@kontextmind/kxm 0.7.200 → 0.7.202

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.200",
+      "version": "0.7.202",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/CHANGELOG.md

@@ -225,6 +225,23 @@ All notable user-facing changes are documented here. The project follows [Semant
 
 ### Changed
 
+- **`kxm vision assert` defaults to the admitted OpenRouter GLM route.**
+  The built-in route is `openrouter/z-ai/glm-5.3-flash`, invoked as
+  `pi --model openrouter/z-ai/glm-5.3-flash`. The old default
+  `zai-coding-cn/glm-5.3-flash` is not allowlisted, and that id no longer
+  has a special argv. `kxm init` admits the vision route and does not add
+  a model file or a roster entry for it. A live accuracy witness is
+  `test/core/vision-accuracy.test.ts`. It calls Pi only when
+  `OPENROUTER_API_KEY` is set; otherwise it checks
+  `test/fixtures/vision/` and does not use the network.
+- **`kxm init` starts the writer on Grok 4.7.** The starter model file is
+  `.kxm/models/grok-grok-4-7.yaml` (`grok` / `grok-4.7`, selector
+  `xai/grok-4.7`, alias `grok-default`). The writer roster, the built-in
+  coder and browser modes, the general subagent default, the Pi producer
+  default, and the `kxm routing benchmark` arm list use the same model.
+  Guide candidates and selector examples may still show `grok-4.6`.
+  `.kxm/prices.yaml` keeps both price rows.
+
 - **The planner fallback is Claude Sonnet 5.5.** `claude-fable` stays the
   planner primary. `claude-claude-sonnet-5-5` (`claude` / `claude-sonnet-5.5`,
   selector `anthropic/claude-sonnet-5.5`, read-only, effort `medium`) is the

package/docs/audits/2026-10-gap-audit.md

@@ -17,7 +17,7 @@ Each fix is a small pull request with squash auto-merge. None of them needs a se
 
 `kxm suggest` used to treat a keyword as a substring. "guide" and "build" took the feature workflow because they contain `ui`, "author" took vulnerability remediation because it contains `auth`, and "change" took bug-fix because it contains `hang`. Hyphenated keywords such as `circuit-breaker` still match as one token. A prompt with no keyword still selects `feature-implementation` at score 0.
 
-`kxm vision assert` accepted `--route` and then ignored it. The flag now selects that Pi model after admission. An unknown route names `kxm routes admit`. A native-vendor id is refused before `pi` starts. The CLI reference documents the command. The built-in default route is unchanged. See decision 2.
+`kxm vision assert` accepted `--route` and then ignored it. The flag now selects that Pi model after admission. An unknown route names `kxm routes admit`. A native-vendor id is refused before `pi` starts. The CLI reference documents the command. That pull request left the built-in default route unchanged. Decision 2 changes it.
 
 `kxm init` outside any Git worktree now says to run `git init` and then `kxm init` again. A directory that is not the worktree root still says to run from that root. `kxm hub view` says to start the hub when nothing is listening on a loopback URL, and names the tunnel and `kxm hub bind` for any other URL. An auth proxy or redirect keeps its existing probe note.
 
@@ -66,13 +66,11 @@ Observed on 2026-10-21, before the runner split:
 
 ### 2. The built-in vision route
 
-`kxm vision assert` still defaults to `zai-coding-cn/glm-5.3-flash` and, for that id only, still runs `pi --provider zai-coding-cn --model glm-5.3-flash`. `.kxm/routes.yaml` removed `zai-coding-cn/*` on 2026-09-27 because that provider is not allowlisted. The admitted replacement in this checkout is `openrouter/z-ai/glm-5.3-flash`. A vision call here with no `--route` still fail-closes, and pull request #412 names `kxm routes admit` in that message. `kxm init` does not admit a vision route.
-
-Changing the default needs a vision accuracy witness on the admitted id. This pass kept the verified default argv.
+Approved 2026-10-21 in [pull request #419](https://github.com/kontextmind/kxm/pull/419). `kxm vision assert` defaults to `openrouter/z-ai/glm-5.3-flash` and runs `pi --model <id>` for every route, including that default. `zai-coding-cn/glm-5.3-flash` no longer has a special argv. `kxm init` admits the vision selector and does not write a model file for it. The accuracy witness is `test/fixtures/vision/` and `test/core/vision-accuracy.test.ts`. That test calls Pi only when `OPENROUTER_API_KEY` is set.
 
 ### 3. The starter writer model
 
-`kxm init` still admits `xai/grok-4.6`, writes `.kxm/models/grok-grok-4-6.yaml`, and puts that route on the writer roster. This repository admits `xai/grok-4.7`. `modes.ts`, `subagent-control.ts`, and the Pi producer default still name grok-4.6. Glossary and catalog examples that show grok-4.6 are selector shapes. Replacing the starter is an admission decision, with the tests and docs that pin 4.6 updated in the same change.
+Approved 2026-10-21 in [pull request #418](https://github.com/kontextmind/kxm/pull/418). `kxm init` admits `xai/grok-4.7`, writes `.kxm/models/grok-grok-4-7.yaml`, and puts that route on the writer roster. `modes.ts`, `subagent-control.ts`, and the Pi producer default name grok-4.7. Glossary and catalog examples that show grok-4.6 stay selector shapes.
 
