@kontextmind/kxm 0.7.29 → 0.7.32

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.29",
+      "version": "0.7.32",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/docs/agent-skills.md

@@ -3,7 +3,7 @@
 This document describes the bundled KXM Agent Skills suite: focused skills
 that cover current KXM top-level command groups. The suite documents the
 existing CLI. It does **not** land unified YAML role/project/workflow
-authority, admit new writers, or replace trusted `.kxm/roster.json` policy.
+authority, admit new writers, or replace trusted `.kxm/roster.yaml` policy.
 
 ## Feature-to-Skill Matrix
 

package/docs/assignment-runner.md

@@ -16,7 +16,7 @@ policy.
 ## 1. Overview and role rotation
 
 Developer orchestration on this runner uses a role-based rotation backed by
-trusted policy in [`.kxm/roster.json`](../.kxm/roster.json). Roles, harnesses,
+trusted policy in [`.kxm/roster.yaml`](../.kxm/roster.yaml). Roles, harnesses,
 and models are admitted with strict permission and vendor boundaries:
 
 | Role | Admitted route | Vendor | Permission | Purpose |
@@ -36,7 +36,7 @@ and models are admitted with strict permission and vendor boundaries:
   exceed the admitted ceiling (e.g. attempting to give edit permissions to a
   read-only reviewer).
 - **Trusted roster policy:** Dispatch (`assign` / `run`) and accept load
-  `.kxm/roster.json` through the trusted control Git loader
+  `.kxm/roster.yaml` through the trusted control Git loader
   (`loadTrustedRosterPolicy`). Loader errors, missing/empty policy, and
   malformed policy fail closed with `route_invalid`. There is no raw working-tree
   JSON fallback and no null-policy acceptance. Tests may inject an explicit
@@ -96,7 +96,7 @@ node scripts/assignment-run.mjs run --manifest /absolute/path/to/manifest.json
 ```
 
 - Manifest validation asserts worktree cleanliness and validates the route
-  against `.kxm/roster.json`.
+  against `.kxm/roster.yaml`.
 - Headless execution dispatches to the native harness (or OpenRouter via Pi for
   admitted relief).
 - Successful runs write `completion.json`, candidate snapshot metadata, and
@@ -219,7 +219,7 @@ The runner fails closed with bounded error codes defined in `RUNNER_CODES`:
 
 | Code | Trigger condition | Remedy |
 |---|---|---|
-| `route_invalid` | Harness/model not admitted in lineup for the requested role, permission exceeds route ceiling, or trusted roster policy cannot be loaded/validated. | Use a trusted clean control checkout; do not dispatch from a dirty implementation branch. Check `.kxm/roster.json` lineup and permissions for the role. |
+| `route_invalid` | Harness/model not admitted in lineup for the requested role, permission exceeds route ceiling, or trusted roster policy cannot be loaded/validated. | Use a trusted clean control checkout; do not dispatch from a dirty implementation branch. Check `.kxm/roster.yaml` lineup and permissions for the role. |
 | `critic_invalid` | Missing required critic role, duplicate roles, wrong model, or vendor collision between writer and critics. | Ensure independent critics (Fable + Sol) from distinct providers. |
 | `critic_block` | An unresolved `BLOCK` verdict exists for the target tree. | Rework the changes, address findings, and pass review with a `rework_of` link. |
 | `commit_tree_mismatch` | Git commit tree does not equal the witnessed tree. | Commit the exact candidate tree verified by the witness before running accept. |

package/docs/getting-started.md

@@ -77,7 +77,7 @@ too). kxm resolves each role's first guide candidate whose harness is
 authenticated and writes only current vNext project resources —
 `.kxm/agents/<role>.yaml` (`kxm.agent.v1`) and `.kxm/workflows/<slug>.yaml`
 (`kxm.workflow.v1`). It never writes retired legacy authority (`.kxm/config`,
-`.kxm/roster.json`). Roles whose candidates have no authenticated harness are
+retired `.kxm/roster.json`) or the trusted `.kxm/roster.yaml` policy. Roles whose candidates have no authenticated harness are
 reported as skipped, not silently downgraded. Guide candidates are dated
 research — verify them before dispatch. Declining is safe: set
 `KXM_SKIP_GUIDE_SETUP_PROMPT=1` to suppress the offer.

