@kontextmind/kxm 0.7.188 → 0.7.190

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.188",
+      "version": "0.7.190",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/docs/README.md

@@ -120,6 +120,7 @@ KXM connects coding agents through a durable, authenticated [hub](glossary.md#hu
 | [Operating rules](contributing/operating-rules.md) | Agents, maintainers | The operator's standing instructions, dated, and where each is enforced |
 | [Decisions](contributing/decisions.md) | Agents, maintainers | Medium-or-higher decisions from automated work, with weights and evidence |
 | [Learnings](contributing/learnings.md) | Agents, maintainers | Durable lessons from running the writer, landing, and docs loops |
+| [Planner bake-off, October 2026](evals/planner-bakeoff-2026-10.md) | Maintainers | Scored plans from two planner models on six KXM tasks, with cost and time |
 | [Artifact templates](templates/README.md) | Workflow authors | Document templates and where workflows use them |
 
 The templates: [feature](templates/feature.md) · [bug fix](templates/bug-fix.md) · [ADR](templates/adr.md) · [architecture](templates/architecture.md) · [research](templates/research.md) · [review](templates/review.md) · [test plan](templates/test-plan.md) · [test report](templates/test-report.md) · [runbook](templates/runbook.md) · [postmortem](templates/postmortem.md) · [handoff](templates/handoff.md).

package/docs/contributing/ci-and-release.md

@@ -39,7 +39,7 @@ together.
 |---|---|---|
 | Before you push | Local | `npm run verify` |
 | Pull request, push to `main`, or manual | `ci.yml` (`required`) | Aggregates the lanes below into one pass/fail check named `CI / required` |
-| Pull request and push | `ci.yml` (Docs lint) | `lint:docs` and `check:versions`, always |
+| Pull request and push | `ci.yml` (Docs lint) | `lint:docs` (markdownlint and the `plans/` relative-link check) and `check:versions`, always |
 | Code pull request and code push | `ci.yml` (Unit engine and Unit, Linux Node 24) | `engine.test.ts` split by test name; `permission.test.ts`, `runtime.test.ts`, and `package-install.test.ts` one file at a time; every other unit file in two light shards. Typecheck and `check-generated` run on `light-1` |
 | Code pull request and code push | `ci.yml` (Python control plane) | Python 3.13 `unittest` contracts from the frozen uv workspace against PostgreSQL 17 started by `scripts/ci-postgres-17.sh` |
 | Platform-sensitive pull request | `ci.yml` (Unit, Windows Node 24) | The same unit lanes on `windows-latest` |

package/docs/contributing/development.md

@@ -255,7 +255,7 @@ It runs three scripts in order:
 | Step | Script | What it checks |
 |---|---|---|
 | 1 | `npm test` | Build, then `test/core/*.test.ts` and `packages/core/*/tests/unit/*.test.ts`. The script passes `--test-force-exit` so a finished run leaves the process even if a handle is still open; a failing test is still reported before that exit |
-| 2 | `npm run check` | `tsc --noEmit`, `markdownlint-cli2`, and version surfaces |
+| 2 | `npm run check` | `tsc --noEmit`, markdownlint, the `plans/` relative-link check, and version surfaces |
 | 3 | `npm run check:generated` | Generated artifacts are tracked and match the staged copy |
 
 Changes to the Python control plane also run its frozen-workspace contract
@@ -303,7 +303,7 @@ Other scripts you will use:
 | `npm run test:simulations` | `test/simulations/*.test.ts` |
 | `npm run test:coverage` | Core suite with coverage floors |
 | `npm run test:coverage:complete` | Core plus simulations with the higher nightly floors |
-| `npm run lint:docs` | Markdown lint only |
+| `npm run lint:docs` | Markdown lint, then the `plans/` relative-link and heading check |
 | `npm run e2e` | Start Obscura if needed, then Playwright in `test/e2e/` (`node --test` does not collect that directory) |
 | `npm run validate:pr` | The three-minute CI gate; see [CI and release](ci-and-release.md) |
 | `npm run validate:ci` | Coverage suite, `check` and a package dry run (not run by CI today) |

package/docs/contributing/writing-docs.md

@@ -297,8 +297,15 @@ exist only in prose, never in command form.
 
 ### Check links
 
-No CI job checks links yet. Before you open a pull request, run this check on
-the files you changed; it prints each relative link whose target is missing:
+`npm run lint:docs` runs markdownlint, then `scripts/check-plan-links.mjs`.
+That script checks every Markdown link under `plans/`. A relative target has
+to exist. A `#heading` on a Markdown file has to match a heading in that
+file. `related` entries in plan front matter are checked the same way, relative
+to the file. Docs lint runs this on every pull request.
+
+For a page outside `plans/`, run this check on the files you changed. It
+prints each relative link whose target is missing, and it does not check
+anchors:
 
 ```bash
 node --input-type=module -e '

package/docs/evals/planner-bakeoff-2026-10/judge/argon.json

@@ -0,0 +1,18 @@
+{
+  "planA": {
+    "correctness": 3,
+    "completeness": 3,
+    "risk": 5,
+    "sequencing": 3,
+    "conciseness": 5
+  },
+  "planB": {
+    "correctness": 1,
+    "completeness": 2,
+    "risk": 5,
+    "sequencing": 3,
+    "conciseness": 5
+  },
+  "winner": "A",
+  "rationale": "Plan A captures both Argon roster variants, pricing, documentation, and key refusals, but misplaces the roster in routes.yaml, mishandles low, and gets safety-net ordering wrong. Plan B is clean and guarded but materially diverges by omitting Argon high and proposing the wrong final roster."
