────────────────────────────────────────
+
+const {
+  mockCreateABTest,
+  mockDeleteABTest,
+  mockGetABTest,
+  mockUpdateABTest,
+  mockListABTests,
+  mockGetCredentialProvider,
+  mockIAMSend,
+} = vi.hoisted(() => ({
+  mockCreateABTest: vi.fn(),
+  mockDeleteABTest: vi.fn(),
+  mockGetABTest: vi.fn(),
+  mockUpdateABTest: vi.fn(),
+  mockListABTests: vi.fn(),
+  mockGetCredentialProvider: vi.fn().mockReturnValue(undefined),
+  mockIAMSend: vi.fn(),
+}));
+
+vi.mock('../../../aws/agentcore-ab-tests', () => ({
+  createABTest: mockCreateABTest,
+  deleteABTest: mockDeleteABTest,
+  getABTest: mockGetABTest,
+  updateABTest: mockUpdateABTest,
+  listABTests: mockListABTests,
+}));
+
+vi.mock('../../../aws/account', () => ({
+  getCredentialProvider: mockGetCredentialProvider,
+}));
+
+vi.mock('@aws-sdk/client-iam', () => ({
+  IAMClient: class {
+    send = mockIAMSend;
+  },
+  CreateRoleCommand: class {
+    constructor(public input: unknown) {}
+  },
+  PutRolePolicyCommand: class {
+    constructor(public input: unknown) {}
+  },
+  DeleteRolePolicyCommand: class {
+    constructor(public input: unknown) {}
+  },
+  DeleteRoleCommand: class {
+    constructor(public input: unknown) {}
+  },
+}));
+
+// ── Helpers ────────────────────────────────────────────────────────────────
+
+function makeProjectSpec(abTests: AgentCoreProjectSpec['abTests'] = []): AgentCoreProjectSpec {
+  return {
+    name: 'TestProject',
+    version: 1,
+    managedBy: 'CDK' as const,
+    runtimes: [],
+    memories: [],
+    credentials: [],
+    evaluators: [],
+    onlineEvalConfigs: [],
+    agentCoreGateways: [],
+    policyEngines: [],
+    harnesses: [],
+    configBundles: [],
+    httpGateways: [],
+    abTests,
+  };
+}
+
+const sampleABTest = {
+  name: 'TestOne',
+  mode: 'config-bundle' as const,
+  gatewayRef: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:gateway/gw-123',
+  variants: [
+    {
+      name: 'C' as const,
+      weight: 80,
+      variantConfiguration: { configurationBundle: { bundleArn: 'arn:bundle:control', bundleVersion: 'v1' } },
+    },
+    {
+      name: 'T1' as const,
+      weight: 20,
+      variantConfiguration: { configurationBundle: { bundleArn: 'arn:bundle:treatment', bundleVersion: 'v1' } },
+    },
+  ],
+  evaluationConfig: { onlineEvaluationConfigArn: 'arn:eval:config' },
+  roleArn: 'arn:aws:iam::123456789012:role/ExistingRole',
+};
+
+// ── Tests ──────────────────────────────────────────────────────────────────
+
+describe('setupABTests', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockListABTests.mockResolvedValue({ abTests: [] });
+    mockUpdateABTest.mockResolvedValue({});
+    mockGetABTest.mockResolvedValue({ status: 'ACTIVE', executionStatus: 'STOPPED' });
+  });
+
+  describe('creation', () => {
+    it('creates new AB test when not in deployed state', async () => {
+      mockCreateABTest.mockResolvedValue({ abTestId: 'abt-001', abTestArn: 'arn:abt:001' });
+
+      const result = await setupABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([sampleABTest]),
+      });
+
+      expect(result.hasErrors).toBe(false);
+      expect(result.results).toHaveLength(1);
+      expect(result.results[0]!.status).toBe('created');
+      expect(result.results[0]!.abTestId).toBe('abt-001');
+      expect(result.abTests.TestOne).toEqual(
+        expect.objectContaining({ abTestId: 'abt-001', abTestArn: 'arn:abt:001' })
+      );
+    });
+
+    it('updates already-deployed test', async () => {
+      mockUpdateABTest.mockResolvedValue({ abTestId: 'abt-existing', abTestArn: 'arn:abt:existing' });
+
+      const result = await setupABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([sampleABTest]),
+        existingABTests: {
+          TestOne: { abTestId: 'abt-existing', abTestArn: 'arn:abt:existing' },
+        },
+      });
+
+      expect(result.results[0]!.status).toBe('updated');
+      expect(mockCreateABTest).not.toHaveBeenCalled();
+      expect(mockUpdateABTest).toHaveBeenCalled();
+    });
+
+    it('updates test found via API list (state loss recovery)', async () => {
+      mockListABTests.mockResolvedValue({
+        abTests: [{ name: 'TestOne', abTestId: 'abt-api', abTestArn: 'arn:abt:api' }],
+      });
+      mockUpdateABTest.mockResolvedValue({ abTestId: 'abt-api', abTestArn: 'arn:abt:api' });
+
+      const result = await setupABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([sampleABTest]),
+      });
+
+      expect(result.results[0]!.status).toBe('updated');
+      expect(result.abTests.TestOne!.abTestId).toBe('abt-api');
+      expect(mockCreateABTest).not.toHaveBeenCalled();
+      expect(mockUpdateABTest).toHaveBeenCalled();
+    });
+
+    it('auto-creates IAM role when roleArn not provided', async () => {
+      const testWithoutRole = { ...sampleABTest, roleArn: undefined };
+      mockCreateABTest.mockResolvedValue({ abTestId: 'abt-002', abTestArn: 'arn:abt:002' });
+      mockIAMSend.mockResolvedValue({ Role: { Arn: 'arn:aws:iam::123:role/AutoRole' } });
+
+      const result = await setupABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([testWithoutRole]),
+      });
+
+      expect(result.results[0]!.status).toBe('created');
+      expect(result.abTests.TestOne!.roleCreatedByCli).toBe(true);
+      expect(mockIAMSend).toHaveBeenCalled();
+    });
+
+    it('uses provided roleArn without creating IAM role', async () => {
+      mockCreateABTest.mockResolvedValue({ abTestId: 'abt-003', abTestArn: 'arn:abt:003' });
+
+      const result = await setupABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([sampleABTest]),
+      });
+
+      expect(result.results[0]!.status).toBe('created');
+      expect(result.abTests.TestOne!.roleCreatedByCli).toBe(false);
+      expect(mockIAMSend).not.toHaveBeenCalled();
+    });
+
+    it('reports error when createABTest fails', async () => {
+      mockCreateABTest.mockRejectedValue(new Error('API failure'));
+
+      const result = await setupABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([sampleABTest]),
+      });
+
+      expect(result.hasErrors).toBe(true);
+      expect(result.results[0]!.status).toBe('error');
+      expect(result.results[0]!.error).toBe('API failure');
+    });
+  });
+
+  describe('ARN resolution', () => {
+    it('resolves bundle name to ARN from deployed state', async () => {
+      const testWithNames = {
+        ...sampleABTest,
+        variants: [
+          {
+            name: 'C' as const,
+            weight: 80,
+            variantConfiguration: { configurationBundle: { bundleArn: 'my-bundle', bundleVersion: 'LATEST' } },
+          },
+          {
+            name: 'T1' as const,
+            weight: 20,
+            variantConfiguration: { configurationBundle: { bundleArn: 'my-bundle', bundleVersion: 'v2' } },
+          },
+        ],
+      };
+      mockCreateABTest.mockResolvedValue({ abTestId: 'abt-004', abTestArn: 'arn:abt:004' });
+
+      await setupABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([testWithNames]),
+        deployedResources: {
+          configBundles: {
+            'my-bundle': { bundleArn: 'arn:bundle:resolved', versionId: 'ver-latest' },
+          },
+        } as unknown as DeployedResourceState,
+      });
+
+      const callArgs = mockCreateABTest.mock.calls[0]![0];
+      expect(callArgs.variants[0].variantConfiguration.configurationBundle.bundleArn).toBe('arn:bundle:resolved');
+      expect(callArgs.variants[0].variantConfiguration.configurationBundle.bundleVersion).toBe('ver-latest');
+      expect(callArgs.variants[1].variantConfiguration.configurationBundle.bundleVersion).toBe('v2');
+    });
+
+    it('resolves gateway placeholder to ARN', async () => {
+      const testWithPlaceholder = {
+        ...sampleABTest,
+        gatewayRef: '{{gateway:my-gw}}',
+      };
+      mockCreateABTest.mockResolvedValue({ abTestId: 'abt-005', abTestArn: 'arn:abt:005' });
+
+      await setupABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([testWithPlaceholder]),
+        deployedResources: {
+          mcp: {
+            gateways: {
+              'my-gw': { gatewayArn: 'arn:aws:bedrock-agentcore:us-east-1:123:gateway/resolved-gw' },
+            },
+          },
+        } as unknown as DeployedResourceState,
+      });
+
+      expect(mockCreateABTest.mock.calls[0]![0].gatewayArn).toBe(
+        'arn:aws:bedrock-agentcore:us-east-1:123:gateway/resolved-gw'
+      );
+    });
+
+    it('resolves gateway placeholder to ARN from HTTP gateways', async () => {
+      const testWithPlaceholder = {
+        ...sampleABTest,
+        gatewayRef: '{{gateway:my-http-gw}}',
+      };
+      mockCreateABTest.mockResolvedValue({ abTestId: 'abt-007', abTestArn: 'arn:abt:007' });
+
+      await setupABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([testWithPlaceholder]),
+        deployedResources: {
+          httpGateways: {
+            'my-http-gw': {
+              gatewayId: 'httpgw-001',
+              gatewayArn: 'arn:aws:bedrock-agentcore:us-east-1:123:httpgateway/httpgw-001',
+            },
+          },
+        } as unknown as DeployedResourceState,
+      });
+
+      expect(mockCreateABTest.mock.calls[0]![0].gatewayArn).toBe(
+        'arn:aws:bedrock-agentcore:us-east-1:123:httpgateway/httpgw-001'
+      );
+    });
+
+    it('resolves online eval config name to ARN', async () => {
+      const testWithEvalName = {
+        ...sampleABTest,
+        evaluationConfig: { onlineEvaluationConfigArn: 'my-eval-config' },
+      };
+      mockCreateABTest.mockResolvedValue({ abTestId: 'abt-006', abTestArn: 'arn:abt:006' });
+
+      await setupABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([testWithEvalName]),
+        deployedResources: {
+          onlineEvalConfigs: {
+            'my-eval-config': { onlineEvaluationConfigArn: 'arn:eval:resolved' },
+          },
+        } as unknown as DeployedResourceState,
+      });
+
+      expect(mockCreateABTest.mock.calls[0]![0].evaluationConfig.onlineEvaluationConfigArn).toBe('arn:eval:resolved');
+    });
+  });
+
+  describe('deletion (reconciliation)', () => {
+    it('stops, polls until executionStatus is STOPPED, then deletes orphaned AB test', async () => {
+      const callOrder: string[] = [];
+      mockUpdateABTest.mockImplementation(() => {
+        callOrder.push('stop');
+        return Promise.resolve({});
+      });
+      let getCallCount = 0;
+      mockGetABTest.mockImplementation(() => {
+        getCallCount++;
+        callOrder.push(`poll(${getCallCount})`);
+        // First poll: executionStatus not yet STOPPED (still transitioning)
+        if (getCallCount === 1) return Promise.resolve({ status: 'ACTIVE', executionStatus: 'RUNNING' });
+        // Second poll: executionStatus is STOPPED — done
+        return Promise.resolve({ status: 'ACTIVE', executionStatus: 'STOPPED' });
+      });
+      mockDeleteABTest.mockImplementation(() => {
+        callOrder.push('delete');
+        return Promise.resolve({ success: true });
+      });
+
+      const result = await deleteOrphanedABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([]),
+        existingABTests: {
+          RemovedTest: { abTestId: 'abt-old', abTestArn: 'arn:abt:old' },
+        },
+      });
+
+      // Verify: stop → poll (RUNNING) → poll (STOPPED) → delete
+      expect(callOrder).toEqual(['stop', 'poll(1)', 'poll(2)', 'delete']);
+      expect(mockUpdateABTest).toHaveBeenCalledWith({
+        region: 'us-east-1',
+        abTestId: 'abt-old',
+        executionStatus: 'STOPPED',
+      });
+      expect(result.results[0]!.status).toBe('deleted');
+    });
+
+    it('proceeds with delete when stop fails (already stopped)', async () => {
+      mockUpdateABTest.mockRejectedValue(new Error('Cannot update in current state'));
+      mockDeleteABTest.mockResolvedValue({ success: true });
+
+      const result = await deleteOrphanedABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([]),
+        existingABTests: {
+          RemovedTest: { abTestId: 'abt-stopped', abTestArn: 'arn:abt:stopped' },
+        },
+      });
+
+      expect(mockUpdateABTest).toHaveBeenCalled();
+      expect(mockDeleteABTest).toHaveBeenCalled();
+      expect(result.results[0]!.status).toBe('deleted');
+    });
+
+    it('cleans up auto-created IAM role on deletion', async () => {
+      mockDeleteABTest.mockResolvedValue({ success: true });
+      mockIAMSend.mockResolvedValue({});
+
+      await deleteOrphanedABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([]),
+        existingABTests: {
+          RemovedTest: {
+            abTestId: 'abt-old',
+            abTestArn: 'arn:abt:old',
+            roleArn: 'arn:aws:iam::123:role/AutoCreatedRole',
+            roleCreatedByCli: true,
+          },
+        },
+      });
+
+      // Should have called delete policy + delete role
+      expect(mockIAMSend).toHaveBeenCalledTimes(2);
+
+      // Verify first call is DeleteRolePolicyCommand
+      const firstCall = mockIAMSend.mock.calls[0]![0];
+      expect(firstCall.input).toEqual(
+        expect.objectContaining({ RoleName: 'AutoCreatedRole', PolicyName: expect.any(String) })
+      );
+
+      // Verify second call is DeleteRoleCommand
+      const secondCall = mockIAMSend.mock.calls[1]![0];
+      expect(secondCall.input).toEqual(expect.objectContaining({ RoleName: 'AutoCreatedRole' }));
+    });
+
+    it('does not delete role when roleCreatedByCli is false', async () => {
+      mockDeleteABTest.mockResolvedValue({ success: true });
+
+      await deleteOrphanedABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([]),
+        existingABTests: {
+          RemovedTest: {
+            abTestId: 'abt-old',
+            abTestArn: 'arn:abt:old',
+            roleArn: 'arn:aws:iam::123:role/UserRole',
+            roleCreatedByCli: false,
+          },
+        },
+      });
+
+      expect(mockIAMSend).not.toHaveBeenCalled();
+    });
+
+    it('reports error when deletion fails', async () => {
+      mockDeleteABTest.mockRejectedValue(new Error('delete failed'));
+
+      const result = await deleteOrphanedABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([]),
+        existingABTests: {
+          FailTest: { abTestId: 'abt-fail', abTestArn: 'arn:abt:fail' },
+        },
+      });
+
+      expect(result.hasErrors).toBe(true);
+      expect(result.results[0]!.status).toBe('error');
+      expect(result.results[0]!.error).toBe('delete failed');
+    });
+
+    it('sets warning when AB test was stopped before deletion', async () => {
+      mockUpdateABTest.mockResolvedValue({});
+      mockGetABTest.mockResolvedValue({ status: 'ACTIVE', executionStatus: 'STOPPED' });
+      mockDeleteABTest.mockResolvedValue({ success: true });
+
+      const result = await deleteOrphanedABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([]),
+        existingABTests: {
+          StoppedTest: { abTestId: 'abt-warn', abTestArn: 'arn:abt:warn' },
+        },
+      });
+
+      expect(result.results[0]!.status).toBe('deleted');
+      expect(result.results[0]!.warning).toBe('AB test "StoppedTest" was stopped before deletion');
+    });
+
+    it('does not set warning when stop fails (already stopped)', async () => {
+      mockUpdateABTest.mockRejectedValue(new Error('Cannot update'));
+      mockDeleteABTest.mockResolvedValue({ success: true });
+
+      const result = await deleteOrphanedABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([]),
+        existingABTests: {
+          AlreadyStopped: { abTestId: 'abt-no-warn', abTestArn: 'arn:abt:no-warn' },
+        },
+      });
+
+      expect(result.results[0]!.status).toBe('deleted');
+      expect(result.results[0]!.warning).toBeUndefined();
+    });
+
+    it('proceeds with delete even when poll never reaches STOPPED (timeout)', async () => {
+      mockUpdateABTest.mockResolvedValue({});
+      // executionStatus never becomes STOPPED — always RUNNING
+      mockGetABTest.mockResolvedValue({ status: 'ACTIVE', executionStatus: 'RUNNING' });
+      mockDeleteABTest.mockResolvedValue({ success: true });
+
+      const result = await deleteOrphanedABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([]),
+        existingABTests: {
+          StuckTest: { abTestId: 'abt-stuck', abTestArn: 'arn:abt:stuck' },
+        },
+      });
+
+      // Should still attempt delete after exhausting poll loop
+      expect(mockDeleteABTest).toHaveBeenCalledWith({ region: 'us-east-1', abTestId: 'abt-stuck' });
+      expect(result.results[0]!.status).toBe('deleted');
+      // Poll was called 20 times (the loop limit)
+      expect(mockGetABTest).toHaveBeenCalledTimes(20);
+      // Should warn that polling timed out
+      expect(result.results[0]!.warning).toBe(
+        'AB test "StuckTest" did not reach STOPPED status within the polling window — proceeding with delete'
+      );
+    }, 120_000);
+
+    it('sets warning even when deleteABTest returns success: false', async () => {
+      mockUpdateABTest.mockResolvedValue({});
+      mockGetABTest.mockResolvedValue({ status: 'ACTIVE', executionStatus: 'STOPPED' });
+      mockDeleteABTest.mockResolvedValue({ success: false, error: 'still running' });
+
+      const result = await deleteOrphanedABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([]),
+        existingABTests: {
+          FailAfterStop: { abTestId: 'abt-fail-stop', abTestArn: 'arn:abt:fail-stop' },
+        },
+      });
+
+      expect(result.results[0]!.status).toBe('error');
+      expect(result.results[0]!.error).toBe('still running');
+      // Warning should still be set because stop succeeded
+      expect(result.results[0]!.warning).toBe('AB test "FailAfterStop" was stopped before deletion');
+    });
+  });
+
+  describe('IAM role creation', () => {
+    it('creates role with correct trust policy and inline policy', async () => {
+      const testWithoutRole = { ...sampleABTest, roleArn: undefined };
+      mockCreateABTest.mockResolvedValue({ abTestId: 'abt-iam', abTestArn: 'arn:abt:iam' });
+      mockIAMSend.mockResolvedValue({ Role: { Arn: 'arn:aws:iam::123:role/AutoRole' } });
+
+      await setupABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([testWithoutRole]),
+      });
+
+      // First call: CreateRoleCommand with trust policy
+      const createRoleCall = mockIAMSend.mock.calls[0]![0];
+      const trustPolicy = JSON.parse(createRoleCall.input.AssumeRolePolicyDocument);
+      expect(trustPolicy.Statement).toHaveLength(1);
+      expect(trustPolicy.Statement[0].Principal.Service).toBe('bedrock-agentcore.amazonaws.com');
+
+      // Second call: PutRolePolicyCommand with inline policy
+      const putPolicyCall = mockIAMSend.mock.calls[1]![0];
+      const policy = JSON.parse(putPolicyCall.input.PolicyDocument);
+      const sids = policy.Statement.map((s: { Sid: string }) => s.Sid);
+      expect(sids).toContain('GatewayRuleStatement');
+      expect(sids).toContain('GatewayReadStatement');
+      expect(sids).toContain('GatewayListStatement');
+      expect(sids).toContain('OnlineEvaluationConfigStatement');
+      expect(sids).toContain('ConfigurationBundleReadStatement');
+      expect(sids).toContain('CloudWatchLogReadStatement');
+      expect(sids).toContain('CloudWatchIndexPolicyStatement');
+
+      // ListGateways must use wildcard resource (can't be scoped)
+      const listGatewayStmt = policy.Statement.find((s: { Sid: string }) => s.Sid === 'GatewayListStatement');
+      expect(listGatewayStmt.Resource).toEqual(['*']);
+    });
+  });
+
+  describe('edge cases', () => {
+    it('proceeds with creation when listABTests fails', async () => {
+      mockListABTests.mockRejectedValue(new Error('API unavailable'));
+      mockCreateABTest.mockResolvedValue({ abTestId: 'abt-new', abTestArn: 'arn:abt:new' });
+
+      const result = await setupABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([sampleABTest]),
+      });
+
+      expect(result.results[0]!.status).toBe('created');
+      expect(mockCreateABTest).toHaveBeenCalled();
+    });
+
+    it('swallows errors during IAM role deletion', async () => {
+      mockDeleteABTest.mockResolvedValue({ success: true });
+      mockIAMSend.mockRejectedValue(new Error('IAM permission denied'));
+
+      const result = await deleteOrphanedABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([]),
+        existingABTests: {
+          OldTest: {
+            abTestId: 'abt-old',
+            abTestArn: 'arn:abt:old',
+            roleArn: 'arn:aws:iam::123:role/SomeRole',
+            roleCreatedByCli: true,
+          },
+        },
+      });
+
+      // Deletion should still succeed even though IAM cleanup failed
+      expect(result.results[0]!.status).toBe('deleted');
+    });
+  });
+
+  describe('mixed operations', () => {
+    it('creates new and updates existing', async () => {
+      const newTest = { ...sampleABTest, name: 'NewTest' };
+      const keptTest = { ...sampleABTest, name: 'KeptTest' };
+
+      mockCreateABTest.mockResolvedValue({ abTestId: 'abt-new', abTestArn: 'arn:abt:new' });
+      mockUpdateABTest.mockResolvedValue({ abTestId: 'abt-kept', abTestArn: 'arn:abt:kept' });
+
+      const result = await setupABTests({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([newTest, keptTest]),
+        existingABTests: {
+          KeptTest: { abTestId: 'abt-kept', abTestArn: 'arn:abt:kept' },
+        },
+      });
+
+      expect(result.results).toHaveLength(2);
+      const statuses = result.results.map(r => `${r.testName}:${r.status}`);
+      expect(statuses).toContain('NewTest:created');
+      expect(statuses).toContain('KeptTest:updated');
+    });
+  });
+});
diff --git a/src/cli/operations/deploy/__tests__/post-deploy-config-bundles.test.ts b/src/cli/operations/deploy/__tests__/post-deploy-config-bundles.test.ts
new file mode 100644
index 000000000..34be18b88
--- /dev/null
+++ b/src/cli/operations/deploy/__tests__/post-deploy-config-bundles.test.ts
@@ -0,0 +1,652 @@
+import type { AgentCoreProjectSpec, DeployedState } from '../../../../schema';
+import { resolveConfigBundleComponentKeys, setupConfigBundles } from '../post-deploy-config-bundles.js';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const {
+  mockCreateConfigurationBundle,
+  mockDeleteConfigurationBundle,
+  mockGetConfigurationBundleVersion,
+  mockListConfigurationBundleVersions,
+  mockListConfigurationBundles,
+  mockUpdateConfigurationBundle,
+} = vi.hoisted(() => ({
+  mockCreateConfigurationBundle: vi.fn(),
+  mockDeleteConfigurationBundle: vi.fn(),
+  mockGetConfigurationBundleVersion: vi.fn(),
+  mockListConfigurationBundleVersions: vi.fn(),
+  mockListConfigurationBundles: vi.fn(),
+  mockUpdateConfigurationBundle: vi.fn(),
+}));
+
+vi.mock('../../../aws/agentcore-config-bundles', () => ({
+  createConfigurationBundle: mockCreateConfigurationBundle,
+  deleteConfigurationBundle: mockDeleteConfigurationBundle,
+  getConfigurationBundleVersion: mockGetConfigurationBundleVersion,
+  listConfigurationBundleVersions: mockListConfigurationBundleVersions,
+  listConfigurationBundles: mockListConfigurationBundles,
+  updateConfigurationBundle: mockUpdateConfigurationBundle,
+}));
+
+const REGION = 'us-west-2';
+
+function makeProjectSpec(configBundles: Record<string, unknown>[]) {
+  return { name: 'TestProject', configBundles } as any;
+}
+
+describe('setupConfigBundles', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('create new bundle', () => {
+    it('should create a new bundle when not in existingBundles and not found by name', async () => {
+      mockListConfigurationBundles.mockResolvedValue({ bundles: [] });
+      mockCreateConfigurationBundle.mockResolvedValue({
+        bundleId: 'b-new',
+        bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-new',
+        versionId: 'v-1',
+      });
+
+      const result = await setupConfigBundles({
+        region: REGION,
+        projectSpec: makeProjectSpec([
+          { name: 'MyBundle', type: 'ConfigurationBundle', components: { foo: { type: 'inline', value: 'bar' } } },
+        ]),
+      });
+
+      expect(mockCreateConfigurationBundle).toHaveBeenCalledWith(
+        expect.objectContaining({
+          region: REGION,
+          bundleName: 'TestProjectMyBundle',
+          components: { foo: { type: 'inline', value: 'bar' } },
+          commitMessage: 'Create MyBundle',
+        })
+      );
+      expect(result.hasErrors).toBe(false);
+      expect(result.results).toHaveLength(1);
+      expect(result.results[0]).toMatchObject({ bundleName: 'MyBundle', status: 'created', bundleId: 'b-new' });
+      expect(result.configBundles.MyBundle).toEqual({
+        bundleId: 'b-new',
+        bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-new',
+        versionId: 'v-1',
+      });
+    });
+  });
+
+  describe('update existing bundle', () => {
+    it('should update an existing bundle when components have changed', async () => {
+      const existingBundles = {
+        MyBundle: {
+          bundleId: 'b-123',
+          bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-123',
+          versionId: 'v-1',
+        },
+      };
+
+      mockGetConfigurationBundleVersion.mockResolvedValue({
+        bundleId: 'b-123',
+        bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-123',
+        versionId: 'v-1',
+        components: { foo: { type: 'inline', value: 'old' } },
+        description: undefined,
+        lineageMetadata: { branchName: 'main' },
+      });
+
+      mockUpdateConfigurationBundle.mockResolvedValue({
+        bundleId: 'b-123',
+        bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-123',
+        versionId: 'v-2',
+      });
+
+      const result = await setupConfigBundles({
+        region: REGION,
+        projectSpec: makeProjectSpec([
+          { name: 'MyBundle', type: 'ConfigurationBundle', components: { foo: { type: 'inline', value: 'new' } } },
+        ]),
+        existingBundles,
+      });
+
+      expect(mockUpdateConfigurationBundle).toHaveBeenCalledWith(
+        expect.objectContaining({
+          region: REGION,
+          bundleId: 'b-123',
+          components: { foo: { type: 'inline', value: 'new' } },
+          parentVersionIds: ['v-1'],
+          branchName: 'main',
+          commitMessage: 'Update MyBundle',
+        })
+      );
+      expect(result.results[0]).toMatchObject({ status: 'updated', versionId: 'v-2' });
+      expect(result.hasErrors).toBe(false);
+    });
+  });
+
+  describe('skip unchanged bundle', () => {
+    it('should skip update when components and description are unchanged', async () => {
+      const components = { foo: { type: 'inline', value: 'same' } };
+      const existingBundles = {
+        MyBundle: {
+          bundleId: 'b-123',
+          bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-123',
+          versionId: 'v-1',
+        },
+      };
+
+      mockGetConfigurationBundleVersion.mockResolvedValue({
+        bundleId: 'b-123',
+        bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-123',
+        versionId: 'v-1',
+        components,
+        description: 'My desc',
+        lineageMetadata: { branchName: 'main' },
+      });
+
+      const result = await setupConfigBundles({
+        region: REGION,
+        projectSpec: makeProjectSpec([
+          { name: 'MyBundle', type: 'ConfigurationBundle', components, description: 'My desc' },
+        ]),
+        existingBundles,
+      });
+
+      expect(mockUpdateConfigurationBundle).not.toHaveBeenCalled();
+      expect(mockCreateConfigurationBundle).not.toHaveBeenCalled();
+      expect(result.results[0]).toMatchObject({ bundleName: 'MyBundle', status: 'skipped', versionId: 'v-1' });
+      expect(result.configBundles.MyBundle).toEqual(existingBundles.MyBundle);
+    });
+  });
+
+  describe('deep equal is key-order-independent', () => {
+    it('should skip update when components differ only in key order', async () => {
+      const existingBundles = {
+        MyBundle: {
+          bundleId: 'b-123',
+          bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-123',
+          versionId: 'v-1',
+        },
+      };
+
+      // API returns keys in one order
+      mockGetConfigurationBundleVersion.mockResolvedValue({
+        bundleId: 'b-123',
+        bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-123',
+        versionId: 'v-1',
+        components: { a: { type: 'inline', value: '1' }, b: { type: 'inline', value: '2' } },
+        description: undefined,
+        lineageMetadata: { branchName: 'main' },
+      });
+
+      // Spec has same keys in different order
+      const result = await setupConfigBundles({
+        region: REGION,
+        projectSpec: makeProjectSpec([
+          {
+            name: 'MyBundle',
+            components: { b: { type: 'inline', value: '2' }, a: { type: 'inline', value: '1' } },
+          },
+        ]),
+        existingBundles,
+      });
+
+      expect(mockUpdateConfigurationBundle).not.toHaveBeenCalled();
+      expect(result.results[0]).toMatchObject({ status: 'skipped' });
+    });
+  });
+
+  describe('delete orphaned bundles', () => {
+    it('should delete bundles in existingBundles but not in projectSpec', async () => {
+      const existingBundles = {
+        OrphanBundle: {
+          bundleId: 'b-orphan',
+          bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-orphan',
+          versionId: 'v-1',
+        },
+      };
+
+      mockDeleteConfigurationBundle.mockResolvedValue(undefined);
+
+      const result = await setupConfigBundles({
+        region: REGION,
+        projectSpec: makeProjectSpec([]),
+        existingBundles,
+      });
+
+      expect(mockDeleteConfigurationBundle).toHaveBeenCalledWith({
+        region: REGION,
+        bundleId: 'b-orphan',
+      });
+      expect(result.results[0]).toMatchObject({ bundleName: 'OrphanBundle', status: 'deleted' });
+      expect(result.hasErrors).toBe(false);
+    });
+
+    it('should report error status when delete throws', async () => {
+      const existingBundles = {
+        OrphanBundle: {
+          bundleId: 'b-orphan',
+          bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-orphan',
+          versionId: 'v-1',
+        },
+      };
+
+      mockDeleteConfigurationBundle.mockRejectedValue(new Error('Access denied'));
+
+      const result = await setupConfigBundles({
+        region: REGION,
+        projectSpec: makeProjectSpec([]),
+        existingBundles,
+      });
+
+      expect(result.results[0]).toMatchObject({ bundleName: 'OrphanBundle', status: 'error', error: 'Access denied' });
+      expect(result.hasErrors).toBe(true);
+    });
+  });
+
+  describe('uses branch from API when bundleSpec has no branchName', () => {
+    it('should use branchName from getConfigurationBundleVersion lineageMetadata', async () => {
+      const existingBundles = {
+        MyBundle: {
+          bundleId: 'b-123',
+          bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-123',
+          versionId: 'v-1',
+        },
+      };
+
+      mockGetConfigurationBundleVersion.mockResolvedValue({
+        bundleId: 'b-123',
+        bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-123',
+        versionId: 'v-1',
+        components: { old: { type: 'inline', value: 'data' } },
+        description: undefined,
+        lineageMetadata: { branchName: 'feature-branch' },
+      });
+
+      mockUpdateConfigurationBundle.mockResolvedValue({
+        bundleId: 'b-123',
+        bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-123',
+        versionId: 'v-2',
+      });
+
+      await setupConfigBundles({
+        region: REGION,
+        projectSpec: makeProjectSpec([
+          {
+            name: 'MyBundle',
+            components: { new: { type: 'inline', value: 'data' } },
+            // no branchName specified
+          },
+        ]),
+        existingBundles,
+      });
+
+      expect(mockUpdateConfigurationBundle).toHaveBeenCalledWith(
+        expect.objectContaining({
+          branchName: 'feature-branch',
+        })
+      );
+    });
+
+    it('should prefer bundleSpec branchName over API branchName', async () => {
+      const existingBundles = {
+        MyBundle: {
+          bundleId: 'b-123',
+          bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-123',
+          versionId: 'v-1',
+        },
+      };
+
+      mockGetConfigurationBundleVersion.mockResolvedValue({
+        bundleId: 'b-123',
+        bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-123',
+        versionId: 'v-1',
+        components: { old: { type: 'inline', value: 'data' } },
+        description: undefined,
+        lineageMetadata: { branchName: 'api-branch' },
+      });
+
+      mockUpdateConfigurationBundle.mockResolvedValue({
+        bundleId: 'b-123',
+        bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-123',
+        versionId: 'v-2',
+      });
+
+      await setupConfigBundles({
+        region: REGION,
+        projectSpec: makeProjectSpec([
+          {
+            name: 'MyBundle',
+            components: { new: { type: 'inline', value: 'data' } },
+            branchName: 'spec-branch',
+          },
+        ]),
+        existingBundles,
+      });
+
+      expect(mockUpdateConfigurationBundle).toHaveBeenCalledWith(
+        expect.objectContaining({
+          branchName: 'spec-branch',
+        })
+      );
+    });
+  });
+
+  describe('fallback path via findBundleByName', () => {
+    it('should fall through to findBundleByName when getConfigurationBundleVersion throws 404', async () => {
+      const existingBundles = {
+        MyBundle: {
+          bundleId: 'b-old',
+          bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-old',
+          versionId: 'v-old',
+        },
+      };
+
+      // First call (existing bundle path) throws 404
+      mockGetConfigurationBundleVersion.mockRejectedValueOnce(new Error('404 not found')).mockResolvedValueOnce({
+        bundleId: 'b-found',
+        bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-found',
+        versionId: 'v-latest',
+        components: { old: { type: 'inline', value: 'data' } },
+        description: undefined,
+        lineageMetadata: { branchName: 'main' },
+      });
+
+      mockListConfigurationBundles.mockResolvedValue({
+        bundles: [{ bundleId: 'b-found', bundleName: 'TestProjectMyBundle' }],
+      });
+
+      mockListConfigurationBundleVersions.mockResolvedValue({
+        versions: [{ versionId: 'v-latest', versionCreatedAt: 1234567890 }],
+      });
+
+      mockUpdateConfigurationBundle.mockResolvedValue({
+        bundleId: 'b-found',
+        bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-found',
+        versionId: 'v-new',
+      });
+
+      const result = await setupConfigBundles({
+        region: REGION,
+        projectSpec: makeProjectSpec([
+          {
+            name: 'MyBundle',
+            components: { new: { type: 'inline', value: 'data' } },
+          },
+        ]),
+        existingBundles,
+      });
+
+      expect(mockListConfigurationBundles).toHaveBeenCalledWith({ region: REGION, maxResults: 100 });
+      expect(mockListConfigurationBundleVersions).toHaveBeenCalledWith({
+        region: REGION,
+        bundleId: 'b-found',
+      });
+      expect(result.results[0]).toMatchObject({ status: 'updated', bundleId: 'b-found', versionId: 'v-new' });
+      expect(result.hasErrors).toBe(false);
+    });
+
+    it('should create a new bundle when findBundleByName returns nothing after 404', async () => {
+      const existingBundles = {
+        MyBundle: {
+          bundleId: 'b-old',
+          bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-old',
+          versionId: 'v-old',
+        },
+      };
+
+      mockGetConfigurationBundleVersion.mockRejectedValueOnce(new Error('404 not found'));
+      mockListConfigurationBundles.mockResolvedValue({ bundles: [] });
+      mockCreateConfigurationBundle.mockResolvedValue({
+        bundleId: 'b-new',
+        bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-new',
+        versionId: 'v-1',
+      });
+
+      const result = await setupConfigBundles({
+        region: REGION,
+        projectSpec: makeProjectSpec([
+          { name: 'MyBundle', type: 'ConfigurationBundle', components: { x: { type: 'inline', value: '1' } } },
+        ]),
+        existingBundles,
+      });
+
+      expect(mockCreateConfigurationBundle).toHaveBeenCalled();
+      expect(result.results[0]).toMatchObject({ status: 'created', bundleId: 'b-new' });
+    });
+  });
+
+  describe('error handling', () => {
+    it('should report error status when create fails', async () => {
+      mockListConfigurationBundles.mockResolvedValue({ bundles: [] });
+      mockCreateConfigurationBundle.mockRejectedValue(new Error('Service unavailable'));
+
+      const result = await setupConfigBundles({
+        region: REGION,
+        projectSpec: makeProjectSpec([
+          { name: 'MyBundle', type: 'ConfigurationBundle', components: { x: { type: 'inline', value: '1' } } },
+        ]),
+      });
+
+      expect(result.results[0]).toMatchObject({
+        bundleName: 'MyBundle',
+        status: 'error',
+        error: 'Service unavailable',
+      });
+      expect(result.hasErrors).toBe(true);
+    });
+
+    it('should report error status when update fails with non-404 error', async () => {
+      const existingBundles = {
+        MyBundle: {
+          bundleId: 'b-123',
+          bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-123',
+          versionId: 'v-1',
+        },
+      };
+
+      mockGetConfigurationBundleVersion.mockRejectedValue(new Error('Throttling exception'));
+
+      const result = await setupConfigBundles({
+        region: REGION,
+        projectSpec: makeProjectSpec([
+          { name: 'MyBundle', type: 'ConfigurationBundle', components: { x: { type: 'inline', value: '1' } } },
+        ]),
+        existingBundles,
+      });
+
+      expect(result.results[0]).toMatchObject({
+        bundleName: 'MyBundle',
+        status: 'error',
+        error: 'Throttling exception',
+      });
+      expect(result.hasErrors).toBe(true);
+      // Should NOT fall through to findBundleByName
+      expect(mockListConfigurationBundles).not.toHaveBeenCalled();
+    });
+
+    it('should report error when delete throws an exception', async () => {
+      const existingBundles = {
+        OrphanBundle: {
+          bundleId: 'b-orphan',
+          bundleArn: 'arn:aws:agentcore:us-west-2:123:bundle/b-orphan',
+          versionId: 'v-1',
+        },
+      };
+
+      mockDeleteConfigurationBundle.mockRejectedValue(new Error('Network error'));
+
+      const result = await setupConfigBundles({
+        region: REGION,
+        projectSpec: makeProjectSpec([]),
+        existingBundles,
+      });
+
+      expect(result.results[0]).toMatchObject({
+        bundleName: 'OrphanBundle',
+        status: 'error',
+        error: 'Network error',
+      });
+      expect(result.hasErrors).toBe(true);
+    });
+  });
+});
+
+// ── resolveConfigBundleComponentKeys ───────────────────────────────────────
+
+describe('resolveConfigBundleComponentKeys', () => {
+  function makeFullProjectSpec(configBundles: AgentCoreProjectSpec['configBundles'] = []): AgentCoreProjectSpec {
+    return {
+      name: 'TestProject',
+      version: 1,
+      managedBy: 'CDK' as const,
+      runtimes: [],
+      memories: [],
+      credentials: [],
+      evaluators: [],
+      onlineEvalConfigs: [],
+      agentCoreGateways: [],
+      policyEngines: [],
+      harnesses: [],
+      configBundles,
+      httpGateways: [],
+      abTests: [],
+    };
+  }
+
+  function makeDeployedState(targetName: string, resources: Record<string, unknown>): DeployedState {
+    return {
+      targets: {
+        [targetName]: { resources },
+      },
+    } as unknown as DeployedState;
+  }
+
+  it('returns projectSpec unchanged when target has no resources', () => {
+    const spec = makeFullProjectSpec([
+      { name: 'b1', components: { '{{runtime:my-rt}}': { configuration: { k: 'v' } } } } as any,
+    ]);
+    const deployedState = { targets: {} } as unknown as DeployedState;
+
+    const result = resolveConfigBundleComponentKeys(spec, deployedState, 'missing-target');
+    expect(result).toBe(spec); // same reference — no transformation
+  });
+
+  it('resolves {{runtime:name}} placeholder to runtime ARN', () => {
+    const spec = makeFullProjectSpec([
+      { name: 'b1', components: { '{{runtime:my-agent}}': { configuration: { k: 'v' } } } } as any,
+    ]);
+    const deployedState = makeDeployedState('target1', {
+      runtimes: { 'my-agent': { runtimeArn: 'arn:aws:bedrock-agentcore:us-east-1:123:runtime/rt-1' } },
+    });
+
+    const result = resolveConfigBundleComponentKeys(spec, deployedState, 'target1');
+    const keys = Object.keys(result.configBundles[0]!.components);
+    expect(keys).toEqual(['arn:aws:bedrock-agentcore:us-east-1:123:runtime/rt-1']);
+  });
+
+  it('resolves {{gateway:name}} placeholder to HTTP gateway ARN', () => {
+    const spec = makeFullProjectSpec([
+      { name: 'b1', components: { '{{gateway:my-gw}}': { configuration: { k: 'v' } } } } as any,
+    ]);
+    const deployedState = makeDeployedState('target1', {
+      httpGateways: { 'my-gw': { gatewayArn: 'arn:aws:bedrock-agentcore:us-east-1:123:gateway/gw-1' } },
+    });
+
+    const result = resolveConfigBundleComponentKeys(spec, deployedState, 'target1');
+    const keys = Object.keys(result.configBundles[0]!.components);
+    expect(keys).toEqual(['arn:aws:bedrock-agentcore:us-east-1:123:gateway/gw-1']);
+  });
+
+  it('resolves {{gateway:name}} placeholder to MCP gateway ARN', () => {
+    const spec = makeFullProjectSpec([
+      { name: 'b1', components: { '{{gateway:my-mcp-gw}}': { configuration: { k: 'v' } } } } as any,
+    ]);
+    const deployedState = makeDeployedState('target1', {
+      mcp: { gateways: { 'my-mcp-gw': { gatewayArn: 'arn:mcp:gw:resolved' } } },
+    });
+
+    const result = resolveConfigBundleComponentKeys(spec, deployedState, 'target1');
+    const keys = Object.keys(result.configBundles[0]!.components);
+    expect(keys).toEqual(['arn:mcp:gw:resolved']);
+  });
+
+  it('passes through keys that are already ARNs', () => {
+    const spec = makeFullProjectSpec([
+      { name: 'b1', components: { 'arn:existing:key': { configuration: { k: 'v' } } } } as any,
+    ]);
+    const deployedState = makeDeployedState('target1', { runtimes: {} });
+
+    const result = resolveConfigBundleComponentKeys(spec, deployedState, 'target1');
+    const keys = Object.keys(result.configBundles[0]!.components);
+    expect(keys).toEqual(['arn:existing:key']);
+  });
+
+  it('passes through plain string keys that are not placeholders or ARNs', () => {
+    const spec = makeFullProjectSpec([
+      { name: 'b1', components: { 'some-plain-key': { configuration: { k: 'v' } } } } as any,
+    ]);
+    const deployedState = makeDeployedState('target1', { runtimes: {} });
+
+    const result = resolveConfigBundleComponentKeys(spec, deployedState, 'target1');
+    const keys = Object.keys(result.configBundles[0]!.components);
+    expect(keys).toEqual(['some-plain-key']);
+  });
+
+  it('throws when gateway placeholder references non-existent gateway', () => {
+    const spec = makeFullProjectSpec([
+      { name: 'b1', components: { '{{gateway:missing}}': { configuration: {} } } } as any,
+    ]);
+    const deployedState = makeDeployedState('target1', { httpGateways: {}, mcp: { gateways: {} } });
+
+    expect(() => resolveConfigBundleComponentKeys(spec, deployedState, 'target1')).toThrow(
+      'Config bundle references gateway "missing" but it was not found in deployed resources'
+    );
+  });
+
+  it('throws when runtime placeholder references non-existent runtime', () => {
+    const spec = makeFullProjectSpec([
+      { name: 'b1', components: { '{{runtime:missing}}': { configuration: {} } } } as any,
+    ]);
+    const deployedState = makeDeployedState('target1', { runtimes: {} });
+
+    expect(() => resolveConfigBundleComponentKeys(spec, deployedState, 'target1')).toThrow(
+      'Config bundle references runtime "missing" but it was not found in deployed resources'
+    );
+  });
+
+  it('handles projectSpec with no configBundles', () => {
+    const spec = makeFullProjectSpec([]);
+    const deployedState = makeDeployedState('target1', { runtimes: {} });
+
+    const result = resolveConfigBundleComponentKeys(spec, deployedState, 'target1');
+    expect(result.configBundles).toEqual([]);
+  });
+
+  it('does not mutate the original projectSpec', () => {
+    const spec = makeFullProjectSpec([
+      { name: 'b1', components: { '{{runtime:my-rt}}': { configuration: { k: 'v' } } } } as any,
+    ]);
+    const deployedState = makeDeployedState('target1', {
+      runtimes: { 'my-rt': { runtimeArn: 'arn:resolved' } },
+    });
+
+    const result = resolveConfigBundleComponentKeys(spec, deployedState, 'target1');
+    // Original should still have the placeholder
+    expect(Object.keys(spec.configBundles[0]!.components)).toEqual(['{{runtime:my-rt}}']);
+    // Result should have the resolved key
+    expect(Object.keys(result.configBundles[0]!.components)).toEqual(['arn:resolved']);
+  });
+
+  it('prefers HTTP gateway over MCP gateway when both exist with same name', () => {
+    const spec = makeFullProjectSpec([
+      { name: 'b1', components: { '{{gateway:dupe-gw}}': { configuration: {} } } } as any,
+    ]);
+    const deployedState = makeDeployedState('target1', {
+      httpGateways: { 'dupe-gw': { gatewayArn: 'arn:http:gw' } },
+      mcp: { gateways: { 'dupe-gw': { gatewayArn: 'arn:mcp:gw' } } },
+    });
+
+    const result = resolveConfigBundleComponentKeys(spec, deployedState, 'target1');
+    const keys = Object.keys(result.configBundles[0]!.components);
+    // HTTP gateway should take precedence (checked first in code)
+    expect(keys).toEqual(['arn:http:gw']);
+  });
+});
diff --git a/src/cli/operations/deploy/__tests__/post-deploy-http-gateways.test.ts b/src/cli/operations/deploy/__tests__/post-deploy-http-gateways.test.ts
new file mode 100644
index 000000000..f395c52f3
--- /dev/null
+++ b/src/cli/operations/deploy/__tests__/post-deploy-http-gateways.test.ts
@@ -0,0 +1,436 @@
+import type { AgentCoreProjectSpec, DeployedResourceState, HttpGatewayDeployedState } from '../../../../schema';
+import { deleteOrphanedHttpGateways, setupHttpGateways } from '../post-deploy-http-gateways.js';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+// ── Hoisted mocks ──────────────────────────────────────────────────────────
+
+const {
+  mockCreateHttpGateway,
+  mockCreateHttpGatewayTarget,
+  mockDeleteHttpGateway,
+  mockDeleteHttpGatewayTarget,
+  mockListAllHttpGateways,
+  mockListHttpGatewayTargets,
+  mockWaitForGatewayReady,
+  mockWaitForTargetReady,
+  mockGetCredentialProvider,
+  mockIAMSend,
+} = vi.hoisted(() => ({
+  mockCreateHttpGateway: vi.fn(),
+  mockCreateHttpGatewayTarget: vi.fn(),
+  mockDeleteHttpGateway: vi.fn(),
+  mockDeleteHttpGatewayTarget: vi.fn(),
+  mockListAllHttpGateways: vi.fn(),
+  mockListHttpGatewayTargets: vi.fn(),
+  mockWaitForGatewayReady: vi.fn(),
+  mockWaitForTargetReady: vi.fn(),
+  mockGetCredentialProvider: vi.fn().mockReturnValue(undefined),
+  mockIAMSend: vi.fn(),
+}));
+
+vi.mock('../../../aws/agentcore-http-gateways', () => ({
+  createHttpGateway: mockCreateHttpGateway,
+  createHttpGatewayTarget: mockCreateHttpGatewayTarget,
+  deleteHttpGateway: mockDeleteHttpGateway,
+  deleteHttpGatewayTarget: mockDeleteHttpGatewayTarget,
+  listAllHttpGateways: mockListAllHttpGateways,
+  listHttpGatewayTargets: mockListHttpGatewayTargets,
+  waitForGatewayReady: mockWaitForGatewayReady,
+  waitForTargetReady: mockWaitForTargetReady,
+}));
+
+vi.mock('../../../aws/account', () => ({
+  getCredentialProvider: mockGetCredentialProvider,
+}));
+
+vi.mock('@aws-sdk/client-iam', () => ({
+  IAMClient: class {
+    send = mockIAMSend;
+  },
+  CreateRoleCommand: class {
+    constructor(public input: unknown) {}
+  },
+  GetRoleCommand: class {
+    constructor(public input: unknown) {}
+  },
+  PutRolePolicyCommand: class {
+    constructor(public input: unknown) {}
+  },
+  DeleteRolePolicyCommand: class {
+    constructor(public input: unknown) {}
+  },
+  DeleteRoleCommand: class {
+    constructor(public input: unknown) {}
+  },
+}));
+
+// ── Helpers ────────────────────────────────────────────────────────────────
+
+function makeProjectSpec(httpGateways: AgentCoreProjectSpec['httpGateways'] = []): AgentCoreProjectSpec {
+  return {
+    name: 'TestProject',
+    version: 1,
+    managedBy: 'CDK' as const,
+    runtimes: [],
+    memories: [],
+    credentials: [],
+    evaluators: [],
+    onlineEvalConfigs: [],
+    agentCoreGateways: [],
+    policyEngines: [],
+    harnesses: [],
+    configBundles: [],
+    abTests: [],
+    httpGateways,
+  };
+}
+
+const sampleHttpGateway = {
+  name: 'MyHttpGw',
+  runtimeRef: 'my-agent',
+  roleArn: 'arn:aws:iam::123456789012:role/ExistingRole',
+};
+
+const sampleDeployedResources = {
+  runtimes: {
+    'my-agent': {
+      runtimeArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/rt-123',
+      runtimeId: 'rt-123',
+    },
+  },
+} as unknown as DeployedResourceState;
+
+// ── Tests ──────────────────────────────────────────────────────────────────
+
+describe('setupHttpGateways', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockListAllHttpGateways.mockResolvedValue([]);
+    mockListHttpGatewayTargets.mockResolvedValue({ targets: [] });
+    mockWaitForGatewayReady.mockResolvedValue({ gatewayId: 'gw-001', status: 'READY' });
+    mockWaitForTargetReady.mockResolvedValue({});
+  });
+
+  describe('creation', () => {
+    it('creates gateway + target for new spec entry', async () => {
+      mockCreateHttpGateway.mockResolvedValue({
+        gatewayId: 'gw-001',
+        gatewayArn: 'arn:aws:bedrock-agentcore:us-east-1:123:httpgateway/gw-001',
+      });
+      mockCreateHttpGatewayTarget.mockResolvedValue({ targetId: 'tgt-001' });
+
+      const result = await setupHttpGateways({
+        region: 'us-east-1',
+        projectName: 'TestProject',
+        projectSpec: makeProjectSpec([sampleHttpGateway]),
+        deployedResources: sampleDeployedResources,
+      });
+
+      expect(result.hasErrors).toBe(false);
+      expect(result.results).toHaveLength(1);
+      expect(result.results[0]!.status).toBe('created');
+      expect(result.results[0]!.gatewayId).toBe('gw-001');
+      expect(result.httpGateways.MyHttpGw).toEqual(
+        expect.objectContaining({
+          gatewayId: 'gw-001',
+          gatewayArn: 'arn:aws:bedrock-agentcore:us-east-1:123:httpgateway/gw-001',
+          targetId: 'tgt-001',
+        })
+      );
+
+      expect(mockCreateHttpGateway).toHaveBeenCalledWith({
+        region: 'us-east-1',
+        name: 'MyHttpGw',
+        roleArn: 'arn:aws:iam::123456789012:role/ExistingRole',
+      });
+      expect(mockCreateHttpGatewayTarget).toHaveBeenCalledWith({
+        region: 'us-east-1',
+        gatewayId: 'gw-001',
+        targetName: 'my-agent',
+        runtimeArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/rt-123',
+      });
+    });
+
+    it('skips existing gateway', async () => {
+      const existingHttpGateways: Record<string, HttpGatewayDeployedState> = {
+        MyHttpGw: {
+          gatewayId: 'gw-existing',
+          gatewayArn: 'arn:httpgw:existing',
+          targetId: 'tgt-existing',
+        },
+      };
+
+      const result = await setupHttpGateways({
+        region: 'us-east-1',
+        projectName: 'TestProject',
+        projectSpec: makeProjectSpec([sampleHttpGateway]),
+        existingHttpGateways,
+        deployedResources: sampleDeployedResources,
+      });
+
+      expect(result.results[0]!.status).toBe('skipped');
+      expect(result.results[0]!.gatewayId).toBe('gw-existing');
+      expect(mockCreateHttpGateway).not.toHaveBeenCalled();
+      expect(mockCreateHttpGatewayTarget).not.toHaveBeenCalled();
+    });
+
+    it('finds gateway by name via list (state loss recovery)', async () => {
+      mockListAllHttpGateways.mockResolvedValue([
+        { name: 'MyHttpGw', gatewayId: 'gw-api', gatewayArn: 'arn:httpgw:api' },
+      ]);
+
+      const result = await setupHttpGateways({
+        region: 'us-east-1',
+        projectName: 'TestProject',
+        projectSpec: makeProjectSpec([sampleHttpGateway]),
+        deployedResources: sampleDeployedResources,
+      });
+
+      expect(result.results[0]!.status).toBe('skipped');
+      expect(result.httpGateways.MyHttpGw!.gatewayId).toBe('gw-api');
+      expect(mockCreateHttpGateway).not.toHaveBeenCalled();
+    });
+
+    it('reports error on missing runtime ref', async () => {
+      const emptyDeployedResources = {} as unknown as DeployedResourceState;
+
+      const result = await setupHttpGateways({
+        region: 'us-east-1',
+        projectName: 'TestProject',
+        projectSpec: makeProjectSpec([sampleHttpGateway]),
+        deployedResources: emptyDeployedResources,
+      });
+
+      expect(result.hasErrors).toBe(true);
+      expect(result.results[0]!.status).toBe('error');
+      expect(result.results[0]!.error).toContain('Runtime "my-agent" not found');
+      expect(mockCreateHttpGateway).not.toHaveBeenCalled();
+    });
+
+    it('auto-creates IAM role when roleArn not provided', async () => {
+      const gwWithoutRole = { ...sampleHttpGateway, roleArn: undefined };
+      mockCreateHttpGateway.mockResolvedValue({
+        gatewayId: 'gw-002',
+        gatewayArn: 'arn:httpgw:002',
+      });
+      mockCreateHttpGatewayTarget.mockResolvedValue({ targetId: 'tgt-002' });
+      mockIAMSend.mockResolvedValue({ Role: { Arn: 'arn:aws:iam::123:role/AutoRole' } });
+
+      const result = await setupHttpGateways({
+        region: 'us-east-1',
+        projectName: 'TestProject',
+        projectSpec: makeProjectSpec([gwWithoutRole]),
+        deployedResources: sampleDeployedResources,
+      });
+
+      expect(result.results[0]!.status).toBe('created');
+      expect(result.httpGateways.MyHttpGw!.roleCreatedByCli).toBe(true);
+      expect(mockIAMSend).toHaveBeenCalled();
+
+      // Verify CreateRoleCommand was sent with correct trust policy
+      const createRoleCall = mockIAMSend.mock.calls[0]![0];
+      const trustPolicy = JSON.parse(createRoleCall.input.AssumeRolePolicyDocument);
+      expect(trustPolicy.Statement[0].Principal.Service).toBe('bedrock-agentcore.amazonaws.com');
+
+      // Verify PutRolePolicyCommand was sent with correct inline policy actions
+      const putPolicyCall = mockIAMSend.mock.calls[1]![0];
+      const inlinePolicy = JSON.parse(putPolicyCall.input.PolicyDocument);
+      const actions = inlinePolicy.Statement[0].Action;
+      expect(actions).toContain('bedrock-agentcore:InvokeRuntime');
+      expect(actions).toContain('bedrock-agentcore:InvokeAgent');
+      expect(actions).toContain('bedrock-agentcore:InvokeAgentRuntime');
+      expect(inlinePolicy.Statement[0].Resource).toBe('*');
+    });
+
+    it('rollback on target creation failure', async () => {
+      mockCreateHttpGateway.mockResolvedValue({
+        gatewayId: 'gw-rollback',
+        gatewayArn: 'arn:httpgw:rollback',
+      });
+      mockCreateHttpGatewayTarget.mockRejectedValue(new Error('Target creation failed'));
+      mockDeleteHttpGateway.mockResolvedValue({ success: true });
+
+      const result = await setupHttpGateways({
+        region: 'us-east-1',
+        projectName: 'TestProject',
+        projectSpec: makeProjectSpec([sampleHttpGateway]),
+        deployedResources: sampleDeployedResources,
+      });
+
+      expect(result.hasErrors).toBe(true);
+      expect(result.results[0]!.status).toBe('error');
+      expect(result.results[0]!.error).toContain('Target creation failed');
+      expect(result.results[0]!.error).toContain('gateway rolled back');
+
+      // Verify rollback: deleteHttpGateway was called
+      expect(mockDeleteHttpGateway).toHaveBeenCalledWith({
+        region: 'us-east-1',
+        gatewayId: 'gw-rollback',
+      });
+    });
+  });
+
+  describe('deletion (reconciliation)', () => {
+    it('deletes orphaned gateway not in project spec', async () => {
+      mockDeleteHttpGateway.mockResolvedValue({ success: true });
+      mockDeleteHttpGatewayTarget.mockResolvedValue({ success: true });
+
+      const result = await deleteOrphanedHttpGateways({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([]),
+        existingHttpGateways: {
+          RemovedGw: {
+            gatewayId: 'gw-old',
+            gatewayArn: 'arn:httpgw:old',
+            targetId: 'tgt-old',
+          },
+        },
+      });
+
+      expect(mockDeleteHttpGatewayTarget).toHaveBeenCalledWith({
+        region: 'us-east-1',
+        gatewayId: 'gw-old',
+        targetId: 'tgt-old',
+      });
+      expect(mockDeleteHttpGateway).toHaveBeenCalledWith({
+        region: 'us-east-1',
+        gatewayId: 'gw-old',
+      });
+      expect(result.results[0]!.status).toBe('deleted');
+    });
+
+    it('cleans up auto-created IAM role on deletion', async () => {
+      mockDeleteHttpGateway.mockResolvedValue({ success: true });
+      mockIAMSend.mockResolvedValue({});
+
+      await deleteOrphanedHttpGateways({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([]),
+        existingHttpGateways: {
+          RemovedGw: {
+            gatewayId: 'gw-old',
+            gatewayArn: 'arn:httpgw:old',
+            roleArn: 'arn:aws:iam::123:role/AutoCreatedRole',
+            roleCreatedByCli: true,
+          },
+        },
+      });
+
+      // Should have called delete policy + delete role
+      expect(mockIAMSend).toHaveBeenCalledTimes(2);
+
+      // Verify first call is DeleteRolePolicyCommand
+      const firstCall = mockIAMSend.mock.calls[0]![0];
+      expect(firstCall.input).toEqual(
+        expect.objectContaining({ RoleName: 'AutoCreatedRole', PolicyName: expect.any(String) })
+      );
+
+      // Verify second call is DeleteRoleCommand
+      const secondCall = mockIAMSend.mock.calls[1]![0];
+      expect(secondCall.input).toEqual(expect.objectContaining({ RoleName: 'AutoCreatedRole' }));
+    });
+
+    it('reports error when deletion fails', async () => {
+      mockDeleteHttpGateway.mockRejectedValue(new Error('delete failed'));
+
+      const result = await deleteOrphanedHttpGateways({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([]),
+        existingHttpGateways: {
+          FailGw: { gatewayId: 'gw-fail', gatewayArn: 'arn:httpgw:fail' },
+        },
+      });
+
+      expect(result.hasErrors).toBe(true);
+      expect(result.results[0]!.status).toBe('error');
+      expect(result.results[0]!.error).toBe('delete failed');
+    });
+  });
+
+  describe('edge cases', () => {
+    it('proceeds with creation when listHttpGateways fails', async () => {
+      mockListAllHttpGateways.mockRejectedValue(new Error('API unavailable'));
+      mockCreateHttpGateway.mockResolvedValue({
+        gatewayId: 'gw-new',
+        gatewayArn: 'arn:httpgw:new',
+      });
+      mockCreateHttpGatewayTarget.mockResolvedValue({ targetId: 'tgt-new' });
+
+      const result = await setupHttpGateways({
+        region: 'us-east-1',
+        projectName: 'TestProject',
+        projectSpec: makeProjectSpec([sampleHttpGateway]),
+        deployedResources: sampleDeployedResources,
+      });
+
+      expect(result.results[0]!.status).toBe('created');
+      expect(mockCreateHttpGateway).toHaveBeenCalled();
+    });
+
+    it('uses provided roleArn without creating IAM role', async () => {
+      mockCreateHttpGateway.mockResolvedValue({
+        gatewayId: 'gw-003',
+        gatewayArn: 'arn:httpgw:003',
+      });
+      mockCreateHttpGatewayTarget.mockResolvedValue({ targetId: 'tgt-003' });
+
+      const result = await setupHttpGateways({
+        region: 'us-east-1',
+        projectName: 'TestProject',
+        projectSpec: makeProjectSpec([sampleHttpGateway]),
+        deployedResources: sampleDeployedResources,
+      });
+
+      expect(result.results[0]!.status).toBe('created');
+      expect(result.httpGateways.MyHttpGw!.roleCreatedByCli).toBe(false);
+      expect(mockIAMSend).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('mixed operations', () => {
+    it('creates new and skips existing (orphan deletion is a separate pass)', async () => {
+      const newGw = { ...sampleHttpGateway, name: 'NewGw' };
+      const keptGw = { ...sampleHttpGateway, name: 'KeptGw' };
+
+      mockCreateHttpGateway.mockResolvedValue({
+        gatewayId: 'gw-new',
+        gatewayArn: 'arn:httpgw:new',
+      });
+      mockCreateHttpGatewayTarget.mockResolvedValue({ targetId: 'tgt-new' });
+      mockDeleteHttpGateway.mockResolvedValue({ success: true });
+
+      const result = await setupHttpGateways({
+        region: 'us-east-1',
+        projectName: 'TestProject',
+        projectSpec: makeProjectSpec([newGw, keptGw]),
+        existingHttpGateways: {
+          KeptGw: { gatewayId: 'gw-kept', gatewayArn: 'arn:httpgw:kept' },
+          OrphanGw: { gatewayId: 'gw-orphan', gatewayArn: 'arn:httpgw:orphan' },
+        },
+        deployedResources: sampleDeployedResources,
+      });
+
+      expect(result.results).toHaveLength(2);
+      const statuses = result.results.map(r => `${r.gatewayName}:${r.status}`);
+      expect(statuses).toContain('NewGw:created');
+      expect(statuses).toContain('KeptGw:skipped');
+    });
+
+    it('deleteOrphanedHttpGateways removes orphans separately', async () => {
+      mockDeleteHttpGateway.mockResolvedValue({ success: true });
+
+      const result = await deleteOrphanedHttpGateways({
+        region: 'us-east-1',
+        projectSpec: makeProjectSpec([{ ...sampleHttpGateway, name: 'KeptGw' }]),
+        existingHttpGateways: {
+          KeptGw: { gatewayId: 'gw-kept', gatewayArn: 'arn:httpgw:kept' },
+          OrphanGw: { gatewayId: 'gw-orphan', gatewayArn: 'arn:httpgw:orphan' },
+        },
+      });
+
+      expect(result.results).toHaveLength(1);
+      expect(result.results[0]!.gatewayName).toBe('OrphanGw');
+      expect(result.results[0]!.status).toBe('deleted');
+    });
+  });
+});
diff --git a/src/cli/operations/deploy/__tests__/post-deploy-observability.test.ts b/src/cli/operations/deploy/__tests__/post-deploy-observability.test.ts
index 9155a699d..ba069f29e 100644
--- a/src/cli/operations/deploy/__tests__/post-deploy-observability.test.ts
+++ b/src/cli/operations/deploy/__tests__/post-deploy-observability.test.ts
@@ -1,23 +1,23 @@
 import { setupTransactionSearch } from '../post-deploy-observability.js';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 
-const { mockEnableTransactionSearch, mockReadCliConfig } = vi.hoisted(() => ({
+const { mockEnableTransactionSearch, mockReadGlobalConfigSync } = vi.hoisted(() => ({
   mockEnableTransactionSearch: vi.fn(),
-  mockReadCliConfig: vi.fn(),
+  mockReadGlobalConfigSync: vi.fn(),
 }));
 
 vi.mock('../../../aws/transaction-search', () => ({
   enableTransactionSearch: mockEnableTransactionSearch,
 }));
 
-vi.mock('../../../../lib/schemas/io/cli-config', () => ({
-  readCliConfig: mockReadCliConfig,
+vi.mock('../../../../lib/schemas/io/global-config', () => ({
+  readGlobalConfigSync: mockReadGlobalConfigSync,
 }));
 
 describe('setupTransactionSearch', () => {
   beforeEach(() => {
     vi.clearAllMocks();
-    mockReadCliConfig.mockReturnValue({});
+    mockReadGlobalConfigSync.mockReturnValue({});
     mockEnableTransactionSearch.mockResolvedValue({ success: true });
   });
 
@@ -33,7 +33,7 @@ describe('setupTransactionSearch', () => {
   });
 
   it('passes custom transactionSearchIndexPercentage from config', async () => {
-    mockReadCliConfig.mockReturnValue({ transactionSearchIndexPercentage: 25 });
+    mockReadGlobalConfigSync.mockReturnValue({ transactionSearchIndexPercentage: 25 });
 
     const result = await setupTransactionSearch({
       region: 'us-east-1',
@@ -57,7 +57,7 @@ describe('setupTransactionSearch', () => {
   });
 
   it('skips when disableTransactionSearch is true in config', async () => {
-    mockReadCliConfig.mockReturnValue({ disableTransactionSearch: true });
+    mockReadGlobalConfigSync.mockReturnValue({ disableTransactionSearch: true });
 
     const result = await setupTransactionSearch({
       region: 'us-east-1',
diff --git a/src/cli/operations/deploy/__tests__/post-deploy-online-evals.test.ts b/src/cli/operations/deploy/__tests__/post-deploy-online-evals.test.ts
new file mode 100644
index 000000000..8120167ae
--- /dev/null
+++ b/src/cli/operations/deploy/__tests__/post-deploy-online-evals.test.ts
@@ -0,0 +1,179 @@
+import { enableOnlineEvalConfigs } from '../post-deploy-online-evals';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { mockUpdateOnlineEvalExecutionStatus } = vi.hoisted(() => ({
+  mockUpdateOnlineEvalExecutionStatus: vi.fn(),
+}));
+
+vi.mock('../../../aws/agentcore-control', () => ({
+  updateOnlineEvalExecutionStatus: mockUpdateOnlineEvalExecutionStatus,
+}));
+
+function makeOnlineEvalConfig(overrides: Record<string, unknown> = {}) {
+  return {
+    name: 'MyEval',
+    agent: 'my-agent',
+    evaluators: ['Builtin.Faithfulness'],
+    samplingRate: 10,
+    enableOnCreate: true,
+    ...overrides,
+  };
+}
+
+const deployedConfigs = {
+  MyEval: {
+    onlineEvaluationConfigId: 'oec-123',
+    onlineEvaluationConfigArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:online-evaluation-config/oec-123',
+  },
+};
+
+describe('enableOnlineEvalConfigs', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockUpdateOnlineEvalExecutionStatus.mockResolvedValue({
+      configId: 'oec-123',
+      executionStatus: 'ENABLED',
+      status: 'ACTIVE',
+    });
+  });
+
+  describe('enablement', () => {
+    it('enables config with enableOnCreate true', async () => {
+      const result = await enableOnlineEvalConfigs({
+        region: 'us-east-1',
+        onlineEvalConfigs: [makeOnlineEvalConfig()],
+        deployedOnlineEvalConfigs: deployedConfigs,
+      });
+
+      expect(result.hasErrors).toBe(false);
+      expect(result.results).toHaveLength(1);
+      expect(result.results[0]!.status).toBe('enabled');
+      expect(mockUpdateOnlineEvalExecutionStatus).toHaveBeenCalledWith({
+        region: 'us-east-1',
+        onlineEvaluationConfigId: 'oec-123',
+        executionStatus: 'ENABLED',
+      });
+    });
+
+    it('enables config when enableOnCreate is undefined (defaults to enable)', async () => {
+      const result = await enableOnlineEvalConfigs({
+        region: 'us-east-1',
+        onlineEvalConfigs: [makeOnlineEvalConfig({ enableOnCreate: undefined })],
+        deployedOnlineEvalConfigs: deployedConfigs,
+      });
+
+      expect(result.hasErrors).toBe(false);
+      expect(result.results[0]!.status).toBe('enabled');
+      expect(mockUpdateOnlineEvalExecutionStatus).toHaveBeenCalled();
+    });
+
+    it('skips config with enableOnCreate false', async () => {
+      const result = await enableOnlineEvalConfigs({
+        region: 'us-east-1',
+        onlineEvalConfigs: [makeOnlineEvalConfig({ enableOnCreate: false })],
+        deployedOnlineEvalConfigs: deployedConfigs,
+      });
+
+      expect(result.hasErrors).toBe(false);
+      expect(result.results[0]!.status).toBe('skipped');
+      expect(mockUpdateOnlineEvalExecutionStatus).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('error handling', () => {
+    it('reports error when config not in deployed state', async () => {
+      const result = await enableOnlineEvalConfigs({
+        region: 'us-east-1',
+        onlineEvalConfigs: [makeOnlineEvalConfig({ name: 'Missing' })],
+        deployedOnlineEvalConfigs: deployedConfigs,
+      });
+
+      expect(result.hasErrors).toBe(true);
+      expect(result.results[0]!.status).toBe('error');
+      expect(result.results[0]!.error).toContain('not found in deployed state');
+    });
+
+    it('reports error when API call fails', async () => {
+      mockUpdateOnlineEvalExecutionStatus.mockRejectedValue(new Error('AccessDenied'));
+
+      const result = await enableOnlineEvalConfigs({
+        region: 'us-east-1',
+        onlineEvalConfigs: [makeOnlineEvalConfig()],
+        deployedOnlineEvalConfigs: deployedConfigs,
+      });
+
+      expect(result.hasErrors).toBe(true);
+      expect(result.results[0]!.status).toBe('error');
+      expect(result.results[0]!.error).toBe('AccessDenied');
+    });
+
+    it('hasErrors is true when any config fails', async () => {
+      mockUpdateOnlineEvalExecutionStatus
+        .mockResolvedValueOnce({ configId: 'oec-123', executionStatus: 'ENABLED', status: 'ACTIVE' })
+        .mockRejectedValueOnce(new Error('Throttled'));
+
+      const result = await enableOnlineEvalConfigs({
+        region: 'us-east-1',
+        onlineEvalConfigs: [makeOnlineEvalConfig({ name: 'MyEval' }), makeOnlineEvalConfig({ name: 'OtherEval' })],
+        deployedOnlineEvalConfigs: {
+          ...deployedConfigs,
+          OtherEval: {
+            onlineEvaluationConfigId: 'oec-456',
+            onlineEvaluationConfigArn:
+              'arn:aws:bedrock-agentcore:us-east-1:123456789012:online-evaluation-config/oec-456',
+          },
+        },
+      });
+
+      expect(result.hasErrors).toBe(true);
+      expect(result.results[0]!.status).toBe('enabled');
+      expect(result.results[1]!.status).toBe('error');
+    });
+  });
+
+  describe('multiple configs', () => {
+    it('processes multiple configs independently', async () => {
+      const result = await enableOnlineEvalConfigs({
+        region: 'us-east-1',
+        onlineEvalConfigs: [makeOnlineEvalConfig({ name: 'MyEval' }), makeOnlineEvalConfig({ name: 'OtherEval' })],
+        deployedOnlineEvalConfigs: {
+          ...deployedConfigs,
+          OtherEval: {
+            onlineEvaluationConfigId: 'oec-456',
+            onlineEvaluationConfigArn:
+              'arn:aws:bedrock-agentcore:us-east-1:123456789012:online-evaluation-config/oec-456',
+          },
+        },
+      });
+
+      expect(result.hasErrors).toBe(false);
+      expect(result.results).toHaveLength(2);
+      expect(result.results[0]!.status).toBe('enabled');
+      expect(result.results[1]!.status).toBe('enabled');
+      expect(mockUpdateOnlineEvalExecutionStatus).toHaveBeenCalledTimes(2);
+    });
+
+    it('mixed enableOnCreate values', async () => {
+      const result = await enableOnlineEvalConfigs({
+        region: 'us-east-1',
+        onlineEvalConfigs: [
+          makeOnlineEvalConfig({ name: 'MyEval', enableOnCreate: true }),
+          makeOnlineEvalConfig({ name: 'OtherEval', enableOnCreate: false }),
+        ],
+        deployedOnlineEvalConfigs: {
+          ...deployedConfigs,
+          OtherEval: {
+            onlineEvaluationConfigId: 'oec-456',
+            onlineEvaluationConfigArn:
+              'arn:aws:bedrock-agentcore:us-east-1:123456789012:online-evaluation-config/oec-456',
+          },
+        },
+      });
+
+      expect(result.hasErrors).toBe(false);
+      expect(result.results[0]!.status).toBe('enabled');
+      expect(result.results[1]!.status).toBe('skipped');
+      expect(mockUpdateOnlineEvalExecutionStatus).toHaveBeenCalledTimes(1);
+    });
+  });
+});
diff --git a/src/cli/operations/deploy/__tests__/pre-deploy-identity.test.ts b/src/cli/operations/deploy/__tests__/pre-deploy-identity.test.ts
index c7ff81c84..866749c59 100644
--- a/src/cli/operations/deploy/__tests__/pre-deploy-identity.test.ts
+++ b/src/cli/operations/deploy/__tests__/pre-deploy-identity.test.ts
@@ -78,6 +78,7 @@ vi.mock('../../../../lib/index.js', () => ({
 
 vi.mock('../../../aws/index.js', () => ({
   getCredentialProvider: mockGetCredentialProvider,
+  createControlClient: vi.fn(() => ({ send: mockControlSend })),
 }));
 
 vi.mock('../../../errors.js', () => ({
diff --git a/src/cli/operations/deploy/__tests__/preflight-harness-dockerfile.test.ts b/src/cli/operations/deploy/__tests__/preflight-harness-dockerfile.test.ts
new file mode 100644
index 000000000..6f9f80314
--- /dev/null
+++ b/src/cli/operations/deploy/__tests__/preflight-harness-dockerfile.test.ts
@@ -0,0 +1,100 @@
+import type { AgentCoreProjectSpec } from '../../../../schema';
+import { validateHarnessDockerfiles } from '../preflight.js';
+import { existsSync, readFileSync } from 'node:fs';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('node:fs', () => ({
+  existsSync: vi.fn(),
+  readFileSync: vi.fn(),
+}));
+
+vi.mock('../../../../lib', () => ({
+  DOCKERFILE_NAME: 'Dockerfile',
+  getDockerfilePath: (codeLocation: string, dockerfile?: string) => {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const p = require('node:path') as typeof import('node:path');
+    return p.join(codeLocation, dockerfile ?? 'Dockerfile');
+  },
+  ConfigIO: vi.fn(),
+  requireConfigRoot: vi.fn(),
+  resolveCodeLocation: vi.fn(),
+}));
+
+const mockedExistsSync = vi.mocked(existsSync);
+const mockedReadFileSync = vi.mocked(readFileSync);
+
+const CONFIG_ROOT = '/project/agentcore';
+
+function makeSpec(harnesses: { name: string; path: string }[]): AgentCoreProjectSpec {
+  return {
+    name: 'test-project',
+    runtimes: [],
+    harnesses,
+  } as unknown as AgentCoreProjectSpec;
+}
+
+describe('validateHarnessDockerfiles', () => {
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('does nothing when no harnesses are defined', () => {
+    const spec = makeSpec([]);
+    expect(() => validateHarnessDockerfiles(spec, CONFIG_ROOT)).not.toThrow();
+    expect(mockedReadFileSync).not.toHaveBeenCalled();
+  });
+
+  it('does nothing when harness has no dockerfile field', () => {
+    mockedReadFileSync.mockReturnValue(JSON.stringify({ name: 'my_harness', model: {} }));
+
+    const spec = makeSpec([{ name: 'my_harness', path: 'harnesses/my_harness' }]);
+    expect(() => validateHarnessDockerfiles(spec, CONFIG_ROOT)).not.toThrow();
+    expect(mockedExistsSync).not.toHaveBeenCalled();
+  });
+
+  it('does nothing when harness has containerUri (dockerfile is ignored)', () => {
+    mockedReadFileSync.mockReturnValue(
+      JSON.stringify({ name: 'my_harness', dockerfile: 'Dockerfile', containerUri: 'ecr-uri' })
+    );
+
+    const spec = makeSpec([{ name: 'my_harness', path: 'harnesses/my_harness' }]);
+    expect(() => validateHarnessDockerfiles(spec, CONFIG_ROOT)).not.toThrow();
+    expect(mockedExistsSync).not.toHaveBeenCalled();
+  });
+
+  it('passes when harness has dockerfile and file exists', () => {
+    mockedReadFileSync.mockReturnValue(JSON.stringify({ name: 'my_harness', dockerfile: 'Dockerfile' }));
+    mockedExistsSync.mockReturnValue(true);
+
+    const spec = makeSpec([{ name: 'my_harness', path: 'harnesses/my_harness' }]);
+    expect(() => validateHarnessDockerfiles(spec, CONFIG_ROOT)).not.toThrow();
+  });
+
+  it('throws when harness has dockerfile but file does not exist', () => {
+    mockedReadFileSync.mockReturnValue(JSON.stringify({ name: 'my_harness', dockerfile: 'Dockerfile' }));
+    mockedExistsSync.mockReturnValue(false);
+
+    const spec = makeSpec([{ name: 'my_harness', path: 'harnesses/my_harness' }]);
+    expect(() => validateHarnessDockerfiles(spec, CONFIG_ROOT)).toThrow(/my_harness.*Dockerfile not found/);
+  });
+
+  it('checks for custom dockerfile name', () => {
+    mockedReadFileSync.mockReturnValue(JSON.stringify({ name: 'gpu', dockerfile: 'Dockerfile.gpu' }));
+    mockedExistsSync.mockReturnValue(true);
+
+    const spec = makeSpec([{ name: 'gpu', path: 'harnesses/gpu' }]);
+    expect(() => validateHarnessDockerfiles(spec, CONFIG_ROOT)).not.toThrow();
+
+    const calledPath = mockedExistsSync.mock.calls[0]?.[0] as string;
+    expect(calledPath).toContain('Dockerfile.gpu');
+  });
+
+  it('continues if harness.json cannot be read', () => {
+    mockedReadFileSync.mockImplementation(() => {
+      throw new Error('ENOENT');
+    });
+
+    const spec = makeSpec([{ name: 'broken', path: 'harnesses/broken' }]);
+    expect(() => validateHarnessDockerfiles(spec, CONFIG_ROOT)).not.toThrow();
+  });
+});
diff --git a/src/cli/operations/deploy/__tests__/preflight.test.ts b/src/cli/operations/deploy/__tests__/preflight.test.ts
index 12e172d17..bca98bfd6 100644
--- a/src/cli/operations/deploy/__tests__/preflight.test.ts
+++ b/src/cli/operations/deploy/__tests__/preflight.test.ts
@@ -32,10 +32,20 @@ vi.mock('../../../../lib/index.js', () => ({
     resolveAWSDeploymentTargets = mockReadAWSDeploymentTargets;
     readDeployedState = mockReadDeployedState;
     configExists = mockConfigExists;
+    getPathResolver = () => ({ getAgentConfigPath: () => '/tmp/mock-agentcore.json' });
   },
   requireConfigRoot: mockRequireConfigRoot,
 }));
 
+vi.mock('node:fs', async importOriginal => {
+  const actual = await importOriginal<typeof import('node:fs')>();
+  return {
+    ...actual,
+    readFileSync: () => JSON.stringify({}),
+    writeFileSync: vi.fn(),
+  };
+});
+
 vi.mock('../../../cdk/local-cdk-project.js', () => ({
   LocalCdkProject: class {
     validate = mockValidate;
@@ -78,7 +88,7 @@ describe('validateProject', () => {
     mockReadDeployedState.mockRejectedValue(new Error('No deployed state'));
 
     await expect(validateProject()).rejects.toThrow(
-      'No resources defined in project. Add at least one resource (agent, memory, evaluator, or gateway) before deploying.'
+      'No resources defined in project. Add at least one resource (agent, memory, evaluator, gateway, or harness) before deploying.'
     );
   });
 
diff --git a/src/cli/operations/deploy/change-detection.ts b/src/cli/operations/deploy/change-detection.ts
new file mode 100644
index 000000000..65a513142
--- /dev/null
+++ b/src/cli/operations/deploy/change-detection.ts
@@ -0,0 +1,75 @@
+import { ConfigIO } from '../../../lib';
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+
+/**
+ * Computes a hash of the project configuration relevant to deploy.
+ * Includes agentcore.json, all harness.json files, system-prompt.md files,
+ * and aws-targets.json.
+ *
+ * Only used for harness-only projects — runtime projects always need full
+ * deploy since source code changes aren't tracked here.
+ */
+export async function computeProjectDeployHash(configIO: ConfigIO): Promise<string> {
+  const hash = createHash('sha256');
+
+  const projectSpec = await configIO.readProjectSpec();
+  hash.update(JSON.stringify(projectSpec));
+
+  const configRoot = configIO.getConfigRoot();
+  const projectRoot = dirname(configRoot);
+
+  for (const harness of projectSpec.harnesses ?? []) {
+    const harnessDir = join(projectRoot, harness.path);
+    try {
+      const harnessJson = await readFile(join(harnessDir, 'harness.json'), 'utf-8');
+      hash.update(harnessJson);
+    } catch {
+      // harness.json missing — hash will differ from last deploy
+    }
+    try {
+      const prompt = await readFile(join(harnessDir, 'system-prompt.md'), 'utf-8');
+      hash.update(prompt);
+    } catch {
+      // no system prompt
+    }
+  }
+
+  const awsTargets = await configIO.readAWSDeploymentTargets();
+  hash.update(JSON.stringify(awsTargets));
+
+  return hash.digest('hex').slice(0, 16);
+}
+
+/**
+ * Checks if the project has changed since the last deploy.
+ * Returns true if deploy can be skipped.
+ *
+ * Only applies to harness-only projects. Projects with runtimes always
+ * need full deploy since source code changes aren't tracked by hash.
+ */
+export async function canSkipDeploy(configIO: ConfigIO): Promise<boolean> {
+  try {
+    const projectSpec = await configIO.readProjectSpec();
+
+    if (projectSpec.runtimes.length > 0) {
+      return false;
+    }
+
+    const currentHash = await computeProjectDeployHash(configIO);
+    const deployedState = await configIO.readDeployedState();
+    const targetNames = Object.keys(deployedState.targets);
+    if (targetNames.length === 0) return false;
+
+    for (const targetName of targetNames) {
+      const targetState = deployedState.targets[targetName];
+      const storedHash = targetState?.resources?.deployHash;
+      if (storedHash !== currentHash) return false;
+    }
+
+    return true;
+  } catch {
+    return false;
+  }
+}
diff --git a/src/cli/operations/deploy/gateway-status.ts b/src/cli/operations/deploy/gateway-status.ts
index 815f1115e..d74d21ef0 100644
--- a/src/cli/operations/deploy/gateway-status.ts
+++ b/src/cli/operations/deploy/gateway-status.ts
@@ -1,7 +1,8 @@
 /**
  * Query gateway target sync statuses after deployment.
  */
-import { BedrockAgentCoreControlClient, ListGatewayTargetsCommand } from '@aws-sdk/client-bedrock-agentcore-control';
+import { createControlClient } from '../../aws/agentcore-control';
+import { ListGatewayTargetsCommand } from '@aws-sdk/client-bedrock-agentcore-control';
 
 export interface TargetSyncStatus {
   name: string;
@@ -29,7 +30,7 @@ export function formatTargetStatus(status: string): string {
  */
 export async function getGatewayTargetStatuses(gatewayId: string, region: string): Promise<TargetSyncStatus[]> {
   try {
-    const client = new BedrockAgentCoreControlClient({ region });
+    const client = createControlClient(region);
     const response = await client.send(
       new ListGatewayTargetsCommand({ gatewayIdentifier: gatewayId, maxResults: 100 })
     );
diff --git a/src/cli/operations/deploy/imperative/__tests__/manager.test.ts b/src/cli/operations/deploy/imperative/__tests__/manager.test.ts
new file mode 100644
index 000000000..f563f8fd5
--- /dev/null
+++ b/src/cli/operations/deploy/imperative/__tests__/manager.test.ts
@@ -0,0 +1,624 @@
+import { ImperativeDeploymentManager } from '../manager';
+import type { DeployPhase, DeployProgress, ImperativeDeployContext, ImperativeDeployer } from '../types';
+import { describe, expect, it, vi } from 'vitest';
+
+function createMockDeployer(
+  overrides: Partial<ImperativeDeployer> & { name: string; phase: DeployPhase }
+): ImperativeDeployer {
+  return {
+    label: overrides.label ?? overrides.name,
+    shouldRun: overrides.shouldRun ?? (() => true),
+    deploy: overrides.deploy ?? (() => Promise.resolve({ success: true })),
+    teardown: overrides.teardown ?? (() => Promise.resolve({ success: true })),
+    ...overrides,
+  };
+}
+
+function createMockContext(overrides?: Partial<ImperativeDeployContext>): ImperativeDeployContext {
+  return {
+    projectSpec: {} as ImperativeDeployContext['projectSpec'],
+    target: {} as ImperativeDeployContext['target'],
+    configIO: {} as ImperativeDeployContext['configIO'],
+    deployedState: {} as ImperativeDeployContext['deployedState'],
+    ...overrides,
+  };
+}
+
+describe('ImperativeDeploymentManager', () => {
+  describe('register', () => {
+    it('returns this for chaining', () => {
+      const manager = new ImperativeDeploymentManager();
+      const deployer = createMockDeployer({ name: 'a', phase: 'pre-cdk' });
+      const result = manager.register(deployer);
+      expect(result).toBe(manager);
+    });
+  });
+
+  describe('runPhase', () => {
+    it('runs deployers in registration order within a phase', async () => {
+      const order: string[] = [];
+      const manager = new ImperativeDeploymentManager();
+
+      manager.register(
+        createMockDeployer({
+          name: 'first',
+          phase: 'pre-cdk',
+          deploy: () => {
+            order.push('first');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'second',
+          phase: 'pre-cdk',
+          deploy: () => {
+            order.push('second');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'third',
+          phase: 'pre-cdk',
+          deploy: () => {
+            order.push('third');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+
+      const context = createMockContext();
+      const result = await manager.runPhase('pre-cdk', context);
+
+      expect(result.success).toBe(true);
+      expect(order).toEqual(['first', 'second', 'third']);
+      expect(result.results.size).toBe(3);
+    });
+
+    it('skips deployers where shouldRun returns false', async () => {
+      const manager = new ImperativeDeploymentManager();
+
+      manager.register(
+        createMockDeployer({
+          name: 'runs',
+          phase: 'pre-cdk',
+          deploy: () => Promise.resolve({ success: true, state: { ran: true } }),
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'skipped',
+          phase: 'pre-cdk',
+          shouldRun: () => false,
+          deploy: () => Promise.resolve({ success: true, state: { ran: true } }),
+        })
+      );
+
+      const context = createMockContext();
+      const result = await manager.runPhase('pre-cdk', context);
+
+      expect(result.success).toBe(true);
+      expect(result.results.has('runs')).toBe(true);
+      expect(result.results.has('skipped')).toBe(false);
+    });
+
+    it('stops on first failure (fail-fast)', async () => {
+      const order: string[] = [];
+      const manager = new ImperativeDeploymentManager();
+
+      manager.register(
+        createMockDeployer({
+          name: 'ok',
+          phase: 'post-cdk',
+          deploy: () => {
+            order.push('ok');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'fail',
+          phase: 'post-cdk',
+          deploy: () => {
+            order.push('fail');
+            return Promise.resolve({ success: false, error: 'something broke' });
+          },
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'never',
+          phase: 'post-cdk',
+          deploy: () => {
+            order.push('never');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+
+      const context = createMockContext();
+      const result = await manager.runPhase('post-cdk', context);
+
+      expect(result.success).toBe(false);
+      expect(result.error).toBe('something broke');
+      expect(order).toEqual(['ok', 'fail']);
+      expect(result.results.has('never')).toBe(false);
+    });
+
+    it('handles thrown errors as failures', async () => {
+      const manager = new ImperativeDeploymentManager();
+
+      manager.register(
+        createMockDeployer({
+          name: 'thrower',
+          phase: 'pre-cdk',
+          deploy: () => Promise.reject(new Error('unexpected crash')),
+        })
+      );
+
+      const context = createMockContext();
+      const result = await manager.runPhase('pre-cdk', context);
+
+      expect(result.success).toBe(false);
+      expect(result.error).toBe('unexpected crash');
+      expect(result.results.get('thrower')?.success).toBe(false);
+    });
+
+    it('only runs deployers matching the requested phase', async () => {
+      const order: string[] = [];
+      const manager = new ImperativeDeploymentManager();
+
+      manager.register(
+        createMockDeployer({
+          name: 'pre',
+          phase: 'pre-cdk',
+          deploy: () => {
+            order.push('pre');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'post',
+          phase: 'post-cdk',
+          deploy: () => {
+            order.push('post');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'standalone',
+          phase: 'standalone',
+          deploy: () => {
+            order.push('standalone');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+
+      const context = createMockContext();
+      const result = await manager.runPhase('post-cdk', context);
+
+      expect(result.success).toBe(true);
+      expect(order).toEqual(['post']);
+      expect(result.results.size).toBe(1);
+      expect(result.results.has('post')).toBe(true);
+    });
+
+    it('calls progress callbacks correctly', async () => {
+      const manager = new ImperativeDeploymentManager();
+      const onProgress = vi.fn<DeployProgress>();
+
+      manager.register(
+        createMockDeployer({
+          name: 'deployer-a',
+          label: 'Deployer A',
+          phase: 'pre-cdk',
+          deploy: () => Promise.resolve({ success: true }),
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'deployer-b',
+          label: 'Deployer B',
+          phase: 'pre-cdk',
+          deploy: () => Promise.resolve({ success: false, error: 'oops' }),
+        })
+      );
+
+      const context = createMockContext({ onProgress });
+      await manager.runPhase('pre-cdk', context);
+
+      expect(onProgress).toHaveBeenCalledTimes(4);
+      expect(onProgress).toHaveBeenNthCalledWith(1, 'Deployer A', 'start');
+      expect(onProgress).toHaveBeenNthCalledWith(2, 'Deployer A', 'done');
+      expect(onProgress).toHaveBeenNthCalledWith(3, 'Deployer B', 'start');
+      expect(onProgress).toHaveBeenNthCalledWith(4, 'Deployer B', 'error');
+    });
+
+    it('reports error status in progress callback on failure', async () => {
+      const manager = new ImperativeDeploymentManager();
+      const onProgress = vi.fn<DeployProgress>();
+
+      manager.register(
+        createMockDeployer({
+          name: 'fail',
+          label: 'Failing',
+          phase: 'standalone',
+          deploy: () => Promise.resolve({ success: false, error: 'boom' }),
+        })
+      );
+
+      const context = createMockContext({ onProgress });
+      await manager.runPhase('standalone', context);
+
+      expect(onProgress).toHaveBeenCalledWith('Failing', 'start');
+      expect(onProgress).toHaveBeenCalledWith('Failing', 'error');
+    });
+
+    it('returns empty results when no deployers are registered', async () => {
+      const manager = new ImperativeDeploymentManager();
+      const context = createMockContext();
+      const result = await manager.runPhase('pre-cdk', context);
+
+      expect(result.success).toBe(true);
+      expect(result.results.size).toBe(0);
+      expect(result.notes).toEqual([]);
+    });
+
+    it('returns empty results when no deployers match the phase', async () => {
+      const manager = new ImperativeDeploymentManager();
+
+      manager.register(createMockDeployer({ name: 'post-only', phase: 'post-cdk' }));
+
+      const context = createMockContext();
+      const result = await manager.runPhase('pre-cdk', context);
+
+      expect(result.success).toBe(true);
+      expect(result.results.size).toBe(0);
+    });
+
+    it('collects notes from successful deployers', async () => {
+      const manager = new ImperativeDeploymentManager();
+
+      manager.register(
+        createMockDeployer({
+          name: 'noted',
+          phase: 'pre-cdk',
+          deploy: () => Promise.resolve({ success: true, notes: ['note-1', 'note-2'] }),
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'also-noted',
+          phase: 'pre-cdk',
+          deploy: () => Promise.resolve({ success: true, notes: ['note-3'] }),
+        })
+      );
+
+      const context = createMockContext();
+      const result = await manager.runPhase('pre-cdk', context);
+
+      expect(result.success).toBe(true);
+      expect(result.notes).toEqual(['note-1', 'note-2', 'note-3']);
+    });
+
+    it('includes notes from deployers up to and including the failed one', async () => {
+      const manager = new ImperativeDeploymentManager();
+
+      manager.register(
+        createMockDeployer({
+          name: 'ok',
+          phase: 'pre-cdk',
+          deploy: () => Promise.resolve({ success: true, notes: ['before-fail'] }),
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'fail',
+          phase: 'pre-cdk',
+          deploy: () => Promise.resolve({ success: false, error: 'failed', notes: ['fail-note'] }),
+        })
+      );
+
+      const context = createMockContext();
+      const result = await manager.runPhase('pre-cdk', context);
+
+      expect(result.success).toBe(false);
+      expect(result.notes).toEqual(['before-fail', 'fail-note']);
+    });
+  });
+
+  describe('teardownAll', () => {
+    it('runs deployers in reverse registration order', async () => {
+      const order: string[] = [];
+      const manager = new ImperativeDeploymentManager();
+
+      manager.register(
+        createMockDeployer({
+          name: 'first',
+          phase: 'pre-cdk',
+          teardown: () => {
+            order.push('first');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'second',
+          phase: 'post-cdk',
+          teardown: () => {
+            order.push('second');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'third',
+          phase: 'standalone',
+          teardown: () => {
+            order.push('third');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+
+      const context = createMockContext();
+      const result = await manager.teardownAll(context);
+
+      expect(result.success).toBe(true);
+      expect(order).toEqual(['third', 'second', 'first']);
+    });
+
+    it('runs all deployers regardless of phase', async () => {
+      const manager = new ImperativeDeploymentManager();
+      const torn: string[] = [];
+
+      manager.register(
+        createMockDeployer({
+          name: 'pre',
+          phase: 'pre-cdk',
+          teardown: () => {
+            torn.push('pre');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'post',
+          phase: 'post-cdk',
+          teardown: () => {
+            torn.push('post');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'standalone',
+          phase: 'standalone',
+          teardown: () => {
+            torn.push('standalone');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+
+      const context = createMockContext();
+      const result = await manager.teardownAll(context);
+
+      expect(result.success).toBe(true);
+      expect(torn).toEqual(['standalone', 'post', 'pre']);
+    });
+
+    it('continues on failure and collects all errors (best-effort)', async () => {
+      const order: string[] = [];
+      const manager = new ImperativeDeploymentManager();
+
+      manager.register(
+        createMockDeployer({
+          name: 'first',
+          phase: 'pre-cdk',
+          teardown: () => {
+            order.push('first');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'second',
+          phase: 'post-cdk',
+          teardown: () => {
+            order.push('second');
+            return Promise.resolve({ success: false, error: 'teardown failed' });
+          },
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'third',
+          phase: 'standalone',
+          teardown: () => {
+            order.push('third');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+
+      const context = createMockContext();
+      const result = await manager.teardownAll(context);
+
+      // Reverse order: third, second (fails), first still runs
+      expect(result.success).toBe(false);
+      expect(result.error).toBe('teardown failed');
+      expect(order).toEqual(['third', 'second', 'first']);
+    });
+
+    it('collects multiple teardown errors', async () => {
+      const manager = new ImperativeDeploymentManager();
+
+      manager.register(
+        createMockDeployer({
+          name: 'first',
+          phase: 'pre-cdk',
+          teardown: () => Promise.resolve({ success: false, error: 'first broke' }),
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'second',
+          phase: 'post-cdk',
+          teardown: () => Promise.resolve({ success: false, error: 'second broke' }),
+        })
+      );
+
+      const context = createMockContext();
+      const result = await manager.teardownAll(context);
+
+      expect(result.success).toBe(false);
+      expect(result.error).toBe('second broke; first broke');
+    });
+
+    it('skips deployers where shouldRun returns false', async () => {
+      const manager = new ImperativeDeploymentManager();
+      const torn: string[] = [];
+
+      manager.register(
+        createMockDeployer({
+          name: 'active',
+          phase: 'pre-cdk',
+          teardown: () => {
+            torn.push('active');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'inactive',
+          phase: 'post-cdk',
+          shouldRun: () => false,
+          teardown: () => {
+            torn.push('inactive');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+
+      const context = createMockContext();
+      const result = await manager.teardownAll(context);
+
+      expect(result.success).toBe(true);
+      expect(torn).toEqual(['active']);
+    });
+
+    it('calls progress callbacks correctly during teardown', async () => {
+      const manager = new ImperativeDeploymentManager();
+      const onProgress = vi.fn<DeployProgress>();
+
+      manager.register(
+        createMockDeployer({
+          name: 'td',
+          label: 'Teardown Step',
+          phase: 'pre-cdk',
+          teardown: () => Promise.resolve({ success: true }),
+        })
+      );
+
+      const context = createMockContext({ onProgress });
+      await manager.teardownAll(context);
+
+      expect(onProgress).toHaveBeenCalledWith('Teardown Step', 'start');
+      expect(onProgress).toHaveBeenCalledWith('Teardown Step', 'done');
+    });
+
+    it('handles thrown errors during teardown and continues', async () => {
+      const order: string[] = [];
+      const manager = new ImperativeDeploymentManager();
+
+      manager.register(
+        createMockDeployer({
+          name: 'ok',
+          phase: 'pre-cdk',
+          teardown: () => {
+            order.push('ok');
+            return Promise.resolve({ success: true });
+          },
+        })
+      );
+      manager.register(
+        createMockDeployer({
+          name: 'thrower',
+          phase: 'post-cdk',
+          teardown: () => Promise.reject(new Error('teardown crash')),
+        })
+      );
+
+      const context = createMockContext();
+      const result = await manager.teardownAll(context);
+
+      expect(result.success).toBe(false);
+      expect(result.error).toBe('teardown crash');
+      expect(order).toEqual(['ok']);
+    });
+  });
+
+  describe('hasDeployersForPhase', () => {
+    it('returns true when a deployer matches phase and shouldRun', () => {
+      const manager = new ImperativeDeploymentManager();
+      manager.register(createMockDeployer({ name: 'a', phase: 'pre-cdk' }));
+
+      const context = createMockContext();
+      expect(manager.hasDeployersForPhase('pre-cdk', context)).toBe(true);
+    });
+
+    it('returns false when no deployers match the phase', () => {
+      const manager = new ImperativeDeploymentManager();
+      manager.register(createMockDeployer({ name: 'a', phase: 'post-cdk' }));
+
+      const context = createMockContext();
+      expect(manager.hasDeployersForPhase('pre-cdk', context)).toBe(false);
+    });
+
+    it('returns false when deployer matches phase but shouldRun returns false', () => {
+      const manager = new ImperativeDeploymentManager();
+      manager.register(
+        createMockDeployer({
+          name: 'a',
+          phase: 'pre-cdk',
+          shouldRun: () => false,
+        })
+      );
+
+      const context = createMockContext();
+      expect(manager.hasDeployersForPhase('pre-cdk', context)).toBe(false);
+    });
+
+    it('returns false when no deployers are registered', () => {
+      const manager = new ImperativeDeploymentManager();
+      const context = createMockContext();
+      expect(manager.hasDeployersForPhase('standalone', context)).toBe(false);
+    });
+
+    it('returns true when at least one deployer matches among many', () => {
+      const manager = new ImperativeDeploymentManager();
+      manager.register(createMockDeployer({ name: 'a', phase: 'pre-cdk', shouldRun: () => false }));
+      manager.register(createMockDeployer({ name: 'b', phase: 'post-cdk' }));
+      manager.register(createMockDeployer({ name: 'c', phase: 'pre-cdk', shouldRun: () => true }));
+
+      const context = createMockContext();
+      expect(manager.hasDeployersForPhase('pre-cdk', context)).toBe(true);
+    });
+  });
+});
diff --git a/src/cli/operations/deploy/imperative/deployers/__tests__/harness-deployer.test.ts b/src/cli/operations/deploy/imperative/deployers/__tests__/harness-deployer.test.ts
new file mode 100644
index 000000000..4d5123852
--- /dev/null
+++ b/src/cli/operations/deploy/imperative/deployers/__tests__/harness-deployer.test.ts
@@ -0,0 +1,750 @@
+import type { ConfigIO } from '../../../../../../lib';
+import type { AgentCoreProjectSpec, AwsDeploymentTarget, DeployedState } from '../../../../../../schema';
+import * as harnessApi from '../../../../../aws/agentcore-harness';
+import type { ImperativeDeployContext } from '../../types';
+import { HarnessDeployer } from '../harness-deployer';
+import * as harnessMapper from '../harness-mapper';
+import { readFile } from 'fs/promises';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('fs/promises', () => ({
+  readFile: vi.fn(),
+}));
+
+vi.mock('../../../../../aws/agentcore-harness', () => ({
+  createHarness: vi.fn(),
+  updateHarness: vi.fn(),
+  deleteHarness: vi.fn(),
+  getHarness: vi.fn(),
+}));
+
+vi.mock('../harness-mapper', () => ({
+  mapHarnessSpecToCreateOptions: vi.fn(),
+}));
+
+const mockedReadFile = vi.mocked(readFile);
+const mockedCreateHarness = vi.mocked(harnessApi.createHarness);
+const mockedUpdateHarness = vi.mocked(harnessApi.updateHarness);
+const mockedDeleteHarness = vi.mocked(harnessApi.deleteHarness);
+const mockedGetHarness = vi.mocked(harnessApi.getHarness);
+const mockedMapHarness = vi.mocked(harnessMapper.mapHarnessSpecToCreateOptions);
+
+const REGION = 'us-east-1';
+const TARGET_NAME = 'default';
+const CONFIG_ROOT = '/project/agentcore';
+
+function createContext(overrides?: {
+  harnesses?: AgentCoreProjectSpec['harnesses'];
+  deployedHarnesses?: DeployedState['targets'][string]['resources'];
+  cdkOutputs?: Record<string, string>;
+}): ImperativeDeployContext {
+  const projectSpec = {
+    name: 'TestProject',
+    version: 1,
+    managedBy: 'CDK' as const,
+    runtimes: [],
+    memories: [],
+    credentials: [],
+    evaluators: [],
+    onlineEvalConfigs: [],
+    agentCoreGateways: [],
+    policyEngines: [],
+    configBundles: [],
+    abTests: [],
+    httpGateways: [],
+    harnesses: overrides?.harnesses,
+  } as AgentCoreProjectSpec;
+
+  const target: AwsDeploymentTarget = {
+    name: TARGET_NAME,
+    account: '123456789012',
+    region: REGION,
+  };
+
+  const deployedState: DeployedState = {
+    targets: {
+      [TARGET_NAME]: {
+        resources: overrides?.deployedHarnesses ?? {},
+      },
+    },
+  };
+
+  const configIO = {
+    getConfigRoot: () => CONFIG_ROOT,
+    getPathResolver: () => ({ getBaseDir: () => CONFIG_ROOT }),
+  } as unknown as ConfigIO;
+
+  return {
+    projectSpec,
+    target,
+    deployedState,
+    configIO,
+    cdkOutputs: overrides?.cdkOutputs ?? {},
+  };
+}
+
+const HARNESS_SPEC_JSON = JSON.stringify({
+  name: 'my_harness',
+  model: { provider: 'bedrock', modelId: 'anthropic.claude-3-sonnet-20240229-v1:0' },
+  tools: [],
+  skills: [],
+});
+
+describe('HarnessDeployer', () => {
+  let deployer: HarnessDeployer;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.useFakeTimers();
+    deployer = new HarnessDeployer();
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  describe('metadata', () => {
+    it('has correct name, label, and phase', () => {
+      expect(deployer.name).toBe('harness');
+      expect(deployer.label).toBe('Harnesses');
+      expect(deployer.phase).toBe('post-cdk');
+    });
+  });
+
+  describe('shouldRun', () => {
+    it('returns true when project has harnesses', () => {
+      const ctx = createContext({
+        harnesses: [{ name: 'my_harness', path: 'harnesses/my_harness' }],
+      });
+      expect(deployer.shouldRun(ctx)).toBe(true);
+    });
+
+    it('returns true when only deployed state has harnesses', () => {
+      const ctx = createContext({
+        deployedHarnesses: {
+          harnesses: {
+            old_harness: {
+              harnessId: 'h-123',
+              harnessArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-123',
+              roleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+              status: 'READY',
+            },
+          },
+        },
+      });
+      expect(deployer.shouldRun(ctx)).toBe(true);
+    });
+
+    it('returns false when no harnesses anywhere', () => {
+      const ctx = createContext();
+      expect(deployer.shouldRun(ctx)).toBe(false);
+    });
+
+    it('returns false when harnesses array is empty', () => {
+      const ctx = createContext({ harnesses: [] });
+      expect(deployer.shouldRun(ctx)).toBe(false);
+    });
+  });
+
+  describe('deploy', () => {
+    it('creates a harness when not previously deployed', async () => {
+      const createOptions = {
+        region: REGION,
+        harnessName: 'my_harness',
+        executionRoleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+        model: { bedrockModelConfig: { modelId: 'anthropic.claude-3-sonnet-20240229-v1:0' } },
+      };
+
+      mockedReadFile.mockResolvedValueOnce(HARNESS_SPEC_JSON);
+      mockedMapHarness.mockResolvedValueOnce(createOptions);
+      mockedCreateHarness.mockResolvedValueOnce({
+        harness: {
+          harnessId: 'h-new',
+          harnessName: 'my_harness',
+          arn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-new',
+          status: 'CREATING',
+          executionRoleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+          createdAt: '2024-01-01T00:00:00Z',
+          updatedAt: '2024-01-01T00:00:00Z',
+        },
+      });
+      mockedGetHarness.mockResolvedValueOnce({
+        harness: {
+          harnessId: 'h-new',
+          harnessName: 'my_harness',
+          arn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-new',
+          status: 'READY',
+          executionRoleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+          environment: {
+            agentCoreRuntimeEnvironment: {
+              agentRuntimeArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/rt-new',
+            },
+          },
+          createdAt: '2024-01-01T00:00:00Z',
+          updatedAt: '2024-01-01T00:00:00Z',
+        },
+      });
+
+      const ctx = createContext({
+        harnesses: [{ name: 'my_harness', path: 'harnesses/my_harness' }],
+        cdkOutputs: {
+          ApplicationHarnessMyHarnessRoleArnOutput123: 'arn:aws:iam::123456789012:role/HarnessRole',
+        },
+      });
+
+      const resultPromise = deployer.deploy(ctx);
+      await vi.advanceTimersByTimeAsync(5_000);
+      const result = await resultPromise;
+
+      expect(result.success).toBe(true);
+      expect(result.state).toEqual({
+        my_harness: expect.objectContaining({
+          harnessId: 'h-new',
+          harnessArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-new',
+          roleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+          status: 'READY',
+          agentRuntimeArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/rt-new',
+          memoryArn: undefined,
+        }),
+      });
+      expect(result.state!.my_harness).toHaveProperty('configHash');
+      expect(mockedCreateHarness).toHaveBeenCalledWith(createOptions);
+      expect(result.notes).toContain('Created harness "my_harness"');
+    });
+
+    it('resolves role ARN from new AgentCoreHarnessEnvironment output key', async () => {
+      const createOptions = {
+        region: REGION,
+        harnessName: 'my_harness',
+        executionRoleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+        model: { bedrockModelConfig: { modelId: 'anthropic.claude-3-sonnet-20240229-v1:0' } },
+      };
+
+      mockedReadFile.mockResolvedValueOnce(HARNESS_SPEC_JSON);
+      mockedMapHarness.mockResolvedValueOnce(createOptions);
+      mockedCreateHarness.mockResolvedValueOnce({
+        harness: {
+          harnessId: 'h-new',
+          harnessName: 'my_harness',
+          arn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-new',
+          status: 'READY',
+          executionRoleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+          createdAt: '2024-01-01T00:00:00Z',
+          updatedAt: '2024-01-01T00:00:00Z',
+        },
+      });
+
+      const ctx = createContext({
+        harnesses: [{ name: 'my_harness', path: 'harnesses/my_harness' }],
+        cdkOutputs: {
+          ApplicationHarnessMyHarnessRoleRoleArnOutput123: 'arn:aws:iam::123456789012:role/HarnessRole',
+        },
+      });
+
+      const result = await deployer.deploy(ctx);
+
+      expect(result.success).toBe(true);
+      expect(result.state!.my_harness).toEqual(
+        expect.objectContaining({
+          harnessId: 'h-new',
+          roleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+        })
+      );
+      expect(mockedCreateHarness).toHaveBeenCalledWith(createOptions);
+    });
+
+    it('prefers new RoleRoleArn key over old RoleArn key when both are present', async () => {
+      const createOptions = {
+        region: REGION,
+        harnessName: 'my_harness',
+        executionRoleArn: 'arn:aws:iam::123456789012:role/NewRole',
+        model: { bedrockModelConfig: { modelId: 'anthropic.claude-3-sonnet-20240229-v1:0' } },
+      };
+
+      mockedReadFile.mockResolvedValueOnce(HARNESS_SPEC_JSON);
+      mockedMapHarness.mockResolvedValueOnce(createOptions);
+      mockedCreateHarness.mockResolvedValueOnce({
+        harness: {
+          harnessId: 'h-new',
+          harnessName: 'my_harness',
+          arn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-new',
+          status: 'READY',
+          executionRoleArn: 'arn:aws:iam::123456789012:role/NewRole',
+          createdAt: '2024-01-01T00:00:00Z',
+          updatedAt: '2024-01-01T00:00:00Z',
+        },
+      });
+
+      const ctx = createContext({
+        harnesses: [{ name: 'my_harness', path: 'harnesses/my_harness' }],
+        cdkOutputs: {
+          ApplicationHarnessMyHarnessRoleRoleArnOutput123: 'arn:aws:iam::123456789012:role/NewRole',
+          ApplicationHarnessMyHarnessRoleArnOutput456: 'arn:aws:iam::123456789012:role/OldRole',
+        },
+      });
+
+      const result = await deployer.deploy(ctx);
+
+      expect(result.success).toBe(true);
+      expect(result.state!.my_harness).toEqual(
+        expect.objectContaining({
+          roleArn: 'arn:aws:iam::123456789012:role/NewRole',
+        })
+      );
+    });
+
+    it('updates a harness when already deployed', async () => {
+      const createOptions = {
+        region: REGION,
+        harnessName: 'my_harness',
+        executionRoleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+        model: { bedrockModelConfig: { modelId: 'anthropic.claude-3-sonnet-20240229-v1:0' } },
+      };
+
+      mockedReadFile.mockResolvedValueOnce(HARNESS_SPEC_JSON);
+      mockedMapHarness.mockResolvedValueOnce(createOptions);
+      mockedUpdateHarness.mockResolvedValueOnce({
+        harness: {
+          harnessId: 'h-existing',
+          harnessName: 'my_harness',
+          arn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-existing',
+          status: 'UPDATING',
+          executionRoleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+          createdAt: '2024-01-01T00:00:00Z',
+          updatedAt: '2024-01-02T00:00:00Z',
+        },
+      });
+      mockedGetHarness.mockResolvedValueOnce({
+        harness: {
+          harnessId: 'h-existing',
+          harnessName: 'my_harness',
+          arn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-existing',
+          status: 'READY',
+          executionRoleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+          environment: {
+            agentCoreRuntimeEnvironment: {
+              agentRuntimeArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/rt-existing',
+            },
+          },
+          createdAt: '2024-01-01T00:00:00Z',
+          updatedAt: '2024-01-02T00:00:00Z',
+        },
+      });
+
+      const ctx = createContext({
+        harnesses: [{ name: 'my_harness', path: 'harnesses/my_harness' }],
+        deployedHarnesses: {
+          harnesses: {
+            my_harness: {
+              harnessId: 'h-existing',
+              harnessArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-existing',
+              roleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+              status: 'READY',
+            },
+          },
+        },
+        cdkOutputs: {
+          ApplicationHarnessMyHarnessRoleArnOutput123: 'arn:aws:iam::123456789012:role/HarnessRole',
+        },
+      });
+
+      const resultPromise = deployer.deploy(ctx);
+      await vi.advanceTimersByTimeAsync(5_000);
+      const result = await resultPromise;
+
+      expect(result.success).toBe(true);
+      expect(mockedUpdateHarness).toHaveBeenCalledWith(
+        expect.objectContaining({
+          region: REGION,
+          harnessId: 'h-existing',
+        })
+      );
+      expect(result.notes).toContain('Updated harness "my_harness"');
+    });
+
+    it('deletes a harness removed from project spec', async () => {
+      mockedDeleteHarness.mockResolvedValueOnce({
+        harness: {
+          harnessId: 'h-old',
+          harnessName: 'old_harness',
+          arn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-old',
+          status: 'DELETING',
+          executionRoleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+          createdAt: '2024-01-01T00:00:00Z',
+          updatedAt: '2024-01-02T00:00:00Z',
+        },
+      });
+
+      const ctx = createContext({
+        harnesses: [],
+        deployedHarnesses: {
+          harnesses: {
+            old_harness: {
+              harnessId: 'h-old',
+              harnessArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-old',
+              roleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+              status: 'READY',
+            },
+          },
+        },
+      });
+
+      const result = await deployer.deploy(ctx);
+
+      expect(result.success).toBe(true);
+      expect(mockedDeleteHarness).toHaveBeenCalledWith({ region: REGION, harnessId: 'h-old' });
+      expect(result.notes).toContain('Deleted harness "old_harness"');
+      // Deleted harness should not appear in result state
+      expect(result.state).toEqual({});
+    });
+
+    it('returns error when role ARN not found in CDK outputs', async () => {
+      mockedReadFile.mockResolvedValueOnce(HARNESS_SPEC_JSON);
+
+      const ctx = createContext({
+        harnesses: [{ name: 'my_harness', path: 'harnesses/my_harness' }],
+        cdkOutputs: {
+          // No matching output key
+          SomeOtherOutput: 'value',
+        },
+      });
+
+      const result = await deployer.deploy(ctx);
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('Could not find role ARN');
+      expect(result.error).toContain('my_harness');
+    });
+
+    it('returns error when harness.json cannot be read', async () => {
+      mockedReadFile.mockRejectedValueOnce(new Error('ENOENT: no such file or directory'));
+
+      const ctx = createContext({
+        harnesses: [{ name: 'my_harness', path: 'harnesses/my_harness' }],
+        cdkOutputs: {
+          ApplicationHarnessMyHarnessRoleArnOutput123: 'arn:aws:iam::123456789012:role/HarnessRole',
+        },
+      });
+
+      const result = await deployer.deploy(ctx);
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('Failed to read harness.json');
+    });
+
+    it('preserves existing harness state when validation fails', async () => {
+      mockedReadFile.mockResolvedValueOnce('{ "invalid": true }');
+
+      const existingState = {
+        harnessId: 'h-existing',
+        harnessArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-existing',
+        roleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+        status: 'READY' as const,
+        configHash: 'abc123',
+      };
+
+      const ctx = createContext({
+        harnesses: [{ name: 'my_harness', path: 'harnesses/my_harness' }],
+        deployedHarnesses: {
+          harnesses: { my_harness: existingState },
+        },
+        cdkOutputs: {
+          ApplicationHarnessMyHarnessRoleArnOutput123: 'arn:aws:iam::123456789012:role/HarnessRole',
+        },
+      });
+
+      const result = await deployer.deploy(ctx);
+
+      expect(result.success).toBe(false);
+      expect(result.state).toEqual({ my_harness: existingState });
+    });
+
+    it('preserves existing harness state when harness.json read fails', async () => {
+      mockedReadFile.mockRejectedValueOnce(new Error('ENOENT'));
+
+      const existingState = {
+        harnessId: 'h-existing',
+        harnessArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-existing',
+        roleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+        status: 'READY' as const,
+        configHash: 'abc123',
+      };
+
+      const ctx = createContext({
+        harnesses: [{ name: 'my_harness', path: 'harnesses/my_harness' }],
+        deployedHarnesses: {
+          harnesses: { my_harness: existingState },
+        },
+        cdkOutputs: {
+          ApplicationHarnessMyHarnessRoleArnOutput123: 'arn:aws:iam::123456789012:role/HarnessRole',
+        },
+      });
+
+      const result = await deployer.deploy(ctx);
+
+      expect(result.success).toBe(false);
+      expect(result.state).toEqual({ my_harness: existingState });
+    });
+
+    it('preserves existing harness state when role ARN not found', async () => {
+      mockedReadFile.mockResolvedValueOnce(HARNESS_SPEC_JSON);
+
+      const existingState = {
+        harnessId: 'h-existing',
+        harnessArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-existing',
+        roleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+        status: 'READY' as const,
+        configHash: 'abc123',
+      };
+
+      const ctx = createContext({
+        harnesses: [{ name: 'my_harness', path: 'harnesses/my_harness' }],
+        deployedHarnesses: {
+          harnesses: { my_harness: existingState },
+        },
+        cdkOutputs: { SomeOtherOutput: 'value' },
+      });
+
+      const result = await deployer.deploy(ctx);
+
+      expect(result.success).toBe(false);
+      expect(result.state).toEqual({ my_harness: existingState });
+    });
+
+    it('returns error when API call fails', async () => {
+      mockedReadFile.mockResolvedValueOnce(HARNESS_SPEC_JSON);
+      mockedMapHarness.mockResolvedValueOnce({
+        region: REGION,
+        harnessName: 'my_harness',
+        executionRoleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+      });
+      mockedCreateHarness.mockRejectedValueOnce(new Error('Service unavailable'));
+
+      const ctx = createContext({
+        harnesses: [{ name: 'my_harness', path: 'harnesses/my_harness' }],
+        cdkOutputs: {
+          ApplicationHarnessMyHarnessRoleArnOutput123: 'arn:aws:iam::123456789012:role/HarnessRole',
+        },
+      });
+
+      const result = await deployer.deploy(ctx);
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('Failed to deploy harness "my_harness"');
+      expect(result.error).toContain('Service unavailable');
+    });
+  });
+
+  describe('configHash', () => {
+    const ROLE_ARN = 'arn:aws:iam::123456789012:role/HarnessRole';
+    const CDK_OUTPUTS = { ApplicationHarnessMyHarnessRoleArnOutput123: ROLE_ARN };
+
+    const HARNESS_SPEC_WITH_DOCKERFILE_JSON = JSON.stringify({
+      name: 'my_harness',
+      model: { provider: 'bedrock', modelId: 'anthropic.claude-3-sonnet-20240229-v1:0' },
+      tools: [],
+      skills: [],
+      dockerfile: 'Dockerfile',
+    });
+
+    const READY_HARNESS = {
+      harnessId: 'h-new',
+      harnessName: 'my_harness',
+      arn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-new',
+      status: 'READY' as const,
+      executionRoleArn: ROLE_ARN,
+      createdAt: '2024-01-01T00:00:00Z',
+      updatedAt: '2024-01-01T00:00:00Z',
+    };
+
+    it('produces different hashes for different Dockerfile contents', async () => {
+      const ctx = createContext({
+        harnesses: [{ name: 'my_harness', path: 'harnesses/my_harness' }],
+        cdkOutputs: CDK_OUTPUTS,
+      });
+
+      // First deploy — Dockerfile v1
+      mockedReadFile
+        .mockResolvedValueOnce(HARNESS_SPEC_WITH_DOCKERFILE_JSON)
+        .mockRejectedValueOnce(new Error('ENOENT'))
+        .mockResolvedValueOnce('FROM python:3.11');
+      mockedMapHarness.mockResolvedValueOnce({ region: REGION, harnessName: 'my_harness', executionRoleArn: ROLE_ARN });
+      mockedCreateHarness.mockResolvedValueOnce({ harness: READY_HARNESS });
+
+      const result1 = await deployer.deploy(ctx);
+      const hash1 = result1.state!.my_harness!.configHash;
+
+      vi.clearAllMocks();
+
+      // Second deploy — Dockerfile v2 (same everything else)
+      mockedReadFile
+        .mockResolvedValueOnce(HARNESS_SPEC_WITH_DOCKERFILE_JSON)
+        .mockRejectedValueOnce(new Error('ENOENT'))
+        .mockResolvedValueOnce('FROM python:3.12');
+      mockedMapHarness.mockResolvedValueOnce({ region: REGION, harnessName: 'my_harness', executionRoleArn: ROLE_ARN });
+      mockedCreateHarness.mockResolvedValueOnce({ harness: READY_HARNESS });
+
+      const result2 = await deployer.deploy(ctx);
+      const hash2 = result2.state!.my_harness!.configHash;
+
+      expect(hash1).toBeDefined();
+      expect(hash2).toBeDefined();
+      expect(hash1).not.toBe(hash2);
+    });
+
+    it('triggers update when Dockerfile content changes after initial deploy', async () => {
+      // First deploy to get the real hash for Dockerfile v1
+      const ctx = createContext({
+        harnesses: [{ name: 'my_harness', path: 'harnesses/my_harness' }],
+        cdkOutputs: CDK_OUTPUTS,
+      });
+
+      mockedReadFile
+        .mockResolvedValueOnce(HARNESS_SPEC_WITH_DOCKERFILE_JSON)
+        .mockRejectedValueOnce(new Error('ENOENT'))
+        .mockResolvedValueOnce('FROM python:3.11');
+      mockedMapHarness.mockResolvedValueOnce({ region: REGION, harnessName: 'my_harness', executionRoleArn: ROLE_ARN });
+      mockedCreateHarness.mockResolvedValueOnce({ harness: READY_HARNESS });
+
+      const initialResult = await deployer.deploy(ctx);
+      const initialHash = initialResult.state!.my_harness!.configHash;
+
+      vi.clearAllMocks();
+
+      // Second deploy — Dockerfile changed, deployed state has the old hash
+      const ctxWithDeployed = createContext({
+        harnesses: [{ name: 'my_harness', path: 'harnesses/my_harness' }],
+        deployedHarnesses: {
+          harnesses: {
+            my_harness: {
+              harnessId: 'h-new',
+              harnessArn: READY_HARNESS.arn,
+              roleArn: ROLE_ARN,
+              status: 'READY',
+              configHash: initialHash,
+            },
+          },
+        },
+        cdkOutputs: CDK_OUTPUTS,
+      });
+
+      mockedReadFile
+        .mockResolvedValueOnce(HARNESS_SPEC_WITH_DOCKERFILE_JSON)
+        .mockRejectedValueOnce(new Error('ENOENT'))
+        .mockResolvedValueOnce('FROM python:3.12');
+      mockedMapHarness.mockResolvedValueOnce({ region: REGION, harnessName: 'my_harness', executionRoleArn: ROLE_ARN });
+      mockedUpdateHarness.mockResolvedValueOnce({ harness: READY_HARNESS });
+
+      const result = await deployer.deploy(ctxWithDeployed);
+
+      expect(result.success).toBe(true);
+      expect(mockedUpdateHarness).toHaveBeenCalled();
+      expect(result.notes).toContain('Updated harness "my_harness"');
+    });
+
+    it('does not read Dockerfile when no dockerfile field is set', async () => {
+      mockedReadFile.mockResolvedValueOnce(HARNESS_SPEC_JSON).mockRejectedValueOnce(new Error('ENOENT'));
+      mockedMapHarness.mockResolvedValueOnce({ region: REGION, harnessName: 'my_harness', executionRoleArn: ROLE_ARN });
+      mockedCreateHarness.mockResolvedValueOnce({ harness: READY_HARNESS });
+
+      const ctx = createContext({
+        harnesses: [{ name: 'my_harness', path: 'harnesses/my_harness' }],
+        cdkOutputs: CDK_OUTPUTS,
+      });
+
+      await deployer.deploy(ctx);
+
+      const dockerfileCallArgs = mockedReadFile.mock.calls.find(
+        ([path]) => typeof path === 'string' && path.includes('Dockerfile')
+      );
+      expect(dockerfileCallArgs).toBeUndefined();
+    });
+  });
+
+  describe('teardown', () => {
+    it('deletes all deployed harnesses', async () => {
+      mockedDeleteHarness
+        .mockResolvedValueOnce({
+          harness: {
+            harnessId: 'h-1',
+            harnessName: 'harness_a',
+            arn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-1',
+            status: 'DELETING',
+            executionRoleArn: 'arn:aws:iam::123456789012:role/RoleA',
+            createdAt: '2024-01-01T00:00:00Z',
+            updatedAt: '2024-01-01T00:00:00Z',
+          },
+        })
+        .mockResolvedValueOnce({
+          harness: {
+            harnessId: 'h-2',
+            harnessName: 'harness_b',
+            arn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-2',
+            status: 'DELETING',
+            executionRoleArn: 'arn:aws:iam::123456789012:role/RoleB',
+            createdAt: '2024-01-01T00:00:00Z',
+            updatedAt: '2024-01-01T00:00:00Z',
+          },
+        });
+
+      const ctx = createContext({
+        deployedHarnesses: {
+          harnesses: {
+            harness_a: {
+              harnessId: 'h-1',
+              harnessArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-1',
+              roleArn: 'arn:aws:iam::123456789012:role/RoleA',
+              status: 'READY',
+            },
+            harness_b: {
+              harnessId: 'h-2',
+              harnessArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-2',
+              roleArn: 'arn:aws:iam::123456789012:role/RoleB',
+              status: 'READY',
+            },
+          },
+        },
+      });
+
+      const result = await deployer.teardown(ctx);
+
+      expect(result.success).toBe(true);
+      expect(result.state).toEqual({});
+      expect(mockedDeleteHarness).toHaveBeenCalledTimes(2);
+      expect(result.notes).toContain('Deleted harness "harness_a"');
+      expect(result.notes).toContain('Deleted harness "harness_b"');
+    });
+
+    it('returns error when delete fails during teardown', async () => {
+      mockedDeleteHarness.mockRejectedValueOnce(new Error('Access denied'));
+
+      const ctx = createContext({
+        deployedHarnesses: {
+          harnesses: {
+            bad_harness: {
+              harnessId: 'h-bad',
+              harnessArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:harness/h-bad',
+              roleArn: 'arn:aws:iam::123456789012:role/Role',
+              status: 'READY',
+            },
+          },
+        },
+      });
+
+      const result = await deployer.teardown(ctx);
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('Failed to delete harness "bad_harness"');
+    });
+
+    it('succeeds with empty state when no harnesses are deployed', async () => {
+      const ctx = createContext();
+
+      const result = await deployer.teardown(ctx);
+
+      expect(result.success).toBe(true);
+      expect(result.state).toEqual({});
+      expect(mockedDeleteHarness).not.toHaveBeenCalled();
+    });
+  });
+});
diff --git a/src/cli/operations/deploy/imperative/deployers/__tests__/harness-mapper-auth.test.ts b/src/cli/operations/deploy/imperative/deployers/__tests__/harness-mapper-auth.test.ts
new file mode 100644
index 000000000..ccbcfb70e
--- /dev/null
+++ b/src/cli/operations/deploy/imperative/deployers/__tests__/harness-mapper-auth.test.ts
@@ -0,0 +1,116 @@
+import type { HarnessSpec } from '../../../../../../schema';
+import { mapHarnessSpecToCreateOptions } from '../harness-mapper';
+import { stat } from 'fs/promises';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('fs/promises', () => ({
+  readFile: vi.fn(),
+  stat: vi.fn(),
+}));
+
+const mockedStat = vi.mocked(stat);
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  const enoent = Object.assign(new Error('ENOENT'), { code: 'ENOENT' });
+  mockedStat.mockRejectedValue(enoent);
+});
+
+function minimalSpec(overrides?: Partial<HarnessSpec>): HarnessSpec {
+  return {
+    name: 'test_harness',
+    model: { provider: 'bedrock', modelId: 'anthropic.claude-3-sonnet-20240229-v1:0' },
+    tools: [],
+    skills: [],
+    ...overrides,
+  };
+}
+
+const BASE_OPTIONS = {
+  harnessDir: '/project/agentcore/harnesses/test_harness',
+  executionRoleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+  region: 'us-east-1' as const,
+  projectName: 'myproject',
+};
+
+describe('mapHarnessSpecToCreateOptions - authorizer configuration', () => {
+  it('maps CUSTOM_JWT auth config with casing transform', async () => {
+    const spec = minimalSpec({
+      authorizerType: 'CUSTOM_JWT',
+      authorizerConfiguration: {
+        customJwtAuthorizer: {
+          discoveryUrl: 'https://cognito-idp.us-east-1.amazonaws.com/us-east-1_abc123/.well-known/openid-configuration',
+          allowedAudience: ['aud-1', 'aud-2'],
+          allowedClients: ['client-1'],
+          allowedScopes: ['openid', 'profile'],
+          customClaims: [
+            {
+              inboundTokenClaimName: 'department',
+              inboundTokenClaimValueType: 'STRING',
+              authorizingClaimMatchValue: {
+                claimMatchOperator: 'EQUALS',
+                claimMatchValue: { matchValueString: 'engineering' },
+              },
+            },
+          ],
+        },
+      },
+    });
+
+    const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+    expect(result.authorizerConfiguration).toEqual({
+      customJWTAuthorizer: {
+        discoveryUrl: 'https://cognito-idp.us-east-1.amazonaws.com/us-east-1_abc123/.well-known/openid-configuration',
+        allowedAudience: ['aud-1', 'aud-2'],
+        allowedClients: ['client-1'],
+        allowedScopes: ['openid', 'profile'],
+        customClaims: [
+          {
+            inboundTokenClaimName: 'department',
+            inboundTokenClaimValueType: 'STRING',
+            authorizingClaimMatchValue: {
+              claimMatchOperator: 'EQUALS',
+              claimMatchValue: { matchValueString: 'engineering' },
+            },
+          },
+        ],
+      },
+    });
+  });
+
+  it('omits authorizerConfiguration when not in spec', async () => {
+    const spec = minimalSpec();
+
+    const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+    expect(result.authorizerConfiguration).toBeUndefined();
+  });
+
+  it('includes only populated optional JWT fields', async () => {
+    const spec = minimalSpec({
+      authorizerType: 'CUSTOM_JWT',
+      authorizerConfiguration: {
+        customJwtAuthorizer: {
+          discoveryUrl: 'https://cognito-idp.us-east-1.amazonaws.com/us-east-1_abc123/.well-known/openid-configuration',
+          allowedAudience: ['aud-1'],
+        },
+      },
+    });
+
+    const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+    expect(result.authorizerConfiguration).toEqual({
+      customJWTAuthorizer: {
+        discoveryUrl: 'https://cognito-idp.us-east-1.amazonaws.com/us-east-1_abc123/.well-known/openid-configuration',
+        allowedAudience: ['aud-1'],
+      },
+    });
+
+    // Verify optional fields that were not provided are absent
+    const jwtConfig = result.authorizerConfiguration!.customJWTAuthorizer as Record<string, unknown>;
+    expect(jwtConfig).not.toHaveProperty('allowedClients');
+    expect(jwtConfig).not.toHaveProperty('allowedScopes');
+    expect(jwtConfig).not.toHaveProperty('customClaims');
+  });
+});
diff --git a/src/cli/operations/deploy/imperative/deployers/__tests__/harness-mapper.test.ts b/src/cli/operations/deploy/imperative/deployers/__tests__/harness-mapper.test.ts
new file mode 100644
index 000000000..8d5e033d9
--- /dev/null
+++ b/src/cli/operations/deploy/imperative/deployers/__tests__/harness-mapper.test.ts
@@ -0,0 +1,661 @@
+import type { DeployedResourceState, HarnessSpec } from '../../../../../../schema';
+import { mapHarnessSpecToCreateOptions } from '../harness-mapper';
+import { readFile, stat } from 'fs/promises';
+import { join } from 'path';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('fs/promises', () => ({
+  readFile: vi.fn(),
+  stat: vi.fn(),
+}));
+
+const mockedReadFile = vi.mocked(readFile);
+const mockedStat = vi.mocked(stat);
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  const enoent = Object.assign(new Error('ENOENT'), { code: 'ENOENT' });
+  mockedStat.mockRejectedValue(enoent);
+});
+
+function minimalSpec(overrides?: Partial<HarnessSpec>): HarnessSpec {
+  return {
+    name: 'test_harness',
+    model: { provider: 'bedrock', modelId: 'anthropic.claude-3-sonnet-20240229-v1:0' },
+    tools: [],
+    skills: [],
+    ...overrides,
+  };
+}
+
+const BASE_OPTIONS = {
+  harnessDir: '/project/agentcore/harnesses/test_harness',
+  executionRoleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+  region: 'us-east-1' as const,
+  projectName: 'myproject',
+};
+
+describe('mapHarnessSpecToCreateOptions', () => {
+  // ── Model mapping ──────────────────────────────────────────────────────
+
+  describe('model mapping', () => {
+    it('maps bedrock provider with temperature, topP, and maxTokens', async () => {
+      const spec = minimalSpec({
+        model: {
+          provider: 'bedrock',
+          modelId: 'anthropic.claude-3-sonnet-20240229-v1:0',
+          temperature: 0.7,
+          topP: 0.9,
+          maxTokens: 4096,
+        },
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.model).toEqual({
+        bedrockModelConfig: {
+          modelId: 'anthropic.claude-3-sonnet-20240229-v1:0',
+          temperature: 0.7,
+          topP: 0.9,
+          maxTokens: 4096,
+        },
+      });
+    });
+
+    it('maps open_ai provider with apiKeyArn', async () => {
+      const spec = minimalSpec({
+        model: {
+          provider: 'open_ai',
+          modelId: 'gpt-4o',
+          apiKeyArn: 'arn:aws:secretsmanager:us-east-1:123456789012:secret:openai-key',
+          temperature: 0.5,
+          topP: 0.8,
+          maxTokens: 2048,
+        },
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.model).toEqual({
+        openAiModelConfig: {
+          modelId: 'gpt-4o',
+          apiKeyArn: 'arn:aws:secretsmanager:us-east-1:123456789012:secret:openai-key',
+          temperature: 0.5,
+          topP: 0.8,
+          maxTokens: 2048,
+        },
+      });
+    });
+
+    it('maps gemini provider with topK', async () => {
+      const spec = minimalSpec({
+        model: {
+          provider: 'gemini',
+          modelId: 'gemini-1.5-pro',
+          apiKeyArn: 'arn:aws:secretsmanager:us-east-1:123456789012:secret:gemini-key',
+          topK: 0.4,
+          temperature: 0.3,
+        },
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.model).toEqual({
+        geminiModelConfig: {
+          modelId: 'gemini-1.5-pro',
+          apiKeyArn: 'arn:aws:secretsmanager:us-east-1:123456789012:secret:gemini-key',
+          topK: 0.4,
+          temperature: 0.3,
+        },
+      });
+    });
+  });
+
+  // ── System prompt mapping ──────────────────────────────────────────────
+
+  describe('system prompt mapping', () => {
+    it('reads system prompt from a file path starting with ./', async () => {
+      mockedStat.mockResolvedValueOnce({ size: 100 } as any);
+      mockedReadFile.mockResolvedValueOnce('You are a helpful assistant.');
+
+      const spec = minimalSpec({ systemPrompt: './prompt.md' });
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(mockedReadFile).toHaveBeenCalledWith(join(BASE_OPTIONS.harnessDir, './prompt.md'), 'utf-8');
+      expect(result.systemPrompt).toEqual([{ text: 'You are a helpful assistant.' }]);
+    });
+
+    it('reads system prompt from a file path starting with ../', async () => {
+      mockedStat.mockResolvedValueOnce({ size: 100 } as any);
+      mockedReadFile.mockResolvedValueOnce('Shared prompt content.');
+
+      const spec = minimalSpec({ systemPrompt: '../shared/prompt.txt' });
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(mockedReadFile).toHaveBeenCalledWith(join(BASE_OPTIONS.harnessDir, '../shared/prompt.txt'), 'utf-8');
+      expect(result.systemPrompt).toEqual([{ text: 'Shared prompt content.' }]);
+    });
+
+    it('rejects system prompt file exceeding 1 MB', async () => {
+      mockedStat.mockResolvedValueOnce({ size: 1024 * 1024 + 1 } as any);
+
+      const spec = minimalSpec({ systemPrompt: './huge-prompt.md' });
+
+      await expect(mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec })).rejects.toThrow('too large');
+    });
+
+    it('treats non-path strings as literal text', async () => {
+      const spec = minimalSpec({ systemPrompt: 'You are a research assistant.' });
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(mockedReadFile).not.toHaveBeenCalled();
+      expect(result.systemPrompt).toEqual([{ text: 'You are a research assistant.' }]);
+    });
+
+    it('omits system prompt when not specified', async () => {
+      const spec = minimalSpec();
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.systemPrompt).toBeUndefined();
+    });
+  });
+
+  // ── Tools mapping ──────────────────────────────────────────────────────
+
+  describe('tools mapping', () => {
+    it('passes tools through with type, name, and config', async () => {
+      const spec = minimalSpec({
+        tools: [
+          {
+            type: 'remote_mcp',
+            name: 'my_mcp_tool',
+            config: { remoteMcp: { url: 'https://mcp.example.com' } },
+          },
+          {
+            type: 'agentcore_browser',
+            name: 'browser_tool',
+          },
+        ],
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.tools).toEqual([
+        {
+          type: 'remote_mcp',
+          name: 'my_mcp_tool',
+          config: { remoteMcp: { url: 'https://mcp.example.com' } },
+        },
+        {
+          type: 'agentcore_browser',
+          name: 'browser_tool',
+        },
+      ]);
+    });
+
+    it('omits tools when array is empty', async () => {
+      const spec = minimalSpec({ tools: [] });
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.tools).toBeUndefined();
+    });
+
+    it('passes gateway tool with outboundAuth awsIam through the mapper', async () => {
+      const spec = minimalSpec({
+        tools: [
+          {
+            type: 'agentcore_gateway',
+            name: 'my_gw',
+            config: {
+              agentCoreGateway: {
+                gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc',
+                outboundAuth: { awsIam: {} },
+              },
+            },
+          },
+        ],
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.tools).toEqual([
+        {
+          type: 'agentcore_gateway',
+          name: 'my_gw',
+          config: {
+            agentCoreGateway: {
+              gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc',
+              outboundAuth: { awsIam: {} },
+            },
+          },
+        },
+      ]);
+    });
+
+    it('passes gateway tool with outboundAuth none through the mapper', async () => {
+      const spec = minimalSpec({
+        tools: [
+          {
+            type: 'agentcore_gateway',
+            name: 'my_gw',
+            config: {
+              agentCoreGateway: {
+                gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc',
+                outboundAuth: { none: {} },
+              },
+            },
+          },
+        ],
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.tools).toEqual([
+        {
+          type: 'agentcore_gateway',
+          name: 'my_gw',
+          config: {
+            agentCoreGateway: {
+              gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc',
+              outboundAuth: { none: {} },
+            },
+          },
+        },
+      ]);
+    });
+
+    it('passes gateway tool with outboundAuth oauth through the mapper', async () => {
+      const spec = minimalSpec({
+        tools: [
+          {
+            type: 'agentcore_gateway',
+            name: 'my_gw',
+            config: {
+              agentCoreGateway: {
+                gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc',
+                outboundAuth: {
+                  oauth: {
+                    providerArn:
+                      'arn:aws:bedrock-agentcore:us-west-2:123:token-vault/default/oauth2credentialprovider/my-provider',
+                    scopes: ['read', 'write'],
+                    grantType: 'CLIENT_CREDENTIALS',
+                  },
+                },
+              },
+            },
+          },
+        ],
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.tools).toEqual([
+        {
+          type: 'agentcore_gateway',
+          name: 'my_gw',
+          config: {
+            agentCoreGateway: {
+              gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc',
+              outboundAuth: {
+                oauth: {
+                  providerArn:
+                    'arn:aws:bedrock-agentcore:us-west-2:123:token-vault/default/oauth2credentialprovider/my-provider',
+                  scopes: ['read', 'write'],
+                  grantType: 'CLIENT_CREDENTIALS',
+                },
+              },
+            },
+          },
+        },
+      ]);
+    });
+
+    it('passes gateway tool without outboundAuth through the mapper', async () => {
+      const spec = minimalSpec({
+        tools: [
+          {
+            type: 'agentcore_gateway',
+            name: 'my_gw',
+            config: {
+              agentCoreGateway: {
+                gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc',
+              },
+            },
+          },
+        ],
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.tools).toEqual([
+        {
+          type: 'agentcore_gateway',
+          name: 'my_gw',
+          config: {
+            agentCoreGateway: {
+              gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc',
+            },
+          },
+        },
+      ]);
+    });
+  });
+
+  // ── Skills mapping ─────────────────────────────────────────────────────
+
+  describe('skills mapping', () => {
+    it('maps string array to { path } objects', async () => {
+      const spec = minimalSpec({ skills: ['research', 'summarize'] });
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.skills).toEqual([{ path: 'research' }, { path: 'summarize' }]);
+    });
+
+    it('omits skills when array is empty', async () => {
+      const spec = minimalSpec({ skills: [] });
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.skills).toBeUndefined();
+    });
+  });
+
+  // ── Memory mapping ─────────────────────────────────────────────────────
+
+  describe('memory mapping', () => {
+    it('resolves memory by name from deployed state', async () => {
+      const deployedResources: DeployedResourceState = {
+        memories: {
+          my_memory: {
+            memoryId: 'mem-123',
+            memoryArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:memory/mem-123',
+          },
+        },
+      };
+
+      const spec = minimalSpec({ memory: { name: 'my_memory' } });
+      const result = await mapHarnessSpecToCreateOptions({
+        ...BASE_OPTIONS,
+        harnessSpec: spec,
+        deployedResources,
+      });
+
+      expect(result.memory).toEqual({
+        memoryArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:memory/mem-123',
+      });
+    });
+
+    it('uses ARN directly when provided', async () => {
+      const spec = minimalSpec({
+        memory: { arn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:memory/custom-mem' },
+      });
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.memory).toEqual({
+        memoryArn: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:memory/custom-mem',
+      });
+    });
+
+    it('throws when memory name is not found in deployed state', async () => {
+      const spec = minimalSpec({ memory: { name: 'nonexistent' } });
+
+      await expect(mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec })).rejects.toThrow(
+        'Memory "nonexistent" referenced by harness is not in deployed state'
+      );
+    });
+  });
+
+  // ── Truncation mapping ─────────────────────────────────────────────────
+
+  describe('truncation mapping', () => {
+    it('passes through truncation configuration', async () => {
+      const spec = minimalSpec({
+        truncation: {
+          strategy: 'sliding_window',
+          config: { slidingWindow: { messagesCount: 20 } },
+        },
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.truncation).toEqual({
+        strategy: 'sliding_window',
+        config: { slidingWindow: { messagesCount: 20 } },
+      });
+    });
+  });
+
+  // ── Container URI mapping ──────────────────────────────────────────────
+
+  describe('container URI mapping', () => {
+    it('maps containerUri to environmentArtifact', async () => {
+      const spec = minimalSpec({
+        containerUri: '123456789012.dkr.ecr.us-east-1.amazonaws.com/my-harness:latest',
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.environmentArtifact).toEqual({
+        containerConfiguration: {
+          containerUri: '123456789012.dkr.ecr.us-east-1.amazonaws.com/my-harness:latest',
+        },
+      });
+    });
+
+    it('resolves containerUri from CDK outputs when dockerfile is set', async () => {
+      const spec = minimalSpec({ dockerfile: 'Dockerfile' });
+      const cdkOutputs = {
+        HarnessTestHarnessContainerUriOutputABC123: '123456789012.dkr.ecr.us-east-1.amazonaws.com/harness-test:abc',
+      };
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec, cdkOutputs });
+
+      expect(result.environmentArtifact).toEqual({
+        containerConfiguration: {
+          containerUri: '123456789012.dkr.ecr.us-east-1.amazonaws.com/harness-test:abc',
+        },
+      });
+    });
+
+    it('resolves containerUri from new AgentCoreHarnessEnvironment output key', async () => {
+      const spec = minimalSpec({ dockerfile: 'Dockerfile' });
+      const cdkOutputs = {
+        ApplicationHarnessTestHarnessImageUriOutputABC123:
+          '123456789012.dkr.ecr.us-east-1.amazonaws.com/harness-test:new',
+      };
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec, cdkOutputs });
+
+      expect(result.environmentArtifact).toEqual({
+        containerConfiguration: {
+          containerUri: '123456789012.dkr.ecr.us-east-1.amazonaws.com/harness-test:new',
+        },
+      });
+    });
+
+    it('prefers new ImageUri key over old ContainerUri key when both are present', async () => {
+      const spec = minimalSpec({ dockerfile: 'Dockerfile' });
+      const cdkOutputs = {
+        ApplicationHarnessTestHarnessImageUriOutputABC123:
+          '123456789012.dkr.ecr.us-east-1.amazonaws.com/harness-test:new',
+        HarnessTestHarnessContainerUriOutputDEF456: '123456789012.dkr.ecr.us-east-1.amazonaws.com/harness-test:old',
+      };
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec, cdkOutputs });
+
+      expect(result.environmentArtifact).toEqual({
+        containerConfiguration: {
+          containerUri: '123456789012.dkr.ecr.us-east-1.amazonaws.com/harness-test:new',
+        },
+      });
+    });
+
+    it('throws when dockerfile is set but no container URI found in CDK outputs', async () => {
+      const spec = minimalSpec({ dockerfile: 'Dockerfile' });
+
+      await expect(
+        mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec, cdkOutputs: {} })
+      ).rejects.toThrow('no container URI was found in CDK outputs');
+    });
+
+    it('prefers explicit containerUri over dockerfile', async () => {
+      const spec = minimalSpec({
+        containerUri: '123456789012.dkr.ecr.us-east-1.amazonaws.com/explicit:latest',
+        dockerfile: undefined,
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.environmentArtifact).toEqual({
+        containerConfiguration: {
+          containerUri: '123456789012.dkr.ecr.us-east-1.amazonaws.com/explicit:latest',
+        },
+      });
+    });
+  });
+
+  // ── Network/Lifecycle mapping ──────────────────────────────────────────
+
+  describe('environment provider mapping', () => {
+    it('maps networkConfig to environment.agentCoreRuntimeEnvironment.networkConfiguration', async () => {
+      const spec = minimalSpec({
+        networkMode: 'VPC',
+        networkConfig: {
+          subnets: ['subnet-12345678'],
+          securityGroups: ['sg-12345678'],
+        },
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.environment).toEqual({
+        agentCoreRuntimeEnvironment: {
+          networkConfiguration: {
+            networkMode: 'VPC',
+            networkModeConfig: {
+              subnets: ['subnet-12345678'],
+              securityGroups: ['sg-12345678'],
+            },
+          },
+        },
+      });
+    });
+
+    it('maps lifecycleConfig to environment.agentCoreRuntimeEnvironment.lifecycleConfiguration', async () => {
+      const spec = minimalSpec({
+        lifecycleConfig: {
+          idleRuntimeSessionTimeout: 900,
+          maxLifetime: 28800,
+        },
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.environment).toEqual({
+        agentCoreRuntimeEnvironment: {
+          lifecycleConfiguration: {
+            idleRuntimeSessionTimeout: 900,
+            maxLifetime: 28800,
+          },
+        },
+      });
+    });
+
+    it('combines network and lifecycle in the same environment provider', async () => {
+      const spec = minimalSpec({
+        networkMode: 'VPC',
+        networkConfig: {
+          subnets: ['subnet-12345678'],
+          securityGroups: ['sg-12345678'],
+        },
+        lifecycleConfig: {
+          idleRuntimeSessionTimeout: 600,
+        },
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.environment).toEqual({
+        agentCoreRuntimeEnvironment: {
+          networkConfiguration: {
+            networkMode: 'VPC',
+            networkModeConfig: {
+              subnets: ['subnet-12345678'],
+              securityGroups: ['sg-12345678'],
+            },
+          },
+          lifecycleConfiguration: {
+            idleRuntimeSessionTimeout: 600,
+          },
+        },
+      });
+    });
+
+    it('omits environment when neither network nor lifecycle is present', async () => {
+      const spec = minimalSpec();
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.environment).toBeUndefined();
+    });
+  });
+
+  // ── Pass-through fields ────────────────────────────────────────────────
+
+  describe('pass-through fields', () => {
+    it('includes execution limits', async () => {
+      const spec = minimalSpec({
+        maxIterations: 10,
+        maxTokens: 8192,
+        timeoutSeconds: 300,
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.maxIterations).toBe(10);
+      expect(result.maxTokens).toBe(8192);
+      expect(result.timeoutSeconds).toBe(300);
+    });
+
+    it('includes environment variables', async () => {
+      const spec = minimalSpec({
+        environmentVariables: { API_KEY: 'secret', DEBUG: 'true' },
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.environmentVariables).toEqual({ API_KEY: 'secret', DEBUG: 'true' });
+    });
+
+    it('includes tags', async () => {
+      const spec = minimalSpec({
+        tags: { team: 'platform', env: 'prod' },
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.tags).toEqual({ team: 'platform', env: 'prod' });
+    });
+
+    it('includes allowedTools', async () => {
+      const spec = minimalSpec({
+        allowedTools: ['*', 'my_tool'],
+      });
+
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.allowedTools).toEqual(['*', 'my_tool']);
+    });
+  });
+
+  // ── Core fields ────────────────────────────────────────────────────────
+
+  describe('core fields', () => {
+    it('sets region, harnessName, and executionRoleArn', async () => {
+      const spec = minimalSpec();
+      const result = await mapHarnessSpecToCreateOptions({ ...BASE_OPTIONS, harnessSpec: spec });
+
+      expect(result.region).toBe('us-east-1');
+      expect(result.harnessName).toBe('myproject_test_harness');
+      expect(result.executionRoleArn).toBe('arn:aws:iam::123456789012:role/HarnessRole');
+    });
+  });
+});
diff --git a/src/cli/operations/deploy/imperative/deployers/harness-deployer.ts b/src/cli/operations/deploy/imperative/deployers/harness-deployer.ts
new file mode 100644
index 000000000..3f000e5d0
--- /dev/null
+++ b/src/cli/operations/deploy/imperative/deployers/harness-deployer.ts
@@ -0,0 +1,359 @@
+/**
+ * HarnessDeployer - Post-CDK imperative deployer for Harness resources.
+ *
+ * Runs after CDK deploy to create, update, or delete harness resources
+ * via the SigV4 API client. Harness role ARNs are resolved from CDK
+ * stack outputs, and harness specs are read from disk (harness.json).
+ */
+import type { HarnessDeployedState, HarnessSpec } from '../../../../../schema';
+import { HarnessSpecSchema } from '../../../../../schema';
+import type {
+  CreateHarnessResult,
+  Harness,
+  UpdateHarnessOptions,
+  UpdateHarnessResult,
+} from '../../../../aws/agentcore-harness';
+import { createHarness, deleteHarness, getHarness, updateHarness } from '../../../../aws/agentcore-harness';
+import { AgentCoreApiError } from '../../../../aws/api-client';
+import { toPascalId } from '../../../../cloudformation/logical-ids';
+import type { DeployPhase, ImperativeDeployContext, ImperativeDeployResult, ImperativeDeployer } from '../types';
+import { mapHarnessSpecToCreateOptions } from './harness-mapper';
+import { readFile } from 'fs/promises';
+import { createHash } from 'node:crypto';
+import { dirname, join } from 'path';
+
+const ROLE_VALIDATION_RETRY_DELAYS_MS = [5_000, 10_000, 15_000, 20_000, 30_000];
+const READY_POLL_INTERVAL_MS = 3_000;
+const READY_POLL_MAX_ATTEMPTS = 40; // 2 minutes max
+
+// ============================================================================
+// Types
+// ============================================================================
+
+type HarnessDeployedStateMap = Record<string, HarnessDeployedState>;
+
+async function computeHarnessHash(harnessDir: string, harnessSpec: HarnessSpec, roleArn: string): Promise<string> {
+  const hash = createHash('sha256');
+  hash.update(JSON.stringify(harnessSpec));
+  hash.update(roleArn);
+  try {
+    const promptContent = await readFile(join(harnessDir, 'system-prompt.md'), 'utf-8');
+    hash.update(promptContent);
+  } catch {
+    // no system-prompt.md
+  }
+  if (harnessSpec.dockerfile) {
+    try {
+      const dockerfileContent = await readFile(join(harnessDir, harnessSpec.dockerfile), 'utf-8');
+      hash.update(dockerfileContent);
+    } catch {
+      // Dockerfile missing — preflight already validates existence before deploy
+    }
+  }
+  return hash.digest('hex').slice(0, 16);
+}
+
+// ============================================================================
+// Deployer
+// ============================================================================
+
+export class HarnessDeployer implements ImperativeDeployer<HarnessDeployedStateMap> {
+  readonly name = 'harness';
+  readonly label = 'Harnesses';
+  readonly phase: DeployPhase = 'post-cdk';
+
+  shouldRun(context: ImperativeDeployContext): boolean {
+    const projectHarnesses = context.projectSpec.harnesses;
+    const hasProjectHarnesses = !!projectHarnesses && projectHarnesses.length > 0;
+
+    const targetName = context.target.name;
+    const deployedHarnesses = context.deployedState.targets?.[targetName]?.resources?.harnesses;
+    const hasDeployedHarnesses = !!deployedHarnesses && Object.keys(deployedHarnesses).length > 0;
+
+    return hasProjectHarnesses || hasDeployedHarnesses;
+  }
+
+  async deploy(context: ImperativeDeployContext): Promise<ImperativeDeployResult<HarnessDeployedStateMap>> {
+    const { projectSpec, target, configIO, deployedState, cdkOutputs } = context;
+    const region = target.region;
+    const targetName = target.name;
+    const projectName = projectSpec.name;
+    const configRoot = configIO.getConfigRoot();
+    const projectRoot = dirname(configRoot);
+
+    const projectHarnesses = projectSpec.harnesses ?? [];
+    const deployedHarnesses = deployedState.targets?.[targetName]?.resources?.harnesses ?? {};
+    const resultState: HarnessDeployedStateMap = { ...deployedHarnesses };
+    const notes: string[] = [];
+
+    // Build set of harness names in current project spec
+    const projectHarnessNames = new Set(projectHarnesses.map(h => h.name));
+
+    // Create or update each harness in the project spec
+    for (const entry of projectHarnesses) {
+      // Harness path is relative to project root (like agent codeLocation)
+      const harnessDir = join(projectRoot, entry.path);
+
+      // Read harness.json from disk and validate
+      let harnessSpec: HarnessSpec;
+      try {
+        const raw = await readFile(join(harnessDir, 'harness.json'), 'utf-8');
+        const parsed: unknown = JSON.parse(raw);
+        const validated = HarnessSpecSchema.safeParse(parsed);
+        if (!validated.success) {
+          return {
+            success: false,
+            error: `Invalid harness.json for "${entry.name}": ${validated.error.message}`,
+            state: resultState,
+          };
+        }
+        harnessSpec = validated.data;
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+          success: false,
+          error: `Failed to read harness.json for "${entry.name}": ${message}`,
+          state: resultState,
+        };
+      }
+
+      // Resolve role ARN from CDK outputs
+      const roleArn = resolveRoleArn(entry.name, cdkOutputs);
+      if (!roleArn) {
+        return {
+          success: false,
+          error: `Could not find role ARN in CDK outputs for harness "${entry.name}". Expected output key starting with "ApplicationHarness${toPascalId(entry.name)}RoleArn" or "ApplicationHarness${toPascalId(entry.name)}RoleRoleArn".`,
+          state: resultState,
+        };
+      }
+
+      // Use executionRoleArn from harness spec if provided, otherwise use CDK output
+      const executionRoleArn = harnessSpec.executionRoleArn ?? roleArn;
+
+      const deployedResources = deployedState.targets?.[targetName]?.resources;
+      const existingHarness = deployedHarnesses[entry.name];
+
+      const configHash = await computeHarnessHash(harnessDir, harnessSpec, executionRoleArn);
+
+      if (existingHarness?.configHash === configHash) {
+        resultState[entry.name] = existingHarness;
+        notes.push(`Harness "${entry.name}" unchanged, skipped`);
+        context.onProgress?.(`Harness "${entry.name}": no changes`, 'done');
+        continue;
+      }
+
+      try {
+        if (existingHarness) {
+          // Update existing harness
+          const createOptions = await mapHarnessSpecToCreateOptions({
+            harnessSpec,
+            harnessDir,
+            executionRoleArn,
+            region,
+            projectName,
+            deployedResources,
+            cdkOutputs,
+          });
+
+          // Memory uses { optionalValue: null } to explicitly clear it when removed from config,
+          // since the API treats an absent field as "no change" but null as "remove".
+          // environmentArtifact uses undefined (omit) because container config is immutable
+          // after creation — it cannot be cleared via update, only set on create.
+          const updateOptions: UpdateHarnessOptions = {
+            region,
+            harnessId: existingHarness.harnessId,
+            executionRoleArn: createOptions.executionRoleArn,
+            model: createOptions.model,
+            systemPrompt: createOptions.systemPrompt,
+            tools: createOptions.tools,
+            skills: createOptions.skills,
+            allowedTools: createOptions.allowedTools,
+            memory: createOptions.memory ? { optionalValue: createOptions.memory } : { optionalValue: null },
+            truncation: createOptions.truncation,
+            maxIterations: createOptions.maxIterations,
+            maxTokens: createOptions.maxTokens,
+            timeoutSeconds: createOptions.timeoutSeconds,
+            environment: createOptions.environment,
+            environmentArtifact: createOptions.environmentArtifact
+              ? { optionalValue: createOptions.environmentArtifact }
+              : undefined,
+            environmentVariables: createOptions.environmentVariables,
+            tags: createOptions.tags,
+            authorizerConfiguration: createOptions.authorizerConfiguration
+              ? { optionalValue: createOptions.authorizerConfiguration }
+              : { optionalValue: null },
+          };
+
+          const updateResult: UpdateHarnessResult = await updateHarness(updateOptions);
+          const finalHarness = await waitForReady(region, updateResult.harness);
+          resultState[entry.name] = {
+            harnessId: finalHarness.harnessId,
+            harnessArn: finalHarness.arn,
+            roleArn: executionRoleArn,
+            status: finalHarness.status,
+            agentRuntimeArn: extractRuntimeArn(finalHarness),
+            memoryArn: createOptions.memory?.memoryArn,
+            configHash,
+          };
+          notes.push(`Updated harness "${entry.name}"`);
+        } else {
+          // Create new harness (with retry for IAM role propagation delay)
+          const createOptions = await mapHarnessSpecToCreateOptions({
+            harnessSpec,
+            harnessDir,
+            executionRoleArn,
+            region,
+            projectName,
+            deployedResources,
+            cdkOutputs,
+          });
+
+          const createResult: CreateHarnessResult = await createWithRetry(createOptions);
+          const finalHarness = await waitForReady(region, createResult.harness);
+          resultState[entry.name] = {
+            harnessId: finalHarness.harnessId,
+            harnessArn: finalHarness.arn,
+            roleArn: executionRoleArn,
+            status: finalHarness.status,
+            agentRuntimeArn: extractRuntimeArn(finalHarness),
+            memoryArn: createOptions.memory?.memoryArn,
+            configHash,
+          };
+          notes.push(`Created harness "${entry.name}"`);
+        }
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const hint = getDeployErrorHint(err, region);
+        const errorMsg = hint
+          ? `Failed to deploy harness "${entry.name}": ${message}\n${hint}`
+          : `Failed to deploy harness "${entry.name}": ${message}`;
+        return { success: false, error: errorMsg, state: resultState };
+      }
+    }
+
+    // Delete harnesses that exist in deployed state but not in project spec
+    for (const [name, state] of Object.entries(deployedHarnesses)) {
+      if (!projectHarnessNames.has(name)) {
+        try {
+          await deleteHarness({ region, harnessId: state.harnessId });
+          delete resultState[name];
+          notes.push(`Deleted harness "${name}"`);
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          return { success: false, error: `Failed to delete harness "${name}": ${message}`, state: resultState };
+        }
+      }
+    }
+
+    return { success: true, state: resultState, notes };
+  }
+
+  async teardown(context: ImperativeDeployContext): Promise<ImperativeDeployResult<HarnessDeployedStateMap>> {
+    const { target, deployedState } = context;
+    const region = target.region;
+    const targetName = target.name;
+
+    const deployedHarnesses = deployedState.targets?.[targetName]?.resources?.harnesses ?? {};
+    const notes: string[] = [];
+
+    for (const [name, state] of Object.entries(deployedHarnesses)) {
+      try {
+        await deleteHarness({ region, harnessId: state.harnessId });
+        notes.push(`Deleted harness "${name}"`);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { success: false, error: `Failed to delete harness "${name}": ${message}` };
+      }
+    }
+
+    return { success: true, state: {}, notes };
+  }
+}
+
+// ============================================================================
+// Helpers
+// ============================================================================
+
+/**
+ * Resolve the IAM role ARN for a harness from CDK stack outputs.
+ *
+ * Supports two construct tree layouts:
+ *   Old (AgentCoreHarnessRole directly under Application):
+ *     ApplicationHarness{PascalName}RoleArnOutput...
+ *   New (AgentCoreHarnessEnvironment wrapping AgentCoreHarnessRole):
+ *     ApplicationHarness{PascalName}RoleRoleArnOutput...
+ */
+function resolveRoleArn(harnessName: string, cdkOutputs?: Record<string, string>): string | undefined {
+  if (!cdkOutputs) return undefined;
+
+  const pascalName = toPascalId(harnessName);
+  // Longer prefix first — RoleArn is a substring of RoleRoleArn, so checking it first would match both.
+  const prefixes = [`ApplicationHarness${pascalName}RoleRoleArn`, `ApplicationHarness${pascalName}RoleArn`];
+
+  for (const [key, value] of Object.entries(cdkOutputs)) {
+    if (prefixes.some(p => key.startsWith(p))) {
+      return value;
+    }
+  }
+
+  return undefined;
+}
+
+function isRoleValidationError(err: unknown): boolean {
+  return err instanceof AgentCoreApiError && err.statusCode === 400 && err.errorBody.includes('Role validation failed');
+}
+
+async function createWithRetry(options: Parameters<typeof createHarness>[0]): Promise<CreateHarnessResult> {
+  let lastError: unknown;
+  for (let attempt = 0; attempt <= ROLE_VALIDATION_RETRY_DELAYS_MS.length; attempt++) {
+    try {
+      return await createHarness(options);
+    } catch (err) {
+      if (!isRoleValidationError(err) || attempt === ROLE_VALIDATION_RETRY_DELAYS_MS.length) {
+        throw err;
+      }
+      lastError = err;
+      await sleep(ROLE_VALIDATION_RETRY_DELAYS_MS[attempt]!);
+    }
+  }
+  throw lastError;
+}
+
+async function waitForReady(region: string, harness: Harness): Promise<Harness> {
+  if (harness.status === 'READY' || harness.status === 'FAILED') return harness;
+
+  for (let i = 0; i < READY_POLL_MAX_ATTEMPTS; i++) {
+    await sleep(READY_POLL_INTERVAL_MS);
+    const result = await getHarness({ region, harnessId: harness.harnessId });
+    if (result.harness.status === 'READY' || result.harness.status === 'FAILED') return result.harness;
+  }
+
+  return harness;
+}
+
+function extractRuntimeArn(harness: Harness): string | undefined {
+  return harness.environment?.agentCoreRuntimeEnvironment?.agentRuntimeArn;
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+function getDeployErrorHint(err: unknown, region: string): string | undefined {
+  if (!(err instanceof AgentCoreApiError)) return undefined;
+  const body = err.errorBody.toLowerCase();
+
+  if (err.statusCode === 403) {
+    return 'Check that your AWS credentials have permission to call the AgentCore Harness API.';
+  }
+  if (body.includes('not available') || body.includes('not supported') || body.includes('endpoint')) {
+    return `Harness may not be available in ${region}. Try a different region (e.g., us-east-1, us-west-2).`;
+  }
+  if (err.statusCode === 429) {
+    return 'Too many requests. Wait a moment and try again.';
+  }
+  if (err.statusCode >= 500) {
+    return 'This looks like a service-side issue. Wait a moment and redeploy.';
+  }
+  return undefined;
+}
diff --git a/src/cli/operations/deploy/imperative/deployers/harness-mapper.ts b/src/cli/operations/deploy/imperative/deployers/harness-mapper.ts
new file mode 100644
index 000000000..e1321914d
--- /dev/null
+++ b/src/cli/operations/deploy/imperative/deployers/harness-mapper.ts
@@ -0,0 +1,403 @@
+/**
+ * Maps user-facing HarnessSpec (harness.json) to the CreateHarness API wire format.
+ *
+ * Each transformation is a pure function that converts a section of the spec
+ * into the corresponding API field. The top-level mapHarnessSpecToCreateOptions
+ * orchestrates them and returns a complete CreateHarnessOptions object.
+ */
+import type { DeployedResourceState, HarnessSpec } from '../../../../../schema';
+import type {
+  CreateHarnessOptions,
+  HarnessEnvironmentArtifact,
+  HarnessEnvironmentProvider,
+  HarnessMemoryConfiguration,
+  HarnessModelConfiguration,
+  HarnessSkill,
+  HarnessSystemPrompt,
+  HarnessTool,
+  HarnessTruncationConfiguration,
+} from '../../../../aws/agentcore-harness';
+import { toPascalId } from '../../../../cloudformation/logical-ids';
+import { readFile, stat } from 'fs/promises';
+import { join } from 'path';
+
+const MAX_PROMPT_FILE_SIZE = 1024 * 1024; // 1 MB
+
+// ============================================================================
+// Public Interface
+// ============================================================================
+
+export interface MapHarnessOptions {
+  harnessSpec: HarnessSpec;
+  harnessDir: string;
+  executionRoleArn: string;
+  region: string;
+  projectName: string;
+  deployedResources?: DeployedResourceState;
+  cdkOutputs?: Record<string, string>;
+}
+
+/**
+ * Transform a HarnessSpec into CreateHarnessOptions for the control plane API.
+ */
+export async function mapHarnessSpecToCreateOptions(options: MapHarnessOptions): Promise<CreateHarnessOptions> {
+  const { harnessSpec, harnessDir, executionRoleArn, region, projectName, deployedResources, cdkOutputs } = options;
+
+  const result: CreateHarnessOptions = {
+    region,
+    harnessName: `${projectName}_${harnessSpec.name}`,
+    executionRoleArn,
+  };
+
+  // Model
+  result.model = mapModel(harnessSpec.model);
+
+  // System prompt (may read from disk or auto-discover system-prompt.md)
+  if (harnessSpec.systemPrompt !== undefined) {
+    result.systemPrompt = await mapSystemPrompt(harnessSpec.systemPrompt, harnessDir);
+  } else {
+    // Auto-discover system-prompt.md if it exists
+    result.systemPrompt = await tryLoadSystemPromptFile(harnessDir);
+  }
+
+  // Tools
+  if (harnessSpec.tools.length > 0) {
+    result.tools = mapTools(harnessSpec.tools);
+  }
+
+  // Skills
+  if (harnessSpec.skills.length > 0) {
+    result.skills = mapSkills(harnessSpec.skills);
+  }
+
+  // Allowed tools
+  if (harnessSpec.allowedTools) {
+    result.allowedTools = harnessSpec.allowedTools;
+  }
+
+  // Memory
+  if (harnessSpec.memory) {
+    result.memory = mapMemory(harnessSpec.memory, deployedResources, cdkOutputs);
+  }
+
+  // Truncation
+  if (harnessSpec.truncation) {
+    result.truncation = mapTruncation(harnessSpec.truncation);
+  }
+
+  // Execution limits
+  if (harnessSpec.maxIterations !== undefined) {
+    result.maxIterations = harnessSpec.maxIterations;
+  }
+  if (harnessSpec.maxTokens !== undefined) {
+    result.maxTokens = harnessSpec.maxTokens;
+  }
+  if (harnessSpec.timeoutSeconds !== undefined) {
+    result.timeoutSeconds = harnessSpec.timeoutSeconds;
+  }
+
+  // Container artifact
+  if (harnessSpec.containerUri) {
+    result.environmentArtifact = mapEnvironmentArtifact(harnessSpec.containerUri);
+  } else if (harnessSpec.dockerfile) {
+    const builtUri = resolveContainerUriFromOutputs(harnessSpec.name, cdkOutputs);
+    if (!builtUri) {
+      throw new Error(
+        `Harness "${harnessSpec.name}" specifies "dockerfile" but no container URI was found in CDK outputs. ` +
+          `Expected a CDK output key starting with "ApplicationHarness${toPascalId(harnessSpec.name)}ImageUri" or "Harness${toPascalId(harnessSpec.name)}ContainerUri".`
+      );
+    }
+    result.environmentArtifact = mapEnvironmentArtifact(builtUri);
+  }
+
+  // Environment provider (network + lifecycle)
+  const environmentProvider = mapEnvironmentProvider(harnessSpec);
+  if (environmentProvider) {
+    result.environment = environmentProvider;
+  }
+
+  // Environment variables
+  if (harnessSpec.environmentVariables) {
+    result.environmentVariables = harnessSpec.environmentVariables;
+  }
+
+  // Tags
+  if (harnessSpec.tags) {
+    result.tags = harnessSpec.tags;
+  }
+
+  // Authorizer configuration — authorizerType is inferred by the API from the
+  // presence of authorizerConfiguration, so only the configuration is forwarded.
+  if (harnessSpec.authorizerConfiguration?.customJwtAuthorizer) {
+    const jwt = harnessSpec.authorizerConfiguration.customJwtAuthorizer;
+    result.authorizerConfiguration = {
+      customJWTAuthorizer: {
+        discoveryUrl: jwt.discoveryUrl,
+        ...(jwt.allowedAudience && { allowedAudience: jwt.allowedAudience }),
+        ...(jwt.allowedClients && { allowedClients: jwt.allowedClients }),
+        ...(jwt.allowedScopes && { allowedScopes: jwt.allowedScopes }),
+        ...(jwt.customClaims && { customClaims: jwt.customClaims }),
+      },
+    };
+  }
+
+  return result;
+}
+
+// ============================================================================
+// Model Mapping
+// ============================================================================
+
+function mapModel(model: HarnessSpec['model']): HarnessModelConfiguration {
+  const { provider, modelId, apiKeyArn, temperature, topP, topK, maxTokens } = model;
+
+  switch (provider) {
+    case 'bedrock':
+      return {
+        bedrockModelConfig: {
+          modelId,
+          ...(temperature !== undefined && { temperature }),
+          ...(topP !== undefined && { topP }),
+          ...(maxTokens !== undefined && { maxTokens }),
+        },
+      };
+    case 'open_ai':
+      return {
+        openAiModelConfig: {
+          modelId,
+          ...(apiKeyArn && { apiKeyArn }),
+          ...(temperature !== undefined && { temperature }),
+          ...(topP !== undefined && { topP }),
+          ...(maxTokens !== undefined && { maxTokens }),
+        },
+      };
+    case 'gemini':
+      return {
+        geminiModelConfig: {
+          modelId,
+          ...(apiKeyArn && { apiKeyArn }),
+          ...(temperature !== undefined && { temperature }),
+          ...(topP !== undefined && { topP }),
+          ...(topK !== undefined && { topK }),
+          ...(maxTokens !== undefined && { maxTokens }),
+        },
+      };
+  }
+}
+
+// ============================================================================
+// System Prompt Mapping
+// ============================================================================
+
+const FILE_PATH_PATTERN = /^\.\.?\//;
+const FILE_EXTENSION_PATTERN = /\.(md|txt)$/;
+
+function isFilePath(value: string): boolean {
+  return FILE_PATH_PATTERN.test(value) || FILE_EXTENSION_PATTERN.test(value);
+}
+
+async function mapSystemPrompt(prompt: string, harnessDir: string): Promise<HarnessSystemPrompt> {
+  let text: string;
+
+  if (isFilePath(prompt)) {
+    const filePath = join(harnessDir, prompt);
+    const fileStats = await stat(filePath);
+    if (fileStats.size > MAX_PROMPT_FILE_SIZE) {
+      throw new Error(
+        `System prompt file "${prompt}" is too large (${fileStats.size} bytes). Maximum size is ${MAX_PROMPT_FILE_SIZE} bytes.`
+      );
+    }
+    text = await readFile(filePath, 'utf-8');
+  } else {
+    text = prompt;
+  }
+
+  return [{ text }];
+}
+
+/**
+ * Try to load system-prompt.md from harness directory.
+ * Returns undefined if file doesn't exist (harness will have no system prompt).
+ */
+async function tryLoadSystemPromptFile(harnessDir: string): Promise<HarnessSystemPrompt | undefined> {
+  const promptPath = join(harnessDir, 'system-prompt.md');
+
+  try {
+    const fileStats = await stat(promptPath);
+    if (fileStats.size > MAX_PROMPT_FILE_SIZE) {
+      throw new Error(
+        `System prompt file "system-prompt.md" is too large (${fileStats.size} bytes). Maximum size is ${MAX_PROMPT_FILE_SIZE} bytes.`
+      );
+    }
+    const text = await readFile(promptPath, 'utf-8');
+    return [{ text }];
+  } catch (err) {
+    // File doesn't exist - return undefined (no system prompt)
+    if ((err as NodeJS.ErrnoException).code === 'ENOENT') {
+      return undefined;
+    }
+    // Other errors (permissions, etc.) should be thrown
+    throw err;
+  }
+}
+
+// ============================================================================
+// Tools Mapping
+// ============================================================================
+
+function mapTools(tools: HarnessSpec['tools']): HarnessTool[] {
+  return tools.map(tool => ({
+    type: tool.type,
+    name: tool.name,
+    ...(tool.config && { config: tool.config as unknown as Record<string, unknown> }),
+  }));
+}
+
+// ============================================================================
+// Skills Mapping
+// ============================================================================
+
+function mapSkills(skills: string[]): HarnessSkill[] {
+  return skills.map(path => ({ path }));
+}
+
+// ============================================================================
+// Memory Mapping
+// ============================================================================
+
+function mapMemory(
+  memory: NonNullable<HarnessSpec['memory']>,
+  deployedResources?: DeployedResourceState,
+  cdkOutputs?: Record<string, string>
+): HarnessMemoryConfiguration | undefined {
+  // Direct ARN takes precedence
+  if (memory.arn) {
+    return { memoryArn: memory.arn };
+  }
+
+  // Resolve by name from deployed state or CDK outputs
+  if (memory.name) {
+    // Try deployed state first
+    const deployedMemory = deployedResources?.memories?.[memory.name];
+    if (deployedMemory) {
+      return { memoryArn: deployedMemory.memoryArn };
+    }
+
+    // Fall back to CDK outputs
+    if (cdkOutputs) {
+      const memoryArn = resolveMemoryArnFromOutputs(memory.name, cdkOutputs);
+      if (memoryArn) {
+        return { memoryArn };
+      }
+    }
+
+    throw new Error(
+      `Memory "${memory.name}" referenced by harness is not in deployed state. Ensure the memory is defined in agentcore.json and has been deployed.`
+    );
+  }
+
+  return undefined;
+}
+
+/**
+ * Resolve memory ARN from CDK stack outputs.
+ * The CDK construct exports memory ARNs with keys matching:
+ *   ApplicationMemory{PascalName}ArnOutput...
+ */
+function resolveMemoryArnFromOutputs(memoryName: string, cdkOutputs: Record<string, string>): string | undefined {
+  const pascalName = toPascalId(memoryName);
+  const prefix = `ApplicationMemory${pascalName}ArnOutput`;
+
+  for (const [key, value] of Object.entries(cdkOutputs)) {
+    if (key.startsWith(prefix)) {
+      return value;
+    }
+  }
+
+  return undefined;
+}
+
+// ============================================================================
+// Truncation Mapping
+// ============================================================================
+
+function mapTruncation(truncation: NonNullable<HarnessSpec['truncation']>): HarnessTruncationConfiguration {
+  return {
+    strategy: truncation.strategy,
+    config: truncation.config as HarnessTruncationConfiguration['config'],
+  };
+}
+
+// ============================================================================
+// Container URI Resolution (from CDK outputs for dockerfile-based harnesses)
+// ============================================================================
+
+/**
+ * Supports two construct tree layouts:
+ *   Old (CfnOutput on stack root):
+ *     Harness{PascalName}ContainerUri...
+ *   New (CfnOutput inside AgentCoreHarnessEnvironment):
+ *     ApplicationHarness{PascalName}ImageUriOutput...
+ */
+function resolveContainerUriFromOutputs(harnessName: string, cdkOutputs?: Record<string, string>): string | undefined {
+  if (!cdkOutputs) return undefined;
+
+  const pascalName = toPascalId(harnessName);
+  const prefixes = [`ApplicationHarness${pascalName}ImageUri`, `Harness${pascalName}ContainerUri`];
+
+  for (const [key, value] of Object.entries(cdkOutputs)) {
+    if (prefixes.some(p => key.startsWith(p))) {
+      return value;
+    }
+  }
+
+  return undefined;
+}
+
+// ============================================================================
+// Container / Environment Artifact Mapping
+// ============================================================================
+
+function mapEnvironmentArtifact(containerUri: string): HarnessEnvironmentArtifact {
+  return {
+    containerConfiguration: { containerUri },
+  };
+}
+
+// ============================================================================
+// Environment Provider (Network + Lifecycle) Mapping
+// ============================================================================
+
+function mapEnvironmentProvider(spec: HarnessSpec): HarnessEnvironmentProvider | undefined {
+  const hasNetwork = !!spec.networkConfig;
+  const hasLifecycle = !!spec.lifecycleConfig;
+  const hasSessionStorage = !!spec.sessionStoragePath;
+
+  if (!hasNetwork && !hasLifecycle && !hasSessionStorage) {
+    return undefined;
+  }
+
+  const agentCoreRuntimeEnvironment: Record<string, unknown> = {};
+
+  if (spec.networkConfig) {
+    agentCoreRuntimeEnvironment.networkConfiguration = {
+      networkMode: 'VPC',
+      networkModeConfig: {
+        subnets: spec.networkConfig.subnets,
+        securityGroups: spec.networkConfig.securityGroups,
+      },
+    };
+  }
+
+  if (spec.lifecycleConfig) {
+    agentCoreRuntimeEnvironment.lifecycleConfiguration = spec.lifecycleConfig;
+  }
+
+  if (spec.sessionStoragePath) {
+    agentCoreRuntimeEnvironment.filesystemConfigurations = [{ sessionStorage: { mountPath: spec.sessionStoragePath } }];
+  }
+
+  return {
+    agentCoreRuntimeEnvironment,
+  };
+}
diff --git a/src/cli/operations/deploy/imperative/deployers/index.ts b/src/cli/operations/deploy/imperative/deployers/index.ts
new file mode 100644
index 000000000..655785b10
--- /dev/null
+++ b/src/cli/operations/deploy/imperative/deployers/index.ts
@@ -0,0 +1,2 @@
+export { HarnessDeployer } from './harness-deployer';
+export { mapHarnessSpecToCreateOptions, type MapHarnessOptions } from './harness-mapper';
diff --git a/src/cli/operations/deploy/imperative/index.ts b/src/cli/operations/deploy/imperative/index.ts
new file mode 100644
index 000000000..930dfe094
--- /dev/null
+++ b/src/cli/operations/deploy/imperative/index.ts
@@ -0,0 +1,18 @@
+import { HarnessDeployer } from './deployers';
+import { ImperativeDeploymentManager } from './manager';
+
+export type {
+  DeployPhase,
+  DeployProgress,
+  ImperativeDeployContext,
+  ImperativeDeployResult,
+  ImperativeDeployer,
+} from './types';
+
+export { ImperativeDeploymentManager, type ImperativePhaseResult } from './manager';
+
+export { HarnessDeployer, mapHarnessSpecToCreateOptions, type MapHarnessOptions } from './deployers';
+
+export function createDeploymentManager(): ImperativeDeploymentManager {
+  return new ImperativeDeploymentManager().register(new HarnessDeployer());
+}
diff --git a/src/cli/operations/deploy/imperative/manager.ts b/src/cli/operations/deploy/imperative/manager.ts
new file mode 100644
index 000000000..b7e22ecda
--- /dev/null
+++ b/src/cli/operations/deploy/imperative/manager.ts
@@ -0,0 +1,110 @@
+import type { DeployPhase, ImperativeDeployContext, ImperativeDeployResult, ImperativeDeployer } from './types';
+
+export interface ImperativePhaseResult {
+  success: boolean;
+  results: Map<string, ImperativeDeployResult>;
+  error?: string;
+  notes: string[];
+}
+
+export class ImperativeDeploymentManager {
+  private readonly deployers: ImperativeDeployer[] = [];
+
+  register(deployer: ImperativeDeployer): this {
+    this.deployers.push(deployer);
+    return this;
+  }
+
+  async runPhase(phase: DeployPhase, context: ImperativeDeployContext): Promise<ImperativePhaseResult> {
+    const results = new Map<string, ImperativeDeployResult>();
+    const notes: string[] = [];
+
+    const applicable = this.deployers.filter(d => d.phase === phase && d.shouldRun(context));
+
+    for (const deployer of applicable) {
+      context.onProgress?.(deployer.label, 'start');
+
+      try {
+        const result = await deployer.deploy(context);
+        results.set(deployer.name, result);
+
+        if (result.notes) {
+          notes.push(...result.notes);
+        }
+
+        if (!result.success) {
+          context.onProgress?.(deployer.label, 'error');
+          return {
+            success: false,
+            results,
+            error: result.error ?? `Deployer '${deployer.name}' failed`,
+            notes,
+          };
+        }
+
+        context.onProgress?.(deployer.label, 'done');
+      } catch (err) {
+        const errorMessage = err instanceof Error ? err.message : String(err);
+        results.set(deployer.name, { success: false, error: errorMessage });
+        context.onProgress?.(deployer.label, 'error');
+        return {
+          success: false,
+          results,
+          error: errorMessage,
+          notes,
+        };
+      }
+    }
+
+    return { success: true, results, notes };
+  }
+
+  async teardownAll(context: ImperativeDeployContext): Promise<ImperativePhaseResult> {
+    const results = new Map<string, ImperativeDeployResult>();
+    const notes: string[] = [];
+    const errors: string[] = [];
+
+    const applicable = this.deployers.filter(d => d.shouldRun(context)).reverse();
+
+    for (const deployer of applicable) {
+      context.onProgress?.(deployer.label, 'start');
+
+      try {
+        const result = await deployer.teardown(context);
+        results.set(deployer.name, result);
+
+        if (result.notes) {
+          notes.push(...result.notes);
+        }
+
+        if (!result.success) {
+          context.onProgress?.(deployer.label, 'error');
+          errors.push(result.error ?? `Teardown of '${deployer.name}' failed`);
+          continue;
+        }
+
+        context.onProgress?.(deployer.label, 'done');
+      } catch (err) {
+        const errorMessage = err instanceof Error ? err.message : String(err);
+        results.set(deployer.name, { success: false, error: errorMessage });
+        context.onProgress?.(deployer.label, 'error');
+        errors.push(errorMessage);
+      }
+    }
+
+    if (errors.length > 0) {
+      return {
+        success: false,
+        results,
+        error: errors.join('; '),
+        notes,
+      };
+    }
+
+    return { success: true, results, notes };
+  }
+
+  hasDeployersForPhase(phase: DeployPhase, context: ImperativeDeployContext): boolean {
+    return this.deployers.some(d => d.phase === phase && d.shouldRun(context));
+  }
+}
diff --git a/src/cli/operations/deploy/imperative/types.ts b/src/cli/operations/deploy/imperative/types.ts
new file mode 100644
index 000000000..7efa13e7a
--- /dev/null
+++ b/src/cli/operations/deploy/imperative/types.ts
@@ -0,0 +1,32 @@
+import type { ConfigIO } from '../../../../lib';
+import type { AgentCoreProjectSpec, AwsDeploymentTarget, DeployedState } from '../../../../schema';
+
+export type DeployPhase = 'pre-cdk' | 'post-cdk' | 'standalone';
+
+export type DeployProgress = (step: string, status: 'start' | 'done' | 'error') => void;
+
+export interface ImperativeDeployContext {
+  projectSpec: AgentCoreProjectSpec;
+  target: AwsDeploymentTarget;
+  configIO: ConfigIO;
+  deployedState: DeployedState;
+  onProgress?: DeployProgress;
+  cdkOutputs?: Record<string, string>;
+  autoConfirm?: boolean;
+}
+
+export interface ImperativeDeployResult<TState = Record<string, unknown>> {
+  success: boolean;
+  state?: TState;
+  notes?: string[];
+  error?: string;
+}
+
+export interface ImperativeDeployer<TState = Record<string, unknown>> {
+  readonly name: string;
+  readonly label: string;
+  readonly phase: DeployPhase;
+  shouldRun(context: ImperativeDeployContext): boolean;
+  deploy(context: ImperativeDeployContext): Promise<ImperativeDeployResult<TState>>;
+  teardown(context: ImperativeDeployContext): Promise<ImperativeDeployResult<TState>>;
+}
diff --git a/src/cli/operations/deploy/index.ts b/src/cli/operations/deploy/index.ts
index a5b9a2f9d..332f0ca2d 100644
--- a/src/cli/operations/deploy/index.ts
+++ b/src/cli/operations/deploy/index.ts
@@ -45,6 +45,30 @@ export {
 // Post-deploy observability setup
 export { setupTransactionSearch, type TransactionSearchSetupResult } from './post-deploy-observability';
 