package/docs/workflow-guide.md

@@ -74,7 +74,7 @@ pull request (five CI jobs: 2 Linux validate, classify, docs, plugin)
 
 **Runner loop invariants:**
 
-- **Roles and rotation:** The runner strictly maps assignments to authenticated roster roles (`AGENTS.md` and `.kxm/roster.json`):
+- **Roles and rotation:** The runner strictly maps assignments to authenticated roster roles (`AGENTS.md` and `.kxm/roster.yaml`):
   - **Implement / write code (`writer`):** **Grok** (`grok --model grok-4.6`, headless). Currently admitted native writer on this runner. Failover follows attempts-and-relief: after an empty or failed attempt, immediately fail over to the next eligible authenticated writer in the roster (**Qwen** `openrouter/qwen/qwen3-coder-plus` via Pi).
   - **Plan (`planner`):** **Claude Fable** (`claude --model fable`), read-only architecture and permissions planning.
   - **Review architecture (`reviewer-arch`):** **Claude Fable** (`claude --model fable`), designated architecture and permissions critic.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.29",
+  "version": "0.7.32",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.29",
+  "version": "0.7.32",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/cli.js

@@ -24951,33 +24951,29 @@ function loadPriceCatalogForEstimate(options) {
 // plugins/kxm/src/vnext-engine.ts
 var import_yaml5 = __toESM(require_dist(), 1);
 
-// plugins/kxm/src/producers.ts
+// plugins/kxm/src/routes.ts
 var import_yaml4 = __toESM(require_dist(), 1);
 import { existsSync as existsSync11, readFileSync as readFileSync10, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7, readdirSync as readdirSync3 } from "node:fs";
 import { join as join11 } from "node:path";
-var empty = () => ({ schema: "kxm.producers.v1", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), promoted: [], demoted: [], enabled: [], disabled: [], roles: {} });
-function loadProducerPolicy(root) {
-  const path4 = join11(root, ".kxm", "producers.yaml");
+var RETIRED_POLICY = ".kxm/producers.yaml";
+var empty = () => ({ schema: "kxm.routes.v2", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), admitted: [], disabled: [], roles: {} });
+function loadRoutePolicy(root) {
+  if (existsSync11(join11(root, RETIRED_POLICY))) throw new Error(`retired ${RETIRED_POLICY} present; use .kxm/routes.yaml (kxm.routes.v2)`);
+  const path4 = join11(root, ".kxm", "routes.yaml");
   if (!existsSync11(path4)) return empty();
   const value = (0, import_yaml4.parse)(readFileSync10(path4, "utf8"));
-  if (value?.schema !== "kxm.producers.v1" || !Array.isArray(value.promoted) || !Array.isArray(value.demoted)) throw new Error("invalid .kxm/producers.yaml");
-  return { schema: "kxm.producers.v1", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : (/* @__PURE__ */ new Date()).toISOString(), promoted: value.promoted.filter((x2) => typeof x2 === "string"), demoted: value.demoted.filter((x2) => typeof x2 === "string"), enabled: Array.isArray(value.enabled) ? value.enabled.filter((x2) => typeof x2 === "string") : [], disabled: Array.isArray(value.disabled) ? value.disabled.filter((x2) => typeof x2 === "string") : [], roles: value.roles && typeof value.roles === "object" ? Object.fromEntries(Object.entries(value.roles).filter(([, v2]) => Array.isArray(v2)).map(([k, v2]) => [k, v2.filter((x2) => typeof x2 === "string")])) : {} };
-}
-function updateProducer(root, model, status) {
-  const policy = loadProducerPolicy(root);
-  policy.promoted = policy.promoted.filter((x2) => x2 !== model);
-  policy.demoted = policy.demoted.filter((x2) => x2 !== model);
-  policy[status].push(model);
-  policy.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  mkdirSync7(join11(root, ".kxm"), { recursive: true });
-  writeFileSync7(join11(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
-  return policy;
+  if (value?.schema !== "kxm.routes.v2" || !Array.isArray(value.admitted)) throw new Error("invalid .kxm/routes.yaml");
