@kontextmind/kxm 0.7.111 → 0.7.115

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.111",
+      "version": "0.7.115",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/.kxm/agents/implementer.yaml

@@ -3,7 +3,7 @@ purpose: Implement the approved change within the declared repository scope.
 harness: grok
 model:
   provider: xai
-  model: grok-4.6
+  model: grok-4.7
 tools:
   preset: workspace-writer
 defaultRepositoryAccess: none

package/.kxm/roles/writer.yaml

@@ -5,7 +5,7 @@ id: writer
 # Effort default: medium for implementation (AGENTS.md). agy ids bake in the
 # effort tier, so those entries carry no effort field.
 roster:
-  - model: xai/grok-4.6
+  - model: xai/grok-4.7
     effort: medium
     enabled: true
   - model: openrouter/qwen/qwen3-coder-plus

package/CHANGELOG.md

@@ -81,6 +81,12 @@ All notable user-facing changes are documented here. The project follows [Semant
 
 ### Changed
 
+- **Windows Validate legs run again on GitHub-hosted `windows-latest`.** The PR gate
+  still requires only `Validate (linux, Node 22.19.0)` and `Validate (linux, Node 24)`
+  on ARC `kontextmind-doks`. Windows Node 22.19.0 and 24 report `validate:pr` but are
+  not protect-main required checks. Nightly complete coverage and release stay on
+  Linux. See [CI and release](docs/contributing/ci-and-release.md).
+
 - **The rotation surface drive uses is the one setup writes.** Guide setup appends only
   reviewed selectors to `.kxm/routes.yaml`. It skips Google guide candidates: Google's
   route is the Pi `antigravity` provider, which a Runtime drive cannot reach yet, so a

package/docs/contributing/assignment-runner.md

@@ -33,7 +33,7 @@ permissions:
 
 | Role | Admitted route (harness / model) | Vendor | Permission |
 |---|---|---|---|
-| `writer` | `grok` / `grok-4.6`; relief: `pi` / `openrouter/qwen/qwen3-coder-plus` | `xai`; `alibaba` | `edit` |
+| `writer` | `grok` / `grok-4.7`; relief: `pi` / `openrouter/qwen/qwen3-coder-plus` | `xai`; `alibaba` | `edit` |
 | `planner` | `claude` / `fable` | `anthropic` | `read-only` |
 | `reviewer-arch` | `claude` / `fable` | `anthropic` | `read-only` |
 | `reviewer-cli` | `codex` / `gpt-5.6-sol` | `openai` | `read-only` |
@@ -115,7 +115,7 @@ Write a closed `kxm.assignment.v1` manifest. Unknown keys are refused.
   "assignment_id": "asg-writer-1",
   "kind": "implement",
   "harness": "grok",
-  "model": "grok-4.6",
+  "model": "grok-4.7",
   "effort": "medium",
   "permission": "edit",
   "cwd": "/abs/kxm-fix-improve-sources",
@@ -247,7 +247,7 @@ then is that `BLOCK` resolved.
     ├── output-schema.json   # the structured-output schema given to the harness
     ├── pre-dispatch.json    # written before spawn (kxm.assignment-dispatch.v1)
     ├── completion.json      # kxm.assignment-completion.v1, or refusal.json
-    ├── routing-record.json  # read by kxm routing report
+    ├── routing-record.json  # export with `node scripts/assignment-run.mjs routing-export --task-dir <abs>` and pass the JSONL to `kxm improve report --file` / `kxm routing report --file`
     ├── telemetry.jsonl      # usage, latency and cost
     ├── runner-errors.jsonl  # bounded failure codes
     ├── witness/             # latest.json and history/<receipt-id>.json

