diff --git a/docs/turn-loop.md b/docs/turn-loop.md
index 04f4a15e..d6e987b7 100644
--- a/docs/turn-loop.md
+++ b/docs/turn-loop.md
@@ -616,6 +616,17 @@ at_unix_timestamp?)`, `request_next_turn()`.
 - **Scheduling + diagnostics** (`scheduling`, `diagnostics`) —
   scheduled prompts, `get_logs`. See
   [`docs/tools/scheduling.md`](tools/scheduling.md).
+- **Forge repos** (`forge`) — `create_repo` — the only agent path to
+  create a repo under the `agents/` org (direct forge token creation is
+  disabled for agents). The repo is created in the c0re-owned `agents`
+  org; the calling agent gets write collaborator access; the default
+  branch is branch-protected (operator-team must approve merges, so the
+  agent cannot self-merge). Opt-in; not in any default preset.
+  See [`docs/tools/forge.md — Repo management`](tools/forge.md).
+- **Web egress** (`web_tools`) — enables Claude's built-in `WebFetch`
+  and `WebSearch` tools (not MCP tools; added directly to the
+  `--allowedTools` list). Off by default; add the group in the
+  P3RM1SS10NS tab and rebuild to enable.
 - **Capability-gated** — `get_host_journal` (requires
   `read_host_journal` capability set via the P3RM1SS10NS tab;
   orthogonal to tool groups). Full list of capabilities and their