+  return { schema: "kxm.routes.v2", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : (/* @__PURE__ */ new Date()).toISOString(), admitted: value.admitted.filter((x2) => typeof x2 === "string"), disabled: Array.isArray(value.disabled) ? value.disabled.filter((x2) => typeof x2 === "string") : [], roles: value.roles && typeof value.roles === "object" ? Object.fromEntries(Object.entries(value.roles).filter(([, v2]) => Array.isArray(v2)).map(([k, v2]) => [k, v2.filter((x2) => typeof x2 === "string")])) : {} };
+}
+function updateRouteState(root, model, state) {
+  return setRouteState(root, model, state);
 }
-function setModelState(root, model, state, role, removeRole2 = false) {
-  const policy = loadProducerPolicy(root);
-  policy.enabled = policy.enabled.filter((x2) => x2 !== model);
+function setRouteState(root, model, state, role, removeRole2 = false) {
+  const policy = loadRoutePolicy(root);
+  policy.admitted = policy.admitted.filter((x2) => x2 !== model);
   policy.disabled = policy.disabled.filter((x2) => x2 !== model);
-  policy[state].push(model);
+  if (state === "admitted") policy.admitted.push(model);
+  else policy.disabled.push(model);
   if (role) {
     if (!/^[a-z][a-z0-9_-]{0,63}$/i.test(role)) throw new Error("invalid role id");
     const rolePath = join11(root, ".kxm", "roles", `${role}.yaml`);
@@ -24999,7 +24995,7 @@ function setModelState(root, model, state, role, removeRole2 = false) {
   }
   policy.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
   mkdirSync7(join11(root, ".kxm"), { recursive: true });
-  writeFileSync7(join11(root, ".kxm", "producers.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
+  writeFileSync7(join11(root, ".kxm", "routes.yaml"), (0, import_yaml4.stringify)(policy), "utf8");
   return policy;
 }
 function listRoleBindings(root) {
@@ -33853,7 +33849,7 @@ async function cmdHarnessList(runtime) {
   print(runtime.io, runtime.json, { ok: true, command: "harness list", ...inventory }, formatHarnessInventory(inventory));
   return 0;
 }
-async function selectProducerModel(runtime, requested) {
+async function selectInventoryModel(runtime, requested) {
   const models = listInventoryModels(runtime.dirs.workdir);
   if (requested) return models.find((model) => model.toLowerCase() === requested.toLowerCase());
   if (runtime.json || !process.stdin.isTTY || models.length === 0) return void 0;
@@ -33864,18 +33860,18 @@ async function selectProducerModel(runtime, requested) {
   const index = Number.parseInt(answer.trim(), 10) - 1;
   return Number.isInteger(index) && index >= 0 && index < models.length ? models[index] : void 0;
 }
-async function cmdProducerChange(runtime, status, requested) {
-  const model = await selectProducerModel(runtime, requested);
+async function cmdRouteChange(runtime, status, requested) {
+  const model = await selectInventoryModel(runtime, requested);
   if (!model) {
-    print(runtime.io, runtime.json, { ok: false, command: `producers ${status}`, error: "model_selection_required" }, "select a model from the refreshed inventory");
+    print(runtime.io, runtime.json, { ok: false, command: `routes ${status}`, error: "model_selection_required" }, "select a model from the refreshed inventory");
     return 2;
   }
   if (runtime.dryRun) {
-    print(runtime.io, runtime.json, { ok: true, command: `producers ${status}`, model, dryRun: true }, `would ${status} ${model}`);
+    print(runtime.io, runtime.json, { ok: true, command: `routes ${status}`, model, dryRun: true }, `would ${status === "admitted" ? "admit" : "disable"} ${model}`);
     return 0;
   }
-  const policy = updateProducer(runtime.dirs.workdir, model, status);
-  print(runtime.io, runtime.json, { ok: true, command: `producers ${status}`, model, policy }, `${status} ${model}`);
+  const policy = updateRouteState(runtime.dirs.workdir, model, status);