package/docs/contributing/ci-and-release.md

@@ -24,10 +24,11 @@ flowchart LR
   MAIN -->|"daily 04:00 UTC"| NIGHT[Nightly<br/>complete suite]
 ```
 
-All workflows live in `.github/workflows/`. Every job runs on the organization's
-ARC runner scale set, and `test/core/ci-contract.test.ts` pins the
-runner selector, job names, coverage floors and release triggers. Change a
-workflow and that test together.
+All workflows live in `.github/workflows/`. Linux jobs run on the organization's
+ARC runner scale set. Validate also runs two Windows legs on GitHub-hosted
+`windows-latest`. `test/core/ci-contract.test.ts` pins the runner selectors, job
+names, coverage floors and release triggers. Change a workflow and that test
+together.
 
 ## What runs where
 
@@ -64,11 +65,14 @@ Three differences matter when a check fails on one side only:
 
 ### Validate matrix and required checks
 
-The Validate job runs on Node 22.19.0 and Node 24, on Linux, with a
-three-minute job timeout. The branch ruleset
-requires the job names `Validate (linux, Node 22.19.0)` and
-`Validate (linux, Node 24)`, so renaming the job or the matrix means updating
-the ruleset in the same change. A newer push cancels an older pull request run;
+The Validate job runs on Node 22.19.0 and Node 24, on Linux and Windows. Linux
+uses the ARC scale set `kontextmind-doks` with a three-minute job timeout.
+Windows uses GitHub-hosted `windows-latest` with a fifteen-minute timeout so
+`npm ci` can finish. The branch ruleset requires the job names
+`Validate (linux, Node 22.19.0)` and `Validate (linux, Node 24)` only; the
+Windows names are reported but not required, so a Windows-only failure does not
+block merge. Renaming a required Linux job or the matrix means updating the
+ruleset in the same change. A newer push cancels an older pull request run;
 runs on `main` are never cancelled.
 
 ### CI jobs stay queued while a runner is online
@@ -106,9 +110,11 @@ autoscaler. Do not relabel `km-gh-rn01` or push an empty commit as a routing
 workaround.
 
 > [!NOTE]
-> Windows legs are paused, not removed. Windows stays a supported target, and
-> Windows-specific fixtures (for example the `pi.cmd` worker launch in
-> `test/core/worker.test.ts`) run when you test on Windows locally.
+> Windows Validate uses GitHub-hosted `windows-latest`, not a self-hosted
+> homelab runner and not the ARC scale set. Do not add a `kontextmind-doks`
+> label to a Windows runner. Nightly complete coverage and release stay on
+> Linux. Windows-specific fixtures (for example the `pi.cmd` worker launch in
+> `test/core/worker.test.ts`) also run in the hosted Windows Validate legs.
 
 ### The docs-only classifier
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.111",
+  "version": "0.7.115",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.111",
+  "version": "0.7.115",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/mcp-server.js

@@ -17313,7 +17313,7 @@ function sessionTokenFixHint(policy) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.111";
+var VERSION = "0.7.115";
 var CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.111",
+  "version": "0.7.115",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/src/mcp-server.ts

@@ -11,7 +11,7 @@ import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 import { sessionTokenFixHint } from "./session-token-hint.ts";
 
-const VERSION = "0.7.111";
+const VERSION = "0.7.115";
 const CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();

package/scripts/assignment-run.d.mts

@@ -339,6 +339,13 @@ export function changeReport(request: { taskDir: string }, deps?: Record<string,
   ranking: "not-ranked";
   orchestration_usage: "unavailable";
 };
+export const ROUTING_EXPORT_SCHEMA: "kxm.assignment-routing-export.v1";
+export function exportAssignmentRoutingRecords(request: { taskDir: string }, deps?: Record<string, unknown>): {
+  schema: "kxm.assignment-routing-export.v1";
+  task_id: string;
+  records: Array<Record<string, any>>;
+  skipped: Array<{ assignment_id: string | null; reason: "acceptance_record_invalid" | "no_routing_record" | "routing_record_invalid" | "manifest_invalid" }>;
+};
 export function writeCurrentPlan(request: {
   taskDir: string; plan: string; sha256: string; baseCommit: string; expectedGeneration: number; settledDecisions?: string[];
 }, deps?: Record<string, unknown>): {

package/scripts/assignment-run.mjs

@@ -2330,7 +2330,7 @@ export async function observeAssignment(outputDir, deps = {}) {
   return appended;
 }
 
-const CLI_USAGE = "usage: assignment-run.mjs run --manifest <absolute-path> | observe --record-dir <absolute-path> | witness --record-dir <absolute-path> | accept --task-dir <absolute-path> --commit <commit> --record-dir <absolute-path> --critic <absolute-path> --critic <absolute-path> [--observed-pr <id>] [--observed-ci <id>] | attribute --task-dir <absolute-path> --record-dir <absolute-path> --class <orchestration|model|environment|unclassified> --explanation-file <absolute-path> | observe-cost --task-dir <absolute-path> --input <absolute-path> | plan-current --task-dir <absolute-path> --plan <absolute-path> --sha256 <hex64> --base-commit <commit> --expected-generation <n> | change-report --task-dir <absolute-path>";