+// Post-deploy HTTP gateways
+export {
+  setupHttpGateways,
+  type SetupHttpGatewaysOptions,
+  type SetupHttpGatewaysResult,
+  type HttpGatewaySetupResult,
+} from './post-deploy-http-gateways';
+
+// Post-deploy online eval enablement
+export {
+  enableOnlineEvalConfigs,
+  type EnableOnlineEvalsOptions,
+  type EnableOnlineEvalsResult,
+  type OnlineEvalEnableResult,
+} from './post-deploy-online-evals';
+
+// Post-deploy config bundles
+export {
+  setupConfigBundles,
+  type SetupConfigBundlesOptions,
+  type SetupConfigBundlesResult,
+  type ConfigBundleSetupResult,
+} from './post-deploy-config-bundles';
+
 // Re-export external requirements for convenience
 export {
   checkDependencyVersions,
diff --git a/src/cli/operations/deploy/post-deploy-ab-tests.ts b/src/cli/operations/deploy/post-deploy-ab-tests.ts
new file mode 100644
index 000000000..4678d16f8
--- /dev/null
+++ b/src/cli/operations/deploy/post-deploy-ab-tests.ts
@@ -0,0 +1,733 @@
+import type { ABTestDeployedState, AgentCoreProjectSpec, DeployedResourceState } from '../../../schema';
+import { getCredentialProvider } from '../../aws/account';
+import { createABTest, deleteABTest, getABTest, listABTests, updateABTest } from '../../aws/agentcore-ab-tests';
+import type { ABTestEvaluationConfig, ABTestVariant, TrafficAllocationConfig } from '../../aws/agentcore-ab-tests';
+import { arnPrefix } from '../../aws/partition';
+import {
+  CreateRoleCommand,
+  DeleteRoleCommand,
+  DeleteRolePolicyCommand,
+  GetRoleCommand,
+  IAMClient,
+  PutRolePolicyCommand,
+} from '@aws-sdk/client-iam';
+import { createHash } from 'node:crypto';
+
+// ============================================================================
+// Types
+// ============================================================================
+
+export interface SetupABTestsOptions {
+  region: string;
+  projectSpec: AgentCoreProjectSpec;
+  existingABTests?: Record<string, ABTestDeployedState>;
+  /** Full deployed resource state for resolving ARN references. */
+  deployedResources?: DeployedResourceState;
+}
+
+export interface ABTestSetupResult {
+  testName: string;
+  status: 'created' | 'updated' | 'deleted' | 'skipped' | 'error';
+  abTestId?: string;
+  abTestArn?: string;
+  error?: string;
+  warning?: string;
+}
+
+export interface SetupABTestsResult {
+  results: ABTestSetupResult[];
+  abTests: Record<string, ABTestDeployedState>;
+  hasErrors: boolean;
+}
+
+// ============================================================================
+// Constants
+// ============================================================================
+
+const AB_TEST_ROLE_POLICY_NAME = 'ABTestExecutionPolicy';
+
+// ============================================================================
+// Config Hash
+// ============================================================================
+
+/**
+ * Compute a deterministic SHA-256 hash of the key AB test configuration fields.
+ * Used to detect whether a redeployment actually changed the test config.
+ */
+function computeConfigHash(testSpec: {
+  variants: unknown;
+  evaluationConfig: unknown;
+  gatewayRef: string;
+  gatewayFilter?: unknown;
+  trafficAllocationConfig?: unknown;
+}): string {
+  const payload = JSON.stringify({
+    variants: testSpec.variants,
+    evaluationConfig: testSpec.evaluationConfig,
+    gatewayRef: testSpec.gatewayRef,
+    gatewayFilter: testSpec.gatewayFilter,
+    trafficAllocationConfig: testSpec.trafficAllocationConfig,
+  });
+  return createHash('sha256').update(payload).digest('hex');
+}
+
+// ============================================================================
+// Shared Update Helper
+// ============================================================================
+
+interface ApplyABTestUpdateOptions {
+  region: string;
+  abTestId: string;
+  resolvedVariants: ABTestVariant[];
+  resolvedEvalConfig: ABTestEvaluationConfig;
+  trafficAllocationConfig?: TrafficAllocationConfig;
+  resolvedRoleArn?: string;
+  testName: string;
+  roleCreatedByCli: boolean;
+  currentHash: string;
+}
+
+async function applyABTestUpdate(
+  options: ApplyABTestUpdateOptions
+): Promise<{ state: ABTestDeployedState; result: ABTestSetupResult }> {
+  const updateResult = await updateABTest({
+    region: options.region,
+    abTestId: options.abTestId,
+    variants: options.resolvedVariants,
+    evaluationConfig: options.resolvedEvalConfig,
+    trafficAllocationConfig: options.trafficAllocationConfig,
+    roleArn: options.resolvedRoleArn,
+  });
+
+  return {
+    state: {
+      abTestId: updateResult.abTestId,
+      abTestArn: updateResult.abTestArn,
+      roleArn: options.resolvedRoleArn,
+      roleCreatedByCli: options.roleCreatedByCli,
+      configHash: options.currentHash,
+    },
+    result: {
+      testName: options.testName,
+      status: 'updated',
+      abTestId: updateResult.abTestId,
+      abTestArn: updateResult.abTestArn,
+    },
+  };
+}
+
+// ============================================================================
+// Implementation
+// ============================================================================
+
+/**
+ * Create, update, or delete AB tests post-deploy.
+ *
+ * Pattern:
+ * 1. For each AB test in project spec → resolve ARN references, create or skip
+ * 2. For each AB test in deployed-state but NOT in project spec → delete (reconciliation)
+ * 3. Return updated deployed state entries
+ */
+export async function setupABTests(options: SetupABTestsOptions): Promise<SetupABTestsResult> {
+  const { region, projectSpec, existingABTests, deployedResources } = options;
+  const results: ABTestSetupResult[] = [];
+  const abTests: Record<string, ABTestDeployedState> = {};
+
+  // Create or skip tests from the spec
+  for (const testSpec of projectSpec.abTests ?? []) {
+    let resolvedRoleArn: string | undefined;
+    let roleCreatedByCli = false;
+    try {
+      const currentHash = computeConfigHash(testSpec);
+      const existingTest = existingABTests?.[testSpec.name];
+
+      // Resolve ARN references from deployed state
+      const resolvedVariants = resolveVariants(testSpec.variants, deployedResources);
+      const resolvedGatewayArn = resolveGatewayArn(testSpec.gatewayRef, deployedResources);
+      if (!resolvedGatewayArn.startsWith('arn:') || resolvedGatewayArn.split(':').length < 6) {
+        results.push({
+          testName: testSpec.name,
+          status: 'error',
+          error: `Gateway ARN could not be resolved for AB test "${testSpec.name}". Reference "${testSpec.gatewayRef}" did not match any deployed gateway. Ensure the HTTP gateway was deployed successfully.`,
+        });
+        continue;
+      }
+      const resolvedEvalConfig = resolveEvalConfig(testSpec.evaluationConfig, deployedResources);
+      const evalConfigArns: string[] =
+        'onlineEvaluationConfigArn' in resolvedEvalConfig
+          ? [resolvedEvalConfig.onlineEvaluationConfigArn]
+          : resolvedEvalConfig.perVariantOnlineEvaluationConfig.map(pv => pv.onlineEvaluationConfigArn);
+      if (testSpec.roleArn) {
+        resolvedRoleArn = testSpec.roleArn;
+      } else {
+        resolvedRoleArn = await getOrCreateABTestRole({
+          region,
+          projectName: projectSpec.name,
+          testName: testSpec.name,
+          gatewayArn: resolvedGatewayArn,
+          onlineEvalConfigArns: evalConfigArns,
+        });
+        roleCreatedByCli = true;
+      }
+
+      if (existingTest) {
+        // Config unchanged — skip to preserve running state
+        if (existingTest.configHash === currentHash) {
+          abTests[testSpec.name] = existingTest;
+          results.push({
+            testName: testSpec.name,
+            status: 'skipped',
+            abTestId: existingTest.abTestId,
+            abTestArn: existingTest.abTestArn,
+          });
+          continue;
+        }
+
+        // Config changed — update in-place instead of delete+recreate
+        const applied = await applyABTestUpdate({
+          region,
+          abTestId: existingTest.abTestId,
+          resolvedVariants,
+          resolvedEvalConfig,
+          trafficAllocationConfig: testSpec.trafficAllocationConfig as TrafficAllocationConfig | undefined,
+          resolvedRoleArn,
+          testName: testSpec.name,
+          roleCreatedByCli: existingTest.roleCreatedByCli ?? roleCreatedByCli,
+          currentHash,
+        });
+        abTests[testSpec.name] = applied.state;
+        results.push(applied.result);
+        continue;
+      }
+
+      // Try to find by name via list (handles re-creation after state loss)
+      const existingByName = await findABTestByName(region, projectSpec.name, testSpec.name);
+      if (existingByName) {
+        // Found by name — update in-place with fresh config
+        const applied = await applyABTestUpdate({
+          region,
+          abTestId: existingByName.abTestId,
+          resolvedVariants,
+          resolvedEvalConfig,
+          trafficAllocationConfig: testSpec.trafficAllocationConfig as TrafficAllocationConfig | undefined,
+          resolvedRoleArn,
+          testName: testSpec.name,
+          roleCreatedByCli,
+          currentHash,
+        });
+        abTests[testSpec.name] = applied.state;
+        results.push(applied.result);
+        continue;
+      }
+
+      const createOptions = {
+        region,
+        name: `${projectSpec.name}_${testSpec.name}`,
+        description: testSpec.description,
+        gatewayArn: resolvedGatewayArn,
+        roleArn: resolvedRoleArn,
+        variants: resolvedVariants,
+        evaluationConfig: resolvedEvalConfig,
+        gatewayFilter: testSpec.gatewayFilter,
+        trafficAllocationConfig: testSpec.trafficAllocationConfig as TrafficAllocationConfig | undefined,
+        maxDurationDays: testSpec.maxDurationDays,
+        enableOnCreate: testSpec.enableOnCreate,
+      };
+
+      // Retry on gateway/eval access denied — IAM policy propagation can take time
+      let result;
+      const MAX_RETRIES = 5;
+      const BASE_DELAY_MS = 5_000;
+      for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+        try {
+          result = await createABTest(createOptions);
+          break;
+        } catch (err: unknown) {
+          const errCode = (err as { name?: string }).name;
+          const errStatus = (err as { $metadata?: { httpStatusCode?: number } }).$metadata?.httpStatusCode;
+          const msg = err instanceof Error ? err.message : String(err);
+
+          const isRetryable =
+            errCode === 'AccessDeniedException' ||
+            errStatus === 403 ||
+            msg.includes('Access denied') ||
+            msg.includes('Gateway validation error');
+
+          if (isRetryable && attempt < MAX_RETRIES - 1) {
+            const delay = BASE_DELAY_MS * Math.pow(2, attempt) + Math.random() * 1000;
+            await new Promise(resolve => setTimeout(resolve, delay));
+            continue;
+          }
+          throw err;
+        }
+      }
+      if (!result) throw new Error('AB test creation failed after retries');
+
+      abTests[testSpec.name] = {
+        abTestId: result.abTestId,
+        abTestArn: result.abTestArn,
+        roleArn: resolvedRoleArn,
+        roleCreatedByCli,
+        configHash: currentHash,
+      };
+
+      results.push({
+        testName: testSpec.name,
+        status: 'created',
+        abTestId: result.abTestId,
+        abTestArn: result.abTestArn,
+      });
+    } catch (err) {
+      // Clean up auto-created role on AB test creation failure to avoid orphaned roles
+      if (roleCreatedByCli && resolvedRoleArn) {
+        try {
+          await deleteABTestRole(region, resolvedRoleArn);
+        } catch {
+          // Best-effort role cleanup
+        }
+      }
+      results.push({
+        testName: testSpec.name,
+        status: 'error',
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  }
+
+  // Orphaned AB tests are deleted by deleteOrphanedABTests() which runs
+  // as a separate pre-pass before HTTP gateway setup. No deletion loop here.
+
+  return {
+    results,
+    abTests,
+    hasErrors: results.some(r => r.status === 'error'),
+  };
+}
+
+/**
+ * Delete orphaned AB tests (in deployed-state but removed from spec).
+ *
+ * AB tests create rules on HTTP gateways, so they must be deleted before
+ * the gateway can be deleted. Call this before setupHttpGateways.
+ *
+ * The main setupABTests deletion loop becomes a no-op for any tests
+ * already cleaned up here.
+ */
+export async function deleteOrphanedABTests(options: {
+  region: string;
+  projectSpec: AgentCoreProjectSpec;
+  existingABTests?: Record<string, ABTestDeployedState>;
+}): Promise<{ results: ABTestSetupResult[]; hasErrors: boolean }> {
+  const { region, projectSpec, existingABTests } = options;
+  if (!existingABTests) return { results: [], hasErrors: false };
+
+  const specTestNames = new Set((projectSpec.abTests ?? []).map(t => t.name));
+  const results: ABTestSetupResult[] = [];
+
+  for (const [testName, testState] of Object.entries(existingABTests)) {
+    if (!specTestNames.has(testName)) {
+      try {
+        // Stop the AB test first — running tests cannot be deleted
+        let wasStopped = false;
+        let stopTimedOut = false;
+        try {
+          await updateABTest({ region, abTestId: testState.abTestId, executionStatus: 'STOPPED' });
+          wasStopped = true;
+
+          // Poll until executionStatus is STOPPED (stop is async)
+          let stopped = false;
+          for (let i = 0; i < 20; i++) {
+            const test = await getABTest({ region, abTestId: testState.abTestId });
+            if (test.executionStatus === 'STOPPED') {
+              stopped = true;
+              break;
+            }
+            await new Promise(resolve => setTimeout(resolve, 3_000));
+          }
+          if (!stopped) {
+            stopTimedOut = true;
+          }
+        } catch {
+          // May already be stopped or in a state that doesn't need stopping — proceed with delete
+        }
+
+        const deleteResult = await deleteABTest({
+          region,
+          abTestId: testState.abTestId,
+        });
+
+        if (deleteResult.success && testState.roleCreatedByCli && testState.roleArn) {
+          await deleteABTestRole(region, testState.roleArn);
+        }
+
+        results.push({
+          testName,
+          status: deleteResult.success ? 'deleted' : 'error',
+          error: deleteResult.error,
+          warning: stopTimedOut
+            ? `AB test "${testName}" did not reach STOPPED status within the polling window — proceeding with delete`
+            : wasStopped
+              ? `AB test "${testName}" was stopped before deletion`
+              : undefined,
+        });
+      } catch (err) {
+        results.push({
+          testName,
+          status: 'error',
+          error: err instanceof Error ? err.message : String(err),
+        });
+      }
+    }
+  }
+
+  return {
+    results,
+    hasErrors: results.some(r => r.status === 'error'),
+  };
+}
+
+// ============================================================================
+// ARN Resolution Helpers
+// ============================================================================
+
+async function findABTestByName(
+  region: string,
+  projectName: string,
+  testName: string
+): Promise<{ abTestId: string; abTestArn: string } | undefined> {
+  try {
+    const prefixedName = `${projectName}_${testName}`;
+    const result = await listABTests({ region, maxResults: 100 });
+    return result.abTests.find(
+      t => t.name.toLowerCase() === prefixedName.toLowerCase() || t.name.toLowerCase() === testName.toLowerCase()
+    );
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Resolve variant config bundle references.
+ * If bundleArn is a name (not an ARN), look it up in deployed config bundles.
+ * Target-based variants are passed through as-is.
+ */
+function resolveVariants(
+  variants: {
+    name: 'C' | 'T1';
+    weight: number;
+    variantConfiguration: {
+      configurationBundle?: { bundleArn: string; bundleVersion: string };
+      target?: { targetName: string };
+    };
+  }[],
+  deployedResources?: DeployedResourceState
+): ABTestVariant[] {
+  return variants.map(v => {
+    const bundle = v.variantConfiguration.configurationBundle;
+    if (bundle) {
+      return {
+        name: v.name,
+        weight: v.weight,
+        variantConfiguration: {
+          configurationBundle: {
+            bundleArn: resolveConfigBundleArn(bundle.bundleArn, deployedResources),
+            bundleVersion: resolveConfigBundleVersion(bundle.bundleArn, bundle.bundleVersion, deployedResources),
+          },
+        },
+      };
+    }
+    // Target-based variant — pass through
+    return {
+      name: v.name,
+      weight: v.weight,
+      variantConfiguration: {
+        ...(v.variantConfiguration.target && { target: { name: v.variantConfiguration.target.targetName } }),
+      },
+    };
+  });
+}
+
+function resolveConfigBundleArn(ref: string, deployedResources?: DeployedResourceState): string {
+  if (ref.startsWith('arn:')) return ref;
+
+  const bundles = deployedResources?.configBundles;
+  if (bundles?.[ref]) {
+    return bundles[ref].bundleArn;
+  }
+
+  return ref;
+}
+
+function resolveConfigBundleVersion(
+  bundleRef: string,
+  versionRef: string,
+  deployedResources?: DeployedResourceState
+): string {
+  if (versionRef !== 'LATEST') return versionRef;
+
+  // Resolve LATEST to the deployed versionId
+  const bundles = deployedResources?.configBundles;
+  const name = bundleRef.startsWith('arn:') ? undefined : bundleRef;
+  if (name && bundles?.[name]) {
+    return bundles[name].versionId;
+  }
+
+  return versionRef;
+}
+
+function resolveGatewayArn(ref: string, deployedResources?: DeployedResourceState): string {
+  if (ref.startsWith('arn:')) return ref;
+
+  // Check for placeholder pattern {{gateway:<name>}}
+  const placeholderMatch = /^\{\{gateway:(.+)\}\}$/.exec(ref);
+  const gwName = placeholderMatch ? placeholderMatch[1] : ref;
+
+  const gateways = deployedResources?.mcp?.gateways;
+  if (gateways && gwName && gateways[gwName]) {
+    return gateways[gwName].gatewayArn;
+  }
+
+  // Check HTTP gateways (imperatively created for A/B testing)
+  const httpGateways = deployedResources?.httpGateways;
+  if (httpGateways && gwName && httpGateways[gwName]) {
+    return httpGateways[gwName].gatewayArn;
+  }
+
+  return ref;
+}
+
+function resolveEvalConfig(
+  config:
+    | { onlineEvaluationConfigArn: string }
+    | { perVariantOnlineEvaluationConfig: { treatmentName: 'C' | 'T1'; onlineEvaluationConfigArn: string }[] },
+  deployedResources?: DeployedResourceState
+): ABTestEvaluationConfig {
+  if ('perVariantOnlineEvaluationConfig' in config) {
+    // Per-variant eval config — resolve each ARN
+    return {
+      perVariantOnlineEvaluationConfig: config.perVariantOnlineEvaluationConfig.map(pv => ({
+        name: pv.treatmentName,
+        onlineEvaluationConfigArn: resolveOnlineEvalArn(pv.onlineEvaluationConfigArn, deployedResources),
+      })),
+    };
+  }
+
+  const ref = config.onlineEvaluationConfigArn;
+  return { onlineEvaluationConfigArn: resolveOnlineEvalArn(ref, deployedResources) };
+}
+
+function resolveOnlineEvalArn(ref: string, deployedResources?: DeployedResourceState): string {
+  if (ref.startsWith('arn:')) return ref;
+
+  const configs = deployedResources?.onlineEvalConfigs;
+  if (configs?.[ref]) {
+    return configs[ref].onlineEvaluationConfigArn;
+  }
+
+  return ref;
+}
+
+// ============================================================================
+// IAM Role Management
+// ============================================================================
+
+/**
+ * Generate a project-scoped role name following the CDK pattern:
+ * AgentCore-{ProjectName}-ABTest{TestName}-{Hash}
+ */
+function generateRoleName(projectName: string, testName: string): string {
+  // Deterministic hash so retries produce the same role name (avoids orphaned roles)
+  const hash = createHash('sha256').update(`${projectName}:${testName}`).digest('hex').slice(0, 8);
+  const base = `AgentCore-${projectName}-ABTest${testName}`;
+  // IAM role names max 64 chars
+  return `${base.slice(0, 55)}-${hash}`;
+}
+
+/**
+ * Extract role name from ARN: arn:aws:iam::123456789012:role/RoleName → RoleName
+ */
+function roleNameFromArn(roleArn: string): string {
+  const parts = roleArn.split('/');
+  return parts[parts.length - 1] ?? roleArn;
+}
+
+interface CreateABTestRoleOptions {
+  region: string;
+  projectName: string;
+  testName: string;
+  gatewayArn: string;
+  onlineEvalConfigArns: string[];
+}
+
+async function getOrCreateABTestRole(options: CreateABTestRoleOptions): Promise<string> {
+  const { region, projectName, testName, gatewayArn, onlineEvalConfigArns } = options;
+  const credentials = getCredentialProvider();
+  const iamClient = new IAMClient({ region, credentials });
+
+  // Extract account ID from gateway ARN (arn:aws:bedrock-agentcore:REGION:ACCOUNT:gateway/ID)
+  const accountId = gatewayArn.split(':')[4] ?? '*';
+  // Extract gateway ID for resource scoping
+  const gatewayId = gatewayArn.split('/').pop() ?? '*';
+
+  const roleName = generateRoleName(projectName, testName);
+
+  const trustPolicy = JSON.stringify({
+    Version: '2012-10-17',
+    Statement: [
+      {
+        Effect: 'Allow',
+        Principal: { Service: 'bedrock-agentcore.amazonaws.com' },
+        Action: 'sts:AssumeRole',
+      },
+    ],
+  });
+
+  let roleArn: string;
+  let _needsPropagationWait = false;
+
+  try {
+    const createResult = await iamClient.send(
+      new CreateRoleCommand({
+        RoleName: roleName,
+        AssumeRolePolicyDocument: trustPolicy,
+        Description: `Auto-created execution role for AgentCore AB test: ${testName}`,
+        Tags: [
+          { Key: 'agentcore:created-by', Value: 'agentcore-cli' },
+          { Key: 'agentcore:project-name', Value: projectName },
+          { Key: 'agentcore:ab-test-name', Value: testName },
+        ],
+      })
+    );
+
+    roleArn = createResult.Role?.Arn ?? '';
+    if (!roleArn) {
+      throw new Error(`IAM CreateRole succeeded but returned no role ARN for "${roleName}"`);
+    }
+    _needsPropagationWait = true;
+  } catch (err: unknown) {
+    // Handle retry after a previous failed deploy left the role behind
+    const errName = (err as { name?: string }).name;
+    if (errName === 'EntityAlreadyExistsException') {
+      // IAM role already exists — reuse it
+      const existing = await iamClient.send(new GetRoleCommand({ RoleName: roleName }));
+      roleArn = existing.Role?.Arn ?? '';
+      if (!roleArn) {
+        throw new Error(`Role "${roleName}" already exists but ARN could not be retrieved`);
+      }
+    } else {
+      throw err;
+    }
+  }
+
+  const policy = JSON.stringify({
+    Version: '2012-10-17',
+    Statement: [
+      {
+        Sid: 'GatewayRuleStatement',
+        Effect: 'Allow',
+        Action: [
+          'bedrock-agentcore:CreateGatewayRule',
+          'bedrock-agentcore:UpdateGatewayRule',
+          'bedrock-agentcore:GetGatewayRule',
+          'bedrock-agentcore:DeleteGatewayRule',
+          'bedrock-agentcore:ListGatewayRules',
+        ],
+        Resource: [`${arnPrefix(region)}:bedrock-agentcore:${region}:${accountId}:gateway/${gatewayId}`],
+      },
+      {
+        Sid: 'GatewayReadStatement',
+        Effect: 'Allow',
+        Action: ['bedrock-agentcore:GetGateway'],
+        Resource: [`${arnPrefix(region)}:bedrock-agentcore:${region}:${accountId}:gateway/${gatewayId}`],
+      },
+      {
+        Sid: 'GatewayListStatement',
+        Effect: 'Allow',
+        Action: ['bedrock-agentcore:ListGateways'],
+        Resource: ['*'],
+      },
+      {
+        Sid: 'OnlineEvaluationConfigStatement',
+        Effect: 'Allow',
+        Action: ['bedrock-agentcore:GetOnlineEvaluationConfig', 'bedrock-agentcore:UpdateOnlineEvaluationConfig'],
+        Resource: onlineEvalConfigArns,
+      },
+      {
+        Sid: 'ConfigurationBundleReadStatement',
+        Effect: 'Allow',
+        Action: ['bedrock-agentcore:GetConfigurationBundle', 'bedrock-agentcore:GetConfigurationBundleVersion'],
+        Resource: [`${arnPrefix(region)}:bedrock-agentcore:${region}:${accountId}:configuration-bundle/*`],
+      },
+      {
+        Sid: 'CloudWatchDescribeLogGroups',
+        Effect: 'Allow',
+        Action: ['logs:DescribeLogGroups'],
+        Resource: ['*'],
+      },
+      {
+        Sid: 'CloudWatchLogReadStatement',
+        Effect: 'Allow',
+        Action: [
+          'logs:StartQuery',
+          'logs:GetQueryResults',
+          'logs:StopQuery',
+          'logs:FilterLogEvents',
+          'logs:GetLogEvents',
+        ],
+        Resource: [
+          `${arnPrefix(region)}:logs:${region}:${accountId}:log-group:/aws/bedrock-agentcore/evaluations/*`,
+          `${arnPrefix(region)}:logs:${region}:${accountId}:log-group:/aws/bedrock-agentcore/evaluations/*:*`,
+          `${arnPrefix(region)}:logs:${region}:${accountId}:log-group:aws/spans`,
+          `${arnPrefix(region)}:logs:${region}:${accountId}:log-group:aws/spans:*`,
+        ],
+      },
+      {
+        Sid: 'CloudWatchIndexPolicyStatement',
+        Effect: 'Allow',
+        Action: ['logs:DescribeIndexPolicies', 'logs:PutIndexPolicy'],
+        Resource: [
+          `${arnPrefix(region)}:logs:${region}:${accountId}:log-group:aws/spans`,
+          `${arnPrefix(region)}:logs:${region}:${accountId}:log-group:aws/spans:*`,
+        ],
+      },
+    ],
+  });
+
+  // Re-apply the inline policy (idempotent — covers both new and recovered roles)
+  await iamClient.send(
+    new PutRolePolicyCommand({
+      RoleName: roleName,
+      PolicyName: AB_TEST_ROLE_POLICY_NAME,
+      PolicyDocument: policy,
+    })
+  );
+
+  // Always wait for IAM policy propagation — both new roles and policy updates on existing roles
+  await new Promise(resolve => setTimeout(resolve, 15_000));
+
+  return roleArn;
+}
+
+async function deleteABTestRole(region: string, roleArn: string): Promise<void> {
+  const credentials = getCredentialProvider();
+  const iamClient = new IAMClient({ region, credentials });
+  const roleName = roleNameFromArn(roleArn);
+
+  try {
+    // Must delete inline policies before deleting the role
+    await iamClient.send(
+      new DeleteRolePolicyCommand({
+        RoleName: roleName,
+        PolicyName: AB_TEST_ROLE_POLICY_NAME,
+      })
+    );
+  } catch {
+    // Policy may not exist
+  }
+
+  try {
+    await iamClient.send(new DeleteRoleCommand({ RoleName: roleName }));
+  } catch {
+    // Role may already be deleted or in use — best effort
+  }
+}
diff --git a/src/cli/operations/deploy/post-deploy-config-bundles.ts b/src/cli/operations/deploy/post-deploy-config-bundles.ts
new file mode 100644
index 000000000..5318c54b1
--- /dev/null
+++ b/src/cli/operations/deploy/post-deploy-config-bundles.ts
@@ -0,0 +1,348 @@
+import type { AgentCoreProjectSpec, ConfigBundleDeployedState, DeployedState } from '../../../schema';
+import {
+  createConfigurationBundle,
+  deleteConfigurationBundle,
+  getConfigurationBundleVersion,
+  listConfigurationBundleVersions,
+  listConfigurationBundles,
+  updateConfigurationBundle,
+} from '../../aws/agentcore-config-bundles';
+import type { ComponentConfigurationMap } from '../../aws/agentcore-config-bundles';
+
+// ============================================================================
+// Types
+// ============================================================================
+
+export interface SetupConfigBundlesOptions {
+  region: string;
+  projectSpec: AgentCoreProjectSpec;
+  /** Existing config bundle deployed state (from deployed-state.json) */
+  existingBundles?: Record<string, ConfigBundleDeployedState>;
+}
+
+export interface ConfigBundleSetupResult {
+  bundleName: string;
+  status: 'created' | 'updated' | 'deleted' | 'skipped' | 'error';
+  bundleId?: string;
+  bundleArn?: string;
+  versionId?: string;
+  error?: string;
+}
+
+export interface SetupConfigBundlesResult {
+  results: ConfigBundleSetupResult[];
+  /** Deployed state entries for config bundles (to merge into deployed-state.json) */
+  configBundles: Record<string, ConfigBundleDeployedState>;
+  hasErrors: boolean;
+}
+
+// ============================================================================
+// Implementation
+// ============================================================================
+
+/**
+ * Create, update, or delete configuration bundles post-deploy.
+ *
+ * Pattern:
+ * 1. For each configBundle in project spec → create or update
+ * 2. For each bundle in deployed-state but NOT in project spec → delete (reconciliation)
+ * 3. Return updated deployed state entries
+ */
+export async function setupConfigBundles(options: SetupConfigBundlesOptions): Promise<SetupConfigBundlesResult> {
+  const { region, projectSpec, existingBundles } = options;
+  const results: ConfigBundleSetupResult[] = [];
+  const configBundles: Record<string, ConfigBundleDeployedState> = {};
+
+  const specBundleNames = new Set((projectSpec.configBundles ?? []).map(b => b.name));
+  const projectName = projectSpec.name;
+
+  // Create or update bundles from the spec
+  for (const bundleSpec of projectSpec.configBundles ?? []) {
+    // Prepend project name to the API-side bundle name (no separator for config bundles)
+    const apiBundleName = `${projectName}${bundleSpec.name}`;
+
+    try {
+      // Try to update if we have an existing bundle ID
+      const existingBundle = existingBundles?.[bundleSpec.name];
+      let updated = false;
+
+      if (existingBundle) {
+        try {
+          // Fetch the exact version we know about — avoids branch-not-found errors
+          const current = await getConfigurationBundleVersion({
+            region,
+            bundleId: existingBundle.bundleId,
+            versionId: existingBundle.versionId,
+          });
+          const componentsChanged = !deepEqual(current.components, bundleSpec.components);
+          const descriptionChanged = (bundleSpec.description ?? undefined) !== (current.description ?? undefined);
+
+          if (!componentsChanged && !descriptionChanged) {
+            // Nothing changed — skip the update, preserve existing state
+            configBundles[bundleSpec.name] = {
+              bundleId: existingBundle.bundleId,
+              bundleArn: existingBundle.bundleArn,
+              versionId: existingBundle.versionId,
+            };
+            results.push({
+              bundleName: bundleSpec.name,
+              status: 'skipped',
+              bundleId: existingBundle.bundleId,
+              bundleArn: existingBundle.bundleArn,
+              versionId: existingBundle.versionId,
+            });
+            updated = true;
+          } else {
+            // Use the branch from the spec, or fall back to whatever branch the API has
+            const effectiveBranch = bundleSpec.branchName ?? current.lineageMetadata?.branchName ?? 'mainline';
+            const result = await updateConfigurationBundle({
+              region,
+              bundleId: existingBundle.bundleId,
+              description: bundleSpec.description,
+              components: bundleSpec.components as ComponentConfigurationMap,
+              parentVersionIds: [current.versionId],
+              branchName: effectiveBranch,
+              commitMessage: bundleSpec.commitMessage ?? `Update ${bundleSpec.name}`,
+            });
+
+            configBundles[bundleSpec.name] = {
+              bundleId: result.bundleId,
+              bundleArn: result.bundleArn,
+              versionId: result.versionId,
+            };
+
+            results.push({
+              bundleName: bundleSpec.name,
+              status: 'updated',
+              bundleId: result.bundleId,
+              bundleArn: result.bundleArn,
+              versionId: result.versionId,
+            });
+            updated = true;
+          }
+        } catch (updateErr) {
+          // If bundle or branch not found, fall through to find-by-name or create
+          const msg = updateErr instanceof Error ? updateErr.message : String(updateErr);
+          if (!msg.includes('404') && !msg.includes('not found')) throw updateErr;
+        }
+      }
+
+      if (!updated) {
+        // Try to find by name via list (handles re-creation after state loss)
+        const existingByName = await findBundleByName(region, apiBundleName);
+
+        if (existingByName) {
+          // Fetch versions and pick the newest — avoids branch-not-found errors from getConfigurationBundle
+          const versions = await listConfigurationBundleVersions({
+            region,
+            bundleId: existingByName.bundleId,
+          });
+          const sorted = [...versions.versions].sort((a, b) => Number(b.versionCreatedAt) - Number(a.versionCreatedAt));
+          const latestVersionId = sorted[0]?.versionId;
+          if (!latestVersionId) throw new Error(`No versions found for bundle ${bundleSpec.name}`);
+          const current = await getConfigurationBundleVersion({
+            region,
+            bundleId: existingByName.bundleId,
+            versionId: latestVersionId,
+          });
+          const componentsChanged = !deepEqual(current.components, bundleSpec.components);
+          const descriptionChanged = (bundleSpec.description ?? undefined) !== (current.description ?? undefined);
+
+          if (!componentsChanged && !descriptionChanged) {
+            configBundles[bundleSpec.name] = {
+              bundleId: existingByName.bundleId,
+              bundleArn: current.bundleArn,
+              versionId: current.versionId,
+            };
+            results.push({
+              bundleName: bundleSpec.name,
+              status: 'skipped',
+              bundleId: existingByName.bundleId,
+              bundleArn: current.bundleArn,
+              versionId: current.versionId,
+            });
+          } else {
+            const effectiveBranch = bundleSpec.branchName ?? current.lineageMetadata?.branchName ?? 'mainline';
+            const result = await updateConfigurationBundle({
+              region,
+              bundleId: existingByName.bundleId,
+              description: bundleSpec.description,
+              components: bundleSpec.components as ComponentConfigurationMap,
+              parentVersionIds: [current.versionId],
+              branchName: effectiveBranch,
+              commitMessage: bundleSpec.commitMessage ?? `Update ${bundleSpec.name}`,
+            });
+
+            configBundles[bundleSpec.name] = {
+              bundleId: result.bundleId,
+              bundleArn: result.bundleArn,
+              versionId: result.versionId,
+            };
+
+            results.push({
+              bundleName: bundleSpec.name,
+              status: 'updated',
+              bundleId: result.bundleId,
+              bundleArn: result.bundleArn,
+              versionId: result.versionId,
+            });
+          }
+        } else {
+          // Create new — omit branchName if not in spec so the API uses its default
+          const result = await createConfigurationBundle({
+            region,
+            bundleName: apiBundleName,
+            description: bundleSpec.description,
+            components: bundleSpec.components as ComponentConfigurationMap,
+            branchName: bundleSpec.branchName,
+            commitMessage: bundleSpec.commitMessage ?? `Create ${bundleSpec.name}`,
+          });
+
+          configBundles[bundleSpec.name] = {
+            bundleId: result.bundleId,
+            bundleArn: result.bundleArn,
+            versionId: result.versionId,
+          };
+
+          results.push({
+            bundleName: bundleSpec.name,
+            status: 'created',
+            bundleId: result.bundleId,
+            bundleArn: result.bundleArn,
+            versionId: result.versionId,
+          });
+        }
+      }
+    } catch (err) {
+      results.push({
+        bundleName: bundleSpec.name,
+        status: 'error',
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  }
+
+  // Delete orphaned bundles (in deployed-state but removed from spec)
+  if (existingBundles) {
+    for (const [bundleName, bundleState] of Object.entries(existingBundles)) {
+      if (!specBundleNames.has(bundleName)) {
+        try {
+          await deleteConfigurationBundle({
+            region,
+            bundleId: bundleState.bundleId,
+          });
+
+          results.push({
+            bundleName,
+            status: 'deleted',
+          });
+        } catch (err) {
+          results.push({
+            bundleName,
+            status: 'error',
+            error: err instanceof Error ? err.message : String(err),
+          });
+        }
+      }
+    }
+  }
+
+  return {
+    results,
+    configBundles,
+    hasErrors: results.some(r => r.status === 'error'),
+  };
+}
+
+// ============================================================================
+// Helpers
+// ============================================================================
+
+async function findBundleByName(region: string, bundleName: string): Promise<{ bundleId: string } | undefined> {
+  try {
+    const result = await listConfigurationBundles({ region, maxResults: 100 });
+    return result.bundles.find(b => b.bundleName === bundleName);
+  } catch {
+    return undefined;
+  }
+}
+
+/** Key-order-independent deep-equal for JSON-serializable objects. */
+function deepEqual(a: unknown, b: unknown): boolean {
+  if (a === b) return true;
+  if (a === null || b === null || typeof a !== typeof b) return false;
+  if (typeof a !== 'object') return false;
+
+  if (Array.isArray(a)) {
+    if (!Array.isArray(b) || a.length !== b.length) return false;
+    return a.every((item, i) => deepEqual(item, b[i]));
+  }
+
+  const aObj = a as Record<string, unknown>;
+  const bObj = b as Record<string, unknown>;
+  const aKeys = Object.keys(aObj);
+  const bKeys = Object.keys(bObj);
+  if (aKeys.length !== bKeys.length) return false;
+  return aKeys.every(key => key in bObj && deepEqual(aObj[key], bObj[key]));
+}
+
+// ============================================================================
+// Component Key Resolution
+// ============================================================================
+
+/**
+ * Resolve placeholder component keys (e.g., {{runtime:name}}, {{gateway:name}})
+ * to actual ARNs from deployed state.
+ */
+export function resolveConfigBundleComponentKeys(
+  projectSpec: AgentCoreProjectSpec,
+  deployedState: DeployedState,
+  targetName: string
+): AgentCoreProjectSpec {
+  const resources = deployedState.targets?.[targetName]?.resources;
+  if (!resources) return projectSpec;
+
+  const resolvedBundles = (projectSpec.configBundles ?? []).map(bundle => {
+    const resolvedComponents: Record<string, { configuration: Record<string, unknown> }> = {};
+
+    for (const [key, value] of Object.entries(bundle.components ?? {})) {
+      const resolvedKey = resolveComponentKey(key, resources);
+      resolvedComponents[resolvedKey] = value;
+    }
+
+    return { ...bundle, components: resolvedComponents };
+  });
+
+  return { ...projectSpec, configBundles: resolvedBundles };
+}
+
+function resolveComponentKey(
+  key: string,
+  resources: NonNullable<DeployedState['targets'][string]['resources']>
+): string {
+  if (key.startsWith('arn:')) return key;
+
+  const gwMatch = /^\{\{gateway:(.+)\}\}$/.exec(key);
+  if (gwMatch) {
+    const gwName = gwMatch[1]!;
+    const httpGw = resources.httpGateways?.[gwName];
+    if (httpGw) return httpGw.gatewayArn;
+    const mcpGw = resources.mcp?.gateways?.[gwName];
+    if (mcpGw) return mcpGw.gatewayArn;
+    throw new Error(
+      `Config bundle references gateway "${gwName}" but it was not found in deployed resources. Ensure the gateway is defined in agentcore.json and deploys successfully.`
+    );
+  }
+
+  const rtMatch = /^\{\{runtime:(.+)\}\}$/.exec(key);
+  if (rtMatch) {
+    const rtName = rtMatch[1]!;
+    const rt = resources.runtimes?.[rtName];
+    if (rt) return rt.runtimeArn;
+    throw new Error(
+      `Config bundle references runtime "${rtName}" but it was not found in deployed resources. Ensure the runtime is defined in agentcore.json and deploys successfully.`
+    );
+  }
+
+  return key;
+}
diff --git a/src/cli/operations/deploy/post-deploy-http-gateways.ts b/src/cli/operations/deploy/post-deploy-http-gateways.ts
new file mode 100644
index 000000000..db18d28a2
--- /dev/null
+++ b/src/cli/operations/deploy/post-deploy-http-gateways.ts
@@ -0,0 +1,628 @@
+import type { AgentCoreProjectSpec, DeployedResourceState, HttpGatewayDeployedState } from '../../../schema';
+import { getCredentialProvider } from '../../aws/account';
+import {
+  createHttpGateway,
+  createHttpGatewayTarget,
+  deleteHttpGateway,
+  deleteHttpGatewayTarget,
+  getHttpGatewayTarget,
+  listAllHttpGateways,
+  listHttpGatewayTargets,
+  waitForGatewayReady,
+  waitForTargetReady,
+} from '../../aws/agentcore-http-gateways';
+import {
+  CreateRoleCommand,
+  DeleteRoleCommand,
+  DeleteRolePolicyCommand,
+  GetRoleCommand,
+  IAMClient,
+  PutRolePolicyCommand,
+} from '@aws-sdk/client-iam';
+import { createHash } from 'node:crypto';
+
+// ============================================================================
+// Types
+// ============================================================================
+
+export interface SetupHttpGatewaysOptions {
+  region: string;
+  projectName: string;
+  projectSpec: AgentCoreProjectSpec;
+  existingHttpGateways?: Record<string, HttpGatewayDeployedState>;
+  deployedResources?: DeployedResourceState;
+}
+
+export interface HttpGatewaySetupResult {
+  gatewayName: string;
+  status: 'created' | 'skipped' | 'deleted' | 'error';
+  gatewayId?: string;
+  gatewayArn?: string;
+  error?: string;
+}
+
+export interface SetupHttpGatewaysResult {
+  results: HttpGatewaySetupResult[];
+  httpGateways: Record<string, HttpGatewayDeployedState>;
+  hasErrors: boolean;
+}
+
+// ============================================================================
+// Constants
+// ============================================================================
+
+const HTTP_GATEWAY_ROLE_POLICY_NAME = 'HttpGatewayExecutionPolicy';
+
+// ============================================================================
+// Implementation
+// ============================================================================
+
+/**
+ * Create or delete HTTP gateways post-deploy.
+ *
+ * Pattern:
+ * 1. For each httpGateway in project spec -> resolve runtime ARN, create or skip
+ * 2. For each httpGateway in deployed-state but NOT in project spec -> delete (reconciliation)
+ * 3. Return updated deployed state entries
+ */
+export async function setupHttpGateways(options: SetupHttpGatewaysOptions): Promise<SetupHttpGatewaysResult> {
+  const { region, projectName, projectSpec, existingHttpGateways, deployedResources } = options;
+  const results: HttpGatewaySetupResult[] = [];
+  const httpGateways: Record<string, HttpGatewayDeployedState> = {};
+
+  // Defensive: Zod .default([]) only fires on undefined, not null.
+  // If someone has "httpGateways": null in their JSON, it passes through as null.
+  const httpGatewaySpecs = projectSpec.httpGateways ?? [];
+
+  // Create or skip gateways from the spec
+  for (const gwSpec of httpGatewaySpecs) {
+    let resolvedRoleArn: string | undefined;
+    let roleCreatedByCli = false;
+    try {
+      const existingGateway = existingHttpGateways?.[gwSpec.name];
+
+      if (existingGateway) {
+        // Already deployed
+
+        // Create or update targets from httpGateways[].targets (for target-based AB testing)
+        if (gwSpec.targets && gwSpec.targets.length > 0) {
+          // List existing targets to avoid unnecessary create calls
+          const existingTargetsByName = new Map<string, { targetId: string }>();
+          try {
+            const existingTargets = await listHttpGatewayTargets({
+              region,
+              gatewayId: existingGateway.gatewayId,
+            });
+            for (const t of existingTargets.targets) {
+              existingTargetsByName.set(t.name, { targetId: t.targetId });
+            }
+          } catch {
+            // If list fails, fall through and let create handle 409s
+          }
+
+          for (const tgt of gwSpec.targets) {
+            const existingTarget = existingTargetsByName.get(tgt.name);
+            if (existingTarget) {
+              // Target exists by name — check if qualifier matches
+              try {
+                const targetDetails = await getHttpGatewayTarget({
+                  region,
+                  gatewayId: existingGateway.gatewayId,
+                  targetId: existingTarget.targetId,
+                });
+                const httpConfig = (
+                  targetDetails.targetConfiguration as
+                    | {
+                        http?: {
+                          agentcoreRuntime?: { qualifier?: string };
+                          runtimeTargetConfiguration?: { qualifier?: string };
+                        };
+                      }
+                    | undefined
+                )?.http;
+                const existingQualifier =
+                  httpConfig?.agentcoreRuntime?.qualifier ?? httpConfig?.runtimeTargetConfiguration?.qualifier;
+                const specQualifier = tgt.qualifier ?? 'DEFAULT';
+                if (existingQualifier === specQualifier) {
+                  // Qualifier matches — skip
+                  continue;
+                }
+                // Qualifier differs — delete old target and recreate
+                await deleteHttpGatewayTarget({
+                  region,
+                  gatewayId: existingGateway.gatewayId,
+                  targetId: existingTarget.targetId,
+                });
+              } catch {
+                // If get/delete fails, fall through to create which will handle conflicts
+              }
+            }
+            try {
+              const tgtRuntime = deployedResources?.runtimes?.[tgt.runtimeRef];
+              if (!tgtRuntime) continue;
+              const tgtResult = await createHttpGatewayTarget({
+                region,
+                gatewayId: existingGateway.gatewayId,
+                targetName: tgt.name,
+                runtimeArn: tgtRuntime.runtimeArn,
+                qualifier: tgt.qualifier,
+              });
+              await waitForTargetReady({
+                region,
+                gatewayId: existingGateway.gatewayId,
+                targetId: tgtResult.targetId,
+              });
+            } catch (tgtErr) {
+              if (tgtErr instanceof Error && tgtErr.message.includes('409')) continue;
+              // Non-fatal
+            }
+          }
+        }
+
+        httpGateways[gwSpec.name] = existingGateway;
+        results.push({
+          gatewayName: gwSpec.name,
+          status: 'skipped',
+          gatewayId: existingGateway.gatewayId,
+          gatewayArn: existingGateway.gatewayArn,
+        });
+        continue;
+      }
+
+      // Try to find by name via list (handles re-creation after state loss)
+      const existingByName = await findHttpGatewayByName(region, gwSpec.name);
+      if (existingByName) {
+        console.warn(
+          `Warning: HTTP gateway "${gwSpec.name}" found by name but local state was lost. Target and role state may be incomplete — consider re-deploying.`
+        );
+        httpGateways[gwSpec.name] = {
+          gatewayId: existingByName.gatewayId,
+          gatewayArn: existingByName.gatewayArn,
+          // targetId, roleArn, roleCreatedByCli unknown after state-loss recovery
+        };
+        results.push({
+          gatewayName: gwSpec.name,
+          status: 'skipped',
+          gatewayId: existingByName.gatewayId,
+          gatewayArn: existingByName.gatewayArn,
+        });
+        continue;
+      }
+
+      // Resolve runtime ARN from deployed state
+      const runtimeState = deployedResources?.runtimes?.[gwSpec.runtimeRef];
+      if (!runtimeState) {
+        results.push({
+          gatewayName: gwSpec.name,
+          status: 'error',
+          error: `Runtime "${gwSpec.runtimeRef}" not found in deployed resources. Deploy the runtime before creating an HTTP gateway.`,
+        });
+        continue;
+      }
+      const runtimeArn = runtimeState.runtimeArn;
+      if (gwSpec.roleArn) {
+        resolvedRoleArn = gwSpec.roleArn;
+      } else {
+        resolvedRoleArn = await getOrCreateHttpGatewayRole({
+          region,
+          projectName,
+          gatewayName: gwSpec.name,
+          runtimeArn,
+        });
+        roleCreatedByCli = true;
+      }
+
+      // Create gateway and wait for it to become READY before adding targets
+      // Creating HTTP gateway for runtime
+      const createResult = await createHttpGateway({
+        region,
+        name: gwSpec.name,
+        roleArn: resolvedRoleArn,
+      });
+
+      const readyGateway = await waitForGatewayReady({
+        region,
+        gatewayId: createResult.gatewayId,
+      });
+
+      // Create target pointing to the runtime
+      let targetId: string | undefined;
+      try {
+        const targetResult = await createHttpGatewayTarget({
+          region,
+          gatewayId: createResult.gatewayId,
+          targetName: gwSpec.runtimeRef,
+          runtimeArn,
+        });
+
+        targetId = targetResult.targetId;
+
+        // Wait for target to become ready
+        // Waiting for gateway target to become ready
+        await waitForTargetReady({
+          region,
+          gatewayId: createResult.gatewayId,
+          targetId: targetResult.targetId,
+        });
+      } catch (targetErr) {
+        // Rollback: delete target (if created), wait for deletion, then delete gateway
+        try {
+          if (targetId) {
+            await deleteHttpGatewayTarget({ region, gatewayId: createResult.gatewayId, targetId });
+          }
+        } catch {
+          // Best-effort target cleanup
+        }
+        try {
+          await deleteHttpGateway({ region, gatewayId: createResult.gatewayId });
+        } catch {
+          // Best-effort gateway rollback
+        }
+
+        // Always clean up auto-created role on target failure, regardless of gateway rollback result
+        if (roleCreatedByCli && resolvedRoleArn) {
+          try {
+            await deleteHttpGatewayRole(region, resolvedRoleArn);
+          } catch {
+            // Best-effort role cleanup
+          }
+        }
+
+        results.push({
+          gatewayName: gwSpec.name,
+          status: 'error',
+          error: `Target creation failed, gateway rolled back: ${targetErr instanceof Error ? targetErr.message : String(targetErr)}`,
+        });
+        continue;
+      }
+
+      // Create additional targets from httpGateways[].targets (for target-based AB testing)
+      if (gwSpec.targets && gwSpec.targets.length > 0) {
+        for (const tgt of gwSpec.targets) {
+          try {
+            const tgtRuntime = deployedResources?.runtimes?.[tgt.runtimeRef];
+            if (!tgtRuntime) {
+              // Runtime not deployed, skip this target
+              continue;
+            }
+            const tgtResult = await createHttpGatewayTarget({
+              region,
+              gatewayId: createResult.gatewayId,
+              targetName: tgt.name,
+              runtimeArn: tgtRuntime.runtimeArn,
+              qualifier: tgt.qualifier,
+            });
+            await waitForTargetReady({
+              region,
+              gatewayId: createResult.gatewayId,
+              targetId: tgtResult.targetId,
+            });
+          } catch (tgtErr) {
+            // 409 = already exists, skip
+            if (tgtErr instanceof Error && tgtErr.message.includes('409')) continue;
+            // Non-fatal: log but continue
+          }
+        }
+      }
+
+      httpGateways[gwSpec.name] = {
+        gatewayId: createResult.gatewayId,
+        gatewayArn: createResult.gatewayArn,
+        gatewayUrl: readyGateway.gatewayUrl,
+        targetId,
+        roleArn: resolvedRoleArn,
+        roleCreatedByCli,
+      };
+
+      results.push({
+        gatewayName: gwSpec.name,
+        status: 'created',
+        gatewayId: createResult.gatewayId,
+        gatewayArn: createResult.gatewayArn,
+      });
+    } catch (err) {
+      // If we auto-created a role, clean it up on failure
+      if (roleCreatedByCli && resolvedRoleArn) {
+        try {
+          await deleteHttpGatewayRole(region, resolvedRoleArn);
+        } catch {
+          // Best-effort role cleanup
+        }
+      }
+      results.push({
+        gatewayName: gwSpec.name,
+        status: 'error',
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  }
+
+  // Orphaned gateways are deleted by deleteOrphanedHttpGateways() which runs
+  // as a separate pre-pass. No deletion loop here.
+
+  return {
+    results,
+    httpGateways,
+    hasErrors: results.some(r => r.status === 'error'),
+  };
+}
+
+// ============================================================================
+// Shared Gateway Deletion
+// ============================================================================
+
+/**
+ * Delete an HTTP gateway and all its targets. Best-effort — target failures
+ * are warned but don't prevent gateway deletion attempt.
+ *
+ * Order: targets → gateway → role
+ */
+export async function deleteHttpGatewayWithTargets(options: {
+  region: string;
+  gatewayId: string;
+  gatewayName: string;
+  knownTargetId?: string;
+  roleArn?: string;
+  roleCreatedByCli?: boolean;
+}): Promise<{ success: boolean; error?: string }> {
+  const { region, gatewayId, gatewayName, knownTargetId, roleArn, roleCreatedByCli } = options;
+
+  const targetIds: string[] = [];
+  if (knownTargetId) {
+    targetIds.push(knownTargetId);
+  }
+  try {
+    const targets = await listHttpGatewayTargets({ region, gatewayId, maxResults: 100 });
+    for (const t of targets.targets) {
+      if (!targetIds.includes(t.targetId)) {
+        targetIds.push(t.targetId);
+      }
+    }
+  } catch {
+    // Best-effort — proceed with whatever IDs we have
+  }
+
+  for (const targetId of targetIds) {
+    try {
+      await deleteHttpGatewayTarget({ region, gatewayId, targetId });
+    } catch (err) {
+      console.warn(
+        `Warning: Failed to delete target ${targetId} on gateway "${gatewayName}": ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+
+  const deleteResult = await deleteHttpGateway({ region, gatewayId });
+  if (!deleteResult.success) {
+    return { success: false, error: deleteResult.error };
+  }
+
+  if (roleCreatedByCli && roleArn) {
+    try {
+      await deleteHttpGatewayRole(region, roleArn);
+    } catch {
+      // Best-effort role cleanup
+    }
+  }
+
+  return { success: true };
+}
+
+/**
+ * Delete orphaned HTTP gateways (in deployed-state but removed from spec).
+ * Call before setupHttpGateways.
+ */
+export async function deleteOrphanedHttpGateways(options: {
+  region: string;
+  projectSpec: AgentCoreProjectSpec;
+  existingHttpGateways?: Record<string, HttpGatewayDeployedState>;
+}): Promise<{ results: HttpGatewaySetupResult[]; hasErrors: boolean }> {
+  const { region, projectSpec, existingHttpGateways } = options;
+  if (!existingHttpGateways) return { results: [], hasErrors: false };
+
+  const specGatewayNames = new Set((projectSpec.httpGateways ?? []).map(g => g.name));
+  const results: HttpGatewaySetupResult[] = [];
+
+  for (const [gwName, gwState] of Object.entries(existingHttpGateways)) {
+    if (!specGatewayNames.has(gwName)) {
+      try {
+        const result = await deleteHttpGatewayWithTargets({
+          region,
+          gatewayId: gwState.gatewayId,
+          gatewayName: gwName,
+          knownTargetId: gwState.targetId,
+          roleArn: gwState.roleArn,
+          roleCreatedByCli: gwState.roleCreatedByCli,
+        });
+
+        results.push({
+          gatewayName: gwName,
+          status: result.success ? 'deleted' : 'error',
+          error: result.error,
+        });
+      } catch (err) {
+        results.push({
+          gatewayName: gwName,
+          status: 'error',
+          error: err instanceof Error ? err.message : String(err),
+        });
+      }
+    }
+  }
+
+  return {
+    results,
+    hasErrors: results.some(r => r.status === 'error'),
+  };
+}
+
+// ============================================================================
+// Gateway Trace Delivery
+// ============================================================================
+
+// ============================================================================
+// Helpers
+// ============================================================================
+
+async function findHttpGatewayByName(
+  region: string,
+  name: string
+): Promise<{ gatewayId: string; gatewayArn: string } | undefined> {
+  try {
+    const gateways = await listAllHttpGateways({ region });
+    return gateways.find(gw => gw.name === name);
+  } catch (err) {
+    console.warn(
+      `Warning: Could not list HTTP gateways to check for existing "${name}": ${err instanceof Error ? err.message : String(err)}`
+    );
+    return undefined;
+  }
+}
+
+// ============================================================================
+// IAM Role Management
+// ============================================================================
+
+/**
+ * Generate a project-scoped role name following the CDK pattern:
+ * AgentCore-{ProjectName}-HttpGw{GatewayName}-{Hash}
+ */
+function generateRoleName(projectName: string, gatewayName: string): string {
+  const base = `AgentCore-${projectName}-HttpGw${gatewayName}`;
+  // Use deterministic hash so retries produce the same role name
+  const hash = createHash('sha256').update(`${projectName}:${gatewayName}`).digest('hex').slice(0, 8);
+  // IAM role names max 64 chars
+  return `${base.slice(0, 55)}-${hash}`;
+}
+
+/**
+ * Extract role name from ARN: arn:aws:iam::123456789012:role/RoleName -> RoleName
+ */
+function roleNameFromArn(roleArn: string): string {
+  const parts = roleArn.split('/');
+  return parts[parts.length - 1] ?? roleArn;
+}
+
+interface CreateHttpGatewayRoleOptions {
+  region: string;
+  projectName: string;
+  gatewayName: string;
+  runtimeArn: string;
+}
+
+async function getOrCreateHttpGatewayRole(options: CreateHttpGatewayRoleOptions): Promise<string> {
+  const { region, projectName, gatewayName } = options;
+  const credentials = getCredentialProvider();
+  const iamClient = new IAMClient({ region, credentials });
+
+  const roleName = generateRoleName(projectName, gatewayName);
+
+  const trustPolicy = JSON.stringify({
+    Version: '2012-10-17',
+    Statement: [
+      {
+        Effect: 'Allow',
+        Principal: { Service: 'bedrock-agentcore.amazonaws.com' },
+        Action: 'sts:AssumeRole',
+      },
+    ],
+  });
+
+  const policy = JSON.stringify({
+    Version: '2012-10-17',
+    Statement: [
+      {
+        Sid: 'InvokeRuntimeStatement',
+        Effect: 'Allow',
+        Action: [
+          'bedrock-agentcore:InvokeRuntime',
+          'bedrock-agentcore:InvokeAgent',
+          'bedrock-agentcore:InvokeAgentRuntime',
+        ],
+        // Resource must be '*' because the gateway service invokes runtimes using
+        // a resource identifier that doesn't match the deployed runtime ARN format.
+        // This matches the A/B testing guide's gateway role policy.
+        Resource: '*',
+      },
+    ],
+  });
+
+  let roleArn: string;
+  let needsPropagationWait = false;
+
+  try {
+    const createResult = await iamClient.send(
+      new CreateRoleCommand({
+        RoleName: roleName,
+        AssumeRolePolicyDocument: trustPolicy,
+        Description: `Auto-created execution role for AgentCore HTTP gateway: ${gatewayName}`,
+        Tags: [
+          { Key: 'agentcore:created-by', Value: 'agentcore-cli' },
+          { Key: 'agentcore:project-name', Value: projectName },
+          { Key: 'agentcore:http-gateway-name', Value: gatewayName },
+        ],
+      })
+    );
+
+    roleArn = createResult.Role?.Arn ?? '';
+    if (!roleArn) {
+      throw new Error(`IAM CreateRole succeeded but returned no role ARN for "${roleName}"`);
+    }
+    needsPropagationWait = true;
+  } catch (err: unknown) {
+    // Handle retry after a previous failed deploy left the role behind
+    const errName = (err as { name?: string }).name;
+    if (errName === 'EntityAlreadyExistsException') {
+      // IAM role already exists — reusing
+      const existing = await iamClient.send(new GetRoleCommand({ RoleName: roleName }));
+      roleArn = existing.Role?.Arn ?? '';
+      if (!roleArn) {
+        throw new Error(`Role "${roleName}" already exists but ARN could not be retrieved`);
+      }
+    } else {
+      throw new Error(
+        `Failed to create IAM role "${roleName}" for HTTP gateway "${gatewayName}": ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+
+  // Re-apply the inline policy (idempotent — covers both new and recovered roles)
+  await iamClient.send(
+    new PutRolePolicyCommand({
+      RoleName: roleName,
+      PolicyName: HTTP_GATEWAY_ROLE_POLICY_NAME,
+      PolicyDocument: policy,
+    })
+  );
+
+  if (needsPropagationWait) {
+    // Waiting for IAM role propagation (~15s)
+    await new Promise(resolve => setTimeout(resolve, 15_000));
+  }
+
+  return roleArn;
+}
+
+export async function deleteHttpGatewayRole(region: string, roleArn: string): Promise<void> {
+  const credentials = getCredentialProvider();
+  const iamClient = new IAMClient({ region, credentials });
+  const roleName = roleNameFromArn(roleArn);
+
+  try {
+    // Must delete inline policies before deleting the role
+    await iamClient.send(
+      new DeleteRolePolicyCommand({
+        RoleName: roleName,
+        PolicyName: HTTP_GATEWAY_ROLE_POLICY_NAME,
+      })
+    );
+  } catch {
+    // Policy may not exist
+  }
+
+  try {
+    await iamClient.send(new DeleteRoleCommand({ RoleName: roleName }));
+  } catch {
+    // Role may already be deleted or in use -- best effort
+  }
+}
diff --git a/src/cli/operations/deploy/post-deploy-observability.ts b/src/cli/operations/deploy/post-deploy-observability.ts
index 295392629..0616a65dc 100644
--- a/src/cli/operations/deploy/post-deploy-observability.ts
+++ b/src/cli/operations/deploy/post-deploy-observability.ts
@@ -1,4 +1,4 @@
-import { readCliConfig } from '../../../lib/schemas/io/cli-config';
+import { readGlobalConfigSync } from '../../../lib/schemas/io/global-config';
 import { enableTransactionSearch } from '../../aws/transaction-search';
 
 export interface TransactionSearchSetupOptions {
@@ -31,7 +31,7 @@ export async function setupTransactionSearch(
     return { success: true };
   }
 
-  const config = readCliConfig();
+  const config = readGlobalConfigSync();
   if (config.disableTransactionSearch) {
     return { success: true };
   }
diff --git a/src/cli/operations/deploy/post-deploy-online-evals.ts b/src/cli/operations/deploy/post-deploy-online-evals.ts
new file mode 100644
index 000000000..d1012898d
--- /dev/null
+++ b/src/cli/operations/deploy/post-deploy-online-evals.ts
@@ -0,0 +1,80 @@
+import type { OnlineEvalDeployedState } from '../../../schema/schemas/deployed-state';
+import type { OnlineEvalConfig } from '../../../schema/schemas/primitives/online-eval-config';
+import { updateOnlineEvalExecutionStatus } from '../../aws/agentcore-control';
+
+// ============================================================================
+// Types
+// ============================================================================
+
+export interface EnableOnlineEvalsOptions {
+  region: string;
+  onlineEvalConfigs: OnlineEvalConfig[];
+  deployedOnlineEvalConfigs: Record<string, OnlineEvalDeployedState>;
+}
+
+export interface OnlineEvalEnableResult {
+  configName: string;
+  status: 'enabled' | 'skipped' | 'error';
+  error?: string;
+}
+
+export interface EnableOnlineEvalsResult {
+  results: OnlineEvalEnableResult[];
+  hasErrors: boolean;
+}
+
+// ============================================================================
+// Implementation
+// ============================================================================
+
+/**
+ * Enable online eval configs that have `enableOnCreate: true` in the project spec.
+ *
+ * CFN does not support EnableOnCreate on `AWS::BedrockAgentCore::OnlineEvaluationConfig`,
+ * so configs always deploy as DISABLED. This post-deploy step enables them via API.
+ *
+ * Callers should only pass newly deployed configs (not previously existing ones) to
+ * avoid re-enabling configs a customer intentionally disabled.
+ */
+export async function enableOnlineEvalConfigs(options: EnableOnlineEvalsOptions): Promise<EnableOnlineEvalsResult> {
+  const { region, onlineEvalConfigs, deployedOnlineEvalConfigs } = options;
+  const results: OnlineEvalEnableResult[] = [];
+
+  for (const config of onlineEvalConfigs) {
+    // Default enableOnCreate to true when not explicitly set
+    if (config.enableOnCreate === false) {
+      results.push({ configName: config.name, status: 'skipped' });
+      continue;
+    }
+
+    const deployed = deployedOnlineEvalConfigs[config.name];
+    if (!deployed) {
+      results.push({
+        configName: config.name,
+        status: 'error',
+        error: `Online eval config "${config.name}" not found in deployed state`,
+      });
+      continue;
+    }
+
+    try {
+      await updateOnlineEvalExecutionStatus({
+        region,
+        onlineEvaluationConfigId: deployed.onlineEvaluationConfigId,
+        executionStatus: 'ENABLED',
+      });
+      results.push({ configName: config.name, status: 'enabled' });
+    } catch (err) {
+      results.push({
+        configName: config.name,
+        status: 'error',
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  }
+
+  return {
+    results,
+    hasErrors: results.some(r => r.status === 'error'),
+  };
+}
diff --git a/src/cli/operations/deploy/pre-deploy-identity.ts b/src/cli/operations/deploy/pre-deploy-identity.ts
index 8484f16aa..71e9a3d35 100644
--- a/src/cli/operations/deploy/pre-deploy-identity.ts
+++ b/src/cli/operations/deploy/pre-deploy-identity.ts
@@ -1,6 +1,6 @@
 import { SecureCredentials, readEnvFile } from '../../../lib';
 import type { AgentCoreProjectSpec, Credential } from '../../../schema';
-import { getCredentialProvider } from '../../aws';
+import { createControlClient, getCredentialProvider } from '../../aws';
 import { isNoCredentialsError } from '../../errors';
 import { getAwsLoginGuidance } from '../../external-requirements/checks';
 import { computeDefaultCredentialEnvVarName } from '../../primitives/credential-utils';
@@ -13,7 +13,7 @@ import {
   updateApiKeyProvider,
   updateOAuth2Provider,
 } from '../identity';
-import { BedrockAgentCoreControlClient, GetTokenVaultCommand } from '@aws-sdk/client-bedrock-agentcore-control';
+import { type BedrockAgentCoreControlClient, GetTokenVaultCommand } from '@aws-sdk/client-bedrock-agentcore-control';
 import { CreateKeyCommand, KMSClient } from '@aws-sdk/client-kms';
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -55,19 +55,17 @@ export interface SetupApiKeyProvidersOptions {
 export async function setupApiKeyProviders(options: SetupApiKeyProvidersOptions): Promise<PreDeployIdentityResult> {
   const { projectSpec, configBaseDir, region, runtimeCredentials, enableKmsEncryption } = options;
   const results: ApiKeyProviderSetupResult[] = [];
-  const credentials = getCredentialProvider();
-
   const envVars = await readEnvFile(configBaseDir);
   // Wrap env vars in SecureCredentials and merge with runtime credentials
   const envCredentials = SecureCredentials.fromEnvVars(envVars);
   const allCredentials = runtimeCredentials ? envCredentials.merge(runtimeCredentials) : envCredentials;
 
-  const client = new BedrockAgentCoreControlClient({ region, credentials });
+  const client = createControlClient(region);
 
   // Configure KMS encryption for token vault if enabled
   let kmsKeyArn: string | undefined;
   if (enableKmsEncryption) {
-    const kmsResult = await setupTokenVaultKms(region, credentials, projectSpec);
+    const kmsResult = await setupTokenVaultKms(region, projectSpec);
     if (!kmsResult.success) {
       return {
         results: [
@@ -100,11 +98,10 @@ export async function setupApiKeyProviders(options: SetupApiKeyProvidersOptions)
 
 async function setupTokenVaultKms(
   region: string,
-  credentials: ReturnType<typeof getCredentialProvider>,
   projectSpec: AgentCoreProjectSpec
 ): Promise<{ success: boolean; keyArn?: string; error?: string }> {
   try {
-    const controlClient = new BedrockAgentCoreControlClient({ region, credentials });
+    const controlClient = createControlClient(region);
 
     // Check if the token vault already has a customer-managed key
     try {
@@ -120,7 +117,7 @@ async function setupTokenVaultKms(
     }
 
     // No CMK configured — create a new KMS key and set it on the vault
-    const kmsClient = new KMSClient({ region, credentials });
+    const kmsClient = new KMSClient({ region, credentials: getCredentialProvider() });
     const response = await kmsClient.send(
       new CreateKeyCommand({
         Description: `AgentCore Identity encryption key for ${projectSpec.name}`,
@@ -289,13 +286,12 @@ export interface PreDeployOAuth2Result {
 export async function setupOAuth2Providers(options: SetupOAuth2ProvidersOptions): Promise<PreDeployOAuth2Result> {
   const { projectSpec, configBaseDir, region, runtimeCredentials } = options;
   const results: OAuth2ProviderSetupResult[] = [];
-  const credentials = getCredentialProvider();
 
   const envVars = await readEnvFile(configBaseDir);
   const envCredentials = SecureCredentials.fromEnvVars(envVars);
   const allCredentials = runtimeCredentials ? envCredentials.merge(runtimeCredentials) : envCredentials;
 
-  const client = new BedrockAgentCoreControlClient({ region, credentials });
+  const client = createControlClient(region);
 
   for (const credential of projectSpec.credentials) {
     if (credential.authorizerType === 'OAuthCredentialProvider') {
diff --git a/src/cli/operations/deploy/preflight.ts b/src/cli/operations/deploy/preflight.ts
index 4aa24e71b..34a60fdc2 100644
--- a/src/cli/operations/deploy/preflight.ts
+++ b/src/cli/operations/deploy/preflight.ts
@@ -6,7 +6,7 @@ import { CdkToolkitWrapper, createCdkToolkitWrapper, silentIoHost } from '../../
 import { checkBootstrapStatus, checkStacksStatus, formatCdkEnvironment } from '../../cloudformation';
 import { cleanupStaleLockFiles } from '../../tui/utils';
 import type { IIoHost } from '@aws-cdk/toolkit-lib';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import * as path from 'node:path';
 
 export interface PreflightContext {
@@ -70,6 +70,7 @@ export async function validateProject(): Promise<PreflightContext> {
   cdkProject.validate();
 
   const configIO = new ConfigIO({ baseDir: configRoot });
+
   const projectSpec = await configIO.readProjectSpec();
   const awsTargets = await configIO.resolveAWSDeploymentTargets();
 
@@ -88,7 +89,10 @@ export async function validateProject(): Promise<PreflightContext> {
   // Check for gateways in agentcore.json
   const hasGateways = projectSpec.agentCoreGateways && projectSpec.agentCoreGateways.length > 0;
 
-  if (!hasAgents && !hasGateways && !hasMemories && !hasEvaluators && !hasPolicyEngines) {
+  // Check for harnesses in agentcore.json
+  const hasHarnesses = projectSpec.harnesses && projectSpec.harnesses.length > 0;
+
+  if (!hasAgents && !hasGateways && !hasMemories && !hasEvaluators && !hasPolicyEngines && !hasHarnesses) {
     let hasExistingStack = false;
     try {
       const deployedState = await configIO.readDeployedState();
@@ -98,18 +102,22 @@ export async function validateProject(): Promise<PreflightContext> {
     }
     if (!hasExistingStack) {
       throw new Error(
-        'No resources defined in project. Add at least one resource (agent, memory, evaluator, or gateway) before deploying.'
+        'No resources defined in project. Add at least one resource (agent, memory, evaluator, gateway, or harness) before deploying.'
       );
     }
     isTeardownDeploy = true;
   }
 
-  // Validate runtime names don't exceed AWS limits
+  // Validate runtime and harness names don't exceed AWS limits
   validateRuntimeNames(projectSpec);
+  validateHarnessNames(projectSpec);
 
   // Validate Container agents have Dockerfiles
   validateContainerAgents(projectSpec, configRoot);
 
+  // Validate harnesses with dockerfile field have actual Dockerfiles
+  validateHarnessDockerfiles(projectSpec, configRoot);
+
   // Validate AWS credentials before proceeding with build/synth.
   // Skip for teardown deploys — callers validate after teardown confirmation.
   if (!isTeardownDeploy) {
@@ -139,6 +147,26 @@ function validateRuntimeNames(projectSpec: AgentCoreProjectSpec): void {
   }
 }
 
+/**
+ * Validates that combined harness names (projectName_harnessName) don't exceed AWS limits.
+ */
+function validateHarnessNames(projectSpec: AgentCoreProjectSpec): void {
+  const projectName = projectSpec.name;
+  for (const harness of projectSpec.harnesses || []) {
+    const harnessName = harness.name;
+    if (harnessName) {
+      const combinedName = `${projectName}_${harnessName}`;
+      if (combinedName.length > MAX_RUNTIME_NAME_LENGTH) {
+        throw new Error(
+          `Harness name too long: "${combinedName}" (${combinedName.length} chars). ` +
+            `AWS limits harness names to ${MAX_RUNTIME_NAME_LENGTH} characters. ` +
+            `Shorten the project name or harness name in agentcore.json.`
+        );
+      }
+    }
+  }
+}
+
 /**
  * Validates that Container agents have required Dockerfiles.
  */
@@ -161,6 +189,41 @@ export function validateContainerAgents(projectSpec: AgentCoreProjectSpec, confi
   }
 }
 
+/**
+ * Validates that harnesses specifying a dockerfile have the Dockerfile on disk.
+ */
+export function validateHarnessDockerfiles(projectSpec: AgentCoreProjectSpec, configRoot: string): void {
+  const projectRoot = path.dirname(configRoot);
+  const errors: string[] = [];
+
+  for (const entry of projectSpec.harnesses || []) {
+    const harnessDir = path.join(projectRoot, entry.path);
+    const harnessJsonPath = path.join(harnessDir, 'harness.json');
+
+    let harnessSpec: { dockerfile?: string; containerUri?: string };
+    try {
+      const raw = readFileSync(harnessJsonPath, 'utf-8');
+      harnessSpec = JSON.parse(raw) as { dockerfile?: string; containerUri?: string };
+    } catch {
+      continue; // harness-deployer will report this error with full context
+    }
+
+    if (harnessSpec.dockerfile && !harnessSpec.containerUri) {
+      const dockerfilePath = getDockerfilePath(harnessDir, harnessSpec.dockerfile);
+      if (!existsSync(dockerfilePath)) {
+        errors.push(
+          `Harness "${entry.name}": ${harnessSpec.dockerfile} not found at ${dockerfilePath}. ` +
+            `Harnesses with a "dockerfile" field require the Dockerfile to exist.`
+        );
+      }
+    }
+  }
+
+  if (errors.length > 0) {
+    throw new Error(errors.join('\n'));
+  }
+}
+
 /**
  * Builds the CDK project.
  */
diff --git a/src/cli/operations/deploy/teardown.ts b/src/cli/operations/deploy/teardown.ts
index 28a8f326a..2e38f2576 100644
--- a/src/cli/operations/deploy/teardown.ts
+++ b/src/cli/operations/deploy/teardown.ts
@@ -1,8 +1,11 @@
 import { CONFIG_DIR, ConfigIO } from '../../../lib';
 import type { AwsDeploymentTarget } from '../../../schema';
 import { withTargetRegion } from '../../aws';
+import { deleteConfigurationBundle } from '../../aws/agentcore-config-bundles';
 import { CdkToolkitWrapper, silentIoHost } from '../../cdk/toolkit-lib';
 import { type DiscoveredStack, findStack } from '../../cloudformation/stack-discovery';
+import { deleteOrphanedABTests } from './post-deploy-ab-tests';
+import { deleteOrphanedHttpGateways } from './post-deploy-http-gateways';
 import { StackSelectionStrategy } from '@aws-cdk/toolkit-lib';
 import { existsSync } from 'fs';
 import { join } from 'path';
@@ -111,6 +114,83 @@ export async function performStackTeardown(targetName: string): Promise<StackTea
 
   const discovered = await discoverDeployedTargets();
   const deployedTarget = discovered.deployedTargets.find(dt => dt.target.name === targetName);
+
+  // Clean up imperatively-created resources before stack destruction.
+  // Ordering: AB tests first (they create rules on gateways), then gateways, then bundles.
+  // Delegates to the existing orphan-cleanup functions with an empty spec so everything
+  // is treated as orphaned — reuses stop/poll/delete/role-cleanup logic without duplication.
+  try {
+    const deployedState = await configIO.readDeployedState();
+    const resources = deployedState.targets?.[targetName]?.resources;
+
+    if (resources?.httpGateways || resources?.configBundles || resources?.abTests) {
+      let region = deployedTarget?.target.region;
+      if (!region) {
+        try {
+          const targets = await configIO.resolveAWSDeploymentTargets();
+          const matchingTarget = targets.find(t => t.name === targetName);
+          region = matchingTarget?.region;
+        } catch {
+          // Can't resolve region
+        }
+      }
+      if (!region) {
+        console.warn('Warning: Could not determine region for resource cleanup — resources may need manual deletion');
+      }
+      if (region) {
+        const projectSpec = await configIO.readProjectSpec();
+        const emptySpec = { ...projectSpec, abTests: [], httpGateways: [] };
+
+        if (resources.abTests) {
+          const abResult = await deleteOrphanedABTests({
+            region,
+            projectSpec: emptySpec,
+            existingABTests: resources.abTests,
+          });
+          for (const r of abResult.results) {
+            if (r.status === 'deleted') {
+              console.log(`Deleted AB test "${r.testName}"`);
+            } else if (r.error) {
+              console.warn(`Warning: Failed to delete AB test "${r.testName}": ${r.error}`);
+            }
+          }
+        }
+
+        if (resources.httpGateways) {
+          const gwResult = await deleteOrphanedHttpGateways({
+            region,
+            projectSpec: emptySpec,
+            existingHttpGateways: resources.httpGateways,
+          });
+          for (const r of gwResult.results) {
+            if (r.status === 'deleted') {
+              console.log(`Deleted HTTP gateway "${r.gatewayName}"`);
+            } else if (r.error) {
+              console.warn(`Warning: Failed to delete HTTP gateway "${r.gatewayName}": ${r.error}`);
+            }
+          }
+        }
+
+        for (const [bundleName, bundleState] of Object.entries(resources.configBundles ?? {})) {
+          try {
+            await deleteConfigurationBundle({ region, bundleId: bundleState.bundleId });
+            console.log(`Deleted config bundle "${bundleName}"`);
+          } catch (err) {
+            console.warn(
+              `Warning: Error during config bundle "${bundleName}" cleanup: ${err instanceof Error ? err.message : String(err)}`
+            );
+          }
+        }
+      }
+    }
+  } catch (err) {
+    // Only suppress "file not found" — other errors (corrupt state, permissions) should warn
+    const msg = err instanceof Error ? err.message : String(err);
+    if (!msg.includes('ENOENT') && !msg.includes('not found') && !msg.includes('does not exist')) {
+      console.warn(`Warning: Could not read deployed state for resource cleanup: ${msg}`);
+    }
+  }
+
   if (deployedTarget) {
     await destroyTarget({ target: deployedTarget, cdkProjectDir });
   }
diff --git a/src/cli/operations/dev/__tests__/config.test.ts b/src/cli/operations/dev/__tests__/config.test.ts
index b6967ac6e..75047d37d 100644
--- a/src/cli/operations/dev/__tests__/config.test.ts
+++ b/src/cli/operations/dev/__tests__/config.test.ts
@@ -21,6 +21,10 @@ describe('getDevConfig', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     const config = getDevConfig(workingDir, project);
@@ -48,6 +52,10 @@ describe('getDevConfig', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     const config = getDevConfig(workingDir, project);
@@ -75,6 +83,10 @@ describe('getDevConfig', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     const config = getDevConfig(workingDir, project, '/test/project/agentcore');
@@ -108,6 +120,10 @@ describe('getDevConfig', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     expect(() => getDevConfig(workingDir, project, undefined, 'NonExistentAgent')).toThrow(
@@ -136,6 +152,10 @@ describe('getDevConfig', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     expect(() => getDevConfig(workingDir, project, undefined, 'NodeAgent')).toThrow('Dev mode only supports Python');
@@ -162,6 +182,10 @@ describe('getDevConfig', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     const config = getDevConfig(workingDir, project, '/test/project/agentcore');
@@ -191,6 +215,10 @@ describe('getDevConfig', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     // No configRoot provided
@@ -220,6 +248,10 @@ describe('getDevConfig', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     const config = getDevConfig(workingDir, project, '/test/project/agentcore');
@@ -249,6 +281,10 @@ describe('getDevConfig', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     const config = getDevConfig(workingDir, project, '/test/project/agentcore');
@@ -277,6 +313,10 @@ describe('getDevConfig', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     const config = getDevConfig(workingDir, project, '/test/project/agentcore');
@@ -305,6 +345,10 @@ describe('getDevConfig', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     const config = getDevConfig(workingDir, project, '/test/project/agentcore');
@@ -333,6 +377,10 @@ describe('getDevConfig', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     const config = getDevConfig(workingDir, project, '/test/project/agentcore');
@@ -361,6 +409,10 @@ describe('getDevConfig', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     const config = getDevConfig(workingDir, project, '/test/project/agentcore');
@@ -390,6 +442,10 @@ describe('getDevConfig', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     const config = getDevConfig(workingDir, project, '/test/project/agentcore');
@@ -432,6 +488,10 @@ describe('getAgentPort', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     expect(getAgentPort(project, 'Agent1', 8080)).toBe(8080);
@@ -450,6 +510,10 @@ describe('getAgentPort', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     expect(getAgentPort(project, 'NonExistent', 9000)).toBe(9000);
@@ -473,6 +537,10 @@ describe('getDevSupportedAgents', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     expect(getDevSupportedAgents(project)).toEqual([]);
@@ -499,6 +567,10 @@ describe('getDevSupportedAgents', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     expect(getDevSupportedAgents(project)).toEqual([]);
@@ -533,6 +605,10 @@ describe('getDevSupportedAgents', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     const supported = getDevSupportedAgents(project);
@@ -561,6 +637,10 @@ describe('getDevSupportedAgents', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     const supported = getDevSupportedAgents(project);
@@ -597,6 +677,10 @@ describe('getDevSupportedAgents', () => {
       onlineEvalConfigs: [],
       agentCoreGateways: [],
       policyEngines: [],
+      harnesses: [],
+      configBundles: [],
+      abTests: [],
+      httpGateways: [],
     };
 
     const supported = getDevSupportedAgents(project);
diff --git a/src/cli/operations/dev/web-ui/__tests__/harness-invocation.test.ts b/src/cli/operations/dev/web-ui/__tests__/harness-invocation.test.ts
new file mode 100644
index 000000000..98d537d53
--- /dev/null
+++ b/src/cli/operations/dev/web-ui/__tests__/harness-invocation.test.ts
@@ -0,0 +1,204 @@
+import { invokeHarness } from '../../../../aws/agentcore-harness.js';
+import type { HarnessStreamEvent } from '../../../../aws/agentcore-harness.js';
+import { handleHarnessInvocation } from '../handlers/harness-invocation.js';
+import type { RouteContext } from '../handlers/route-context.js';
+import type { ServerResponse } from 'http';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('../../../../aws/agentcore-harness.js', () => ({
+  invokeHarness: vi.fn(),
+}));
+
+function mockRes(): ServerResponse & {
+  _status: number;
+  _headers: Record<string, string>;
+  _chunks: string[];
+  _ended: boolean;
+} {
+  const res = {
+    _status: 0,
+    _headers: {} as Record<string, string>,
+    _chunks: [] as string[],
+    _ended: false,
+    headersSent: false,
+    writeHead(status: number, headers?: Record<string, string>) {
+      res._status = status;
+      res.headersSent = true;
+      if (headers) Object.assign(res._headers, headers);
+      return res;
+    },
+    setHeader(name: string, value: string) {
+      res._headers[name] = value;
+    },
+    write(chunk: string) {
+      res._chunks.push(chunk);
+      return true;
+    },
+    end(body?: string) {
+      if (body) res._chunks.push(body);
+      res._ended = true;
+    },
+  };
+  return res as unknown as ServerResponse & {
+    _status: number;
+    _headers: Record<string, string>;
+    _chunks: string[];
+    _ended: boolean;
+  };
+}
+
+function mockCtx(overrides: Partial<RouteContext> = {}): RouteContext {
+  return {
+    options: {
+      mode: 'dev',
+      agents: [],
+      harnesses: [
+        {
+          name: 'test-harness',
+          harnessArn: 'arn:aws:bedrock-agentcore:us-west-2:123:harness/abc',
+          region: 'us-west-2',
+        },
+      ],
+      uiPort: 8081,
+    } as RouteContext['options'],
+    runningAgents: new Map(),
+    startingAgents: new Map(),
+    agentErrors: new Map(),
+    setCorsHeaders: vi.fn(),
+    readBody: vi.fn(),
+    ...overrides,
+  } as unknown as RouteContext;
+}
+
+async function* fakeStream(events: HarnessStreamEvent[]): AsyncGenerator<HarnessStreamEvent> {
+  for (const event of events) {
+    yield await Promise.resolve(event);
+  }
+}
+
+describe('handleHarnessInvocation', () => {
+  beforeEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('returns 400 when harnessName is missing', async () => {
+    const ctx = mockCtx();
+    const res = mockRes();
+
+    await handleHarnessInvocation(ctx, { prompt: 'hello' }, res, undefined);
+
+    expect(res._status).toBe(400);
+    expect(res._chunks[0]).toBeDefined();
+    expect(JSON.parse(res._chunks[0]!)).toEqual({ success: false, error: 'harnessName is required' });
+  });
+
+  it('returns 400 when prompt is missing', async () => {
+    const ctx = mockCtx();
+    const res = mockRes();
+
+    await handleHarnessInvocation(ctx, { harnessName: 'test-harness' }, res, undefined);
+
+    expect(res._status).toBe(400);
+    expect(res._chunks[0]).toBeDefined();
+    expect(JSON.parse(res._chunks[0]!)).toEqual({ success: false, error: 'prompt is required' });
+  });
+
+  it('returns 404 when harness not found in config', async () => {
+    const ctx = mockCtx();
+    const res = mockRes();
+
+    await handleHarnessInvocation(ctx, { harnessName: 'unknown', prompt: 'hello' }, res, undefined);
+
+    expect(res._status).toBe(404);
+    expect(res._chunks[0]).toBeDefined();
+    expect(JSON.parse(res._chunks[0]!)).toEqual({ success: false, error: 'Harness "unknown" not found' });
+  });
+
+  it('streams structured SSE events from harness', async () => {
+    const events: HarnessStreamEvent[] = [
+      { type: 'messageStart', role: 'assistant' },
+      { type: 'contentBlockDelta', contentBlockIndex: 0, delta: { type: 'text', text: 'Hello' } },
+      { type: 'messageStop', stopReason: 'end_turn' },
+      { type: 'metadata', usage: { inputTokens: 10, outputTokens: 5, totalTokens: 15 }, metrics: { latencyMs: 100 } },
+    ];
+    vi.mocked(invokeHarness).mockReturnValue(fakeStream(events));
+
+    const ctx = mockCtx();
+    const res = mockRes();
+
+    await handleHarnessInvocation(
+      ctx,
+      { harnessName: 'test-harness', prompt: 'hello', sessionId: 'sess-1' },
+      res,
+      undefined
+    );
+
+    expect(res._status).toBe(200);
+    expect(res._headers['Content-Type']).toBe('text/event-stream');
+    expect(res._headers['x-session-id']).toBe('sess-1');
+
+    const sseLines = res._chunks.filter(c => c.startsWith('data: '));
+    expect(sseLines).toHaveLength(4);
+    expect(sseLines[0]).toBeDefined();
+    expect(sseLines[1]).toBeDefined();
+    expect(sseLines[2]).toBeDefined();
+    expect(sseLines[3]).toBeDefined();
+    expect(JSON.parse(sseLines[0]!.slice(6))).toEqual({ type: 'messageStart', role: 'assistant' });
+    expect(JSON.parse(sseLines[1]!.slice(6))).toMatchObject({ type: 'contentBlockDelta', delta: { text: 'Hello' } });
+    expect(JSON.parse(sseLines[2]!.slice(6))).toEqual({ type: 'messageStop', stopReason: 'end_turn' });
+    expect(JSON.parse(sseLines[3]!.slice(6))).toMatchObject({ type: 'metadata' });
+  });
+
+  it('passes overrides to invokeHarness', async () => {
+    vi.mocked(invokeHarness).mockReturnValue(
+      fakeStream([
+        { type: 'messageStart', role: 'assistant' },
+        { type: 'messageStop', stopReason: 'end_turn' },
+      ])
+    );
+
+    const ctx = mockCtx();
+    const res = mockRes();
+    const overrides = { maxTokens: 500, systemPrompt: 'Be brief' };
+
+    await handleHarnessInvocation(
+      ctx,
+      { harnessName: 'test-harness', prompt: 'hi', sessionId: 'sess-1', harnessOverrides: overrides },
+      res,
+      undefined
+    );
+
+    expect(invokeHarness).toHaveBeenCalledWith(
+      expect.objectContaining({
+        maxTokens: 500,
+        systemPrompt: [{ text: 'Be brief' }],
+        harnessArn: 'arn:aws:bedrock-agentcore:us-west-2:123:harness/abc',
+        region: 'us-west-2',
+      })
+    );
+  });
+
+  it('streams error event when invokeHarness throws', async () => {
+    vi.mocked(invokeHarness).mockImplementation(() => {
+      throw new Error('AWS credentials expired');
+    });
+
+    const ctx = mockCtx();
+    const res = mockRes();
+
+    await handleHarnessInvocation(
+      ctx,
+      { harnessName: 'test-harness', prompt: 'hello', sessionId: 'sess-1' },
+      res,
+      undefined
+    );
+
+    expect(res._status).toBe(200);
+    const sseLines = res._chunks.filter(c => c.startsWith('data: '));
+    expect(sseLines).toHaveLength(1);
+    expect(sseLines[0]).toBeDefined();
+    const errorEvent = JSON.parse(sseLines[0]!.slice(6));
+    expect(errorEvent.type).toBe('error');
+    expect(errorEvent.message).toContain('AWS credentials expired');
+  });
+});
diff --git a/src/cli/operations/dev/web-ui/__tests__/harness-tool-response.test.ts b/src/cli/operations/dev/web-ui/__tests__/harness-tool-response.test.ts
new file mode 100644
index 000000000..028806fcd
--- /dev/null
+++ b/src/cli/operations/dev/web-ui/__tests__/harness-tool-response.test.ts
@@ -0,0 +1,168 @@
+import { invokeHarness } from '../../../../aws/agentcore-harness.js';
+import type { HarnessStreamEvent } from '../../../../aws/agentcore-harness.js';
+import { handleHarnessToolResponse } from '../handlers/harness-tool-response.js';
+import type { RouteContext } from '../handlers/route-context.js';
+import type { IncomingMessage, ServerResponse } from 'http';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('../../../../aws/agentcore-harness.js', () => ({
+  invokeHarness: vi.fn(),
+}));
+
+function mockReq(): IncomingMessage {
+  return {} as IncomingMessage;
+}
+
+function mockRes(): ServerResponse & {
+  _status: number;
+  _headers: Record<string, string>;
+  _chunks: string[];
+  _ended: boolean;
+} {
+  const res = {
+    _status: 0,
+    _headers: {} as Record<string, string>,
+    _chunks: [] as string[],
+    _ended: false,
+    headersSent: false,
+    writeHead(status: number, headers?: Record<string, string>) {
+      res._status = status;
+      res.headersSent = true;
+      if (headers) Object.assign(res._headers, headers);
+      return res;
+    },
+    setHeader(name: string, value: string) {
+      res._headers[name] = value;
+    },
+    write(chunk: string) {
+      res._chunks.push(chunk);
+      return true;
+    },
+    end(body?: string) {
+      if (body) res._chunks.push(body);
+      res._ended = true;
+    },
+  };
+  return res as unknown as ServerResponse & {
+    _status: number;
+    _headers: Record<string, string>;
+    _chunks: string[];
+    _ended: boolean;
+  };
+}
+
+function mockCtx(overrides: Partial<RouteContext> = {}): RouteContext {
+  return {
+    options: {
+      mode: 'dev',
+      agents: [],
+      harnesses: [
+        {
+          name: 'test-harness',
+          harnessArn: 'arn:aws:bedrock-agentcore:us-west-2:123:harness/abc',
+          region: 'us-west-2',
+        },
+      ],
+      uiPort: 8081,
+    } as RouteContext['options'],
+    runningAgents: new Map(),
+    startingAgents: new Map(),
+    agentErrors: new Map(),
+    setCorsHeaders: vi.fn(),
+    readBody: vi.fn(),
+    ...overrides,
+  } as unknown as RouteContext;
+}
+
+async function* fakeStream(events: HarnessStreamEvent[]): AsyncGenerator<HarnessStreamEvent> {
+  for (const event of events) {
+    yield await Promise.resolve(event);
+  }
+}
+
+describe('handleHarnessToolResponse', () => {
+  beforeEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('returns 400 when harnessName is missing', async () => {
+    const ctx = mockCtx({
+      readBody: vi.fn().mockResolvedValue(JSON.stringify({ sessionId: 's1', messages: [] })),
+    });
+    const res = mockRes();
+
+    await handleHarnessToolResponse(ctx, mockReq(), res, undefined);
+
+    expect(res._status).toBe(400);
+    expect(res._chunks[0]).toBeDefined();
+    expect(JSON.parse(res._chunks[0]!)).toEqual({ success: false, error: 'harnessName is required' });
+  });
+
+  it('returns 400 when messages is missing', async () => {
+    const ctx = mockCtx({
+      readBody: vi.fn().mockResolvedValue(JSON.stringify({ harnessName: 'test-harness', sessionId: 's1' })),
+    });
+    const res = mockRes();
+
+    await handleHarnessToolResponse(ctx, mockReq(), res, undefined);
+
+    expect(res._status).toBe(400);
+    expect(res._chunks[0]).toBeDefined();
+    expect(JSON.parse(res._chunks[0]!)).toEqual({ success: false, error: 'messages array is required' });
+  });
+
+  it('returns 404 when harness not found', async () => {
+    const ctx = mockCtx({
+      readBody: vi.fn().mockResolvedValue(JSON.stringify({ harnessName: 'unknown', sessionId: 's1', messages: [] })),
+    });
+    const res = mockRes();
+
+    await handleHarnessToolResponse(ctx, mockReq(), res, undefined);
+
+    expect(res._status).toBe(404);
+    expect(res._chunks[0]).toBeDefined();
+    expect(JSON.parse(res._chunks[0]!)).toEqual({ success: false, error: 'Harness "unknown" not found' });
+  });
+
+  it('passes messages to invokeHarness and streams SSE response', async () => {
+    const toolMessages = [
+      { role: 'assistant', content: [{ toolUse: { toolUseId: 't1', name: 'search', input: { q: 'test' } } }] },
+      {
+        role: 'user',
+        content: [{ toolResult: { toolUseId: 't1', content: [{ text: 'result' }], status: 'success' } }],
+      },
+    ];
+    vi.mocked(invokeHarness).mockReturnValue(
+      fakeStream([
+        { type: 'messageStart', role: 'assistant' },
+        { type: 'contentBlockDelta', contentBlockIndex: 0, delta: { type: 'text', text: 'Done' } },
+        { type: 'messageStop', stopReason: 'end_turn' },
+      ])
+    );
+
+    const ctx = mockCtx({
+      readBody: vi.fn().mockResolvedValue(
+        JSON.stringify({
+          harnessName: 'test-harness',
+          sessionId: 'sess-1',
+          messages: toolMessages,
+        })
+      ),
+    });
+    const res = mockRes();
+
+    await handleHarnessToolResponse(ctx, mockReq(), res, undefined);
+
+    expect(invokeHarness).toHaveBeenCalledWith(
+      expect.objectContaining({
+        messages: toolMessages,
+        runtimeSessionId: 'sess-1',
+        harnessArn: 'arn:aws:bedrock-agentcore:us-west-2:123:harness/abc',
+      })
+    );
+
+    expect(res._status).toBe(200);
+    const sseLines = res._chunks.filter(c => c.startsWith('data: '));
+    expect(sseLines).toHaveLength(3);
+  });
+});
diff --git a/src/cli/operations/dev/web-ui/__tests__/harness-utils.test.ts b/src/cli/operations/dev/web-ui/__tests__/harness-utils.test.ts
new file mode 100644
index 000000000..a7ac6c67e
--- /dev/null
+++ b/src/cli/operations/dev/web-ui/__tests__/harness-utils.test.ts
@@ -0,0 +1,129 @@
+import type { HarnessInvocationOverrides } from '../api-types.js';
+import { buildInvokeOptions } from '../handlers/harness-utils.js';
+import { describe, expect, it } from 'vitest';
+
+const BASE_ARN = 'arn:aws:bedrock-agentcore:us-west-2:123:harness/abc';
+const REGION = 'us-west-2';
+const SESSION_ID = 'sess-1';
+const MESSAGES = [{ role: 'user' as const, content: [{ text: 'hello' }] }];
+
+describe('buildInvokeOptions', () => {
+  it('sets required fields with no overrides', () => {
+    const opts = buildInvokeOptions(BASE_ARN, REGION, SESSION_ID, MESSAGES);
+
+    expect(opts).toMatchObject({
+      harnessArn: BASE_ARN,
+      region: REGION,
+      runtimeSessionId: SESSION_ID,
+      messages: MESSAGES,
+      maxIterations: 75,
+    });
+  });
+
+  it('forwards model override', () => {
+    const overrides: HarnessInvocationOverrides = {
+      model: { bedrockModelConfig: { modelId: 'anthropic.claude-v2' } },
+    };
+
+    const opts = buildInvokeOptions(BASE_ARN, REGION, SESSION_ID, MESSAGES, overrides);
+
+    expect(opts.model).toEqual({ bedrockModelConfig: { modelId: 'anthropic.claude-v2' } });
+  });
+
+  it('wraps systemPrompt string into HarnessSystemPrompt array', () => {
+    const opts = buildInvokeOptions(BASE_ARN, REGION, SESSION_ID, MESSAGES, {
+      systemPrompt: 'Be concise',
+    });
+
+    expect(opts.systemPrompt).toEqual([{ text: 'Be concise' }]);
+  });
+
+  it('forwards skills', () => {
+    const overrides: HarnessInvocationOverrides = {
+      skills: [{ path: '/tools/search' }],
+    };
+
+    const opts = buildInvokeOptions(BASE_ARN, REGION, SESSION_ID, MESSAGES, overrides);
+
+    expect(opts.skills).toEqual([{ path: '/tools/search' }]);
+  });
+
+  it('forwards actorId', () => {
+    const opts = buildInvokeOptions(BASE_ARN, REGION, SESSION_ID, MESSAGES, {
+      actorId: 'user-42',
+    });
+
+    expect(opts.actorId).toBe('user-42');
+  });
+
+  it('forwards maxIterations', () => {
+    const opts = buildInvokeOptions(BASE_ARN, REGION, SESSION_ID, MESSAGES, {
+      maxIterations: 10,
+    });
+
+    expect(opts.maxIterations).toBe(10);
+  });
+
+  it('forwards maxTokens', () => {
+    const opts = buildInvokeOptions(BASE_ARN, REGION, SESSION_ID, MESSAGES, {
+      maxTokens: 1024,
+    });
+
+    expect(opts.maxTokens).toBe(1024);
+  });
+
+  it('forwards timeoutSeconds', () => {
+    const opts = buildInvokeOptions(BASE_ARN, REGION, SESSION_ID, MESSAGES, {
+      timeoutSeconds: 30,
+    });
+
+    expect(opts.timeoutSeconds).toBe(30);
+  });
+
+  it('forwards allowedTools', () => {
+    const opts = buildInvokeOptions(BASE_ARN, REGION, SESSION_ID, MESSAGES, {
+      allowedTools: ['tool-a', 'tool-b'],
+    });
+
+    expect(opts.allowedTools).toEqual(['tool-a', 'tool-b']);
+  });
+
+  it('forwards tools', () => {
+    const overrides: HarnessInvocationOverrides = {
+      tools: [
+        { type: 'remote_mcp', name: 'my-mcp', config: { url: 'https://example.com' } },
+        { type: 'inline_function', name: 'calc', config: { fn: 'add' } },
+      ],
+    };
+
+    const opts = buildInvokeOptions(BASE_ARN, REGION, SESSION_ID, MESSAGES, overrides);
+
+    expect(opts.tools).toEqual(overrides.tools);
+  });
+
+  it('forwards all overrides together', () => {
+    const overrides: HarnessInvocationOverrides = {
+      model: { openAiModelConfig: { modelId: 'gpt-4' } },
+      systemPrompt: 'You are helpful',
+      skills: [{ path: '/s' }],
+      actorId: 'actor-1',
+      maxIterations: 5,
+      maxTokens: 256,
+      timeoutSeconds: 60,
+      allowedTools: ['tool-x'],
+      tools: [{ type: 'remote_mcp', name: 'mcp-1', config: {} }],
+    };
+
+    const opts = buildInvokeOptions(BASE_ARN, REGION, SESSION_ID, MESSAGES, overrides);
+
+    expect(opts.model).toEqual(overrides.model);
+    expect(opts.systemPrompt).toEqual([{ text: 'You are helpful' }]);
+    expect(opts.skills).toEqual(overrides.skills);
+    expect(opts.actorId).toBe('actor-1');
+    expect(opts.maxIterations).toBe(5);
+    expect(opts.maxTokens).toBe(256);
+    expect(opts.timeoutSeconds).toBe(60);
+    expect(opts.allowedTools).toEqual(['tool-x']);
+    expect(opts.tools).toEqual(overrides.tools);
+  });
+});
diff --git a/src/cli/operations/dev/web-ui/__tests__/status.test.ts b/src/cli/operations/dev/web-ui/__tests__/status.test.ts
new file mode 100644
index 000000000..81e019a5b
--- /dev/null
+++ b/src/cli/operations/dev/web-ui/__tests__/status.test.ts
@@ -0,0 +1,112 @@
+import type { RouteContext } from '../handlers/route-context.js';
+import { handleStatus } from '../handlers/status.js';
+import type { ServerResponse } from 'http';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+function mockRes(): ServerResponse & { _status: number; _headers: Record<string, string>; _body: string } {
+  const res = {
+    _status: 0,
+    _headers: {} as Record<string, string>,
+    _body: '',
+    writeHead(status: number, headers?: Record<string, string>) {
+      res._status = status;
+      if (headers) Object.assign(res._headers, headers);
+      return res;
+    },
+    setHeader(name: string, value: string) {
+      res._headers[name] = value;
+    },
+    end(body?: string) {
+      if (body) res._body = body;
+    },
+  };
+  return res as unknown as ServerResponse & { _status: number; _headers: Record<string, string>; _body: string };
+}
+
+function mockCtx(overrides: Partial<RouteContext> = {}): RouteContext {
+  return {
+    options: {
+      mode: 'dev',
+      agents: [],
+      harnesses: [],
+      uiPort: 8081,
+    } as RouteContext['options'],
+    runningAgents: new Map(),
+    startingAgents: new Map(),
+    agentErrors: new Map(),
+    setCorsHeaders: vi.fn(),
+    readBody: vi.fn(),
+    ...overrides,
+  } as unknown as RouteContext;
+}
+
+describe('handleStatus', () => {
+  beforeEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('returns empty harnesses array when no harnesses configured', () => {
+    const ctx = mockCtx();
+    const res = mockRes();
+
+    handleStatus(ctx, res, undefined);
+
+    const body = JSON.parse(res._body);
+    expect(body.harnesses).toEqual([]);
+  });
+
+  it('includes harnesses in status response', () => {
+    const ctx = mockCtx({
+      options: {
+        mode: 'dev',
+        agents: [{ name: 'my-agent', buildType: 'CodeZip', protocol: 'HTTP' }],
+        harnesses: [
+          {
+            name: 'my-harness',
+            harnessArn: 'arn:aws:bedrock-agentcore:us-west-2:123:harness/abc',
+            region: 'us-west-2',
+          },
+        ],
+        uiPort: 8081,
+      } as RouteContext['options'],
+    });
+    const res = mockRes();
+
+    handleStatus(ctx, res, undefined);
+
+    const body = JSON.parse(res._body);
+    expect(body.agents).toEqual([{ name: 'my-agent', buildType: 'CodeZip', protocol: 'HTTP' }]);
+    expect(body.harnesses).toEqual([{ name: 'my-harness' }]);
+  });
+
+  it('returns harnesses alongside running agents and errors', () => {
+    const agents = new Map([['my-agent', { server: {} as any, port: 8082, protocol: 'HTTP' }]]);
+    const agentErrors = new Map([['broken-agent', { message: 'crash', timestamp: 1 }]]);
+    const ctx = mockCtx({
+      options: {
+        mode: 'dev',
+        agents: [
+          { name: 'my-agent', buildType: 'CodeZip', protocol: 'HTTP' },
+          { name: 'broken-agent', buildType: 'CodeZip', protocol: 'HTTP' },
+        ],
+        harnesses: [
+          { name: 'harness-1', harnessArn: 'arn:1', region: 'us-east-1' },
+          { name: 'harness-2', harnessArn: 'arn:2', region: 'us-west-2' },
+        ],
+        uiPort: 8081,
+      } as RouteContext['options'],
+      runningAgents: agents,
+      agentErrors,
+    });
+    const res = mockRes();
+
+    handleStatus(ctx, res, undefined);
+
+    const body = JSON.parse(res._body);
+    expect(body.harnesses).toHaveLength(2);
+    expect(body.harnesses[0].name).toBe('harness-1');
+    expect(body.harnesses[1].name).toBe('harness-2');
+    expect(body.running).toHaveLength(1);
+    expect(body.errors).toHaveLength(1);
+  });
+});
diff --git a/src/cli/operations/dev/web-ui/api-types.ts b/src/cli/operations/dev/web-ui/api-types.ts
index 8ba57937e..61e0c80a2 100644
--- a/src/cli/operations/dev/web-ui/api-types.ts
+++ b/src/cli/operations/dev/web-ui/api-types.ts
@@ -8,6 +8,7 @@
  * TODO: Extract these types into a shared package so both repos import
  * from a single source of truth instead of manually duplicating.
  */
+import type { HarnessModelConfiguration, HarnessTool } from '../../../aws/agentcore-harness';
 import type { CloudWatchSpanRecord, CloudWatchTraceRecord } from '../../traces/types';
 
 // ---------------------------------------------------------------------------
@@ -17,10 +18,13 @@ import type { CloudWatchSpanRecord, CloudWatchTraceRecord } from '../../traces/t
 /** Response shape for GET /api/status */
 export interface StatusResponse {
   agents: StatusAgent[];
+  harnesses: StatusHarness[];
   running: StatusRunningAgent[];
   errors: StatusAgentError[];
   /** Agent name to pre-select in the UI (set when --runtime is specified) */
   selectedAgent?: string;
+  /** Harness name to pre-select in the UI */
+  selectedHarness?: string;
 }
 
 /** Agent metadata returned in the status response */
@@ -30,6 +34,11 @@ export interface StatusAgent {
   protocol: string;
 }
 
+/** Harness metadata returned in the status response */
+export interface StatusHarness {
+  name: string;
+}
+
 /** Running agent entry in the status response */
 export interface StatusRunningAgent {
   name: string;
@@ -108,6 +117,7 @@ export interface ResourcesResponse {
   success: true;
   project: string;
   agents: ResourceAgent[];
+  harnesses: ResourceHarness[];
   memories: ResourceMemory[];
   credentials: ResourceCredential[];
   gateways: ResourceGateway[];
@@ -133,6 +143,21 @@ export interface ResourceAgent {
   invocationUrl?: string;
 }
 
+/** Deployed state for a harness */
+export interface DeployedHarnessState {
+  harnessId: string;
+  harnessArn: string;
+}
+
+/** Harness details in the resources response */
+export interface ResourceHarness {
+  name: string;
+  model: string;
+  tools: string[];
+  deploymentStatus?: ResourceDeploymentStatus;
+  deployed?: DeployedHarnessState;
+}
+
 /** Memory details in the resources response */
 export interface ResourceMemory {
   name: string;
@@ -252,9 +277,36 @@ export interface StartResponse {
 /** Request body for POST /invocations */
 export interface InvocationRequest {
   agentName?: string;
+  harnessName?: string;
   prompt?: string;
   sessionId?: string;
   userId?: string;
+  harnessOverrides?: HarnessInvocationOverrides;
+}
+
+/** Overrides sent with harness invocations */
+export interface HarnessInvocationOverrides {
+  model?: HarnessModelConfiguration;
+  systemPrompt?: string;
+  skills?: { path: string }[];
+  actorId?: string;
+  maxIterations?: number;
+  maxTokens?: number;
+  timeoutSeconds?: number;
+  allowedTools?: string[];
+  tools?: HarnessTool[];
+}
+
+// ---------------------------------------------------------------------------
+// POST /api/harness/tool-response
+// ---------------------------------------------------------------------------
+
+/** Request body for POST /api/harness/tool-response */
+export interface HarnessToolResponseRequest {
+  harnessName: string;
+  sessionId: string;
+  messages: { role: string; content: Record<string, unknown>[] }[];
+  harnessOverrides?: HarnessInvocationOverrides;
 }
 
 // ---------------------------------------------------------------------------
diff --git a/src/cli/operations/dev/web-ui/constants.ts b/src/cli/operations/dev/web-ui/constants.ts
index 1ff6d9361..d3eafb498 100644
--- a/src/cli/operations/dev/web-ui/constants.ts
+++ b/src/cli/operations/dev/web-ui/constants.ts
@@ -16,3 +16,9 @@ export interface AgentError {
   message: string;
   timestamp: number;
 }
+
+export interface HarnessInfo {
+  name: string;
+  harnessArn: string;
+  region: string;
+}
diff --git a/src/cli/operations/dev/web-ui/handlers/harness-invocation.ts b/src/cli/operations/dev/web-ui/handlers/harness-invocation.ts
new file mode 100644
index 000000000..4e4c464f1
--- /dev/null
+++ b/src/cli/operations/dev/web-ui/handlers/harness-invocation.ts
@@ -0,0 +1,87 @@
+import { invokeHarness } from '../../../../aws/agentcore-harness';
+import type { InvokeHarnessOptions } from '../../../../aws/agentcore-harness';
+import type { HarnessInvocationOverrides } from '../api-types';
+import { buildInvokeOptions } from './harness-utils';
+import type { RouteContext } from './route-context';
+import { randomUUID } from 'node:crypto';
+import type { ServerResponse } from 'node:http';
+
+interface ParsedHarnessRequest {
+  harnessName: string;
+  prompt: string;
+  sessionId: string;
+  userId?: string;
+  overrides?: HarnessInvocationOverrides;
+}
+
+function parseRequest(raw: Record<string, unknown>): { parsed?: ParsedHarnessRequest; error?: string } {
+  const harnessName = raw.harnessName as string | undefined;
+  if (!harnessName) return { error: 'harnessName is required' };
+
+  const prompt = raw.prompt as string | undefined;
+  if (!prompt) return { error: 'prompt is required' };
+
+  return {
+    parsed: {
+      harnessName,
+      prompt,
+      sessionId: (raw.sessionId as string) || randomUUID(),
+      userId: raw.userId as string | undefined,
+      overrides: raw.harnessOverrides as HarnessInvocationOverrides | undefined,
+    },
+  };
+}
+
+export async function handleHarnessInvocation(
+  ctx: RouteContext,
+  body: Record<string, unknown>,
+  res: ServerResponse,
+  origin?: string
+): Promise<void> {
+  const { parsed, error } = parseRequest(body);
+  if (!parsed) {
+    ctx.setCorsHeaders(res, origin);
+    res.writeHead(400, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ success: false, error }));
+    return;
+  }
+
+  const harness = (ctx.options.harnesses ?? []).find(h => h.name === parsed.harnessName);
+  if (!harness) {
+    ctx.setCorsHeaders(res, origin);
+    res.writeHead(404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ success: false, error: `Harness "${parsed.harnessName}" not found` }));
+    return;
+  }
+
+  const messages: InvokeHarnessOptions['messages'] = [{ role: 'user', content: [{ text: parsed.prompt }] }];
+
+  const invokeOpts = buildInvokeOptions(
+    harness.harnessArn,
+    harness.region,
+    parsed.sessionId,
+    messages,
+    parsed.overrides
+  );
+
+  ctx.setCorsHeaders(res, origin);
+  const sseHeaders: Record<string, string> = {
+    'Content-Type': 'text/event-stream',
+    'Cache-Control': 'no-cache',
+    Connection: 'keep-alive',
+    'x-session-id': parsed.sessionId,
+  };
+  res.writeHead(200, sseHeaders);
+
+  try {
+    const stream = invokeHarness(invokeOpts);
+    for await (const event of stream) {
+      res.write(`data: ${JSON.stringify(event)}\n\n`);
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    res.write(`data: ${JSON.stringify({ type: 'error', errorType: 'invocationError', message })}\n\n`);
+  }
+
+  res.end();
+}
diff --git a/src/cli/operations/dev/web-ui/handlers/harness-tool-response.ts b/src/cli/operations/dev/web-ui/handlers/harness-tool-response.ts
new file mode 100644
index 000000000..369ad45d7
--- /dev/null
+++ b/src/cli/operations/dev/web-ui/handlers/harness-tool-response.ts
@@ -0,0 +1,92 @@
+import { invokeHarness } from '../../../../aws/agentcore-harness';
+import type { HarnessInvocationOverrides } from '../api-types';
+import { buildInvokeOptions } from './harness-utils';
+import type { RouteContext } from './route-context';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+
+interface ParsedToolResponseRequest {
+  harnessName: string;
+  sessionId: string;
+  messages: { role: string; content: Record<string, unknown>[] }[];
+  harnessOverrides?: HarnessInvocationOverrides;
+}
+
+function parseToolResponseRequest(body: string): {
+  parsed?: ParsedToolResponseRequest;
+  error?: string;
+  status?: number;
+} {
+  let raw: Record<string, unknown>;
+  try {
+    raw = JSON.parse(body) as Record<string, unknown>;
+  } catch {
+    return { error: 'Invalid JSON', status: 400 };
+  }
+
+  if (!raw.harnessName) return { error: 'harnessName is required', status: 400 };
+  if (!raw.messages || !Array.isArray(raw.messages)) return { error: 'messages array is required', status: 400 };
+  if (!raw.sessionId) return { error: 'sessionId is required', status: 400 };
+
+  return {
+    parsed: {
+      harnessName: raw.harnessName as string,
+      sessionId: raw.sessionId as string,
+      messages: raw.messages as ParsedToolResponseRequest['messages'],
+      harnessOverrides: raw.harnessOverrides as HarnessInvocationOverrides | undefined,
+    },
+  };
+}
+
+export async function handleHarnessToolResponse(
+  ctx: RouteContext,
+  req: IncomingMessage,
+  res: ServerResponse,
+  origin?: string
+): Promise<void> {
+  const body = await ctx.readBody(req);
+
+  const { parsed, error, status } = parseToolResponseRequest(body);
+  if (!parsed) {
+    ctx.setCorsHeaders(res, origin);
+    res.writeHead(status ?? 400, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ success: false, error }));
+    return;
+  }
+
+  const harness = (ctx.options.harnesses ?? []).find(h => h.name === parsed.harnessName);
+  if (!harness) {
+    ctx.setCorsHeaders(res, origin);
+    res.writeHead(404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ success: false, error: `Harness "${parsed.harnessName}" not found` }));
+    return;
+  }
+
+  const invokeOpts = buildInvokeOptions(
+    harness.harnessArn,
+    harness.region,
+    parsed.sessionId,
+    parsed.messages,
+    parsed.harnessOverrides
+  );
+
+  ctx.setCorsHeaders(res, origin);
+  const sseHeaders: Record<string, string> = {
+    'Content-Type': 'text/event-stream',
+    'Cache-Control': 'no-cache',
+    Connection: 'keep-alive',
+    'x-session-id': parsed.sessionId,
+  };
+  res.writeHead(200, sseHeaders);
+
+  try {
+    const stream = invokeHarness(invokeOpts);
+    for await (const event of stream) {
+      res.write(`data: ${JSON.stringify(event)}\n\n`);
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    res.write(`data: ${JSON.stringify({ type: 'error', errorType: 'invocationError', message })}\n\n`);
+  }
+
+  res.end();
+}
diff --git a/src/cli/operations/dev/web-ui/handlers/harness-utils.ts b/src/cli/operations/dev/web-ui/handlers/harness-utils.ts
new file mode 100644
index 000000000..4a2947e9e
--- /dev/null
+++ b/src/cli/operations/dev/web-ui/handlers/harness-utils.ts
@@ -0,0 +1,31 @@
+import type { HarnessSystemPrompt, InvokeHarnessOptions } from '../../../../aws/agentcore-harness';
+import type { HarnessInvocationOverrides } from '../api-types';
+
+const DEFAULT_MAX_ITERATIONS = 75;
+
+export function buildInvokeOptions(
+  harnessArn: string,
+  region: string,
+  sessionId: string,
+  messages: InvokeHarnessOptions['messages'],
+  overrides?: HarnessInvocationOverrides
+): InvokeHarnessOptions {
+  const opts: InvokeHarnessOptions = {
+    region,
+    harnessArn,
+    runtimeSessionId: sessionId,
+    messages,
+  };
+
+  if (overrides?.model) opts.model = overrides.model;
+  if (overrides?.systemPrompt) opts.systemPrompt = [{ text: overrides.systemPrompt }] as HarnessSystemPrompt;
+  if (overrides?.skills) opts.skills = overrides.skills;
+  if (overrides?.actorId) opts.actorId = overrides.actorId;
+  opts.maxIterations = overrides?.maxIterations ?? DEFAULT_MAX_ITERATIONS;
+  if (overrides?.maxTokens != null) opts.maxTokens = overrides.maxTokens;
+  if (overrides?.timeoutSeconds != null) opts.timeoutSeconds = overrides.timeoutSeconds;
+  if (overrides?.allowedTools) opts.allowedTools = overrides.allowedTools;
+  if (overrides?.tools) opts.tools = overrides.tools;
+
+  return opts;
+}
diff --git a/src/cli/operations/dev/web-ui/handlers/index.ts b/src/cli/operations/dev/web-ui/handlers/index.ts
index 0ae7b4f67..8f45106e2 100644
--- a/src/cli/operations/dev/web-ui/handlers/index.ts
+++ b/src/cli/operations/dev/web-ui/handlers/index.ts
@@ -8,3 +8,5 @@ export { handleListCloudWatchTraces, handleGetCloudWatchTrace } from './cloudwat
 export { handleListMemoryRecords, handleRetrieveMemoryRecords } from './memory';
 export { handleMcpProxy } from './mcp-proxy';
 export { handleA2AAgentCard } from './a2a-proxy';
+export { handleHarnessInvocation } from './harness-invocation';
+export { handleHarnessToolResponse } from './harness-tool-response';
diff --git a/src/cli/operations/dev/web-ui/handlers/invocations.ts b/src/cli/operations/dev/web-ui/handlers/invocations.ts
index 3a6b70ed9..1fc073aa7 100644
--- a/src/cli/operations/dev/web-ui/handlers/invocations.ts
+++ b/src/cli/operations/dev/web-ui/handlers/invocations.ts
@@ -1,4 +1,5 @@
 import { extractSSEEventText, extractTaskText, isStatusUpdateEvent } from '../../invoke-a2a';
+import { handleHarnessInvocation } from './harness-invocation';
 import type { RouteContext } from './route-context';
 import { randomUUID } from 'node:crypto';
 import { type IncomingMessage, type ServerResponse, request as httpRequest } from 'node:http';
@@ -17,23 +18,30 @@ export async function handleInvocations(
 ): Promise<void> {
   const body = await ctx.readBody(req);
 
-  let agentPort: number | undefined;
-  let agentName: string | undefined;
-  let agentProtocol: string | undefined;
-  let sessionId: string | undefined;
-  let userId: string | undefined;
+  let parsedBody: Record<string, unknown>;
   try {
-    const parsed = JSON.parse(body) as { agentName?: string; sessionId?: string; userId?: string };
-    agentName = parsed.agentName;
-    sessionId = parsed.sessionId ?? randomUUID();
-    userId = parsed.userId;
-    if (agentName) {
-      const running = ctx.runningAgents.get(agentName);
-      agentPort = running?.port;
-      agentProtocol = running?.protocol;
-    }
+    parsedBody = JSON.parse(body) as Record<string, unknown>;
   } catch {
-    // fall through
+    ctx.setCorsHeaders(res, origin);
+    res.writeHead(400, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ success: false, error: 'Invalid JSON' }));
+    return;
+  }
+
+  // Route to harness handler if harnessName is present
+  if (parsedBody.harnessName) {
+    return handleHarnessInvocation(ctx, parsedBody, res, origin);
+  }
+
+  let agentPort: number | undefined;
+  let agentProtocol: string | undefined;
+  const agentName = parsedBody.agentName as string | undefined;
+  const sessionId = (parsedBody.sessionId as string) || randomUUID();
+  const userId = parsedBody.userId as string | undefined;
+  if (agentName) {
+    const running = ctx.runningAgents.get(agentName);
+    agentPort = running?.port;
+    agentProtocol = running?.protocol;
   }
 
   // Clear any previous runtime error for this agent so stale errors don't persist
diff --git a/src/cli/operations/dev/web-ui/handlers/resources.ts b/src/cli/operations/dev/web-ui/handlers/resources.ts
index a9926ab08..a65ac3e21 100644
--- a/src/cli/operations/dev/web-ui/handlers/resources.ts
+++ b/src/cli/operations/dev/web-ui/handlers/resources.ts
@@ -8,6 +8,7 @@ import type {
   ResourceDeploymentStatus,
   ResourceEvaluator,
   ResourceGateway,
+  ResourceHarness,
   ResourceMemory,
   ResourceOnlineEvalConfig,
   ResourcePolicyEngine,
@@ -106,6 +107,42 @@ export async function handleResources(ctx: RouteContext, res: ServerResponse, or
       }
     }
 
+    // Build harnesses from local config
+    const localHarnessNames = new Set((project.harnesses ?? []).map(h => h.name));
+    const harnesses: ResourceHarness[] = [];
+    for (const h of project.harnesses ?? []) {
+      let model = '';
+      let tools: string[] = [];
+      try {
+        const spec = await configIO.readHarnessSpec(h.name);
+        model = `${spec.model.provider}/${spec.model.modelId}`;
+        tools = spec.tools.map(t => t.name);
+      } catch {
+        // harness spec may be unreadable — show what we can
+      }
+      const deployed = targetResources?.harnesses?.[h.name];
+      harnesses.push({
+        name: h.name,
+        model,
+        tools,
+        deploymentStatus: statusByTypeAndName.get(`harness:${h.name}`),
+        deployed: deployed ? { harnessId: deployed.harnessId, harnessArn: deployed.harnessArn } : undefined,
+      });
+    }
+
+    // Add pending-removal harnesses
+    for (const [name, deployed] of Object.entries(targetResources?.harnesses ?? {})) {
+      if (!localHarnessNames.has(name)) {
+        harnesses.push({
+          name,
+          model: '',
+          tools: [],
+          deploymentStatus: 'pending-removal' as ResourceDeploymentStatus,
+          deployed: { harnessId: deployed.harnessId, harnessArn: deployed.harnessArn },
+        });
+      }
+    }
+
     // Build memories from local config
     const localMemoryNames = new Set(project.memories.map(m => m.name));
     const memories: ResourceMemory[] = project.memories.map(m => ({
@@ -274,6 +311,7 @@ export async function handleResources(ctx: RouteContext, res: ServerResponse, or
         success: true,
         project: project.name,
         agents,
+        harnesses,
         memories,
         credentials,
         gateways,
diff --git a/src/cli/operations/dev/web-ui/handlers/status.ts b/src/cli/operations/dev/web-ui/handlers/status.ts
index 0fdb05500..b6fe0d1fc 100644
--- a/src/cli/operations/dev/web-ui/handlers/status.ts
+++ b/src/cli/operations/dev/web-ui/handlers/status.ts
@@ -1,8 +1,8 @@
-import type { StatusAgentError, StatusRunningAgent } from '../api-types';
+import type { StatusAgentError, StatusHarness, StatusRunningAgent } from '../api-types';
 import type { RouteContext } from './route-context';
 import type { ServerResponse } from 'node:http';
 
-/** GET /api/status — returns available agents, which ones are running, and any errors */
+/** GET /api/status — returns available agents, harnesses, which agents are running, and any errors */
 export function handleStatus(ctx: RouteContext, res: ServerResponse, origin?: string): void {
   const { agents } = ctx.options;
   const running: StatusRunningAgent[] = [];
@@ -11,15 +11,24 @@ export function handleStatus(ctx: RouteContext, res: ServerResponse, origin?: st
     running.push({ name, port });
   }
 
-  // Collect per-agent errors
   const errors: StatusAgentError[] = [];
   for (const [name, agentError] of ctx.agentErrors) {
     errors.push({ name, message: agentError.message });
   }
 
+  const harnesses: StatusHarness[] = (ctx.options.harnesses ?? []).map(h => ({ name: h.name }));
+
   ctx.setCorsHeaders(res, origin);
   res.writeHead(200, { 'Content-Type': 'application/json' });
   res.end(
-    JSON.stringify({ mode: ctx.options.mode, agents, running, errors, selectedAgent: ctx.options.selectedAgent })
+    JSON.stringify({
+      mode: ctx.options.mode,
+      agents,
+      harnesses,
+      running,
+      errors,
+      selectedAgent: ctx.options.selectedAgent,
+      selectedHarness: ctx.options.selectedHarness,
+    })
   );
 }
diff --git a/src/cli/operations/dev/web-ui/web-server.ts b/src/cli/operations/dev/web-ui/web-server.ts
index 2b20b2d07..6b1c421ee 100644
--- a/src/cli/operations/dev/web-ui/web-server.ts
+++ b/src/cli/operations/dev/web-ui/web-server.ts
@@ -1,11 +1,12 @@
 import type { DevConfig } from '../config';
 import type { DevServer } from '../server';
-import { type AgentError, type AgentInfo, WEB_UI_LOCAL_URL } from './constants';
+import { type AgentError, type AgentInfo, type HarnessInfo, WEB_UI_LOCAL_URL } from './constants';
 import {
   type RouteContext,
   handleA2AAgentCard,
   handleGetCloudWatchTrace,
   handleGetTrace,
+  handleHarnessToolResponse,
   handleInvocations,
   handleListCloudWatchTraces,
   handleListMemoryRecords,
@@ -131,6 +132,8 @@ export interface WebUIOptions {
   uiPort: number;
   /** Available agents (metadata only — servers are started on demand) */
   agents: AgentInfo[];
+  /** Deployed harnesses available for invocation (metadata only — no local server needed) */
+  harnesses?: HarnessInfo[];
   /** Dev config factory — called when an agent needs to be started. Required for dev mode, unused when onStart is provided. */
   getDevConfig?: (agentName: string) => DevConfig | null | Promise<DevConfig | null>;
   /** Env vars to pass to started agent servers */
@@ -159,6 +162,8 @@ export interface WebUIOptions {
   onRetrieveMemoryRecords?: RetrieveMemoryRecordsHandler;
   /** Agent to pre-select in the UI dropdown (set when --runtime is specified) */
   selectedAgent?: string;
+  /** Harness to pre-select in the UI dropdown */
+  selectedHarness?: string;
   /** Callback to reload the agents list from config. When provided, the server watches agentcore.json and calls this on change. */
   reloadAgents?: () => Promise<AgentInfo[]>;
 }
@@ -326,6 +331,8 @@ export class WebUIServer {
       await handleListCloudWatchTraces(ctx, req, res, origin);
     } else if (req.method === 'POST' && req.url === '/api/start') {
       await handleStart(ctx, req, res, origin);
+    } else if (req.method === 'POST' && req.url === '/api/harness/tool-response') {
+      await handleHarnessToolResponse(ctx, req, res, origin);
     } else if (req.method === 'POST' && req.url === '/invocations') {
       await handleInvocations(ctx, req, res, origin);
     } else if (req.method === 'POST' && req.url === '/api/mcp') {
diff --git a/src/cli/operations/eval/batch-eval-storage.ts b/src/cli/operations/eval/batch-eval-storage.ts
new file mode 100644
index 000000000..3145120ba
--- /dev/null
+++ b/src/cli/operations/eval/batch-eval-storage.ts
@@ -0,0 +1,75 @@
+import { findConfigRoot } from '../../../lib';
+import type { EvaluationResults } from '../../aws/agentcore-batch-evaluation';
+import type { BatchEvaluationResult, RunBatchEvaluationCommandResult } from './run-batch-evaluation';
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'fs';
+import { join } from 'path';
+
+const BATCH_EVAL_RESULTS_DIR = 'batch-eval-results';
+
+export interface BatchEvalRunRecord {
+  name: string;
+  batchEvaluationId: string;
+  status: string;
+  startedAt?: string;
+  completedAt?: string;
+  evaluators: string[];
+  results: BatchEvaluationResult[];
+  evaluationResults?: EvaluationResults;
+}
+
+function getResultsDir(): string {
+  const configRoot = findConfigRoot();
+  if (!configRoot) {
+    throw new Error('No agentcore project found. Run `agentcore create` first.');
+  }
+  return join(configRoot, '.cli', BATCH_EVAL_RESULTS_DIR);
+}
+
+export function saveBatchEvalRun(result: RunBatchEvaluationCommandResult): string {
+  const dir = getResultsDir();
+  mkdirSync(dir, { recursive: true });
+
+  const id = result.batchEvaluationId ?? 'unknown';
+  const filePath = join(dir, `${id}.json`);
+
+  const record: BatchEvalRunRecord = {
+    name: result.name ?? 'unknown',
+    batchEvaluationId: id,
+    status: result.status ?? 'unknown',
+    startedAt: result.startedAt,
+    completedAt: result.completedAt,
+    evaluators: result.results.map(r => r.evaluatorId),
+    results: result.results,
+    evaluationResults: result.evaluationResults,
+  };
+
+  writeFileSync(filePath, JSON.stringify(record, null, 2));
+  return filePath;
+}
+
+export function loadBatchEvalRun(batchEvaluationId: string): BatchEvalRunRecord {
+  const dir = getResultsDir();
+  const jsonName = batchEvaluationId.endsWith('.json') ? batchEvaluationId : `${batchEvaluationId}.json`;
+  const filePath = join(dir, jsonName);
+
+  if (!existsSync(filePath)) {
+    throw new Error(`Batch evaluation run "${batchEvaluationId}" not found at ${filePath}`);
+  }
+
+  return JSON.parse(readFileSync(filePath, 'utf-8')) as BatchEvalRunRecord;
+}
+
+export function listBatchEvalRuns(): BatchEvalRunRecord[] {
+  const dir = getResultsDir();
+
+  if (!existsSync(dir)) {
+    return [];
+  }
+
+  const files = readdirSync(dir)
+    .filter(f => f.endsWith('.json'))
+    .sort()
+    .reverse();
+
+  return files.map(f => JSON.parse(readFileSync(join(dir, f), 'utf-8')) as BatchEvalRunRecord);
+}
diff --git a/src/cli/operations/eval/run-batch-evaluation.ts b/src/cli/operations/eval/run-batch-evaluation.ts
new file mode 100644
index 000000000..0962f4e0a
--- /dev/null
+++ b/src/cli/operations/eval/run-batch-evaluation.ts
@@ -0,0 +1,347 @@
+/**
+ * Orchestrates running a BatchEvaluation:
+ *   1. Resolve agent from deployed state (for serviceNames / logGroupNames)
+ *   2. Build evaluators + dataSourceConfig
+ *   3. Call StartBatchEvaluation
+ *   4. Poll GetBatchEvaluation until terminal status
+ *   5. Return results
+ */
+import { ConfigIO } from '../../../lib';
+import type { DeployedState } from '../../../schema';
+import { generateClientToken, getBatchEvaluation, startBatchEvaluation } from '../../aws/agentcore-batch-evaluation';
+import type {
+  CloudWatchFilterConfig,
+  EvaluationResults,
+  GetBatchEvaluationResult,
+  SessionMetadataEntry,
+} from '../../aws/agentcore-batch-evaluation';
+import { detectRegion } from '../../aws/region';
+import { ExecLogger } from '../../logging/exec-logger';
+import { CloudWatchLogsClient, GetLogEventsCommand } from '@aws-sdk/client-cloudwatch-logs';
+
+// ============================================================================
+// Types
+// ============================================================================
+
+export interface RunBatchEvaluationOptions {
+  /** Agent name (from project config) */
+  agent: string;
+  /** Evaluator IDs (Builtin.* or custom) */
+  evaluators: string[];
+  /** Optional name for the batch evaluation */
+  name?: string;
+  /** Region override */
+  region?: string;
+  /** Specific session IDs to evaluate (optional — filters CloudWatch source) */
+  sessionIds?: string[];
+  /** Lookback window in days (optional — filters CloudWatch source by time range) */
+  lookbackDays?: number;
+  /** Session metadata with ground truth (assertions, expected trajectory, turns) */
+  sessionMetadata?: SessionMetadataEntry[];
+  /** Poll interval in ms */
+  pollIntervalMs?: number;
+  /** Progress callback */
+  onProgress?: (status: string, message: string) => void;
+  /** Called once the batch evaluation has been created, with ID and region for cancellation */
+  onStarted?: (info: { batchEvaluationId: string; region: string }) => void;
+}
+
+export interface BatchEvaluationResult {
+  evaluatorId: string;
+  score?: number;
+  label?: string;
+  explanation?: string;
+  error?: string;
+}
+
+export interface RunBatchEvaluationCommandResult {
+  success: boolean;
+  error?: string;
+  batchEvaluationId?: string;
+  name?: string;
+  status?: string;
+  results: BatchEvaluationResult[];
+  evaluationResults?: EvaluationResults;
+  startedAt?: string;
+  completedAt?: string;
+  logFilePath?: string;
+}
+
+// ============================================================================
+// Constants
+// ============================================================================
+
+const DEFAULT_POLL_INTERVAL_MS = 10_000;
+const TERMINAL_STATUSES = new Set(['COMPLETED', 'COMPLETED_WITH_ERRORS', 'FAILED', 'STOPPED', 'CANCELLED']);
+
+// ============================================================================
+// Implementation
+// ============================================================================
+
+export async function runBatchEvaluationCommand(
+  options: RunBatchEvaluationOptions
+): Promise<RunBatchEvaluationCommandResult> {
+  const { agent, evaluators, pollIntervalMs = DEFAULT_POLL_INTERVAL_MS, onProgress } = options;
+
+  let logger: ExecLogger | undefined;
+  try {
+    logger = new ExecLogger({ command: 'batch-evaluate' });
+  } catch {
+    // Non-fatal
+  }
+
+  try {
+    // 1. Read project config and deployed state
+    logger?.startStep('Load project config');
+    const configIO = new ConfigIO();
+    const [projectSpec, deployedState, awsTargets] = await Promise.all([
+      configIO.readProjectSpec(),
+      configIO.readDeployedState(),
+      configIO.resolveAWSDeploymentTargets(),
+    ]);
+
+    // Use the deployed target region (from aws-targets) rather than generic detectRegion()
+    const targetRegion = awsTargets.length > 0 ? awsTargets[0]!.region : undefined;
+    const { region: detectedRegion } = await detectRegion();
+    const region = options.region ?? targetRegion ?? detectedRegion;
+    const stage = process.env.AGENTCORE_STAGE?.toLowerCase() ?? 'prod';
+    logger?.log(`Region: ${region}, Stage: ${stage}`);
+    logger?.endStep('success');
+
+    // 2. Resolve agent from deployed state
+    logger?.startStep('Resolve agent');
+    const agentState = resolveAgentState(deployedState, agent);
+    if (!agentState) {
+      const error = `Agent "${agent}" not deployed. Run \`agentcore deploy\` first.`;
+      logger?.log(error, 'error');
+      logger?.endStep('error', error);
+      logger?.finalize(false);
+      return { success: false, error, results: [], logFilePath: logger?.logFilePath };
+    }
+
+    const runtimeId = agentState.runtimeId;
+    // Service name in CW logs uses project_agent format without the CDK hash suffix
+    const serviceName = `${projectSpec.name}_${agent}.DEFAULT`;
+    const runtimeLogGroup = `/aws/bedrock-agentcore/runtimes/${runtimeId}-DEFAULT`;
+
+    logger?.log(`Agent: ${agent} (runtime: ${runtimeId})`);
+    logger?.log(`Service name: ${serviceName}`);
+    logger?.log(`Log group: ${runtimeLogGroup}`);
+    logger?.endStep('success');
+
+    // 2b. Resolve evaluator names to deployed IDs
+    // Handles: "Builtin.Correctness", "arn:aws:...:evaluator/Builtin.Correctness", or custom evaluator names
+    const targetResources = Object.values(deployedState.targets).find(t => t.resources?.runtimes?.[agent])?.resources;
+    const resolvedEvaluators = evaluators.map(name => {
+      // Extract short name from ARN if passed (e.g. "arn:aws:bedrock-agentcore:::evaluator/Builtin.Correctness" → "Builtin.Correctness")
+      const shortName = name.includes('evaluator/') ? name.split('evaluator/').pop()! : name;
+      if (shortName.startsWith('Builtin.')) return shortName;
+      const deployed = targetResources?.evaluators?.[shortName];
+      if (deployed?.evaluatorId) {
+        logger?.log(`Resolved evaluator "${shortName}" → ${deployed.evaluatorId}`);
+        return deployed.evaluatorId;
+      }
+      logger?.log(`Evaluator "${shortName}" not found in deployed state, passing as-is`, 'warn');
+      return shortName;
+    });
+
+    // 3. Start the batch evaluation
+    logger?.startStep('Start batch evaluation');
+    let evalName: string;
+    if (options.name) {
+      if (!/^[a-zA-Z][a-zA-Z0-9_]{0,47}$/.test(options.name)) {
+        return {
+          success: false,
+          error: `Batch evaluation name must start with a letter and contain only letters, digits, and underscores (max 48 chars). Got: "${options.name}"`,
+          results: [],
+          logFilePath: logger?.logFilePath,
+        };
+      }
+      evalName = options.name;
+    } else {
+      evalName = `${projectSpec.name}_${agent}_${Date.now()}`.replace(/[^a-zA-Z0-9_]/g, '_').slice(0, 48);
+    }
+
+    onProgress?.('starting', `Starting batch evaluation "${evalName}"...`);
+
+    // Build optional filter config for CloudWatch filtering
+    // API requires either sessionIds OR timeRange, not both — sessionIds takes precedence
+    // Merge explicit sessionIds with any sessionIds from sessionMetadata (deduplicated)
+    const metadataSessionIds = options.sessionMetadata?.map(m => m.sessionId).filter(Boolean) ?? [];
+    const explicitSessionIds = options.sessionIds ?? [];
+    const effectiveSessionIds = [...new Set([...explicitSessionIds, ...metadataSessionIds])];
+    const hasSessionIds = effectiveSessionIds.length > 0;
+
+    const filterConfig: CloudWatchFilterConfig | undefined = (() => {
+      if (hasSessionIds) {
+        return { sessionIds: effectiveSessionIds };
+      }
+      if (options.lookbackDays) {
+        const endTime = new Date().toISOString();
+        const startTime = new Date(Date.now() - options.lookbackDays * 24 * 60 * 60 * 1000).toISOString();
+        return { timeRange: { startTime, endTime } };
+      }
+      return undefined;
+    })();
+
+    const startPayload = {
+      region,
+      name: evalName,
+      evaluators: resolvedEvaluators.map(id => ({ evaluatorId: id })),
+      dataSourceConfig: {
+        cloudWatchLogs: {
+          serviceNames: [serviceName],
+          logGroupNames: [runtimeLogGroup],
+          ...(filterConfig ? { filterConfig } : {}),
+        },
+      },
+      ...(options.sessionMetadata && options.sessionMetadata.length > 0
+        ? { evaluationMetadata: { sessionMetadata: options.sessionMetadata } }
+        : {}),
+      clientToken: generateClientToken(),
+    };
+
+    logger?.log(`Request payload:\n${JSON.stringify(startPayload, null, 2)}`);
+
+    const startResult = await startBatchEvaluation(startPayload);
+
+    logger?.log(`Response: ${JSON.stringify(startResult, null, 2)}`);
+    logger?.endStep('success');
+
+    onProgress?.('running', `Batch evaluation started (ID: ${startResult.batchEvaluationId})`);
+    onProgress?.('running', 'This may take a few minutes...');
+    options.onStarted?.({ batchEvaluationId: startResult.batchEvaluationId, region });
+
+    // 4. Poll for completion
+    logger?.startStep('Poll for completion');
+    let current: GetBatchEvaluationResult = {
+      batchEvaluationId: startResult.batchEvaluationId,
+      batchEvaluationArn: startResult.batchEvaluationArn,
+      name: startResult.name,
+      status: startResult.status,
+    };
+
+    while (!TERMINAL_STATUSES.has(current.status)) {
+      await sleep(pollIntervalMs);
+
+      current = await getBatchEvaluation({
+        region,
+        batchEvaluationId: startResult.batchEvaluationId,
+      });
+
+      onProgress?.('polling', `Status: ${current.status}`);
+      logger?.log(`Poll status: ${current.status}`);
+    }
+
+    if (current.status !== 'COMPLETED' && current.status !== 'COMPLETED_WITH_ERRORS') {
+      const reasons = current.errorDetails?.join('; ') ?? '';
+      const error = `Batch evaluation finished with status: ${current.status}${reasons ? ` — ${reasons}` : ''}`;
+      logger?.log(error, 'error');
+      logger?.log(`Full poll response:\n${JSON.stringify(current, null, 2)}`, 'error');
+      logger?.endStep('error', error);
+      logger?.finalize(false);
+      return {
+        success: false,
+        error,
+        batchEvaluationId: startResult.batchEvaluationId,
+        name: evalName,
+        status: current.status,
+        results: [],
+        logFilePath: logger?.logFilePath,
+      };
+    }
+
+    logger?.endStep('success');
+
+    // 5. Fetch results from CloudWatch output logs
+    logger?.startStep('Fetch results');
+    let results: BatchEvaluationResult[] = [];
+
+    const cwDest = current.outputConfig?.cloudWatchConfig;
+    if (cwDest) {
+      try {
+        results = await fetchResultsFromCloudWatch(region, cwDest.logGroupName, cwDest.logStreamName);
+        logger?.log(`Fetched ${results.length} result(s) from CloudWatch`);
+      } catch (cwErr: unknown) {
+        logger?.log(`Failed to fetch CW results: ${cwErr instanceof Error ? cwErr.message : String(cwErr)}`, 'error');
+      }
+    }
+
+    logger?.endStep('success');
+
+    logger?.log(`Results: ${JSON.stringify(results, null, 2)}`);
+    logger?.finalize(true);
+
+    return {
+      success: true,
+      batchEvaluationId: startResult.batchEvaluationId,
+      name: evalName,
+      status: current.status,
+      results,
+      evaluationResults: current.evaluationResults,
+      startedAt: current.createdAt,
+      completedAt: current.updatedAt ?? new Date().toISOString(),
+      logFilePath: logger?.logFilePath,
+    };
+  } catch (err) {
+    const error = err instanceof Error ? err.message : String(err);
+    logger?.log(error, 'error');
+    logger?.finalize(false);
+    return { success: false, error, results: [], logFilePath: logger?.logFilePath };
+  }
+}
+
+// ============================================================================
+// Helpers
+// ============================================================================
+
+function resolveAgentState(
+  deployedState: DeployedState,
+  agentName: string
+): { runtimeId: string; runtimeArn: string; roleArn?: string } | undefined {
+  for (const target of Object.values(deployedState.targets)) {
+    const agent = target.resources?.runtimes?.[agentName];
+    if (agent) return agent;
+  }
+  return undefined;
+}
+
+async function fetchResultsFromCloudWatch(
+  region: string,
+  logGroupName: string,
+  logStreamName: string
+): Promise<BatchEvaluationResult[]> {
+  const client = new CloudWatchLogsClient({ region });
+  const response = await client.send(
+    new GetLogEventsCommand({
+      logGroupName,
+      logStreamName,
+      startFromHead: true,
+    })
+  );
+
+  const results: BatchEvaluationResult[] = [];
+  for (const event of response.events ?? []) {
+    if (!event.message) continue;
+    try {
+      const parsed = JSON.parse(event.message) as Record<string, unknown>;
+      const attrs = (parsed.attributes ?? {}) as Record<string, unknown>;
+      const evaluatorId = attrs['gen_ai.evaluation.name'] as string | undefined;
+      if (!evaluatorId) continue;
+
+      results.push({
+        evaluatorId,
+        score: attrs['gen_ai.evaluation.score.value'] as number | undefined,
+        label: attrs['gen_ai.evaluation.score.label'] as string | undefined,
+        explanation: attrs['gen_ai.evaluation.explanation'] as string | undefined,
+      });
+    } catch {
+      // Skip non-JSON or malformed entries
+    }
+  }
+  return results;
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
diff --git a/src/cli/operations/eval/run-eval.ts b/src/cli/operations/eval/run-eval.ts
index d130438ff..90cd519c7 100644
--- a/src/cli/operations/eval/run-eval.ts
+++ b/src/cli/operations/eval/run-eval.ts
@@ -1,12 +1,12 @@
 import { getCredentialProvider } from '../../aws';
 import { evaluate } from '../../aws/agentcore';
+import type { EvaluationReferenceInput } from '../../aws/agentcore';
 import { getEvaluator } from '../../aws/agentcore-control';
 import { DEFAULT_ENDPOINT_NAME } from '../../constants';
 import type { DeployedProjectConfig } from '../resolve-agent';
 import { loadDeployedProjectConfig, resolveAgent } from '../resolve-agent';
 import { generateFilename, saveEvalRun } from './storage';
 import type { EvalEvaluatorResult, EvalRunResult, EvalSessionScore, RunEvalOptions, SessionInfo } from './types';
-import type { EvaluationReferenceInput } from '@aws-sdk/client-bedrock-agentcore';
 import { CloudWatchLogsClient, GetQueryResultsCommand, StartQueryCommand } from '@aws-sdk/client-cloudwatch-logs';
 import type { ResultField } from '@aws-sdk/client-cloudwatch-logs';
 import type { DocumentType } from '@smithy/types';
diff --git a/src/cli/operations/fetch-access/__tests__/fetch-harness-token.test.ts b/src/cli/operations/fetch-access/__tests__/fetch-harness-token.test.ts
new file mode 100644
index 000000000..b10532ada
--- /dev/null
+++ b/src/cli/operations/fetch-access/__tests__/fetch-harness-token.test.ts
@@ -0,0 +1,232 @@
+import { readEnvFile } from '../../../../lib/utils/env';
+import { canFetchHarnessToken, fetchHarnessToken } from '../fetch-harness-token';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('../../../../lib/index.js', () => ({
+  ConfigIO: vi.fn(),
+}));
+
+vi.mock('../../../../lib/utils/env', () => ({
+  readEnvFile: vi.fn(),
+}));
+
+const DISCOVERY_URL = 'https://idp.example.com/.well-known/openid-configuration';
+const TOKEN_ENDPOINT = 'https://idp.example.com/token';
+
+const defaultHarnessSpecCustomJwt = {
+  name: 'myHarness',
+  model: { provider: 'bedrock', modelId: 'anthropic.claude-3-sonnet-20240229-v1:0' },
+  authorizerType: 'CUSTOM_JWT',
+  authorizerConfiguration: {
+    customJwtAuthorizer: {
+      discoveryUrl: DISCOVERY_URL,
+      allowedClients: ['fallback-client'],
+      allowedScopes: ['openid', 'profile'],
+    },
+  },
+};
+
+const defaultHarnessSpecIam = {
+  name: 'myHarness',
+  model: { provider: 'bedrock', modelId: 'anthropic.claude-3-sonnet-20240229-v1:0' },
+};
+
+const defaultDeployedState = {
+  targets: {
+    default: {
+      resources: {
+        harnesses: {
+          myHarness: {
+            harnessArn: 'arn:aws:bedrock:us-east-1:123456789012:harness/h-123',
+          },
+        },
+      },
+    },
+  },
+};
+
+const baseProjectSpec = {
+  name: 'test',
+  version: 1,
+  credentials: [
+    {
+      authorizerType: 'OAuthCredentialProvider',
+      name: 'myHarness-oauth',
+      discoveryUrl: DISCOVERY_URL,
+    },
+  ],
+  runtimes: [],
+  memories: [],
+  evaluators: [],
+  onlineEvalConfigs: [],
+};
+
+function createMockConfigIO(overrides: { deployedState?: any; projectSpec?: any; harnessSpec?: any }) {
+  return {
+    readDeployedState: vi.fn().mockResolvedValue(overrides.deployedState ?? defaultDeployedState),
+    readProjectSpec: vi.fn().mockResolvedValue(overrides.projectSpec ?? baseProjectSpec),
+    readHarnessSpec: vi.fn().mockResolvedValue(overrides.harnessSpec ?? defaultHarnessSpecCustomJwt),
+  } as any;
+}
+
+describe('canFetchHarnessToken', () => {
+  beforeEach(() => {
+    vi.mocked(readEnvFile).mockResolvedValue({
+      AGENTCORE_CREDENTIAL_MYHARNESS_OAUTH_CLIENT_SECRET: 'test-secret',
+    });
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('returns true when all prerequisites met', async () => {
+    const configIO = createMockConfigIO({});
+
+    const result = await canFetchHarnessToken('myHarness', { configIO });
+
+    expect(result).toBe(true);
+  });
+
+  it('returns false when harness is not CUSTOM_JWT', async () => {
+    const configIO = createMockConfigIO({
+      harnessSpec: defaultHarnessSpecIam,
+    });
+
+    const result = await canFetchHarnessToken('myHarness', { configIO });
+
+    expect(result).toBe(false);
+  });
+
+  it('returns false when no managed credential exists', async () => {
+    const configIO = createMockConfigIO({
+      projectSpec: { ...baseProjectSpec, credentials: [] },
+    });
+
+    const result = await canFetchHarnessToken('myHarness', { configIO });
+
+    expect(result).toBe(false);
+  });
+
+  it('returns false when client secret is missing from env', async () => {
+    vi.mocked(readEnvFile).mockResolvedValue({});
+    const configIO = createMockConfigIO({});
+
+    const result = await canFetchHarnessToken('myHarness', { configIO });
+
+    expect(result).toBe(false);
+  });
+
+  it('returns false when readHarnessSpec throws', async () => {
+    const configIO = createMockConfigIO({});
+    configIO.readHarnessSpec.mockRejectedValue(new Error('file not found'));
+
+    const result = await canFetchHarnessToken('myHarness', { configIO });
+
+    expect(result).toBe(false);
+  });
+});
+
+describe('fetchHarnessToken', () => {
+  beforeEach(() => {
+    global.fetch = vi.fn();
+    vi.mocked(readEnvFile).mockResolvedValue({
+      AGENTCORE_CREDENTIAL_MYHARNESS_OAUTH_CLIENT_SECRET: 'test-secret',
+      AGENTCORE_CREDENTIAL_MYHARNESS_OAUTH_CLIENT_ID: 'test-client',
+    });
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('throws for non-CUSTOM_JWT harness', async () => {
+    const configIO = createMockConfigIO({
+      harnessSpec: defaultHarnessSpecIam,
+    });
+
+    await expect(fetchHarnessToken('myHarness', { configIO })).rejects.toThrow('uses AWS_IAM auth, not CUSTOM_JWT');
+  });
+
+  it('throws when no deployed targets exist', async () => {
+    const configIO = createMockConfigIO({
+      deployedState: { targets: {} },
+    });
+
+    await expect(fetchHarnessToken('myHarness', { configIO })).rejects.toThrow(
+      'No deployed targets found. Run `agentcore deploy` first.'
+    );
+  });
+
+  it('throws when customJwtAuthorizer is missing from config', async () => {
+    const configIO = createMockConfigIO({
+      harnessSpec: {
+        ...defaultHarnessSpecCustomJwt,
+        authorizerConfiguration: {},
+      },
+    });
+
+    await expect(fetchHarnessToken('myHarness', { configIO })).rejects.toThrow(
+      'has no customJwtAuthorizer configuration'
+    );
+  });
+
+  it('performs OAuth flow and returns token', async () => {
+    vi.mocked(global.fetch)
+      .mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve({ token_endpoint: TOKEN_ENDPOINT }),
+      } as Response)
+      .mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve({ access_token: 'harness-token', expires_in: 3600 }),
+      } as Response);
+
+    const configIO = createMockConfigIO({});
+
+    const result = await fetchHarnessToken('myHarness', { configIO });
+
+    expect(result).toEqual({
+      token: 'harness-token',
+      expiresIn: 3600,
+    });
+  });
+
+  it('passes deployTarget option through to target resolution', async () => {
+    const deployedState = {
+      targets: {
+        staging: {
+          resources: {
+            credentials: {
+              'myHarness-oauth': { clientId: 'staging-client' },
+            },
+          },
+        },
+        prod: {
+          resources: {},
+        },
+      },
+    };
+
+    vi.mocked(global.fetch)
+      .mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve({ token_endpoint: TOKEN_ENDPOINT }),
+      } as Response)
+      .mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve({ access_token: 'staging-token', expires_in: 1800 }),
+      } as Response);
+
+    const configIO = createMockConfigIO({ deployedState });
+
+    const result = await fetchHarnessToken('myHarness', { configIO, deployTarget: 'staging' });
+
+    expect(result.token).toBe('staging-token');
+
+    // Verify it used the staging client ID from deployed state
+    const tokenCall = vi.mocked(global.fetch).mock.calls[1]!;
+    const body = tokenCall[1]?.body as string;
+    expect(body).toContain('client_id=staging-client');
+  });
+});
diff --git a/src/cli/operations/fetch-access/fetch-harness-token.ts b/src/cli/operations/fetch-access/fetch-harness-token.ts
new file mode 100644
index 000000000..654bc5c36
--- /dev/null
+++ b/src/cli/operations/fetch-access/fetch-harness-token.ts
@@ -0,0 +1,83 @@
+import { ConfigIO } from '../../../lib';
+import { readEnvFile } from '../../../lib/utils/env';
+import {
+  computeDefaultCredentialEnvVarName,
+  computeManagedOAuthCredentialName,
+} from '../../primitives/credential-utils';
+import { fetchOAuthToken } from './oauth-token';
+import type { OAuthTokenResult } from './oauth-token';
+
+/**
+ * Check whether auto-fetch is possible for a CUSTOM_JWT harness.
+ * Returns true only if the managed OAuth credential exists in the project
+ * spec AND the client secret is available in .env.local.
+ */
+export async function canFetchHarnessToken(
+  harnessName: string,
+  options: { configIO?: ConfigIO } = {}
+): Promise<boolean> {
+  try {
+    const configIO = options.configIO ?? new ConfigIO();
+    const harnessSpec = await configIO.readHarnessSpec(harnessName);
+
+    if (harnessSpec.authorizerType !== 'CUSTOM_JWT') return false;
+    if (!harnessSpec.authorizerConfiguration?.customJwtAuthorizer) return false;
+
+    const projectSpec = await configIO.readProjectSpec();
+    const credName = computeManagedOAuthCredentialName(harnessName);
+    const hasCredential = projectSpec.credentials.some(
+      c => c.authorizerType === 'OAuthCredentialProvider' && c.name === credName
+    );
+    if (!hasCredential) return false;
+
+    const envVarPrefix = computeDefaultCredentialEnvVarName(credName);
+    const envVars = await readEnvFile();
+    return !!envVars[`${envVarPrefix}_CLIENT_SECRET`];
+  } catch (err) {
+    if (process.env.DEBUG) console.error('[canFetchHarnessToken]', err);
+    return false;
+  }
+}
+
+/**
+ * Fetch an OAuth access token for a CUSTOM_JWT harness.
+ *
+ * Performs OIDC discovery and client_credentials token fetch using the
+ * managed OAuth credential created during harness setup.
+ */
+export async function fetchHarnessToken(
+  harnessName: string,
+  options: { configIO?: ConfigIO; deployTarget?: string } = {}
+): Promise<OAuthTokenResult> {
+  const configIO = options.configIO ?? new ConfigIO();
+
+  const deployedState = await configIO.readDeployedState();
+  const projectSpec = await configIO.readProjectSpec();
+  const harnessSpec = await configIO.readHarnessSpec(harnessName);
+
+  const targetNames = Object.keys(deployedState.targets);
+  if (targetNames.length === 0) {
+    throw new Error('No deployed targets found. Run `agentcore deploy` first.');
+  }
+
+  const targetName = options.deployTarget ?? targetNames[0]!;
+
+  if (harnessSpec.authorizerType !== 'CUSTOM_JWT') {
+    throw new Error(`Harness '${harnessName}' uses ${harnessSpec.authorizerType ?? 'AWS_IAM'} auth, not CUSTOM_JWT.`);
+  }
+
+  const jwtConfig = harnessSpec.authorizerConfiguration?.customJwtAuthorizer;
+  if (!jwtConfig) {
+    throw new Error(
+      `Harness '${harnessName}' is configured as CUSTOM_JWT but has no customJwtAuthorizer configuration.`
+    );
+  }
+
+  return fetchOAuthToken({
+    resourceName: harnessName,
+    jwtConfig,
+    deployedState,
+    targetName,
+    credentials: projectSpec.credentials,
+  });
+}
diff --git a/src/cli/operations/fetch-access/index.ts b/src/cli/operations/fetch-access/index.ts
index 06b7807a7..cbccf9c45 100644
--- a/src/cli/operations/fetch-access/index.ts
+++ b/src/cli/operations/fetch-access/index.ts
@@ -1,4 +1,5 @@
 export { fetchGatewayToken } from './fetch-gateway-token';
+export { canFetchHarnessToken, fetchHarnessToken } from './fetch-harness-token';
 export { canFetchRuntimeToken, fetchRuntimeToken } from './fetch-runtime-token';
 export { fetchOAuthToken } from './oauth-token';
 export type { OAuthTokenResult } from './oauth-token';
diff --git a/src/cli/operations/fetch-access/list-gateways.ts b/src/cli/operations/fetch-access/list-gateways.ts
index 03102ff26..0e70559ce 100644
--- a/src/cli/operations/fetch-access/list-gateways.ts
+++ b/src/cli/operations/fetch-access/list-gateways.ts
@@ -30,5 +30,17 @@ export async function listGateways(
     });
   }
 