+  print(runtime.io, runtime.json, { ok: true, command: `routes ${status}`, model, policy }, `${status} ${model}`);
   return 0;
 }
 async function cmdModelsScreen(runtime) {
@@ -33888,25 +33884,24 @@ async function cmdModelsScreen(runtime) {
   const ask = (q2) => new Promise((resolve31) => rl.question(q2, resolve31));
   try {
     while (true) {
-      const policy = loadProducerPolicy(runtime.dirs.workdir);
+      const policy = loadRoutePolicy(runtime.dirs.workdir);
       const roleBindings = listRoleBindings(runtime.dirs.workdir);
-      runtime.io.stdout(models.map((m2, i) => `${i + 1}. ${m2} [${policy.enabled.includes(m2) ? "enabled" : policy.disabled.includes(m2) ? "disabled" : "unset"}] [${policy.promoted.includes(m2) ? "producer" : policy.demoted.includes(m2) ? "demoted" : "not producer"}] roles:${Object.entries(roleBindings).filter(([, xs]) => xs.includes(m2)).map(([r]) => r).join(",") || "-"}`).join("\n") + "\n");
-      const command = (await ask("[e]nable [d]isable [p]romote [x]demote [a]dd-role [r]emove-role [q]uit: ")).trim().toLowerCase();
+      runtime.io.stdout(models.map((m2, i) => `${i + 1}. ${m2} [${policy.admitted.includes(m2) ? "admitted" : policy.disabled.includes(m2) ? "disabled" : "unset"}] roles:${Object.entries(roleBindings).filter(([, xs]) => xs.includes(m2)).map(([r]) => r).join(",") || "-"}`).join("\n") + "\n");
+      const command = (await ask("[a]dmit [d]isable [r]ole-add [x]ole-remove [q]uit: ")).trim().toLowerCase();
       if (command === "q" || command === "quit") return 0;
       const index = Number.parseInt((await ask("model number: ")).trim(), 10) - 1;
       if (!Number.isInteger(index) || !models[index]) continue;
       const model = models[index];
-      if (command === "p" || command === "x") updateProducer(runtime.dirs.workdir, model, command === "p" ? "promoted" : "demoted");
-      else if (command === "e" || command === "d") setModelState(runtime.dirs.workdir, model, command === "e" ? "enabled" : "disabled");
-      else if (command === "a" || command === "r") setModelState(runtime.dirs.workdir, model, "enabled", (await ask("role: ")).trim(), command === "r");
+      if (command === "a" || command === "d") setRouteState(runtime.dirs.workdir, model, command === "a" ? "admitted" : "disabled");
+      else if (command === "r" || command === "x") setRouteState(runtime.dirs.workdir, model, "admitted", (await ask("role: ")).trim(), command === "x");
     }
   } finally {
     rl.close();
   }
 }
-async function cmdProducerList(runtime) {
-  const policy = loadProducerPolicy(runtime.dirs.workdir);
-  print(runtime.io, runtime.json, { ok: true, command: "producers list", policy }, [...policy.promoted.map((x2) => `promoted ${x2}`), ...policy.demoted.map((x2) => `demoted ${x2}`)].join("\n") || "no producer decisions");
+async function cmdRouteList(runtime) {
+  const policy = loadRoutePolicy(runtime.dirs.workdir);
+  print(runtime.io, runtime.json, { ok: true, command: "routes list", policy }, [...policy.admitted.map((x2) => `admitted ${x2}`), ...policy.disabled.map((x2) => `disabled ${x2}`)].join("\n") || "no route decisions");
   return 0;
 }
 async function cmdModelInventoryRefresh(runtime) {
@@ -48797,7 +48792,7 @@ function createProgram(ctx, result) {
   addGlobalOptions(runCmd.command("list").description("List recent runs for the current project")).action(async function runListAction() {
     result.code = await cmdVnextRunList(runtimeFrom(ctx, this));
   });
-  const modelsCmd = addGlobalOptions(program2.command("models").description("Manage model catalogs, roles, and producer state"));
+  const modelsCmd = addGlobalOptions(program2.command("models").description("Manage model catalogs, roles, and route state"));
   modelsCmd.action(async function modelsScreenAction() {
     result.code = await cmdModelsScreen(runtimeFrom(ctx, this));
   });
@@ -48805,14 +48800,14 @@ function createProgram(ctx, result) {