+}

package/docs/evals/planner-bakeoff-2026-10/judge/journal.json

@@ -0,0 +1,18 @@
+{
+  "planA": {
+    "correctness": 4,
+    "completeness": 5,
+    "risk": 4,
+    "sequencing": 4,
+    "conciseness": 3
+  },
+  "planB": {
+    "correctness": 5,
+    "completeness": 5,
+    "risk": 5,
+    "sequencing": 5,
+    "conciseness": 4
+  },
+  "winner": "B",
+  "rationale": "Plan B takes the smallest honest step: it locks the current refusal with characterization tests, documents the unimplemented design, updates Tracking, and stops without schema, store, relabeling, or unnecessary CLI behavior changes."
+}

package/docs/evals/planner-bakeoff-2026-10/judge/reviewer.json

@@ -0,0 +1,18 @@
+{
+  "planA": {
+    "correctness": 5,
+    "completeness": 4,
+    "risk": 5,
+    "sequencing": 5,
+    "conciseness": 4
+  },
+  "planB": {
+    "correctness": 3,
+    "completeness": 3,
+    "risk": 4,
+    "sequencing": 3,
+    "conciseness": 5
+  },
+  "winner": "A",
+  "rationale": "Plan A matches the shipped roster, role ownership, admission, pricing aliases, safeguards, and implementation sequence. Plan B incorrectly places reviewer-cli reordering in routes.yaml, omits the OpenRouter suffix from the Pi fallback, and leaves more shipped details unresolved. Both miss explicit workforce-name, generated-dist, review-template, and first-run-plan coverage."
+}

package/docs/evals/planner-bakeoff-2026-10/judge/weekly.json

@@ -0,0 +1,18 @@
+{
+  "planA": {
+    "correctness": 4,
+    "completeness": 4,
+    "risk": 5,
+    "sequencing": 5,
+    "conciseness": 3
+  },
+  "planB": {
+    "correctness": 5,
+    "completeness": 4,
+    "risk": 5,
+    "sequencing": 4,
+    "conciseness": 4
+  },
+  "winner": "B",
+  "rationale": "Both are strong and cover the testable module, workflow, safety invariants, fixed-branch PR behavior, and key tests. Plan B is slightly closer to the shipped architecture and more concise, while Plan A has better test-first sequencing but adds some unnecessary detail and assumptions."
+}

package/docs/evals/planner-bakeoff-2026-10/judge/wiki.json

@@ -0,0 +1,18 @@
+{
+  "planA": {
+    "correctness": 4,
+    "completeness": 3,
+    "risk": 5,
+    "sequencing": 5,
+    "conciseness": 4
+  },
+  "planB": {
+    "correctness": 3,
+    "completeness": 3,
+    "risk": 4,
+    "sequencing": 4,
+    "conciseness": 4
+  },
+  "winner": "A",
+  "rationale": "Plan A matches the shipped root location and avoids scope expansion, with strong safety checks and sequencing. Both plans omit several shipped pages and links, but Plan B adds an unshipped handbook directory and invents a browser flag."
+}

package/docs/evals/planner-bakeoff-2026-10/judge/writer2.json

@@ -0,0 +1,18 @@
+{
+  "planA": {
+    "correctness": 2,
+    "completeness": 4,
+    "risk": 2,
+    "sequencing": 2,
+    "conciseness": 3
+  },
+  "planB": {
+    "correctness": 3,
+    "completeness": 3,
+    "risk": 5,
+    "sequencing": 5,
+    "conciseness": 5
+  },
+  "winner": "B",
+  "rationale": "Both miss the shipped default, but B fails closed, checks tools before admission, and names qwen3.7-plus as the fallback. A is more exhaustive but sequences the critical tool check too late and makes a risky alias assumption."
+}

package/docs/evals/planner-bakeoff-2026-10/prompts/argon.txt

@@ -0,0 +1,30 @@
+# Task packet
+
+Product: KXM. Future work is not backwards-compatible. Brake old names; do not add dual product aliases.
+
+Role: planner. Permission is read-only. You plan; you do not edit routes in this exercise. The plan may say which files a later writer should change.
+
+Request: Plan admission of Gemini 4 Argon onto the agy writer roster. Argon is the only Gemini 4 model. The agy CLI pins it as gemini-4-argon-high, gemini-4-argon-medium, or gemini-4-argon-low (base gemini-4-argon with an effort flag). agy -p exits when a pinned model is not available. It does not fall through by itself. Argon requires a paid Google AI Pro, Ultra, or Enterprise plan.
+
+Current writer roster, in order, effort medium:
+1. grok-grok-4-7 (native grok, vendor xai)
+2. pi-qwen3-coder-plus-openrouter (Pi + OpenRouter, edit)
+3. agy-gemini-3-8-flash-high
+4. agy-gemini-3-8-flash-medium
+
+Routing rules you must keep:
+- Google is never billed through OpenRouter. The native harness for Gemini is agy.
+- If the native harness is missing or logged out, fail closed. Do not silently use another vendor's key.
+- Planner primary stays claude-fable. Architecture review stays claude-fable. This task does not put Argon on those rosters. Argon may be named only as a possible later fallback.