+  // Include HTTP gateways (auto-created for A/B testing)
+  const deployedHttpGateways = target.resources?.httpGateways ?? {};
+  for (const httpGateway of projectSpec.httpGateways ?? []) {
+    const deployed = deployedHttpGateways[httpGateway.name];
+    if (!deployed?.gatewayArn) continue;
+
+    gateways.push({
+      name: httpGateway.name,
+      authType: 'AWS_IAM',
+    });
+  }
+
   return gateways;
 }
diff --git a/src/cli/operations/memory/list-memory-records.ts b/src/cli/operations/memory/list-memory-records.ts
index 8bbf34628..5d0c53828 100644
--- a/src/cli/operations/memory/list-memory-records.ts
+++ b/src/cli/operations/memory/list-memory-records.ts
@@ -1,5 +1,5 @@
-import { getCredentialProvider } from '../../aws';
-import { BedrockAgentCoreClient, ListMemoryRecordsCommand } from '@aws-sdk/client-bedrock-agentcore';
+import { createAgentCoreClient } from '../../aws';
+import { ListMemoryRecordsCommand } from '@aws-sdk/client-bedrock-agentcore';
 
 export interface MemoryRecordEntry {
   memoryRecordId: string;
@@ -33,10 +33,7 @@ export interface ListMemoryRecordsResult {
 export async function listMemoryRecords(options: ListMemoryRecordsOptions): Promise<ListMemoryRecordsResult> {
   const { region, memoryId, namespace, memoryStrategyId, maxResults = 50, nextToken } = options;
 
-  const client = new BedrockAgentCoreClient({
-    region,
-    credentials: getCredentialProvider(),
-  });
+  const client = createAgentCoreClient(region);
 
   try {
     const response = await client.send(
diff --git a/src/cli/operations/memory/retrieve-memory-records.ts b/src/cli/operations/memory/retrieve-memory-records.ts
index e8d2a65ed..720a45287 100644
--- a/src/cli/operations/memory/retrieve-memory-records.ts
+++ b/src/cli/operations/memory/retrieve-memory-records.ts
@@ -1,6 +1,6 @@
-import { getCredentialProvider } from '../../aws';
+import { createAgentCoreClient } from '../../aws';
 import type { MemoryRecordEntry } from './list-memory-records';
-import { BedrockAgentCoreClient, RetrieveMemoryRecordsCommand } from '@aws-sdk/client-bedrock-agentcore';
+import { RetrieveMemoryRecordsCommand } from '@aws-sdk/client-bedrock-agentcore';
 
 export interface RetrieveMemoryRecordsOptions {
   region: string;
@@ -28,10 +28,7 @@ export async function retrieveMemoryRecords(
 ): Promise<RetrieveMemoryRecordsResult> {
   const { region, memoryId, namespace, searchQuery, memoryStrategyId, topK, maxResults, nextToken } = options;
 
-  const client = new BedrockAgentCoreClient({
-    region,
-    credentials: getCredentialProvider(),
-  });
+  const client = createAgentCoreClient(region);
 
   try {
     const response = await client.send(
diff --git a/src/cli/operations/recommendation/__tests__/apply-to-bundle.test.ts b/src/cli/operations/recommendation/__tests__/apply-to-bundle.test.ts
new file mode 100644
index 000000000..5e0fb668a
--- /dev/null
+++ b/src/cli/operations/recommendation/__tests__/apply-to-bundle.test.ts
@@ -0,0 +1,199 @@
+import type { ConfigIO } from '../../../../lib';
+import type { RecommendationResult } from '../../../aws/agentcore-recommendation';
+import { applyRecommendationToBundle } from '../apply-to-bundle';
+import { describe, expect, it, vi } from 'vitest';
+
+const { RUNTIME_ARN, BUNDLE_ARN, NEW_VERSION_ID } = vi.hoisted(() => ({
+  RUNTIME_ARN: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/myAgent-abc123',
+  BUNDLE_ARN: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:configuration-bundle/MyBundle-xyz789',
+  NEW_VERSION_ID: 'v2-recommendation',
+}));
+
+vi.mock('../../../aws/agentcore-config-bundles', () => ({
+  getConfigurationBundleVersion: vi.fn().mockResolvedValue({
+    bundleArn: BUNDLE_ARN,
+    bundleId: 'MyBundle-xyz789',
+    bundleName: 'MyBundle',
+    versionId: NEW_VERSION_ID,
+    components: {
+      [RUNTIME_ARN]: {
+        configuration: {
+          systemPrompt: 'new improved prompt',
+          temperature: 0.8,
+        },
+      },
+    },
+    lineageMetadata: {
+      commitMessage: 'Recommendation applied',
+    },
+    createdAt: '2026-04-12T00:00:00Z',
+    versionCreatedAt: '2026-04-12T00:00:00Z',
+  }),
+}));
+
+function makeConfigIO(spec: Record<string, unknown>, deployedState?: Record<string, unknown>) {
+  const writeSpecSpy = vi.fn().mockResolvedValue(undefined);
+  const writeDeployedStateSpy = vi.fn().mockResolvedValue(undefined);
+  const configIO = {
+    readProjectSpec: vi.fn().mockResolvedValue(spec),
+    writeProjectSpec: writeSpecSpy,
+    readDeployedState: vi.fn().mockResolvedValue(
+      deployedState ?? {
+        targets: {
+          default: {
+            resources: {
+              configBundles: {
+                MyBundle: {
+                  bundleId: 'MyBundle-xyz789',
+                  bundleArn: BUNDLE_ARN,
+                  versionId: 'v1',
+                },
+              },
+            },
+          },
+        },
+      }
+    ),
+    writeDeployedState: writeDeployedStateSpy,
+  } as unknown as ConfigIO;
+  return { configIO, writeSpecSpy, writeDeployedStateSpy };
+}
+
+function makeSpec(systemPrompt = 'old prompt') {
+  return {
+    name: 'testProject',
+    configBundles: [
+      {
+        name: 'MyBundle',
+        type: 'ConfigurationBundle',
+        components: {
+          [RUNTIME_ARN]: {
+            configuration: {
+              systemPrompt,
+              temperature: 0.7,
+            },
+          },
+        },
+        branchName: 'main',
+        commitMessage: 'Initial',
+      },
+    ],
+  };
+}
+
+describe('applyRecommendationToBundle', () => {
+  it('syncs local config from server-created version by bundle name', async () => {
+    const spec = makeSpec();
+    const { configIO, writeSpecSpy, writeDeployedStateSpy } = makeConfigIO(spec);
+
+    const result: RecommendationResult = {
+      systemPromptRecommendationResult: {
+        recommendedSystemPrompt: 'new improved prompt',
+        configurationBundle: { bundleArn: BUNDLE_ARN, versionId: NEW_VERSION_ID },
+      },
+    };
+
+    const applyResult = await applyRecommendationToBundle(
+      { bundleName: 'MyBundle', result, region: 'us-east-1' },
+      configIO
+    );
+
+    expect(applyResult.success).toBe(true);
+    expect(applyResult.newVersionId).toBe(NEW_VERSION_ID);
+
+    // Verify spec was written with server components
+    expect(writeSpecSpy).toHaveBeenCalledTimes(1);
+    const writtenSpec = writeSpecSpy.mock.calls[0]![0];
+    expect(writtenSpec.configBundles[0].components[RUNTIME_ARN].configuration.systemPrompt).toBe('new improved prompt');
+    // Server version has temperature 0.8 (not local 0.7)
+    expect(writtenSpec.configBundles[0].components[RUNTIME_ARN].configuration.temperature).toBe(0.8);
+    // Commit message from lineage metadata
+    expect(writtenSpec.configBundles[0].commitMessage).toBe('Recommendation applied');
+
+    // Verify deployed state was updated with new version
+    expect(writeDeployedStateSpy).toHaveBeenCalledTimes(1);
+    const writtenState = writeDeployedStateSpy.mock.calls[0]![0];
+    expect(writtenState.targets.default.resources.configBundles.MyBundle.versionId).toBe(NEW_VERSION_ID);
+  });
+
+  it('syncs local config by bundle ARN via deployed state', async () => {
+    const spec = makeSpec();
+    const { configIO } = makeConfigIO(spec);
+
+    const result: RecommendationResult = {
+      systemPromptRecommendationResult: {
+        recommendedSystemPrompt: 'ARN-resolved prompt',
+        configurationBundle: { bundleArn: BUNDLE_ARN, versionId: NEW_VERSION_ID },
+      },
+    };
+
+    const applyResult = await applyRecommendationToBundle(
+      { bundleArn: BUNDLE_ARN, result, region: 'us-east-1' },
+      configIO
+    );
+
+    expect(applyResult.success).toBe(true);
+    expect(applyResult.newVersionId).toBe(NEW_VERSION_ID);
+  });
+
+  it('syncs tool description recommendation result', async () => {
+    const spec = makeSpec();
+    const { configIO } = makeConfigIO(spec);
+
+    const result: RecommendationResult = {
+      toolDescriptionRecommendationResult: {
+        tools: [{ toolName: 'search', recommendedToolDescription: 'new desc' }],
+        configurationBundle: { bundleArn: BUNDLE_ARN, versionId: NEW_VERSION_ID },
+      },
+    };
+
+    const applyResult = await applyRecommendationToBundle(
+      { bundleName: 'MyBundle', result, region: 'us-east-1' },
+      configIO
+    );
+
+    expect(applyResult.success).toBe(true);
+    expect(applyResult.newVersionId).toBe(NEW_VERSION_ID);
+  });
+
+  it('returns error when result has no configurationBundle', async () => {
+    const spec = makeSpec();
+    const { configIO, writeSpecSpy } = makeConfigIO(spec);
+
+    const result: RecommendationResult = {
+      systemPromptRecommendationResult: {
+        recommendedSystemPrompt: 'new prompt',
+      },
+    };
+
+    const applyResult = await applyRecommendationToBundle(
+      { bundleName: 'MyBundle', result, region: 'us-east-1' },
+      configIO
+    );
+
+    expect(applyResult.success).toBe(false);
+    expect(applyResult.error).toContain('does not contain a new config bundle version');
+    expect(writeSpecSpy).not.toHaveBeenCalled();
+  });
+
+  it('returns error when bundle not found in agentcore.json', async () => {
+    const spec = makeSpec();
+    const { configIO, writeSpecSpy } = makeConfigIO(spec);
+
+    const result: RecommendationResult = {
+      systemPromptRecommendationResult: {
+        recommendedSystemPrompt: 'new',
+        configurationBundle: { bundleArn: BUNDLE_ARN, versionId: NEW_VERSION_ID },
+      },
+    };
+
+    const applyResult = await applyRecommendationToBundle(
+      { bundleName: 'NonExistent', result, region: 'us-east-1' },
+      configIO
+    );
+
+    expect(applyResult.success).toBe(false);
+    expect(applyResult.error).toContain('NonExistent');
+    expect(writeSpecSpy).not.toHaveBeenCalled();
+  });
+});
diff --git a/src/cli/operations/recommendation/__tests__/fetch-session-spans.test.ts b/src/cli/operations/recommendation/__tests__/fetch-session-spans.test.ts
new file mode 100644
index 000000000..4395edd23
--- /dev/null
+++ b/src/cli/operations/recommendation/__tests__/fetch-session-spans.test.ts
@@ -0,0 +1,224 @@
+import { fetchSessionSpans } from '../fetch-session-spans';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mockSearchLogs = vi.fn();
+
+vi.mock('../../../aws/cloudwatch', () => ({
+  searchLogs: (...args: unknown[]) => mockSearchLogs(...args),
+}));
+
+/**
+ * Helper: create an async generator from an array of log events.
+ */
+async function* fakeLogStream(events: { timestamp: number; message: string }[]) {
+  for (const e of events) {
+    yield await Promise.resolve(e);
+  }
+}
+
+/** Helper: create an async generator that throws on first iteration. */
+// eslint-disable-next-line require-yield
+async function* fakeErrorStream(error: Error): AsyncGenerator<{ timestamp: number; message: string }> {
+  await Promise.resolve();
+  throw error;
+}
+
+const SESSION_ID = 'sess-abc-123';
+
+function makeSpanRecord(traceId: string, spanId: string) {
+  return {
+    timestamp: Date.now(),
+    message: JSON.stringify({
+      traceId,
+      spanId,
+      scope: { name: 'strands.telemetry.tracer' },
+      attributes: { 'session.id': SESSION_ID },
+      body: {},
+    }),
+  };
+}
+
+function makeLogRecord(traceId: string, spanId: string, sessionId: string) {
+  return {
+    timestamp: Date.now(),
+    message: JSON.stringify({
+      traceId,
+      spanId,
+      attributes: { 'session.id': sessionId },
+      body: {
+        input: { messages: [{ content: { content: 'hello' }, role: 'user' }] },
+        output: { messages: [{ content: { content: 'hi' }, role: 'assistant' }] },
+      },
+    }),
+  };
+}
+
+describe('fetchSessionSpans', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('combines span records and log records for the same session', async () => {
+    const spanEvents = [makeSpanRecord('trace1', 'span1'), makeSpanRecord('trace1', 'span2')];
+    const logEvents = [makeLogRecord('trace1', 'span3', SESSION_ID)];
+
+    // First call = aws/spans, second call = runtime log group
+    mockSearchLogs.mockReturnValueOnce(fakeLogStream(spanEvents)).mockReturnValueOnce(fakeLogStream(logEvents));
+
+    const result = await fetchSessionSpans({
+      region: 'us-east-1',
+      runtimeId: 'myproject_MyAgent-QMd093Gl4O',
+      sessionId: SESSION_ID,
+    });
+
+    expect(result.spans).toHaveLength(3);
+    expect(result.spanRecordCount).toBe(2);
+    expect(result.logRecordCount).toBe(1);
+  });
+
+  it('filters out log records from other sessions', async () => {
+    const spanEvents = [makeSpanRecord('trace1', 'span1')];
+    const logEvents = [
+      makeLogRecord('trace1', 'span2', SESSION_ID),
+      makeLogRecord('trace1', 'span3', 'other-session-id'),
+    ];
+
+    mockSearchLogs.mockReturnValueOnce(fakeLogStream(spanEvents)).mockReturnValueOnce(fakeLogStream(logEvents));
+
+    const result = await fetchSessionSpans({
+      region: 'us-east-1',
+      runtimeId: 'myproject_MyAgent-QMd093Gl4O',
+      sessionId: SESSION_ID,
+    });
+
+    expect(result.spans).toHaveLength(2);
+    expect(result.logRecordCount).toBe(1);
+  });
+
+  it('returns empty spans when no records found', async () => {
+    mockSearchLogs.mockReturnValueOnce(fakeLogStream([])).mockReturnValueOnce(fakeLogStream([]));
+
+    const result = await fetchSessionSpans({
+      region: 'us-east-1',
+      runtimeId: 'myproject_MyAgent-QMd093Gl4O',
+      sessionId: SESSION_ID,
+    });
+
+    expect(result.spans).toHaveLength(0);
+    expect(result.spanRecordCount).toBe(0);
+    expect(result.logRecordCount).toBe(0);
+  });
+
+  it('handles ResourceNotFoundException gracefully (log group does not exist)', async () => {
+    // Spans log group works, runtime log group does not exist
+    mockSearchLogs
+      .mockReturnValueOnce(fakeLogStream([makeSpanRecord('t1', 's1')]))
+      .mockReturnValueOnce(
+        fakeErrorStream(new Error('ResourceNotFoundException: The specified log group does not exist'))
+      );
+
+    const result = await fetchSessionSpans({
+      region: 'us-east-1',
+      runtimeId: 'myproject_MyAgent-QMd093Gl4O',
+      sessionId: SESSION_ID,
+    });
+
+    // Should still return span records from aws/spans
+    expect(result.spans).toHaveLength(1);
+    expect(result.spanRecordCount).toBe(1);
+    expect(result.logRecordCount).toBe(0);
+  });
+
+  it('rethrows non-ResourceNotFoundException errors', async () => {
+    mockSearchLogs
+      .mockReturnValueOnce(fakeLogStream([]))
+      .mockReturnValueOnce(fakeErrorStream(new Error('AccessDeniedException: Not authorized')));
+
+    await expect(
+      fetchSessionSpans({
+        region: 'us-east-1',
+        runtimeId: 'myproject_MyAgent-QMd093Gl4O',
+        sessionId: SESSION_ID,
+      })
+    ).rejects.toThrow('AccessDeniedException');
+  });
+
+  it('skips unparseable log messages', async () => {
+    const spanEvents = [{ timestamp: Date.now(), message: 'not-valid-json' }, makeSpanRecord('trace1', 'span1')];
+
+    mockSearchLogs.mockReturnValueOnce(fakeLogStream(spanEvents)).mockReturnValueOnce(fakeLogStream([]));
+
+    const result = await fetchSessionSpans({
+      region: 'us-east-1',
+      runtimeId: 'myproject_MyAgent-QMd093Gl4O',
+      sessionId: SESSION_ID,
+    });
+
+    expect(result.spans).toHaveLength(1);
+  });
+
+  it('uses correct log group names', async () => {
+    mockSearchLogs.mockReturnValueOnce(fakeLogStream([])).mockReturnValueOnce(fakeLogStream([]));
+
+    await fetchSessionSpans({
+      region: 'us-east-1',
+      runtimeId: 'myproject_MyAgent-QMd093Gl4O',
+      sessionId: SESSION_ID,
+      lookbackDays: 3,
+    });
+
+    expect(mockSearchLogs).toHaveBeenCalledTimes(2);
+
+    // First call: aws/spans
+    const spanCall = mockSearchLogs.mock.calls[0]![0];
+    expect(spanCall.logGroupName).toBe('aws/spans');
+    expect(spanCall.filterPattern).toContain(SESSION_ID);
+
+    // Second call: runtime log group
+    const logCall = mockSearchLogs.mock.calls[1]![0];
+    expect(logCall.logGroupName).toBe('/aws/bedrock-agentcore/runtimes/myproject_MyAgent-QMd093Gl4O-DEFAULT');
+    expect(logCall.filterPattern).toContain('"body" "input"');
+  });
+
+  it('calls onProgress callback', async () => {
+    mockSearchLogs
+      .mockReturnValueOnce(fakeLogStream([makeSpanRecord('t1', 's1')]))
+      .mockReturnValueOnce(fakeLogStream([]));
+
+    const progress: string[] = [];
+    await fetchSessionSpans({
+      region: 'us-east-1',
+      runtimeId: 'rt-123',
+      sessionId: SESSION_ID,
+      onProgress: msg => progress.push(msg),
+    });
+
+    expect(progress.length).toBeGreaterThan(0);
+    expect(progress.some(m => m.includes('span records'))).toBe(true);
+  });
+
+  it('matches log records by session ID in body (fallback)', async () => {
+    // Log record with session ID only in body, not in attributes
+    const logEvent = {
+      timestamp: Date.now(),
+      message: JSON.stringify({
+        traceId: 'trace1',
+        spanId: 'span1',
+        attributes: {},
+        body: {
+          input: { messages: [{ content: { content: `session ${SESSION_ID} data` }, role: 'user' }] },
+        },
+      }),
+    };
+
+    mockSearchLogs.mockReturnValueOnce(fakeLogStream([])).mockReturnValueOnce(fakeLogStream([logEvent]));
+
+    const result = await fetchSessionSpans({
+      region: 'us-east-1',
+      runtimeId: 'rt-123',
+      sessionId: SESSION_ID,
+    });
+
+    expect(result.logRecordCount).toBe(1);
+  });
+});
diff --git a/src/cli/operations/recommendation/__tests__/recommendation-storage.test.ts b/src/cli/operations/recommendation/__tests__/recommendation-storage.test.ts
new file mode 100644
index 000000000..f6a60b6e8
--- /dev/null
+++ b/src/cli/operations/recommendation/__tests__/recommendation-storage.test.ts
@@ -0,0 +1,134 @@
+import { listAllRecommendations, loadRecommendationRun, saveRecommendationRun } from '../recommendation-storage';
+import type { RunRecommendationCommandResult } from '../types';
+import { existsSync, mkdirSync, rmSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mockFindConfigRoot = vi.fn();
+
+vi.mock('../../../../lib', () => ({
+  findConfigRoot: () => mockFindConfigRoot(),
+}));
+
+function makeTmpDir(): string {
+  const dir = join(tmpdir(), `recommendation-storage-test-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+function makeResult(overrides: Partial<RunRecommendationCommandResult> = {}): RunRecommendationCommandResult {
+  return {
+    success: true,
+    recommendationId: 'rec-123',
+    status: 'COMPLETED',
+    startedAt: '2026-03-24T10:00:00.000Z',
+    completedAt: '2026-03-24T10:05:00.000Z',
+    result: {
+      systemPromptRecommendationResult: {
+        recommendedSystemPrompt: 'You are an expert booking assistant.',
+      },
+    },
+    ...overrides,
+  };
+}
+
+describe('recommendation-storage', () => {
+  let tmpDir: string;
+
+  beforeEach(() => {
+    tmpDir = makeTmpDir();
+    mockFindConfigRoot.mockReturnValue(tmpDir);
+  });
+
+  afterEach(() => {
+    if (existsSync(tmpDir)) {
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
+    vi.clearAllMocks();
+  });
+
+  describe('saveRecommendationRun', () => {
+    it('creates directory and writes JSON file', () => {
+      const result = makeResult();
+      const filePath = saveRecommendationRun('rec-123', result, 'SYSTEM_PROMPT_RECOMMENDATION', 'booking-agent', [
+        'Builtin.Helpfulness',
+      ]);
+
+      expect(filePath).toContain('recommendations');
+      expect(filePath).toContain('rec-123.json');
+      expect(existsSync(filePath)).toBe(true);
+    });
+
+    it('writes valid JSON that can be read back', () => {
+      const result = makeResult();
+      saveRecommendationRun('rec-123', result, 'SYSTEM_PROMPT_RECOMMENDATION', 'booking-agent', [
+        'Builtin.Helpfulness',
+      ]);
+
+      const loaded = loadRecommendationRun('rec-123');
+      expect(loaded.recommendationId).toBe('rec-123');
+      expect(loaded.type).toBe('SYSTEM_PROMPT_RECOMMENDATION');
+      expect(loaded.agent).toBe('booking-agent');
+      expect(loaded.evaluators).toEqual(['Builtin.Helpfulness']);
+      expect(loaded.result?.systemPromptRecommendationResult?.recommendedSystemPrompt).toBe(
+        'You are an expert booking assistant.'
+      );
+    });
+  });
+
+  describe('loadRecommendationRun', () => {
+    it('loads a previously saved recommendation', () => {
+      saveRecommendationRun('rec-123', makeResult(), 'SYSTEM_PROMPT_RECOMMENDATION', 'agent', ['eval']);
+      const loaded = loadRecommendationRun('rec-123');
+      expect(loaded.status).toBe('COMPLETED');
+    });
+
+    it('accepts filename with .json extension', () => {
+      saveRecommendationRun('rec-123', makeResult(), 'SYSTEM_PROMPT_RECOMMENDATION', 'agent', ['eval']);
+      const loaded = loadRecommendationRun('rec-123.json');
+      expect(loaded.recommendationId).toBe('rec-123');
+    });
+
+    it('throws for a non-existent recommendation', () => {
+      expect(() => loadRecommendationRun('nonexistent')).toThrow('not found');
+    });
+  });
+
+  describe('listAllRecommendations', () => {
+    it('returns empty array when no recommendations exist', () => {
+      expect(listAllRecommendations()).toEqual([]);
+    });
+
+    it('returns saved recommendations in reverse order', () => {
+      saveRecommendationRun(
+        'rec-aaa',
+        makeResult({ recommendationId: 'rec-aaa' }),
+        'SYSTEM_PROMPT_RECOMMENDATION',
+        'agent',
+        ['eval']
+      );
+      saveRecommendationRun(
+        'rec-zzz',
+        makeResult({ recommendationId: 'rec-zzz' }),
+        'TOOL_DESCRIPTION_RECOMMENDATION',
+        'agent',
+        ['eval']
+      );
+
+      const all = listAllRecommendations();
+      expect(all).toHaveLength(2);
+      expect(all[0]!.recommendationId).toBe('rec-zzz');
+      expect(all[1]!.recommendationId).toBe('rec-aaa');
+    });
+  });
+
+  describe('error when no config root', () => {
+    it('throws when findConfigRoot returns null', () => {
+      mockFindConfigRoot.mockReturnValue(null);
+      expect(() =>
+        saveRecommendationRun('rec-123', makeResult(), 'SYSTEM_PROMPT_RECOMMENDATION', 'agent', ['eval'])
+      ).toThrow('No agentcore project found');
+    });
+  });
+});
diff --git a/src/cli/operations/recommendation/__tests__/run-recommendation.test.ts b/src/cli/operations/recommendation/__tests__/run-recommendation.test.ts
new file mode 100644
index 000000000..b26a59b32
--- /dev/null
+++ b/src/cli/operations/recommendation/__tests__/run-recommendation.test.ts
@@ -0,0 +1,700 @@
+import { runRecommendationCommand } from '../run-recommendation';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+// Mock dependencies — paths are relative to the file under test (run-recommendation.ts)
+const mockReadProjectSpec = vi.fn().mockResolvedValue({ name: 'test-project' });
+const mockReadDeployedState = vi.fn().mockResolvedValue({
+  targets: {
+    default: {
+      resources: {
+        runtimes: {
+          MyAgent: {
+            runtimeId: 'rt-abc123',
+            runtimeArn: 'arn:aws:bedrock:us-east-1:998846730471:agent-runtime/rt-abc123',
+          },
+        },
+        evaluators: {
+          MyEvaluator: {
+            evaluatorArn: 'arn:aws:bedrock-agentcore:us-east-1:998846730471:evaluator/my-eval-abc1234567',
+          },
+        },
+      },
+    },
+  },
+});
+
+vi.mock('../../../../lib', () => ({
+  ConfigIO: class {
+    readProjectSpec = mockReadProjectSpec;
+    readDeployedState = mockReadDeployedState;
+    resolveAWSDeploymentTargets = vi.fn().mockResolvedValue([{ region: 'us-east-1' }]);
+  },
+}));
+
+vi.mock('../../../aws/region', () => ({
+  detectRegion: vi.fn().mockResolvedValue({ region: 'us-east-1' }),
+}));
+
+const mockStartRecommendation = vi.fn();
+const mockGetRecommendation = vi.fn();
+
+vi.mock('../../../aws/agentcore-recommendation', () => ({
+  startRecommendation: (...args: unknown[]) => mockStartRecommendation(...args),
+  getRecommendation: (...args: unknown[]) => mockGetRecommendation(...args),
+}));
+
+const mockFetchSessionSpans = vi.fn();
+vi.mock('../fetch-session-spans', () => ({
+  fetchSessionSpans: (...args: unknown[]) => mockFetchSessionSpans(...args),
+}));
+
+const mockReadFileSync = vi.fn();
+vi.mock('fs', async () => {
+  const actual = await vi.importActual<typeof import('fs')>('fs');
+  return { ...actual, readFileSync: (...args: unknown[]) => mockReadFileSync(...args) };
+});
+
+describe('runRecommendationCommand', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('returns error when agent is not deployed', async () => {
+    mockReadDeployedState.mockResolvedValueOnce({ targets: {} });
+
+    const result = await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'NonExistentAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      inlineContent: 'You are helpful.',
+      traceSource: 'cloudwatch',
+    });
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain('NonExistentAgent');
+    expect(result.error).toContain('not deployed');
+  });
+
+  it('returns error when evaluator cannot be resolved', async () => {
+    const result = await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['UnknownEvaluator'],
+      inputSource: 'inline',
+      inlineContent: 'You are helpful.',
+      traceSource: 'cloudwatch',
+    });
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain('UnknownEvaluator');
+    expect(result.error).toContain('not found');
+  });
+
+  it('returns result on COMPLETED status', async () => {
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-001',
+      recommendationArn: 'arn:rec-001',
+      name: 'test-rec',
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      status: 'PENDING',
+    });
+
+    mockGetRecommendation.mockResolvedValue({
+      recommendationId: 'rec-001',
+      status: 'COMPLETED',
+      createdAt: '2026-03-30T00:00:00Z',
+      completedAt: '2026-03-30T00:01:00Z',
+      recommendationResult: {
+        systemPromptRecommendationResult: {
+          recommendedSystemPrompt: 'Optimized prompt',
+          explanation: 'Made clearer',
+        },
+      },
+    });
+
+    const result = await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      inlineContent: 'You are helpful.',
+      traceSource: 'cloudwatch',
+      pollIntervalMs: 0,
+    });
+
+    expect(result.success).toBe(true);
+    expect(result.recommendationId).toBe('rec-001');
+    expect(result.status).toBe('COMPLETED');
+    expect(result.result?.systemPromptRecommendationResult?.recommendedSystemPrompt).toBe('Optimized prompt');
+  });
+
+  it('returns error on FAILED status', async () => {
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-002',
+      recommendationArn: 'arn:rec-002',
+      name: 'test-rec',
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      status: 'PENDING',
+    });
+
+    mockGetRecommendation.mockResolvedValue({
+      recommendationId: 'rec-002',
+      status: 'FAILED',
+    });
+
+    const result = await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      inlineContent: 'You are helpful.',
+      traceSource: 'cloudwatch',
+      pollIntervalMs: 0,
+    });
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain('FAILED');
+    expect(result.recommendationId).toBe('rec-002');
+  });
+
+  it('expands Builtin.* evaluator to full ARN in startRecommendation call', async () => {
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-003',
+      status: 'COMPLETED',
+    });
+
+    mockGetRecommendation.mockResolvedValue({
+      recommendationId: 'rec-003',
+      status: 'COMPLETED',
+      recommendationResult: {},
+    });
+
+    await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      inlineContent: 'test',
+      traceSource: 'cloudwatch',
+      pollIntervalMs: 0,
+    });
+
+    const callArgs = mockStartRecommendation.mock.calls[0]![0];
+    const evaluators = callArgs.recommendationConfig.systemPromptRecommendationConfig.evaluationConfig.evaluators;
+    expect(evaluators[0].evaluatorArn).toBe('arn:aws:bedrock-agentcore:::evaluator/Builtin.Toxicity');
+  });
+
+  it('uses account ID from runtime ARN in log group ARN', async () => {
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-004',
+      status: 'COMPLETED',
+    });
+
+    mockGetRecommendation.mockResolvedValue({
+      recommendationId: 'rec-004',
+      status: 'COMPLETED',
+      recommendationResult: {},
+    });
+
+    await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      inlineContent: 'test',
+      traceSource: 'cloudwatch',
+      pollIntervalMs: 0,
+    });
+
+    const callArgs = mockStartRecommendation.mock.calls[0]![0];
+    const logGroupArn =
+      callArgs.recommendationConfig.systemPromptRecommendationConfig.agentTraces.cloudwatchLogs.logGroupArns[0];
+    expect(logGroupArn).toContain(':998846730471:');
+    expect(logGroupArn).not.toContain(':*:');
+  });
+
+  it('resolves custom evaluator from deployed state', async () => {
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-005',
+      status: 'COMPLETED',
+    });
+
+    mockGetRecommendation.mockResolvedValue({
+      recommendationId: 'rec-005',
+      status: 'COMPLETED',
+      recommendationResult: {},
+    });
+
+    await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['MyEvaluator'],
+      inputSource: 'inline',
+      inlineContent: 'test',
+      traceSource: 'cloudwatch',
+      pollIntervalMs: 0,
+    });
+
+    const callArgs = mockStartRecommendation.mock.calls[0]![0];
+    const evaluators = callArgs.recommendationConfig.systemPromptRecommendationConfig.evaluationConfig.evaluators;
+    expect(evaluators[0].evaluatorArn).toBe(
+      'arn:aws:bedrock-agentcore:us-east-1:998846730471:evaluator/my-eval-abc1234567'
+    );
+  });
+
+  it('builds TOOL_DESCRIPTION_RECOMMENDATION config with toolName:description pairs', async () => {
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-006',
+      status: 'COMPLETED',
+    });
+
+    mockGetRecommendation.mockResolvedValue({
+      recommendationId: 'rec-006',
+      status: 'COMPLETED',
+      recommendationResult: {},
+    });
+
+    await runRecommendationCommand({
+      type: 'TOOL_DESCRIPTION_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      tools: ['search:Search the web for info', 'calculate:Perform math calculations'],
+      traceSource: 'cloudwatch',
+      pollIntervalMs: 0,
+    });
+
+    const callArgs = mockStartRecommendation.mock.calls[0]![0];
+    const tools =
+      callArgs.recommendationConfig.toolDescriptionRecommendationConfig.toolDescription.toolDescriptionText.tools;
+    expect(tools).toHaveLength(2);
+    expect(tools[0].toolName).toBe('search');
+    expect(tools[0].toolDescription.text).toBe('Search the web for info');
+    expect(tools[1].toolName).toBe('calculate');
+    expect(tools[1].toolDescription.text).toBe('Perform math calculations');
+  });
+
+  it('catches and returns errors from startRecommendation', async () => {
+    mockStartRecommendation.mockRejectedValue(new Error('API timeout'));
+
+    const result = await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      inlineContent: 'test',
+      traceSource: 'cloudwatch',
+    });
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain('API timeout');
+  });
+
+  it('retries transient poll failures and succeeds', async () => {
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-retry-ok',
+      recommendationArn: 'arn:rec-retry-ok',
+      name: 'test-rec',
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      status: 'PENDING',
+    });
+
+    // First poll fails, second succeeds
+    mockGetRecommendation.mockRejectedValueOnce(new Error('fetch failed')).mockResolvedValueOnce({
+      recommendationId: 'rec-retry-ok',
+      status: 'COMPLETED',
+      recommendationResult: {
+        systemPromptRecommendationResult: { recommendedSystemPrompt: 'Better prompt' },
+      },
+    });
+
+    const result = await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      inlineContent: 'test',
+      traceSource: 'cloudwatch',
+      pollIntervalMs: 0,
+    });
+
+    expect(result.success).toBe(true);
+    expect(result.recommendationId).toBe('rec-retry-ok');
+    expect(mockGetRecommendation).toHaveBeenCalledTimes(2);
+  });
+
+  it('fails after max consecutive poll retries', async () => {
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-retry-fail',
+      recommendationArn: 'arn:rec-retry-fail',
+      name: 'test-rec',
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      status: 'PENDING',
+    });
+
+    mockGetRecommendation.mockRejectedValue(new Error('fetch failed'));
+
+    const result = await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      inlineContent: 'test',
+      traceSource: 'cloudwatch',
+      pollIntervalMs: 0,
+    });
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain('consecutive errors');
+    expect(result.error).toContain('fetch failed');
+    expect(result.error).toContain('rec-retry-fail');
+    expect(mockGetRecommendation).toHaveBeenCalledTimes(3);
+  });
+
+  it('times out after max poll duration', async () => {
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-timeout',
+      recommendationArn: 'arn:rec-timeout',
+      name: 'test-rec',
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      status: 'PENDING',
+    });
+
+    mockGetRecommendation.mockResolvedValue({
+      recommendationId: 'rec-timeout',
+      status: 'IN_PROGRESS',
+    });
+
+    const result = await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      inlineContent: 'test',
+      traceSource: 'cloudwatch',
+      pollIntervalMs: 0,
+      maxPollDurationMs: 0, // Immediately timeout
+    });
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain('Polling timed out');
+    expect(result.error).toContain('rec-timeout');
+  });
+
+  it('reads system prompt from file when inputSource is file', async () => {
+    mockReadFileSync.mockReturnValue('You are a healthcare assistant.');
+
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-file',
+      status: 'COMPLETED',
+    });
+    mockGetRecommendation.mockResolvedValue({
+      recommendationId: 'rec-file',
+      status: 'COMPLETED',
+      recommendationResult: {},
+    });
+
+    await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Helpfulness'],
+      inputSource: 'file',
+      promptFile: '/tmp/prompt.txt',
+      traceSource: 'cloudwatch',
+      pollIntervalMs: 0,
+    });
+
+    expect(mockReadFileSync).toHaveBeenCalledWith('/tmp/prompt.txt', 'utf-8');
+    const callArgs = mockStartRecommendation.mock.calls[0]![0];
+    const systemPrompt = callArgs.recommendationConfig.systemPromptRecommendationConfig.systemPrompt;
+    expect(systemPrompt.text).toBe('You are a healthcare assistant.');
+  });
+
+  it('uses inline sessionSpans from spans-file trace source', async () => {
+    const fakeSpans = [
+      { traceId: 't1', spanId: 's1', body: {} },
+      { traceId: 't1', spanId: 's2', body: {} },
+    ];
+    mockReadFileSync.mockReturnValue(JSON.stringify(fakeSpans));
+
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-spans',
+      status: 'COMPLETED',
+    });
+    mockGetRecommendation.mockResolvedValue({
+      recommendationId: 'rec-spans',
+      status: 'COMPLETED',
+      recommendationResult: {},
+    });
+
+    await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      inlineContent: 'test',
+      traceSource: 'spans-file',
+      spansFile: '/tmp/spans.json',
+      pollIntervalMs: 0,
+    });
+
+    const callArgs = mockStartRecommendation.mock.calls[0]![0];
+    const traces = callArgs.recommendationConfig.systemPromptRecommendationConfig.agentTraces;
+    expect(traces.sessionSpans).toHaveLength(2);
+    expect(traces.cloudwatchLogs).toBeUndefined();
+  });
+
+  it('wraps single span object in array for spans-file', async () => {
+    const singleSpan = { traceId: 't1', spanId: 's1', body: {} };
+    mockReadFileSync.mockReturnValue(JSON.stringify(singleSpan));
+
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-single',
+      status: 'COMPLETED',
+    });
+    mockGetRecommendation.mockResolvedValue({
+      recommendationId: 'rec-single',
+      status: 'COMPLETED',
+      recommendationResult: {},
+    });
+
+    await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      inlineContent: 'test',
+      traceSource: 'spans-file',
+      spansFile: '/tmp/single.json',
+      pollIntervalMs: 0,
+    });
+
+    const callArgs = mockStartRecommendation.mock.calls[0]![0];
+    const traces = callArgs.recommendationConfig.systemPromptRecommendationConfig.agentTraces;
+    expect(traces.sessionSpans).toHaveLength(1);
+  });
+
+  it('auto-fetches spans for tool-desc with sessions trace source', async () => {
+    mockFetchSessionSpans.mockResolvedValue({
+      spans: [
+        { traceId: 't1', spanId: 's1', body: {} },
+        { traceId: 't1', spanId: 's2', body: {} },
+      ],
+      spanRecordCount: 1,
+      logRecordCount: 1,
+    });
+
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-autofetch',
+      status: 'COMPLETED',
+    });
+    mockGetRecommendation.mockResolvedValue({
+      recommendationId: 'rec-autofetch',
+      status: 'COMPLETED',
+      recommendationResult: {},
+    });
+
+    await runRecommendationCommand({
+      type: 'TOOL_DESCRIPTION_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      tools: ['add_numbers:Add two numbers together'],
+      traceSource: 'sessions',
+      sessionIds: ['session-abc'],
+      pollIntervalMs: 0,
+    });
+
+    expect(mockFetchSessionSpans).toHaveBeenCalledWith(
+      expect.objectContaining({
+        region: 'us-east-1',
+        runtimeId: 'rt-abc123',
+        sessionId: 'session-abc',
+      })
+    );
+
+    const callArgs = mockStartRecommendation.mock.calls[0]![0];
+    const traces = callArgs.recommendationConfig.toolDescriptionRecommendationConfig.agentTraces;
+    expect(traces.sessionSpans).toHaveLength(2);
+    expect(traces.cloudwatchLogs).toBeUndefined();
+  });
+
+  it('throws when auto-fetch returns zero spans', async () => {
+    mockFetchSessionSpans.mockResolvedValue({
+      spans: [],
+      spanRecordCount: 0,
+      logRecordCount: 0,
+    });
+
+    const result = await runRecommendationCommand({
+      type: 'TOOL_DESCRIPTION_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      tools: ['add_numbers:Add numbers'],
+      traceSource: 'sessions',
+      sessionIds: ['session-empty'],
+      pollIntervalMs: 0,
+    });
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain('No spans found');
+  });
+
+  it('derives service name from runtimeId by stripping hash suffix', async () => {
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-svc',
+      status: 'COMPLETED',
+    });
+    mockGetRecommendation.mockResolvedValue({
+      recommendationId: 'rec-svc',
+      status: 'COMPLETED',
+      recommendationResult: {},
+    });
+
+    await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      inlineContent: 'test',
+      traceSource: 'cloudwatch',
+      pollIntervalMs: 0,
+    });
+
+    const callArgs = mockStartRecommendation.mock.calls[0]![0];
+    const serviceNames =
+      callArgs.recommendationConfig.systemPromptRecommendationConfig.agentTraces.cloudwatchLogs.serviceNames;
+    // runtimeId 'rt-abc123' → service name 'rt.DEFAULT' (strips '-abc123' suffix)
+    expect(serviceNames[0]).toBe('rt.DEFAULT');
+  });
+
+  it('auto-fetches spans for system-prompt with sessions trace source', async () => {
+    mockFetchSessionSpans.mockResolvedValue({ spans: [{ sessionId: 'sess-1', spans: [] }] });
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-sid',
+      status: 'COMPLETED',
+    });
+    mockGetRecommendation.mockResolvedValue({
+      recommendationId: 'rec-sid',
+      status: 'COMPLETED',
+      recommendationResult: {},
+    });
+
+    await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      inlineContent: 'test',
+      traceSource: 'sessions',
+      sessionIds: ['sess-1'],
+      pollIntervalMs: 0,
+    });
+
+    expect(mockFetchSessionSpans).toHaveBeenCalledWith(expect.objectContaining({ sessionId: 'sess-1' }));
+    const callArgs = mockStartRecommendation.mock.calls[0]![0];
+    const traces = callArgs.recommendationConfig.systemPromptRecommendationConfig.agentTraces;
+    expect(traces.sessionSpans).toBeDefined();
+    expect(traces.cloudwatchLogs).toBeUndefined();
+  });
+
+  it('builds cloudwatch config with two log group ARNs', async () => {
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-cw',
+      status: 'COMPLETED',
+    });
+    mockGetRecommendation.mockResolvedValue({
+      recommendationId: 'rec-cw',
+      status: 'COMPLETED',
+      recommendationResult: {},
+    });
+
+    await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      inlineContent: 'test',
+      traceSource: 'cloudwatch',
+      lookbackDays: 3,
+      pollIntervalMs: 0,
+    });
+
+    const callArgs = mockStartRecommendation.mock.calls[0]![0];
+    const cwConfig = callArgs.recommendationConfig.systemPromptRecommendationConfig.agentTraces.cloudwatchLogs;
+    expect(cwConfig.logGroupArns).toHaveLength(2);
+    expect(cwConfig.logGroupArns[0]).toContain('/aws/bedrock-agentcore/runtimes/rt-abc123-DEFAULT');
+    expect(cwConfig.logGroupArns[1]).toContain('aws/spans');
+    expect(cwConfig.startTime).toBeDefined();
+    expect(cwConfig.endTime).toBeDefined();
+  });
+
+  it('extracts failure details from statusReasons and result error fields', async () => {
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-fail-detail',
+      recommendationArn: 'arn:rec-fail-detail',
+      name: 'test',
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      status: 'PENDING',
+      requestId: 'start-req-id',
+    });
+
+    mockGetRecommendation.mockResolvedValue({
+      recommendationId: 'rec-fail-detail',
+      status: 'FAILED',
+      requestId: 'poll-req-id',
+      statusReasons: ['Insufficient trace data'],
+      recommendationResult: {
+        systemPromptRecommendationResult: {
+          errorCode: 'INSUFFICIENT_DATA',
+          errorMessage: 'Not enough traces to generate recommendation',
+        },
+      },
+    });
+
+    const result = await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: ['Builtin.Toxicity'],
+      inputSource: 'inline',
+      inlineContent: 'test',
+      traceSource: 'cloudwatch',
+      pollIntervalMs: 0,
+    });
+
+    expect(result.success).toBe(false);
+    expect(result.error).toContain('Insufficient trace data');
+    expect(result.error).toContain('INSUFFICIENT_DATA');
+    expect(result.error).toContain('Not enough traces');
+    // Request IDs are logged to file only, not included in the error message
+  });
+
+  it('passes full ARN evaluator as-is', async () => {
+    mockStartRecommendation.mockResolvedValue({
+      recommendationId: 'rec-arn',
+      status: 'COMPLETED',
+    });
+    mockGetRecommendation.mockResolvedValue({
+      recommendationId: 'rec-arn',
+      status: 'COMPLETED',
+      recommendationResult: {},
+    });
+
+    const fullArn = 'arn:aws:bedrock-agentcore:us-east-1:123456789012:evaluator/custom-eval';
+    await runRecommendationCommand({
+      type: 'SYSTEM_PROMPT_RECOMMENDATION',
+      agent: 'MyAgent',
+      evaluators: [fullArn],
+      inputSource: 'inline',
+      inlineContent: 'test',
+      traceSource: 'cloudwatch',
+      pollIntervalMs: 0,
+    });
+
+    const callArgs = mockStartRecommendation.mock.calls[0]![0];
+    const evaluators = callArgs.recommendationConfig.systemPromptRecommendationConfig.evaluationConfig.evaluators;
+    expect(evaluators[0].evaluatorArn).toBe(fullArn);
+  });
+});
diff --git a/src/cli/operations/recommendation/apply-to-bundle.ts b/src/cli/operations/recommendation/apply-to-bundle.ts
new file mode 100644
index 000000000..bf9060d10
--- /dev/null
+++ b/src/cli/operations/recommendation/apply-to-bundle.ts
@@ -0,0 +1,140 @@
+/**
+ * Syncs local agentcore.json after the server applies a recommendation to a
+ * config bundle.
+ *
+ * When a recommendation uses a config bundle as input, the server automatically
+ * creates a new bundle version with the recommended changes applied. The
+ * recommendation result includes the new version's bundleArn and versionId.
+ *
+ * This module fetches that new version via GetConfigurationBundleVersion and
+ * updates the local agentcore.json components to match the server state.
+ */
+import { ConfigIO } from '../../../lib';
+import { getConfigurationBundleVersion } from '../../aws/agentcore-config-bundles';
+import type { RecommendationResult } from '../../aws/agentcore-recommendation';
+
+export interface ApplyRecommendationOptions {
+  /** Config bundle name in agentcore.json (used by CLI) */
+  bundleName?: string;
+  /** Config bundle ARN (used by TUI — resolved to name via deployed state) */
+  bundleArn?: string;
+  /** The recommendation result from the API (contains new bundle version info) */
+  result: RecommendationResult;
+  /** AWS region for fetching the new bundle version */
+  region: string;
+}
+
+export interface ApplyRecommendationResult {
+  success: boolean;
+  error?: string;
+  /** New version ID that was synced from the server */
+  newVersionId?: string;
+}
+
+/**
+ * Extract the bundleId from a bundle ARN.
+ * ARN format: arn:aws:bedrock-agentcore:{region}:{account}:configuration-bundle/{bundleId}
+ */
+function extractBundleIdFromArn(arn: string): string | undefined {
+  const match = /configuration-bundle\/(.+)$/.exec(arn);
+  return match?.[1];
+}
+
+/**
+ * Sync local agentcore.json after the server creates a new config bundle version
+ * from a recommendation. Fetches the new version and updates local components.
+ */
+export async function applyRecommendationToBundle(
+  options: ApplyRecommendationOptions,
+  configIO: ConfigIO = new ConfigIO()
+): Promise<ApplyRecommendationResult> {
+  const { result, region } = options;
+
+  // Extract the new bundle version from the recommendation result
+  const resultBundle =
+    result.systemPromptRecommendationResult?.configurationBundle ??
+    result.toolDescriptionRecommendationResult?.configurationBundle;
+
+  if (!resultBundle) {
+    return {
+      success: false,
+      error:
+        'Recommendation result does not contain a new config bundle version. The server may not have applied the recommendation to the bundle.',
+    };
+  }
+
+  const bundleId = extractBundleIdFromArn(resultBundle.bundleArn);
+  if (!bundleId) {
+    return {
+      success: false,
+      error: `Could not extract bundle ID from ARN: ${resultBundle.bundleArn}`,
+    };
+  }
+
+  // Fetch the new version from the server
+  const newVersion = await getConfigurationBundleVersion({
+    region,
+    bundleId,
+    versionId: resultBundle.versionId,
+  });
+
+  // Read current project spec and deployed state
+  const [spec, deployedState] = await Promise.all([configIO.readProjectSpec(), configIO.readDeployedState()]);
+
+  // Find the target bundle by name or by matching ARN in deployed state
+  let bundleName: string | undefined;
+  if (options.bundleName) {
+    bundleName = options.bundleName;
+  } else if (options.bundleArn) {
+    // TUI stores the ARN — resolve to bundle name via deployed state
+    for (const targetName of Object.keys(deployedState.targets ?? {})) {
+      const target = deployedState.targets?.[targetName];
+      const bundles = target?.resources?.configBundles;
+      if (bundles) {
+        for (const [name, state] of Object.entries(bundles)) {
+          if (state.bundleArn === options.bundleArn) {
+            bundleName = name;
+            break;
+          }
+        }
+      }
+      if (bundleName) break;
+    }
+  }
+
+  const identifier = bundleName ?? options.bundleArn ?? 'unknown';
+  const bundle = bundleName ? spec.configBundles?.find(cb => cb.name === bundleName) : undefined;
+  if (!bundle) {
+    return {
+      success: false,
+      error: `Config bundle "${identifier}" not found in agentcore.json.`,
+    };
+  }
+
+  // Update local bundle components to match the server's new version
+  bundle.components = newVersion.components as typeof bundle.components;
+
+  // Update commit message from lineage metadata if available
+  if (newVersion.lineageMetadata?.commitMessage) {
+    bundle.commitMessage = newVersion.lineageMetadata.commitMessage;
+  }
+
+  // Write updated spec
+  await configIO.writeProjectSpec(spec);
+
+  // Update deployed state with the new version ID
+  for (const targetName of Object.keys(deployedState.targets ?? {})) {
+    const target = deployedState.targets?.[targetName];
+    const bundleState = target?.resources?.configBundles?.[identifier];
+    if (bundleState) {
+      bundleState.versionId = resultBundle.versionId;
+      break;
+    }
+  }
+  await configIO.writeDeployedState(deployedState);
+
+  return {
+    success: true,
+    newVersionId: resultBundle.versionId,
+  };
+}
diff --git a/src/cli/operations/recommendation/constants.ts b/src/cli/operations/recommendation/constants.ts
new file mode 100644
index 000000000..c79647c44
--- /dev/null
+++ b/src/cli/operations/recommendation/constants.ts
@@ -0,0 +1,11 @@
+/** Polling interval in ms for checking recommendation status. */
+export const DEFAULT_POLL_INTERVAL_MS = 5000;
+
+/** Statuses that indicate a recommendation has reached a terminal state. */
+export const TERMINAL_STATUSES = new Set(['COMPLETED', 'SUCCEEDED', 'FAILED', 'DELETING']);
+
+/** Max retries for transient poll failures (network errors, 5xx). */
+export const MAX_POLL_RETRIES = 3;
+
+/** Max total polling duration in ms (30 minutes). */
+export const MAX_POLL_DURATION_MS = 30 * 60 * 1000;
diff --git a/src/cli/operations/recommendation/fetch-session-spans.ts b/src/cli/operations/recommendation/fetch-session-spans.ts
new file mode 100644
index 000000000..db5e63911
--- /dev/null
+++ b/src/cli/operations/recommendation/fetch-session-spans.ts
@@ -0,0 +1,158 @@
+/**
+ * Fetches OTEL span records and log records from CloudWatch for a given session,
+ * combining them into a SessionSpan[] suitable for inline `sessionSpans` in the
+ * Recommendation API.
+ *
+ * Tool description recommendations require inline sessionSpans (the server-side
+ * Lambda does NOT support `cloudwatchLogs` for this type). The OTEL mapper needs
+ * BOTH:
+ *   - Span records from the `aws/spans` log group
+ *   - Log records (with body.input/output.messages) from the runtime log group
+ *
+ * Without log records the mapper produces "zero trajectories".
+ */
+import type { SessionSpan } from '../../aws/agentcore-recommendation';
+import { searchLogs } from '../../aws/cloudwatch';
+
+export interface FetchSessionSpansOptions {
+  /** AWS region */
+  region: string;
+  /** Agent runtime ID, e.g. "myproject_MyAgent-QMd093Gl4O" */
+  runtimeId: string;
+  /** Session ID to filter spans for */
+  sessionId: string;
+  /** Lookback days (default 7) */
+  lookbackDays?: number;
+  /** Progress callback */
+  onProgress?: (message: string) => void;
+}
+
+export interface FetchSessionSpansResult {
+  spans: SessionSpan[];
+  spanRecordCount: number;
+  logRecordCount: number;
+}
+
+/** The log group where OTEL span records are stored (no leading slash). */
+const SPANS_LOG_GROUP = 'aws/spans';
+
+/**
+ * Fetch session spans from both CloudWatch log groups and combine them.
+ *
+ * 1. Fetches span records from `aws/spans` filtered by session.id
+ * 2. Fetches log records from the runtime log group filtered by body+input
+ * 3. Filters log records client-side by matching session.id
+ * 4. Returns combined array
+ */
+export async function fetchSessionSpans(options: FetchSessionSpansOptions): Promise<FetchSessionSpansResult> {
+  const { region, runtimeId, sessionId, lookbackDays = 7, onProgress } = options;
+
+  const runtimeLogGroup = `/aws/bedrock-agentcore/runtimes/${runtimeId}-DEFAULT`;
+  const endTimeMs = Date.now();
+  const startTimeMs = endTimeMs - lookbackDays * 24 * 60 * 60 * 1000;
+
+  // Fetch span records and log records in parallel
+  onProgress?.('Fetching span records from aws/spans...');
+  const [spanRecords, logRecords] = await Promise.all([
+    collectLogEvents({
+      logGroupName: SPANS_LOG_GROUP,
+      region,
+      startTimeMs,
+      endTimeMs,
+      filterPattern: `"session.id" "${sessionId}"`,
+    }),
+    collectLogEvents({
+      logGroupName: runtimeLogGroup,
+      region,
+      startTimeMs,
+      endTimeMs,
+      // Filter for log records that contain body with input messages
+      filterPattern: `"body" "input"`,
+    }),
+  ]);
+
+  onProgress?.(`Found ${spanRecords.length} span records, ${logRecords.length} log record candidates`);
+
+  // Parse span records — these are already OTEL spans with attributes.session.id
+  const spans: SessionSpan[] = [];
+  for (const event of spanRecords) {
+    try {
+      const parsed = JSON.parse(event.message) as SessionSpan;
+      spans.push(parsed);
+    } catch {
+      // Skip unparseable records
+    }
+  }
+
+  // Parse and filter log records — keep only those matching our session
+  let logRecordCount = 0;
+  for (const event of logRecords) {
+    try {
+      const parsed = JSON.parse(event.message) as Record<string, unknown>;
+      if (matchesSession(parsed, sessionId)) {
+        spans.push(parsed as unknown as SessionSpan);
+        logRecordCount++;
+      }
+    } catch {
+      // Skip unparseable records
+    }
+  }
+
+  onProgress?.(
+    `Combined ${spans.length} spans (${spans.length - logRecordCount} span records + ${logRecordCount} log records)`
+  );
+
+  return {
+    spans,
+    spanRecordCount: spans.length - logRecordCount,
+    logRecordCount,
+  };
+}
+
+/**
+ * Check if a parsed log record matches the target session ID.
+ * Log records may have session.id in attributes or in the traceId/body context.
+ */
+function matchesSession(record: Record<string, unknown>, sessionId: string): boolean {
+  // Check attributes.session.id (most common)
+  const attrs = record.attributes as Record<string, unknown> | undefined;
+  if (attrs?.['session.id'] === sessionId) return true;
+
+  // Check nested body for session references
+  const body = record.body as Record<string, unknown> | undefined;
+  if (body) {
+    const bodyStr = JSON.stringify(body);
+    if (bodyStr.includes(sessionId)) return true;
+  }
+
+  return false;
+}
+
+/**
+ * Collect all log events from a CloudWatch log group into an array.
+ * Uses the existing searchLogs async generator.
+ */
+async function collectLogEvents(options: {
+  logGroupName: string;
+  region: string;
+  startTimeMs: number;
+  endTimeMs: number;
+  filterPattern: string;
+}): Promise<{ timestamp: number; message: string }[]> {
+  const events: { timestamp: number; message: string }[] = [];
+
+  try {
+    for await (const event of searchLogs(options)) {
+      events.push(event);
+    }
+  } catch (err) {
+    // Log group may not exist yet (e.g. no invocations) — return empty
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes('ResourceNotFoundException') || msg.includes('does not exist')) {
+      return [];
+    }
+    throw err;
+  }
+
+  return events;
+}
diff --git a/src/cli/operations/recommendation/index.ts b/src/cli/operations/recommendation/index.ts
new file mode 100644
index 000000000..f60a1d798
--- /dev/null
+++ b/src/cli/operations/recommendation/index.ts
@@ -0,0 +1,18 @@
+export { applyRecommendationToBundle } from './apply-to-bundle';
+export type { ApplyRecommendationOptions, ApplyRecommendationResult } from './apply-to-bundle';
+export { fetchSessionSpans } from './fetch-session-spans';
+export type { FetchSessionSpansOptions, FetchSessionSpansResult } from './fetch-session-spans';
+export { runRecommendationCommand } from './run-recommendation';
+export type {
+  RunRecommendationCommandOptions,
+  RunRecommendationCommandResult,
+  RecommendationType,
+  RecommendationInputSourceKind,
+  TraceSourceKind,
+} from './types';
+export {
+  saveRecommendationRun,
+  loadRecommendationRun,
+  listAllRecommendations,
+  type RecommendationRunRecord,
+} from './recommendation-storage';
diff --git a/src/cli/operations/recommendation/recommendation-storage.ts b/src/cli/operations/recommendation/recommendation-storage.ts
new file mode 100644
index 000000000..e60846574
--- /dev/null
+++ b/src/cli/operations/recommendation/recommendation-storage.ts
@@ -0,0 +1,84 @@
+import { findConfigRoot } from '../../../lib';
+import type { RecommendationResult, RecommendationType } from '../../aws/agentcore-recommendation';
+import type { RunRecommendationCommandResult } from './types';
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'fs';
+import { join } from 'path';
+
+const RECOMMENDATIONS_DIR = 'recommendations';
+
+export interface RecommendationRunRecord {
+  recommendationId: string;
+  type: RecommendationType;
+  agent: string;
+  evaluators: string[];
+  status: string;
+  startedAt?: string;
+  completedAt?: string;
+  result?: RecommendationResult;
+}
+
+function getRecommendationResultsDir(): string {
+  const configRoot = findConfigRoot();
+  if (!configRoot) {
+    throw new Error('No agentcore project found. Run `agentcore create` first.');
+  }
+  return join(configRoot, '.cli', RECOMMENDATIONS_DIR);
+}
+
+export function saveRecommendationRun(
+  recommendationId: string,
+  result: RunRecommendationCommandResult,
+  type: RecommendationType,
+  agent: string,
+  evaluators: string[]
+): string {
+  const dir = getRecommendationResultsDir();
+  mkdirSync(dir, { recursive: true });
+
+  const filePath = join(dir, `${recommendationId}.json`);
+
+  const record: RecommendationRunRecord = {
+    recommendationId,
+    type,
+    agent,
+    evaluators,
+    status: result.status ?? 'unknown',
+    startedAt: result.startedAt,
+    completedAt: result.completedAt,
+    result: result.result,
+  };
+
+  writeFileSync(filePath, JSON.stringify(record, null, 2));
+  return filePath;
+}
+
+export function loadRecommendationRun(recommendationId: string): RecommendationRunRecord {
+  const dir = getRecommendationResultsDir();
+  const jsonName = recommendationId.endsWith('.json') ? recommendationId : `${recommendationId}.json`;
+  const filePath = join(dir, jsonName);
+
+  if (!existsSync(filePath)) {
+    throw new Error(`Recommendation "${recommendationId}" not found at ${filePath}`);
+  }
+
+  return JSON.parse(readFileSync(filePath, 'utf-8')) as RecommendationRunRecord;
+}
+
+export function listAllRecommendations(): RecommendationRunRecord[] {
+  const configRoot = findConfigRoot();
+  if (!configRoot) {
+    throw new Error('No agentcore project found. Run `agentcore create` first.');
+  }
+
+  const dir = join(configRoot, '.cli', RECOMMENDATIONS_DIR);
+  if (!existsSync(dir)) {
+    return [];
+  }
+
+  const files = readdirSync(dir)
+    .filter(f => f.endsWith('.json'))
+    .sort()
+    .reverse();
+
+  return files.map(f => JSON.parse(readFileSync(join(dir, f), 'utf-8')) as RecommendationRunRecord);
+}
diff --git a/src/cli/operations/recommendation/run-recommendation.ts b/src/cli/operations/recommendation/run-recommendation.ts
new file mode 100644
index 000000000..0423cfe32
--- /dev/null
+++ b/src/cli/operations/recommendation/run-recommendation.ts
@@ -0,0 +1,610 @@
+/**
+ * Orchestrates running a Recommendation:
+ *   1. Resolve agent and evaluator from project
+ *   2. Build recommendationConfig from CLI inputs
+ *   3. Call StartRecommendation (creates resource, returns 202)
+ *   4. Poll GetRecommendation until terminal status
+ *   5. Return result with optimized artifact
+ */
+import { ConfigIO } from '../../../lib';
+import type { DeployedState } from '../../../schema';
+import type {
+  RecommendationConfig,
+  RecommendationResult,
+  RecommendationType,
+  SessionSpan,
+} from '../../aws/agentcore-recommendation';
+import { getRecommendation, startRecommendation } from '../../aws/agentcore-recommendation';
+import { arnPrefix } from '../../aws/partition';
+import { detectRegion } from '../../aws/region';
+import { ExecLogger } from '../../logging/exec-logger';
+import { DEFAULT_POLL_INTERVAL_MS, MAX_POLL_DURATION_MS, MAX_POLL_RETRIES, TERMINAL_STATUSES } from './constants';
+import { fetchSessionSpans } from './fetch-session-spans';
+import type { RunRecommendationCommandOptions, RunRecommendationCommandResult } from './types';
+import { readFileSync } from 'fs';
+
+export async function runRecommendationCommand(
+  options: RunRecommendationCommandOptions
+): Promise<RunRecommendationCommandResult> {
+  const { pollIntervalMs = DEFAULT_POLL_INTERVAL_MS, onProgress } = options;
+  let logger: ExecLogger | undefined;
+  try {
+    logger = new ExecLogger({ command: 'recommend' });
+  } catch {
+    // Logger creation can fail in tests or when no project root exists — non-fatal
+  }
+
+  try {
+    logger?.startStep('Load project config');
+    // 1. Read project config and deployed state
+    const configIO = new ConfigIO();
+    const [projectSpec, deployedState, awsTargets] = await Promise.all([
+      configIO.readProjectSpec(),
+      configIO.readDeployedState(),
+      configIO.resolveAWSDeploymentTargets(),
+    ]);
+
+    const targetRegion = awsTargets.length > 0 ? awsTargets[0]!.region : undefined;
+    const { region: detectedRegion } = await detectRegion();
+    const region = options.region ?? targetRegion ?? detectedRegion;
+    const stage = process.env.AGENTCORE_STAGE?.toLowerCase() ?? 'prod';
+    logger?.log(`Region: ${region}, Stage: ${stage}`);
+    logger?.endStep('success');
+
+    // 2. Resolve agent from deployed state (needed for log group ARNs)
+    logger?.startStep('Resolve agent and evaluators');
+    const agentState = resolveAgentState(deployedState, options.agent);
+    if (!agentState) {
+      logger?.log(`Agent "${options.agent}" not found in deployed state`, 'error');
+      logger?.endStep('error', `Agent "${options.agent}" not deployed`);
+      logger?.finalize(false);
+      return {
+        success: false,
+        error: `Agent "${options.agent}" not deployed. Run \`agentcore deploy\` first.`,
+        logFilePath: logger?.logFilePath,
+      };
+    }
+    logger?.log(`Agent: ${options.agent} (runtime: ${agentState.runtimeId})`);
+
+    // 3. Resolve evaluator ID/ARN (API accepts exactly one for system-prompt, none for tool-desc)
+    const evaluatorIds: string[] = [];
+    for (const evaluator of options.evaluators) {
+      const evaluatorId = resolveEvaluatorId(deployedState, evaluator, region);
+      if (!evaluatorId) {
+        return {
+          success: false,
+          error: `Evaluator "${evaluator}" not found in deployed state. Use a Builtin.* name, a full ARN, or deploy a custom evaluator first.`,
+          logFilePath: logger?.logFilePath,
+        };
+      }
+      evaluatorIds.push(evaluatorId);
+    }
+    if (options.type === 'SYSTEM_PROMPT_RECOMMENDATION' && evaluatorIds.length !== 1) {
+      return {
+        success: false,
+        error: 'System prompt recommendations require exactly one evaluator.',
+        logFilePath: logger?.logFilePath,
+      };
+    }
+    logger?.log(`Evaluators: ${evaluatorIds.join(', ') || '(none)'}`);
+    logger?.endStep('success');
+
+    // 4. Read input content (if from file)
+    let inlineContent: string | undefined;
+    if (options.inputSource === 'file' && options.promptFile) {
+      inlineContent = readFileSync(options.promptFile, 'utf-8');
+    } else if (options.inputSource === 'inline') {
+      inlineContent = options.inlineContent;
+    }
+
+    // Validate that system prompt content is non-empty (API rejects empty text)
+    if (
+      options.type === 'SYSTEM_PROMPT_RECOMMENDATION' &&
+      options.inputSource !== 'config-bundle' &&
+      !inlineContent?.trim()
+    ) {
+      return {
+        success: false,
+        error: 'System prompt content is required. Provide via --inline, --prompt-file, or --bundle-name.',
+        logFilePath: logger?.logFilePath,
+      };
+    }
+
+    // 5. Extract account ID from agent runtime ARN
+    const accountId = extractAccountIdFromArn(agentState.runtimeArn);
+
+    // 5b. Resolve config bundle ARN from deployed state (if using config bundle)
+    let bundleArn: string | undefined;
+    if (options.inputSource === 'config-bundle' && options.bundleName) {
+      if (options.bundleName.startsWith('arn:')) {
+        // Already an ARN (e.g. from TUI which stores the ARN directly)
+        bundleArn = options.bundleName;
+      } else {
+        // Human-readable name (e.g. from CLI --bundle-name flag) — resolve from deployed state
+        for (const targetName of Object.keys(deployedState.targets ?? {})) {
+          const target = deployedState.targets?.[targetName];
+          const bundle = target?.resources?.configBundles?.[options.bundleName];
+          if (bundle?.bundleArn) {
+            bundleArn = bundle.bundleArn;
+            break;
+          }
+        }
+        if (!bundleArn) {
+          return {
+            success: false,
+            error: `Config bundle "${options.bundleName}" not found in deployed state. Run \`agentcore deploy\` first.`,
+            logFilePath: logger?.logFilePath,
+          };
+        }
+      }
+      logger?.log(`Resolved bundle ARN: ${bundleArn}`);
+    }
+
+    // 5c. Resolve short-form systemPromptJsonPath (e.g. "systemPrompt") to full JSONPath
+    let resolvedSystemPromptJsonPath = options.systemPromptJsonPath;
+    if (
+      options.inputSource === 'config-bundle' &&
+      options.bundleName &&
+      resolvedSystemPromptJsonPath &&
+      !resolvedSystemPromptJsonPath.startsWith('$')
+    ) {
+      // User provided a short field name like "systemPrompt" — resolve from agentcore.json
+      const bundleName = options.bundleName.startsWith('arn:')
+        ? // Find bundle name from ARN by matching deployed state
+          Object.values(deployedState.targets)
+            .flatMap(t => Object.entries(t.resources?.configBundles ?? {}))
+            .find(([, b]) => b.bundleArn === options.bundleName)?.[0]
+        : options.bundleName;
+
+      if (bundleName) {
+        const projBundle = projectSpec.configBundles?.find(b => b.name === bundleName);
+        if (projBundle?.components) {
+          const subPath = resolvedSystemPromptJsonPath;
+          // Use the first component key, resolved to a real ARN
+          const firstComponentKey = Object.keys(projBundle.components)[0];
+          if (firstComponentKey) {
+            const resolvedKey = resolveComponentKeyForJsonPath(firstComponentKey, deployedState);
+            resolvedSystemPromptJsonPath = `$.${resolvedKey}.configuration.${subPath}`;
+            logger?.log(`Resolved short JSONPath "${subPath}" → "${resolvedSystemPromptJsonPath}"`);
+          }
+        }
+      }
+    }
+
+    // 6. Build recommendationConfig based on type
+    const recommendationConfig = await buildRecommendationConfig({
+      type: options.type,
+      inlineContent,
+      bundleArn,
+      bundleVersion: options.bundleVersion,
+      systemPromptJsonPath: resolvedSystemPromptJsonPath,
+      toolDescJsonPaths: options.toolDescJsonPaths,
+      inputSource: options.inputSource,
+      tools: options.tools,
+      traceSource: options.traceSource,
+      lookbackDays: options.lookbackDays,
+      sessionIds: options.sessionIds,
+      spansFile: options.spansFile,
+      runtimeId: agentState.runtimeId,
+      accountId,
+      region,
+      evaluatorIds,
+      onProgress,
+      logger,
+    });
+
+    // 7. Start the recommendation
+    logger?.startStep('Start recommendation');
+    const recommendationName = options.recommendationName ?? `${projectSpec.name}_${options.agent}_${Date.now()}`;
+    onProgress?.('starting', `Starting recommendation "${recommendationName}"...`);
+
+    const startPayload = {
+      region,
+      name: recommendationName,
+      type: options.type,
+      recommendationConfig,
+    };
+    logger?.log(`Request payload:\n${JSON.stringify(startPayload, null, 2)}`);
+
+    const startResult = await startRecommendation(startPayload);
+
+    logger?.log(`Response: ${JSON.stringify(startResult, null, 2)}`);
+    logger?.endStep('success');
+    onProgress?.('started', `Recommendation created: ${startResult.recommendationId} (status: ${startResult.status})`);
+    options.onStarted?.({ recommendationId: startResult.recommendationId, region });
+
+    // 8. Poll GetRecommendation until terminal status
+    logger?.startStep('Poll for completion');
+    const maxDurationMs = options.maxPollDurationMs ?? MAX_POLL_DURATION_MS;
+    const pollStartTime = Date.now();
+    let currentStatus = startResult.status;
+    let consecutiveFailures = 0;
+
+    while (!TERMINAL_STATUSES.has(currentStatus)) {
+      await sleep(pollIntervalMs);
+
+      // Check max poll duration
+      if (Date.now() - pollStartTime > maxDurationMs) {
+        logger?.log(`Max poll duration (${maxDurationMs}ms) exceeded`, 'error');
+        logger?.endStep('error', 'Poll timeout');
+        logger?.finalize(false);
+        return {
+          success: false,
+          error: `Polling timed out after ${Math.round(maxDurationMs / 60000)} minutes. The recommendation may still be running server-side.\nRecommendation ID: ${startResult.recommendationId}`,
+          recommendationId: startResult.recommendationId,
+          status: currentStatus,
+          logFilePath: logger?.logFilePath,
+        };
+      }
+
+      // Poll with retry for transient failures
+      let pollResult;
+      try {
+        pollResult = await getRecommendation({
+          region,
+          recommendationId: startResult.recommendationId,
+        });
+        consecutiveFailures = 0;
+      } catch (pollErr) {
+        consecutiveFailures++;
+        const pollErrMsg = pollErr instanceof Error ? pollErr.message : String(pollErr);
+        logger?.log(`Poll attempt failed (${consecutiveFailures}/${MAX_POLL_RETRIES}): ${pollErrMsg}`, 'error');
+
+        if (consecutiveFailures >= MAX_POLL_RETRIES) {
+          logger?.endStep('error', `${MAX_POLL_RETRIES} consecutive poll failures`);
+          logger?.finalize(false);
+          return {
+            success: false,
+            error: `Polling failed after ${MAX_POLL_RETRIES} consecutive errors: ${pollErrMsg}\nThe recommendation may still be running server-side.\nRecommendation ID: ${startResult.recommendationId}`,
+            recommendationId: startResult.recommendationId,
+            status: currentStatus,
+            logFilePath: logger?.logFilePath,
+          };
+        }
+        onProgress?.('polling', `Poll error, retrying (${consecutiveFailures}/${MAX_POLL_RETRIES})...`);
+        continue;
+      }
+
+      currentStatus = pollResult.status;
+      onProgress?.('polling', `Status: ${currentStatus}`);
+
+      if (TERMINAL_STATUSES.has(currentStatus)) {
+        if (currentStatus === 'COMPLETED' || currentStatus === 'SUCCEEDED') {
+          logger?.log(`Completed. Result:\n${JSON.stringify(pollResult.recommendationResult, null, 2)}`);
+          logger?.endStep('success');
+          logger?.finalize(true);
+          return {
+            success: true,
+            recommendationId: startResult.recommendationId,
+            status: currentStatus,
+            result: pollResult.recommendationResult,
+            region,
+            startedAt: pollResult.createdAt,
+            completedAt: pollResult.completedAt,
+            logFilePath: logger?.logFilePath,
+          };
+        }
+
+        // Extract error details from the FAILED response
+        const failureDetails = extractFailureDetails(pollResult);
+        logger?.log(`Terminal status: ${currentStatus}`, 'error');
+        logger?.log(`Full poll response:\n${JSON.stringify(pollResult, null, 2)}`, 'error');
+        if (failureDetails) logger?.log(`Failure details: ${failureDetails}`, 'error');
+        logger?.endStep('error', `Status: ${currentStatus}`);
+        logger?.finalize(false);
+        // Log request IDs for debugging (only in log file, not shown in TUI)
+        const requestIds = [
+          startResult.requestId ? `Start: ${startResult.requestId}` : '',
+          pollResult.requestId ? `Poll: ${pollResult.requestId}` : '',
+        ]
+          .filter(Boolean)
+          .join(', ');
+        if (requestIds) logger?.log(`Request IDs: ${requestIds}`, 'error');
+
+        return {
+          success: false,
+          error: failureDetails
+            ? `Recommendation failed: ${failureDetails}`
+            : `Recommendation finished with status: ${currentStatus}`,
+          recommendationId: startResult.recommendationId,
+          status: currentStatus,
+          logFilePath: logger?.logFilePath,
+        };
+      }
+    }
+
+    // Should not reach here, but handle gracefully
+    logger?.log(`Unexpected terminal status: ${currentStatus}`, 'error');
+    logger?.endStep('error', `Unexpected status: ${currentStatus}`);
+    logger?.finalize(false);
+    return {
+      success: false,
+      error: `Recommendation ended with unexpected status: ${currentStatus}`,
+      recommendationId: startResult.recommendationId,
+      status: currentStatus,
+      logFilePath: logger?.logFilePath,
+    };
+  } catch (err) {
+    const errorMsg = err instanceof Error ? err.message : String(err);
+    logger?.log(`Error: ${errorMsg}`, 'error');
+    logger?.endStep('error', errorMsg);
+    logger?.finalize(false);
+    return {
+      success: false,
+      error: errorMsg,
+      logFilePath: logger?.logFilePath,
+    };
+  }
+}
+
+// ============================================================================
+// Helpers
+// ============================================================================
+
+function resolveAgentState(
+  deployedState: DeployedState,
+  agentName: string
+): { runtimeId: string; runtimeArn: string } | undefined {
+  for (const target of Object.values(deployedState.targets)) {
+    const agent = target.resources?.runtimes?.[agentName];
+    if (agent) return agent;
+  }
+  return undefined;
+}
+
+/**
+ * Resolve an evaluator name to a full ARN.
+ * Returns undefined if the evaluator cannot be resolved.
+ */
+function resolveEvaluatorId(deployedState: DeployedState, evaluator: string, region: string): string | undefined {
+  // Already a full ARN — use as-is
+  if (evaluator.startsWith('arn:')) {
+    return evaluator;
+  }
+  // Builtin shorthand → expand to full ARN
+  if (evaluator.startsWith('Builtin.')) {
+    return `${arnPrefix(region)}:bedrock-agentcore:::evaluator/${evaluator}`;
+  }
+  // Look up custom evaluator from deployed state
+  for (const target of Object.values(deployedState.targets)) {
+    const evalState = target.resources?.evaluators?.[evaluator];
+    if (evalState) return evalState.evaluatorArn;
+  }
+  return undefined;
+}
+
+/**
+ * Extract the 12-digit AWS account ID from an ARN.
+ * Falls back to '*' if the ARN format is unexpected.
+ */
+function extractAccountIdFromArn(arn: string): string {
+  const parts = arn.split(':');
+  return parts[4] && /^\d{12}$/.test(parts[4]) ? parts[4] : '*';
+}
+
+interface BuildConfigOptions {
+  type: RecommendationType;
+  inlineContent?: string;
+  bundleArn?: string;
+  bundleVersion?: string;
+  systemPromptJsonPath?: string;
+  toolDescJsonPaths?: { toolName: string; toolDescriptionJsonPath: string }[];
+  inputSource: string;
+  tools?: string[];
+  traceSource: string;
+  lookbackDays?: number;
+  sessionIds?: string[];
+  spansFile?: string;
+  runtimeId: string;
+  accountId: string;
+  region: string;
+  evaluatorIds: string[];
+  onProgress?: (status: string, message: string) => void;
+  logger?: ExecLogger;
+}
+
+async function buildRecommendationConfig(opts: BuildConfigOptions): Promise<RecommendationConfig> {
+  // Build agent traces — either from a spans file (inline session spans) or CloudWatch
+  let agentTraces;
+
+  if (opts.traceSource === 'spans-file' && opts.spansFile) {
+    // Explicit spans file — read and use as inline sessionSpans
+    const spansContent = readFileSync(opts.spansFile, 'utf-8');
+    const sessionSpans = JSON.parse(spansContent) as SessionSpan | SessionSpan[];
+    agentTraces = {
+      sessionSpans: Array.isArray(sessionSpans) ? sessionSpans : [sessionSpans],
+    };
+  } else if (opts.traceSource === 'sessions' && opts.sessionIds && opts.sessionIds.length > 0) {
+    // Session IDs selected — auto-fetch from both log groups and use inline sessionSpans.
+    // The CloudWatch trace config does not support filtering by multiple session IDs,
+    // so we fetch spans client-side and send them inline.
+    opts.onProgress?.('fetching-spans', 'Fetching session spans from CloudWatch...');
+    opts.logger?.log(
+      'Auto-fetching spans for selected sessions (CloudWatch config does not support session ID filtering)'
+    );
+
+    const allSpans = [];
+    for (const sessionId of opts.sessionIds) {
+      const result = await fetchSessionSpans({
+        region: opts.region,
+        runtimeId: opts.runtimeId,
+        sessionId,
+        lookbackDays: opts.lookbackDays ?? 7,
+        onProgress: msg => {
+          opts.logger?.log(msg);
+          opts.onProgress?.('fetching-spans', msg);
+        },
+      });
+      allSpans.push(...result.spans);
+    }
+
+    if (allSpans.length === 0) {
+      throw new Error(
+        'No spans found for the specified session(s). Ensure the agent has been invoked and traces have propagated to CloudWatch (may take 5-10 minutes).'
+      );
+    }
+
+    opts.logger?.log(`Total spans fetched: ${allSpans.length}`);
+    opts.onProgress?.('fetching-spans', `Fetched ${allSpans.length} spans`);
+    agentTraces = { sessionSpans: allSpans };
+  } else {
+    // Lookback-based path — use cloudwatchLogs with time range
+    const runtimeLogGroupArn = `${arnPrefix(opts.region)}:logs:${opts.region}:${opts.accountId}:log-group:/aws/bedrock-agentcore/runtimes/${opts.runtimeId}-DEFAULT`;
+    const spansLogGroupArn = `${arnPrefix(opts.region)}:logs:${opts.region}:${opts.accountId}:log-group:aws/spans`;
+
+    // Derive service name: strip the random hash suffix from runtimeId
+    // runtimeId format: {project}_{agent}-{hash} → serviceName: {project}_{agent}.DEFAULT
+    const serviceName = opts.runtimeId.replace(/-[^-]+$/, '.DEFAULT');
+
+    const lookbackDays = opts.lookbackDays ?? 7;
+    agentTraces = {
+      cloudwatchLogs: {
+        logGroupArns: [runtimeLogGroupArn, spansLogGroupArn],
+        serviceNames: [serviceName],
+        startTime: new Date(Date.now() - lookbackDays * 24 * 60 * 60 * 1000).toISOString(),
+        endTime: new Date().toISOString(),
+      },
+    };
+  }
+
+  const evaluationConfig: import('../../aws/agentcore-recommendation').RecommendationEvaluationConfig = {
+    evaluators: [{ evaluatorArn: opts.evaluatorIds[0]! }],
+  };
+
+  // Validate required fields for config-bundle source (API requires all three)
+  if (opts.inputSource === 'config-bundle' && opts.bundleArn && !opts.bundleVersion) {
+    throw new Error('Config bundle version is required. Provide --bundle-version or deploy the bundle first.');
+  }
+
+  if (opts.inputSource === 'config-bundle' && opts.bundleArn) {
+    if (opts.type === 'SYSTEM_PROMPT_RECOMMENDATION' && !opts.systemPromptJsonPath) {
+      throw new Error(
+        'Config bundle requires --system-prompt-json-path to locate the system prompt field.\n' +
+          "Use the field name (e.g. --system-prompt-json-path 'systemPrompt') and it will be resolved from agentcore.json.\n" +
+          "Or provide the full JSONPath (e.g. '$.ARN.configuration.systemPrompt')."
+      );
+    }
+    if (opts.type === 'TOOL_DESCRIPTION_RECOMMENDATION' && !opts.toolDescJsonPaths?.length) {
+      throw new Error(
+        'Config bundle requires --tool-desc-json-path to locate tool description fields.\n' +
+          "Example: --tool-desc-json-path 'toolName:$.ARN.configuration.toolDescription'"
+      );
+    }
+  }
+
+  if (opts.type === 'SYSTEM_PROMPT_RECOMMENDATION') {
+    return {
+      systemPromptRecommendationConfig: {
+        systemPrompt:
+          opts.inputSource === 'config-bundle' && opts.bundleArn
+            ? {
+                configurationBundle: {
+                  bundleArn: opts.bundleArn,
+                  versionId: opts.bundleVersion!,
+                  systemPromptJsonPath: opts.systemPromptJsonPath,
+                },
+              }
+            : { text: opts.inlineContent ?? '' },
+        agentTraces,
+        evaluationConfig,
+      },
+    };
+  }
+
+  // TOOL_DESCRIPTION_RECOMMENDATION
+  if (opts.inputSource === 'config-bundle' && opts.bundleArn && opts.toolDescJsonPaths?.length) {
+    // Config bundle source — pass bundle reference with JSON paths for server-side resolution
+    return {
+      toolDescriptionRecommendationConfig: {
+        toolDescription: {
+          configurationBundle: {
+            bundleArn: opts.bundleArn,
+            versionId: opts.bundleVersion!,
+            tools: opts.toolDescJsonPaths,
+          },
+        },
+        agentTraces,
+      },
+    };
+  }
+
+  // Inline/file source — parse "toolName:description" pairs from tools array
+  const toolEntries = (opts.tools ?? []).map(t => {
+    const colonIdx = t.indexOf(':');
+    if (colonIdx > 0) {
+      return { toolName: t.slice(0, colonIdx), toolDescription: { text: t.slice(colonIdx + 1) } };
+    }
+    return { toolName: t, toolDescription: { text: opts.inlineContent ?? '' } };
+  });
+
+  return {
+    toolDescriptionRecommendationConfig: {
+      toolDescription: {
+        toolDescriptionText: {
+          tools: toolEntries,
+        },
+      },
+      agentTraces,
+    },
+  };
+}
+
+/**
+ * Extract error details from a FAILED recommendation response.
+ * The API populates errorCode/errorMessage in the result, and statusReasons at top level.
+ */
+function extractFailureDetails(pollResult: {
+  statusReasons?: string[];
+  recommendationResult?: RecommendationResult;
+}): string | undefined {
+  const parts: string[] = [];
+
+  if (pollResult.statusReasons?.length) {
+    parts.push(pollResult.statusReasons.join('; '));
+  }
+
+  const result = pollResult.recommendationResult;
+  if (result) {
+    const errorSource = result.systemPromptRecommendationResult ?? result.toolDescriptionRecommendationResult;
+    if (errorSource) {
+      if (errorSource.errorCode) parts.push(`[${errorSource.errorCode}]`);
+      if (errorSource.errorMessage) parts.push(errorSource.errorMessage);
+    }
+  }
+
+  return parts.length > 0 ? parts.join(' ') : undefined;
+}
+
+/**
+ * Resolve a component key (which may be a placeholder like {{runtime:name}})
+ * to its real ARN from deployed state. Returns the key unchanged if not a placeholder.
+ */
+function resolveComponentKeyForJsonPath(key: string, deployedState: DeployedState): string {
+  if (key.startsWith('arn:')) return key;
+
+  const rtMatch = /^\{\{runtime:(.+)\}\}$/.exec(key);
+  if (rtMatch) {
+    const rtName = rtMatch[1]!;
+    for (const target of Object.values(deployedState.targets)) {
+      const rt = target.resources?.runtimes?.[rtName];
+      if (rt) return rt.runtimeArn;
+    }
+  }
+
+  const gwMatch = /^\{\{gateway:(.+)\}\}$/.exec(key);
+  if (gwMatch) {
+    const gwName = gwMatch[1]!;
+    for (const target of Object.values(deployedState.targets)) {
+      const httpGw = target.resources?.httpGateways?.[gwName];
+      if (httpGw) return httpGw.gatewayArn;
+      const mcpGw = target.resources?.mcp?.gateways?.[gwName];
+      if (mcpGw) return mcpGw.gatewayArn;
+    }
+  }
+
+  return key;
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
diff --git a/src/cli/operations/recommendation/types.ts b/src/cli/operations/recommendation/types.ts
new file mode 100644
index 000000000..426ba84a8
--- /dev/null
+++ b/src/cli/operations/recommendation/types.ts
@@ -0,0 +1,72 @@
+/**
+ * Shared types for the recommendation feature.
+ */
+import type { RecommendationResult, RecommendationType } from '../../aws/agentcore-recommendation';
+
+export type { RecommendationType } from '../../aws/agentcore-recommendation';
+
+/** CLI-facing input source kind (maps to API config shape). */
+export type RecommendationInputSourceKind = 'config-bundle' | 'inline' | 'file';
+
+/** CLI-facing trace source kind (maps to API agentTraces shape). */
+export type TraceSourceKind = 'cloudwatch' | 'sessions' | 'spans-file';
+
+export interface RunRecommendationCommandOptions {
+  /** What to optimize */
+  type: RecommendationType;
+  /** Agent name (from project) */
+  agent: string;
+  /** Evaluator name, Builtin.* ID, or ARN (API accepts exactly one for system-prompt) */
+  evaluators: string[];
+  /** Input source kind */
+  inputSource: RecommendationInputSourceKind;
+  /** Config bundle name (when inputSource is 'config-bundle') */
+  bundleName?: string;
+  /** Config bundle version (when inputSource is 'config-bundle') */
+  bundleVersion?: string;
+  /** JSONPath to the system prompt field within the config bundle (when inputSource is 'config-bundle') */
+  systemPromptJsonPath?: string;
+  /** Tool name → JSONPath pairs for tool descriptions within the config bundle (when inputSource is 'config-bundle') */
+  toolDescJsonPaths?: { toolName: string; toolDescriptionJsonPath: string }[];
+  /** Inline content (when inputSource is 'inline') */
+  inlineContent?: string;
+  /** File path (when inputSource is 'file') */
+  promptFile?: string;
+  /** Specific tool names and descriptions (for TOOL_DESCRIPTION_RECOMMENDATION) */
+  tools?: string[];
+  /** Trace source kind */
+  traceSource: TraceSourceKind;
+  /** Lookback days (when traceSource is 'cloudwatch') */
+  lookbackDays?: number;
+  /** Session IDs (when traceSource is 'sessions') — used to filter CloudWatch traces */
+  sessionIds?: string[];
+  /** Path to JSON file containing session spans (when traceSource is 'spans-file') */
+  spansFile?: string;
+  /** Region override */
+  region?: string;
+  /** Optional recommendation name */
+  recommendationName?: string;
+  /** Poll interval in ms */
+  pollIntervalMs?: number;
+  /** Max polling duration in ms before timing out */
+  maxPollDurationMs?: number;
+  /** Progress callback */
+  onProgress?: (status: string, message: string) => void;
+  /** Called once the recommendation has been created, with ID and region for cancellation */
+  onStarted?: (info: { recommendationId: string; region: string }) => void;
+}
+
+export interface RunRecommendationCommandResult {
+  success: boolean;
+  error?: string;
+  recommendationId?: string;
+  status?: string;
+  /** The recommendation result from the API (populated on COMPLETED) */
+  result?: RecommendationResult;
+  /** Resolved AWS region used for the recommendation */
+  region?: string;
+  startedAt?: string;
+  completedAt?: string;
+  /** Path to the execution log file */
+  logFilePath?: string;
+}
diff --git a/src/cli/operations/resolve-agent.ts b/src/cli/operations/resolve-agent.ts
index 8f8ee6ba3..461a348ee 100644
--- a/src/cli/operations/resolve-agent.ts
+++ b/src/cli/operations/resolve-agent.ts
@@ -1,5 +1,6 @@
 import { ConfigIO } from '../../lib';
 import type { AgentCoreProjectSpec, AwsDeploymentTargets, DeployedState } from '../../schema';
+import { getHarness } from '../aws/agentcore-harness';
 
 export interface DeployedProjectConfig {
   project: AgentCoreProjectSpec;
@@ -97,3 +98,130 @@ export function resolveAgent(
     },
   };
 }
+
+/**
+ * Resolves a harness to a ResolvedAgent by looking up deployed state and
+ * fetching the underlying agentRuntimeArn via the GetHarness API.
+ */
+export async function resolveHarness(
+  context: DeployedProjectConfig,
+  harnessName: string
+): Promise<{ success: true; agent: ResolvedAgent } | { success: false; error: string }> {
+  const { project, deployedState, awsTargets } = context;
+
+  const harnesses = project.harnesses ?? [];
+  const harnessSpec = harnesses.find(h => h.name === harnessName);
+  if (!harnessSpec) {
+    const available = harnesses.map(h => h.name);
+    return {
+      success: false,
+      error:
+        available.length > 0
+          ? `Harness '${harnessName}' not found. Available: ${available.join(', ')}`
+          : 'No harnesses defined in agentcore.json',
+    };
+  }
+
+  const targetNames = Object.keys(deployedState.targets);
+  if (targetNames.length === 0) {
+    return { success: false, error: 'No deployed targets found. Run `agentcore deploy` first.' };
+  }
+  const selectedTargetName = targetNames[0]!;
+
+  const targetState = deployedState.targets[selectedTargetName];
+  const targetConfig = awsTargets.find(t => t.name === selectedTargetName);
+
+  if (!targetConfig) {
+    return { success: false, error: `Target config '${selectedTargetName}' not found in aws-targets` };
+  }
+
+  const harnessState = targetState?.resources?.harnesses?.[harnessName];
+  if (!harnessState) {
+    return {
+      success: false,
+      error: `Harness '${harnessName}' is not deployed to target '${selectedTargetName}'. Run 'agentcore deploy' first.`,
+    };
+  }
+
+  // If agentRuntimeArn is in deployed state, extract runtimeId from it
+  let runtimeId: string | undefined;
+
+  if (harnessState.agentRuntimeArn) {
+    const arnMatch = /runtime\/([^/]+)/.exec(harnessState.agentRuntimeArn);
+    if (arnMatch) {
+      runtimeId = arnMatch[1];
+    }
+  }
+
+  // Fallback: call GetHarness API to confirm it exists, then use harnessId as runtimeId
+  if (!runtimeId) {
+    try {
+      await getHarness({ region: targetConfig.region, harnessId: harnessState.harnessId });
+      runtimeId = harnessState.harnessId;
+    } catch (err) {
+      return {
+        success: false,
+        error: `Failed to resolve runtime for harness '${harnessName}': ${(err as Error).message}`,
+      };
+    }
+  }
+
+  if (!runtimeId) {
+    return {
+      success: false,
+      error: `Could not resolve runtime ID for harness '${harnessName}'. Re-deploy to populate agentRuntimeArn.`,
+    };
+  }
+
+  return {
+    success: true,
+    agent: {
+      agentName: harnessName,
+      targetName: selectedTargetName,
+      region: targetConfig.region,
+      accountId: targetConfig.account,
+      runtimeId,
+    },
+  };
+}
+
+/**
+ * Resolves to a runtime or harness based on options and project config.
+ * - If --harness is specified, resolves that harness.
+ * - If --runtime is specified, resolves that runtime.
+ * - If neither is specified, auto-selects: single runtime wins, or if no runtimes
+ *   but harnesses exist, auto-selects the single harness. Multiple harnesses
+ *   without a flag produces an error listing available options.
+ */
+export async function resolveAgentOrHarness(
+  context: DeployedProjectConfig,
+  options: { runtime?: string; harness?: string }
+): Promise<{ success: true; agent: ResolvedAgent } | { success: false; error: string }> {
+  if (options.harness && options.runtime) {
+    return { success: false, error: 'Cannot specify both --harness and --runtime' };
+  }
+
+  if (options.harness) {
+    return resolveHarness(context, options.harness);
+  }
+
+  if (options.runtime || context.project.runtimes.length > 0) {
+    return resolveAgent(context, options);
+  }
+
+  // No runtimes — try harnesses
+  const harnesses = context.project.harnesses ?? [];
+  if (harnesses.length === 0) {
+    return { success: false, error: 'No runtimes or harnesses defined in agentcore.json' };
+  }
+
+  if (harnesses.length > 1) {
+    const names = harnesses.map(h => h.name);
+    return {
+      success: false,
+      error: `Multiple harnesses found. Use --harness to specify one: ${names.join(', ')}`,
+    };
+  }
+
+  return resolveHarness(context, harnesses[0]!.name);
+}
diff --git a/src/cli/primitives/ABTestPrimitive.ts b/src/cli/primitives/ABTestPrimitive.ts
new file mode 100644
index 000000000..9dd973571
--- /dev/null
+++ b/src/cli/primitives/ABTestPrimitive.ts
@@ -0,0 +1,728 @@
+import { findConfigRoot } from '../../lib';
+import type { ABTest } from '../../schema/schemas/primitives/ab-test';
+import { ABTestSchema } from '../../schema/schemas/primitives/ab-test';
+import { getErrorMessage } from '../errors';
+import type { RemovalPreview, RemovalResult, SchemaChange } from '../operations/remove/types';
+import { requireTTY } from '../tui/guards/tty';
+import { BasePrimitive } from './BasePrimitive';
+import type { AddResult, AddScreenComponent, RemovableResource } from './types';
+import type { Command } from '@commander-js/extra-typings';
+
+export type GatewayChoice = { type: 'create-new' } | { type: 'existing-http'; name: string };
+
+export interface AddABTestOptions {
+  name: string;
+  description?: string;
+  agent: string;
+  gatewayChoice?: GatewayChoice;
+  roleArn?: string;
+  controlBundle: string;
+  controlVersion: string;
+  treatmentBundle: string;
+  treatmentVersion: string;
+  controlWeight: number;
+  treatmentWeight: number;
+  onlineEval: string;
+  trafficHeaderName?: string;
+  maxDurationDays?: number;
+  enableOnCreate?: boolean;
+}
+
+export interface AddTargetBasedABTestOptions {
+  name: string;
+  description?: string;
+  gateway: string;
+  runtime: string;
+  roleArn?: string;
+  controlEndpoint: string;
+  treatmentEndpoint: string;
+  controlWeight: number;
+  treatmentWeight: number;
+  controlOnlineEval: string;
+  treatmentOnlineEval: string;
+  gatewayFilter?: string;
+  enableOnCreate?: boolean;
+}
+
+export type RemovableABTest = RemovableResource;
+
+/**
+ * ABTestPrimitive handles all A/B test add/remove operations.
+ *
+ * A/B tests split traffic between two config bundle versions (control vs
+ * treatment) through a gateway, with online evaluation tracking performance.
+ * They are created via direct API calls (not CloudFormation) and stored in
+ * agentcore.json for lifecycle management.
+ */
+export class ABTestPrimitive extends BasePrimitive<AddABTestOptions, RemovableABTest> {
+  readonly kind = 'ab-test' as const;
+  readonly label = 'AB Test';
+  override readonly article = 'an';
+  readonly primitiveSchema = ABTestSchema;
+
+  async add(options: AddABTestOptions): Promise<AddResult<{ abTestName: string }>> {
+    try {
+      const abTest = await this.createABTest(options);
+      return { success: true, abTestName: abTest.name };
+    } catch (err) {
+      return { success: false, error: getErrorMessage(err) };
+    }
+  }
+
+  async remove(testName: string, options?: { deleteGateway?: boolean }): Promise<RemovalResult> {
+    try {
+      const project = await this.readProjectSpec();
+
+      const index = (project.abTests ?? []).findIndex(t => t.name === testName);
+      if (index === -1) {
+        return { success: false, error: `AB test "${testName}" not found.` };
+      }
+
+      const removedTest = project.abTests[index]!;
+      project.abTests.splice(index, 1);
+
+      // Cascade: remove auto-created online eval configs for target-based tests
+      // Only remove eval configs that were auto-created (matching the {testName}_eval_ prefix pattern)
+      if (removedTest.mode === 'target-based' && 'perVariantOnlineEvaluationConfig' in removedTest.evaluationConfig) {
+        const autoCreatedPrefix = `${testName}_eval_`;
+        const evalNames = removedTest.evaluationConfig.perVariantOnlineEvaluationConfig
+          .map(pv => pv.onlineEvaluationConfigArn)
+          .filter(name => name.startsWith(autoCreatedPrefix));
+        project.onlineEvalConfigs = project.onlineEvalConfigs.filter(c => !evalNames.includes(c.name));
+      }
+
+      // --delete-gateway: cascade remove gateway targets and orphaned gateways
+      if (options?.deleteGateway && removedTest.gatewayRef) {
+        const gwMatch = /^\{\{gateway:(.+)\}\}$/.exec(removedTest.gatewayRef);
+        if (gwMatch) {
+          const gwName = gwMatch[1]!;
+
+          // Remove gateway targets that were created for this AB test's variants
+          if (removedTest.mode === 'target-based') {
+            const targetNames = removedTest.variants
+              .map(v => v.variantConfiguration.target?.targetName)
+              .filter((n): n is string => !!n);
+            const gw = (project.httpGateways ?? []).find(g => g.name === gwName);
+            if (gw?.targets) {
+              gw.targets = gw.targets.filter(t => !targetNames.includes(t.name));
+            }
+          }
+
+          // Remove gateway if no other AB tests reference it
+          const stillReferenced = (project.abTests ?? []).some(t => {
+            const m = /^\{\{gateway:(.+)\}\}$/.exec(t.gatewayRef);
+            return m?.[1] === gwName;
+          });
+          if (!stillReferenced) {
+            project.httpGateways = (project.httpGateways ?? []).filter(gw => gw.name !== gwName);
+          }
+        }
+      }
+
+      await this.writeProjectSpec(project);
+
+      return { success: true };
+    } catch (err) {
+      return { success: false, error: getErrorMessage(err) };
+    }
+  }
+
+  async previewRemove(testName: string): Promise<RemovalPreview> {
+    const project = await this.readProjectSpec();
+
+    const abTest = (project.abTests ?? []).find(t => t.name === testName);
+    if (!abTest) {
+      throw new Error(`AB test "${testName}" not found.`);
+    }
+
+    const summary: string[] = [`Removing AB test: ${testName}`];
+    const schemaChanges: SchemaChange[] = [];
+
+    const testIndex = (project.abTests ?? []).findIndex(t => t.name === testName);
+    const afterSpec = {
+      ...project,
+      abTests: (project.abTests ?? []).filter(t => t.name !== testName),
+      httpGateways: [...(project.httpGateways ?? [])],
+    };
+
+    // Check if the gateway would be orphaned
+    const test = (project.abTests ?? [])[testIndex];
+    if (test?.gatewayRef) {
+      const gwMatch = /^\{\{gateway:(.+)\}\}$/.exec(test.gatewayRef);
+      if (gwMatch) {
+        const gwName = gwMatch[1];
+        const otherTests = (project.abTests ?? []).filter((_, i) => i !== testIndex);
+        const stillReferenced = otherTests.some(t => {
+          const m = /^\{\{gateway:(.+)\}\}$/.exec(t.gatewayRef);
+          return m && m[1] === gwName;
+        });
+        if (!stillReferenced) {
+          summary.push(`Also removing HTTP gateway: ${gwName} (no other AB tests reference it)`);
+          afterSpec.httpGateways = (project.httpGateways ?? []).filter(gw => gw.name !== gwName);
+        }
+      }
+    }
+
+    schemaChanges.push({
+      file: 'agentcore/agentcore.json',
+      before: project,
+      after: afterSpec,
+    });
+
+    return { summary, directoriesToDelete: [], schemaChanges };
+  }
+
+  async getRemovable(): Promise<RemovableABTest[]> {
+    try {
+      const project = await this.readProjectSpec();
+      return (project.abTests ?? []).map(t => ({ name: t.name }));
+    } catch {
+      return [];
+    }
+  }
+
+  async getAllNames(): Promise<string[]> {
+    try {
+      const project = await this.readProjectSpec();
+      return (project.abTests ?? []).map(t => t.name);
+    } catch {
+      return [];
+    }
+  }
+
+  registerCommands(addCmd: Command, removeCmd: Command): void {
+    const abTestCmd = addCmd
+      .command('ab-test')
+      .description('[preview] Add an A/B test to the project')
+      .option('--mode <mode>', 'config-bundle (default) or target-based')
+      .option('--name <name>', 'AB test name')
+      .option('--description <text>', 'AB test description')
+      .option('--runtime <name>', 'Runtime agent to A/B test')
+      .option('--role-arn <arn>', 'IAM role ARN (auto-created if not provided)')
+      .option('--control-bundle <name>', 'Control config bundle name or ARN')
+      .option('--control-version <id>', 'Control config bundle version')
+      .option('--treatment-bundle <name>', 'Treatment config bundle name or ARN')
+      .option('--treatment-version <id>', 'Treatment config bundle version')
+      .option('--control-endpoint <endpoint>', 'Endpoint qualifier for control')
+      .option('--treatment-endpoint <endpoint>', 'Endpoint qualifier for treatment')
+      .option('--control-weight <n>', 'Traffic weight for control (1-100)', parseInt)
+      .option('--treatment-weight <n>', 'Traffic weight for treatment (1-100)', parseInt)
+      .option('--gateway <name>', 'HTTP gateway name')
+      .option('--online-eval <name>', 'Online evaluation config name or ARN')
+      .option('--control-online-eval <name>', 'Eval config name or ARN for control')
+      .option('--treatment-online-eval <name>', 'Eval config name or ARN for treatment')
+      .option('--gateway-filter <pattern>', 'Path pattern for routing')
+      .option('--traffic-header <name>', 'Header name for traffic routing')
+      // Hidden deprecated aliases for backwards compatibility
+      .option('--control-qualifier <endpoint>', '')
+      .option('--treatment-qualifier <endpoint>', '')
+      // TODO(post-preview): Re-enable --max-duration once configurable duration is launched.
+      // .option('--max-duration <days>', 'Maximum duration in days (1-90)', parseInt)
+      .option('--enable', 'Enable the AB test on creation')
+      .option('--json', 'Output as JSON');
+
+    // Hide mode-specific and deprecated flags from the default options list.
+    // They are shown in the grouped help text below instead.
+    const hiddenFromDefaultHelp = new Set([
+      '--runtime',
+      '--control-bundle',
+      '--control-version',
+      '--treatment-bundle',
+      '--treatment-version',
+      '--online-eval',
+      '--traffic-header',
+      '--control-endpoint',
+      '--treatment-endpoint',
+      '--control-online-eval',
+      '--treatment-online-eval',
+      '--gateway-filter',
+      '--control-qualifier',
+      '--treatment-qualifier',
+    ]);
+    for (const opt of abTestCmd.options) {
+      if (hiddenFromDefaultHelp.has(opt.long ?? '')) {
+        opt.hidden = true;
+      }
+    }
+
+    // Add grouped help text after the default options section
+    abTestCmd.addHelpText(
+      'after',
+      `
+Config-Bundle Mode (--mode config-bundle) -- default
+  Split traffic between two config bundle versions.
+  --runtime <name>                 Runtime agent to A/B test
+  --control-bundle <name>          Control config bundle name or ARN
+  --control-version <id>           Control config bundle version
+  --treatment-bundle <name>        Treatment config bundle name or ARN
+  --treatment-version <id>         Treatment config bundle version
+  --online-eval <name>             Online evaluation config name or ARN
+  --traffic-header <name>          Header name for traffic routing
+
+Target-Based Mode (--mode target-based)
+  Route traffic to different runtime endpoints.
+  --control-endpoint <endpoint>    Endpoint for control target
+  --treatment-endpoint <endpoint>  Endpoint for treatment target
+  --control-online-eval <name>     Eval config name or ARN for control
+  --treatment-online-eval <name>   Eval config name or ARN for treatment
+  --gateway-filter <pattern>       Path pattern for routing
+`
+    );
+
+    abTestCmd.action(
+      async (cliOptions: {
+        mode?: string;
+        name?: string;
+        description?: string;
+        runtime?: string;
+        gateway?: string;
+        roleArn?: string;
+        controlBundle?: string;
+        controlVersion?: string;
+        treatmentBundle?: string;
+        treatmentVersion?: string;
+        controlEndpoint?: string;
+        controlQualifier?: string; // deprecated alias for --control-endpoint
+        treatmentEndpoint?: string;
+        treatmentQualifier?: string; // deprecated alias for --treatment-endpoint
+        controlWeight?: number;
+        treatmentWeight?: number;
+        onlineEval?: string;
+        controlOnlineEval?: string;
+        treatmentOnlineEval?: string;
+        gatewayFilter?: string;
+        trafficHeader?: string;
+        maxDuration?: number;
+        enable?: boolean;
+        json?: boolean;
+      }) => {
+        try {
+          if (!findConfigRoot()) {
+            console.error('No agentcore project found. Run `agentcore create` first.');
+            process.exit(1);
+          }
+
+          // Resolve deprecated aliases (--control-qualifier -> --control-endpoint, etc.)
+          const resolvedControlEndpoint = cliOptions.controlEndpoint ?? cliOptions.controlQualifier;
+          const resolvedTreatmentEndpoint = cliOptions.treatmentEndpoint ?? cliOptions.treatmentQualifier;
+
+          if (cliOptions.name || cliOptions.json) {
+            const fail = (error: string) => {
+              if (cliOptions.json) {
+                console.log(JSON.stringify({ success: false, error }));
+              } else {
+                console.error(error);
+              }
+              process.exit(1);
+            };
+
+            const mode = cliOptions.mode ?? 'config-bundle';
+            if (mode !== 'config-bundle' && mode !== 'target-based') {
+              fail(`Invalid --mode "${mode}". Must be one of: config-bundle, target-based`);
+            }
+
+            if (!cliOptions.name) fail('--name is required');
+
+            // Target-based mode
+            if (mode === 'target-based') {
+              // Cross-validation: reject config-bundle flags
+              if (cliOptions.controlBundle) fail('--control-bundle cannot be used with --mode target-based');
+              if (cliOptions.treatmentBundle) fail('--treatment-bundle cannot be used with --mode target-based');
+              if (cliOptions.controlVersion) fail('--control-version cannot be used with --mode target-based');
+              if (cliOptions.treatmentVersion) fail('--treatment-version cannot be used with --mode target-based');
+              if (cliOptions.onlineEval) fail('--online-eval cannot be used with --mode target-based');
+
+              // Required flags
+              if (!cliOptions.gateway) fail('--gateway is required for target-based mode');
+              if (!cliOptions.runtime) fail('--runtime is required for target-based mode');
+              if (!resolvedControlEndpoint) fail('--control-endpoint is required for target-based mode');
+              if (!resolvedTreatmentEndpoint) fail('--treatment-endpoint is required for target-based mode');
+              if (cliOptions.controlWeight === undefined) fail('--control-weight is required');
+              if (cliOptions.treatmentWeight === undefined) fail('--treatment-weight is required');
+
+              // Eval: require both online eval config names
+              if (!cliOptions.controlOnlineEval || !cliOptions.treatmentOnlineEval) {
+                fail(
+                  '--control-online-eval and --treatment-online-eval are required. Create eval configs first with: agentcore add online-eval --endpoint <name>'
+                );
+              }
+
+              const result = await this.addTargetBased({
+                name: cliOptions.name!,
+                description: cliOptions.description,
+                gateway: cliOptions.gateway!,
+                runtime: cliOptions.runtime!,
+                roleArn: cliOptions.roleArn,
+                controlEndpoint: resolvedControlEndpoint!,
+                treatmentEndpoint: resolvedTreatmentEndpoint!,
+                controlWeight: cliOptions.controlWeight!,
+                treatmentWeight: cliOptions.treatmentWeight!,
+                controlOnlineEval: cliOptions.controlOnlineEval!,
+                treatmentOnlineEval: cliOptions.treatmentOnlineEval!,
+                gatewayFilter: cliOptions.gatewayFilter,
+                enableOnCreate: cliOptions.enable,
+              });
+
+              if (cliOptions.json) {
+                console.log(JSON.stringify(result));
+              } else if (result.success) {
+                console.log(`Added target-based AB test '${result.abTestName}'`);
+              } else {
+                console.error(result.error);
+              }
+              process.exit(result.success ? 0 : 1);
+              return;
+            }
+
+            // Config-bundle mode (default)
+            // Cross-validation: reject target-based flags
+            if (cliOptions.gatewayFilter) fail('--gateway-filter requires --mode target-based');
+            if (cliOptions.controlOnlineEval) fail('--control-online-eval requires --mode target-based');
+            if (cliOptions.treatmentOnlineEval) fail('--treatment-online-eval requires --mode target-based');
+
+            if (!cliOptions.gateway && !cliOptions.runtime)
+              fail('--runtime is required (unless --gateway is provided)');
+            if (!cliOptions.controlBundle) fail('--control-bundle is required');
+            if (!cliOptions.controlVersion) fail('--control-version is required');
+            if (!cliOptions.treatmentBundle) fail('--treatment-bundle is required');
+            if (!cliOptions.treatmentVersion) fail('--treatment-version is required');
+            if (cliOptions.controlWeight === undefined) fail('--control-weight is required');
+            if (cliOptions.treatmentWeight === undefined) fail('--treatment-weight is required');
+            if (!cliOptions.onlineEval) fail('--online-eval is required');
+
+            const result = await this.add({
+              name: cliOptions.name!,
+              description: cliOptions.description,
+              agent: cliOptions.runtime ?? '',
+              gatewayChoice: cliOptions.gateway
+                ? { type: 'existing-http', name: cliOptions.gateway }
+                : { type: 'create-new' },
+              roleArn: cliOptions.roleArn!,
+              controlBundle: cliOptions.controlBundle!,
+              controlVersion: cliOptions.controlVersion!,
+              treatmentBundle: cliOptions.treatmentBundle!,
+              treatmentVersion: cliOptions.treatmentVersion!,
+              controlWeight: cliOptions.controlWeight!,
+              treatmentWeight: cliOptions.treatmentWeight!,
+              onlineEval: cliOptions.onlineEval!,
+              trafficHeaderName: cliOptions.trafficHeader,
+              maxDurationDays: cliOptions.maxDuration,
+              enableOnCreate: cliOptions.enable,
+            });
+
+            if (cliOptions.json) {
+              console.log(JSON.stringify(result));
+            } else if (result.success) {
+              console.log(`Added AB test '${result.abTestName}'`);
+            } else {
+              console.error(result.error);
+            }
+            process.exit(result.success ? 0 : 1);
+          } else {
+            // TUI fallback
+            const [{ render }, { default: React }, { AddFlow }] = await Promise.all([
+              import('ink'),
+              import('react'),
+              import('../tui/screens/add/AddFlow'),
+            ]);
+            const { clear, unmount } = render(
+              React.createElement(AddFlow, {
+                isInteractive: false,
+                initialResource: 'ab-test',
+                onExit: () => {
+                  clear();
+                  unmount();
+                  process.exit(0);
+                },
+              })
+            );
+          }
+        } catch (error) {
+          if (cliOptions.json) {
+            console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+          } else {
+            console.error(getErrorMessage(error));
+          }
+          process.exit(1);
+        }
+      }
+    );
+
+    removeCmd
+      .command(this.kind)
+      .description(`Remove ${this.article} ${this.label.toLowerCase()} from the project`)
+      .option('--name <name>', 'Name of resource to remove [non-interactive]')
+      .option('-y, --yes', 'Skip confirmation prompt [non-interactive]')
+      .option('--json', 'Output as JSON [non-interactive]')
+      .option('--delete-gateway', 'Also remove gateway targets and orphaned gateways (default: false)')
+      .action(async (cliOptions: { name?: string; yes?: boolean; json?: boolean; deleteGateway?: boolean }) => {
+        try {
+          if (!findConfigRoot()) {
+            console.error('No agentcore project found. Run `agentcore create` first.');
+            process.exit(1);
+          }
+
+          if (cliOptions.name || cliOptions.yes || cliOptions.json) {
+            if (!cliOptions.name) {
+              console.log(JSON.stringify({ success: false, error: '--name is required' }));
+              process.exit(1);
+            }
+
+            const result = await this.remove(cliOptions.name, { deleteGateway: cliOptions.deleteGateway });
+            console.log(
+              JSON.stringify({
+                success: result.success,
+                resourceType: this.kind,
+                resourceName: cliOptions.name,
+                message: result.success ? `Removed ${this.label.toLowerCase()} '${cliOptions.name}'` : undefined,
+                error: !result.success ? result.error : undefined,
+              })
+            );
+            process.exit(result.success ? 0 : 1);
+          } else {
+            // TUI fallback
+            requireTTY();
+            const [{ render }, { default: React }, { RemoveFlow }] = await Promise.all([
+              import('ink'),
+              import('react'),
+              import('../tui/screens/remove'),
+            ]);
+            const { clear, unmount } = render(
+              React.createElement(RemoveFlow, {
+                isInteractive: false,
+                force: cliOptions.yes,
+                initialResourceType: this.kind,
+                initialResourceName: cliOptions.name,
+                onExit: () => {
+                  clear();
+                  unmount();
+                  process.exit(0);
+                },
+              })
+            );
+          }
+        } catch (error) {
+          if (cliOptions.json) {
+            console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+          } else {
+            console.error(`Error: ${getErrorMessage(error)}`);
+          }
+          process.exit(1);
+        }
+      });
+  }
+
+  addScreen(): AddScreenComponent {
+    return null;
+  }
+
+  private async createABTest(options: AddABTestOptions): Promise<ABTest> {
+    const project = await this.readProjectSpec();
+
+    this.checkDuplicate(project.abTests ?? [], options.name);
+
+    // Resolve gateway reference based on the user's choice
+    let gatewayRef: string;
+    const choice = options.gatewayChoice ?? { type: 'create-new' };
+
+    if (choice.type === 'existing-http') {
+      // Reuse an existing HTTP gateway from the project spec
+      const existing = (project.httpGateways ?? []).find(gw => gw.name === choice.name);
+      if (!existing) {
+        throw new Error(`HTTP gateway "${choice.name}" not found in project.`);
+      }
+      gatewayRef = `{{gateway:${choice.name}}}`;
+    } else {
+      // Create new HTTP gateway — truncate name to fit 48-char limit
+      const httpGwName = `${options.name.replace(/_/g, '-').slice(0, 44)}-gw`;
+      const existingGw = (project.httpGateways ?? []).find(gw => gw.name === httpGwName);
+      if (existingGw) {
+        if (existingGw.runtimeRef !== options.agent) {
+          throw new Error(
+            `HTTP gateway "${httpGwName}" already exists with a different runtime (${existingGw.runtimeRef}). ` +
+              `Choose a different AB test name to avoid a gateway name collision.`
+          );
+        }
+      } else {
+        project.httpGateways ??= [];
+        project.httpGateways.push({
+          name: httpGwName,
+          runtimeRef: options.agent,
+        });
+      }
+      gatewayRef = `{{gateway:${httpGwName}}}`;
+    }
+
+    const abTest: ABTest = {
+      name: options.name,
+      mode: 'config-bundle',
+      ...(options.description && { description: options.description }),
+      gatewayRef,
+      ...(options.roleArn && { roleArn: options.roleArn }),
+      variants: [
+        {
+          name: 'C',
+          weight: options.controlWeight,
+          variantConfiguration: {
+            configurationBundle: {
+              bundleArn: options.controlBundle,
+              bundleVersion: options.controlVersion,
+            },
+          },
+        },
+        {
+          name: 'T1',
+          weight: options.treatmentWeight,
+          variantConfiguration: {
+            configurationBundle: {
+              bundleArn: options.treatmentBundle,
+              bundleVersion: options.treatmentVersion,
+            },
+          },
+        },
+      ],
+      evaluationConfig: {
+        onlineEvaluationConfigArn: options.onlineEval,
+      },
+      ...(options.trafficHeaderName && {
+        trafficAllocationConfig: { routeOnHeader: { headerName: options.trafficHeaderName } },
+      }),
+      ...(options.maxDurationDays !== undefined && { maxDurationDays: options.maxDurationDays }),
+      ...(options.enableOnCreate !== undefined && { enableOnCreate: options.enableOnCreate }),
+    };
+
+    project.abTests ??= [];
+    project.abTests.push(abTest);
+    await this.writeProjectSpec(project);
+
+    return abTest;
+  }
+
+  async addTargetBased(options: AddTargetBasedABTestOptions): Promise<AddResult<{ abTestName: string }>> {
+    try {
+      const abTest = await this.createTargetBasedABTest(options);
+      return { success: true, abTestName: abTest.name };
+    } catch (err) {
+      return { success: false, error: getErrorMessage(err) };
+    }
+  }
+
+  private async createTargetBasedABTest(options: AddTargetBasedABTestOptions): Promise<ABTest> {
+    const project = await this.readProjectSpec();
+
+    this.checkDuplicate(project.abTests ?? [], options.name);
+
+    // Validate runtime exists
+    const runtime = project.runtimes.find(r => r.name === options.runtime);
+    if (!runtime) {
+      throw new Error(`Runtime "${options.runtime}" not found in project.`);
+    }
+
+    // Validate endpoints exist on the runtime
+    if (!runtime.endpoints?.[options.controlEndpoint]) {
+      throw new Error(
+        `Endpoint "${options.controlEndpoint}" not found on runtime "${options.runtime}". Add it with: agentcore add runtime-endpoint`
+      );
+    }
+    if (!runtime.endpoints?.[options.treatmentEndpoint]) {
+      throw new Error(
+        `Endpoint "${options.treatmentEndpoint}" not found on runtime "${options.runtime}". Add it with: agentcore add runtime-endpoint`
+      );
+    }
+
+    // Auto-generate target names from runtime + qualifier
+    const controlTarget = `${options.runtime}-${options.controlEndpoint}`;
+    const treatmentTarget = `${options.runtime}-${options.treatmentEndpoint}`;
+
+    // Auto-create HTTP gateway if it doesn't exist
+    let existing = (project.httpGateways ?? []).find(gw => gw.name === options.gateway);
+    if (!existing) {
+      existing = {
+        name: options.gateway,
+        description: `HTTP gateway for AB test ${options.name}`,
+        runtimeRef: options.runtime,
+        targets: [
+          { name: controlTarget, runtimeRef: options.runtime, qualifier: options.controlEndpoint },
+          { name: treatmentTarget, runtimeRef: options.runtime, qualifier: options.treatmentEndpoint },
+        ],
+      };
+      project.httpGateways ??= [];
+      project.httpGateways.push(existing);
+    } else {
+      // Gateway exists — ensure targets exist
+      existing.targets ??= [];
+      if (!existing.targets.find(t => t.name === controlTarget)) {
+        existing.targets.push({
+          name: controlTarget,
+          runtimeRef: options.runtime,
+          qualifier: options.controlEndpoint,
+        });
+      }
+      if (!existing.targets.find(t => t.name === treatmentTarget)) {
+        existing.targets.push({
+          name: treatmentTarget,
+          runtimeRef: options.runtime,
+          qualifier: options.treatmentEndpoint,
+        });
+      }
+    }
+    const gatewayRef = `{{gateway:${options.gateway}}}`;
+
+    // Look up online eval configs by name
+    const controlEvalConfig = project.onlineEvalConfigs.find(c => c.name === options.controlOnlineEval);
+    if (!controlEvalConfig) {
+      throw new Error(
+        `Online eval config '${options.controlOnlineEval}' not found. Create it first with: agentcore add online-eval`
+      );
+    }
+    const treatmentEvalConfig = project.onlineEvalConfigs.find(c => c.name === options.treatmentOnlineEval);
+    if (!treatmentEvalConfig) {
+      throw new Error(
+        `Online eval config '${options.treatmentOnlineEval}' not found. Create it first with: agentcore add online-eval`
+      );
+    }
+
+    // Store eval names — post-deploy resolveOnlineEvalArn will resolve names to ARNs
+    const evaluationConfig: ABTest['evaluationConfig'] = {
+      perVariantOnlineEvaluationConfig: [
+        { treatmentName: 'C' as const, onlineEvaluationConfigArn: options.controlOnlineEval },
+        { treatmentName: 'T1' as const, onlineEvaluationConfigArn: options.treatmentOnlineEval },
+      ],
+    };
+
+    const abTest: ABTest = {
+      name: options.name,
+      mode: 'target-based',
+      ...(options.description && { description: options.description }),
+      gatewayRef,
+      ...(options.roleArn && { roleArn: options.roleArn }),
+      variants: [
+        {
+          name: 'C' as const,
+          weight: options.controlWeight,
+          variantConfiguration: {
+            target: { targetName: controlTarget },
+          },
+        },
+        {
+          name: 'T1' as const,
+          weight: options.treatmentWeight,
+          variantConfiguration: {
+            target: { targetName: treatmentTarget },
+          },
+        },
+      ],
+      evaluationConfig,
+      ...(options.gatewayFilter && {
+        gatewayFilter: { targetPaths: [options.gatewayFilter] },
+      }),
+      ...(options.enableOnCreate !== undefined && { enableOnCreate: options.enableOnCreate }),
+    };
+
+    project.abTests ??= [];
+    project.abTests.push(abTest);
+    await this.writeProjectSpec(project);
+
+    return abTest;
+  }
+}
diff --git a/src/cli/primitives/AgentPrimitive.tsx b/src/cli/primitives/AgentPrimitive.tsx
index 4702633ed..b9873990b 100644
--- a/src/cli/primitives/AgentPrimitive.tsx
+++ b/src/cli/primitives/AgentPrimitive.tsx
@@ -25,6 +25,7 @@ import { parseAndNormalizeHeaders } from '../commands/shared/header-utils';
 import type { VpcOptions } from '../commands/shared/vpc-utils';
 import { VPC_ENDPOINT_WARNING, parseCommaSeparatedList } from '../commands/shared/vpc-utils';
 import { getErrorMessage } from '../errors';
+import { createConfigBundleForAgent } from '../operations/agent/config-bundle-defaults';
 import {
   mapGenerateConfigToRenderConfig,
   mapModelProviderToCredentials,
@@ -34,6 +35,19 @@ import {
 import { executeImportAgent } from '../operations/agent/import';
 import { setupPythonProject } from '../operations/python';
 import type { RemovalPreview, RemovalResult, SchemaChange } from '../operations/remove/types';
+import { cliCommandRun } from '../telemetry/cli-command-run.js';
+import {
+  AgentType,
+  AuthorizerType,
+  Build,
+  Framework,
+  Language,
+  Memory,
+  ModelProvider as ModelProviderEnum,
+  NetworkMode as NetworkModeEnum,
+  Protocol,
+  standardize,
+} from '../telemetry/schemas/common-shapes.js';
 import { createRenderer } from '../templates';
 import { requireTTY } from '../tui/guards/tty';
 import type { GenerateConfig, MemoryOption } from '../tui/screens/generate/types';
@@ -76,6 +90,7 @@ export interface AddAgentOptions extends VpcOptions {
   idleTimeout?: number;
   maxLifetime?: number;
   sessionStorageMountPath?: string;
+  withConfigBundle?: boolean;
 }
 
 /**
@@ -253,6 +268,10 @@ export class AgentPrimitive extends BasePrimitive<AddAgentOptions, RemovableReso
         '--session-storage-mount-path <path>',
         'Absolute mount path for session filesystem storage (e.g. /mnt/session-storage) [non-interactive]'
       )
+      .option(
+        '--with-config-bundle',
+        'Create a config bundle wired into the agent template [preview] [non-interactive]'
+      )
       .option('--json', 'Output as JSON [non-interactive]')
       .action(async options => {
         if (!findConfigRoot()) {
@@ -264,92 +283,107 @@ export class AgentPrimitive extends BasePrimitive<AddAgentOptions, RemovableReso
 
         // Any flag triggers non-interactive CLI mode
         if (cliOptions.name || cliOptions.framework || cliOptions.json) {
-          const validation = validateAddAgentOptions(cliOptions);
-          if (!validation.valid) {
-            if (cliOptions.json) {
-              console.log(JSON.stringify({ success: false, error: validation.error }));
-            } else {
-              console.error(validation.error);
+          await cliCommandRun('add.agent', !!cliOptions.json, async () => {
+            const validation = validateAddAgentOptions(cliOptions);
+            if (!validation.valid) {
+              throw new Error(validation.error);
             }
-            process.exit(1);
-          }
-
-          // Parse custom claims JSON if provided (already validated by validateAddAgentOptions)
-          const customClaims = cliOptions.customClaims
-            ? (JSON.parse(cliOptions.customClaims) as CustomClaimValidation[])
-            : undefined;
-
-          // Parse request header allowlist if provided
-          const requestHeaderAllowlist = cliOptions.requestHeaderAllowlist
-            ? parseAndNormalizeHeaders(cliOptions.requestHeaderAllowlist)
-            : undefined;
-
-          const result = await this.add({
-            name: cliOptions.name!,
-            type: cliOptions.type ?? 'create',
-            buildType: (cliOptions.build as BuildType) ?? 'CodeZip',
-            language: cliOptions.language!,
-            framework: cliOptions.framework!,
-            modelProvider: cliOptions.modelProvider!,
-            apiKey: cliOptions.apiKey,
-            memory: cliOptions.memory,
-            protocol: cliOptions.protocol,
-            networkMode: cliOptions.networkMode,
-            subnets: cliOptions.subnets,
-            securityGroups: cliOptions.securityGroups,
-            requestHeaderAllowlist,
-            codeLocation: cliOptions.codeLocation,
-            entrypoint: cliOptions.entrypoint,
-            bedrockAgentId: cliOptions.agentId,
-            bedrockAliasId: cliOptions.agentAliasId,
-            bedrockRegion: cliOptions.region,
-            authorizerType: cliOptions.authorizerType,
-            discoveryUrl: cliOptions.discoveryUrl,
-            allowedAudience: cliOptions.allowedAudience,
-            allowedClients: cliOptions.allowedClients,
-            allowedScopes: cliOptions.allowedScopes,
-            customClaims,
-            clientId: cliOptions.clientId,
-            clientSecret: cliOptions.clientSecret,
-            idleTimeout: cliOptions.idleTimeout ? Number(cliOptions.idleTimeout) : undefined,
-            maxLifetime: cliOptions.maxLifetime ? Number(cliOptions.maxLifetime) : undefined,
-            sessionStorageMountPath: cliOptions.sessionStorageMountPath,
-          });
 
-          if (cliOptions.json) {
-            console.log(JSON.stringify(result));
-          } else if (result.success) {
-            console.log(`Added agent '${result.agentName}'`);
-            if (result.agentPath) {
-              console.log(`Agent code: ${result.agentPath}`);
+            // Parse custom claims JSON if provided (already validated by validateAddAgentOptions)
+            const customClaims = cliOptions.customClaims
+              ? (JSON.parse(cliOptions.customClaims) as CustomClaimValidation[])
+              : undefined;
+
+            // Parse request header allowlist if provided
+            const requestHeaderAllowlist = cliOptions.requestHeaderAllowlist
+              ? parseAndNormalizeHeaders(cliOptions.requestHeaderAllowlist)
+              : undefined;
+
+            const result = await this.add({
+              name: cliOptions.name!,
+              type: cliOptions.type ?? 'create',
+              buildType: (cliOptions.build as BuildType) ?? 'CodeZip',
+              language: cliOptions.language!,
+              framework: cliOptions.framework!,
+              modelProvider: cliOptions.modelProvider!,
+              apiKey: cliOptions.apiKey,
+              memory: cliOptions.memory,
+              protocol: cliOptions.protocol,
+              networkMode: cliOptions.networkMode,
+              subnets: cliOptions.subnets,
+              securityGroups: cliOptions.securityGroups,
+              requestHeaderAllowlist,
+              codeLocation: cliOptions.codeLocation,
+              entrypoint: cliOptions.entrypoint,
+              bedrockAgentId: cliOptions.agentId,
+              bedrockAliasId: cliOptions.agentAliasId,
+              bedrockRegion: cliOptions.region,
+              authorizerType: cliOptions.authorizerType,
+              discoveryUrl: cliOptions.discoveryUrl,
+              allowedAudience: cliOptions.allowedAudience,
+              allowedClients: cliOptions.allowedClients,
+              allowedScopes: cliOptions.allowedScopes,
+              customClaims,
+              clientId: cliOptions.clientId,
+              clientSecret: cliOptions.clientSecret,
+              idleTimeout: cliOptions.idleTimeout ? Number(cliOptions.idleTimeout) : undefined,
+              maxLifetime: cliOptions.maxLifetime ? Number(cliOptions.maxLifetime) : undefined,
+              sessionStorageMountPath: cliOptions.sessionStorageMountPath,
+              withConfigBundle: cliOptions.withConfigBundle,
+            });
+
+            if (!result.success) {
+              throw new Error(result.error);
             }
-            if (cliOptions.networkMode === 'VPC') {
-              console.log(`\x1b[33mNote: ${VPC_ENDPOINT_WARNING}\x1b[0m`);
+
+            if (cliOptions.json) {
+              console.log(JSON.stringify(result));
+            } else {
+              console.log(`Added agent '${result.agentName}'`);
+              if (result.agentPath) {
+                console.log(`Agent code: ${result.agentPath}`);
+              }
+              if (cliOptions.networkMode === 'VPC') {
+                console.log(`\x1b[33mNote: ${VPC_ENDPOINT_WARNING}\x1b[0m`);
+              }
             }
-          } else {
-            console.error(result.error);
-          }
 
-          process.exit(result.success ? 0 : 1);
+            return {
+              language: standardize(Language, cliOptions.language),
+              framework: standardize(Framework, cliOptions.framework),
+              model_provider: standardize(ModelProviderEnum, cliOptions.modelProvider),
+              agent_type: standardize(AgentType, cliOptions.type ?? 'create'),
+              build: standardize(Build, cliOptions.build ?? 'CodeZip'),
+              protocol: standardize(Protocol, cliOptions.protocol ?? 'HTTP'),
+              network_mode: standardize(NetworkModeEnum, cliOptions.networkMode ?? 'PUBLIC'),
+              authorizer_type: standardize(AuthorizerType, cliOptions.authorizerType ?? 'NONE'),
+              memory: standardize(Memory, cliOptions.memory ?? 'none'),
+            };
+          });
         } else {
-          // TUI fallback — dynamic imports to avoid pulling ink (async) into registry
-          requireTTY();
-          const [{ render }, { default: React }, { AddFlow }] = await Promise.all([
-            import('ink'),
-            import('react'),
-            import('../tui/screens/add/AddFlow'),
-          ]);
-          const { clear, unmount } = render(
-            React.createElement(AddFlow, {
-              isInteractive: false,
-              initialResource: 'agent',
-              onExit: () => {
-                clear();
-                unmount();
-                process.exit(0);
-              },
-            })
-          );
+          try {
+            // TUI fallback — dynamic imports to avoid pulling ink (async) into registry
+            requireTTY();
+            const [{ render }, { default: React }, { AddFlow }] = await Promise.all([
+              import('ink'),
+              import('react'),
+              import('../tui/screens/add/AddFlow'),
+            ]);
+            const { clear, unmount } = render(
+              React.createElement(AddFlow, {
+                isInteractive: false,
+                initialResource: 'agent',
+                onExit: () => {
+                  clear();
+                  unmount();
+                  process.exit(0);
+                },
+              })
+            );
+          } catch (error) {
+            console.error(getErrorMessage(error));
+            process.exit(1);
+          }
         }
       });
 
@@ -412,6 +446,7 @@ export class AgentPrimitive extends BasePrimitive<AddAgentOptions, RemovableReso
       idleRuntimeSessionTimeout: options.idleTimeout,
       maxLifetime: options.maxLifetime,
       sessionStorageMountPath: options.sessionStorageMountPath,
+      withConfigBundle: options.withConfigBundle,
     };
 
     const agentPath = join(projectRoot, APP_DIR, options.name);
@@ -462,6 +497,10 @@ export class AgentPrimitive extends BasePrimitive<AddAgentOptions, RemovableReso
       await setupPythonProject({ projectDir: agentPath });
     }
 
+    if (options.withConfigBundle) {
+      await createConfigBundleForAgent(options.name, configBaseDir);
+    }
+
     return { success: true, agentName: options.name, agentPath };
   }
 
diff --git a/src/cli/primitives/ConfigBundlePrimitive.ts b/src/cli/primitives/ConfigBundlePrimitive.ts
new file mode 100644
index 000000000..77f26205b
--- /dev/null
+++ b/src/cli/primitives/ConfigBundlePrimitive.ts
@@ -0,0 +1,237 @@
+import { findConfigRoot } from '../../lib';
+import type { ConfigBundle } from '../../schema';
+import { ConfigBundleSchema } from '../../schema';
+import { getErrorMessage } from '../errors';
+import type { RemovalPreview, RemovalResult, SchemaChange } from '../operations/remove/types';
+import { BasePrimitive } from './BasePrimitive';
+import type { AddResult, AddScreenComponent, RemovableResource } from './types';
+import type { Command } from '@commander-js/extra-typings';
+import { readFileSync } from 'fs';
+
+export interface AddConfigBundleOptions {
+  name: string;
+  description?: string;
+  components: Record<string, { configuration: Record<string, unknown> }>;
+  branchName?: string;
+  commitMessage?: string;
+}
+
+export type RemovableConfigBundle = RemovableResource;
+
+/**
+ * ConfigBundlePrimitive handles all configuration bundle add/remove operations.
+ *
+ * Configuration bundles are versioned collections of component configurations
+ * (system prompts, tool configs) keyed by component ARN. They are created via
+ * direct API calls (not CloudFormation) and stored in agentcore.json for
+ * lifecycle management.
+ */
+export class ConfigBundlePrimitive extends BasePrimitive<AddConfigBundleOptions, RemovableConfigBundle> {
+  readonly kind = 'config-bundle' as const;
+  readonly label = 'Configuration Bundle';
+  override readonly article = 'a';
+  readonly primitiveSchema = ConfigBundleSchema;
+
+  async add(options: AddConfigBundleOptions): Promise<AddResult<{ bundleName: string }>> {
+    try {
+      const bundle = await this.createConfigBundle(options);
+      return { success: true, bundleName: bundle.name };
+    } catch (err) {
+      return { success: false, error: getErrorMessage(err) };
+    }
+  }
+
+  async remove(bundleName: string): Promise<RemovalResult> {
+    try {
+      const project = await this.readProjectSpec();
+
+      const index = (project.configBundles ?? []).findIndex(b => b.name === bundleName);
+      if (index === -1) {
+        return { success: false, error: `Configuration bundle "${bundleName}" not found.` };
+      }
+
+      project.configBundles.splice(index, 1);
+      await this.writeProjectSpec(project);
+
+      return { success: true };
+    } catch (err) {
+      return { success: false, error: getErrorMessage(err) };
+    }
+  }
+
+  async previewRemove(bundleName: string): Promise<RemovalPreview> {
+    const project = await this.readProjectSpec();
+
+    const bundle = (project.configBundles ?? []).find(b => b.name === bundleName);
+    if (!bundle) {
+      throw new Error(`Configuration bundle "${bundleName}" not found.`);
+    }
+
+    const summary: string[] = [`Removing configuration bundle: ${bundleName}`];
+    const schemaChanges: SchemaChange[] = [];
+
+    const afterSpec = {
+      ...project,
+      configBundles: (project.configBundles ?? []).filter(b => b.name !== bundleName),
+    };
+
+    schemaChanges.push({
+      file: 'agentcore/agentcore.json',
+      before: project,
+      after: afterSpec,
+    });
+
+    return { summary, directoriesToDelete: [], schemaChanges };
+  }
+
+  async getRemovable(): Promise<RemovableConfigBundle[]> {
+    try {
+      const project = await this.readProjectSpec();
+      return (project.configBundles ?? []).map(b => ({ name: b.name }));
+    } catch {
+      return [];
+    }
+  }
+
+  async getAllNames(): Promise<string[]> {
+    try {
+      const project = await this.readProjectSpec();
+      return (project.configBundles ?? []).map(b => b.name);
+    } catch {
+      return [];
+    }
+  }
+
+  registerCommands(addCmd: Command, removeCmd: Command): void {
+    addCmd
+      .command(this.kind)
+      .description('[preview] Add a configuration bundle to the project')
+      .option('--name <name>', 'Bundle name')
+      .option('--description <text>', 'Bundle description')
+      .option(
+        '--components <json>',
+        'Components map as inline JSON. Keys are ARNs or placeholders: {{runtime:<name>}}, {{gateway:<name>}}. Placeholders resolve to real ARNs at deploy time.'
+      )
+      .option('--components-file <path>', 'Path to components JSON file (same format as --components)')
+      .option('--branch <name>', 'Branch name for versioning')
+      .option('--commit-message <text>', 'Commit message for this version')
+      .option('--json', 'Output as JSON')
+      .action(
+        async (cliOptions: {
+          name?: string;
+          description?: string;
+          components?: string;
+          componentsFile?: string;
+          branch?: string;
+          commitMessage?: string;
+          json?: boolean;
+        }) => {
+          try {
+            if (!findConfigRoot()) {
+              console.error('No agentcore project found. Run `agentcore create` first.');
+              process.exit(1);
+            }
+
+            if (cliOptions.name || cliOptions.json) {
+              const fail = (error: string) => {
+                if (cliOptions.json) {
+                  console.log(JSON.stringify({ success: false, error }));
+                } else {
+                  console.error(error);
+                }
+                process.exit(1);
+              };
+
+              if (!cliOptions.name) {
+                fail('--name is required in non-interactive mode');
+              }
+
+              if (!cliOptions.components && !cliOptions.componentsFile) {
+                fail('Either --components or --components-file is required');
+              }
+
+              let components: Record<string, { configuration: Record<string, unknown> }>;
+              if (cliOptions.componentsFile) {
+                const raw = readFileSync(cliOptions.componentsFile, 'utf-8');
+                components = JSON.parse(raw) as Record<string, { configuration: Record<string, unknown> }>;
+              } else {
+                components = JSON.parse(cliOptions.components!) as Record<
+                  string,
+                  { configuration: Record<string, unknown> }
+                >;
+              }
+
+              const result = await this.add({
+                name: cliOptions.name!,
+                description: cliOptions.description,
+                components,
+                branchName: cliOptions.branch,
+                commitMessage: cliOptions.commitMessage,
+              });
+
+              if (cliOptions.json) {
+                console.log(JSON.stringify(result));
+              } else if (result.success) {
+                console.log(`Added configuration bundle '${result.bundleName}'`);
+              } else {
+                console.error(result.error);
+              }
+              process.exit(result.success ? 0 : 1);
+            } else {
+              // TUI fallback
+              const [{ render }, { default: React }, { AddFlow }] = await Promise.all([
+                import('ink'),
+                import('react'),
+                import('../tui/screens/add/AddFlow'),
+              ]);
+              const { clear, unmount } = render(
+                React.createElement(AddFlow, {
+                  isInteractive: false,
+                  initialResource: 'config-bundle',
+                  onExit: () => {
+                    clear();
+                    unmount();
+                    process.exit(0);
+                  },
+                })
+              );
+            }
+          } catch (error) {
+            if (cliOptions.json) {
+              console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+            } else {
+              console.error(getErrorMessage(error));
+            }
+            process.exit(1);
+          }
+        }
+      );
+
+    this.registerRemoveSubcommand(removeCmd);
+  }
+
+  addScreen(): AddScreenComponent {
+    return null;
+  }
+
+  private async createConfigBundle(options: AddConfigBundleOptions): Promise<ConfigBundle> {
+    const project = await this.readProjectSpec();
+
+    this.checkDuplicate(project.configBundles ?? [], options.name);
+
+    const bundle: ConfigBundle = {
+      name: options.name,
+      type: 'ConfigurationBundle',
+      ...(options.description && { description: options.description }),
+      components: options.components,
+      branchName: options.branchName ?? 'mainline',
+      ...(options.commitMessage && { commitMessage: options.commitMessage }),
+    };
+
+    project.configBundles ??= [];
+    project.configBundles.push(bundle);
+    await this.writeProjectSpec(project);
+
+    return bundle;
+  }
+}
diff --git a/src/cli/primitives/CredentialPrimitive.tsx b/src/cli/primitives/CredentialPrimitive.tsx
index 52f578235..9607094f8 100644
--- a/src/cli/primitives/CredentialPrimitive.tsx
+++ b/src/cli/primitives/CredentialPrimitive.tsx
@@ -4,6 +4,8 @@ import { CredentialSchema } from '../../schema';
 import { validateAddCredentialOptions } from '../commands/add/validate';
 import { getErrorMessage } from '../errors';
 import type { RemovalPreview, RemovalResult, SchemaChange } from '../operations/remove/types';
+import { cliCommandRun } from '../telemetry/cli-command-run.js';
+import { CredentialType, standardize } from '../telemetry/schemas/common-shapes.js';
 import { requireTTY } from '../tui/guards/tty';
 import { BasePrimitive } from './BasePrimitive';
 import { computeDefaultCredentialEnvVarName } from './credential-utils';
@@ -273,23 +275,23 @@ export class CredentialPrimitive extends BasePrimitive<AddCredentialOptions, Rem
           clientSecret?: string;
           scopes?: string;
         }) => {
-          try {
-            if (!findConfigRoot()) {
-              console.error('No agentcore project found. Run `agentcore create` first.');
-              process.exit(1);
-            }
+          if (!findConfigRoot()) {
+            console.error('No agentcore project found. Run `agentcore create` first.');
+            process.exit(1);
+          }
 
-            if (
-              cliOptions.name ||
-              cliOptions.apiKey ||
-              cliOptions.json ||
-              cliOptions.type ||
-              cliOptions.discoveryUrl ||
-              cliOptions.clientId ||
-              cliOptions.clientSecret ||
-              cliOptions.scopes
-            ) {
-              // CLI mode
+          if (
+            cliOptions.name ||
+            cliOptions.apiKey ||
+            cliOptions.json ||
+            cliOptions.type ||
+            cliOptions.discoveryUrl ||
+            cliOptions.clientId ||
+            cliOptions.clientSecret ||
+            cliOptions.scopes
+          ) {
+            // CLI mode
+            await cliCommandRun('add.credential', !!cliOptions.json, async () => {
               const validation = validateAddCredentialOptions({
                 name: cliOptions.name,
                 type: cliOptions.type as 'api-key' | 'oauth' | undefined,
@@ -301,12 +303,7 @@ export class CredentialPrimitive extends BasePrimitive<AddCredentialOptions, Rem
               });
 
               if (!validation.valid) {
-                if (cliOptions.json) {
-                  console.log(JSON.stringify({ success: false, error: validation.error }));
-                } else {
-                  console.error(validation.error);
-                }
-                process.exit(1);
+                throw new Error(validation.error);
               }
 
               const addOptions =
@@ -330,15 +327,22 @@ export class CredentialPrimitive extends BasePrimitive<AddCredentialOptions, Rem
 
               const result = await this.add(addOptions);
 
+              if (!result.success) {
+                throw new Error(result.error);
+              }
+
               if (cliOptions.json) {
                 console.log(JSON.stringify(result));
-              } else if (result.success) {
-                console.log(`Added credential '${result.credentialName}'`);
               } else {
-                console.error(result.error);
+                console.log(`Added credential '${result.credentialName}'`);
               }
-              process.exit(result.success ? 0 : 1);
-            } else {
+
+              return {
+                credential_type: standardize(CredentialType, cliOptions.type ?? 'api-key'),
+              };
+            });
+          } else {
+            try {
               // TUI fallback — dynamic imports to avoid pulling ink (async) into registry
               requireTTY();
               const [{ render }, { default: React }, { AddFlow }] = await Promise.all([
@@ -357,14 +361,10 @@ export class CredentialPrimitive extends BasePrimitive<AddCredentialOptions, Rem
                   },
                 })
               );
-            }
-          } catch (error) {
-            if (cliOptions.json) {
-              console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
-            } else {
+            } catch (error) {
               console.error(getErrorMessage(error));
+              process.exit(1);
             }
-            process.exit(1);
           }
         }
       );
diff --git a/src/cli/primitives/EvaluatorPrimitive.ts b/src/cli/primitives/EvaluatorPrimitive.ts
index 73aaf8073..ec7372b08 100644
--- a/src/cli/primitives/EvaluatorPrimitive.ts
+++ b/src/cli/primitives/EvaluatorPrimitive.ts
@@ -3,6 +3,8 @@ import type { EvaluationLevel, Evaluator, EvaluatorConfig } from '../../schema';
 import { EvaluationLevelSchema, EvaluatorSchema } from '../../schema';
 import { getErrorMessage } from '../errors';
 import type { RemovalPreview, RemovalResult, SchemaChange } from '../operations/remove/types';
+import { cliCommandRun } from '../telemetry/cli-command-run.js';
+import { EvaluatorType, Level, standardize } from '../telemetry/schemas/common-shapes.js';
 import { renderCodeBasedEvaluatorTemplate } from '../templates/EvaluatorRenderer';
 import { requireTTY } from '../tui/guards/tty';
 import {
@@ -196,20 +198,15 @@ export class EvaluatorPrimitive extends BasePrimitive<AddEvaluatorOptions, Remov
           config?: string;
           json?: boolean;
         }) => {
-          try {
-            if (!findConfigRoot()) {
-              console.error('No agentcore project found. Run `agentcore create` first.');
-              process.exit(1);
-            }
+          if (!findConfigRoot()) {
+            console.error('No agentcore project found. Run `agentcore create` first.');
+            process.exit(1);
+          }
 
-            if (cliOptions.name || cliOptions.json) {
-              const fail = (error: string) => {
-                if (cliOptions.json) {
-                  console.log(JSON.stringify({ success: false, error }));
-                } else {
-                  console.error(error);
-                }
-                process.exit(1);
+          if (cliOptions.name || cliOptions.json) {
+            await cliCommandRun('add.evaluator', !!cliOptions.json, async () => {
+              const fail = (error: string): never => {
+                throw new Error(error);
               };
 
               if (!cliOptions.name || !cliOptions.level) {
@@ -298,9 +295,13 @@ export class EvaluatorPrimitive extends BasePrimitive<AddEvaluatorOptions, Remov
                 config: configJson,
               });
 
+              if (!result.success) {
+                throw new Error(result.error);
+              }
+
               if (cliOptions.json) {
                 console.log(JSON.stringify(result));
-              } else if (result.success) {
+              } else {
                 if (result.codePath) {
                   console.log(`Created evaluator '${result.evaluatorName}'`);
                   console.log(`  Code: ${result.codePath}lambda_function.py`);
@@ -311,11 +312,15 @@ export class EvaluatorPrimitive extends BasePrimitive<AddEvaluatorOptions, Remov
                 } else {
                   console.log(`Added evaluator '${result.evaluatorName}'`);
                 }
-              } else {
-                console.error(result.error);
               }
-              process.exit(result.success ? 0 : 1);
-            } else {
+
+              return {
+                evaluator_type: standardize(EvaluatorType, evalType),
+                level: standardize(Level, levelResult.data),
+              };
+            });
+          } else {
+            try {
               // TUI fallback
               requireTTY();
               const [{ render }, { default: React }, { AddFlow }] = await Promise.all([
@@ -334,14 +339,10 @@ export class EvaluatorPrimitive extends BasePrimitive<AddEvaluatorOptions, Remov
                   },
                 })
               );
-            }
-          } catch (error) {
-            if (cliOptions.json) {
-              console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
-            } else {
+            } catch (error) {
               console.error(getErrorMessage(error));
+              process.exit(1);
             }
-            process.exit(1);
           }
         }
       );
diff --git a/src/cli/primitives/GatewayPrimitive.ts b/src/cli/primitives/GatewayPrimitive.ts
index 427aa1533..625a3c4a5 100644
--- a/src/cli/primitives/GatewayPrimitive.ts
+++ b/src/cli/primitives/GatewayPrimitive.ts
@@ -12,6 +12,8 @@ import type { AddGatewayOptions as CLIAddGatewayOptions } from '../commands/add/
 import { validateAddGatewayOptions } from '../commands/add/validate';
 import { getErrorMessage } from '../errors';
 import type { RemovalPreview, RemovalResult, SchemaChange } from '../operations/remove/types';
+import { cliCommandRun } from '../telemetry/cli-command-run.js';
+import { AuthorizerType, PolicyEngineMode, standardize } from '../telemetry/schemas/common-shapes.js';
 import { requireTTY } from '../tui/guards/tty';
 import type { AddGatewayConfig } from '../tui/screens/mcp/types';
 import { BasePrimitive } from './BasePrimitive';
@@ -182,20 +184,14 @@ export class GatewayPrimitive extends BasePrimitive<AddGatewayOptions, Removable
       .option('--json', 'Output as JSON [non-interactive]')
       .action(async (rawOptions: Record<string, string | boolean | undefined>) => {
         const cliOptions = rawOptions as unknown as CLIAddGatewayOptions;
-        try {
-          if (!findConfigRoot()) {
-            console.error('No agentcore project found. Run `agentcore create` first.');
-            process.exit(1);
-          }
-
+        if (!findConfigRoot()) {
+          console.error('No agentcore project found. Run `agentcore create` first.');
+          process.exit(1);
+        }
+        await cliCommandRun('add.gateway', !!cliOptions.json, async () => {
           const validation = validateAddGatewayOptions(cliOptions);
           if (!validation.valid) {
-            if (cliOptions.json) {
-              console.log(JSON.stringify({ success: false, error: validation.error }));
-            } else {
-              console.error(validation.error);
-            }
-            process.exit(1);
+            throw new Error(validation.error);
           }
 
           // Parse custom claims JSON if provided (already validated)
@@ -221,23 +217,30 @@ export class GatewayPrimitive extends BasePrimitive<AddGatewayOptions, Removable
             policyEngineMode: cliOptions.policyEngineMode,
           });
 
-          if (cliOptions.json) {
-            console.log(JSON.stringify(result));
-          } else if (result.success) {
-            console.log(`Added gateway '${result.gatewayName}'`);
-          } else {
-            console.error(result.error);
+          if (!result.success) {
+            throw new Error(result.error);
           }
 
-          process.exit(result.success ? 0 : 1);
-        } catch (error) {
           if (cliOptions.json) {
-            console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+            console.log(JSON.stringify(result));
           } else {
-            console.error(`Error: ${getErrorMessage(error)}`);
+            console.log(`Added gateway '${result.gatewayName}'`);
           }
-          process.exit(1);
-        }
+
+          const runtimeCount = cliOptions.runtimes
+            ? cliOptions.runtimes
+                .split(',')
+                .map(s => s.trim())
+                .filter(Boolean).length
+            : 0;
+          return {
+            authorizer_type: standardize(AuthorizerType, cliOptions.authorizerType ?? 'NONE'),
+            has_policy_engine: !!cliOptions.policyEngine,
+            policy_engine_mode: standardize(PolicyEngineMode, cliOptions.policyEngineMode ?? 'log_only'),
+            semantic_search: cliOptions.semanticSearch !== false,
+            runtime_count: runtimeCount,
+          };
+        });
       });
 
     removeCmd
diff --git a/src/cli/primitives/GatewayTargetPrimitive.ts b/src/cli/primitives/GatewayTargetPrimitive.ts
index 41a2e6a75..e8a1da996 100644
--- a/src/cli/primitives/GatewayTargetPrimitive.ts
+++ b/src/cli/primitives/GatewayTargetPrimitive.ts
@@ -14,6 +14,13 @@ import { validateAddGatewayTargetOptions } from '../commands/add/validate';
 import { getErrorMessage } from '../errors';
 import type { RemovableGatewayTarget } from '../operations/remove/remove-gateway-target';
 import type { RemovalPreview, RemovalResult, SchemaChange } from '../operations/remove/types';
+import { cliCommandRun } from '../telemetry/cli-command-run.js';
+import {
+  GATEWAY_TARGET_TYPE_MAP,
+  GatewayTargetHost,
+  OutboundAuth,
+  standardize,
+} from '../telemetry/schemas/common-shapes.js';
 import { getTemplateToolDefinitions, renderGatewayTargetTemplate } from '../templates/GatewayTargetRenderer';
 import { requireTTY } from '../tui/guards/tty';
 import type {
@@ -297,20 +304,15 @@ export class GatewayTargetPrimitive extends BasePrimitive<AddGatewayTargetOption
           delete rawOptions.outboundAuth;
         }
         const cliOptions = rawOptions as unknown as CLIAddGatewayTargetOptions;
-        try {
-          if (!findConfigRoot()) {
-            console.error('No agentcore project found. Run `agentcore create` first.');
-            process.exit(1);
-          }
+        if (!findConfigRoot()) {
+          console.error('No agentcore project found. Run `agentcore create` first.');
+          process.exit(1);
+        }
 