   addGlobalOptions(modelsCmd.command("inventory-refresh").alias("refresh").description("Refresh the YAML model inventory with standard and Nous/OpenRouter prices")).action(async function modelInventoryRefreshAction() {
     result.code = await cmdModelInventoryRefresh(runtimeFrom(ctx, this));
   });
-  const producersCmd = addGlobalOptions(program2.command("producers").description("Promote or demote verified producer models"));
-  producersCmd.helpCommand("help", "Show producers help");
-  addGlobalOptions(producersCmd.command("list").description("List producer decisions")).action(async function producersListAction() {
-    result.code = await cmdProducerList(runtimeFrom(ctx, this));
+  const routesCmd = addGlobalOptions(program2.command("routes").description("Admit or disable verified model routes"));
+  routesCmd.helpCommand("help", "Show routes help");
+  addGlobalOptions(routesCmd.command("list").description("List route decisions")).action(async function routesListAction() {
+    result.code = await cmdRouteList(runtimeFrom(ctx, this));
   });
-  for (const status of ["promote", "demote"]) {
-    addGlobalOptions(producersCmd.command(status).description(`${status} a model from the inventory`)).option("--model <id>", "Exact model id; omit to choose interactively").action(async function producerChangeAction(options) {
-      result.code = await cmdProducerChange(runtimeFrom(ctx, this), status === "promote" ? "promoted" : "demoted", options.model);
+  for (const status of ["admit", "disable"]) {
+    addGlobalOptions(routesCmd.command(status).description(`${status === "admit" ? "Admit" : "Disable"} a model route from the inventory`)).option("--model <id>", "Exact model id; omit to choose interactively").action(async function routeChangeAction(options) {
+      result.code = await cmdRouteChange(runtimeFrom(ctx, this), status === "admit" ? "admitted" : "disabled", options.model);
     });
   }
   const harnessCmd = addGlobalOptions(program2.command("harness").description("Detect coding-agent harnesses and authentication"));

package/plugins/kxm/dist/mcp-server.js

@@ -17121,7 +17121,7 @@ async function deliverInboxNotification(messageId, delivered, notify) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.29";
+var VERSION = "0.7.32";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();
 var meshClient;

package/plugins/kxm/dist/runtime.js

@@ -22945,17 +22945,19 @@ import { createHash as createHash11, randomBytes as randomBytes2, timingSafeEqua
 import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
 import { join as join11 } from "node:path";
 
-// plugins/kxm/src/producers.ts
+// plugins/kxm/src/routes.ts
 var import_yaml4 = __toESM(require_dist(), 1);
 import { existsSync as existsSync8, readFileSync as readFileSync6, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3, readdirSync as readdirSync4 } from "node:fs";
 import { join as join9 } from "node:path";
-var empty = () => ({ schema: "kxm.producers.v1", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), promoted: [], demoted: [], enabled: [], disabled: [], roles: {} });
-function loadProducerPolicy(root) {
-  const path = join9(root, ".kxm", "producers.yaml");
+var RETIRED_POLICY = ".kxm/producers.yaml";
+var empty = () => ({ schema: "kxm.routes.v2", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), admitted: [], disabled: [], roles: {} });
+function loadRoutePolicy(root) {
+  if (existsSync8(join9(root, RETIRED_POLICY))) throw new Error(`retired ${RETIRED_POLICY} present; use .kxm/routes.yaml (kxm.routes.v2)`);
+  const path = join9(root, ".kxm", "routes.yaml");
   if (!existsSync8(path)) return empty();
   const value = (0, import_yaml4.parse)(readFileSync6(path, "utf8"));
-  if (value?.schema !== "kxm.producers.v1" || !Array.isArray(value.promoted) || !Array.isArray(value.demoted)) throw new Error("invalid .kxm/producers.yaml");