+const CLI_USAGE = "usage: assignment-run.mjs run --manifest <absolute-path> | observe --record-dir <absolute-path> | witness --record-dir <absolute-path> | accept --task-dir <absolute-path> --commit <commit> --record-dir <absolute-path> --critic <absolute-path> --critic <absolute-path> [--observed-pr <id>] [--observed-ci <id>] | attribute --task-dir <absolute-path> --record-dir <absolute-path> --class <orchestration|model|environment|unclassified> --explanation-file <absolute-path> | observe-cost --task-dir <absolute-path> --input <absolute-path> | plan-current --task-dir <absolute-path> --plan <absolute-path> --sha256 <hex64> --base-commit <commit> --expected-generation <n> | change-report --task-dir <absolute-path> | routing-export --task-dir <absolute-path>";
 
 const WITNESS_RECEIPT_KEYS = Object.freeze([
   "schema",
@@ -4293,8 +4293,135 @@ export function writeCurrentPlan(request, deps = {}) {
   } catch (error) { throw observationFailure(error, "plan_ref_invalid"); }
 }
 
+export const ROUTING_EXPORT_SCHEMA = "kxm.assignment-routing-export.v1";
+
+function contractExportable(contract) {
+  return Boolean(contract)
+    && typeof contract === "object"
+    && !Array.isArray(contract)
+    && typeof contract.boundary === "string"
+    && Array.isArray(contract.deliverables)
+    && contract.witness
+    && typeof contract.witness === "object"
+    && !Array.isArray(contract.witness)
+    && typeof contract.witness.id === "string"
+    && Array.isArray(contract.deferred);
+}
+
+export function exportAssignmentRoutingRecords(request, deps = {}) {
+  const io = ioDeps(deps);
+  const taskDir = observationTask(request.taskDir, io);
+  const taskId = basename(taskDir);
+  const skipped = [];
+  const acceptedIds = new Set();
+  const acceptedPath = join(taskDir, ACCEPTED_FILENAME);
+  if (lstatOrNull(acceptedPath, io.lstatSync)) {
+    try {
+      const value = privateRecord(acceptedPath, io).value;
+      const valid = value.schema === ACCEPTED_SCHEMA
+        && value.task_id === taskId
+        && typeof value.writer?.assignment_id === "string"
+        && Array.isArray(value.critics);
+      if (!valid) throw new Error("acceptance invalid");
+      acceptedIds.add(value.writer.assignment_id);
+      for (const critic of value.critics) {
+        if (typeof critic?.assignment_id === "string") acceptedIds.add(critic.assignment_id);
+      }
+    } catch {
+      skipped.push({ assignment_id: null, reason: "acceptance_record_invalid" });
+    }
+  }
+  const collected = [];
+  const dirs = listDirectAssignmentDirs(taskDir, io).sort((left, right) => left.assignment_id < right.assignment_id ? -1 : left.assignment_id > right.assignment_id ? 1 : 0);
+  for (const { assignment_id, path } of dirs) {
+    const routingPath = join(path, "routing-record.json");
+    if (!lstatOrNull(routingPath, io.lstatSync)) {
+      skipped.push({ assignment_id, reason: "no_routing_record" });
+      continue;
+    }
+    let record;
+    try {
+      record = parseRoutingRecord(privateRecord(routingPath, io).value);
+      if (record.workflowRunId !== assignment_id) throw new Error("workflowRunId");
+    } catch {
+      skipped.push({ assignment_id, reason: "routing_record_invalid" });
+      continue;
+    }
+    let contract;
+    try {
+      const manifest = privateRecord(join(path, "manifest.json"), io).value;
+      contract = manifest.contract;
+      if (!contractExportable(contract)) throw new Error("contract");
+    } catch {
+      skipped.push({ assignment_id, reason: "manifest_invalid" });
+      continue;
+    }
+    collected.push({ id: assignment_id, record, contract });
+  }
+  const supersededBy = new Map();
+  for (const entry of collected) {
+    const reworkOf = entry.record.providerMetadata?.rework_of;
+    if (typeof reworkOf === "string" && !supersededBy.has(reworkOf)) supersededBy.set(reworkOf, entry.id);
+  }
+  const records = [];
+  for (const entry of collected) {
+    const kind = entry.record.stageId;
+    const role = entry.record.agentRole;
+    const askSha256 = sha256Bytes(Buffer.from(JSON.stringify(["kxm.assignment-ask.v1", kind, role])));
+    const objectiveSha256 = sha256Bytes(Buffer.from(JSON.stringify([
+      "kxm.assignment-brief.v1",
+      kind,
+      entry.contract.boundary,
+      entry.contract.deliverables,
+      entry.contract.witness.id,
+      entry.contract.deferred,
+    ])));
+    const finalOutcome = acceptedIds.has(entry.id) ? "accepted" : supersededBy.has(entry.id) ? "failed" : "pending";
+    try {
+      records.push(parseRoutingRecord({
+        ...entry.record,