+- Writer primary stays grok-grok-4-7.
+- Product kxm init defaults stay grok-4.6 and fable. This checkout's writer roster is a separate developer roster from the init template.
+- An admitted model file that is on no roster fails workforce lint. A model file uses schema kxm.model.v2 with harness, model, vendor, status, permissions.
+- Route selectors live in .kxm/routes.yaml (schema kxm.routes.v2). kxm routes admit only accepts an id present in .kxm/models/inventory.yaml.
+- .kxm/prices.yaml is schema kxm.prices.v1, dated, sha256-pinned. The loader refuses a hash mismatch. A row needs id, provider, model, tiers with inputPerMillion and outputPerMillion.
+- List price given for this plan: Argon is $2 input and $10 output per 1M tokens through 2026-11-30, then $4 and $20. Batch is $1 and $5. Context is 1,048,576.
+- kxm models inventory-refresh reads OpenRouter and Nous. On this machine pi, grok, and agy may be absent, so a refresh must not drop existing CLI-only inventory rows.
+- When a roster or CLI name changes, update Tracking in plans/implementation-plan.md in the same change. Do not enlarge earlier phases.
+- Same-change docs that hardcode the writer rotation must move together: docs/reference/harness-routing.md, the config reference, changelog, and roster policy tests.
+- Do not add a harness preferences overlay. Do not declare agy a long-lived worker. agy is one-shot headless (agy -p).
+
+Deliver a plan a writer could implement without another architecture pass.

package/docs/evals/planner-bakeoff-2026-10/prompts/journal.txt

@@ -0,0 +1,22 @@
+# Task packet
+
+Product: KXM. This item is still open. Nothing has shipped. The plan must say what is blocked now and what may be designed now.
+
+Recorded gap: Runtime runs have no journal or retrospective.
+
+Facts:
+- `kxm workflow record` and the tool `kxm_workflow_record` post to POST /v1/workflows/:id/journal.
+- That route looks the id up among the hub's webhook runs. A `kxm run` id answers workflow_not_found.
+- Terminal Runtime runs export no retrospective.
+- Ranked signals in the improvement report cover hub webhook runs only.
+- A Runtime journal needs a new store.
+- The delivery queue forbids a new event-store or hub-store schema change while S5 is open. S5 still has an open interactive browser login witness. Zero event-store or hub-store schema change in S0 through S5.
+- Owner when the trigger fires: the current writer route, with the planner role planning. Trigger: S5 closes and a Runtime journal store may be added.
+- Journal categories that already exist for hub webhook runs: plan, decision, contradiction, error, lesson, observation, hypothesis, experiment, state-change, skill-candidate. A record is bound to a stage id.
+- Do not auto-promote skills or gates from telemetry.
+- Do not add a schema field for private handoff notes.
+- Hub and Runtime are different stores. Do not relabel a Runtime run as a webhook run to make the existing route succeed.
+
+Request: Plan the smallest honest next step. Prefer a design note and tests that lock the current refusal, over a store that the queue forbids. If you believe a store can land before S5 closes, say which existing store version you would bump and why that does not break the queue rule. The packet does not name current schema version numbers; do not invent them.
+
+Deliver a plan a writer could implement without another architecture pass.

package/docs/evals/planner-bakeoff-2026-10/prompts/reviewer.txt

@@ -0,0 +1,28 @@
+# Task packet
+
+Product: KXM. The CLI reviewer and the architecture reviewer are different roles and different providers from the writer.
+
+Request: Plan admission of Codex GPT-6.1 Sol as the reviewer-cli primary. The current primary is Codex GPT-5.6 Sol.
+
+Current reviewer-cli roster, permission read-only:
+1. codex-gpt-5-6-sol, effort low. Comment: required CLI critic. Native harness codex, model gpt-5.6-sol, vendor openai.
+2. pi-qwen3-8-flash-openrouter, effort low. Different vendor fallback.
+
+Facts:
+- GPT-6.1 Sol API id is gpt-6.1-sol. Pro is the same model with reasoning mode pro, not a separate model. OpenRouter lists that mode as openai/gpt-6.1-sol-pro at the same per-token price.
+- List price: $2 input and $10 output per 1M tokens through 272000 prompt tokens, then $4 and $15. Cache read $0.10 and cache write $2.50 on both tiers.
+- Native harness is codex. Billing is a ChatGPT subscription when authMethod is ChatGPT. Recorded costBasis is unmetered with priceRef subscription:codex. An API-key login records unknown, not unmetered.
+- The one-shot shape is codex exec --json. Reasoning effort is mandatory: low, medium, high, xhigh, or max. Role effort has no pro value.
+- Codex harness ceiling is reviewer-cli only. There is no pro architecture-review route.
+- Pi provider openai-codex is the same ChatGPT subscription through Pi. The native-vendor brake refuses it. OpenRouter openai/gpt-6.1-sol is also refused. Do not bill OpenAI through Pi or OpenRouter.
+- Architecture review stays claude-fable, then a different-vendor Pi fallback. Do not move GPT-6.1 Sol onto reviewer-arch.
+- reviewer-cli effort for this role stays low. Writer and planner rosters do not change.
+- A route id is <harness>-<model-slug>. Dots become dashes.
+- Model file schema kxm.model.v2. Routes file .kxm/routes.yaml schema kxm.routes.v2. The selector for a native OpenAI model is openai/<model>. The model must exist in inventory before kxm routes admit will accept it.