-  return { schema: "kxm.producers.v1", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : (/* @__PURE__ */ new Date()).toISOString(), promoted: value.promoted.filter((x) => typeof x === "string"), demoted: value.demoted.filter((x) => typeof x === "string"), enabled: Array.isArray(value.enabled) ? value.enabled.filter((x) => typeof x === "string") : [], disabled: Array.isArray(value.disabled) ? value.disabled.filter((x) => typeof x === "string") : [], roles: value.roles && typeof value.roles === "object" ? Object.fromEntries(Object.entries(value.roles).filter(([, v]) => Array.isArray(v)).map(([k, v]) => [k, v.filter((x) => typeof x === "string")])) : {} };
+  if (value?.schema !== "kxm.routes.v2" || !Array.isArray(value.admitted)) throw new Error("invalid .kxm/routes.yaml");
+  return { schema: "kxm.routes.v2", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : (/* @__PURE__ */ new Date()).toISOString(), admitted: value.admitted.filter((x) => typeof x === "string"), disabled: Array.isArray(value.disabled) ? value.disabled.filter((x) => typeof x === "string") : [], roles: value.roles && typeof value.roles === "object" ? Object.fromEntries(Object.entries(value.roles).filter(([, v]) => Array.isArray(v)).map(([k, v]) => [k, v.filter((x) => typeof x === "string")])) : {} };
 }
 function listRoleBindings(root) {
   const dir = join9(root, ".kxm", "roles");
@@ -22968,9 +22970,9 @@ function listRoleBindings(root) {
   }
   return result;
 }
-function isProducerAdmitted(root, modelId) {
-  const policy = loadProducerPolicy(root);
-  return policy.enabled.includes(modelId) && policy.promoted.includes(modelId) && !policy.disabled.includes(modelId) && !policy.demoted.includes(modelId);
+function isRouteAdmitted(root, modelId) {
+  const policy = loadRoutePolicy(root);
+  return policy.admitted.includes(modelId) && !policy.disabled.includes(modelId);
 }
 
 // plugins/kxm/src/context-packet.ts
@@ -25164,7 +25166,7 @@ function resolveProducerRoute(projectRoot, step, agentId) {
       }
     };
   }
-  if (!isProducerAdmitted(projectRoot, selector)) {
+  if (!isRouteAdmitted(projectRoot, selector)) {
     return {
       error: {
         reason: "step_unsupported",
@@ -27337,7 +27339,7 @@ async function startVnextRuntimeSupervisorInner(paths, requestedPortOption, now)
                 const value = model;
                 const provider = typeof value.provider === "string" ? value.provider : void 0;
                 const modelName = typeof value.model === "string" ? value.model : void 0;
-                if (!provider || !modelName || !isProducerAdmitted(projectRoot, `${provider}/${modelName}`)) {
+                if (!provider || !modelName || !isRouteAdmitted(projectRoot, `${provider}/${modelName}`)) {
                   throw new Error("producer_route_not_admitted");
                 }
                 return { provider, model: modelName };

package/plugins/kxm/dist/vnext-runtime-supervisor.js

@@ -22470,17 +22470,19 @@ import { createHash as createHash10, randomBytes, timingSafeEqual } from "node:c
 import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
 import { join as join11 } from "node:path";
 
-// plugins/kxm/src/producers.ts
+// plugins/kxm/src/routes.ts
 var import_yaml4 = __toESM(require_dist(), 1);
 import { existsSync as existsSync8, readFileSync as readFileSync6, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3, readdirSync as readdirSync4 } from "node:fs";
 import { join as join9 } from "node:path";
-var empty = () => ({ schema: "kxm.producers.v1", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), promoted: [], demoted: [], enabled: [], disabled: [], roles: {} });
-function loadProducerPolicy(root) {
-  const path = join9(root, ".kxm", "producers.yaml");
+var RETIRED_POLICY = ".kxm/producers.yaml";
+var empty = () => ({ schema: "kxm.routes.v2", updatedAt: (/* @__PURE__ */ new Date()).toISOString(), admitted: [], disabled: [], roles: {} });
+function loadRoutePolicy(root) {
+  if (existsSync8(join9(root, RETIRED_POLICY))) throw new Error(`retired ${RETIRED_POLICY} present; use .kxm/routes.yaml (kxm.routes.v2)`);