+        await cliCommandRun('add.gateway-target', !!cliOptions.json, async () => {
           const validation = await validateAddGatewayTargetOptions(cliOptions);
           if (!validation.valid) {
-            if (cliOptions.json) {
-              console.log(JSON.stringify({ success: false, error: validation.error }));
-            } else {
-              console.error(validation.error);
-            }
-            process.exit(1);
+            throw new Error(validation.error);
           }
 
           // Map CLI flag values to internal types
@@ -321,6 +323,19 @@ export class GatewayTargetPrimitive extends BasePrimitive<AddGatewayTargetOption
             none: 'NONE',
           };
 
+          const cliType = cliOptions.type ?? '';
+          const telemetryTargetType = GATEWAY_TARGET_TYPE_MAP[cliType] ?? ('unknown' as const);
+          const telemetryOutboundAuth = standardize(
+            OutboundAuth,
+            (cliOptions.outboundAuthType ?? 'none').replaceAll('_', '-')
+          );
+          const telemetryHost = standardize(GatewayTargetHost, cliOptions.host ?? 'lambda');
+          const telemetryAttrs = {
+            target_type: telemetryTargetType,
+            host: telemetryHost,
+            outbound_auth: telemetryOutboundAuth,
+          };
+
           // Handle API Gateway targets (no code generation)
           if (cliOptions.type === 'apiGateway') {
             const config: ApiGatewayTargetConfig = {
@@ -357,7 +372,7 @@ export class GatewayTargetPrimitive extends BasePrimitive<AddGatewayTargetOption
             } else {
               console.log(`Added gateway target '${result.toolName}'`);
             }
-            process.exit(0);
+            return telemetryAttrs;
           }
 
           // Handle schema-based targets (OpenAPI / Smithy)
@@ -393,7 +408,7 @@ export class GatewayTargetPrimitive extends BasePrimitive<AddGatewayTargetOption
             } else {
               console.log(`Added gateway target '${result.toolName}'`);
             }
-            process.exit(0);
+            return telemetryAttrs;
           }
 
           // Handle Lambda Function ARN targets (no code generation)
@@ -412,7 +427,7 @@ export class GatewayTargetPrimitive extends BasePrimitive<AddGatewayTargetOption
             } else {
               console.log(`Added gateway target '${result.toolName}'`);
             }
-            process.exit(0);
+            return { ...telemetryAttrs };
           }
 
           // Handle MCP server targets (existing endpoint, no code generation)
@@ -438,13 +453,17 @@ export class GatewayTargetPrimitive extends BasePrimitive<AddGatewayTargetOption
                 : {}),
             };
             const result = await this.createExternalGatewayTarget(config);
-            const output = { success: true, toolName: result.toolName, sourcePath: result.projectPath || undefined };
+            const output = {
+              success: true,
+              toolName: result.toolName,
+              sourcePath: result.projectPath || undefined,
+            };
             if (cliOptions.json) {
               console.log(JSON.stringify(output));
             } else {
               console.log(`Added gateway target '${result.toolName}'`);
             }
-            process.exit(0);
+            return telemetryAttrs;
           }
 
           const result = await this.add({
@@ -455,26 +474,21 @@ export class GatewayTargetPrimitive extends BasePrimitive<AddGatewayTargetOption
             host: cliOptions.host,
           });
 
+          if (!result.success) {
+            throw new Error(result.error);
+          }
+
           if (cliOptions.json) {
             console.log(JSON.stringify(result));
-          } else if (result.success) {
+          } else {
             console.log(`Added gateway target '${result.toolName}'`);
             if (result.sourcePath) {
               console.log(`Tool code: ${result.sourcePath}`);
             }
-          } else {
-            console.error(result.error);
           }
 
-          process.exit(result.success ? 0 : 1);
-        } catch (error) {
-          if (cliOptions.json) {
-            console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
-          } else {
-            console.error(`Error: ${getErrorMessage(error)}`);
-          }
-          process.exit(1);
-        }
+          return telemetryAttrs;
+        });
       });
 
     removeCmd
diff --git a/src/cli/primitives/HarnessPrimitive.ts b/src/cli/primitives/HarnessPrimitive.ts
new file mode 100644
index 000000000..c54c7a8d3
--- /dev/null
+++ b/src/cli/primitives/HarnessPrimitive.ts
@@ -0,0 +1,565 @@
+import { APP_DIR, ConfigIO, findConfigRoot } from '../../lib';
+import type {
+  HarnessGatewayOutboundAuth,
+  HarnessModelProvider,
+  HarnessSpec,
+  MemoryStrategy,
+  MemoryStrategyType,
+  NetworkMode,
+  RuntimeAuthorizerType,
+} from '../../schema';
+import { DEFAULT_EPISODIC_REFLECTION_NAMESPACES, DEFAULT_STRATEGY_NAMESPACES, HarnessSpecSchema } from '../../schema';
+import { deleteHarness } from '../aws/agentcore-harness';
+import { getErrorMessage } from '../errors';
+import type { RemovalPreview, RemovalResult, SchemaChange } from '../operations/remove/types';
+import { getTemplatePath } from '../templates/templateRoot';
+import { DEFAULT_MEMORY_EXPIRY_DAYS } from '../tui/screens/generate/defaults';
+import { BasePrimitive } from './BasePrimitive';
+import { buildAuthorizerConfigFromJwtConfig, createManagedOAuthCredential } from './auth-utils';
+import type { JwtConfigOptions } from './auth-utils';
+import type { AddResult, AddScreenComponent, RemovableResource } from './types';
+import type { Command } from '@commander-js/extra-typings';
+import { access, copyFile, mkdir, readFile, rm, writeFile } from 'fs/promises';
+import { basename, dirname, isAbsolute, join, resolve } from 'path';
+
+export interface AddHarnessOptions {
+  name: string;
+  modelProvider: HarnessModelProvider;
+  modelId: string;
+  apiKeyArn?: string;
+  systemPrompt?: string;
+  skipMemory?: boolean;
+  containerUri?: string;
+  dockerfilePath?: string;
+  maxIterations?: number;
+  maxTokens?: number;
+  timeoutSeconds?: number;
+  truncationStrategy?: 'sliding_window' | 'summarization';
+  networkMode?: NetworkMode;
+  subnets?: string[];
+  securityGroups?: string[];
+  idleTimeout?: number;
+  maxLifetime?: number;
+  sessionStoragePath?: string;
+  withInvokeScript?: boolean;
+  selectedTools?: string[];
+  mcpName?: string;
+  mcpUrl?: string;
+  gatewayArn?: string;
+  gatewayOutboundAuth?: 'awsIam' | 'none' | 'oauth';
+  gatewayProviderArn?: string;
+  gatewayScopes?: string[];
+  authorizerType?: RuntimeAuthorizerType;
+  jwtConfig?: JwtConfigOptions;
+  configBaseDir?: string;
+}
+
+export type RemovableHarness = RemovableResource;
+
+export class HarnessPrimitive extends BasePrimitive<AddHarnessOptions, RemovableHarness> {
+  readonly kind = 'harness' as const;
+  readonly label = 'Harness';
+  readonly primitiveSchema = HarnessSpecSchema;
+
+  async add(options: AddHarnessOptions): Promise<AddResult<{ harnessName: string }>> {
+    try {
+      const configBaseDir = options.configBaseDir ?? findConfigRoot();
+      if (!configBaseDir) {
+        return { success: false, error: 'No agentcore project found. Run `agentcore create` first.' };
+      }
+
+      const configIO = new ConfigIO({ baseDir: configBaseDir });
+      const project = await this.readProjectSpec(configIO);
+
+      const harnesses = project.harnesses ?? [];
+      this.checkDuplicate(harnesses, options.name);
+
+      const memoryName = options.skipMemory ? undefined : `${options.name}Memory`;
+
+      let dockerfile: string | undefined;
+      if (options.dockerfilePath) {
+        const projectRoot = dirname(configBaseDir);
+        const srcPath = isAbsolute(options.dockerfilePath)
+          ? options.dockerfilePath
+          : resolve(projectRoot, options.dockerfilePath);
+        try {
+          await access(srcPath);
+        } catch {
+          return { success: false, error: `Dockerfile not found at: ${srcPath}` };
+        }
+        const appDir = join(projectRoot, APP_DIR, options.name);
+        await mkdir(appDir, { recursive: true });
+        const destFilename = basename(srcPath);
+        await copyFile(srcPath, join(appDir, destFilename));
+        dockerfile = destFilename;
+      }
+
+      const tools: HarnessSpec['tools'] = [];
+      if (options.selectedTools) {
+        for (const toolType of options.selectedTools) {
+          if (toolType === 'agentcore_browser') {
+            tools.push({ type: 'agentcore_browser', name: 'browser' });
+          } else if (toolType === 'agentcore_code_interpreter') {
+            tools.push({ type: 'agentcore_code_interpreter', name: 'code-interpreter' });
+          } else if (toolType === 'remote_mcp' && options.mcpName && options.mcpUrl) {
+            tools.push({
+              type: 'remote_mcp',
+              name: options.mcpName,
+              config: { remoteMcp: { url: options.mcpUrl } },
+            });
+          } else if (toolType === 'agentcore_gateway' && options.gatewayArn) {
+            let outboundAuth: HarnessGatewayOutboundAuth | undefined;
+            if (options.gatewayOutboundAuth === 'awsIam') {
+              outboundAuth = { awsIam: {} };
+            } else if (options.gatewayOutboundAuth === 'none') {
+              outboundAuth = { none: {} };
+            } else if (
+              options.gatewayOutboundAuth === 'oauth' &&
+              options.gatewayProviderArn &&
+              options.gatewayScopes &&
+              options.gatewayScopes.length > 0
+            ) {
+              outboundAuth = {
+                oauth: {
+                  providerArn: options.gatewayProviderArn,
+                  scopes: options.gatewayScopes,
+                },
+              };
+            }
+            tools.push({
+              type: 'agentcore_gateway',
+              name: 'gateway',
+              config: {
+                agentCoreGateway: {
+                  gatewayArn: options.gatewayArn,
+                  ...(outboundAuth && { outboundAuth }),
+                },
+              },
+            });
+          }
+        }
+      }
+
+      const harnessSpec: HarnessSpec = {
+        name: options.name,
+        model: {
+          provider: options.modelProvider,
+          modelId: options.modelId,
+          ...(options.apiKeyArn && { apiKeyArn: options.apiKeyArn }),
+        },
+        tools,
+        skills: [],
+        ...(options.systemPrompt && { systemPrompt: options.systemPrompt }),
+        ...(memoryName && { memory: { name: memoryName } }),
+        ...(options.containerUri && { containerUri: options.containerUri }),
+        ...(dockerfile && { dockerfile }),
+        ...(options.maxIterations !== undefined && { maxIterations: options.maxIterations }),
+        ...(options.maxTokens !== undefined && { maxTokens: options.maxTokens }),
+        ...(options.timeoutSeconds !== undefined && { timeoutSeconds: options.timeoutSeconds }),
+        ...(options.truncationStrategy && { truncation: { strategy: options.truncationStrategy } }),
+        ...(options.networkMode && { networkMode: options.networkMode }),
+        ...(options.networkMode === 'VPC' &&
+          options.subnets &&
+          options.securityGroups && {
+            networkConfig: {
+              subnets: options.subnets,
+              securityGroups: options.securityGroups,
+            },
+          }),
+        ...(this.buildLifecycleConfig(options) && { lifecycleConfig: this.buildLifecycleConfig(options) }),
+        ...(options.sessionStoragePath && { sessionStoragePath: options.sessionStoragePath }),
+        ...(options.authorizerType && { authorizerType: options.authorizerType }),
+        ...(options.authorizerType === 'CUSTOM_JWT' && options.jwtConfig
+          ? { authorizerConfiguration: buildAuthorizerConfigFromJwtConfig(options.jwtConfig) }
+          : {}),
+      };
+
+      await configIO.writeHarnessSpec(options.name, harnessSpec);
+
+      const pathResolver = configIO.getPathResolver();
+      const harnessDir = pathResolver.getHarnessDir(options.name);
+      const systemPromptPath = join(harnessDir, 'system-prompt.md');
+      const systemPromptContent = options.systemPrompt ?? 'You are a helpful assistant';
+      await writeFile(systemPromptPath, systemPromptContent, 'utf-8');
+
+      if (options.withInvokeScript) {
+        const templatePath = getTemplatePath('harness', 'invoke.py.template');
+        const invokeScriptPath = join(harnessDir, 'invoke.py');
+        let template = await readFile(templatePath, 'utf-8');
+        template = template.replace('{{HARNESS_ARN}}', '<your-harness-arn>');
+        template = template.replace('{{REGION}}', '<your-region>');
+        await writeFile(invokeScriptPath, template, 'utf-8');
+      }
+
+      if (memoryName) {
+        const strategyTypes: MemoryStrategyType[] = ['SEMANTIC', 'USER_PREFERENCE', 'SUMMARIZATION', 'EPISODIC'];
+        const strategies: MemoryStrategy[] = strategyTypes.map(type => ({
+          type,
+          ...(DEFAULT_STRATEGY_NAMESPACES[type] && { namespaces: DEFAULT_STRATEGY_NAMESPACES[type] }),
+          ...(type === 'EPISODIC' && { reflectionNamespaces: DEFAULT_EPISODIC_REFLECTION_NAMESPACES }),
+        }));
+
+        project.memories.push({
+          name: memoryName,
+          eventExpiryDuration: DEFAULT_MEMORY_EXPIRY_DAYS,
+          strategies,
+        });
+      }
+
+      project.harnesses = [
+        ...harnesses,
+        {
+          name: options.name,
+          path: `app/${options.name}`,
+        },
+      ];
+
+      await this.writeProjectSpec(project, configIO);
+
+      if (options.jwtConfig?.clientId && options.jwtConfig?.clientSecret) {
+        await createManagedOAuthCredential(
+          options.name,
+          options.jwtConfig,
+          spec => this.writeProjectSpec(spec, configIO),
+          () => this.readProjectSpec(configIO)
+        );
+      }
+
+      return { success: true, harnessName: options.name };
+    } catch (err) {
+      return { success: false, error: getErrorMessage(err) };
+    }
+  }
+
+  async remove(harnessName: string): Promise<RemovalResult> {
+    try {
+      const configRoot = findConfigRoot();
+      if (!configRoot) {
+        return { success: false, error: 'No agentcore project found.' };
+      }
+
+      const configIO = new ConfigIO({ baseDir: configRoot });
+      const project = await this.readProjectSpec(configIO);
+
+      const harnesses = project.harnesses ?? [];
+      const harnessIndex = harnesses.findIndex(h => h.name === harnessName);
+
+      if (harnessIndex === -1) {
+        return { success: false, error: `Harness "${harnessName}" not found.` };
+      }
+
+      // Delete harness from AWS if it's deployed
+      try {
+        const deployedState = await configIO.readDeployedState();
+        for (const target of Object.values(deployedState.targets)) {
+          const deployedHarness = target.resources?.harnesses?.[harnessName];
+          if (deployedHarness) {
+            const targets = await configIO.resolveAWSDeploymentTargets();
+            const region = targets[0]?.region;
+            if (region) {
+              await deleteHarness({ region, harnessId: deployedHarness.harnessId });
+            }
+            delete target.resources!.harnesses![harnessName];
+            await configIO.writeDeployedState(deployedState);
+            break;
+          }
+        }
+      } catch {
+        // AWS deletion is best-effort; next deploy will clean up
+      }
+
+      harnesses.splice(harnessIndex, 1);
+      project.harnesses = harnesses;
+
+      await this.writeProjectSpec(project, configIO);
+
+      const pathResolver = configIO.getPathResolver();
+      const harnessDir = pathResolver.getHarnessDir(harnessName);
+      await rm(harnessDir, { recursive: true, force: true });
+
+      return { success: true };
+    } catch (err) {
+      return { success: false, error: getErrorMessage(err) };
+    }
+  }
+
+  async previewRemove(harnessName: string): Promise<RemovalPreview> {
+    const project = await this.readProjectSpec();
+
+    const harnesses = project.harnesses ?? [];
+    const harness = harnesses.find(h => h.name === harnessName);
+
+    if (!harness) {
+      throw new Error(`Harness "${harnessName}" not found.`);
+    }
+
+    const summary: string[] = [`Removing harness: ${harnessName}`];
+    const directoriesToDelete: string[] = [`app/${harnessName}`];
+    const schemaChanges: SchemaChange[] = [];
+
+    const afterSpec = {
+      ...project,
+      harnesses: harnesses.filter(h => h.name !== harnessName),
+    };
+
+    schemaChanges.push({
+      file: 'agentcore/agentcore.json',
+      before: project,
+      after: afterSpec,
+    });
+
+    return { summary, directoriesToDelete, schemaChanges };
+  }
+
+  async getRemovable(): Promise<RemovableHarness[]> {
+    try {
+      const project = await this.readProjectSpec();
+      const harnesses = project.harnesses ?? [];
+      return harnesses.map(h => ({ name: h.name }));
+    } catch {
+      return [];
+    }
+  }
+
+  registerCommands(addCmd: Command, removeCmd: Command): void {
+    addCmd
+      .command('harness')
+      .description('Add a harness to the project')
+      .option('--name <name>', 'Harness name (start with letter, alphanumeric + underscores, max 48 chars)')
+      .option('--model-provider <provider>', 'Model provider: bedrock, open_ai, gemini')
+      .option('--model-id <id>', 'Model ID (e.g., anthropic.claude-3-5-sonnet-20240620-v1:0)')
+      .option('--api-key-arn <arn>', 'API key ARN for non-Bedrock providers')
+      .option('--container <uri-or-path>', 'Container image URI or path to a Dockerfile')
+      .option('--no-memory', 'Skip auto-creating memory')
+      .option('--max-iterations <n>', 'Max iterations', parseInt)
+      .option('--max-tokens <n>', 'Max tokens', parseInt)
+      .option('--timeout <seconds>', 'Timeout in seconds', parseInt)
+      .option('--truncation-strategy <strategy>', 'Truncation strategy: sliding_window or summarization')
+      .option('--network-mode <mode>', 'Network mode: PUBLIC or VPC')
+      .option('--subnets <ids>', 'Comma-separated subnet IDs (for VPC mode)')
+      .option('--security-groups <ids>', 'Comma-separated security group IDs (for VPC mode)')
+      .option('--idle-timeout <seconds>', 'Idle timeout in seconds', parseInt)
+      .option('--max-lifetime <seconds>', 'Max lifetime in seconds', parseInt)
+      .option('--session-storage <path>', 'Mount path for persistent session storage (e.g., /mnt/data/)')
+      .option('--with-invoke-script', 'Generate a standalone Python invoke script')
+      .option(
+        '--system-prompt <text>',
+        'System prompt text (written to system-prompt.md; defaults to "You are a helpful assistant")'
+      )
+      .option(
+        '--tools <tools>',
+        'Comma-separated tools: agentcore_browser, agentcore_code_interpreter, remote_mcp, agentcore_gateway'
+      )
+      .option('--mcp-name <name>', 'Remote MCP tool name (required when --tools includes remote_mcp)')
+      .option('--mcp-url <url>', 'Remote MCP endpoint URL (required when --tools includes remote_mcp)')
+      .option('--gateway-arn <arn>', 'Gateway ARN (required when --tools includes agentcore_gateway)')
+      .option(
+        '--gateway-outbound-auth <type>',
+        'Gateway outbound auth: awsIam, none, oauth (requires --gateway-provider-arn and --gateway-scopes)'
+      )
+      .option('--gateway-provider-arn <arn>', 'OAuth provider ARN for gateway outbound auth')
+      .option('--gateway-scopes <scopes>', 'Comma-separated OAuth scopes for gateway outbound auth')
+      .option('--authorizer-type <type>', 'Authorizer type: AWS_IAM or CUSTOM_JWT')
+      .option('--discovery-url <url>', 'OIDC discovery URL (for CUSTOM_JWT)')
+      .option('--allowed-audience <audiences>', 'Comma-separated allowed audiences (for CUSTOM_JWT)')
+      .option('--allowed-clients <clients>', 'Comma-separated allowed client IDs (for CUSTOM_JWT)')
+      .option('--allowed-scopes <scopes>', 'Comma-separated allowed scopes (for CUSTOM_JWT)')
+      .option('--custom-claims <json>', 'Custom claims JSON array (for CUSTOM_JWT)')
+      .option('--client-id <id>', 'OAuth client ID (for CUSTOM_JWT)')
+      .option('--client-secret <secret>', 'OAuth client secret (for CUSTOM_JWT)')
+      .option('--json', 'Output as JSON')
+      .action(
+        async (cliOptions: {
+          name?: string;
+          modelProvider?: string;
+          modelId?: string;
+          apiKeyArn?: string;
+          container?: string;
+          memory?: boolean;
+          maxIterations?: number;
+          maxTokens?: number;
+          timeout?: number;
+          truncationStrategy?: string;
+          networkMode?: string;
+          subnets?: string;
+          securityGroups?: string;
+          idleTimeout?: number;
+          maxLifetime?: number;
+          sessionStorage?: string;
+          withInvokeScript?: boolean;
+          systemPrompt?: string;
+          tools?: string;
+          mcpName?: string;
+          mcpUrl?: string;
+          gatewayArn?: string;
+          gatewayOutboundAuth?: string;
+          gatewayProviderArn?: string;
+          gatewayScopes?: string;
+          authorizerType?: string;
+          discoveryUrl?: string;
+          allowedAudience?: string;
+          allowedClients?: string;
+          allowedScopes?: string;
+          customClaims?: string;
+          clientId?: string;
+          clientSecret?: string;
+          json?: boolean;
+        }) => {
+          try {
+            if (!findConfigRoot()) {
+              console.error('No agentcore project found. Run `agentcore create` first.');
+              process.exit(1);
+            }
+
+            // Validate auth options
+            const { validateAddHarnessOptions } = await import('../commands/add/validate');
+            const authValidation = validateAddHarnessOptions({
+              ...cliOptions,
+              authorizerType: cliOptions.authorizerType as RuntimeAuthorizerType | undefined,
+            });
+            if (!authValidation.valid) {
+              if (cliOptions.json) {
+                console.log(JSON.stringify({ success: false, error: authValidation.error }));
+              } else {
+                console.error(authValidation.error);
+              }
+              process.exit(1);
+            }
+
+            if (cliOptions.name || cliOptions.json) {
+              if (!cliOptions.name) {
+                const error = '--name is required';
+                if (cliOptions.json) {
+                  console.log(JSON.stringify({ success: false, error }));
+                } else {
+                  console.error(error);
+                }
+                process.exit(1);
+              }
+
+              const { DEFAULT_MODEL_IDS } = await import('../tui/screens/harness/types');
+              const provider = (cliOptions.modelProvider ?? 'bedrock') as HarnessModelProvider;
+              const modelId = cliOptions.modelId ?? DEFAULT_MODEL_IDS[provider];
+
+              const containerOption = this.parseContainerFlag(cliOptions.container);
+
+              const result = await this.add({
+                name: cliOptions.name,
+                modelProvider: provider,
+                modelId,
+                apiKeyArn: cliOptions.apiKeyArn,
+                containerUri: containerOption.containerUri,
+                dockerfilePath: containerOption.dockerfilePath,
+                skipMemory: cliOptions.memory === false,
+                maxIterations: cliOptions.maxIterations,
+                maxTokens: cliOptions.maxTokens,
+                timeoutSeconds: cliOptions.timeout,
+                truncationStrategy: cliOptions.truncationStrategy as 'sliding_window' | 'summarization' | undefined,
+                networkMode: cliOptions.networkMode as NetworkMode | undefined,
+                subnets: cliOptions.subnets?.split(',').map(s => s.trim()),
+                securityGroups: cliOptions.securityGroups?.split(',').map(s => s.trim()),
+                idleTimeout: cliOptions.idleTimeout,
+                maxLifetime: cliOptions.maxLifetime,
+                sessionStoragePath: cliOptions.sessionStorage,
+                withInvokeScript: cliOptions.withInvokeScript,
+                systemPrompt: cliOptions.systemPrompt,
+                selectedTools: cliOptions.tools?.split(',').map(s => s.trim()),
+                mcpName: cliOptions.mcpName,
+                mcpUrl: cliOptions.mcpUrl,
+                gatewayArn: cliOptions.gatewayArn,
+                gatewayOutboundAuth: cliOptions.gatewayOutboundAuth as 'awsIam' | 'none' | 'oauth' | undefined,
+                gatewayProviderArn: cliOptions.gatewayProviderArn,
+                gatewayScopes: cliOptions.gatewayScopes?.split(',').map(s => s.trim()),
+                authorizerType: cliOptions.authorizerType as RuntimeAuthorizerType | undefined,
+                jwtConfig:
+                  cliOptions.authorizerType === 'CUSTOM_JWT' && cliOptions.discoveryUrl
+                    ? {
+                        discoveryUrl: cliOptions.discoveryUrl,
+                        allowedAudience: cliOptions.allowedAudience?.split(',').map(s => s.trim()),
+                        allowedClients: cliOptions.allowedClients?.split(',').map(s => s.trim()),
+                        allowedScopes: cliOptions.allowedScopes?.split(',').map(s => s.trim()),
+                        customClaims: cliOptions.customClaims
+                          ? (JSON.parse(cliOptions.customClaims) as JwtConfigOptions['customClaims'])
+                          : undefined,
+                        clientId: cliOptions.clientId,
+                        clientSecret: cliOptions.clientSecret,
+                      }
+                    : undefined,
+              });
+
+              if (!result.success) {
+                if (cliOptions.json) {
+                  console.log(JSON.stringify(result));
+                } else {
+                  console.error(result.error);
+                }
+                process.exit(1);
+              }
+
+              if (cliOptions.json) {
+                console.log(JSON.stringify(result));
+              } else {
+                console.log(`Added harness '${result.harnessName}'.`);
+              }
+
+              process.exit(0);
+            } else {
+              const [{ render }, { default: React }, { AddFlow }] = await Promise.all([
+                import('ink'),
+                import('react'),
+                import('../tui/screens/add/AddFlow'),
+              ]);
+              const { clear, unmount } = render(
+                React.createElement(AddFlow, {
+                  isInteractive: false,
+                  initialResource: 'harness' as const,
+                  onExit: () => {
+                    clear();
+                    unmount();
+                    process.exit(0);
+                  },
+                })
+              );
+            }
+          } catch (error) {
+            if (cliOptions.json) {
+              console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+            } else {
+              console.error(getErrorMessage(error));
+            }
+            process.exit(1);
+          }
+        }
+      );
+
+    this.registerRemoveSubcommand(removeCmd);
+  }
+
+  addScreen(): AddScreenComponent {
+    return null;
+  }
+
+  parseContainerFlag(value?: string): { containerUri?: string; dockerfilePath?: string } {
+    if (!value) return {};
+    // Treat as Dockerfile if it uses a relative path prefix or ends with a
+    // Dockerfile extension. Bare absolute paths like /my-org/image:tag are
+    // valid container URIs so we don't match on leading / alone.
+    const looksLikeDockerfile =
+      value.endsWith('Dockerfile') ||
+      value.endsWith('.dockerfile') ||
+      value.startsWith('./') ||
+      value.startsWith('../');
+    if (looksLikeDockerfile) {
+      return { dockerfilePath: value };
+    }
+    return { containerUri: value };
+  }
+
+  private buildLifecycleConfig(options: { idleTimeout?: number; maxLifetime?: number }) {
+    if (options.idleTimeout === undefined && options.maxLifetime === undefined) return undefined;
+    return {
+      ...(options.idleTimeout !== undefined && { idleRuntimeSessionTimeout: options.idleTimeout }),
+      ...(options.maxLifetime !== undefined && { maxLifetime: options.maxLifetime }),
+    };
+  }
+}
diff --git a/src/cli/primitives/MemoryPrimitive.tsx b/src/cli/primitives/MemoryPrimitive.tsx
index ad157c2cf..a0c15c2c3 100644
--- a/src/cli/primitives/MemoryPrimitive.tsx
+++ b/src/cli/primitives/MemoryPrimitive.tsx
@@ -17,6 +17,7 @@ import {
 import { DEFAULT_DELIVERY_TYPE, validateAddMemoryOptions } from '../commands/add/validate';
 import { getErrorMessage } from '../errors';
 import type { RemovalPreview, RemovalResult, SchemaChange } from '../operations/remove/types';
+import { cliCommandRun } from '../telemetry/cli-command-run.js';
 import { requireTTY } from '../tui/guards/tty';
 import { DEFAULT_EVENT_EXPIRY } from '../tui/screens/memory/types';
 import { BasePrimitive } from './BasePrimitive';
@@ -183,14 +184,14 @@ export class MemoryPrimitive extends BasePrimitive<AddMemoryOptions, RemovableMe
           streamDeliveryResources?: string;
           json?: boolean;
         }) => {
-          try {
-            if (!findConfigRoot()) {
-              console.error('No agentcore project found. Run `agentcore create` first.');
-              process.exit(1);
-            }
+          if (!findConfigRoot()) {
+            console.error('No agentcore project found. Run `agentcore create` first.');
+            process.exit(1);
+          }
 
-            if (cliOptions.name || cliOptions.json) {
-              // CLI mode
+          if (cliOptions.name || cliOptions.json) {
+            // CLI mode
+            await cliCommandRun('add.memory', !!cliOptions.json, async () => {
               const expiry = cliOptions.expiry ? parseInt(cliOptions.expiry, 10) : undefined;
               const validation = validateAddMemoryOptions({
                 name: cliOptions.name,
@@ -203,12 +204,7 @@ export class MemoryPrimitive extends BasePrimitive<AddMemoryOptions, RemovableMe
               });
 
               if (!validation.valid) {
-                if (cliOptions.json) {
-                  console.log(JSON.stringify({ success: false, error: validation.error }));
-                } else {
-                  console.error(validation.error);
-                }
-                process.exit(1);
+                throw new Error(validation.error);
               }
 
               const result = await this.add({
@@ -221,15 +217,30 @@ export class MemoryPrimitive extends BasePrimitive<AddMemoryOptions, RemovableMe
                 streamDeliveryResources: cliOptions.streamDeliveryResources,
               });
 
+              if (!result.success) {
+                throw new Error(result.error);
+              }
+
               if (cliOptions.json) {
                 console.log(JSON.stringify(result));
-              } else if (result.success) {
-                console.log(`Added memory '${result.memoryName}'`);
               } else {
-                console.error(result.error);
+                console.log(`Added memory '${result.memoryName}'`);
               }
-              process.exit(result.success ? 0 : 1);
-            } else {
+
+              const strategyList = (cliOptions.strategies ?? '')
+                .split(',')
+                .map(s => s.trim().toUpperCase())
+                .filter(Boolean);
+              return {
+                strategy_count: strategyList.length,
+                strategy_semantic: strategyList.includes('SEMANTIC'),
+                strategy_summarization: strategyList.includes('SUMMARIZATION'),
+                strategy_user_preference: strategyList.includes('USER_PREFERENCE'),
+                strategy_episodic: strategyList.includes('EPISODIC'),
+              };
+            });
+          } else {
+            try {
               // TUI fallback — dynamic imports to avoid pulling ink (async) into registry
               requireTTY();
               const [{ render }, { default: React }, { AddFlow }] = await Promise.all([
@@ -248,14 +259,10 @@ export class MemoryPrimitive extends BasePrimitive<AddMemoryOptions, RemovableMe
                   },
                 })
               );
-            }
-          } catch (error) {
-            if (cliOptions.json) {
-              console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
-            } else {
+            } catch (error) {
               console.error(getErrorMessage(error));
+              process.exit(1);
             }
-            process.exit(1);
           }
         }
       );
diff --git a/src/cli/primitives/OnlineEvalConfigPrimitive.ts b/src/cli/primitives/OnlineEvalConfigPrimitive.ts
index c53bfb88f..6e4436ac9 100644
--- a/src/cli/primitives/OnlineEvalConfigPrimitive.ts
+++ b/src/cli/primitives/OnlineEvalConfigPrimitive.ts
@@ -3,6 +3,7 @@ import type { OnlineEvalConfig } from '../../schema';
 import { OnlineEvalConfigSchema } from '../../schema';
 import { getErrorMessage } from '../errors';
 import type { RemovalPreview, RemovalResult, SchemaChange } from '../operations/remove/types';
+import { cliCommandRun } from '../telemetry/cli-command-run.js';
 import { requireTTY } from '../tui/guards/tty';
 import { BasePrimitive } from './BasePrimitive';
 import type { AddResult, AddScreenComponent, RemovableResource } from './types';
@@ -14,6 +15,7 @@ export interface AddOnlineEvalConfigOptions {
   evaluators: string[];
   samplingRate: number;
   enableOnCreate?: boolean;
+  endpoint?: string;
 }
 
 export type RemovableOnlineEvalConfig = RemovableResource;
@@ -109,6 +111,7 @@ export class OnlineEvalConfigPrimitive extends BasePrimitive<AddOnlineEvalConfig
       .option('-e, --evaluator <evaluators...>', 'Evaluator name(s), Builtin.* IDs, or ARNs [non-interactive]')
       .option('--evaluator-arn <arns...>', 'Evaluator ARN(s) [non-interactive]')
       .option('--sampling-rate <rate>', 'Sampling percentage (0.01-100) [non-interactive]')
+      .option('--endpoint <name>', 'Runtime endpoint name to scope monitoring [non-interactive]')
       .option('--enable-on-create', 'Enable evaluation immediately after deploy [non-interactive]')
       .option('--json', 'Output as JSON [non-interactive]')
       .action(
@@ -118,40 +121,32 @@ export class OnlineEvalConfigPrimitive extends BasePrimitive<AddOnlineEvalConfig
           evaluator?: string[];
           evaluatorArn?: string[];
           samplingRate?: string;
+          endpoint?: string;
           enableOnCreate?: boolean;
           json?: boolean;
         }) => {
-          try {
-            if (!findConfigRoot()) {
-              console.error('No agentcore project found. Run `agentcore create` first.');
-              process.exit(1);
-            }
+          if (!findConfigRoot()) {
+            console.error('No agentcore project found. Run `agentcore create` first.');
+            process.exit(1);
+          }
 
-            if (cliOptions.name || cliOptions.json) {
-              // Merge --evaluator and --evaluator-arn into a single list
-              const allEvaluators = [...(cliOptions.evaluator ?? []), ...(cliOptions.evaluatorArn ?? [])];
+          if (cliOptions.name || cliOptions.json) {
+            // Merge --evaluator and --evaluator-arn into a single list
+            const allEvaluators = [...(cliOptions.evaluator ?? []), ...(cliOptions.evaluatorArn ?? [])];
 
+            await cliCommandRun('add.online-eval', !!cliOptions.json, async () => {
               if (!cliOptions.name || !cliOptions.runtime || allEvaluators.length === 0 || !cliOptions.samplingRate) {
-                const error =
-                  '--name, --runtime, --evaluator (and/or --evaluator-arn), and --sampling-rate are all required in non-interactive mode';
-                if (cliOptions.json) {
-                  console.log(JSON.stringify({ success: false, error }));
-                } else {
-                  console.error(error);
-                }
-                process.exit(1);
+                throw new Error(
+                  '--name, --runtime, --evaluator (and/or --evaluator-arn), and --sampling-rate are all required in non-interactive mode'
+                );
               }
 
               // Sampling rate as a percentage of requests to evaluate (0.01% to 100%)
               const samplingRate = parseFloat(cliOptions.samplingRate);
               if (isNaN(samplingRate) || samplingRate < 0.01 || samplingRate > 100) {
-                const error = `Invalid --sampling-rate "${cliOptions.samplingRate}". Must be a percentage between 0.01 and 100`;
-                if (cliOptions.json) {
-                  console.log(JSON.stringify({ success: false, error }));
-                } else {
-                  console.error(error);
-                }
-                process.exit(1);
+                throw new Error(
+                  `Invalid --sampling-rate "${cliOptions.samplingRate}". Must be a percentage between 0.01 and 100`
+                );
               }
 
               const result = await this.add({
@@ -160,17 +155,26 @@ export class OnlineEvalConfigPrimitive extends BasePrimitive<AddOnlineEvalConfig
                 evaluators: allEvaluators,
                 samplingRate,
                 enableOnCreate: cliOptions.enableOnCreate,
+                endpoint: cliOptions.endpoint,
               });
 
+              if (!result.success) {
+                throw new Error(result.error);
+              }
+
               if (cliOptions.json) {
                 console.log(JSON.stringify(result));
-              } else if (result.success) {
-                console.log(`Added online eval config '${result.configName}'`);
               } else {
-                console.error(result.error);
+                console.log(`Added online eval config '${result.configName}'`);
               }
-              process.exit(result.success ? 0 : 1);
-            } else {
+
+              return {
+                evaluator_count: allEvaluators.length,
+                enable_on_create: cliOptions.enableOnCreate ?? false,
+              };
+            });
+          } else {
+            try {
               // TUI fallback
               requireTTY();
               const [{ render }, { default: React }, { AddFlow }] = await Promise.all([
@@ -189,14 +193,10 @@ export class OnlineEvalConfigPrimitive extends BasePrimitive<AddOnlineEvalConfig
                   },
                 })
               );
-            }
-          } catch (error) {
-            if (cliOptions.json) {
-              console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
-            } else {
+            } catch (error) {
               console.error(getErrorMessage(error));
+              process.exit(1);
             }
-            process.exit(1);
           }
         }
       );
@@ -213,12 +213,28 @@ export class OnlineEvalConfigPrimitive extends BasePrimitive<AddOnlineEvalConfig
 
     this.checkDuplicate(project.onlineEvalConfigs, options.name, 'Online eval config');
 
+    // Validate that the endpoint exists on the specified runtime if provided
+    if (options.endpoint) {
+      const runtime = project.runtimes.find(r => r.name === options.agent);
+      if (!runtime) {
+        throw new Error(`Runtime "${options.agent}" not found in project.`);
+      }
+      if (!runtime.endpoints?.[options.endpoint]) {
+        throw new Error(
+          `Endpoint "${options.endpoint}" not found on runtime "${options.agent}". Available endpoints: ${
+            runtime.endpoints ? Object.keys(runtime.endpoints).join(', ') : '(none)'
+          }`
+        );
+      }
+    }
+
     const config: OnlineEvalConfig = {
       name: options.name,
       agent: options.agent,
       evaluators: options.evaluators,
       samplingRate: options.samplingRate,
       ...(options.enableOnCreate !== undefined && { enableOnCreate: options.enableOnCreate }),
+      ...(options.endpoint && { endpoint: options.endpoint }),
     };
 
     project.onlineEvalConfigs.push(config);
diff --git a/src/cli/primitives/PolicyEnginePrimitive.ts b/src/cli/primitives/PolicyEnginePrimitive.ts
index a1f887547..bb9b314d8 100644
--- a/src/cli/primitives/PolicyEnginePrimitive.ts
+++ b/src/cli/primitives/PolicyEnginePrimitive.ts
@@ -3,6 +3,8 @@ import type { AgentCoreProjectSpec, PolicyEngine } from '../../schema';
 import { PolicyEngineModeSchema, PolicyEngineSchema } from '../../schema';
 import { getErrorMessage } from '../errors';
 import type { RemovalPreview, RemovalResult, SchemaChange } from '../operations/remove/types';
+import { cliCommandRun } from '../telemetry/cli-command-run.js';
+import { AttachMode, standardize } from '../telemetry/schemas/common-shapes.js';
 import { requireTTY } from '../tui/guards/tty';
 import { BasePrimitive } from './BasePrimitive';
 import { SOURCE_CODE_NOTE } from './constants';
@@ -221,20 +223,15 @@ export class PolicyEnginePrimitive extends BasePrimitive<AddPolicyEngineOptions,
           attachMode?: string;
           json?: boolean;
         }) => {
-          try {
-            if (!findConfigRoot()) {
-              console.error('No agentcore project found. Run `agentcore create` first.');
-              process.exit(1);
-            }
+          if (!findConfigRoot()) {
+            console.error('No agentcore project found. Run `agentcore create` first.');
+            process.exit(1);
+          }
 
-            if (cliOptions.name || cliOptions.description || cliOptions.encryptionKeyArn || cliOptions.json) {
+          if (cliOptions.name || cliOptions.description || cliOptions.encryptionKeyArn || cliOptions.json) {
+            await cliCommandRun('add.policy-engine', !!cliOptions.json, async () => {
               if (!cliOptions.name) {
-                if (cliOptions.json) {
-                  console.log(JSON.stringify({ success: false, error: '--name is required' }));
-                } else {
-                  console.error('--name is required');
-                }
-                process.exit(1);
+                throw new Error('--name is required');
               }
 
               const result = await this.add({
@@ -253,15 +250,29 @@ export class PolicyEnginePrimitive extends BasePrimitive<AddPolicyEngineOptions,
                 await this.attachToGateways(cliOptions.name, gateways, mode);
               }
 
+              if (!result.success) {
+                throw new Error(result.error);
+              }
+
               if (cliOptions.json) {
                 console.log(JSON.stringify(result));
-              } else if (result.success) {
-                console.log(`Added policy engine '${result.engineName}'`);
               } else {
-                console.error(result.error);
+                console.log(`Added policy engine '${result.engineName}'`);
               }
-              process.exit(result.success ? 0 : 1);
-            } else {
+
+              const gatewayCount = cliOptions.attachToGateways
+                ? cliOptions.attachToGateways
+                    .split(',')
+                    .map(s => s.trim())
+                    .filter(Boolean).length
+                : 0;
+              return {
+                attach_gateway_count: gatewayCount,
+                attach_mode: standardize(AttachMode, cliOptions.attachMode ?? 'log_only'),
+              };
+            });
+          } else {
+            try {
               requireTTY();
               const [{ render }, { default: React }, { AddFlow }] = await Promise.all([
                 import('ink'),
@@ -278,14 +289,10 @@ export class PolicyEnginePrimitive extends BasePrimitive<AddPolicyEngineOptions,
                   },
                 })
               );
+            } catch (error) {
+              console.error(getErrorMessage(error));
+              process.exit(1);
             }
-          } catch (error) {
-            if (cliOptions.json) {
-              console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
-            } else {
-              console.error(`Error: ${getErrorMessage(error)}`);
-            }
-            process.exit(1);
           }
         }
       );
diff --git a/src/cli/primitives/PolicyPrimitive.ts b/src/cli/primitives/PolicyPrimitive.ts
index bc1d446cc..beefe3008 100644
--- a/src/cli/primitives/PolicyPrimitive.ts
+++ b/src/cli/primitives/PolicyPrimitive.ts
@@ -5,6 +5,8 @@ import { detectRegion } from '../aws';
 import { getPolicyGeneration, startPolicyGeneration } from '../aws/policy-generation';
 import { getErrorMessage } from '../errors';
 import type { RemovalPreview, RemovalResult, SchemaChange } from '../operations/remove/types';
+import { cliCommandRun } from '../telemetry/cli-command-run.js';
+import { ValidationMode, standardize } from '../telemetry/schemas/common-shapes.js';
 import { requireTTY } from '../tui/guards/tty';
 import { BasePrimitive } from './BasePrimitive';
 import { SOURCE_CODE_NOTE } from './constants';
@@ -291,35 +293,25 @@ export class PolicyPrimitive extends BasePrimitive<AddPolicyOptions, RemovablePo
           validationMode?: string;
           json?: boolean;
         }) => {
-          try {
-            if (!findConfigRoot()) {
-              console.error('No agentcore project found. Run `agentcore create` first.');
-              process.exit(1);
-            }
+          if (!findConfigRoot()) {
+            console.error('No agentcore project found. Run `agentcore create` first.');
+            process.exit(1);
+          }
 
-            if (
-              cliOptions.name ||
-              cliOptions.engine ||
-              cliOptions.source ||
-              cliOptions.statement ||
-              cliOptions.generate ||
-              cliOptions.json
-            ) {
+          if (
+            cliOptions.name ||
+            cliOptions.engine ||
+            cliOptions.source ||
+            cliOptions.statement ||
+            cliOptions.generate ||
+            cliOptions.json
+          ) {
+            await cliCommandRun('add.policy', !!cliOptions.json, async () => {
               if (!cliOptions.name) {
-                if (cliOptions.json) {
-                  console.log(JSON.stringify({ success: false, error: '--name is required' }));
-                } else {
-                  console.error('--name is required');
-                }
-                process.exit(1);
+                throw new Error('--name is required');
               }
               if (!cliOptions.engine) {
-                if (cliOptions.json) {
-                  console.log(JSON.stringify({ success: false, error: '--engine is required' }));
-                } else {
-                  console.error('--engine is required');
-                }
-                process.exit(1);
+                throw new Error('--engine is required');
               }
 
               const result = await this.add({
@@ -335,15 +327,28 @@ export class PolicyPrimitive extends BasePrimitive<AddPolicyOptions, RemovablePo
                   : undefined,
               });
 
+              if (!result.success) {
+                throw new Error(result.error);
+              }
+
               if (cliOptions.json) {
                 console.log(JSON.stringify(result));
-              } else if (result.success) {
-                console.log(`Added policy '${result.policyName}' to engine '${result.engineName}'`);
               } else {
-                console.error(result.error);
+                console.log(`Added policy '${result.policyName}' to engine '${result.engineName}'`);
               }
-              process.exit(result.success ? 0 : 1);
-            } else {
+
+              const sourceType: 'file' | 'statement' | 'generate' = cliOptions.source
+                ? 'file'
+                : cliOptions.generate
+                  ? 'generate'
+                  : 'statement';
+              return {
+                source_type: sourceType,
+                validation_mode: standardize(ValidationMode, cliOptions.validationMode ?? 'FAIL_ON_ANY_FINDINGS'),
+              };
+            });
+          } else {
+            try {
               requireTTY();
               const [{ render }, { default: React }, { AddFlow }] = await Promise.all([
                 import('ink'),
@@ -361,14 +366,10 @@ export class PolicyPrimitive extends BasePrimitive<AddPolicyOptions, RemovablePo
                   },
                 })
               );
+            } catch (error) {
+              console.error(getErrorMessage(error));
+              process.exit(1);
             }
-          } catch (error) {
-            if (cliOptions.json) {
-              console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
-            } else {
-              console.error(`Error: ${getErrorMessage(error)}`);
-            }
-            process.exit(1);
           }
         }
       );
diff --git a/src/cli/primitives/RuntimeEndpointPrimitive.ts b/src/cli/primitives/RuntimeEndpointPrimitive.ts
index 358b5fa69..e055fd17a 100644
--- a/src/cli/primitives/RuntimeEndpointPrimitive.ts
+++ b/src/cli/primitives/RuntimeEndpointPrimitive.ts
@@ -4,6 +4,7 @@ import { RuntimeEndpointSchema } from '../../schema';
 import type { ResourceType } from '../commands/remove/types';
 import { getErrorMessage } from '../errors';
 import type { RemovalPreview, RemovalResult, SchemaChange } from '../operations/remove/types';
+import { cliCommandRun } from '../telemetry/cli-command-run.js';
 import { BasePrimitive } from './BasePrimitive';
 import { SOURCE_CODE_NOTE } from './constants';
 import type { AddResult, AddScreenComponent, RemovableResource } from './types';
@@ -248,12 +249,12 @@ export class RuntimeEndpointPrimitive extends BasePrimitive<AddRuntimeEndpointOp
           description?: string;
           json?: boolean;
         }) => {
-          try {
-            if (!findConfigRoot()) {
-              console.error('No agentcore project found. Run `agentcore create` first.');
-              process.exit(1);
-            }
+          if (!findConfigRoot()) {
+            console.error('No agentcore project found. Run `agentcore create` first.');
+            process.exit(1);
+          }
 
+          await cliCommandRun('add.runtime-endpoint', !!cliOptions.json, async () => {
             const result = await this.add({
               runtime: cliOptions.runtime,
               endpoint: cliOptions.endpoint,
@@ -261,23 +262,18 @@ export class RuntimeEndpointPrimitive extends BasePrimitive<AddRuntimeEndpointOp
               description: cliOptions.description,
             });
 
-            if (cliOptions.json) {
-              console.log(JSON.stringify(result));
-            } else if (result.success) {
-              console.log(`Added runtime endpoint '${cliOptions.endpoint}' to runtime '${cliOptions.runtime}'`);
-            } else {
-              console.error(result.error);
+            if (!result.success) {
+              throw new Error(result.error);
             }
 
-            process.exit(result.success ? 0 : 1);
-          } catch (error) {
             if (cliOptions.json) {
-              console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+              console.log(JSON.stringify(result));
             } else {
-              console.error(`Error: ${getErrorMessage(error)}`);
+              console.log(`Added runtime endpoint '${cliOptions.endpoint}' to runtime '${cliOptions.runtime}'`);
             }
-            process.exit(1);
-          }
+
+            return {};
+          });
         }
       );
 
diff --git a/src/cli/primitives/__tests__/ABTestPrimitive.test.ts b/src/cli/primitives/__tests__/ABTestPrimitive.test.ts
new file mode 100644
index 000000000..20ae26fa1
--- /dev/null
+++ b/src/cli/primitives/__tests__/ABTestPrimitive.test.ts
@@ -0,0 +1,278 @@
+import { ABTestPrimitive } from '../ABTestPrimitive.js';
+import type { AddABTestOptions } from '../ABTestPrimitive.js';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mockReadProjectSpec = vi.fn();
+const mockWriteProjectSpec = vi.fn();
+
+vi.mock('../../../lib/index.js', () => ({
+  ConfigIO: class {
+    readProjectSpec = mockReadProjectSpec;
+    writeProjectSpec = mockWriteProjectSpec;
+  },
+  findConfigRoot: () => '/fake/root',
+}));
+
+function makeProject(abTests: { name: string; gatewayRef?: string }[] = []) {
+  return {
+    name: 'TestProject',
+    version: 1,
+    managedBy: 'CDK' as const,
+    runtimes: [],
+    memories: [],
+    credentials: [],
+    evaluators: [],
+    onlineEvalConfigs: [],
+    agentCoreGateways: [],
+    policyEngines: [],
+    configBundles: [],
+    abTests,
+    httpGateways: [] as { name: string; runtimeRef: string }[],
+  };
+}
+
+const validOptions: AddABTestOptions = {
+  name: 'MyTest',
+  agent: 'my-agent',
+  controlBundle: 'arn:bundle:control',
+  controlVersion: 'v1',
+  treatmentBundle: 'arn:bundle:treatment',
+  treatmentVersion: 'v1',
+  controlWeight: 80,
+  treatmentWeight: 20,
+  onlineEval: 'arn:eval:config',
+};
+
+let primitive: ABTestPrimitive;
+
+describe('ABTestPrimitive', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    primitive = new ABTestPrimitive();
+  });
+
+  it('has correct kind, label, and article', () => {
+    expect(primitive.kind).toBe('ab-test');
+    expect(primitive.label).toBe('AB Test');
+    // eslint-disable-next-line @typescript-eslint/dot-notation
+    expect(primitive['article']).toBe('an');
+  });
+
+  describe('add', () => {
+    it('adds AB test to project spec and returns success', async () => {
+      mockReadProjectSpec.mockResolvedValue(makeProject());
+      mockWriteProjectSpec.mockResolvedValue(undefined);
+
+      const result = await primitive.add(validOptions);
+
+      expect(result.success).toBe(true);
+      expect(result).toHaveProperty('abTestName', 'MyTest');
+
+      const writtenSpec = mockWriteProjectSpec.mock.calls[0]![0];
+      expect(writtenSpec.abTests).toHaveLength(1);
+      expect(writtenSpec.abTests[0].name).toBe('MyTest');
+      expect(writtenSpec.abTests[0].variants).toHaveLength(2);
+      expect(writtenSpec.abTests[0].variants[0].name).toBe('C');
+      expect(writtenSpec.abTests[0].variants[0].weight).toBe(80);
+      expect(writtenSpec.abTests[0].variants[1].name).toBe('T1');
+      expect(writtenSpec.abTests[0].variants[1].weight).toBe(20);
+    });
+
+    it('includes optional fields when provided', async () => {
+      mockReadProjectSpec.mockResolvedValue(makeProject());
+      mockWriteProjectSpec.mockResolvedValue(undefined);
+
+      await primitive.add({
+        ...validOptions,
+        description: 'Test description',
+        roleArn: 'arn:aws:iam::123:role/MyRole',
+        trafficHeaderName: 'X-AB-Route',
+        maxDurationDays: 30,
+        enableOnCreate: true,
+      });
+
+      const writtenSpec = mockWriteProjectSpec.mock.calls[0]![0];
+      const test = writtenSpec.abTests[0];
+      expect(test.description).toBe('Test description');
+      expect(test.roleArn).toBe('arn:aws:iam::123:role/MyRole');
+      expect(test.trafficAllocationConfig).toEqual({ routeOnHeader: { headerName: 'X-AB-Route' } });
+      expect(test.maxDurationDays).toBe(30);
+      expect(test.enableOnCreate).toBe(true);
+    });
+
+    it('omits optional fields when not provided', async () => {
+      mockReadProjectSpec.mockResolvedValue(makeProject());
+      mockWriteProjectSpec.mockResolvedValue(undefined);
+
+      await primitive.add(validOptions);
+
+      const writtenSpec = mockWriteProjectSpec.mock.calls[0]![0];
+      const test = writtenSpec.abTests[0];
+      expect(test.description).toBeUndefined();
+      expect(test.roleArn).toBeUndefined();
+      expect(test.trafficAllocationConfig).toBeUndefined();
+      expect(test.maxDurationDays).toBeUndefined();
+      expect(test.enableOnCreate).toBeUndefined();
+    });
+
+    it('returns error when AB test name already exists', async () => {
+      mockReadProjectSpec.mockResolvedValue(makeProject([{ name: 'MyTest' }]));
+
+      const result = await primitive.add(validOptions);
+
+      expect(result).toEqual(
+        expect.objectContaining({ success: false, error: expect.stringContaining('already exists') })
+      );
+    });
+
+    it('returns error when readProjectSpec fails', async () => {
+      mockReadProjectSpec.mockRejectedValue(new Error('disk read error'));
+
+      const result = await primitive.add(validOptions);
+
+      expect(result).toEqual(expect.objectContaining({ success: false, error: 'disk read error' }));
+    });
+
+    it('returns error when writeProjectSpec fails', async () => {
+      mockReadProjectSpec.mockResolvedValue(makeProject());
+      mockWriteProjectSpec.mockRejectedValue(new Error('disk write error'));
+
+      const result = await primitive.add(validOptions);
+
+      expect(result).toEqual(expect.objectContaining({ success: false, error: 'disk write error' }));
+    });
+
+    it('returns error when variant weights do not sum to 100', async () => {
+      mockReadProjectSpec.mockResolvedValue(makeProject());
+
+      const result = await primitive.add({
+        ...validOptions,
+        controlWeight: 80,
+        treatmentWeight: 80,
+      });
+
+      expect(result.success).toBe(false);
+    });
+  });
+
+  describe('remove', () => {
+    it('removes AB test from project spec', async () => {
+      mockReadProjectSpec.mockResolvedValue(makeProject([{ name: 'TestA' }, { name: 'TestB' }]));
+      mockWriteProjectSpec.mockResolvedValue(undefined);
+
+      const result = await primitive.remove('TestA');
+
+      expect(result.success).toBe(true);
+      const writtenSpec = mockWriteProjectSpec.mock.calls[0]![0];
+      expect(writtenSpec.abTests).toHaveLength(1);
+      expect(writtenSpec.abTests[0].name).toBe('TestB');
+    });
+
+    it('returns error when AB test not found', async () => {
+      mockReadProjectSpec.mockResolvedValue(makeProject());
+
+      const result = await primitive.remove('NonExistent');
+
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error).toContain('NonExistent');
+        expect(result.error).toContain('not found');
+      }
+    });
+
+    it('returns error when readProjectSpec fails', async () => {
+      mockReadProjectSpec.mockRejectedValue(new Error('io error'));
+
+      const result = await primitive.remove('Whatever');
+
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error).toBe('io error');
+      }
+    });
+
+    it('cascade-deletes orphaned HTTP gateway when last referencing AB test is removed', async () => {
+      const project = makeProject([{ name: 'TestA', gatewayRef: '{{gateway:TestA-gw}}' }]);
+      project.httpGateways = [{ name: 'TestA-gw', runtimeRef: 'my-agent' }];
+      mockReadProjectSpec.mockResolvedValue(project);
+      mockWriteProjectSpec.mockResolvedValue(undefined);
+
+      const result = await primitive.remove('TestA');
+
+      expect(result.success).toBe(true);
+      const writtenSpec = mockWriteProjectSpec.mock.calls[0]![0];
+      expect(writtenSpec.abTests).toHaveLength(0);
+      // Gateway is retained by default — cascade-delete only happens with deleteGateway: true
+      expect(writtenSpec.httpGateways).toHaveLength(1);
+    });
+
+    it('retains HTTP gateway when another AB test still references it', async () => {
+      const project = makeProject([
+        { name: 'TestA', gatewayRef: '{{gateway:shared-gw}}' },
+        { name: 'TestB', gatewayRef: '{{gateway:shared-gw}}' },
+      ]);
+      project.httpGateways = [{ name: 'shared-gw', runtimeRef: 'my-agent' }];
+      mockReadProjectSpec.mockResolvedValue(project);
+      mockWriteProjectSpec.mockResolvedValue(undefined);
+
+      const result = await primitive.remove('TestA');
+
+      expect(result.success).toBe(true);
+      const writtenSpec = mockWriteProjectSpec.mock.calls[0]![0];
+      expect(writtenSpec.abTests).toHaveLength(1);
+      expect(writtenSpec.httpGateways).toHaveLength(1);
+      expect(writtenSpec.httpGateways[0].name).toBe('shared-gw');
+    });
+  });
+
+  describe('previewRemove', () => {
+    it('returns preview with schema changes', async () => {
+      mockReadProjectSpec.mockResolvedValue(makeProject([{ name: 'TestA' }]));
+
+      const preview = await primitive.previewRemove('TestA');
+
+      expect(preview.summary[0]).toContain('Removing AB test: TestA');
+      expect(preview.schemaChanges).toHaveLength(1);
+      expect(preview.schemaChanges[0]!.file).toBe('agentcore/agentcore.json');
+      expect((preview.schemaChanges[0]!.after as { abTests: unknown[] }).abTests).toHaveLength(0);
+    });
+
+    it('throws when AB test not found', async () => {
+      mockReadProjectSpec.mockResolvedValue(makeProject());
+
+      await expect(primitive.previewRemove('Missing')).rejects.toThrow('not found');
+    });
+  });
+
+  describe('getRemovable', () => {
+    it('returns AB test names', async () => {
+      mockReadProjectSpec.mockResolvedValue(makeProject([{ name: 'A' }, { name: 'B' }]));
+
+      const result = await primitive.getRemovable();
+
+      expect(result).toEqual([{ name: 'A' }, { name: 'B' }]);
+    });
+
+    it('returns empty array on error', async () => {
+      mockReadProjectSpec.mockRejectedValue(new Error('fail'));
+
+      expect(await primitive.getRemovable()).toEqual([]);
+    });
+  });
+
+  describe('getAllNames', () => {
+    it('returns AB test names as strings', async () => {
+      mockReadProjectSpec.mockResolvedValue(makeProject([{ name: 'X' }, { name: 'Y' }]));
+
+      const result = await primitive.getAllNames();
+
+      expect(result).toEqual(['X', 'Y']);
+    });
+
+    it('returns empty array on error', async () => {
+      mockReadProjectSpec.mockRejectedValue(new Error('fail'));
+
+      expect(await primitive.getAllNames()).toEqual([]);
+    });
+  });
+});
diff --git a/src/cli/primitives/__tests__/GatewayPrimitive.test.ts b/src/cli/primitives/__tests__/GatewayPrimitive.test.ts
index 4c4c66402..f812ca380 100644
--- a/src/cli/primitives/__tests__/GatewayPrimitive.test.ts
+++ b/src/cli/primitives/__tests__/GatewayPrimitive.test.ts
@@ -13,6 +13,10 @@ const defaultProject: AgentCoreProjectSpec = {
   onlineEvalConfigs: [],
   agentCoreGateways: [],
   policyEngines: [],
+  harnesses: [],
+  configBundles: [],
+  abTests: [],
+  httpGateways: [],
 };
 
 const { mockConfigExists, mockReadProjectSpec, mockWriteProjectSpec } = vi.hoisted(() => ({
diff --git a/src/cli/primitives/__tests__/HarnessPrimitive.test.ts b/src/cli/primitives/__tests__/HarnessPrimitive.test.ts
new file mode 100644
index 000000000..b37c58733
--- /dev/null
+++ b/src/cli/primitives/__tests__/HarnessPrimitive.test.ts
@@ -0,0 +1,685 @@
+import { setEnvVar } from '../../../lib';
+import type { AgentCoreProjectSpec, NetworkMode } from '../../../schema';
+import { DEFAULT_EPISODIC_REFLECTION_NAMESPACES, DEFAULT_STRATEGY_NAMESPACES } from '../../../schema';
+import { HarnessPrimitive } from '../HarnessPrimitive';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mockReadProjectSpec = vi.fn();
+const mockWriteProjectSpec = vi.fn();
+const mockWriteHarnessSpec = vi.fn();
+const mockGetHarnessDir = vi.fn().mockReturnValue('/tmp/test/agentcore/harnesses/test');
+
+vi.mock('../../../lib', () => ({
+  APP_DIR: 'app',
+  ConfigIO: class {
+    readProjectSpec = mockReadProjectSpec;
+    writeProjectSpec = mockWriteProjectSpec;
+    writeHarnessSpec = mockWriteHarnessSpec;
+    getPathResolver = () => ({
+      getHarnessDir: mockGetHarnessDir,
+    });
+    hasProject = vi.fn().mockReturnValue(true);
+  },
+  findConfigRoot: vi.fn().mockReturnValue('/tmp/test/agentcore'),
+  setEnvVar: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock('fs/promises', () => ({
+  access: vi.fn().mockResolvedValue(undefined),
+  writeFile: vi.fn().mockResolvedValue(undefined),
+  mkdir: vi.fn().mockResolvedValue(undefined),
+  rm: vi.fn().mockResolvedValue(undefined),
+  copyFile: vi.fn().mockResolvedValue(undefined),
+}));
+
+const baseProject: AgentCoreProjectSpec = {
+  name: 'TestProject',
+  version: 1,
+  managedBy: 'CDK',
+  runtimes: [],
+  memories: [],
+  credentials: [],
+  evaluators: [],
+  onlineEvalConfigs: [],
+  agentCoreGateways: [],
+  policyEngines: [],
+  harnesses: [],
+  configBundles: [],
+  abTests: [],
+  httpGateways: [],
+};
+
+describe('HarnessPrimitive', () => {
+  let primitive: HarnessPrimitive;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    primitive = new HarnessPrimitive();
+    mockWriteProjectSpec.mockResolvedValue(undefined);
+    mockWriteHarnessSpec.mockResolvedValue(undefined);
+  });
+
+  describe('add()', () => {
+    it('creates harness spec and registry entry', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      const result = await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+      });
+
+      expect(result.success).toBe(true);
+      if (result.success) {
+        expect(result.harnessName).toBe('testHarness');
+      }
+
+      expect(mockWriteHarnessSpec).toHaveBeenCalledWith(
+        'testHarness',
+        expect.objectContaining({
+          name: 'testHarness',
+          model: {
+            provider: 'bedrock',
+            modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+          },
+        })
+      );
+
+      expect(mockWriteProjectSpec).toHaveBeenCalledWith(
+        expect.objectContaining({
+          harnesses: [{ name: 'testHarness', path: 'app/testHarness' }],
+        })
+      );
+    });
+
+    it('auto-creates memory entry when skipMemory is false', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+      });
+
+      expect(mockWriteProjectSpec).toHaveBeenCalledWith(
+        expect.objectContaining({
+          memories: expect.arrayContaining([
+            expect.objectContaining({
+              name: 'testHarnessMemory',
+              eventExpiryDuration: 30,
+              strategies: [
+                { type: 'SEMANTIC', namespaces: DEFAULT_STRATEGY_NAMESPACES.SEMANTIC },
+                { type: 'USER_PREFERENCE', namespaces: DEFAULT_STRATEGY_NAMESPACES.USER_PREFERENCE },
+                { type: 'SUMMARIZATION', namespaces: DEFAULT_STRATEGY_NAMESPACES.SUMMARIZATION },
+                {
+                  type: 'EPISODIC',
+                  namespaces: DEFAULT_STRATEGY_NAMESPACES.EPISODIC,
+                  reflectionNamespaces: DEFAULT_EPISODIC_REFLECTION_NAMESPACES,
+                },
+              ],
+            }),
+          ]),
+        })
+      );
+
+      expect(mockWriteHarnessSpec).toHaveBeenCalledWith(
+        'testHarness',
+        expect.objectContaining({
+          memory: { name: 'testHarnessMemory' },
+        })
+      );
+    });
+
+    it('sets memory reference in harness spec', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+      });
+
+      expect(mockWriteHarnessSpec).toHaveBeenCalledWith(
+        'testHarness',
+        expect.objectContaining({
+          memory: { name: 'testHarnessMemory' },
+        })
+      );
+    });
+
+    it('rejects duplicate harness name', async () => {
+      mockReadProjectSpec.mockResolvedValue({
+        ...baseProject,
+        harnesses: [{ name: 'testHarness', path: './harnesses/testHarness' }],
+      });
+
+      const result = await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+      });
+
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error).toContain('already exists');
+      }
+    });
+
+    it('skips memory when skipMemory is true', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        skipMemory: true,
+      });
+
+      expect(mockWriteProjectSpec).toHaveBeenCalledWith(
+        expect.objectContaining({
+          memories: [],
+        })
+      );
+
+      const harnessSpec = mockWriteHarnessSpec.mock.calls[0]![1];
+      expect(harnessSpec).not.toHaveProperty('memory');
+    });
+
+    it('includes execution limits in harness spec', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        maxIterations: 10,
+        maxTokens: 4096,
+        timeoutSeconds: 300,
+      });
+
+      expect(mockWriteHarnessSpec).toHaveBeenCalledWith(
+        'testHarness',
+        expect.objectContaining({
+          maxIterations: 10,
+          maxTokens: 4096,
+          timeoutSeconds: 300,
+        })
+      );
+    });
+
+    it('includes truncation strategy in harness spec', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        truncationStrategy: 'sliding_window',
+      });
+
+      expect(mockWriteHarnessSpec).toHaveBeenCalledWith(
+        'testHarness',
+        expect.objectContaining({
+          truncation: {
+            strategy: 'sliding_window',
+          },
+        })
+      );
+    });
+
+    it('includes network config for VPC mode', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        networkMode: 'VPC' as NetworkMode,
+        subnets: ['subnet-123', 'subnet-456'],
+        securityGroups: ['sg-789'],
+      });
+
+      expect(mockWriteHarnessSpec).toHaveBeenCalledWith(
+        'testHarness',
+        expect.objectContaining({
+          networkMode: 'VPC',
+          networkConfig: {
+            subnets: ['subnet-123', 'subnet-456'],
+            securityGroups: ['sg-789'],
+          },
+        })
+      );
+    });
+
+    it('includes lifecycle config when provided', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        idleTimeout: 600,
+        maxLifetime: 3600,
+      });
+
+      expect(mockWriteHarnessSpec).toHaveBeenCalledWith(
+        'testHarness',
+        expect.objectContaining({
+          lifecycleConfig: {
+            idleRuntimeSessionTimeout: 600,
+            maxLifetime: 3600,
+          },
+        })
+      );
+    });
+
+    it('includes API key ARN for non-Bedrock providers', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'open_ai',
+        modelId: 'gpt-4',
+        apiKeyArn: 'arn:aws:secretsmanager:us-east-1:123456789012:secret:openai-key',
+      });
+
+      expect(mockWriteHarnessSpec).toHaveBeenCalledWith(
+        'testHarness',
+        expect.objectContaining({
+          model: {
+            provider: 'open_ai',
+            modelId: 'gpt-4',
+            apiKeyArn: 'arn:aws:secretsmanager:us-east-1:123456789012:secret:openai-key',
+          },
+        })
+      );
+    });
+
+    it('includes tools in harness spec when selectedTools provided', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      const result = await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        selectedTools: ['agentcore_browser', 'agentcore_code_interpreter'],
+      });
+
+      expect(result.success).toBe(true);
+      expect(mockWriteHarnessSpec).toHaveBeenCalledWith(
+        'testHarness',
+        expect.objectContaining({
+          tools: [
+            { type: 'agentcore_browser', name: 'browser' },
+            { type: 'agentcore_code_interpreter', name: 'code-interpreter' },
+          ],
+        })
+      );
+    });
+
+    it('includes remote_mcp tool with config when mcpName and mcpUrl provided', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      const result = await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        selectedTools: ['remote_mcp'],
+        mcpName: 'my-mcp',
+        mcpUrl: 'https://mcp.example.com',
+      });
+
+      expect(result.success).toBe(true);
+      expect(mockWriteHarnessSpec).toHaveBeenCalledWith(
+        'testHarness',
+        expect.objectContaining({
+          tools: [
+            {
+              type: 'remote_mcp',
+              name: 'my-mcp',
+              config: { remoteMcp: { url: 'https://mcp.example.com' } },
+            },
+          ],
+        })
+      );
+    });
+
+    it('includes gateway tool with config when gatewayArn provided', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      const result = await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        selectedTools: ['agentcore_gateway'],
+        gatewayArn: 'arn:aws:bedrock:us-east-1:123456789012:gateway/my-gw',
+      });
+
+      expect(result.success).toBe(true);
+      expect(mockWriteHarnessSpec).toHaveBeenCalledWith(
+        'testHarness',
+        expect.objectContaining({
+          tools: [
+            {
+              type: 'agentcore_gateway',
+              name: 'gateway',
+              config: {
+                agentCoreGateway: {
+                  gatewayArn: 'arn:aws:bedrock:us-east-1:123456789012:gateway/my-gw',
+                },
+              },
+            },
+          ],
+        })
+      );
+    });
+
+    it('includes gateway tool with outbound auth when gatewayOutboundAuth provided', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      const result = await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        selectedTools: ['agentcore_gateway'],
+        gatewayArn: 'arn:aws:bedrock:us-east-1:123456789012:gateway/my-gw',
+        gatewayOutboundAuth: 'oauth',
+        gatewayProviderArn: 'arn:aws:bedrock:us-east-1:123456789012:provider/my-provider',
+        gatewayScopes: ['read', 'write'],
+      });
+
+      expect(result.success).toBe(true);
+      expect(mockWriteHarnessSpec).toHaveBeenCalledWith(
+        'testHarness',
+        expect.objectContaining({
+          tools: [
+            {
+              type: 'agentcore_gateway',
+              name: 'gateway',
+              config: {
+                agentCoreGateway: {
+                  gatewayArn: 'arn:aws:bedrock:us-east-1:123456789012:gateway/my-gw',
+                  outboundAuth: {
+                    oauth: {
+                      providerArn: 'arn:aws:bedrock:us-east-1:123456789012:provider/my-provider',
+                      scopes: ['read', 'write'],
+                    },
+                  },
+                },
+              },
+            },
+          ],
+        })
+      );
+    });
+
+    it('includes system prompt when provided', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        systemPrompt: 'You are a helpful assistant.',
+      });
+
+      expect(mockWriteHarnessSpec).toHaveBeenCalledWith(
+        'testHarness',
+        expect.objectContaining({
+          systemPrompt: 'You are a helpful assistant.',
+        })
+      );
+    });
+
+    it('sets containerUri in harness spec', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        containerUri: '123456789012.dkr.ecr.us-west-2.amazonaws.com/my-harness:latest',
+      });
+
+      expect(mockWriteHarnessSpec).toHaveBeenCalledWith(
+        'testHarness',
+        expect.objectContaining({
+          containerUri: '123456789012.dkr.ecr.us-west-2.amazonaws.com/my-harness:latest',
+        })
+      );
+    });
+
+    it('copies Dockerfile and sets dockerfile field in harness spec', async () => {
+      const { copyFile, mkdir } = await import('fs/promises');
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        dockerfilePath: '/some/path/Dockerfile',
+      });
+
+      expect(mkdir).toHaveBeenCalledWith(expect.stringContaining('app/testHarness'), { recursive: true });
+      expect(copyFile).toHaveBeenCalledWith(
+        '/some/path/Dockerfile',
+        expect.stringContaining('app/testHarness/Dockerfile')
+      );
+      expect(mockWriteHarnessSpec).toHaveBeenCalledWith(
+        'testHarness',
+        expect.objectContaining({
+          dockerfile: 'Dockerfile',
+        })
+      );
+    });
+
+    it('returns error when Dockerfile does not exist', async () => {
+      const { access } = await import('fs/promises');
+      vi.mocked(access).mockRejectedValueOnce(new Error('ENOENT'));
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      const result = await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        dockerfilePath: '/nonexistent/Dockerfile',
+      });
+
+      expect(result.success).toBe(false);
+      expect(!result.success && result.error).toContain('Dockerfile not found at');
+    });
+
+    it('includes authorizerType AWS_IAM in harness spec', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      const result = await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        authorizerType: 'AWS_IAM',
+      });
+
+      expect(result.success).toBe(true);
+      expect(mockWriteHarnessSpec).toHaveBeenCalledWith(
+        'testHarness',
+        expect.objectContaining({
+          authorizerType: 'AWS_IAM',
+        })
+      );
+      // AWS_IAM should NOT have authorizerConfiguration
+      const harnessSpec = mockWriteHarnessSpec.mock.calls[0]![1];
+      expect(harnessSpec).not.toHaveProperty('authorizerConfiguration');
+    });
+
+    it('includes CUSTOM_JWT auth config in harness spec', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      const result = await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        authorizerType: 'CUSTOM_JWT',
+        jwtConfig: {
+          discoveryUrl: 'https://example.com/.well-known/openid-configuration',
+          allowedAudience: ['aud1'],
+        },
+      });
+
+      expect(result.success).toBe(true);
+      expect(mockWriteHarnessSpec).toHaveBeenCalledWith(
+        'testHarness',
+        expect.objectContaining({
+          authorizerType: 'CUSTOM_JWT',
+          authorizerConfiguration: {
+            customJwtAuthorizer: {
+              discoveryUrl: 'https://example.com/.well-known/openid-configuration',
+              allowedAudience: ['aud1'],
+            },
+          },
+        })
+      );
+    });
+
+    it('creates managed OAuth credential when clientId and clientSecret provided', async () => {
+      // First call returns the base project (for add),
+      // second call returns updated project with the harness (for createManagedOAuthCredential)
+      const projectAfterHarness = {
+        ...JSON.parse(JSON.stringify(baseProject)),
+        harnesses: [{ name: 'testHarness', path: 'app/testHarness' }],
+      };
+      mockReadProjectSpec
+        .mockResolvedValueOnce(JSON.parse(JSON.stringify(baseProject)))
+        .mockResolvedValueOnce(projectAfterHarness);
+
+      const result = await primitive.add({
+        name: 'testHarness',
+        modelProvider: 'bedrock',
+        modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        authorizerType: 'CUSTOM_JWT',
+        jwtConfig: {
+          discoveryUrl: 'https://example.com/.well-known/openid-configuration',
+          allowedAudience: ['aud1'],
+          clientId: 'my-client-id',
+          clientSecret: 'my-client-secret',
+        },
+      });
+
+      expect(result.success).toBe(true);
+
+      // writeProjectSpec called twice: once for harness, once for credential
+      expect(mockWriteProjectSpec).toHaveBeenCalledTimes(2);
+
+      // Second call should include the managed OAuth credential
+      const secondCallSpec = mockWriteProjectSpec.mock.calls[1]![0] as AgentCoreProjectSpec;
+      expect(secondCallSpec.credentials).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({
+            authorizerType: 'OAuthCredentialProvider',
+            name: 'testHarness-oauth',
+            discoveryUrl: 'https://example.com/.well-known/openid-configuration',
+            vendor: 'CustomOauth2',
+            managed: true,
+            usage: 'inbound',
+          }),
+        ])
+      );
+
+      // setEnvVar should have been called for client ID and secret
+      expect(setEnvVar).toHaveBeenCalledWith('AGENTCORE_CREDENTIAL_TESTHARNESS_OAUTH_CLIENT_ID', 'my-client-id');
+      expect(setEnvVar).toHaveBeenCalledWith(
+        'AGENTCORE_CREDENTIAL_TESTHARNESS_OAUTH_CLIENT_SECRET',
+        'my-client-secret'
+      );
+    });
+  });
+
+  describe('parseContainerFlag()', () => {
+    it('returns empty for undefined', () => {
+      expect(primitive.parseContainerFlag(undefined)).toEqual({});
+    });
+
+    it('detects Dockerfile paths ending with Dockerfile', () => {
+      expect(primitive.parseContainerFlag('./Dockerfile')).toEqual({ dockerfilePath: './Dockerfile' });
+      expect(primitive.parseContainerFlag('/abs/path/Dockerfile')).toEqual({ dockerfilePath: '/abs/path/Dockerfile' });
+    });
+
+    it('detects .dockerfile extension', () => {
+      expect(primitive.parseContainerFlag('custom.dockerfile')).toEqual({ dockerfilePath: 'custom.dockerfile' });
+    });
+
+    it('detects relative paths', () => {
+      expect(primitive.parseContainerFlag('./my-image/Dockerfile.prod')).toEqual({
+        dockerfilePath: './my-image/Dockerfile.prod',
+      });
+      expect(primitive.parseContainerFlag('../Dockerfile')).toEqual({ dockerfilePath: '../Dockerfile' });
+    });
+
+    it('treats ECR URIs as containerUri', () => {
+      const uri = '123456789012.dkr.ecr.us-west-2.amazonaws.com/my-harness:latest';
+      expect(primitive.parseContainerFlag(uri)).toEqual({ containerUri: uri });
+    });
+
+    it('treats non-path strings as containerUri', () => {
+      expect(primitive.parseContainerFlag('my-harness:latest')).toEqual({ containerUri: 'my-harness:latest' });
+    });
+  });
+
+  describe('remove()', () => {
+    it('removes harness from registry', async () => {
+      const { rm } = await import('fs/promises');
+
+      mockReadProjectSpec.mockResolvedValue({
+        ...baseProject,
+        harnesses: [{ name: 'testHarness', path: './harnesses/testHarness' }],
+      });
+
+      const result = await primitive.remove('testHarness');
+
+      expect(result.success).toBe(true);
+      expect(mockWriteProjectSpec).toHaveBeenCalledWith(
+        expect.objectContaining({
+          harnesses: [],
+          configBundles: [],
+          abTests: [],
+          httpGateways: [],
+        })
+      );
+      expect(rm).toHaveBeenCalledWith('/tmp/test/agentcore/harnesses/test', { recursive: true, force: true });
+    });
+
+    it('errors for nonexistent harness', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      const result = await primitive.remove('nonexistent');
+
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error).toContain('not found');
+      }
+    });
+  });
+
+  describe('getRemovable()', () => {
+    it('returns all registered harnesses', async () => {
+      mockReadProjectSpec.mockResolvedValue({
+        ...baseProject,
+        harnesses: [
+          { name: 'harness1', path: './harnesses/harness1' },
+          { name: 'harness2', path: './harnesses/harness2' },
+        ],
+      });
+
+      const removable = await primitive.getRemovable();
+
+      expect(removable).toEqual([{ name: 'harness1' }, { name: 'harness2' }]);
+    });
+
+    it('returns empty array when no harnesses exist', async () => {
+      mockReadProjectSpec.mockResolvedValue(JSON.parse(JSON.stringify(baseProject)));
+
+      const removable = await primitive.getRemovable();
+
+      expect(removable).toEqual([]);
+    });
+  });
+});
diff --git a/src/cli/primitives/__tests__/auth-utils.test.ts b/src/cli/primitives/__tests__/auth-utils.test.ts
index 3fce5148f..d309df4d1 100644
--- a/src/cli/primitives/__tests__/auth-utils.test.ts
+++ b/src/cli/primitives/__tests__/auth-utils.test.ts
@@ -93,6 +93,10 @@ describe('createManagedOAuthCredential', () => {
     onlineEvalConfigs: [],
     agentCoreGateways: [],
     policyEngines: [],
+    harnesses: [],
+    configBundles: [],
+    abTests: [],
+    httpGateways: [],
   };
 
   const jwtConfig: JwtConfigOptions = {
diff --git a/src/cli/primitives/index.ts b/src/cli/primitives/index.ts
index 2f19f9f3a..83bff4bbb 100644
--- a/src/cli/primitives/index.ts
+++ b/src/cli/primitives/index.ts
@@ -1,7 +1,9 @@
+export { ABTestPrimitive } from './ABTestPrimitive';
 export { BasePrimitive } from './BasePrimitive';
 export { MemoryPrimitive } from './MemoryPrimitive';
 export { CredentialPrimitive } from './CredentialPrimitive';
 export { AgentPrimitive } from './AgentPrimitive';
+export { HarnessPrimitive } from './HarnessPrimitive';
 export { EvaluatorPrimitive } from './EvaluatorPrimitive';
 export { OnlineEvalConfigPrimitive } from './OnlineEvalConfigPrimitive';
 export { GatewayPrimitive } from './GatewayPrimitive';
@@ -11,14 +13,18 @@ export type { AddRuntimeEndpointOptions, RemovableRuntimeEndpoint } from './Runt
 export {
   ALL_PRIMITIVES,
   agentPrimitive,
+  harnessPrimitive,
   memoryPrimitive,
   credentialPrimitive,
   evaluatorPrimitive,
   onlineEvalConfigPrimitive,
   gatewayPrimitive,
   gatewayTargetPrimitive,
+  configBundlePrimitive,
+  abTestPrimitive,
   runtimeEndpointPrimitive,
   getPrimitive,
 } from './registry';
 export { SOURCE_CODE_NOTE } from './constants';
 export type { AddResult, AddScreenComponent, RemovableResource, RemovalPreview, RemovalResult } from './types';
+export type { AddHarnessOptions } from './HarnessPrimitive';
diff --git a/src/cli/primitives/registry.ts b/src/cli/primitives/registry.ts
index 2680d1ea6..6f2145a79 100644
--- a/src/cli/primitives/registry.ts
+++ b/src/cli/primitives/registry.ts
@@ -1,9 +1,12 @@
+import { ABTestPrimitive } from './ABTestPrimitive';
 import { AgentPrimitive } from './AgentPrimitive';
 import type { BasePrimitive } from './BasePrimitive';
+import { ConfigBundlePrimitive } from './ConfigBundlePrimitive';
 import { CredentialPrimitive } from './CredentialPrimitive';
 import { EvaluatorPrimitive } from './EvaluatorPrimitive';
 import { GatewayPrimitive } from './GatewayPrimitive';
 import { GatewayTargetPrimitive } from './GatewayTargetPrimitive';
+import { HarnessPrimitive } from './HarnessPrimitive';
 import { MemoryPrimitive } from './MemoryPrimitive';
 import { OnlineEvalConfigPrimitive } from './OnlineEvalConfigPrimitive';
 import { PolicyEnginePrimitive } from './PolicyEnginePrimitive';
@@ -15,6 +18,7 @@ import type { RemovableResource } from './types';
  * Singleton instances of all primitives.
  */
 export const agentPrimitive = new AgentPrimitive();
+export const harnessPrimitive = new HarnessPrimitive();
 export const memoryPrimitive = new MemoryPrimitive();
 export const credentialPrimitive = new CredentialPrimitive();
 export const evaluatorPrimitive = new EvaluatorPrimitive();
@@ -23,6 +27,8 @@ export const gatewayPrimitive = new GatewayPrimitive();
 export const gatewayTargetPrimitive = new GatewayTargetPrimitive();
 export const policyEnginePrimitive = new PolicyEnginePrimitive();
 export const policyPrimitive = new PolicyPrimitive();
+export const configBundlePrimitive = new ConfigBundlePrimitive();
+export const abTestPrimitive = new ABTestPrimitive();
 export const runtimeEndpointPrimitive = new RuntimeEndpointPrimitive();
 
 /**
@@ -30,6 +36,7 @@ export const runtimeEndpointPrimitive = new RuntimeEndpointPrimitive();
  */
 export const ALL_PRIMITIVES: BasePrimitive<unknown, RemovableResource>[] = [
   agentPrimitive,
+  harnessPrimitive,
   memoryPrimitive,
   credentialPrimitive,
   evaluatorPrimitive,
@@ -38,6 +45,8 @@ export const ALL_PRIMITIVES: BasePrimitive<unknown, RemovableResource>[] = [
   gatewayTargetPrimitive,
   policyEnginePrimitive,
   policyPrimitive,
+  configBundlePrimitive,
+  abTestPrimitive,
   runtimeEndpointPrimitive,
 ];
 
diff --git a/src/cli/project.ts b/src/cli/project.ts
index d588b8ca6..c6bf1f5d0 100644
--- a/src/cli/project.ts
+++ b/src/cli/project.ts
@@ -18,6 +18,10 @@ export function createDefaultProjectSpec(projectName: string): AgentCoreProjectS
     onlineEvalConfigs: [],
     agentCoreGateways: [],
     policyEngines: [],
+    harnesses: [],
+    configBundles: [],
+    abTests: [],
+    httpGateways: [],
     tags: {
       'agentcore:created-by': 'agentcore-cli',
       'agentcore:project-name': projectName,
diff --git a/src/cli/telemetry/__tests__/client.test.ts b/src/cli/telemetry/__tests__/client.test.ts
index e254524bf..96adebafc 100644
--- a/src/cli/telemetry/__tests__/client.test.ts
+++ b/src/cli/telemetry/__tests__/client.test.ts
@@ -116,18 +116,49 @@ describe('TelemetryClient', () => {
       expect(sink.metrics[0]!.attrs.check_only).toBe('true');
     });
 
-    it('silently drops invalid success payloads', async () => {
+    it('publishes metric with unknown defaults for incomplete success payloads', async () => {
       const sink = new InMemorySink();
       const client = new TelemetryClient(sink);
 
-      // Missing required attrs for 'create' — should silently drop
+      // Missing required attrs for 'create' — should still publish with 'unknown' defaults
       await client.withCommandRun(
         'create',
         // @ts-expect-error — intentionally incomplete
         async () => ({ language: 'python' })
       );
 
-      expect(sink.metrics).toHaveLength(0);
+      expect(sink.metrics).toHaveLength(1);
+      expect(sink.metrics[0]!.attrs).toMatchObject({
+        exit_reason: 'success',
+        language: 'python',
+        framework: 'unknown',
+        model_provider: 'unknown',
+      });
+    });
+
+    it('defaults invalid attrs to unknown while preserving valid ones', async () => {
+      const sink = new InMemorySink();
+      const client = new TelemetryClient(sink);
+
+      await client.withCommandRun(
+        'create',
+        // @ts-expect-error — intentionally invalid enum value
+        async () => ({
+          language: 'rust', // invalid enum
+          framework: 'strands',
+          model_provider: 'bedrock',
+          memory: 'shortterm',
+          protocol: 'mcp',
+          build: 'codezip',
+          agent_type: 'create',
+          network_mode: 'public',
+          has_agent: true,
+        })
+      );
+
+      expect(sink.metrics).toHaveLength(1);
+      expect(sink.metrics[0]!.attrs.language).toBe('unknown');
+      expect(sink.metrics[0]!.attrs.framework).toBe('strands');
     });
 
     it('records cancel when callback returns CANCELLED', async () => {
diff --git a/src/cli/telemetry/cli-command-run.ts b/src/cli/telemetry/cli-command-run.ts
new file mode 100644
index 000000000..987f05730
--- /dev/null
+++ b/src/cli/telemetry/cli-command-run.ts
@@ -0,0 +1,71 @@
+import { getErrorMessage } from '../errors';
+import type { AddResult } from '../primitives/types.js';
+import { TelemetryClientAccessor } from './client-accessor.js';
+import type { Command, CommandAttrs } from './schemas/command-run.js';
+
+/**
+ * Run a CLI command with telemetry, standardized error output, and process.exit.
+ * The callback should throw on failure and return telemetry attrs on success.
+ *
+ * If telemetry initialization fails, the command still runs without telemetry —
+ * telemetry must never block CLI behavior.
+ */
+export async function cliCommandRun<C extends Command>(
+  command: C,
+  json: boolean,
+  fn: () => Promise<CommandAttrs<C>>
+): Promise<never> {
+  try {
+    let client;
+    try {
+      client = await TelemetryClientAccessor.get();
+    } catch {
+      // Telemetry init failed — run without it
+      await fn();
+      process.exit(0);
+    }
+    // withCommandRun records success/failure telemetry, then re-throws on failure
+    await client.withCommandRun(command, fn);
+    process.exit(0);
+  } catch (error) {
+    if (json) {
+      console.log(JSON.stringify({ success: false, error: getErrorMessage(error) }));
+    } else {
+      console.error(getErrorMessage(error));
+    }
+    process.exit(1);
+  }
+}
+
+/**
+ * Wrap a primitive .add() call with telemetry — used by TUI paths.
+ * CLI paths use {@link cliCommandRun} instead.
+ */
+export async function withAddTelemetry<C extends Command, T extends Record<string, unknown>>(
+  command: C,
+  attrs: CommandAttrs<C>,
+  fn: () => Promise<AddResult<T>>
+): Promise<AddResult<T>> {
+  let client;
+  try {
+    client = await TelemetryClientAccessor.get();
+  } catch {
+    return fn();
+  }
+
+  let result: AddResult<T> | undefined;
+  try {
+    await client.withCommandRun(command, async () => {
+      result = await fn();
+      if (!result.success) throw new Error(result.error);
+      return attrs;
+    });
+  } catch (err) {
+    // withCommandRun re-throws after recording failure telemetry.
+    // result is set if fn() ran; if not, fn() itself threw.
+    if (!result) {
+      return { success: false, error: getErrorMessage(err) };
+    }
+  }
+  return result!;
+}
diff --git a/src/cli/telemetry/client-accessor.ts b/src/cli/telemetry/client-accessor.ts
index c41c261df..04172dae5 100644
--- a/src/cli/telemetry/client-accessor.ts
+++ b/src/cli/telemetry/client-accessor.ts
@@ -1,4 +1,4 @@
-import { GLOBAL_CONFIG_DIR, readGlobalConfig } from '../global-config.js';
+import { GLOBAL_CONFIG_DIR, readGlobalConfig } from '../../lib/schemas/io/global-config.js';
 import { TelemetryClient } from './client.js';
 import { resolveAuditFilePath, resolveResourceAttributes } from './config.js';
 import { FileSystemSink } from './sinks/filesystem-sink.js';
diff --git a/src/cli/telemetry/client.ts b/src/cli/telemetry/client.ts
index 3228f45b1..91dffd94f 100644
--- a/src/cli/telemetry/client.ts
+++ b/src/cli/telemetry/client.ts
@@ -1,6 +1,6 @@
 import { classifyError, isUserError } from './error-classification.js';
 import { COMMAND_SCHEMAS, type Command, type CommandAttrs, deriveCommandGroup } from './schemas/command-run.js';
-import { type CommandResult, CommandResultSchema } from './schemas/common-shapes.js';
+import { type CommandResult, CommandResultSchema, resilientParse } from './schemas/common-shapes.js';
 import type { MetricSink } from './sinks/metric-sink.js';
 import { performance } from 'perf_hooks';
 
@@ -69,17 +69,24 @@ export class TelemetryClient {
     durationMs: number
   ): void {
     try {
+      // CommandResult is built internally — hard parse is intentional since
+      // a metric without a valid exit_reason is meaningless.
       CommandResultSchema.parse(result);
-      if (result.exit_reason !== 'failure' && result.exit_reason !== 'cancel') {
-        COMMAND_SCHEMAS[command].parse(attrs);
-      }
+
+      // Validate command attrs resiliently: invalid fields default to 'unknown'
+      // instead of dropping the entire metric.
+      // On failure/cancel the callback attrs are empty so validation is skipped.
+      const validatedAttrs =
+        result.exit_reason !== 'failure' && result.exit_reason !== 'cancel'
+          ? resilientParse(COMMAND_SCHEMAS[command], attrs as Record<string, unknown>)
+          : attrs;
 
       const otelAttrs: Record<string, string | number> = {
         command_group: deriveCommandGroup(command),
         command,
       };
 
-      for (const obj of [result, attrs]) {
+      for (const obj of [result, validatedAttrs]) {
         for (const [k, v] of Object.entries(obj)) {
           if (typeof v === 'boolean') {
             otelAttrs[k] = String(v);
diff --git a/src/cli/telemetry/config.ts b/src/cli/telemetry/config.ts
index 364d57f68..fbaa3fb13 100644
--- a/src/cli/telemetry/config.ts
+++ b/src/cli/telemetry/config.ts
@@ -1,5 +1,5 @@
+import { getOrCreateInstallationId, readGlobalConfig } from '../../lib/schemas/io/global-config.js';
 import { PACKAGE_VERSION } from '../constants.js';
-import { getOrCreateInstallationId, readGlobalConfig } from '../global-config.js';
 import { type ResourceAttributes, ResourceAttributesSchema } from './schemas/common-attributes.js';
 import { randomUUID } from 'crypto';
 import os from 'os';
diff --git a/src/cli/telemetry/schemas/__tests__/command-run.test.ts b/src/cli/telemetry/schemas/__tests__/command-run.test.ts
index 11d293c71..110df1284 100644
--- a/src/cli/telemetry/schemas/__tests__/command-run.test.ts
+++ b/src/cli/telemetry/schemas/__tests__/command-run.test.ts
@@ -1,6 +1,6 @@
 import { COMMAND_SCHEMAS, type Command, type CommandAttrs, deriveCommandGroup } from '../command-run';
 import { ResourceAttributesSchema } from '../common-attributes';
-import { CommandResultSchema } from '../common-shapes';
+import { CommandResultSchema, resilientParse } from '../common-shapes';
 import { describe, expect, expectTypeOf, it } from 'vitest';
 import { z } from 'zod';
 
@@ -170,3 +170,55 @@ describe('type safety', () => {
     }
   });
 });
+
+describe('resilientParse', () => {
+  it('passes valid attrs through unchanged', () => {
+    const attrs = {
+      language: 'python',
+      framework: 'strands',
+      model_provider: 'bedrock',
+      memory: 'shortterm',
+      protocol: 'mcp',
+      build: 'codezip',
+      agent_type: 'create',
+      network_mode: 'public',
+      has_agent: true,
+    };
+    expect(resilientParse(COMMAND_SCHEMAS.create, attrs)).toEqual(attrs);
+  });
+
+  it('defaults a single invalid enum field to unknown', () => {
+    const attrs = {
+      language: 'rust', // invalid
+      framework: 'strands',
+      model_provider: 'bedrock',
+      memory: 'shortterm',
+      protocol: 'mcp',
+      build: 'codezip',
+      agent_type: 'create',
+      network_mode: 'public',
+      has_agent: true,
+    };
+    const result = resilientParse(COMMAND_SCHEMAS.create, attrs);
+    expect(result.language).toBe('unknown');
+    expect(result.framework).toBe('strands');
+  });
+
+  it('defaults missing required fields to unknown', () => {
+    const result = resilientParse(COMMAND_SCHEMAS.create, { language: 'python' });
+    expect(result.language).toBe('python');
+    expect(result.framework).toBe('unknown');
+    expect(result.model_provider).toBe('unknown');
+  });
+
+  it('defaults all fields to unknown when all are invalid', () => {
+    const result = resilientParse(COMMAND_SCHEMAS.create, {});
+    for (const value of Object.values(result)) {
+      expect(value).toBe('unknown');
+    }
+  });
+
+  it('returns empty object for no-attrs schemas', () => {
+    expect(resilientParse(COMMAND_SCHEMAS['telemetry.disable'], {})).toEqual({});
+  });
+});
diff --git a/src/cli/telemetry/schemas/command-run.ts b/src/cli/telemetry/schemas/command-run.ts
index dfd127a98..0acfcaf1b 100644
--- a/src/cli/telemetry/schemas/command-run.ts
+++ b/src/cli/telemetry/schemas/command-run.ts
@@ -157,6 +157,7 @@ export const COMMAND_SCHEMAS = {
   'add.gateway-target': AddGatewayTargetAttrs,
   'add.policy-engine': AddPolicyEngineAttrs,
   'add.policy': AddPolicyAttrs,
+  'add.runtime-endpoint': NoAttrs,
 
   // deploy
   deploy: DeployAttrs,
diff --git a/src/cli/telemetry/schemas/common-shapes.ts b/src/cli/telemetry/schemas/common-shapes.ts
index 5c5e56493..4624883cd 100644
--- a/src/cli/telemetry/schemas/common-shapes.ts
+++ b/src/cli/telemetry/schemas/common-shapes.ts
@@ -8,6 +8,40 @@ export function safeSchema<T extends Record<string, SafeField>>(shape: T) {
   return z.object(shape);
 }
 
+/**
+ * Validate each field in a schema individually, defaulting to 'unknown' on failure.
+ * This ensures a single invalid attribute never blocks the entire metric from being published.
+ * Keys in attrs not present in the schema are omitted from the result.
+ */
+export function resilientParse(
+  schema: z.ZodObject<z.ZodRawShape>,
+  attrs: Record<string, unknown>
+): Record<string, unknown> {
+  const result: Record<string, unknown> = {};
+  for (const key of Object.keys(schema.shape)) {
+    const field = schema.shape[key] as z.ZodType;
+    const parsed = field.safeParse(attrs[key]);
+    result[key] = parsed.success ? parsed.data : 'unknown';
+  }
+  return result;
+}
+
+/**
+ * Lowercase a CLI value and parse it through a Zod enum, returning the narrowed type.
+ * The `as` cast on the failure branch is intentional: invalid values pass through to
+ * recordCommandRun, where COMMAND_SCHEMAS[command].parse(attrs) validates the full
+ * attr object in a try/catch — silently dropping the metric if any field is invalid.
+ * This ensures telemetry never crashes the CLI while keeping the happy-path type-safe.
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function standardize<T extends z.ZodEnum<any>>(schema: T, value: string | undefined): z.infer<T> {
+  const lower = (value ?? '').toLowerCase();
+  const result = schema.safeParse(lower);
+  // If the value doesn't match the enum, return the lowercased value anyway —
+  // recordCommandRun's try/catch will silently drop the invalid metric.
+  return (result.success ? result.data : lower) as z.infer<T>;
+}
+
 // Primitive types
 export const Count = z.number().int().nonnegative();
 
@@ -41,7 +75,17 @@ export const GatewayTargetType = z.enum([
   'open-api-schema',
   'smithy-model',
   'lambda-function-arn',
+  'unknown',
 ]);
+
+/** Map camelCase CLI target type to kebab-case telemetry enum value. */
+export const GATEWAY_TARGET_TYPE_MAP: Record<string, z.infer<typeof GatewayTargetType>> = {
+  apiGateway: 'api-gateway',
+  openApiSchema: 'open-api-schema',
+  smithyModel: 'smithy-model',
+  lambdaFunctionArn: 'lambda-function-arn',
+  mcpServer: 'mcp-server',
+};
 export const Language = z.enum(['python', 'typescript', 'other']);
 export const Level = z.enum(['session', 'trace', 'tool_call']);
 export const Memory = z.enum(['none', 'shortterm', 'longandshortterm']);
diff --git a/src/cli/templates/types.ts b/src/cli/templates/types.ts
index 185f7b084..907cc99dd 100644
--- a/src/cli/templates/types.ts
+++ b/src/cli/templates/types.ts
@@ -72,4 +72,6 @@ export interface AgentRenderConfig {
   sessionStorageMountPath?: string;
   /** Whether to wrap entrypoint with opentelemetry-instrument. Defaults to true. */
   enableOtel?: boolean;
+  /** Whether a config bundle is wired into the agent template */
+  hasConfigBundle?: boolean;
 }
diff --git a/src/cli/tui/App.tsx b/src/cli/tui/App.tsx
index 2f5087329..96b5c7f85 100644
--- a/src/cli/tui/App.tsx
+++ b/src/cli/tui/App.tsx
@@ -4,8 +4,10 @@ import { LayoutProvider } from './context';
 import { CLI_ONLY_EXAMPLES } from './copy';
 import { setExitAction } from './exit-action';
 import { MissingProjectMessage, WrongDirectoryMessage, getProjectRootMismatch, projectExists } from './guards';
+import { ABTestPickerScreen } from './screens/ab-test';
 import { AddFlow } from './screens/add/AddFlow';
 import { CliOnlyScreen } from './screens/cli-only';
+import { ConfigBundleFlow } from './screens/config-bundle-hub';
 import { CreateScreen } from './screens/create';
 import { DeployScreen } from './screens/deploy/DeployScreen';
 import { EvalHubScreen, EvalScreen } from './screens/eval';
@@ -15,8 +17,9 @@ import { ImportFlow } from './screens/import';
 import { InvokeScreen } from './screens/invoke';
 import { OnlineEvalDashboard } from './screens/online-eval';
 import { PackageScreen } from './screens/package';
+import { RecommendationFlow, RecommendationHistoryScreen, RecommendationsHubScreen } from './screens/recommendation';
 import { RemoveFlow } from './screens/remove';
-import { RunEvalFlow, RunScreen } from './screens/run-eval';
+import { BatchEvalHistoryScreen, RunBatchEvalFlow, RunEvalFlow, RunScreen } from './screens/run-eval';
 import { StatusScreen } from './screens/status/StatusScreen';
 import { UpdateScreen } from './screens/update';
 import { ValidateScreen } from './screens/validate';
@@ -38,6 +41,11 @@ type Route =
   | { name: 'remove' }
   | { name: 'run' }
   | { name: 'run-eval'; from?: 'run' | 'evals' }
+  | { name: 'run-batch-eval'; from?: 'run' | 'evals' }
+  | { name: 'batch-eval-history' }
+  | { name: 'recommendations-hub' }
+  | { name: 'recommend'; from?: 'recommendations-hub' | 'run' }
+  | { name: 'recommendation-history' }
   | { name: 'evals' }
   | { name: 'eval-runs' }
   | { name: 'online-evals' }
@@ -45,7 +53,9 @@ type Route =
   | { name: 'validate' }
   | { name: 'package' }
   | { name: 'update' }
+  | { name: 'config-bundle' }
   | { name: 'import' }
+  | { name: 'ab-test' }
   | { name: 'cli-only'; commandId: string };
 
 // Commands that don't require being at the project root
@@ -111,6 +121,8 @@ function AppContent() {
       setRoute({ name: 'evals' });
     } else if (id === 'fetch') {
       setRoute({ name: 'fetch-access' });
+    } else if (id === 'recommendations') {
+      setRoute({ name: 'recommendations-hub' });
     } else if (id === 'validate') {
       setRoute({ name: 'validate' });
     } else if (id === 'package') {
@@ -123,6 +135,10 @@ function AppContent() {
       setRoute({ name: 'import' });
     } else if (id === 'update') {
       setRoute({ name: 'update' });
+    } else if (id === 'config-bundle') {
+      setRoute({ name: 'config-bundle' });
+    } else if (id === 'ab-test') {
+      setRoute({ name: 'ab-test' });
     }
   };
 
@@ -213,6 +229,8 @@ function AppContent() {
     return (
       <RunScreen
         onRunEval={() => setRoute({ name: 'run-eval', from: 'run' })}
+        onRunBatchEval={() => setRoute({ name: 'run-batch-eval', from: 'run' })}
+        onRunRecommendation={() => setRoute({ name: 'recommend', from: 'run' })}
         onExit={() => setRoute({ name: 'help' })}
       />
     );
@@ -224,6 +242,8 @@ function AppContent() {
         onSelect={view => {
           if (view === 'run-eval') setRoute({ name: 'run-eval', from: 'evals' });
           if (view === 'runs') setRoute({ name: 'eval-runs' });
+          if (view === 'run-batch-eval') setRoute({ name: 'run-batch-eval', from: 'evals' });
+          if (view === 'batch-eval-history') setRoute({ name: 'batch-eval-history' });
           if (view === 'online-dashboard') setRoute({ name: 'online-evals' });
         }}
         onExit={() => setRoute({ name: 'help' })}
@@ -241,6 +261,36 @@ function AppContent() {
     );
   }
 
+  if (route.name === 'run-batch-eval') {
+    const backRoute = route.from ?? 'run';
+    return <RunBatchEvalFlow onExit={() => setRoute({ name: backRoute } as Route)} />;
+  }
+
+  if (route.name === 'batch-eval-history') {
+    return <BatchEvalHistoryScreen onExit={() => setRoute({ name: 'evals' })} />;
+  }
+
+  if (route.name === 'recommendations-hub') {
+    return (
+      <RecommendationsHubScreen
+        onSelect={view => {
+          if (view === 'run-recommendation') setRoute({ name: 'recommend', from: 'recommendations-hub' });
+          if (view === 'recommendation-history') setRoute({ name: 'recommendation-history' });
+        }}
+        onExit={() => setRoute({ name: 'help' })}
+      />
+    );
+  }
+
+  if (route.name === 'recommend') {
+    const backRoute = route.from ?? 'recommendations-hub';
+    return <RecommendationFlow onExit={() => setRoute({ name: backRoute } as Route)} />;
+  }
+
+  if (route.name === 'recommendation-history') {
+    return <RecommendationHistoryScreen onExit={() => setRoute({ name: 'recommendations-hub' })} />;
+  }
+
   if (route.name === 'eval-runs') {
     return <EvalScreen isInteractive={true} onExit={() => setRoute({ name: 'evals' })} />;
   }
@@ -274,6 +324,14 @@ function AppContent() {
     return <UpdateScreen isInteractive={true} onExit={() => setRoute({ name: 'help' })} />;
   }
 
+  if (route.name === 'config-bundle') {
+    return <ConfigBundleFlow onExit={() => setRoute({ name: 'help' })} />;
+  }
+
+  if (route.name === 'ab-test') {
+    return <ABTestPickerScreen onExit={() => setRoute({ name: 'help' })} />;
+  }
+
   if (route.name === 'cli-only') {
     const info = CLI_ONLY_EXAMPLES[route.commandId];
     if (info) {
diff --git a/src/cli/tui/components/DeployStatus.tsx b/src/cli/tui/components/DeployStatus.tsx
index 712c9dd95..c6e78b3e4 100644
--- a/src/cli/tui/components/DeployStatus.tsx
+++ b/src/cli/tui/components/DeployStatus.tsx
@@ -7,6 +7,8 @@ interface DeployStatusProps {
   messages: DeployMessage[];
   isComplete: boolean;
   hasError: boolean;
+  hasPostDeployError?: boolean;
+  postDeployWarnings?: string[];
 }
 
 const PROGRESS_BAR_WIDTH = 20;
@@ -127,7 +129,13 @@ function ResourceLine({ resource }: { resource: ParsedResource }) {
  * During deployment: shows last N resource events (type + status only)
  * After completion: shows success/failure state
  */
-export function DeployStatus({ messages, isComplete, hasError }: DeployStatusProps) {
+export function DeployStatus({
+  messages,
+  isComplete,
+  hasError,
+  hasPostDeployError,
+  postDeployWarnings,
+}: DeployStatusProps) {
   // Parse and filter messages to only meaningful resource updates
   const parsedResources = messages
     .map(msg => ({ original: msg, parsed: parseResourceMessage(msg) }))
@@ -139,16 +147,19 @@ export function DeployStatus({ messages, isComplete, hasError }: DeployStatusPro
 
   // When complete, show final status
   if (isComplete) {
+    const hasWarning = hasPostDeployError && !hasError;
+    const borderColor = hasError ? 'red' : hasWarning ? 'yellow' : 'green';
+    const textColor = borderColor;
+    const bannerText = hasError
+      ? '✗ Deploy to AWS Failed'
+      : hasWarning
+        ? '⚠ Deploy to AWS Complete (with warnings)'
+        : '✓ Deploy to AWS Complete';
+
     return (
-      <Box
-        flexDirection="column"
-        borderStyle="round"
-        borderColor={hasError ? 'red' : 'green'}
-        paddingX={1}
-        minWidth={50}
-      >
-        <Text bold color={hasError ? 'red' : 'green'}>
-          {hasError ? '✗ Deploy to AWS Failed' : '✓ Deploy to AWS Complete'}
+      <Box flexDirection="column" borderStyle="round" borderColor={borderColor} paddingX={1} minWidth={50}>
+        <Text bold color={textColor}>
+          {bannerText}
         </Text>
         {progress && (
           <Box marginTop={1}>
@@ -162,6 +173,15 @@ export function DeployStatus({ messages, isComplete, hasError }: DeployStatusPro
             ))}
           </Box>
         )}
+        {hasWarning && postDeployWarnings && postDeployWarnings.length > 0 && (
+          <Box flexDirection="column" marginTop={1}>
+            {postDeployWarnings.map((w, i) => (
+              <Text key={i} color="yellow">
+                {w}
+              </Text>
+            ))}
+          </Box>
+        )}
       </Box>
     );
   }
diff --git a/src/cli/tui/components/MultiSelectList.tsx b/src/cli/tui/components/MultiSelectList.tsx
index 74f6ef2d5..1f2994f22 100644
--- a/src/cli/tui/components/MultiSelectList.tsx
+++ b/src/cli/tui/components/MultiSelectList.tsx
@@ -6,6 +6,8 @@ export interface MultiSelectListProps<T extends SelectableItem> {
   selectedIndex: number;
   selectedIds: Set<string>;
   emptyMessage?: string;
+  /** Maximum number of visible items before scrolling. Undefined = show all. */
+  maxVisibleItems?: number;
 }
 
 export function MultiSelectList<T extends SelectableItem>(props: MultiSelectListProps<T>) {
@@ -18,11 +20,30 @@ export function MultiSelectList<T extends SelectableItem>(props: MultiSelectList
     );
   }
 
+  const { items, selectedIndex, selectedIds, maxVisibleItems } = props;
+  const needsScroll = maxVisibleItems !== undefined && items.length > maxVisibleItems;
+
+  let visibleItems = items;
+  let viewportStart = 0;
+  let viewportEnd = items.length;
+
+  if (needsScroll) {
+    const halfVisible = Math.floor(maxVisibleItems / 2);
+    viewportStart = Math.max(0, selectedIndex - halfVisible);
+    viewportEnd = Math.min(items.length, viewportStart + maxVisibleItems);
+    if (viewportEnd - viewportStart < maxVisibleItems) {
+      viewportStart = Math.max(0, viewportEnd - maxVisibleItems);
+    }
+    visibleItems = items.slice(viewportStart, viewportEnd);
+  }
+
   return (
     <Box flexDirection="column">
-      {props.items.map((item, idx) => {
-        const isCursor = idx === props.selectedIndex;
-        const isChecked = props.selectedIds.has(item.id);
+      {needsScroll && viewportStart > 0 && <Text dimColor> ↑ {viewportStart} more</Text>}
+      {visibleItems.map((item, idx) => {
+        const actualIndex = viewportStart + idx;
+        const isCursor = actualIndex === selectedIndex;
+        const isChecked = selectedIds.has(item.id);
         const checkbox = isChecked ? '[✓]' : '[ ]';
         return (
           <Box key={item.id}>
@@ -35,6 +56,7 @@ export function MultiSelectList<T extends SelectableItem>(props: MultiSelectList
           </Box>
         );
       })}
+      {needsScroll && viewportEnd < items.length && <Text dimColor> ↓ {items.length - viewportEnd} more</Text>}
     </Box>
   );
 }
diff --git a/src/cli/tui/components/PathInput.tsx b/src/cli/tui/components/PathInput.tsx
index ebb16f956..f2663cea4 100644
--- a/src/cli/tui/components/PathInput.tsx
+++ b/src/cli/tui/components/PathInput.tsx
@@ -209,8 +209,30 @@ export function PathInput({
       return;
     }
 
-    // Enter: Validate and submit the current path
+    // Enter: If a dropdown item is highlighted, select it first; then validate and submit
     if (key.return) {
+      // If there's a highlighted match, auto-select it
+      if (matches.length > 0 && matches[clampedIndex]) {
+        const selected = matches[clampedIndex];
+        if (selected.isDirectory) {
+          // Drill into directory
+          setValue(selected.value);
+          setCursor(selected.value.length);
+          setSelectedIndex(0);
+          return;
+        }
+        // It's a file — select and submit it
+        const validationError = allowCreate
+          ? validatePathForCreate(selected.value, basePath)
+          : validatePath(selected.value, basePath, pathType);
+        if (validationError) {
+          setError(validationError);
+          return;
+        }
+        onSubmit(selected.value);
+        return;
+      }
+
       const trimmed = value.trim();
       if (!trimmed) {
         if (allowEmpty) {
diff --git a/src/cli/tui/components/ResourceGraph.tsx b/src/cli/tui/components/ResourceGraph.tsx
index 44bcf0b77..922d63344 100644
--- a/src/cli/tui/components/ResourceGraph.tsx
+++ b/src/cli/tui/components/ResourceGraph.tsx
@@ -11,6 +11,7 @@ import React, { useMemo } from 'react';
 
 const ICONS = {
   agent: '●',
+  harness: '◎',
   memory: '■',
   credential: '◇',
   gateway: '◆',
@@ -20,6 +21,8 @@ const ICONS = {
   'online-eval': '↻',
   'policy-engine': '▣',
   policy: '▢',
+  'config-bundle': '⬡',
+  'ab-test': '⚗',
   'runtime-endpoint': '◉',
 } as const;
 
@@ -103,7 +106,7 @@ function ResourceRow({
       )}
       {invocationUrl && (
         <Text dimColor>
-          {'      '}URL: {invocationUrl}
+          {'      '}Invocation URL: {invocationUrl}
         </Text>
       )}
     </Box>
@@ -121,6 +124,7 @@ export function getTargetDisplayText(target: AgentCoreGatewayTarget): string {
 export function ResourceGraph({ project, mcp, agentName, resourceStatuses }: ResourceGraphProps) {
   const allAgents = project.runtimes ?? [];
   const agents = agentName ? allAgents.filter(a => a.name === agentName) : allAgents;
+  const harnesses = project.harnesses ?? [];
   const memories = project.memories ?? [];
   const credentials = project.credentials ?? [];
   const evaluators = project.evaluators ?? [];
@@ -129,6 +133,8 @@ export function ResourceGraph({ project, mcp, agentName, resourceStatuses }: Res
   const mcpRuntimeTools = mcp?.mcpRuntimeTools ?? [];
   const unassignedTargets = mcp?.unassignedTargets ?? [];
   const policyEngines = project.policyEngines ?? [];
+  const configBundles = project.configBundles ?? [];
+  const abTests = project.abTests ?? [];
 
   // Build lookup map and collect pending-removal resources in a single pass
   const { statusMap, pendingRemovals } = useMemo(() => {
@@ -153,6 +159,7 @@ export function ResourceGraph({ project, mcp, agentName, resourceStatuses }: Res
 
   const hasContent =
     agents.length > 0 ||
+    harnesses.length > 0 ||
     memories.length > 0 ||
     credentials.length > 0 ||
     evaluators.length > 0 ||
@@ -214,6 +221,30 @@ export function ResourceGraph({ project, mcp, agentName, resourceStatuses }: Res
         </Box>
       )}
 
+      {/* Harnesses */}
+      {harnesses.length > 0 && (
+        <Box flexDirection="column">
+          <SectionHeader>Harnesses</SectionHeader>
+          {harnesses.map(harness => {
+            const rsEntry = statusMap.get(`harness:${harness.name}`);
+            const harnessStatus = rsEntry?.error ? 'error' : rsEntry?.detail;
+            const harnessStatusColor = rsEntry?.error ? 'red' : getStatusColor(harnessStatus);
+            return (
+              <ResourceRow
+                key={harness.name}
+                icon={ICONS.harness}
+                color="cyan"
+                name={harness.name}
+                status={harnessStatus}
+                statusColor={harnessStatusColor}
+                deploymentState={rsEntry?.deploymentState}
+                identifier={rsEntry?.identifier}
+              />
+            );
+          })}
+        </Box>
+      )}
+
       {/* Memories */}
       {memories.length > 0 && (
         <Box flexDirection="column">
@@ -306,6 +337,49 @@ export function ResourceGraph({ project, mcp, agentName, resourceStatuses }: Res
         </Box>
       )}
 
+      {/* Configuration Bundles */}
+      {configBundles.length > 0 && (
+        <Box flexDirection="column">
+          <SectionHeader>Configuration Bundles</SectionHeader>
+          {configBundles.map(bundle => {
+            const rsEntry = statusMap.get(`config-bundle:${bundle.name}`);
+            return (
+              <ResourceRow
+                key={bundle.name}
+                icon={ICONS['config-bundle']}
+                color="white"
+                name={bundle.name}
+                detail={rsEntry?.detail ?? bundle.description}
+                deploymentState={rsEntry?.deploymentState}
+                identifier={rsEntry?.identifier}
+              />
+            );
+          })}
+        </Box>
+      )}
+
+      {/* AB Tests */}
+      {abTests.length > 0 && (
+        <Box flexDirection="column">
+          <SectionHeader>AB Tests</SectionHeader>
+          {abTests.map(test => {
+            const rsEntry = statusMap.get(`ab-test:${test.name}`);
+            return (
+              <ResourceRow
+                key={test.name}
+                icon={ICONS['ab-test']}
+                color="white"
+                name={test.name}
+                detail={rsEntry?.detail ?? test.description}
+                deploymentState={rsEntry?.deploymentState}
+                identifier={rsEntry?.identifier}
+                invocationUrl={rsEntry?.invocationUrl}
+              />
+            );
+          })}
+        </Box>
+      )}
+
       {/* Removed locally — still deployed in AWS, will be torn down on next deploy */}
       {pendingRemovals.length > 0 && (
         <Box flexDirection="column">
@@ -431,12 +505,15 @@ export function ResourceGraph({ project, mcp, agentName, resourceStatuses }: Res
         <Text color="gray">{'─'.repeat(50)}</Text>
         <Text>
           <Text color="green">{ICONS.agent}</Text> agent{'  '}
+          <Text color="cyan">{ICONS.harness}</Text> harness{'  '}
           <Text color="blue">{ICONS.memory}</Text> memory{'  '}
           <Text color="yellow">{ICONS.credential}</Text> credential{'  '}
           <Text color="cyan">{ICONS.evaluator}</Text> evaluator{'  '}
           <Text color="magenta">{ICONS['online-eval']}</Text> online-eval{'  '}
           <Text color="magenta">{ICONS.gateway}</Text> gateway{'  '}
-          <Text color="red">{ICONS['policy-engine']}</Text> policy engine
+          <Text color="red">{ICONS['policy-engine']}</Text> policy engine{'  '}
+          <Text color="white">{ICONS['config-bundle']}</Text> config bundle{'  '}
+          <Text color="white">{ICONS['ab-test']}</Text> ab test
         </Text>
       </Box>
     </Box>
diff --git a/src/cli/tui/components/SelectList.tsx b/src/cli/tui/components/SelectList.tsx
index 6163c102a..feea63248 100644
--- a/src/cli/tui/components/SelectList.tsx
+++ b/src/cli/tui/components/SelectList.tsx
@@ -13,6 +13,8 @@ export function SelectList<T extends SelectableItem>(props: {
   items: T[];
   selectedIndex: number;
   emptyMessage?: string;
+  /** Maximum number of visible items before scrolling. Undefined = show all. */
+  maxVisibleItems?: number;
 }) {
   if (props.items.length === 0) {
     return (
@@ -24,10 +26,29 @@ export function SelectList<T extends SelectableItem>(props: {
     );
   }
 
+  const { items, selectedIndex, maxVisibleItems } = props;
+  const needsScroll = maxVisibleItems !== undefined && items.length > maxVisibleItems;
+
+  let visibleItems = items;
+  let viewportStart = 0;
+  let viewportEnd = items.length;
+
+  if (needsScroll) {
+    const halfVisible = Math.floor(maxVisibleItems / 2);
+    viewportStart = Math.max(0, selectedIndex - halfVisible);
+    viewportEnd = Math.min(items.length, viewportStart + maxVisibleItems);
+    if (viewportEnd - viewportStart < maxVisibleItems) {
+      viewportStart = Math.max(0, viewportEnd - maxVisibleItems);
+    }
+    visibleItems = items.slice(viewportStart, viewportEnd);
+  }
+
   return (
     <Box flexDirection="column">
-      {props.items.map((item, idx) => {
-        const selected = idx === props.selectedIndex;
+      {needsScroll && viewportStart > 0 && <Text dimColor> ↑ {viewportStart} more</Text>}
+      {visibleItems.map((item, idx) => {
+        const actualIndex = viewportStart + idx;
+        const selected = actualIndex === selectedIndex;
         const disabled = item.disabled ?? false;
         return (
           <Box key={item.id} marginTop={item.spaceBefore ? 1 : 0}>
@@ -43,6 +64,7 @@ export function SelectList<T extends SelectableItem>(props: {
           </Box>
         );
       })}
+      {needsScroll && viewportEnd < items.length && <Text dimColor> ↓ {items.length - viewportEnd} more</Text>}
     </Box>
   );
 }
diff --git a/src/cli/tui/components/TextInput.tsx b/src/cli/tui/components/TextInput.tsx
index b72f0b662..02ffe2bf0 100644
--- a/src/cli/tui/components/TextInput.tsx
+++ b/src/cli/tui/components/TextInput.tsx
@@ -13,6 +13,8 @@ interface TextInputProps {
   onCancel: () => void;
   placeholder?: string;
   initialValue?: string;
+  /** Dimmed description displayed below the prompt */
+  description?: string;
   /** Zod string schema for validation - error message is extracted from schema */
   schema?: ZodString;
   /** Custom validation beyond schema - both validate function and error message are required together */
@@ -60,6 +62,7 @@ export function TextInput({
   onCancel,
   placeholder,
   initialValue = '',
+  description,
   schema,
   customValidation,
   allowEmpty = false,
@@ -114,6 +117,7 @@ export function TextInput({
     return (
       <Box flexDirection="column">
         {prompt && <Text>{prompt}</Text>}
+        {description && <Text dimColor>{description}</Text>}
         <Text wrap="wrap">
           {!hideArrow && <Text color="cyan">&gt; </Text>}
           <Text>{beforeCursorFull}</Text>
@@ -177,6 +181,7 @@ export function TextInput({
   return (
     <Box flexDirection="column">
       {prompt && <Text>{prompt}</Text>}
+      {description && <Text dimColor>{description}</Text>}
       <Text wrap="truncate-end">
         {!hideArrow && <Text color="cyan">&gt; </Text>}
         {showEllipsisBefore && <Text dimColor>…</Text>}
diff --git a/src/cli/tui/components/WizardSelect.tsx b/src/cli/tui/components/WizardSelect.tsx
index bd4343813..184720398 100644
--- a/src/cli/tui/components/WizardSelect.tsx
+++ b/src/cli/tui/components/WizardSelect.tsx
@@ -16,6 +16,8 @@ interface WizardSelectBaseProps {
 interface WizardSelectProps extends WizardSelectBaseProps {
   /** Current selected index */
   selectedIndex: number;
+  /** Maximum visible items before scrolling. Undefined = show all. */
+  maxVisibleItems?: number;
 }
 
 interface WizardMultiSelectProps extends WizardSelectBaseProps {
@@ -23,6 +25,8 @@ interface WizardMultiSelectProps extends WizardSelectBaseProps {
   cursorIndex: number;
   /** Currently selected item IDs */
   selectedIds: Set<string>;
+  /** Maximum visible items before scrolling. Undefined = show all. */
+  maxVisibleItems?: number;
 }
 