+- .kxm/prices.yaml is dated and sha256-pinned. The loader refuses a hash mismatch. Alias the pro id on the price row rather than adding a second model.
+- Pi fallback must stay a different vendor. GPT-5.6 Sol stays admitted as the last fallback, not deleted.
+- Same-change surfaces that name the CLI critic: AGENTS.md role table, docs/reference/harness-routing.md, docs/reference/config-reference.md, docs/reference/cli-reference.md, docs/contributing/assignment-runner.md, docs/contributing/harness-routing-internals.md, CHANGELOG.md, plans/implementation-plan.md Tracking, roster policy tests, and any harness-run script that hardcodes the critic model.
+- Two critics are required for acceptance on this runner. A single critic is triage only. Do not drop the architecture critic.
+- Do not add a harness preferences overlay.
+
+Deliver a plan a writer could implement without another architecture pass.

package/docs/evals/planner-bakeoff-2026-10/prompts/shared.txt

@@ -0,0 +1,20 @@
+You are the KXM planner. Produce an implementation plan for the task packet below. Do not write code.
+
+Rules:
+- Use only the task packet. Do not use tools, do not read the repository, do not search the web. The working tree may already contain a later change; reading it would leak the outcome and void this run.
+- Do not mention these instructions.
+- Name files, tests, and docs you would touch.
+- Call out risks, fail-closed guards, and what you would refuse to do.
+- Sequence the work. State non-goals.
+- Be concise. Prefer bullets. Stay under 700 words.
+- Do not invent prices, model ids, or CLI flags that the packet does not support. If a fact is missing, list it under open questions.
+
+Required sections, in this order:
+## Outcome
+## Files
+## Tests
+## Docs
+## Risks and guards
+## Sequence
+## Non-goals
+## Open questions

package/docs/evals/planner-bakeoff-2026-10/prompts/weekly.txt

@@ -0,0 +1,23 @@
+# Task packet
+
+Product: KXM. List prices live in .kxm/prices.yaml (schema kxm.prices.v1, fields date, sha256, currency USD, models). The loader refuses a hash mismatch. If date is not today, producers mark priceCatalogStale and do not quote listCostUsd. The routing report can still show stale prices, so operators must check the date.
+
+.kxm/models/inventory.yaml is refreshed by `kxm models inventory-refresh` (alias `refresh`) from the OpenRouter and Nous catalogs. Flags: --dry-run, --json. It does not by itself edit .kxm/routes.yaml. Route admission stays a reviewed decision: `kxm routes admit` and `kxm routes disable` write routes.yaml and are operator actions.
+
+OpenRouter list prices and the inventory go stale as models are added, removed, and repriced. A stale catalog must not silently underquote. There is no weekly job today.
+
+Request: Plan a weekly refresh of OpenRouter model prices and the model inventory. The job opens one pull request when the catalog changed. A human reviews it. It does not merge itself and does not admit or disable routes.
+
+Constraints:
+- Fetch the public OpenRouter models API only. Do not put a token in the workflow if the API is public. If a token would be required, fail closed and say so.
+- The pull request body lists models added, removed, and repriced. It does not dump secrets.
+- Preserve CLI-only inventory rows when the refresh host has no pi, grok, or agy binary. A refresh that deletes those rows is a failed plan.
+- prices.yaml date and sha256 change only when the bytes change, and they change together.
+- Do not auto-promote a new model onto a roster. New ids can appear in the inventory without becoming admitted routes.
+- CI for this repo uses GitHub Actions. Pull requests already run docs lint, typecheck, and unit tests. Do not add a required status check that calls a model.
+- Schedule is weekly. The packet does not pick the weekday or hour. Choose one and mark it as a choice, not a discovered fact.
+- Document the job in docs/reference/harness-routing.md and the contributing CI page. Update CHANGELOG.md.
+- Tests must cover: no PR when unchanged, a PR body that names added and removed ids, refusal to drop CLI-only rows, and refusal to edit routes.yaml.
+- Do not change writer, planner, or reviewer rosters in this change.
+
+Deliver a plan a writer could implement without another architecture pass.

package/docs/evals/planner-bakeoff-2026-10/prompts/wiki.txt

@@ -0,0 +1,27 @@
+# Task packet
+
+Product: KXM. KontextMind is the organization and a separate knowledge plane. Do not confuse them.
+
+Standing rule, unchanged by this task: wiki compile and wiki ingest stay unselected. `kxm context wiki-compile` and `kxm context wiki-lint` exist. The guide says the wiki is a reviewable Markdown view of the context pool, never the authoritative store, and the project's release policy defers it, so do not build a process on it. Compiled pages land under `.kxm/knowledge/wiki/` with sections architecture, decisions, incidents, patterns, plus temporal state, contradictions, superseded history, and index.md. That compiler is not what this task turns on.
+
+Known compiler gaps, not in scope to fix: the hub looks for `.kxm/memory` two directories above its database and misses authored memory with the default `.kxm/state/kxm.db` layout. The compiler includes unreviewed journal entries and pending proposals. The index links the temporal-state page at the wrong path.
+
+Request: Seed a small hand-written project knowledge wiki in this repository so operators can read current architecture, routing decisions, glossary, CI and release patterns, and a few runbooks. It is authored Markdown, not a run of wiki-compile. It must not select ingest, must not change hub schema, and must not claim the pages are generated authority.