 ### 4. Confirm or reverse the defaults already in Tracking
 

package/docs/contributing/decisions.md

@@ -2,7 +2,7 @@
 title: "Decisions"
 description: "Decisions of medium significance or higher made by automated KXM work in this repository. One entry per decision: the options evaluated with their weights, and why the selected option won. Recorded the turn the decision is taken."
 audience: "agents and maintainers"
-updated: "2026-10-11"
+updated: "2026-10-21"
 ---
 
 # Decisions
@@ -229,3 +229,26 @@ Evidence: `plugins/kxm/src/cli/plugins.ts`, `plugins/kxm/src/session-work.ts`, a
   unverified gate.
 Evidence: `plans/implementation-plan.md`, `plans/plan-python-migration.md`,
 `python/kxm-control/tests/test_mg1.py`, and `.github/workflows/ci.yml`.
+
+## 2026-10-21 — How `kxm init` admits the vision route (routing)
+
+- Context: Eddie approved moving `kxm vision assert` to
+  `openrouter/z-ai/glm-5.3-flash` and asked `kxm init` to admit that route
+  when the change stays small. The gate checks `.kxm/routes.yaml` only.
+  Workforce lint treats an admitted selector with no model file as a warning
+  (`admitted_unrouted`), and a model file that no roster names as an error
+  (`route_unused`).
+- Options:
+  - Admit the selector and skip the model file — weight 0.9. Vision works
+    on a fresh project, and dispatch rosters stay the writer and the planner.
+    The warning does not fail init or `workforce lint`.
+  - Add a model file and put it on a roster — weight 0.3. Clears the warning,
+    but it also makes GLM a dispatch candidate for whichever role receives it.
+  - Leave init unchanged — weight 0.2. A new project still fail-closes on the
+    new default until someone admits the route by hand.
+- Selected: admit the selector only. No model file, no roster entry.
+- Solid recommendation: when a vision role exists, give the route its own
+  read-only model file and roster so the warning goes away without sharing
+  the writer.
+- Interim recommendation: the admitted selector is enough for `kxm vision assert`.
+Evidence: `plugins/kxm/src/template.ts`, `plugins/kxm/src/workforce-names.mjs`, and `test/core/vision-gate.test.ts`.