 /**
@@ -39,13 +43,25 @@ interface WizardMultiSelectProps extends WizardSelectBaseProps {
  * />
  * ```
  */
-export function WizardSelect({ title, description, items, selectedIndex, emptyMessage }: WizardSelectProps) {
+export function WizardSelect({
+  title,
+  description,
+  items,
+  selectedIndex,
+  emptyMessage,
+  maxVisibleItems,
+}: WizardSelectProps) {
   return (
     <Box flexDirection="column">
       <Text bold>{title}</Text>
       {description && <Text dimColor>{description}</Text>}
       <Box marginTop={1}>
-        <SelectList items={items} selectedIndex={selectedIndex} emptyMessage={emptyMessage} />
+        <SelectList
+          items={items}
+          selectedIndex={selectedIndex}
+          emptyMessage={emptyMessage}
+          maxVisibleItems={maxVisibleItems}
+        />
       </Box>
     </Box>
   );
@@ -73,6 +89,7 @@ export function WizardMultiSelect({
   cursorIndex,
   selectedIds,
   emptyMessage,
+  maxVisibleItems,
 }: WizardMultiSelectProps) {
   return (
     <Box flexDirection="column">
@@ -84,6 +101,7 @@ export function WizardMultiSelect({
           selectedIndex={cursorIndex}
           selectedIds={selectedIds}
           emptyMessage={emptyMessage}
+          maxVisibleItems={maxVisibleItems}
         />
       </Box>
     </Box>
diff --git a/src/cli/tui/components/__tests__/DeployStatus.test.tsx b/src/cli/tui/components/__tests__/DeployStatus.test.tsx
index f13ad796a..fedca8e1a 100644
--- a/src/cli/tui/components/__tests__/DeployStatus.test.tsx
+++ b/src/cli/tui/components/__tests__/DeployStatus.test.tsx
@@ -155,6 +155,55 @@ describe('DeployStatus', () => {
     });
   });
 
+  describe('warning state (post-deploy errors)', () => {
+    it('shows warning banner when hasPostDeployError is true', () => {
+      const { lastFrame } = render(
+        <DeployStatus messages={[]} isComplete={true} hasError={false} hasPostDeployError={true} />
+      );
+      const frame = lastFrame()!;
+
+      expect(frame).toContain('⚠');
+      expect(frame).toContain('Deploy to AWS Complete (with warnings)');
+    });
+
+    it('shows post-deploy warnings in the banner', () => {
+      const warnings = ['Config bundle "my-bundle": timeout', 'AB test "test-1": not found'];
+      const { lastFrame } = render(
+        <DeployStatus
+          messages={[]}
+          isComplete={true}
+          hasError={false}
+          hasPostDeployError={true}
+          postDeployWarnings={warnings}
+        />
+      );
+      const frame = lastFrame()!;
+
+      expect(frame).toContain('Config bundle "my-bundle": timeout');
+      expect(frame).toContain('AB test "test-1": not found');
+    });
+
+    it('warning state takes precedence over complete state', () => {
+      const { lastFrame } = render(
+        <DeployStatus messages={[]} isComplete={true} hasError={false} hasPostDeployError={true} />
+      );
+      const frame = lastFrame()!;
+
+      expect(frame).not.toContain('✓ Deploy to AWS Complete');
+      expect(frame).toContain('⚠ Deploy to AWS Complete (with warnings)');
+    });
+
+    it('error state takes precedence over warning state', () => {
+      const { lastFrame } = render(
+        <DeployStatus messages={[]} isComplete={true} hasError={true} hasPostDeployError={true} />
+      );
+      const frame = lastFrame()!;
+
+      expect(frame).toContain('✗ Deploy to AWS Failed');
+      expect(frame).not.toContain('with warnings');
+    });
+  });
+
   describe('error state details', () => {
     it('shows last 3 resource events on failure', () => {
       const messages = [
diff --git a/src/cli/tui/constants.ts b/src/cli/tui/constants.ts
index 74762fb91..98ff3841c 100644
--- a/src/cli/tui/constants.ts
+++ b/src/cli/tui/constants.ts
@@ -36,6 +36,8 @@ export const HELP_TEXT = {
   STATUS_REFRESH: '↑↓ select · Enter refresh · Esc back · Ctrl+C quit',
   /** Status screen refresh with target cycling */
   STATUS_TARGET_CYCLE: '↑↓ select · Enter refresh · T target · Esc back · Ctrl+C quit',
+  /** Variant config form */
+  VARIANTS_FORM: 'Enter to select · Esc back',
 } as const;
 
 /**
diff --git a/src/cli/tui/context/LayoutContext.tsx b/src/cli/tui/context/LayoutContext.tsx
index e55a7366d..bba1fd8c4 100644
--- a/src/cli/tui/context/LayoutContext.tsx
+++ b/src/cli/tui/context/LayoutContext.tsx
@@ -2,7 +2,7 @@ import { useStdout } from 'ink';
 import React, { type ReactNode, createContext, useContext } from 'react';
 
 /** Maximum content width cap */
-const MAX_CONTENT_WIDTH = 60;
+const MAX_CONTENT_WIDTH = 80;
 
 interface LayoutContextValue {
   /** Global content width: min(terminalWidth, MAX_CONTENT_WIDTH) */
diff --git a/src/cli/tui/copy.ts b/src/cli/tui/copy.ts
index 2aef3c42c..5ed1bff33 100644
--- a/src/cli/tui/copy.ts
+++ b/src/cli/tui/copy.ts
@@ -41,15 +41,19 @@ export const COMMAND_DESCRIPTIONS = {
   remove: 'Remove resources from project config.',
   status: 'Show deployed resource details and status.',
   traces: 'View and download agent traces.',
-  evals: 'View past eval run results.',
+  evals: 'View saved eval and batch eval results from past runs.',
   fetch: 'Fetch access info for deployed resources.',
-  pause: 'Pause an online eval config. Supports --arn for configs outside the project.',
-  resume: 'Resume a paused online eval config. Supports --arn for configs outside the project.',
-  run: 'Run on-demand evaluation.',
+  pause: 'Pause a deployed resource (online eval config, A/B test).',
+  resume: 'Resume a paused resource (online eval config, A/B test).',
+  recommend: '[preview] Run optimization recommendations for system prompts and tool descriptions.',
+  recommendations: '[preview] View recommendation history from past runs.',
+  run: 'Run evaluations, batch evaluations, or optimization recommendations.',
+  stop: 'Stop a running batch evaluation or A/B test.',
   import: 'Import a runtime, memory, or starter toolkit into this project. [experimental]',
   telemetry: 'Manage anonymous usage analytics preferences.',
   update: 'Check for and install CLI updates',
   validate: 'Validate agentcore/ config files.',
+  'config-bundle': '[preview] Manage configuration bundle versions and diffs.',
 } as const;
 
 /**
@@ -62,7 +66,7 @@ export const CLI_ONLY_EXAMPLES: Record<string, { description: string; examples:
     examples: [
       'agentcore logs',
       'agentcore logs --since 30m --level error',
-      'agentcore logs --agent MyAgent --query "timeout"',
+      'agentcore logs --runtime MyAgent --query "timeout"',
       'agentcore logs evals --since 1h',
     ],
   },
@@ -82,4 +86,38 @@ export const CLI_ONLY_EXAMPLES: Record<string, { description: string; examples:
     description: 'Resume a paused online eval config. This command runs in the terminal.',
     examples: ['agentcore resume online-eval <name>', 'agentcore resume online-eval --arn <arn>'],
   },
+  'run eval': {
+    description: 'Run on-demand evaluation of runtime traces against one or more evaluators.',
+    examples: [
+      'agentcore run eval -r MyAgent -e Builtin.Correctness',
+      'agentcore run eval -r MyAgent -e Builtin.Faithfulness --lookback 14',
+      'agentcore run eval -r MyAgent -e Builtin.Correctness -A "Must mention pricing" --expected-response "The price is $10"',
+      'agentcore run eval --runtime-arn <arn> --evaluator-arn <arn> --region us-east-1',
+    ],
+  },
+  'run batch-evaluation': {
+    description: 'Run evaluators in batch across all agent sessions found in CloudWatch.',
+    examples: [
+      'agentcore run batch-evaluation -r MyAgent -e Builtin.Correctness',
+      'agentcore run batch-evaluation -r MyAgent -e Builtin.Correctness Builtin.Faithfulness --json',
+      'agentcore run batch-evaluation -r MyAgent -e Builtin.Completeness -n "weekly-check"',
+    ],
+  },
+  'run recommendation': {
+    description: 'Optimize system prompts or tool descriptions using agent traces.',
+    examples: [
+      'agentcore run recommendation -t system-prompt -r MyAgent -e Builtin.Correctness --inline "You are a helpful assistant"',
+      'agentcore run recommendation -t system-prompt -r MyAgent -e Builtin.Correctness --prompt-file ./prompt.txt',
+      'agentcore run recommendation -t tool-description -r MyAgent --tools "search:Searches the web,calc:Does math"',
+      'agentcore run recommendation -t system-prompt -r MyAgent -e Builtin.Correctness --bundle-name MyBundle',
+    ],
+  },
+  stop: {
+    description: 'Stop a running batch evaluation or A/B test.',
+    examples: [
+      'agentcore stop batch-evaluation -i <batch-eval-id>',
+      'agentcore stop batch-evaluation -i <batch-eval-id> --json',
+      'agentcore stop ab-test <name>',
+    ],
+  },
 };
diff --git a/src/cli/tui/hooks/__tests__/useDevDeploy.test.tsx b/src/cli/tui/hooks/__tests__/useDevDeploy.test.tsx
new file mode 100644
index 000000000..ff8434a8e
--- /dev/null
+++ b/src/cli/tui/hooks/__tests__/useDevDeploy.test.tsx
@@ -0,0 +1,94 @@
+import { useDevDeploy } from '../useDevDeploy.js';
+import { Text } from 'ink';
+import { render } from 'ink-testing-library';
+import React from 'react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+const mockHandleDeploy = vi.fn();
+
+vi.mock('../../../commands/deploy/actions.js', () => ({
+  handleDeploy: (...args: unknown[]) => mockHandleDeploy(...args),
+}));
+
+function Harness({ skip }: { skip?: boolean }) {
+  const { steps, isComplete, error } = useDevDeploy({ skip });
+  return (
+    <Text>
+      steps:{steps.length} isComplete:{String(isComplete)} error:{error ?? 'null'}
+    </Text>
+  );
+}
+
+describe('useDevDeploy', () => {
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('calls handleDeploy on mount', async () => {
+    mockHandleDeploy.mockResolvedValue({ success: true });
+
+    const { lastFrame } = render(<Harness />);
+
+    await vi.waitFor(() => {
+      expect(mockHandleDeploy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          target: 'default',
+          autoConfirm: true,
+        })
+      );
+    });
+
+    await vi.waitFor(() => {
+      expect(lastFrame()).toContain('isComplete:true');
+    });
+  });
+
+  it('does not call handleDeploy when skip is true', async () => {
+    const { lastFrame } = render(<Harness skip={true} />);
+
+    await vi.waitFor(() => {
+      expect(lastFrame()).toContain('isComplete:true');
+    });
+
+    expect(mockHandleDeploy).not.toHaveBeenCalled();
+  });
+
+  it('captures error from failed deploy', async () => {
+    mockHandleDeploy.mockResolvedValue({ success: false, error: 'Stack failed' });
+
+    const { lastFrame } = render(<Harness />);
+
+    await vi.waitFor(() => {
+      expect(lastFrame()).toContain('isComplete:true');
+      expect(lastFrame()).toContain('error:Stack failed');
+    });
+  });
+
+  it('captures error from thrown exception', async () => {
+    mockHandleDeploy.mockRejectedValue(new Error('Network error'));
+
+    const { lastFrame } = render(<Harness />);
+
+    await vi.waitFor(() => {
+      expect(lastFrame()).toContain('isComplete:true');
+      expect(lastFrame()).toContain('error:Network error');
+    });
+  });
+
+  it('populates steps from onProgress callback', async () => {
+    mockHandleDeploy.mockImplementation((opts: { onProgress?: (step: string, status: string) => void }) => {
+      opts.onProgress?.('Validate project', 'start');
+      opts.onProgress?.('Validate project', 'success');
+      opts.onProgress?.('Build CDK', 'start');
+      opts.onProgress?.('Build CDK', 'success');
+      return Promise.resolve({ success: true });
+    });
+
+    const { lastFrame } = render(<Harness />);
+
+    await vi.waitFor(() => {
+      expect(lastFrame()).toContain('steps:2');
+      expect(lastFrame()).toContain('isComplete:true');
+    });
+  });
+});
diff --git a/src/cli/tui/hooks/__tests__/usePanelNavigation.test.tsx b/src/cli/tui/hooks/__tests__/usePanelNavigation.test.tsx
new file mode 100644
index 000000000..89182b2e5
--- /dev/null
+++ b/src/cli/tui/hooks/__tests__/usePanelNavigation.test.tsx
@@ -0,0 +1,347 @@
+import { usePanelNavigation } from '../usePanelNavigation.js';
+import { Text } from 'ink';
+import { render } from 'ink-testing-library';
+import React from 'react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+const UP_ARROW = '\x1B[A';
+const DOWN_ARROW = '\x1B[B';
+const ENTER = '\r';
+const ESCAPE = '\x1B';
+const TAB = '\t';
+
+afterEach(() => vi.restoreAllMocks());
+
+// Wrapper component to test the hook via rendering
+function PanelNav({
+  isActive = true,
+  fieldCount = 3,
+  onExit = vi.fn(),
+  isFieldDisabled,
+  isFieldAutoCompleted,
+  onComplete,
+  onResult,
+}: {
+  isActive?: boolean;
+  fieldCount?: number;
+  onExit?: () => void;
+  isFieldDisabled?: (column: number, field: number) => boolean;
+  isFieldAutoCompleted?: (column: number, field: number) => boolean;
+  onComplete?: () => void;
+  onResult?: (result: ReturnType<typeof usePanelNavigation>) => void;
+}) {
+  const result = usePanelNavigation({
+    isActive,
+    fieldCount,
+    onExit,
+    isFieldDisabled,
+    isFieldAutoCompleted,
+    onComplete,
+  });
+
+  onResult?.(result);
+
+  return (
+    <Text>
+      col:{result.position.column} field:{result.position.field} layer:{result.position.layer}
+    </Text>
+  );
+}
+
+const delay = (ms = 50) => new Promise(resolve => setTimeout(resolve, ms));
+
+describe('usePanelNavigation', () => {
+  it('starts at column 0, field 0, layer focus', () => {
+    const { lastFrame } = render(<PanelNav />);
+    expect(lastFrame()).toContain('col:0');
+    expect(lastFrame()).toContain('field:0');
+    expect(lastFrame()).toContain('layer:focus');
+  });
+
+  describe('Tab switches columns', () => {
+    it('Tab switches from column 0 to column 1', async () => {
+      const { lastFrame, stdin } = render(<PanelNav />);
+
+      await delay();
+      stdin.write(TAB);
+      await delay();
+
+      expect(lastFrame()).toContain('col:1');
+    });
+
+    it('Tab switches from column 1 back to column 0', async () => {
+      const { lastFrame, stdin } = render(<PanelNav />);
+
+      await delay();
+      stdin.write(TAB); // 0 → 1
+      await delay();
+      stdin.write(TAB); // 1 → 0
+      await delay();
+
+      expect(lastFrame()).toContain('col:0');
+    });
+  });
+
+  describe('Up/Down moves between fields', () => {
+    it('Down moves to next field', async () => {
+      const { lastFrame, stdin } = render(<PanelNav />);
+
+      await delay();
+      stdin.write(DOWN_ARROW);
+      await delay();
+
+      expect(lastFrame()).toContain('field:1');
+    });
+
+    it('Up moves to previous field', async () => {
+      const { lastFrame, stdin } = render(<PanelNav />);
+
+      await delay();
+      stdin.write(DOWN_ARROW);
+      stdin.write(DOWN_ARROW);
+      await delay();
+      expect(lastFrame()).toContain('field:2');
+
+      stdin.write(UP_ARROW);
+      await delay();
+      expect(lastFrame()).toContain('field:1');
+    });
+  });
+
+  it('Up at field 0 stays at field 0', async () => {
+    const { lastFrame, stdin } = render(<PanelNav />);
+
+    await delay();
+    stdin.write(UP_ARROW);
+    await delay();
+
+    expect(lastFrame()).toContain('field:0');
+  });
+
+  it('Down at last field stays at last field', async () => {
+    const { lastFrame, stdin } = render(<PanelNav fieldCount={3} />);
+
+    await delay();
+    stdin.write(DOWN_ARROW);
+    stdin.write(DOWN_ARROW); // field 2 (last)
+    await delay();
+    expect(lastFrame()).toContain('field:2');
+
+    stdin.write(DOWN_ARROW); // should stay
+    await delay();
+    expect(lastFrame()).toContain('field:2');
+  });
+
+  it('Enter activates field (layer → active)', async () => {
+    const { lastFrame, stdin } = render(<PanelNav />);
+
+    await delay();
+    stdin.write(ENTER);
+    await delay();
+
+    expect(lastFrame()).toContain('layer:active');
+  });
+
+  describe('Escape navigation', () => {
+    it('Escape at field 0 column 0 calls onExit', async () => {
+      const onExit = vi.fn();
+      const { stdin } = render(<PanelNav onExit={onExit} />);
+
+      await delay();
+      stdin.write(ESCAPE);
+      await delay();
+
+      expect(onExit).toHaveBeenCalledTimes(1);
+    });
+
+    it('Escape at field > 0 goes to field 0', async () => {
+      const { lastFrame, stdin } = render(<PanelNav />);
+
+      await delay();
+      stdin.write(DOWN_ARROW);
+      stdin.write(DOWN_ARROW);
+      await delay();
+      expect(lastFrame()).toContain('field:2');
+
+      stdin.write(ESCAPE);
+      await delay();
+      expect(lastFrame()).toContain('field:0');
+    });
+
+    it('Escape at column 1 field 0 goes to column 0', async () => {
+      const { lastFrame, stdin } = render(<PanelNav />);
+
+      await delay();
+      stdin.write(TAB); // go to column 1
+      await delay();
+      expect(lastFrame()).toContain('col:1');
+
+      stdin.write(ESCAPE);
+      await delay();
+      expect(lastFrame()).toContain('col:0');
+      expect(lastFrame()).toContain('field:0');
+    });
+  });
+
+  describe('deactivate auto-advance', () => {
+    it('deactivate auto-advances to next field in same column', async () => {
+      const onResult = vi.fn();
+      const { stdin } = render(<PanelNav onResult={onResult} />);
+
+      await delay();
+      stdin.write(ENTER); // activate field 0
+      await delay();
+
+      const result = onResult.mock.calls[onResult.mock.calls.length - 1]![0];
+      expect(result.position.layer).toBe('active');
+    });
+  });
+
+  describe('deactivate behavior', () => {
+    // Harness that auto-deactivates when activated to test the deactivate advance path
+    function AutoDeactivateHarness({ fieldCount = 3, onComplete }: { fieldCount?: number; onComplete?: () => void }) {
+      const nav = usePanelNavigation({
+        isActive: true,
+        fieldCount,
+        onExit: vi.fn(),
+        onComplete,
+      });
+
+      // When activated, immediately deactivate on next render
+      React.useEffect(() => {
+        if (nav.position.layer === 'active') {
+          nav.deactivate();
+        }
+      }, [nav.position.layer, nav.position.column, nav.position.field, nav.deactivate]);
+
+      return (
+        <Text>
+          col:{nav.position.column} field:{nav.position.field} layer:{nav.position.layer}
+        </Text>
+      );
+    }
+
+    it('deactivate at field 0 advances to field 1 in same column', async () => {
+      const { lastFrame, stdin } = render(<AutoDeactivateHarness />);
+
+      await delay();
+      stdin.write(ENTER); // activate field 0 → auto-deactivate → field 1
+      await delay();
+
+      expect(lastFrame()).toContain('field:1');
+      expect(lastFrame()).toContain('col:0');
+      expect(lastFrame()).toContain('layer:focus');
+    });
+
+    it('deactivate at last field of column 0 moves to column 1 field 0', async () => {
+      const { lastFrame, stdin } = render(<AutoDeactivateHarness fieldCount={1} />);
+
+      await delay();
+      stdin.write(ENTER); // activate field 0 (last in col 0) → auto-deactivate → col 1 field 0
+      await delay();
+
+      expect(lastFrame()).toContain('col:1');
+      expect(lastFrame()).toContain('field:0');
+    });
+
+    it('deactivate at last field of column 1 calls onComplete', async () => {
+      const onComplete = vi.fn();
+      const { lastFrame, stdin } = render(<AutoDeactivateHarness fieldCount={1} onComplete={onComplete} />);
+
+      await delay();
+      // Move to column 1 first
+      stdin.write(ENTER); // col 0 field 0 → deactivate → col 1 field 0
+      await delay();
+
+      expect(lastFrame()).toContain('col:1');
+      expect(lastFrame()).toContain('field:0');
+
+      stdin.write(ENTER); // col 1 field 0 (last) → deactivate → onComplete
+      await delay(100);
+
+      expect(onComplete).toHaveBeenCalled();
+    });
+  });
+
+  describe('isFieldFocused/isFieldActive/isColumnActive', () => {
+    it('isFieldFocused returns true for current position in focus layer', () => {
+      let resultRef: ReturnType<typeof usePanelNavigation> | undefined;
+      render(
+        <PanelNav
+          onResult={r => {
+            resultRef = r;
+          }}
+        />
+      );
+
+      expect(resultRef!.isFieldFocused(0, 0)).toBe(true);
+      expect(resultRef!.isFieldFocused(0, 1)).toBe(false);
+      expect(resultRef!.isFieldFocused(1, 0)).toBe(false);
+    });
+
+    it('isFieldActive returns false in focus layer', () => {
+      let resultRef: ReturnType<typeof usePanelNavigation> | undefined;
+      render(
+        <PanelNav
+          onResult={r => {
+            resultRef = r;
+          }}
+        />
+      );
+
+      expect(resultRef!.isFieldActive(0, 0)).toBe(false);
+    });
+
+    it('isColumnActive returns true for current column', () => {
+      let resultRef: ReturnType<typeof usePanelNavigation> | undefined;
+      render(
+        <PanelNav
+          onResult={r => {
+            resultRef = r;
+          }}
+        />
+      );
+
+      expect(resultRef!.isColumnActive(0)).toBe(true);
+      expect(resultRef!.isColumnActive(1)).toBe(false);
+    });
+  });
+
+  describe('disabled fields are skipped', () => {
+    it('Down skips disabled field', async () => {
+      const isFieldDisabled = (_col: number, field: number) => field === 1;
+      const { lastFrame, stdin } = render(<PanelNav isFieldDisabled={isFieldDisabled} />);
+
+      await delay();
+      stdin.write(DOWN_ARROW); // should skip field 1 and land on field 2
+      await delay();
+
+      expect(lastFrame()).toContain('field:2');
+    });
+
+    it('Up skips disabled field', async () => {
+      const isFieldDisabled = (_col: number, field: number) => field === 1;
+      const { lastFrame, stdin } = render(<PanelNav isFieldDisabled={isFieldDisabled} />);
+
+      await delay();
+      stdin.write(DOWN_ARROW); // skip 1 → field 2
+      await delay();
+      expect(lastFrame()).toContain('field:2');
+
+      stdin.write(UP_ARROW); // skip 1 → field 0
+      await delay();
+      expect(lastFrame()).toContain('field:0');
+    });
+
+    it('stays in place when all remaining fields are disabled', async () => {
+      const { lastFrame, stdin } = render(<PanelNav fieldCount={2} isFieldDisabled={(_c, f) => f === 1} />);
+
+      await delay();
+      // field 0, only field 1 exists and is disabled → stay at 0
+      stdin.write(DOWN_ARROW);
+      await delay();
+
+      expect(lastFrame()).toContain('field:0');
+    });
+  });
+});
diff --git a/src/cli/tui/hooks/index.ts b/src/cli/tui/hooks/index.ts
index a7eba80f1..3584fc34e 100644
--- a/src/cli/tui/hooks/index.ts
+++ b/src/cli/tui/hooks/index.ts
@@ -7,6 +7,8 @@ export { useListNavigation } from './useListNavigation';
 export { useMultiSelectNavigation } from './useMultiSelectNavigation';
 export { useResponsive } from './useResponsive';
 export { useAvailableAgents, useCreateGateway, useExistingGateways } from './useCreateMcp';
+export { useDevDeploy } from './useDevDeploy';
+export type { UseDevDeployOptions, UseDevDeployResult } from './useDevDeploy';
 export { useDevServer } from './useDevServer';
 export { useProject } from './useProject';
 export type { UseProjectResult, ProjectContext } from './useProject';
diff --git a/src/cli/tui/hooks/useCreateABTest.ts b/src/cli/tui/hooks/useCreateABTest.ts
new file mode 100644
index 000000000..e54666074
--- /dev/null
+++ b/src/cli/tui/hooks/useCreateABTest.ts
@@ -0,0 +1,93 @@
+import type { AddTargetBasedABTestOptions } from '../../primitives/ABTestPrimitive';
+import { abTestPrimitive } from '../../primitives/registry';
+import type { GatewayChoice } from '../screens/ab-test/types';
+import { useCallback, useEffect, useState } from 'react';
+
+interface CreateABTestConfig {
+  name: string;
+  description?: string;
+  agent: string;
+  gatewayChoice?: GatewayChoice;
+  controlBundle: string;
+  controlVersion: string;
+  treatmentBundle: string;
+  treatmentVersion: string;
+  controlWeight: number;
+  treatmentWeight: number;
+  onlineEval: string;
+  maxDuration?: number;
+  enableOnCreate?: boolean;
+}
+
+export function useCreateABTest() {
+  const [status, setStatus] = useState<{ state: 'idle' | 'loading' | 'success' | 'error'; error?: string }>({
+    state: 'idle',
+  });
+
+  const create = useCallback(async (config: CreateABTestConfig) => {
+    setStatus({ state: 'loading' });
+    try {
+      const addResult = await abTestPrimitive.add({
+        name: config.name,
+        description: config.description,
+        agent: config.agent,
+        gatewayChoice: config.gatewayChoice,
+        controlBundle: config.controlBundle,
+        controlVersion: config.controlVersion,
+        treatmentBundle: config.treatmentBundle,
+        treatmentVersion: config.treatmentVersion,
+        controlWeight: config.controlWeight,
+        treatmentWeight: config.treatmentWeight,
+        onlineEval: config.onlineEval,
+        maxDurationDays: config.maxDuration,
+        enableOnCreate: config.enableOnCreate,
+      });
+      if (!addResult.success) {
+        throw new Error(addResult.error ?? 'Failed to create AB test');
+      }
+      setStatus({ state: 'success' });
+      return { ok: true as const, testName: config.name };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Failed to create AB test.';
+      setStatus({ state: 'error', error: message });
+      return { ok: false as const, error: message };
+    }
+  }, []);
+
+  const createTargetBased = useCallback(async (config: Omit<AddTargetBasedABTestOptions, 'roleArn'>) => {
+    setStatus({ state: 'loading' });
+    try {
+      const addResult = await abTestPrimitive.addTargetBased(config);
+      if (!addResult.success) {
+        throw new Error(addResult.error ?? 'Failed to create target-based AB test');
+      }
+      setStatus({ state: 'success' });
+      return { ok: true as const, testName: config.name };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Failed to create target-based AB test.';
+      setStatus({ state: 'error', error: message });
+      return { ok: false as const, error: message };
+    }
+  }, []);
+
+  const reset = useCallback(() => {
+    setStatus({ state: 'idle' });
+  }, []);
+
+  return { status, createABTest: create, createTargetBasedABTest: createTargetBased, reset };
+}
+
+export function useExistingABTestNames() {
+  const [names, setNames] = useState<string[]>([]);
+
+  useEffect(() => {
+    void abTestPrimitive.getAllNames().then(setNames);
+  }, []);
+
+  const refresh = useCallback(async () => {
+    const result = await abTestPrimitive.getAllNames();
+    setNames(result);
+  }, []);
+
+  return { names, refresh };
+}
diff --git a/src/cli/tui/hooks/useCreateConfigBundle.ts b/src/cli/tui/hooks/useCreateConfigBundle.ts
new file mode 100644
index 000000000..864501eed
--- /dev/null
+++ b/src/cli/tui/hooks/useCreateConfigBundle.ts
@@ -0,0 +1,59 @@
+import { configBundlePrimitive } from '../../primitives/registry';
+import { useCallback, useEffect, useState } from 'react';
+
+interface CreateConfigBundleConfig {
+  name: string;
+  description?: string;
+  components: Record<string, { configuration: Record<string, unknown> }>;
+  branchName?: string;
+  commitMessage?: string;
+}
+
+export function useCreateConfigBundle() {
+  const [status, setStatus] = useState<{ state: 'idle' | 'loading' | 'success' | 'error'; error?: string }>({
+    state: 'idle',
+  });
+
+  const create = useCallback(async (config: CreateConfigBundleConfig) => {
+    setStatus({ state: 'loading' });
+    try {
+      const addResult = await configBundlePrimitive.add({
+        name: config.name,
+        description: config.description,
+        components: config.components,
+        branchName: config.branchName,
+        commitMessage: config.commitMessage,
+      });
+      if (!addResult.success) {
+        throw new Error(addResult.error ?? 'Failed to create configuration bundle');
+      }
+      setStatus({ state: 'success' });
+      return { ok: true as const, bundleName: config.name };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Failed to create configuration bundle.';
+      setStatus({ state: 'error', error: message });
+      return { ok: false as const, error: message };
+    }
+  }, []);
+
+  const reset = useCallback(() => {
+    setStatus({ state: 'idle' });
+  }, []);
+
+  return { status, createConfigBundle: create, reset };
+}
+
+export function useExistingConfigBundleNames() {
+  const [names, setNames] = useState<string[]>([]);
+
+  useEffect(() => {
+    void configBundlePrimitive.getAllNames().then(setNames);
+  }, []);
+
+  const refresh = useCallback(async () => {
+    const result = await configBundlePrimitive.getAllNames();
+    setNames(result);
+  }, []);
+
+  return { names, refresh };
+}
diff --git a/src/cli/tui/hooks/useCreateEvaluator.ts b/src/cli/tui/hooks/useCreateEvaluator.ts
index 6e1d8f052..f1cad666f 100644
--- a/src/cli/tui/hooks/useCreateEvaluator.ts
+++ b/src/cli/tui/hooks/useCreateEvaluator.ts
@@ -1,5 +1,7 @@
 import type { EvaluatorConfig } from '../../../schema';
 import { evaluatorPrimitive } from '../../primitives/registry';
+import { withAddTelemetry } from '../../telemetry/cli-command-run.js';
+import { Level, standardize } from '../../telemetry/schemas/common-shapes.js';
 import { useCallback, useEffect, useState } from 'react';
 
 interface CreateEvaluatorConfig {
@@ -16,11 +18,19 @@ export function useCreateEvaluator() {
   const create = useCallback(async (config: CreateEvaluatorConfig) => {
     setStatus({ state: 'loading' });
     try {
-      const addResult = await evaluatorPrimitive.add({
-        name: config.name,
-        level: config.level as 'SESSION' | 'TRACE' | 'TOOL_CALL',
-        config: config.config,
-      });
+      const addResult = await withAddTelemetry(
+        'add.evaluator',
+        {
+          evaluator_type: config.config.codeBased ? 'code-based' : 'llm-as-a-judge',
+          level: standardize(Level, config.level),
+        },
+        () =>
+          evaluatorPrimitive.add({
+            name: config.name,
+            level: config.level as 'SESSION' | 'TRACE' | 'TOOL_CALL',
+            config: config.config,
+          })
+      );
       if (!addResult.success) {
         throw new Error(addResult.error ?? 'Failed to create evaluator');
       }
diff --git a/src/cli/tui/hooks/useCreateMcp.ts b/src/cli/tui/hooks/useCreateMcp.ts
index 2b3b3b25a..ec91666d0 100644
--- a/src/cli/tui/hooks/useCreateMcp.ts
+++ b/src/cli/tui/hooks/useCreateMcp.ts
@@ -4,6 +4,8 @@ import {
   gatewayTargetPrimitive,
   policyEnginePrimitive,
 } from '../../primitives/registry';
+import { withAddTelemetry } from '../../telemetry/cli-command-run.js';
+import { AuthorizerType, PolicyEngineMode, standardize } from '../../telemetry/schemas/common-shapes.js';
 import type { AddGatewayConfig } from '../screens/mcp/types';
 import { useCallback, useEffect, useState } from 'react';
 
@@ -23,22 +25,33 @@ export function useCreateGateway() {
   const createGateway = useCallback(async (config: AddGatewayConfig) => {
     setStatus({ state: 'loading' });
     try {
-      const addResult = await gatewayPrimitive.add({
-        name: config.name,
-        description: config.description,
-        authorizerType: config.authorizerType,
-        discoveryUrl: config.jwtConfig?.discoveryUrl,
-        allowedAudience: config.jwtConfig?.allowedAudience?.join(','),
-        allowedClients: config.jwtConfig?.allowedClients?.join(','),
-        allowedScopes: config.jwtConfig?.allowedScopes?.join(','),
-        customClaims: config.jwtConfig?.customClaims,
-        clientId: config.jwtConfig?.clientId,
-        clientSecret: config.jwtConfig?.clientSecret,
-        enableSemanticSearch: config.enableSemanticSearch,
-        exceptionLevel: config.exceptionLevel,
-        policyEngine: config.policyEngineConfiguration?.policyEngineName,
-        policyEngineMode: config.policyEngineConfiguration?.mode,
-      });
+      const addResult = await withAddTelemetry(
+        'add.gateway',
+        {
+          authorizer_type: standardize(AuthorizerType, config.authorizerType ?? 'NONE'),
+          has_policy_engine: !!config.policyEngineConfiguration?.policyEngineName,
+          policy_engine_mode: standardize(PolicyEngineMode, config.policyEngineConfiguration?.mode ?? 'log_only'),
+          semantic_search: config.enableSemanticSearch !== false,
+          runtime_count: 0,
+        },
+        () =>
+          gatewayPrimitive.add({
+            name: config.name,
+            description: config.description,
+            authorizerType: config.authorizerType,
+            discoveryUrl: config.jwtConfig?.discoveryUrl,
+            allowedAudience: config.jwtConfig?.allowedAudience?.join(','),
+            allowedClients: config.jwtConfig?.allowedClients?.join(','),
+            allowedScopes: config.jwtConfig?.allowedScopes?.join(','),
+            customClaims: config.jwtConfig?.customClaims,
+            clientId: config.jwtConfig?.clientId,
+            clientSecret: config.jwtConfig?.clientSecret,
+            enableSemanticSearch: config.enableSemanticSearch,
+            exceptionLevel: config.exceptionLevel,
+            policyEngine: config.policyEngineConfiguration?.policyEngineName,
+            policyEngineMode: config.policyEngineConfiguration?.mode,
+          })
+      );
       if (!addResult.success) {
         throw new Error(addResult.error ?? 'Failed to create gateway');
       }
diff --git a/src/cli/tui/hooks/useCreateMemory.ts b/src/cli/tui/hooks/useCreateMemory.ts
index 4345b4ead..d4196582f 100644
--- a/src/cli/tui/hooks/useCreateMemory.ts
+++ b/src/cli/tui/hooks/useCreateMemory.ts
@@ -2,6 +2,7 @@ import { ConfigIO } from '../../../lib';
 import type { Memory } from '../../../schema';
 import { getAvailableAgents } from '../../operations/attach';
 import { memoryPrimitive } from '../../primitives/registry';
+import { withAddTelemetry } from '../../telemetry/cli-command-run.js';
 import { useCallback, useEffect, useState } from 'react';
 
 interface CreateMemoryConfig {
@@ -24,13 +25,25 @@ export function useCreateMemory() {
     setStatus({ state: 'loading' });
     try {
       const strategiesStr = config.strategies.map(s => s.type).join(',');
-      const addResult = await memoryPrimitive.add({
-        name: config.name,
-        expiry: config.eventExpiryDuration,
-        strategies: strategiesStr || undefined,
-        dataStreamArn: config.streaming?.dataStreamArn,
-        contentLevel: config.streaming?.contentLevel,
-      });
+      const strategyList = strategiesStr ? strategiesStr.split(',').map(s => s.trim().toUpperCase()) : [];
+      const addResult = await withAddTelemetry(
+        'add.memory',
+        {
+          strategy_count: strategyList.length,
+          strategy_semantic: strategyList.includes('SEMANTIC'),
+          strategy_summarization: strategyList.includes('SUMMARIZATION'),
+          strategy_user_preference: strategyList.includes('USER_PREFERENCE'),
+          strategy_episodic: strategyList.includes('EPISODIC'),
+        },
+        () =>
+          memoryPrimitive.add({
+            name: config.name,
+            expiry: config.eventExpiryDuration,
+            strategies: strategiesStr || undefined,
+            dataStreamArn: config.streaming?.dataStreamArn,
+            contentLevel: config.streaming?.contentLevel,
+          })
+      );
       if (!addResult.success) {
         throw new Error(addResult.error ?? 'Failed to create memory');
       }
diff --git a/src/cli/tui/hooks/useCreateOnlineEval.ts b/src/cli/tui/hooks/useCreateOnlineEval.ts
index 2d0190552..b853fed05 100644
--- a/src/cli/tui/hooks/useCreateOnlineEval.ts
+++ b/src/cli/tui/hooks/useCreateOnlineEval.ts
@@ -1,11 +1,14 @@
 import { onlineEvalConfigPrimitive } from '../../primitives/registry';
+import { withAddTelemetry } from '../../telemetry/cli-command-run.js';
 import { useCallback, useEffect, useState } from 'react';
 
 interface CreateOnlineEvalConfig {
   name: string;
   agent: string;
+  endpoint?: string;
   evaluators: string[];
   samplingRate: number;
+  sessionTimeoutMinutes?: number;
   enableOnCreate: boolean;
 }
 
@@ -17,13 +20,23 @@ export function useCreateOnlineEval() {
   const create = useCallback(async (config: CreateOnlineEvalConfig) => {
     setStatus({ state: 'loading' });
     try {
-      const addResult = await onlineEvalConfigPrimitive.add({
-        name: config.name,
-        agent: config.agent,
-        evaluators: config.evaluators,
-        samplingRate: config.samplingRate,
-        enableOnCreate: config.enableOnCreate,
-      });
+      const addResult = await withAddTelemetry(
+        'add.online-eval',
+        {
+          evaluator_count: config.evaluators.length,
+          enable_on_create: config.enableOnCreate ?? false,
+        },
+        () =>
+          onlineEvalConfigPrimitive.add({
+            name: config.name,
+            agent: config.agent,
+            ...(config.endpoint ? { endpoint: config.endpoint } : {}),
+            evaluators: config.evaluators,
+            samplingRate: config.samplingRate,
+            ...(config.sessionTimeoutMinutes !== undefined && { sessionTimeoutMinutes: config.sessionTimeoutMinutes }),
+            enableOnCreate: config.enableOnCreate,
+          })
+      );
       if (!addResult.success) {
         throw new Error(addResult.error ?? 'Failed to create online eval config');
       }
diff --git a/src/cli/tui/hooks/useDevDeploy.ts b/src/cli/tui/hooks/useDevDeploy.ts
new file mode 100644
index 000000000..d4dfaca09
--- /dev/null
+++ b/src/cli/tui/hooks/useDevDeploy.ts
@@ -0,0 +1,110 @@
+import { ConfigIO } from '../../../lib';
+import { detectAwsContext } from '../../aws/aws-context';
+import type { DeployMessage } from '../../cdk/toolkit-lib';
+import { handleDeploy } from '../../commands/deploy/actions';
+import { getErrorMessage } from '../../errors';
+import { canSkipDeploy } from '../../operations/deploy/change-detection';
+import type { Step, StepStatus } from '../components/StepProgress';
+import { useCallback, useEffect, useRef, useState } from 'react';
+
+export interface UseDevDeployOptions {
+  skip?: boolean;
+  ready?: boolean;
+}
+
+export interface UseDevDeployResult {
+  steps: Step[];
+  deployMessages: DeployMessage[];
+  isComplete: boolean;
+  error: string | undefined;
+  logPath: string | undefined;
+}
+
+export function useDevDeploy({ skip, ready = true }: UseDevDeployOptions = {}): UseDevDeployResult {
+  const [steps, setSteps] = useState<Step[]>([]);
+  const [deployMessages, setDeployMessages] = useState<DeployMessage[]>([]);
+  const [deployDone, setDeployDone] = useState(false);
+  const [error, setError] = useState<string | undefined>();
+  const [logPath, setLogPath] = useState<string | undefined>();
+  const hasStarted = useRef(false);
+
+  const onProgress = useCallback((stepName: string, status: 'start' | 'success' | 'error') => {
+    setSteps(prev => {
+      if (status === 'start') {
+        return [...prev, { label: stepName, status: 'running' as StepStatus }];
+      }
+      return prev.map(s => (s.label === stepName ? { ...s, status: status as StepStatus } : s));
+    });
+  }, []);
+
+  const onDeployMessage = useCallback((msg: DeployMessage) => {
+    setDeployMessages(prev => [...prev, msg]);
+  }, []);
+
+  useEffect(() => {
+    if (skip || !ready || hasStarted.current) return;
+    hasStarted.current = true;
+
+    const run = async () => {
+      try {
+        const configIO = new ConfigIO();
+
+        // Auto-populate aws-targets.json if empty
+        try {
+          const targets = await configIO.readAWSDeploymentTargets();
+          if (targets.length === 0) {
+            const ctx = await detectAwsContext();
+            if (ctx.accountId) {
+              await configIO.writeAWSDeploymentTargets([
+                { name: 'default', account: ctx.accountId, region: ctx.region },
+              ]);
+            }
+          }
+        } catch {
+          try {
+            const ctx = await detectAwsContext();
+            if (ctx.accountId) {
+              await configIO.writeAWSDeploymentTargets([
+                { name: 'default', account: ctx.accountId, region: ctx.region },
+              ]);
+            }
+          } catch {
+            // Can't detect — let handleDeploy fail with a clear error
+          }
+        }
+
+        const noChanges = await canSkipDeploy(configIO);
+        if (noChanges) {
+          onProgress('No changes detected — skipping deploy', 'success');
+          return;
+        }
+
+        const result = await handleDeploy({
+          target: 'default',
+          autoConfirm: true,
+          onProgress,
+          onDeployMessage,
+        });
+
+        if (result.logPath) {
+          setLogPath(result.logPath);
+        }
+
+        if (!result.success) {
+          setError(result.error);
+        }
+      } catch (err) {
+        setError(getErrorMessage(err));
+      } finally {
+        setDeployDone(true);
+      }
+    };
+
+    void run();
+  }, [skip, ready, onProgress, onDeployMessage]);
+
+  // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing -- skip is boolean, not nullable; || is the correct operator here
+  const isComplete = skip || deployDone;
+
+  return { steps, deployMessages, isComplete, error, logPath };
+}
diff --git a/src/cli/tui/hooks/usePanelNavigation.ts b/src/cli/tui/hooks/usePanelNavigation.ts
new file mode 100644
index 000000000..1e06157ac
--- /dev/null
+++ b/src/cli/tui/hooks/usePanelNavigation.ts
@@ -0,0 +1,196 @@
+import { useInput } from 'ink';
+import { useCallback, useState } from 'react';
+
+export interface PanelPosition {
+  column: 0 | 1;
+  field: number;
+  layer: 'focus' | 'active';
+}
+
+interface UsePanelNavigationOptions {
+  /** Only capture input when the builder step is active */
+  isActive: boolean;
+  /** Number of fields per column */
+  fieldCount: number;
+  /** Called when Escape is pressed at the top-left origin */
+  onExit: () => void;
+  /** Optional check whether a field is disabled (non-focusable) */
+  isFieldDisabled?: (column: number, field: number) => boolean;
+  /** Optional check whether a field is auto-completed (skip on navigation) */
+  isFieldAutoCompleted?: (column: number, field: number) => boolean;
+  /** Called when the last field in the last column is completed */
+  onComplete?: () => void;
+}
+
+interface UsePanelNavigationResult {
+  position: PanelPosition;
+  /** Whether the given field is the currently focused field */
+  isFieldFocused: (column: number, field: number) => boolean;
+  /** Whether the given field has its picker/input open */
+  isFieldActive: (column: number, field: number) => boolean;
+  /** Whether the given column is the active column */
+  isColumnActive: (column: number) => boolean;
+  /** Open the picker/input for the currently focused field */
+  activate: () => void;
+  /** Close the picker/input, returning to field focus */
+  deactivate: () => void;
+  /** Move focus to a specific field */
+  moveToField: (column: number, field: number) => void;
+}
+
+/**
+ * 2D focus management hook for a side-by-side panel builder.
+ *
+ * Navigation model:
+ * - Tab switches columns (0 <-> 1)
+ * - Up/Down moves between fields within the active column
+ * - Enter activates the focused field (layer -> 'active')
+ * - Escape deactivates or navigates back
+ *
+ * When layer === 'active', the hook yields input to child components
+ * by setting its own `useInput` to inactive.
+ */
+export function usePanelNavigation({
+  isActive,
+  fieldCount,
+  onExit,
+  isFieldDisabled,
+  isFieldAutoCompleted: _isFieldAutoCompleted,
+  onComplete,
+}: UsePanelNavigationOptions): UsePanelNavigationResult {
+  const [position, setPosition] = useState<PanelPosition>({
+    column: 0,
+    field: 0,
+    layer: 'focus',
+  });
+
+  // Only handle input when at focus layer and the panel is active
+  const inputActive = isActive && position.layer === 'focus';
+
+  useInput(
+    (input, key) => {
+      // Tab: switch columns
+      if (key.tab) {
+        setPosition(p => ({
+          ...p,
+          column: p.column === 0 ? 1 : 0,
+        }));
+        return;
+      }
+
+      // Up: move to previous field
+      if (key.upArrow) {
+        setPosition(p => {
+          let next = p.field - 1;
+          // Skip disabled fields going up
+          while (next >= 0 && isFieldDisabled?.(p.column, next)) {
+            next--;
+          }
+          if (next < 0) return p;
+          return { ...p, field: next };
+        });
+        return;
+      }
+
+      // Down: move to next field
+      if (key.downArrow) {
+        setPosition(p => {
+          let next = p.field + 1;
+          // Skip disabled fields going down
+          while (next < fieldCount && isFieldDisabled?.(p.column, next)) {
+            next++;
+          }
+          if (next >= fieldCount) return p;
+          return { ...p, field: next };
+        });
+        return;
+      }
+
+      // Enter: always activate the focused field (open picker)
+      if (key.return) {
+        setPosition(p => ({ ...p, layer: 'active' }));
+        return;
+      }
+
+      // Escape: navigate back through the hierarchy
+      if (key.escape) {
+        setPosition(p => {
+          // If not at field 0, go to field 0 in same column
+          if (p.field > 0) {
+            return { ...p, field: 0 };
+          }
+          // If at field 0 but not column 0, go to column 0
+          if (p.column > 0) {
+            return { ...p, column: 0 };
+          }
+          // At origin: exit
+          onExit();
+          return p;
+        });
+        return;
+      }
+    },
+    { isActive: inputActive }
+  );
+
+  const isFieldFocused = useCallback(
+    (column: number, field: number): boolean => {
+      return position.column === column && position.field === field && position.layer === 'focus';
+    },
+    [position]
+  );
+
+  const isFieldActive = useCallback(
+    (column: number, field: number): boolean => {
+      return position.column === column && position.field === field && position.layer === 'active';
+    },
+    [position]
+  );
+
+  const isColumnActive = useCallback(
+    (column: number): boolean => {
+      return position.column === column;
+    },
+    [position.column]
+  );
+
+  const activate = useCallback(() => {
+    setPosition(p => ({ ...p, layer: 'active' }));
+  }, []);
+
+  const deactivate = useCallback(() => {
+    setPosition(p => {
+      // After a selection, advance to the next field in sequence:
+      // column 0 fields 0→1→2, then column 1 fields 0→1→2, then complete
+      const nextField = p.field + 1;
+      if (nextField < fieldCount) {
+        // Next field in same column
+        return { column: p.column, field: nextField, layer: 'focus' };
+      }
+      if (p.column === 0) {
+        // Finished left column → move to right column field 0
+        return { column: 1, field: 0, layer: 'focus' };
+      }
+      // Finished last field in right column → stay and let onComplete handle it
+      if (onComplete) {
+        // Use setTimeout to avoid setState during render
+        setTimeout(onComplete, 0);
+      }
+      return { ...p, layer: 'focus' };
+    });
+  }, [fieldCount, onComplete]);
+
+  const moveToField = useCallback((column: number, field: number) => {
+    setPosition({ column: column as 0 | 1, field, layer: 'focus' });
+  }, []);
+
+  return {
+    position,
+    isFieldFocused,
+    isFieldActive,
+    isColumnActive,
+    activate,
+    deactivate,
+    moveToField,
+  };
+}
diff --git a/src/cli/tui/hooks/useRemove.ts b/src/cli/tui/hooks/useRemove.ts
index 8331d38e6..db1061dd4 100644
--- a/src/cli/tui/hooks/useRemove.ts
+++ b/src/cli/tui/hooks/useRemove.ts
@@ -6,11 +6,14 @@ import type { RemovableMemory } from '../../primitives/MemoryPrimitive';
 import type { RemovablePolicyResource } from '../../primitives/PolicyPrimitive';
 import type { RemovableRuntimeEndpoint } from '../../primitives/RuntimeEndpointPrimitive';
 import {
+  abTestPrimitive,
   agentPrimitive,
+  configBundlePrimitive,
   credentialPrimitive,
   evaluatorPrimitive,
   gatewayPrimitive,
   gatewayTargetPrimitive,
+  harnessPrimitive,
   memoryPrimitive,
   onlineEvalConfigPrimitive,
   policyEnginePrimitive,
@@ -108,6 +111,13 @@ export function useRemovableAgents() {
   return { agents, ...rest };
 }
 
+export function useRemovableHarnesses() {
+  const { items: harnesses, ...rest } = useRemovableResources(() =>
+    harnessPrimitive.getRemovable().then(r => r.map(h => h.name))
+  );
+  return { harnesses, ...rest };
+}
+
 export function useRemovableGateways() {
   const { items: gateways, ...rest } = useRemovableResources(() =>
     gatewayPrimitive.getRemovable().then(r => r.map(g => g.name))
@@ -150,6 +160,24 @@ export function useRemovablePolicies() {
   return { policies, ...rest };
 }
 
+export function useRemovableConfigBundles() {
+  const { items: configBundles, ...rest } = useRemovableResources(() => configBundlePrimitive.getRemovable());
+  return { configBundles, ...rest };
+}
+
+export function useRemovableABTests() {
+  const { items: abTests, ...rest } = useRemovableResources(() => abTestPrimitive.getRemovable());
+  return { abTests, ...rest };
+}
+
+export function useRemoveABTest() {
+  return useRemoveResource(
+    (name: string) => abTestPrimitive.remove(name),
+    'ab-test',
+    name => name
+  );
+}
+
 export function useRemovableRuntimeEndpoints() {
   const { items: endpoints, ...rest } = useRemovableResources<RemovableRuntimeEndpoint>(() =>
     runtimeEndpointPrimitive.getRemovable()
@@ -196,6 +224,10 @@ export function useRemovalPreview() {
     (name: string) => loadPreview(n => agentPrimitive.previewRemove(n), name),
     [loadPreview]
   );
+  const loadHarnessPreview = useCallback(
+    (name: string) => loadPreview(n => harnessPrimitive.previewRemove(n), name),
+    [loadPreview]
+  );
   const loadGatewayPreview = useCallback(
     (name: string) => loadPreview(n => gatewayPrimitive.previewRemove(n), name),
     [loadPreview]
@@ -228,6 +260,16 @@ export function useRemovalPreview() {
     (compositeKey: string) => loadPreview(k => policyPrimitive.previewRemove(k), compositeKey),
     [loadPreview]
   );
+  const loadConfigBundlePreview = useCallback(
+    (name: string) => loadPreview(n => configBundlePrimitive.previewRemove(n), name),
+    [loadPreview]
+  );
+
+  const loadABTestPreview = useCallback(
+    (name: string) => loadPreview(n => abTestPrimitive.previewRemove(n), name),
+    [loadPreview]
+  );
+
   const loadRuntimeEndpointPreview = useCallback(
     (name: string) => loadPreview(n => runtimeEndpointPrimitive.previewRemove(n), name),
     [loadPreview]
@@ -240,6 +282,7 @@ export function useRemovalPreview() {
   return {
     ...state,
     loadAgentPreview,
+    loadHarnessPreview,
     loadGatewayPreview,
     loadGatewayTargetPreview,
     loadMemoryPreview,
@@ -248,6 +291,8 @@ export function useRemovalPreview() {
     loadOnlineEvalPreview,
     loadPolicyEnginePreview,
     loadPolicyPreview,
+    loadConfigBundlePreview,
+    loadABTestPreview,
     loadRuntimeEndpointPreview,
     reset,
   };
@@ -272,6 +317,14 @@ export function useRemoveAgent() {
   );
 }
 
+export function useRemoveHarness() {
+  return useRemoveResource(
+    (name: string) => harnessPrimitive.remove(name),
+    'harness',
+    name => name
+  );
+}
+
 export function useRemoveGateway() {
   return useRemoveResource(
     (name: string) => gatewayPrimitive.remove(name),
@@ -336,6 +389,14 @@ export function useRemovePolicy() {
   );
 }
 
+export function useRemoveConfigBundle() {
+  return useRemoveResource(
+    (name: string) => configBundlePrimitive.remove(name),
+    'config-bundle',
+    name => name
+  );
+}
+
 export function useRemoveRuntimeEndpoint() {
   return useRemoveResource(
     (name: string) => runtimeEndpointPrimitive.remove(name),
diff --git a/src/cli/tui/screens/ab-test/ABTestDetailScreen.tsx b/src/cli/tui/screens/ab-test/ABTestDetailScreen.tsx
new file mode 100644
index 000000000..36b36ee00
--- /dev/null
+++ b/src/cli/tui/screens/ab-test/ABTestDetailScreen.tsx
@@ -0,0 +1,623 @@
+import { ConfigIO } from '../../../../lib';
+import { getCredentialProvider } from '../../../aws/account';
+import { getABTest, updateABTest } from '../../../aws/agentcore-ab-tests';
+import type { GetABTestResult } from '../../../aws/agentcore-ab-tests';
+import { getOnlineEvaluationConfig } from '../../../aws/agentcore-control';
+import { getHttpGateway, listHttpGatewayTargets } from '../../../aws/agentcore-http-gateways';
+import { dnsSuffix } from '../../../aws/partition';
+import { getErrorMessage } from '../../../errors';
+import { GradientText, Screen } from '../../components';
+import { CloudWatchLogsClient, FilterLogEventsCommand } from '@aws-sdk/client-cloudwatch-logs';
+import { Box, Text, useInput } from 'ink';
+import React, { useCallback, useEffect, useRef, useState } from 'react';
+
+interface ABTestDetailScreenProps {
+  abTestId: string;
+  region: string;
+  onExit: () => void;
+}
+
+/** Derive the gateway URL from a gateway ARN. */
+function gatewayUrlFromArn(arn: string): string {
+  const parts = arn.split(':');
+  const region = parts[3];
+  const gatewayId = parts[5]?.split('/')[1];
+  if (region && gatewayId) {
+    return `https://${gatewayId}.gateway.bedrock-agentcore.${region}.${dnsSuffix(region)}`;
+  }
+  return arn;
+}
+
+/** Extract the resource ID from an ARN (last segment after / or :). */
+function extractId(arn: string): string {
+  const slashIdx = arn.lastIndexOf('/');
+  if (slashIdx !== -1) return arn.slice(slashIdx + 1);
+  const colonIdx = arn.lastIndexOf(':');
+  if (colonIdx !== -1) return arn.slice(colonIdx + 1);
+  return arn;
+}
+
+/** Truncate a version ID to 8 characters. */
+function shortVersion(version: string): string {
+  return version.slice(0, 8);
+}
+
+/** Format a Unix epoch timestamp (seconds) to a UTC date string. */
+function formatTimestamp(ts: string | number): string {
+  const ms = typeof ts === 'string' ? parseFloat(ts) * 1000 : ts * 1000;
+  const d = new Date(ms);
+  return d
+    .toISOString()
+    .replace('T', ' ')
+    .replace(/\.\d+Z$/, ' UTC');
+}
+
+/** Build a horizontal rule with optional left label and right label. */
+function rule(left?: string, right?: string, width = 48): string {
+  if (!left && !right) return '─'.repeat(width);
+  const leftPart = left ? `── ${left} ` : '──';
+  const rightPart = right ? ` ${right} ──` : '';
+  const fillLen = width - leftPart.length - rightPart.length;
+  const fill = fillLen > 0 ? '─'.repeat(fillLen) : '';
+  return `${leftPart}${fill}${rightPart}`;
+}
+
+interface DebugCheckResult {
+  label: string;
+  status: 'pass' | 'fail' | 'warn';
+  detail: string;
+}
+
+async function runDebugChecks(test: GetABTestResult, region: string): Promise<DebugCheckResult[]> {
+  const results: DebugCheckResult[] = [];
+  const logsClient = new CloudWatchLogsClient({ region, credentials: getCredentialProvider() });
+
+  // 1. AB Test Status
+  results.push({
+    label: 'AB Test Status',
+    status: test.status === 'ACTIVE' && test.executionStatus === 'RUNNING' ? 'pass' : 'warn',
+    detail: `${test.status} / ${test.executionStatus}`,
+  });
+
+  // 1b. AB Test Role
+  results.push({
+    label: 'AB Test Role',
+    status: test.roleArn ? 'pass' : 'warn',
+    detail: test.roleArn ?? 'No role ARN',
+  });
+
+  // 2. Online Eval Config(s)
+  const evalConfigArns: { name: string; arn: string }[] =
+    'perVariantOnlineEvaluationConfig' in test.evaluationConfig
+      ? test.evaluationConfig.perVariantOnlineEvaluationConfig.map(v => ({
+          name: v.name,
+          arn: v.onlineEvaluationConfigArn,
+        }))
+      : [{ name: '', arn: test.evaluationConfig.onlineEvaluationConfigArn }];
+
+  for (const { name: variantName, arn: evalArn } of evalConfigArns) {
+    const evalConfigId = extractId(evalArn);
+    const labelSuffix = variantName ? ` (${variantName})` : '';
+    try {
+      const evalConfig = await getOnlineEvaluationConfig({ region, configId: evalConfigId });
+      results.push({
+        label: `Online Eval Config${labelSuffix}`,
+        status: evalConfig.executionStatus === 'ENABLED' ? 'pass' : 'fail',
+        detail: `${evalConfig.configName} — ${evalConfig.executionStatus}`,
+      });
+    } catch (err) {
+      results.push({ label: `Online Eval Config${labelSuffix}`, status: 'fail', detail: getErrorMessage(err) });
+    }
+  }
+
+  // 2b. Gateway Role
+  const gatewayId = extractId(test.gatewayArn);
+  try {
+    const gateway = await getHttpGateway({ region, gatewayId });
+    results.push({
+      label: 'Gateway Role',
+      status: gateway.roleArn ? 'pass' : 'warn',
+      detail: gateway.roleArn ?? 'No role ARN',
+    });
+  } catch (err) {
+    results.push({ label: 'Gateway Role', status: 'fail', detail: getErrorMessage(err) });
+  }
+
+  // 5. Runtime spans — check for experiment metadata per variant in aws/spans
+  //    service.name in spans follows the pattern: {projectName}_{agentName}.{endpoint}
+  //    We derive the service name prefix from the deployed state runtimeId (strip random suffix).
+  const twoHoursAgo = Date.now() - 2 * 60 * 60 * 1000;
+  const variantNames = test.variants.map(v => v.name);
+  let serviceNamePrefix: string | undefined;
+  try {
+    const configIO = new ConfigIO();
+    const deployedState = await configIO.readDeployedState();
+    for (const [, target] of Object.entries(deployedState.targets ?? {})) {
+      const runtimes = target.resources?.runtimes ?? {};
+      const firstRuntime = Object.values(runtimes)[0];
+      if (firstRuntime?.runtimeId) {
+        // runtimeId is "{projectName}_{agentName}-{randomSuffix}", strip the suffix
+        serviceNamePrefix = firstRuntime.runtimeId.replace(/-[^-]+$/, '');
+        break;
+      }
+    }
+  } catch {
+    // Fall back to abTestArn-only filtering if deployed state isn't readable
+  }
+
+  try {
+    const baseFilter = serviceNamePrefix ? `"${serviceNamePrefix}"` : '"gen_ai_agent"';
+    const [allRuntimeSpans, ...variantSpanResults] = await Promise.all([
+      logsClient.send(
+        new FilterLogEventsCommand({
+          logGroupName: 'aws/spans',
+          startTime: twoHoursAgo,
+          filterPattern: baseFilter,
+          limit: 1,
+        })
+      ),
+      ...variantNames.map(name =>
+        logsClient.send(
+          new FilterLogEventsCommand({
+            logGroupName: 'aws/spans',
+            startTime: twoHoursAgo,
+            filterPattern: `"${test.abTestArn}" "${name}"`,
+            limit: 50,
+          })
+        )
+      ),
+    ]);
+
+    const hasRuntimeSpans = (allRuntimeSpans.events?.length ?? 0) > 0;
+    const totalExperimentSpans = variantSpanResults.reduce((sum, r) => sum + (r.events?.length ?? 0), 0);
+
+    for (let i = 0; i < variantNames.length; i++) {
+      const name = variantNames[i];
+      const count = variantSpanResults[i]?.events?.length ?? 0;
+      const label = `Runtime Experiment Spans — ${name} (2h)`;
+
+      if (count > 0) {
+        results.push({ label, status: 'pass', detail: `${count} spans with experiment metadata` });
+      } else if (hasRuntimeSpans) {
+        results.push({
+          label,
+          status: 'warn',
+          detail:
+            totalExperimentSpans > 0
+              ? `No spans for ${name} — traffic may not be reaching this variant`
+              : 'Runtime spans found but no experiment metadata — update bedrock-agentcore SDK to the latest version',
+        });
+      } else {
+        results.push({ label, status: 'warn', detail: 'No runtime spans found — send traffic to the gateway first' });
+      }
+    }
+  } catch (err) {
+    results.push({ label: 'Runtime Experiment Spans', status: 'fail', detail: getErrorMessage(err) });
+  }
+
+  // 6. Eval Results — check each eval config's log group
+  const thirtyMinAgo = Date.now() - 30 * 60 * 1000;
+  for (const { name: variantName, arn: evalArn } of evalConfigArns) {
+    const configId = extractId(evalArn);
+    const labelSuffix = variantName ? ` (${variantName})` : '';
+    try {
+      const evalLogGroup = `/aws/bedrock-agentcore/evaluations/results/${configId}`;
+
+      const [allEvents, taggedEvents] = await Promise.all([
+        logsClient.send(new FilterLogEventsCommand({ logGroupName: evalLogGroup, startTime: thirtyMinAgo, limit: 1 })),
+        logsClient.send(
+          new FilterLogEventsCommand({
+            logGroupName: evalLogGroup,
+            startTime: thirtyMinAgo,
+            filterPattern: `"${test.abTestArn}"`,
+            limit: 100,
+          })
+        ),
+      ]);
+
+      const hasResults = (allEvents.events?.length ?? 0) > 0;
+      const taggedCount = taggedEvents.events?.length ?? 0;
+
+      if (!hasResults) {
+        results.push({
+          label: `Eval Results${labelSuffix}`,
+          status: 'warn',
+          detail: 'No eval results yet — wait ~5m after session timeout for evaluator to process',
+        });
+      } else {
+        results.push({
+          label: `Eval Results${labelSuffix}`,
+          status: taggedCount > 0 ? 'pass' : 'warn',
+          detail:
+            taggedCount > 0
+              ? `${taggedCount} results tagged with AB test`
+              : 'Results exist but none tagged with variant — check gateway trace delivery',
+        });
+      }
+    } catch (err) {
+      const msg = getErrorMessage(err);
+      results.push({
+        label: `Eval Results${labelSuffix}`,
+        status: msg.includes('ResourceNotFoundException') ? 'warn' : 'fail',
+        detail: msg.includes('ResourceNotFoundException') ? 'Log group not found — evaluator has not run yet' : msg,
+      });
+    }
+  }
+
+  // 6. Aggregation Results
+  const metrics = test.results?.evaluatorMetrics ?? [];
+  const reporting = metrics.filter(m => m.controlStats?.sampleSize > 0);
+  results.push({
+    label: 'Aggregation Results',
+    status: reporting.length > 0 ? 'pass' : 'warn',
+    detail:
+      reporting.length > 0
+        ? `${reporting.length} evaluator(s) reporting`
+        : 'No aggregation data yet — wait ~12-15m after traffic',
+  });
+
+  return results;
+}
+
+export function ABTestDetailScreen({ abTestId, region, onExit }: ABTestDetailScreenProps) {
+  const [test, setTest] = useState<GetABTestResult | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [actionMessage, setActionMessage] = useState<string | null>(null);
+  const [confirmingStop, setConfirmingStop] = useState(false);
+  const [confirmingPromote, setConfirmingPromote] = useState(false);
+  const [debugResults, setDebugResults] = useState<DebugCheckResult[] | null>(null);
+  const [debugLoading, setDebugLoading] = useState(false);
+  const [targetName, setTargetName] = useState<string>('');
+
+  const hasFetched = useRef(false);
+  useEffect(() => {
+    if (hasFetched.current) return;
+    hasFetched.current = true;
+    const load = async () => {
+      try {
+        const result = await getABTest({ region, abTestId });
+        setTest(result);
+
+        // Fetch gateway target name for invocation URL
+        const gwId = extractId(result.gatewayArn);
+        try {
+          const targets = await listHttpGatewayTargets({ region, gatewayId: gwId, maxResults: 1 });
+          const firstTarget = targets.targets[0];
+          if (firstTarget) setTargetName(firstTarget.name);
+        } catch {
+          // Best-effort — URL will show without target path
+        }
+      } catch (err) {
+        setError(getErrorMessage(err));
+      }
+    };
+    void load();
+  }, [region, abTestId]);
+
+  const performAction = useCallback(
+    async (targetStatus: 'PAUSED' | 'RUNNING' | 'STOPPED', label: string) => {
+      setActionMessage(`${label}...`);
+      try {
+        await updateABTest({ region, abTestId, executionStatus: targetStatus });
+        // Poll until status updates or max attempts reached
+        for (let i = 0; i < 5; i++) {
+          await new Promise(resolve => setTimeout(resolve, 1000));
+          const result = await getABTest({ region, abTestId });
+          setTest(result);
+          if (result.executionStatus === targetStatus) {
+            setActionMessage(label.replace('...', 'd').replace('ing', 'ed'));
+            return;
+          }
+        }
+        // Final fetch even if status didn't converge
+        setActionMessage(label.replace('ing', 'ed'));
+      } catch (err: unknown) {
+        setActionMessage(`Error: ${getErrorMessage(err)}`);
+      }
+    },
+    [region, abTestId]
+  );
+
+  useInput((input, _key) => {
+    if (!test) return;
+
+    if (confirmingStop) {
+      if (input === 'y' || input === 'Y') {
+        setConfirmingStop(false);
+        void performAction('STOPPED', 'Stopping');
+      } else {
+        setConfirmingStop(false);
+      }
+      return;
+    }
+
+    if (confirmingPromote) {
+      if (input === 'y' || input === 'Y') {
+        setConfirmingPromote(false);
+        setActionMessage('Promoting...');
+        void (async () => {
+          try {
+            // Stop the AB test
+            await updateABTest({ region, abTestId, executionStatus: 'STOPPED' });
+            for (let i = 0; i < 5; i++) {
+              await new Promise(resolve => setTimeout(resolve, 1000));
+              const result = await getABTest({ region, abTestId });
+              setTest(result);
+              if (result.executionStatus === 'STOPPED') break;
+            }
+
+            // Apply promotion to agentcore.json
+            let promotionDetail = '';
+            try {
+              const { promoteABTestConfig } = await import('../../../operations/ab-test/promote');
+              const promoResult = await promoteABTestConfig(abTestId, test.name);
+              promotionDetail = promoResult.promoted
+                ? `${promoResult.promotionDetail} Run \`agentcore deploy\` to apply.`
+                : promoResult.promotionDetail;
+            } catch {
+              // Config update failed — still report the stop
+            }
+
+            setActionMessage(promotionDetail || 'AB test stopped. Run `agentcore deploy` to apply.');
+          } catch (err) {
+            setActionMessage(`Error: ${getErrorMessage(err)}`);
+          }
+        })();
+      } else {
+        setConfirmingPromote(false);
+      }
+      return;
+    }
+
+    if (input === 'p' || input === 'P') {
+      void performAction('PAUSED', 'Pausing');
+    }
+
+    if (input === 'r' || input === 'R') {
+      void performAction('RUNNING', 'Resuming');
+    }
+
+    if (input === 's' || input === 'S') {
+      setConfirmingStop(true);
+      setActionMessage(null);
+    }
+
+    if (input === 'w' || input === 'W') {
+      setConfirmingPromote(true);
+      setActionMessage(null);
+    }
+
+    if (input === 'd' || input === 'D') {
+      setDebugLoading(true);
+      setDebugResults(null);
+      void runDebugChecks(test, region)
+        .then(results => {
+          setDebugResults(results);
+          setDebugLoading(false);
+        })
+        .catch(() => {
+          setDebugResults([{ label: 'Debug', status: 'fail' as const, detail: 'Diagnostics failed to run' }]);
+          setDebugLoading(false);
+        });
+    }
+  });
+
+  if (error) {
+    return (
+      <Screen title="AB Test [preview]" onExit={onExit} helpText="Esc exit">
+        <Text color="red">{`Error: ${error}`}</Text>
+      </Screen>
+    );
+  }
+
+  if (!test) {
+    return (
+      <Screen title="AB Test [preview]" onExit={onExit} helpText="Esc exit">
+        <Text dimColor>Loading...</Text>
+      </Screen>
+    );
+  }
+
+  const controlVariant = test.variants.find(v => v.name === 'C');
+  const treatmentVariant = test.variants.find(v => v.name === 'T1');
+
+  const executionColor =
+    test.executionStatus === 'RUNNING' ? 'green' : test.executionStatus === 'PAUSED' ? 'yellow' : 'red';
+
+  const helpParts: string[] = [];
+  if (test.executionStatus === 'RUNNING') {
+    helpParts.push('P pause', 'S stop', 'W promote');
+  } else if (test.executionStatus === 'PAUSED') {
+    helpParts.push('R resume', 'S stop', 'W promote');
+  }
+  helpParts.push('D debug', 'Esc exit');
+  const helpKeys = helpParts.join(' · ');
+
+  // Build status text: only show provisioning status if not ACTIVE
+  const statusPrefix = test.status !== 'ACTIVE' ? `${test.status}  ` : '';
+
+  // TODO(post-preview): Re-enable duration display once configurable duration is launched.
+  const durationText = '';
+
+  // Column width for side-by-side variants
+  const colW = 28;
+
+  return (
+    <Screen title={`AB Test [preview]: ${test.name}`} onExit={onExit} helpText={helpKeys}>
+      <Box flexDirection="column" paddingX={1}>
+        {/* ── Header: Line 1 — status ─────────────────────────── */}
+        <Box>
+          <Box flexGrow={1}>
+            {statusPrefix && <Text bold>{statusPrefix}</Text>}
+            <Text color={executionColor} bold>{`● ${test.executionStatus}`}</Text>
+          </Box>
+          {durationText && <Text dimColor>{durationText}</Text>}
+        </Box>
+
+        {/* ── Header: Line 2 — invocation URL ────────────────────── */}
+        {targetName ? (
+          <Box>
+            <Text dimColor>{`Invocation URL: ${gatewayUrlFromArn(test.gatewayArn)}/${targetName}/invocations`}</Text>
+          </Box>
+        ) : (
+          <Box>
+            <Text dimColor>Invocation URL: loading...</Text>
+          </Box>
+        )}
+
+        {/* ── Header: Line 3 — online eval (only for single-config mode) ── */}
+        {'onlineEvaluationConfigArn' in test.evaluationConfig && (
+          <Box>
+            <Text dimColor>{`Online Eval: ${extractId(test.evaluationConfig.onlineEvaluationConfigArn)}`}</Text>
+          </Box>
+        )}
+
+        {/* ── Description (if present) ────────────────────────── */}
+        {test.description && (
+          <Box>
+            <Text dimColor>{`Description: ${test.description}`}</Text>
+          </Box>
+        )}
+
+        {/* ── Variants: side-by-side ──────────────────────────── */}
+        <Box marginTop={1}>
+          <Box flexDirection="column" minWidth={colW} marginRight={2}>
+            <Text bold>{'CONTROL (C)'}</Text>
+            <Text color="cyan">{`${String(controlVariant?.weight ?? 'N/A')}% traffic`}</Text>
+            <Text dimColor>
+              {controlVariant?.variantConfiguration.target
+                ? `target: ${controlVariant.variantConfiguration.target.name}`
+                : `${extractId(controlVariant?.variantConfiguration.configurationBundle?.bundleArn ?? '')} @ ${shortVersion(controlVariant?.variantConfiguration.configurationBundle?.bundleVersion ?? '')}`}
+            </Text>
+          </Box>
+          <Box flexDirection="column">
+            <Text bold>{'TREATMENT (T1)'}</Text>
+            <Text color="cyan">{`${String(treatmentVariant?.weight ?? 'N/A')}% traffic`}</Text>
+            <Text dimColor>
+              {treatmentVariant?.variantConfiguration.target
+                ? `target: ${treatmentVariant.variantConfiguration.target.name}`
+                : `${extractId(treatmentVariant?.variantConfiguration.configurationBundle?.bundleArn ?? '')} @ ${shortVersion(treatmentVariant?.variantConfiguration.configurationBundle?.bundleVersion ?? '')}`}
+            </Text>
+          </Box>
+        </Box>
+
+        {/* ── Evaluation Results ───────────────────────────────── */}
+        <Box marginTop={1} flexDirection="column">
+          {test.results ? (
+            <>
+              <Text dimColor>
+                {rule(
+                  'Results',
+                  test.results.analysisTimestamp ? formatTimestamp(test.results.analysisTimestamp) : undefined
+                )}
+              </Text>
+              <Box marginTop={1}>
+                <Box minWidth={24}>
+                  <Text dimColor>{''}</Text>
+                </Box>
+                <Box minWidth={12}>
+                  <Text dimColor>{'Control'}</Text>
+                </Box>
+                <Box minWidth={12}>
+                  <Text dimColor>{'Treatment'}</Text>
+                </Box>
+                <Text dimColor>{'Δ'}</Text>
+              </Box>
+              {test.results.evaluatorMetrics.map((metric, i) => (
+                <Box key={i} flexDirection="column" marginTop={i > 0 ? 1 : 0}>
+                  <Box>
+                    <Box minWidth={24}>
+                      <Text bold>{extractId(metric.evaluatorArn)}</Text>
+                    </Box>
+                    <Box minWidth={12}>
+                      <Text>{metric.controlStats.mean.toFixed(4)}</Text>
+                    </Box>
+                    <Box minWidth={12}>
+                      <Text>{metric.variantResults[0]?.mean.toFixed(4) ?? ''}</Text>
+                    </Box>
+                    {metric.variantResults[0]?.isSignificant ? (
+                      <Text color="green">{`+${(metric.variantResults[0]?.percentChange ?? 0).toFixed(2)}% ✓`}</Text>
+                    ) : (
+                      <Text color="red">{`${(metric.variantResults[0]?.percentChange ?? 0).toFixed(2)}% ✗`}</Text>
+                    )}
+                  </Box>
+                  <Box>
+                    <Box minWidth={24}>
+                      <Text>{''}</Text>
+                    </Box>
+                    <Box minWidth={12}>
+                      <Text dimColor>{`n=${metric.controlStats.sampleSize}`}</Text>
+                    </Box>
+                    <Box minWidth={12}>
+                      <Text dimColor>{`n=${metric.variantResults[0]?.sampleSize ?? ''}`}</Text>
+                    </Box>
+                    <Text dimColor>{`p=${metric.variantResults[0]?.pValue?.toFixed(3) ?? 'N/A'}`}</Text>
+                  </Box>
+                </Box>
+              ))}
+            </>
+          ) : (
+            <>
+              <Text dimColor>{rule('Results')}</Text>
+              <Box marginTop={1}>
+                <Text dimColor>No evaluation results yet.</Text>
+              </Box>
+            </>
+          )}
+        </Box>
+
+        {/* ── Debug Panel ─────────────────────────────────────── */}
+        {debugLoading && (
+          <Box marginTop={1}>
+            <GradientText text="Running pipeline diagnostics..." />
+          </Box>
+        )}
+        {debugResults && (
+          <Box marginTop={1} flexDirection="column">
+            <Text dimColor>{rule('Pipeline Debug')}</Text>
+            {debugResults.map((check, i) => {
+              const icon = check.status === 'pass' ? '✓' : check.status === 'fail' ? '✗' : '⚠';
+              const color = check.status === 'pass' ? 'green' : check.status === 'fail' ? 'red' : 'yellow';
+              return (
+                <Box key={i}>
+                  <Text color={color}>{`  ${icon} `}</Text>
+                  <Text bold>{check.label}</Text>
+                  <Text dimColor>{`  ${check.detail}`}</Text>
+                </Box>
+              );
+            })}
+          </Box>
+        )}
+
+        {/* ── Stop confirmation ────────────────────────────────── */}
+        {confirmingStop && (
+          <Box marginTop={1}>
+            <Text color="yellow" bold>
+              {
+                'Stop this AB test permanently? All traffic will shift to the control variant. This cannot be undone. (Y/n)'
+              }
+            </Text>
+          </Box>
+        )}
+
+        {/* ── Promote confirmation ─────────────────────────────── */}
+        {confirmingPromote && (
+          <Box marginTop={1}>
+            <Text color="green" bold>
+              {
+                'Promote treatment as winner? This will stop the AB test and update the control endpoint to the treatment version. Run `agentcore deploy` after to apply. (Y/n)'
+              }
+            </Text>
+          </Box>
+        )}
+
+        {/* ── Action feedback ──────────────────────────────────── */}
+        {actionMessage && !confirmingStop && (
+          <Box marginTop={1}>
+            <Text color="cyan">{actionMessage}</Text>
+          </Box>
+        )}
+      </Box>
+    </Screen>
+  );
+}
diff --git a/src/cli/tui/screens/ab-test/ABTestPickerScreen.tsx b/src/cli/tui/screens/ab-test/ABTestPickerScreen.tsx
new file mode 100644
index 000000000..9d47e4441
--- /dev/null
+++ b/src/cli/tui/screens/ab-test/ABTestPickerScreen.tsx
@@ -0,0 +1,90 @@
+import { ConfigIO } from '../../../../lib';
+import type { SelectableItem } from '../../components';
+import { Screen, SelectScreen } from '../../components';
+import { HELP_TEXT } from '../../constants';
+import { ABTestDetailScreen } from './ABTestDetailScreen';
+import { Text } from 'ink';
+import React, { useEffect, useRef, useState } from 'react';
+
+interface ABTestPickerScreenProps {
+  onExit: () => void;
+}
+
+interface DeployedABTest {
+  name: string;
+  abTestId: string;
+}
+
+export function ABTestPickerScreen({ onExit }: ABTestPickerScreenProps) {
+  const [tests, setTests] = useState<DeployedABTest[] | null>(null);
+  const [selectedTest, setSelectedTest] = useState<DeployedABTest | null>(null);
+  const [region, setRegion] = useState('us-east-1');
+
+  const hasFetched = useRef(false);
+  useEffect(() => {
+    if (hasFetched.current) return;
+    hasFetched.current = true;
+    const load = async () => {
+      try {
+        const configIO = new ConfigIO();
+        const [deployedState, targets] = await Promise.all([
+          configIO.readDeployedState(),
+          configIO.resolveAWSDeploymentTargets(),
+        ]);
+        const found: DeployedABTest[] = [];
+        for (const target of Object.values(deployedState.targets ?? {})) {
+          const abTests = target.resources?.abTests;
+          if (abTests) {
+            for (const [name, state] of Object.entries(abTests)) {
+              found.push({ name, abTestId: state.abTestId });
+            }
+          }
+        }
+        setTests(found);
+        if (targets.length > 0) setRegion(targets[0]!.region);
+      } catch {
+        setTests([]);
+      }
+    };
+    void load();
+  }, []);
+
+  if (selectedTest) {
+    return <ABTestDetailScreen abTestId={selectedTest.abTestId} region={region} onExit={() => setSelectedTest(null)} />;
+  }
+
+  if (tests === null) {
+    return (
+      <Screen title="AB Tests" onExit={onExit} helpText={HELP_TEXT.EXIT}>
+        <Text dimColor>Loading AB tests...</Text>
+      </Screen>
+    );
+  }
+
+  if (tests.length === 0) {
+    return (
+      <Screen title="AB Tests" onExit={onExit} helpText={HELP_TEXT.EXIT}>
+        <Text>No deployed AB tests found.</Text>
+        <Text dimColor>Add one with `agentcore add ab-test` and deploy.</Text>
+      </Screen>
+    );
+  }
+
+  const items: SelectableItem[] = tests.map(t => ({
+    id: t.name,
+    title: t.name,
+    description: `ID: ${t.abTestId}`,
+  }));
+
+  return (
+    <SelectScreen
+      title="Select AB Test"
+      items={items}
+      onSelect={item => {
+        const test = tests.find(t => t.name === item.id);
+        if (test) setSelectedTest(test);
+      }}
+      onExit={onExit}
+    />
+  );
+}
diff --git a/src/cli/tui/screens/ab-test/AddABTestFlow.tsx b/src/cli/tui/screens/ab-test/AddABTestFlow.tsx
new file mode 100644
index 000000000..b8313075d
--- /dev/null
+++ b/src/cli/tui/screens/ab-test/AddABTestFlow.tsx
@@ -0,0 +1,281 @@
+import { ConfigIO } from '../../../../lib';
+import { listConfigurationBundleVersions } from '../../../aws/agentcore-config-bundles';
+import { ErrorPrompt } from '../../components';
+import { useCreateABTest, useExistingABTestNames } from '../../hooks/useCreateABTest';
+import { AddSuccessScreen } from '../add/AddSuccessScreen';
+import { AddConfigBundleFlow } from '../config-bundle/AddConfigBundleFlow';
+import { AddABTestScreen } from './AddABTestScreen';
+import type { HttpGatewayInfo, OnlineEvalConfigInfo, RuntimeInfo } from './AddABTestScreen';
+import { TargetBasedABTestScreen } from './TargetBasedABTestScreen';
+import type { AddABTestConfig } from './types';
+import React, { useCallback, useEffect, useState } from 'react';
+
+type FlowState =
+  | { name: 'create-wizard' }
+  | { name: 'target-wizard' }
+  | { name: 'create-bundle' }
+  | { name: 'create-success'; testName: string }
+  | { name: 'error'; message: string };
+
+interface AddABTestFlowProps {
+  isInteractive?: boolean;
+  onExit: () => void;
+  onBack: () => void;
+  onDev?: () => void;
+  onDeploy?: () => void;
+}
+
+export function AddABTestFlow({ isInteractive = true, onExit, onBack, onDev, onDeploy }: AddABTestFlowProps) {
+  const { createABTest, createTargetBasedABTest, reset: resetCreate } = useCreateABTest();
+  const { names: existingNames } = useExistingABTestNames();
+  const [flow, setFlow] = useState<FlowState>({ name: 'create-wizard' });
+
+  // Load deployed state for bundle lists
+  const [agents, setAgents] = useState<{ name: string }[]>([]);
+  const [existingHttpGateways, setExistingHttpGateways] = useState<string[]>([]);
+  const [deployedBundles, setDeployedBundles] = useState<{ name: string; bundleId: string }[]>([]);
+  const [onlineEvalConfigs, setOnlineEvalConfigs] = useState<string[]>([]);
+  const [runtimesInfo, setRuntimesInfo] = useState<RuntimeInfo[]>([]);
+  const [httpGatewayDetails, setHttpGatewayDetails] = useState<HttpGatewayInfo[]>([]);
+  const [onlineEvalConfigDetails, setOnlineEvalConfigDetails] = useState<OnlineEvalConfigInfo[]>([]);
+  const [region, setRegion] = useState('us-east-1');
+
+  const [loadEpoch, setLoadEpoch] = useState(0);
+
+  useEffect(() => {
+    void (async () => {
+      try {
+        const configIO = new ConfigIO();
+        const deployedState = await configIO.readDeployedState();
+        const projectSpec = await configIO.readProjectSpec();
+
+        // Get region from first target
+        for (const [, target] of Object.entries(deployedState.targets ?? {})) {
+          const resources = target.resources;
+
+          // Deployed config bundles
+          const bundles = resources?.configBundles;
+          if (bundles) {
+            setDeployedBundles(
+              Object.entries(bundles).map(([name, state]) => ({
+                name,
+                bundleId: state.bundleId,
+              }))
+            );
+          }
+          break;
+        }
+
+        // Agents from project spec runtimes
+        const runtimes = projectSpec.runtimes ?? [];
+        setAgents(runtimes.map(r => ({ name: r.name })));
+
+        // Runtimes with endpoints for target-based mode
+        setRuntimesInfo(
+          runtimes.map(r => ({
+            name: r.name,
+            endpoints: Object.entries(r.endpoints ?? {}).map(([epName, ep]) => ({
+              name: epName,
+              version: ep.version,
+            })),
+          }))
+        );
+
+        // Existing HTTP gateways from project spec
+        const httpGws = projectSpec.httpGateways ?? [];
+        setExistingHttpGateways(httpGws.map(gw => gw.name));
+
+        // HTTP gateway details with targets for target-based mode
+        setHttpGatewayDetails(
+          httpGws.map(gw => ({
+            name: gw.name,
+            runtimeRef: gw.runtimeRef,
+            targets: (gw.targets ?? []).map(t => ({
+              name: t.name,
+              runtimeRef: t.runtimeRef,
+              qualifier: t.qualifier,
+            })),
+          }))
+        );
+
+        // Online eval configs from project spec
+        const evalConfigs = projectSpec.onlineEvalConfigs ?? [];
+        setOnlineEvalConfigs(evalConfigs.map(c => c.name));
+        setOnlineEvalConfigDetails(
+          evalConfigs.map(c => ({
+            name: c.name,
+            agent: c.agent,
+            endpoint: c.endpoint,
+          }))
+        );
+
+        // Region from aws-targets, falling back to env
+        const targets = await configIO.resolveAWSDeploymentTargets();
+        if (targets.length > 0) {
+          setRegion(targets[0]!.region);
+        } else {
+          setRegion(process.env.AWS_DEFAULT_REGION ?? process.env.AWS_REGION ?? 'us-east-1');
+        }
+      } catch {
+        // No deployed state — lists will be empty
+      }
+    })();
+  }, [loadEpoch]);
+
+  const fetchBundleVersions = useCallback(
+    async (bundleId: string) => {
+      try {
+        const result = await listConfigurationBundleVersions({ region, bundleId });
+        return result.versions.map(v => ({
+          versionId: v.versionId,
+          createdAt: v.versionCreatedAt,
+        }));
+      } catch {
+        return [];
+      }
+    },
+    [region]
+  );
+
+  useEffect(() => {
+    if (!isInteractive && flow.name === 'create-success') {
+      onExit();
+    }
+  }, [isInteractive, flow.name, onExit]);
+
+  const handleCreateComplete = useCallback(
+    (config: AddABTestConfig) => {
+      if (config.mode === 'target-based') {
+        const gatewayName =
+          config.gatewayChoice.type === 'existing-http'
+            ? config.gatewayChoice.name
+            : config.gatewayChoice.type === 'create-new'
+              ? `${config.name.replace(/_/g, '-').slice(0, 44)}-gw`
+              : '';
+        void createTargetBasedABTest({
+          name: config.name,
+          description: config.description || undefined,
+          gateway: gatewayName,
+          runtime: config.runtime,
+          controlEndpoint: config.controlEndpoint,
+          treatmentEndpoint: config.treatmentEndpoint,
+          controlWeight: config.controlWeight,
+          treatmentWeight: config.treatmentWeight,
+          controlOnlineEval: config.controlOnlineEval,
+          treatmentOnlineEval: config.treatmentOnlineEval,
+          enableOnCreate: config.enableOnCreate,
+        }).then(result => {
+          if (result.ok) {
+            setFlow({ name: 'create-success', testName: result.testName });
+            return;
+          }
+          setFlow({ name: 'error', message: result.error });
+        });
+        return;
+      }
+
+      const controlWeight = 100 - config.treatmentWeight;
+      void createABTest({
+        name: config.name,
+        description: config.description || undefined,
+        agent: config.agent,
+        gatewayChoice: config.gatewayChoice,
+        controlBundle: config.controlBundle,
+        controlVersion: config.controlVersion,
+        treatmentBundle: config.treatmentBundle,
+        treatmentVersion: config.treatmentVersion,
+        controlWeight,
+        treatmentWeight: config.treatmentWeight,
+        onlineEval: config.onlineEval,
+        maxDuration: config.maxDuration,
+        enableOnCreate: config.enableOnCreate,
+      }).then(result => {
+        if (result.ok) {
+          setFlow({ name: 'create-success', testName: result.testName });
+          return;
+        }
+        setFlow({ name: 'error', message: result.error });
+      });
+    },
+    [createABTest, createTargetBasedABTest]
+  );
+
+  const handleSwitchToTargetBased = useCallback(() => {
+    setFlow({ name: 'target-wizard' });
+  }, []);
+
+  const handleCreateBundle = useCallback(() => {
+    setFlow({ name: 'create-bundle' });
+  }, []);
+
+  const handleBundleFlowDone = useCallback(() => {
+    setLoadEpoch(e => e + 1);
+    setFlow({ name: 'create-wizard' });
+  }, []);
+
+  if (flow.name === 'create-bundle') {
+    return (
+      <AddConfigBundleFlow isInteractive={isInteractive} onExit={handleBundleFlowDone} onBack={handleBundleFlowDone} />
+    );
+  }
+
+  if (flow.name === 'target-wizard') {
+    return (
+      <TargetBasedABTestScreen
+        onComplete={handleCreateComplete}
+        onExit={onBack}
+        existingTestNames={existingNames}
+        runtimes={runtimesInfo}
+        httpGatewayDetails={httpGatewayDetails}
+        existingHttpGateways={existingHttpGateways}
+        onlineEvalConfigDetails={onlineEvalConfigDetails}
+      />
+    );
+  }
+
+  if (flow.name === 'create-wizard') {
+    return (
+      <AddABTestScreen
+        existingTestNames={existingNames}
+        agents={agents}
+        existingHttpGateways={existingHttpGateways}
+        deployedBundles={deployedBundles}
+        onlineEvalConfigs={onlineEvalConfigs}
+        fetchBundleVersions={fetchBundleVersions}
+        onComplete={handleCreateComplete}
+        onExit={onBack}
+        onCreateBundle={handleCreateBundle}
+        runtimes={runtimesInfo}
+        httpGatewayDetails={httpGatewayDetails}
+        onlineEvalConfigDetails={onlineEvalConfigDetails}
+        onSwitchToTargetBased={handleSwitchToTargetBased}
+      />
+    );
+  }
+
+  if (flow.name === 'create-success') {
+    return (
+      <AddSuccessScreen
+        isInteractive={isInteractive}
+        message={`Added AB test: ${flow.testName}`}
+        detail="AB test added to project in `agentcore/agentcore.json`. Deploy with `agentcore deploy` to create."
+        onAddAnother={onBack}
+        onDev={onDev}
+        onDeploy={onDeploy}
+        onExit={onExit}
+      />
+    );
+  }
+
+  return (
+    <ErrorPrompt
+      message="Failed to add AB test"
+      detail={flow.message}
+      onBack={() => {
+        resetCreate();
+        setFlow({ name: 'create-wizard' });
+      }}
+      onExit={onExit}
+    />
+  );
+}
diff --git a/src/cli/tui/screens/ab-test/AddABTestScreen.tsx b/src/cli/tui/screens/ab-test/AddABTestScreen.tsx
new file mode 100644
index 000000000..3306ce86c
--- /dev/null
+++ b/src/cli/tui/screens/ab-test/AddABTestScreen.tsx
@@ -0,0 +1,914 @@
+import { ABTestNameSchema } from '../../../../schema/schemas/primitives/ab-test';
+import type { SelectableItem } from '../../components';
+import { ConfirmReview, Panel, Screen, StepIndicator, TextInput, WizardSelect } from '../../components';
+import { HELP_TEXT } from '../../constants';
+import { useListNavigation } from '../../hooks';
+import type { VersionLoadState } from './VariantConfigForm';
+import { VariantConfigForm } from './VariantConfigForm';
+import type { AddABTestConfig, TargetInfo } from './types';
+import { AB_TEST_STEP_LABELS } from './types';
+import { useAddABTestWizard } from './useAddABTestWizard';
+import { Box, Text } from 'ink';
+import React, { useCallback, useEffect, useMemo, useState } from 'react';
+
+function formatVersionDate(value: string): string {
+  const n = Number(value);
+  if (!isNaN(n) && n > 0) {
+    // Epoch seconds (< 1e12) vs milliseconds (>= 1e12)
+    const ms = n < 1e12 ? n * 1000 : n;
+    return new Date(ms).toLocaleString();
+  }
+  return new Date(value).toLocaleString();
+}
+
+/** Runtime endpoint info passed from the parent flow. */
+export interface RuntimeEndpointInfo {
+  name: string;
+  version: number;
+}
+
+/** Runtime info with endpoints, passed from the parent flow. */
+export interface RuntimeInfo {
+  name: string;
+  endpoints: RuntimeEndpointInfo[];
+}
+
+/** Gateway target info passed from the parent flow. */
+export interface GatewayTargetInfo {
+  name: string;
+  runtimeRef: string;
+  qualifier: string;
+}
+
+/** HTTP gateway info with targets, passed from the parent flow. */
+export interface HttpGatewayInfo {
+  name: string;
+  runtimeRef: string;
+  targets: GatewayTargetInfo[];
+}
+
+/** Online eval config info with agent and endpoint for filtering. */
+export interface OnlineEvalConfigInfo {
+  name: string;
+  agent: string;
+  endpoint?: string;
+}
+
+interface AddABTestScreenProps {
+  onComplete: (config: AddABTestConfig) => void;
+  onExit: () => void;
+  existingTestNames: string[];
+  agents: { name: string }[];
+  existingHttpGateways: string[];
+  deployedBundles: { name: string; bundleId: string }[];
+  onlineEvalConfigs: string[];
+  fetchBundleVersions: (bundleId: string) => Promise<{ versionId: string; createdAt: string }[]>;
+  onCreateBundle?: () => void;
+  /** Full runtime info including endpoints (for target-based mode). */
+  runtimes: RuntimeInfo[];
+  /** Full HTTP gateway info including targets (for target-based mode). */
+  httpGatewayDetails: HttpGatewayInfo[];
+  /** Full online eval config objects for target-based eval filtering. */
+  onlineEvalConfigDetails?: OnlineEvalConfigInfo[];
+  /** Callback to switch to the dedicated target-based wizard screen. */
+  onSwitchToTargetBased?: () => void;
+}
+
+export function AddABTestScreen({
+  onComplete,
+  onExit,
+  existingTestNames,
+  agents,
+  existingHttpGateways,
+  deployedBundles,
+  onlineEvalConfigs,
+  fetchBundleVersions,
+  onCreateBundle,
+  runtimes,
+  httpGatewayDetails,
+  onlineEvalConfigDetails = [],
+  onSwitchToTargetBased,
+}: AddABTestScreenProps) {
+  const wizard = useAddABTestWizard();
+
+  // Build select items
+  const agentItems: SelectableItem[] = useMemo(
+    () => agents.map(a => ({ id: a.name, title: a.name, description: 'Agent' })),
+    [agents]
+  );
+
+  const bundleItems: SelectableItem[] = useMemo(
+    () => deployedBundles.map(b => ({ id: b.name, title: b.name, description: `ID: ${b.bundleId}` })),
+    [deployedBundles]
+  );
+
+  const onlineEvalItems: SelectableItem[] = useMemo(
+    () => onlineEvalConfigs.map(name => ({ id: name, title: name, description: 'Online Eval Config' })),
+    [onlineEvalConfigs]
+  );
+
+  const gatewayItems: SelectableItem[] = useMemo(() => {
+    const items: SelectableItem[] = [];
+    for (const gwName of existingHttpGateways) {
+      items.push({ id: gwName, title: gwName, description: 'Existing HTTP gateway' });
+    }
+    items.push({
+      id: '__create__',
+      title: '+ Create new gateway',
+      description: 'Auto-create for this AB test',
+      spaceBefore: items.length > 0,
+    });
+    return items;
+  }, [existingHttpGateways]);
+
+  const enableItems: SelectableItem[] = useMemo(
+    () => [
+      { id: 'yes', title: 'Yes', description: 'Start the AB test immediately after deploy' },
+      { id: 'no', title: 'No', description: 'Create paused — start manually later' },
+    ],
+    []
+  );
+
+  // Version items — fetched dynamically per bundle
+  const [controlVersionItems, setControlVersionItems] = React.useState<SelectableItem[]>([]);
+  const [treatmentVersionItems, setTreatmentVersionItems] = React.useState<SelectableItem[]>([]);
+  const [controlVersionLoadState, setControlVersionLoadState] = React.useState<VersionLoadState>('idle');
+  const [treatmentVersionLoadState, setTreatmentVersionLoadState] = React.useState<VersionLoadState>('idle');
+
+  const handleFetchVersions = React.useCallback(
+    (bundleName: string) => {
+      const bundle = deployedBundles.find(b => b.name === bundleName);
+      if (!bundle) return;
+
+      setControlVersionLoadState('loading');
+      setTreatmentVersionLoadState('loading');
+
+      void fetchBundleVersions(bundle.bundleId)
+        .then(versions => {
+          const items = versions.map(v => ({
+            id: v.versionId,
+            title: v.versionId.slice(0, 8),
+            description: `Created: ${formatVersionDate(v.createdAt)}`,
+          }));
+          setControlVersionItems(items);
+          setTreatmentVersionItems(items);
+          setControlVersionLoadState('loaded');
+          setTreatmentVersionLoadState('loaded');
+        })
+        .catch(() => {
+          setControlVersionLoadState('error');
+          setTreatmentVersionLoadState('error');
+        });
+    },
+    [deployedBundles, fetchBundleVersions]
+  );
+
+  // ── Gateway sub-flow state (target-based: "create new" text input) ────────
+  const [gatewayCreateMode, setGatewayCreateMode] = useState(false);
+
+  // ── Target picker sub-flow state ──────────────────────────────────────────
+  // Sub-flow phases: 'pick' -> 'selectRuntime' -> 'selectQualifier'
+  type TargetSubFlowPhase = 'pick' | 'selectRuntime' | 'selectQualifier';
+  const [controlSubFlow, setControlSubFlow] = useState<TargetSubFlowPhase>('pick');
+  const [controlNewRuntime, setControlNewRuntime] = useState('');
+
+  const [treatmentSubFlow, setTreatmentSubFlow] = useState<TargetSubFlowPhase>('pick');
+  const [treatmentNewRuntime, setTreatmentNewRuntime] = useState('');
+
+  /* eslint-disable react-hooks/set-state-in-effect -- intentional reset on step change */
+  useEffect(() => {
+    if (wizard.step === 'controlTarget') {
+      setControlSubFlow('pick');
+      setControlNewRuntime('');
+    }
+  }, [wizard.step]);
+
+  useEffect(() => {
+    if (wizard.step === 'treatmentTarget') {
+      setTreatmentSubFlow('pick');
+      setTreatmentNewRuntime('');
+    }
+  }, [wizard.step]);
+  /* eslint-enable react-hooks/set-state-in-effect */
+
+  // Step flags
+  const isModeStep = wizard.step === 'mode';
+  const isNameStep = wizard.step === 'name';
+  const isDescriptionStep = wizard.step === 'description';
+  const isAgentStep = wizard.step === 'agent';
+  const isGatewayStep = wizard.step === 'gateway';
+  const isVariantsStep = wizard.step === 'variants';
+  const isOnlineEvalStep = wizard.step === 'onlineEval';
+  const isControlTargetStep = wizard.step === 'controlTarget';
+  const isTreatmentTargetStep = wizard.step === 'treatmentTarget';
+  const isWeightsStep = wizard.step === 'weights';
+  const isEvalPathStep = wizard.step === 'evalPath';
+  const isEvalSelectStep = wizard.step === 'evalSelect';
+  const isEnableStep = wizard.step === 'enableOnCreate';
+  const isConfirmStep = wizard.step === 'confirm';
+
+  const isTargetBased = wizard.config.mode === 'target-based';
+
+  // Tell the wizard which steps to skip (both forward and backward navigation).
+  const gatewayChoiceTypeRef = React.useRef(wizard.config.gatewayChoice.type);
+
+  const shouldSkipStep = useCallback(
+    (s: string) => {
+      // Agent selection is only needed in config-bundle mode when auto-creating a gateway.
+      if (s === 'agent' && (isTargetBased || gatewayChoiceTypeRef.current !== 'create-new')) return true;
+      // Config-bundle steps skipped in target-based mode
+      if (s === 'variants' && isTargetBased) return true;
+      if (s === 'onlineEval' && isTargetBased) return true;
+      // Target-based steps skipped in config-bundle mode
+      if (s === 'controlTarget' && !isTargetBased) return true;
+      if (s === 'treatmentTarget' && !isTargetBased) return true;
+      if (s === 'weights' && !isTargetBased) return true;
+      if (s === 'evalPath' && !isTargetBased) return true;
+      if (s === 'evalSelect' && !isTargetBased) return true;
+      if (s === 'evalCreate' && !isTargetBased) return true;
+      if (s === 'evalSamplingRate' && !isTargetBased) return true;
+      if (s === 'maxDuration') return true;
+      return false;
+    },
+    [isTargetBased]
+  );
+
+  useEffect(() => {
+    wizard.setSkipCheck(shouldSkipStep);
+  }, [shouldSkipStep]); // wizard.setSkipCheck is stable (useCallback with no deps)
+
+  // Mode selection items
+  const modeItems: SelectableItem[] = useMemo(
+    () => [
+      {
+        id: 'config-bundle',
+        title: 'Config Bundle',
+        description: 'Split traffic between config bundle versions (same target, different config)',
+      },
+      {
+        id: 'target-based',
+        title: 'Target-Based',
+        description: 'Split traffic between gateway targets (different targets, each self-contained)',
+      },
+    ],
+    []
+  );
+
+  // ── Target picker items builder ──────────────────────────────────────────
+  // Builds the three-section grouped picker items for target selection.
+  const buildTargetItems = useCallback(
+    (excludeTarget: TargetInfo | null): SelectableItem[] => {
+      const items: SelectableItem[] = [];
+
+      // Section 1: Existing targets on the selected gateway
+      const selectedGw = httpGatewayDetails.find(g => g.name === wizard.config.gateway);
+      const existingTargets = selectedGw?.targets ?? [];
+      if (existingTargets.length > 0) {
+        items.push({
+          id: '__section_existing__',
+          title: '── Existing Targets ──',
+          description: '',
+          disabled: true,
+        });
+        for (const t of existingTargets) {
+          if (excludeTarget?.name === t.name) continue;
+          items.push({
+            id: `existing:${t.name}`,
+            title: t.name,
+            description: `endpoint=${t.qualifier}  runtime=${t.runtimeRef}`,
+          });
+        }
+      }
+
+      // Section 2: Endpoints from project runtimes (quick-create targets)
+      const endpointItems: SelectableItem[] = [];
+      for (const rt of runtimes) {
+        for (const ep of rt.endpoints) {
+          const targetName = ep.name;
+          if (excludeTarget?.name === targetName) continue;
+          endpointItems.push({
+            id: `endpoint:${rt.name}/${ep.name}`,
+            title: `${rt.name}/${ep.name}`,
+            description: `v${ep.version}`,
+          });
+        }
+      }
+      if (endpointItems.length > 0) {
+        items.push({
+          id: '__section_endpoints__',
+          title: '── Endpoints ──',
+          description: 'Select to auto-create target',
+          disabled: true,
+          spaceBefore: items.length > 0,
+        });
+        items.push(...endpointItems);
+      }
+
+      // Section 3: Create new target
+      items.push({
+        id: '__create_target__',
+        title: '+ Create new target',
+        description: 'Configure runtime, name, and endpoint',
+        spaceBefore: true,
+      });
+
+      return items;
+    },
+    [httpGatewayDetails, runtimes, wizard.config.gateway]
+  );
+
+  const controlTargetItems = useMemo(() => buildTargetItems(null), [buildTargetItems]);
+  const treatmentTargetItems = useMemo(
+    () => buildTargetItems(wizard.config.controlTargetInfo),
+    [buildTargetItems, wizard.config.controlTargetInfo]
+  );
+
+  // Runtime items for the "create new target" sub-flow
+  const runtimeItems: SelectableItem[] = useMemo(
+    () => runtimes.map(r => ({ id: r.name, title: r.name, description: `${r.endpoints.length} endpoint(s)` })),
+    [runtimes]
+  );
+
+  // Qualifier items for a given runtime (DEFAULT + all endpoints)
+  const buildQualifierItems = useCallback(
+    (runtimeName: string): SelectableItem[] => {
+      const rt = runtimes.find(r => r.name === runtimeName);
+      const items: SelectableItem[] = [{ id: 'DEFAULT', title: 'DEFAULT', description: 'Default endpoint' }];
+      if (rt) {
+        for (const ep of rt.endpoints) {
+          items.push({ id: ep.name, title: ep.name, description: `v${ep.version}` });
+        }
+      }
+      return items;
+    },
+    [runtimes]
+  );
+
+  const controlEndpointItems = useMemo(
+    () => buildQualifierItems(controlNewRuntime),
+    [buildQualifierItems, controlNewRuntime]
+  );
+  const treatmentEndpointItems = useMemo(
+    () => buildQualifierItems(treatmentNewRuntime),
+    [buildQualifierItems, treatmentNewRuntime]
+  );
+
+  // Navigation hooks for select steps
+  const modeNav = useListNavigation({
+    items: modeItems,
+    onSelect: item => {
+      if (item.id === 'target-based' && onSwitchToTargetBased) {
+        onSwitchToTargetBased();
+        return;
+      }
+      wizard.setMode(item.id as 'config-bundle' | 'target-based');
+    },
+    onExit: () => wizard.goBack(),
+    isActive: isModeStep,
+  });
+
+  const agentNav = useListNavigation({
+    items: agentItems,
+    onSelect: item => wizard.setAgent(item.id),
+    onExit: () => wizard.goBack(),
+    isActive: isAgentStep,
+  });
+
+  const gatewayNav = useListNavigation({
+    items: gatewayItems,
+    onSelect: item => {
+      if (item.id === '__create__') {
+        setGatewayCreateMode(true);
+        return;
+      }
+      const choice = { type: 'existing-http', name: item.id } as const;
+      gatewayChoiceTypeRef.current = choice.type;
+      wizard.setGatewayWithName(item.id, false);
+    },
+    onExit: () => wizard.goBack(),
+    isActive: isGatewayStep && !gatewayCreateMode,
+    isDisabled: item => item.disabled === true,
+  });
+
+  const onlineEvalNav = useListNavigation({
+    items: onlineEvalItems,
+    onSelect: item => wizard.setOnlineEval(item.id),
+    onExit: () => wizard.goBack(),
+    isActive: isOnlineEvalStep,
+  });
+
+  // ── Control target picker navigation ─────────────────────────────────────
+  const controlTargetNav = useListNavigation({
+    items: controlTargetItems,
+    onSelect: item => {
+      if (item.id === '__create_target__') {
+        setControlSubFlow('selectRuntime');
+        return;
+      }
+      if (item.id.startsWith('existing:')) {
+        const targetName = item.id.replace('existing:', '');
+        const selectedGw = httpGatewayDetails.find(g => g.name === wizard.config.gateway);
+        const target = selectedGw?.targets.find(t => t.name === targetName);
+        if (target) {
+          wizard.setControlTarget(
+            { name: target.name, runtimeRef: target.runtimeRef, qualifier: target.qualifier },
+            false
+          );
+        }
+        return;
+      }
+      if (item.id.startsWith('endpoint:')) {
+        const path = item.id.replace('endpoint:', '');
+        const [runtimeName, endpointName] = path.split('/');
+        if (runtimeName && endpointName) {
+          const autoName = `${runtimeName}-${endpointName}`;
+          wizard.setControlTarget({ name: autoName, runtimeRef: runtimeName, qualifier: endpointName }, true);
+        }
+      }
+    },
+    onExit: () => wizard.goBack(),
+    isActive: isControlTargetStep && controlSubFlow === 'pick',
+    isDisabled: item => item.disabled === true,
+  });
+
+  // Control sub-flow: select runtime
+  const controlRuntimeNav = useListNavigation({
+    items: runtimeItems,
+    onSelect: item => {
+      setControlNewRuntime(item.id);
+      setControlSubFlow('selectQualifier');
+    },
+    onExit: () => setControlSubFlow('pick'),
+    isActive: isControlTargetStep && controlSubFlow === 'selectRuntime',
+  });
+
+  // Control sub-flow: select qualifier (auto-generates target name)
+  const controlEndpointNav = useListNavigation({
+    items: controlEndpointItems,
+    onSelect: item => {
+      const autoName = `${controlNewRuntime}-${item.id}`;
+      wizard.setControlTarget({ name: autoName, runtimeRef: controlNewRuntime, qualifier: item.id }, true);
+    },
+    onExit: () => setControlSubFlow('selectRuntime'),
+    isActive: isControlTargetStep && controlSubFlow === 'selectQualifier',
+  });
+
+  // ── Treatment target picker navigation ───────────────────────────────────
+  const treatmentTargetNav = useListNavigation({
+    items: treatmentTargetItems,
+    onSelect: item => {
+      if (item.id === '__create_target__') {
+        setTreatmentSubFlow('selectRuntime');
+        return;
+      }
+      if (item.id.startsWith('existing:')) {
+        const targetName = item.id.replace('existing:', '');
+        const selectedGw = httpGatewayDetails.find(g => g.name === wizard.config.gateway);
+        const target = selectedGw?.targets.find(t => t.name === targetName);
+        if (target) {
+          wizard.setTreatmentTarget(
+            { name: target.name, runtimeRef: target.runtimeRef, qualifier: target.qualifier },
+            false
+          );
+        }
+        return;
+      }
+      if (item.id.startsWith('endpoint:')) {
+        const path = item.id.replace('endpoint:', '');
+        const [runtimeName, endpointName] = path.split('/');
+        if (runtimeName && endpointName) {
+          const autoName = `${runtimeName}-${endpointName}`;
+          wizard.setTreatmentTarget({ name: autoName, runtimeRef: runtimeName, qualifier: endpointName }, true);
+        }
+      }
+    },
+    onExit: () => wizard.goBack(),
+    isActive: isTreatmentTargetStep && treatmentSubFlow === 'pick',
+    isDisabled: item => item.disabled === true,
+  });
+
+  // Treatment sub-flow: select runtime
+  const treatmentRuntimeNav = useListNavigation({
+    items: runtimeItems,
+    onSelect: item => {
+      setTreatmentNewRuntime(item.id);
+      setTreatmentSubFlow('selectQualifier');
+    },
+    onExit: () => setTreatmentSubFlow('pick'),
+    isActive: isTreatmentTargetStep && treatmentSubFlow === 'selectRuntime',
+  });
+
+  // Treatment sub-flow: select qualifier (auto-generates target name)
+  const treatmentEndpointNav = useListNavigation({
+    items: treatmentEndpointItems,
+    onSelect: item => {
+      const autoName = `${treatmentNewRuntime}-${item.id}`;
+      wizard.setTreatmentTarget({ name: autoName, runtimeRef: treatmentNewRuntime, qualifier: item.id }, true);
+    },
+    onExit: () => setTreatmentSubFlow('selectRuntime'),
+    isActive: isTreatmentTargetStep && treatmentSubFlow === 'selectQualifier',
+  });
+
+  const evalPathItems: SelectableItem[] = useMemo(
+    () => [
+      {
+        id: 'select',
+        title: 'Select existing online eval configs',
+        description: 'Use configs already in your project',
+      },
+      { id: 'create', title: 'Create new', description: 'Pick evaluators + sampling rate, auto-create configs' },
+    ],
+    []
+  );
+
+  const evalPathNav = useListNavigation({
+    items: evalPathItems,
+    onSelect: item => wizard.setEvalPath(item.id as 'select' | 'create'),
+    onExit: () => wizard.goBack(),
+    isActive: isEvalPathStep,
+  });
+
+  // ── Eval select sub-flow: pick control eval, then treatment eval ────────
+  type EvalSelectPhase = 'controlEval' | 'treatmentEval';
+  const [evalSelectPhase, setEvalSelectPhase] = useState<EvalSelectPhase>('controlEval');
+  const [selectedControlEval, setSelectedControlEval] = useState('');
+
+  // Reset eval select sub-flow when entering the step
+  /* eslint-disable react-hooks/set-state-in-effect -- intentional reset on step change */
+  useEffect(() => {
+    if (wizard.step === 'evalSelect') {
+      setEvalSelectPhase('controlEval');
+      setSelectedControlEval('');
+    }
+  }, [wizard.step]);
+  /* eslint-enable react-hooks/set-state-in-effect */
+
+  // Filter online eval configs by runtime + endpoint (qualifier)
+  const controlRuntime = wizard.config.controlTargetInfo?.runtimeRef ?? '';
+  const controlEndpoint = wizard.config.controlTargetInfo?.qualifier ?? '';
+  const treatmentRuntime = wizard.config.treatmentTargetInfo?.runtimeRef ?? '';
+  const treatmentEndpoint = wizard.config.treatmentTargetInfo?.qualifier ?? '';
+
+  const controlEvalItems: SelectableItem[] = useMemo(() => {
+    return onlineEvalConfigDetails
+      .filter(c => c.agent === controlRuntime && (c.endpoint ?? 'DEFAULT') === controlEndpoint)
+      .map(c => ({ id: c.name, title: c.name, description: `${c.agent}/${c.endpoint ?? 'DEFAULT'}` }));
+  }, [onlineEvalConfigDetails, controlRuntime, controlEndpoint]);
+
+  const treatmentEvalItems: SelectableItem[] = useMemo(() => {
+    return onlineEvalConfigDetails
+      .filter(c => c.agent === treatmentRuntime && (c.endpoint ?? 'DEFAULT') === treatmentEndpoint)
+      .map(c => ({ id: c.name, title: c.name, description: `${c.agent}/${c.endpoint ?? 'DEFAULT'}` }));
+  }, [onlineEvalConfigDetails, treatmentRuntime, treatmentEndpoint]);
+
+  const controlEvalNoMatch = isEvalSelectStep && evalSelectPhase === 'controlEval' && controlEvalItems.length === 0;
+  const treatmentEvalNoMatch =
+    isEvalSelectStep && evalSelectPhase === 'treatmentEval' && treatmentEvalItems.length === 0;
+
+  const controlEvalNav = useListNavigation({
+    items: controlEvalItems,
+    onSelect: item => {
+      setSelectedControlEval(item.id);
+      setEvalSelectPhase('treatmentEval');
+    },
+    onExit: () => wizard.goBack(),
+    isActive: isEvalSelectStep && evalSelectPhase === 'controlEval' && !controlEvalNoMatch,
+  });
+
+  const treatmentEvalNav = useListNavigation({
+    items: treatmentEvalItems,
+    onSelect: item => {
+      wizard.setEvalSelect(selectedControlEval, item.id);
+    },
+    onExit: () => setEvalSelectPhase('controlEval'),
+    isActive: isEvalSelectStep && evalSelectPhase === 'treatmentEval' && !treatmentEvalNoMatch,
+  });
+
+  const enableNav = useListNavigation({
+    items: enableItems,
+    onSelect: item => wizard.setEnableOnCreate(item.id === 'yes'),
+    onExit: () => wizard.goBack(),
+    isActive: isEnableStep,
+  });
+
+  useListNavigation({
+    items: [{ id: 'confirm', title: 'Confirm' }],
+    onSelect: () => onComplete(wizard.config),
+    onExit: () => wizard.goBack(),
+    isActive: isConfirmStep,
+  });
+
+  // Help text
+  const isSelectStep =
+    isModeStep ||
+    isAgentStep ||
+    (isGatewayStep && !gatewayCreateMode) ||
+    isOnlineEvalStep ||
+    isEnableStep ||
+    isControlTargetStep ||
+    isTreatmentTargetStep ||
+    isEvalPathStep ||
+    isEvalSelectStep;
+  const helpText = isSelectStep
+    ? HELP_TEXT.NAVIGATE_SELECT
+    : isConfirmStep
+      ? HELP_TEXT.CONFIRM_CANCEL
+      : isVariantsStep
+        ? HELP_TEXT.VARIANTS_FORM
+        : HELP_TEXT.TEXT_INPUT;
+
+  const headerContent = <StepIndicator steps={wizard.steps} currentStep={wizard.step} labels={AB_TEST_STEP_LABELS} />;
+
+  const controlWeight = 100 - wizard.config.treatmentWeight;
+
+  // Format target display for confirm review
+  const formatTargetDisplay = (info: TargetInfo | null, isNew: boolean): string => {
+    if (!info) return '(not set)';
+    const newLabel = isNew ? ' (new)' : '';
+    return `${info.name} endpoint=${info.qualifier} runtime=${info.runtimeRef}${newLabel}`;
+  };
+
+  return (
+    <Screen
+      title="Add AB Test [preview]"
+      onExit={onExit}
+      helpText={helpText}
+      headerContent={headerContent}
+      exitEnabled={false}
+    >
+      <Panel fullWidth>
+        {isModeStep && (
+          <WizardSelect
+            title="What type of A/B test do you want to create?"
+            items={modeItems}
+            selectedIndex={modeNav.selectedIndex}
+          />
+        )}
+
+        {isNameStep && (
+          <TextInput
+            key="name"
+            prompt="AB test name"
+            initialValue=""
+            onSubmit={wizard.setName}
+            onCancel={onExit}
+            schema={ABTestNameSchema}
+            customValidation={value => (existingTestNames.includes(value) ? `AB test "${value}" already exists` : true)}
+          />
+        )}
+
+        {isDescriptionStep && (
+          <TextInput
+            key="description"
+            prompt="Description (optional, press Enter to skip)"
+            initialValue=""
+            allowEmpty
+            onSubmit={wizard.setDescription}
+            onCancel={() => wizard.goBack()}
+          />
+        )}
+
+        {isAgentStep && <WizardSelect title="Select agent" items={agentItems} selectedIndex={agentNav.selectedIndex} />}
+
+        {/* ── Step 4: Gateway selection ──────────────────────────── */}
+        {isGatewayStep && !gatewayCreateMode && (
+          <WizardSelect title="Select gateway" items={gatewayItems} selectedIndex={gatewayNav.selectedIndex} />
+        )}
+        {isGatewayStep && gatewayCreateMode && (
+          <TextInput
+            key="gateway-name"
+            prompt="New gateway name"
+            initialValue=""
+            onSubmit={name => {
+              gatewayChoiceTypeRef.current = 'create-new';
+              wizard.setGatewayWithName(name, true);
+              setGatewayCreateMode(false);
+            }}
+            onCancel={() => setGatewayCreateMode(false)}
+          />
+        )}
+
+        {isVariantsStep && (
+          <VariantConfigForm
+            bundleItems={bundleItems}
+            fetchVersionItems={handleFetchVersions}
+            controlVersionItems={controlVersionItems}
+            treatmentVersionItems={treatmentVersionItems}
+            controlVersionLoadState={controlVersionLoadState}
+            treatmentVersionLoadState={treatmentVersionLoadState}
+            onComplete={wizard.setVariants}
+            onCancel={() => wizard.goBack()}
+            onCreateBundle={onCreateBundle}
+          />
+        )}
+
+        {/* ── Step 5: Control target selection ─────────────────── */}
+        {isControlTargetStep && controlSubFlow === 'pick' && (
+          <WizardSelect
+            title="Select control target"
+            items={controlTargetItems}
+            selectedIndex={controlTargetNav.selectedIndex}
+          />
+        )}
+        {isControlTargetStep && controlSubFlow === 'selectRuntime' && (
+          <WizardSelect
+            title="Select runtime for new control target"
+            items={runtimeItems}
+            selectedIndex={controlRuntimeNav.selectedIndex}
+          />
+        )}
+        {isControlTargetStep && controlSubFlow === 'selectQualifier' && (
+          <WizardSelect
+            title={`Select endpoint for control target (runtime: ${controlNewRuntime})`}
+            items={controlEndpointItems}
+            selectedIndex={controlEndpointNav.selectedIndex}
+          />
+        )}
+
+        {/* ── Step 6: Treatment target selection ───────────────── */}
+        {isTreatmentTargetStep && treatmentSubFlow === 'pick' && (
+          <Box flexDirection="column">
+            {wizard.config.controlTargetInfo && (
+              <Box marginBottom={1}>
+                <Text color="green">
+                  {'\u2713'} Control: {wizard.config.controlTargetInfo.name} endpoint=
+                  {wizard.config.controlTargetInfo.qualifier}
+                </Text>
+              </Box>
+            )}
+            <WizardSelect
+              title="Select treatment target"
+              items={treatmentTargetItems}
+              selectedIndex={treatmentTargetNav.selectedIndex}
+            />
+          </Box>
+        )}
+        {isTreatmentTargetStep && treatmentSubFlow === 'selectRuntime' && (
+          <WizardSelect
+            title="Select runtime for new treatment target"
+            items={runtimeItems}
+            selectedIndex={treatmentRuntimeNav.selectedIndex}
+          />
+        )}
+        {isTreatmentTargetStep && treatmentSubFlow === 'selectQualifier' && (
+          <WizardSelect
+            title={`Select endpoint for treatment target (runtime: ${treatmentNewRuntime})`}
+            items={treatmentEndpointItems}
+            selectedIndex={treatmentEndpointNav.selectedIndex}
+          />
+        )}
+
+        {/* ── Target-based: Traffic weights ───────────────────── */}
+        {isWeightsStep && (
+          <TextInput
+            key="weights"
+            prompt="Control weight (1-100, treatment gets the remainder)"
+            initialValue={String(wizard.config.controlWeight)}
+            onSubmit={value => {
+              const w = parseInt(value, 10);
+              if (!isNaN(w) && w >= 1 && w <= 99) {
+                wizard.setWeights(w, 100 - w);
+              }
+            }}
+            onCancel={() => wizard.goBack()}
+            customValidation={value => {
+              const w = parseInt(value, 10);
+              if (isNaN(w)) return 'Must be a number';
+              if (w < 1 || w > 99) return 'Must be between 1 and 99';
+              return true;
+            }}
+          />
+        )}
+
+        {/* ── Target-based: Eval path selection ───────────────── */}
+        {isEvalPathStep && (
+          <WizardSelect
+            title="How do you want to configure evaluation?"
+            items={evalPathItems}
+            selectedIndex={evalPathNav.selectedIndex}
+          />
+        )}
+
+        {/* ── Target-based: Eval select (control) ───────────── */}
+        {isEvalSelectStep && evalSelectPhase === 'controlEval' && !controlEvalNoMatch && (
+          <WizardSelect
+            title={`Select online eval for control (${controlRuntime}/${controlEndpoint})`}
+            items={controlEvalItems}
+            selectedIndex={controlEvalNav.selectedIndex}
+          />
+        )}
+        {isEvalSelectStep && evalSelectPhase === 'controlEval' && controlEvalNoMatch && (
+          <Text color="red">
+            No online eval config found for {controlRuntime}/{controlEndpoint}. Create one first: agentcore add
+            online-eval --runtime {controlRuntime} --endpoint {controlEndpoint}
+          </Text>
+        )}
+
+        {/* ── Target-based: Eval select (treatment) ─────────── */}
+        {isEvalSelectStep && evalSelectPhase === 'treatmentEval' && !treatmentEvalNoMatch && (
+          <Box flexDirection="column">
+            <Box marginBottom={1}>
+              <Text color="green">
+                {'\u2713'} Control eval: {selectedControlEval}
+              </Text>
+            </Box>
+            <WizardSelect
+              title={`Select online eval for treatment (${treatmentRuntime}/${treatmentEndpoint})`}
+              items={treatmentEvalItems}
+              selectedIndex={treatmentEvalNav.selectedIndex}
+            />
+          </Box>
+        )}
+        {isEvalSelectStep && evalSelectPhase === 'treatmentEval' && treatmentEvalNoMatch && (
+          <Text color="red">
+            No online eval config found for {treatmentRuntime}/{treatmentEndpoint}. Create one first: agentcore add
+            online-eval --runtime {treatmentRuntime} --endpoint {treatmentEndpoint}
+          </Text>
+        )}
+
+        {/* ── Config-bundle: Online eval selection ────────────── */}
+        {isOnlineEvalStep &&
+          (onlineEvalItems.length > 0 ? (
+            <WizardSelect
+              title="Select online evaluation config"
+              items={onlineEvalItems}
+              selectedIndex={onlineEvalNav.selectedIndex}
+            />
+          ) : (
+            <Text color="red">
+              No online eval configs found. An online eval is required for AB tests. Add one with `agentcore add
+              online-eval`, then retry. Press Esc to go back.
+            </Text>
+          ))}
+
+        {/* TODO(post-preview): Re-enable maxDuration TextInput once configurable duration is launched. */}
+
+        {isEnableStep && (
+          <WizardSelect
+            title="Enable AB test on creation?"
+            items={enableItems}
+            selectedIndex={enableNav.selectedIndex}
+          />
+        )}
+
+        {isConfirmStep && (
+          <ConfirmReview
+            fields={
+              isTargetBased
+                ? [
+                    { label: 'Mode', value: 'Target-Based' },
+                    { label: 'Name', value: wizard.config.name },
+                    ...(wizard.config.description ? [{ label: 'Description', value: wizard.config.description }] : []),
+                    {
+                      label: 'Gateway',
+                      value: wizard.config.gatewayIsNew
+                        ? `${wizard.config.gateway} (new)`
+                        : wizard.config.gateway || 'Create new (auto)',
+                    },
+                    {
+                      label: 'Control target',
+                      value: formatTargetDisplay(wizard.config.controlTargetInfo, wizard.config.controlTargetIsNew),
+                    },
+                    {
+                      label: 'Treatment target',
+                      value: formatTargetDisplay(wizard.config.treatmentTargetInfo, wizard.config.treatmentTargetIsNew),
+                    },
+                    {
+                      label: 'Traffic split',
+                      value: `Control ${wizard.config.controlWeight}% / Treatment ${100 - wizard.config.controlWeight}%`,
+                    },
+                    {
+                      label: 'Evaluation',
+                      value: `C: ${wizard.config.controlOnlineEval}, T1: ${wizard.config.treatmentOnlineEval}`,
+                    },
+                    { label: 'Enable on create', value: wizard.config.enableOnCreate ? 'Yes' : 'No' },
+                  ]
+                : [
+                    { label: 'Mode', value: 'Config Bundle' },
+                    { label: 'Name', value: wizard.config.name },
+                    ...(wizard.config.description ? [{ label: 'Description', value: wizard.config.description }] : []),
+                    {
+                      label: 'Gateway',
+                      value:
+                        wizard.config.gatewayChoice.type === 'create-new'
+                          ? `Create new for ${wizard.config.agent} (auto)`
+                          : wizard.config.gatewayChoice.name,
+                    },
+                    { label: 'Control bundle', value: wizard.config.controlBundle },
+                    { label: 'Control version', value: wizard.config.controlVersion.slice(0, 8) },
+                    { label: 'Treatment bundle', value: wizard.config.treatmentBundle },
+                    { label: 'Treatment version', value: wizard.config.treatmentVersion.slice(0, 8) },
+                    {
+                      label: 'Traffic split',
+                      value: `Control ${controlWeight}% / Treatment ${wizard.config.treatmentWeight}%`,
+                    },
+                    { label: 'Online eval', value: wizard.config.onlineEval },
+                    { label: 'Enable on create', value: wizard.config.enableOnCreate ? 'Yes' : 'No' },
+                  ]
+            }
+          />
+        )}
+      </Panel>
+    </Screen>
+  );
+}
diff --git a/src/cli/tui/screens/ab-test/RemoveABTestScreen.tsx b/src/cli/tui/screens/ab-test/RemoveABTestScreen.tsx
new file mode 100644
index 000000000..48adc621f
--- /dev/null
+++ b/src/cli/tui/screens/ab-test/RemoveABTestScreen.tsx
@@ -0,0 +1,26 @@
+import type { RemovableResource } from '../../../primitives/types';
+import type { SelectableItem } from '../../components';
+import { SelectScreen } from '../../components';
+import React, { useMemo } from 'react';
+
+interface RemoveABTestScreenProps {
+  abTests: RemovableResource[];
+  onSelect: (testName: string) => void;
+  onExit: () => void;
+}
+
+export function RemoveABTestScreen({ abTests, onSelect, onExit }: RemoveABTestScreenProps) {
+  const items: SelectableItem[] = useMemo(
+    () =>
+      abTests.map(t => ({
+        id: t.name,
+        title: t.name,
+        description: 'AB Test',
+      })),
+    [abTests]
+  );
+
+  return (
+    <SelectScreen title="Select AB Test to Remove" items={items} onSelect={item => onSelect(item.id)} onExit={onExit} />
+  );
+}
diff --git a/src/cli/tui/screens/ab-test/TargetBasedABTestScreen.tsx b/src/cli/tui/screens/ab-test/TargetBasedABTestScreen.tsx
new file mode 100644
index 000000000..60b92dd45
--- /dev/null
+++ b/src/cli/tui/screens/ab-test/TargetBasedABTestScreen.tsx
@@ -0,0 +1,712 @@
+import type { SelectableItem } from '../../components';
+import {
+  ConfirmReview,
+  Cursor,
+  Panel,
+  Screen,
+  StepIndicator,
+  TextInput,
+  TwoColumn,
+  WizardSelect,
+} from '../../components';
+import { HELP_TEXT } from '../../constants';
+import { useListNavigation } from '../../hooks';
+import { usePanelNavigation } from '../../hooks/usePanelNavigation';
+import type { HttpGatewayInfo, OnlineEvalConfigInfo, RuntimeInfo } from './AddABTestScreen';
+import type { AddABTestConfig, TargetInfo } from './types';
+import { TARGET_BASED_STEP_LABELS, useTargetBasedWizard } from './useTargetBasedWizard';
+import { Box, Text, useInput } from 'ink';
+import React, { useCallback, useEffect, useMemo, useState } from 'react';
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Props
+// ─────────────────────────────────────────────────────────────────────────────
+
+interface TargetBasedABTestScreenProps {
+  onComplete: (config: AddABTestConfig) => void;
+  onExit: () => void;
+  existingTestNames: string[];
+  runtimes: RuntimeInfo[];
+  httpGatewayDetails: HttpGatewayInfo[];
+  existingHttpGateways: string[];
+  onlineEvalConfigDetails: OnlineEvalConfigInfo[];
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Builder field indices
+// ─────────────────────────────────────────────────────────────────────────────
+
+const FIELD_TARGET = 0;
+const FIELD_WEIGHT = 1;
+const FIELD_EVAL = 2;
+const FIELD_COUNT = 3;
+
+// ─────────────────────────────────────────────────────────────────────────────
+// VariantColumn sub-component
+// ─────────────────────────────────────────────────────────────────────────────
+
+interface VariantColumnProps {
+  label: string;
+  color: string;
+  isActive: boolean;
+  focusedField: number | null;
+  activeField: number | null;
+  targetInfo: TargetInfo | null;
+  weight: number;
+  evalConfigName: string;
+  targetItems: SelectableItem[];
+  targetNavIndex: number;
+  evalItems: SelectableItem[];
+  evalNavIndex: number;
+  onWeightSubmit: (value: string) => void;
+  onWeightCancel: () => void;
+}
+
+function VariantColumn({
+  label,
+  color,
+  isActive,
+  focusedField,
+  activeField,
+  targetInfo,
+  weight,
+  evalConfigName,
+  targetItems,
+  targetNavIndex,
+  evalItems,
+  evalNavIndex,
+  onWeightSubmit,
+  onWeightCancel,
+}: VariantColumnProps) {
+  const borderColor = isActive ? color : 'gray';
+
+  const fieldLabel = (idx: number, text: string, value: string) => {
+    const isFocused = focusedField === idx;
+    const isFieldActive = activeField === idx;
+    const prefix = isFocused || isFieldActive ? '>' : ' ';
+    const checkmark = value && value !== '(not set)' ? '\u2713 ' : '';
+
+    return (
+      <Box>
+        <Text color={isFocused ? color : undefined} bold={isFocused}>
+          {prefix} {text}:{' '}
+        </Text>
+        <Text color={checkmark ? 'green' : 'gray'}>
+          {checkmark}
+          {value}
+        </Text>
+      </Box>
+    );
+  };
+
+  return (
+    <Box flexDirection="column" borderStyle="round" borderColor={borderColor} paddingX={1}>
+      <Text bold color={color}>
+        {label}
+      </Text>
+      <Box flexDirection="column" marginTop={1}>
+        {/* Target field */}
+        {activeField === FIELD_TARGET ? (
+          <WizardSelect title="Select target" items={targetItems} selectedIndex={targetNavIndex} />
+        ) : (
+          fieldLabel(
+            FIELD_TARGET,
+            'Target',
+            targetInfo ? `${targetInfo.name} (${targetInfo.runtimeRef}/${targetInfo.qualifier})` : '(not set)'
+          )
+        )}
+
+        {/* Weight field */}
+        {activeField === FIELD_WEIGHT ? (
+          <TextInput
+            key="weight"
+            prompt={`${label} weight (1-99)`}
+            initialValue={String(weight)}
+            onSubmit={onWeightSubmit}
+            onCancel={onWeightCancel}
+            customValidation={value => {
+              const w = parseInt(value, 10);
+              if (isNaN(w)) return 'Must be a number';
+              if (w < 1 || w > 99) return 'Must be between 1 and 99';
+              return true;
+            }}
+          />
+        ) : (
+          fieldLabel(FIELD_WEIGHT, 'Weight', `${weight}%`)
+        )}
+
+        {/* Eval config field */}
+        {activeField === FIELD_EVAL ? (
+          evalItems.length > 0 ? (
+            <WizardSelect title="Select eval config" items={evalItems} selectedIndex={evalNavIndex} />
+          ) : (
+            <Box flexDirection="column">
+              <Text color="yellow">No eval config found for this target.</Text>
+              <Text dimColor>Press Esc to go back. Create one with: agentcore add online-eval</Text>
+            </Box>
+          )
+        ) : (
+          fieldLabel(FIELD_EVAL, 'Eval', evalConfigName || '(optional)')
+        )}
+      </Box>
+    </Box>
+  );
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Main Screen
+// ─────────────────────────────────────────────────────────────────────────────
+
+export function TargetBasedABTestScreen({
+  onComplete,
+  onExit,
+  existingTestNames,
+  runtimes,
+  httpGatewayDetails,
+  existingHttpGateways,
+  onlineEvalConfigDetails,
+}: TargetBasedABTestScreenProps) {
+  const wizard = useTargetBasedWizard();
+
+  // ── Name/Description multi-field form ───────────────────────────────────
+  type NameField = 'name' | 'description';
+  const NAME_FIELDS: NameField[] = ['name', 'description'];
+  const [activeNameField, setActiveNameField] = useState<NameField>('name');
+  const [nameValue, setNameValue] = useState('');
+  const [descriptionValue, setDescriptionValue] = useState('');
+  const [nameError, setNameError] = useState<string | null>(null);
+  const [gatewayCreateMode, setGatewayCreateMode] = useState(false);
+
+  // Step flags
+  const isNameStep = wizard.step === 'nameDescription';
+  const isGatewayStep = wizard.step === 'gateway';
+  const isBuilderStep = wizard.step === 'builder';
+  const isEnableStep = wizard.step === 'enableOnCreate';
+  const isConfirmStep = wizard.step === 'confirm';
+
+  // ── Name/Description input handler ─────────────────────────────────────
+  useInput(
+    (input, key) => {
+      if (!isNameStep) return;
+
+      if (key.escape) {
+        if (activeNameField === 'description') {
+          setActiveNameField('name');
+        } else {
+          onExit();
+        }
+        return;
+      }
+
+      if (key.tab || key.upArrow || key.downArrow) {
+        const idx = NAME_FIELDS.indexOf(activeNameField);
+        if (key.shift || key.upArrow) {
+          setActiveNameField(NAME_FIELDS[(idx - 1 + NAME_FIELDS.length) % NAME_FIELDS.length]!);
+        } else {
+          setActiveNameField(NAME_FIELDS[(idx + 1) % NAME_FIELDS.length]!);
+        }
+        setNameError(null);
+        return;
+      }
+
+      if (key.return) {
+        if (activeNameField === 'name') {
+          if (!nameValue.trim()) {
+            setNameError('Name is required');
+            return;
+          }
+          if (!/^[a-zA-Z][a-zA-Z0-9_]{0,47}$/.test(nameValue.trim())) {
+            setNameError('Must begin with a letter, alphanumeric + underscores only (max 48 chars)');
+            return;
+          }
+          if (existingTestNames.includes(nameValue.trim())) {
+            setNameError(`AB test "${nameValue.trim()}" already exists`);
+            return;
+          }
+          setActiveNameField('description');
+          setNameError(null);
+          return;
+        }
+        // On description, submit both
+        if (!nameValue.trim()) {
+          setNameError('Name is required');
+          setActiveNameField('name');
+          return;
+        }
+        wizard.setName(nameValue.trim());
+        wizard.setDescription(descriptionValue.trim());
+        wizard.advanceFromNameDescription();
+        return;
+      }
+
+      // Text input
+      if (key.backspace || key.delete) {
+        if (activeNameField === 'name') setNameValue(v => v.slice(0, -1));
+        else setDescriptionValue(v => v.slice(0, -1));
+        setNameError(null);
+        return;
+      }
+      if (input && !key.ctrl && !key.meta) {
+        if (activeNameField === 'name') setNameValue(v => v + input);
+        else setDescriptionValue(v => v + input);
+        setNameError(null);
+      }
+    },
+    { isActive: isNameStep }
+  );
+
+  // ── Gateway items ───────────────────────────────────────────────────────
+  const gatewayItems: SelectableItem[] = useMemo(() => {
+    const items: SelectableItem[] = [];
+    for (const gwName of existingHttpGateways) {
+      items.push({ id: gwName, title: gwName, description: 'Existing HTTP gateway' });
+    }
+    items.push({
+      id: '__create__',
+      title: 'Create new gateway',
+      description: 'Auto-create for this AB test',
+    });
+    return items;
+  }, [existingHttpGateways]);
+
+  // ── Target items builder ────────────────────────────────────────────────
+  const buildTargetItems = useCallback(
+    (excludeTarget: TargetInfo | null): SelectableItem[] => {
+      const items: SelectableItem[] = [];
+
+      // Section 1: Existing targets on the selected gateway
+      const selectedGw = httpGatewayDetails.find(g => g.name === wizard.config.gateway);
+      const existingTargets = selectedGw?.targets ?? [];
+      if (existingTargets.length > 0) {
+        items.push({
+          id: '__section_existing__',
+          title: '── Gateway Targets ──',
+          description: '',
+          disabled: true,
+        });
+        for (const t of existingTargets) {
+          if (t.name === excludeTarget?.name) continue;
+          items.push({
+            id: `existing:${t.name}`,
+            title: t.name,
+            description: `${t.runtimeRef}/${t.qualifier}`,
+          });
+        }
+      }
+
+      // Section 2: Runtime endpoints (auto-create targets)
+      const endpointItems: SelectableItem[] = [];
+      for (const rt of runtimes) {
+        for (const ep of rt.endpoints) {
+          const targetName = `${rt.name}-${ep.name}`;
+          if (targetName === excludeTarget?.name) continue;
+          endpointItems.push({
+            id: `endpoint:${rt.name}/${ep.name}`,
+            title: `${rt.name}/${ep.name}`,
+            description: `v${ep.version}`,
+          });
+        }
+      }
+      if (endpointItems.length > 0) {
+        items.push({
+          id: '__section_endpoints__',
+          title: '── Runtime Endpoints ──\n   Select to auto-create target',
+          description: '',
+          disabled: true,
+          spaceBefore: items.length > 0,
+        });
+        items.push(...endpointItems);
+      }
+
+      return items;
+    },
+    [httpGatewayDetails, runtimes, wizard.config.gateway]
+  );
+
+  const controlTargetItems = useMemo(() => buildTargetItems(null), [buildTargetItems]);
+  const treatmentTargetItems = useMemo(
+    () => buildTargetItems(wizard.config.controlTargetInfo),
+    [buildTargetItems, wizard.config.controlTargetInfo]
+  );
+
+  // ── Eval items (auto-matched by runtime + endpoint) ─────────────────────
+  const buildEvalItems = useCallback(
+    (targetInfo: TargetInfo | null): SelectableItem[] => {
+      if (!targetInfo) return [];
+      return onlineEvalConfigDetails
+        .filter(c => c.agent === targetInfo.runtimeRef && (c.endpoint ?? 'DEFAULT') === targetInfo.qualifier)
+        .map(c => ({ id: c.name, title: c.name, description: `${c.agent}/${c.endpoint ?? 'DEFAULT'}` }));
+    },
+    [onlineEvalConfigDetails]
+  );
+
+  const controlEvalItems = useMemo(
+    () => buildEvalItems(wizard.config.controlTargetInfo),
+    [buildEvalItems, wizard.config.controlTargetInfo]
+  );
+  const treatmentEvalItems = useMemo(
+    () => buildEvalItems(wizard.config.treatmentTargetInfo),
+    [buildEvalItems, wizard.config.treatmentTargetInfo]
+  );
+
+  // Auto-match eval when target is selected and exactly one match exists
+  useEffect(() => {
+    if (wizard.config.controlTargetInfo && controlEvalItems.length === 1 && !wizard.config.controlOnlineEval) {
+      wizard.setControlEval(controlEvalItems[0]!.id);
+    }
+  }, [wizard.config.controlTargetInfo, controlEvalItems, wizard.config.controlOnlineEval, wizard.setControlEval]);
+
+  useEffect(() => {
+    if (wizard.config.treatmentTargetInfo && treatmentEvalItems.length === 1 && !wizard.config.treatmentOnlineEval) {
+      wizard.setTreatmentEval(treatmentEvalItems[0]!.id);
+    }
+  }, [
+    wizard.config.treatmentTargetInfo,
+    treatmentEvalItems,
+    wizard.config.treatmentOnlineEval,
+    wizard.setTreatmentEval,
+  ]);
+
+  // ── Enable items ────────────────────────────────────────────────────────
+  const enableItems: SelectableItem[] = useMemo(
+    () => [
+      { id: 'yes', title: 'Yes', description: 'Start the AB test immediately after deploy' },
+      { id: 'no', title: 'No', description: 'Create paused — start manually later' },
+    ],
+    []
+  );
+
+  // ── Panel navigation for the builder step ───────────────────────────────
+  const panel = usePanelNavigation({
+    isActive: isBuilderStep,
+    fieldCount: FIELD_COUNT,
+    onExit: () => wizard.goBack(),
+    onComplete: () => wizard.advance(),
+  });
+
+  // ── Target selection handler ────────────────────────────────────────────
+  const handleTargetSelect = useCallback(
+    (column: number, item: SelectableItem) => {
+      const setter = column === 0 ? wizard.setControlTarget : wizard.setTreatmentTarget;
+
+      if (item.id.startsWith('existing:')) {
+        const targetName = item.id.replace('existing:', '');
+        const selectedGw = httpGatewayDetails.find(g => g.name === wizard.config.gateway);
+        const target = selectedGw?.targets.find(t => t.name === targetName);
+        if (target) {
+          setter({ name: target.name, runtimeRef: target.runtimeRef, qualifier: target.qualifier }, false);
+        }
+      } else if (item.id.startsWith('endpoint:')) {
+        const path = item.id.replace('endpoint:', '');
+        const [runtimeName, endpointName] = path.split('/');
+        if (runtimeName && endpointName) {
+          const autoName = `${runtimeName}-${endpointName}`;
+          setter({ name: autoName, runtimeRef: runtimeName, qualifier: endpointName }, true);
+        }
+      }
+      panel.deactivate();
+    },
+    [httpGatewayDetails, wizard.config.gateway, wizard.setControlTarget, wizard.setTreatmentTarget, panel]
+  );
+
+  // ── List navigations for builder pickers ────────────────────────────────
+
+  // Control target picker
+  const controlTargetNav = useListNavigation({
+    items: controlTargetItems,
+    onSelect: item => handleTargetSelect(0, item),
+    onExit: () => panel.deactivate(),
+    isActive: panel.isFieldActive(0, FIELD_TARGET),
+    isDisabled: item => item.disabled === true,
+  });
+
+  // Treatment target picker
+  const treatmentTargetNav = useListNavigation({
+    items: treatmentTargetItems,
+    onSelect: item => handleTargetSelect(1, item),
+    onExit: () => panel.deactivate(),
+    isActive: panel.isFieldActive(1, FIELD_TARGET),
+    isDisabled: item => item.disabled === true,
+  });
+
+  // Control eval picker
+  const controlEvalNav = useListNavigation({
+    items: controlEvalItems,
+    onSelect: item => {
+      wizard.setControlEval(item.id);
+      panel.deactivate();
+    },
+    onExit: () => panel.deactivate(),
+    isActive: panel.isFieldActive(0, FIELD_EVAL),
+  });
+
+  // Treatment eval picker
+  const treatmentEvalNav = useListNavigation({
+    items: treatmentEvalItems,
+    onSelect: item => {
+      wizard.setTreatmentEval(item.id);
+      panel.deactivate();
+    },
+    onExit: () => panel.deactivate(),
+    isActive: panel.isFieldActive(1, FIELD_EVAL),
+  });
+
+  // ── Non-builder navigation hooks ────────────────────────────────────────
+
+  const gatewayNav = useListNavigation({
+    items: gatewayItems,
+    onSelect: item => {
+      if (item.id === '__create__') {
+        setGatewayCreateMode(true);
+        return;
+      }
+      wizard.setGateway(item.id, false);
+    },
+    onExit: () => wizard.goBack(),
+    isActive: isGatewayStep && !gatewayCreateMode,
+    isDisabled: item => item.disabled === true,
+  });
+
+  const enableNav = useListNavigation({
+    items: enableItems,
+    onSelect: item => wizard.setEnableOnCreate(item.id === 'yes'),
+    onExit: () => wizard.goBack(),
+    isActive: isEnableStep,
+  });
+
+  // Builder "Continue" navigation — when all fields filled, Enter on confirm row advances
+  const builderContinueItems: SelectableItem[] = useMemo(
+    () => (wizard.isBuilderComplete ? [{ id: 'continue', title: 'Continue' }] : []),
+    [wizard.isBuilderComplete]
+  );
+
+  const _builderContinueNav = useListNavigation({
+    items: builderContinueItems,
+    onSelect: () => wizard.advance(),
+    onExit: () => wizard.goBack(),
+    isActive: false, // Controlled programmatically below
+  });
+
+  useListNavigation({
+    items: [{ id: 'confirm', title: 'Confirm' }],
+    onSelect: () => onComplete(wizard.toAddABTestConfig()),
+    onExit: () => wizard.goBack(),
+    isActive: isConfirmStep,
+  });
+
+  // ── Help text ───────────────────────────────────────────────────────────
+  const isSelectStep = (isGatewayStep && !gatewayCreateMode) || isEnableStep;
+  const helpText = isSelectStep
+    ? HELP_TEXT.NAVIGATE_SELECT
+    : isConfirmStep
+      ? HELP_TEXT.CONFIRM_CANCEL
+      : isBuilderStep
+        ? 'Tab switch column \u00B7 \u2191\u2193 navigate \u00B7 Enter select \u00B7 Esc back'
+        : HELP_TEXT.TEXT_INPUT;
+
+  const headerContent = (
+    <StepIndicator steps={wizard.steps} currentStep={wizard.step} labels={TARGET_BASED_STEP_LABELS} />
+  );
+
+  // ── Format display helpers ──────────────────────────────────────────────
+  const formatTargetDisplay = (info: TargetInfo | null, isNew: boolean): string => {
+    if (!info) return '(not set)';
+    const newLabel = isNew ? ' (new)' : '';
+    return `${info.name} endpoint=${info.qualifier} runtime=${info.runtimeRef}${newLabel}`;
+  };
+
+  // ── Weight submit handlers ──────────────────────────────────────────────
+  const handleControlWeightSubmit = useCallback(
+    (value: string) => {
+      const w = parseInt(value, 10);
+      if (!isNaN(w) && w >= 1 && w <= 99) {
+        wizard.setControlWeight(w);
+      }
+      panel.deactivate();
+    },
+    [wizard, panel]
+  );
+
+  const handleTreatmentWeightSubmit = useCallback(
+    (value: string) => {
+      const w = parseInt(value, 10);
+      if (!isNaN(w) && w >= 1 && w <= 99) {
+        // Treatment weight setter: set control to 100 - treatment
+        wizard.setControlWeight(100 - w);
+      }
+      panel.deactivate();
+    },
+    [wizard, panel]
+  );
+
+  const handleWeightCancel = useCallback(() => {
+    panel.deactivate();
+  }, [panel]);
+
+  return (
+    <Screen
+      title="Add AB Test — Target-Based"
+      onExit={onExit}
+      helpText={helpText}
+      headerContent={headerContent}
+      exitEnabled={false}
+    >
+      <Panel fullWidth>
+        {/* ── Step 1: Name + Description ─────────────────────── */}
+        {isNameStep && (
+          <Box flexDirection="column">
+            <Box>
+              <Text color={activeNameField === 'name' ? 'cyan' : 'gray'}>{'Name: '}</Text>
+              {activeNameField === 'name' && !nameValue && <Cursor />}
+              <Text color={activeNameField === 'name' ? undefined : 'gray'}>
+                {nameValue || <Text dimColor>{'e.g., my-ab-test'}</Text>}
+              </Text>
+              {activeNameField === 'name' && nameValue ? <Cursor /> : null}
+            </Box>
+            <Box>
+              <Text color={activeNameField === 'description' ? 'cyan' : 'gray'}>{'Description: '}</Text>
+              {activeNameField === 'description' && !descriptionValue && <Cursor />}
+              <Text color={activeNameField === 'description' ? undefined : 'gray'}>
+                {descriptionValue || <Text dimColor>{'(optional)'}</Text>}
+              </Text>
+              {activeNameField === 'description' && descriptionValue ? <Cursor /> : null}
+            </Box>
+            {nameError && (
+              <Box marginTop={1}>
+                <Text color="red">{nameError}</Text>
+              </Box>
+            )}
+          </Box>
+        )}
+
+        {/* ── Step 2: Gateway ────────────────────────────────── */}
+        {isGatewayStep && !gatewayCreateMode && (
+          <WizardSelect title="Select gateway" items={gatewayItems} selectedIndex={gatewayNav.selectedIndex} />
+        )}
+        {isGatewayStep && gatewayCreateMode && (
+          <TextInput
+            key="tb-gateway-name"
+            prompt="New gateway name"
+            initialValue=""
+            onSubmit={name => {
+              wizard.setGateway(name, true);
+              setGatewayCreateMode(false);
+            }}
+            onCancel={() => setGatewayCreateMode(false)}
+          />
+        )}
+
+        {/* ── Step 3: Side-by-Side Builder ───────────────────── */}
+        {isBuilderStep && (
+          <Box flexDirection="column">
+            <TwoColumn
+              left={
+                <VariantColumn
+                  label="CONTROL"
+                  color="cyan"
+                  isActive={panel.isColumnActive(0)}
+                  focusedField={
+                    panel.position.layer === 'focus' && panel.position.column === 0 ? panel.position.field : null
+                  }
+                  activeField={
+                    panel.position.layer === 'active' && panel.position.column === 0 ? panel.position.field : null
+                  }
+                  targetInfo={wizard.config.controlTargetInfo}
+                  weight={wizard.config.controlWeight}
+                  evalConfigName={wizard.config.controlOnlineEval}
+                  targetItems={controlTargetItems}
+                  targetNavIndex={controlTargetNav.selectedIndex}
+                  evalItems={controlEvalItems}
+                  evalNavIndex={controlEvalNav.selectedIndex}
+                  onWeightSubmit={handleControlWeightSubmit}
+                  onWeightCancel={handleWeightCancel}
+                />
+              }
+              right={
+                <VariantColumn
+                  label="TREATMENT"
+                  color="yellow"
+                  isActive={panel.isColumnActive(1)}
+                  focusedField={
+                    panel.position.layer === 'focus' && panel.position.column === 1 ? panel.position.field : null
+                  }
+                  activeField={
+                    panel.position.layer === 'active' && panel.position.column === 1 ? panel.position.field : null
+                  }
+                  targetInfo={wizard.config.treatmentTargetInfo}
+                  weight={wizard.config.treatmentWeight}
+                  evalConfigName={wizard.config.treatmentOnlineEval}
+                  targetItems={treatmentTargetItems}
+                  targetNavIndex={treatmentTargetNav.selectedIndex}
+                  evalItems={treatmentEvalItems}
+                  evalNavIndex={treatmentEvalNav.selectedIndex}
+                  onWeightSubmit={handleTreatmentWeightSubmit}
+                  onWeightCancel={handleWeightCancel}
+                />
+              }
+            />
+            {wizard.isBuilderComplete && (
+              <Box marginTop={1}>
+                <Text color="green">
+                  {'\u2713'} All fields configured. Press Enter to continue, or adjust values above.
+                </Text>
+              </Box>
+            )}
+            {!wizard.isBuilderComplete && (
+              <Box marginTop={1}>
+                <Text dimColor>Configure both columns, then press Enter to continue.</Text>
+              </Box>
+            )}
+          </Box>
+        )}
+
+        {/* ── Step 4: Enable on Create ───────────────────────── */}
+        {isEnableStep && (
+          <WizardSelect
+            title="Enable AB test on creation?"
+            items={enableItems}
+            selectedIndex={enableNav.selectedIndex}
+          />
+        )}
+
+        {/* ── Step 5: Confirm ────────────────────────────────── */}
+        {isConfirmStep && (
+          <ConfirmReview
+            fields={[
+              { label: 'Mode', value: 'Target-Based' },
+              { label: 'Name', value: wizard.config.name },
+              ...(wizard.config.description ? [{ label: 'Description', value: wizard.config.description }] : []),
+              {
+                label: 'Gateway',
+                value: wizard.config.gatewayIsNew
+                  ? `${wizard.config.gateway} (new)`
+                  : wizard.config.gateway || 'Create new (auto)',
+              },
+              {
+                label: 'Control target',
+                value: formatTargetDisplay(wizard.config.controlTargetInfo, wizard.config.controlTargetIsNew),
+              },
+              {
+                label: 'Treatment target',
+                value: formatTargetDisplay(wizard.config.treatmentTargetInfo, wizard.config.treatmentTargetIsNew),
+              },
+              {
+                label: 'Traffic split',
+                value: `Control ${wizard.config.controlWeight}% / Treatment ${wizard.config.treatmentWeight}%`,
+              },
+              ...(wizard.config.controlOnlineEval || wizard.config.treatmentOnlineEval
+                ? [
+                    {
+                      label: 'Evaluation',
+                      value: `C: ${wizard.config.controlOnlineEval || '(none)'}, T: ${wizard.config.treatmentOnlineEval || '(none)'}`,
+                    },
+                  ]
+                : []),
+              { label: 'Enable on create', value: wizard.config.enableOnCreate ? 'Yes' : 'No' },
+            ]}
+          />
+        )}
+      </Panel>
+    </Screen>
+  );
+}
diff --git a/src/cli/tui/screens/ab-test/VariantConfigForm.tsx b/src/cli/tui/screens/ab-test/VariantConfigForm.tsx
new file mode 100644
index 000000000..61f465323
--- /dev/null
+++ b/src/cli/tui/screens/ab-test/VariantConfigForm.tsx
@@ -0,0 +1,268 @@
+import type { SelectableItem } from '../../components';
+import { TextInput, WizardSelect } from '../../components';
+import { useListNavigation } from '../../hooks';
+import { Box, Text } from 'ink';
+import React, { useCallback, useMemo, useState } from 'react';
+
+type VariantSubField = 'controlBundle' | 'controlVersion' | 'treatmentBundle' | 'treatmentVersion' | 'treatmentWeight';
+
+const SUB_FIELDS: VariantSubField[] = [
+  'controlBundle',
+  'controlVersion',
+  'treatmentBundle',
+  'treatmentVersion',
+  'treatmentWeight',
+];
+
+export interface VariantConfig {
+  controlBundle: string;
+  controlVersion: string;
+  treatmentBundle: string;
+  treatmentVersion: string;
+  treatmentWeight: number;
+}
+
+export type VersionLoadState = 'idle' | 'loading' | 'loaded' | 'error';
+
+interface VariantConfigFormProps {
+  bundleItems: SelectableItem[];
+  fetchVersionItems: (bundleName: string) => void;
+  controlVersionItems: SelectableItem[];
+  treatmentVersionItems: SelectableItem[];
+  controlVersionLoadState: VersionLoadState;
+  treatmentVersionLoadState: VersionLoadState;
+  onComplete: (config: VariantConfig) => void;
+  onCancel: () => void;
+  onCreateBundle?: () => void;
+}
+
+export function VariantConfigForm({
+  bundleItems,
+  fetchVersionItems,
+  controlVersionItems,
+  treatmentVersionItems,
+  controlVersionLoadState,
+  treatmentVersionLoadState,
+  onComplete,
+  onCancel,
+  onCreateBundle,
+}: VariantConfigFormProps) {
+  const [activeField, setActiveField] = useState<VariantSubField>('controlBundle');
+  const [controlBundle, setControlBundle] = useState('');
+  const [controlVersion, setControlVersion] = useState('');
+  const [treatmentBundle, setTreatmentBundle] = useState('');
+  const [treatmentVersion, setTreatmentVersion] = useState('');
+  const [treatmentWeight, setTreatmentWeight] = useState('20');
+
+  const augmentedBundleItems: SelectableItem[] = useMemo(() => {
+    const items: SelectableItem[] = [];
+    if (onCreateBundle) {
+      items.push({ id: '__create_bundle__', title: 'Create new config bundle', description: 'Add a new bundle first' });
+    }
+    items.push(...bundleItems);
+    return items;
+  }, [bundleItems, onCreateBundle]);
+
+  const advanceField = useCallback(() => {
+    const idx = SUB_FIELDS.indexOf(activeField);
+    const next = SUB_FIELDS[idx + 1];
+    if (next) setActiveField(next);
+  }, [activeField]);
+
+  // Navigation for each select sub-field
+  const controlBundleNav = useListNavigation({
+    items: augmentedBundleItems,
+    onSelect: item => {
+      if (item.id === '__create_bundle__') {
+        onCreateBundle?.();
+        return;
+      }
+      setControlBundle(item.id);
+      fetchVersionItems(item.id);
+      advanceField();
+    },
+    onExit: onCancel,
+    isActive: activeField === 'controlBundle',
+  });
+
+  const controlVersionNav = useListNavigation({
+    items: controlVersionItems,
+    onSelect: item => {
+      setControlVersion(item.id);
+      advanceField();
+    },
+    onExit: () => setActiveField('controlBundle'),
+    isActive: activeField === 'controlVersion' && controlVersionLoadState === 'loaded',
+  });
+
+  const treatmentBundleNav = useListNavigation({
+    items: augmentedBundleItems,
+    onSelect: item => {
+      if (item.id === '__create_bundle__') {
+        onCreateBundle?.();
+        return;
+      }
+      setTreatmentBundle(item.id);
+      fetchVersionItems(item.id);
+      advanceField();
+    },
+    onExit: () => setActiveField('controlVersion'),
+    isActive: activeField === 'treatmentBundle',
+  });
+
+  const treatmentVersionNav = useListNavigation({
+    items: treatmentVersionItems,
+    onSelect: item => {
+      setTreatmentVersion(item.id);
+      advanceField();
+    },
+    onExit: () => setActiveField('treatmentBundle'),
+    isActive: activeField === 'treatmentVersion' && treatmentVersionLoadState === 'loaded',
+  });
+
+  const controlWeight = 100 - parseInt(treatmentWeight || '0', 10);
+
+  const completedValue = (value: string, label: string) => (
+    <Box>
+      <Text dimColor>{label}: </Text>
+      <Text color="green">{value || '(pending)'}</Text>
+      {value && <Text color="green"> ✓</Text>}
+    </Box>
+  );
+
+  const pendingValue = (label: string) => (
+    <Box>
+      <Text dimColor>{label}: </Text>
+      <Text dimColor>(pending)</Text>
+    </Box>
+  );
+
+  const renderVersionField = (
+    isActive: boolean,
+    loadState: VersionLoadState,
+    items: SelectableItem[],
+    nav: { selectedIndex: number },
+    title: string,
+    completedVersion: string,
+    label: string
+  ) => {
+    if (!isActive) {
+      return completedVersion ? completedValue(completedVersion.slice(0, 8), label) : pendingValue(label);
+    }
+
+    switch (loadState) {
+      case 'loading':
+        return <Text dimColor>{label}: Loading versions...</Text>;
+      case 'error':
+        return <Text color="red">{label}: Failed to load versions. Press Esc to go back and retry.</Text>;
+      case 'loaded':
+        if (items.length === 0) {
+          return <Text color="red">{label}: No versions found. Deploy the config bundle first.</Text>;
+        }
+        return <WizardSelect title={title} items={items} selectedIndex={nav.selectedIndex} />;
+      default:
+        return <Text dimColor>{label}: Waiting...</Text>;
+    }
+  };
+
+  return (
+    <Box flexDirection="column">
+      <Text bold>Configure Variants</Text>
+
+      {/* Control section */}
+      <Box marginTop={1} flexDirection="column">
+        <Text bold color="cyan">
+          Control (C):
+        </Text>
+
+        {activeField === 'controlBundle' ? (
+          augmentedBundleItems.length > 0 ? (
+            <WizardSelect
+              title="  Select control bundle"
+              items={augmentedBundleItems}
+              selectedIndex={controlBundleNav.selectedIndex}
+            />
+          ) : (
+            <Text color="red"> No deployed config bundles found.</Text>
+          )
+        ) : (
+          completedValue(controlBundle, '  Bundle')
+        )}
+
+        {renderVersionField(
+          activeField === 'controlVersion',
+          controlVersionLoadState,
+          controlVersionItems,
+          controlVersionNav,
+          '  Select control version',
+          controlVersion,
+          '  Version'
+        )}
+      </Box>
+
+      {/* Treatment section */}
+      <Box marginTop={1} flexDirection="column">
+        <Text bold color="yellow">
+          Treatment (T1):
+        </Text>
+
+        {activeField === 'treatmentBundle' ? (
+          <WizardSelect
+            title="  Select treatment bundle"
+            items={augmentedBundleItems}
+            selectedIndex={treatmentBundleNav.selectedIndex}
+          />
+        ) : treatmentBundle ? (
+          completedValue(treatmentBundle, '  Bundle')
+        ) : (
+          pendingValue('  Bundle')
+        )}
+
+        {renderVersionField(
+          activeField === 'treatmentVersion',
+          treatmentVersionLoadState,
+          treatmentVersionItems,
+          treatmentVersionNav,
+          '  Select treatment version',
+          treatmentVersion,
+          '  Version'
+        )}
+
+        {activeField === 'treatmentWeight' ? (
+          <Box flexDirection="column">
+            <TextInput
+              key="weight"
+              prompt={`  Treatment weight (1-99) — control will be ${controlWeight}%`}
+              initialValue="20"
+              onChange={value => setTreatmentWeight(value)}
+              onSubmit={value => {
+                const n = parseInt(value, 10);
+                if (!isNaN(n) && n >= 1 && n <= 99) {
+                  setTreatmentWeight(value);
+                  onComplete({
+                    controlBundle,
+                    controlVersion,
+                    treatmentBundle,
+                    treatmentVersion,
+                    treatmentWeight: n,
+                  });
+                }
+              }}
+              onCancel={() => setActiveField('treatmentVersion')}
+              customValidation={(value: string) => {
+                const n = parseInt(value, 10);
+                if (isNaN(n)) return 'Must be a number';
+                if (n < 1 || n > 99) return 'Must be between 1 and 99';
+                return true;
+              }}
+            />
+          </Box>
+        ) : treatmentWeight && treatmentVersion ? (
+          completedValue(`${treatmentWeight}% (control: ${controlWeight}%)`, '  Weight')
+        ) : (
+          pendingValue('  Weight')
+        )}
+      </Box>
+    </Box>
+  );
+}
diff --git a/src/cli/tui/screens/ab-test/__tests__/useAddABTestWizard.test.tsx b/src/cli/tui/screens/ab-test/__tests__/useAddABTestWizard.test.tsx
new file mode 100644
index 000000000..082d7662b
--- /dev/null
+++ b/src/cli/tui/screens/ab-test/__tests__/useAddABTestWizard.test.tsx
@@ -0,0 +1,286 @@
+import type { VariantConfig } from '../VariantConfigForm';
+import type { GatewayChoice } from '../types';
+import type { StepSkipCheck } from '../useAddABTestWizard';
+import { useAddABTestWizard } from '../useAddABTestWizard';
+import { Text } from 'ink';
+import { render } from 'ink-testing-library';
+import React, { act, useImperativeHandle } from 'react';
+import { describe, expect, it } from 'vitest';
+
+// ── Simple harness ─────────────────────────────────────────────────────────
+
+function Harness() {
+  const wizard = useAddABTestWizard();
+  return (
+    <Text>
+      step:{wizard.step}
+      name:{wizard.config.name}
+      treatmentWeight:{wizard.config.treatmentWeight}
+      enableOnCreate:{String(wizard.config.enableOnCreate)}
+      steps:{wizard.steps.join(',')}
+    </Text>
+  );
+}
+
+// ── Imperative harness ─────────────────────────────────────────────────────
+
+interface HarnessHandle {
+  setName: (name: string) => void;
+  setDescription: (desc: string) => void;
+  setAgent: (agent: string) => void;
+  setGateway: (choice: GatewayChoice) => void;
+  setVariants: (vc: VariantConfig) => void;
+  setOnlineEval: (eval_: string) => void;
+  setMaxDuration: (days: number | undefined) => void;
+  setEnableOnCreate: (enable: boolean) => void;
+  setSkipCheck: (check: StepSkipCheck) => void;
+  goBack: () => void;
+  reset: () => void;
+}
+
+const ImperativeHarness = React.forwardRef<HarnessHandle>((_, ref) => {
+  const wizard = useAddABTestWizard();
+  useImperativeHandle(ref, () => ({
+    setName: wizard.setName,
+    setDescription: wizard.setDescription,
+    setAgent: wizard.setAgent,
+    setGateway: wizard.setGateway,
+    setVariants: wizard.setVariants,
+    setOnlineEval: wizard.setOnlineEval,
+    setMaxDuration: wizard.setMaxDuration,
+    setEnableOnCreate: wizard.setEnableOnCreate,
+    setSkipCheck: wizard.setSkipCheck,
+    goBack: wizard.goBack,
+    reset: wizard.reset,
+  }));
+  return (
+    <Text>
+      step:{wizard.step}
+      name:{wizard.config.name}
+      description:{wizard.config.description}
+      agent:{wizard.config.agent}
+      controlBundle:{wizard.config.controlBundle}
+      treatmentWeight:{wizard.config.treatmentWeight}
+      onlineEval:{wizard.config.onlineEval}
+      maxDuration:{String(wizard.config.maxDuration ?? 'undefined')}
+      enableOnCreate:{String(wizard.config.enableOnCreate)}
+    </Text>
+  );
+});
+ImperativeHarness.displayName = 'ImperativeHarness';
+
+// ── Tests ──────────────────────────────────────────────────────────────────
+
+describe('useAddABTestWizard', () => {
+  describe('defaults', () => {
+    it('default step is mode', () => {
+      const { lastFrame } = render(<Harness />);
+      expect(lastFrame()).toContain('step:mode');
+    });
+
+    it('default treatment weight is 20', () => {
+      const { lastFrame } = render(<Harness />);
+      expect(lastFrame()).toContain('treatmentWeight:20');
+    });
+
+    it('default enableOnCreate is true', () => {
+      const { lastFrame } = render(<Harness />);
+      expect(lastFrame()).toContain('enableOnCreate:true');
+    });
+
+    it('has all 10 steps', () => {
+      const { lastFrame } = render(<Harness />);
+      const frame = lastFrame()!.replace(/\n/g, '');
+      expect(frame).toContain(
+        'steps:mode,name,description,gateway,agent,variants,onlineEval,maxDuration,enableOnCreate,confirm'
+      );
+    });
+  });
+
+  describe('step navigation', () => {
+    it('setName advances to description', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.setName('Test1'));
+
+      expect(lastFrame()).toContain('step:description');
+      expect(lastFrame()).toContain('name:Test1');
+    });
+
+    it('setDescription advances to gateway', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.setName('Test1'));
+      act(() => ref.current!.setDescription('desc'));
+
+      expect(lastFrame()).toContain('step:gateway');
+      expect(lastFrame()).toContain('description:desc');
+    });
+
+    it('setGateway advances to agent', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.setName('T'));
+      act(() => ref.current!.setDescription(''));
+      act(() => ref.current!.setGateway({ type: 'create-new' }));
+
+      expect(lastFrame()).toContain('step:agent');
+    });
+
+    it('setAgent advances to variants', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.setName('T'));
+      act(() => ref.current!.setDescription(''));
+      act(() => ref.current!.setGateway({ type: 'create-new' }));
+      act(() => ref.current!.setAgent('my-agent'));
+
+      expect(lastFrame()).toContain('step:variants');
+      expect(lastFrame()).toContain('agent:my-agent');
+    });
+
+    it('setVariants advances to onlineEval', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.setName('T'));
+      act(() => ref.current!.setDescription(''));
+      act(() => ref.current!.setGateway({ type: 'create-new' }));
+      act(() => ref.current!.setAgent('my-agent'));
+      act(() =>
+        ref.current!.setVariants({
+          controlBundle: 'cb',
+          controlVersion: 'v1',
+          treatmentBundle: 'tb',
+          treatmentVersion: 'v2',
+          treatmentWeight: 30,
+        })
+      );
+
+      expect(lastFrame()).toContain('step:onlineEval');
+      expect(lastFrame()).toContain('controlBundle:cb');
+      expect(lastFrame()).toContain('treatmentWeight:30');
+    });
+
+    it('full wizard reaches confirm step', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.setName('T'));
+      act(() => ref.current!.setDescription(''));
+      act(() => ref.current!.setGateway({ type: 'create-new' }));
+      act(() => ref.current!.setAgent('my-agent'));
+      act(() =>
+        ref.current!.setVariants({
+          controlBundle: 'cb',
+          controlVersion: 'v1',
+          treatmentBundle: 'tb',
+          treatmentVersion: 'v2',
+          treatmentWeight: 25,
+        })
+      );
+      act(() => ref.current!.setOnlineEval('eval-arn'));
+      act(() => ref.current!.setMaxDuration(30));
+      act(() => ref.current!.setEnableOnCreate(false));
+
+      const frame = lastFrame()!.replace(/\n/g, '');
+      expect(frame).toContain('step:confirm');
+      expect(frame).toContain('enableOnCreate:false');
+      expect(frame).toContain('maxDuration:30');
+    });
+  });
+
+  describe('goBack', () => {
+    it('goes back from description to name', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.setName('T'));
+      expect(lastFrame()).toContain('step:description');
+
+      act(() => ref.current!.goBack());
+      expect(lastFrame()).toContain('step:name');
+    });
+
+    it('does not go back from first step', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.goBack());
+      expect(lastFrame()).toContain('step:mode');
+    });
+  });
+
+  describe('reset', () => {
+    it('resets to initial state', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.setName('Test1'));
+      act(() => ref.current!.setDescription('desc'));
+      expect(lastFrame()).toContain('step:gateway');
+
+      act(() => ref.current!.reset());
+
+      expect(lastFrame()).toContain('step:mode');
+      expect(lastFrame()).toContain('name:');
+      expect(lastFrame()).toContain('treatmentWeight:20');
+    });
+  });
+
+  describe('skip check', () => {
+    it('advance skips over steps marked as skippable', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.setSkipCheck(s => s === 'gateway'));
+      act(() => ref.current!.setName('T'));
+      act(() => ref.current!.setDescription(''));
+      act(() => ref.current!.setAgent('my-agent'));
+
+      expect(lastFrame()).toContain('step:variants');
+    });
+
+    it('goBack skips over steps marked as skippable', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.setName('T'));
+      act(() => ref.current!.setDescription(''));
+      act(() => ref.current!.setGateway({ type: 'create-new' }));
+      act(() => ref.current!.setAgent('my-agent'));
+      expect(lastFrame()).toContain('step:variants');
+
+      act(() => ref.current!.setSkipCheck(s => s === 'agent'));
+      act(() => ref.current!.goBack());
+
+      expect(lastFrame()).toContain('step:gateway');
+    });
+
+    it('advance skips multiple consecutive skippable steps', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.setSkipCheck(s => s === 'agent' || s === 'variants'));
+      act(() => ref.current!.setName('T'));
+      act(() => ref.current!.setDescription(''));
+      act(() => ref.current!.setGateway({ type: 'create-new' }));
+
+      expect(lastFrame()).toContain('step:onlineEval');
+    });
+
+    it('skip check does not affect non-skippable steps', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.setSkipCheck(() => false));
+      act(() => ref.current!.setName('T'));
+
+      expect(lastFrame()).toContain('step:description');
+    });
+  });
+});
diff --git a/src/cli/tui/screens/ab-test/__tests__/useTargetBasedWizard.test.tsx b/src/cli/tui/screens/ab-test/__tests__/useTargetBasedWizard.test.tsx
new file mode 100644
index 000000000..4ea0a40d5
--- /dev/null
+++ b/src/cli/tui/screens/ab-test/__tests__/useTargetBasedWizard.test.tsx
@@ -0,0 +1,319 @@
+import type { TargetInfo } from '../types';
+import { useTargetBasedWizard } from '../useTargetBasedWizard';
+import { Text } from 'ink';
+import { render } from 'ink-testing-library';
+import React, { act, useImperativeHandle } from 'react';
+import { describe, expect, it } from 'vitest';
+
+// ── Simple harness ─────────────────────────────────────────────────────────
+
+function Harness() {
+  const wizard = useTargetBasedWizard();
+  return (
+    <Text>
+      step:{wizard.step}
+      name:{wizard.config.name}
+      description:{wizard.config.description}
+      gateway:{wizard.config.gateway}
+      controlWeight:{wizard.config.controlWeight}
+      treatmentWeight:{wizard.config.treatmentWeight}
+      enableOnCreate:{String(wizard.config.enableOnCreate)}
+    </Text>
+  );
+}
+
+// ── Imperative harness ─────────────────────────────────────────────────────
+
+interface HarnessHandle {
+  setName: (name: string) => void;