+
+Content the seed should cover, from facts already true:
+- Architecture overview: hub, local Runtime, SQLite at `.kxm/state/kxm.db`, single node, at-least-once.
+- Decision: native harness wins. Claude Fable plans and does architecture review. Grok writes. Codex reviews CLI and docs. Google goes through agy, not OpenRouter. Pi is for vendors with no native harness.
+- Glossary pointers to docs/glossary.md. Do not fork a second conflicting glossary; summarize and link.
+- CI pattern: pull requests run docs lint, typecheck, Node unit tests, and a Python control-plane suite. `CI / required` is the aggregate check.
+- Release and failed-release runbooks at a high level: npm package `@kontextmind/kxm`, changelog, do not invent a new release command.
+- Model-route runbook: `kxm routes list`, admit and disable are reviewed, prices.yaml hash must match.
+- One runbook for the default Playwright browser, Obscura, and the rule that Steel is for human takeover. Do not invent flags.
+
+Constraints:
+- Put pages under `.kxm/knowledge/` and add an index. Link them from docs/README.md, the architecture index, the context-and-memory guide, and the config reference in one line each. Do not link from docs/ into plans/.
+- Pages use the glossary terms. No secrets, no hostnames of private boxes, no tokens.
+- Do not add an npm script or a CI job.
+- Do not edit routes, rosters, or prices.
+- A docs change still has to pass markdownlint. Follow the docs style: sentence-case titles, relative links, no Mesh product names.
+
+Deliver a plan a writer could implement without another architecture pass.

package/docs/evals/planner-bakeoff-2026-10/prompts/writer2.txt

@@ -0,0 +1,40 @@
+# Task packet
+
+Product: KXM. Qwen has no native harness in KXM. Pi is the right harness. Prefer an admitted OpenRouter selector when no authenticated vendor-plan provider is in this packet.
+
+Request: Writer #2 is pi-qwen3-coder-plus-openrouter. OpenRouter now returns 404 for qwen/qwen3-coder-plus. Plan the replacement of writer #2. Do not change writer #1.
+
+Current writer roster, effort medium:
+1. grok-grok-4-7
+2. pi-qwen3-coder-plus-openrouter (model openrouter/qwen/qwen3-coder-plus, vendor alibaba, permission edit, status admitted). Alias qwen-openrouter-pi.
+3. agy-gemini-4-argon-high
+4. agy-gemini-4-argon-medium
+5. agy-gemini-3-8-flash-medium (safety net because agy -p does not fall through)
+6. agy-gemini-3-8-flash-high (kept so the admitted model file stays on a roster)
+
+Live replacement candidates verified against the OpenRouter models API on 2026-10-17. Prices are USD per 1M tokens:
+
+| Model | Input / output | Context |
+| qwen/qwen3.7-plus | 0.32 / 1.28 | 1000000 |
+| qwen/qwen3-coder-next | 0.12 / 0.80 | 262144 |
+| qwen/qwen3-coder-flash | 0.195 / 0.975 | 1000000 |
+| meta/muse-spark-open | 1.25 / 4.25 | 1048576 |
+| moonshotai/kimi-k2.7-code | 0.6712 / 3.35 | 262144 |
+
+The packet does not say which candidate supports tools. A writer route needs edit permission. Fail closed if you cannot show tool support from this packet; put that gap in open questions and still recommend a default with the assumption labeled.
+
+qwen3.7-plus base tier is the price above. Prompts at or above 256000 tokens list at 0.96 / 3.84 if you select that model. supported_parameters is not in this packet.
+
+Rules:
+- Do not bill a native vendor through Pi. Qwen is allowed through OpenRouter. Moonshot has a native kimi harness, so a moonshot model through OpenRouter is the native-vendor case the brake refuses. Do not select it unless you explain the brake and refuse it.
+- Meta through OpenRouter is not a native-harness exception named in this packet. Treat it as an admission question, not an automatic writer.
+- Keep the old prices.yaml row for qwen/qwen3-coder-plus at its last list price. Do not delete history. Mark the old route retired in inventory and routes comments. Take it off the admitted list and off the writer roster.
+- New route id shape: pi-<model-slug>-openrouter, dots written as dashes.
+- Model file schema kxm.model.v2, harness pi, vendor alibaba for a Qwen model, permissions include edit. Add an evidence note under plans/evidence/.
+- .kxm/prices.yaml is dated and sha256-pinned. Update date and sha256 in the same change. The loader refuses a mismatch.
+- Inventory must contain the id before routes admit.
+- Same-change docs and tests that hardcode writer #2 or qwen3-coder-plus: harness-routing, config reference, CLI reference, assignment runner, glossary if it names the route, changelog, plans/implementation-plan.md Tracking, roster-policy tests, and generated dist only if a string is embedded there.
+- Do not change planner, reviewer-cli, or reviewer-arch. Do not reorder Argon or Flash.
+- Do not add a harness preferences overlay.
+
+Deliver a plan a writer could implement without another architecture pass. Pick one replacement and say why.

package/docs/evals/planner-bakeoff-2026-10/raw/argon-fable.txt

@@ -0,0 +1,68 @@
+## Outcome
+
+- Three new model files, `agy-gemini-4-argon-high`, `agy-gemini-4-argon-medium`, `agy-gemini-4-argon-low`, exist under `.kxm/models/`, schema `kxm.model.v2`, harness `agy`, model `gemini-4-argon`, vendor `google`, status `admitted`, permissions matching the current agy Flash entries. Effort is carried by the pinned agy model id, not a new flag.