package/docs/reference/cli-reference.md

@@ -201,7 +201,7 @@ kxm init --dry-run --json
 ```
 
 ```text
-{"schema":"kxm.cli-result.v1","ok":true,"command":"init","action":"planned","mode":"create","inspectedFrom":"/work/proj","projectRoot":"/work/proj","changesRequired":true,"legacyInputs":[],"issues":[],"files":[".kxm/agents/planner.yaml",".kxm/agents/writer.yaml",".kxm/gates.yaml",".kxm/models/claude-fable.yaml",".kxm/models/grok-grok-4-6.yaml",".kxm/project.yaml",".kxm/repo/repo.yaml",".kxm/roles/planner.yaml",".kxm/roles/writer.yaml",".kxm/routes.yaml",".kxm/template-provenance.yaml",".kxm/workflows/default.yaml"],"plannedOnly":true}
+{"schema":"kxm.cli-result.v1","ok":true,"command":"init","action":"planned","mode":"create","inspectedFrom":"/work/proj","projectRoot":"/work/proj","changesRequired":true,"legacyInputs":[],"issues":[],"files":[".kxm/agents/planner.yaml",".kxm/agents/writer.yaml",".kxm/gates.yaml",".kxm/models/claude-fable.yaml",".kxm/models/grok-grok-4-7.yaml",".kxm/project.yaml",".kxm/repo/repo.yaml",".kxm/roles/planner.yaml",".kxm/roles/writer.yaml",".kxm/routes.yaml",".kxm/template-provenance.yaml",".kxm/workflows/default.yaml"],"plannedOnly":true}
 ```
 
 Create the project:
@@ -922,13 +922,13 @@ kxm vision assert --image <path> --question <text> [--route <id>] [--timeout-ms
 |---|---|---|---|
 | `--image` | `<path>` | required | Screenshot file. A missing file fails closed with `image unreadable` |
 | `--question` | `<text>` | required | Yes/no assertion, trimmed to 500 characters inside the prompt |
-| `--route` | `<id>` | `zai-coding-cn/glm-5.3-flash` | Admitted route id. The default keeps the verified Pi command `--provider zai-coding-cn --model glm-5.3-flash`. Any other id is `pi --model <id>` after the native-vendor brake |
+| `--route` | `<id>` | `openrouter/z-ai/glm-5.3-flash` | Admitted route id. Pi is invoked as `pi --model <id>` after the native-vendor brake |
 | `--timeout-ms` | `<n>` | `90000` | Integer from 5000 through 300000 |
 | `--expect` | `true` or `false` | none | Exit 0 only when the verdict equals this value |
 
 - Global options apply, except `--dry-run`, which exits 2 with `dry_run_unsupported` because the command calls Pi.
-- The route must be listed under `admitted` in `.kxm/routes.yaml`. Otherwise the command exits 1 and the `divergence` names the id and `kxm routes admit --model <id>`.
-- This repository does not admit the default `zai-coding-cn/glm-5.3-flash` (`zai-coding-cn` is not an allowlisted harness). Pass `--route openrouter/z-ai/glm-5.3-flash`, which is admitted here, or admit the route you pass.
+- The route must be listed under `admitted` in `.kxm/routes.yaml`. Otherwise the command exits 1 and the `divergence` names the id and `kxm routes admit --model <id>`. `kxm init` admits the default. This repository already admits `openrouter/z-ai/glm-5.3-flash`.
+- A live accuracy witness for that id is `test/fixtures/vision/manifest.json` plus `test/core/vision-accuracy.test.ts`. It calls Pi only when `OPENROUTER_API_KEY` is set. Otherwise it checks the fixture set and does not call the network. Run it with `node --disable-warning=ExperimentalWarning --experimental-strip-types --test --test-force-exit test/core/vision-accuracy.test.ts`.
 - A native-vendor id such as `xai/grok-4.7` or `anthropic/fable` is refused before Pi starts, even when that id is admitted. The `divergence` is the Pi brake message.
 - Exit 0 when the verdict resolves and, if `--expect` is set, matches it. Exit 1 for a fail-closed divergence. Exit 2 when `--image` or `--question` is missing, `--expect` is not `true` or `false`, or `--timeout-ms` is not an integer.
 - JSON keys: `ok`, `command` (`vision assert`), `verdict` (`true`, `false`, or `null`), `route`, `raw`, `divergence` when the gate fails closed, and `expect` when `--expect` is set.
@@ -3036,7 +3036,7 @@ KXM PRE-FLIGHT CONTEXT EXPLAIN
 ════════════════════════════════════════════════════════════
 Major Mode:       coder
 Enabled Domains:  (none)
-Target Model:     grok/grok-4.6
+Target Model:     grok/grok-4.7
 Catalog status:   price catalog missing
 
 CONTEXT BREAKDOWN:
@@ -3661,7 +3661,7 @@ Dedicated offline benchmark for side-by-side model comparison (Decision Q12). To
 | Option | Argument | Default | Description |
 |---|---|---|---|
 | `--task` | `<fixture>` | `Deterministic benchmark task` | Task prompt or fixture path for benchmark comparison |
-| `--arms` | `<models>` | `grok/grok-4.6,claude/fable,pi/qwen3.7-plus` | Comma-separated model routes to benchmark (e.g. grok/grok-4.6,claude/fable) |
+| `--arms` | `<models>` | `grok/grok-4.7,claude/fable,pi/qwen3.7-plus` | Comma-separated model routes to benchmark (e.g. grok/grok-4.6,claude/fable) |
 | `--runs` | `<count>` | `1` | Benchmark runs per arm |
 
 - Reads nothing. JSON keys: `task`, `runs`, `timestamp`, `arms` (`harness`, `model`, `latencyMs`, `tokensIn`, `tokensOut`, `costUsd`, `outcome`).
@@ -3673,7 +3673,7 @@ kxm routing benchmark
 ```text
 Routing Benchmark Results (task: Deterministic benchmark task, runs: 1)
 Harness    Model                     Latency(ms)   TokensIn  TokensOut    Cost($)    Outcome
-grok       grok-4.6                          420       1200        450      $0.17     passed
+grok       grok-4.7                          420       1200        450      $0.17     passed
 claude     fable                             680       1200        450      $0.45     passed
 pi         qwen3.7-plus                  560       1200        450      $0.12     passed