+  const path = join9(root, ".kxm", "routes.yaml");
   if (!existsSync8(path)) return empty();
   const value = (0, import_yaml4.parse)(readFileSync6(path, "utf8"));
-  if (value?.schema !== "kxm.producers.v1" || !Array.isArray(value.promoted) || !Array.isArray(value.demoted)) throw new Error("invalid .kxm/producers.yaml");
-  return { schema: "kxm.producers.v1", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : (/* @__PURE__ */ new Date()).toISOString(), promoted: value.promoted.filter((x) => typeof x === "string"), demoted: value.demoted.filter((x) => typeof x === "string"), enabled: Array.isArray(value.enabled) ? value.enabled.filter((x) => typeof x === "string") : [], disabled: Array.isArray(value.disabled) ? value.disabled.filter((x) => typeof x === "string") : [], roles: value.roles && typeof value.roles === "object" ? Object.fromEntries(Object.entries(value.roles).filter(([, v]) => Array.isArray(v)).map(([k, v]) => [k, v.filter((x) => typeof x === "string")])) : {} };
+  if (value?.schema !== "kxm.routes.v2" || !Array.isArray(value.admitted)) throw new Error("invalid .kxm/routes.yaml");
+  return { schema: "kxm.routes.v2", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : (/* @__PURE__ */ new Date()).toISOString(), admitted: value.admitted.filter((x) => typeof x === "string"), disabled: Array.isArray(value.disabled) ? value.disabled.filter((x) => typeof x === "string") : [], roles: value.roles && typeof value.roles === "object" ? Object.fromEntries(Object.entries(value.roles).filter(([, v]) => Array.isArray(v)).map(([k, v]) => [k, v.filter((x) => typeof x === "string")])) : {} };
 }
 function listRoleBindings(root) {
   const dir = join9(root, ".kxm", "roles");
@@ -22493,9 +22495,9 @@ function listRoleBindings(root) {
   }
   return result;
 }
-function isProducerAdmitted(root, modelId) {
-  const policy = loadProducerPolicy(root);
-  return policy.enabled.includes(modelId) && policy.promoted.includes(modelId) && !policy.disabled.includes(modelId) && !policy.demoted.includes(modelId);
+function isRouteAdmitted(root, modelId) {
+  const policy = loadRoutePolicy(root);
+  return policy.admitted.includes(modelId) && !policy.disabled.includes(modelId);
 }
 
 // plugins/kxm/src/context-packet.ts
@@ -24678,7 +24680,7 @@ function resolveProducerRoute(projectRoot, step, agentId) {
       }
     };
   }
-  if (!isProducerAdmitted(projectRoot, selector)) {
+  if (!isRouteAdmitted(projectRoot, selector)) {
     return {
       error: {
         reason: "step_unsupported",
@@ -26851,7 +26853,7 @@ async function startVnextRuntimeSupervisorInner(paths, requestedPortOption, now)
                 const value = model;
                 const provider = typeof value.provider === "string" ? value.provider : void 0;
                 const modelName = typeof value.model === "string" ? value.model : void 0;
-                if (!provider || !modelName || !isProducerAdmitted(projectRoot, `${provider}/${modelName}`)) {
+                if (!provider || !modelName || !isRouteAdmitted(projectRoot, `${provider}/${modelName}`)) {
                   throw new Error("producer_route_not_admitted");
                 }
                 return { provider, model: modelName };

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kxm-claude-plugin",
-  "version": "0.7.29",
+  "version": "0.7.32",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/skills/kxm/SKILL.md

@@ -8,7 +8,7 @@ description: Select the right suite skill; state universal safety rules and port
 This skill routes to the appropriate specialized skill for each KXM command category. Use this skill to determine which specific skill handles the command you need.
 
 These bundled skills document the current CLI. They do not switch runtime YAML
-authority, admit writers, or replace `.kxm/roster.json` trusted policy.
+authority, admit writers, or replace `.kxm/roster.yaml` trusted policy.