+- Writer roster in `.kxm/routes.yaml` becomes, in order, effort medium: `grok-grok-4-7`, `pi-qwen3-coder-plus-openrouter`, `agy-gemini-4-argon-high`, `agy-gemini-4-argon-medium`, `agy-gemini-3-8-flash-high`, `agy-gemini-3-8-flash-medium`. Primary unchanged.
+- `agy-gemini-4-argon-low` is admitted but placed on no roster only if lint allows a documented exception; otherwise it is omitted from this change (see Open questions). Default plan: do not create the `low` file.
+- Inventory, prices, Tracking, and routing docs move in the same change. Planner and architecture-review rosters are untouched.
+
+## Files
+
+- `.kxm/models/agy-gemini-4-argon-high.yaml`, `.kxm/models/agy-gemini-4-argon-medium.yaml` (new).
+- `.kxm/models/inventory.yaml`: add both ids with harness `agy`, pinned ids `gemini-4-argon-high` / `gemini-4-argon-medium`, context `1048576`, plan requirement note (Pro/Ultra/Enterprise).
+- `.kxm/routes.yaml`: writer selector order as above; no other roster changes.
+- `.kxm/prices.yaml`: new row `id: agy-gemini-4-argon`, `provider: google`, `model: gemini-4-argon`, tiers: standard `inputPerMillion: 2`, `outputPerMillion: 10` valid through `2026-11-30`; standard-after `4` / `20` from `2026-12-01`; batch `1` / `5`. Bump the file date and recompute the sha256 pin.
+- Inventory-refresh code (the module behind `kxm models inventory-refresh`): guard that rows whose harness is `agy`, `grok`, or `pi` are preserved when their CLI is absent. Only if a test shows the current code drops them.
+- `plans/implementation-plan.md`: Tracking → Decided entry for Argon writer admission; no earlier phase enlarged.
+
+## Tests
+
+- Roster policy test: expected writer order updated; asserts primary is `grok-grok-4-7`, planner/arch-review rosters contain only `claude-fable`, and no roster contains `openrouter/…google…`.
+- Workforce lint test: every admitted model file is on a roster (fails if `low` is created and unrostered).
+- Model schema test: new files validate as `kxm.model.v2`; vendor `google` + harness `agy` only; a model file with vendor `google` and harness `pi`/OpenRouter fails.
+- Prices loader test: hash-mismatch refusal still holds; new row parses with two dated standard tiers plus batch; a fixture dated after 2026-11-30 resolves to 4/20.
+- Inventory-refresh test: with OpenRouter/Nous fixtures and no `agy`/`grok`/`pi` binaries, the agy and grok rows survive the refresh.
+- Harness capability test: agy routes are one-shot (`agy -p`), never registered as `kxm agent worker`; a missing or logged-out agy yields fail-closed with no fallthrough to another vendor.
+- Brake test: old or alias names (e.g. a generic `gemini-4` id without `-argon`, or a `gemini` CLI entry promoted to a harness) are rejected.
+- `npm run verify` after `npm ci`; regenerate `dist` if any CLI module changed.
+
+## Docs
+
+- `docs/reference/harness-routing.md`: writer rotation table; note Argon's plan requirement, effort via pinned id, no self-fallthrough.
+- Config reference (routes/models/prices section): new ids, the dated two-tier price row convention.
+- Changelog: "Admit Gemini 4 Argon (high, medium) to the developer writer roster after OpenRouter Qwen; prices row added."
+- `plans/implementation-plan.md` Tracking.
+- `AGENTS.md` is not edited: it intentionally defers admissions to Tracking.
+
+## Risks and guards
+
+- Billing Google via OpenRouter: guard is vendor/harness pairing lint plus the roster test. Refuse any `openrouter/google/...` writer entry.
+- Silent fallthrough: `agy -p` exits on unavailable model; the runner must treat exit as route failure and move to the next eligible route, not retry via Pi. Refuse adding a Pi `google` provider route.
+- Plan gating: Argon needs a paid plan; logged-in agy on a free plan still fails. Guard: `kxm harness list` auth check remains fail-closed; record the failure as cost-unknown attempt.
+- Price staleness: dated tiers avoid underquoting after 2026-11-30; hash pin must be regenerated by script, never hand-edited.
+- Inventory refresh dropping CLI rows: covered by the preservation test.
+- Refuse: harness preferences overlay, long-lived agy worker, putting Argon on planner/review rosters, changing `kxm init` defaults (grok-4.6/fable), dual names or aliases.
+
+## Sequence
+
+1. Add the two model files and inventory rows; run model schema and lint tests.
+2. `kxm routes admit` both ids; edit `.kxm/routes.yaml` writer order; update roster policy test.
+3. Add prices row, bump date, regenerate sha256; update loader test fixtures.
+4. Add inventory-refresh preservation test; fix code only if it fails.
+5. Add fail-closed and brake tests for agy routes.
+6. Update harness-routing doc, config reference, changelog, Tracking.
+7. `npm ci && npm run verify`; stage `dist` if changed; commit as one logical change.
+
+## Non-goals
+
+- No Argon on planner or architecture-review rosters (later fallback at most).
+- No change to writer primary or `kxm init` template.
+- No `agy` worker mode, no retry/fallthrough logic inside agy itself.