 ```

package/docs/reference/config-reference.md

@@ -398,8 +398,10 @@ resultSchema: kxm.assignment-result.v1
 
 `kxm init` creates `planner` (`role: planner`, alias `coordinator`) and `writer`
 (`role: writer`, alias `implementer`) without `harness` or `model`, and admits
-`anthropic/fable` and `xai/grok-4.6` in `.kxm/routes.yaml`. The model files are
-`claude-fable` and `grok-grok-4-6`. An interactive `kxm init` can add
+`anthropic/fable`, `xai/grok-4.7`, and the vision route
+`openrouter/z-ai/glm-5.3-flash` in `.kxm/routes.yaml`. The model files are
+`claude-fable` and `grok-grok-4-7`. The vision route has no model file and is
+not a roster entry. An interactive `kxm init` can add
 workflow-guide agents for reviewed pairs whose harness is authenticated, and
 admits their selectors too, but skips Google guide candidates because the
 Runtime cannot reach the `antigravity` Pi provider yet. `kxm run` and the

package/docs/start/first-workflow.md

@@ -258,7 +258,7 @@ The file is a `kxm.workflow.v1` definition. `coordinator` names the agent that o
 
 ### Why start with `first` and not `default`
 
-`kxm init` also writes a `default` workflow. Its coordinator plans on `claude` / `anthropic/fable`, its implementer writes the checkout on `grok` / `xai/grok-4.6`, and a `test` gate runs `npm test`; `kxm init` admits exactly those two models in `.kxm/routes.yaml`. You can drive it, but even a simulated drive runs `npm test` in your checkout, and a live drive spends both subscriptions and passes the implement step only when Grok changes the checkout. `first` calls no model and runs no command, so it is the safer first run. [Steps the Runtime does not execute yet](../reference/config-reference.md#steps-the-runtime-does-not-execute-yet) lists every setting that makes a drive hand the run off.
+`kxm init` also writes a `default` workflow. Its coordinator plans on `claude` / `anthropic/fable`, its implementer writes the checkout on `grok` / `xai/grok-4.7`, and a `test` gate runs `npm test`. `kxm init` admits those two models and the vision route `openrouter/z-ai/glm-5.3-flash` in `.kxm/routes.yaml`. The vision id has no model file and is not on a roster. You can drive it, but even a simulated drive runs `npm test` in your checkout, and a live drive spends both subscriptions and passes the implement step only when Grok changes the checkout. `first` calls no model and runs no command, so it is the safer first run. [Steps the Runtime does not execute yet](../reference/config-reference.md#steps-the-runtime-does-not-execute-yet) lists every setting that makes a drive hand the run off.
 
 ### Two kinds of runs
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.200",
+  "version": "0.7.202",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.200",
+  "version": "0.7.202",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/cli.js

@@ -18623,7 +18623,7 @@ var init_workforce_names = __esm({
       ["fable-claude", "claude-fable"],
       // sol-codex stays the GPT-5.6 route. codex-gpt-6-1-sol is a separate route.
       ["sol-codex", "codex-gpt-5-6-sol"],
-      ["grok-default", "grok-grok-4-6"],
+      ["grok-default", "grok-grok-4-7"],
       ["fable-default", "claude-fable"]
     ]);
     AGENT_RENAMES = Object.freeze([
@@ -18824,16 +18824,16 @@ function coreTemplate(projectId, projectName, variant) {
     }
     files.set(".kxm/routes.yaml", {
       schema: "kxm.routes.v2",
-      updatedAt: "2026-09-27T00:00:00.000Z",
-      admitted: ["anthropic/fable", "xai/grok-4.6"],
+      updatedAt: "2026-10-21T00:00:00.000Z",
+      admitted: ["anthropic/fable", "xai/grok-4.7", "openrouter/z-ai/glm-5.3-flash"],
       disabled: []
     });
-    files.set(".kxm/models/grok-grok-4-6.yaml", {
+    files.set(".kxm/models/grok-grok-4-7.yaml", {
       schema: "kxm.model.v2",
-      id: "grok-grok-4-6",
+      id: "grok-grok-4-7",
       aliases: ["grok-default"],
       harness: "grok",
-      model: "grok-4.6",
+      model: "grok-4.7",
       vendor: "xai",
       status: "admitted",
       permissions: ["edit"]
@@ -18854,7 +18854,7 @@ function coreTemplate(projectId, projectName, variant) {
       purpose: "writer",
       permission: "edit",
       description: "Primary implementation agent.",
-      roster: [{ route: "grok-grok-4-6", effort: "medium" }]
+      roster: [{ route: "grok-grok-4-7", effort: "medium" }]
     });
     files.set(".kxm/roles/planner.yaml", {
       schema: "kxm.role.v2",
@@ -28904,9 +28904,6 @@ function parseVisionVerdict(raw) {
   return match ? match[1] === "true" : null;
 }
 function visionPiArgs(route) {
-  if (route === VISION_GATE_DEFAULT_ROUTE) {
-    return { ok: true, args: ["--provider", "zai-coding-cn", "--model", "glm-5.3-flash", "-p", "--no-session"] };
-  }
   const validation = validateHarnessModelPair("pi", route);
   if (!validation.valid) {
     return { ok: false, divergence: validation.message ?? "route_not_pi" };
@@ -28959,7 +28956,7 @@ var init_vision_gate = __esm({
     "use strict";
     init_harness();
     init_routes();
-    VISION_GATE_DEFAULT_ROUTE = "zai-coding-cn/glm-5.3-flash";
+    VISION_GATE_DEFAULT_ROUTE = "openrouter/z-ai/glm-5.3-flash";
     QUESTION_MAX_CHARS = 500;
     RAW_MAX_CHARS = 2e3;
   }
@@ -55403,7 +55400,7 @@ var DEFAULT_MODES_CONFIG = Object.freeze({
       baseTools: ["read", "edit", "write", "bash"],
       contextFiles: ["AGENTS.md"],
       thinkingLevel: "medium",
-      model: "grok/grok-4.6"
