chore(harness): declare provider workers as direct dependencies

[ytallo]

Summary

• Update harness/iii.worker.yaml to depend directly on provider-anthropic and provider-openai (^1.0.0) instead of llm-router, so the harness bundle pulls in the provider workers explicitly.
• Document the llm-router security model in llm-router/README.md: clarify which router functions are agent-callable vs worker-only, and align trigger registration examples with :: function IDs.

Test plan

• Verify harness bundle resolves and boots with the updated dependency graph
• Confirm provider workers are present in the bundled deployment without a separate llm-router dependency entry
• Spot-check llm-router README security section for accuracy against iii-permissions.yaml

Summary by CodeRabbit

• Documentation

  • Expanded security documentation to clarify the agent access control model, specifying which router and provider operations are available versus restricted for in-run agents, with improved code examples.

• Chores

  • Updated service configuration to support new provider integrations while optimizing the dependency graph.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
workers	Ready	Preview, Comment	Jun 18, 2026 7:44pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: cc621fd1-9ffb-4a98-8930-009873f8b303

📥 Commits

Reviewing files that changed from the base of the PR and between 64c1dad and 7d172c4.

📒 Files selected for processing (2)

• harness/iii.worker.yaml
• llm-router/README.md

---

📝 Walkthrough

Walkthrough

harness/iii.worker.yaml swaps the llm-router dependency for direct provider-anthropic and provider-openai entries. llm-router/README.md adds a Security model section describing which router APIs are agent-callable vs denied, and corrects a iii.registerFunction example to use a string id.

Changes

Router security docs and harness wiring

Layer / File(s)	Summary
Harness dependency wiring harness/iii.worker.yaml	Adds provider-anthropic and provider-openai under dependencies; removes the llm-router entry while retaining approval-gate.
llm-router security model and API docs llm-router/README.md	Adds an inline agent-callable note at the read-surface description, replaces the prior restriction note with a dedicated Security model section (allowed: model catalog and provider list; denied: chat/spend surface, provider credential/protocol calls, direct provider::*; worker-to-worker calls bypass the gate), and changes the Events example iii.registerFunction call from object form to a direct string id.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~4 minutes

Possibly related PRs

• iii-hq/workers#134: Also modifies harness/iii.worker.yaml dependencies wiring, changing LLM/provider and router-related dep declarations.
• iii-hq/workers#258: Updates provider-anthropic worker configuration and agent/provider permission model, directly overlapping with the provider wiring added here.
• iii-hq/workers#288: Adjusts harness dependencies to include llm-router and approval-gate, the inverse of the llm-router removal in this PR.

Suggested reviewers

• sergiofilhowz
• andersonleal

Poem

🐇 Hoppity-hop through the router gate,
Providers now listed — no middleman's weight!
The agent may peek at the models in store,
But chat and credentials? They're blocked at the door.
Worker-to-worker can bypass the gate,
The README explains it — isn't that great? 🌟

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: declaring provider workers as direct dependencies in the harness configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/harness-dep

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

skill-check — worker

0 verified, 22 skipped (no docs/).

Layer	Result
structure	✓
vale	✓
ai	✓
render	✓

Four for four. Nicely done.