+  setDescription: (desc: string) => void;
+  advanceFromNameDescription: () => void;
+  setGateway: (name: string, isNew: boolean) => void;
+  advance: () => void;
+  goBack: () => void;
+  setControlTarget: (target: TargetInfo, isNew: boolean) => void;
+  setTreatmentTarget: (target: TargetInfo, isNew: boolean) => void;
+  setControlWeight: (w: number) => void;
+  setControlEval: (name: string) => void;
+  setTreatmentEval: (name: string) => void;
+  setEnableOnCreate: (enable: boolean) => void;
+  toAddABTestConfig: ReturnType<typeof useTargetBasedWizard>['toAddABTestConfig'];
+}
+
+const ImperativeHarness = React.forwardRef<HarnessHandle>((_, ref) => {
+  const wizard = useTargetBasedWizard();
+  useImperativeHandle(ref, () => ({
+    setName: wizard.setName,
+    setDescription: wizard.setDescription,
+    advanceFromNameDescription: wizard.advanceFromNameDescription,
+    setGateway: wizard.setGateway,
+    advance: wizard.advance,
+    goBack: wizard.goBack,
+    setControlTarget: wizard.setControlTarget,
+    setTreatmentTarget: wizard.setTreatmentTarget,
+    setControlWeight: wizard.setControlWeight,
+    setControlEval: wizard.setControlEval,
+    setTreatmentEval: wizard.setTreatmentEval,
+    setEnableOnCreate: wizard.setEnableOnCreate,
+    toAddABTestConfig: wizard.toAddABTestConfig,
+  }));
+  const ctrlName = wizard.config.controlTargetInfo ? wizard.config.controlTargetInfo.name : 'null';
+  const treatName = wizard.config.treatmentTargetInfo ? wizard.config.treatmentTargetInfo.name : 'null';
+  return (
+    <Text>
+      {[
+        `step:${wizard.step}`,
+        `name:${wizard.config.name}`,
+        `description:${wizard.config.description}`,
+        `gateway:${wizard.config.gateway}`,
+        `gatewayIsNew:${String(wizard.config.gatewayIsNew)}`,
+        `controlWeight:${wizard.config.controlWeight}`,
+        `treatmentWeight:${wizard.config.treatmentWeight}`,
+        `controlOnlineEval:${wizard.config.controlOnlineEval}`,
+        `treatmentOnlineEval:${wizard.config.treatmentOnlineEval}`,
+        `enableOnCreate:${String(wizard.config.enableOnCreate)}`,
+        `controlTargetInfo:${ctrlName}`,
+        `treatmentTargetInfo:${treatName}`,
+      ].join('|')}
+    </Text>
+  );
+});
+ImperativeHarness.displayName = 'ImperativeHarness';
+
+// ── Tests ──────────────────────────────────────────────────────────────────
+
+describe('useTargetBasedWizard', () => {
+  describe('defaults', () => {
+    it('initial step is nameDescription', () => {
+      const { lastFrame } = render(<Harness />);
+      expect(lastFrame()).toContain('step:nameDescription');
+    });
+
+    it('default weights are 90/10', () => {
+      const { lastFrame } = render(<Harness />);
+      expect(lastFrame()).toContain('controlWeight:90');
+      expect(lastFrame()).toContain('treatmentWeight:10');
+    });
+
+    it('default enableOnCreate is true', () => {
+      const { lastFrame } = render(<Harness />);
+      expect(lastFrame()).toContain('enableOnCreate:true');
+    });
+  });
+
+  describe('step navigation', () => {
+    it('advanceFromNameDescription moves to gateway step', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.advanceFromNameDescription());
+
+      expect(lastFrame()).toContain('step:gateway');
+    });
+
+    it('advance from gateway moves to builder', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.advanceFromNameDescription());
+      // setGateway auto-advances to builder
+      act(() => ref.current!.setGateway('my-gw', false));
+
+      expect(lastFrame()).toContain('step:builder');
+    });
+
+    it('advance from builder moves to enableOnCreate', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.advanceFromNameDescription());
+      act(() => ref.current!.setGateway('my-gw', false));
+      // Now at builder, advance to enableOnCreate
+      act(() => ref.current!.advance());
+
+      expect(lastFrame()).toContain('step:enableOnCreate');
+    });
+
+    it('advance from enableOnCreate moves to confirm', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.advanceFromNameDescription());
+      act(() => ref.current!.setGateway('my-gw', false));
+      act(() => ref.current!.advance()); // builder → enableOnCreate
+      act(() => ref.current!.setEnableOnCreate(true)); // enableOnCreate → confirm
+
+      expect(lastFrame()).toContain('step:confirm');
+    });
+  });
+
+  describe('goBack', () => {
+    it('goBack from gateway goes to nameDescription', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.advanceFromNameDescription());
+      expect(lastFrame()).toContain('step:gateway');
+
+      act(() => ref.current!.goBack());
+      expect(lastFrame()).toContain('step:nameDescription');
+    });
+
+    it('goBack from builder goes to gateway', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.advanceFromNameDescription());
+      act(() => ref.current!.setGateway('my-gw', false));
+      expect(lastFrame()).toContain('step:builder');
+
+      act(() => ref.current!.goBack());
+      expect(lastFrame()).toContain('step:gateway');
+    });
+  });
+
+  describe('config updates', () => {
+    it('setName updates config', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.setName('MyTest'));
+
+      expect(lastFrame()).toContain('name:MyTest');
+    });
+
+    it('setDescription updates config', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.setDescription('desc1'));
+
+      expect(lastFrame()).toContain('description:desc1');
+    });
+
+    it('setGateway updates config', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.advanceFromNameDescription());
+      act(() => ref.current!.setGateway('gw-123', true));
+
+      expect(lastFrame()).toContain('gateway:gw-123');
+      expect(lastFrame()).toContain('gatewayIsNew:true');
+    });
+
+    it('setControlTarget updates config with targetInfo', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      const target: TargetInfo = { name: 'ctrl-target', runtimeRef: 'arn:runtime:1', qualifier: 'DEFAULT' };
+      act(() => ref.current!.setControlTarget(target, false));
+
+      expect(lastFrame()).toContain('controlTargetInfo:ctrl-target');
+    });
+
+    it('setTreatmentTarget updates config with targetInfo', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      const target: TargetInfo = { name: 'tt1', runtimeRef: 'arn:runtime:2', qualifier: 'v2' };
+      act(() => ref.current!.setTreatmentTarget(target, true));
+
+      const frame = lastFrame()!.replace(/\n/g, '');
+      expect(frame).toContain('treatmentTargetInfo:tt1');
+    });
+
+    it('setControlWeight updates config (sum to 100)', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.setControlWeight(70));
+
+      const frame = lastFrame()!.replace(/\n/g, '');
+      expect(frame).toContain('controlWeight:70');
+      expect(frame).toContain('treatmentWeight:30');
+    });
+
+    it('setControlEval updates config', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.setControlEval('eval-arn-1'));
+
+      expect(lastFrame()).toContain('controlOnlineEval:eval-arn-1');
+    });
+
+    it('setTreatmentEval updates config', () => {
+      const ref = React.createRef<HarnessHandle>();
+      const { lastFrame } = render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.setTreatmentEval('eval-arn-2'));
+
+      expect(lastFrame()).toContain('treatmentOnlineEval:eval-arn-2');
+    });
+  });
+
+  describe('toAddABTestConfig', () => {
+    it('returns correct AddABTestConfig shape', () => {
+      const ref = React.createRef<HarnessHandle>();
+      render(<ImperativeHarness ref={ref} />);
+
+      const controlTarget: TargetInfo = { name: 'ctrl', runtimeRef: 'arn:runtime:1', qualifier: 'DEFAULT' };
+      const treatmentTarget: TargetInfo = { name: 'treat', runtimeRef: 'arn:runtime:2', qualifier: 'v2' };
+
+      act(() => ref.current!.setName('TestAB'));
+      act(() => ref.current!.setDescription('A/B test'));
+      act(() => ref.current!.advanceFromNameDescription());
+      act(() => ref.current!.setGateway('my-gateway', false));
+      act(() => ref.current!.setControlTarget(controlTarget, false));
+      act(() => ref.current!.setTreatmentTarget(treatmentTarget, true));
+      act(() => ref.current!.setControlWeight(80));
+      act(() => ref.current!.setControlEval('eval-1'));
+      act(() => ref.current!.setTreatmentEval('eval-2'));
+
+      let config: ReturnType<HarnessHandle['toAddABTestConfig']> | undefined;
+      act(() => {
+        config = ref.current!.toAddABTestConfig();
+      });
+
+      expect(config).toBeDefined();
+      expect(config!.mode).toBe('target-based');
+      expect(config!.name).toBe('TestAB');
+      expect(config!.description).toBe('A/B test');
+      expect(config!.gateway).toBe('my-gateway');
+      expect(config!.gatewayIsNew).toBe(false);
+      expect(config!.gatewayChoice).toEqual({ type: 'existing-http', name: 'my-gateway' });
+      expect(config!.controlTargetInfo).toEqual(controlTarget);
+      expect(config!.controlTargetIsNew).toBe(false);
+      expect(config!.treatmentTargetInfo).toEqual(treatmentTarget);
+      expect(config!.treatmentTargetIsNew).toBe(true);
+      expect(config!.controlWeight).toBe(80);
+      expect(config!.treatmentWeight).toBe(20);
+      expect(config!.controlOnlineEval).toBe('eval-1');
+      expect(config!.treatmentOnlineEval).toBe('eval-2');
+      expect(config!.runtime).toBe('arn:runtime:1');
+      expect(config!.controlTarget).toBe('ctrl');
+      expect(config!.controlEndpoint).toBe('DEFAULT');
+      expect(config!.treatmentTarget).toBe('treat');
+      expect(config!.treatmentEndpoint).toBe('v2');
+      expect(config!.enableOnCreate).toBe(true);
+      expect(config!.evaluators).toEqual([]);
+      expect(config!.samplingRate).toBe(10);
+    });
+
+    it('returns create-new gatewayChoice when gatewayIsNew is true', () => {
+      const ref = React.createRef<HarnessHandle>();
+      render(<ImperativeHarness ref={ref} />);
+
+      act(() => ref.current!.advanceFromNameDescription());
+      act(() => ref.current!.setGateway('new-gw', true));
+
+      let config: ReturnType<HarnessHandle['toAddABTestConfig']> | undefined;
+      act(() => {
+        config = ref.current!.toAddABTestConfig();
+      });
+
+      expect(config!.gatewayChoice).toEqual({ type: 'create-new' });
+    });
+  });
+});
diff --git a/src/cli/tui/screens/ab-test/index.ts b/src/cli/tui/screens/ab-test/index.ts
new file mode 100644
index 000000000..162b24eb9
--- /dev/null
+++ b/src/cli/tui/screens/ab-test/index.ts
@@ -0,0 +1,4 @@
+export { AddABTestFlow } from './AddABTestFlow';
+export { ABTestDetailScreen } from './ABTestDetailScreen';
+export { ABTestPickerScreen } from './ABTestPickerScreen';
+export { RemoveABTestScreen } from './RemoveABTestScreen';
diff --git a/src/cli/tui/screens/ab-test/types.ts b/src/cli/tui/screens/ab-test/types.ts
new file mode 100644
index 000000000..977a2ca07
--- /dev/null
+++ b/src/cli/tui/screens/ab-test/types.ts
@@ -0,0 +1,89 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// AB Test Wizard Types
+// ─────────────────────────────────────────────────────────────────────────────
+
+export type ABTestMode = 'config-bundle' | 'target-based';
+
+export type AddABTestStep =
+  | 'mode'
+  | 'name'
+  | 'description'
+  | 'agent'
+  | 'gateway'
+  | 'variants'
+  | 'controlTarget'
+  | 'treatmentTarget'
+  | 'weights'
+  | 'evalPath'
+  | 'evalSelect'
+  | 'evalCreate'
+  | 'evalSamplingRate'
+  | 'onlineEval'
+  | 'maxDuration'
+  | 'enableOnCreate'
+  | 'confirm';
+
+export type GatewayChoice = { type: 'create-new' } | { type: 'existing-http'; name: string };
+
+/** Rich target info for target-based AB testing. */
+export interface TargetInfo {
+  name: string;
+  runtimeRef: string;
+  qualifier: string;
+}
+
+export interface AddABTestConfig {
+  mode: ABTestMode;
+  name: string;
+  description: string;
+  agent: string;
+  gatewayChoice: GatewayChoice;
+  // Config-bundle mode
+  controlBundle: string;
+  controlVersion: string;
+  treatmentBundle: string;
+  treatmentVersion: string;
+  treatmentWeight: number;
+  onlineEval: string;
+  // Target-based mode fields
+  gateway: string;
+  gatewayIsNew: boolean;
+  controlTargetInfo: TargetInfo | null;
+  controlTargetIsNew: boolean;
+  treatmentTargetInfo: TargetInfo | null;
+  treatmentTargetIsNew: boolean;
+  // Legacy target-based fields (populated from TargetInfo for downstream compatibility)
+  runtime: string;
+  controlTarget: string;
+  controlEndpoint: string;
+  treatmentTarget: string;
+  treatmentEndpoint: string;
+  controlWeight: number;
+  controlOnlineEval: string;
+  treatmentOnlineEval: string;
+  evaluators: string[];
+  samplingRate: number;
+  // Shared
+  maxDuration: number | undefined;
+  enableOnCreate: boolean;
+}
+
+export const AB_TEST_STEP_LABELS: Record<AddABTestStep, string> = {
+  mode: 'Mode',
+  name: 'Name',
+  description: 'Description',
+  agent: 'Agent',
+  gateway: 'Gateway',
+  variants: 'Variants',
+  controlTarget: 'Control',
+  treatmentTarget: 'Treatment',
+  weights: 'Weights',
+  evalPath: 'Eval',
+  evalSelect: 'Eval',
+  evalCreate: 'Eval',
+  evalSamplingRate: 'Eval',
+  onlineEval: 'Eval',
+  maxDuration: 'Duration',
+  enableOnCreate: 'Enable',
+  confirm: 'Confirm',
+};
diff --git a/src/cli/tui/screens/ab-test/useAddABTestWizard.ts b/src/cli/tui/screens/ab-test/useAddABTestWizard.ts
new file mode 100644
index 000000000..bb4fef0ad
--- /dev/null
+++ b/src/cli/tui/screens/ab-test/useAddABTestWizard.ts
@@ -0,0 +1,324 @@
+import type { VariantConfig } from './VariantConfigForm';
+import type { ABTestMode, AddABTestConfig, AddABTestStep, GatewayChoice, TargetInfo } from './types';
+import { useCallback, useRef, useState } from 'react';
+
+const CONFIG_BUNDLE_STEPS: AddABTestStep[] = [
+  'mode',
+  'name',
+  'description',
+  'gateway',
+  'agent',
+  'variants',
+  'onlineEval',
+  'maxDuration',
+  'enableOnCreate',
+  'confirm',
+];
+
+const TARGET_BASED_STEPS: AddABTestStep[] = [
+  'mode',
+  'name',
+  'description',
+  'gateway',
+  'controlTarget',
+  'treatmentTarget',
+  'weights',
+  'evalSelect',
+  'enableOnCreate',
+  'confirm',
+];
+
+function getDefaultConfig(): AddABTestConfig {
+  return {
+    mode: 'config-bundle',
+    name: '',
+    description: '',
+    agent: '',
+    gatewayChoice: { type: 'create-new' },
+    controlBundle: '',
+    controlVersion: '',
+    treatmentBundle: '',
+    treatmentVersion: '',
+    treatmentWeight: 20,
+    onlineEval: '',
+    // Target-based mode fields
+    gateway: '',
+    gatewayIsNew: false,
+    controlTargetInfo: null,
+    controlTargetIsNew: false,
+    treatmentTargetInfo: null,
+    treatmentTargetIsNew: false,
+    // Legacy target-based fields
+    runtime: '',
+    controlTarget: '',
+    controlEndpoint: '',
+    treatmentTarget: '',
+    treatmentEndpoint: '',
+    controlWeight: 90,
+    controlOnlineEval: '',
+    treatmentOnlineEval: '',
+    evaluators: [],
+    samplingRate: 10,
+    maxDuration: undefined,
+    enableOnCreate: true,
+  };
+}
+
+export type StepSkipCheck = (step: AddABTestStep) => boolean;
+
+export function useAddABTestWizard() {
+  const [config, setConfig] = useState<AddABTestConfig>(getDefaultConfig);
+  const [step, setStep] = useState<AddABTestStep>('mode');
+  const skipCheckRef = useRef<StepSkipCheck>(() => false);
+
+  const getSteps = useCallback((): AddABTestStep[] => {
+    return config.mode === 'target-based' ? TARGET_BASED_STEPS : CONFIG_BUNDLE_STEPS;
+  }, [config.mode]);
+
+  const currentIndex = getSteps().indexOf(step);
+
+  const setSkipCheck = useCallback((check: StepSkipCheck) => {
+    skipCheckRef.current = check;
+  }, []);
+
+  const goBack = useCallback(() => {
+    const steps = getSteps();
+    for (let i = currentIndex - 1; i >= 0; i--) {
+      if (!skipCheckRef.current(steps[i]!)) {
+        setStep(steps[i]!);
+        return;
+      }
+    }
+  }, [currentIndex, getSteps]);
+
+  const nextStep = useCallback(
+    (currentStepName: AddABTestStep): AddABTestStep | undefined => {
+      const steps = getSteps();
+      const idx = steps.indexOf(currentStepName);
+      for (let i = idx + 1; i < steps.length; i++) {
+        if (!skipCheckRef.current(steps[i]!)) {
+          return steps[i]!;
+        }
+      }
+      return undefined;
+    },
+    [getSteps]
+  );
+
+  const advance = useCallback(
+    (from: AddABTestStep) => {
+      const next = nextStep(from);
+      if (next) setStep(next);
+    },
+    [nextStep]
+  );
+
+  const setMode = useCallback(
+    (mode: ABTestMode) => {
+      setConfig(c => ({ ...c, mode }));
+      advance('mode');
+    },
+    [advance]
+  );
+
+  const setName = useCallback(
+    (name: string) => {
+      setConfig(c => ({ ...c, name }));
+      advance('name');
+    },
+    [advance]
+  );
+
+  const setDescription = useCallback(
+    (description: string) => {
+      setConfig(c => ({ ...c, description }));
+      advance('description');
+    },
+    [advance]
+  );
+
+  const setAgent = useCallback(
+    (agent: string) => {
+      setConfig(c => ({ ...c, agent }));
+      advance('agent');
+    },
+    [advance]
+  );
+
+  const setGateway = useCallback(
+    (gatewayChoice: GatewayChoice) => {
+      setConfig(c => ({
+        ...c,
+        gatewayChoice,
+        gateway: gatewayChoice.type === 'existing-http' ? gatewayChoice.name : '',
+        gatewayIsNew: gatewayChoice.type === 'create-new',
+      }));
+      advance('gateway');
+    },
+    [advance]
+  );
+
+  const setGatewayWithName = useCallback(
+    (gatewayName: string, isNew: boolean) => {
+      const gatewayChoice: GatewayChoice = isNew
+        ? { type: 'create-new' }
+        : { type: 'existing-http', name: gatewayName };
+      setConfig(c => ({
+        ...c,
+        gatewayChoice,
+        gateway: gatewayName,
+        gatewayIsNew: isNew,
+      }));
+      advance('gateway');
+    },
+    [advance]
+  );
+
+  const setVariants = useCallback(
+    (variantConfig: VariantConfig) => {
+      setConfig(c => ({
+        ...c,
+        controlBundle: variantConfig.controlBundle,
+        controlVersion: variantConfig.controlVersion,
+        treatmentBundle: variantConfig.treatmentBundle,
+        treatmentVersion: variantConfig.treatmentVersion,
+        treatmentWeight: variantConfig.treatmentWeight,
+      }));
+      advance('variants');
+    },
+    [advance]
+  );
+
+  const setOnlineEval = useCallback(
+    (onlineEval: string) => {
+      setConfig(c => ({ ...c, onlineEval }));
+      advance('onlineEval');
+    },
+    [advance]
+  );
+
+  // Target-based mode setters
+
+  const setControlTarget = useCallback(
+    (target: TargetInfo, isNew: boolean) => {
+      setConfig(c => ({
+        ...c,
+        controlTargetInfo: target,
+        controlTargetIsNew: isNew,
+        controlTarget: target.name,
+        controlEndpoint: target.qualifier,
+        runtime: target.runtimeRef,
+      }));
+      advance('controlTarget');
+    },
+    [advance]
+  );
+
+  const setTreatmentTarget = useCallback(
+    (target: TargetInfo, isNew: boolean) => {
+      setConfig(c => ({
+        ...c,
+        treatmentTargetInfo: target,
+        treatmentTargetIsNew: isNew,
+        treatmentTarget: target.name,
+        treatmentEndpoint: target.qualifier,
+        // Keep runtime from control if already set, otherwise use treatment's
+        runtime: c.runtime || target.runtimeRef,
+      }));
+      advance('treatmentTarget');
+    },
+    [advance]
+  );
+
+  const setWeights = useCallback(
+    (controlWeight: number, treatmentWeight: number) => {
+      setConfig(c => ({ ...c, controlWeight, treatmentWeight }));
+      advance('weights');
+    },
+    [advance]
+  );
+
+  const setEvalPath = useCallback(
+    (path: 'select' | 'create') => {
+      if (path === 'select') {
+        advance('evalPath');
+      } else {
+        // Skip evalSelect, go to evalCreate
+        setStep('evalCreate');
+      }
+    },
+    [advance]
+  );
+
+  const setEvalSelect = useCallback(
+    (controlEval: string, treatmentEval: string) => {
+      setConfig(c => ({ ...c, controlOnlineEval: controlEval, treatmentOnlineEval: treatmentEval }));
+      advance('evalSelect');
+    },
+    [advance]
+  );
+
+  const setEvaluators = useCallback(
+    (evaluators: string[]) => {
+      setConfig(c => ({ ...c, evaluators }));
+      advance('evalCreate');
+    },
+    [advance]
+  );
+
+  const setSamplingRate = useCallback(
+    (samplingRate: number) => {
+      setConfig(c => ({ ...c, samplingRate }));
+      advance('evalSamplingRate');
+    },
+    [advance]
+  );
+
+  const setMaxDuration = useCallback(
+    (maxDuration: number | undefined) => {
+      setConfig(c => ({ ...c, maxDuration }));
+      advance('maxDuration');
+    },
+    [advance]
+  );
+
+  const setEnableOnCreate = useCallback(
+    (enableOnCreate: boolean) => {
+      setConfig(c => ({ ...c, enableOnCreate }));
+      advance('enableOnCreate');
+    },
+    [advance]
+  );
+
+  const reset = useCallback(() => {
+    setConfig(getDefaultConfig());
+    setStep('mode');
+  }, []);
+
+  return {
+    config,
+    step,
+    steps: getSteps(),
+    currentIndex,
+    goBack,
+    setSkipCheck,
+    setMode,
+    setName,
+    setDescription,
+    setAgent,
+    setGateway,
+    setGatewayWithName,
+    setVariants,
+    setOnlineEval,
+    setControlTarget,
+    setTreatmentTarget,
+    setWeights,
+    setEvalPath,
+    setEvalSelect,
+    setEvaluators,
+    setSamplingRate,
+    setMaxDuration,
+    setEnableOnCreate,
+    reset,
+  };
+}
diff --git a/src/cli/tui/screens/ab-test/useTargetBasedWizard.ts b/src/cli/tui/screens/ab-test/useTargetBasedWizard.ts
new file mode 100644
index 000000000..7c26474d8
--- /dev/null
+++ b/src/cli/tui/screens/ab-test/useTargetBasedWizard.ts
@@ -0,0 +1,188 @@
+import type { AddABTestConfig, GatewayChoice, TargetInfo } from './types';
+import { useCallback, useState } from 'react';
+
+export type TargetBasedStep = 'nameDescription' | 'gateway' | 'builder' | 'enableOnCreate' | 'confirm';
+
+export const TARGET_BASED_STEP_LABELS: Record<TargetBasedStep, string> = {
+  nameDescription: 'Name',
+  gateway: 'Gateway',
+  builder: 'Configure',
+  enableOnCreate: 'Enable',
+  confirm: 'Confirm',
+};
+
+const STEPS: TargetBasedStep[] = ['nameDescription', 'gateway', 'builder', 'enableOnCreate', 'confirm'];
+
+interface TargetBasedConfig {
+  name: string;
+  description: string;
+  gateway: string;
+  gatewayIsNew: boolean;
+  controlTargetInfo: TargetInfo | null;
+  controlTargetIsNew: boolean;
+  controlWeight: number;
+  controlOnlineEval: string;
+  treatmentTargetInfo: TargetInfo | null;
+  treatmentTargetIsNew: boolean;
+  treatmentWeight: number;
+  treatmentOnlineEval: string;
+  enableOnCreate: boolean;
+}
+
+function getDefaultConfig(): TargetBasedConfig {
+  return {
+    name: '',
+    description: '',
+    gateway: '',
+    gatewayIsNew: false,
+    controlTargetInfo: null,
+    controlTargetIsNew: false,
+    controlWeight: 90,
+    controlOnlineEval: '',
+    treatmentTargetInfo: null,
+    treatmentTargetIsNew: false,
+    treatmentWeight: 10,
+    treatmentOnlineEval: '',
+    enableOnCreate: true,
+  };
+}
+
+export function useTargetBasedWizard() {
+  const [config, setConfig] = useState<TargetBasedConfig>(getDefaultConfig);
+  const [step, setStep] = useState<TargetBasedStep>('nameDescription');
+
+  const currentIndex = STEPS.indexOf(step);
+
+  const goBack = useCallback(() => {
+    const idx = STEPS.indexOf(step);
+    if (idx > 0) {
+      setStep(STEPS[idx - 1]!);
+    }
+  }, [step]);
+
+  const advance = useCallback(() => {
+    const idx = STEPS.indexOf(step);
+    if (idx < STEPS.length - 1) {
+      setStep(STEPS[idx + 1]!);
+    }
+  }, [step]);
+
+  const setName = useCallback((name: string) => {
+    setConfig(c => ({ ...c, name }));
+  }, []);
+
+  const setDescription = useCallback((description: string) => {
+    setConfig(c => ({ ...c, description }));
+  }, []);
+
+  const advanceFromNameDescription = useCallback(() => {
+    setStep('gateway');
+  }, []);
+
+  const setGateway = useCallback((name: string, isNew: boolean) => {
+    setConfig(c => ({ ...c, gateway: name, gatewayIsNew: isNew }));
+    // Auto-advance to builder
+    setStep('builder');
+  }, []);
+
+  const setControlTarget = useCallback((target: TargetInfo, isNew: boolean) => {
+    setConfig(c => ({
+      ...c,
+      controlTargetInfo: target,
+      controlTargetIsNew: isNew,
+    }));
+  }, []);
+
+  const setTreatmentTarget = useCallback((target: TargetInfo, isNew: boolean) => {
+    setConfig(c => ({
+      ...c,
+      treatmentTargetInfo: target,
+      treatmentTargetIsNew: isNew,
+    }));
+  }, []);
+
+  const setControlWeight = useCallback((w: number) => {
+    setConfig(c => ({ ...c, controlWeight: w, treatmentWeight: 100 - w }));
+  }, []);
+
+  const setControlEval = useCallback((name: string) => {
+    setConfig(c => ({ ...c, controlOnlineEval: name }));
+  }, []);
+
+  const setTreatmentEval = useCallback((name: string) => {
+    setConfig(c => ({ ...c, treatmentOnlineEval: name }));
+  }, []);
+
+  const setEnableOnCreate = useCallback((enableOnCreate: boolean) => {
+    setConfig(c => ({ ...c, enableOnCreate }));
+    setStep('confirm');
+  }, []);
+
+  const isBuilderComplete =
+    config.controlTargetInfo !== null &&
+    config.treatmentTargetInfo !== null &&
+    config.controlWeight > 0 &&
+    config.treatmentWeight > 0;
+
+  const toAddABTestConfig = useCallback((): AddABTestConfig => {
+    const gatewayChoice: GatewayChoice = config.gatewayIsNew
+      ? { type: 'create-new' }
+      : { type: 'existing-http', name: config.gateway };
+
+    return {
+      mode: 'target-based',
+      name: config.name,
+      description: config.description,
+      agent: '',
+      gatewayChoice,
+      // Config-bundle fields (safe defaults)
+      controlBundle: '',
+      controlVersion: '',
+      treatmentBundle: '',
+      treatmentVersion: '',
+      treatmentWeight: config.treatmentWeight,
+      onlineEval: '',
+      // Target-based fields
+      gateway: config.gateway,
+      gatewayIsNew: config.gatewayIsNew,
+      controlTargetInfo: config.controlTargetInfo,
+      controlTargetIsNew: config.controlTargetIsNew,
+      treatmentTargetInfo: config.treatmentTargetInfo,
+      treatmentTargetIsNew: config.treatmentTargetIsNew,
+      // Legacy target-based fields
+      runtime: config.controlTargetInfo?.runtimeRef ?? '',
+      controlTarget: config.controlTargetInfo?.name ?? '',
+      controlEndpoint: config.controlTargetInfo?.qualifier ?? '',
+      treatmentTarget: config.treatmentTargetInfo?.name ?? '',
+      treatmentEndpoint: config.treatmentTargetInfo?.qualifier ?? '',
+      controlWeight: config.controlWeight,
+      controlOnlineEval: config.controlOnlineEval,
+      treatmentOnlineEval: config.treatmentOnlineEval,
+      evaluators: [],
+      samplingRate: 10,
+      maxDuration: undefined,
+      enableOnCreate: config.enableOnCreate,
+    };
+  }, [config]);
+
+  return {
+    config,
+    step,
+    steps: STEPS,
+    currentIndex,
+    goBack,
+    advance,
+    setName,
+    setDescription,
+    advanceFromNameDescription,
+    setGateway,
+    setControlTarget,
+    setTreatmentTarget,
+    setControlWeight,
+    setControlEval,
+    setTreatmentEval,
+    setEnableOnCreate,
+    isBuilderComplete,
+    toAddABTestConfig,
+  };
+}
diff --git a/src/cli/tui/screens/add/AddFlow.tsx b/src/cli/tui/screens/add/AddFlow.tsx
index ac2e8e40b..fdf64bff1 100644
--- a/src/cli/tui/screens/add/AddFlow.tsx
+++ b/src/cli/tui/screens/add/AddFlow.tsx
@@ -3,11 +3,14 @@ import { VPC_ENDPOINT_WARNING } from '../../../commands/shared/vpc-utils';
 import { computeDefaultCredentialEnvVarName } from '../../../primitives/credential-utils';
 import { ErrorPrompt } from '../../components';
 import { useAvailableAgents } from '../../hooks/useCreateMcp';
+import { AddABTestFlow } from '../ab-test';
 import { AddAgentFlow } from '../agent/AddAgentFlow';
 import type { AddAgentConfig } from '../agent/types';
 import { FRAMEWORK_OPTIONS } from '../agent/types';
 import { useAddAgent } from '../agent/useAddAgent';
+import { AddConfigBundleFlow } from '../config-bundle';
 import { AddEvaluatorFlow } from '../evaluator';
+import { AddHarnessFlow } from '../harness/AddHarnessFlow';
 import { AddIdentityFlow } from '../identity';
 import { AddGatewayFlow, AddGatewayTargetFlow } from '../mcp';
 import { AddMemoryFlow } from '../memory/AddMemoryFlow';
@@ -23,6 +26,7 @@ import React, { useCallback, useEffect, useState } from 'react';
 
 type FlowState =
   | { name: 'select' }
+  | { name: 'harness-wizard' }
   | { name: 'agent-wizard' }
   | { name: 'gateway-wizard' }
   | { name: 'tool-wizard' }
@@ -31,6 +35,8 @@ type FlowState =
   | { name: 'evaluator-wizard' }
   | { name: 'online-eval-wizard' }
   | { name: 'policy-wizard' }
+  | { name: 'config-bundle-wizard' }
+  | { name: 'ab-test-wizard' }
   | { name: 'runtime-endpoint-wizard' }
   | {
       name: 'agent-create-success';
@@ -165,6 +171,8 @@ interface AddFlowProps {
 
 function getInitialFlowState(resource?: AddResourceType): FlowState {
   switch (resource) {
+    case 'harness':
+      return { name: 'harness-wizard' };
     case 'agent':
       return { name: 'agent-wizard' };
     case 'gateway':
@@ -183,6 +191,10 @@ function getInitialFlowState(resource?: AddResourceType): FlowState {
       return { name: 'policy-wizard' };
     case 'runtime-endpoint':
       return { name: 'runtime-endpoint-wizard' };
+    case 'config-bundle':
+      return { name: 'config-bundle-wizard' };
+    case 'ab-test':
+      return { name: 'ab-test-wizard' };
     default:
       return { name: 'select' };
   }
@@ -206,6 +218,9 @@ export function AddFlow(props: AddFlowProps) {
 
   const handleSelectResource = useCallback((resourceType: AddResourceType) => {
     switch (resourceType) {
+      case 'harness':
+        setFlow({ name: 'harness-wizard' });
+        break;
       case 'agent':
         setFlow({ name: 'agent-wizard' });
         break;
@@ -230,6 +245,12 @@ export function AddFlow(props: AddFlowProps) {
       case 'policy':
         setFlow({ name: 'policy-wizard' });
         break;
+      case 'config-bundle':
+        setFlow({ name: 'config-bundle-wizard' });
+        break;
+      case 'ab-test':
+        setFlow({ name: 'ab-test-wizard' });
+        break;
       case 'runtime-endpoint':
         setFlow({ name: 'runtime-endpoint-wizard' });
         break;
@@ -279,6 +300,18 @@ export function AddFlow(props: AddFlowProps) {
     return <AddScreen onSelect={handleSelectResource} onExit={props.onExit} />;
   }
 
+  if (flow.name === 'harness-wizard') {
+    return (
+      <AddHarnessFlow
+        isInteractive={props.isInteractive}
+        onBack={() => setFlow({ name: 'select' })}
+        onExit={props.onExit}
+        onDev={props.onDev}
+        onDeploy={props.onDeploy}
+      />
+    );
+  }
+
   // Agent wizard - now uses AddAgentFlow with mode selection
   if (flow.name === 'agent-wizard') {
     return (
@@ -466,6 +499,32 @@ export function AddFlow(props: AddFlowProps) {
     );
   }
 
+  // Configuration bundle wizard
+  if (flow.name === 'config-bundle-wizard') {
+    return (
+      <AddConfigBundleFlow
+        isInteractive={props.isInteractive}
+        onExit={props.onExit}
+        onBack={() => setFlow({ name: 'select' })}
+        onDev={props.onDev}
+        onDeploy={props.onDeploy}
+      />
+    );
+  }
+
+  // AB test wizard
+  if (flow.name === 'ab-test-wizard') {
+    return (
+      <AddABTestFlow
+        isInteractive={props.isInteractive}
+        onExit={props.onExit}
+        onBack={() => setFlow({ name: 'select' })}
+        onDev={props.onDev}
+        onDeploy={props.onDeploy}
+      />
+    );
+  }
+
   if (flow.name === 'runtime-endpoint-wizard') {
     return (
       <AddRuntimeEndpointFlow
diff --git a/src/cli/tui/screens/add/AddScreen.tsx b/src/cli/tui/screens/add/AddScreen.tsx
index 7ea889660..fde06ae08 100644
--- a/src/cli/tui/screens/add/AddScreen.tsx
+++ b/src/cli/tui/screens/add/AddScreen.tsx
@@ -2,6 +2,7 @@ import type { SelectableItem } from '../../components';
 import { SelectScreen } from '../../components';
 
 const ADD_RESOURCES = [
+  { id: 'harness', title: 'Harness', description: 'Managed config-based agent loop, no code required' },
   { id: 'agent', title: 'Agent', description: 'Deploy an HTTP, MCP, A2A, or AG-UI agent' },
   { id: 'memory', title: 'Memory', description: 'Persistent context storage' },
   { id: 'credential', title: 'Credential', description: 'API key credential providers' },
@@ -11,6 +12,8 @@ const ADD_RESOURCES = [
   { id: 'gateway-target', title: 'Gateway Target', description: 'Extend agent capabilities' },
   { id: 'runtime-endpoint', title: 'Runtime Endpoint', description: 'Named endpoint for a runtime' },
   { id: 'policy', title: 'Policy', description: 'Cedar policies for gateway tools' },
+  { id: 'config-bundle', title: 'Configuration Bundle [preview]', description: 'Versioned component configurations' },
+  { id: 'ab-test', title: 'AB Test [preview]', description: 'Compare agent configurations with traffic splitting' },
 ] as const;
 
 const ADD_RESOURCE_ITEMS: SelectableItem[] = ADD_RESOURCES.map(r => ({
diff --git a/src/cli/tui/screens/agent/AddAgentScreen.tsx b/src/cli/tui/screens/agent/AddAgentScreen.tsx
index e99386055..c8961c065 100644
--- a/src/cli/tui/screens/agent/AddAgentScreen.tsx
+++ b/src/cli/tui/screens/agent/AddAgentScreen.tsx
@@ -185,6 +185,7 @@ export function AddAgentScreen({ existingAgentNames, onComplete, onExit }: AddAg
     idleTimeout: '' as string,
     maxLifetime: '' as string,
     sessionStorageMountPath: '' as string,
+    withConfigBundle: undefined as boolean | undefined,
   });
   const [byoAdvancedSettings, setByoAdvancedSettings] = useState<Set<AdvancedSettingId>>(new Set());
   const [byoAuthorizerType, setByoAuthorizerType] = useState<RuntimeAuthorizerType>('AWS_IAM');
@@ -311,6 +312,7 @@ export function AddAgentScreen({ existingAgentNames, onComplete, onExit }: AddAg
       idleRuntimeSessionTimeout: generateWizard.config.idleRuntimeSessionTimeout,
       maxLifetime: generateWizard.config.maxLifetime,
       sessionStorageMountPath: generateWizard.config.sessionStorageMountPath,
+      withConfigBundle: generateWizard.config.withConfigBundle,
       pythonVersion: DEFAULT_PYTHON_VERSION,
       memory: generateWizard.config.memory,
     };
@@ -433,6 +435,7 @@ export function AddAgentScreen({ existingAgentNames, onComplete, onExit }: AddAg
       ...(byoConfig.idleTimeout && { idleRuntimeSessionTimeout: Number(byoConfig.idleTimeout) }),
       ...(byoConfig.maxLifetime && { maxLifetime: Number(byoConfig.maxLifetime) }),
       ...(byoConfig.sessionStorageMountPath && { sessionStorageMountPath: byoConfig.sessionStorageMountPath }),
+      ...(byoConfig.withConfigBundle && { withConfigBundle: true }),
       pythonVersion: DEFAULT_PYTHON_VERSION,
       memory: 'none',
     };
@@ -494,11 +497,14 @@ export function AddAgentScreen({ existingAgentNames, onComplete, onExit }: AddAg
           idleTimeout: '',
           maxLifetime: '',
           sessionStorageMountPath: '',
+          withConfigBundle: undefined,
         }));
         setByoAuthorizerType('AWS_IAM');
         setByoJwtConfig(undefined);
         setByoStep('confirm');
       } else {
+        // Config bundle has no sub-steps — set flag immediately
+        setByoConfig(c => ({ ...c, withConfigBundle: selected.has('configBundle') || undefined }));
         // Navigate to first advanced sub-step (steps memo hasn't updated yet)
         setTimeout(() => {
           if (selected.has('dockerfile') && byoConfig.buildType === 'Container') {
@@ -1348,6 +1354,9 @@ export function AddAgentScreen({ existingAgentNames, onComplete, onExit }: AddAg
               ...(byoConfig.sessionStorageMountPath
                 ? [{ label: 'Session Storage', value: byoConfig.sessionStorageMountPath }]
                 : []),
+              ...(byoConfig.withConfigBundle
+                ? [{ label: 'Config Bundle', value: 'Yes (auto-created on deploy)' }]
+                : []),
             ]}
           />
         )}
diff --git a/src/cli/tui/screens/agent/types.ts b/src/cli/tui/screens/agent/types.ts
index bc1553352..c708bcac0 100644
--- a/src/cli/tui/screens/agent/types.ts
+++ b/src/cli/tui/screens/agent/types.ts
@@ -97,6 +97,8 @@ export interface AddAgentConfig {
   maxLifetime?: number;
   /** Mount path for session filesystem storage (e.g. /mnt/session-storage) */
   sessionStorageMountPath?: string;
+  /** When true, create a config bundle wired into the agent template */
+  withConfigBundle?: boolean;
   /** Python version (only for Python agents) */
   pythonVersion: PythonRuntime;
   /** Memory option (create path only) */
diff --git a/src/cli/tui/screens/agent/useAddAgent.ts b/src/cli/tui/screens/agent/useAddAgent.ts
index 3160e8712..e2fabe140 100644
--- a/src/cli/tui/screens/agent/useAddAgent.ts
+++ b/src/cli/tui/screens/agent/useAddAgent.ts
@@ -1,7 +1,7 @@
 import { APP_DIR, ConfigIO, NoProjectError, findConfigRoot, setEnvVar } from '../../../../lib';
 import type { AgentEnvSpec, DirectoryPath, FilePath } from '../../../../schema';
-import { getErrorMessage } from '../../../errors';
 import { type PythonSetupResult, setupPythonProject } from '../../../operations';
+import { createConfigBundleForAgent } from '../../../operations/agent/config-bundle-defaults';
 import {
   mapGenerateConfigToRenderConfig,
   mapModelProviderToCredentials,
@@ -12,6 +12,19 @@ import { executeImportAgent } from '../../../operations/agent/import';
 import { buildAuthorizerConfigFromJwtConfig, createManagedOAuthCredential } from '../../../primitives/auth-utils';
 import { computeDefaultCredentialEnvVarName } from '../../../primitives/credential-utils';
 import { credentialPrimitive } from '../../../primitives/registry';
+import { withAddTelemetry } from '../../../telemetry/cli-command-run.js';
+import {
+  AgentType as AgentTypeEnum,
+  AuthorizerType as AuthorizerTypeEnum,
+  Build,
+  Framework,
+  Language,
+  Memory as MemoryEnum,
+  ModelProvider,
+  NetworkMode,
+  Protocol,
+  standardize,
+} from '../../../telemetry/schemas/common-shapes.js';
 import { createRenderer } from '../../../templates';
 import type { GenerateConfig } from '../generate/types';
 import type { AddAgentConfig } from './types';
@@ -118,6 +131,7 @@ function mapAddAgentConfigToGenerateConfig(config: AddAgentConfig): GenerateConf
     idleRuntimeSessionTimeout: config.idleRuntimeSessionTimeout,
     maxLifetime: config.maxLifetime,
     sessionStorageMountPath: config.sessionStorageMountPath,
+    withConfigBundle: config.withConfigBundle,
   };
 }
 
@@ -135,34 +149,25 @@ export function useAddAgent() {
   const addAgent = useCallback(async (config: AddAgentConfig): Promise<AddAgentOutcome> => {
     setIsLoading(true);
     try {
-      const configBaseDir = findConfigRoot();
-      if (!configBaseDir) {
-        return { ok: false, error: new NoProjectError().message };
-      }
-
-      const configIO = new ConfigIO({ baseDir: configBaseDir });
-
-      if (!configIO.configExists('project')) {
-        return { ok: false, error: new NoProjectError().message };
-      }
-
-      // Check for duplicate agent name
-      const project = await configIO.readProjectSpec();
-      const existingAgent = project.runtimes.find(agent => agent.name === config.name);
-      if (existingAgent) {
-        return { ok: false, error: `Agent "${config.name}" already exists in this project.` };
-      }
-
-      // Branch based on agent type
-      if (config.agentType === 'import') {
-        return await handleImportPath(config, configBaseDir);
-      } else if (config.agentType === 'create') {
-        return await handleCreatePath(config, configBaseDir);
-      } else {
-        return await handleByoPath(config, configIO, configBaseDir);
+      const result = await withAddTelemetry(
+        'add.agent',
+        {
+          language: standardize(Language, config.language),
+          framework: standardize(Framework, config.framework),
+          model_provider: standardize(ModelProvider, config.modelProvider),
+          agent_type: standardize(AgentTypeEnum, config.agentType),
+          build: standardize(Build, config.buildType),
+          protocol: standardize(Protocol, config.protocol ?? 'HTTP'),
+          network_mode: standardize(NetworkMode, config.networkMode ?? 'PUBLIC'),
+          authorizer_type: standardize(AuthorizerTypeEnum, config.authorizerType ?? 'NONE'),
+          memory: standardize(MemoryEnum, config.memory ?? 'none'),
+        },
+        () => addAgentInner(config)
+      );
+      if (!result.success) {
+        return { ok: false, error: result.error };
       }
-    } catch (err) {
-      return { ok: false, error: getErrorMessage(err) };
+      return result.outcome;
     } finally {
       setIsLoading(false);
     }
@@ -175,6 +180,43 @@ export function useAddAgent() {
   return { addAgent, isLoading, reset };
 }
 
+type AddAgentInnerResult =
+  | { success: true; outcome: AddAgentCreateResult | AddAgentByoResult }
+  | { success: false; error: string };
+
+async function addAgentInner(config: AddAgentConfig): Promise<AddAgentInnerResult> {
+  const configBaseDir = findConfigRoot();
+  if (!configBaseDir) {
+    return { success: false, error: new NoProjectError().message };
+  }
+
+  const configIO = new ConfigIO({ baseDir: configBaseDir });
+
+  if (!configIO.configExists('project')) {
+    return { success: false, error: new NoProjectError().message };
+  }
+
+  const project = await configIO.readProjectSpec();
+  const existingAgent = project.runtimes.find(agent => agent.name === config.name);
+  if (existingAgent) {
+    return { success: false, error: `Agent "${config.name}" already exists in this project.` };
+  }
+
+  let outcome: AddAgentCreateResult | AddAgentByoResult | AddAgentError;
+  if (config.agentType === 'import') {
+    outcome = await handleImportPath(config, configBaseDir);
+  } else if (config.agentType === 'create') {
+    outcome = await handleCreatePath(config, configBaseDir);
+  } else {
+    outcome = await handleByoPath(config, configIO, configBaseDir);
+  }
+
+  if (!outcome.ok) {
+    return { success: false, error: outcome.error };
+  }
+  return { success: true, outcome };
+}
+
 /**
  * Handle the "create" path: generate agent from template and write to project.
  */
@@ -259,6 +301,11 @@ async function handleCreatePath(
     pythonSetupResult = await setupPythonProject({ projectDir: agentPath });
   }
 
+  // Auto-create config bundle when opted in
+  if (config.withConfigBundle) {
+    await createConfigBundleForAgent(config.name, configBaseDir);
+  }
+
   return {
     ok: true,
     type: 'create',
diff --git a/src/cli/tui/screens/config-bundle-hub/ConfigBundleFlow.tsx b/src/cli/tui/screens/config-bundle-hub/ConfigBundleFlow.tsx
new file mode 100644
index 000000000..4c634ca37
--- /dev/null
+++ b/src/cli/tui/screens/config-bundle-hub/ConfigBundleFlow.tsx
@@ -0,0 +1,60 @@
+/**
+ * Config Bundle Flow — manages navigation between hub, version history, and diff screens.
+ */
+import { ConfigBundleHubScreen } from './ConfigBundleHubScreen';
+import { DiffScreen } from './DiffScreen';
+import { VersionHistoryScreen } from './VersionHistoryScreen';
+import type { BundleWithMeta } from './useConfigBundleHub';
+import React, { useState } from 'react';
+
+type FlowState =
+  | { name: 'hub' }
+  | { name: 'versions'; bundle: BundleWithMeta; region: string }
+  | { name: 'diff'; bundle: BundleWithMeta; region: string; fromVersionId: string; toVersionId: string };
+
+interface ConfigBundleFlowProps {
+  onExit: () => void;
+}
+
+export function ConfigBundleFlow({ onExit }: ConfigBundleFlowProps) {
+  const [flow, setFlow] = useState<FlowState>({ name: 'hub' });
+
+  if (flow.name === 'hub') {
+    return (
+      <ConfigBundleHubScreen
+        onSelectBundle={(bundle, region) => {
+          setFlow({ name: 'versions', bundle, region });
+        }}
+        onExit={onExit}
+      />
+    );
+  }
+
+  if (flow.name === 'versions') {
+    return (
+      <VersionHistoryScreen
+        bundle={flow.bundle}
+        region={flow.region}
+        onViewDiff={(bundleId, fromVersionId, toVersionId) =>
+          setFlow({ name: 'diff', bundle: flow.bundle, region: flow.region, fromVersionId, toVersionId })
+        }
+        onExit={() => setFlow({ name: 'hub' })}
+      />
+    );
+  }
+
+  if (flow.name === 'diff') {
+    return (
+      <DiffScreen
+        bundleId={flow.bundle.bundleId}
+        bundleName={flow.bundle.bundleName}
+        fromVersionId={flow.fromVersionId}
+        toVersionId={flow.toVersionId}
+        region={flow.region}
+        onExit={() => setFlow({ name: 'versions', bundle: flow.bundle, region: flow.region })}
+      />
+    );
+  }
+
+  return null;
+}
diff --git a/src/cli/tui/screens/config-bundle-hub/ConfigBundleHubScreen.tsx b/src/cli/tui/screens/config-bundle-hub/ConfigBundleHubScreen.tsx
new file mode 100644
index 000000000..476336dd0
--- /dev/null
+++ b/src/cli/tui/screens/config-bundle-hub/ConfigBundleHubScreen.tsx
@@ -0,0 +1,129 @@
+/**
+ * Top-level config bundle hub — lists all deployed bundles.
+ * Enter drills into version history.
+ */
+import { Panel, Screen } from '../../components';
+import type { BundleWithMeta } from './useConfigBundleHub';
+import { useConfigBundleHub } from './useConfigBundleHub';
+import { Box, Text, useInput } from 'ink';
+import React from 'react';
+
+function formatRelativeTime(epochSeconds: string): string {
+  const ms = Number(epochSeconds) < 1e12 ? Number(epochSeconds) * 1000 : Number(epochSeconds);
+  const diff = Date.now() - ms;
+  const minutes = Math.floor(diff / 60000);
+  if (minutes < 1) return 'just now';
+  if (minutes < 60) return `${minutes}m ago`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return `${hours}h ago`;
+  const days = Math.floor(hours / 24);
+  return `${days}d ago`;
+}
+
+interface ConfigBundleHubScreenProps {
+  onSelectBundle: (bundle: BundleWithMeta, region: string) => void;
+  onExit: () => void;
+}
+
+export function ConfigBundleHubScreen({ onSelectBundle, onExit }: ConfigBundleHubScreenProps) {
+  const { bundles, isLoading, error, region } = useConfigBundleHub();
+  const [selectedIndex, setSelectedIndex] = React.useState(0);
+
+  useInput(
+    (input: string, key: { return: boolean; upArrow: boolean; downArrow: boolean }) => {
+      if (key.upArrow && bundles.length > 0) {
+        setSelectedIndex(i => (i - 1 + bundles.length) % bundles.length);
+      }
+      if (key.downArrow && bundles.length > 0) {
+        setSelectedIndex(i => (i + 1) % bundles.length);
+      }
+      if (key.return && bundles[selectedIndex]) {
+        onSelectBundle(bundles[selectedIndex], region);
+      }
+    },
+    { isActive: !isLoading && bundles.length > 0 }
+  );
+
+  if (isLoading) {
+    return (
+      <Screen title="Configuration Bundles [preview]" onExit={onExit}>
+        <Text dimColor>Loading configuration bundles...</Text>
+      </Screen>
+    );
+  }
+
+  if (error) {
+    return (
+      <Screen title="Configuration Bundles [preview]" onExit={onExit}>
+        <Text color="red">Error: {error}</Text>
+      </Screen>
+    );
+  }
+
+  if (bundles.length === 0) {
+    return (
+      <Screen title="Configuration Bundles [preview]" onExit={onExit}>
+        <Panel>
+          <Text dimColor>No configuration bundles found.</Text>
+          <Text dimColor>Use `agentcore add config-bundle` to create one, then deploy.</Text>
+        </Panel>
+      </Screen>
+    );
+  }
+
+  const headerContent = (
+    <Box>
+      <Text>Region: </Text>
+      <Text color="yellow">{region}</Text>
+      <Text dimColor> · {bundles.length} bundle(s)</Text>
+    </Box>
+  );
+
+  return (
+    <Screen
+      title="Configuration Bundles [preview]"
+      onExit={onExit}
+      helpText="↑↓ navigate · Enter view versions · Esc back · Ctrl+C quit"
+      headerContent={headerContent}
+    >
+      <Panel fullWidth>
+        {bundles.map((bundle, idx) => (
+          <BundleRow key={bundle.bundleId} bundle={bundle} selected={idx === selectedIndex} />
+        ))}
+      </Panel>
+    </Screen>
+  );
+}
+
+function BundleRow({ bundle, selected }: { bundle: BundleWithMeta; selected: boolean }) {
+  const branchSummary = bundle.branches.length > 0 ? bundle.branches.join(', ') : 'no branches';
+
+  return (
+    <Box flexDirection="column" marginBottom={1}>
+      <Text>
+        <Text color={selected ? 'cyan' : undefined}>{selected ? '❯' : ' '} </Text>
+        <Text bold color={selected ? 'cyan' : undefined}>
+          {bundle.bundleName}
+        </Text>
+      </Text>
+      <Text>
+        {'  '}
+        <Text dimColor>
+          Versions: {bundle.versionCount} ({branchSummary})
+        </Text>
+      </Text>
+      {bundle.description && (
+        <Text>
+          {'  '}
+          <Text dimColor>Description: {bundle.description}</Text>
+        </Text>
+      )}
+      {bundle.lastUpdated && (
+        <Text>
+          {'  '}
+          <Text dimColor>Last update: {formatRelativeTime(bundle.lastUpdated)}</Text>
+        </Text>
+      )}
+    </Box>
+  );
+}
diff --git a/src/cli/tui/screens/config-bundle-hub/DiffScreen.tsx b/src/cli/tui/screens/config-bundle-hub/DiffScreen.tsx
new file mode 100644
index 000000000..f91b2b00e
--- /dev/null
+++ b/src/cli/tui/screens/config-bundle-hub/DiffScreen.tsx
@@ -0,0 +1,149 @@
+/**
+ * Diff screen — shows component differences between two bundle versions.
+ */
+import { getConfigurationBundleVersion } from '../../../../cli/aws/agentcore-config-bundles';
+import type { GetConfigurationBundleVersionResult } from '../../../../cli/aws/agentcore-config-bundles';
+import { deepDiff } from '../../../../cli/operations/config-bundle/diff-versions';
+import type { DiffEntry } from '../../../../cli/operations/config-bundle/diff-versions';
+import { Panel, Screen } from '../../components';
+import { Box, Text, useInput, useStdout } from 'ink';
+import React, { useEffect, useMemo, useState } from 'react';
+
+function formatTimestamp(epochSeconds: string): string {
+  const num = Number(epochSeconds);
+  const ms = num < 1e12 ? num * 1000 : num;
+  return new Date(ms)
+    .toISOString()
+    .replace('T', ' ')
+    .replace(/\.\d+Z$/, 'Z');
+}
+
+interface DiffScreenProps {
+  bundleId: string;
+  bundleName: string;
+  fromVersionId: string;
+  toVersionId: string;
+  region: string;
+  onExit: () => void;
+}
+
+export function DiffScreen({ bundleId, bundleName, fromVersionId, toVersionId, region, onExit }: DiffScreenProps) {
+  const [fromVersion, setFromVersion] = useState<GetConfigurationBundleVersionResult | undefined>();
+  const [toVersion, setToVersion] = useState<GetConfigurationBundleVersionResult | undefined>();
+  const [diffs, setDiffs] = useState<DiffEntry[]>([]);
+  const [isLoading, setIsLoading] = useState(true);
+  const [error, setError] = useState<string | undefined>();
+  const [scrollOffset, setScrollOffset] = useState(0);
+  const { stdout } = useStdout();
+
+  useEffect(() => {
+    async function load() {
+      try {
+        const [from, to] = await Promise.all([
+          getConfigurationBundleVersion({ region, bundleId, versionId: fromVersionId }),
+          getConfigurationBundleVersion({ region, bundleId, versionId: toVersionId }),
+        ]);
+        setFromVersion(from);
+        setToVersion(to);
+        setDiffs(deepDiff(from.components, to.components));
+        setIsLoading(false);
+      } catch (err) {
+        setError(err instanceof Error ? err.message : String(err));
+        setIsLoading(false);
+      }
+    }
+    void load();
+  }, [bundleId, fromVersionId, toVersionId, region]);
+
+  // Build display lines
+  const lines = useMemo(() => {
+    if (!fromVersion || !toVersion) return [];
+    const result: { text: string; color?: string }[] = [];
+
+    result.push({
+      text: `Diff: ${fromVersion.versionId} → ${toVersion.versionId}`,
+    });
+    result.push({
+      text: `From: ${fromVersion.lineageMetadata?.commitMessage ?? '(no message)'} (${formatTimestamp(fromVersion.versionCreatedAt)})`,
+      color: 'gray',
+    });
+    result.push({
+      text: `To: ${toVersion.lineageMetadata?.commitMessage ?? '(no message)'} (${formatTimestamp(toVersion.versionCreatedAt)})`,
+      color: 'gray',
+    });
+    result.push({ text: '' });
+
+    if (diffs.length === 0) {
+      result.push({ text: 'No differences found.', color: 'green' });
+    } else {
+      result.push({ text: `${diffs.length} change(s):` });
+      result.push({ text: '' });
+
+      for (const d of diffs) {
+        result.push({ text: d.path });
+        if (d.type === 'added') {
+          result.push({ text: `+ ${JSON.stringify(d.newValue)}`, color: 'green' });
+        } else if (d.type === 'removed') {
+          result.push({ text: `- ${JSON.stringify(d.oldValue)}`, color: 'red' });
+        } else if (d.type === 'changed') {
+          result.push({ text: `- ${JSON.stringify(d.oldValue)}`, color: 'red' });
+          result.push({ text: `+ ${JSON.stringify(d.newValue)}`, color: 'green' });
+        }
+        result.push({ text: '' });
+      }
+    }
+
+    return result;
+  }, [fromVersion, toVersion, diffs]);
+
+  const terminalHeight = stdout?.rows ?? 24;
+  const displayHeight = Math.max(5, terminalHeight - 10);
+  const maxScroll = Math.max(0, lines.length - displayHeight);
+
+  useInput((_input, key) => {
+    if (key.upArrow) setScrollOffset(prev => Math.max(0, prev - 1));
+    if (key.downArrow) setScrollOffset(prev => Math.min(maxScroll, prev + 1));
+  });
+
+  if (isLoading) {
+    return (
+      <Screen title={`${bundleName} — Diff`} onExit={onExit}>
+        <Text dimColor>Loading versions for diff...</Text>
+      </Screen>
+    );
+  }
+
+  if (error) {
+    return (
+      <Screen title={`${bundleName} — Diff`} onExit={onExit}>
+        <Text color="red">Error: {error}</Text>
+      </Screen>
+    );
+  }
+
+  const visibleLines = lines.slice(scrollOffset, scrollOffset + displayHeight);
+  const needsScroll = lines.length > displayHeight;
+
+  return (
+    <Screen
+      title={`${bundleName} — Diff`}
+      onExit={onExit}
+      helpText={needsScroll ? '↑↓ scroll · Esc back · Ctrl+C quit' : 'Esc back · Ctrl+C quit'}
+    >
+      <Panel fullWidth>
+        <Box flexDirection="column" height={displayHeight}>
+          {visibleLines.map((line, idx) => (
+            <Text key={scrollOffset + idx} color={line.color as never} dimColor={line.color === 'gray'}>
+              {line.text}
+            </Text>
+          ))}
+        </Box>
+        {needsScroll && (
+          <Text dimColor>
+            [{scrollOffset + 1}-{Math.min(scrollOffset + displayHeight, lines.length)} of {lines.length}]
+          </Text>
+        )}
+      </Panel>
+    </Screen>
+  );
+}
diff --git a/src/cli/tui/screens/config-bundle-hub/VersionHistoryScreen.tsx b/src/cli/tui/screens/config-bundle-hub/VersionHistoryScreen.tsx
new file mode 100644
index 000000000..56e161c85
--- /dev/null
+++ b/src/cli/tui/screens/config-bundle-hub/VersionHistoryScreen.tsx
@@ -0,0 +1,245 @@
+/**
+ * Version history screen — shows versions grouped by branch for a single bundle.
+ * Enter views version details, D starts diff selection.
+ */
+import { getConfigurationBundleVersion } from '../../../../cli/aws/agentcore-config-bundles';
+import type { ConfigurationBundleVersionSummary } from '../../../../cli/aws/agentcore-config-bundles';
+import { Panel, Screen } from '../../components';
+import type { BundleWithMeta } from './useConfigBundleHub';
+import { useVersionHistory } from './useConfigBundleHub';
+import { Box, Text, useInput } from 'ink';
+import React, { useMemo, useState } from 'react';
+
+function formatTimestamp(epochSeconds: string): string {
+  const num = Number(epochSeconds);
+  const ms = num < 1e12 ? num * 1000 : num;
+  return new Date(ms)
+    .toISOString()
+    .replace('T', ' ')
+    .replace(/\.\d+Z$/, 'Z');
+}
+
+interface VersionHistoryScreenProps {
+  bundle: BundleWithMeta;
+  region: string;
+  onViewDiff: (bundleId: string, fromVersionId: string, toVersionId: string) => void;
+  onExit: () => void;
+}
+
+type Mode = 'browse' | 'diff-select-from' | 'diff-select-to' | 'version-detail';
+
+export function VersionHistoryScreen({ bundle, region, onViewDiff, onExit }: VersionHistoryScreenProps) {
+  const { versions, isLoading, error } = useVersionHistory(bundle.bundleId, region);
+  const [selectedIndex, setSelectedIndex] = useState(0);
+  const [mode, setMode] = useState<Mode>('browse');
+  const [diffFromId, setDiffFromId] = useState<string | undefined>();
+  const [detailText, setDetailText] = useState<string | undefined>();
+
+  // Flat list of all versions for navigation
+  const flatVersions = useMemo(() => versions, [versions]);
+
+  // Group by branch for display
+  const byBranch = useMemo(() => {
+    const map = new Map<string, ConfigurationBundleVersionSummary[]>();
+    for (const v of versions) {
+      const branch = v.lineageMetadata?.branchName ?? 'unknown';
+      if (!map.has(branch)) map.set(branch, []);
+      map.get(branch)!.push(v);
+    }
+    return map;
+  }, [versions]);
+
+  useInput(
+    (input, key) => {
+      if (isLoading || flatVersions.length === 0) return;
+
+      if (mode === 'version-detail') {
+        if (key.escape) setMode('browse');
+        return;
+      }
+
+      // Navigation
+      if (key.upArrow) {
+        setSelectedIndex(i => (i - 1 + flatVersions.length) % flatVersions.length);
+        return;
+      }
+      if (key.downArrow) {
+        setSelectedIndex(i => (i + 1) % flatVersions.length);
+        return;
+      }
+
+      if (mode === 'browse') {
+        // Enter — view version detail
+        if (key.return && flatVersions[selectedIndex]) {
+          setMode('version-detail');
+          setDetailText(undefined);
+          void loadDetail(flatVersions[selectedIndex].versionId);
+          return;
+        }
+        // D — start diff
+        if (input === 'd' || input === 'D') {
+          setMode('diff-select-from');
+          return;
+        }
+      }
+
+      if (mode === 'diff-select-from') {
+        if (key.escape) {
+          setMode('browse');
+          return;
+        }
+        if (key.return && flatVersions[selectedIndex]) {
+          setDiffFromId(flatVersions[selectedIndex].versionId);
+          setMode('diff-select-to');
+          return;
+        }
+      }
+
+      if (mode === 'diff-select-to') {
+        if (key.escape) {
+          setMode('diff-select-from');
+          return;
+        }
+        if (key.return && flatVersions[selectedIndex] && diffFromId) {
+          onViewDiff(bundle.bundleId, diffFromId, flatVersions[selectedIndex].versionId);
+          return;
+        }
+      }
+    },
+    { isActive: !isLoading }
+  );
+
+  async function loadDetail(versionId: string) {
+    try {
+      const detail = await getConfigurationBundleVersion({
+        region,
+        bundleId: bundle.bundleId,
+        versionId,
+      });
+      const lines: string[] = [];
+      lines.push(`Version: ${detail.versionId}`);
+      if (detail.description) lines.push(`Description: ${detail.description}`);
+      if (detail.lineageMetadata?.branchName) lines.push(`Branch: ${detail.lineageMetadata.branchName}`);
+      if (detail.lineageMetadata?.commitMessage) lines.push(`Message: ${detail.lineageMetadata.commitMessage}`);
+      if (detail.lineageMetadata?.createdBy) {
+        const cb = detail.lineageMetadata.createdBy;
+        lines.push(`Created by: ${cb.name}${cb.arn ? ` (${cb.arn})` : ''}`);
+      }
+      if (detail.lineageMetadata?.parentVersionIds?.length) {
+        lines.push(`Parent: ${detail.lineageMetadata.parentVersionIds.map(id => id).join(', ')}`);
+      }
+      lines.push(`Created: ${formatTimestamp(detail.versionCreatedAt)}`);
+      lines.push('');
+      lines.push('Components:');
+      for (const [arn, comp] of Object.entries(detail.components)) {
+        lines.push(`  ${arn}`);
+        lines.push(`  ${JSON.stringify(comp.configuration, null, 2).split('\n').join('\n  ')}`);
+        lines.push('');
+      }
+      setDetailText(lines.join('\n'));
+    } catch (err) {
+      setDetailText(`Error loading version: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+
+  if (isLoading) {
+    return (
+      <Screen title={`${bundle.bundleName} — Versions`} onExit={onExit} exitEnabled={mode === 'browse'}>
+        <Text dimColor>Loading version history...</Text>
+      </Screen>
+    );
+  }
+
+  if (error) {
+    return (
+      <Screen title={`${bundle.bundleName} — Versions`} onExit={onExit}>
+        <Text color="red">Error: {error}</Text>
+      </Screen>
+    );
+  }
+
+  // Version detail overlay
+  if (mode === 'version-detail') {
+    return (
+      <Screen title={`${bundle.bundleName} — Version Detail`} onExit={() => setMode('browse')} helpText="Esc back">
+        <Panel fullWidth>{detailText ? <Text>{detailText}</Text> : <Text dimColor>Loading...</Text>}</Panel>
+      </Screen>
+    );
+  }
+
+  // Mode-specific help text
+  let helpText = '↑↓ navigate · Enter view · D diff · Esc back · Ctrl+C quit';
+  if (mode === 'diff-select-from') {
+    helpText = '↑↓ navigate · Enter select FROM version · Esc cancel';
+  } else if (mode === 'diff-select-to') {
+    helpText = `↑↓ navigate · Enter select TO version · Esc back (from: ${diffFromId!})`;
+  }
+
+  // Mode-specific header
+  let modeIndicator: React.ReactNode = null;
+  if (mode === 'diff-select-from') {
+    modeIndicator = (
+      <Box marginBottom={1}>
+        <Text color="yellow">Select the FROM version for diff:</Text>
+      </Box>
+    );
+  } else if (mode === 'diff-select-to') {
+    modeIndicator = (
+      <Box marginBottom={1}>
+        <Text color="yellow">From: {diffFromId!} — Now select the TO version:</Text>
+      </Box>
+    );
+  }
+
+  // Build a flat index map so we can highlight the selected version
+  let flatIdx = 0;
+
+  return (
+    <Screen
+      title={`${bundle.bundleName} — Versions`}
+      onExit={onExit}
+      helpText={helpText}
+      exitEnabled={mode === 'browse'}
+    >
+      <Panel fullWidth>
+        {modeIndicator}
+        {[...byBranch.entries()].map(([branch, branchVersions]) => (
+          <Box key={branch} flexDirection="column" marginBottom={1}>
+            <Text bold color="cyan">
+              Branch: {branch}
+            </Text>
+            {branchVersions.map((v, i) => {
+              const currentFlatIdx = flatIdx++;
+              const isSelected = currentFlatIdx === selectedIndex;
+              const meta = v.lineageMetadata;
+              const message = meta?.commitMessage ?? '';
+              const isLast = i === branchVersions.length - 1;
+              const connector = isLast ? '└' : '├';
+              const isDiffFrom = v.versionId === diffFromId;
+
+              return (
+                <Box key={v.versionId} flexDirection="column">
+                  <Text>
+                    <Text color={isSelected ? 'cyan' : undefined}>{isSelected ? '❯' : ' '} </Text>
+                    <Text>{connector} </Text>
+                    <Text color="green" bold={isDiffFrom}>
+                      {v.versionId}
+                    </Text>
+                    <Text dimColor> {formatTimestamp(v.versionCreatedAt)}</Text>
+                    {message ? <Text> &quot;{message}&quot;</Text> : null}
+                  </Text>
+                  {meta?.parentVersionIds?.length ? (
+                    <Text>
+                      {'  '}
+                      {isLast ? ' ' : '│'} <Text dimColor>parent: {meta.parentVersionIds.join(', ')}</Text>
+                    </Text>
+                  ) : null}
+                </Box>
+              );
+            })}
+          </Box>
+        ))}
+      </Panel>
+    </Screen>
+  );
+}
diff --git a/src/cli/tui/screens/config-bundle-hub/index.ts b/src/cli/tui/screens/config-bundle-hub/index.ts
new file mode 100644
index 000000000..b7ceb3d02
--- /dev/null
+++ b/src/cli/tui/screens/config-bundle-hub/index.ts
@@ -0,0 +1,4 @@
+export { ConfigBundleFlow } from './ConfigBundleFlow';
+export { ConfigBundleHubScreen } from './ConfigBundleHubScreen';
+export { VersionHistoryScreen } from './VersionHistoryScreen';
+export { DiffScreen } from './DiffScreen';
diff --git a/src/cli/tui/screens/config-bundle-hub/useConfigBundleHub.ts b/src/cli/tui/screens/config-bundle-hub/useConfigBundleHub.ts
new file mode 100644
index 000000000..c0276ae53
--- /dev/null
+++ b/src/cli/tui/screens/config-bundle-hub/useConfigBundleHub.ts
@@ -0,0 +1,220 @@
+/**
+ * Hook for the Config Bundle Hub — reads bundles from project config
+ * and enriches deployed ones with version metadata from the API.
+ */
+import type { ConfigurationBundleVersionSummary } from '../../../../cli/aws/agentcore-config-bundles';
+import {
+  listConfigurationBundleVersions,
+  listConfigurationBundles,
+} from '../../../../cli/aws/agentcore-config-bundles';
+import { ConfigIO } from '../../../../lib';
+import { getBundleNameVariants } from '../../../operations/config-bundle/bundle-name-variants';
+import { useEffect, useRef, useState } from 'react';
+
+export interface BundleWithMeta {
+  bundleId: string;
+  bundleArn: string;
+  bundleName: string;
+  description?: string;
+  versionCount: number;
+  branches: string[];
+  lastUpdated?: string;
+}
+
+export interface ConfigBundleHubState {
+  bundles: BundleWithMeta[];
+  isLoading: boolean;
+  error?: string;
+  region: string;
+}
+
+export function useConfigBundleHub(): ConfigBundleHubState {
+  const [bundles, setBundles] = useState<BundleWithMeta[]>([]);
+  const [isLoading, setIsLoading] = useState(true);
+  const [error, setError] = useState<string | undefined>();
+  const [region, setRegion] = useState('us-east-1');
+  const mountedRef = useRef(true);
+
+  useEffect(() => {
+    mountedRef.current = true;
+
+    async function load() {
+      setIsLoading(true);
+      setError(undefined);
+      try {
+        const configIO = new ConfigIO();
+        const [projectSpec, deployedState, targets] = await Promise.all([
+          configIO.readProjectSpec(),
+          configIO.readDeployedState(),
+          configIO.resolveAWSDeploymentTargets(),
+        ]);
+
+        if (targets.length === 0) {
+          if (mountedRef.current) {
+            setError('No AWS deployment targets configured.');
+            setIsLoading(false);
+          }
+          return;
+        }
+        const resolvedRegion = targets[0]!.region;
+        if (mountedRef.current) setRegion(resolvedRegion);
+
+        // Get config bundles from project config (agentcore.json)
+        const projectBundles = projectSpec.configBundles ?? [];
+        if (projectBundles.length === 0) {
+          if (mountedRef.current) {
+            setBundles([]);
+            setIsLoading(false);
+          }
+          return;
+        }
+
+        // Get deployed state to look up bundleIds
+        const deployedBundles =
+          Object.values(deployedState.targets).find(t => t.resources?.configBundles)?.resources?.configBundles ?? {};
+
+        // Build bundle list from project config, enriching with deployed version info
+        const enriched = await Promise.all(
+          projectBundles.map(async (bundleSpec): Promise<BundleWithMeta> => {
+            const deployed = deployedBundles[bundleSpec.name];
+            if (!deployed) {
+              // Not yet deployed — show from project config only
+              return {
+                bundleId: '',
+                bundleArn: '',
+                bundleName: bundleSpec.name,
+                description: bundleSpec.description,
+                versionCount: 0,
+                branches: bundleSpec.branchName ? [bundleSpec.branchName] : [],
+              };
+            }
+
+            // Deployed — fetch version metadata from API
+            // Use a helper that falls back to the list API if the deployed-state bundleId is stale
+            let effectiveBundleId = deployed.bundleId;
+            let effectiveBundleArn = deployed.bundleArn;
+
+            try {
+              const versions = await listConfigurationBundleVersions({
+                region: resolvedRegion,
+                bundleId: effectiveBundleId,
+                maxResults: 50,
+              });
+              const branchSet = new Set<string>();
+              let latestTs = '';
+              for (const v of versions.versions) {
+                if (v.lineageMetadata?.branchName) branchSet.add(v.lineageMetadata.branchName);
+                if (v.versionCreatedAt > latestTs) latestTs = v.versionCreatedAt;
+              }
+              return {
+                bundleId: effectiveBundleId,
+                bundleArn: effectiveBundleArn,
+                bundleName: bundleSpec.name,
+                description: bundleSpec.description,
+                versionCount: versions.versions.length,
+                branches: [...branchSet],
+                lastUpdated: latestTs || undefined,
+              };
+            } catch {
+              // Stale deployed-state ID — try to resolve via list API
+              try {
+                const allBundles = await listConfigurationBundles({ region: resolvedRegion, maxResults: 100 });
+                const nameVariants = getBundleNameVariants(bundleSpec.name, projectSpec.name);
+                const match = allBundles.bundles.find(b => nameVariants.includes(b.bundleName));
+                if (match) {
+                  effectiveBundleId = match.bundleId;
+                  effectiveBundleArn = match.bundleArn;
+                  const versions = await listConfigurationBundleVersions({
+                    region: resolvedRegion,
+                    bundleId: effectiveBundleId,
+                    maxResults: 50,
+                  });
+                  const branchSet = new Set<string>();
+                  let latestTs = '';
+                  for (const v of versions.versions) {
+                    if (v.lineageMetadata?.branchName) branchSet.add(v.lineageMetadata.branchName);
+                    if (v.versionCreatedAt > latestTs) latestTs = v.versionCreatedAt;
+                  }
+                  return {
+                    bundleId: effectiveBundleId,
+                    bundleArn: effectiveBundleArn,
+                    bundleName: bundleSpec.name,
+                    description: bundleSpec.description,
+                    versionCount: versions.versions.length,
+                    branches: [...branchSet],
+                    lastUpdated: latestTs || undefined,
+                  };
+                }
+              } catch {
+                // Both paths failed
+              }
+              return {
+                bundleId: effectiveBundleId,
+                bundleArn: effectiveBundleArn,
+                bundleName: bundleSpec.name,
+                description: bundleSpec.description,
+                versionCount: 0,
+                branches: [],
+              };
+            }
+          })
+        );
+
+        if (mountedRef.current) {
+          setBundles(enriched);
+          setIsLoading(false);
+        }
+      } catch (err) {
+        if (mountedRef.current) {
+          setError(err instanceof Error ? err.message : String(err));
+          setIsLoading(false);
+        }
+      }
+    }
+
+    void load();
+    return () => {
+      mountedRef.current = false;
+    };
+  }, []);
+
+  return { bundles, isLoading, error, region };
+}
+
+export function useVersionHistory(bundleId: string, region: string) {
+  const [versions, setVersions] = useState<ConfigurationBundleVersionSummary[]>([]);
+  const [isLoading, setIsLoading] = useState(true);
+  const [error, setError] = useState<string | undefined>();
+
+  useEffect(() => {
+    async function load() {
+      setIsLoading(true);
+      setError(undefined);
+      try {
+        const allVersions: ConfigurationBundleVersionSummary[] = [];
+        let nextToken: string | undefined;
+        do {
+          const result = await listConfigurationBundleVersions({
+            region,
+            bundleId,
+            maxResults: 50,
+            nextToken,
+          });
+          allVersions.push(...result.versions);
+          nextToken = result.nextToken;
+        } while (nextToken);
+
+        allVersions.sort((a, b) => Number(b.versionCreatedAt) - Number(a.versionCreatedAt));
+        setVersions(allVersions);
+        setIsLoading(false);
+      } catch (err) {
+        setError(err instanceof Error ? err.message : String(err));
+        setIsLoading(false);
+      }
+    }
+
+    void load();
+  }, [bundleId, region]);
+
+  return { versions, isLoading, error };
+}
diff --git a/src/cli/tui/screens/config-bundle/AddConfigBundleFlow.tsx b/src/cli/tui/screens/config-bundle/AddConfigBundleFlow.tsx
new file mode 100644
index 000000000..2ccc9fab2
--- /dev/null
+++ b/src/cli/tui/screens/config-bundle/AddConfigBundleFlow.tsx
@@ -0,0 +1,177 @@
+import { ConfigIO } from '../../../../lib';
+import { ErrorPrompt, GradientText, Screen } from '../../components';
+import { useCreateConfigBundle, useExistingConfigBundleNames } from '../../hooks/useCreateConfigBundle';
+import { AddSuccessScreen } from '../add/AddSuccessScreen';
+import { AddConfigBundleScreen } from './AddConfigBundleScreen';
+import type { AddConfigBundleConfig, DeployedComponent } from './types';
+import React, { useCallback, useEffect, useState } from 'react';
+
+type FlowState =
+  | { name: 'loading' }
+  | { name: 'create-wizard'; deployedComponents: DeployedComponent[] }
+  | { name: 'create-success'; bundleName: string }
+  | { name: 'error'; message: string };
+
+interface AddConfigBundleFlowProps {
+  isInteractive?: boolean;
+  onExit: () => void;
+  onBack: () => void;
+  onDev?: () => void;
+  onDeploy?: () => void;
+}
+
+export function AddConfigBundleFlow({
+  isInteractive = true,
+  onExit,
+  onBack,
+  onDev,
+  onDeploy,
+}: AddConfigBundleFlowProps) {
+  const { createConfigBundle, reset: resetCreate } = useCreateConfigBundle();
+  const { names: existingNames } = useExistingConfigBundleNames();
+  const [flow, setFlow] = useState<FlowState>({ name: 'loading' });
+
+  // Load deployed runtimes/gateways and fill in undeployed ones from project spec
+  useEffect(() => {
+    void (async () => {
+      try {
+        const configIO = new ConfigIO();
+        const components: DeployedComponent[] = [];
+        const deployedArns = new Set<string>();
+
+        // 1. Collect deployed components (real ARNs)
+        try {
+          const deployedState = await configIO.readDeployedState();
+          for (const target of Object.values(deployedState.targets)) {
+            const runtimes = target.resources?.runtimes;
+            if (runtimes) {
+              for (const [name, state] of Object.entries(runtimes)) {
+                components.push({ name, arn: state.runtimeArn, type: 'runtime' });
+                deployedArns.add(name);
+              }
+            }
+            const httpGateways = target.resources?.httpGateways;
+            if (httpGateways) {
+              for (const [name, state] of Object.entries(httpGateways)) {
+                components.push({ name, arn: state.gatewayArn, type: 'gateway' });
+                deployedArns.add(name);
+              }
+            }
+          }
+        } catch {
+          // No deployed state yet — that's fine, we'll use project spec below
+        }
+
+        // 2. Add undeployed runtimes/gateways from project spec as placeholders
+        try {
+          const projectSpec = await configIO.readProjectSpec();
+          for (const rt of projectSpec.runtimes ?? []) {
+            if (!deployedArns.has(rt.name)) {
+              components.push({
+                name: rt.name,
+                arn: `{{runtime:${rt.name}}}`,
+                type: 'runtime',
+                isPlaceholder: true,
+              });
+            }
+          }
+          for (const gw of projectSpec.httpGateways ?? []) {
+            if (!deployedArns.has(gw.name)) {
+              components.push({
+                name: gw.name,
+                arn: `{{gateway:${gw.name}}}`,
+                type: 'gateway',
+                isPlaceholder: true,
+              });
+            }
+          }
+        } catch {
+          // If we can't read project spec, continue with what we have
+        }
+
+        setFlow({ name: 'create-wizard', deployedComponents: components });
+      } catch {
+        setFlow({ name: 'create-wizard', deployedComponents: [] });
+      }
+    })();
+  }, []);
+
+  useEffect(() => {
+    if (!isInteractive && flow.name === 'create-success') {
+      onExit();
+    }
+  }, [isInteractive, flow.name, onExit]);
+
+  const handleCreateComplete = useCallback(
+    (config: AddConfigBundleConfig) => {
+      void createConfigBundle({
+        name: config.name,
+        description: config.description || undefined,
+        components: config.components,
+        branchName: config.branchName || 'mainline',
+        commitMessage: config.commitMessage || `Create ${config.name}`,
+      }).then(result => {
+        if (result.ok) {
+          setFlow(prev => {
+            if (prev.name === 'loading') return prev;
+            return { name: 'create-success', bundleName: result.bundleName };
+          });
+          return;
+        }
+        setFlow(prev => {
+          if (prev.name === 'loading') return prev;
+          return { name: 'error', message: result.error };
+        });
+      });
+    },
+    [createConfigBundle]
+  );
+
+  if (flow.name === 'loading') {
+    return (
+      <Screen title="Add Configuration Bundle" onExit={onBack}>
+        <GradientText text="Loading deployed resources..." />
+      </Screen>
+    );
+  }
+
+  if (flow.name === 'create-wizard') {
+    return (
+      <AddConfigBundleScreen
+        existingBundleNames={existingNames}
+        deployedComponents={flow.deployedComponents}
+        onComplete={handleCreateComplete}
+        onExit={onBack}
+      />
+    );
+  }
+
+  if (flow.name === 'create-success') {
+    return (
+      <AddSuccessScreen
+        isInteractive={isInteractive}
+        message={`Added configuration bundle: ${flow.bundleName}`}
+        detail="Bundle added to project in `agentcore/agentcore.json`. Deploy with `agentcore deploy`."
+        onAddAnother={onBack}
+        onDev={onDev}
+        onDeploy={onDeploy}
+        onExit={onExit}
+      />
+    );
+  }
+
+  return (
+    <ErrorPrompt
+      message="Failed to add configuration bundle"
+      detail={flow.message}
+      onBack={() => {
+        resetCreate();
+        setFlow(prev => {
+          if (prev.name === 'loading') return prev;
+          return { name: 'create-wizard', deployedComponents: [] };
+        });
+      }}
+      onExit={onExit}
+    />
+  );
+}
diff --git a/src/cli/tui/screens/config-bundle/AddConfigBundleScreen.tsx b/src/cli/tui/screens/config-bundle/AddConfigBundleScreen.tsx
new file mode 100644
index 000000000..47d33ddf5
--- /dev/null
+++ b/src/cli/tui/screens/config-bundle/AddConfigBundleScreen.tsx
@@ -0,0 +1,275 @@
+import { ConfigBundleNameSchema } from '../../../../schema';
+import type { SelectableItem } from '../../components';
+import { ConfirmReview, Panel, Screen, StepIndicator, TextInput, WizardSelect } from '../../components';
+import { HELP_TEXT } from '../../constants';
+import { useListNavigation } from '../../hooks';
+import { generateUniqueName } from '../../utils';
+import type { AddConfigBundleConfig, ComponentType, DeployedComponent } from './types';
+import { COMPONENT_TYPE_OPTIONS, CONFIG_BUNDLE_STEP_LABELS } from './types';
+import { useAddConfigBundleWizard } from './useAddConfigBundleWizard';
+import { Box, Text } from 'ink';
+import React, { useMemo } from 'react';
+
+interface AddConfigBundleScreenProps {
+  onComplete: (config: AddConfigBundleConfig) => void;
+  onExit: () => void;
+  existingBundleNames: string[];
+  deployedComponents: DeployedComponent[];
+}
+
+function validateConfigJson(value: string): string | true {
+  try {
+    const parsed: unknown = JSON.parse(value);
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+      return 'Must be a JSON object with key-value pairs';
+    }
+    return true;
+  } catch (err) {
+    if (err instanceof SyntaxError) {
+      return 'Invalid JSON syntax';
+    }
+    return 'Must be a valid JSON object';
+  }
+}
+
+export function AddConfigBundleScreen({
+  onComplete,
+  onExit,
+  existingBundleNames,
+  deployedComponents,
+}: AddConfigBundleScreenProps) {
+  const wizard = useAddConfigBundleWizard();
+
+  const componentTypeItems: SelectableItem[] = useMemo(
+    () => COMPONENT_TYPE_OPTIONS.map(opt => ({ id: opt.id, title: opt.title, description: opt.description })),
+    []
+  );
+
+  // Filter deployed components by selected type
+  const availableComponents: SelectableItem[] = useMemo(() => {
+    const filtered = deployedComponents.filter(c => c.type === wizard.config.currentComponentType);
+    // Exclude already-added ARNs
+    const existingArns = new Set(Object.keys(wizard.config.components));
+    return filtered
+      .filter(c => !existingArns.has(c.arn))
+      .map(c => ({
+        id: c.arn,
+        title: c.name,
+        description: c.isPlaceholder ? '(not yet deployed — ARN resolved on deploy)' : c.arn,
+      }));
+  }, [deployedComponents, wizard.config.currentComponentType, wizard.config.components]);
+
+  const addAnotherItems: SelectableItem[] = useMemo(
+    () => [
+      { id: 'no', title: 'Continue' },
+      { id: 'yes', title: 'Add another component' },
+    ],
+    []
+  );
+
+  const isNameStep = wizard.step === 'name';
+  const isDescriptionStep = wizard.step === 'description';
+  const isComponentTypeStep = wizard.step === 'componentType';
+  const isComponentSelectStep = wizard.step === 'componentSelect';
+  const isConfigurationStep = wizard.step === 'configuration';
+  const isAddAnotherStep = wizard.step === 'addAnother';
+  const isBranchNameStep = wizard.step === 'branchName';
+  const isCommitMessageStep = wizard.step === 'commitMessage';
+  const isConfirmStep = wizard.step === 'confirm';
+
+  const componentTypeNav = useListNavigation({
+    items: componentTypeItems,
+    onSelect: item => wizard.setComponentType(item.id as ComponentType),
+    onExit: () => wizard.goBack(),
+    isActive: isComponentTypeStep,
+  });
+
+  const componentSelectNav = useListNavigation({
+    items: availableComponents,
+    onSelect: item => wizard.setSelectedComponent(item.id),
+    onExit: () => wizard.goBack(),
+    isActive: isComponentSelectStep,
+  });
+
+  const addAnotherNav = useListNavigation({
+    items: addAnotherItems,
+    onSelect: item => {
+      if (item.id === 'yes') wizard.addAnotherComponent();
+      else wizard.doneAddingComponents();
+    },
+    onExit: () => wizard.goBack(),
+    isActive: isAddAnotherStep,
+  });
+
+  useListNavigation({
+    items: [{ id: 'confirm', title: 'Confirm' }],
+    onSelect: () => onComplete(wizard.config),
+    onExit: () => wizard.goBack(),
+    isActive: isConfirmStep,
+  });
+
+  const helpText =
+    isComponentTypeStep || isComponentSelectStep || isAddAnotherStep
+      ? HELP_TEXT.NAVIGATE_SELECT
+      : isConfirmStep
+        ? HELP_TEXT.CONFIRM_CANCEL
+        : HELP_TEXT.TEXT_INPUT;
+
+  const headerContent = (
+    <StepIndicator steps={wizard.steps} currentStep={wizard.step} labels={CONFIG_BUNDLE_STEP_LABELS} />
+  );
+
+  const componentCount = Object.keys(wizard.config.components).length;
+
+  return (
+    <Screen
+      title="Add Configuration Bundle"
+      onExit={onExit}
+      helpText={helpText}
+      headerContent={headerContent}
+      exitEnabled={false}
+    >
+      <Panel fullWidth>
+        {isNameStep && (
+          <TextInput
+            key="name"
+            prompt="Bundle name"
+            initialValue={generateUniqueName('MyBundle', existingBundleNames)}
+            onSubmit={wizard.setName}
+            onCancel={onExit}
+            schema={ConfigBundleNameSchema}
+            customValidation={value => !existingBundleNames.includes(value) || 'Bundle name already exists'}
+          />
+        )}
+
+        {isDescriptionStep && (
+          <TextInput
+            key="description"
+            prompt="Description (optional, press Enter to skip)"
+            initialValue=""
+            allowEmpty
+            onSubmit={wizard.setDescription}
+            onCancel={() => wizard.goBack()}
+          />
+        )}
+
+        {isComponentTypeStep && (
+          <WizardSelect
+            title="What do you want to configure?"
+            description={
+              componentCount > 0
+                ? `${componentCount} component(s) added. Select another type or go back to continue.`
+                : 'Select the type of resource to add to this bundle'
+            }
+            items={componentTypeItems}
+            selectedIndex={componentTypeNav.selectedIndex}
+          />
+        )}
+
+        {isComponentSelectStep && availableComponents.length > 0 && (
+          <WizardSelect
+            title={`Select a deployed ${wizard.config.currentComponentType}`}
+            description="Choose from your deployed resources"
+            items={availableComponents}
+            selectedIndex={componentSelectNav.selectedIndex}
+          />
+        )}
+
+        {isComponentSelectStep && availableComponents.length === 0 && (
+          <Box flexDirection="column">
+            <Text color="yellow">
+              No deployed {wizard.config.currentComponentType === 'runtime' ? 'runtimes' : 'gateways'} found.
+            </Text>
+            <Text dimColor>Deploy your resources first with `agentcore deploy`, then try again.</Text>
+            <Text dimColor>Press Esc to go back.</Text>
+          </Box>
+        )}
+
+        {isConfigurationStep && (
+          <>
+            <Box flexDirection="column" marginBottom={1}>
+              <Text>
+                <Text bold>Component:</Text> {wizard.config.currentComponentArn}
+              </Text>
+              <Text dimColor>Enter the configuration as a JSON object (key-value pairs).</Text>
+              <Text dimColor>Example: {'{"systemPrompt": "You are a helpful assistant", "temperature": 0.7}'}</Text>
+            </Box>
+            <TextInput
+              key={`config-${wizard.config.currentComponentArn}`}
+              prompt="Configuration (JSON)"
+              placeholder='{"key": "value"}'
+              initialValue=""
+              expandable
+              onSubmit={value => {
+                const parsed = JSON.parse(value) as Record<string, unknown>;
+                wizard.setConfiguration(parsed);
+              }}
+              onCancel={() => wizard.goBack()}
+              customValidation={validateConfigJson}
+            />
+          </>
+        )}
+
+        {isAddAnotherStep && (
+          <>
+            <Box flexDirection="column" marginBottom={1}>
+              <Text color="green">
+                {componentCount} component{componentCount !== 1 ? 's' : ''} configured:
+              </Text>
+              {Object.keys(wizard.config.components).map(arn => (
+                <Text key={arn} dimColor>
+                  {'  '}• {arn}
+                </Text>
+              ))}
+            </Box>
+            <WizardSelect
+              title="Add another component?"
+              items={addAnotherItems}
+              selectedIndex={addAnotherNav.selectedIndex}
+            />
+          </>
+        )}
+
+        {isBranchNameStep && (
+          <TextInput
+            key="branchName"
+            prompt="Branch name (press Enter for default)"
+            placeholder="main"
+            initialValue=""
+            allowEmpty
+            onSubmit={wizard.setBranchName}
+            onCancel={() => wizard.goBack()}
+          />
+        )}
+
+        {isCommitMessageStep && (
+          <TextInput
+            key="commitMessage"
+            prompt="Commit message (press Enter for default)"
+            placeholder={`Create ${wizard.config.name}`}
+            initialValue=""
+            allowEmpty
+            onSubmit={wizard.setCommitMessage}
+            onCancel={() => wizard.goBack()}
+          />
+        )}
+
+        {isConfirmStep && (
+          <ConfirmReview
+            fields={[
+              { label: 'Name', value: wizard.config.name },
+              ...(wizard.config.description ? [{ label: 'Description', value: wizard.config.description }] : []),
+              { label: 'Components', value: `${componentCount} component(s)` },
+              ...Object.entries(wizard.config.components).map(([arn, comp]) => ({
+                label: `  ${arn.split('/').pop() ?? arn}`,
+                value: Object.keys(comp.configuration).join(', '),
+              })),
+              { label: 'Branch', value: wizard.config.branchName || 'mainline' },
+              { label: 'Message', value: wizard.config.commitMessage || `Create ${wizard.config.name}` },
+            ]}
+          />
+        )}
+      </Panel>
+    </Screen>
+  );
+}
diff --git a/src/cli/tui/screens/config-bundle/index.ts b/src/cli/tui/screens/config-bundle/index.ts
new file mode 100644
index 000000000..831a3c94e
--- /dev/null
+++ b/src/cli/tui/screens/config-bundle/index.ts
@@ -0,0 +1 @@
+export { AddConfigBundleFlow } from './AddConfigBundleFlow';
diff --git a/src/cli/tui/screens/config-bundle/types.ts b/src/cli/tui/screens/config-bundle/types.ts
new file mode 100644
index 000000000..dba1ba4e7
--- /dev/null
+++ b/src/cli/tui/screens/config-bundle/types.ts
@@ -0,0 +1,57 @@
+import type { ComponentConfigurationMap } from '../../../../schema';
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Config Bundle Wizard Types
+// ─────────────────────────────────────────────────────────────────────────────
+
+export type AddConfigBundleStep =
+  | 'name'
+  | 'description'
+  | 'componentType'
+  | 'componentSelect'
+  | 'configuration'
+  | 'addAnother'
+  | 'branchName'
+  | 'commitMessage'
+  | 'confirm';
+
+export type ComponentType = 'runtime' | 'gateway';
+
+export interface DeployedComponent {
+  name: string;
+  arn: string;
+  type: ComponentType;
+  /** True when the resource is not yet deployed — ARN is a placeholder resolved at deploy time. */
+  isPlaceholder?: boolean;
+}
+
+export interface AddConfigBundleConfig {
+  name: string;
+  description: string;
+  components: ComponentConfigurationMap;
+  /** Raw text entered by user (JSON string or file path). */
+  componentsRaw: string;
+  branchName: string;
+  commitMessage: string;
+  /** Currently selected component type in wizard. */
+  currentComponentType?: ComponentType;
+  /** Currently selected component ARN in wizard. */
+  currentComponentArn?: string;
+}
+
+export const CONFIG_BUNDLE_STEP_LABELS: Record<AddConfigBundleStep, string> = {
+  name: 'Name',
+  description: 'Description',
+  componentType: 'Type',
+  componentSelect: 'Component',
+  configuration: 'Config',
+  addAnother: 'More?',
+  branchName: 'Branch',
+  commitMessage: 'Message',
+  confirm: 'Confirm',
+};
+
+export const COMPONENT_TYPE_OPTIONS = [
+  { id: 'runtime', title: 'Agent Runtime', description: 'Configure an agent runtime' },
+  { id: 'gateway', title: 'HTTP Gateway', description: 'Configure an HTTP gateway' },
+] as const;
diff --git a/src/cli/tui/screens/config-bundle/useAddConfigBundleWizard.ts b/src/cli/tui/screens/config-bundle/useAddConfigBundleWizard.ts
new file mode 100644
index 000000000..daa79173b
--- /dev/null
+++ b/src/cli/tui/screens/config-bundle/useAddConfigBundleWizard.ts
@@ -0,0 +1,113 @@
+import type { ComponentConfigurationMap } from '../../../../schema';
+import type { AddConfigBundleConfig, AddConfigBundleStep, ComponentType } from './types';
+import { useCallback, useState } from 'react';
+
+const ALL_STEPS: AddConfigBundleStep[] = [
+  'name',
+  'description',
+  'componentType',
+  'componentSelect',
+  'configuration',
+  'addAnother',
+  'branchName',
+  'commitMessage',
+  'confirm',
+];
+
+function getDefaultConfig(): AddConfigBundleConfig {
+  return {
+    name: '',
+    description: '',
+    components: {},
+    componentsRaw: '',
+    branchName: 'mainline',
+    commitMessage: '',
+  };
+}
+
+export function useAddConfigBundleWizard() {
+  const [config, setConfig] = useState<AddConfigBundleConfig>(getDefaultConfig);
+  const [step, setStep] = useState<AddConfigBundleStep>('name');
+
+  const currentIndex = ALL_STEPS.indexOf(step);
+
+  const goBack = useCallback(() => {
+    const prevStep = ALL_STEPS[currentIndex - 1];
+    if (prevStep) setStep(prevStep);
+  }, [currentIndex]);
+
+  const setName = useCallback((name: string) => {
+    setConfig(c => ({ ...c, name }));
+    setStep('description');
+  }, []);
+
+  const setDescription = useCallback((description: string) => {
+    setConfig(c => ({ ...c, description }));
+    setStep('componentType');
+  }, []);
+
+  const setComponentType = useCallback((componentType: ComponentType) => {
+    setConfig(c => ({ ...c, currentComponentType: componentType, currentComponentArn: undefined }));
+    setStep('componentSelect');
+  }, []);
+
+  const setSelectedComponent = useCallback((arn: string) => {
+    setConfig(c => ({ ...c, currentComponentArn: arn }));
+    setStep('configuration');
+  }, []);
+
+  const setConfiguration = useCallback((configuration: Record<string, unknown>) => {
+    setConfig(c => {
+      const arn = c.currentComponentArn;
+      if (!arn) return c;
+      const updatedComponents: ComponentConfigurationMap = {
+        ...c.components,
+        [arn]: { configuration },
+      };
+      return { ...c, components: updatedComponents };
+    });
+    setStep('addAnother');
+  }, []);
+
+  const addAnotherComponent = useCallback(() => {
+    setConfig(c => ({ ...c, currentComponentType: undefined, currentComponentArn: undefined }));
+    setStep('componentType');
+  }, []);
+
+  const doneAddingComponents = useCallback(() => {
+    setStep('branchName');
+  }, []);
+
+  const setBranchName = useCallback((branchName: string) => {
+    setConfig(c => ({ ...c, branchName }));
+    setStep('commitMessage');
+  }, []);
+
+  const setCommitMessage = useCallback((commitMessage: string) => {
+    setConfig(c => ({ ...c, commitMessage }));
+    setStep('confirm');
+  }, []);
+
+  const reset = useCallback(() => {
+    setConfig(getDefaultConfig());
+    setStep('name');
+  }, []);
+
+  return {
+    config,
+    step,
+    steps: ALL_STEPS,
+    currentIndex,
+    goBack,
+    setName,
+    setDescription,
+    setComponentType,
+    setSelectedComponent,
+    setConfiguration,
+    addAnotherComponent,
+    doneAddingComponents,
+    setBranchName,
+    setCommitMessage,
+    reset,
+  };
+}
diff --git a/src/cli/tui/screens/create/CreateScreen.tsx b/src/cli/tui/screens/create/CreateScreen.tsx
index 801dfc8d8..19f9dfb3c 100644
--- a/src/cli/tui/screens/create/CreateScreen.tsx
+++ b/src/cli/tui/screens/create/CreateScreen.tsx
@@ -19,13 +19,20 @@ import { STATUS_COLORS } from '../../theme';
 import { AddAgentScreen } from '../agent/AddAgentScreen';
 import type { AddAgentConfig } from '../agent/types';
 import { FRAMEWORK_OPTIONS } from '../agent/types';
+import { AddHarnessScreen } from '../harness/AddHarnessScreen';
+import type { AddHarnessConfig } from '../harness/types';
 import { useCreateFlow } from './useCreateFlow';
 import { Box, Text, useApp } from 'ink';
 import { join } from 'path';
 import { useCallback, useEffect } from 'react';
 
 /** Build a text representation of the completion screen for terminal output */
-function buildExitMessage(projectName: string, steps: Step[], agentConfig: AddAgentConfig | null): string {
+function buildExitMessage(
+  projectName: string,
+  steps: Step[],
+  agentConfig: AddAgentConfig | null,
+  harnessConfig: AddHarnessConfig | null
+): string {
   const lines: string[] = [];
 
   // Title
@@ -63,6 +70,14 @@ function buildExitMessage(projectName: string, steps: Step[], agentConfig: AddAg
     const maxPathLen = Math.max(agentPath.length, agentcorePath.length);
     lines.push(`    ${agentPath.padEnd(maxPathLen)}  \x1b[2mAgent code location (empty)\x1b[0m`);
     lines.push(`    ${agentcorePath.padEnd(maxPathLen)}  \x1b[2mConfig and CDK project\x1b[0m`);
+  } else if (harnessConfig) {
+    const harnessPath = `harness/${harnessConfig.name}/`;
+    const agentcorePath = 'agentcore/';
+    const maxPathLen = Math.max(harnessPath.length, agentcorePath.length);
+    lines.push(`    ${harnessPath.padEnd(maxPathLen)}  \x1b[2mHarness\x1b[0m`);
+    lines.push(`    ${agentcorePath.padEnd(maxPathLen)}  \x1b[2mConfig and CDK project\x1b[0m`);
+    lines.push('');
+    lines.push(`\x1b[2mModel:\x1b[0m ${harnessConfig.modelId} \x1b[2mvia ${harnessConfig.modelProvider}\x1b[0m`);
   } else {
     lines.push(`    agentcore/  \x1b[2mConfig and CDK project\x1b[0m`);
   }
@@ -120,23 +135,39 @@ interface CreateScreenProps {
 }
 
 /** Next steps shown after successful project creation */
-function getCreateNextSteps(hasAgent: boolean): NextStep[] {
+function getCreateNextSteps(hasAgent: boolean, hasHarness: boolean): NextStep[] {
   if (hasAgent) {
     return [
       { command: 'dev', label: 'Run agent locally' },
       { command: 'deploy', label: 'Deploy to AWS' },
     ];
   }
+  if (hasHarness) {
+    return [{ command: 'deploy', label: 'Deploy to AWS' }];
+  }
   return [{ command: 'add', label: 'Add an agent' }];
 }
 
-const CREATE_PROMPT_ITEMS = [
-  { id: 'yes', title: 'Yes, add an agent' },
-  { id: 'no', title: "No, I'll do it later" },
+const CREATE_TYPE_ITEMS = [
+  { id: 'harness', title: 'Harness (recommended)', description: 'Managed config-based agent loop, no code required' },
+  {
+    id: 'agent',
+    title: 'Agent',
+    description: 'Start with a template or bring your own code hosted on AgentCore Runtime',
+  },
+  { id: 'skip', title: 'Skip', description: "I'll add resources later" },
 ];
 
 /** Tree-style display of created project structure */
-function CreatedSummary({ projectName, agentConfig }: { projectName: string; agentConfig: AddAgentConfig | null }) {
+function CreatedSummary({
+  projectName,
+  agentConfig,
+  harnessConfig,
+}: {
+  projectName: string;
+  agentConfig: AddAgentConfig | null;
+  harnessConfig: AddHarnessConfig | null;
+}) {
   const getFrameworkLabel = (framework: string) => {
     const option = FRAMEWORK_OPTIONS.find(o => o.id === framework);
     return option?.title ?? framework;
@@ -145,8 +176,10 @@ function CreatedSummary({ projectName, agentConfig }: { projectName: string; age
   const isCreate = agentConfig?.agentType === 'create' || agentConfig?.agentType === 'import';
   const isByo = agentConfig?.agentType === 'byo';
   const agentPath = isCreate ? `app/${agentConfig.name}/` : isByo ? agentConfig.codeLocation : null;
+  const harnessPath = harnessConfig ? `harness/${harnessConfig.name}/` : null;
+  const resourcePath = agentPath ?? harnessPath;
   const agentcorePath = 'agentcore/';
-  const maxPathLen = agentPath ? Math.max(agentPath.length, agentcorePath.length) : agentcorePath.length;
+  const maxPathLen = resourcePath ? Math.max(resourcePath.length, agentcorePath.length) : agentcorePath.length;
 
   return (
     <Box flexDirection="column" marginTop={1}>
@@ -172,6 +205,14 @@ function CreatedSummary({ projectName, agentConfig }: { projectName: string; age
             </Text>
           </Box>
         )}
+        {harnessConfig && harnessPath && (
+          <Box marginLeft={2}>
+            <Text>
+              {harnessPath.padEnd(maxPathLen)}
+              <Text dimColor>{'  '}Harness</Text>
+            </Text>
+          </Box>
+        )}
         <Box marginLeft={2}>
           <Text>
             {agentcorePath.padEnd(maxPathLen)}
@@ -186,6 +227,13 @@ function CreatedSummary({ projectName, agentConfig }: { projectName: string; age
           <Text dimColor> via {agentConfig.modelProvider}</Text>
         </Box>
       )}
+      {harnessConfig && (
+        <Box marginTop={1}>
+          <Text dimColor>Model: </Text>
+          <Text>{harnessConfig.modelId}</Text>
+          <Text dimColor> via {harnessConfig.modelProvider}</Text>
+        </Box>
+      )}
       {isByo && agentConfig && (
         <Box flexDirection="column" marginTop={1}>
           <Text color="yellow">
@@ -213,12 +261,21 @@ export function CreateScreen({ cwd, isInteractive, onExit, onNavigate }: CreateS
   const handleExit = useCallback(() => {
     if (allSuccess && isInteractive) {
       // Set message to be printed after TUI exits (full completion screen)
-      setExitMessage(buildExitMessage(flow.projectName, flow.steps, flow.addAgentConfig));
+      setExitMessage(buildExitMessage(flow.projectName, flow.steps, flow.addAgentConfig, flow.addHarnessConfig));
       exit();
     } else {
       onExit();
     }
-  }, [allSuccess, isInteractive, flow.projectName, flow.steps, flow.addAgentConfig, exit, onExit]);
+  }, [
+    allSuccess,
+    isInteractive,
+    flow.projectName,
+    flow.steps,
+    flow.addAgentConfig,
+    flow.addHarnessConfig,
+    exit,
+    onExit,
+  ]);
 
   // Auto-exit when project creation completes successfully
   useEffect(() => {
@@ -227,14 +284,14 @@ export function CreateScreen({ cwd, isInteractive, onExit, onNavigate }: CreateS
     }
   }, [allSuccess, handleExit]);
 
-  // Create prompt navigation
-  const { selectedIndex: createPromptIndex } = useListNavigation({
-    items: CREATE_PROMPT_ITEMS,
+  // Create type selection navigation
+  const { selectedIndex: createTypeIndex } = useListNavigation({
+    items: CREATE_TYPE_ITEMS,
     onSelect: item => {
-      flow.setWantsCreate(item.id === 'yes');
+      flow.handleCreateTypeSelection(item.id as 'harness' | 'agent' | 'skip');
     },
     onExit: handleExit,
-    isActive: flow.phase === 'create-prompt',
+    isActive: flow.phase === 'create-type-prompt',
   });
 
   // Checking phase: instant async check — render nothing to avoid a flash before the real UI
@@ -253,6 +310,17 @@ export function CreateScreen({ cwd, isInteractive, onExit, onNavigate }: CreateS
     );
   }
 
+  // Harness wizard phase (separate component, no header conflict)
+  if (flow.phase === 'harness-wizard') {
+    return (
+      <AddHarnessScreen
+        existingHarnessNames={[]}
+        onComplete={flow.handleAddHarnessComplete}
+        onExit={flow.goBackFromHarnessWizard}
+      />
+    );
+  }
+
   // All other phases share a single <Screen> to prevent duplicate header flashes
   // when Ink transitions between different <Screen> mounts.
   const phase = flow.phase;
@@ -270,7 +338,7 @@ export function CreateScreen({ cwd, isInteractive, onExit, onNavigate }: CreateS
       ? 'Press Esc to exit'
       : phase === 'input'
         ? HELP_TEXT.TEXT_INPUT
-        : phase === 'create-prompt'
+        : phase === 'create-type-prompt'
           ? HELP_TEXT.NAVIGATE_SELECT
           : flow.hasError || allSuccess
             ? HELP_TEXT.EXIT
@@ -310,17 +378,12 @@ export function CreateScreen({ cwd, isInteractive, onExit, onNavigate }: CreateS
         </>
       )}
 
-      {phase === 'create-prompt' && (
+      {phase === 'create-type-prompt' && (
         <>
-          <Box marginBottom={1}>
-            <Text>
-              Project: <Text color={STATUS_COLORS.success}>{flow.projectName}</Text>
-            </Text>
-          </Box>
           <Box flexDirection="column">
-            <Text>Would you like to add an agent now?</Text>
+            <Text>What would you like to build?</Text>
             <Box marginTop={1}>
-              <SelectList items={CREATE_PROMPT_ITEMS} selectedIndex={createPromptIndex} />
+              <SelectList items={CREATE_TYPE_ITEMS} selectedIndex={createTypeIndex} />
             </Box>
           </Box>
         </>
@@ -331,14 +394,18 @@ export function CreateScreen({ cwd, isInteractive, onExit, onNavigate }: CreateS
       {allSuccess && flow.outputDir && (
         <Box marginTop={1} flexDirection="column">
           <StepProgress steps={flow.steps} />
-          <CreatedSummary projectName={flow.projectName} agentConfig={flow.addAgentConfig} />
+          <CreatedSummary
+            projectName={flow.projectName}
+            agentConfig={flow.addAgentConfig}
+            harnessConfig={flow.addHarnessConfig}
+          />
           {isInteractive ? (
             <Box marginTop={1}>
               <Text color="green">Project created successfully!</Text>
             </Box>
           ) : (
             <NextSteps
-              steps={getCreateNextSteps(flow.addAgentConfig !== null)}
+              steps={getCreateNextSteps(flow.addAgentConfig !== null, flow.addHarnessConfig !== null)}
               isInteractive={isInteractive}
               onSelect={step => {
                 if (onNavigate) {
diff --git a/src/cli/tui/screens/create/useCreateFlow.ts b/src/cli/tui/screens/create/useCreateFlow.ts
index 04c003ad0..bc3131521 100644
--- a/src/cli/tui/screens/create/useCreateFlow.ts
+++ b/src/cli/tui/screens/create/useCreateFlow.ts
@@ -3,6 +3,7 @@ import type { DeployedState } from '../../../../schema';
 import { getErrorMessage } from '../../../errors';
 import { CreateLogger } from '../../../logging';
 import { initGitRepo, setupPythonProject, writeEnvFile, writeGitignore } from '../../../operations';
+import { createConfigBundleForAgent } from '../../../operations/agent/config-bundle-defaults';
 import {
   mapGenerateConfigToRenderConfig,
   mapModelProviderToCredentials,
@@ -20,6 +21,7 @@ import { withMinDuration } from '../../utils';
 import { mapByoConfigToAgent } from '../agent';
 import type { AddAgentConfig } from '../agent/types';
 import type { GenerateConfig } from '../generate/types';
+import type { AddHarnessConfig } from '../harness/types';
 import { mkdir } from 'fs/promises';
 import { basename, join } from 'path';
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
@@ -28,8 +30,9 @@ type CreatePhase =
   | 'checking'
   | 'existing-project-error'
   | 'input'
-  | 'create-prompt'
+  | 'create-type-prompt'
   | 'create-wizard'
+  | 'harness-wizard'
   | 'running'
   | 'complete';
 
@@ -45,16 +48,23 @@ interface CreateFlowState {
   // Project name actions
   setProjectName: (name: string) => void;
   confirmProjectName: () => void;
-  // Create prompt actions
-  wantsCreate: boolean;
-  setWantsCreate: (wants: boolean) => void;
+  // Create type selection
+  handleCreateTypeSelection: (choice: 'harness' | 'agent' | 'skip') => void;
   // Add agent config (set when AddAgentScreen completes)
   addAgentConfig: AddAgentConfig | null;
   handleAddAgentComplete: (config: AddAgentConfig) => void;
   goBackFromAddAgent: () => void;
+  // Add harness config (set when AddHarnessScreen completes)
+  addHarnessConfig: AddHarnessConfig | null;
+  handleAddHarnessComplete: (config: AddHarnessConfig) => void;
+  goBackFromHarnessWizard: () => void;
 }
 
-function getCreateSteps(projectName: string, agentConfig: AddAgentConfig | null): Step[] {
+function getCreateSteps(
+  projectName: string,
+  agentConfig: AddAgentConfig | null,
+  harnessConfig: AddHarnessConfig | null
+): Step[] {
   const steps: Step[] = [{ label: `Create ${projectName}/ project directory`, status: 'pending' }];
 
   if (agentConfig) {
@@ -62,6 +72,8 @@ function getCreateSteps(projectName: string, agentConfig: AddAgentConfig | null)
     if (agentConfig.language === 'Python' && agentConfig.agentType === 'create') {
       steps.push({ label: 'Set up Python environment', status: 'pending' });
     }
+  } else if (harnessConfig) {
+    steps.push({ label: 'Add harness to project', status: 'pending' });
   }
 
   steps.push({ label: 'Prepare agentcore/ directory', status: 'pending' });
@@ -107,12 +119,12 @@ export function useCreateFlow(cwd: string): CreateFlowState {
   const [outputDir, setOutputDir] = useState<string>();
   const [logFilePath, setLogFilePath] = useState<string | undefined>();
 
-  // Create prompt state
-  const [wantsCreate, setWantsCreate] = useState(false);
-
   // Add agent config (from AddAgentScreen)
   const [addAgentConfig, setAddAgentConfig] = useState<AddAgentConfig | null>(null);
 
+  // Add harness config (from AddHarnessScreen)
+  const [addHarnessConfig, setAddHarnessConfig] = useState<AddHarnessConfig | null>(null);
+
   // Logger ref for the create operation
   const loggerRef = useRef<CreateLogger | null>(null);
 
@@ -137,24 +149,28 @@ export function useCreateFlow(cwd: string): CreateFlowState {
   }, [cwd, phase]);
 
   const confirmProjectName = useCallback(() => {
-    setPhase('create-prompt');
+    setPhase('create-type-prompt');
   }, []);
 
   const updateStep = (index: number, update: Partial<Step>) => {
     setSteps(prev => prev.map((s, i) => (i === index ? { ...s, ...update } : s)));
   };
 
-  // Create prompt handlers
-  const handleSetWantsCreate = useCallback(
-    (wants: boolean) => {
-      setWantsCreate(wants);
-      if (wants) {
-        setAddAgentConfig(null); // Reset any previous config
+  // Create type selection handler
+  const handleCreateTypeSelection = useCallback(
+    (choice: 'harness' | 'agent' | 'skip') => {
+      if (choice === 'harness') {
+        setAddAgentConfig(null);
+        setAddHarnessConfig(null);
+        setPhase('harness-wizard');
+      } else if (choice === 'agent') {
+        setAddAgentConfig(null);
+        setAddHarnessConfig(null);
         setPhase('create-wizard');
       } else {
-        // Skip add agent, go straight to running
         setAddAgentConfig(null);
-        setSteps(getCreateSteps(projectName, null));
+        setAddHarnessConfig(null);
+        setSteps(getCreateSteps(projectName, null, null));
         setPhase('running');
       }
     },
@@ -165,15 +181,30 @@ export function useCreateFlow(cwd: string): CreateFlowState {
   const handleAddAgentComplete = useCallback(
     (config: AddAgentConfig) => {
       setAddAgentConfig(config);
-      setSteps(getCreateSteps(projectName, config));
+      setSteps(getCreateSteps(projectName, config, null));
       setPhase('running');
     },
     [projectName]
   );
 
-  // Go back from add agent wizard to create prompt
+  // Go back from add agent wizard to create type prompt
   const goBackFromAddAgent = useCallback(() => {
-    setPhase('create-prompt');
+    setPhase('create-type-prompt');
+  }, []);
+
+  // Handle completion from AddHarnessScreen
+  const handleAddHarnessComplete = useCallback(
+    (config: AddHarnessConfig) => {
+      setAddHarnessConfig(config);
+      setSteps(getCreateSteps(projectName, null, config));
+      setPhase('running');
+    },
+    [projectName]
+  );
+
+  // Go back from harness wizard to create type prompt
+  const goBackFromHarnessWizard = useCallback(() => {
+    setPhase('create-type-prompt');
   }, []);
 
   // Main running effect
@@ -276,6 +307,7 @@ export function useCreateFlow(cwd: string): CreateFlowState {
                   idleRuntimeSessionTimeout: addAgentConfig.idleRuntimeSessionTimeout,
                   maxLifetime: addAgentConfig.maxLifetime,
                   sessionStorageMountPath: addAgentConfig.sessionStorageMountPath,
+                  withConfigBundle: addAgentConfig.withConfigBundle,
                 };
 
                 logger.logSubStep(`Framework: ${generateConfig.sdk}`);
@@ -338,6 +370,11 @@ export function useCreateFlow(cwd: string): CreateFlowState {
                     () => configIO.readProjectSpec()
                   );
                 }
+                // Auto-create config bundle when opted in
+                if (addAgentConfig.withConfigBundle) {
+                  logger.logSubStep('Creating config bundle...');
+                  await createConfigBundleForAgent(addAgentConfig.name, configBaseDir);
+                }
               } else if (addAgentConfig.agentType === 'import') {
                 // Import path: delegate to executeImportAgent
                 logger.logSubStep(`Importing from Bedrock Agent: ${addAgentConfig.bedrockAgentId}`);
@@ -452,6 +489,66 @@ export function useCreateFlow(cwd: string): CreateFlowState {
           }
         }
 
+        // Step: Add harness to project (if addHarnessConfig is set)
+        if (!addAgentConfig && addHarnessConfig) {
+          logger.startStep('Add harness to project');
+          updateStep(stepIndex, { status: 'running' });
+          try {
+            await withMinDuration(async () => {
+              logger.logSubStep(`Adding harness: ${addHarnessConfig.name}`);
+              const { harnessPrimitive } = await import('../../../primitives/registry');
+              const result = await harnessPrimitive.add({
+                name: addHarnessConfig.name,
+                modelProvider: addHarnessConfig.modelProvider,
+                modelId: addHarnessConfig.modelId,
+                apiKeyArn: addHarnessConfig.apiKeyArn,
+                skipMemory: addHarnessConfig.skipMemory,
+                containerUri: addHarnessConfig.containerUri,
+                dockerfilePath: addHarnessConfig.dockerfilePath,
+                maxIterations: addHarnessConfig.maxIterations,
+                maxTokens: addHarnessConfig.maxTokens,
+                timeoutSeconds: addHarnessConfig.timeoutSeconds,
+                truncationStrategy: addHarnessConfig.truncationStrategy,
+                networkMode: addHarnessConfig.networkMode,
+                subnets: addHarnessConfig.subnets,
+                securityGroups: addHarnessConfig.securityGroups,
+                idleTimeout: addHarnessConfig.idleTimeout,
+                maxLifetime: addHarnessConfig.maxLifetime,
+                sessionStoragePath: addHarnessConfig.sessionStoragePath,
+                selectedTools: addHarnessConfig.selectedTools,
+                mcpName: addHarnessConfig.mcpName,
+                mcpUrl: addHarnessConfig.mcpUrl,
+                gatewayArn: addHarnessConfig.gatewayArn,
+                authorizerType: addHarnessConfig.authorizerType,
+                jwtConfig: addHarnessConfig.jwtConfig
+                  ? {
+                      discoveryUrl: addHarnessConfig.jwtConfig.discoveryUrl,
+                      allowedAudience: addHarnessConfig.jwtConfig.allowedAudience,
+                      allowedClients: addHarnessConfig.jwtConfig.allowedClients,
+                      allowedScopes: addHarnessConfig.jwtConfig.allowedScopes,
+                      customClaims: addHarnessConfig.jwtConfig.customClaims,
+                      clientId: addHarnessConfig.jwtConfig.clientId,
+                      clientSecret: addHarnessConfig.jwtConfig.clientSecret,
+                    }
+                  : undefined,
+                configBaseDir,
+              });
+              if (!result.success) {
+                throw new Error(result.error);
+              }
+            });
+            logger.endStep('success');
+            updateStep(stepIndex, { status: 'success' });
+            stepIndex++;
+          } catch (err) {
+            const errMsg = getErrorMessage(err);
+            logger.endStep('error', errMsg);
+            updateStep(stepIndex, { status: 'error', error: errMsg });
+            logger.finalize(false);
+            return;
+          }
+        }
+
         // Step: Create CDK project
         logger.startStep('Prepare agentcore/ directory (CDK project)');
         updateStep(stepIndex, { status: 'running' });
@@ -487,6 +584,7 @@ export function useCreateFlow(cwd: string): CreateFlowState {
           logger.endStep('success');
           updateStep(stepIndex, { status: 'success' });
         }
+        stepIndex++;
 
         logger.finalize(true);
         setPhase('complete');
@@ -523,12 +621,15 @@ export function useCreateFlow(cwd: string): CreateFlowState {
     logFilePath,
     setProjectName,
     confirmProjectName,
-    // Create prompt
-    wantsCreate,
-    setWantsCreate: handleSetWantsCreate,
+    // Create type selection
+    handleCreateTypeSelection,
     // Add agent
     addAgentConfig,
     handleAddAgentComplete,
     goBackFromAddAgent,
+    // Add harness
+    addHarnessConfig,
+    handleAddHarnessComplete,
+    goBackFromHarnessWizard,
   };
 }
diff --git a/src/cli/tui/screens/deploy/DeployScreen.tsx b/src/cli/tui/screens/deploy/DeployScreen.tsx
index 6e99e0cfc..729d14656 100644
--- a/src/cli/tui/screens/deploy/DeployScreen.tsx
+++ b/src/cli/tui/screens/deploy/DeployScreen.tsx
@@ -36,8 +36,8 @@ interface DeployScreenProps {
 }
 
 /** Next steps shown after successful deployment */
-function getDeployNextSteps(hasAgents: boolean): NextStep[] {
-  if (hasAgents) {
+function getDeployNextSteps(hasInvokable: boolean): NextStep[] {
+  if (hasInvokable) {
     return [
       { command: 'invoke', label: 'Test your agent' },
       { command: 'status', label: 'View deployment status' },
@@ -76,6 +76,8 @@ export function DeployScreen({
     diffSummaries,
     numStacksWithChanges,
     deployNotes,
+    postDeployWarnings,
+    postDeployHasError,
     isDiffLoading,
     requestDiff,
     hasError,
@@ -342,7 +344,13 @@ export function DeployScreen({
           {/* Show deploy status when deploying or complete */}
           {showDeployStatus && (
             <Box marginTop={1}>
-              <DeployStatus messages={deployMessages} isComplete={isComplete} hasError={hasError} />
+              <DeployStatus
+                messages={deployMessages}
+                isComplete={isComplete}
+                hasError={hasError}
+                hasPostDeployError={postDeployHasError}
+                postDeployWarnings={postDeployWarnings}
+              />
             </Box>
           )}
 
@@ -375,6 +383,20 @@ export function DeployScreen({
             </Box>
           )}
 
+          {allSuccess && postDeployWarnings.length > 0 && (
+            <Box flexDirection="column" marginTop={1}>
+              <Text color="yellow" bold>
+                Post-deploy warnings:
+              </Text>
+              {postDeployWarnings.map((w, i) => (
+                <Text key={i} color="yellow">
+                  {'  '}
+                  {w}
+                </Text>
+              ))}
+            </Box>
+          )}
+
           {allSuccess && deployNotes.length > 0 && (
             <Box flexDirection="column" marginTop={1}>
               {deployNotes.map((note, i) => (
@@ -405,7 +427,9 @@ export function DeployScreen({
 
           {allSuccess && !diffMode && (
             <NextSteps
-              steps={getDeployNextSteps((context?.projectSpec.runtimes.length ?? 0) > 0)}
+              steps={getDeployNextSteps(
+                (context?.projectSpec.runtimes.length ?? 0) > 0 || (context?.projectSpec.harnesses?.length ?? 0) > 0
+              )}
               isInteractive={isInteractive}
               onSelect={step => {
                 if (step.command === 'invoke') {
diff --git a/src/cli/tui/screens/deploy/useDeployFlow.ts b/src/cli/tui/screens/deploy/useDeployFlow.ts
index 786c70764..33531e521 100644
--- a/src/cli/tui/screens/deploy/useDeployFlow.ts
+++ b/src/cli/tui/screens/deploy/useDeployFlow.ts
@@ -1,4 +1,5 @@
 import { ConfigIO } from '../../../../lib';
+import type { DeployedState, HarnessDeployedState } from '../../../../schema';
 import type { CdkToolkitWrapper, DeployMessage, SwitchableIoHost } from '../../../cdk/toolkit-lib';
 import {
   buildDeployedState,
@@ -15,6 +16,14 @@ import { getErrorMessage, isChangesetInProgressError, isExpiredTokenError } from
 import { ExecLogger } from '../../../logging';
 import { performStackTeardown, setupTransactionSearch } from '../../../operations/deploy';
 import { getGatewayTargetStatuses } from '../../../operations/deploy/gateway-status';
+import { createDeploymentManager } from '../../../operations/deploy/imperative';
+import { deleteOrphanedABTests, setupABTests } from '../../../operations/deploy/post-deploy-ab-tests';
+import {
+  resolveConfigBundleComponentKeys,
+  setupConfigBundles,
+} from '../../../operations/deploy/post-deploy-config-bundles';
+import { setupHttpGateways } from '../../../operations/deploy/post-deploy-http-gateways';
+import { enableOnlineEvalConfigs } from '../../../operations/deploy/post-deploy-online-evals';
 import {
   type StackDiffSummary,
   type Step,
@@ -83,6 +92,10 @@ interface DeployFlowState {
   numStacksWithChanges?: number;
   /** Notes to display after successful deploy (e.g., transaction search info) */
   deployNotes: string[];
+  /** Warnings from post-deploy steps (config bundles, AB tests) */
+  postDeployWarnings: string[];
+  /** True if any post-deploy sub-resource operation had errors */
+  postDeployHasError: boolean;
   /** Whether an on-demand diff is currently running */
   isDiffLoading: boolean;
   /** Request an on-demand diff (lazy: runs once, caches result) */
@@ -128,11 +141,14 @@ export function useDeployFlow(options: DeployFlowOptions = {}): DeployFlowState
   });
   const [publishAssetsStep, setPublishAssetsStep] = useState<Step>({ label: 'Publish assets', status: 'pending' });
   const [deployStep, setDeployStep] = useState<Step>({ label: 'Deploy to AWS', status: 'pending' });
+  const [postCdkStep, setPostCdkStep] = useState<Step | null>(null);
   const [diffStep, setDiffStep] = useState<Step>({ label: 'Run CDK diff', status: 'pending' });
   const [diffSummaries, setDiffSummaries] = useState<StackDiffSummary[]>([]);
   const [numStacksWithChanges, setNumStacksWithChanges] = useState<number | undefined>();
   const [isDiffLoading, setIsDiffLoading] = useState(false);
   const [deployNotes, setDeployNotes] = useState<string[]>([]);
+  const [postDeployWarnings, setPostDeployWarnings] = useState<string[]>([]);
+  const [postDeployHasError, setPostDeployHasError] = useState(false);
   const isDiffRunningRef = useRef(false);
   const [deployOutput, setDeployOutput] = useState<string | null>(null);
   const [deployMessages, setDeployMessages] = useState<DeployMessage[]>([]);
@@ -151,6 +167,7 @@ export function useDeployFlow(options: DeployFlowOptions = {}): DeployFlowState
     setPreDeployDiffStep({ label: 'Computing diff changes...', status: 'pending' });
     setPublishAssetsStep({ label: 'Publish assets', status: 'pending' });
     setDeployStep({ label: 'Deploy to AWS', status: 'pending' });
+    setPostCdkStep(null);
     setDeployOutput(null);
     setHasTokenExpiredError(false); // Reset token expired state when retrying
     setHasStartedCfn(false);
@@ -274,8 +291,14 @@ export function useDeployFlow(options: DeployFlowOptions = {}): DeployFlowState
     const evaluators = parseEvaluatorOutputs(outputs, evaluatorNames);
 
     // Parse online eval config outputs
-    const onlineEvalNames = (ctx.projectSpec.onlineEvalConfigs ?? []).map((c: { name: string }) => c.name);
-    const onlineEvalConfigs = parseOnlineEvalOutputs(outputs, onlineEvalNames);
+    const onlineEvalSpecs = (ctx.projectSpec.onlineEvalConfigs ?? []).map(
+      (c: { name: string; agent?: string; endpoint?: string }) => ({
+        name: c.name,
+        agent: c.agent,
+        endpoint: c.endpoint,
+      })
+    );
+    const onlineEvalConfigs = parseOnlineEvalOutputs(outputs, onlineEvalSpecs);
 
     // Parse policy engine outputs
     const policyEngineSpecs = ctx.projectSpec.policyEngines ?? [];
@@ -292,7 +315,42 @@ export function useDeployFlow(options: DeployFlowOptions = {}): DeployFlowState
     setStackOutputs(outputs);
 
     const existingState = await configIO.readDeployedState().catch(() => undefined);
-    const deployedState = buildDeployedState({
+
+    // Post-CDK: deploy imperative resources (harness)
+    let deployedHarnesses: Record<string, HarnessDeployedState> | undefined;
+    const imperativeManager = createDeploymentManager();
+    const imperativeDeployedState = existingState ?? { targets: {} };
+    const imperativeContext = {
+      projectSpec: ctx.projectSpec,
+      target,
+      configIO,
+      deployedState: imperativeDeployedState,
+      cdkOutputs: outputs,
+      onProgress: (step: string, status: 'start' | 'done' | 'error') => {
+        logger.log(`${step}: ${status}`);
+      },
+    };
+
+    let harnessDeployError: string | undefined;
+    if (imperativeManager.hasDeployersForPhase('post-cdk', imperativeContext)) {
+      setPostCdkStep({ label: 'Deploy harnesses', status: 'running' });
+      logger.startStep('Deploy harnesses');
+      const postCdkResult = await imperativeManager.runPhase('post-cdk', imperativeContext);
+      const harnessResult = postCdkResult.results.get('harness');
+      if (harnessResult?.state) {
+        deployedHarnesses = harnessResult.state as Record<string, HarnessDeployedState>;
+      }
+      if (!postCdkResult.success) {
+        logger.endStep('error', postCdkResult.error);
+        harnessDeployError = postCdkResult.error;
+      } else {
+        logger.endStep('success');
+      }
+    }
+
+    // Persist state BEFORE updating React step status — React state updates can
+    // interrupt this async callback by triggering re-renders that dispose resources.
+    let deployedState = buildDeployedState({
       targetName: target.name,
       stackName: currentStackName,
       agents,
@@ -305,9 +363,227 @@ export function useDeployFlow(options: DeployFlowOptions = {}): DeployFlowState
       credentials: Object.keys(allCredentials).length > 0 ? allCredentials : undefined,
       policyEngines,
       policies,
+      harnesses: deployedHarnesses,
     });
     await configIO.writeDeployedState(deployedState);
 
+    // Now safe to update React state — the file write is complete
+    if (imperativeManager.hasDeployersForPhase('post-cdk', imperativeContext)) {
+      if (harnessDeployError) {
+        setPostCdkStep({ label: 'Deploy harnesses', status: 'error', error: harnessDeployError });
+      } else {
+        setPostCdkStep({ label: 'Deploy harnesses', status: 'success' });
+      }
+    }
+
+    if (harnessDeployError) {
+      throw new Error(`Harness deployment failed: ${harnessDeployError}`);
+    }
+
+    // Post-deploy: Enable online eval configs that have enableOnCreate (CFN deploys them as DISABLED).
+    // Only enable configs that are newly deployed — skip configs that already existed before this
+    // deploy run, so we don't re-enable configs a customer intentionally disabled.
+    const onlineEvalFullSpecs = ctx.projectSpec.onlineEvalConfigs ?? [];
+    const deployedOnlineEvalConfigs = deployedState.targets?.[target.name]?.resources?.onlineEvalConfigs ?? {};
+    const previouslyDeployedOnlineEvals = existingState?.targets?.[target.name]?.resources?.onlineEvalConfigs ?? {};
+    const newOnlineEvalFullSpecs = onlineEvalFullSpecs.filter(c => !previouslyDeployedOnlineEvals[c.name]);
+    if (newOnlineEvalFullSpecs.length > 0 && Object.keys(deployedOnlineEvalConfigs).length > 0) {
+      try {
+        const enableResult = await enableOnlineEvalConfigs({
+          region: target.region,
+          onlineEvalConfigs: newOnlineEvalFullSpecs,
+          deployedOnlineEvalConfigs,
+        });
+
+        if (enableResult.hasErrors) {
+          const errors = enableResult.results.filter(r => r.status === 'error');
+          for (const err of errors) {
+            logger.log(`Online eval enable "${err.configName}" error: ${err.error}`, 'warn');
+          }
+          setPostDeployHasError(true);
+          setPostDeployWarnings(prev => [
+            ...prev,
+            ...errors.map(err => `Online eval "${err.configName}": ${err.error}`),
+          ]);
+        }
+      } catch (err: unknown) {
+        const message = err instanceof Error ? err.message : String(err);
+        logger.log(`Online eval enable failed: ${message}`, 'warn');
+        setPostDeployHasError(true);
+        setPostDeployWarnings(prev => [...prev, `Online eval enable failed: ${message}`]);
+      }
+    }
+
+    // Post-deploy: Create/update configuration bundles
+    const configBundleSpecs = ctx.projectSpec.configBundles ?? [];
+    if (configBundleSpecs.length > 0) {
+      try {
+        // Resolve component key placeholders (e.g., {{runtime:name}} → real ARN)
+        const resolvedProjectSpec = resolveConfigBundleComponentKeys(ctx.projectSpec, deployedState, target.name);
+        const existingConfigBundles = deployedState.targets?.[target.name]?.resources?.configBundles;
+        const configBundleResult = await setupConfigBundles({
+          region: target.region,
+          projectSpec: resolvedProjectSpec,
+          existingBundles: existingConfigBundles,
+        });
+
+        // Merge config bundle state into deployed state
+        if (Object.keys(configBundleResult.configBundles).length > 0) {
+          const updatedState = await configIO.readDeployedState().catch(() => deployedState);
+          const targetResources = updatedState.targets[target.name]?.resources;
+          if (targetResources) {
+            targetResources.configBundles = configBundleResult.configBundles;
+            await configIO.writeDeployedState(updatedState);
+          }
+        }
+
+        if (configBundleResult.hasErrors) {
+          const errors = configBundleResult.results.filter(r => r.status === 'error');
+          for (const err of errors) {
+            logger.log(`Config bundle "${err.bundleName}" setup error: ${err.error}`, 'warn');
+          }
+          setPostDeployHasError(true);
+          setPostDeployWarnings(prev => [
+            ...prev,
+            ...errors.map(err => `Config bundle "${err.bundleName}": ${err.error}`),
+          ]);
+        }
+      } catch (err: unknown) {
+        const message = err instanceof Error ? err.message : String(err);
+        logger.log(`Config bundle setup failed: ${message}`, 'warn');
+        setPostDeployHasError(true);
+        setPostDeployWarnings(prev => [...prev, `Config bundle setup failed: ${message}`]);
+      }
+    }
+
+    // Pre-gateway: Delete orphaned AB tests so their gateway rules are cleaned up
+    // before we attempt to delete orphaned HTTP gateways.
+    const existingABTests = deployedState.targets?.[target.name]?.resources?.abTests;
+    if (existingABTests && Object.keys(existingABTests).length > 0) {
+      try {
+        const deleteResult = await deleteOrphanedABTests({
+          region: target.region,
+          projectSpec: ctx.projectSpec,
+          existingABTests,
+        });
+
+        if (deleteResult.hasErrors) {
+          const errors = deleteResult.results.filter(r => r.status === 'error');
+          for (const err of errors) {
+            logger.log(`AB test delete "${err.testName}" error: ${err.error}`, 'warn');
+          }
+          setPostDeployHasError(true);
+          setPostDeployWarnings(prev => [...prev, ...errors.map(err => `AB test "${err.testName}": ${err.error}`)]);
+        }
+
+        // Surface warnings (e.g., "AB test was stopped before deletion")
+        for (const r of deleteResult.results) {
+          if (r.warning) {
+            logger.log(r.warning, 'warn');
+            setPostDeployWarnings(prev => [...prev, r.warning!]);
+          }
+        }
+
+        // Update deployed state to remove deleted AB tests
+        if (deleteResult.results.some(r => r.status === 'deleted')) {
+          const updatedState = await configIO.readDeployedState().catch(() => deployedState);
+          const targetResources = updatedState.targets[target.name]?.resources;
+          if (targetResources?.abTests) {
+            for (const r of deleteResult.results) {
+              if (r.status === 'deleted') delete targetResources.abTests[r.testName];
+            }
+            await configIO.writeDeployedState(updatedState);
+            deployedState = updatedState;
+          }
+        }
+      } catch (err: unknown) {
+        const message = err instanceof Error ? err.message : String(err);
+        logger.log(`AB test orphan cleanup failed: ${message}`, 'warn');
+        setPostDeployHasError(true);
+        setPostDeployWarnings(prev => [...prev, `AB test orphan cleanup failed: ${message}`]);
+      }
+    }
+
+    // Post-deploy: Create/update HTTP gateways
+    const httpGatewaySpecs = ctx.projectSpec.httpGateways ?? [];
+    const existingHttpGateways = deployedState.targets?.[target.name]?.resources?.httpGateways;
+    if (httpGatewaySpecs.length > 0 || Object.keys(existingHttpGateways ?? {}).length > 0) {
+      try {
+        const deployedResources = deployedState.targets?.[target.name]?.resources;
+        const httpGatewayResult = await setupHttpGateways({
+          region: target.region,
+          projectName: ctx.projectSpec.name,
+          projectSpec: ctx.projectSpec,
+          existingHttpGateways,
+          deployedResources,
+        });
+
+        // Always merge HTTP gateway state (even if empty, to clear deleted gateways)
+        const updatedState = await configIO.readDeployedState().catch(() => deployedState);
+        const targetResources = updatedState.targets[target.name]?.resources;
+        if (targetResources) {
+          targetResources.httpGateways = httpGatewayResult.httpGateways;
+          await configIO.writeDeployedState(updatedState);
+          deployedState = updatedState;
+        }
+
+        if (httpGatewayResult.hasErrors) {
+          const errors = httpGatewayResult.results.filter(r => r.status === 'error');
+          for (const err of errors) {
+            logger.log(`HTTP gateway "${err.gatewayName}" setup error: ${err.error}`, 'warn');
+          }
+          setPostDeployHasError(true);
+          setPostDeployWarnings(prev => [
+            ...prev,
+            ...errors.map(err => `HTTP gateway "${err.gatewayName}": ${err.error}`),
+          ]);
+        }
+      } catch (err: unknown) {
+        const message = err instanceof Error ? err.message : String(err);
+        logger.log(`HTTP gateway setup failed: ${message}`, 'warn');
+        setPostDeployHasError(true);
+        setPostDeployWarnings(prev => [...prev, `HTTP gateway setup failed: ${message}`]);
+      }
+    }
+
+    // Post-deploy: Create/update AB tests
+    const abTestSpecs = ctx.projectSpec.abTests ?? [];
+    if (abTestSpecs.length > 0) {
+      try {
+        const existingABTests = deployedState.targets?.[target.name]?.resources?.abTests;
+        const deployedResources = deployedState.targets?.[target.name]?.resources;
+        const abTestResult = await setupABTests({
+          region: target.region,
+          projectSpec: ctx.projectSpec,
+          existingABTests,
+          deployedResources,
+        });
+
+        if (Object.keys(abTestResult.abTests).length > 0) {
+          const updatedState = await configIO.readDeployedState().catch(() => deployedState);
+          const targetResources = updatedState.targets[target.name]?.resources;
+          if (targetResources) {
+            targetResources.abTests = abTestResult.abTests;
+            await configIO.writeDeployedState(updatedState);
+          }
+        }
+
+        if (abTestResult.hasErrors) {
+          const errors = abTestResult.results.filter(r => r.status === 'error');
+          for (const err of errors) {
+            logger.log(`AB test "${err.testName}" setup error: ${err.error}`, 'warn');
+          }
+          setPostDeployHasError(true);
+          setPostDeployWarnings(prev => [...prev, ...errors.map(err => `AB test "${err.testName}": ${err.error}`)]);
+        }
+      } catch (err: unknown) {
+        const message = err instanceof Error ? err.message : String(err);
+        logger.log(`AB test setup failed: ${message}`, 'warn');
+        setPostDeployHasError(true);
+        setPostDeployWarnings(prev => [...prev, `AB test setup failed: ${message}`]);
+      }
+    }
+
     // Query gateway target sync statuses (non-blocking)
     const allStatuses: { name: string; status: string }[] = [];
     for (const [, gateway] of Object.entries(gateways)) {
@@ -395,6 +671,35 @@ export function useDeployFlow(options: DeployFlowOptions = {}): DeployFlowState
         await cdkToolkitWrapper.deploy();
 
         if (context?.isTeardownDeploy) {
+          // Teardown imperative resources (harnesses) before destroying the stack
+          const teardownTarget = context.awsTargets[0];
+          if (teardownTarget) {
+            const imperativeManager = createDeploymentManager();
+            const configIO = new ConfigIO();
+            const existingTeardownState = await configIO
+              .readDeployedState()
+              .catch(() => ({ targets: {} }) as DeployedState);
+            const teardownContext = {
+              projectSpec: context.projectSpec,
+              target: teardownTarget,
+              configIO,
+              deployedState: existingTeardownState,
+              onProgress: (step: string, status: 'start' | 'done' | 'error') => {
+                logger.log(`${step}: ${status}`);
+              },
+            };
+
+            if (imperativeManager.hasDeployersForPhase('post-cdk', teardownContext)) {
+              logger.startStep('Tear down imperative resources');
+              const teardownResult = await imperativeManager.teardownAll(teardownContext);
+              if (!teardownResult.success) {
+                logger.endStep('error', teardownResult.error);
+                throw new Error(`Imperative teardown failed: ${teardownResult.error}`);
+              }
+              logger.endStep('success');
+            }
+          }
+
           // After deploying the empty spec, destroy the stack entirely
           const targetName = context.awsTargets[0]?.name;
           if (targetName) {
@@ -578,22 +883,36 @@ export function useDeployFlow(options: DeployFlowOptions = {}): DeployFlowState
     if (diffMode) {
       return skipPreflight ? [diffStep] : [...preflight.steps, diffStep];
     }
-    return skipPreflight
+    const deploySteps = skipPreflight
       ? [preDeployDiffStep, publishAssetsStep, deployStep]
       : [...preflight.steps, preDeployDiffStep, publishAssetsStep, deployStep];
-  }, [preflight.steps, preDeployDiffStep, publishAssetsStep, deployStep, diffStep, skipPreflight, diffMode]);
+    if (postCdkStep) {
+      deploySteps.push(postCdkStep);
+    }
+    return deploySteps;
+  }, [
+    preflight.steps,
+    preDeployDiffStep,
+    publishAssetsStep,
+    deployStep,
+    diffStep,
+    skipPreflight,
+    diffMode,
+    postCdkStep,
+  ]);
 
   const phase: DeployPhase = useMemo(() => {
     const activeStep = diffMode ? diffStep : deployStep;
+    const finalStep = postCdkStep ?? activeStep;
 
     if (skipPreflight) {
       if (!shouldStartDeploy && activeStep.status === 'pending') {
         return 'idle';
       }
-      if (activeStep.status === 'error') {
+      if (finalStep.status === 'error') {
         return 'error';
       }
-      if (activeStep.status === 'success') {
+      if (finalStep.status === 'success') {
         return 'complete';
       }
       return 'deploying';
@@ -617,14 +936,14 @@ export function useDeployFlow(options: DeployFlowOptions = {}): DeployFlowState
     if (preflight.phase === 'running' || preflight.phase === 'bootstrapping' || preflight.phase === 'identity-setup') {
       return 'running';
     }
-    if (activeStep.status === 'error') {
+    if (finalStep.status === 'error') {
       return 'error';
     }
-    if (activeStep.status === 'success') {
+    if (finalStep.status === 'success') {
       return 'complete';
     }
     return 'deploying';
-  }, [preflight.phase, deployStep, diffStep, skipPreflight, shouldStartDeploy, diffMode]);
+  }, [preflight.phase, deployStep, diffStep, skipPreflight, shouldStartDeploy, diffMode, postCdkStep]);
 
   const hasError = hasStepError(steps);
   const isComplete = areStepsComplete(steps);
@@ -650,6 +969,8 @@ export function useDeployFlow(options: DeployFlowOptions = {}): DeployFlowState
     diffSummaries,
     numStacksWithChanges,
     deployNotes,
+    postDeployWarnings,
+    postDeployHasError,
     isDiffLoading,
     requestDiff,
     stackOutputs,
diff --git a/src/cli/tui/screens/dev/DevScreen.tsx b/src/cli/tui/screens/dev/DevScreen.tsx
index 0040aaf30..e454496ba 100644
--- a/src/cli/tui/screens/dev/DevScreen.tsx
+++ b/src/cli/tui/screens/dev/DevScreen.tsx
@@ -1,11 +1,25 @@
 import type { AgentEnvSpec } from '../../../../schema';
 import { getDevSupportedAgents, getEndpointUrl, loadProjectConfig } from '../../../operations/dev';
-import { GradientText, LogLink, Panel, Screen, SelectList, TextInput } from '../../components';
+import {
+  AwsTargetConfigUI,
+  DeployStatus,
+  GradientText,
+  LogLink,
+  Panel,
+  Screen,
+  SelectList,
+  StepProgress,
+  TextInput,
+  getAwsConfigHelpText,
+} from '../../components';
+import { useAwsTargetConfig } from '../../hooks';
+import { useDevDeploy } from '../../hooks/useDevDeploy';
 import { type ConversationMessage, useDevServer } from '../../hooks/useDevServer';
+import { InvokeScreen } from '../invoke/InvokeScreen';
 import { Box, Text, useInput, useStdout } from 'ink';
 import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 
-type Mode = 'select-agent' | 'chat' | 'input';
+type Mode = 'deploying' | 'select-agent' | 'chat' | 'input' | 'harness';
 
 interface DevScreenProps {
   onBack: () => void;
@@ -15,6 +29,10 @@ interface DevScreenProps {
   agentName?: string;
   /** Custom headers to forward to the agent on every invocation */
   headers?: Record<string, string>;
+  /** Skip automatic resource deployment */
+  skipDeploy?: boolean;
+  /** Called when deploy completes and browser mode should launch */
+  onLaunchBrowser?: (selection?: { agentName?: string; harnessName?: string }) => void;
 }
 
 interface ColoredLine {
@@ -120,7 +138,8 @@ function wrapColoredLines(lines: ColoredLine[], maxWidth: number): ColoredLine[]
 const MAX_VISIBLE_TOOLS = 5;
 
 export function DevScreen(props: DevScreenProps) {
-  const [mode, setMode] = useState<Mode>('select-agent');
+  const { onLaunchBrowser } = props;
+  const [mode, setMode] = useState<Mode>(props.skipDeploy ? 'select-agent' : 'deploying');
   const [isExiting, setIsExiting] = useState(false);
   const [scrollOffset, setScrollOffset] = useState(0);
   // Track if user manually scrolled up (false = auto-scroll to bottom)
@@ -129,6 +148,22 @@ export function DevScreen(props: DevScreenProps) {
   // Track when we just cancelled input to prevent double-escape quit
   const justCancelledRef = useRef(false);
 
+  // AWS target configuration (auto-creates aws-targets.json if missing)
+  const awsConfig = useAwsTargetConfig();
+
+  // Deploy phase state — wait for AWS targets before starting deploy
+  const {
+    steps: deploySteps,
+    deployMessages,
+    isComplete: deployComplete,
+    error: deployError,
+    logPath: deployLogPath,
+  } = useDevDeploy({
+    skip: props.skipDeploy,
+    ready: awsConfig.isConfigured,
+  });
+  const hasTransitionedFromDeployRef = useRef(false);
+
   // Agent selection state
   const [supportedAgents, setSupportedAgents] = useState<AgentEnvSpec[]>([]);
   const [selectedAgentIndex, setSelectedAgentIndex] = useState(0);
@@ -139,31 +174,35 @@ export function DevScreen(props: DevScreenProps) {
   const [isContainerExec, setIsContainerExec] = useState(false);
   const [execInputEmpty, setExecInputEmpty] = useState(true);
 
+  // Harness state
+  const [availableHarnesses, setAvailableHarnesses] = useState<string[]>([]);
+  const [selectedHarness, setSelectedHarness] = useState<string | undefined>();
+
   const workingDir = props.workingDir ?? process.cwd();
 
-  // Load project and get supported agents
+  // Load project and get supported agents (runs once on mount)
   useEffect(() => {
     const load = async () => {
       const project = await loadProjectConfig(workingDir);
       const agents = getDevSupportedAgents(project);
       setSupportedAgents(agents);
 
+      const harnesses = project?.harnesses ?? [];
+      setAvailableHarnesses(harnesses.map(h => h.name));
+
       // If agent name was provided via CLI, validate it
       if (props.agentName) {
         const found = agents.find(a => a.name === props.agentName);
         if (found) {
           setSelectedAgentName(props.agentName);
-          setMode('chat');
         } else if (agents.length > 0) {
-          // Agent not found or not supported, show selection
           setSelectedAgentName(undefined);
         }
-      } else if (agents.length === 1 && agents[0]) {
-        // Auto-select if only one agent
+      } else if (agents.length === 1 && harnesses.length === 0 && agents[0]) {
         setSelectedAgentName(agents[0].name);
-        setMode('chat');
-      } else if (agents.length === 0) {
-        // No supported agents, show error screen
+      } else if (harnesses.length === 1 && agents.length === 0) {
+        setSelectedHarness(harnesses[0]?.name);
+      } else if (agents.length === 0 && harnesses.length === 0) {
         setNoAgentsError(true);
       }
 
@@ -172,6 +211,52 @@ export function DevScreen(props: DevScreenProps) {
     void load();
   }, [workingDir, props.agentName]);
 
+  // Handle deploy completion and transition to next mode
+  useEffect(() => {
+    if (mode !== 'deploying' || !deployComplete || !agentsLoaded || hasTransitionedFromDeployRef.current) return;
+
+    // If deploy failed, stay on deploy screen so the user sees the error.
+    if (deployError) return;
+
+    // Mark as transitioned to prevent re-running
+    hasTransitionedFromDeployRef.current = true;
+
+    // Defer state updates to avoid synchronous setState in effect
+    queueMicrotask(() => {
+      if (onLaunchBrowser) {
+        const agentName =
+          selectedAgentName ??
+          (supportedAgents.length === 1 && availableHarnesses.length === 0 ? supportedAgents[0]?.name : undefined);
+        const harnessName =
+          selectedHarness ??
+          (availableHarnesses.length === 1 && supportedAgents.length === 0 ? availableHarnesses[0] : undefined);
+        onLaunchBrowser({ agentName, harnessName });
+      } else if (selectedAgentName) {
+        setMode('chat');
+      } else if (selectedHarness) {
+        setMode('harness');
+      } else if (supportedAgents.length === 1 && availableHarnesses.length === 0 && supportedAgents[0]) {
+        setSelectedAgentName(supportedAgents[0].name);
+        setMode('chat');
+      } else if (availableHarnesses.length === 1 && supportedAgents.length === 0) {
+        setSelectedHarness(availableHarnesses[0]);
+        setMode('harness');
+      } else {
+        setMode('select-agent');
+      }
+    });
+  }, [
+    mode,
+    deployComplete,
+    deployError,
+    agentsLoaded,
+    selectedAgentName,
+    selectedHarness,
+    supportedAgents,
+    availableHarnesses,
+    onLaunchBrowser,
+  ]);
+
   const onServerReady = useCallback(() => setMode(prev => (prev === 'chat' ? 'input' : prev)), []);
 
   const {
@@ -337,21 +422,39 @@ export function DevScreen(props: DevScreenProps) {
     (input, key) => {
       // Agent selection mode
       if (mode === 'select-agent') {
+        const totalItems = supportedAgents.length + availableHarnesses.length;
         if (key.escape || (key.ctrl && input === 'q')) {
           handleExit();
           return;
         }
         if (key.upArrow || input === 'k') {
-          setSelectedAgentIndex(prev => (prev - 1 + supportedAgents.length) % supportedAgents.length);
+          setSelectedAgentIndex(prev => (prev - 1 + totalItems) % totalItems);
         }
         if (key.downArrow || input === 'j') {
-          setSelectedAgentIndex(prev => (prev + 1) % supportedAgents.length);
+          setSelectedAgentIndex(prev => (prev + 1) % totalItems);
         }
         if (key.return) {
-          const agent = supportedAgents[selectedAgentIndex];
-          if (agent) {
-            setSelectedAgentName(agent.name);
-            setMode('chat');
+          if (selectedAgentIndex < supportedAgents.length) {
+            const agent = supportedAgents[selectedAgentIndex];
+            if (agent) {
+              if (onLaunchBrowser) {
+                onLaunchBrowser({ agentName: agent.name });
+              } else {
+                setSelectedAgentName(agent.name);
+                setMode('chat');
+              }
+            }
+          } else {
+            const harnessIdx = selectedAgentIndex - supportedAgents.length;
+            const harnessName = availableHarnesses[harnessIdx];
+            if (harnessName) {
+              if (onLaunchBrowser) {
+                onLaunchBrowser({ harnessName });
+              } else {
+                setSelectedHarness(harnessName);
+                setMode('harness');
+              }
+            }
           }
         }
         return;
@@ -366,8 +469,8 @@ export function DevScreen(props: DevScreenProps) {
             justCancelledRef.current = false;
             return;
           }
-          // If multiple agents, go back to agent selection
-          if (supportedAgents.length > 1) {
+          // If multiple agents or harnesses, go back to selection
+          if (supportedAgents.length + availableHarnesses.length > 1) {
             stop();
             setMode('select-agent');
             setSelectedAgentName(undefined);
@@ -413,11 +516,51 @@ export function DevScreen(props: DevScreenProps) {
         }
       }
     },
-    { isActive: mode === 'chat' || mode === 'select-agent' }
+    { isActive: (mode === 'chat' || mode === 'select-agent') && !isExiting }
   );
 
-  // Return null while loading
-  if (!agentsLoaded || (mode !== 'select-agent' && !noAgentsError && (!configLoaded || !config))) {
+  // AWS target config screen (shown during deploy phase if targets not yet configured)
+  if (mode === 'deploying' && !awsConfig.isConfigured) {
+    return (
+      <Screen title="Dev" onExit={handleExit} helpText={getAwsConfigHelpText(awsConfig.phase)}>
+        <AwsTargetConfigUI config={awsConfig} onExit={handleExit} isActive={true} />
+      </Screen>
+    );
+  }
+
+  // Deploying screen
+  if (mode === 'deploying') {
+    const hasStartedCfn = deployMessages.length > 0;
+    const displaySteps = hasStartedCfn ? deploySteps.filter(s => s.label !== 'Deploy to AWS') : deploySteps;
+
+    return (
+      <Screen title="Dev" onExit={handleExit} helpText="Esc quit">
+        <Box flexDirection="column" paddingX={1}>
+          <Text bold>Deploying project resources...</Text>
+          <Box marginTop={1}>
+            <StepProgress steps={displaySteps} />
+          </Box>
+          {hasStartedCfn && (
+            <Box marginTop={1}>
+              <DeployStatus messages={deployMessages} isComplete={deployComplete} hasError={!!deployError} />
+            </Box>
+          )}
+          {deployError && (
+            <Box marginTop={1}>
+              <Text color="yellow">Deploy failed: {deployError}</Text>
+            </Box>
+          )}
+          {deployLogPath && <LogLink filePath={deployLogPath} />}
+        </Box>
+      </Screen>
+    );
+  }
+
+  // Return null while loading (harness mode doesn't need dev server config)
+  if (
+    !agentsLoaded ||
+    (mode !== 'select-agent' && mode !== 'harness' && !noAgentsError && (!configLoaded || !config))
+  ) {
     return null;
   }
 
@@ -426,8 +569,8 @@ export function DevScreen(props: DevScreenProps) {
     return (
       <Screen title="Dev Server" onExit={props.onBack} helpText="Esc quit">
         <Box flexDirection="column">
-          <Text color="red">No agents defined in project.</Text>
-          <Text>Dev mode requires at least one Python agent with an entrypoint.</Text>
+          <Text color="red">No agents or harnesses defined in project.</Text>
+          <Text>Dev mode requires at least one Python agent with an entrypoint or a harness.</Text>
           <Text>
             Run <Text color="blue">agentcore add agent</Text> to create one.
           </Text>
@@ -436,13 +579,18 @@ export function DevScreen(props: DevScreenProps) {
     );
   }
 
+  // If harness mode, render the InvokeScreen with the pre-selected harness
+  if (mode === 'harness') {
+    return <InvokeScreen isInteractive={true} onExit={handleExit} title="Dev" initialHarnessName={selectedHarness} />;
+  }
+
   const statusColor = { starting: 'yellow', running: 'green', error: 'red', stopped: 'gray' }[status];
 
   // Visible lines for display
   const visibleLines = lines.slice(effectiveOffset, effectiveOffset + displayHeight);
 
   // Dynamic help text
-  const backOrQuit = supportedAgents.length > 1 ? 'Esc back' : 'Esc quit';
+  const backOrQuit = supportedAgents.length + availableHarnesses.length > 1 ? 'Esc back' : 'Esc quit';
   const execHint = isContainer ? '! exec local · !! exec container' : '! exec';
   const helpText =
     mode === 'select-agent'
@@ -468,15 +616,23 @@ export function DevScreen(props: DevScreenProps) {
   // Agent selection screen
   if (mode === 'select-agent') {
     const agentItems = supportedAgents.map((agent, i) => ({
-      id: String(i),
+      id: `agent-${i}`,
       title: agent.name,
       description: `${agent.runtimeVersion} · ${agent.build}`,
     }));
 
+    const harnessItems = availableHarnesses.map((name, i) => ({
+      id: `harness-${i}`,
+      title: name,
+      description: 'Harness',
+    }));
+
+    const allItems = [...agentItems, ...harnessItems];
+
     return (
       <Screen title="Dev Server" onExit={handleExit} helpText={helpText}>
-        <Panel title="Select Agent" fullWidth>
-          <SelectList items={agentItems} selectedIndex={selectedAgentIndex} />
+        <Panel title={availableHarnesses.length > 0 ? 'Select Target' : 'Select Agent'} fullWidth>
+          <SelectList items={allItems} selectedIndex={selectedAgentIndex} />
         </Panel>
       </Screen>
     );
diff --git a/src/cli/tui/screens/eval/EvalHubScreen.tsx b/src/cli/tui/screens/eval/EvalHubScreen.tsx
index 67056413d..27cb2e66f 100644
--- a/src/cli/tui/screens/eval/EvalHubScreen.tsx
+++ b/src/cli/tui/screens/eval/EvalHubScreen.tsx
@@ -4,7 +4,7 @@ import { HELP_TEXT } from '../../constants';
 import { useListNavigation } from '../../hooks';
 import React, { useMemo } from 'react';
 
-type EvalHubView = 'run-eval' | 'runs' | 'online-dashboard';
+type EvalHubView = 'run-eval' | 'runs' | 'run-batch-eval' | 'batch-eval-history' | 'online-dashboard';
 
 interface EvalHubScreenProps {
   onSelect: (view: EvalHubView) => void;
@@ -19,7 +19,17 @@ export function EvalHubScreen({ onSelect, onExit }: EvalHubScreenProps) {
         title: 'Run On-demand Evaluation',
         description: 'Evaluate agent traces with selected evaluators',
       },
-      { id: 'runs', title: 'Eval Runs', description: 'View past eval run results and scores' },
+      { id: 'runs', title: 'Eval Runs', description: 'View past on-demand eval results and scores' },
+      {
+        id: 'run-batch-eval',
+        title: 'Run Batch Evaluation',
+        description: 'Run a batch evaluation against agent sessions via CloudWatch',
+      },
+      {
+        id: 'batch-eval-history',
+        title: 'Batch Eval History',
+        description: 'View past batch evaluation results (local)',
+      },
       {
         id: 'online-dashboard',
         title: 'Online Eval Dashboard',
diff --git a/src/cli/tui/screens/generate/GenerateWizardUI.tsx b/src/cli/tui/screens/generate/GenerateWizardUI.tsx
index 4b61e4689..9c6c79599 100644
--- a/src/cli/tui/screens/generate/GenerateWizardUI.tsx
+++ b/src/cli/tui/screens/generate/GenerateWizardUI.tsx
@@ -577,6 +577,12 @@ function ConfirmView({ config, credentialProjectName }: { config: GenerateConfig
             <Text>{config.sessionStorageMountPath}</Text>
           </Text>
         )}
+        {config.withConfigBundle && (
+          <Text>
+            <Text dimColor>Config Bundle: </Text>
+            <Text color="green">Yes (auto-created on deploy)</Text>
+          </Text>
+        )}
       </Box>
     </Box>
   );
diff --git a/src/cli/tui/screens/generate/types.ts b/src/cli/tui/screens/generate/types.ts
index 697b318bd..1b764ea80 100644
--- a/src/cli/tui/screens/generate/types.ts
+++ b/src/cli/tui/screens/generate/types.ts
@@ -64,6 +64,8 @@ export interface GenerateConfig {
   maxLifetime?: number;
   /** Mount path for session filesystem storage (e.g. /mnt/session-storage) */
   sessionStorageMountPath?: string;
+  /** When true, create a config bundle wired into the agent template */
+  withConfigBundle?: boolean;
 }
 
 /** Base steps - apiKey, memory, subnets, securityGroups are conditionally added based on selections */
@@ -158,7 +160,14 @@ export const NETWORK_MODE_OPTIONS = [
   { id: 'VPC', title: 'VPC', description: 'Attach to your VPC' },
 ] as const;
 
-export type AdvancedSettingId = 'dockerfile' | 'network' | 'headers' | 'auth' | 'lifecycle' | 'filesystem';
+export type AdvancedSettingId =
+  | 'dockerfile'
+  | 'network'
+  | 'headers'
+  | 'auth'
+  | 'lifecycle'
+  | 'filesystem'
+  | 'configBundle';
 
 export const ADVANCED_SETTING_OPTIONS = [
   { id: 'dockerfile', title: 'Custom Dockerfile', description: 'Specify a custom Dockerfile path' },
@@ -167,6 +176,11 @@ export const ADVANCED_SETTING_OPTIONS = [
   { id: 'auth', title: 'Custom auth (JWT)', description: 'OIDC-based token validation for inbound requests' },
   { id: 'lifecycle', title: 'Lifecycle timeouts', description: 'Idle timeout & max instance lifetime' },
   { id: 'filesystem', title: 'Session filesystem storage', description: 'Persist files across session stop/resume' },
+  {
+    id: 'configBundle',
+    title: 'Config bundle [preview]',
+    description: 'Manage system prompt and tool config without redeploying',
+  },
 ] as const;
 
 /** Dockerfile filename regex — must match the Zod schema in agent-env.ts */
diff --git a/src/cli/tui/screens/generate/useGenerateWizard.ts b/src/cli/tui/screens/generate/useGenerateWizard.ts
index 16e016ad6..411cfb151 100644
--- a/src/cli/tui/screens/generate/useGenerateWizard.ts
+++ b/src/cli/tui/screens/generate/useGenerateWizard.ts
@@ -89,6 +89,7 @@ export function useGenerateWizard(options?: UseGenerateWizardOptions) {
       if (advancedSettings.has('filesystem')) {
         subSteps.push('sessionStorageMountPath');
       }
+      // Config bundle — no sub-steps needed, uses smart defaults
       filtered = [...filtered.slice(0, afterAdvanced), ...subSteps, ...filtered.slice(afterAdvanced)];
     }
     // Add jwtConfig step after authorizerType when CUSTOM_JWT is selected
@@ -234,9 +235,12 @@ export function useGenerateWizard(options?: UseGenerateWizardOptions) {
           idleRuntimeSessionTimeout: undefined,
           maxLifetime: undefined,
           sessionStorageMountPath: undefined,
+          withConfigBundle: undefined,
         }));
         setStep('confirm');
       } else {
+        // Config bundle has no sub-steps — set flag immediately
+        setConfig(c => ({ ...c, withConfigBundle: selected.has('configBundle') || undefined }));
         // Navigate to first advanced sub-step — determined by the steps memo on next render.
         // Use setTimeout so the steps memo recalculates with the new advancedSettings first.
         setTimeout(() => {
diff --git a/src/cli/tui/screens/harness/AddHarnessFlow.tsx b/src/cli/tui/screens/harness/AddHarnessFlow.tsx
new file mode 100644
index 000000000..eca698713
--- /dev/null
+++ b/src/cli/tui/screens/harness/AddHarnessFlow.tsx
@@ -0,0 +1,138 @@
+import { ErrorPrompt } from '../../components';
+import { AddSuccessScreen } from '../add/AddSuccessScreen';
+import { AddHarnessScreen } from './AddHarnessScreen';
+import type { AddHarnessConfig } from './types';
+import React, { useCallback, useEffect, useState } from 'react';
+
+type FlowState =
+  | { name: 'create-wizard' }
+  | { name: 'create-success'; harnessName: string; loading?: boolean; loadingMessage?: string }
+  | { name: 'error'; message: string };
+
+interface AddHarnessFlowProps {
+  isInteractive?: boolean;
+  onExit: () => void;
+  onBack: () => void;
+  onDev?: () => void;
+  onDeploy?: () => void;
+}
+
+export function AddHarnessFlow({ isInteractive = true, onExit, onBack, onDev, onDeploy }: AddHarnessFlowProps) {
+  const [flow, setFlow] = useState<FlowState>({ name: 'create-wizard' });
+  const [existingNames, setExistingNames] = useState<string[]>([]);
+
+  useEffect(() => {
+    void (async () => {
+      try {
+        const { ConfigIO } = await import('../../../../lib');
+        const configIO = new ConfigIO();
+        if (configIO.hasProject()) {
+          const project = await configIO.readProjectSpec();
+          setExistingNames((project.harnesses ?? []).map(h => h.name));
+        }
+      } catch {
+        // ignore
+      }
+    })();
+  }, []);
+
+  useEffect(() => {
+    if (!isInteractive && flow.name === 'create-success' && !flow.loading) {
+      onExit();
+    }
+  }, [isInteractive, flow, onExit]);
+
+  const handleCreateComplete = useCallback(async (config: AddHarnessConfig) => {
+    setFlow({ name: 'create-success', harnessName: config.name, loading: true, loadingMessage: 'Creating harness...' });
+    try {
+      const { harnessPrimitive } = await import('../../../primitives/registry');
+      const result = await harnessPrimitive.add({
+        name: config.name,
+        modelProvider: config.modelProvider,
+        modelId: config.modelId,
+        apiKeyArn: config.apiKeyArn,
+        skipMemory: config.skipMemory,
+        containerUri: config.containerUri,
+        dockerfilePath: config.dockerfilePath,
+        maxIterations: config.maxIterations,
+        maxTokens: config.maxTokens,
+        timeoutSeconds: config.timeoutSeconds,
+        truncationStrategy: config.truncationStrategy,
+        networkMode: config.networkMode,
+        subnets: config.subnets,
+        securityGroups: config.securityGroups,
+        idleTimeout: config.idleTimeout,
+        maxLifetime: config.maxLifetime,
+        sessionStoragePath: config.sessionStoragePath,
+        selectedTools: config.selectedTools,
+        mcpName: config.mcpName,
+        mcpUrl: config.mcpUrl,
+        gatewayArn: config.gatewayArn,
+        gatewayOutboundAuth: config.gatewayOutboundAuth,
+        gatewayProviderArn: config.gatewayProviderArn,
+        gatewayScopes: config.gatewayScopes
+          ? config.gatewayScopes
+              .split(',')
+              .map(s => s.trim())
+              .filter(Boolean)
+          : undefined,
+        authorizerType: config.authorizerType,
+        jwtConfig: config.jwtConfig
+          ? {
+              discoveryUrl: config.jwtConfig.discoveryUrl,
+              allowedAudience: config.jwtConfig.allowedAudience,
+              allowedClients: config.jwtConfig.allowedClients,
+              allowedScopes: config.jwtConfig.allowedScopes,
+              customClaims: config.jwtConfig.customClaims,
+              clientId: config.jwtConfig.clientId,
+              clientSecret: config.jwtConfig.clientSecret,
+            }
+          : undefined,
+      });
+      if (!result.success) {
+        setFlow({ name: 'error', message: result.error });
+        return;
+      }
+
+      setFlow({ name: 'create-success', harnessName: config.name });
+    } catch (err) {
+      const { getErrorMessage } = await import('../../../errors');
+      setFlow({ name: 'error', message: getErrorMessage(err) });
+    }
+  }, []);
+
+  if (flow.name === 'create-wizard') {
+    return (
+      <AddHarnessScreen
+        existingHarnessNames={existingNames}
+        onComplete={config => void handleCreateComplete(config)}
+        onExit={onBack}
+      />
+    );
+  }
+
+  if (flow.name === 'create-success') {
+    return (
+      <AddSuccessScreen
+        isInteractive={isInteractive}
+        message={`Added harness: ${flow.harnessName}`}
+        detail="Harness config written to app/. Deploy with `agentcore deploy`."
+        loading={flow.loading}
+        loadingMessage={flow.loadingMessage}
+        onAddAnother={onBack}
+        onDev={onDev}
+        onDeploy={onDeploy}
+        onExit={onExit}
+      />
+    );
+  }
+
+  return (
+    <ErrorPrompt
+      message="Failed to add harness"
+      detail={flow.message}
+      onBack={() => setFlow({ name: 'create-wizard' })}
+      onExit={onExit}
+    />
+  );
+}
diff --git a/src/cli/tui/screens/harness/AddHarnessScreen.tsx b/src/cli/tui/screens/harness/AddHarnessScreen.tsx
new file mode 100644
index 000000000..13c3fc125
--- /dev/null
+++ b/src/cli/tui/screens/harness/AddHarnessScreen.tsx
@@ -0,0 +1,685 @@
+import type { HarnessModelProvider, RuntimeAuthorizerType } from '../../../../schema';
+import { NetworkModeSchema } from '../../../../schema';
+import { HarnessNameSchema, HarnessTruncationStrategySchema } from '../../../../schema/schemas/primitives/harness';
+import { ARN_VALIDATION_MESSAGE, isValidArn } from '../../../commands/shared/arn-utils';
+import { computeManagedOAuthCredentialName } from '../../../primitives/credential-utils';
+import {
+  ConfirmReview,
+  Panel,
+  Screen,
+  StepIndicator,
+  TextInput,
+  WizardMultiSelect,
+  WizardSelect,
+} from '../../components';
+import type { SelectableItem } from '../../components';
+import { JwtConfigInput, useJwtConfigFlow } from '../../components/jwt-config';
+import { HELP_TEXT } from '../../constants';
+import { useListNavigation, useMultiSelectNavigation } from '../../hooks';
+import { generateUniqueName } from '../../utils';
+import type { AddHarnessConfig, AdvancedSetting, ContainerMode } from './types';
+import {
+  ADVANCED_SETTING_OPTIONS,
+  AUTHORIZER_TYPE_OPTIONS,
+  CONTAINER_MODE_OPTIONS,
+  GATEWAY_OUTBOUND_AUTH_OPTIONS,
+  HARNESS_STEP_LABELS,
+  MEMORY_OPTIONS,
+  MODEL_PROVIDER_OPTIONS,
+  NETWORK_MODE_OPTIONS,
+  TOOL_SELECT_OPTIONS,
+  TRUNCATION_STRATEGY_OPTIONS,
+} from './types';
+import { useAddHarnessWizard } from './useAddHarnessWizard';
+import React, { useMemo } from 'react';
+
+interface AddHarnessScreenProps {
+  existingHarnessNames: string[];
+  onComplete: (config: AddHarnessConfig) => void;
+  onExit: () => void;
+}
+
+export function AddHarnessScreen({ existingHarnessNames, onComplete, onExit }: AddHarnessScreenProps) {
+  const wizard = useAddHarnessWizard();
+
+  const jwtFlow = useJwtConfigFlow({
+    onComplete: jwtConfig => wizard.setJwtConfig(jwtConfig),
+    onBack: () => wizard.goBack(),
+  });
+
+  const modelProviderItems: SelectableItem[] = useMemo(
+    () => MODEL_PROVIDER_OPTIONS.map(opt => ({ id: opt.id, title: opt.title, description: opt.description })),
+    []
+  );
+
+  const containerModeItems: SelectableItem[] = useMemo(
+    () => CONTAINER_MODE_OPTIONS.map(opt => ({ id: opt.id, title: opt.title, description: opt.description })),
+    []
+  );
+
+  const advancedSettingItems: SelectableItem[] = useMemo(
+    () => ADVANCED_SETTING_OPTIONS.map(opt => ({ id: opt.id, title: opt.title, description: opt.description })),
+    []
+  );
+
+  const toolSelectItems: SelectableItem[] = useMemo(
+    () => TOOL_SELECT_OPTIONS.map(opt => ({ id: opt.id, title: opt.title, description: opt.description })),
+    []
+  );
+
+  const memoryItems: SelectableItem[] = useMemo(
+    () => MEMORY_OPTIONS.map(opt => ({ id: opt.id, title: opt.title, description: opt.description })),
+    []
+  );
+
+  const networkModeItems: SelectableItem[] = useMemo(
+    () => NETWORK_MODE_OPTIONS.map(opt => ({ id: opt.id, title: opt.title, description: opt.description })),
+    []
+  );
+
+  const truncationStrategyItems: SelectableItem[] = useMemo(
+    () => TRUNCATION_STRATEGY_OPTIONS.map(opt => ({ id: opt.id, title: opt.title, description: opt.description })),
+    []
+  );
+
+  const authorizerTypeItems: SelectableItem[] = useMemo(
+    () => AUTHORIZER_TYPE_OPTIONS.map(opt => ({ id: opt.id, title: opt.title, description: opt.description })),
+    []
+  );
+
+  const gatewayOutboundAuthItems: SelectableItem[] = useMemo(
+    () => GATEWAY_OUTBOUND_AUTH_OPTIONS.map(opt => ({ id: opt.id, title: opt.title, description: opt.description })),
+    []
+  );
+
+  const isNameStep = wizard.step === 'name';
+  const isModelProviderStep = wizard.step === 'model-provider';
+  const isApiKeyArnStep = wizard.step === 'api-key-arn';
+  const isContainerStep = wizard.step === 'container';
+  const isContainerUriStep = wizard.step === 'container-uri';
+  const isContainerDockerfileStep = wizard.step === 'container-dockerfile';
+  const isAdvancedStep = wizard.step === 'advanced';
+  const isToolsSelectStep = wizard.step === 'tools-select';
+  const isMcpNameStep = wizard.step === 'mcp-name';
+  const isMcpUrlStep = wizard.step === 'mcp-url';
+  const isGatewayArnStep = wizard.step === 'gateway-arn';
+  const isGatewayOutboundAuthStep = wizard.step === 'gateway-outbound-auth';
+  const isGatewayProviderArnStep = wizard.step === 'gateway-provider-arn';
+  const isGatewayScopesStep = wizard.step === 'gateway-scopes';
+  const isMemoryStep = wizard.step === 'memory';
+  const isAuthorizerTypeStep = wizard.step === 'authorizerType';
+  const isJwtConfigStep = wizard.step === 'jwtConfig';
+  const isNetworkModeStep = wizard.step === 'network-mode';
+  const isSubnetsStep = wizard.step === 'subnets';
+  const isSecurityGroupsStep = wizard.step === 'security-groups';
+  const isIdleTimeoutStep = wizard.step === 'idle-timeout';
+  const isMaxLifetimeStep = wizard.step === 'max-lifetime';
+  const isMaxIterationsStep = wizard.step === 'max-iterations';
+  const isMaxTokensStep = wizard.step === 'max-tokens';
+  const isTimeoutStep = wizard.step === 'timeout';
+  const isTruncationStrategyStep = wizard.step === 'truncation-strategy';
+  const isSessionStoragePathStep = wizard.step === 'session-storage-path';
+  const isConfirmStep = wizard.step === 'confirm';
+
+  const modelProviderNav = useListNavigation({
+    items: modelProviderItems,
+    onSelect: item => wizard.setModelProvider(item.id as HarnessModelProvider),
+    onExit: () => wizard.goBack(),
+    isActive: isModelProviderStep,
+  });
+
+  const containerModeNav = useListNavigation({
+    items: containerModeItems,
+    onSelect: item => wizard.setContainerMode(item.id as ContainerMode),
+    onExit: () => wizard.goBack(),
+    isActive: isContainerStep,
+  });
+
+  const advancedSettingsNav = useMultiSelectNavigation({
+    items: advancedSettingItems,
+    getId: item => item.id,
+    onConfirm: ids => wizard.setAdvancedSettings(ids as AdvancedSetting[]),
+    onExit: () => wizard.goBack(),
+    isActive: isAdvancedStep,
+    requireSelection: false,
+  });
+
+  const toolsSelectNav = useMultiSelectNavigation({
+    items: toolSelectItems,
+    getId: item => item.id,
+    onConfirm: ids => wizard.setSelectedTools(ids),
+    onExit: () => wizard.goBack(),
+    isActive: isToolsSelectStep,
+    requireSelection: false,
+  });
+
+  const memoryNav = useListNavigation({
+    items: memoryItems,
+    onSelect: item => wizard.setMemoryEnabled(item.id === 'enabled'),
+    onExit: () => wizard.goBack(),
+    isActive: isMemoryStep,
+  });
+
+  const authorizerTypeNav = useListNavigation({
+    items: authorizerTypeItems,
+    onSelect: item => wizard.setAuthorizerType(item.id as RuntimeAuthorizerType),
+    onExit: () => wizard.goBack(),
+    isActive: isAuthorizerTypeStep,
+  });
+
+  const gatewayOutboundAuthNav = useListNavigation({
+    items: gatewayOutboundAuthItems,
+    onSelect: item => wizard.setGatewayOutboundAuth(item.id as 'awsIam' | 'none' | 'oauth'),