+      model: "grok/grok-4.7"
     },
     planner: {
       description: "High-level architectural planning, scoping, and decomposition",
@@ -55424,7 +55421,7 @@ var DEFAULT_MODES_CONFIG = Object.freeze({
       baseTools: ["read", "bash"],
       contextFiles: ["docs/guides/browser-automation.md"],
       thinkingLevel: "medium",
-      model: "grok/grok-4.6"
+      model: "grok/grok-4.7"
     }
   },
   domains: {
@@ -55501,7 +55498,7 @@ function resolveActiveMode(config, majorModeName = "coder", domainNames = []) {
     contextFiles: Array.from(contextFiles),
     promptSnippets,
     thinkingLevel: major.thinkingLevel,
-    model: major.model || "grok/grok-4.6"
+    model: major.model || "grok/grok-4.7"
   };
 }
 var CATALOG_DATE_RE = /^[0-9]{4}-[0-9]{2}-[0-9]{2}$/;
@@ -55592,7 +55589,7 @@ function calculatePromptFootprint(resolved, projectRoot = process.cwd(), catalog
     catalogDateForStatus(loaded2, catalog, projectRoot)
   );
   const cat = loaded2.catalog;
-  const rawModel = resolved.model || "grok/grok-4.6";
+  const rawModel = resolved.model || "grok/grok-4.7";
   const [prov, mod] = rawModel.includes("/") ? rawModel.split("/", 2) : [void 0, rawModel];
   const inputCost = cat ? calculateModelCost(cat, {
     model: mod || rawModel,
@@ -55621,7 +55618,7 @@ function calculatePromptFootprint(resolved, projectRoot = process.cwd(), catalog
   return {
     majorMode: resolved.majorMode,
     enabledDomains: resolved.enabledDomains,
-    model: resolved.model || "grok/grok-4.6",
+    model: resolved.model || "grok/grok-4.7",
     breakdown,
     totalChars,
     totalTokens,
@@ -58146,7 +58143,7 @@ async function cmdRoutingReport(runtime, options) {
 }
 async function cmdRoutingBenchmark(runtime, options) {
   const task = options.task || "Deterministic benchmark task";
-  const armsStr = options.arms || "grok/grok-4.6,claude/fable,pi/qwen3.7-plus";
+  const armsStr = options.arms || "grok/grok-4.7,claude/fable,pi/qwen3.7-plus";
   const armsList = armsStr.split(",").map((s) => s.trim()).filter(Boolean);
   const runsCount = Math.max(1, parseInt(options.runs || "1", 10) || 1);
   const arms = armsList.map((arm) => {
@@ -58732,7 +58729,7 @@ function createProgram(ctx, result, argv) {
   }
   const visionCmd = addGlobalOptions(program2.command("vision").description("Judge captured UI screenshots through the admitted vision gate"));
   visionCmd.helpCommand("help", "Show vision help");
-  addGlobalOptions(visionCmd.command("assert").description("Assert a UI state on a screenshot (deterministic vision gate)")).requiredOption("--image <path>", "Path to the captured screenshot").requiredOption("--question <text>", "Yes/no assertion to verify on the screenshot").option("--route <id>", `Vision route (default ${"zai-coding-cn/glm-5.3-flash"})`).option("--timeout-ms <n>", "Transport timeout in milliseconds (5000-300000)").option("--expect <bool>", "Exit 0 only when the verdict matches true|false").action(async function visionAssertAction(options) {
+  addGlobalOptions(visionCmd.command("assert").description("Assert a UI state on a screenshot (deterministic vision gate)")).requiredOption("--image <path>", "Path to the captured screenshot").requiredOption("--question <text>", "Yes/no assertion to verify on the screenshot").option("--route <id>", `Vision route (default ${"openrouter/z-ai/glm-5.3-flash"})`).option("--timeout-ms <n>", "Transport timeout in milliseconds (5000-300000)").option("--expect <bool>", "Exit 0 only when the verdict matches true|false").action(async function visionAssertAction(options) {
     result.code = await cmdVisionAssert(runtimeFrom(ctx, this), options ?? {});
   });
   const harnessCmd = addGlobalOptions(program2.command("harness").description("Detect coding-agent harnesses and authentication"));

package/plugins/kxm/dist/mcp-server.js

@@ -25462,7 +25462,7 @@ function sessionTokenFixHint(policy) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.200";
+var VERSION = "0.7.202";
 var CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();

package/plugins/kxm/dist/runtime-supervisor.js

@@ -15547,7 +15547,7 @@ var ROUTE_RENAMES = Object.freeze([
   ["fable-claude", "claude-fable"],
   // sol-codex stays the GPT-5.6 route. codex-gpt-6-1-sol is a separate route.
   ["sol-codex", "codex-gpt-5-6-sol"],
-  ["grok-default", "grok-grok-4-6"],
+  ["grok-default", "grok-grok-4-7"],
   ["fable-default", "claude-fable"]
 ]);
 var AGENT_RENAMES = Object.freeze([
@@ -15972,16 +15972,16 @@ function coreTemplate(projectId, projectName, variant) {
     }
     files.set(".kxm/routes.yaml", {
       schema: "kxm.routes.v2",
-      updatedAt: "2026-09-27T00:00:00.000Z",
-      admitted: ["anthropic/fable", "xai/grok-4.6"],
+      updatedAt: "2026-10-21T00:00:00.000Z",
+      admitted: ["anthropic/fable", "xai/grok-4.7", "openrouter/z-ai/glm-5.3-flash"],
       disabled: []
     });
-    files.set(".kxm/models/grok-grok-4-6.yaml", {
+    files.set(".kxm/models/grok-grok-4-7.yaml", {
       schema: "kxm.model.v2",
-      id: "grok-grok-4-6",
+      id: "grok-grok-4-7",
       aliases: ["grok-default"],
       harness: "grok",
-      model: "grok-4.6",
+      model: "grok-4.7",
       vendor: "xai",
       status: "admitted",
       permissions: ["edit"]
@@ -16002,7 +16002,7 @@ function coreTemplate(projectId, projectName, variant) {
       purpose: "writer",
       permission: "edit",
       description: "Primary implementation agent.",
-      roster: [{ route: "grok-grok-4-6", effort: "medium" }]