+- No new catalog feed, no OpenRouter Gemini route, no GitLab adapter work.
+
+## Open questions
+
+- Does workforce lint allow an admitted-but-unrostered `low` file? If not, either omit `low` or add it as last writer fallback; packet does not decide.
+- Exact permission set for agy entries (copy from Flash or narrower)?
+- Does the prices schema `kxm.prices.v1` support dated tier validity ranges, or must the after-November price land as a separate dated file revision?
+- Which status word does the inventory use for "CLI absent on this machine" rows?
+- Does the `agy` CLI expose the paid-plan check for `kxm harness list`, or is it only observable via `agy -p` exit?

package/docs/evals/planner-bakeoff-2026-10/raw/argon-sonnet.txt

@@ -0,0 +1,69 @@
+## Outcome
+- Admit one Argon route on the agy writer roster as a late fallback, using the pinned id `gemini-4-argon-medium`. This matches the roster's medium effort. The writer roster becomes: grok-grok-4-7, pi-qwen3-coder-plus-openrouter, agy-gemini-3-8-flash-high, agy-gemini-3-8-flash-medium, agy-gemini-4-argon-medium.
+- The writer primary stays grok-grok-4-7. Planner and architecture review stay claude-fable. Argon is not placed on those rosters. The docs may name it only as a possible later fallback.
+- `kxm init` defaults stay unchanged (grok-4.6 and fable).
+- Google traffic goes only through native agy. Nothing is routed through OpenRouter or the Pi provider.
+
+## Files
+- `.kxm/models/inventory.yaml`: add an inventory row for `agy-gemini-4-argon-medium`. It uses harness agy, vendor google, and the pinned model string.
+- `.kxm/models/agy-gemini-4-argon-medium.yaml` (kxm.model.v2): fields are harness, model, vendor, status, permissions. Copy the permission shape from the existing agy Flash model files. Do not grant more than those files do.
+- `.kxm/routes.yaml` (kxm.routes.v2): append the writer selector entry at the end, with effort medium. Use `kxm routes admit` for this, not a hand edit. It accepts only ids that are in the inventory.
+- `.kxm/prices.yaml` (kxm.prices.v1): add an Argon row with id, provider, model and tiers (inputPerMillion and outputPerMillion).
+  - Prices are $2 and $10 through 2026-11-30, and $4 and $20 after that.
+  - The row also carries the batch price ($1 and $5) and the context size (1,048,576).
+  - Re-pin the sha256. Bump the date.
+- Workforce roster source (where the writer rotation is declared, so the new model file is not orphaned): add the Argon id to it. The packet doesn't name this file, so the writer must locate it.
+- The inventory-refresh code under `kxm models`: make a refresh merge instead of replace, so CLI-only rows survive.
+- `plans/implementation-plan.md`: update Tracking in the same change. Do not touch earlier phases.
+
+## Tests
+- Roster policy test: assert the exact writer order above, with primary grok-grok-4-7 and effort medium.
+- Workforce lint test: an Argon model file on the roster passes, and an admitted model file on no roster fails.
+- Admit test: `kxm routes admit` rejects an id missing from the inventory and accepts the Argon id.
+- Prices loader test: the new hash loads, a mismatch is refused, and a row missing a required field is refused.
+- Inventory-refresh test: with pi, grok and agy absent, existing CLI-only rows, including the Argon row, are preserved.
+- Fail-closed test: with agy missing or logged out, the Argon route is refused. There is no fall-through to another vendor's key or to OpenRouter.
+- Brake test: no `openrouter/google…` or Google route via Pi is admitted.
+- Planner and review roster tests: Argon is absent from both.
+- Init template test: defaults are unchanged.
+- Run `npm run verify`.
+
+## Docs
+- `docs/reference/harness-routing.md`: update the writer rotation and describe Argon as the last-position agy fallback.
+- Config reference: update the roster listing.
+- Changelog: add an entry.
+- Mention the plan requirement (paid Google AI Pro, Ultra or Enterprise) and that `agy -p` exits when the pinned model is unavailable.
+- `plans/implementation-plan.md` Tracking: record the new roster.
+
+## Risks and guards
+- Argon needs a paid plan. If the account lacks it, `agy -p` exits and does not fall through. Treat that exit as a route failure and hand over to the next eligible authenticated model. Do not retry silently on a different vendor.
+- The price step on 2026-11-30 makes the dated pin stale. Record the effective-until date in the row or in the docs. A stale catalog must not silently underquote.
+- Do not pin a base `gemini-4-argon` plus an effort flag. The packet only supports the three pinned names, so use the pinned name.
+- If the refresh is a naive overwrite, it drops the Argon row on this machine.
+- Do not edit the hash by hand. Regenerate it.
+- Refuse these: a Google route through OpenRouter or Pi, a harness preferences overlay, declaring agy a long-lived worker, dual or alias names, and Argon on the planner or review rosters.
+
+## Sequence
+1. Fix the refresh merge behavior and its test first.
+2. Add the inventory row and the model file.
+3. Admit the route via `kxm routes admit` and place it on the roster.
+4. Add the price row and re-pin the hash.
+5. Update the roster policy and lint tests.
+6. Update the docs, the changelog and Tracking.
+7. Run `npm run verify`.
+8. The fixed witness and the dual critics (Fable and Sol) run afterward.
+
+## Non-goals
+- Adding the high or low Argon variants.