+    onExit: () => wizard.goBack(),
+    isActive: isGatewayOutboundAuthStep,
+  });
+
+  const networkModeNav = useListNavigation({
+    items: networkModeItems,
+    onSelect: item => wizard.setNetworkMode(NetworkModeSchema.parse(item.id)),
+    onExit: () => wizard.goBack(),
+    isActive: isNetworkModeStep,
+  });
+
+  const truncationStrategyNav = useListNavigation({
+    items: truncationStrategyItems,
+    onSelect: item => wizard.setTruncationStrategy(HarnessTruncationStrategySchema.parse(item.id)),
+    onExit: () => wizard.goBack(),
+    isActive: isTruncationStrategyStep,
+  });
+
+  useListNavigation({
+    items: [{ id: 'confirm', title: 'Confirm' }],
+    onSelect: () => onComplete(wizard.config),
+    onExit: () => wizard.goBack(),
+    isActive: isConfirmStep,
+  });
+
+  const helpText = isJwtConfigStep
+    ? jwtFlow.subStep === 'constraintPicker'
+      ? HELP_TEXT.MULTI_SELECT
+      : jwtFlow.subStep === 'customClaims'
+        ? jwtFlow.claimsManagerMode === 'add' || jwtFlow.claimsManagerMode === 'edit'
+          ? '↑/↓ field · ←/→ cycle · Enter next/save · Esc cancel'
+          : 'Navigate · Enter select · Esc back'
+        : HELP_TEXT.TEXT_INPUT
+    : isAdvancedStep || isToolsSelectStep
+      ? 'Space toggle · Enter confirm · Esc back'
+      : isModelProviderStep ||
+          isMemoryStep ||
+          isContainerStep ||
+          isNetworkModeStep ||
+          isTruncationStrategyStep ||
+          isAuthorizerTypeStep ||
+          isGatewayOutboundAuthStep
+        ? HELP_TEXT.NAVIGATE_SELECT
+        : isConfirmStep
+          ? HELP_TEXT.CONFIRM_CANCEL
+          : HELP_TEXT.TEXT_INPUT;
+
+  const headerContent = <StepIndicator steps={wizard.steps} currentStep={wizard.step} labels={HARNESS_STEP_LABELS} />;
+
+  const confirmFields = useMemo(() => {
+    const fields = [
+      { label: 'Name', value: wizard.config.name },
+      { label: 'Model Provider', value: wizard.config.modelProvider },
+      { label: 'Model ID', value: wizard.config.modelId },
+    ];
+
+    if (wizard.config.apiKeyArn) {
+      fields.push({ label: 'API Key ARN', value: wizard.config.apiKeyArn });
+    }
+
+    if (wizard.config.skipMemory !== undefined) {
+      fields.push({ label: 'Memory', value: wizard.config.skipMemory ? 'Disabled' : 'Enabled' });
+    }
+
+    if (wizard.config.authorizerType) {
+      fields.push({
+        label: 'Auth Type',
+        value:
+          AUTHORIZER_TYPE_OPTIONS.find(o => o.id === wizard.config.authorizerType)?.title ??
+          wizard.config.authorizerType,
+      });
+    }
+    if (wizard.config.authorizerType === 'CUSTOM_JWT' && wizard.config.jwtConfig) {
+      fields.push({ label: 'Discovery URL', value: wizard.config.jwtConfig.discoveryUrl });
+      if (wizard.config.jwtConfig.allowedAudience?.length) {
+        fields.push({ label: 'Allowed Audience', value: wizard.config.jwtConfig.allowedAudience.join(', ') });
+      }
+      if (wizard.config.jwtConfig.allowedClients?.length) {
+        fields.push({ label: 'Allowed Clients', value: wizard.config.jwtConfig.allowedClients.join(', ') });
+      }
+      if (wizard.config.jwtConfig.allowedScopes?.length) {
+        fields.push({ label: 'Allowed Scopes', value: wizard.config.jwtConfig.allowedScopes.join(', ') });
+      }
+      if (wizard.config.jwtConfig.customClaims?.length) {
+        fields.push({
+          label: 'Custom Claims',
+          value: `${wizard.config.jwtConfig.customClaims.length} claim(s) configured`,
+        });
+      }
+      if (wizard.config.jwtConfig.clientId) {
+        fields.push({ label: 'Harness Credential', value: computeManagedOAuthCredentialName(wizard.config.name) });
+      }
+    }
+
+    if (wizard.config.selectedTools?.length) {
+      const toolLabels = wizard.config.selectedTools.map(id => TOOL_SELECT_OPTIONS.find(o => o.id === id)?.title ?? id);
+      fields.push({ label: 'Tools', value: toolLabels.join(', ') });
+      if (wizard.config.mcpName) {
+        fields.push({ label: 'MCP Server', value: `${wizard.config.mcpName} (${wizard.config.mcpUrl})` });
+      }
+      if (wizard.config.gatewayArn) {
+        fields.push({ label: 'Gateway ARN', value: wizard.config.gatewayArn });
+      }
+      if (wizard.config.gatewayOutboundAuth) {
+        fields.push({
+          label: 'Gateway Auth',
+          value:
+            GATEWAY_OUTBOUND_AUTH_OPTIONS.find(o => o.id === wizard.config.gatewayOutboundAuth)?.title ??
+            wizard.config.gatewayOutboundAuth,
+        });
+      }
+      if (wizard.config.gatewayOutboundAuth === 'oauth') {
+        if (wizard.config.gatewayProviderArn) {
+          fields.push({ label: 'Provider ARN', value: wizard.config.gatewayProviderArn });
+        }
+        if (wizard.config.gatewayScopes) {
+          fields.push({ label: 'OAuth Scopes', value: wizard.config.gatewayScopes });
+        }
+      }
+    }
+
+    if (wizard.config.containerUri) {
+      fields.push({ label: 'Container URI', value: wizard.config.containerUri });
+    }
+
+    if (wizard.config.dockerfilePath) {
+      fields.push({ label: 'Dockerfile', value: wizard.config.dockerfilePath });
+    }
+
+    if (wizard.config.networkMode) {
+      fields.push({ label: 'Network Mode', value: wizard.config.networkMode });
+      if (wizard.config.networkMode === 'VPC') {
+        if (wizard.config.subnets) {
+          fields.push({ label: 'Subnets', value: wizard.config.subnets.join(', ') });
+        }
+        if (wizard.config.securityGroups) {
+          fields.push({ label: 'Security Groups', value: wizard.config.securityGroups.join(', ') });
+        }
+      }
+    }
+
+    if (wizard.config.idleTimeout !== undefined) {
+      fields.push({ label: 'Idle Timeout', value: `${wizard.config.idleTimeout}s` });
+    }
+
+    if (wizard.config.maxLifetime !== undefined) {
+      fields.push({ label: 'Max Lifetime', value: `${wizard.config.maxLifetime}s` });
+    }
+
+    if (wizard.config.maxIterations !== undefined) {
+      fields.push({ label: 'Max Iterations', value: String(wizard.config.maxIterations) });
+    }
+
+    if (wizard.config.maxTokens !== undefined) {
+      fields.push({ label: 'Max Tokens', value: String(wizard.config.maxTokens) });
+    }
+
+    if (wizard.config.timeoutSeconds !== undefined) {
+      fields.push({ label: 'Timeout', value: `${wizard.config.timeoutSeconds}s` });
+    }
+
+    if (wizard.config.truncationStrategy) {
+      fields.push({ label: 'Truncation Strategy', value: wizard.config.truncationStrategy });
+    }
+
+    if (wizard.config.sessionStoragePath) {
+      fields.push({ label: 'Session Storage', value: wizard.config.sessionStoragePath });
+    }
+
+    return fields;
+  }, [wizard.config]);
+
+  return (
+    <Screen
+      title="Add Harness"
+      onExit={onExit}
+      helpText={helpText}
+      headerContent={headerContent}
+      exitEnabled={isNameStep}
+    >
+      <Panel>
+        {isNameStep && (
+          <TextInput
+            key="name"
+            prompt="Harness name"
+            initialValue={generateUniqueName('MyHarness', existingHarnessNames)}
+            onSubmit={wizard.setName}
+            onCancel={onExit}
+            schema={HarnessNameSchema}
+            customValidation={value => !existingHarnessNames.includes(value) || 'Harness name already exists'}
+          />
+        )}
+
+        {isModelProviderStep && (
+          <WizardSelect
+            title="Select model provider"
+            description="Choose where to run your models"
+            items={modelProviderItems}
+            selectedIndex={modelProviderNav.selectedIndex}
+          />
+        )}
+
+        {isApiKeyArnStep && (
+          <TextInput
+            key="api-key-arn"
+            prompt="API Key ARN (Secrets Manager)"
+            initialValue=""
+            onSubmit={wizard.setApiKeyArn}
+            onCancel={() => wizard.goBack()}
+            customValidation={value => isValidArn(value) || ARN_VALIDATION_MESSAGE}
+          />
+        )}
+
+        {isContainerStep && (
+          <WizardSelect
+            title="Custom environment"
+            description="Optionally provide a custom container image for the harness runtime"
+            items={containerModeItems}
+            selectedIndex={containerModeNav.selectedIndex}
+          />
+        )}
+
+        {isContainerUriStep && (
+          <TextInput
+            key="container-uri"
+            // eslint-disable-next-line partition/no-hardcoded-endpoint-tld -- example placeholder, not a real endpoint
+            prompt="Container image URI (e.g., 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-harness:latest)"
+            initialValue=""
+            onSubmit={wizard.setContainerUri}
+            onCancel={() => wizard.goBack()}
+            customValidation={value => (value.trim().length > 0 ? true : 'Container URI is required')}
+          />
+        )}
+
+        {isContainerDockerfileStep && (
+          <TextInput
+            key="container-dockerfile"
+            prompt="Path to Dockerfile"
+            initialValue=""
+            onSubmit={wizard.setDockerfilePath}
+            onCancel={() => wizard.goBack()}
+            customValidation={value => (value.trim().length > 0 ? true : 'Dockerfile path is required')}
+          />
+        )}
+
+        {isAdvancedStep && (
+          <WizardMultiSelect
+            title="Advanced settings (optional)"
+            description="Configure tools, network, lifecycle, execution limits, truncation, or session storage"
+            items={advancedSettingItems}
+            cursorIndex={advancedSettingsNav.cursorIndex}
+            selectedIds={advancedSettingsNav.selectedIds}
+          />
+        )}
+
+        {isToolsSelectStep && (
+          <WizardMultiSelect
+            title="Select tools for your harness"
+            description="Choose built-in tools, MCP servers, or gateways"
+            items={toolSelectItems}
+            cursorIndex={toolsSelectNav.cursorIndex}
+            selectedIds={toolsSelectNav.selectedIds}
+          />
+        )}
+
+        {isMcpNameStep && (
+          <TextInput
+            key="mcp-name"
+            prompt="MCP server name"
+            initialValue=""
+            onSubmit={wizard.setMcpName}
+            onCancel={() => wizard.goBack()}
+            customValidation={value => (value.trim().length > 0 ? true : 'MCP name is required')}
+          />
+        )}
+
+        {isMcpUrlStep && (
+          <TextInput
+            key="mcp-url"
+            prompt="MCP server URL"
+            initialValue=""
+            onSubmit={wizard.setMcpUrl}
+            onCancel={() => wizard.goBack()}
+            customValidation={value =>
+              value.startsWith('http://') || value.startsWith('https://') ? true : 'Must be a valid URL'
+            }
+          />
+        )}
+
+        {isGatewayArnStep && (
+          <TextInput
+            key="gateway-arn"
+            prompt="Gateway ARN"
+            initialValue=""
+            onSubmit={wizard.setGatewayArn}
+            onCancel={() => wizard.goBack()}
+            customValidation={value => (isValidArn(value) ? true : ARN_VALIDATION_MESSAGE)}
+          />
+        )}
+
+        {isGatewayOutboundAuthStep && (
+          <WizardSelect
+            title="Gateway outbound auth"
+            description="How should the harness authenticate when calling the gateway?"
+            items={gatewayOutboundAuthItems}
+            selectedIndex={gatewayOutboundAuthNav.selectedIndex}
+          />
+        )}
+
+        {isGatewayProviderArnStep && (
+          <TextInput
+            key="gateway-provider-arn"
+            prompt="Credential provider ARN"
+            description="ARN of the AgentCore Identity OAuth2 credential provider"
+            initialValue=""
+            onSubmit={wizard.setGatewayProviderArn}
+            onCancel={() => wizard.goBack()}
+            customValidation={value => (isValidArn(value) ? true : ARN_VALIDATION_MESSAGE)}
+          />
+        )}
+
+        {isGatewayScopesStep && (
+          <TextInput
+            key="gateway-scopes"
+            prompt="OAuth scopes (comma-separated)"
+            description="Scopes requested from the credential provider"
+            initialValue=""
+            onSubmit={wizard.setGatewayScopes}
+            onCancel={() => wizard.goBack()}
+            customValidation={value => (value.trim().length > 0 ? true : 'At least one scope is required')}
+          />
+        )}
+
+        {isMemoryStep && (
+          <WizardSelect
+            title="Memory"
+            description="Persistent memory lets the harness remember context across sessions"
+            items={memoryItems}
+            selectedIndex={memoryNav.selectedIndex}
+          />
+        )}
+
+        {isAuthorizerTypeStep && (
+          <WizardSelect
+            title="Authorizer type"
+            description="How will clients authenticate to this harness?"
+            items={authorizerTypeItems}
+            selectedIndex={authorizerTypeNav.selectedIndex}
+          />
+        )}
+
+        {isJwtConfigStep && (
+          <JwtConfigInput
+            subStep={jwtFlow.subStep}
+            steps={jwtFlow.steps}
+            selectedConstraints={jwtFlow.selectedConstraints}
+            customClaims={jwtFlow.customClaims}
+            discoveryUrl={jwtFlow.discoveryUrl}
+            audience={jwtFlow.audience}
+            clients={jwtFlow.clients}
+            scopes={jwtFlow.scopes}
+            onDiscoveryUrl={jwtFlow.handlers.handleDiscoveryUrl}
+            onConstraintsPicked={jwtFlow.handlers.handleConstraintsPicked}
+            onAudience={jwtFlow.handlers.handleAudience}
+            onClients={jwtFlow.handlers.handleClients}
+            onScopes={jwtFlow.handlers.handleScopes}
+            onCustomClaimsDone={jwtFlow.handlers.handleCustomClaimsDone}
+            onClientId={jwtFlow.handlers.handleClientId}
+            onClientIdSkip={jwtFlow.handlers.handleClientIdSkip}
+            onClientSecret={jwtFlow.handlers.handleClientSecret}
+            onBack={jwtFlow.goBack}
+            onClaimsManagerModeChange={jwtFlow.handlers.handleClaimsManagerModeChange}
+          />
+        )}
+
+        {isNetworkModeStep && (
+          <WizardSelect
+            title="Network mode"
+            description="Choose network deployment mode"
+            items={networkModeItems}
+            selectedIndex={networkModeNav.selectedIndex}
+          />
+        )}
+
+        {isSubnetsStep && (
+          <TextInput
+            key="subnets"
+            prompt="Subnet IDs (comma-separated)"
+            description="VPC subnet IDs where the harness will be deployed"
+            initialValue=""
+            onSubmit={wizard.setSubnets}
+            onCancel={() => wizard.goBack()}
+            customValidation={value =>
+              value.trim().length > 0 ? true : 'At least one subnet is required for VPC mode'
+            }
+          />
+        )}
+
+        {isSecurityGroupsStep && (
+          <TextInput
+            key="security-groups"
+            prompt="Security Group IDs (comma-separated)"
+            description="Security groups to attach to the harness network interface"
+            initialValue=""
+            onSubmit={wizard.setSecurityGroups}
+            onCancel={() => wizard.goBack()}
+            customValidation={value =>
+              value.trim().length > 0 ? true : 'At least one security group is required for VPC mode'
+            }
+          />
+        )}
+
+        {isIdleTimeoutStep && (
+          <TextInput
+            key="idle-timeout"
+            prompt="Idle timeout (seconds)"
+            description="Time before an inactive session is stopped (60-28800, default 900)"
+            initialValue="900"
+            onSubmit={wizard.setIdleTimeout}
+            onCancel={() => wizard.goBack()}
+            customValidation={value => {
+              const num = parseInt(value, 10);
+              return !isNaN(num) && num >= 60 && num <= 28800 ? true : 'Must be between 60 and 28800';
+            }}
+          />
+        )}
+
+        {isMaxLifetimeStep && (
+          <TextInput
+            key="max-lifetime"
+            prompt="Max lifetime (seconds)"
+            description="Maximum total duration for a session (60-28800, default 28800)"
+            initialValue="28800"
+            onSubmit={wizard.setMaxLifetime}
+            onCancel={() => wizard.goBack()}
+            customValidation={value => {
+              const num = parseInt(value, 10);
+              return !isNaN(num) && num >= 60 && num <= 28800 ? true : 'Must be between 60 and 28800';
+            }}
+          />
+        )}
+
+        {isMaxIterationsStep && (
+          <TextInput
+            key="max-iterations"
+            prompt="Max iterations"
+            description="Maximum number of agent reasoning loops per turn (default 10)"
+            initialValue="10"
+            onSubmit={wizard.setMaxIterations}
+            onCancel={() => wizard.goBack()}
+            customValidation={value => {
+              const num = parseInt(value, 10);
+              return !isNaN(num) && num > 0 ? true : 'Must be a positive number';
+            }}
+          />
+        )}
+
+        {isMaxTokensStep && (
+          <TextInput
+            key="max-tokens"
+            prompt="Max tokens"
+            description="Maximum tokens the model can generate per turn (default 4096)"
+            initialValue="4096"
+            onSubmit={wizard.setMaxTokens}
+            onCancel={() => wizard.goBack()}
+            customValidation={value => {
+              const num = parseInt(value, 10);
+              return !isNaN(num) && num > 0 ? true : 'Must be a positive number';
+            }}
+          />
+        )}
+
+        {isTimeoutStep && (
+          <TextInput
+            key="timeout"
+            prompt="Timeout (seconds)"
+            description="Maximum wall-clock time per agent turn (default 300)"
+            initialValue="300"
+            onSubmit={wizard.setTimeoutSeconds}
+            onCancel={() => wizard.goBack()}
+            customValidation={value => {
+              const num = parseInt(value, 10);
+              return !isNaN(num) && num > 0 ? true : 'Must be a positive number';
+            }}
+          />
+        )}
+
+        {isTruncationStrategyStep && (
+          <WizardSelect
+            title="Truncation strategy"
+            description="How to manage context when it exceeds limits"
+            items={truncationStrategyItems}
+            selectedIndex={truncationStrategyNav.selectedIndex}
+          />
+        )}
+
+        {isSessionStoragePathStep && (
+          <TextInput
+            key="session-storage-path"
+            prompt="Session storage mount path (e.g., /mnt/data/)"
+            description="Absolute path where persistent storage is mounted inside the session"
+            initialValue="/mnt/data/"
+            onSubmit={wizard.setSessionStoragePath}
+            onCancel={() => wizard.goBack()}
+            customValidation={value => (value.startsWith('/') ? true : 'Must be an absolute path')}
+          />
+        )}
+
+        {isConfirmStep && <ConfirmReview fields={confirmFields} />}
+      </Panel>
+    </Screen>
+  );
+}
diff --git a/src/cli/tui/screens/harness/index.ts b/src/cli/tui/screens/harness/index.ts
new file mode 100644
index 000000000..b2af2e47e
--- /dev/null
+++ b/src/cli/tui/screens/harness/index.ts
@@ -0,0 +1,3 @@
+export { AddHarnessFlow } from './AddHarnessFlow';
+export { AddHarnessScreen } from './AddHarnessScreen';
+export type { AddHarnessConfig, AddHarnessStep } from './types';
diff --git a/src/cli/tui/screens/harness/types.ts b/src/cli/tui/screens/harness/types.ts
new file mode 100644
index 000000000..e5166d1bd
--- /dev/null
+++ b/src/cli/tui/screens/harness/types.ts
@@ -0,0 +1,174 @@
+import type { HarnessModelProvider, NetworkMode, RuntimeAuthorizerType } from '../../../../schema';
+import type { JwtConfig } from '../../components/jwt-config';
+
+export type ContainerMode = 'none' | 'uri' | 'dockerfile';
+
+export type AddHarnessStep =
+  | 'name'
+  | 'model-provider'
+  | 'api-key-arn'
+  | 'container'
+  | 'container-uri'
+  | 'container-dockerfile'
+  | 'advanced'
+  | 'tools-select'
+  | 'mcp-name'
+  | 'mcp-url'
+  | 'gateway-arn'
+  | 'gateway-outbound-auth'
+  | 'gateway-provider-arn'
+  | 'gateway-scopes'
+  | 'memory'
+  | 'authorizerType'
+  | 'jwtConfig'
+  | 'network-mode'
+  | 'subnets'
+  | 'security-groups'
+  | 'idle-timeout'
+  | 'max-lifetime'
+  | 'max-iterations'
+  | 'max-tokens'
+  | 'timeout'
+  | 'truncation-strategy'
+  | 'session-storage-path'
+  | 'confirm';
+
+export interface AddHarnessConfig {
+  name: string;
+  modelProvider: HarnessModelProvider;
+  modelId: string;
+  apiKeyArn?: string;
+  skipMemory?: boolean;
+  containerMode?: ContainerMode;
+  containerUri?: string;
+  dockerfilePath?: string;
+  maxIterations?: number;
+  maxTokens?: number;
+  timeoutSeconds?: number;
+  truncationStrategy?: 'sliding_window' | 'summarization';
+  networkMode?: NetworkMode;
+  subnets?: string[];
+  securityGroups?: string[];
+  idleTimeout?: number;
+  maxLifetime?: number;
+  sessionStoragePath?: string;
+  authorizerType?: RuntimeAuthorizerType;
+  jwtConfig?: JwtConfig;
+  selectedTools?: string[];
+  mcpName?: string;
+  mcpUrl?: string;
+  gatewayArn?: string;
+  gatewayOutboundAuth?: 'awsIam' | 'none' | 'oauth';
+  gatewayProviderArn?: string;
+  gatewayScopes?: string;
+}
+
+export const HARNESS_STEP_LABELS: Record<AddHarnessStep, string> = {
+  name: 'Name',
+  'model-provider': 'Model provider',
+  'api-key-arn': 'API key ARN',
+  container: 'Custom environment',
+  'container-uri': 'Container URI',
+  'container-dockerfile': 'Dockerfile path',
+  advanced: 'Advanced settings',
+  'tools-select': 'Tools',
+  'mcp-name': 'MCP name',
+  'mcp-url': 'MCP URL',
+  'gateway-arn': 'Gateway ARN',
+  'gateway-outbound-auth': 'Gateway auth',
+  'gateway-provider-arn': 'Provider ARN',
+  'gateway-scopes': 'OAuth scopes',
+  memory: 'Memory',
+  authorizerType: 'Auth type',
+  jwtConfig: 'JWT config',
+  'network-mode': 'Network mode',
+  subnets: 'Subnets',
+  'security-groups': 'Security groups',
+  'idle-timeout': 'Idle timeout',
+  'max-lifetime': 'Max lifetime',
+  'max-iterations': 'Max iterations',
+  'max-tokens': 'Max tokens',
+  timeout: 'Timeout',
+  'truncation-strategy': 'Truncation',
+  'session-storage-path': 'Session storage path',
+  confirm: 'Confirm',
+};
+
+export const DEFAULT_MODEL_IDS: Record<HarnessModelProvider, string> = {
+  bedrock: 'global.anthropic.claude-sonnet-4-6',
+  open_ai: 'gpt-5',
+  gemini: 'gemini-2.5-flash',
+};
+
+export const MODEL_PROVIDER_OPTIONS = [
+  { id: 'bedrock' as const, title: 'Amazon Bedrock', description: `Default: ${DEFAULT_MODEL_IDS.bedrock}` },
+  {
+    id: 'open_ai' as const,
+    title: 'OpenAI',
+    description: `Default: ${DEFAULT_MODEL_IDS.open_ai} (requires API key ARN)`,
+  },
+  {
+    id: 'gemini' as const,
+    title: 'Google Gemini',
+    description: `Default: ${DEFAULT_MODEL_IDS.gemini} (requires API key ARN)`,
+  },
+] as const;
+
+export const TRUNCATION_STRATEGY_OPTIONS = [
+  { id: 'sliding_window' as const, title: 'Sliding window', description: 'Keep most recent messages' },
+  { id: 'summarization' as const, title: 'Summarization', description: 'Compress older context' },
+] as const;
+
+export const ADVANCED_SETTING_OPTIONS = [
+  { id: 'tools', title: 'Tools', description: 'Add browser, code interpreter, MCP, or gateway tools' },
+  { id: 'auth', title: 'Authentication', description: 'Inbound auth: AWS_IAM or Custom JWT' },
+  { id: 'network', title: 'Network', description: 'Deploy inside a VPC with custom subnets and security groups' },
+  { id: 'lifecycle', title: 'Lifecycle', description: 'Set idle timeout and max session lifetime' },
+  { id: 'execution', title: 'Execution limits', description: 'Cap iterations, tokens, and per-turn timeout' },
+  { id: 'truncation', title: 'Truncation', description: 'Choose how context is managed when it exceeds limits' },
+  { id: 'session-storage', title: 'Session Storage', description: 'Mount persistent storage for session data' },
+] as const;
+
+export type AdvancedSetting = (typeof ADVANCED_SETTING_OPTIONS)[number]['id'];
+
+export const MEMORY_OPTIONS = [
+  {
+    id: 'disabled' as const,
+    title: 'No persistent memory',
+    description: 'Harness does not retain context across sessions',
+  },
+  { id: 'enabled' as const, title: 'Enabled', description: 'Create persistent memory for this harness' },
+] as const;
+
+export const CONTAINER_MODE_OPTIONS = [
+  { id: 'none' as const, title: 'Default Environment', description: 'Includes Python, Bash, File tools' },
+  { id: 'uri' as const, title: 'Container URI', description: 'Use a pre-built container image (ECR URI)' },
+  { id: 'dockerfile' as const, title: 'Dockerfile', description: 'Bring your own Dockerfile' },
+] as const;
+
+export const TOOL_SELECT_OPTIONS = [
+  { id: 'agentcore_browser' as const, title: 'AgentCore Browser', description: 'Web browsing and automation' },
+  {
+    id: 'agentcore_code_interpreter' as const,
+    title: 'AgentCore Code Interpreter',
+    description: 'Sandboxed code execution',
+  },
+  { id: 'agentcore_gateway' as const, title: 'AgentCore Gateway', description: 'Connect via gateway' },
+  { id: 'remote_mcp' as const, title: 'Remote MCP Server', description: 'Connect to an MCP server' },
+] as const;
+
+export const NETWORK_MODE_OPTIONS = [
+  { id: 'PUBLIC' as const, title: 'Public', description: 'Internet-facing' },
+  { id: 'VPC' as const, title: 'VPC', description: 'Deploy within a VPC' },
+] as const;
+
+export const AUTHORIZER_TYPE_OPTIONS = [
+  { id: 'AWS_IAM' as const, title: 'AWS IAM', description: 'Use AWS IAM authentication (default)' },
+  { id: 'CUSTOM_JWT' as const, title: 'Custom JWT', description: 'Use a custom JWT authorizer (OIDC)' },
+] as const;
+
+export const GATEWAY_OUTBOUND_AUTH_OPTIONS = [
+  { id: 'awsIam', title: 'AWS IAM (default)', description: 'SigV4 signing with the harness execution role' },
+  { id: 'none', title: 'None', description: 'No authentication headers' },
+  { id: 'oauth', title: 'OAuth', description: 'Bearer token via AgentCore Identity credential provider' },
+];
diff --git a/src/cli/tui/screens/harness/useAddHarnessWizard.ts b/src/cli/tui/screens/harness/useAddHarnessWizard.ts
new file mode 100644
index 000000000..13325fe35
--- /dev/null
+++ b/src/cli/tui/screens/harness/useAddHarnessWizard.ts
@@ -0,0 +1,454 @@
+import type { HarnessModelProvider, NetworkMode, RuntimeAuthorizerType } from '../../../../schema';
+import type { JwtConfig } from '../../components/jwt-config';
+import type { AddHarnessConfig, AddHarnessStep, AdvancedSetting, ContainerMode } from './types';
+import { DEFAULT_MODEL_IDS } from './types';
+import { useCallback, useMemo, useState } from 'react';
+
+const ADVANCED_SETTING_ORDER: AdvancedSetting[] = [
+  'tools',
+  'auth',
+  'network',
+  'lifecycle',
+  'execution',
+  'truncation',
+  'session-storage',
+];
+
+const SETTING_TO_FIRST_STEP: Record<AdvancedSetting, AddHarnessStep> = {
+  tools: 'tools-select',
+  auth: 'authorizerType',
+  network: 'network-mode',
+  lifecycle: 'idle-timeout',
+  execution: 'max-iterations',
+  truncation: 'truncation-strategy',
+  'session-storage': 'session-storage-path',
+};
+
+function getFirstAdvancedStep(settings: AdvancedSetting[]): AddHarnessStep | undefined {
+  for (const setting of ADVANCED_SETTING_ORDER) {
+    if (settings.includes(setting)) return SETTING_TO_FIRST_STEP[setting];
+  }
+  return undefined;
+}
+
+function getNextAdvancedStep(settings: AdvancedSetting[], after: AdvancedSetting): AddHarnessStep | undefined {
+  const idx = ADVANCED_SETTING_ORDER.indexOf(after);
+  const remaining = ADVANCED_SETTING_ORDER.slice(idx + 1);
+  for (const setting of remaining) {
+    if (settings.includes(setting)) return SETTING_TO_FIRST_STEP[setting];
+  }
+  return undefined;
+}
+
+function getDefaultConfig(): AddHarnessConfig {
+  return {
+    name: '',
+    modelProvider: 'bedrock',
+    modelId: DEFAULT_MODEL_IDS.bedrock,
+  };
+}
+
+export function useAddHarnessWizard() {
+  const [config, setConfig] = useState<AddHarnessConfig>(getDefaultConfig);
+  const [step, setStep] = useState<AddHarnessStep>('name');
+  const [advancedSettings, setAdvancedSettingsState] = useState<AdvancedSetting[]>([]);
+
+  const allSteps = useMemo(() => {
+    const steps: AddHarnessStep[] = ['name', 'model-provider'];
+
+    if (config.modelProvider !== 'bedrock') {
+      steps.push('api-key-arn');
+    }
+
+    steps.push('container');
+    if (config.containerMode === 'uri') {
+      steps.push('container-uri');
+    } else if (config.containerMode === 'dockerfile') {
+      steps.push('container-dockerfile');
+    }
+
+    steps.push('memory');
+
+    steps.push('advanced');
+
+    if (advancedSettings.includes('tools')) {
+      steps.push('tools-select');
+      if (config.selectedTools?.includes('remote_mcp')) {
+        steps.push('mcp-name', 'mcp-url');
+      }
+      if (config.selectedTools?.includes('agentcore_gateway')) {
+        steps.push('gateway-arn');
+        steps.push('gateway-outbound-auth');
+        if (config.gatewayOutboundAuth === 'oauth') {
+          steps.push('gateway-provider-arn', 'gateway-scopes');
+        }
+      }
+    }
+
+    if (advancedSettings.includes('auth')) {
+      steps.push('authorizerType');
+      if (config.authorizerType === 'CUSTOM_JWT') {
+        steps.push('jwtConfig');
+      }
+    }
+
+    if (advancedSettings.includes('network')) {
+      steps.push('network-mode');
+      if (config.networkMode === 'VPC') {
+        steps.push('subnets', 'security-groups');
+      }
+    }
+
+    if (advancedSettings.includes('lifecycle')) {
+      steps.push('idle-timeout', 'max-lifetime');
+    }
+
+    if (advancedSettings.includes('execution')) {
+      steps.push('max-iterations', 'max-tokens', 'timeout');
+    }
+
+    if (advancedSettings.includes('truncation')) {
+      steps.push('truncation-strategy');
+    }
+
+    if (advancedSettings.includes('session-storage')) {
+      steps.push('session-storage-path');
+    }
+
+    steps.push('confirm');
+
+    return steps;
+  }, [
+    config.modelProvider,
+    config.containerMode,
+    config.authorizerType,
+    config.networkMode,
+    config.selectedTools,
+    config.gatewayOutboundAuth,
+    advancedSettings,
+  ]);
+
+  const currentIndex = allSteps.indexOf(step);
+
+  const goBack = useCallback(() => {
+    const idx = allSteps.indexOf(step);
+    const prevStep = allSteps[idx - 1];
+    if (prevStep) setStep(prevStep);
+  }, [allSteps, step]);
+
+  const nextStep = useCallback(
+    (currentStep: AddHarnessStep): AddHarnessStep | undefined => {
+      const idx = allSteps.indexOf(currentStep);
+      return allSteps[idx + 1];
+    },
+    [allSteps]
+  );
+
+  const setName = useCallback(
+    (name: string) => {
+      setConfig(c => ({ ...c, name }));
+      const next = nextStep('name');
+      if (next) setStep(next);
+    },
+    [nextStep]
+  );
+
+  const setModelProvider = useCallback((modelProvider: HarnessModelProvider) => {
+    setConfig(c => ({ ...c, modelProvider, modelId: DEFAULT_MODEL_IDS[modelProvider] }));
+    if (modelProvider !== 'bedrock') {
+      setStep('api-key-arn');
+    } else {
+      setStep('container');
+    }
+  }, []);
+
+  const setApiKeyArn = useCallback(
+    (apiKeyArn: string) => {
+      setConfig(c => ({ ...c, apiKeyArn }));
+      const next = nextStep('api-key-arn');
+      if (next) setStep(next);
+    },
+    [nextStep]
+  );
+
+  const setContainerMode = useCallback((containerMode: ContainerMode) => {
+    setConfig(c => ({ ...c, containerMode, containerUri: undefined, dockerfilePath: undefined }));
+    if (containerMode === 'uri') {
+      setStep('container-uri');
+    } else if (containerMode === 'dockerfile') {
+      setStep('container-dockerfile');
+    } else {
+      setStep('memory');
+    }
+  }, []);
+
+  const setContainerUri = useCallback(
+    (containerUri: string) => {
+      setConfig(c => ({ ...c, containerUri }));
+      const next = nextStep('container-uri');
+      if (next) setStep(next);
+    },
+    [nextStep]
+  );
+
+  const setDockerfilePath = useCallback(
+    (dockerfilePath: string) => {
+      setConfig(c => ({ ...c, dockerfilePath }));
+      const next = nextStep('container-dockerfile');
+      if (next) setStep(next);
+    },
+    [nextStep]
+  );
+
+  const setAdvancedSettings = useCallback((settings: AdvancedSetting[]) => {
+    setAdvancedSettingsState(settings);
+    const firstAdvancedStep = getFirstAdvancedStep(settings);
+    setStep(firstAdvancedStep ?? 'confirm');
+  }, []);
+
+  const setSelectedTools = useCallback(
+    (selectedTools: string[]) => {
+      setConfig(c => ({ ...c, selectedTools }));
+      if (selectedTools.includes('remote_mcp')) {
+        setStep('mcp-name');
+      } else if (selectedTools.includes('agentcore_gateway')) {
+        setStep('gateway-arn');
+      } else {
+        const next = getNextAdvancedStep(advancedSettings, 'tools');
+        setStep(next ?? 'confirm');
+      }
+    },
+    [advancedSettings]
+  );
+
+  const setMcpName = useCallback(
+    (mcpName: string) => {
+      setConfig(c => ({ ...c, mcpName }));
+      const next = nextStep('mcp-name');
+      if (next) setStep(next);
+    },
+    [nextStep]
+  );
+
+  const setMcpUrl = useCallback(
+    (mcpUrl: string) => {
+      setConfig(c => ({ ...c, mcpUrl }));
+      if (config.selectedTools?.includes('agentcore_gateway')) {
+        setStep('gateway-arn');
+      } else {
+        const next = getNextAdvancedStep(advancedSettings, 'tools');
+        setStep(next ?? 'confirm');
+      }
+    },
+    [advancedSettings, config.selectedTools]
+  );
+
+  const setGatewayArn = useCallback((gatewayArn: string) => {
+    setConfig(c => ({ ...c, gatewayArn }));
+    setStep('gateway-outbound-auth');
+  }, []);
+
+  const setGatewayOutboundAuth = useCallback(
+    (authType: 'awsIam' | 'none' | 'oauth') => {
+      setConfig(c => ({ ...c, gatewayOutboundAuth: authType }));
+      if (authType === 'oauth') {
+        setStep('gateway-provider-arn');
+      } else {
+        const next = getNextAdvancedStep(advancedSettings, 'tools');
+        setStep(next ?? 'confirm');
+      }
+    },
+    [advancedSettings]
+  );
+
+  const setGatewayProviderArn = useCallback((gatewayProviderArn: string) => {
+    setConfig(c => ({ ...c, gatewayProviderArn }));
+    setStep('gateway-scopes');
+  }, []);
+
+  const setGatewayScopes = useCallback(
+    (gatewayScopes: string) => {
+      setConfig(c => ({ ...c, gatewayScopes }));
+      const next = getNextAdvancedStep(advancedSettings, 'tools');
+      setStep(next ?? 'confirm');
+    },
+    [advancedSettings]
+  );
+
+  const setMemoryEnabled = useCallback((enabled: boolean) => {
+    setConfig(c => ({ ...c, skipMemory: !enabled }));
+    setStep('advanced');
+  }, []);
+
+  const setAuthorizerType = useCallback(
+    (authorizerType: RuntimeAuthorizerType) => {
+      setConfig(c => ({ ...c, authorizerType, jwtConfig: undefined }));
+      if (authorizerType === 'CUSTOM_JWT') {
+        setStep('jwtConfig');
+      } else {
+        const next = getNextAdvancedStep(advancedSettings, 'auth');
+        setStep(next ?? 'confirm');
+      }
+    },
+    [advancedSettings]
+  );
+
+  const setJwtConfig = useCallback(
+    (jwtConfig: JwtConfig) => {
+      setConfig(c => ({ ...c, jwtConfig }));
+      const next = getNextAdvancedStep(advancedSettings, 'auth');
+      setStep(next ?? 'confirm');
+    },
+    [advancedSettings]
+  );
+
+  const setNetworkMode = useCallback(
+    (networkMode: NetworkMode) => {
+      setConfig(c => ({ ...c, networkMode }));
+      if (networkMode === 'VPC') {
+        setStep('subnets');
+      } else {
+        const next = getNextAdvancedStep(advancedSettings, 'network');
+        setStep(next ?? 'confirm');
+      }
+    },
+    [advancedSettings]
+  );
+
+  const setSubnets = useCallback(
+    (subnetsStr: string) => {
+      const subnets = subnetsStr
+        .split(',')
+        .map(s => s.trim())
+        .filter(Boolean);
+      setConfig(c => ({ ...c, subnets }));
+      const next = nextStep('subnets');
+      if (next) setStep(next);
+    },
+    [nextStep]
+  );
+
+  const setSecurityGroups = useCallback(
+    (sgStr: string) => {
+      const securityGroups = sgStr
+        .split(',')
+        .map(s => s.trim())
+        .filter(Boolean);
+      setConfig(c => ({ ...c, securityGroups }));
+      const next = nextStep('security-groups');
+      if (next) setStep(next);
+    },
+    [nextStep]
+  );
+
+  const setIdleTimeout = useCallback(
+    (idleTimeoutStr: string) => {
+      const idleTimeout = parseInt(idleTimeoutStr, 10);
+      setConfig(c => ({ ...c, idleTimeout }));
+      const next = nextStep('idle-timeout');
+      if (next) setStep(next);
+    },
+    [nextStep]
+  );
+
+  const setMaxLifetime = useCallback(
+    (maxLifetimeStr: string) => {
+      const maxLifetime = parseInt(maxLifetimeStr, 10);
+      setConfig(c => ({ ...c, maxLifetime }));
+      const next = nextStep('max-lifetime');
+      if (next) setStep(next);
+    },
+    [nextStep]
+  );
+
+  const setMaxIterations = useCallback(
+    (maxIterationsStr: string) => {
+      const maxIterations = parseInt(maxIterationsStr, 10);
+      setConfig(c => ({ ...c, maxIterations }));
+      const next = nextStep('max-iterations');
+      if (next) setStep(next);
+    },
+    [nextStep]
+  );
+
+  const setMaxTokens = useCallback(
+    (maxTokensStr: string) => {
+      const maxTokens = parseInt(maxTokensStr, 10);
+      setConfig(c => ({ ...c, maxTokens }));
+      const next = nextStep('max-tokens');
+      if (next) setStep(next);
+    },
+    [nextStep]
+  );
+
+  const setTimeoutSeconds = useCallback(
+    (timeoutStr: string) => {
+      const timeoutSeconds = parseInt(timeoutStr, 10);
+      setConfig(c => ({ ...c, timeoutSeconds }));
+      const next = nextStep('timeout');
+      if (next) setStep(next);
+    },
+    [nextStep]
+  );
+
+  const setTruncationStrategy = useCallback(
+    (truncationStrategy: 'sliding_window' | 'summarization') => {
+      setConfig(c => ({ ...c, truncationStrategy }));
+      const next = nextStep('truncation-strategy');
+      if (next) setStep(next);
+    },
+    [nextStep]
+  );
+
+  const setSessionStoragePath = useCallback(
+    (sessionStoragePath: string) => {
+      setConfig(c => ({ ...c, sessionStoragePath }));
+      const next = nextStep('session-storage-path');
+      if (next) setStep(next);
+    },
+    [nextStep]
+  );
+
+  const reset = useCallback(() => {
+    setConfig(getDefaultConfig());
+    setStep('name');
+    setAdvancedSettingsState([]);
+  }, []);
+
+  return {
+    config,
+    step,
+    steps: allSteps,
+    currentIndex,
+    advancedSettings,
+    goBack,
+    setName,
+    setModelProvider,
+    setApiKeyArn,
+    setContainerMode,
+    setContainerUri,
+    setDockerfilePath,
+    setAdvancedSettings,
+    setSelectedTools,
+    setMcpName,
+    setMcpUrl,
+    setGatewayArn,
+    setGatewayOutboundAuth,
+    setGatewayProviderArn,
+    setGatewayScopes,
+    setMemoryEnabled,
+    setAuthorizerType,
+    setJwtConfig,
+    setNetworkMode,
+    setSubnets,
+    setSecurityGroups,
+    setIdleTimeout,
+    setMaxLifetime,
+    setMaxIterations,
+    setMaxTokens,
+    setTimeoutSeconds,
+    setTruncationStrategy,
+    setSessionStoragePath,
+    reset,
+  };
+}
diff --git a/src/cli/tui/screens/home/HelpScreen.tsx b/src/cli/tui/screens/home/HelpScreen.tsx
index 485c263c7..71b8d56e8 100644
--- a/src/cli/tui/screens/home/HelpScreen.tsx
+++ b/src/cli/tui/screens/home/HelpScreen.tsx
@@ -218,11 +218,11 @@ export function HelpScreen(props: {
 
   const interactiveItems = useMemo((): DisplayItem[] => {
     return commands.filter(cmd => !cmd.cliOnly).flatMap(filterCommand);
-  }, [commands, query]);
+  }, [commands, filterCommand]);
 
   const cliOnlyItems = useMemo((): DisplayItem[] => {
     return commands.filter(cmd => cmd.cliOnly).flatMap(filterCommand);
-  }, [commands, query]);
+  }, [commands, filterCommand]);
 
   const visibleCliOnlyItems = query ? cliOnlyItems : showCliOnly ? cliOnlyItems : [];
 
diff --git a/src/cli/tui/screens/identity/useCreateIdentity.ts b/src/cli/tui/screens/identity/useCreateIdentity.ts
index 42aace21b..e214d1e67 100644
--- a/src/cli/tui/screens/identity/useCreateIdentity.ts
+++ b/src/cli/tui/screens/identity/useCreateIdentity.ts
@@ -2,6 +2,7 @@ import { ConfigIO } from '../../../../lib';
 import type { Credential } from '../../../../schema';
 import type { AddCredentialOptions } from '../../../primitives/CredentialPrimitive';
 import { credentialPrimitive } from '../../../primitives/registry';
+import { withAddTelemetry } from '../../../telemetry/cli-command-run.js';
 import { useCallback, useEffect, useState } from 'react';
 
 interface CreateStatus<T> {
@@ -16,7 +17,13 @@ export function useCreateIdentity() {
   const create = useCallback(async (config: AddCredentialOptions) => {
     setStatus({ state: 'loading' });
     try {
-      const result = await credentialPrimitive.add(config);
+      const result = await withAddTelemetry(
+        'add.credential',
+        {
+          credential_type: config.authorizerType === 'OAuthCredentialProvider' ? 'oauth' : 'api-key',
+        },
+        () => credentialPrimitive.add(config)
+      );
       if (!result.success) {
         throw new Error(result.error ?? 'Failed to create credential');
       }
diff --git a/src/cli/tui/screens/import/ArnInputScreen.tsx b/src/cli/tui/screens/import/ArnInputScreen.tsx
index 11b921a90..9381ca7b8 100644
--- a/src/cli/tui/screens/import/ArnInputScreen.tsx
+++ b/src/cli/tui/screens/import/ArnInputScreen.tsx
@@ -4,8 +4,7 @@ import { Screen } from '../../components/Screen';
 import { TextInput } from '../../components/TextInput';
 import { HELP_TEXT } from '../../constants';
 
-const ARN_PATTERN =
-  /^arn:[^:]+:bedrock-agentcore:[^:]+:[^:]+:(runtime|memory|evaluator|online-evaluation-config|gateway)\/.+$/;
+const ARN_PATTERN = /^arn:[^:]+:bedrock-agentcore:[^:]+:[^:]+:(runtime|memory|evaluator|online-evaluation-config)\/.+$/;
 
 function validateArn(value: string): true | string {
   if (!ARN_PATTERN.test(value)) {
diff --git a/src/cli/tui/screens/invoke/InvokeScreen.tsx b/src/cli/tui/screens/invoke/InvokeScreen.tsx
index d5e70330c..018f2783b 100644
--- a/src/cli/tui/screens/invoke/InvokeScreen.tsx
+++ b/src/cli/tui/screens/invoke/InvokeScreen.tsx
@@ -9,12 +9,16 @@ interface InvokeScreenProps {
   /** Whether running in interactive TUI mode (from App.tsx) vs CLI mode */
   isInteractive: boolean;
   onExit: () => void;
+  /** Override the screen title (defaults to "AgentCore Invoke") */
+  title?: string;
   initialPrompt?: string;
   initialSessionId?: string;
   initialUserId?: string;
   /** Custom headers to forward to the agent runtime on every invocation */
   initialHeaders?: Record<string, string>;
   initialBearerToken?: string;
+  /** Pre-select a harness by name, skipping the agent selection screen */
+  initialHarnessName?: string;
 }
 
 type Mode = 'select-agent' | 'chat' | 'input' | 'token-input';
@@ -49,6 +53,8 @@ function formatConversation(
       lines.push({ text: `> ${msg.content}`, color: 'blue' });
     } else if (msg.isExec) {
       lines.push({ text: msg.content });
+    } else if (msg.isHint) {
+      lines.push({ text: msg.content, color: 'gray' });
     } else if (msg.parts && msg.parts.length > 0) {
       // Rich AGUI rendering: render each part with distinct visual treatment
       for (const part of msg.parts) {
@@ -133,11 +139,13 @@ function wrapColoredLines(lines: ColoredLine[], maxWidth: number): ColoredLine[]
 export function InvokeScreen({
   isInteractive: _isInteractive,
   onExit,
+  title: screenTitle = 'AgentCore Invoke',
   initialPrompt,
   initialSessionId,
   initialUserId,
   initialHeaders,
   initialBearerToken,
+  initialHarnessName,
 }: InvokeScreenProps) {
   const {
     phase,
@@ -158,8 +166,14 @@ export function InvokeScreen({
     execCommand,
     newSession,
     fetchMcpTools,
-  } = useInvokeFlow({ initialSessionId, initialUserId, headers: initialHeaders, initialBearerToken });
-  const [mode, setMode] = useState<Mode>('select-agent');
+  } = useInvokeFlow({
+    initialSessionId,
+    initialUserId,
+    headers: initialHeaders,
+    initialBearerToken,
+    initialHarnessName,
+  });
+  const [mode, setMode] = useState<Mode>(initialHarnessName ? 'input' : 'select-agent');
   const [isExecInput, setIsExecInput] = useState(false);
   const [execInputEmpty, setExecInputEmpty] = useState(true);
   const [scrollOffset, setScrollOffset] = useState(0);
@@ -177,16 +191,20 @@ export function InvokeScreen({
   }, [sessionId, messages.length]);
 
   // Compute auth type early so hooks can reference it
-  const currentAgent = config?.runtimes[selectedAgent];
-  const isCustomJwt = currentAgent?.authorizerType === 'CUSTOM_JWT';
+  const totalInvokables = (config?.runtimes.length ?? 0) + (config?.harnesses.length ?? 0);
+  const runtimeCount = config?.runtimes.length ?? 0;
+  const currentAgent = selectedAgent < runtimeCount ? config?.runtimes[selectedAgent] : undefined;
+  const currentHarness = selectedAgent >= runtimeCount ? config?.harnesses[selectedAgent - runtimeCount] : undefined;
+  const isCustomJwt = (currentAgent?.authorizerType ?? currentHarness?.authorizerType) === 'CUSTOM_JWT';
 
-  // Handle initial prompt - skip agent selection if only one agent
+  // Handle initial prompt - skip agent selection if only one invokable
   useEffect(() => {
     if (config && phase === 'ready') {
-      if (config.runtimes.length === 1 && mode === 'select-agent') {
+      if (totalInvokables === 1 && mode === 'select-agent') {
         const agent = config.runtimes[0];
-        const needsTokenScreen = agent?.authorizerType === 'CUSTOM_JWT' && !bearerToken && !initialBearerToken;
-        // Defer setState to avoid cascading renders within effect
+        const harness = config.runtimes.length === 0 ? config.harnesses[0] : undefined;
+        const authType = agent?.authorizerType ?? harness?.authorizerType;
+        const needsTokenScreen = authType === 'CUSTOM_JWT' && !bearerToken && !initialBearerToken;
         queueMicrotask(() => {
           setMode(needsTokenScreen ? 'token-input' : 'input');
         });
@@ -195,7 +213,22 @@ export function InvokeScreen({
         }
       }
     }
-  }, [config, phase, initialPrompt, messages.length, invoke, mode, bearerToken, initialBearerToken]);
+  }, [config, phase, initialPrompt, messages.length, invoke, mode, bearerToken, initialBearerToken, totalInvokables]);
+
+  // When entering via initialHarnessName (dev mode), redirect to token-input once config loads
+  useEffect(() => {
+    if (
+      initialHarnessName &&
+      config &&
+      phase === 'ready' &&
+      mode === 'input' &&
+      isCustomJwt &&
+      !bearerToken &&
+      !initialBearerToken
+    ) {
+      queueMicrotask(() => setMode('token-input'));
+    }
+  }, [initialHarnessName, config, phase, mode, isCustomJwt, bearerToken, initialBearerToken]);
 
   // Auto-exit when prompt was provided upfront and response completes
   useEffect(() => {
@@ -213,7 +246,7 @@ export function InvokeScreen({
     }
   }, [config, selectedAgent, phase, mode, fetchMcpTools]);
 
-  // Return to input mode after invoke completes
+  // Return to input mode after invoke completes, or show tool approval
   const prevPhaseRef = useRef(phase);
   useEffect(() => {
     if (prevPhaseRef.current === 'invoking' && phase === 'ready' && !initialPrompt) {
@@ -282,11 +315,16 @@ export function InvokeScreen({
           onExit();
           return;
         }
-        if (key.upArrow) selectAgent((selectedAgent - 1 + config.runtimes.length) % config.runtimes.length);
-        if (key.downArrow) selectAgent((selectedAgent + 1) % config.runtimes.length);
+        if (key.upArrow) selectAgent((selectedAgent - 1 + totalInvokables) % totalInvokables);
+        if (key.downArrow) selectAgent((selectedAgent + 1) % totalInvokables);
         if (key.return) {
           const chosen = config.runtimes[selectedAgent];
-          const needsTokenScreen = chosen?.authorizerType === 'CUSTOM_JWT' && !bearerToken && !initialBearerToken;
+          const chosenHarness =
+            selectedAgent >= config.runtimes.length
+              ? config.harnesses[selectedAgent - config.runtimes.length]
+              : undefined;
+          const authType = chosen?.authorizerType ?? chosenHarness?.authorizerType;
+          const needsTokenScreen = authType === 'CUSTOM_JWT' && !bearerToken && !initialBearerToken;
           setMode(needsTokenScreen ? 'token-input' : 'input');
         }
         return;
@@ -299,7 +337,7 @@ export function InvokeScreen({
             justCancelledRef.current = false;
             return;
           }
-          if (config.runtimes.length > 1) {
+          if (totalInvokables > 1) {
             setMode('select-agent');
             return;
           }
@@ -315,8 +353,8 @@ export function InvokeScreen({
           return;
         }
 
-        // New session
-        if (input === 'n' && phase === 'ready') {
+        // New session (Ctrl+N)
+        if (key.ctrl && input === 'n' && phase === 'ready') {
           newSession();
           setScrollOffset(0);
           setUserScrolled(false);
@@ -352,7 +390,7 @@ export function InvokeScreen({
   // Error state - show error in main screen
   if (phase === 'error') {
     return (
-      <Screen title="AgentCore Invoke" onExit={onExit}>
+      <Screen title={screenTitle} onExit={onExit}>
         <Text color="red">{error}</Text>
       </Screen>
     );
@@ -363,7 +401,10 @@ export function InvokeScreen({
     return null;
   }
 
-  const agent = config.runtimes[selectedAgent];
+  const isHarnessSelected = selectedAgent >= config.runtimes.length;
+  const agent = isHarnessSelected ? undefined : config.runtimes[selectedAgent];
+  const selectedHarness = isHarnessSelected ? config.harnesses[selectedAgent - config.runtimes.length] : undefined;
+  const selectedName = agent?.name ?? selectedHarness?.name;
   const traceUrl =
     mode !== 'select-agent' && agent
       ? buildTraceConsoleUrl({
@@ -373,18 +414,25 @@ export function InvokeScreen({
           agentName: agent.name,
         })
       : undefined;
-  const agentProtocol = agent?.protocol ?? 'HTTP';
-
-  const agentItems = config.runtimes.map((a, i) => ({
-    id: String(i),
-    title: a.name,
-    description: `${a.protocol && a.protocol !== 'HTTP' ? `${a.protocol} · ` : ''}Runtime: ${a.state.runtimeId}`,
-  }));
-
-  const isMcp = agentProtocol === 'MCP';
+  const agentProtocol = isHarnessSelected ? undefined : (agent?.protocol ?? 'HTTP');
+
+  const agentItems = [
+    ...config.runtimes.map((a, i) => ({
+      id: String(i),
+      title: a.name,
+      description: `${a.protocol && a.protocol !== 'HTTP' ? `${a.protocol} · ` : ''}Agent`,
+    })),
+    ...config.harnesses.map((h, i) => ({
+      id: String(config.runtimes.length + i),
+      title: h.name,
+      description: 'Harness',
+    })),
+  ];
+
+  const isMcp = !isHarnessSelected && agentProtocol === 'MCP';
 
   // Dynamic help text
-  const backOrQuit = config.runtimes.length > 1 ? 'Esc back' : 'Esc quit';
+  const backOrQuit = totalInvokables > 1 ? 'Esc back' : 'Esc quit';
   const helpText =
     mode === 'select-agent'
       ? '↑↓ select · Enter confirm · Esc quit'
@@ -399,9 +447,9 @@ export function InvokeScreen({
           : phase === 'invoking'
             ? '↑↓ scroll'
             : messages.length > 0
-              ? `↑↓ scroll · Enter invoke · N new session · ${backOrQuit}`
+              ? `↑↓ scroll · Enter invoke · Ctrl+N new session · ${backOrQuit}`
               : isMcp
-                ? `Enter to call a tool · N new session · ${backOrQuit}`
+                ? `Enter to call a tool · Ctrl+N new session · ${backOrQuit}`
                 : `Enter to send a message · ${backOrQuit}`;
 
   const headerContent = (
@@ -412,11 +460,11 @@ export function InvokeScreen({
       </Box>
       {mode !== 'select-agent' && (
         <Box>
-          <Text>Agent: </Text>
-          <Text color="cyan">{agent?.name}</Text>
+          <Text>{isHarnessSelected ? 'Harness: ' : 'Agent: '}</Text>
+          <Text color="cyan">{selectedName}</Text>
         </Box>
       )}
-      {mode !== 'select-agent' && agentProtocol !== 'HTTP' && (
+      {mode !== 'select-agent' && !isHarnessSelected && agentProtocol && agentProtocol !== 'HTTP' && (
         <Box>
           <Text>Protocol: </Text>
           <Text color="cyan">{agentProtocol}</Text>
@@ -453,18 +501,21 @@ export function InvokeScreen({
         </Text>
       )}
       {traceUrl && <Text dimColor>Note: Traces may take 2-3 minutes to appear in CloudWatch</Text>}
-      {mode !== 'select-agent' && agent?.networkMode === 'VPC' && (
+      {mode !== 'select-agent' && !isHarnessSelected && agent?.networkMode === 'VPC' && (
         <Text color="yellow">
           This agent uses VPC network mode. Ensure your VPC endpoints are configured for invocation.
         </Text>
       )}
+      {mode !== 'select-agent' && isHarnessSelected && screenTitle === 'Dev' && (
+        <Text color="yellow">If you changed the harness config, redeploy to pick up changes: agentcore deploy</Text>
+      )}
     </Box>
   );
 
   // Agent selection mode
   if (mode === 'select-agent') {
     return (
-      <Screen title="AgentCore Invoke" onExit={onExit} helpText={helpText} headerContent={headerContent}>
+      <Screen title={screenTitle} onExit={onExit} helpText={helpText} headerContent={headerContent}>
         <Panel title="Select Agent" fullWidth>
           <SelectList items={agentItems} selectedIndex={selectedAgent} />
         </Panel>
@@ -478,10 +529,11 @@ export function InvokeScreen({
   // Check if the last assistant message is empty (streaming hasn't started yet)
   const lastMessage = messages[messages.length - 1];
   const showThinking = phase === 'invoking' && lastMessage?.role === 'assistant' && !lastMessage.content;
+  const thinkingLabel = isExecInput ? 'Loading...' : 'Thinking...';
 
   return (
     <Screen
-      title="AgentCore Invoke"
+      title={screenTitle}
       onExit={onExit}
       helpText={helpText}
       headerContent={headerContent}
@@ -497,14 +549,16 @@ export function InvokeScreen({
               </Text>
             ))}
             {/* Thinking indicator - shows while waiting for response to start */}
-            {showThinking && <GradientText text="Thinking..." />}
+            {showThinking && <GradientText text={thinkingLabel} />}
           </Box>
         )}
 
         {/* Scroll indicator */}
         {needsScroll && (
           <Text dimColor>
-            [{effectiveOffset + 1}-{Math.min(effectiveOffset + displayHeight, totalLines)} of {totalLines}]
+            {effectiveOffset > 0 ? '▲ ' : '  '}
+            ↑↓ scroll
+            {effectiveOffset < maxScroll ? ' ▼' : '  '}
           </Text>
         )}
 
diff --git a/src/cli/tui/screens/invoke/useInvokeFlow.ts b/src/cli/tui/screens/invoke/useInvokeFlow.ts
index 2cb49b071..1f872370b 100644
--- a/src/cli/tui/screens/invoke/useInvokeFlow.ts
+++ b/src/cli/tui/screens/invoke/useInvokeFlow.ts
@@ -2,6 +2,7 @@ import { ConfigIO } from '../../../../lib';
 import type {
   AgentCoreDeployedState,
   AwsDeploymentTarget,
+  HarnessDeployedState,
   ModelProvider,
   NetworkMode,
   ProtocolMode,
@@ -20,10 +21,16 @@ import {
   mcpCallTool,
   mcpListTools,
 } from '../../../aws';
+import { invokeHarness } from '../../../aws/agentcore-harness';
 import { getErrorMessage } from '../../../errors';
 import { InvokeLogger } from '../../../logging';
 import { formatMcpToolList } from '../../../operations/dev/utils';
-import { canFetchRuntimeToken, fetchRuntimeToken } from '../../../operations/fetch-access';
+import {
+  canFetchHarnessToken,
+  canFetchRuntimeToken,
+  fetchHarnessToken,
+  fetchRuntimeToken,
+} from '../../../operations/fetch-access';
 import { generateSessionId } from '../../../operations/session';
 import { useCallback, useEffect, useRef, useState } from 'react';
 
@@ -42,6 +49,12 @@ export interface InvokeConfig {
     networkMode?: NetworkMode;
     protocol?: ProtocolMode;
     authorizerType?: RuntimeAuthorizerType;
+    baggage?: string;
+  }[];
+  harnesses: {
+    name: string;
+    state: HarnessDeployedState;
+    authorizerType?: RuntimeAuthorizerType;
   }[];
   target: AwsDeploymentTarget;
   targetName: string;
@@ -54,6 +67,8 @@ export interface InvokeFlowOptions {
   /** Custom headers to forward to the agent runtime on every invocation */
   headers?: Record<string, string>;
   initialBearerToken?: string;
+  /** Pre-select a harness by name, skipping the agent selection screen */
+  initialHarnessName?: string;
 }
 
 export type TokenFetchState = 'idle' | 'fetching' | 'fetched' | 'error';
@@ -84,7 +99,7 @@ export interface InvokeFlowState {
 }
 
 export function useInvokeFlow(options: InvokeFlowOptions = {}): InvokeFlowState {
-  const { initialSessionId, initialUserId, headers, initialBearerToken } = options;
+  const { initialSessionId, initialUserId, headers, initialBearerToken, initialHarnessName } = options;
   const [phase, setPhase] = useState<'loading' | 'ready' | 'invoking' | 'error'>('loading');
   const [config, setConfig] = useState<InvokeConfig | null>(null);
   const [selectedAgent, setSelectedAgent] = useState(0);
@@ -136,9 +151,24 @@ export function useInvokeFlow(options: InvokeFlowOptions = {}): InvokeFlowState
         }
 
         const runtimes: InvokeConfig['runtimes'] = [];
+        const deployedBundles = targetState?.resources?.configBundles ?? {};
         for (const agent of project.runtimes) {
           const state = targetState?.resources?.runtimes?.[agent.name];
           if (!state) continue;
+
+          // Build config bundle baggage if a bundle is associated with this agent
+          let baggage: string | undefined;
+          const bundleSpec = project.configBundles?.find(b => {
+            const keys = Object.keys(b.components ?? {});
+            return keys.some(k => k === `{{runtime:${agent.name}}}`);
+          });
+          if (bundleSpec) {
+            const bundleState = deployedBundles[bundleSpec.name];
+            if (bundleState?.bundleArn && bundleState?.versionId) {
+              baggage = `aws.agentcore.configbundle_arn=${encodeURIComponent(bundleState.bundleArn)},aws.agentcore.configbundle_version=${encodeURIComponent(bundleState.versionId)}`;
+            }
+          }
+
           runtimes.push({
             name: agent.name,
             state,
@@ -146,16 +176,38 @@ export function useInvokeFlow(options: InvokeFlowOptions = {}): InvokeFlowState
             networkMode: agent.networkMode,
             protocol: agent.protocol,
             authorizerType: agent.authorizerType,
+            baggage,
           });
         }
 
-        if (runtimes.length === 0) {
-          setError('No deployed agents found. Run `agentcore deploy` first.');
+        const harnesses: InvokeConfig['harnesses'] = [];
+        for (const harness of project.harnesses ?? []) {
+          const state = targetState?.resources?.harnesses?.[harness.name];
+          if (!state) continue;
+          let authorizerType: RuntimeAuthorizerType | undefined;
+          try {
+            const spec = await configIO.readHarnessSpec(harness.name);
+            authorizerType = spec.authorizerType;
+          } catch {
+            // spec read is best-effort
+          }
+          harnesses.push({ name: harness.name, state, authorizerType });
+        }
+
+        if (runtimes.length === 0 && harnesses.length === 0) {
+          setError('No deployed agents or harnesses found. Run `agentcore deploy` first.');
           setPhase('error');
           return;
         }
 
-        setConfig({ runtimes, target: targetConfig, targetName, projectName: project.name });
+        setConfig({ runtimes, harnesses, target: targetConfig, targetName, projectName: project.name });
+
+        if (initialHarnessName) {
+          const harnessIdx = harnesses.findIndex(h => h.name === initialHarnessName);
+          if (harnessIdx >= 0) {
+            setSelectedAgent(runtimes.length + harnessIdx);
+          }
+        }
 
         // Initialize session ID - always generate fresh unless explicitly provided
         if (initialSessionId) {
@@ -172,7 +224,7 @@ export function useInvokeFlow(options: InvokeFlowOptions = {}): InvokeFlowState
       }
     };
     void load();
-  }, [initialSessionId]);
+  }, [initialSessionId, initialHarnessName]);
 
   const getMcpInvokeOptions = useCallback(() => {
     if (!config) return null;
@@ -212,15 +264,22 @@ export function useInvokeFlow(options: InvokeFlowOptions = {}): InvokeFlowState
 
   const fetchBearerToken = useCallback(async () => {
     if (!config) return;
-    const agent = config.runtimes[selectedAgent];
-    if (agent?.authorizerType !== 'CUSTOM_JWT') return;
 
-    // Check if credentials are set up before attempting fetch
-    const canFetch = await canFetchRuntimeToken(agent.name);
+    const isHarnessSelected = selectedAgent >= config.runtimes.length;
+    const agent = isHarnessSelected ? undefined : config.runtimes[selectedAgent];
+    const harness = isHarnessSelected ? config.harnesses[selectedAgent - config.runtimes.length] : undefined;
+    const selectedAuthType = agent?.authorizerType ?? harness?.authorizerType;
+    const selectedName = agent?.name ?? harness?.name;
+
+    if (selectedAuthType !== 'CUSTOM_JWT' || !selectedName) return;
+
+    const canFetch = isHarnessSelected
+      ? await canFetchHarnessToken(selectedName)
+      : await canFetchRuntimeToken(selectedName);
     if (!canFetch) {
       setTokenFetchState('error');
       setTokenFetchError(
-        'No OAuth credentials configured for auto-fetch. Press T to enter a bearer token manually, or re-add the agent with --client-id and --client-secret.'
+        'No OAuth credentials configured for auto-fetch. Press T to enter a bearer token manually, or re-add with --client-id and --client-secret.'
       );
       return;
     }
@@ -228,7 +287,9 @@ export function useInvokeFlow(options: InvokeFlowOptions = {}): InvokeFlowState
     setTokenFetchState('fetching');
     setTokenFetchError(null);
     try {
-      const result = await fetchRuntimeToken(agent.name, { deployTarget: config.targetName });
+      const result = isHarnessSelected
+        ? await fetchHarnessToken(selectedName, { deployTarget: config.targetName })
+        : await fetchRuntimeToken(selectedName, { deployTarget: config.targetName });
       setBearerToken(result.token);
       setTokenExpiresIn(result.expiresIn);
       setTokenFetchState('fetched');
@@ -241,20 +302,160 @@ export function useInvokeFlow(options: InvokeFlowOptions = {}): InvokeFlowState
   // Track current streaming content to avoid stale closure issues
   const streamingContentRef = useRef('');
 
+  const streamHarnessInvoke = useCallback(
+    async (
+      region: string,
+      harnessArn: string,
+      runtimeSessionId: string,
+      harnessMessages: { role: string; content: Record<string, unknown>[] }[]
+    ) => {
+      const logger = loggerRef.current;
+      let pendingToolUseId: string | undefined;
+      let pendingToolName: string | undefined;
+      let pendingToolInput = '';
+      let lastMetadata: { inputTokens: number; outputTokens: number; latencyMs: number } | null = null;
+
+      try {
+        const stream = invokeHarness({
+          region,
+          harnessArn,
+          runtimeSessionId,
+          messages: harnessMessages,
+          bearerToken: bearerToken || undefined,
+        });
+
+        for await (const event of stream) {
+          switch (event.type) {
+            case 'contentBlockDelta':
+              if (event.delta.type === 'text') {
+                streamingContentRef.current += event.delta.text;
+                const currentContent = streamingContentRef.current;
+                setMessages(prev => {
+                  const updated = [...prev];
+                  const lastIdx = updated.length - 1;
+                  if (lastIdx >= 0 && updated[lastIdx]?.role === 'assistant') {
+                    updated[lastIdx] = { role: 'assistant', content: currentContent };
+                  }
+                  return updated;
+                });
+              } else if (event.delta.type === 'toolUse') {
+                pendingToolInput += event.delta.input;
+              }
+              break;
+            case 'contentBlockStart':
+              if (event.start.type === 'toolUse') {
+                pendingToolUseId = event.start.toolUse.toolUseId;
+                pendingToolName = event.start.toolUse.name;
+                pendingToolInput = '';
+                const serverName = event.start.toolUse.serverName;
+                const label = serverName ? `${serverName}/${pendingToolName}` : pendingToolName;
+                logger?.logInfo(`Tool call: ${pendingToolName} (id: ${pendingToolUseId})`);
+                streamingContentRef.current += `\n\x1b[2m🔧 ${label}`;
+                const currentContent = streamingContentRef.current;
+                setMessages(prev => {
+                  const updated = [...prev];
+                  const lastIdx = updated.length - 1;
+                  if (lastIdx >= 0 && updated[lastIdx]?.role === 'assistant') {
+                    updated[lastIdx] = { role: 'assistant', content: currentContent };
+                  }
+                  return updated;
+                });
+              } else if (event.start.type === 'toolResult') {
+                const status = event.start.toolResult.status;
+                const icon = status === 'error' ? ' \x1b[31m✗\x1b[0m' : ' ✓\x1b[0m';
+                logger?.logInfo(`Tool result (${pendingToolName}): status=${status ?? 'success'}`);
+                streamingContentRef.current += `${icon}\n`;
+                const currentContent = streamingContentRef.current;
+                setMessages(prev => {
+                  const updated = [...prev];
+                  const lastIdx = updated.length - 1;
+                  if (lastIdx >= 0 && updated[lastIdx]?.role === 'assistant') {
+                    updated[lastIdx] = { role: 'assistant', content: currentContent };
+                  }
+                  return updated;
+                });
+              }
+              break;
+            case 'messageStop':
+              if (event.stopReason === 'tool_use' && pendingToolUseId) {
+                let inputObj: Record<string, unknown> = {};
+                try {
+                  inputObj = JSON.parse(pendingToolInput) as Record<string, unknown>;
+                } catch {
+                  // use empty
+                }
+                logger?.logInfo(`Tool input (${pendingToolName}): ${JSON.stringify(inputObj)}`);
+              } else if (event.stopReason === 'tool_result') {
+                // Server-side tool execution completed
+              }
+              break;
+            case 'metadata': {
+              const { inputTokens, outputTokens } = event.usage;
+              logger?.logInfo(`Tokens: ${inputTokens} in, ${outputTokens} out | Latency: ${event.metrics.latencyMs}ms`);
+              lastMetadata = { inputTokens, outputTokens, latencyMs: event.metrics.latencyMs };
+              break;
+            }
+            case 'error':
+              streamingContentRef.current += `\nError: ${event.message}`;
+              setMessages(prev => {
+                const updated = [...prev];
+                const lastIdx = updated.length - 1;
+                if (lastIdx >= 0 && updated[lastIdx]?.role === 'assistant') {
+                  updated[lastIdx] = { role: 'assistant', content: streamingContentRef.current };
+                }
+                return updated;
+              });
+              break;
+          }
+        }
+
+        if (lastMetadata) {
+          const latency = (lastMetadata.latencyMs / 1000).toFixed(1);
+          streamingContentRef.current += `\n\x1b[2m⚡ ${lastMetadata.inputTokens} in · ${lastMetadata.outputTokens} out · ${latency}s\x1b[0m`;
+          const currentContent = streamingContentRef.current;
+          setMessages(prev => {
+            const updated = [...prev];
+            const lastIdx = updated.length - 1;
+            if (lastIdx >= 0 && updated[lastIdx]?.role === 'assistant') {
+              updated[lastIdx] = { role: 'assistant', content: currentContent };
+            }
+            return updated;
+          });
+        }
+
+        setPhase('ready');
+      } catch (err) {
+        const errMsg = getErrorMessage(err);
+        setMessages(prev => {
+          const updated = [...prev];
+          const lastIdx = updated.length - 1;
+          if (lastIdx >= 0 && updated[lastIdx]?.role === 'assistant') {
+            updated[lastIdx] = { role: 'assistant', content: `Error: ${errMsg}` };
+          }
+          return updated;
+        });
+        setPhase('ready');
+      }
+    },
+    [bearerToken]
+  );
+
   const invoke = useCallback(
     async (prompt: string) => {
       if (!config || phase === 'invoking') return;
 
+      const isHarness = selectedAgent >= config.runtimes.length;
       const agent = config.runtimes[selectedAgent];
-      if (!agent) return;
+      if (!agent && !isHarness) return;
 
-      const isMcp = agent.protocol === 'MCP';
+      const isMcp = !isHarness && agent?.protocol === 'MCP';
 
       // Create logger on first invoke or if agent changed
       if (!loggerRef.current) {
+        const harnessForLog = isHarness ? config.harnesses[selectedAgent - config.runtimes.length] : undefined;
         loggerRef.current = new InvokeLogger({
-          agentName: agent.name,
-          runtimeArn: agent.state.runtimeArn,
+          agentName: agent?.name ?? harnessForLog?.name ?? 'harness',
+          runtimeArn: agent?.state.runtimeArn ?? harnessForLog?.state.harnessArn ?? '',
           region: config.target.region,
           sessionId: sessionId ?? undefined,
         });
@@ -323,6 +524,26 @@ export function useInvokeFlow(options: InvokeFlowOptions = {}): InvokeFlowState
         return;
       }
 
+      if (isHarness) {
+        const harnessIdx = selectedAgent - config.runtimes.length;
+        const harness = config.harnesses[harnessIdx];
+        if (!harness) return;
+
+        setMessages(prev => [...prev, { role: 'user', content: prompt }, { role: 'assistant', content: '' }]);
+        setPhase('invoking');
+        streamingContentRef.current = '';
+
+        logger.logPrompt(prompt, sessionId ?? undefined, userId);
+        await streamHarnessInvoke(config.target.region, harness.state.harnessArn, sessionId ?? generateSessionId(), [
+          { role: 'user', content: [{ text: prompt }] },
+        ]);
+        logger.logResponse(streamingContentRef.current);
+        return;
+      }
+
+      // HTTP / A2A: streaming invoke (agent is guaranteed defined here — harness path returned above)
+      if (!agent) return;
+
       // AGUI: structured event streaming with rich rendering
       if (agent.protocol === 'AGUI') {
         const aguiInput = buildAguiRunInput(prompt, sessionId ?? undefined);
@@ -469,6 +690,7 @@ export function useInvokeFlow(options: InvokeFlowOptions = {}): InvokeFlowState
               logger,
               headers,
               bearerToken: bearerToken || undefined,
+              baggage: agent.baggage,
             });
 
         if (result.sessionId) {
@@ -507,21 +729,46 @@ export function useInvokeFlow(options: InvokeFlowOptions = {}): InvokeFlowState
         setPhase('ready');
       }
     },
-    [config, selectedAgent, phase, sessionId, userId, headers, bearerToken, fetchMcpTools, getMcpInvokeOptions]
+    [
+      config,
+      selectedAgent,
+      phase,
+      sessionId,
+      userId,
+      headers,
+      bearerToken,
+      fetchMcpTools,
+      getMcpInvokeOptions,
+      streamHarnessInvoke,
+    ]
   );
 
   const execCommand = useCallback(
     async (command: string) => {
       if (!config || phase === 'invoking') return;
 
-      const agent = config.runtimes[selectedAgent];
-      if (!agent) return;
+      const isHarnessExec = selectedAgent >= config.runtimes.length;
+      const agent = isHarnessExec ? undefined : config.runtimes[selectedAgent];
+      if (!agent && !isHarnessExec) return;
+
+      let execRuntimeArn: string | undefined;
+      let execName: string;
+      if (isHarnessExec) {
+        const harnessIdx = selectedAgent - config.runtimes.length;
+        const harness = config.harnesses[harnessIdx];
+        if (!harness) return;
+        execRuntimeArn = harness.state.harnessArn;
+        execName = harness.name;
+      } else {
+        execRuntimeArn = agent!.state.runtimeArn;
+        execName = agent!.name;
+      }
 
-      // Create logger on first invoke or if agent changed
+      // Create logger on first exec or if agent changed
       if (!loggerRef.current) {
         loggerRef.current = new InvokeLogger({
-          agentName: agent.name,
-          runtimeArn: agent.state.runtimeArn,
+          agentName: execName,
+          runtimeArn: execRuntimeArn,
           region: config.target.region,
           sessionId: sessionId ?? undefined,
         });
@@ -543,7 +790,7 @@ export function useInvokeFlow(options: InvokeFlowOptions = {}): InvokeFlowState
       try {
         const result = await executeBashCommand({
           region: config.target.region,
-          runtimeArn: agent.state.runtimeArn,
+          runtimeArn: execRuntimeArn,
           command,
           sessionId: sessionId ?? undefined,
           headers,
diff --git a/src/cli/tui/screens/online-eval/AddOnlineEvalFlow.tsx b/src/cli/tui/screens/online-eval/AddOnlineEvalFlow.tsx
index 92c56d90e..243eba4e7 100644
--- a/src/cli/tui/screens/online-eval/AddOnlineEvalFlow.tsx
+++ b/src/cli/tui/screens/online-eval/AddOnlineEvalFlow.tsx
@@ -3,16 +3,17 @@ import { validateAwsCredentials } from '../../../aws/account';
 import { listEvaluators } from '../../../aws/agentcore-control';
 import { detectRegion } from '../../../aws/region';
 import { getErrorMessage } from '../../../errors';
-import { ErrorPrompt } from '../../components';
+import { ErrorPrompt, GradientText } from '../../components';
 import { useCreateOnlineEval, useExistingOnlineEvalNames } from '../../hooks/useCreateOnlineEval';
 import { AddSuccessScreen } from '../add/AddSuccessScreen';
+import type { RuntimeInfoForEval } from './AddOnlineEvalScreen';
 import { AddOnlineEvalScreen } from './AddOnlineEvalScreen';
 import type { AddOnlineEvalConfig, EvaluatorItem } from './types';
 import React, { useCallback, useEffect, useState } from 'react';
 
 type FlowState =
   | { name: 'loading' }
-  | { name: 'create-wizard'; evaluators: EvaluatorItem[]; agentNames: string[] }
+  | { name: 'create-wizard'; evaluators: EvaluatorItem[]; agentNames: string[]; runtimes: RuntimeInfoForEval[] }
   | { name: 'create-success'; configName: string }
   | { name: 'creds-error'; message: string }
   | { name: 'error'; message: string };
@@ -55,7 +56,8 @@ export function AddOnlineEvalFlow({ isInteractive = true, onExit, onBack, onDev,
           description: e.description,
         }));
 
-        const agentNames = projectSpec.runtimes.map(a => a.name);
+        const runtimesList = projectSpec.runtimes ?? [];
+        const agentNames = runtimesList.map(a => a.name);
 
         if (agentNames.length === 0) {
           setFlow({
@@ -65,7 +67,16 @@ export function AddOnlineEvalFlow({ isInteractive = true, onExit, onBack, onDev,
           return;
         }
 
-        setFlow({ name: 'create-wizard', evaluators: items, agentNames });
+        // Build runtime info with endpoints for the endpoint picker
+        const runtimesInfo: RuntimeInfoForEval[] = runtimesList.map(r => ({
+          name: r.name,
+          endpoints: Object.entries(r.endpoints ?? {}).map(([epName, ep]) => ({
+            name: epName,
+            version: ep.version,
+          })),
+        }));
+
+        setFlow({ name: 'create-wizard', evaluators: items, agentNames, runtimes: runtimesInfo });
       } catch (err) {
         if (!cancelled) setFlow({ name: 'error', message: getErrorMessage(err) });
       }
@@ -96,7 +107,7 @@ export function AddOnlineEvalFlow({ isInteractive = true, onExit, onBack, onDev,
   );
 
   if (flow.name === 'loading') {
-    return null;
+    return <GradientText text="Preparing online eval setup..." />;
   }
 
   if (flow.name === 'creds-error') {
@@ -109,6 +120,7 @@ export function AddOnlineEvalFlow({ isInteractive = true, onExit, onBack, onDev,
         existingConfigNames={existingConfigNames}
         evaluatorItems={flow.evaluators}
         agentNames={flow.agentNames}
+        runtimes={flow.runtimes}
         onComplete={handleCreateComplete}
         onExit={onBack}
       />
diff --git a/src/cli/tui/screens/online-eval/AddOnlineEvalScreen.tsx b/src/cli/tui/screens/online-eval/AddOnlineEvalScreen.tsx
index fc863a2d1..fd5fafcf6 100644
--- a/src/cli/tui/screens/online-eval/AddOnlineEvalScreen.tsx
+++ b/src/cli/tui/screens/online-eval/AddOnlineEvalScreen.tsx
@@ -12,11 +12,17 @@ import {
 import { HELP_TEXT } from '../../constants';
 import { useListNavigation, useMultiSelectNavigation } from '../../hooks';
 import { generateUniqueName } from '../../utils';
-import type { AddOnlineEvalConfig, EvaluatorItem } from './types';
+import type { AddOnlineEvalConfig, EvaluatorItem, RuntimeEndpointEntry } from './types';
 import { DEFAULT_SAMPLING_RATE, ONLINE_EVAL_STEP_LABELS } from './types';
 import { useAddOnlineEvalWizard } from './useAddOnlineEvalWizard';
 import { Box, Text } from 'ink';
-import React, { useMemo } from 'react';
+import React, { useCallback, useEffect, useMemo } from 'react';
+
+/** Runtime info with endpoints, passed from the parent flow. */
+export interface RuntimeInfoForEval {
+  name: string;
+  endpoints: RuntimeEndpointEntry[];
+}
 
 interface AddOnlineEvalScreenProps {
   onComplete: (config: AddOnlineEvalConfig) => void;
@@ -24,6 +30,8 @@ interface AddOnlineEvalScreenProps {
   existingConfigNames: string[];
   evaluatorItems: EvaluatorItem[];
   agentNames: string[];
+  /** Runtime info including endpoints for the endpoint picker step. */
+  runtimes?: RuntimeInfoForEval[];
 }
 
 export function AddOnlineEvalScreen({
@@ -32,6 +40,7 @@ export function AddOnlineEvalScreen({
   existingConfigNames,
   evaluatorItems: rawEvaluatorItems,
   agentNames,
+  runtimes = [],
 }: AddOnlineEvalScreenProps) {
   const wizard = useAddOnlineEvalWizard(agentNames.length);
 
@@ -43,6 +52,36 @@ export function AddOnlineEvalScreen({
     return wizard.config;
   }, [wizard.config, agentNames]);
 
+  // Determine endpoints for the currently selected agent
+  const agentEndpoints = useMemo(() => {
+    const agentName = effectiveConfig.agent;
+    if (!agentName) return [];
+    const rt = runtimes.find(r => r.name === agentName);
+    return rt?.endpoints ?? [];
+  }, [effectiveConfig.agent, runtimes]);
+
+  // Skip endpoint step when the selected agent has no endpoints
+  const shouldSkipStep = useCallback(
+    (s: string) => {
+      if (s === 'endpoint' && agentEndpoints.length === 0) return true;
+      return false;
+    },
+    [agentEndpoints.length]
+  );
+
+  useEffect(() => {
+    wizard.setSkipCheck(shouldSkipStep);
+  }, [shouldSkipStep]); // wizard.setSkipCheck is stable (useCallback with no deps)
+
+  // Build endpoint picker items: DEFAULT (plain) + each endpoint
+  const endpointItems: SelectableItem[] = useMemo(() => {
+    const items: SelectableItem[] = [{ id: 'DEFAULT', title: 'DEFAULT' }];
+    for (const ep of agentEndpoints) {
+      items.push({ id: ep.name, title: ep.name, description: `v${ep.version}` });
+    }
+    return items;
+  }, [agentEndpoints]);
+
   const evaluatorItems: SelectableItem[] = useMemo(() => {
     return rawEvaluatorItems.map(e => ({
       id: e.arn,
@@ -57,6 +96,7 @@ export function AddOnlineEvalScreen({
 
   const isNameStep = wizard.step === 'name';
   const isAgentStep = wizard.step === 'agent';
+  const isEndpointStep = wizard.step === 'endpoint';
   const isEvaluatorsStep = wizard.step === 'evaluators';
   const isSamplingRateStep = wizard.step === 'samplingRate';
   const isEnableOnCreateStep = wizard.step === 'enableOnCreate';
@@ -77,6 +117,16 @@ export function AddOnlineEvalScreen({
     isActive: isAgentStep,
   });
 
+  const endpointNav = useListNavigation({
+    items: endpointItems,
+    onSelect: item => {
+      // DEFAULT means no endpoint filter — store undefined
+      wizard.setEndpoint(item.id === 'DEFAULT' ? undefined : item.id);
+    },
+    onExit: () => wizard.goBack(),
+    isActive: isEndpointStep,
+  });
+
   const evaluatorsNav = useMultiSelectNavigation({
     items: evaluatorItems,
     getId: item => item.id,
@@ -102,7 +152,7 @@ export function AddOnlineEvalScreen({
 
   const helpText = isEvaluatorsStep
     ? 'Space toggle · Enter confirm · Esc back'
-    : isAgentStep || isEnableOnCreateStep
+    : isAgentStep || isEndpointStep || isEnableOnCreateStep
       ? HELP_TEXT.NAVIGATE_SELECT
       : isConfirmStep
         ? HELP_TEXT.CONFIRM_CANCEL
@@ -136,6 +186,14 @@ export function AddOnlineEvalScreen({
           />
         )}
 
+        {isEndpointStep && (
+          <WizardSelect
+            title="Select endpoint to monitor"
+            items={endpointItems}
+            selectedIndex={endpointNav.selectedIndex}
+          />
+        )}
+
         {isEvaluatorsStep && (
           <WizardMultiSelect
             title="Select evaluators"
@@ -186,6 +244,7 @@ export function AddOnlineEvalScreen({
             fields={[
               { label: 'Name', value: effectiveConfig.name },
               { label: 'Agent', value: effectiveConfig.agent },
+              ...(effectiveConfig.endpoint ? [{ label: 'Endpoint', value: effectiveConfig.endpoint }] : []),
               { label: 'Evaluators', value: effectiveConfig.evaluators.join(', ') },
               { label: 'Sampling Rate', value: `${effectiveConfig.samplingRate}%` },
               { label: 'Enable on Deploy', value: effectiveConfig.enableOnCreate ? 'Yes' : 'No' },
diff --git a/src/cli/tui/screens/online-eval/types.ts b/src/cli/tui/screens/online-eval/types.ts
index 943eaee73..1a1e5940c 100644
--- a/src/cli/tui/screens/online-eval/types.ts
+++ b/src/cli/tui/screens/online-eval/types.ts
@@ -2,20 +2,35 @@
 // Online Eval Config Flow Types
 // ─────────────────────────────────────────────────────────────────────────────
 
-export type AddOnlineEvalStep = 'name' | 'agent' | 'evaluators' | 'samplingRate' | 'enableOnCreate' | 'confirm';
+export type AddOnlineEvalStep =
+  | 'name'
+  | 'agent'
+  | 'endpoint'
+  | 'evaluators'
+  | 'samplingRate'
+  | 'enableOnCreate'
+  | 'confirm';
 
 export interface AddOnlineEvalConfig {
   name: string;
   agent: string;
+  endpoint?: string;
   evaluators: string[];
   samplingRate: number;
   enableOnCreate: boolean;
   description?: string;
 }
 
+/** Runtime endpoint info used by the online eval endpoint picker. */
+export interface RuntimeEndpointEntry {
+  name: string;
+  version: number;
+}
+
 export const ONLINE_EVAL_STEP_LABELS: Record<AddOnlineEvalStep, string> = {
   name: 'Name',
   agent: 'Agent',
+  endpoint: 'Endpoint',
   evaluators: 'Evaluators',
   samplingRate: 'Rate',
   enableOnCreate: 'Enable',
diff --git a/src/cli/tui/screens/online-eval/useAddOnlineEvalWizard.ts b/src/cli/tui/screens/online-eval/useAddOnlineEvalWizard.ts
index 0032469f2..239a95edc 100644
--- a/src/cli/tui/screens/online-eval/useAddOnlineEvalWizard.ts
+++ b/src/cli/tui/screens/online-eval/useAddOnlineEvalWizard.ts
@@ -1,40 +1,58 @@
 import type { AddOnlineEvalConfig, AddOnlineEvalStep } from './types';
 import { DEFAULT_SAMPLING_RATE } from './types';
-import { useCallback, useState } from 'react';
+import { useCallback, useRef, useState } from 'react';
 
 function getAllSteps(agentCount: number): AddOnlineEvalStep[] {
   if (agentCount <= 1) {
-    return ['name', 'evaluators', 'samplingRate', 'enableOnCreate', 'confirm'];
+    // endpoint step is included but will be skipped dynamically when no endpoints exist
+    return ['name', 'endpoint', 'evaluators', 'samplingRate', 'enableOnCreate', 'confirm'];
   }
-  return ['name', 'agent', 'evaluators', 'samplingRate', 'enableOnCreate', 'confirm'];
+  return ['name', 'agent', 'endpoint', 'evaluators', 'samplingRate', 'enableOnCreate', 'confirm'];
 }
 
 function getDefaultConfig(): AddOnlineEvalConfig {
   return {
     name: '',
     agent: '',
+    endpoint: undefined,
     evaluators: [],
     samplingRate: DEFAULT_SAMPLING_RATE,
     enableOnCreate: true,
   };
 }
 
+type StepSkipCheck = (step: AddOnlineEvalStep) => boolean;
+
 export function useAddOnlineEvalWizard(agentCount: number) {
   const allSteps = getAllSteps(agentCount);
   const [config, setConfig] = useState<AddOnlineEvalConfig>(getDefaultConfig);
   const [step, setStep] = useState<AddOnlineEvalStep>(allSteps[0]!);
+  const skipCheckRef = useRef<StepSkipCheck>(() => false);
 
   const currentIndex = allSteps.indexOf(step);
 
+  const setSkipCheck = useCallback((check: StepSkipCheck) => {
+    skipCheckRef.current = check;
+  }, []);
+
   const goBack = useCallback(() => {
-    const prevStep = allSteps[currentIndex - 1];
-    if (prevStep) setStep(prevStep);
+    for (let i = currentIndex - 1; i >= 0; i--) {
+      if (!skipCheckRef.current(allSteps[i]!)) {
+        setStep(allSteps[i]!);
+        return;
+      }
+    }
   }, [allSteps, currentIndex, setStep]);
 
   const nextStep = useCallback(
     (currentStep: AddOnlineEvalStep): AddOnlineEvalStep | undefined => {
       const idx = allSteps.indexOf(currentStep);
-      return allSteps[idx + 1];
+      for (let i = idx + 1; i < allSteps.length; i++) {
+        if (!skipCheckRef.current(allSteps[i]!)) {
+          return allSteps[i]!;
+        }
+      }
+      return undefined;
     },
     [allSteps]
   );
@@ -50,13 +68,22 @@ export function useAddOnlineEvalWizard(agentCount: number) {
 
   const setAgent = useCallback(
     (agent: string) => {
-      setConfig(c => ({ ...c, agent }));
+      setConfig(c => ({ ...c, agent, endpoint: undefined }));
       const next = nextStep('agent');
       if (next) setStep(next);
     },
     [nextStep, setConfig, setStep]
   );
 
+  const setEndpoint = useCallback(
+    (endpoint: string | undefined) => {
+      setConfig(c => ({ ...c, endpoint }));
+      const next = nextStep('endpoint');
+      if (next) setStep(next);
+    },
+    [nextStep, setConfig, setStep]
+  );
+
   const setEvaluators = useCallback(
     (evaluators: string[]) => {
       setConfig(c => ({ ...c, evaluators }));
@@ -95,8 +122,10 @@ export function useAddOnlineEvalWizard(agentCount: number) {
     steps: allSteps,
     currentIndex,
     goBack,
+    setSkipCheck,
     setName,
     setAgent,
+    setEndpoint,
     setEvaluators,
     setSamplingRate,
     setEnableOnCreate,
diff --git a/src/cli/tui/screens/policy/AddPolicyFlow.tsx b/src/cli/tui/screens/policy/AddPolicyFlow.tsx
index 720984563..9b3542cb8 100644
--- a/src/cli/tui/screens/policy/AddPolicyFlow.tsx
+++ b/src/cli/tui/screens/policy/AddPolicyFlow.tsx
@@ -1,4 +1,6 @@
 import { policyEnginePrimitive, policyPrimitive } from '../../../primitives/registry';
+import { withAddTelemetry } from '../../../telemetry/cli-command-run.js';
+import { AttachMode, ValidationMode, standardize } from '../../../telemetry/schemas/common-shapes.js';
 import {
   ErrorPrompt,
   Panel,
@@ -128,7 +130,14 @@ export function AddPolicyFlow({ isInteractive = true, onExit, onBack, onDev, onD
   }, []);
 
   const commitEngine = useCallback(async (engineName: string, gateways?: string[], mode?: 'LOG_ONLY' | 'ENFORCE') => {
-    const result = await policyEnginePrimitive.add({ name: engineName });
+    const result = await withAddTelemetry(
+      'add.policy-engine',
+      {
+        attach_gateway_count: gateways?.length ?? 0,
+        attach_mode: standardize(AttachMode, mode ?? 'log_only'),
+      },
+      () => policyEnginePrimitive.add({ name: engineName })
+    );
     if (!result.success) {
       setFlow({ name: 'error', message: result.error });
       return;
@@ -155,13 +164,21 @@ export function AddPolicyFlow({ isInteractive = true, onExit, onBack, onDev, onD
   );
 
   const handlePolicyComplete = useCallback(async (config: AddPolicyConfig) => {
-    const result = await policyPrimitive.add({
-      name: config.name,
-      engine: config.engine,
-      statement: config.statement,
-      source: config.sourceFile || undefined,
-      validationMode: config.validationMode,
-    });
+    const result = await withAddTelemetry(
+      'add.policy',
+      {
+        source_type: config.sourceFile ? 'file' : config.sourceMethod === 'generate' ? 'generate' : 'statement',
+        validation_mode: standardize(ValidationMode, config.validationMode ?? 'FAIL_ON_ANY_FINDINGS'),
+      },
+      () =>
+        policyPrimitive.add({
+          name: config.name,
+          engine: config.engine,
+          statement: config.statement,
+          source: config.sourceFile || undefined,
+          validationMode: config.validationMode,
+        })
+    );
 
     if (result.success) {
       setPolicyNames(prev => [...prev, config.name]);
diff --git a/src/cli/tui/screens/recommendation/RecommendationFlow.tsx b/src/cli/tui/screens/recommendation/RecommendationFlow.tsx
new file mode 100644
index 000000000..b28344df3
--- /dev/null
+++ b/src/cli/tui/screens/recommendation/RecommendationFlow.tsx
@@ -0,0 +1,552 @@
+import { ConfigIO } from '../../../../lib';
+import type { DeployedState } from '../../../../schema';
+import { validateAwsCredentials } from '../../../aws/account';
+import { listEvaluators } from '../../../aws/agentcore-control';
+import { detectRegion } from '../../../aws/region';
+import { getErrorMessage } from '../../../errors';
+import { applyRecommendationToBundle, runRecommendationCommand } from '../../../operations/recommendation';
+import type { RunRecommendationCommandResult } from '../../../operations/recommendation';
+import { saveRecommendationRun } from '../../../operations/recommendation/recommendation-storage';
+import { ErrorPrompt, GradientText, Panel, Screen, StepProgress } from '../../components';
+import type { Step } from '../../components';
+import { HELP_TEXT } from '../../constants';
+import { useListNavigation } from '../../hooks';
+import { RecommendationScreen } from './RecommendationScreen';
+import type {
+  AgentItem,
+  ConfigBundleField,
+  ConfigBundleItem,
+  EvaluatorItem,
+  RecommendationWizardConfig,
+} from './types';
+import { Box, Text } from 'ink';
+import React, { useCallback, useEffect, useState } from 'react';
+
+type FlowState =
+  | { name: 'loading' }
+  | { name: 'wizard'; agents: AgentItem[]; evaluators: EvaluatorItem[]; configBundles: ConfigBundleItem[] }
+  | {
+      name: 'running';
+      config: RecommendationWizardConfig;
+      steps: Step[];
+      elapsed: number;
+      recommendationId?: string;
+      region?: string;
+    }
+  | { name: 'results'; result: RunRecommendationCommandResult; config: RecommendationWizardConfig; filePath?: string }
+  | { name: 'creds-error'; message: string }
+  | { name: 'error'; message: string; logFilePath?: string };
+
+interface RecommendationFlowProps {
+  onExit: () => void;
+}
+
+export function RecommendationFlow({ onExit }: RecommendationFlowProps) {
+  const [flow, setFlow] = useState<FlowState>({ name: 'loading' });
+
+  // Load agents and evaluators
+  useEffect(() => {
+    if (flow.name !== 'loading') return;
+    let cancelled = false;
+
+    void (async () => {
+      try {
+        await validateAwsCredentials();
+      } catch (err) {
+        if (!cancelled) setFlow({ name: 'creds-error', message: getErrorMessage(err) });
+        return;
+      }
+
+      try {
+        const configIO = new ConfigIO();
+        const [{ region }, deployedState] = await Promise.all([detectRegion(), configIO.readDeployedState()]);
+
+        if (cancelled) return;
+
+        const agents = buildAgentItems(deployedState);
+        if (agents.length === 0) {
+          setFlow({
+            name: 'error',
+            message: 'No deployed agents found. Run `agentcore deploy` first.',
+          });
+          return;
+        }
+
+        const evalResult = await listEvaluators({ region });
+        if (cancelled) return;
+
+        const evaluators: EvaluatorItem[] = evalResult.evaluators.map(e => ({
+          id: e.evaluatorArn || e.evaluatorName,
+          title: e.evaluatorName,
+          description: e.description ?? e.evaluatorType,
+        }));
+
+        const projectSpec = await configIO.readProjectSpec();
+        const configBundles = buildConfigBundleItems(deployedState, projectSpec.configBundles ?? []);
+
+        setFlow({ name: 'wizard', agents, evaluators, configBundles });
+      } catch (err) {
+        if (!cancelled) setFlow({ name: 'error', message: getErrorMessage(err) });
+      }
+    })();
+
+    return () => {
+      cancelled = true;
+    };
+  }, [flow.name]);
+
+  const handleRunComplete = useCallback((config: RecommendationWizardConfig) => {
+    const willFetchSpans = config.traceSource === 'sessions';
+
+    const initialSteps: Step[] = [
+      ...(willFetchSpans ? [{ label: 'Fetching session spans from CloudWatch...', status: 'pending' as const }] : []),
+      { label: 'Starting recommendation...', status: 'running' },
+      { label: 'Polling for results', status: 'pending' },
+      { label: 'Saving results', status: 'pending' },
+    ];
+
+    // If auto-fetching, the first step is active
+    if (willFetchSpans) {
+      initialSteps[0] = { ...initialSteps[0]!, status: 'running' };
+      initialSteps[1] = { ...initialSteps[1]!, status: 'pending' };
+    }
+
+    setFlow({ name: 'running', config, steps: initialSteps, elapsed: 0 });
+  }, []);
+
+  // Execute the recommendation when entering 'running' state
+  useEffect(() => {
+    if (flow.name !== 'running') return;
+    let cancelled = false;
+
+    const { config } = flow;
+    const startTime = Date.now();
+
+    const timer = setInterval(() => {
+      if (!cancelled) {
+        setFlow(prev => {
+          if (prev.name !== 'running') return prev;
+          return { ...prev, elapsed: Math.floor((Date.now() - startTime) / 1000) };
+        });
+      }
+    }, 1000);
+
+    void (async () => {
+      try {
+        const result = await runRecommendationCommand({
+          type: config.type,
+          agent: config.agent,
+          evaluators: config.evaluators,
+          inputSource: config.inputSource,
+          inlineContent: config.inputSource === 'inline' ? config.content : undefined,
+          promptFile: config.inputSource === 'file' ? config.content : undefined,
+          bundleName: config.inputSource === 'config-bundle' ? config.bundleName : undefined,
+          bundleVersion: config.inputSource === 'config-bundle' ? config.bundleVersion : undefined,
+          systemPromptJsonPath:
+            config.inputSource === 'config-bundle' && config.systemPromptJsonPath
+              ? config.systemPromptJsonPath
+              : undefined,
+          toolDescJsonPaths:
+            config.inputSource === 'config-bundle' && config.toolDescJsonPaths.length > 0
+              ? config.toolDescJsonPaths
+              : undefined,
+          tools: config.tools
+            ? config.tools
+                .split(/,(?=[a-zA-Z0-9_\-.]+:)/)
+                .map(t => t.trim())
+                .filter(Boolean)
+            : undefined,
+          traceSource: config.traceSource,
+          lookbackDays: config.days,
+          sessionIds: config.sessionIds.length > 0 ? config.sessionIds : undefined,
+          onProgress: (status, _message) => {
+            if (cancelled) return;
+            const hasFetchStep = config.traceSource === 'sessions';
+            const offset = hasFetchStep ? 1 : 0;
+
+            setFlow(prev => {
+              if (prev.name !== 'running') return prev;
+              const steps = [...prev.steps];
+              if (status === 'fetching-spans') {
+                steps[0] = { ...steps[0]!, status: 'running' };
+              } else if (status === 'starting') {
+                if (hasFetchStep) steps[0] = { ...steps[0]!, status: 'success' };
+                steps[offset] = { ...steps[offset]!, status: 'running' };
+              } else if (status === 'started' || status === 'polling') {
+                steps[offset] = { ...steps[offset]!, status: 'success' };
+                steps[offset + 1] = { ...steps[offset + 1]!, status: 'running' };
+              }
+              return { ...prev, steps };
+            });
+          },
+          onStarted: info => {
+            setFlow(prev => {
+              if (prev.name !== 'running') return prev;
+              return { ...prev, recommendationId: info.recommendationId, region: info.region };
+            });
+          },
+        });
+
+        clearInterval(timer);
+        if (cancelled) return;
+
+        if (!result.success) {
+          setFlow(prev => {
+            if (prev.name !== 'running') return prev;
+            const steps = prev.steps.map(s =>
+              s.status === 'running' ? { ...s, status: 'error' as const, error: result.error } : s
+            );
+            return { ...prev, steps };
+          });
+          await new Promise(resolve => setTimeout(resolve, 2000));
+          if (cancelled) return;
+          setFlow({ name: 'error', message: result.error ?? 'Recommendation failed', logFilePath: result.logFilePath });
+          return;
+        }
+
+        // Mark polling success, saving running
+        const hasFetchStep = config.traceSource === 'sessions';
+        const offset = hasFetchStep ? 1 : 0;
+
+        setFlow(prev => {
+          if (prev.name !== 'running') return prev;
+          const steps = [...prev.steps];
+          steps[offset + 1] = { ...steps[offset + 1]!, status: 'success' };
+          steps[offset + 2] = { ...steps[offset + 2]!, status: 'running' };
+          return { ...prev, steps };
+        });
+
+        // Save results locally
+        let filePath: string | undefined;
+        try {
+          if (result.recommendationId) {
+            filePath = saveRecommendationRun(
+              result.recommendationId,
+              result,
+              config.type,
+              config.agent,
+              config.evaluators
+            );
+          }
+        } catch {
+          // Non-fatal
+        }
+
+        setFlow({ name: 'results', result, config, filePath });
+      } catch (err) {
+        clearInterval(timer);
+        if (!cancelled) {
+          const errorMsg = getErrorMessage(err);
+          setFlow(prev => {
+            if (prev.name !== 'running') return prev;
+            const steps = prev.steps.map(s =>
+              s.status === 'running' ? { ...s, status: 'error' as const, error: errorMsg } : s
+            );
+            return { ...prev, steps };
+          });
+          await new Promise(resolve => setTimeout(resolve, 2000));
+          setFlow({ name: 'error', message: errorMsg });
+        }
+      }
+    })();
+
+    return () => {
+      cancelled = true;
+      clearInterval(timer);
+    };
+  }, [flow.name]); // eslint-disable-line react-hooks/exhaustive-deps
+
+  // ── Render states ─────────────────────────────────────────────────────────
+
+  if (flow.name === 'loading') {
+    return (
+      <Screen title="Run Recommendation [preview]" onExit={onExit}>
+        <GradientText text="Loading agents and evaluators..." />
+      </Screen>
+    );
+  }
+
+  if (flow.name === 'creds-error') {
+    return <ErrorPrompt message="AWS credentials required" detail={flow.message} onBack={onExit} onExit={onExit} />;
+  }
+
+  if (flow.name === 'wizard') {
+    return (
+      <RecommendationScreen
+        agents={flow.agents}
+        evaluators={flow.evaluators}
+        configBundles={flow.configBundles}
+        onComplete={handleRunComplete}
+        onExit={onExit}
+      />
+    );
+  }
+
+  if (flow.name === 'running') {
+    const minutes = Math.floor(flow.elapsed / 60);
+    const seconds = flow.elapsed % 60;
+    const timeStr = minutes > 0 ? `${minutes}m ${seconds}s` : `${seconds}s`;
+
+    return (
+      <Screen title="Run Recommendation [preview]" onExit={onExit}>
+        <Panel>
+          <Box flexDirection="column" gap={1}>
+            <Text>
+              <Text bold>Agent:</Text> {flow.config.agent}
+              {'  '}
+              <Text bold>Evaluator(s):</Text>{' '}
+              {flow.config.evaluators.map(e => (e.includes('/') ? e.split('/').pop()! : e)).join(', ')}
+              {'  '}
+              <Text dimColor>({timeStr})</Text>
+            </Text>
+            <StepProgress steps={flow.steps} />
+          </Box>
+        </Panel>
+      </Screen>
+    );
+  }
+
+  if (flow.name === 'results') {
+    return (
+      <ResultsView
+        result={flow.result}
+        config={flow.config}
+        filePath={flow.filePath}
+        onRunAnother={() => setFlow({ name: 'loading' })}
+        onExit={onExit}
+      />
+    );
+  }
+
+  return (
+    <ErrorPrompt
+      message="Recommendation failed"
+      detail={flow.logFilePath ? `${flow.message}\n\nLog: ${flow.logFilePath}` : flow.message}
+      onBack={() => setFlow({ name: 'loading' })}
+      onExit={onExit}
+    />
+  );
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Results view
+// ─────────────────────────────────────────────────────────────────────────────
+
+interface ResultsViewProps {
+  result: RunRecommendationCommandResult;
+  config: RecommendationWizardConfig;
+  filePath?: string;
+  onRunAnother: () => void;
+  onExit: () => void;
+}
+
+function ResultsView({ result, config, filePath, onRunAnother, onExit }: ResultsViewProps) {
+  const [applyStatus, setApplyStatus] = useState<{ applied: boolean; message: string } | null>(null);
+
+  const isConfigBundle = config.inputSource === 'config-bundle' && config.bundleName;
+  const hasNewVersion =
+    !!result.result?.systemPromptRecommendationResult?.configurationBundle ||
+    !!result.result?.toolDescriptionRecommendationResult?.configurationBundle;
+  const canApply = isConfigBundle && hasNewVersion && result.region && !applyStatus;
+
+  const actions = [
+    ...(canApply ? [{ id: 'apply', title: 'Sync new bundle version to local config' }] : []),
+    { id: 'another', title: 'Run another recommendation' },
+    { id: 'back', title: 'Back' },
+  ];
+
+  const handleApply = useCallback(async () => {
+    if (!result.result || !result.region) return;
+    try {
+      const applyResult = await applyRecommendationToBundle({
+        bundleArn: config.bundleName, // TUI stores ARN in bundleName
+        result: result.result,
+        region: result.region,
+      });
+      if (applyResult.success) {
+        setApplyStatus({
+          applied: true,
+          message: `New bundle version (${applyResult.newVersionId}) created with recommended changes. Local config updated.`,
+        });
+      } else {
+        setApplyStatus({ applied: false, message: applyResult.error ?? 'Unknown error' });
+      }
+    } catch (err) {
+      setApplyStatus({ applied: false, message: getErrorMessage(err) });
+    }
+  }, [result, config]);
+
+  const nav = useListNavigation({
+    items: actions,
+    onSelect: item => {
+      if (item.id === 'apply') void handleApply();
+      else if (item.id === 'another') onRunAnother();
+      else onExit();
+    },
+    onExit,
+    isActive: true,
+  });
+
+  const sysResult = result.result?.systemPromptRecommendationResult;
+  const toolResult = result.result?.toolDescriptionRecommendationResult;
+
+  return (
+    <Screen
+      title="Recommendation Complete [preview]"
+      onExit={onExit}
+      helpText={HELP_TEXT.NAVIGATE_SELECT}
+      exitEnabled={false}
+    >
+      <Panel fullWidth>
+        <Box flexDirection="column">
+          <Text color="green">✓ Recommendation complete</Text>
+          <Text>
+            <Text bold>ID:</Text> {result.recommendationId}
+            {'  '}
+            <Text bold>Agent:</Text> {config.agent}
+          </Text>
+
+          {sysResult && (
+            <Box marginTop={1} flexDirection="column">
+              {sysResult.recommendedSystemPrompt && (
+                <Box marginTop={1} flexDirection="column">
+                  <Text bold color="cyan">
+                    Recommended System Prompt:
+                  </Text>
+                  <Box marginLeft={2} marginTop={1}>
+                    <Text>{sysResult.recommendedSystemPrompt}</Text>
+                  </Box>
+                </Box>
+              )}
+            </Box>
+          )}
+
+          {toolResult?.tools && toolResult.tools.length > 0 && (
+            <Box marginTop={1} flexDirection="column">
+              <Text bold color="cyan">
+                Recommended Tool Descriptions:
+              </Text>
+              {toolResult.tools.map(tool => (
+                <Box key={tool.toolName} marginTop={1} marginLeft={2} flexDirection="column">
+                  <Text bold>{tool.toolName}</Text>
+                  <Text>{tool.recommendedToolDescription}</Text>
+                </Box>
+              ))}
+            </Box>
+          )}
+
+          {!sysResult && !toolResult && (
+            <Box marginTop={1}>
+              <Text dimColor>No recommendation results returned.</Text>
+            </Box>
+          )}
+
+          {filePath && (
+            <Box marginTop={1}>
+              <Text dimColor>Results saved to: {filePath}</Text>
+            </Box>
+          )}
+
+          {applyStatus && (
+            <Box marginTop={1}>
+              {applyStatus.applied ? (
+                <Text color="green">✓ {applyStatus.message}</Text>
+              ) : (
+                <Text color="red">Could not sync: {applyStatus.message}</Text>
+              )}
+            </Box>
+          )}
+
+          <Box marginTop={1} flexDirection="column">
+            {actions.map((action, idx) => {
+              const selected = idx === nav.selectedIndex;
+              return (
+                <Text key={action.id}>
+                  <Text color={selected ? 'cyan' : undefined}>{selected ? '❯' : ' '} </Text>
+                  <Text color={selected ? 'cyan' : undefined} bold={selected}>
+                    {action.title}
+                  </Text>
+                </Text>
+              );
+            })}
+          </Box>
+        </Box>
+      </Panel>
+    </Screen>
+  );
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Helpers
+// ─────────────────────────────────────────────────────────────────────────────
+
+function buildAgentItems(deployedState: DeployedState): AgentItem[] {
+  const agents: AgentItem[] = [];
+  const seen = new Set<string>();
+
+  for (const target of Object.values(deployedState.targets)) {
+    const runtimeMap = target.resources?.runtimes;
+    if (!runtimeMap) continue;
+    for (const [name, state] of Object.entries(runtimeMap)) {
+      if (seen.has(name)) continue;
+      seen.add(name);
+      agents.push({ name, runtimeId: state.runtimeId, runtimeArn: state.runtimeArn });
+    }
+  }
+
+  return agents;
+}
+
+/**
+ * Recursively collect all string-valued leaf fields from an object.
+ * Returns entries with their full dot-notation path and JSONPath equivalent.
+ *
+ * The recommendation API resolves JSONPath against the components map directly,
+ * using dot notation: `$.{componentArn}.configuration.{fieldName}`
+ */
+function collectStringFields(obj: unknown, prefix: string, jsonPathPrefix: string): ConfigBundleField[] {
+  const fields: ConfigBundleField[] = [];
+  if (obj === null || obj === undefined || typeof obj !== 'object') return fields;
+
+  for (const [key, value] of Object.entries(obj as Record<string, unknown>)) {
+    const path = prefix ? `${prefix}.${key}` : key;
+    const jp = jsonPathPrefix ? `${jsonPathPrefix}.${key}` : key;
+    if (typeof value === 'string' && value.trim().length > 0) {
+      fields.push({ path, jsonPath: jp, value });
+    } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+      fields.push(...collectStringFields(value, path, jp));
+    }
+  }
+
+  return fields;
+}
+
+function buildConfigBundleItems(
+  deployedState: DeployedState,
+  projectBundles: { name: string; components?: Record<string, { configuration?: Record<string, unknown> }> }[]
+): ConfigBundleItem[] {
+  const bundles: ConfigBundleItem[] = [];
+  const seen = new Set<string>();
+
+  for (const target of Object.values(deployedState.targets)) {
+    const bundleMap = target.resources?.configBundles;
+    if (!bundleMap) continue;
+    for (const [name, state] of Object.entries(bundleMap)) {
+      if (seen.has(name)) continue;
+      seen.add(name);
+
+      const projBundle = projectBundles.find(pb => pb.name === name);
+      const fields = projBundle?.components ? collectStringFields(projBundle.components, '', '$') : [];
+
+      bundles.push({
+        name,
+        bundleId: state.bundleId,
+        bundleArn: state.bundleArn,
+        versionId: state.versionId,
+        fields,
+      });
+    }
+  }
+
+  return bundles;
+}
diff --git a/src/cli/tui/screens/recommendation/RecommendationHistoryScreen.tsx b/src/cli/tui/screens/recommendation/RecommendationHistoryScreen.tsx
new file mode 100644
index 000000000..e1ee7e9d9
--- /dev/null
+++ b/src/cli/tui/screens/recommendation/RecommendationHistoryScreen.tsx
@@ -0,0 +1,250 @@
+import type { RecommendationRunRecord } from '../../../operations/recommendation/recommendation-storage';
+import { listAllRecommendations } from '../../../operations/recommendation/recommendation-storage';
+import { Panel, Screen } from '../../components';
+import { HELP_TEXT } from '../../constants';
+import { useListNavigation } from '../../hooks';
+import { Box, Text, useInput, useStdout } from 'ink';
+import React, { useMemo, useState } from 'react';
+
+const MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+
+function formatShortDate(timestamp: string): string {
+  const d = new Date(timestamp);
+  const mon = MONTHS[d.getMonth()];
+  const day = d.getDate();
+  const h = d.getHours();
+  const m = d.getMinutes().toString().padStart(2, '0');
+  const ampm = h >= 12 ? 'PM' : 'AM';
+  const h12 = h % 12 || 12;
+  return `${mon} ${day} ${h12}:${m} ${ampm}`;
+}
+
+function shortTypeName(type: string): string {
+  if (type === 'SYSTEM_PROMPT_RECOMMENDATION') return 'System Prompt';
+  if (type === 'TOOL_DESCRIPTION_RECOMMENDATION') return 'Tool Description';
+  return type;
+}
+
+function statusColor(status: string): string {
+  if (status === 'COMPLETED' || status === 'SUCCEEDED') return 'green';
+  if (status === 'FAILED') return 'red';
+  if (status === 'IN_PROGRESS' || status === 'PENDING') return 'yellow';
+  return 'gray';
+}
+
+const CHROME_LINES = 9;
+
+// ─────────────────────────────────────────────────────────────────────────────
+// List view
+// ─────────────────────────────────────────────────────────────────────────────
+
+function RecommendationListView({
+  records,
+  onSelect,
+  onExit,
+  availableHeight,
+}: {
+  records: RecommendationRunRecord[];
+  onSelect: (record: RecommendationRunRecord) => void;
+  onExit: () => void;
+  availableHeight: number;
+}) {
+  const nav = useListNavigation({
+    items: records,
+    onSelect: item => onSelect(item),
+    onExit,
+    isActive: true,
+  });
+
+  const maxVisible = Math.max(1, availableHeight - 3);
+  const visible = useMemo(() => {
+    let start = 0;
+    if (nav.selectedIndex >= maxVisible) {
+      start = nav.selectedIndex - maxVisible + 1;
+    }
+    return { items: records.slice(start, start + maxVisible), startIdx: start };
+  }, [records, nav.selectedIndex, maxVisible]);
+
+  return (
+    <Panel fullWidth>
+      <Box flexDirection="column">
+        <Text bold>Recommendation History</Text>
+        <Text dimColor>
+          {records.length} recommendation{records.length !== 1 ? 's' : ''}
+        </Text>
+        <Box marginTop={1} flexDirection="column">
+          {visible.items.map((rec, vIdx) => {
+            const idx = visible.startIdx + vIdx;
+            const selected = idx === nav.selectedIndex;
+            const date = rec.startedAt ? formatShortDate(rec.startedAt) : 'unknown';
+
+            return (
+              <Text key={rec.recommendationId} wrap="truncate-end">
+                <Text color={selected ? 'cyan' : undefined}>{selected ? '❯' : ' '} </Text>
+                <Text dimColor>{date.padEnd(16)}</Text>
+                <Text color={statusColor(rec.status)}>{rec.status.padEnd(12)}</Text>
+                <Text>{shortTypeName(rec.type).padEnd(18)}</Text>
+                <Text dimColor>{rec.agent}</Text>
+              </Text>
+            );
+          })}
+          {visible.startIdx + maxVisible < records.length && (
+            <Text dimColor> ↓ {records.length - visible.startIdx - maxVisible} more</Text>
+          )}
+        </Box>
+      </Box>
+    </Panel>
+  );
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Detail view
+// ─────────────────────────────────────────────────────────────────────────────
+
+function RecommendationDetailView({ record, onBack }: { record: RecommendationRunRecord; onBack: () => void }) {
+  useInput((input, key) => {
+    if (key.escape || input === 'b') {
+      onBack();
+    }
+  });
+
+  const sysResult = record.result?.systemPromptRecommendationResult;
+  const toolResult = record.result?.toolDescriptionRecommendationResult;
+
+  return (
+    <Panel fullWidth>
+      <Box flexDirection="column">
+        <Text>
+          <Text bold>ID:</Text> {record.recommendationId}
+        </Text>
+        <Text>
+          <Text bold>Type:</Text> {shortTypeName(record.type)}
+          {'  '}
+          <Text bold>Agent:</Text> {record.agent}
+          {'  '}
+          <Text bold>Status:</Text> <Text color={statusColor(record.status)}>{record.status}</Text>
+        </Text>
+        <Text>
+          <Text bold>Evaluators:</Text> {record.evaluators.join(', ')}
+        </Text>
+        {record.startedAt && (
+          <Text>
+            <Text bold>Started:</Text> {new Date(record.startedAt).toLocaleString()}
+          </Text>
+        )}
+        {record.completedAt && (
+          <Text>
+            <Text bold>Completed:</Text> {new Date(record.completedAt).toLocaleString()}
+          </Text>
+        )}
+
+        {sysResult && (
+          <Box marginTop={1} flexDirection="column">
+            {sysResult.recommendedSystemPrompt && (
+              <Box marginTop={1} flexDirection="column">
+                <Text bold color="cyan">
+                  Recommended System Prompt:
+                </Text>
+                <Box marginLeft={2} marginTop={1}>
+                  <Text>{sysResult.recommendedSystemPrompt}</Text>
+                </Box>
+              </Box>
+            )}
+          </Box>
+        )}
+
+        {toolResult?.tools && toolResult.tools.length > 0 && (
+          <Box marginTop={1} flexDirection="column">
+            <Text bold color="cyan">
+              Recommended Tool Descriptions:
+            </Text>
+            {toolResult.tools.map(tool => (
+              <Box key={tool.toolName} marginTop={1} marginLeft={2} flexDirection="column">
+                <Text bold>{tool.toolName}</Text>
+                <Text>{tool.recommendedToolDescription}</Text>
+              </Box>
+            ))}
+          </Box>
+        )}
+
+        {!sysResult && !toolResult && (
+          <Box marginTop={1}>
+            <Text dimColor>No recommendation results available.</Text>
+          </Box>
+        )}
+
+        <Box marginTop={1}>
+          <Text dimColor>Press Esc or B to go back</Text>
+        </Box>
+      </Box>
+    </Panel>
+  );
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Main screen
+// ─────────────────────────────────────────────────────────────────────────────
+
+interface RecommendationHistoryScreenProps {
+  onExit: () => void;
+}
+
+export function RecommendationHistoryScreen({ onExit }: RecommendationHistoryScreenProps) {
+  const { stdout } = useStdout();
+  const terminalHeight = stdout?.rows ?? 24;
+  const availableHeight = Math.max(6, terminalHeight - CHROME_LINES);
+
+  const [selectedRecord, setSelectedRecord] = useState<RecommendationRunRecord | null>(null);
+
+  const [records, loaded, error] = useMemo(() => {
+    try {
+      return [listAllRecommendations(), true, null] as const;
+    } catch (err) {
+      return [[] as RecommendationRunRecord[], true, err instanceof Error ? err.message : String(err)] as const;
+    }
+  }, []);
+
+  if (!loaded) {
+    return (
+      <Screen title="Recommendation History [preview]" onExit={onExit}>
+        <Text dimColor>Loading...</Text>
+      </Screen>
+    );
+  }
+
+  if (error) {
+    return (
+      <Screen title="Recommendation History [preview]" onExit={onExit}>
+        <Text color="red">{error}</Text>
+      </Screen>
+    );
+  }
+
+  if (records.length === 0) {
+    return (
+      <Screen title="Recommendation History [preview]" onExit={onExit}>
+        <Box flexDirection="column">
+          <Text dimColor>No recommendation runs found.</Text>
+          <Text dimColor>Run `agentcore run recommendation` to create one.</Text>
+        </Box>
+      </Screen>
+    );
+  }
+
+  const helpText = selectedRecord ? 'Esc/B back to list' : HELP_TEXT.NAVIGATE_SELECT;
+
+  return (
+    <Screen title="Recommendation History [preview]" onExit={onExit} helpText={helpText} exitEnabled={!selectedRecord}>
+      {selectedRecord ? (
+        <RecommendationDetailView record={selectedRecord} onBack={() => setSelectedRecord(null)} />
+      ) : (
+        <RecommendationListView
+          records={records}
+          onSelect={setSelectedRecord}
+          onExit={onExit}
+          availableHeight={availableHeight}
+        />
+      )}
+    </Screen>
+  );
+}
diff --git a/src/cli/tui/screens/recommendation/RecommendationScreen.tsx b/src/cli/tui/screens/recommendation/RecommendationScreen.tsx
new file mode 100644
index 000000000..adac72ef8
--- /dev/null
+++ b/src/cli/tui/screens/recommendation/RecommendationScreen.tsx
@@ -0,0 +1,599 @@
+import { detectRegion } from '../../../aws/region';
+import type { SessionInfo } from '../../../operations/eval';
+import { discoverSessions } from '../../../operations/eval';
+import { loadDeployedProjectConfig, resolveAgent } from '../../../operations/resolve-agent';
+import type { SelectableItem } from '../../components';
+import {
+  ConfirmReview,
+  GradientText,
+  Panel,
+  PathInput,
+  Screen,
+  StepIndicator,
+  TextInput,
+  WizardMultiSelect,
+  WizardSelect,
+} from '../../components';
+import { HELP_TEXT } from '../../constants';
+import { useListNavigation, useMultiSelectNavigation } from '../../hooks';
+import type { AgentItem, ConfigBundleItem, EvaluatorItem, RecommendationWizardConfig } from './types';
+import { DEFAULT_LOOKBACK_DAYS, RECOMMENDATION_STEP_LABELS } from './types';
+import { useRecommendationWizard } from './useRecommendationWizard';
+import { Box, Text } from 'ink';
+import React, { useEffect, useMemo, useRef, useState } from 'react';
+
+interface RecommendationScreenProps {
+  agents: AgentItem[];
+  evaluators: EvaluatorItem[];
+  configBundles: ConfigBundleItem[];
+  onComplete: (config: RecommendationWizardConfig) => void;
+  onExit: () => void;
+}
+
+export function RecommendationScreen({
+  agents,
+  evaluators,
+  configBundles,
+  onComplete,
+  onExit,
+}: RecommendationScreenProps) {
+  const wizard = useRecommendationWizard();
+
+  // ── Selectable items ──────────────────────────────────────────────────────
+
+  const typeItems: SelectableItem[] = useMemo(
+    () => [
+      {
+        id: 'SYSTEM_PROMPT_RECOMMENDATION',
+        title: 'System Prompt',
+        description: "Optimize your agent's system prompt based on traces",
+      },
+      {
+        id: 'TOOL_DESCRIPTION_RECOMMENDATION',
+        title: 'Tool Description',
+        description: 'Optimize tool descriptions for better tool selection',
+      },
+    ],
+    []
+  );
+
+  const agentItems: SelectableItem[] = useMemo(
+    () =>
+      agents.map(a => ({
+        id: a.name,
+        title: a.name,
+        description: `Runtime: ${a.runtimeId}`,
+      })),
+    [agents]
+  );
+
+  const evaluatorItems: SelectableItem[] = useMemo(
+    () =>
+      evaluators.map(e => ({
+        id: e.id,
+        title: e.title,
+        description: e.description,
+      })),
+    [evaluators]
+  );
+
+  const isToolDesc = wizard.config.type === 'TOOL_DESCRIPTION_RECOMMENDATION';
+
+  const inputSourceItems: SelectableItem[] = useMemo(
+    () =>
+      isToolDesc
+        ? [
+            { id: 'inline', title: 'Enter inline', description: 'Type tool name:description pairs directly' },
+            {
+              id: 'config-bundle',
+              title: 'Config bundle',
+              description: 'Read tool descriptions from a deployed config bundle',
+            },
+          ]
+        : [
+            { id: 'inline', title: 'Enter inline', description: 'Type or paste content directly' },
+            { id: 'file', title: 'Load from file', description: 'Read content from a file path' },
+            {
+              id: 'config-bundle',
+              title: 'Config bundle',
+              description: 'Use system prompt from a deployed config bundle',
+            },
+          ],
+    [isToolDesc]
+  );
+
+  const traceSourceItems: SelectableItem[] = useMemo(
+    () => [
+      { id: 'cloudwatch', title: 'CloudWatch Logs', description: 'Discover traces from agent runtime logs' },
+      { id: 'sessions', title: 'Session IDs', description: 'Provide specific session IDs manually' },
+    ],
+    []
+  );
+
+  // ── Session discovery ──────────────────────────────────────────────────────
+
+  type SessionResult = { phase: 'loaded'; sessions: SessionInfo[] } | { phase: 'error'; message: string };
+
+  const [sessionResult, setSessionResult] = useState<SessionResult & { key: string }>();
+  const fetchingRef = useRef('');
+
+  // ── Step flags ────────────────────────────────────────────────────────────
+
+  const isTypeStep = wizard.step === 'type';
+  const isAgentStep = wizard.step === 'agent';
+  const isEvaluatorStep = wizard.step === 'evaluator';
+  const isInputSourceStep = wizard.step === 'inputSource';
+  const isContentStep = wizard.step === 'content';
+  const isBundleStep = wizard.step === 'bundle';
+  const isBundleFieldStep = wizard.step === 'bundleField';
+  const isToolsStep = wizard.step === 'tools';
+  const isTraceSourceStep = wizard.step === 'traceSource';
+  const isDaysStep = wizard.step === 'days';
+  const isSessionsStep = wizard.step === 'sessions';
+  const isConfirmStep = wizard.step === 'confirm';
+
+  const isSystemPrompt = wizard.config.type === 'SYSTEM_PROMPT_RECOMMENDATION';
+
+  // ── Session discovery effect ──────────────────────────────────────────────
+
+  const fetchKey = `${wizard.config.agent}:${wizard.config.days}`;
+  const sessionPhase = !isSessionsStep ? 'idle' : sessionResult?.key === fetchKey ? sessionResult.phase : 'loading';
+
+  useEffect(() => {
+    if (!isSessionsStep) return;
+    if (sessionResult?.key === fetchKey) return;
+    if (fetchingRef.current === fetchKey) return;
+    fetchingRef.current = fetchKey;
+    let cancelled = false;
+
+    void (async () => {
+      try {
+        const context = await loadDeployedProjectConfig();
+        const { region } = await detectRegion();
+        const agentResult = resolveAgent(context, { runtime: wizard.config.agent });
+        if (!agentResult.success) {
+          if (!cancelled) setSessionResult({ key: fetchKey, phase: 'error', message: agentResult.error });
+          return;
+        }
+
+        const sessions = await discoverSessions({
+          runtimeId: agentResult.agent.runtimeId,
+          region,
+          lookbackDays: wizard.config.days,
+        });
+
+        if (cancelled) return;
+
+        if (sessions.length === 0) {
+          setSessionResult({
+            key: fetchKey,
+            phase: 'error',
+            message: 'No sessions found in the lookback window. Try increasing the lookback days.',
+          });
+        } else {
+          setSessionResult({ key: fetchKey, phase: 'loaded', sessions });
+        }
+      } catch (err) {
+        if (!cancelled) {
+          setSessionResult({
+            key: fetchKey,
+            phase: 'error',
+            message: err instanceof Error ? err.message : 'Failed to discover sessions',
+          });
+        }
+      }
+    })();
+
+    return () => {
+      cancelled = true;
+    };
+  }, [isSessionsStep, fetchKey]); // eslint-disable-line react-hooks/exhaustive-deps
+
+  const sessionItems: SelectableItem[] = useMemo(() => {
+    const sessions = sessionResult?.phase === 'loaded' ? sessionResult.sessions : [];
+    return sessions.map(s => {
+      const date = s.firstSeen
+        ? new Date(s.firstSeen).toLocaleString([], {
+            month: 'short',
+            day: 'numeric',
+            hour: '2-digit',
+            minute: '2-digit',
+          })
+        : '';
+      const shortId = s.sessionId.length > 36 ? s.sessionId.slice(0, 36) + '…' : s.sessionId;
+      return {
+        id: s.sessionId,
+        title: shortId,
+        description: `${s.spanCount} spans · ${date}`,
+      };
+    });
+  }, [sessionResult]);
+
+  // ── Navigation hooks ──────────────────────────────────────────────────────
+
+  const typeNav = useListNavigation({
+    items: typeItems,
+    onSelect: item => wizard.setType(item.id as 'SYSTEM_PROMPT_RECOMMENDATION' | 'TOOL_DESCRIPTION_RECOMMENDATION'),
+    onExit,
+    isActive: isTypeStep,
+  });
+
+  const agentNav = useListNavigation({
+    items: agentItems,
+    onSelect: item => wizard.setAgent(item.id),
+    onExit: () => wizard.goBack(),
+    isActive: isAgentStep,
+  });
+
+  const evaluatorNav = useListNavigation({
+    items: evaluatorItems,
+    onSelect: item => wizard.setEvaluators([item.id]),
+    onExit: () => wizard.goBack(),
+    isActive: isEvaluatorStep,
+  });
+
+  const inputSourceNav = useListNavigation({
+    items: inputSourceItems,
+    onSelect: item => wizard.setInputSource(item.id as 'inline' | 'file' | 'config-bundle'),
+    onExit: () => wizard.goBack(),
+    isActive: isInputSourceStep,
+  });
+
+  const bundleItems: SelectableItem[] = useMemo(
+    () =>
+      configBundles.map(cb => ({
+        id: cb.bundleArn,
+        title: cb.name,
+        description: `Version: ${cb.versionId.slice(0, 8)}`,
+      })),
+    [configBundles]
+  );
+
+  const bundleNav = useListNavigation({
+    items: bundleItems,
+    onSelect: item => {
+      const cb = configBundles.find(b => b.bundleArn === item.id);
+      if (cb) wizard.setBundle(cb.bundleArn, cb.versionId);
+    },
+    onExit: () => wizard.goBack(),
+    isActive: isBundleStep,
+  });
+
+  // Build selectable items from recursively-discovered fields in the selected config bundle
+  const selectedBundle = useMemo(
+    () => configBundles.find(cb => cb.bundleArn === wizard.config.bundleName),
+    [configBundles, wizard.config.bundleName]
+  );
+
+  const bundleFieldItems: SelectableItem[] = useMemo(() => {
+    if (!selectedBundle) return [];
+    return selectedBundle.fields.map(field => {
+      // Shorten display: strip the long component ARN key, keep the meaningful tail.
+      // "components.arn:aws:...:runtime/name.configuration.systemPrompt" → "configuration.systemPrompt"
+      const segments = field.path.split('.');
+      const configIdx = segments.indexOf('configuration');
+      const displayPath = configIdx >= 0 ? segments.slice(configIdx).join('.') : segments.slice(-2).join('.');
+      return {
+        id: field.path,
+        title: displayPath,
+        description: field.value.length > 80 ? field.value.slice(0, 80) + '…' : field.value,
+      };
+    });
+  }, [selectedBundle]);
+
+  // Single-select for: system prompt (always), or tool desc with only 1 field (just press Enter)
+  const useFieldSingleSelect = !isToolDesc || bundleFieldItems.length <= 1;
+  const bundleFieldNav = useListNavigation({
+    items: bundleFieldItems,
+    onSelect: item => {
+      const field = selectedBundle?.fields.find(f => f.path === item.id);
+      if (!field) return;
+      wizard.setBundleFields([item.id], { systemPromptJsonPath: field.jsonPath });
+    },
+    onExit: () => wizard.goBack(),
+    isActive: isBundleFieldStep && useFieldSingleSelect,
+  });
+
+  // Tool description multi-select: only when there are 2+ fields to choose from
+  const bundleFieldMultiNav = useMultiSelectNavigation({
+    items: bundleFieldItems,
+    getId: item => item.id,
+    onConfirm: ids => {
+      const toolDescJsonPaths = ids
+        .map(id => {
+          const field = selectedBundle?.fields.find(f => f.path === id);
+          if (!field) return undefined;
+          // Use the last segment of the path as the tool name
+          const toolName = field.path.split('.').pop()!;
+          return { toolName, toolDescriptionJsonPath: field.jsonPath };
+        })
+        .filter((p): p is { toolName: string; toolDescriptionJsonPath: string } => p !== undefined);
+      wizard.setBundleFields(ids, { toolDescJsonPaths });
+    },
+    onExit: () => wizard.goBack(),
+    isActive: isBundleFieldStep && !useFieldSingleSelect,
+    requireSelection: true,
+  });
+
+  const traceSourceNav = useListNavigation({
+    items: traceSourceItems,
+    onSelect: item => wizard.setTraceSource(item.id as 'cloudwatch' | 'sessions'),
+    onExit: () => wizard.goBack(),
+    isActive: isTraceSourceStep,
+  });
+
+  // Handle Esc during session loading/error (when multi-select is not yet active)
+  useListNavigation({
+    items: [{ id: 'back', title: 'Back' }],
+    onSelect: () => wizard.goBack(),
+    onExit: () => wizard.goBack(),
+    isActive: isSessionsStep && sessionPhase !== 'loaded',
+  });
+
+  const sessionsNav = useMultiSelectNavigation({
+    items: sessionItems,
+    getId: item => item.id,
+    onConfirm: ids => wizard.setSessions(ids),
+    onExit: () => wizard.goBack(),
+    isActive: isSessionsStep && sessionPhase === 'loaded',
+    requireSelection: true,
+  });
+
+  useListNavigation({
+    items: [{ id: 'confirm', title: 'Confirm' }],
+    onSelect: () => onComplete(wizard.config),
+    onExit: () => wizard.goBack(),
+    isActive: isConfirmStep,
+  });
+
+  // ── Help text ─────────────────────────────────────────────────────────────
+
+  const helpText = isEvaluatorStep
+    ? HELP_TEXT.NAVIGATE_SELECT
+    : isSessionsStep
+      ? sessionPhase === 'loading'
+        ? ''
+        : sessionPhase === 'error'
+          ? HELP_TEXT.CONFIRM_CANCEL
+          : 'Space toggle · Enter confirm · Esc back'
+      : isBundleFieldStep && !useFieldSingleSelect
+        ? 'Space to select · Enter confirm · Esc back'
+        : isTypeStep || isAgentStep || isInputSourceStep || isTraceSourceStep || isBundleStep || isBundleFieldStep
+          ? HELP_TEXT.NAVIGATE_SELECT
+          : isConfirmStep
+            ? HELP_TEXT.CONFIRM_CANCEL
+            : HELP_TEXT.TEXT_INPUT;
+
+  const headerContent = (
+    <StepIndicator steps={wizard.steps} currentStep={wizard.step} labels={RECOMMENDATION_STEP_LABELS} />
+  );
+
+  // ── Confirm fields ────────────────────────────────────────────────────────
+
+  const confirmFields = [
+    { label: 'Type', value: isSystemPrompt ? 'System Prompt' : 'Tool Description' },
+    { label: 'Agent', value: wizard.config.agent },
+    ...(isSystemPrompt
+      ? [
+          {
+            label: 'Evaluator',
+            value:
+              wizard.config.evaluators.map(e => (e.includes('/') ? e.split('/').pop()! : e)).join(', ') || '(none)',
+          },
+        ]
+      : []),
+    {
+      label: 'Input',
+      value:
+        wizard.config.inputSource === 'file'
+          ? `File: ${wizard.config.content}`
+          : wizard.config.inputSource === 'config-bundle'
+            ? `Bundle: ${configBundles.find(b => b.bundleArn === wizard.config.bundleName)?.name ?? wizard.config.bundleName} (${wizard.config.bundleFields.length === 1 ? `field: ${wizard.config.bundleFields[0]}` : `fields: ${wizard.config.bundleFields.join(', ')}`})`
+            : 'Inline',
+    },
+    {
+      label: 'Traces',
+      value:
+        wizard.config.traceSource === 'sessions'
+          ? `${wizard.config.sessionIds.length} session${wizard.config.sessionIds.length !== 1 ? 's' : ''} selected (auto-fetch)`
+          : `CloudWatch (${wizard.config.days}d)`,
+    },
+  ];
+
+  if (!isSystemPrompt && wizard.config.inputSource !== 'config-bundle') {
+    confirmFields.push({ label: 'Tools', value: wizard.config.tools || '(none)' });
+  }
+
+  // ── Render ────────────────────────────────────────────────────────────────
+
+  return (
+    <Screen
+      title="Run Recommendation"
+      onExit={onExit}
+      helpText={helpText}
+      headerContent={headerContent}
+      exitEnabled={false}
+    >
+      <Panel>
+        {isTypeStep && (
+          <WizardSelect
+            title="What do you want to optimize?"
+            description="Choose the type of recommendation"
+            items={typeItems}
+            selectedIndex={typeNav.selectedIndex}
+          />
+        )}
+
+        {isAgentStep && (
+          <WizardSelect
+            title="Select agent"
+            description="Choose a deployed agent to analyze"
+            items={agentItems}
+            selectedIndex={agentNav.selectedIndex}
+            emptyMessage="No deployed agents found. Run `agentcore deploy` first."
+          />
+        )}
+
+        {isEvaluatorStep && (
+          <WizardSelect
+            title="Select evaluator"
+            description="System prompt optimization requires exactly one evaluator"
+            items={evaluatorItems}
+            selectedIndex={evaluatorNav.selectedIndex}
+            emptyMessage="No evaluators available."
+            maxVisibleItems={10}
+          />
+        )}
+
+        {isInputSourceStep && (
+          <WizardSelect
+            title={
+              isSystemPrompt
+                ? 'How do you want to provide the system prompt?'
+                : 'How do you want to provide tool descriptions?'
+            }
+            items={inputSourceItems}
+            selectedIndex={inputSourceNav.selectedIndex}
+          />
+        )}
+
+        {isContentStep && wizard.config.inputSource === 'inline' && (
+          <TextInput
+            key="content-inline"
+            prompt={isSystemPrompt ? 'System prompt' : 'Tool descriptions'}
+            placeholder={isSystemPrompt ? 'You are a helpful assistant...' : 'toolName:description, ...'}
+            onSubmit={wizard.setContent}
+            onCancel={() => wizard.goBack()}
+            expandable
+          />
+        )}
+
+        {isContentStep && wizard.config.inputSource === 'file' && (
+          <PathInput
+            key="content-file"
+            onSubmit={wizard.setContent}
+            onCancel={() => wizard.goBack()}
+            placeholder="/path/to/prompt.txt"
+            pathType="file"
+          />
+        )}
+
+        {isBundleStep && configBundles.length === 0 && (
+          <Box flexDirection="column">
+            <Text bold>Select config bundle</Text>
+            <Text color="yellow">
+              No deployed config bundles found. Run `agentcore add config-bundle` and `agentcore deploy` first.
+            </Text>
+            <Text dimColor>Press Esc to go back and choose a different input source.</Text>
+          </Box>
+        )}
+
+        {isBundleStep && configBundles.length > 0 && (
+          <WizardSelect
+            title="Select config bundle"
+            description={
+              isToolDesc
+                ? 'Choose a deployed config bundle to read tool descriptions from'
+                : 'Choose a deployed config bundle to read the system prompt from'
+            }
+            items={bundleItems}
+            selectedIndex={bundleNav.selectedIndex}
+            maxVisibleItems={10}
+          />
+        )}
+
+        {isBundleFieldStep && bundleFieldItems.length === 0 && (
+          <Box flexDirection="column">
+            <Text bold>Select field</Text>
+            <Text color="yellow">No text fields found in this config bundle&apos;s configuration.</Text>
+            <Text dimColor>Press Esc to go back and choose a different bundle.</Text>
+          </Box>
+        )}
+
+        {isBundleFieldStep && bundleFieldItems.length > 0 && useFieldSingleSelect && (
+          <WizardSelect
+            title={
+              isToolDesc ? 'Which field contains the tool description?' : 'Which field contains the system prompt?'
+            }
+            description="Select the field — its JSON path will be sent to the API for server-side resolution"
+            items={bundleFieldItems}
+            selectedIndex={bundleFieldNav.selectedIndex}
+            maxVisibleItems={10}
+          />
+        )}
+
+        {isBundleFieldStep && bundleFieldItems.length > 0 && !useFieldSingleSelect && (
+          <WizardMultiSelect
+            title="Which fields contain tool descriptions?"
+            description="Select fields — the last path segment becomes the tool name"
+            items={bundleFieldItems}
+            cursorIndex={bundleFieldMultiNav.cursorIndex}
+            selectedIds={bundleFieldMultiNav.selectedIds}
+          />
+        )}
+
+        {isToolsStep && (
+          <Box flexDirection="column">
+            <Text dimColor>Enter tool names and descriptions as comma-separated toolName:description pairs.</Text>
+            <TextInput
+              key="tools"
+              prompt="Tools"
+              placeholder="search:Find documents, calculator:Compute math"
+              onSubmit={wizard.setTools}
+              onCancel={() => wizard.goBack()}
+              expandable
+            />
+          </Box>
+        )}
+
+        {isTraceSourceStep && (
+          <WizardSelect
+            title="How do you want to source agent traces?"
+            items={traceSourceItems}
+            selectedIndex={traceSourceNav.selectedIndex}
+          />
+        )}
+
+        {isDaysStep && (
+          <Box flexDirection="column">
+            <Text dimColor>Note: Traces may take 5-10 min to appear after agent invocations.</Text>
+            <TextInput
+              key="days"
+              prompt="Lookback window (days)"
+              initialValue={String(DEFAULT_LOOKBACK_DAYS)}
+              onSubmit={value => {
+                const days = parseInt(value, 10);
+                if (!isNaN(days) && days >= 1 && days <= 90) {
+                  wizard.setDays(days);
+                }
+              }}
+              onCancel={() => wizard.goBack()}
+              customValidation={value => {
+                const days = parseInt(value, 10);
+                if (isNaN(days)) return 'Must be a number';
+                if (days < 1 || days > 90) return 'Must be between 1 and 90';
+                return true;
+              }}
+            />
+          </Box>
+        )}
+
+        {isSessionsStep && sessionPhase === 'loading' && <GradientText text="Discovering sessions..." />}
+
+        {isSessionsStep && sessionResult?.phase === 'error' && <Text color="red">{sessionResult.message}</Text>}
+
+        {isSessionsStep && sessionPhase === 'loaded' && (
+          <WizardMultiSelect
+            title="Select sessions to analyze"
+            description={`Found ${sessionItems.length} session${sessionItems.length !== 1 ? 's' : ''} — select one or more`}
+            items={sessionItems}
+            cursorIndex={sessionsNav.cursorIndex}
+            selectedIds={sessionsNav.selectedIds}
+          />
+        )}
+
+        {isConfirmStep && <ConfirmReview fields={confirmFields} />}
+      </Panel>
+    </Screen>
+  );
+}
diff --git a/src/cli/tui/screens/recommendation/RecommendationsHubScreen.tsx b/src/cli/tui/screens/recommendation/RecommendationsHubScreen.tsx
new file mode 100644
index 000000000..2e53e0ebd
--- /dev/null
+++ b/src/cli/tui/screens/recommendation/RecommendationsHubScreen.tsx
@@ -0,0 +1,43 @@
+import { Screen, WizardSelect } from '../../components';
+import type { SelectableItem } from '../../components';
+import { HELP_TEXT } from '../../constants';
+import { useListNavigation } from '../../hooks';
+import React, { useMemo } from 'react';
+
+export type RecommendationsHubView = 'run-recommendation' | 'recommendation-history';
+
+interface RecommendationsHubScreenProps {
+  onSelect: (view: RecommendationsHubView) => void;
+  onExit: () => void;
+}
+
+export function RecommendationsHubScreen({ onSelect, onExit }: RecommendationsHubScreenProps) {
+  const items: SelectableItem[] = useMemo(
+    () => [
+      {
+        id: 'run-recommendation',
+        title: 'Run Recommendation',
+        description: 'Optimize system prompts and tool descriptions using agent traces',
+      },
+      {
+        id: 'recommendation-history',
+        title: 'Recommendation History',
+        description: 'View past recommendation results (local)',
+      },
+    ],
+    []
+  );
+
+  const nav = useListNavigation({
+    items,
+    onSelect: item => onSelect(item.id as RecommendationsHubView),
+    onExit,
+    isActive: true,
+  });
+
+  return (
+    <Screen title="Recommendations [preview]" onExit={onExit} helpText={HELP_TEXT.NAVIGATE_SELECT} exitEnabled={false}>
+      <WizardSelect title="Choose an option" items={items} selectedIndex={nav.selectedIndex} />
+    </Screen>
+  );
+}
diff --git a/src/cli/tui/screens/recommendation/index.ts b/src/cli/tui/screens/recommendation/index.ts
new file mode 100644
index 000000000..3c2e16fe7
--- /dev/null
+++ b/src/cli/tui/screens/recommendation/index.ts
@@ -0,0 +1,3 @@
+export { RecommendationFlow } from './RecommendationFlow';
+export { RecommendationHistoryScreen } from './RecommendationHistoryScreen';
+export { RecommendationsHubScreen } from './RecommendationsHubScreen';
diff --git a/src/cli/tui/screens/recommendation/types.ts b/src/cli/tui/screens/recommendation/types.ts
new file mode 100644
index 000000000..587ea4a20
--- /dev/null
+++ b/src/cli/tui/screens/recommendation/types.ts
@@ -0,0 +1,86 @@
+import type {
+  RecommendationInputSourceKind,
+  RecommendationType,
+  TraceSourceKind,
+} from '../../../operations/recommendation';
+
+export type RecommendationStep =
+  | 'type'
+  | 'agent'
+  | 'evaluator'
+  | 'inputSource'
+  | 'content'
+  | 'bundle'
+  | 'bundleField'
+  | 'tools'
+  | 'traceSource'
+  | 'days'
+  | 'sessions'
+  | 'confirm';
+
+export interface RecommendationWizardConfig {
+  type: RecommendationType;
+  agent: string;
+  evaluators: string[];
+  inputSource: RecommendationInputSourceKind;
+  content: string;
+  tools: string;
+  traceSource: TraceSourceKind;
+  days: number;
+  sessionIds: string[];
+  bundleName: string;
+  bundleVersion: string;
+  bundleFields: string[];
+  /** JSONPath for system prompt within the config bundle (set when user picks a field) */
+  systemPromptJsonPath: string;
+  /** Tool name → JSONPath pairs for tool descriptions within the config bundle */
+  toolDescJsonPaths: { toolName: string; toolDescriptionJsonPath: string }[];
+}
+
+export const RECOMMENDATION_STEP_LABELS: Record<RecommendationStep, string> = {
+  type: 'Type',
+  agent: 'Agent',
+  evaluator: 'Evaluator',
+  inputSource: 'Source',
+  content: 'Content',
+  bundle: 'Bundle',
+  bundleField: 'Fields',
+  tools: 'Tools',
+  traceSource: 'Traces',
+  days: 'Lookback',
+  sessions: 'Sessions',
+  confirm: 'Confirm',
+};
+
+export const DEFAULT_LOOKBACK_DAYS = 7;
+
+export interface AgentItem {
+  name: string;
+  runtimeId: string;
+  runtimeArn: string;
+}
+
+export interface EvaluatorItem {
+  id: string;
+  title: string;
+  description: string;
+}
+
+/** A string field found at an arbitrary depth inside a config bundle's JSON. */
+export interface ConfigBundleField {
+  /** Dot-notation path from the bundle root, e.g. "components.myAgent.configuration.systemPrompt" */
+  path: string;
+  /** JSONPath expression for the API, e.g. "$.components.myAgent.configuration.systemPrompt" */
+  jsonPath: string;
+  /** The string value at this path */
+  value: string;
+}
+
+export interface ConfigBundleItem {
+  name: string;
+  bundleId: string;
+  bundleArn: string;
+  versionId: string;
+  /** All string-valued fields found recursively across the bundle's components. */
+  fields: ConfigBundleField[];
+}
diff --git a/src/cli/tui/screens/recommendation/useRecommendationWizard.ts b/src/cli/tui/screens/recommendation/useRecommendationWizard.ts
new file mode 100644
index 000000000..94c3c66d1
--- /dev/null
+++ b/src/cli/tui/screens/recommendation/useRecommendationWizard.ts
@@ -0,0 +1,232 @@
+import type {
+  RecommendationInputSourceKind,
+  RecommendationType,
+  TraceSourceKind,
+} from '../../../operations/recommendation';
+import type { RecommendationStep, RecommendationWizardConfig } from './types';
+import { DEFAULT_LOOKBACK_DAYS } from './types';
+import { useCallback, useState } from 'react';
+
+function getAllSteps(
+  type: RecommendationType,
+  inputSource: RecommendationInputSourceKind,
+  traceSource: TraceSourceKind
+): RecommendationStep[] {
+  const steps: RecommendationStep[] = ['type', 'agent'];
+
+  // Evaluator step only for system prompt recommendations (tool desc API does not accept evaluators)
+  if (type === 'SYSTEM_PROMPT_RECOMMENDATION') {
+    steps.push('evaluator');
+  }
+
+  // Input source selection (both types support inline and config-bundle)
+  steps.push('inputSource');
+
+  if (type === 'SYSTEM_PROMPT_RECOMMENDATION') {
+    if (inputSource === 'inline' || inputSource === 'file') {
+      steps.push('content');
+    } else if (inputSource === 'config-bundle') {
+      steps.push('bundle');
+      steps.push('bundleField');
+    }
+  } else {
+    // TOOL_DESCRIPTION_RECOMMENDATION
+    if (inputSource === 'config-bundle') {
+      steps.push('bundle');
+      steps.push('bundleField');
+    } else {
+      steps.push('tools');
+    }
+  }
+
+  steps.push('traceSource');
+
+  if (traceSource === 'sessions') {
+    // When using session IDs: ask lookback days first (for discovery), then select sessions
+    steps.push('days');
+    steps.push('sessions');
+  } else {
+    // CloudWatch: just ask lookback days
+    steps.push('days');
+  }
+
+  steps.push('confirm');
+  return steps;
+}
+
+function getDefaultConfig(): RecommendationWizardConfig {
+  return {
+    type: 'SYSTEM_PROMPT_RECOMMENDATION',
+    agent: '',
+    evaluators: [],
+    inputSource: 'inline',
+    content: '',
+    tools: '',
+    traceSource: 'cloudwatch',
+    days: DEFAULT_LOOKBACK_DAYS,
+    sessionIds: [],
+    bundleName: '',
+    bundleVersion: '',
+    bundleFields: [],
+    systemPromptJsonPath: '',
+    toolDescJsonPaths: [],
+  };
+}
+
+export function useRecommendationWizard() {
+  const [config, setConfig] = useState<RecommendationWizardConfig>(getDefaultConfig);
+  const [step, setStep] = useState<RecommendationStep>('type');
+
+  const allSteps = getAllSteps(config.type, config.inputSource, config.traceSource);
+  const currentIndex = allSteps.indexOf(step);
+
+  const advance = useCallback(
+    (
+      fromStep: RecommendationStep,
+      overrides?: {
+        type?: RecommendationType;
+        inputSource?: RecommendationInputSourceKind;
+        traceSource?: TraceSourceKind;
+      }
+    ) => {
+      const steps = getAllSteps(
+        overrides?.type ?? config.type,
+        overrides?.inputSource ?? config.inputSource,
+        overrides?.traceSource ?? config.traceSource
+      );
+      const idx = steps.indexOf(fromStep);
+      const next = steps[idx + 1];
+      if (next) setStep(next);
+    },
+    [config.type, config.inputSource, config.traceSource]
+  );
+
+  const goBack = useCallback(() => {
+    const prevStep = allSteps[currentIndex - 1];
+    if (prevStep) setStep(prevStep);
+  }, [allSteps, currentIndex]);
+
+  const setType = useCallback(
+    (type: RecommendationType) => {
+      setConfig(c => ({ ...c, type }));
+      advance('type', { type });
+    },
+    [advance]
+  );
+
+  const setAgent = useCallback(
+    (agent: string) => {
+      setConfig(c => ({ ...c, agent }));
+      advance('agent');
+    },
+    [advance]
+  );
+
+  const setEvaluators = useCallback(
+    (evaluators: string[]) => {
+      setConfig(c => ({ ...c, evaluators }));
+      advance('evaluator');
+    },
+    [advance]
+  );
+
+  const setInputSource = useCallback(
+    (inputSource: RecommendationInputSourceKind) => {
+      setConfig(c => ({ ...c, inputSource }));
+      advance('inputSource', { inputSource });
+    },
+    [advance]
+  );
+
+  const setContent = useCallback(
+    (content: string) => {
+      setConfig(c => ({ ...c, content }));
+      advance('content');
+    },
+    [advance]
+  );
+
+  const setTools = useCallback(
+    (tools: string) => {
+      setConfig(c => ({ ...c, tools }));
+      advance('tools');
+    },
+    [advance]
+  );
+
+  const setTraceSource = useCallback(
+    (traceSource: TraceSourceKind) => {
+      setConfig(c => ({ ...c, traceSource }));
+      advance('traceSource', { traceSource });
+    },
+    [advance]
+  );
+
+  const setDays = useCallback(
+    (days: number) => {
+      setConfig(c => ({ ...c, days }));
+      advance('days');
+    },
+    [advance]
+  );
+
+  const setBundle = useCallback(
+    (bundleName: string, bundleVersion: string) => {
+      setConfig(c => ({ ...c, bundleName, bundleVersion }));
+      advance('bundle');
+    },
+    [advance]
+  );
+
+  const setBundleFields = useCallback(
+    (
+      bundleFields: string[],
+      jsonPathInfo?: {
+        systemPromptJsonPath?: string;
+        toolDescJsonPaths?: { toolName: string; toolDescriptionJsonPath: string }[];
+      }
+    ) => {
+      setConfig(c => ({
+        ...c,
+        bundleFields,
+        ...(jsonPathInfo?.systemPromptJsonPath && { systemPromptJsonPath: jsonPathInfo.systemPromptJsonPath }),
+        ...(jsonPathInfo?.toolDescJsonPaths && { toolDescJsonPaths: jsonPathInfo.toolDescJsonPaths }),
+      }));
+      advance('bundleField');
+    },
+    [advance]
+  );
+
+  const setSessions = useCallback(
+    (sessionIds: string[]) => {
+      setConfig(c => ({ ...c, sessionIds }));
+      advance('sessions');
+    },
+    [advance]
+  );
+
+  const reset = useCallback(() => {
+    setConfig(getDefaultConfig());
+    setStep('type');
+  }, []);
+
+  return {
+    config,
+    step,
+    steps: allSteps,
+    currentIndex,
+    goBack,
+    setType,
+    setAgent,
+    setEvaluators,
+    setInputSource,
+    setContent,
+    setBundle,
+    setBundleFields,
+    setTools,
+    setTraceSource,
+    setDays,
+    setSessions,
+    reset,
+  };
+}
diff --git a/src/cli/tui/screens/remove/RemoveConfigBundleScreen.tsx b/src/cli/tui/screens/remove/RemoveConfigBundleScreen.tsx
new file mode 100644
index 000000000..90299eb30
--- /dev/null
+++ b/src/cli/tui/screens/remove/RemoveConfigBundleScreen.tsx
@@ -0,0 +1,26 @@
+import type { RemovableConfigBundle } from '../../../primitives/ConfigBundlePrimitive';
+import { SelectScreen } from '../../components';
+import React from 'react';
+
+interface RemoveConfigBundleScreenProps {
+  configBundles: RemovableConfigBundle[];
+  onSelect: (bundleName: string) => void;
+  onExit: () => void;
+}
+
+export function RemoveConfigBundleScreen({ configBundles, onSelect, onExit }: RemoveConfigBundleScreenProps) {
+  const items = configBundles.map(bundle => ({
+    id: bundle.name,
+    title: bundle.name,
+    description: 'Configuration Bundle',
+  }));
+
+  return (
+    <SelectScreen
+      title="Select Configuration Bundle to Remove"
+      items={items}
+      onSelect={item => onSelect(item.id)}
+      onExit={onExit}
+    />
+  );
+}
diff --git a/src/cli/tui/screens/remove/RemoveFlow.tsx b/src/cli/tui/screens/remove/RemoveFlow.tsx
index c8a9e77b3..6ad51fb47 100644
--- a/src/cli/tui/screens/remove/RemoveFlow.tsx
+++ b/src/cli/tui/screens/remove/RemoveFlow.tsx
@@ -1,10 +1,13 @@
 import type { RemovableGatewayTarget, RemovalPreview } from '../../../operations/remove';
 import { ErrorPrompt, Panel, Screen } from '../../components';
 import {
+  useRemovableABTests,
   useRemovableAgents,
+  useRemovableConfigBundles,
   useRemovableEvaluators,
   useRemovableGatewayTargets,
   useRemovableGateways,
+  useRemovableHarnesses,
   useRemovableIdentities,
   useRemovableMemories,
   useRemovableOnlineEvalConfigs,
@@ -12,10 +15,13 @@ import {
   useRemovablePolicyEngines,
   useRemovableRuntimeEndpoints,
   useRemovalPreview,
+  useRemoveABTest,
   useRemoveAgent,
+  useRemoveConfigBundle,
   useRemoveEvaluator,
   useRemoveGateway,
   useRemoveGatewayTarget,
+  useRemoveHarness,
   useRemoveIdentity,
   useRemoveMemory,
   useRemoveOnlineEvalConfig,
@@ -23,8 +29,10 @@ import {
   useRemovePolicyEngine,
   useRemoveRuntimeEndpoint,
 } from '../../hooks/useRemove';
+import { RemoveABTestScreen } from '../ab-test/RemoveABTestScreen';
 import { RemoveAgentScreen } from './RemoveAgentScreen';
 import { RemoveAllScreen } from './RemoveAllScreen';
+import { RemoveConfigBundleScreen } from './RemoveConfigBundleScreen';
 import { RemoveConfirmScreen } from './RemoveConfirmScreen';
 import { RemoveEvaluatorScreen } from './RemoveEvaluatorScreen';
 import { RemoveGatewayScreen } from './RemoveGatewayScreen';
@@ -53,6 +61,10 @@ type FlowState =
   | { name: 'select-online-eval' }
   | { name: 'select-policy-engine' }
   | { name: 'select-policy' }
+  | { name: 'select-harness' }
+  | { name: 'confirm-harness'; harnessName: string; preview: RemovalPreview }
+  | { name: 'select-config-bundle' }
+  | { name: 'select-ab-test' }
   | { name: 'select-runtime-endpoint' }
   | { name: 'confirm-agent'; agentName: string; preview: RemovalPreview }
   | { name: 'confirm-gateway'; gatewayName: string; preview: RemovalPreview }
@@ -63,8 +75,11 @@ type FlowState =
   | { name: 'confirm-online-eval'; configName: string; preview: RemovalPreview }
   | { name: 'confirm-policy-engine'; engineName: string; preview: RemovalPreview }
   | { name: 'confirm-policy'; compositeKey: string; policyName: string; preview: RemovalPreview }
+  | { name: 'confirm-config-bundle'; bundleName: string; preview: RemovalPreview }
+  | { name: 'confirm-ab-test'; testName: string; preview: RemovalPreview }
   | { name: 'confirm-runtime-endpoint'; endpointName: string; preview: RemovalPreview }
   | { name: 'loading'; message: string }
+  | { name: 'harness-success'; harnessName: string; logFilePath?: string }
   | { name: 'agent-success'; agentName: string; logFilePath?: string }
   | { name: 'gateway-success'; gatewayName: string; logFilePath?: string }
   | { name: 'tool-success'; toolName: string; logFilePath?: string }
@@ -74,6 +89,8 @@ type FlowState =
   | { name: 'online-eval-success'; configName: string; logFilePath?: string }
   | { name: 'policy-engine-success'; engineName: string; logFilePath?: string }
   | { name: 'policy-success'; policyName: string; logFilePath?: string }
+  | { name: 'config-bundle-success'; bundleName: string; logFilePath?: string }
+  | { name: 'ab-test-success'; testName: string; logFilePath?: string }
   | { name: 'runtime-endpoint-success'; endpointName: string; logFilePath?: string }
   | { name: 'remove-all' }
   | { name: 'error'; message: string };
@@ -89,6 +106,7 @@ interface RemoveFlowProps {
   /** Initial resource type to start at (for CLI subcommands) */
   initialResourceType?:
     | 'agent'
+    | 'harness'
     | 'gateway'
     | 'gateway-target'
     | 'runtime-endpoint'
@@ -97,7 +115,9 @@ interface RemoveFlowProps {
     | 'evaluator'
     | 'online-eval'
     | 'policy-engine'
-    | 'policy';
+    | 'policy'
+    | 'config-bundle'
+    | 'ab-test';
   /** Initial resource name to auto-select (for CLI --name flag) */
   initialResourceName?: string;
 }
@@ -129,8 +149,14 @@ export function RemoveFlow({
         return { name: 'select-online-eval' };
       case 'policy-engine':
         return { name: 'select-policy-engine' };
+      case 'harness':
+        return { name: 'select-harness' };
       case 'policy':
         return { name: 'select-policy' };
+      case 'config-bundle':
+        return { name: 'select-config-bundle' };
+      case 'ab-test':
+        return { name: 'select-ab-test' };
       case 'runtime-endpoint':
         return { name: 'select-runtime-endpoint' };
       default:
@@ -141,6 +167,7 @@ export function RemoveFlow({
 
   // Data hooks - need isLoading to avoid showing screen before data loads
   const { agents, isLoading: isLoadingAgents, refresh: refreshAgents } = useRemovableAgents();
+  const { harnesses, isLoading: isLoadingHarnesses, refresh: refreshHarnesses } = useRemovableHarnesses();
   const { gateways, isLoading: isLoadingGateways, refresh: refreshGateways } = useRemovableGateways();
   const { tools: mcpTools, isLoading: isLoadingTools, refresh: refreshTools } = useRemovableGatewayTargets();
   const { memories, isLoading: isLoadingMemories, refresh: refreshMemories } = useRemovableMemories();
@@ -157,6 +184,12 @@ export function RemoveFlow({
     refresh: refreshPolicyEngines,
   } = useRemovablePolicyEngines();
   const { policies, isLoading: isLoadingPolicies, refresh: refreshPolicies } = useRemovablePolicies();
+  const {
+    configBundles,
+    isLoading: isLoadingConfigBundles,
+    refresh: refreshConfigBundles,
+  } = useRemovableConfigBundles();
+  const { abTests } = useRemovableABTests();
   const {
     endpoints: runtimeEndpoints,
     isLoading: isLoadingRuntimeEndpoints,
@@ -166,6 +199,7 @@ export function RemoveFlow({
   // Check if any data is still loading
   const isLoading =
     isLoadingAgents ||
+    isLoadingHarnesses ||
     isLoadingGateways ||
     isLoadingTools ||
     isLoadingMemories ||
@@ -174,11 +208,13 @@ export function RemoveFlow({
     isLoadingOnlineEvals ||
     isLoadingPolicyEngines ||
     isLoadingPolicies ||
+    isLoadingConfigBundles ||
     isLoadingRuntimeEndpoints;
 
   // Preview hook
   const {
     loadAgentPreview,
+    loadHarnessPreview,
     loadGatewayPreview,
     loadGatewayTargetPreview,
     loadMemoryPreview,
@@ -187,12 +223,15 @@ export function RemoveFlow({
     loadOnlineEvalPreview,
     loadPolicyEnginePreview,
     loadPolicyPreview,
+    loadConfigBundlePreview,
+    loadABTestPreview,
     loadRuntimeEndpointPreview,
     reset: resetPreview,
   } = useRemovalPreview();
 
   // Removal hooks
   const { remove: removeAgentOp, reset: resetRemoveAgent } = useRemoveAgent();
+  const { remove: removeHarnessOp, reset: resetRemoveHarness } = useRemoveHarness();
   const { remove: removeGatewayOp, reset: resetRemoveGateway } = useRemoveGateway();
   const { remove: removeGatewayTargetOp, reset: resetRemoveGatewayTarget } = useRemoveGatewayTarget();
   const { remove: removeMemoryOp, reset: resetRemoveMemory } = useRemoveMemory();
@@ -201,6 +240,8 @@ export function RemoveFlow({
   const { remove: removeOnlineEvalOp, reset: resetRemoveOnlineEval } = useRemoveOnlineEvalConfig();
   const { remove: removePolicyEngineOp, reset: resetRemovePolicyEngine } = useRemovePolicyEngine();
   const { remove: removePolicyOp, reset: resetRemovePolicy } = useRemovePolicy();
+  const { remove: removeConfigBundleOp, reset: resetRemoveConfigBundle } = useRemoveConfigBundle();
+  const { remove: removeABTestOp, reset: resetRemoveABTest } = useRemoveABTest();
   const { remove: removeRuntimeEndpointOp, reset: resetRemoveRuntimeEndpoint } = useRemoveRuntimeEndpoint();
 
   // Track pending result state
@@ -224,6 +265,7 @@ export function RemoveFlow({
     if (!isInteractive) {
       const successStates = [
         'agent-success',
+        'harness-success',
         'gateway-success',
         'tool-success',
         'memory-success',
@@ -232,6 +274,8 @@ export function RemoveFlow({
         'online-eval-success',
         'policy-engine-success',
         'policy-success',
+        'config-bundle-success',
+        'ab-test-success',
         'runtime-endpoint-success',
       ];
       if (successStates.includes(flow.name)) {
@@ -248,6 +292,9 @@ export function RemoveFlow({
       case 'agent':
         setFlow({ name: 'select-agent' });
         break;
+      case 'harness':
+        setFlow({ name: 'select-harness' });
+        break;
       case 'gateway':
         setFlow({ name: 'select-gateway' });
         break;
@@ -272,6 +319,12 @@ export function RemoveFlow({
       case 'policy':
         setFlow({ name: 'select-policy' });
         break;
+      case 'config-bundle':
+        setFlow({ name: 'select-config-bundle' });
+        break;
+      case 'ab-test':
+        setFlow({ name: 'select-ab-test' });
+        break;
       case 'runtime-endpoint':
         setFlow({ name: 'select-runtime-endpoint' });
         break;
@@ -306,6 +359,28 @@ export function RemoveFlow({
     [loadAgentPreview, force, removeAgentOp]
   );
 
+  const handleSelectHarness = useCallback(
+    async (harnessName: string) => {
+      const result = await loadHarnessPreview(harnessName);
+      if (result.ok) {
+        if (force) {
+          setFlow({ name: 'loading', message: `Removing harness ${harnessName}...` });
+          const removeResult = await removeHarnessOp(harnessName, result.preview);
+          if (removeResult.success) {
+            setFlow({ name: 'harness-success', harnessName });
+          } else {
+            setFlow({ name: 'error', message: removeResult.error });
+          }
+        } else {
+          setFlow({ name: 'confirm-harness', harnessName, preview: result.preview });
+        }
+      } else {
+        setFlow({ name: 'error', message: result.error });
+      }
+    },
+    [loadHarnessPreview, force, removeHarnessOp]
+  );
+
   const handleSelectGateway = useCallback(
     async (gatewayName: string) => {
       const result = await loadGatewayPreview(gatewayName);
@@ -485,6 +560,50 @@ export function RemoveFlow({
     [loadPolicyPreview, force, removePolicyOp]
   );
 
+  const handleSelectConfigBundle = useCallback(
+    async (bundleName: string) => {
+      const result = await loadConfigBundlePreview(bundleName);
+      if (result.ok) {
+        if (force) {
+          setFlow({ name: 'loading', message: `Removing configuration bundle ${bundleName}...` });
+          const removeResult = await removeConfigBundleOp(bundleName, result.preview);
+          if (removeResult.success) {
+            setFlow({ name: 'config-bundle-success', bundleName });
+          } else {
+            setFlow({ name: 'error', message: removeResult.error });
+          }
+        } else {
+          setFlow({ name: 'confirm-config-bundle', bundleName, preview: result.preview });
+        }
+      } else {
+        setFlow({ name: 'error', message: result.error });
+      }
+    },
+    [loadConfigBundlePreview, force, removeConfigBundleOp]
+  );
+
+  const handleSelectABTest = useCallback(
+    async (testName: string) => {
+      const result = await loadABTestPreview(testName);
+      if (result.ok) {
+        if (force) {
+          setFlow({ name: 'loading', message: `Removing AB test ${testName}...` });
+          const removeResult = await removeABTestOp(testName, result.preview);
+          if (removeResult.success) {
+            setFlow({ name: 'ab-test-success', testName });
+          } else {
+            setFlow({ name: 'error', message: removeResult.error });
+          }
+        } else {
+          setFlow({ name: 'confirm-ab-test', testName, preview: result.preview });
+        }
+      } else {
+        setFlow({ name: 'error', message: result.error });
+      }
+    },
+    [loadABTestPreview, force, removeABTestOp]
+  );
+
   const handleSelectRuntimeEndpoint = useCallback(
     async (endpointName: string) => {
       const result = await loadRuntimeEndpointPreview(endpointName);
@@ -543,6 +662,12 @@ export function RemoveFlow({
         case 'policy':
           void handleSelectPolicy(initialResourceName);
           break;
+        case 'config-bundle':
+          void handleSelectConfigBundle(initialResourceName);
+          break;
+        case 'ab-test':
+          void handleSelectABTest(initialResourceName);
+          break;
         case 'runtime-endpoint':
           void handleSelectRuntimeEndpoint(initialResourceName);
           break;
@@ -560,6 +685,8 @@ export function RemoveFlow({
     handleSelectOnlineEval,
     handleSelectPolicyEngine,
     handleSelectPolicy,
+    handleSelectConfigBundle,
+    handleSelectABTest,
     handleSelectRuntimeEndpoint,
   ]);
 
@@ -580,6 +707,22 @@ export function RemoveFlow({
     [removeAgentOp]
   );
 
+  const handleConfirmHarness = useCallback(
+    async (harnessName: string, preview: RemovalPreview) => {
+      pendingResultRef.current = null;
+      setResultReady(false);
+      setFlow({ name: 'loading', message: `Removing harness ${harnessName}...` });
+      const result = await removeHarnessOp(harnessName, preview);
+      if (result.success) {
+        pendingResultRef.current = { name: 'harness-success', harnessName, logFilePath: result.logFilePath };
+      } else {
+        pendingResultRef.current = { name: 'error', message: result.error };
+      }
+      setResultReady(true);
+    },
+    [removeHarnessOp]
+  );
+
   const handleConfirmGateway = useCallback(
     async (gatewayName: string, preview: RemovalPreview) => {
       pendingResultRef.current = null;
@@ -708,6 +851,38 @@ export function RemoveFlow({
     [removePolicyOp]
   );
 
+  const handleConfirmConfigBundle = useCallback(
+    async (bundleName: string, preview: RemovalPreview) => {
+      pendingResultRef.current = null;
+      setResultReady(false);
+      setFlow({ name: 'loading', message: `Removing configuration bundle ${bundleName}...` });
+      const result = await removeConfigBundleOp(bundleName, preview);
+      if (result.success) {
+        pendingResultRef.current = { name: 'config-bundle-success', bundleName, logFilePath: result.logFilePath };
+      } else {
+        pendingResultRef.current = { name: 'error', message: result.error };
+      }
+      setResultReady(true);
+    },
+    [removeConfigBundleOp]
+  );
+
+  const handleConfirmABTest = useCallback(
+    async (testName: string, preview: RemovalPreview) => {
+      pendingResultRef.current = null;
+      setResultReady(false);
+      setFlow({ name: 'loading', message: `Removing AB test ${testName}...` });
+      const result = await removeABTestOp(testName, preview);
+      if (result.success) {
+        pendingResultRef.current = { name: 'ab-test-success', testName, logFilePath: result.logFilePath };
+      } else {
+        pendingResultRef.current = { name: 'error', message: result.error };
+      }
+      setResultReady(true);
+    },
+    [removeABTestOp]
+  );
+
   const handleConfirmRuntimeEndpoint = useCallback(
     async (endpointName: string, preview: RemovalPreview) => {
       pendingResultRef.current = null;
@@ -727,6 +902,7 @@ export function RemoveFlow({
   const resetAll = useCallback(() => {
     resetPreview();
     resetRemoveAgent();
+    resetRemoveHarness();
     resetRemoveGateway();
     resetRemoveGatewayTarget();
     resetRemoveMemory();
@@ -735,10 +911,13 @@ export function RemoveFlow({
     resetRemoveOnlineEval();
     resetRemovePolicyEngine();
     resetRemovePolicy();
+    resetRemoveConfigBundle();
+    resetRemoveABTest();
     resetRemoveRuntimeEndpoint();
   }, [
     resetPreview,
     resetRemoveAgent,
+    resetRemoveHarness,
     resetRemoveGateway,
     resetRemoveGatewayTarget,
     resetRemoveMemory,
@@ -747,12 +926,15 @@ export function RemoveFlow({
     resetRemoveOnlineEval,
     resetRemovePolicyEngine,
     resetRemovePolicy,
+    resetRemoveConfigBundle,
+    resetRemoveABTest,
     resetRemoveRuntimeEndpoint,
   ]);
 
   const refreshAll = useCallback(async () => {
     await Promise.all([
       refreshAgents(),
+      refreshHarnesses(),
       refreshGateways(),
       refreshTools(),
       refreshMemories(),
@@ -761,10 +943,12 @@ export function RemoveFlow({
       refreshOnlineEvals(),
       refreshPolicyEngines(),
       refreshPolicies(),
+      refreshConfigBundles(),
       refreshRuntimeEndpoints(),
     ]);
   }, [
     refreshAgents,
+    refreshHarnesses,
     refreshGateways,
     refreshTools,
     refreshMemories,
@@ -773,6 +957,7 @@ export function RemoveFlow({
     refreshOnlineEvals,
     refreshPolicyEngines,
     refreshPolicies,
+    refreshConfigBundles,
     refreshRuntimeEndpoints,
   ]);
 
@@ -786,6 +971,7 @@ export function RemoveFlow({
         onSelect={handleSelectResource}
         onExit={onExit}
         agentCount={agents.length}
+        harnessCount={harnesses.length}
         gatewayCount={gateways.length}
         mcpToolCount={mcpTools.length}
         memoryCount={memories.length}
@@ -794,6 +980,8 @@ export function RemoveFlow({
         onlineEvalCount={onlineEvalConfigs.length}
         policyEngineCount={policyEngines.length}
         policyCount={policies.length}
+        configBundleCount={configBundles.length}
+        abTestCount={abTests.length}
         runtimeEndpointCount={runtimeEndpoints.length}
       />
     );
@@ -828,6 +1016,19 @@ export function RemoveFlow({
     );
   }
 
+  if (flow.name === 'select-harness') {
+    if (initialResourceName && isLoading) {
+      return null;
+    }
+    return (
+      <RemoveAgentScreen
+        agents={harnesses}
+        onSelect={(name: string) => void handleSelectHarness(name)}
+        onExit={() => setFlow({ name: 'select' })}
+      />
+    );
+  }
+
   if (flow.name === 'select-gateway') {
     if (initialResourceName && isLoading) {
       return null;
@@ -929,6 +1130,32 @@ export function RemoveFlow({
     );
   }
 
+  if (flow.name === 'select-config-bundle') {
+    if (initialResourceName && isLoading) {
+      return null;
+    }
+    return (
+      <RemoveConfigBundleScreen
+        configBundles={configBundles}
+        onSelect={(name: string) => void handleSelectConfigBundle(name)}
+        onExit={() => setFlow({ name: 'select' })}
+      />
+    );
+  }
+
+  if (flow.name === 'select-ab-test') {
+    if (initialResourceName && isLoading) {
+      return null;
+    }
+    return (
+      <RemoveABTestScreen
+        abTests={abTests}
+        onSelect={(name: string) => void handleSelectABTest(name)}
+        onExit={() => setFlow({ name: 'select' })}
+      />
+    );
+  }
+
   if (flow.name === 'select-runtime-endpoint') {
     if (initialResourceName && isLoading) {
       return null;
@@ -954,6 +1181,17 @@ export function RemoveFlow({
     );
   }
 
+  if (flow.name === 'confirm-harness') {
+    return (
+      <RemoveConfirmScreen
+        title={`Remove Harness: ${flow.harnessName}`}
+        preview={flow.preview}