+      roster: [{ route: "grok-grok-4-7", effort: "medium" }]
     });
     files.set(".kxm/roles/planner.yaml", {
       schema: "kxm.role.v2",

package/plugins/kxm/dist/runtime.js

@@ -15520,7 +15520,7 @@ var ROUTE_RENAMES = Object.freeze([
   ["fable-claude", "claude-fable"],
   // sol-codex stays the GPT-5.6 route. codex-gpt-6-1-sol is a separate route.
   ["sol-codex", "codex-gpt-5-6-sol"],
-  ["grok-default", "grok-grok-4-6"],
+  ["grok-default", "grok-grok-4-7"],
   ["fable-default", "claude-fable"]
 ]);
 var AGENT_RENAMES = Object.freeze([
@@ -15945,16 +15945,16 @@ function coreTemplate(projectId, projectName, variant) {
     }
     files.set(".kxm/routes.yaml", {
       schema: "kxm.routes.v2",
-      updatedAt: "2026-09-27T00:00:00.000Z",
-      admitted: ["anthropic/fable", "xai/grok-4.6"],
+      updatedAt: "2026-10-21T00:00:00.000Z",
+      admitted: ["anthropic/fable", "xai/grok-4.7", "openrouter/z-ai/glm-5.3-flash"],
       disabled: []
     });
-    files.set(".kxm/models/grok-grok-4-6.yaml", {
+    files.set(".kxm/models/grok-grok-4-7.yaml", {
       schema: "kxm.model.v2",
-      id: "grok-grok-4-6",
+      id: "grok-grok-4-7",
       aliases: ["grok-default"],
       harness: "grok",
-      model: "grok-4.6",
+      model: "grok-4.7",
       vendor: "xai",
       status: "admitted",
       permissions: ["edit"]
@@ -15975,7 +15975,7 @@ function coreTemplate(projectId, projectName, variant) {
       purpose: "writer",
       permission: "edit",
       description: "Primary implementation agent.",
-      roster: [{ route: "grok-grok-4-6", effort: "medium" }]
+      roster: [{ route: "grok-grok-4-7", effort: "medium" }]
     });
     files.set(".kxm/roles/planner.yaml", {
       schema: "kxm.role.v2",
@@ -34555,7 +34555,7 @@ var PiSession = class {
 };
 function createKxmPiProducer(options = {}) {
   const sessions = /* @__PURE__ */ new Map();
-  const defaultModel = options.defaultModel ?? "xai/grok-4.6";
+  const defaultModel = options.defaultModel ?? "xai/grok-4.7";
   const defaultProvider = options.defaultProvider ?? "xai";
   function parseModelString(spec) {
     const trimmed = spec.trim();
@@ -35776,7 +35776,7 @@ var DEFAULT_MODES_CONFIG = Object.freeze({
       baseTools: ["read", "edit", "write", "bash"],
       contextFiles: ["AGENTS.md"],
       thinkingLevel: "medium",
-      model: "grok/grok-4.6"
+      model: "grok/grok-4.7"
     },
     planner: {
       description: "High-level architectural planning, scoping, and decomposition",
@@ -35797,7 +35797,7 @@ var DEFAULT_MODES_CONFIG = Object.freeze({
       baseTools: ["read", "bash"],
       contextFiles: ["docs/guides/browser-automation.md"],
       thinkingLevel: "medium",
-      model: "grok/grok-4.6"
+      model: "grok/grok-4.7"
     }
   },
   domains: {
@@ -35874,7 +35874,7 @@ function resolveActiveMode(config, majorModeName = "coder", domainNames = []) {
     contextFiles: Array.from(contextFiles),
     promptSnippets,
     thinkingLevel: major.thinkingLevel,
-    model: major.model || "grok/grok-4.6"
+    model: major.model || "grok/grok-4.7"
   };
 }
 var CATALOG_DATE_RE = /^[0-9]{4}-[0-9]{2}-[0-9]{2}$/;
@@ -35965,7 +35965,7 @@ function calculatePromptFootprint(resolved, projectRoot = process.cwd(), catalog
     catalogDateForStatus(loaded, catalog, projectRoot)
   );
   const cat = loaded.catalog;
-  const rawModel = resolved.model || "grok/grok-4.6";
+  const rawModel = resolved.model || "grok/grok-4.7";
   const [prov, mod] = rawModel.includes("/") ? rawModel.split("/", 2) : [void 0, rawModel];
   const inputCost = cat ? calculateModelCost(cat, {
     model: mod || rawModel,
@@ -35994,7 +35994,7 @@ function calculatePromptFootprint(resolved, projectRoot = process.cwd(), catalog
   return {
     majorMode: resolved.majorMode,
     enabledDomains: resolved.enabledDomains,
-    model: resolved.model || "grok/grok-4.6",
+    model: resolved.model || "grok/grok-4.7",
     breakdown,
     totalChars,
     totalTokens,
@@ -36451,7 +36451,7 @@ var SUBAGENT_TYPES = Object.freeze([
   "Auditor"
 ]);
 var DEFAULT_SUBAGENT_MODELS = Object.freeze({
-  general: "grok/grok-4.6",
+  general: "grok/grok-4.7",
   Explore: "openrouter/qwen/qwen3.7-plus",
   Plan: "claude/fable",
   Reviewer: "openai/gpt-5.6-sol",
@@ -36491,7 +36491,7 @@ var SubagentManager = class {
       throw new Error('Subagent "description" is required.');
     }
     const type = params.type ?? "general";
-    const model = params.model ?? DEFAULT_SUBAGENT_MODELS[type] ?? "grok/grok-4.6";
+    const model = params.model ?? DEFAULT_SUBAGENT_MODELS[type] ?? "grok/grok-4.7";
     const thinking = params.thinking ?? "low";
     const allowedTools = narrowSubagentTools(params.allowed_tools, params.parent_tools);
     const id = `ag_${randomUUID5().replaceAll("-", "").slice(0, 10)}`;

package/plugins/kxm/dist/server.js

@@ -15012,7 +15012,7 @@ var ROUTE_RENAMES = Object.freeze([
   ["fable-claude", "claude-fable"],
   // sol-codex stays the GPT-5.6 route. codex-gpt-6-1-sol is a separate route.
   ["sol-codex", "codex-gpt-5-6-sol"],
-  ["grok-default", "grok-grok-4-6"],
+  ["grok-default", "grok-grok-4-7"],
   ["fable-default", "claude-fable"]
 ]);
 var AGENT_RENAMES = Object.freeze([

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.200",
+  "version": "0.7.202",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/skills/kxm-browser-verify/SKILL.md

@@ -106,5 +106,5 @@ kxm vision assert --image .kxm/artifacts/browser/shot.png \
 ```
 