+- Putting Argon on the planner or review rosters.
+- Changing the writer primary or the init defaults.
+- Automatic failover scheduling.
+- Cost or quality ranking work.
+- Changes to the Pi or OpenRouter paths.
+
+## Open questions
+- Which file declares the workforce roster? The packet does not name it.
+- Should the roster use medium only, or also high? The packet fixes effort at medium, so this plan assumes medium only.
+- What permission set do the agy Flash model files use? It is assumed to be the writer permission set.
+- Does the price row have a field for the batch price, the context size and the step-up date? The packet does not say. If not, put them in docs, not in a new schema field.
+- Does this account hold a qualifying Google plan? The route is untested until agy is logged in.

package/docs/evals/planner-bakeoff-2026-10/raw/journal-fable.txt

@@ -0,0 +1,60 @@
+## Outcome
+
+- Blocked now: any Runtime journal store, Runtime retrospective export, or Runtime signals in the improvement report. All three need a new store, and the queue forbids event-store or hub-store schema changes while S5 is open. Nothing in this slice lands a store or bumps a store version.
+- Designed now: a design note that fixes the shape of the future Runtime journal store, and tests that lock the current fail-closed behaviour so it cannot drift into a silent success or a relabel.
+- Honest user-facing state: `kxm workflow record` with a `kxm run` id keeps answering `workflow_not_found`. The CLI and tool explain that Runtime runs have no journal yet, without pretending to record anything.
+
+## Files
+
+Proposed locations; the writer should use the existing equivalents where they already exist.
+
+- `docs/design/runtime-journal.md` (new): design note, see Docs.
+- Hub journal route handler (`POST /v1/workflows/:id/journal`): no behaviour change. Only add a comment-free test around the existing `workflow_not_found` answer.
+- `kxm workflow record` CLI command and the `kxm_workflow_record` tool wrapper: when the hub answers `workflow_not_found` and the id matches the Runtime run id shape, surface a message stating Runtime runs have no journal store yet, and point to the design note. Exit non-zero. No retry, no local fallback write, no relabel.
+- Improvement report producer: add a test only, asserting that Runtime runs contribute zero ranked signals and the report says so explicitly rather than omitting them.
+- `plans/implementation-plan.md` Tracking: record this slice as "designed, blocked on S5", trigger and owner as in the packet.
+
+## Tests
+
+- Route refusal: POST journal with a Runtime run id returns `workflow_not_found`; the hub store contains no new row; the Runtime store is untouched.
+- No relabel brake: a Runtime run id is never looked up as a webhook run, even when a webhook run with the same id happens to exist (collision case returns the webhook run, and the test documents that the id spaces are distinct so this must not be relied on).
+- CLI and tool messaging: `kxm workflow record --json` with a Runtime run id emits a structured error naming the gap, exits non-zero, and does not write any local file.
+- Retrospective: a terminal Runtime run exports no retrospective and the export path refuses with a clear reason instead of an empty document.
+- Improvement report: Runtime runs are counted as excluded, listed under exclusions, and never ranked.
+- Schema freeze: snapshot test asserting event-store and hub-store schema versions are unchanged by this change. Values come from the existing fixtures, not from this plan.
+
+## Docs
+
+- Design note content: why Hub and Runtime are separate stores; the ten existing categories and stage-id binding carried over unchanged; a Runtime record is bound to a Runtime stage id; retrospective derives from the journal plus receipt; improvement report consumes Runtime signals only after the store lands; private handoff notes stay in summaries and sidecars, no schema field; no auto-promotion of skills or gates from telemetry; which store version would be bumped when S5 closes (left as a placeholder, filled by the writer from the current fixtures at that time).
+- `kxm workflow record` reference and the `kxm-workflow` skill: one sentence stating the Runtime limitation.
+- Tracking: add the blocked row and the trigger.
+
+## Risks and guards
+
+- Risk: a writer "fixes" the refusal by treating a Runtime run as a webhook run. Guard: the no-relabel test and the explicit decision in the design note.
+- Risk: a local JSON fallback journal sneaks in as "not a schema change". Guard: the CLI test asserts no file write; the design note states fallback stores are refused.
+- Risk: smuggling the store early via a store version bump. Refuse. I do not believe a store can land before S5 closes; any bump of either store is exactly what the queue rule forbids, and the packet gives no version numbers to reason about.
+- Risk: improvement report silently drops Runtime runs. Guard: exclusion is listed, not omitted.
+- Refuse: a schema field for handoff notes; auto-promotion from telemetry; any `--force` or alias that maps Runtime ids onto the webhook route.
+
+## Sequence
+
+1. Write the design note.
+2. Add route, retrospective, report, and schema-freeze tests; all pass against current code.
+3. Add the CLI and tool error message; add its test.
+4. Update reference docs, skill, and Tracking in the same change.
+5. `npm run verify`; commit.
+
+## Non-goals
+
+- Runtime journal store, retrospective export, Runtime ranked signals.
+- Any event-store or hub-store schema change.
+- Changing the hub route behaviour.
+- New CLI flags.
+
+## Open questions
+
+- Current event-store and hub-store schema version numbers for the freeze snapshot.
+- Whether Runtime run ids are distinguishable from webhook run ids by shape; if not, the CLI message must trigger on the hub error alone.
+- Where the retrospective export entry point lives for Runtime runs today, if anywhere.
+- Exact file paths for the route handler, report producer, and skill reference.