+        workflowRunId: taskId,
+        finalOutcome,
+        providerMetadata: {
+          ...entry.record.providerMetadata,
+          workflowId: "assignment-runner",
+          askSha256,
+          objectiveSha256,
+          stepWrites: WRITER_KINDS.includes(kind),
+          assignmentId: entry.id,
+          ...(finalOutcome === "failed" ? { supersededBy: supersededBy.get(entry.id) } : {}),
+        },
+      }));
+    } catch {
+      skipped.push({ assignment_id: entry.id, reason: "routing_record_invalid" });
+    }
+  }
+  return { schema: ROUTING_EXPORT_SCHEMA, task_id: taskId, records, skipped };
+}
+
 export async function main(argv = process.argv, io = { stdin: process.stdin, stdout: process.stdout, stderr: process.stderr }) {
   const args = argv.slice(2).filter((arg) => arg !== "--");
+  if (args[0] === "routing-export") {
+    try {
+      const values = {};
+      for (let i = 1; i < args.length; i += 2) {
+        if (args[i] !== "--task-dir" || values[args[i]] !== undefined || args[i + 1] === undefined) throw failClosed("invalid report/plan arguments", "manifest_invalid");
+        values[args[i]] = args[i + 1];
+      }
+      if (values["--task-dir"] === undefined) throw failClosed("missing report/plan arguments", "manifest_invalid");
+      const result = exportAssignmentRoutingRecords({ taskDir: values["--task-dir"] });
+      for (const record of result.records) io.stdout.write(`${JSON.stringify(record)}\n`);
+      io.stderr.write(`${JSON.stringify({ schema: result.schema, task_id: result.task_id, records: result.records.length, skipped: result.skipped })}\n`);
+      process.exitCode = 0;
+      return result;
+    } catch (error) {
+      const failure = observationFailure(error);
+      io.stderr.write(`${failure.runnerCode}: assignment routing export refused\n`);
+      process.exitCode = 1;
+      throw failure;
+    }
+  }
+
   if (["change-report", "plan-current"].includes(args[0])) {
     try {
       const flags = args[0] === "change-report" ? ["--task-dir"] : ["--task-dir", "--plan", "--sha256", "--base-commit", "--expected-generation"];

package/scripts/harness-run.mjs

@@ -137,7 +137,7 @@ export const ROUTES = Object.freeze({
     provider: "xai",
     roles: Object.freeze(["writer"]),
     permissions: Object.freeze(["edit"]),
-    models: Object.freeze(["grok-4.6"]),
+    models: Object.freeze(["grok-4.7"]),
     efforts: Object.freeze(["low", "medium", "high"]),
     auth: Object.freeze({ args: ["models"], loginHint: "grok (OAuth to auth.x.ai)" }),
   },
@@ -153,7 +153,7 @@ export const ROUTES = Object.freeze({
     provider: "anthropic",
     roles: Object.freeze(["planner", "reviewer-arch"]),
     permissions: Object.freeze(["read-only"]),
-    models: Object.freeze(["fable"]),
+    models: Object.freeze(["fable", "opus"]),
     efforts: Object.freeze(["low", "medium", "high", "xhigh", "max"]),
     auth: Object.freeze({ args: ["auth", "status"], loginHint: "claude auth login" }),
   },

package/scripts/native-critic.mjs

@@ -8,13 +8,13 @@ import { buildArgv } from "./harness-run.mjs";
 
 // Launch intent only: these labels are not observed model identity or admission.
 export function nativeCriticLaunch(harness) {
-  if (!["fable", "astra"].includes(harness)) {
-    throw new Error("usage: native-critic.mjs <fable|astra> <prompt>");
+  if (!["fable", "astra", "opus"].includes(harness)) {
+    throw new Error("usage: native-critic.mjs <fable|astra|opus> <prompt>");
   }
-  const model = harness === "fable" ? "fable" : "gpt-6-astra";
-  const command = harness === "fable" ? "claude" : "codex";
-  const args = harness === "fable"
-    ? ["-p", "--model", model, "--output-format", "json", "--no-session-persistence", "--tools", "Read,Glob,Grep", "--setting-sources", "user"]
+  const model = harness === "fable" ? "fable" : harness === "opus" ? "opus" : "gpt-6-astra";
+  const command = harness === "fable" || harness === "opus" ? "claude" : "codex";
+  const args = harness === "fable" || harness === "opus"
+    ? ["-p", "--model", model, "--effort", "medium", "--output-format", "json", "--no-session-persistence", "--tools", "Read,Glob,Grep", "--setting-sources", "user"]
     : buildArgv({ harness: "codex", model, effort: "low", permission: "read-only", prompt_file: "-" });
   return { model, command, args };
 }
@@ -36,7 +36,7 @@ async function main() {
   mkdirSync(outDir, { recursive: true });
   const client = new HubClient({ serverUrl, authToken: env.KXM_AUTH_TOKEN, name: `${harness}-critic`, purpose: "independent CLI critic", project: env.KXM_PROJECT || ".kxm", model });
   const prompt = promptParts.join(" ");
-  const agent = await client.start(() => {});
+  const agent = await client.start(() => { });
   const result = await new Promise((resolve) => {
     const child = spawn(command, args, { env, stdio: ["pipe", "pipe", "pipe"], shell: false });
     let stdout = "", stderr = "";