 - Exit 0 only when the verdict resolves and matches `--expect`; fail-closed divergences (`route_not_admitted`, `image unreadable`, `verdict unreadable`, or the Pi native-vendor brake) exit 1.
-- The route must be admitted in `.kxm/routes.yaml`. The built-in default is `zai-coding-cn/glm-5.3-flash` (the verified Pi invocation `--provider zai-coding-cn --model glm-5.3-flash`). This checkout does not admit that id. Pass `--route openrouter/z-ai/glm-5.3-flash`, which is admitted here. `--route` selects the Pi model; a native-vendor id is refused before Pi starts.
+- The route must be admitted in `.kxm/routes.yaml`. The built-in default is `openrouter/z-ai/glm-5.3-flash`, invoked as `pi --model openrouter/z-ai/glm-5.3-flash`. `kxm init` admits that id, and this checkout already admits it. `--route` selects the Pi model; a native-vendor id is refused before Pi starts.
 - The gate is a supplement to deterministic Playwright assertions, never a replacement.

package/plugins/kxm/src/cli/system.ts

@@ -1071,7 +1071,7 @@ export async function cmdRoutingBenchmark(
   options: { task?: string | undefined; arms?: string | undefined; runs?: string | undefined },
 ): Promise<number> {
   const task = options.task || "Deterministic benchmark task";
-  const armsStr = options.arms || "grok/grok-4.6,claude/fable,pi/qwen3.7-plus";
+  const armsStr = options.arms || "grok/grok-4.7,claude/fable,pi/qwen3.7-plus";
   const armsList = armsStr.split(",").map((s) => s.trim()).filter(Boolean);
   const runsCount = Math.max(1, parseInt(options.runs || "1", 10) || 1);
 

package/plugins/kxm/src/cli.ts

@@ -757,7 +757,7 @@ function createProgram(ctx: CliContext, result: { code: number }, argv: readonly
   addGlobalOptions(visionCmd.command("assert").description("Assert a UI state on a screenshot (deterministic vision gate)"))
     .requiredOption("--image <path>", "Path to the captured screenshot")
     .requiredOption("--question <text>", "Yes/no assertion to verify on the screenshot")
-    .option("--route <id>", `Vision route (default ${"zai-coding-cn/glm-5.3-flash"})`)
+    .option("--route <id>", `Vision route (default ${"openrouter/z-ai/glm-5.3-flash"})`)
     .option("--timeout-ms <n>", "Transport timeout in milliseconds (5000-300000)")
     .option("--expect <bool>", "Exit 0 only when the verdict matches true|false")
     .action(async function visionAssertAction(this: Command, options: { image?: string; question?: string; route?: string; timeoutMs?: string; expect?: string }) { result.code = await cmdVisionAssert(runtimeFrom(ctx, this), options ?? {}); });

package/plugins/kxm/src/mcp-server.ts

@@ -11,7 +11,7 @@ import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 import { sessionTokenFixHint } from "./session-token-hint.ts";
 
-const VERSION = "0.7.200";
+const VERSION = "0.7.202";
 const CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();

package/plugins/kxm/src/modes.ts

@@ -80,7 +80,7 @@ export const DEFAULT_MODES_CONFIG: ModesConfig = Object.freeze({
       baseTools: ["read", "edit", "write", "bash"],
       contextFiles: ["AGENTS.md"],
       thinkingLevel: "medium" as const,
-      model: "grok/grok-4.6",
+      model: "grok/grok-4.7",
     },
     planner: {
       description: "High-level architectural planning, scoping, and decomposition",
@@ -101,7 +101,7 @@ export const DEFAULT_MODES_CONFIG: ModesConfig = Object.freeze({
       baseTools: ["read", "bash"],
       contextFiles: ["docs/guides/browser-automation.md"],
       thinkingLevel: "medium" as const,
-      model: "grok/grok-4.6",
+      model: "grok/grok-4.7",
     },
   },
   domains: {
@@ -201,7 +201,7 @@ export function resolveActiveMode(
     contextFiles: Array.from(contextFiles),
     promptSnippets,
     thinkingLevel: major.thinkingLevel,
-    model: major.model || "grok/grok-4.6",
+    model: major.model || "grok/grok-4.7",
   };
 }
 
@@ -330,7 +330,7 @@ export function calculatePromptFootprint(
     catalogDateForStatus(loaded, catalog, projectRoot),
   );
   const cat = loaded.catalog;
-  const rawModel = resolved.model || "grok/grok-4.6";
+  const rawModel = resolved.model || "grok/grok-4.7";
   const [prov, mod] = rawModel.includes("/") ? rawModel.split("/", 2) : [undefined, rawModel];
 
   const inputCost = cat
@@ -369,7 +369,7 @@ export function calculatePromptFootprint(
   return {
     majorMode: resolved.majorMode,
     enabledDomains: resolved.enabledDomains,
-    model: resolved.model || "grok/grok-4.6",
+    model: resolved.model || "grok/grok-4.7",
     breakdown,
     totalChars,
     totalTokens,

package/plugins/kxm/src/pi-producer.ts

@@ -448,7 +448,7 @@ export interface KxmPiProducer extends KxmProducer {
 
 export function createKxmPiProducer(options: KxmPiProducerOptions = {}): KxmPiProducer {
   const sessions = new Map<string, PiSession>();
-  const defaultModel = options.defaultModel ?? "xai/grok-4.6";
+  const defaultModel = options.defaultModel ?? "xai/grok-4.7";
   const defaultProvider = options.defaultProvider ?? "xai";
 