+        onConfirm={() => void handleConfirmHarness(flow.harnessName, flow.preview)}
+        onCancel={() => setFlow({ name: 'select-harness' })}
+      />
+    );
+  }
+
   if (flow.name === 'confirm-gateway') {
     return (
       <RemoveConfirmScreen
@@ -1042,6 +1280,28 @@ export function RemoveFlow({
     );
   }
 
+  if (flow.name === 'confirm-config-bundle') {
+    return (
+      <RemoveConfirmScreen
+        title={`Remove Configuration Bundle: ${flow.bundleName}`}
+        preview={flow.preview}
+        onConfirm={() => void handleConfirmConfigBundle(flow.bundleName, flow.preview)}
+        onCancel={() => setFlow({ name: 'select-config-bundle' })}
+      />
+    );
+  }
+
+  if (flow.name === 'confirm-ab-test') {
+    return (
+      <RemoveConfirmScreen
+        title={`Remove AB Test: ${flow.testName}`}
+        preview={flow.preview}
+        onConfirm={() => void handleConfirmABTest(flow.testName, flow.preview)}
+        onCancel={() => setFlow({ name: 'select-ab-test' })}
+      />
+    );
+  }
+
   if (flow.name === 'confirm-runtime-endpoint') {
     return (
       <RemoveConfirmScreen
@@ -1070,6 +1330,22 @@ export function RemoveFlow({
     );
   }
 
+  if (flow.name === 'harness-success') {
+    return (
+      <RemoveSuccessScreen
+        isInteractive={isInteractive}
+        message={`Removed harness: ${flow.harnessName}`}
+        detail="Harness removed from agentcore.json. Deploy with `agentcore deploy` to apply changes."
+        logFilePath={flow.logFilePath}
+        onRemoveAnother={() => {
+          resetAll();
+          void refreshAll().then(() => setFlow({ name: 'select' }));
+        }}
+        onExit={onExit}
+      />
+    );
+  }
+
   if (flow.name === 'gateway-success') {
     return (
       <RemoveSuccessScreen
@@ -1198,6 +1474,38 @@ export function RemoveFlow({
     );
   }
 
+  if (flow.name === 'config-bundle-success') {
+    return (
+      <RemoveSuccessScreen
+        isInteractive={isInteractive}
+        message={`Removed configuration bundle: ${flow.bundleName}`}
+        detail="Configuration bundle removed from agentcore.json. Deploy with `agentcore deploy` to apply changes."
+        logFilePath={flow.logFilePath}
+        onRemoveAnother={() => {
+          resetAll();
+          void refreshAll().then(() => setFlow({ name: 'select' }));
+        }}
+        onExit={onExit}
+      />
+    );
+  }
+
+  if (flow.name === 'ab-test-success') {
+    return (
+      <RemoveSuccessScreen
+        isInteractive={isInteractive}
+        message={`Removed AB test: ${flow.testName}`}
+        detail="AB test removed from agentcore.json. Deploy with `agentcore deploy` to apply changes."
+        logFilePath={flow.logFilePath}
+        onRemoveAnother={() => {
+          resetAll();
+          void refreshAll().then(() => setFlow({ name: 'select' }));
+        }}
+        onExit={onExit}
+      />
+    );
+  }
+
   if (flow.name === 'runtime-endpoint-success') {
     return (
       <RemoveSuccessScreen
@@ -1223,7 +1531,7 @@ export function RemoveFlow({
   return (
     <ErrorPrompt
       message="Failed to remove resource"
-      detail={flow.message}
+      detail={'message' in flow ? flow.message : 'Unknown error'}
       onBack={() => {
         resetAll();
         setFlow({ name: 'select' });
diff --git a/src/cli/tui/screens/remove/RemoveScreen.tsx b/src/cli/tui/screens/remove/RemoveScreen.tsx
index 83488ed3a..d14786985 100644
--- a/src/cli/tui/screens/remove/RemoveScreen.tsx
+++ b/src/cli/tui/screens/remove/RemoveScreen.tsx
@@ -4,6 +4,7 @@ import { useMemo } from 'react';
 
 const REMOVE_RESOURCES = [
   { id: 'agent', title: 'Agent', description: 'Remove an agent from the project' },
+  { id: 'harness', title: 'Harness', description: 'Remove a harness from the project' },
   { id: 'memory', title: 'Memory', description: 'Remove a memory provider' },
   { id: 'credential', title: 'Credential', description: 'Remove a credential' },
   { id: 'evaluator', title: 'Evaluator', description: 'Remove a custom evaluator' },
@@ -12,6 +13,8 @@ const REMOVE_RESOURCES = [
   { id: 'policy', title: 'Policy', description: 'Remove a policy from a policy engine' },
   { id: 'gateway', title: 'Gateway', description: 'Remove a gateway' },
   { id: 'gateway-target', title: 'Gateway Target', description: 'Remove a gateway target' },
+  { id: 'config-bundle', title: 'Configuration Bundle [preview]', description: 'Remove a configuration bundle' },
+  { id: 'ab-test', title: 'AB Test [preview]', description: 'Remove an A/B test' },
   { id: 'runtime-endpoint', title: 'Runtime Endpoint', description: 'Remove a runtime endpoint' },
   { id: 'all', title: 'All', description: 'Reset entire agentcore project' },
 ] as const;
@@ -23,6 +26,8 @@ interface RemoveScreenProps {
   onExit: () => void;
   /** Number of agents available for removal */
   agentCount: number;
+  /** Number of harnesses available for removal */
+  harnessCount: number;
   /** Number of gateways available for removal */
   gatewayCount: number;
   /** Number of gateway targets available for removal */
@@ -39,6 +44,10 @@ interface RemoveScreenProps {
   policyEngineCount: number;
   /** Number of policies available for removal */
   policyCount: number;
+  /** Number of configuration bundles available for removal */
+  configBundleCount: number;
+  /** Number of AB tests available for removal */
+  abTestCount: number;
   /** Number of runtime endpoints available for removal */
   runtimeEndpointCount: number;
 }
@@ -47,6 +56,7 @@ export function RemoveScreen({
   onSelect,
   onExit,
   agentCount,
+  harnessCount,
   gatewayCount,
   mcpToolCount,
   memoryCount,
@@ -55,6 +65,8 @@ export function RemoveScreen({
   onlineEvalCount,
   policyEngineCount,
   policyCount,
+  configBundleCount,
+  abTestCount,
   runtimeEndpointCount,
 }: RemoveScreenProps) {
   const items: SelectableItem[] = useMemo(() => {
@@ -69,6 +81,12 @@ export function RemoveScreen({
             description = 'No agents to remove';
           }
           break;
+        case 'harness':
+          if (harnessCount === 0) {
+            disabled = true;
+            description = 'No harnesses to remove';
+          }
+          break;
         case 'gateway':
           if (gatewayCount === 0) {
             disabled = true;
@@ -117,6 +135,18 @@ export function RemoveScreen({
             description = 'No policies to remove';
           }
           break;
+        case 'config-bundle':
+          if (configBundleCount === 0) {
+            disabled = true;
+            description = 'No configuration bundles to remove';
+          }
+          break;
+        case 'ab-test':
+          if (abTestCount === 0) {
+            disabled = true;
+            description = 'No AB tests to remove';
+          }
+          break;
         case 'runtime-endpoint':
           if (runtimeEndpointCount === 0) {
             disabled = true;
@@ -132,6 +162,7 @@ export function RemoveScreen({
     });
   }, [
     agentCount,
+    harnessCount,
     gatewayCount,
     mcpToolCount,
     memoryCount,
@@ -140,6 +171,8 @@ export function RemoveScreen({
     onlineEvalCount,
     policyEngineCount,
     policyCount,
+    configBundleCount,
+    abTestCount,
     runtimeEndpointCount,
   ]);
 
diff --git a/src/cli/tui/screens/remove/__tests__/RemoveScreen.test.tsx b/src/cli/tui/screens/remove/__tests__/RemoveScreen.test.tsx
index 16e0223e3..9f148fa68 100644
--- a/src/cli/tui/screens/remove/__tests__/RemoveScreen.test.tsx
+++ b/src/cli/tui/screens/remove/__tests__/RemoveScreen.test.tsx
@@ -13,6 +13,9 @@ describe('RemoveScreen', () => {
         onSelect={onSelect}
         onExit={onExit}
         agentCount={1}
+        configBundleCount={0}
+        abTestCount={0}
+        harnessCount={1}
         gatewayCount={1}
         mcpToolCount={1}
         memoryCount={1}
@@ -44,6 +47,9 @@ describe('RemoveScreen', () => {
         onSelect={onSelect}
         onExit={onExit}
         agentCount={0}
+        configBundleCount={0}
+        abTestCount={0}
+        harnessCount={0}
         gatewayCount={0}
         mcpToolCount={0}
         memoryCount={0}
diff --git a/src/cli/tui/screens/run-eval/BatchEvalHistoryScreen.tsx b/src/cli/tui/screens/run-eval/BatchEvalHistoryScreen.tsx
new file mode 100644
index 000000000..a1903f7d0
--- /dev/null
+++ b/src/cli/tui/screens/run-eval/BatchEvalHistoryScreen.tsx
@@ -0,0 +1,307 @@
+import type { BatchEvalRunRecord } from '../../../operations/eval/batch-eval-storage';
+import { listBatchEvalRuns } from '../../../operations/eval/batch-eval-storage';
+import { Panel, Screen } from '../../components';
+import { HELP_TEXT } from '../../constants';
+import { useListNavigation } from '../../hooks';
+import { Box, Text, useInput, useStdout } from 'ink';
+import React, { useMemo, useState } from 'react';
+
+const MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+
+function formatShortDate(timestamp: string): string {
+  const d = new Date(timestamp);
+  const mon = MONTHS[d.getMonth()];
+  const day = d.getDate();
+  const h = d.getHours();
+  const m = d.getMinutes().toString().padStart(2, '0');
+  const ampm = h >= 12 ? 'PM' : 'AM';
+  const h12 = h % 12 || 12;
+  return `${mon} ${day} ${h12}:${m} ${ampm}`;
+}
+
+function statusColor(status: string): string {
+  if (status === 'COMPLETED' || status === 'SUCCEEDED') return 'green';
+  if (status === 'FAILED') return 'red';
+  if (status === 'IN_PROGRESS' || status === 'PENDING') return 'yellow';
+  return 'gray';
+}
+
+function scoreColor(score: number): string {
+  if (score >= 0.8) return 'green';
+  if (score >= 0.5) return 'yellow';
+  return 'red';
+}
+
+const CHROME_LINES = 9;
+
+// ─────────────────────────────────────────────────────────────────────────────
+// List view
+// ─────────────────────────────────────────────────────────────────────────────
+
+function BatchEvalListView({
+  records,
+  onSelect,
+  onExit,
+  availableHeight,
+}: {
+  records: BatchEvalRunRecord[];
+  onSelect: (record: BatchEvalRunRecord) => void;
+  onExit: () => void;
+  availableHeight: number;
+}) {
+  const nav = useListNavigation({
+    items: records,
+    onSelect: item => onSelect(item),
+    onExit,
+    isActive: true,
+  });
+
+  const maxVisible = Math.max(1, availableHeight - 3);
+  const visible = useMemo(() => {
+    let start = 0;
+    if (nav.selectedIndex >= maxVisible) {
+      start = nav.selectedIndex - maxVisible + 1;
+    }
+    return { items: records.slice(start, start + maxVisible), startIdx: start };
+  }, [records, nav.selectedIndex, maxVisible]);
+
+  return (
+    <Panel fullWidth>
+      <Box flexDirection="column">
+        <Text bold>Batch Evaluation History</Text>
+        <Text dimColor>
+          {records.length} batch evaluation{records.length !== 1 ? 's' : ''}
+        </Text>
+        <Box marginTop={1} flexDirection="column">
+          {visible.items.map((rec, vIdx) => {
+            const idx = visible.startIdx + vIdx;
+            const selected = idx === nav.selectedIndex;
+            const date = rec.startedAt ? formatShortDate(rec.startedAt) : 'unknown';
+
+            // Build a short score summary from evaluationResults or results
+            const summaries = rec.evaluationResults?.evaluatorSummaries;
+            let scoreText = '';
+            if (summaries && summaries.length > 0) {
+              scoreText = summaries
+                .map(s => {
+                  const avg = s.statistics?.averageScore;
+                  return avg != null ? avg.toFixed(2) : 'N/A';
+                })
+                .join(', ');
+            } else if (rec.results.length > 0) {
+              const byEval = new Map<string, number[]>();
+              for (const r of rec.results) {
+                if (r.score != null) {
+                  const scores = byEval.get(r.evaluatorId) ?? [];
+                  scores.push(r.score);
+                  byEval.set(r.evaluatorId, scores);
+                }
+              }
+              scoreText = [...byEval.entries()]
+                .map(([, scores]) => (scores.reduce((a, b) => a + b, 0) / scores.length).toFixed(2))
+                .join(', ');
+            }
+
+            return (
+              <Text key={rec.batchEvaluationId} wrap="truncate-end">
+                <Text color={selected ? 'cyan' : undefined}>{selected ? '>' : ' '} </Text>
+                <Text dimColor>{date.padEnd(16)}</Text>
+                <Text color={statusColor(rec.status)}>{rec.status.padEnd(12)}</Text>
+                {scoreText && <Text>{scoreText.padEnd(10)}</Text>}
+                <Text dimColor>{rec.name}</Text>
+              </Text>
+            );
+          })}
+          {visible.startIdx + maxVisible < records.length && (
+            <Text dimColor> {records.length - visible.startIdx - maxVisible} more</Text>
+          )}
+        </Box>
+      </Box>
+    </Panel>
+  );
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Detail view
+// ─────────────────────────────────────────────────────────────────────────────
+
+function BatchEvalDetailView({ record, onBack }: { record: BatchEvalRunRecord; onBack: () => void }) {
+  useInput((input, key) => {
+    if (key.escape || input === 'b') {
+      onBack();
+    }
+  });
+
+  const evalRes = record.evaluationResults;
+  const summaries = evalRes?.evaluatorSummaries;
+
+  // Fall back to local grouping when API summaries aren't available
+  const byEvaluator = useMemo(() => {
+    if (summaries && summaries.length > 0) return null;
+    const map = new Map<string, { scores: number[]; errors: number }>();
+    for (const r of record.results) {
+      const entry = map.get(r.evaluatorId) ?? { scores: [], errors: 0 };
+      if (r.error) {
+        entry.errors++;
+      } else if (r.score != null) {
+        entry.scores.push(r.score);
+      }
+      map.set(r.evaluatorId, entry);
+    }
+    return map;
+  }, [record.results, summaries]);
+
+  return (
+    <Panel fullWidth>
+      <Box flexDirection="column">
+        <Text>
+          <Text bold>ID:</Text> {record.batchEvaluationId}
+        </Text>
+        <Text>
+          <Text bold>Name:</Text> {record.name}
+          {'  '}
+          <Text bold>Status:</Text> <Text color={statusColor(record.status)}>{record.status}</Text>
+        </Text>
+        <Text>
+          <Text bold>Evaluators:</Text> {record.evaluators.join(', ')}
+        </Text>
+        {record.startedAt && (
+          <Text>
+            <Text bold>Started:</Text> {new Date(record.startedAt).toLocaleString()}
+          </Text>
+        )}
+        {record.completedAt && (
+          <Text>
+            <Text bold>Completed:</Text> {new Date(record.completedAt).toLocaleString()}
+          </Text>
+        )}
+
+        {evalRes?.totalNumberOfSessions != null && (
+          <Text>
+            <Text bold>Sessions:</Text> {evalRes.totalNumberOfSessions} total
+            {evalRes.numberOfSessionsCompleted != null && <Text>, {evalRes.numberOfSessionsCompleted} completed</Text>}
+            {evalRes.numberOfSessionsFailed ? <Text color="red">, {evalRes.numberOfSessionsFailed} failed</Text> : null}
+          </Text>
+        )}
+
+        {summaries && summaries.length > 0 ? (
+          <Box marginTop={1} flexDirection="column">
+            <Text bold>Scores (0 worst — 1 best):</Text>
+            {summaries.map(s => {
+              const avg = s.statistics?.averageScore;
+              const avgStr = avg != null ? avg.toFixed(2) : 'N/A';
+              const color = avg != null ? scoreColor(avg) : undefined;
+              return (
+                <Text key={s.evaluatorId}>
+                  {'  '}
+                  <Text bold>{s.evaluatorId}</Text>
+                  {'  '}
+                  <Text color={color}>{avgStr}</Text>
+                  {s.totalFailed ? <Text color="red"> ({s.totalFailed} failed)</Text> : null}
+                  {s.totalEvaluated != null && <Text dimColor> [{s.totalEvaluated} evaluated]</Text>}
+                </Text>
+              );
+            })}
+          </Box>
+        ) : byEvaluator && byEvaluator.size > 0 ? (
+          <Box marginTop={1} flexDirection="column">
+            <Text bold>Scores (0 worst — 1 best):</Text>
+            {[...byEvaluator.entries()].map(([evalId, { scores, errors }]) => {
+              const avg = scores.length > 0 ? scores.reduce((a, b) => a + b, 0) / scores.length : 0;
+              return (
+                <Text key={evalId}>
+                  {'  '}
+                  <Text bold>{evalId}</Text>
+                  {'  '}
+                  <Text color={scoreColor(avg)}>{avg.toFixed(2)}</Text>
+                  {errors > 0 && <Text color="red"> ({errors} errors)</Text>}
+                </Text>
+              );
+            })}
+          </Box>
+        ) : (
+          <Box marginTop={1}>
+            <Text dimColor>No evaluation results available.</Text>
+          </Box>
+        )}
+
+        <Box marginTop={1}>
+          <Text dimColor>Press Esc or B to go back</Text>
+        </Box>
+      </Box>
+    </Panel>
+  );
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Main screen
+// ─────────────────────────────────────────────────────────────────────────────
+
+interface BatchEvalHistoryScreenProps {
+  onExit: () => void;
+}
+
+export function BatchEvalHistoryScreen({ onExit }: BatchEvalHistoryScreenProps) {
+  const { stdout } = useStdout();
+  const terminalHeight = stdout?.rows ?? 24;
+  const availableHeight = Math.max(6, terminalHeight - CHROME_LINES);
+
+  const [selectedRecord, setSelectedRecord] = useState<BatchEvalRunRecord | null>(null);
+
+  const [records, loaded, error] = useMemo(() => {
+    try {
+      return [listBatchEvalRuns(), true, null] as const;
+    } catch (err) {
+      return [[] as BatchEvalRunRecord[], true, err instanceof Error ? err.message : String(err)] as const;
+    }
+  }, []);
+
+  if (!loaded) {
+    return (
+      <Screen title="Batch Evaluation History [preview]" onExit={onExit}>
+        <Text dimColor>Loading...</Text>
+      </Screen>
+    );
+  }
+
+  if (error) {
+    return (
+      <Screen title="Batch Evaluation History [preview]" onExit={onExit}>
+        <Text color="red">{error}</Text>
+      </Screen>
+    );
+  }
+
+  if (records.length === 0) {
+    return (
+      <Screen title="Batch Evaluation History [preview]" onExit={onExit}>
+        <Box flexDirection="column">
+          <Text dimColor>No batch evaluation runs found.</Text>
+          <Text dimColor>Run a batch evaluation from the TUI or CLI to see results here.</Text>
+        </Box>
+      </Screen>
+    );
+  }
+
+  const helpText = selectedRecord ? 'Esc/B back to list' : HELP_TEXT.NAVIGATE_SELECT;
+
+  return (
+    <Screen
+      title="Batch Evaluation History [preview]"
+      onExit={onExit}
+      helpText={helpText}
+      exitEnabled={!selectedRecord}
+    >
+      {selectedRecord ? (
+        <BatchEvalDetailView record={selectedRecord} onBack={() => setSelectedRecord(null)} />
+      ) : (
+        <BatchEvalListView
+          records={records}
+          onSelect={setSelectedRecord}
+          onExit={onExit}
+          availableHeight={availableHeight}
+        />
+      )}
+    </Screen>
+  );
+}
diff --git a/src/cli/tui/screens/run-eval/RunBatchEvalFlow.tsx b/src/cli/tui/screens/run-eval/RunBatchEvalFlow.tsx
new file mode 100644
index 000000000..38c03c150
--- /dev/null
+++ b/src/cli/tui/screens/run-eval/RunBatchEvalFlow.tsx
@@ -0,0 +1,968 @@
+import { validateAwsCredentials } from '../../../aws/account';
+import { stopBatchEvaluation } from '../../../aws/agentcore-batch-evaluation';
+import type { SessionMetadataEntry } from '../../../aws/agentcore-batch-evaluation';
+import { listEvaluators } from '../../../aws/agentcore-control';
+import { detectRegion } from '../../../aws/region';
+import { getErrorMessage } from '../../../errors';
+import type { SessionInfo } from '../../../operations/eval';
+import { discoverSessions } from '../../../operations/eval';
+import { saveBatchEvalRun } from '../../../operations/eval/batch-eval-storage';
+import { runBatchEvaluationCommand } from '../../../operations/eval/run-batch-evaluation';
+import type {
+  BatchEvaluationResult,
+  RunBatchEvaluationCommandResult,
+} from '../../../operations/eval/run-batch-evaluation';
+import { loadDeployedProjectConfig, resolveAgent } from '../../../operations/resolve-agent';
+import {
+  ConfirmReview,
+  ErrorPrompt,
+  GradientText,
+  Panel,
+  PathInput,
+  Screen,
+  StepIndicator,
+  StepProgress,
+  TextInput,
+  WizardMultiSelect,
+  WizardSelect,
+} from '../../components';
+import type { SelectableItem, Step } from '../../components';
+import { HELP_TEXT } from '../../constants';
+import { useListNavigation, useMultiSelectNavigation } from '../../hooks';
+import type { EvaluatorItem } from '../online-eval/types';
+import { GroundTruthForm } from './GroundTruthForm';
+import type { AgentItem } from './types';
+import type { GroundTruthData } from './useRunEvalWizard';
+import { Box, Text, useInput } from 'ink';
+import { readFileSync } from 'node:fs';
+import { resolve as resolvePath } from 'node:path';
+import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+
+// ============================================================================
+// Types
+// ============================================================================
+
+const DEFAULT_LOOKBACK_DAYS = 7;
+
+type BatchEvalStep = 'agent' | 'evaluators' | 'days' | 'sessions' | 'ground-truth' | 'name' | 'confirm';
+
+interface BatchEvalConfig {
+  agent: string;
+  evaluators: string[];
+  evaluatorNames: string[];
+  days: number;
+  sessionIds: string[];
+  groundTruthFile: string;
+  sessionMetadata?: SessionMetadataEntry[];
+  name: string;
+}
+
+const STEP_LABELS: Record<BatchEvalStep, string> = {
+  agent: 'Agent',
+  evaluators: 'Evaluators',
+  days: 'Lookback',
+  sessions: 'Sessions',
+  'ground-truth': 'Ground Truth',
+  name: 'Name',
+  confirm: 'Confirm',
+};
+
+type FlowState =
+  | { name: 'loading' }
+  | { name: 'wizard'; agents: AgentItem[]; evaluators: EvaluatorItem[] }
+  | {
+      name: 'running';
+      config: BatchEvalConfig;
+      steps: Step[];
+      elapsed: number;
+      batchEvaluationId?: string;
+      region?: string;
+    }
+  | { name: 'results'; result: RunBatchEvaluationCommandResult; savedFilePath?: string }
+  | { name: 'creds-error'; message: string }
+  | { name: 'error'; message: string; logFilePath?: string };
+
+// ============================================================================
+// Flow Component
+// ============================================================================
+
+interface RunBatchEvalFlowProps {
+  onExit: () => void;
+}
+
+export function RunBatchEvalFlow({ onExit }: RunBatchEvalFlowProps) {
+  const [flow, setFlow] = useState<FlowState>({ name: 'loading' });
+  const stoppingRef = useRef(false);
+
+  // Handle Esc to stop a running batch evaluation
+  useInput((_input, key) => {
+    if (flow.name !== 'running' || !flow.batchEvaluationId || !flow.region || stoppingRef.current) return;
+    if (key.escape) {
+      stoppingRef.current = true;
+      void stopBatchEvaluation({ region: flow.region, batchEvaluationId: flow.batchEvaluationId }).catch(() => {
+        // Best-effort — the poll loop will pick up the final status
+      });
+      setFlow(prev => {
+        if (prev.name !== 'running') return prev;
+        const steps = prev.steps.map(s =>
+          s.status === 'running' ? { ...s, status: 'error' as const, error: 'Stopping...' } : s
+        );
+        return { ...prev, steps };
+      });
+    }
+  });
+
+  // Load agents and evaluators
+  useEffect(() => {
+    if (flow.name !== 'loading') return;
+    let cancelled = false;
+
+    void (async () => {
+      try {
+        await validateAwsCredentials();
+      } catch (err) {
+        if (!cancelled) setFlow({ name: 'creds-error', message: getErrorMessage(err) });
+        return;
+      }
+
+      try {
+        const context = await loadDeployedProjectConfig();
+        const targetRegion = context.awsTargets?.[0]?.region;
+        const { region: detectedRegion } = await detectRegion();
+        const region = targetRegion ?? detectedRegion;
+        const evalResult = await listEvaluators({ region });
+
+        if (cancelled) return;
+
+        const evaluators: EvaluatorItem[] = evalResult.evaluators.map(e => ({
+          arn: e.evaluatorArn,
+          name: e.evaluatorName,
+          type: e.evaluatorType,
+          description: e.description,
+        }));
+
+        // Only show deployed agents
+        const deployedAgentNames = new Set<string>();
+        for (const target of Object.values(context.deployedState.targets)) {
+          const runtimeStates = target.resources?.runtimes;
+          if (runtimeStates) {
+            for (const name of Object.keys(runtimeStates)) {
+              deployedAgentNames.add(name);
+            }
+          }
+        }
+
+        const agents: AgentItem[] = context.project.runtimes
+          .filter((a: { name: string }) => deployedAgentNames.has(a.name))
+          .map((a: { name: string; build: string }) => ({ name: a.name, build: a.build }));
+
+        if (agents.length === 0) {
+          if (!cancelled) {
+            setFlow({
+              name: 'error',
+              message:
+                context.project.runtimes.length === 0
+                  ? 'No agents found in project. Run `agentcore add agent` first.'
+                  : 'No deployed agents found. Run `agentcore deploy` first.',
+            });
+          }
+          return;
+        }
+
+        if (evaluators.length === 0) {
+          if (!cancelled) {
+            setFlow({ name: 'error', message: 'No evaluators found in your account. Create an evaluator first.' });
+          }
+          return;
+        }
+
+        setFlow({ name: 'wizard', agents, evaluators });
+      } catch (err) {
+        if (!cancelled) setFlow({ name: 'error', message: getErrorMessage(err) });
+      }
+    })();
+
+    return () => {
+      cancelled = true;
+    };
+  }, [flow.name]);
+
+  const handleWizardComplete = useCallback((config: BatchEvalConfig) => {
+    stoppingRef.current = false;
+    const initialSteps: Step[] = [
+      { label: 'Starting batch evaluation...', status: 'running' },
+      { label: 'Polling for results', status: 'pending' },
+      { label: 'Fetching scores', status: 'pending' },
+    ];
+    setFlow({ name: 'running', config, steps: initialSteps, elapsed: 0 });
+  }, []);
+
+  // Execute batch evaluation
+  useEffect(() => {
+    if (flow.name !== 'running') return;
+    let cancelled = false;
+
+    const { config } = flow;
+    const startTime = Date.now();
+
+    const timer = setInterval(() => {
+      if (!cancelled) {
+        setFlow(prev => {
+          if (prev.name !== 'running') return prev;
+          return { ...prev, elapsed: Math.floor((Date.now() - startTime) / 1000) };
+        });
+      }
+    }, 1000);
+
+    void (async () => {
+      try {
+        const result = await runBatchEvaluationCommand({
+          agent: config.agent,
+          evaluators: config.evaluators,
+          name: config.name || undefined,
+          sessionIds: config.sessionIds.length > 0 ? config.sessionIds : undefined,
+          lookbackDays: config.days,
+          sessionMetadata: config.sessionMetadata,
+          onProgress: (status, _message) => {
+            if (cancelled) return;
+            setFlow(prev => {
+              if (prev.name !== 'running') return prev;
+              const steps = [...prev.steps];
+              if (status === 'running') {
+                steps[0] = { ...steps[0]!, status: 'success' };
+                steps[1] = { ...steps[1]!, status: 'running' };
+              }
+              return { ...prev, steps };
+            });
+          },
+          onStarted: info => {
+            setFlow(prev => {
+              if (prev.name !== 'running') return prev;
+              return { ...prev, batchEvaluationId: info.batchEvaluationId, region: info.region };
+            });
+          },
+        });
+
+        clearInterval(timer);
+        if (cancelled) return;
+
+        // Save results locally
+        let savedFilePath: string | undefined;
+        if (result.success) {
+          try {
+            savedFilePath = saveBatchEvalRun(result);
+          } catch {
+            // Non-fatal
+          }
+        }
+
+        if (!result.success) {
+          setFlow(prev => {
+            if (prev.name !== 'running') return prev;
+            const steps = prev.steps.map(s =>
+              s.status === 'running' ? { ...s, status: 'error' as const, error: result.error } : s
+            );
+            return { ...prev, steps };
+          });
+          await new Promise(resolve => setTimeout(resolve, 2000));
+          if (cancelled) return;
+          setFlow({
+            name: 'error',
+            message: result.error ?? 'Batch evaluation failed',
+            logFilePath: result.logFilePath,
+          });
+          return;
+        }
+
+        // Mark all steps success
+        setFlow(prev => {
+          if (prev.name !== 'running') return prev;
+          const steps = prev.steps.map(s => ({ ...s, status: 'success' as const }));
+          return { ...prev, steps };
+        });
+
+        setFlow({ name: 'results', result, savedFilePath });
+      } catch (err) {
+        clearInterval(timer);
+        if (!cancelled) {
+          const errorMsg = getErrorMessage(err);
+          setFlow(prev => {
+            if (prev.name !== 'running') return prev;
+            const steps = prev.steps.map(s =>
+              s.status === 'running' ? { ...s, status: 'error' as const, error: errorMsg } : s
+            );
+            return { ...prev, steps };
+          });
+          await new Promise(resolve => setTimeout(resolve, 2000));
+          setFlow({ name: 'error', message: errorMsg });
+        }
+      }
+    })();
+
+    return () => {
+      cancelled = true;
+      clearInterval(timer);
+    };
+  }, [flow.name]); // eslint-disable-line react-hooks/exhaustive-deps
+
+  if (flow.name === 'loading') {
+    return (
+      <Screen title="Run Batch Evaluation [preview]" onExit={onExit}>
+        <GradientText text="Loading agents and evaluators..." />
+      </Screen>
+    );
+  }
+
+  if (flow.name === 'creds-error') {
+    return <ErrorPrompt message="AWS credentials required" detail={flow.message} onBack={onExit} onExit={onExit} />;
+  }
+
+  if (flow.name === 'wizard') {
+    return (
+      <BatchEvalWizard
+        agents={flow.agents}
+        evaluators={flow.evaluators}
+        onComplete={handleWizardComplete}
+        onExit={onExit}
+      />
+    );
+  }
+
+  if (flow.name === 'running') {
+    const minutes = Math.floor(flow.elapsed / 60);
+    const seconds = flow.elapsed % 60;
+    const timeStr = minutes > 0 ? `${minutes}m ${seconds}s` : `${seconds}s`;
+
+    return (
+      <Screen title="Run Batch Evaluation [preview]" onExit={onExit}>
+        <Panel>
+          <Box flexDirection="column" gap={1}>
+            <Text>
+              <Text bold>Agent:</Text> {flow.config.agent}
+              {'  '}
+              <Text bold>Evaluators:</Text> {flow.config.evaluatorNames.join(', ')}
+              {'  '}
+              <Text dimColor>({timeStr})</Text>
+            </Text>
+            <StepProgress steps={flow.steps} />
+            <Text dimColor>This may take a few minutes...</Text>
+            {flow.batchEvaluationId && <Text dimColor>Press Esc to stop the evaluation</Text>}
+          </Box>
+        </Panel>
+      </Screen>
+    );
+  }
+
+  if (flow.name === 'results') {
+    return (
+      <ResultsView
+        result={flow.result}
+        savedFilePath={flow.savedFilePath}
+        onRunAnother={() => setFlow({ name: 'loading' })}
+        onExit={onExit}
+      />
+    );
+  }
+
+  return (
+    <ErrorPrompt
+      message="Batch evaluation failed"
+      detail={flow.logFilePath ? `${flow.message}\n\nLog: ${flow.logFilePath}` : flow.message}
+      onBack={() => setFlow({ name: 'loading' })}
+      onExit={onExit}
+    />
+  );
+}
+
+// ============================================================================
+// Wizard Component
+// ============================================================================
+
+interface BatchEvalWizardProps {
+  agents: AgentItem[];
+  evaluators: EvaluatorItem[];
+  onComplete: (config: BatchEvalConfig) => void;
+  onExit: () => void;
+}
+
+function BatchEvalWizard({ agents, evaluators: rawEvaluators, onComplete, onExit }: BatchEvalWizardProps) {
+  const skipAgent = agents.length <= 1;
+  const allSteps = useMemo<BatchEvalStep[]>(
+    () =>
+      skipAgent
+        ? ['evaluators', 'days', 'sessions', 'ground-truth', 'name', 'confirm']
+        : ['agent', 'evaluators', 'days', 'sessions', 'ground-truth', 'name', 'confirm'],
+    [skipAgent]
+  );
+
+  const [step, setStep] = useState<BatchEvalStep>(allSteps[0]!);
+  const [config, setConfig] = useState<BatchEvalConfig>({
+    agent: skipAgent ? agents[0]!.name : '',
+    evaluators: [],
+    evaluatorNames: [],
+    days: DEFAULT_LOOKBACK_DAYS,
+    sessionIds: [],
+    groundTruthFile: '',
+    sessionMetadata: undefined,
+    name: '',
+  });
+
+  const currentIndex = allSteps.indexOf(step);
+  const [groundTruthError, setGroundTruthError] = useState<string | null>(null);
+  const [gtMode, setGtMode] = useState<'choose' | 'file' | 'inline'>('choose');
+
+  const goBack = useCallback(() => {
+    const prev = allSteps[currentIndex - 1];
+    if (prev) {
+      if (prev === 'ground-truth') setGtMode('choose');
+      setStep(prev);
+    } else onExit();
+  }, [allSteps, currentIndex, onExit]);
+
+  const goNext = useCallback(() => {
+    const next = allSteps[currentIndex + 1];
+    if (next) setStep(next);
+  }, [allSteps, currentIndex]);
+
+  const agentItems: SelectableItem[] = useMemo(
+    () => agents.map(a => ({ id: a.name, title: a.name, description: a.build })),
+    [agents]
+  );
+
+  const evaluatorItems: SelectableItem[] = useMemo(
+    () =>
+      rawEvaluators.map(e => ({
+        id: e.arn,
+        title: e.name,
+        description: e.type === 'Builtin' ? 'Built-in evaluator' : (e.description ?? 'Custom evaluator'),
+      })),
+    [rawEvaluators]
+  );
+
+  // ── Session discovery ──────────────────────────────────────────────────────
+
+  type SessionResult = { phase: 'loaded'; sessions: SessionInfo[] } | { phase: 'error'; message: string };
+
+  const [sessionResult, setSessionResult] = useState<SessionResult & { key: string }>();
+  const fetchingRef = useRef('');
+
+  const isAgentStep = step === 'agent';
+  const isEvaluatorsStep = step === 'evaluators';
+  const isDaysStep = step === 'days';
+  const isSessionsStep = step === 'sessions';
+  const isGroundTruthStep = step === 'ground-truth';
+  const isNameStep = step === 'name';
+  const isConfirmStep = step === 'confirm';
+
+  const fetchKey = `${config.agent}:${config.days}`;
+  const sessionPhase = !isSessionsStep ? 'idle' : sessionResult?.key === fetchKey ? sessionResult.phase : 'loading';
+
+  useEffect(() => {
+    if (!isSessionsStep) return;
+    if (sessionResult?.key === fetchKey) return;
+    if (fetchingRef.current === fetchKey) return;
+    fetchingRef.current = fetchKey;
+    let cancelled = false;
+
+    void (async () => {
+      try {
+        const context = await loadDeployedProjectConfig();
+        const targetRegion = context.awsTargets?.[0]?.region;
+        const { region: detectedRegion } = await detectRegion();
+        const region = targetRegion ?? detectedRegion;
+        const agentResult = resolveAgent(context, { runtime: config.agent });
+        if (!agentResult.success) {
+          if (!cancelled) setSessionResult({ key: fetchKey, phase: 'error', message: agentResult.error });
+          return;
+        }
+
+        const sessions = await discoverSessions({
+          runtimeId: agentResult.agent.runtimeId,
+          region,
+          lookbackDays: config.days,
+        });
+
+        if (cancelled) return;
+
+        if (sessions.length === 0) {
+          setSessionResult({
+            key: fetchKey,
+            phase: 'error',
+            message: 'No sessions found in the lookback window. Try increasing the lookback days.',
+          });
+        } else {
+          setSessionResult({ key: fetchKey, phase: 'loaded', sessions });
+        }
+      } catch (err) {
+        if (!cancelled) {
+          setSessionResult({
+            key: fetchKey,
+            phase: 'error',
+            message: err instanceof Error ? err.message : 'Failed to discover sessions',
+          });
+        }
+      }
+    })();
+
+    return () => {
+      cancelled = true;
+    };
+  }, [isSessionsStep, fetchKey]); // eslint-disable-line react-hooks/exhaustive-deps
+
+  const sessionItems: SelectableItem[] = useMemo(() => {
+    const sessions = sessionResult?.phase === 'loaded' ? sessionResult.sessions : [];
+    return sessions.map(s => {
+      const date = s.firstSeen
+        ? new Date(s.firstSeen).toLocaleString([], {
+            month: 'short',
+            day: 'numeric',
+            hour: '2-digit',
+            minute: '2-digit',
+          })
+        : '';
+      const shortId = s.sessionId.length > 36 ? s.sessionId.slice(0, 36) + '…' : s.sessionId;
+      return {
+        id: s.sessionId,
+        title: shortId,
+        description: `${s.spanCount} spans · ${date}`,
+      };
+    });
+  }, [sessionResult]);
+
+  // ── Navigation hooks ──────────────────────────────────────────────────────
+
+  const agentNav = useListNavigation({
+    items: agentItems,
+    onSelect: item => {
+      setConfig(c => ({ ...c, agent: item.id }));
+      goNext();
+    },
+    onExit,
+    isActive: isAgentStep,
+  });
+
+  const evaluatorsNav = useMultiSelectNavigation({
+    items: evaluatorItems,
+    getId: item => item.id,
+    onConfirm: ids => {
+      const names = ids.map(id => {
+        const item = rawEvaluators.find(e => e.arn === id);
+        return item?.name ?? id;
+      });
+      setConfig(c => ({ ...c, evaluators: ids, evaluatorNames: names }));
+      goNext();
+    },
+    onExit: () => goBack(),
+    isActive: isEvaluatorsStep,
+    requireSelection: true,
+  });
+
+  // Handle Esc during session loading/error
+  useListNavigation({
+    items: [{ id: 'back', title: 'Back' }],
+    onSelect: () => goBack(),
+    onExit: () => goBack(),
+    isActive: isSessionsStep && sessionPhase !== 'loaded',
+  });
+
+  const sessionsNav = useMultiSelectNavigation({
+    items: sessionItems,
+    getId: item => item.id,
+    onConfirm: ids => {
+      setConfig(c => ({ ...c, sessionIds: ids }));
+      goNext();
+    },
+    onExit: () => goBack(),
+    isActive: isSessionsStep && sessionPhase === 'loaded',
+    requireSelection: true,
+  });
+
+  const gtChoiceItems: SelectableItem[] = useMemo(
+    () => [
+      { id: 'skip', title: 'Skip', description: 'No ground truth' },
+      { id: 'file', title: 'Load from file', description: 'JSON file with session metadata and ground truth' },
+      { id: 'inline', title: 'Enter manually', description: 'Type assertions, trajectory, and expected response' },
+    ],
+    []
+  );
+
+  const gtChoiceNav = useListNavigation({
+    items: gtChoiceItems,
+    onSelect: item => {
+      setGroundTruthError(null);
+      if (item.id === 'skip') {
+        setConfig(c => ({ ...c, groundTruthFile: '', sessionMetadata: undefined }));
+        goNext();
+      } else if (item.id === 'file') {
+        setGtMode('file');
+      } else {
+        setGtMode('inline');
+      }
+    },
+    onExit: () => goBack(),
+    isActive: isGroundTruthStep && gtMode === 'choose',
+  });
+
+  useListNavigation({
+    items: [{ id: 'confirm', title: 'Confirm' }],
+    onSelect: () => onComplete(config),
+    onExit: () => goBack(),
+    isActive: isConfirmStep,
+  });
+
+  const helpText = isAgentStep
+    ? HELP_TEXT.NAVIGATE_SELECT
+    : isEvaluatorsStep
+      ? 'Space toggle · Enter confirm · Esc back'
+      : isDaysStep
+        ? HELP_TEXT.TEXT_INPUT
+        : isSessionsStep
+          ? sessionPhase === 'loading'
+            ? ''
+            : sessionPhase === 'error'
+              ? HELP_TEXT.CONFIRM_CANCEL
+              : 'Space toggle · Enter confirm · Esc back'
+          : isGroundTruthStep
+            ? gtMode === 'choose'
+              ? HELP_TEXT.NAVIGATE_SELECT
+              : gtMode === 'file'
+                ? HELP_TEXT.TEXT_INPUT
+                : 'Enter value · Enter on empty to skip section · Esc back'
+            : isNameStep
+              ? HELP_TEXT.TEXT_INPUT
+              : HELP_TEXT.CONFIRM_CANCEL;
+
+  const headerContent = <StepIndicator steps={allSteps} currentStep={step} labels={STEP_LABELS} />;
+
+  return (
+    <Screen title="Run Batch Evaluation [preview]" onExit={goBack} helpText={helpText} headerContent={headerContent}>
+      <Panel>
+        {isAgentStep && (
+          <WizardSelect
+            title="Select agent to evaluate"
+            description="Choose a deployed agent"
+            items={agentItems}
+            selectedIndex={agentNav.selectedIndex}
+          />
+        )}
+
+        {isEvaluatorsStep && (
+          <WizardMultiSelect
+            title="Select evaluators"
+            description="Choose evaluators to run against agent sessions"
+            items={evaluatorItems}
+            cursorIndex={evaluatorsNav.cursorIndex}
+            selectedIds={evaluatorsNav.selectedIds}
+            maxVisibleItems={10}
+          />
+        )}
+
+        {isDaysStep && (
+          <Box flexDirection="column">
+            <Text dimColor>Note: Traces may take 5–10 min to appear after agent invocations.</Text>
+            <TextInput
+              key="days"
+              prompt="Lookback window (days)"
+              initialValue={String(DEFAULT_LOOKBACK_DAYS)}
+              onSubmit={value => {
+                const days = parseInt(value, 10);
+                if (!isNaN(days) && days >= 1 && days <= 90) {
+                  setConfig(c => ({ ...c, days }));
+                  goNext();
+                }
+              }}
+              onCancel={() => goBack()}
+              customValidation={value => {
+                const days = parseInt(value, 10);
+                if (isNaN(days)) return 'Must be a number';
+                if (days < 1 || days > 90) return 'Must be between 1 and 90';
+                return true;
+              }}
+            />
+          </Box>
+        )}
+
+        {isSessionsStep && sessionPhase === 'loading' && <GradientText text="Discovering sessions..." />}
+
+        {isSessionsStep && sessionResult?.phase === 'error' && <Text color="red">{sessionResult.message}</Text>}
+
+        {isSessionsStep && sessionPhase === 'loaded' && (
+          <WizardMultiSelect
+            title="Select sessions to evaluate"
+            description={`Found ${sessionItems.length} session${sessionItems.length !== 1 ? 's' : ''} — select one or more`}
+            items={sessionItems}
+            cursorIndex={sessionsNav.cursorIndex}
+            selectedIds={sessionsNav.selectedIds}
+          />
+        )}
+
+        {isGroundTruthStep && gtMode === 'choose' && (
+          <WizardSelect
+            title="Ground truth (optional)"
+            description="Provide assertions, expected trajectory, or expected responses for evaluation"
+            items={gtChoiceItems}
+            selectedIndex={gtChoiceNav.selectedIndex}
+          />
+        )}
+
+        {isGroundTruthStep && gtMode === 'file' && (
+          <Box flexDirection="column">
+            <Text dimColor>Select a JSON file with session ground truth (assertions, expected trajectory, turns).</Text>
+            {groundTruthError && <Text color="red">{groundTruthError}</Text>}
+            <PathInput
+              placeholder="path/to/ground-truth.json"
+              pathType="file"
+              onSubmit={value => {
+                setGroundTruthError(null);
+                try {
+                  const resolved = resolvePath(value.trim());
+                  const content = readFileSync(resolved, 'utf-8');
+                  const parsed = JSON.parse(content) as Record<string, unknown>;
+                  const metadata: SessionMetadataEntry[] = Array.isArray(parsed)
+                    ? (parsed as SessionMetadataEntry[])
+                    : (parsed.sessionMetadata as SessionMetadataEntry[]);
+                  if (!Array.isArray(metadata)) {
+                    setGroundTruthError('File must be a JSON array or contain a "sessionMetadata" array');
+                    return;
+                  }
+                  setConfig(c => ({ ...c, groundTruthFile: resolved, sessionMetadata: metadata }));
+                  goNext();
+                } catch (err) {
+                  setGroundTruthError(`Failed to load file: ${err instanceof Error ? err.message : String(err)}`);
+                }
+              }}
+              onCancel={() => {
+                setGroundTruthError(null);
+                setGtMode('choose');
+              }}
+            />
+          </Box>
+        )}
+
+        {isGroundTruthStep && gtMode === 'inline' && (
+          <GroundTruthForm
+            sessionId={config.sessionIds.length === 1 ? config.sessionIds[0]! : `${config.sessionIds.length} sessions`}
+            onSubmit={(gt: GroundTruthData) => {
+              // Apply the same ground truth to all selected sessions
+              const metadata: SessionMetadataEntry[] = config.sessionIds.map(sid => ({
+                sessionId: sid,
+                groundTruth: {
+                  inline: {
+                    ...(gt.assertions.length > 0 ? { assertions: gt.assertions.map(text => ({ text })) } : {}),
+                    ...(gt.expectedTrajectory.length > 0
+                      ? { expectedTrajectory: { toolNames: gt.expectedTrajectory } }
+                      : {}),
+                    ...(gt.expectedResponse
+                      ? {
+                          turns: [
+                            {
+                              input: { prompt: '' },
+                              expectedResponse: { text: gt.expectedResponse },
+                            },
+                          ],
+                        }
+                      : {}),
+                  },
+                },
+              }));
+              setConfig(c => ({ ...c, groundTruthFile: '', sessionMetadata: metadata }));
+              goNext();
+            }}
+            onCancel={() => {
+              setGtMode('choose');
+            }}
+          />
+        )}
+
+        {isNameStep && (
+          <Box flexDirection="column">
+            <Text dimColor>Optional — leave blank for auto-generated name.</Text>
+            <TextInput
+              key="name"
+              prompt="Batch evaluation name"
+              initialValue=""
+              allowEmpty
+              onSubmit={value => {
+                setConfig(c => ({ ...c, name: value }));
+                goNext();
+              }}
+              onCancel={() => goBack()}
+            />
+          </Box>
+        )}
+
+        {isConfirmStep && (
+          <ConfirmReview
+            fields={[
+              { label: 'Agent', value: config.agent },
+              { label: 'Evaluators', value: config.evaluatorNames.join(', ') },
+              { label: 'Lookback', value: `${config.days} day${config.days !== 1 ? 's' : ''}` },
+              {
+                label: 'Sessions',
+                value: `${config.sessionIds.length} selected`,
+              },
+              ...(config.sessionMetadata
+                ? [{ label: 'Ground Truth', value: `${config.sessionMetadata.length} session(s) with ground truth` }]
+                : []),
+              ...(config.name ? [{ label: 'Name', value: config.name }] : []),
+            ]}
+          />
+        )}
+      </Panel>
+    </Screen>
+  );
+}
+
+// ============================================================================
+// Results View
+// ============================================================================
+
+function scoreColor(score: number): string {
+  if (score >= 0.8) return 'green';
+  if (score >= 0.5) return 'yellow';
+  return 'red';
+}
+
+interface ResultsViewProps {
+  result: RunBatchEvaluationCommandResult;
+  savedFilePath?: string;
+  onRunAnother: () => void;
+  onExit: () => void;
+}
+
+function ResultsView({ result, savedFilePath, onRunAnother, onExit }: ResultsViewProps) {
+  const actions = [
+    { id: 'another', title: 'Run another batch evaluation' },
+    { id: 'back', title: 'Back' },
+  ];
+
+  const nav = useListNavigation({
+    items: actions,
+    onSelect: item => {
+      if (item.id === 'another') onRunAnother();
+      else onExit();
+    },
+    onExit,
+    isActive: true,
+  });
+
+  const evalRes = result.evaluationResults;
+  const summaries = evalRes?.evaluatorSummaries;
+
+  // Fall back to local grouping when API summaries aren't available
+  const byEvaluator = useMemo(() => {
+    if (summaries && summaries.length > 0) return null;
+    const map = new Map<string, BatchEvaluationResult[]>();
+    for (const r of result.results) {
+      const group = map.get(r.evaluatorId) ?? [];
+      group.push(r);
+      map.set(r.evaluatorId, group);
+    }
+    return map;
+  }, [result.results, summaries]);
+
+  return (
+    <Screen
+      title="Batch Evaluation Complete [preview]"
+      onExit={onExit}
+      helpText={HELP_TEXT.NAVIGATE_SELECT}
+      exitEnabled={false}
+    >
+      <Panel fullWidth>
+        <Box flexDirection="column">
+          <Text color="green">✓ Batch evaluation complete</Text>
+          <Text>
+            <Text bold>ID:</Text> {result.batchEvaluationId}
+            {'  '}
+            <Text bold>Status:</Text> {result.status}
+          </Text>
+          {result.name && (
+            <Text>
+              <Text bold>Name:</Text> {result.name}
+            </Text>
+          )}
+
+          {evalRes?.totalNumberOfSessions != null && (
+            <Text>
+              <Text bold>Sessions:</Text> {evalRes.totalNumberOfSessions} total
+              {evalRes.numberOfSessionsCompleted != null && (
+                <Text>, {evalRes.numberOfSessionsCompleted} completed</Text>
+              )}
+              {evalRes.numberOfSessionsFailed ? (
+                <Text color="red">, {evalRes.numberOfSessionsFailed} failed</Text>
+              ) : null}
+            </Text>
+          )}
+
+          {summaries && summaries.length > 0 ? (
+            <Box marginTop={1} flexDirection="column">
+              <Text dimColor>Scores range from 0 (worst) to 1 (best).</Text>
+              {summaries.map(s => {
+                const avg = s.statistics?.averageScore;
+                const avgStr = avg != null ? avg.toFixed(2) : 'N/A';
+                const color = avg != null ? scoreColor(avg) : undefined;
+                return (
+                  <Text key={s.evaluatorId}>
+                    {'  '}
+                    <Text bold>{s.evaluatorId}</Text>
+                    {'  '}
+                    <Text color={color}>{avgStr}</Text>
+                    {s.totalFailed ? <Text color="red"> ({s.totalFailed} failed)</Text> : null}
+                    {s.totalEvaluated != null && <Text dimColor> [{s.totalEvaluated} evaluated]</Text>}
+                  </Text>
+                );
+              })}
+            </Box>
+          ) : byEvaluator && byEvaluator.size > 0 ? (
+            <Box marginTop={1} flexDirection="column">
+              <Text dimColor>Scores range from 0 (worst) to 1 (best).</Text>
+              {[...byEvaluator.entries()].map(([evalId, evalResults]) => {
+                const scores = evalResults.filter(r => !r.error).map(r => r.score!);
+                const avg = scores.length > 0 ? scores.reduce((a, b) => a + b, 0) / scores.length : 0;
+                const errors = evalResults.filter(r => r.error).length;
+                return (
+                  <Text key={evalId}>
+                    {'  '}
+                    <Text bold>{evalId}</Text>
+                    {'  '}
+                    <Text color={scoreColor(avg)}>{avg.toFixed(2)}</Text>
+                    {errors > 0 && <Text color="red"> ({errors} errors)</Text>}
+                  </Text>
+                );
+              })}
+            </Box>
+          ) : (
+            <Box marginTop={1}>
+              <Text dimColor>No evaluation results returned.</Text>
+            </Box>
+          )}
+
+          {savedFilePath && (
+            <Box marginTop={1}>
+              <Text dimColor>Results saved to: {savedFilePath}</Text>
+            </Box>
+          )}
+          {result.logFilePath && (
+            <Box marginTop={1}>
+              <Text dimColor>Log: {result.logFilePath}</Text>
+            </Box>
+          )}
+
+          <Box marginTop={1} flexDirection="column">
+            {actions.map((action, idx) => {
+              const selected = idx === nav.selectedIndex;
+              return (
+                <Text key={action.id}>
+                  <Text color={selected ? 'cyan' : undefined}>{selected ? '❯' : ' '} </Text>
+                  <Text color={selected ? 'cyan' : undefined} bold={selected}>
+                    {action.title}
+                  </Text>
+                </Text>
+              );
+            })}
+          </Box>
+        </Box>
+      </Panel>
+    </Screen>
+  );
+}
diff --git a/src/cli/tui/screens/run-eval/RunScreen.tsx b/src/cli/tui/screens/run-eval/RunScreen.tsx
index 6675983f9..a9a797a37 100644
--- a/src/cli/tui/screens/run-eval/RunScreen.tsx
+++ b/src/cli/tui/screens/run-eval/RunScreen.tsx
@@ -6,10 +6,12 @@ import React, { useMemo } from 'react';
 
 interface RunScreenProps {
   onRunEval: () => void;
+  onRunBatchEval: () => void;
+  onRunRecommendation: () => void;
   onExit: () => void;
 }
 
-export function RunScreen({ onRunEval, onExit }: RunScreenProps) {
+export function RunScreen({ onRunEval, onRunBatchEval, onRunRecommendation, onExit }: RunScreenProps) {
   const items: SelectableItem[] = useMemo(
     () => [
       {
@@ -17,13 +19,27 @@ export function RunScreen({ onRunEval, onExit }: RunScreenProps) {
         title: 'On-demand Evaluation',
         description: 'Evaluate agent traces with selected evaluators. CLI also supports --agent-arn.',
       },
+      {
+        id: 'run-batch-eval',
+        title: 'Batch Evaluation',
+        description: 'Run a batch evaluation against agent sessions via CloudWatch.',
+      },
+      {
+        id: 'run-recommendation',
+        title: 'Recommendation',
+        description: 'Optimize system prompts or tool descriptions using agent traces.',
+      },
     ],
     []
   );
 
   const nav = useListNavigation({
     items,
-    onSelect: () => onRunEval(),
+    onSelect: item => {
+      if (item.id === 'run-eval') onRunEval();
+      else if (item.id === 'run-batch-eval') onRunBatchEval();
+      else if (item.id === 'run-recommendation') onRunRecommendation();
+    },
     onExit,
     isActive: true,
   });
diff --git a/src/cli/tui/screens/run-eval/index.ts b/src/cli/tui/screens/run-eval/index.ts
index d76e0e086..7c56bd639 100644
--- a/src/cli/tui/screens/run-eval/index.ts
+++ b/src/cli/tui/screens/run-eval/index.ts
@@ -1,3 +1,5 @@
+export { BatchEvalHistoryScreen } from './BatchEvalHistoryScreen';
+export { RunBatchEvalFlow } from './RunBatchEvalFlow';
 export { RunEvalFlow } from './RunEvalFlow';
 export { RunEvalScreen } from './RunEvalScreen';
 export { RunScreen } from './RunScreen';
diff --git a/src/cli/tui/screens/runtime-endpoint/AddRuntimeEndpointFlow.tsx b/src/cli/tui/screens/runtime-endpoint/AddRuntimeEndpointFlow.tsx
index 2404109fc..83bda78e5 100644
--- a/src/cli/tui/screens/runtime-endpoint/AddRuntimeEndpointFlow.tsx
+++ b/src/cli/tui/screens/runtime-endpoint/AddRuntimeEndpointFlow.tsx
@@ -1,5 +1,6 @@
 import { ConfigIO } from '../../../../lib';
 import { runtimeEndpointPrimitive } from '../../../primitives/registry';
+import { withAddTelemetry } from '../../../telemetry/cli-command-run.js';
 import { ErrorPrompt } from '../../components';
 import { AddSuccessScreen } from '../add/AddSuccessScreen';
 import { AddRuntimeEndpointScreen } from './AddRuntimeEndpointScreen';
@@ -78,24 +79,24 @@ export function AddRuntimeEndpointFlow({
   }, [isInteractive, flow.name, onExit]);
 
   const handleCreateComplete = useCallback((config: RuntimeEndpointWizardConfig) => {
-    void runtimeEndpointPrimitive
-      .add({
+    void withAddTelemetry('add.runtime-endpoint', {}, () =>
+      runtimeEndpointPrimitive.add({
         runtime: config.runtimeName,
         endpoint: config.endpointName,
         version: config.version,
         description: config.description,
       })
-      .then(result => {
-        if (result.success) {
-          setFlow({
-            name: 'create-success',
-            endpointName: config.endpointName,
-            runtimeName: config.runtimeName,
-          });
-          return;
-        }
-        setFlow({ name: 'error', message: result.error ?? 'Unknown error' });
-      });
+    ).then(result => {
+      if (result.success) {
+        setFlow({
+          name: 'create-success',
+          endpointName: config.endpointName,
+          runtimeName: config.runtimeName,
+        });
+        return;
+      }
+      setFlow({ name: 'error', message: result.error ?? 'Unknown error' });
+    });
   }, []);
 
   if (flow.name === 'loading') {
diff --git a/src/cli/tui/utils/commands.ts b/src/cli/tui/utils/commands.ts
index 1ea68e3b5..912c6a7f6 100644
--- a/src/cli/tui/utils/commands.ts
+++ b/src/cli/tui/utils/commands.ts
@@ -12,12 +12,12 @@ export interface CommandMeta {
 /**
  * Commands hidden from TUI entirely (meta commands).
  */
-const HIDDEN_FROM_TUI = ['help', 'telemetry'] as const;
+const HIDDEN_FROM_TUI = ['help', 'telemetry', 'promote'] as const;
 
 /**
  * Commands that are CLI-only (shown but marked as requiring CLI invocation).
  */
-const CLI_ONLY_COMMANDS = ['logs', 'traces', 'pause', 'resume'] as const;
+const CLI_ONLY_COMMANDS = ['logs', 'traces', 'pause', 'resume', 'stop'] as const;
 
 /**
  * Commands hidden from TUI when inside an existing project.
diff --git a/src/cli/update-notifier.ts b/src/cli/update-notifier.ts
index 98c468296..56821e7b9 100644
--- a/src/cli/update-notifier.ts
+++ b/src/cli/update-notifier.ts
@@ -1,5 +1,5 @@
 import { compareVersions, fetchLatestVersion } from './commands/update/action.js';
-import { PACKAGE_VERSION } from './constants.js';
+import { PACKAGE_VERSION, getDistroConfig } from './constants.js';
 import { mkdir, readFile, writeFile } from 'fs/promises';
 import { homedir } from 'os';
 import { join } from 'path';
@@ -66,9 +66,10 @@ export function printUpdateNotification(result: UpdateCheckResult): void {
   const yellow = '\x1b[33m';
   const cyan = '\x1b[36m';
   const reset = '\x1b[0m';
+  const { installCommand } = getDistroConfig();
 
   process.stderr.write(
     `\n${yellow}Update available:${reset} ${PACKAGE_VERSION} → ${cyan}${result.latestVersion}${reset}\n` +
-      `Run ${cyan}\`npm install -g @aws/agentcore@latest\`${reset} to update.\n`
+      `Run ${cyan}\`${installCommand}\`${reset} to update.\n`
   );
 }
diff --git a/src/lib/constants.ts b/src/lib/constants.ts
index 48b5feb48..5ef7b5c34 100644
--- a/src/lib/constants.ts
+++ b/src/lib/constants.ts
@@ -10,6 +10,9 @@ export const CONFIG_DIR = 'agentcore';
 export const APP_DIR = 'app';
 export const MCP_APP_SUBDIR = 'mcp';
 
+// Harnesses directory
+export const HARNESS_DIR = 'harnesses';
+
 // CLI system subdirectory (inside CONFIG_DIR)
 export const CLI_SYSTEM_DIR = '.cli';
 export const CLI_LOGS_DIR = 'logs';
diff --git a/src/lib/packaging/__tests__/helpers.test.ts b/src/lib/packaging/__tests__/helpers.test.ts
index f27c171fa..a554edb0e 100644
--- a/src/lib/packaging/__tests__/helpers.test.ts
+++ b/src/lib/packaging/__tests__/helpers.test.ts
@@ -477,11 +477,8 @@ describe('nested agentcore directory is preserved (issue #843)', () => {
   });
 
   // ── createZipFromDir (async) ──
-  // The zip stage should NOT exclude agentcore/ — that's copySourceTree's job.
-  // When zipping a staging directory, any agentcore/ present is a legitimate
-  // Python package installed by uv, not the project config dir.
 
-  it('zip: does not exclude agentcore/ directories (staging has no project config)', async () => {
+  it('zip: excludes top-level agentcore/ but includes nested agentcore/', async () => {
     const src = buildFixture(join(root, 'zip-async'));
     const zipPath = join(root, 'zip-async.zip');
 
@@ -490,17 +487,21 @@ describe('nested agentcore directory is preserved (issue #843)', () => {
     const zipBuffer = await readFile(zipPath);
     const entries = Object.keys(unzipSync(new Uint8Array(zipBuffer)));
 
-    // Both top-level and nested agentcore/ are preserved in the zip —
-    // the zip function zips everything; exclusion is copySourceTree's concern
-    expect(entries).toContain('agentcore/config.yaml');
+    // Top-level agentcore/ should NOT appear
+    expect(entries.some(e => e === 'agentcore/config.yaml')).toBe(false);
+    expect(entries.some(e => e.startsWith('agentcore/'))).toBe(false);
+
+    // Nested agentcore/ SHOULD appear
     expect(entries).toContain('lib/langgraph_checkpoint_aws/agentcore/__init__.py');
     expect(entries).toContain('lib/langgraph_checkpoint_aws/agentcore/core.py');
+
+    // Regular files present
     expect(entries).toContain('main.py');
   });
 
   // ── createZipFromDirSync ──
 
-  it('sync zip: does not exclude agentcore/ directories (staging has no project config)', () => {
+  it('sync zip: excludes top-level agentcore/ but includes nested agentcore/', () => {
     const src = buildFixture(join(root, 'zip-sync'));
     const zipPath = join(root, 'zip-sync.zip');
 
@@ -509,61 +510,9 @@ describe('nested agentcore directory is preserved (issue #843)', () => {
     const zipBuffer = readFileSync(zipPath);
     const entries = Object.keys(unzipSync(new Uint8Array(zipBuffer)));
 
-    expect(entries).toContain('agentcore/config.yaml');
+    expect(entries.some(e => e.startsWith('agentcore/'))).toBe(false);
     expect(entries).toContain('lib/langgraph_checkpoint_aws/agentcore/__init__.py');
     expect(entries).toContain('lib/langgraph_checkpoint_aws/agentcore/core.py');
     expect(entries).toContain('main.py');
   });
-
-  // ── Staging directory scenario (the actual bug) ──
-  // After uv installs deps into staging, copySourceTree copies user source on top.
-  // The staging dir may contain a top-level agentcore/ from a Python package.
-  // createZipFromDir must NOT strip it.
-
-  it('zip preserves top-level agentcore/ Python package in staging dir', async () => {
-    const staging = join(root, 'staging-zip-async');
-    mkdirSync(staging, { recursive: true });
-
-    // Simulate uv-installed dependency with top-level agentcore/ package
-    const agentcorePkg = join(staging, 'langgraph_checkpoint_aws', 'agentcore');
-    mkdirSync(agentcorePkg, { recursive: true });
-    writeFileSync(join(staging, 'langgraph_checkpoint_aws', '__init__.py'), '# init');
-    writeFileSync(join(agentcorePkg, '__init__.py'), '# agentcore init');
-    writeFileSync(join(agentcorePkg, 'saver.py'), 'class AgentCoreMemorySaver: pass');
-
-    // User source copied on top by copySourceTree
-    writeFileSync(join(staging, 'main.py'), 'print("hello")');
-
-    const zipPath = join(root, 'staging-async.zip');
-    await createZipFromDir(staging, zipPath);
-
-    const zipBuffer = await readFile(zipPath);
-    const entries = Object.keys(unzipSync(new Uint8Array(zipBuffer)));
-
-    expect(entries).toContain('langgraph_checkpoint_aws/agentcore/__init__.py');
-    expect(entries).toContain('langgraph_checkpoint_aws/agentcore/saver.py');
-    expect(entries).toContain('main.py');
-  });
-
-  it('sync zip preserves top-level agentcore/ Python package in staging dir', () => {
-    const staging = join(root, 'staging-zip-sync');
-    mkdirSync(staging, { recursive: true });
-
-    const agentcorePkg = join(staging, 'langgraph_checkpoint_aws', 'agentcore');
-    mkdirSync(agentcorePkg, { recursive: true });
-    writeFileSync(join(staging, 'langgraph_checkpoint_aws', '__init__.py'), '# init');
-    writeFileSync(join(agentcorePkg, '__init__.py'), '# agentcore init');
-    writeFileSync(join(agentcorePkg, 'saver.py'), 'class AgentCoreMemorySaver: pass');
-    writeFileSync(join(staging, 'main.py'), 'print("hello")');
-
-    const zipPath = join(root, 'staging-sync.zip');
-    createZipFromDirSync(staging, zipPath);
-
-    const zipBuffer = readFileSync(zipPath);
-    const entries = Object.keys(unzipSync(new Uint8Array(zipBuffer)));
-
-    expect(entries).toContain('langgraph_checkpoint_aws/agentcore/__init__.py');
-    expect(entries).toContain('langgraph_checkpoint_aws/agentcore/saver.py');
-    expect(entries).toContain('main.py');
-  });
 });
diff --git a/src/lib/packaging/build-args.ts b/src/lib/packaging/build-args.ts
index e5af34045..eadc35875 100644
--- a/src/lib/packaging/build-args.ts
+++ b/src/lib/packaging/build-args.ts
@@ -1,11 +1,11 @@
-import { readCliConfig } from '../schemas/io/cli-config';
+import { readGlobalConfigSync } from '../schemas/io/global-config';
 
 /**
  * Return Docker --build-arg flags for UV index URLs configured in ~/.agentcore/config.json.
  * Returns an empty array when no custom indexes are configured.
  */
 export function getUvBuildArgs(): string[] {
-  const config = readCliConfig();
+  const config = readGlobalConfigSync();
   const args: string[] = [];
   if (config.uvDefaultIndex) args.push('--build-arg', `UV_DEFAULT_INDEX=${config.uvDefaultIndex}`);
   if (config.uvIndex) args.push('--build-arg', `UV_INDEX=${config.uvIndex}`);
diff --git a/src/lib/packaging/helpers.ts b/src/lib/packaging/helpers.ts
index 36074395c..31c74b298 100644
--- a/src/lib/packaging/helpers.ts
+++ b/src/lib/packaging/helpers.ts
@@ -192,23 +192,24 @@ export async function createZipFromDir(sourceDir: string, outputZip: string): Pr
   await rm(outputZip, { force: true });
   await mkdir(dirname(outputZip), { recursive: true });
 
-  const files = await collectFiles(sourceDir);
+  const files = await collectFiles(sourceDir, sourceDir);
   const zipped = zipSync(files);
   await writeFile(outputZip, zipped);
 }
 
-async function collectFiles(directory: string, basePath = ''): Promise<Zippable> {
+async function collectFiles(directory: string, rootDir: string, basePath = ''): Promise<Zippable> {
   const result: Zippable = {};
   const entries = await readdir(directory, { withFileTypes: true });
 
   for (const entry of entries) {
     if (EXCLUDED_ENTRIES.has(entry.name)) continue;
+    if (entry.name === CONFIG_DIR && resolve(directory) === resolve(rootDir)) continue;
 
     const fullPath = join(directory, entry.name);
     const zipPath = basePath ? `${basePath}/${entry.name}` : entry.name;
 
     if (entry.isDirectory()) {
-      Object.assign(result, await collectFiles(fullPath, zipPath));
+      Object.assign(result, await collectFiles(fullPath, rootDir, zipPath));
     } else if (entry.isFile()) {
       result[zipPath] = [await readFile(fullPath), { level: 6 }];
     }
@@ -324,18 +325,19 @@ export function ensureBinaryAvailableSync(binary: string, installHint?: string):
   throw new MissingDependencyError(binary, installHint);
 }
 
-function collectFilesSync(directory: string, basePath = ''): Zippable {
+function collectFilesSync(directory: string, rootDir: string, basePath = ''): Zippable {
   const result: Zippable = {};
   const entries = readdirSync(directory, { withFileTypes: true });
 
   for (const entry of entries) {
     if (EXCLUDED_ENTRIES.has(entry.name)) continue;
+    if (entry.name === CONFIG_DIR && resolve(directory) === resolve(rootDir)) continue;
 
     const fullPath = join(directory, entry.name);
     const zipPath = basePath ? `${basePath}/${entry.name}` : entry.name;
 
     if (entry.isDirectory()) {
-      Object.assign(result, collectFilesSync(fullPath, zipPath));
+      Object.assign(result, collectFilesSync(fullPath, rootDir, zipPath));
     } else if (entry.isFile()) {
       result[zipPath] = [readFileSync(fullPath), { level: 6 }];
     }
@@ -347,7 +349,7 @@ export function createZipFromDirSync(sourceDir: string, outputZip: string): void
   rmSync(outputZip, { force: true });
   mkdirSync(dirname(outputZip), { recursive: true });
 
-  const files = collectFilesSync(sourceDir);
+  const files = collectFilesSync(sourceDir, sourceDir);
   const zipped = zipSync(files);
   writeFileSync(outputZip, zipped);
 }
diff --git a/src/lib/schemas/io/__tests__/config-io.test.ts b/src/lib/schemas/io/__tests__/config-io.test.ts
index 4b583c502..ffe829fa0 100644
--- a/src/lib/schemas/io/__tests__/config-io.test.ts
+++ b/src/lib/schemas/io/__tests__/config-io.test.ts
@@ -286,6 +286,77 @@ describe('ConfigIO', () => {
     });
   });
 
+  describe('writeHarnessSpec and readHarnessSpec', () => {
+    it('round-trips valid harness spec', async () => {
+      const projectDir = join(testDir, `harness-rt-${randomUUID()}`);
+      const agentcoreDir = join(projectDir, 'agentcore');
+      mkdirSync(agentcoreDir, { recursive: true });
+
+      const configIO = new ConfigIO({ baseDir: agentcoreDir });
+
+      const harnessSpec = {
+        name: 'testHarness',
+        model: {
+          provider: 'bedrock',
+          modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        },
+        tools: [],
+      } as any;
+
+      await configIO.writeHarnessSpec('testHarness', harnessSpec);
+
+      const harnessDir = join(projectDir, 'app', 'testHarness');
+      const harnessFile = join(harnessDir, 'harness.json');
+      expect(existsSync(harnessFile)).toBe(true);
+
+      const readBack = await configIO.readHarnessSpec('testHarness');
+      expect(readBack.name).toBe('testHarness');
+      expect(readBack.model.provider).toBe('bedrock');
+      expect(readBack.model.modelId).toBe('anthropic.claude-3-5-sonnet-20240620-v1:0');
+    });
+
+    it('throws ConfigNotFoundError when harness.json does not exist', async () => {
+      const projectDir = join(testDir, `harness-missing-${randomUUID()}`);
+      const agentcoreDir = join(projectDir, 'agentcore');
+      mkdirSync(agentcoreDir, { recursive: true });
+
+      const configIO = new ConfigIO({ baseDir: agentcoreDir });
+
+      await expect(configIO.readHarnessSpec('nonexistent-harness')).rejects.toThrow(ConfigNotFoundError);
+    });
+
+    it('throws ConfigValidationError for invalid harness data', async () => {
+      const projectDir = join(testDir, `harness-invalid-${randomUUID()}`);
+      const agentcoreDir = join(projectDir, 'agentcore');
+      mkdirSync(agentcoreDir, { recursive: true });
+
+      const configIO = new ConfigIO({ baseDir: agentcoreDir });
+
+      const invalidSpec = { invalid: 'data' } as any;
+
+      await expect(configIO.writeHarnessSpec('bad-harness', invalidSpec)).rejects.toThrow(ConfigValidationError);
+    });
+
+    it('throws NoProjectError when no project exists', async () => {
+      const emptyDir = join(testDir, `empty-harness-${randomUUID()}`);
+      await mkdir(emptyDir, { recursive: true });
+      changeWorkingDir(emptyDir);
+
+      const configIO = new ConfigIO();
+
+      const validSpec = {
+        name: 'testHarness',
+        model: {
+          provider: 'bedrock',
+          modelId: 'anthropic.claude-3-5-sonnet-20240620-v1:0',
+        },
+        tools: [],
+      } as any;
+
+      await expect(configIO.writeHarnessSpec('testHarness', validSpec)).rejects.toThrow(NoProjectError);
+    });
+  });
+
   describe('resolveAWSDeploymentTargets region handling (issue #772)', () => {
     let projectDir: string;
     let agentcoreDir: string;
diff --git a/src/lib/schemas/io/__tests__/path-resolver.test.ts b/src/lib/schemas/io/__tests__/path-resolver.test.ts
index cbf9c8288..70bff97e2 100644
--- a/src/lib/schemas/io/__tests__/path-resolver.test.ts
+++ b/src/lib/schemas/io/__tests__/path-resolver.test.ts
@@ -204,6 +204,21 @@ describe('PathResolver', () => {
     expect(resolver.getMcpDefsPath()).toBe(join('/base', 'mcp-defs.json'));
   });
 
+  it('getHarnessesDir returns harnesses directory path', () => {
+    const resolver = new PathResolver({ baseDir: '/project/agentcore' });
+    expect(resolver.getHarnessesDir()).toBe(join('/project', 'app'));
+  });
+
+  it('getHarnessDir returns specific harness directory path', () => {
+    const resolver = new PathResolver({ baseDir: '/project/agentcore' });
+    expect(resolver.getHarnessDir('myHarness')).toBe(join('/project', 'app', 'myHarness'));
+  });
+
+  it('getHarnessConfigPath returns harness config file path', () => {
+    const resolver = new PathResolver({ baseDir: '/project/agentcore' });
+    expect(resolver.getHarnessConfigPath('myHarness')).toBe(join('/project', 'app', 'myHarness', 'harness.json'));
+  });
+
   it('setBaseDir updates the base directory', () => {
     const resolver = new PathResolver({ baseDir: '/old' });
     resolver.setBaseDir('/new');
diff --git a/src/lib/schemas/io/cli-config.ts b/src/lib/schemas/io/cli-config.ts
deleted file mode 100644
index aa36d82f1..000000000
--- a/src/lib/schemas/io/cli-config.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-import { readFileSync } from 'fs';
-import { homedir } from 'os';
-import { join } from 'path';
-
-const CONFIG_FILE = join(homedir(), '.agentcore', 'config.json');
-
-export interface CliConfig {
-  uvDefaultIndex?: string;
-  uvIndex?: string;
-  disableTransactionSearch?: boolean;
-  transactionSearchIndexPercentage?: number;
-}
-
-/**
- * Read the global CLI config from ~/.agentcore/config.json.
- * Returns an empty object if the file doesn't exist or is malformed.
- */
-export function readCliConfig(): CliConfig {
-  try {
-    const data = readFileSync(CONFIG_FILE, 'utf-8');
-    const parsed: Record<string, unknown> = JSON.parse(data) as Record<string, unknown>;
-    const config: CliConfig = {};
-    if (typeof parsed.uvDefaultIndex === 'string') config.uvDefaultIndex = parsed.uvDefaultIndex;
-    if (typeof parsed.uvIndex === 'string') config.uvIndex = parsed.uvIndex;
-    if (parsed.disableTransactionSearch === true) config.disableTransactionSearch = true;
-    if (typeof parsed.transactionSearchIndexPercentage === 'number') {
-      const pct = parsed.transactionSearchIndexPercentage;
-      if (pct >= 0 && pct <= 100) {
-        config.transactionSearchIndexPercentage = pct;
-      }
-    }
-    return config;
-  } catch {
-    return {};
-  }
-}
diff --git a/src/lib/schemas/io/config-io.ts b/src/lib/schemas/io/config-io.ts
index 423403f90..e4b2740e4 100644
--- a/src/lib/schemas/io/config-io.ts
+++ b/src/lib/schemas/io/config-io.ts
@@ -1,9 +1,16 @@
-import type { AgentCoreCliMcpDefs, AgentCoreProjectSpec, AwsDeploymentTarget, DeployedState } from '../../../schema';
+import type {
+  AgentCoreCliMcpDefs,
+  AgentCoreProjectSpec,
+  AwsDeploymentTarget,
+  DeployedState,
+  HarnessSpec,
+} from '../../../schema';
 import {
   AgentCoreCliMcpDefsSchema,
   AgentCoreProjectSpecSchema,
   AgentCoreRegionSchema,
   AwsDeploymentTargetsSchema,
+  HarnessSpecSchema,
   createValidatedDeployedStateSchema,
 } from '../../../schema';
 import {
@@ -110,7 +117,12 @@ export class ConfigIO {
    */
   async writeProjectSpec(data: AgentCoreProjectSpec): Promise<void> {
     const filePath = this.pathResolver.getAgentConfigPath();
-    await this.validateAndWrite(filePath, 'AgentCore Project Config', AgentCoreProjectSpecSchema, data);
+    // TODO: extend this to all resource arrays so empty defaults never pollute agentcore.json
+    const cleaned = { ...data };
+    if (cleaned.configBundles?.length === 0) delete (cleaned as Record<string, unknown>).configBundles;
+    if (cleaned.abTests?.length === 0) delete (cleaned as Record<string, unknown>).abTests;
+    if (cleaned.httpGateways?.length === 0) delete (cleaned as Record<string, unknown>).httpGateways;
+    await this.validateAndWrite(filePath, 'AgentCore Project Config', AgentCoreProjectSpecSchema, cleaned);
   }
 
   /**
@@ -225,6 +237,22 @@ export class ConfigIO {
     await this.validateAndWrite(filePath, 'MCP Definitions', AgentCoreCliMcpDefsSchema, data);
   }
 
+  /**
+   * Read and validate a harness specification file
+   */
+  async readHarnessSpec(harnessName: string): Promise<HarnessSpec> {
+    const filePath = this.pathResolver.getHarnessConfigPath(harnessName);
+    return this.readAndValidate(filePath, 'Harness Spec', HarnessSpecSchema);
+  }
+
+  /**
+   * Write and validate a harness specification file
+   */
+  async writeHarnessSpec(harnessName: string, data: HarnessSpec): Promise<void> {
+    const filePath = this.pathResolver.getHarnessConfigPath(harnessName);
+    await this.validateAndWrite(filePath, 'Harness Spec', HarnessSpecSchema, data);
+  }
+
   /**
    * Check if the base directory exists
    */
diff --git a/src/cli/global-config.ts b/src/lib/schemas/io/global-config.ts
similarity index 73%
rename from src/cli/global-config.ts
rename to src/lib/schemas/io/global-config.ts
index 267ad6669..fc64eb39b 100644
--- a/src/cli/global-config.ts
+++ b/src/lib/schemas/io/global-config.ts
@@ -1,3 +1,4 @@
+import { readFileSync } from 'fs';
 import { mkdir, readFile, writeFile } from 'fs/promises';
 import { randomUUID } from 'node:crypto';
 import { homedir } from 'os';
@@ -9,18 +10,19 @@ export const GLOBAL_CONFIG_FILE = join(GLOBAL_CONFIG_DIR, 'config.json');
 
 const GlobalConfigSchema = z
   .object({
-    installationId: z.string().optional(),
-    uvDefaultIndex: z.string().optional(),
-    uvIndex: z.string().optional(),
-    disableTransactionSearch: z.boolean().optional(),
-    transactionSearchIndexPercentage: z.number().min(0).max(100).optional(),
+    installationId: z.string().optional().catch(undefined),
+    uvDefaultIndex: z.string().optional().catch(undefined),
+    uvIndex: z.string().optional().catch(undefined),
+    disableTransactionSearch: z.boolean().optional().catch(undefined),
+    transactionSearchIndexPercentage: z.number().int().min(0).max(100).optional().catch(undefined),
     telemetry: z
       .object({
-        enabled: z.boolean().optional(),
-        endpoint: z.string().optional(),
-        audit: z.boolean().optional(),
+        enabled: z.boolean().optional().catch(undefined),
+        endpoint: z.string().optional().catch(undefined),
+        audit: z.boolean().optional().catch(undefined),
       })
-      .optional(),
+      .optional()
+      .catch(undefined),
   })
   .passthrough();
 
@@ -35,6 +37,15 @@ export async function readGlobalConfig(configFile = GLOBAL_CONFIG_FILE): Promise
   }
 }
 
+export function readGlobalConfigSync(configFile = GLOBAL_CONFIG_FILE): GlobalConfig {
+  try {
+    const data = readFileSync(configFile, 'utf-8');
+    return GlobalConfigSchema.parse(JSON.parse(data));
+  } catch {
+    return {};
+  }
+}
+
 export async function updateGlobalConfig(
   partial: GlobalConfig,
   configDir = GLOBAL_CONFIG_DIR,
diff --git a/src/lib/schemas/io/index.ts b/src/lib/schemas/io/index.ts
index e8ddddc0f..212468ffe 100644
--- a/src/lib/schemas/io/index.ts
+++ b/src/lib/schemas/io/index.ts
@@ -11,4 +11,3 @@ export {
   type PathConfig,
 } from './path-resolver';
 export { ConfigIO, createConfigIO, getSchemaUrlForVersion } from './config-io';
-export { readCliConfig, type CliConfig } from './cli-config';
diff --git a/src/lib/schemas/io/path-resolver.ts b/src/lib/schemas/io/path-resolver.ts
index 9737c4a2b..d79e54e89 100644
--- a/src/lib/schemas/io/path-resolver.ts
+++ b/src/lib/schemas/io/path-resolver.ts
@@ -1,4 +1,4 @@
-import { CLI_LOGS_DIR, CLI_SYSTEM_DIR, CONFIG_DIR, CONFIG_FILES as _CONFIG_FILES } from '../../constants';
+import { APP_DIR, CLI_LOGS_DIR, CLI_SYSTEM_DIR, CONFIG_DIR, CONFIG_FILES as _CONFIG_FILES } from '../../constants';
 import { existsSync } from 'fs';
 import { dirname, join } from 'path';
 
@@ -202,6 +202,27 @@ export class PathResolver {
     return join(this.config.baseDir, CONFIG_FILES.MCP_DEFS);
   }
 
+  /**
+   * Get the path to the harnesses directory (app/)
+   */
+  getHarnessesDir(): string {
+    return join(this.getProjectRoot(), APP_DIR);
+  }
+
+  /**
+   * Get the path to a specific harness directory (app/<harnessName>/)
+   */
+  getHarnessDir(harnessName: string): string {
+    return join(this.getProjectRoot(), APP_DIR, harnessName);
+  }
+
+  /**
+   * Get the path to a specific harness config file (app/<harnessName>/harness.json)
+   */
+  getHarnessConfigPath(harnessName: string): string {
+    return join(this.getProjectRoot(), APP_DIR, harnessName, 'harness.json');
+  }
+
   /**
    * Update the base directory
    */
diff --git a/src/schema/llm-compacted/agentcore.ts b/src/schema/llm-compacted/agentcore.ts
index 5819cbd47..c86c14cb7 100644
--- a/src/schema/llm-compacted/agentcore.ts
+++ b/src/schema/llm-compacted/agentcore.ts
@@ -18,6 +18,16 @@ interface AgentCoreProjectSpec {
   runtimes: AgentEnvSpec[]; // Unique by name
   memories: Memory[]; // Unique by name
   credentials: Credential[]; // Unique by name
+  evaluators: Evaluator[]; // Unique by name — custom evaluator definitions
+  onlineEvalConfigs: OnlineEvalConfig[]; // Unique by name — online evaluation configs
+  agentCoreGateways: AgentCoreGateway[]; // Unique by name — MCP gateways
+  mcpRuntimeTools?: AgentCoreMcpRuntimeTool[]; // Unique by name — standalone MCP runtime tools (not behind a gateway)
+  unassignedTargets?: AgentCoreGatewayTarget[]; // Unique by name — targets not yet assigned to a gateway
+  policyEngines: PolicyEngine[]; // Unique by name — Cedar policy engines
+  configBundles: ConfigBundle[]; // Unique by name — configuration bundles for versioned config
+  abTests: ABTest[]; // Unique by name — A/B test experiments
+  /** @internal Auto-managed by AB test creation. Do not configure directly. */
+  httpGateways: HttpGateway[]; // Unique by name — HTTP gateways bound to a runtime
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -36,6 +46,15 @@ interface NetworkConfig {
 
 type MemoryStrategyType = 'SEMANTIC' | 'SUMMARIZATION' | 'USER_PREFERENCE' | 'EPISODIC';
 type ModelProvider = 'Bedrock' | 'Gemini' | 'OpenAI' | 'Anthropic';
+type EvaluationLevel = 'SESSION' | 'TRACE' | 'TOOL_CALL';
+type GatewayTargetType = 'lambda' | 'mcpServer' | 'openApiSchema' | 'smithyModel' | 'apiGateway' | 'lambdaFunctionArn';
+type OutboundAuthType = 'OAUTH' | 'API_KEY' | 'NONE';
+type GatewayAuthorizerType = 'NONE' | 'AWS_IAM' | 'CUSTOM_JWT';
+type GatewayExceptionLevel = 'NONE' | 'DEBUG';
+type PolicyEngineMode = 'LOG_ONLY' | 'ENFORCE';
+type ValidationMode = 'FAIL_ON_ANY_FINDINGS' | 'IGNORE_ALL_FINDINGS';
+type ComputeHost = 'Lambda' | 'AgentCoreRuntime';
+type ABTestVariantName = 'C' | 'T1';
 
 // ─────────────────────────────────────────────────────────────────────────────
 // AGENT
@@ -74,8 +93,10 @@ interface EnvVar {
 interface Memory {
   name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @max 48
   eventExpiryDuration: number; // @min 3 @max 365 (days)
-  strategies: MemoryStrategy[]; // @min 1, unique by type
+  strategies: MemoryStrategy[]; // Unique by type. Can be empty (short-term memory).
   tags?: Record<string, string>;
+  encryptionKeyArn?: string;
+  executionRoleArn?: string;
 }
 
 interface MemoryStrategy {
@@ -93,4 +114,290 @@ interface MemoryStrategy {
 interface Credential {
   authorizerType: 'ApiKeyCredentialProvider' | 'OAuthCredentialProvider';
   name: string; // @regex ^[a-zA-Z0-9\-_]+$ @min 1 @max 128
+  // Additional fields for OAuthCredentialProvider:
+  discoveryUrl?: string; // OIDC discovery URL (OAuth only)
+  scopes?: string[]; // Supported scopes (OAuth only)
+  vendor?: string; // Credential provider vendor type (OAuth only, default: 'CustomOauth2')
+  managed?: boolean; // Whether auto-created by CLI (OAuth only)
+  usage?: 'inbound' | 'outbound'; // Auth direction (OAuth only)
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// EVALUATOR
+// ─────────────────────────────────────────────────────────────────────────────
+
+interface Evaluator {
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @max 48
+  level: EvaluationLevel;
+  description?: string;
+  config: EvaluatorConfig; // Must have either llmAsAJudge or codeBased, not both
+  tags?: Record<string, string>;
+}
+
+interface EvaluatorConfig {
+  llmAsAJudge?: LlmAsAJudgeConfig;
+  codeBased?: CodeBasedConfig;
+}
+
+interface LlmAsAJudgeConfig {
+  model: string; // Bedrock model ID or ARN
+  instructions: string; // Evaluation instructions
+  ratingScale: RatingScale; // Must have either numerical or categorical, not both
+}
+
+interface RatingScale {
+  numerical?: { value: number; label: string; definition: string }[];
+  categorical?: { label: string; definition: string }[];
+}
+
+interface CodeBasedConfig {
+  managed?: ManagedCodeBasedConfig;
+  external?: ExternalCodeBasedConfig;
+}
+
+interface ManagedCodeBasedConfig {
+  codeLocation: string;
+  entrypoint: string; // default 'lambda_function.handler'
+  timeoutSeconds: number; // @min 1 @max 300 (default 60)
+  additionalPolicies?: string[];
+}
+
+interface ExternalCodeBasedConfig {
+  lambdaArn: string; // @regex ^arn:aws[a-z-]*:lambda:[a-z0-9-]+:\d{12}:function:.+$
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// ONLINE EVAL CONFIG
+// ─────────────────────────────────────────────────────────────────────────────
+
+interface OnlineEvalConfig {
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @max 48
+  agent: string; // Agent name — must match a project agent
+  evaluators: string[]; // @min 1 — evaluator names, Builtin.* IDs, or evaluator ARNs
+  samplingRate: number; // @min 0.01 @max 100 (percentage)
+  description?: string; // @max 200
+  enableOnCreate?: boolean; // Whether to enable on create (default: true)
+  tags?: Record<string, string>;
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// GATEWAY (MCP)
+// ─────────────────────────────────────────────────────────────────────────────
+
+interface AgentCoreGateway {
+  name: string; // @regex ^[0-9a-zA-Z](?:[0-9a-zA-Z-]*[0-9a-zA-Z])?$ @max 100
+  description?: string;
+  targets: AgentCoreGatewayTarget[]; // Gateway targets
+  authorizerType?: GatewayAuthorizerType; // default 'NONE'
+  authorizerConfiguration?: AuthorizerConfig; // Required when authorizerType is 'CUSTOM_JWT'
+  enableSemanticSearch?: boolean; // default true
+  exceptionLevel?: GatewayExceptionLevel; // default 'NONE'
+  policyEngineConfiguration?: GatewayPolicyEngineConfiguration;
+  tags?: Record<string, string>;
+}
+
+interface AuthorizerConfig {
+  customJwtAuthorizer?: {
+    discoveryUrl: string; // OIDC discovery URL (HTTPS, must end with /.well-known/openid-configuration)
+    allowedAudience?: string[];
+    allowedClients?: string[];
+    allowedScopes?: string[];
+    customClaims?: CustomClaimValidation[];
+  };
+}
+
+interface CustomClaimValidation {
+  inboundTokenClaimName: string; // @regex ^[A-Za-z0-9_.:-]+$ @max 255
+  inboundTokenClaimValueType: 'STRING' | 'STRING_ARRAY';
+  authorizingClaimMatchValue: {
+    claimMatchOperator: 'EQUALS' | 'CONTAINS' | 'CONTAINS_ANY';
+    claimMatchValue: {
+      matchValueString?: string; // @regex ^[A-Za-z0-9_.-]+$ @max 255
+      matchValueStringList?: string[]; // each @regex ^[A-Za-z0-9_.-]+$ @max 255
+    };
+  };
+}
+
+interface GatewayPolicyEngineConfiguration {
+  policyEngineName: string; // Reference to a PolicyEngine name
+  mode: PolicyEngineMode;
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// GATEWAY TARGET
+// ─────────────────────────────────────────────────────────────────────────────
+
+interface AgentCoreGatewayTarget {
+  name: string;
+  targetType: GatewayTargetType;
+  toolDefinitions?: ToolDefinition[]; // Required for 'lambda' targets
+  compute?: ToolComputeConfig; // Required for 'lambda' and scaffold targets
+  endpoint?: string; // URL — required for external 'mcpServer' targets
+  outboundAuth?: OutboundAuth;
+  apiGateway?: ApiGatewayConfig; // Required for 'apiGateway' target type
+  schemaSource?: SchemaSource; // Required for 'openApiSchema' / 'smithyModel' targets
+  lambdaFunctionArn?: LambdaFunctionArnConfig; // Required for 'lambdaFunctionArn' target type
+}
+
+interface OutboundAuth {
+  type: OutboundAuthType; // default 'NONE'
+  credentialName?: string; // Required when type is not 'NONE'
+  scopes?: string[];
+}
+
+interface ToolDefinition {
+  name: string;
+  description?: string;
+  inputSchema: object; // JSON Schema
+  outputSchema?: object;
+}
+
+interface ToolComputeConfig {
+  host: ComputeHost;
+  implementation: ToolImplementationBinding;
+  // Lambda-specific:
+  nodeVersion?: NodeRuntime; // Required for TypeScript Lambda
+  pythonVersion?: PythonRuntime; // Required for Python Lambda
+  timeout?: number; // @min 1 @max 900
+  memorySize?: number; // @min 128 @max 10240
+  iamPolicy?: object; // IAM policy document
+  // AgentCoreRuntime-specific:
+  runtime?: RuntimeConfig;
+}
+
+interface ToolImplementationBinding {
+  language: 'TypeScript' | 'Python';
+  path: string;
+  handler: string;
+}
+
+interface RuntimeConfig {
+  artifact: 'CodeZip';
+  pythonVersion: PythonRuntime;
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @max 48
+  entrypoint: string; // Python file path with optional handler
+  codeLocation: string;
+  instrumentation?: Instrumentation;
+  networkMode?: NetworkMode; // default 'PUBLIC'
+  description?: string;
+}
+
+interface ApiGatewayConfig {
+  restApiId: string;
+  stage: string;
+  apiGatewayToolConfiguration: {
+    toolFilters: {
+      filterPath: string;
+      methods: ('GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS')[];
+    }[];
+    toolOverrides?: { name: string; path: string; method: string; description?: string }[];
+  };
+}
+
+interface LambdaFunctionArnConfig {
+  lambdaArn: string; // @max 170
+  toolSchemaFile: string;
+}
+
+type SchemaSource = { inline: { path: string } } | { s3: { uri: string; bucketOwnerAccountId?: string } };
+
+// ─────────────────────────────────────────────────────────────────────────────
+// MCP RUNTIME TOOL
+// ─────────────────────────────────────────────────────────────────────────────
+
+interface AgentCoreMcpRuntimeTool {
+  name: string;
+  toolDefinition: ToolDefinition;
+  compute: {
+    host: 'AgentCoreRuntime'; // Only AgentCoreRuntime (Python only)
+    implementation: ToolImplementationBinding;
+    runtime?: RuntimeConfig;
+    iamPolicy?: object;
+  };
+  bindings?: McpRuntimeBinding[]; // Grant agents permission to invoke this tool
+}
+
+interface McpRuntimeBinding {
+  runtimeName: string; // Agent runtime name to bind to
+  envVarName: string; // @regex ^[A-Za-z_][A-Za-z0-9_]*$ — env var for runtime ARN
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// POLICY ENGINE
+// ─────────────────────────────────────────────────────────────────────────────
+
+interface PolicyEngine {
+  name: string; // @regex ^[A-Za-z][A-Za-z0-9_]{0,47}$ @max 48
+  description?: string; // @max 4096
+  encryptionKeyArn?: string;
+  tags?: Record<string, string>;
+  policies: Policy[]; // Unique by name
+}
+
+interface Policy {
+  name: string; // @regex ^[A-Za-z][A-Za-z0-9_]{0,47}$ @max 48
+  description?: string; // @max 4096
+  statement: string; // Cedar policy statement
+  sourceFile?: string;
+  validationMode: ValidationMode; // default 'FAIL_ON_ANY_FINDINGS'
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// CONFIG BUNDLE
+// ─────────────────────────────────────────────────────────────────────────────
+
+interface ConfigBundle {
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,99}$ @max 100
+  description?: string; // @max 500
+  /** Component configurations keyed by component ARN or placeholder (e.g. {{runtime:<runtimeName>}}) */
+  components: Record<string, ComponentConfiguration>;
+  branchName?: string; // @max 128 — optional branch name for versioning
+  commitMessage?: string; // @max 500 — optional commit message
+}
+
+interface ComponentConfiguration {
+  configuration: Record<string, unknown>; // Freeform configuration for the component
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// AB TEST
+// ─────────────────────────────────────────────────────────────────────────────
+
+interface ABTest {
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9_]{0,47}$ @max 48
+  description?: string; // @max 200
+  gatewayRef: string; // Reference to the gateway (ARN or {{gateway:name}} placeholder)
+  roleArn?: string;
+  variants: [ABTestVariant, ABTestVariant]; // Exactly 2 — one 'C' (control) and one 'T1' (treatment). Weights must sum to 100.
+  evaluationConfig: {
+    onlineEvaluationConfigArn: string;
+  };
+  trafficAllocationConfig?: {
+    routeOnHeader: { headerName: string };
+  };
+  maxDurationDays?: number; // @min 1 @max 90
+  enableOnCreate?: boolean;
+}
+
+interface ABTestVariant {
+  name: ABTestVariantName;
+  weight: number; // @min 1 @max 100
+  variantConfiguration: {
+    configurationBundle: {
+      bundleArn: string;
+      bundleVersion: string;
+    };
+  };
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// HTTP GATEWAY
+// ─────────────────────────────────────────────────────────────────────────────
+
+/** @internal HTTP gateway auto-created when setting up an AB test. */
+interface HttpGateway {
+  name: string; // @regex ^[a-zA-Z][a-zA-Z0-9-]{0,47}$ @max 48
+  description?: string; // @max 200
+  runtimeRef: string; // Reference to a runtime name from spec.runtimes
+  roleArn?: string; // IAM role ARN — auto-created if omitted
 }
diff --git a/src/schema/schemas/__tests__/agentcore-project.test.ts b/src/schema/schemas/__tests__/agentcore-project.test.ts
index 08aaf3b12..25ac53676 100644
--- a/src/schema/schemas/__tests__/agentcore-project.test.ts
+++ b/src/schema/schemas/__tests__/agentcore-project.test.ts
@@ -2,6 +2,7 @@ import {
   AgentCoreProjectSpecSchema,
   CredentialNameSchema,
   CredentialSchema,
+  HarnessRegistryEntrySchema,
   MemoryNameSchema,
   MemorySchema,
   ProjectNameSchema,
@@ -416,6 +417,18 @@ describe('CredentialSchema', () => {
   });
 });
 
+describe('HarnessRegistryEntrySchema', () => {
+  it('accepts valid entry', () => {
+    const result = HarnessRegistryEntrySchema.safeParse({ name: 'myHarness', path: './harnesses/myHarness' });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects name starting with digit', () => {
+    const result = HarnessRegistryEntrySchema.safeParse({ name: '1harness', path: './harnesses/1harness' });
+    expect(result.success).toBe(false);
+  });
+});
+
 describe('AgentCoreProjectSpecSchema', () => {
   const minimalProject = {
     name: 'TestProject',
@@ -561,4 +574,48 @@ describe('AgentCoreProjectSpecSchema', () => {
     });
     expect(result.success).toBe(false);
   });
+
+  it('accepts project with harnesses array', () => {
+    const result = AgentCoreProjectSpecSchema.safeParse({
+      ...minimalProject,
+      harnesses: [{ name: 'myHarness', path: './harnesses/myHarness' }],
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('harnesses is undefined when not provided', () => {
+    const result = AgentCoreProjectSpecSchema.safeParse(minimalProject);
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.harnesses).toEqual([]);
+    }
+  });
+
+  it('rejects duplicate harness names', () => {
+    const harness = { name: 'myHarness', path: './harnesses/myHarness' };
+    const result = AgentCoreProjectSpecSchema.safeParse({
+      ...minimalProject,
+      harnesses: [harness, harness],
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues.some(i => i.message.includes('Duplicate harness name'))).toBe(true);
+    }
+  });
+
+  it('rejects harness with empty name', () => {
+    const result = AgentCoreProjectSpecSchema.safeParse({
+      ...minimalProject,
+      harnesses: [{ name: '', path: './harnesses/empty' }],
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects harness with empty path', () => {
+    const result = AgentCoreProjectSpecSchema.safeParse({
+      ...minimalProject,
+      harnesses: [{ name: 'myHarness', path: '' }],
+    });
+    expect(result.success).toBe(false);
+  });
 });
diff --git a/src/schema/schemas/__tests__/deployed-state.test.ts b/src/schema/schemas/__tests__/deployed-state.test.ts
index f1791712b..8fb4c44d3 100644
--- a/src/schema/schemas/__tests__/deployed-state.test.ts
+++ b/src/schema/schemas/__tests__/deployed-state.test.ts
@@ -5,6 +5,7 @@ import {
   DeployedResourceStateSchema,
   DeployedStateSchema,
   GatewayDeployedStateSchema,
+  HarnessDeployedStateSchema,
   McpDeployedStateSchema,
   McpLambdaDeployedStateSchema,
   McpRuntimeDeployedStateSchema,
@@ -318,6 +319,39 @@ describe('DeployedStateSchema', () => {
   });
 });
 
+describe('HarnessDeployedStateSchema', () => {
+  it('accepts valid harness deployed state', () => {
+    const result = HarnessDeployedStateSchema.safeParse({
+      harnessId: 'abc123',
+      harnessArn: 'arn:aws:bedrock-agentcore:us-west-2:123:harness/abc123',
+      roleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+      status: 'READY',
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects empty harnessId', () => {
+    const result = HarnessDeployedStateSchema.safeParse({
+      harnessId: '',
+      harnessArn: 'arn:aws:test',
+      roleArn: 'arn:aws:test',
+      status: 'READY',
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('accepts optional memoryArn', () => {
+    const result = HarnessDeployedStateSchema.safeParse({
+      harnessId: 'abc123',
+      harnessArn: 'arn:aws:bedrock-agentcore:us-west-2:123:harness/abc123',
+      roleArn: 'arn:aws:iam::123456789012:role/HarnessRole',
+      status: 'READY',
+      memoryArn: 'arn:aws:bedrock-agentcore:us-west-2:123:memory/def456',
+    });
+    expect(result.success).toBe(true);
+  });
+});
+
 describe('createValidatedDeployedStateSchema', () => {
   it('accepts state with targets matching known target names', () => {
     const schema = createValidatedDeployedStateSchema(['dev', 'prod']);
diff --git a/src/schema/schemas/agentcore-project.ts b/src/schema/schemas/agentcore-project.ts
index e61196348..47c10d2a9 100644
--- a/src/schema/schemas/agentcore-project.ts
+++ b/src/schema/schemas/agentcore-project.ts
@@ -9,7 +9,11 @@
 import { isReservedProjectName } from '../constants';
 import { AgentEnvSpecSchema } from './agent-env';
 import { AgentCoreGatewaySchema, AgentCoreGatewayTargetSchema, AgentCoreMcpRuntimeToolSchema } from './mcp';
+import { ABTestSchema } from './primitives/ab-test';
+import { ConfigBundleSchema } from './primitives/config-bundle';
 import { EvaluationLevelSchema, EvaluatorConfigSchema, EvaluatorNameSchema } from './primitives/evaluator';
+import { HarnessNameSchema } from './primitives/harness';
+import { HttpGatewaySchema } from './primitives/http-gateway';
 import {
   DEFAULT_EPISODIC_REFLECTION_NAMESPACES,
   DEFAULT_STRATEGY_NAMESPACES,
@@ -43,11 +47,27 @@ export type {
   RatingScale,
 } from './primitives/evaluator';
 export { BedrockModelIdSchema, isValidBedrockModelId, EvaluatorNameSchema } from './primitives/evaluator';
+export type { HarnessGatewayOutboundAuth, HarnessSpec, HarnessModelProvider } from './primitives/harness';
+export {
+  GatewayOAuthGrantTypeSchema,
+  HarnessGatewayOutboundAuthSchema,
+  HarnessNameSchema,
+  HarnessSpecSchema,
+  HarnessToolTypeSchema,
+  HarnessModelProviderSchema,
+} from './primitives/harness';
+export { ConfigBundleSchema };
+export type { ComponentConfiguration, ComponentConfigurationMap, ConfigBundle } from './primitives/config-bundle';
+export { ConfigBundleNameSchema, ComponentConfigurationMapSchema } from './primitives/config-bundle';
 export { PolicyEngineSchema };
 export type { Policy, PolicyEngine, ValidationMode } from './primitives/policy';
 export { PolicyEngineNameSchema, PolicyNameSchema, PolicySchema, ValidationModeSchema } from './primitives/policy';
 export { TagsSchema };
 export type { Tags } from './primitives/tags';
+export type { ABTestMode, TargetRef, GatewayFilter, PerVariantOnlineEvaluationConfig } from './primitives/ab-test';
+export { ABTestModeSchema, TargetRefSchema, GatewayFilterSchema } from './primitives/ab-test';
+export type { HttpGatewayTarget } from './primitives/http-gateway';
+export { HttpGatewayTargetSchema } from './primitives/http-gateway';
 
 // ============================================================================
 // ManagedBy Schema
@@ -205,6 +225,17 @@ export const EvaluatorSchema = z.object({
 
 export type Evaluator = z.infer<typeof EvaluatorSchema>;
 
+// ============================================================================
+// Harness Registry Schema
+// ============================================================================
+
+export const HarnessRegistryEntrySchema = z.object({
+  name: HarnessNameSchema,
+  path: z.string().min(1, 'Path to harness config directory is required'),
+});
+
+export type HarnessRegistryEntry = z.infer<typeof HarnessRegistryEntrySchema>;
+
 // ============================================================================
 // Project Schema (Top Level)
 // ============================================================================
@@ -312,6 +343,46 @@ export const AgentCoreProjectSpecSchema = z
           name => `Duplicate policy engine name: ${name}`
         )
       ),
+
+    harnesses: z
+      .array(HarnessRegistryEntrySchema)
+      .default([])
+      .superRefine(
+        uniqueBy(
+          harness => harness.name,
+          name => `Duplicate harness name: ${name}`
+        )
+      ),
+
+    configBundles: z
+      .array(ConfigBundleSchema)
+      .default([])
+      .superRefine(
+        uniqueBy(
+          bundle => bundle.name,
+          name => `Duplicate config bundle name: ${name}`
+        )
+      ),
+
+    abTests: z
+      .array(ABTestSchema)
+      .default([])
+      .superRefine(
+        uniqueBy(
+          test => test.name,
+          name => `Duplicate AB test name: ${name}`
+        )
+      ),
+
+    httpGateways: z
+      .array(HttpGatewaySchema)
+      .default([])
+      .superRefine(
+        uniqueBy(
+          gw => gw.name,
+          name => `Duplicate HTTP gateway name: ${name}`
+        )
+      ),
   })
   .strict()
   .superRefine((spec, ctx) => {
@@ -339,6 +410,70 @@ export const AgentCoreProjectSpecSchema = z
         }
       }
     }
+
+    // Validate HTTP gateway runtimeRef references
+    for (const gw of spec.httpGateways ?? []) {
+      const runtimeExists = spec.runtimes.some(r => r.name === gw.runtimeRef);
+      if (!runtimeExists) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: `HTTP gateway "${gw.name}" references unknown runtime "${gw.runtimeRef}"`,
+        });
+      }
+    }
+
+    // Validate AB test gateway references
+    for (const test of spec.abTests ?? []) {
+      const gwField = test.gatewayRef;
+      if (gwField && typeof gwField === 'string') {
+        const match = /^\{\{gateway:(.+)\}\}$/.exec(gwField);
+        if (match) {
+          const gwName = match[1];
+          const gwExists = (spec.httpGateways ?? []).some(gw => gw.name === gwName);
+          if (!gwExists) {
+            ctx.addIssue({
+              code: z.ZodIssueCode.custom,
+              message: `AB test "${test.name}" references gateway "${gwName}" which does not exist in httpGateways`,
+            });
+          }
+
+          // For target-based AB tests, validate target names exist in the gateway's targets array
+          if (test.mode === 'target-based') {
+            const gw = (spec.httpGateways ?? []).find(g => g.name === gwName);
+            if (gw) {
+              const gwTargetNames = new Set((gw.targets ?? []).map(t => t.name));
+              for (const variant of test.variants) {
+                const targetName = variant.variantConfiguration.target?.targetName;
+                if (targetName && !gwTargetNames.has(targetName)) {
+                  ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    message: `AB test "${test.name}" variant "${variant.name}" references target "${targetName}" which does not exist in gateway "${gwName}" targets`,
+                  });
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+
+    // Validate HTTP gateway target runtimeRef and qualifier references
+    for (const gw of spec.httpGateways ?? []) {
+      for (const target of gw.targets ?? []) {
+        const runtime = spec.runtimes.find(r => r.name === target.runtimeRef);
+        if (!runtime) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: `HTTP gateway "${gw.name}" target "${target.name}" references unknown runtime "${target.runtimeRef}"`,
+          });
+        } else if (target.qualifier && target.qualifier !== 'DEFAULT' && !runtime.endpoints?.[target.qualifier]) {
+          ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: `HTTP gateway "${gw.name}" target "${target.name}" references qualifier "${target.qualifier}" which is not an endpoint on runtime "${target.runtimeRef}"`,
+          });
+        }
+      }
+    }
   });
 
 export type AgentCoreProjectSpec = z.infer<typeof AgentCoreProjectSpecSchema>;
diff --git a/src/schema/schemas/deployed-state.ts b/src/schema/schemas/deployed-state.ts
index 6eeff21b7..355bc560d 100644
--- a/src/schema/schemas/deployed-state.ts
+++ b/src/schema/schemas/deployed-state.ts
@@ -135,6 +135,22 @@ export const PolicyDeployedStateSchema = z.object({
 
 export type PolicyDeployedState = z.infer<typeof PolicyDeployedStateSchema>;
 
+// ============================================================================
+// Harness Deployed State
+// ============================================================================
+
+export const HarnessDeployedStateSchema = z.object({
+  harnessId: z.string().min(1),
+  harnessArn: z.string().min(1),
+  roleArn: z.string().min(1),
+  status: z.string().min(1),
+  agentRuntimeArn: z.string().optional(),
+  memoryArn: z.string().optional(),
+  configHash: z.string().optional(),
+});
+
+export type HarnessDeployedState = z.infer<typeof HarnessDeployedStateSchema>;
+
 // ============================================================================
 // Credential Deployed State
 // ============================================================================
@@ -166,10 +182,58 @@ export const OnlineEvalDeployedStateSchema = z.object({
   onlineEvaluationConfigId: z.string().min(1),
   onlineEvaluationConfigArn: z.string().min(1),
   executionStatus: z.enum(['ENABLED', 'DISABLED']).optional(),
+  /** Agent name this online eval config monitors. */
+  agent: z.string().min(1).optional(),
+  /** Runtime endpoint name scoped to this online eval config. */
+  endpoint: z.string().min(1).optional(),
 });
 
 export type OnlineEvalDeployedState = z.infer<typeof OnlineEvalDeployedStateSchema>;
 
+// ============================================================================
+// Configuration Bundle Deployed State
+// ============================================================================
+
+export const ConfigBundleDeployedStateSchema = z.object({
+  bundleId: z.string().min(1),
+  bundleArn: z.string().min(1),
+  versionId: z.string().min(1),
+});
+
+export type ConfigBundleDeployedState = z.infer<typeof ConfigBundleDeployedStateSchema>;
+
+// ============================================================================
+// AB Test Deployed State
+// ============================================================================
+
+export const ABTestDeployedStateSchema = z.object({
+  abTestId: z.string().min(1),
+  abTestArn: z.string().min(1),
+  /** IAM role ARN used by this AB test. */
+  roleArn: z.string().min(1).optional(),
+  /** Whether the CLI auto-created this role (true = CLI should delete on cleanup). */
+  roleCreatedByCli: z.boolean().optional(),
+  /** SHA-256 hash of the AB test configuration for change detection. */
+  configHash: z.string().optional(),
+});
+
+export type ABTestDeployedState = z.infer<typeof ABTestDeployedStateSchema>;
+
+// ============================================================================
+// HTTP Gateway Deployed State
+// ============================================================================
+
+export const HttpGatewayDeployedStateSchema = z.object({
+  gatewayId: z.string().min(1),
+  gatewayArn: z.string().min(1),
+  gatewayUrl: z.string().optional(),
+  targetId: z.string().min(1).optional(),
+  roleArn: z.string().min(1).optional(),
+  roleCreatedByCli: z.boolean().optional(),
+});
+
+export type HttpGatewayDeployedState = z.infer<typeof HttpGatewayDeployedStateSchema>;
+
 // ============================================================================
 // Runtime Endpoint Deployed State
 // ============================================================================
@@ -193,11 +257,16 @@ export const DeployedResourceStateSchema = z.object({
   credentials: z.record(z.string(), CredentialDeployedStateSchema).optional(),
   evaluators: z.record(z.string(), EvaluatorDeployedStateSchema).optional(),
   onlineEvalConfigs: z.record(z.string(), OnlineEvalDeployedStateSchema).optional(),
+  configBundles: z.record(z.string(), ConfigBundleDeployedStateSchema).optional(),
+  abTests: z.record(z.string(), ABTestDeployedStateSchema).optional(),
+  httpGateways: z.record(z.string(), HttpGatewayDeployedStateSchema).optional(),
   policyEngines: z.record(z.string(), PolicyEngineDeployedStateSchema).optional(),
   policies: z.record(z.string(), PolicyDeployedStateSchema).optional(),
+  harnesses: z.record(z.string(), HarnessDeployedStateSchema).optional(),
   runtimeEndpoints: z.record(z.string(), RuntimeEndpointDeployedStateSchema).optional(),
   stackName: z.string().optional(),
   identityKmsKeyArn: z.string().optional(),
+  deployHash: z.string().optional(),
 });
 
 export type DeployedResourceState = z.infer<typeof DeployedResourceStateSchema>;
diff --git a/src/schema/schemas/primitives/__tests__/ab-test.test.ts b/src/schema/schemas/primitives/__tests__/ab-test.test.ts
new file mode 100644
index 000000000..874cd7d13
--- /dev/null
+++ b/src/schema/schemas/primitives/__tests__/ab-test.test.ts
@@ -0,0 +1,228 @@
+import {
+  ABTestDescriptionSchema,
+  ABTestNameSchema,
+  ABTestSchema,
+  VariantNameSchema,
+  VariantWeightSchema,
+} from '../ab-test';
+import { describe, expect, it } from 'vitest';
+
+describe('ABTestNameSchema', () => {
+  it('accepts valid name starting with letter', () => {
+    expect(ABTestNameSchema.safeParse('MyTest_1').success).toBe(true);
+  });
+
+  it('rejects empty string', () => {
+    expect(ABTestNameSchema.safeParse('').success).toBe(false);
+  });
+
+  it('rejects name starting with number', () => {
+    expect(ABTestNameSchema.safeParse('1test').success).toBe(false);
+  });
+
+  it('rejects name with hyphens', () => {
+    expect(ABTestNameSchema.safeParse('my-test').success).toBe(false);
+  });
+
+  it('rejects name over 48 chars', () => {
+    expect(ABTestNameSchema.safeParse('a'.repeat(49)).success).toBe(false);
+  });
+
+  it('accepts name at 48 chars', () => {
+    expect(ABTestNameSchema.safeParse('a'.repeat(48)).success).toBe(true);
+  });
+});
+
+describe('ABTestDescriptionSchema', () => {
+  it('accepts undefined (optional)', () => {
+    expect(ABTestDescriptionSchema.safeParse(undefined).success).toBe(true);
+  });
+
+  it('rejects empty string', () => {
+    expect(ABTestDescriptionSchema.safeParse('').success).toBe(false);
+  });
+
+  it('rejects string over 200 chars', () => {
+    expect(ABTestDescriptionSchema.safeParse('x'.repeat(201)).success).toBe(false);
+  });
+
+  it('accepts string at exactly 200 chars', () => {
+    expect(ABTestDescriptionSchema.safeParse('x'.repeat(200)).success).toBe(true);
+  });
+});
+
+describe('VariantNameSchema', () => {
+  it('accepts C', () => {
+    expect(VariantNameSchema.safeParse('C').success).toBe(true);
+  });
+
+  it('accepts T1', () => {
+    expect(VariantNameSchema.safeParse('T1').success).toBe(true);
+  });
+
+  it('rejects other names', () => {
+    expect(VariantNameSchema.safeParse('T2').success).toBe(false);
+  });
+});
+
+describe('VariantWeightSchema', () => {
+  it('accepts 1', () => {
+    expect(VariantWeightSchema.safeParse(1).success).toBe(true);
+  });
+
+  it('accepts 100', () => {
+    expect(VariantWeightSchema.safeParse(100).success).toBe(true);
+  });
+
+  it('rejects 0', () => {
+    expect(VariantWeightSchema.safeParse(0).success).toBe(false);
+  });
+
+  it('rejects 101', () => {
+    expect(VariantWeightSchema.safeParse(101).success).toBe(false);
+  });
+
+  it('rejects non-integer', () => {
+    expect(VariantWeightSchema.safeParse(50.5).success).toBe(false);
+  });
+});
+
+describe('ABTestSchema', () => {
+  const validABTest = {
+    name: 'TestOne',
+    gatewayRef: 'arn:aws:bedrock-agentcore:us-east-1:123456789012:gateway/gw-123',
+    variants: [
+      {
+        name: 'C',
+        weight: 80,
+        variantConfiguration: {
+          configurationBundle: { bundleArn: 'arn:bundle:control', bundleVersion: 'v1' },
+        },
+      },
+      {
+        name: 'T1',
+        weight: 20,
+        variantConfiguration: {
+          configurationBundle: { bundleArn: 'arn:bundle:treatment', bundleVersion: 'v1' },
+        },
+      },
+    ],
+    evaluationConfig: { onlineEvaluationConfigArn: 'arn:eval:config' },
+  };
+
+  it('accepts valid minimal AB test', () => {
+    expect(ABTestSchema.safeParse(validABTest).success).toBe(true);
+  });
+
+  it('accepts with optional fields', () => {
+    const result = ABTestSchema.safeParse({
+      ...validABTest,
+      description: 'A test',
+      roleArn: 'arn:aws:iam::123:role/MyRole',
+      maxDurationDays: 30,
+      enableOnCreate: true,
+      trafficAllocationConfig: { routeOnHeader: { headerName: 'X-AB-Route' } },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects with only 1 variant', () => {
+    const result = ABTestSchema.safeParse({
+      ...validABTest,
+      variants: [validABTest.variants[0]],
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects with 3 variants', () => {
+    const result = ABTestSchema.safeParse({
+      ...validABTest,
+      variants: [...validABTest.variants, validABTest.variants[0]],
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects maxDurationDays outside 1-90', () => {
+    expect(ABTestSchema.safeParse({ ...validABTest, maxDurationDays: 0 }).success).toBe(false);
+    expect(ABTestSchema.safeParse({ ...validABTest, maxDurationDays: 91 }).success).toBe(false);
+  });
+
+  describe('variant weight sum validation', () => {
+    it('accepts weights summing to 100 (50/50)', () => {
+      const test = {
+        ...validABTest,
+        variants: [
+          { ...validABTest.variants[0], weight: 50 },
+          { ...validABTest.variants[1], weight: 50 },
+        ],
+      };
+      expect(ABTestSchema.safeParse(test).success).toBe(true);
+    });
+
+    it('accepts weights summing to 100 (1/99)', () => {
+      const test = {
+        ...validABTest,
+        variants: [
+          { ...validABTest.variants[0], weight: 1 },
+          { ...validABTest.variants[1], weight: 99 },
+        ],
+      };
+      expect(ABTestSchema.safeParse(test).success).toBe(true);
+    });
+
+    it('rejects weights summing to 150', () => {
+      const test = {
+        ...validABTest,
+        variants: [
+          { ...validABTest.variants[0], weight: 80 },
+          { ...validABTest.variants[1], weight: 70 },
+        ],
+      };
+      const result = ABTestSchema.safeParse(test);
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues.some(i => i.message.includes('sum to 100'))).toBe(true);
+      }
+    });
+
+    it('rejects weights summing to 2', () => {
+      const test = {
+        ...validABTest,
+        variants: [
+          { ...validABTest.variants[0], weight: 1 },
+          { ...validABTest.variants[1], weight: 1 },
+        ],
+      };
+      expect(ABTestSchema.safeParse(test).success).toBe(false);
+    });
+  });
+
+  describe('variant uniqueness validation', () => {
+    it('rejects two control variants', () => {
+      const test = {
+        ...validABTest,
+        variants: [
+          { ...validABTest.variants[0], name: 'C', weight: 50 },
+          { ...validABTest.variants[1], name: 'C', weight: 50 },
+        ],
+      };
+      const result = ABTestSchema.safeParse(test);
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error.issues.some(i => i.message.includes('control (C) and one treatment (T1)'))).toBe(true);
+      }
+    });
+
+    it('rejects two treatment variants', () => {
+      const test = {
+        ...validABTest,
+        variants: [
+          { ...validABTest.variants[0], name: 'T1', weight: 50 },
+          { ...validABTest.variants[1], name: 'T1', weight: 50 },
+        ],
+      };
+      const result = ABTestSchema.safeParse(test);
+      expect(result.success).toBe(false);
+    });
+  });
+});
diff --git a/src/schema/schemas/primitives/__tests__/harness-auth.test.ts b/src/schema/schemas/primitives/__tests__/harness-auth.test.ts
new file mode 100644
index 000000000..401ed9b52
--- /dev/null
+++ b/src/schema/schemas/primitives/__tests__/harness-auth.test.ts
@@ -0,0 +1,97 @@
+import { HarnessSpecSchema } from '../harness';
+import { describe, expect, it } from 'vitest';
+
+describe('HarnessSpecSchema – auth fields', () => {
+  const minimalHarness = {
+    name: 'myHarness',
+    model: {
+      provider: 'bedrock',
+      modelId: 'us.anthropic.claude-sonnet-4-5-20250514-v1:0',
+    },
+  };
+
+  const validCustomJwtConfig = {
+    customJwtAuthorizer: {
+      discoveryUrl: 'https://cognito-idp.us-west-2.amazonaws.com/us-west-2_abc123/.well-known/openid-configuration',
+      allowedAudience: ['my-client-id'],
+    },
+  };
+
+  it('accepts harness spec with no auth fields (backwards compat)', () => {
+    const result = HarnessSpecSchema.safeParse(minimalHarness);
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts harness spec with authorizerType AWS_IAM only', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      authorizerType: 'AWS_IAM',
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts harness spec with authorizerType CUSTOM_JWT and proper authorizerConfiguration', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      authorizerType: 'CUSTOM_JWT',
+      authorizerConfiguration: validCustomJwtConfig,
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects authorizerType CUSTOM_JWT without authorizerConfiguration', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      authorizerType: 'CUSTOM_JWT',
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(
+        result.error.issues.some(i =>
+          i.message.includes(
+            'authorizerConfiguration with customJwtAuthorizer is required when authorizerType is CUSTOM_JWT'
+          )
+        )
+      ).toBe(true);
+    }
+  });
+
+  it('rejects authorizerConfiguration present without authorizerType CUSTOM_JWT', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      authorizerConfiguration: validCustomJwtConfig,
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(
+        result.error.issues.some(i =>
+          i.message.includes('authorizerConfiguration is only allowed when authorizerType is CUSTOM_JWT')
+        )
+      ).toBe(true);
+    }
+  });
+
+  it('rejects authorizerConfiguration with authorizerType AWS_IAM', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      authorizerType: 'AWS_IAM',
+      authorizerConfiguration: validCustomJwtConfig,
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(
+        result.error.issues.some(i =>
+          i.message.includes('authorizerConfiguration is only allowed when authorizerType is CUSTOM_JWT')
+        )
+      ).toBe(true);
+    }
+  });
+
+  it('rejects invalid authorizerType value', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      authorizerType: 'INVALID_VALUE',
+    });
+    expect(result.success).toBe(false);
+  });
+});
diff --git a/src/schema/schemas/primitives/__tests__/harness.test.ts b/src/schema/schemas/primitives/__tests__/harness.test.ts
new file mode 100644
index 000000000..8ec96a1c8
--- /dev/null
+++ b/src/schema/schemas/primitives/__tests__/harness.test.ts
@@ -0,0 +1,694 @@
+import {
+  HarnessModelProviderSchema,
+  HarnessModelSchema,
+  HarnessNameSchema,
+  HarnessSpecSchema,
+  HarnessToolSchema,
+  HarnessToolTypeSchema,
+} from '../harness';
+import { describe, expect, it } from 'vitest';
+
+describe('HarnessNameSchema', () => {
+  it.each(['MyHarness', 'a', 'Agent1', 'my_harness_01'])('accepts valid name "%s"', name => {
+    expect(HarnessNameSchema.safeParse(name).success).toBe(true);
+  });
+
+  it('accepts 48-character name (max)', () => {
+    const name = 'A' + 'b'.repeat(47);
+    expect(name).toHaveLength(48);
+    expect(HarnessNameSchema.safeParse(name).success).toBe(true);
+  });
+
+  it('rejects 49-character name', () => {
+    const name = 'A' + 'b'.repeat(48);
+    expect(name).toHaveLength(49);
+    expect(HarnessNameSchema.safeParse(name).success).toBe(false);
+  });
+
+  it('rejects empty string', () => {
+    expect(HarnessNameSchema.safeParse('').success).toBe(false);
+  });
+
+  it('rejects name starting with digit', () => {
+    expect(HarnessNameSchema.safeParse('1harness').success).toBe(false);
+  });
+
+  it('rejects name with hyphens', () => {
+    expect(HarnessNameSchema.safeParse('my-harness').success).toBe(false);
+  });
+
+  it('rejects name with spaces', () => {
+    expect(HarnessNameSchema.safeParse('my harness').success).toBe(false);
+  });
+});
+
+describe('HarnessToolTypeSchema', () => {
+  it.each(['remote_mcp', 'agentcore_browser', 'agentcore_gateway', 'inline_function', 'agentcore_code_interpreter'])(
+    'accepts "%s"',
+    type => {
+      expect(HarnessToolTypeSchema.safeParse(type).success).toBe(true);
+    }
+  );
+
+  it('rejects unknown tool type', () => {
+    expect(HarnessToolTypeSchema.safeParse('unknown_tool').success).toBe(false);
+  });
+});
+
+describe('HarnessModelProviderSchema', () => {
+  it.each(['bedrock', 'open_ai', 'gemini'])('accepts "%s"', provider => {
+    expect(HarnessModelProviderSchema.safeParse(provider).success).toBe(true);
+  });
+
+  it('rejects unknown provider', () => {
+    expect(HarnessModelProviderSchema.safeParse('azure').success).toBe(false);
+  });
+});
+
+describe('HarnessToolSchema', () => {
+  it('accepts browser tool with no config', () => {
+    const result = HarnessToolSchema.safeParse({ type: 'agentcore_browser', name: 'browser' });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts browser tool with optional browserArn', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'agentcore_browser',
+      name: 'browser',
+      config: { agentCoreBrowser: { browserArn: 'arn:aws:bedrock-agentcore:us-west-2:123:browser/abc' } },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts code interpreter tool with no config', () => {
+    const result = HarnessToolSchema.safeParse({ type: 'agentcore_code_interpreter', name: 'code-interp' });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts remote MCP tool with url', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'remote_mcp',
+      name: 'exa',
+      config: { remoteMcp: { url: 'https://mcp.exa.ai/mcp' } },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts remote MCP tool with headers', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'remote_mcp',
+      name: 'exa',
+      config: { remoteMcp: { url: 'https://mcp.exa.ai/mcp', headers: { Authorization: 'Bearer tok' } } },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts gateway tool with gatewayArn', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'agentcore_gateway',
+      name: 'my-gw',
+      config: { agentCoreGateway: { gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc' } },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts gateway tool with outboundAuth awsIam', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'agentcore_gateway',
+      name: 'my-gw',
+      config: {
+        agentCoreGateway: {
+          gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc',
+          outboundAuth: { awsIam: {} },
+        },
+      },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts gateway tool with outboundAuth none', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'agentcore_gateway',
+      name: 'my-gw',
+      config: {
+        agentCoreGateway: {
+          gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc',
+          outboundAuth: { none: {} },
+        },
+      },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts gateway tool with outboundAuth oauth', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'agentcore_gateway',
+      name: 'my-gw',
+      config: {
+        agentCoreGateway: {
+          gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc',
+          outboundAuth: {
+            oauth: {
+              providerArn:
+                'arn:aws:bedrock-agentcore:us-west-2:123:token-vault/default/oauth2credentialprovider/my-provider',
+              scopes: ['read', 'write'],
+              grantType: 'CLIENT_CREDENTIALS',
+            },
+          },
+        },
+      },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts gateway tool without outboundAuth (defaults to SigV4)', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'agentcore_gateway',
+      name: 'my-gw',
+      config: {
+        agentCoreGateway: {
+          gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc',
+        },
+      },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects gateway tool with invalid outboundAuth variant', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'agentcore_gateway',
+      name: 'my-gw',
+      config: {
+        agentCoreGateway: {
+          gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc',
+          outboundAuth: { unknownAuth: {} },
+        },
+      },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects gateway tool with credentialProviderName and shows migration message', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'agentcore_gateway',
+      name: 'my-gw',
+      config: {
+        agentCoreGateway: {
+          gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc',
+          credentialProviderName: 'my-oauth',
+        },
+      },
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues.some(i => i.message.includes('no longer supported'))).toBe(true);
+    }
+  });
+
+  it('accepts inline function tool', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'inline_function',
+      name: 'approve_purchase',
+      config: {
+        inlineFunction: {
+          description: 'Approve a purchase',
+          inputSchema: {
+            type: 'object',
+            properties: { amount: { type: 'number' } },
+            required: ['amount'],
+          },
+        },
+      },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects tool name longer than 64 chars', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'agentcore_browser',
+      name: 'a'.repeat(65),
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects tool name with invalid characters', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'agentcore_browser',
+      name: 'my tool!',
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects remote_mcp with agentCoreBrowser config', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'remote_mcp',
+      name: 'mcp-server',
+      config: { agentCoreBrowser: { browserArn: 'arn:aws:bedrock-agentcore:us-west-2:123:browser/abc' } },
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues.some(i => i.message.includes('requires "remoteMcp" config'))).toBe(true);
+    }
+  });
+
+  it('rejects agentcore_gateway without config', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'agentcore_gateway',
+      name: 'my-gw',
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues.some(i => i.message.includes('requires a "agentCoreGateway" config'))).toBe(true);
+    }
+  });
+
+  it('rejects remote_mcp without config', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'remote_mcp',
+      name: 'exa',
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects inline_function without config', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'inline_function',
+      name: 'my-func',
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects agentcore_gateway with remoteMcp config', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'agentcore_gateway',
+      name: 'my-gw',
+      config: { remoteMcp: { url: 'https://example.com' } },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects inline_function with agentCoreGateway config', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'inline_function',
+      name: 'my-func',
+      config: { agentCoreGateway: { gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc' } },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('allows agentcore_browser without config', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'agentcore_browser',
+      name: 'browser',
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('allows agentcore_code_interpreter without config', () => {
+    const result = HarnessToolSchema.safeParse({
+      type: 'agentcore_code_interpreter',
+      name: 'code-interp',
+    });
+    expect(result.success).toBe(true);
+  });
+});
+
+describe('HarnessModelSchema', () => {
+  it('accepts bedrock model with just modelId', () => {
+    const result = HarnessModelSchema.safeParse({
+      provider: 'bedrock',
+      modelId: 'us.anthropic.claude-sonnet-4-5-20250514-v1:0',
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts bedrock model with optional inference params', () => {
+    const result = HarnessModelSchema.safeParse({
+      provider: 'bedrock',
+      modelId: 'us.anthropic.claude-sonnet-4-5-20250514-v1:0',
+      temperature: 0.7,
+      topP: 0.9,
+      maxTokens: 4096,
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts open_ai model with apiKeyArn', () => {
+    const result = HarnessModelSchema.safeParse({
+      provider: 'open_ai',
+      modelId: 'gpt-4o',
+      apiKeyArn: 'arn:aws:bedrock-agentcore:us-west-2:123:apikey/abc',
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts gemini model with topK', () => {
+    const result = HarnessModelSchema.safeParse({
+      provider: 'gemini',
+      modelId: 'gemini-2.5-pro',
+      apiKeyArn: 'arn:aws:bedrock-agentcore:us-west-2:123:apikey/abc',
+      topK: 0.5,
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects temperature above 2.0', () => {
+    const result = HarnessModelSchema.safeParse({
+      provider: 'bedrock',
+      modelId: 'test',
+      temperature: 2.1,
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects temperature below 0', () => {
+    const result = HarnessModelSchema.safeParse({
+      provider: 'bedrock',
+      modelId: 'test',
+      temperature: -0.1,
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects topP above 1.0', () => {
+    const result = HarnessModelSchema.safeParse({
+      provider: 'bedrock',
+      modelId: 'test',
+      topP: 1.1,
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects maxTokens of 0', () => {
+    const result = HarnessModelSchema.safeParse({
+      provider: 'bedrock',
+      modelId: 'test',
+      maxTokens: 0,
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('requires modelId', () => {
+    const result = HarnessModelSchema.safeParse({ provider: 'bedrock' });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects topK for bedrock provider', () => {
+    const result = HarnessModelSchema.safeParse({
+      provider: 'bedrock',
+      modelId: 'us.anthropic.claude-sonnet-4-5-20250514-v1:0',
+      topK: 0.5,
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(
+        result.error.issues.some(i => i.message.includes('topK is only supported for the "gemini" provider'))
+      ).toBe(true);
+    }
+  });
+
+  it('rejects topK for open_ai provider', () => {
+    const result = HarnessModelSchema.safeParse({
+      provider: 'open_ai',
+      modelId: 'gpt-4o',
+      apiKeyArn: 'arn:aws:bedrock-agentcore:us-west-2:123:apikey/abc',
+      topK: 0.5,
+    });
+    expect(result.success).toBe(false);
+  });
+});
+
+describe('HarnessSpecSchema', () => {
+  const minimalHarness = {
+    name: 'myHarness',
+    model: {
+      provider: 'bedrock',
+      modelId: 'us.anthropic.claude-sonnet-4-5-20250514-v1:0',
+    },
+  };
+
+  it('accepts minimal harness spec', () => {
+    const result = HarnessSpecSchema.safeParse(minimalHarness);
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.tools).toEqual([]);
+      expect(result.data.skills).toEqual([]);
+    }
+  });
+
+  it('accepts harness with system prompt file path', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      systemPrompt: './system-prompt.md',
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts harness with tools', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      tools: [
+        { type: 'agentcore_browser', name: 'browser' },
+        { type: 'remote_mcp', name: 'exa', config: { remoteMcp: { url: 'https://mcp.exa.ai/mcp' } } },
+        {
+          type: 'agentcore_gateway',
+          name: 'my-gw',
+          config: { agentCoreGateway: { gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc' } },
+        },
+      ],
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects duplicate tool names', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      tools: [
+        { type: 'agentcore_browser', name: 'browser' },
+        { type: 'agentcore_code_interpreter', name: 'browser' },
+      ],
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues.some(i => i.message.includes('Duplicate tool name'))).toBe(true);
+    }
+  });
+
+  it('accepts harness with skills as string paths', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      skills: ['./skills/research', '.agents/skills/xlsx'],
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts harness with allowedTools', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      allowedTools: ['file_operations', 'browser'],
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts wildcard in allowedTools', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      allowedTools: ['*'],
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts harness with memory reference', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      memory: { name: 'research_memory' },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts harness with memory arn override', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      memory: { arn: 'arn:aws:bedrock-agentcore:us-west-2:123:memory/abc' },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts harness with execution limits', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      maxIterations: 50,
+      timeoutSeconds: 1800,
+      maxTokens: 8192,
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts harness with sliding_window truncation', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      truncation: {
+        strategy: 'sliding_window',
+        config: { slidingWindow: { messagesCount: 100 } },
+      },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts harness with summarization truncation', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      truncation: {
+        strategy: 'summarization',
+        config: { summarization: { summaryRatio: 0.3, preserveRecentMessages: 10 } },
+      },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects unknown truncation strategy', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      truncation: { strategy: 'random', config: {} },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('accepts harness with container config', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      containerUri: '123456789012.dkr.ecr.us-west-2.amazonaws.com/my-agent:latest',
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts harness with dockerfile', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      dockerfile: 'Dockerfile',
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects containerUri and dockerfile together', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      containerUri: '123456789012.dkr.ecr.us-west-2.amazonaws.com/my-agent:latest',
+      dockerfile: 'Dockerfile',
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues.some(i => i.message.includes('mutually exclusive'))).toBe(true);
+    }
+  });
+
+  it('accepts harness with VPC network config', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      networkMode: 'VPC',
+      networkConfig: {
+        subnets: ['subnet-abc12345'],
+        securityGroups: ['sg-abc12345'],
+      },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects VPC mode without networkConfig', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      networkMode: 'VPC',
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects networkConfig without VPC mode', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      networkConfig: {
+        subnets: ['subnet-abc12345'],
+        securityGroups: ['sg-abc12345'],
+      },
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('accepts harness with lifecycle config', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      lifecycleConfig: {
+        idleRuntimeSessionTimeout: 900,
+        maxLifetime: 28800,
+      },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts harness with environment variables', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      environmentVariables: { NODE_ENV: 'production', DEBUG: 'true' },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts harness with tags', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      tags: { team: 'platform', env: 'dev' },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts harness with executionRoleArn', () => {
+    const result = HarnessSpecSchema.safeParse({
+      ...minimalHarness,
+      executionRoleArn: 'arn:aws:iam::123456789012:role/MyRole',
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts fully-loaded harness spec', () => {
+    const result = HarnessSpecSchema.safeParse({
+      name: 'research_agent',
+      model: {
+        provider: 'bedrock',
+        modelId: 'us.anthropic.claude-sonnet-4-5-20250514-v1:0',
+        temperature: 0.7,
+        maxTokens: 4096,
+      },
+      systemPrompt: './system-prompt.md',
+      tools: [
+        { type: 'agentcore_browser', name: 'browser' },
+        { type: 'agentcore_code_interpreter', name: 'code_interpreter' },
+        { type: 'remote_mcp', name: 'exa', config: { remoteMcp: { url: 'https://mcp.exa.ai/mcp' } } },
+        {
+          type: 'agentcore_gateway',
+          name: 'my_gateway',
+          config: { agentCoreGateway: { gatewayArn: 'arn:aws:bedrock-agentcore:us-west-2:123:gateway/abc' } },
+        },
+        {
+          type: 'inline_function',
+          name: 'approve_purchase',
+          config: {
+            inlineFunction: {
+              description: 'Approve a purchase',
+              inputSchema: { type: 'object', properties: { amount: { type: 'number' } }, required: ['amount'] },
+            },
+          },
+        },
+      ],
+      skills: ['./skills/research'],
+      allowedTools: ['*'],
+      memory: { name: 'research_memory' },
+      maxIterations: 75,
+      timeoutSeconds: 3600,
+      maxTokens: 16384,
+      truncation: { strategy: 'sliding_window', config: { slidingWindow: { messagesCount: 150 } } },
+      lifecycleConfig: { idleRuntimeSessionTimeout: 900 },
+      networkMode: 'PUBLIC',
+      tags: { team: 'research' },
+    });
+    expect(result.success).toBe(true);
+  });
+});
diff --git a/src/schema/schemas/primitives/__tests__/http-gateway.test.ts b/src/schema/schemas/primitives/__tests__/http-gateway.test.ts
new file mode 100644
index 000000000..259fe1a21
--- /dev/null
+++ b/src/schema/schemas/primitives/__tests__/http-gateway.test.ts
@@ -0,0 +1,82 @@
+import { HttpGatewayNameSchema, HttpGatewaySchema } from '../http-gateway';
+import { describe, expect, it } from 'vitest';
+
+describe('HttpGatewayNameSchema', () => {
+  it('accepts valid name starting with letter', () => {
+    expect(HttpGatewayNameSchema.safeParse('MyGateway1').success).toBe(true);
+  });
+
+  it('accepts name with hyphens', () => {
+    expect(HttpGatewayNameSchema.safeParse('my-gateway').success).toBe(true);
+  });
+
+  it('rejects empty string', () => {
+    expect(HttpGatewayNameSchema.safeParse('').success).toBe(false);
+  });
+
+  it('rejects name starting with number', () => {
+    expect(HttpGatewayNameSchema.safeParse('1gateway').success).toBe(false);
+  });
+
+  it('rejects name with underscores', () => {
+    expect(HttpGatewayNameSchema.safeParse('my_gateway').success).toBe(false);
+  });
+
+  it('rejects name over 48 chars', () => {
+    expect(HttpGatewayNameSchema.safeParse('a'.repeat(49)).success).toBe(false);
+  });
+
+  it('accepts name at 48 chars', () => {
+    expect(HttpGatewayNameSchema.safeParse('a'.repeat(48)).success).toBe(true);
+  });
+});
+
+describe('HttpGatewaySchema', () => {
+  const validHttpGateway = {
+    name: 'MyGateway',
+    runtimeRef: 'my-runtime',
+  };
+
+  it('accepts valid HTTP gateway with required fields', () => {
+    expect(HttpGatewaySchema.safeParse(validHttpGateway).success).toBe(true);
+  });
+
+  it('accepts valid HTTP gateway with all optional fields', () => {
+    const result = HttpGatewaySchema.safeParse({
+      ...validHttpGateway,
+      description: 'A test gateway',
+      roleArn: 'arn:aws:iam::123456789012:role/MyRole',
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects missing name', () => {
+    const { name: _, ...withoutName } = validHttpGateway;
+    expect(HttpGatewaySchema.safeParse(withoutName).success).toBe(false);
+  });
+
+  it('rejects missing runtimeRef', () => {
+    const { runtimeRef: _, ...withoutRuntimeRef } = validHttpGateway;
+    expect(HttpGatewaySchema.safeParse(withoutRuntimeRef).success).toBe(false);
+  });
+
+  it('rejects name too long (>48 chars)', () => {
+    expect(HttpGatewaySchema.safeParse({ ...validHttpGateway, name: 'a'.repeat(49) }).success).toBe(false);
+  });
+
+  it('rejects name starting with number', () => {
+    expect(HttpGatewaySchema.safeParse({ ...validHttpGateway, name: '1Gateway' }).success).toBe(false);
+  });
+
+  it('rejects name with invalid characters (underscores)', () => {
+    expect(HttpGatewaySchema.safeParse({ ...validHttpGateway, name: 'my_gateway' }).success).toBe(false);
+  });
+
+  it('rejects extra unknown fields (.strict())', () => {
+    const result = HttpGatewaySchema.safeParse({
+      ...validHttpGateway,
+      unknownField: 'should fail',
+    });
+    expect(result.success).toBe(false);
+  });
+});
diff --git a/src/schema/schemas/primitives/ab-test.ts b/src/schema/schemas/primitives/ab-test.ts
new file mode 100644
index 000000000..ec04ab4f7
--- /dev/null
+++ b/src/schema/schemas/primitives/ab-test.ts
@@ -0,0 +1,147 @@
+import { z } from 'zod';
+
+// ============================================================================
+// AB Test Types
+// ============================================================================
+
+export const ABTestNameSchema = z
+  .string()
+  .min(1, 'Name is required')
+  .max(48)
+  .regex(
+    /^[a-zA-Z][a-zA-Z0-9_]{0,47}$/,
+    'Must begin with a letter and contain only alphanumeric characters and underscores (max 48 chars)'
+  );
+
+export const ABTestDescriptionSchema = z.string().min(1).max(200).optional();
+
+export const ABTestModeSchema = z.enum(['config-bundle', 'target-based']).optional().default('config-bundle');
+
+export type ABTestMode = z.infer<typeof ABTestModeSchema>;
+
+export const VariantNameSchema = z.enum(['C', 'T1']);
+
+export const VariantWeightSchema = z.number().int().min(1).max(100);
+
+// ── Config Bundle variant configuration ────────────────────────────────────
+
+export const ConfigurationBundleRefSchema = z.object({
+  bundleArn: z.string().min(1),
+  bundleVersion: z.string().min(1),
+});
+
+export type ConfigurationBundleRef = z.infer<typeof ConfigurationBundleRefSchema>;
+
+// ── Target-based variant configuration ─────────────────────────────────────
+
+export const TargetRefSchema = z.object({
+  targetName: z.string().min(1).max(100),
+});
+
+export type TargetRef = z.infer<typeof TargetRefSchema>;
+
+// ── Variant configuration union ────────────────────────────────────────────
+// Exactly one of configurationBundle or target must be set (XOR).
+
+const ConfigBundleVariantConfigSchema = z.object({
+  configurationBundle: ConfigurationBundleRefSchema,
+  target: z.never().optional(),
+});
+
+const TargetVariantConfigSchema = z.object({
+  configurationBundle: z.never().optional(),
+  target: TargetRefSchema,
+});
+
+export const VariantConfigurationSchema = z.union([ConfigBundleVariantConfigSchema, TargetVariantConfigSchema]);
+
+export type VariantConfiguration = z.infer<typeof VariantConfigurationSchema>;
+
+export const ABTestVariantSchema = z.object({
+  name: VariantNameSchema,
+  weight: VariantWeightSchema,
+  variantConfiguration: VariantConfigurationSchema,
+});
+
+export type ABTestVariant = z.infer<typeof ABTestVariantSchema>;
+
+// ── Evaluation config union ────────────────────────────────────────────────
+
+export const PerVariantOnlineEvaluationConfigSchema = z.object({
+  treatmentName: VariantNameSchema,
+  onlineEvaluationConfigArn: z.string().min(1),
+});
+
+export type PerVariantOnlineEvaluationConfig = z.infer<typeof PerVariantOnlineEvaluationConfigSchema>;
+
+export const ABTestEvaluationConfigSchema = z.union([
+  z.object({ onlineEvaluationConfigArn: z.string().min(1) }),
+  z.object({
+    perVariantOnlineEvaluationConfig: z.array(PerVariantOnlineEvaluationConfigSchema).length(2),
+  }),
+]);
+
+export type ABTestEvaluationConfig = z.infer<typeof ABTestEvaluationConfigSchema>;
+
+// ── Gateway filter ─────────────────────────────────────────────────────────
+
+export const GatewayFilterSchema = z.object({
+  targetPaths: z.array(z.string().min(1).max(500)).max(1),
+});
+
+export type GatewayFilter = z.infer<typeof GatewayFilterSchema>;
+
+// ── Traffic allocation ─────────────────────────────────────────────────────
+
+export const TrafficRouteOnHeaderSchema = z.object({
+  headerName: z.string().min(1),
+});
+
+export const TrafficAllocationConfigSchema = z.object({
+  routeOnHeader: TrafficRouteOnHeaderSchema,
+});
+
+export type TrafficAllocationConfig = z.infer<typeof TrafficAllocationConfigSchema>;
+
+// ── AB Test schema ─────────────────────────────────────────────────────────
+
+export const ABTestSchema = z
+  .object({
+    name: ABTestNameSchema,
+    description: ABTestDescriptionSchema,
+    mode: ABTestModeSchema,
+    gatewayRef: z.string().min(1),
+    roleArn: z.string().min(1).optional(),
+    variants: z.array(ABTestVariantSchema).length(2),
+    evaluationConfig: ABTestEvaluationConfigSchema,
+    gatewayFilter: GatewayFilterSchema.optional(),
+    trafficAllocationConfig: TrafficAllocationConfigSchema.optional(),
+    maxDurationDays: z.number().int().min(1).max(90).optional(),
+    enableOnCreate: z.boolean().optional(),
+    promoted: z.boolean().optional(),
+  })
+  .refine(
+    data => {
+      const names = data.variants.map(v => v.name);
+      return names.includes('C') && names.includes('T1');
+    },
+    { message: 'Variants must include exactly one control (C) and one treatment (T1)', path: ['variants'] }
+  )
+  .refine(data => data.variants.reduce((sum, v) => sum + v.weight, 0) === 100, {
+    message: 'Variant weights must sum to 100',
+    path: ['variants'],
+  })
+  .refine(
+    data => {
+      if (data.mode === 'target-based') {
+        return data.variants.every(v => v.variantConfiguration.target != null);
+      }
+      return data.variants.every(v => v.variantConfiguration.configurationBundle != null);
+    },
+    {
+      message: 'Target-based mode requires target on each variant; config-bundle mode requires configurationBundle',
+      path: ['variants'],
+    }
+  );
+
+export type ABTest = z.infer<typeof ABTestSchema>;
diff --git a/src/schema/schemas/primitives/config-bundle.ts b/src/schema/schemas/primitives/config-bundle.ts
new file mode 100644
index 000000000..06702bd3c
--- /dev/null
+++ b/src/schema/schemas/primitives/config-bundle.ts
@@ -0,0 +1,49 @@
+import { z } from 'zod';
+
+// ============================================================================
+// Configuration Bundle Types
+// ============================================================================
+
+export const ConfigBundleNameSchema = z
+  .string()
+  .min(1, 'Name is required')
+  .max(100)
+  .regex(
+    /^[a-zA-Z][a-zA-Z0-9_]{0,99}$/,
+    'Must begin with a letter and contain only alphanumeric characters and underscores (max 100 chars)'
+  );
+
+export const ConfigBundleDescriptionSchema = z.string().min(1).max(500).optional();
+
+/** Freeform configuration for a single component within a bundle. */
+export const ComponentConfigurationSchema = z.object({
+  configuration: z.record(z.string(), z.unknown()),
+});
+
+export type ComponentConfiguration = z.infer<typeof ComponentConfigurationSchema>;
+
+/**
+ * Map of component identifier (ARN or placeholder) to its configuration.
+ *
+ * Keys are typically resource ARNs (runtime ARN, gateway ARN) but may use
+ * placeholder tokens like `{{runtime:<runtimeName>}}` when the bundle is created
+ * before deploy and ARNs are not yet available.
+ */
+export const ComponentConfigurationMapSchema = z.record(z.string(), ComponentConfigurationSchema);
+
+export type ComponentConfigurationMap = z.infer<typeof ComponentConfigurationMapSchema>;
+
+export const ConfigBundleSchema = z.object({
+  name: ConfigBundleNameSchema,
+  /** Discriminator required by the CDK package's schema validation. */
+  type: z.literal('ConfigurationBundle').default('ConfigurationBundle'),
+  description: ConfigBundleDescriptionSchema,
+  /** Component configurations keyed by component ARN or placeholder. */
+  components: ComponentConfigurationMapSchema,
+  /** Optional branch name for versioning. */
+  branchName: z.string().max(128).optional(),
+  /** Optional commit message for this version. */
+  commitMessage: z.string().max(500).optional(),
+});
+
+export type ConfigBundle = z.infer<typeof ConfigBundleSchema>;
diff --git a/src/schema/schemas/primitives/harness.ts b/src/schema/schemas/primitives/harness.ts
new file mode 100644
index 000000000..823d75d82
--- /dev/null
+++ b/src/schema/schemas/primitives/harness.ts
@@ -0,0 +1,315 @@
+import { NetworkModeSchema } from '../../constants';
+import { NetworkConfigSchema } from '../agent-env';
+import { LifecycleConfigurationSchema } from '../agent-env';
+import { AuthorizerConfigSchema, RuntimeAuthorizerTypeSchema } from '../auth';
+import { uniqueBy } from '../zod-util';
+import { TagsSchema } from './tags';
+import { z } from 'zod';
+
+// ============================================================================
+// Harness Name
+// ============================================================================
+
+export const HarnessNameSchema = z
+  .string()
+  .min(1, 'Harness name is required')
+  .max(48)
+  .regex(
+    /^[a-zA-Z][a-zA-Z0-9_]{0,47}$/,
+    'Must begin with a letter and contain only alphanumeric characters and underscores (max 48 chars)'
+  );
+
+// ============================================================================
+// Model Configuration
+// ============================================================================
+
+export const HarnessModelProviderSchema = z.enum(['bedrock', 'open_ai', 'gemini']);
+export type HarnessModelProvider = z.infer<typeof HarnessModelProviderSchema>;
+
+export const HarnessModelSchema = z
+  .object({
+    provider: HarnessModelProviderSchema,
+    modelId: z.string().min(1, 'Model ID is required'),
+    apiKeyArn: z.string().optional(),
+    temperature: z.number().min(0).max(2).optional(),
+    topP: z.number().min(0).max(1).optional(),
+    topK: z.number().min(0).max(1).optional(),
+    maxTokens: z.number().int().min(1).optional(),
+  })
+  .superRefine((model, ctx) => {
+    if (model.topK !== undefined && model.provider !== 'gemini') {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'topK is only supported for the "gemini" provider',
+        path: ['topK'],
+      });
+    }
+  });
+
+export type HarnessModel = z.infer<typeof HarnessModelSchema>;
+
+// ============================================================================
+// Tool Configuration
+// ============================================================================
+
+export const HarnessToolTypeSchema = z.enum([
+  'remote_mcp',
+  'agentcore_browser',
+  'agentcore_gateway',
+  'inline_function',
+  'agentcore_code_interpreter',
+]);
+export type HarnessToolType = z.infer<typeof HarnessToolTypeSchema>;
+
+export const HarnessToolNameSchema = z
+  .string()
+  .min(1)
+  .max(64)
+  .regex(
+    /^[a-zA-Z0-9_-]+$/,
+    'Tool name must contain only alphanumeric characters, hyphens, and underscores (1-64 chars)'
+  );
+
+export const RemoteMcpConfigSchema = z.object({
+  remoteMcp: z.object({
+    url: z.string().min(1),
+    headers: z.record(z.string(), z.string()).optional(),
+  }),
+});
+
+export const AgentCoreBrowserConfigSchema = z.object({
+  agentCoreBrowser: z.object({
+    browserArn: z.string().optional(),
+  }),
+});
+
+export const AgentCoreCodeInterpreterConfigSchema = z.object({
+  agentCoreCodeInterpreter: z.object({
+    codeInterpreterArn: z.string().optional(),
+  }),
+});
+
+export const GatewayOAuthGrantTypeSchema = z.enum(['CLIENT_CREDENTIALS', 'USER_FEDERATION']);
+
+export const HarnessGatewayOutboundAuthSchema = z.union([
+  z.object({ awsIam: z.object({}) }),
+  z.object({ none: z.object({}) }),
+  z.object({
+    oauth: z.object({
+      providerArn: z.string().min(1),
+      scopes: z.array(z.string().min(1)),
+      grantType: GatewayOAuthGrantTypeSchema.optional(),
+      customParameters: z.record(z.string(), z.string()).optional(),
+    }),
+  }),
+]);
+
+export type HarnessGatewayOutboundAuth = z.infer<typeof HarnessGatewayOutboundAuthSchema>;
+
+export const AgentCoreGatewayConfigSchema = z.object({
+  agentCoreGateway: z
+    .object({
+      gatewayArn: z.string().min(1),
+      outboundAuth: HarnessGatewayOutboundAuthSchema.optional(),
+    })
+    .passthrough()
+    .superRefine((data, ctx) => {
+      if ('credentialProviderName' in data) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message:
+            'credentialProviderName is no longer supported. Use outboundAuth instead. Example: outboundAuth: { awsIam: {} } or outboundAuth: { oauth: { providerArn: "...", scopes: [...] } }',
+          path: ['credentialProviderName'],
+        });
+      }
+    }),
+});
+
+export const InlineFunctionConfigSchema = z.object({
+  inlineFunction: z.object({
+    description: z.string().min(1),
+    inputSchema: z.record(z.string(), z.unknown()),
+  }),
+});
+
+export const HarnessToolConfigSchema = z.union([
+  RemoteMcpConfigSchema,
+  AgentCoreBrowserConfigSchema,
+  AgentCoreCodeInterpreterConfigSchema,
+  AgentCoreGatewayConfigSchema,
+  InlineFunctionConfigSchema,
+]);
+
+const TOOL_TYPE_TO_CONFIG_KEY: Record<HarnessToolType, string> = {
+  remote_mcp: 'remoteMcp',
+  agentcore_browser: 'agentCoreBrowser',
+  agentcore_gateway: 'agentCoreGateway',
+  inline_function: 'inlineFunction',
+  agentcore_code_interpreter: 'agentCoreCodeInterpreter',
+};
+
+const TOOL_TYPES_REQUIRING_CONFIG = new Set<HarnessToolType>(['remote_mcp', 'agentcore_gateway', 'inline_function']);
+
+export const HarnessToolSchema = z
+  .object({
+    type: HarnessToolTypeSchema,
+    name: HarnessToolNameSchema,
+    config: HarnessToolConfigSchema.optional(),
+  })
+  .superRefine((tool, ctx) => {
+    const expectedKey = TOOL_TYPE_TO_CONFIG_KEY[tool.type];
+
+    if (!tool.config) {
+      if (TOOL_TYPES_REQUIRING_CONFIG.has(tool.type)) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: `Tool type "${tool.type}" requires a "${expectedKey}" config`,
+          path: ['config'],
+        });
+      }
+      return;
+    }
+
+    const configKeys = Object.keys(tool.config);
+    if (configKeys.length !== 1 || configKeys[0] !== expectedKey) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: `Tool type "${tool.type}" requires "${expectedKey}" config, got "${configKeys[0]}"`,
+        path: ['config'],
+      });
+    }
+  });
+
+export type HarnessTool = z.infer<typeof HarnessToolSchema>;
+
+// ============================================================================
+// Memory Reference
+// ============================================================================
+
+export const HarnessMemoryRefSchema = z.object({
+  name: z.string().min(1).optional(),
+  arn: z.string().min(1).optional(),
+  actorId: z.string().optional(),
+});
+
+export type HarnessMemoryRef = z.infer<typeof HarnessMemoryRefSchema>;
+
+// ============================================================================
+// Truncation Configuration
+// ============================================================================
+
+export const HarnessTruncationStrategySchema = z.enum(['sliding_window', 'summarization']);
+
+export const SlidingWindowConfigSchema = z.object({
+  slidingWindow: z.object({
+    messagesCount: z.number().int().min(1).optional(),
+  }),
+});
+
+export const SummarizationConfigSchema = z.object({
+  summarization: z.object({
+    summaryRatio: z.number().min(0).max(1).optional(),
+    preserveRecentMessages: z.number().int().min(0).optional(),
+    summarizationSystemPrompt: z.string().optional(),
+  }),
+});
+
+export const HarnessTruncationConfigSchema = z.object({
+  strategy: HarnessTruncationStrategySchema,
+  config: z.union([SlidingWindowConfigSchema, SummarizationConfigSchema]).optional(),
+});
+
+export type HarnessTruncationConfig = z.infer<typeof HarnessTruncationConfigSchema>;
+
+// ============================================================================
+// Allowed Tools
+// ============================================================================
+
+export const AllowedToolSchema = z
+  .string()
+  .min(1)
+  .max(64)
+  .regex(/^(\*|@?[^/]+(\/[^/]+)?)$/, 'Must be "*" or a tool name pattern (max 64 chars)');
+
+// ============================================================================
+// HarnessSpec — per-harness config file schema (harness.json)
+// ============================================================================
+
+export const HarnessSpecSchema = z
+  .object({
+    name: HarnessNameSchema,
+    model: HarnessModelSchema,
+    systemPrompt: z.string().optional(),
+    tools: z
+      .array(HarnessToolSchema)
+      .default([])
+      .superRefine(
+        uniqueBy(
+          tool => tool.name,
+          name => `Duplicate tool name: ${name}`
+        )
+      ),
+    skills: z.array(z.string().min(1)).default([]),
+    allowedTools: z.array(AllowedToolSchema).optional(),
+    memory: HarnessMemoryRefSchema.optional(),
+    maxIterations: z.number().int().min(1).optional(),
+    maxTokens: z.number().int().min(1).optional(),
+    timeoutSeconds: z.number().int().min(1).optional(),
+    truncation: HarnessTruncationConfigSchema.optional(),
+    containerUri: z.string().min(1).optional(),
+    dockerfile: z.string().min(1).optional(),
+    executionRoleArn: z.string().optional(),
+    networkMode: NetworkModeSchema.optional(),
+    networkConfig: NetworkConfigSchema.optional(),
+    lifecycleConfig: LifecycleConfigurationSchema.optional(),
+    sessionStoragePath: z
+      .string()
+      .min(1)
+      .refine(val => val.startsWith('/mnt/'), { message: 'sessionStoragePath must be an absolute path under /mnt/' })
+      .optional(),
+    environmentVariables: z.record(z.string(), z.string()).optional(),
+    /** Authorizer type for inbound requests. Defaults to AWS_IAM. */
+    authorizerType: RuntimeAuthorizerTypeSchema.optional(),
+    /** Authorizer configuration. Required when authorizerType is CUSTOM_JWT. */
+    authorizerConfiguration: AuthorizerConfigSchema.optional(),
+    tags: TagsSchema.optional(),
+  })
+  .superRefine((data, ctx) => {
+    if (data.containerUri !== undefined && data.dockerfile !== undefined) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'containerUri and dockerfile are mutually exclusive',
+        path: ['containerUri'],
+      });
+    }
+    if (data.networkMode === 'VPC' && !data.networkConfig) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'networkConfig is required when networkMode is VPC',
+        path: ['networkConfig'],
+      });
+    }
+    if (data.networkMode !== 'VPC' && data.networkConfig) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'networkConfig is only allowed when networkMode is VPC',
+        path: ['networkConfig'],
+      });
+    }
+    if (data.authorizerType === 'CUSTOM_JWT' && !data.authorizerConfiguration?.customJwtAuthorizer) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'authorizerConfiguration with customJwtAuthorizer is required when authorizerType is CUSTOM_JWT',
+        path: ['authorizerConfiguration'],
+      });
+    }
+    if (data.authorizerType !== 'CUSTOM_JWT' && data.authorizerConfiguration) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'authorizerConfiguration is only allowed when authorizerType is CUSTOM_JWT',
+        path: ['authorizerConfiguration'],
+      });
+    }
+  });
+
+export type HarnessSpec = z.infer<typeof HarnessSpecSchema>;
diff --git a/src/schema/schemas/primitives/http-gateway.ts b/src/schema/schemas/primitives/http-gateway.ts
new file mode 100644
index 000000000..f40505b5f
--- /dev/null
+++ b/src/schema/schemas/primitives/http-gateway.ts
@@ -0,0 +1,42 @@
+import { z } from 'zod';
+
+// ============================================================================
+// HTTP Gateway Types
+// ============================================================================
+
+export const HttpGatewayNameSchema = z
+  .string()
+  .min(1, 'Name is required')
+  .max(48)
+  .regex(
+    /^[a-zA-Z][a-zA-Z0-9-]{0,47}$/,
+    'Must begin with a letter and contain only alphanumeric characters and hyphens (max 48 chars)'
+  );
+
+export const HttpGatewayTargetSchema = z.object({
+  /** Gateway target name (referenced by AB test variants) */
+  name: z.string().min(1).max(100),
+  /** Reference to a runtime name from spec.runtimes */
+  runtimeRef: z.string().min(1),
+  /** Endpoint qualifier on the runtime (e.g., 'prod', 'staging'). Defaults to 'DEFAULT'. */
+  qualifier: z.string().min(1).default('DEFAULT'),
+});
+
+export type HttpGatewayTarget = z.infer<typeof HttpGatewayTargetSchema>;
+
+export const HttpGatewaySchema = z
+  .object({
+    /** Unique name for the HTTP gateway */
+    name: HttpGatewayNameSchema,
+    /** Optional description */
+    description: z.string().min(1).max(200).optional(),
+    /** Reference to a runtime name from spec.runtimes. One target is created per gateway pointing to this runtime. */
+    runtimeRef: z.string().min(1),
+    /** IAM role ARN for gateway execution. Auto-created if omitted. */
+    roleArn: z.string().min(1).optional(),
+    /** Additional targets for the gateway (for target-based AB testing). */
+    targets: z.array(HttpGatewayTargetSchema).optional(),
+  })
+  .strict();
+
+export type HttpGateway = z.infer<typeof HttpGatewaySchema>;
diff --git a/src/schema/schemas/primitives/index.ts b/src/schema/schemas/primitives/index.ts
index e14a0f248..0a3c808cf 100644
--- a/src/schema/schemas/primitives/index.ts
+++ b/src/schema/schemas/primitives/index.ts
@@ -1,3 +1,24 @@
+export type {
+  ABTest,
+  ABTestVariant,
+  ABTestEvaluationConfig,
+  ConfigurationBundleRef,
+  TrafficAllocationConfig,
+  VariantConfiguration,
+} from './ab-test';
+export {
+  ABTestNameSchema,
+  ABTestDescriptionSchema,
+  ABTestSchema,
+  ABTestVariantSchema,
+  ABTestEvaluationConfigSchema,
+  ConfigurationBundleRefSchema,
+  TrafficAllocationConfigSchema,
+  VariantConfigurationSchema,
+  VariantNameSchema,
+  VariantWeightSchema,
+} from './ab-test';
+
 export type { MemoryStrategy, MemoryStrategyType } from './memory';
 export {
   DEFAULT_EPISODIC_REFLECTION_NAMESPACES,
@@ -44,3 +65,33 @@ export {
   PolicySchema,
   ValidationModeSchema,
 } from './policy';
+
+export type {
+  HarnessGatewayOutboundAuth,
+  HarnessMemoryRef,
+  HarnessModel,
+  HarnessModelProvider,
+  HarnessSpec,
+  HarnessTool,
+  HarnessToolType,
+  HarnessTruncationConfig,
+} from './harness';
+export {
+  AllowedToolSchema,
+  GatewayOAuthGrantTypeSchema,
+  HarnessGatewayOutboundAuthSchema,
+  HarnessMemoryRefSchema,
+  HarnessModelProviderSchema,
+  HarnessModelSchema,
+  HarnessNameSchema,
+  HarnessSpecSchema,
+  HarnessToolConfigSchema,
+  HarnessToolNameSchema,
+  HarnessToolSchema,
+  HarnessToolTypeSchema,
+  HarnessTruncationConfigSchema,
+  HarnessTruncationStrategySchema,
+} from './harness';
+
+export type { HttpGateway } from './http-gateway';
+export { HttpGatewayNameSchema, HttpGatewaySchema } from './http-gateway';
diff --git a/src/schema/schemas/primitives/online-eval-config.ts b/src/schema/schemas/primitives/online-eval-config.ts
index 6dbc0787f..5b6f13cb6 100644
--- a/src/schema/schemas/primitives/online-eval-config.ts
+++ b/src/schema/schemas/primitives/online-eval-config.ts
@@ -18,6 +18,8 @@ export const OnlineEvalConfigSchema = z.object({
   name: OnlineEvalConfigNameSchema,
   /** Agent name to monitor (must match a project agent) */
   agent: z.string().min(1, 'Agent name is required'),
+  /** Optional runtime endpoint name to scope monitoring to a specific endpoint */
+  endpoint: z.string().min(1).optional(),
   /** Evaluator names (custom), Builtin.* IDs, or evaluator ARNs */
   evaluators: z.array(z.string().min(1)).min(1, 'At least one evaluator is required'),
   /** Sampling rate as a percentage (0.01 to 100) */
diff --git a/src/test-utils/cli-runner.ts b/src/test-utils/cli-runner.ts
index 789624364..4526546c5 100644
--- a/src/test-utils/cli-runner.ts
+++ b/src/test-utils/cli-runner.ts
@@ -72,6 +72,14 @@ function getCLIPath(): string {
  * Run the AgentCore CLI via the local build (unit/integ tests).
  * Skips dependency installation by default for speed.
  */
-export async function runCLI(args: string[], cwd: string, skipInstall = true): Promise<RunResult> {
-  return spawnAndCollect('node', [getCLIPath(), ...args], cwd, skipInstall ? { AGENTCORE_SKIP_INSTALL: '1' } : {});
+export async function runCLI(
+  args: string[],
+  cwd: string,
+  options: { skipInstall?: boolean; env?: Record<string, string> } = {}
+): Promise<RunResult> {
+  const { skipInstall = true, env } = options;
+  return spawnAndCollect('node', [getCLIPath(), ...args], cwd, {
+    ...(skipInstall ? { AGENTCORE_SKIP_INSTALL: '1' } : {}),
+    ...env,
+  });
 }
diff --git a/src/test-utils/index.ts b/src/test-utils/index.ts
index ff127a35e..2920b822a 100644
--- a/src/test-utils/index.ts
+++ b/src/test-utils/index.ts
@@ -2,13 +2,33 @@
  * Shared test utilities for AgentCore CLI tests.
  * Import these helpers instead of duplicating code in each test file.
  */
+import { runCLI as runCLIImpl } from './cli-runner.js';
+import { expect } from 'vitest';
 
 export { runCLI, spawnAndCollect, cleanSpawnEnv, type RunResult } from './cli-runner.js';
+export { createTelemetryHelper, type TelemetryHelper, type TelemetryEntry } from './telemetry-helper.js';
 export { exists } from './fs-helpers.js';
 export { hasCommand, hasAwsCredentials, prereqs } from './prereqs.js';
 export { createTestProject, type TestProject, type CreateTestProjectOptions } from './project-factory.js';
 export { readProjectConfig } from './config-reader.js';
 
+export async function runSuccess(args: string[], cwd: string): Promise<Record<string, unknown>> {
+  const result = await runCLIImpl(args, cwd);
+  expect(result.exitCode, `stdout: ${result.stdout}, stderr: ${result.stderr}`).toBe(0);
+  const json: unknown = parseJsonOutput(result.stdout);
+  expect(json).toHaveProperty('success', true);
+  return json as Record<string, unknown>;
+}
+
+export async function runFailure(args: string[], cwd: string): Promise<Record<string, unknown>> {
+  const result = await runCLIImpl(args, cwd);
+  expect(result.exitCode).toBe(1);
+  const json: unknown = parseJsonOutput(result.stdout);
+  expect(json).toHaveProperty('success', false);
+  expect(json).toHaveProperty('error');
+  return json as Record<string, unknown>;
+}
+
 /**
  * Retry an async function up to `times` attempts with a delay between retries.
  */
diff --git a/src/test-utils/project-factory.ts b/src/test-utils/project-factory.ts
index 77c77e1c6..61525f6c5 100644
--- a/src/test-utils/project-factory.ts
+++ b/src/test-utils/project-factory.ts
@@ -65,7 +65,7 @@ export async function createTestProject(options: CreateTestProjectOptions = {}):
 
   args.push('--json');
 
-  const result = await runCLI(args, testDir, skipInstall);
+  const result = await runCLI(args, testDir, { skipInstall });
 
   if (result.exitCode !== 0) {
     // Clean up on failure
diff --git a/src/test-utils/telemetry-helper.ts b/src/test-utils/telemetry-helper.ts
new file mode 100644
index 000000000..e7fa58949
--- /dev/null
+++ b/src/test-utils/telemetry-helper.ts
@@ -0,0 +1,56 @@
+import { globSync } from 'glob';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { expect } from 'vitest';
+
+export interface TelemetryEntry {
+  value: number;
+  attrs: Record<string, string | number>;
+}
+
+export interface TelemetryHelper {
+  /** Temp directory used as AGENTCORE_CONFIG_DIR */
+  dir: string;
+  /** Env vars to pass to runCLI to enable audit mode */
+  env: { AGENTCORE_TELEMETRY_AUDIT: '1'; AGENTCORE_CONFIG_DIR: string };
+  /** Read all JSONL entries from the audit telemetry directory */
+  readEntries: () => TelemetryEntry[];
+  /** Assert a metric was emitted with attrs matching the given subset */
+  assertMetricEmitted: (expected: Record<string, string | number | boolean>) => void;
+  /** Delete telemetry entries only (keeps the config dir) */
+  clearEntries: () => void;
+  /** Delete the entire config directory — call in afterAll */
+  destroy: () => void;
+}
+
+export function createTelemetryHelper(): TelemetryHelper {
+  const dir = mkdtempSync(join(tmpdir(), 'agentcore-audit-'));
+  const helper: TelemetryHelper = {
+    dir,
+    env: { AGENTCORE_TELEMETRY_AUDIT: '1', AGENTCORE_CONFIG_DIR: dir },
+    readEntries() {
+      return globSync(join(dir, 'telemetry', '*.json')).flatMap(f =>
+        readFileSync(f, 'utf-8')
+          .trim()
+          .split('\n')
+          .map(line => JSON.parse(line) as TelemetryEntry)
+      );
+    },
+    assertMetricEmitted(expected) {
+      const entries = helper.readEntries();
+      const match = entries.find(e => Object.entries(expected).every(([k, v]) => String(e.attrs[k]) === String(v)));
+      expect(
+        match,
+        `No telemetry entry matching ${JSON.stringify(expected)}\nFound ${entries.length} entries:\n${entries.map(e => JSON.stringify(e.attrs)).join('\n')}`
+      ).toBeDefined();
+    },
+    clearEntries() {
+      rmSync(join(dir, 'telemetry'), { recursive: true, force: true });
+    },
+    destroy() {
+      rmSync(dir, { recursive: true, force: true });
+    },
+  };
+  return helper;
+}