   function parseModelString(spec: string): { provider: string; model: string } {

package/plugins/kxm/src/subagent-control.ts

@@ -76,7 +76,7 @@ export const SUBAGENT_TYPES: readonly SubagentType[] = Object.freeze([
 ]);
 
 export const DEFAULT_SUBAGENT_MODELS: Readonly<Record<SubagentType, string>> = Object.freeze({
-  general: "grok/grok-4.6",
+  general: "grok/grok-4.7",
   Explore: "openrouter/qwen/qwen3.7-plus",
   Plan: "claude/fable",
   Reviewer: "openai/gpt-5.6-sol",
@@ -135,7 +135,7 @@ export class SubagentManager {
     }
 
     const type = params.type ?? "general";
-    const model = params.model ?? DEFAULT_SUBAGENT_MODELS[type] ?? "grok/grok-4.6";
+    const model = params.model ?? DEFAULT_SUBAGENT_MODELS[type] ?? "grok/grok-4.7";
     const thinking = params.thinking ?? "low";
     const allowedTools = narrowSubagentTools(params.allowed_tools, params.parent_tools);
     const id = `ag_${randomUUID().replaceAll("-", "").slice(0, 10)}`;

package/plugins/kxm/src/template.ts

@@ -209,22 +209,24 @@ function coreTemplate(projectId: string, projectName: string, variant: KxmTempla
       });
       files.set(".kxm/workflows/default.yaml", { ...workflow, coordinator: "planner", limits, steps });
     }
-    // The two models the template names, and nothing else. A fresh project can
-    // be driven without falling through to an unadmitted default model.
+    // The two roster models the template names, plus the vision selector the
+    // built-in gate defaults to. That selector has no model file and is not a
+    // roster route. A fresh project can be driven without falling through to
+    // an unadmitted default model.
     // Route ids follow <harness>-<model-slug>. grok-default and fable-default
     // remain aliases so an existing --route flag still resolves.
     files.set(".kxm/routes.yaml", {
       schema: "kxm.routes.v2",
-      updatedAt: "2026-09-27T00:00:00.000Z",
-      admitted: ["anthropic/fable", "xai/grok-4.6"],
+      updatedAt: "2026-10-21T00:00:00.000Z",
+      admitted: ["anthropic/fable", "xai/grok-4.7", "openrouter/z-ai/glm-5.3-flash"],
       disabled: [],
     });
-    files.set(".kxm/models/grok-grok-4-6.yaml", {
+    files.set(".kxm/models/grok-grok-4-7.yaml", {
       schema: "kxm.model.v2",
-      id: "grok-grok-4-6",
+      id: "grok-grok-4-7",
       aliases: ["grok-default"],
       harness: "grok",
-      model: "grok-4.6",
+      model: "grok-4.7",
       vendor: "xai",
       status: "admitted",
       permissions: ["edit"],
@@ -245,7 +247,7 @@ function coreTemplate(projectId: string, projectName: string, variant: KxmTempla
       purpose: "writer",
       permission: "edit",
       description: "Primary implementation agent.",
-      roster: [{ route: "grok-grok-4-6", effort: "medium" }],
+      roster: [{ route: "grok-grok-4-7", effort: "medium" }],
     });
     files.set(".kxm/roles/planner.yaml", {
       schema: "kxm.role.v2",

package/plugins/kxm/src/vision-gate.ts

@@ -10,7 +10,7 @@ import { isRouteAdmitted } from "./routes.ts";
  * `divergence` reason. Transport is injectable so tests run without
  * network. */
 
-export const VISION_GATE_DEFAULT_ROUTE = "zai-coding-cn/glm-5.3-flash";
+export const VISION_GATE_DEFAULT_ROUTE = "openrouter/z-ai/glm-5.3-flash";
 const QUESTION_MAX_CHARS = 500;
 const RAW_MAX_CHARS = 2000;
 
@@ -54,13 +54,9 @@ export function parseVisionVerdict(raw: string): boolean | null {
 }
 
 /** Pi argv for an admitted vision route, without the prompt.
- * The verified default keeps `--provider zai-coding-cn --model glm-5.3-flash`.
- * Every other id is `pi --model <id>` after the native-vendor brake, so
- * `--route` selects the model instead of only the admission check. */
+ * Every id, including the default, is `pi --model <id>` after the
+ * native-vendor brake, so `--route` selects the model. */
 export function visionPiArgs(route: string): { ok: true; args: readonly string[] } | { ok: false; divergence: string } {
-  if (route === VISION_GATE_DEFAULT_ROUTE) {
-    return { ok: true, args: ["--provider", "zai-coding-cn", "--model", "glm-5.3-flash", "-p", "--no-session"] };
-  }
   const validation = validateHarnessModelPair("pi", route);
   if (!validation.valid) {
     return { ok: false, divergence: validation.message ?? "route_not_pi" };

package/plugins/kxm/src/workforce-names.mjs

@@ -38,7 +38,7 @@ export const ROUTE_RENAMES = Object.freeze([
   ["fable-claude", "claude-fable"],
   // sol-codex stays the GPT-5.6 route. codex-gpt-6-1-sol is a separate route.
   ["sol-codex", "codex-gpt-5-6-sol"],
-  ["grok-default", "grok-grok-4-6"],
+  ["grok-default", "grok-grok-4-7"],
   ["fable-default", "claude-fable"],
 ]);