 
 ## Command Routing Guide
 

package/plugins/kxm/src/cli/vnext.ts

@@ -5,7 +5,7 @@ import { join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { createBackup, restoreBackup } from "../database.ts";
 import { refreshModelInventory } from "../model-inventory.ts";
-import { listInventoryModels, listRoleBindings, loadProducerPolicy, setModelState, updateProducer } from "../producers.ts";
+import { listInventoryModels, listRoleBindings, loadRoutePolicy, setRouteState, updateRouteState } from "../routes.ts";
 import {
   VnextConfigError,
   discoverVnextProjectRoot,
@@ -723,7 +723,7 @@ export async function cmdHarnessList(runtime: Runtime): Promise<number> {
   return 0;
 }
 
-export async function selectProducerModel(runtime: Runtime, requested?: string | undefined): Promise<string | undefined> {
+export async function selectInventoryModel(runtime: Runtime, requested?: string | undefined): Promise<string | undefined> {
   const models = listInventoryModels(runtime.dirs.workdir);
   if (requested) return models.find((model) => model.toLowerCase() === requested.toLowerCase());
   if (runtime.json || !process.stdin.isTTY || models.length === 0) return undefined;
@@ -735,12 +735,12 @@ export async function selectProducerModel(runtime: Runtime, requested?: string |
   return Number.isInteger(index) && index >= 0 && index < models.length ? models[index] : undefined;
 }
 
-export async function cmdProducerChange(runtime: Runtime, status: "promoted" | "demoted", requested?: string | undefined): Promise<number> {
-  const model = await selectProducerModel(runtime, requested);
-  if (!model) { print(runtime.io, runtime.json, { ok: false, command: `producers ${status}`, error: "model_selection_required" }, "select a model from the refreshed inventory"); return 2; }
-  if (runtime.dryRun) { print(runtime.io, runtime.json, { ok: true, command: `producers ${status}`, model, dryRun: true }, `would ${status} ${model}`); return 0; }
-  const policy = updateProducer(runtime.dirs.workdir, model, status);
-  print(runtime.io, runtime.json, { ok: true, command: `producers ${status}`, model, policy }, `${status} ${model}`);
+export async function cmdRouteChange(runtime: Runtime, status: "admitted" | "disabled", requested?: string | undefined): Promise<number> {
+  const model = await selectInventoryModel(runtime, requested);
+  if (!model) { print(runtime.io, runtime.json, { ok: false, command: `routes ${status}`, error: "model_selection_required" }, "select a model from the refreshed inventory"); return 2; }
+  if (runtime.dryRun) { print(runtime.io, runtime.json, { ok: true, command: `routes ${status}`, model, dryRun: true }, `would ${status === "admitted" ? "admit" : "disable"} ${model}`); return 0; }
+  const policy = updateRouteState(runtime.dirs.workdir, model, status);
+  print(runtime.io, runtime.json, { ok: true, command: `routes ${status}`, model, policy }, `${status} ${model}`);
   return 0;
 }
 
@@ -751,24 +751,23 @@ export async function cmdModelsScreen(runtime: Runtime): Promise<number> {
   const ask = (q: string) => new Promise<string>((resolve) => rl.question(q, resolve));
   try {
     while (true) {
-      const policy = loadProducerPolicy(runtime.dirs.workdir);
+      const policy = loadRoutePolicy(runtime.dirs.workdir);
       const roleBindings = listRoleBindings(runtime.dirs.workdir);
-      runtime.io.stdout(models.map((m, i) => `${i + 1}. ${m} [${policy.enabled.includes(m) ? "enabled" : policy.disabled.includes(m) ? "disabled" : "unset"}] [${policy.promoted.includes(m) ? "producer" : policy.demoted.includes(m) ? "demoted" : "not producer"}] roles:${Object.entries(roleBindings).filter(([, xs]) => xs.includes(m)).map(([r]) => r).join(",") || "-"}`).join("\n") + "\n");
-      const command = (await ask("[e]nable [d]isable [p]romote [x]demote [a]dd-role [r]emove-role [q]uit: ")).trim().toLowerCase();
+      runtime.io.stdout(models.map((m, i) => `${i + 1}. ${m} [${policy.admitted.includes(m) ? "admitted" : policy.disabled.includes(m) ? "disabled" : "unset"}] roles:${Object.entries(roleBindings).filter(([, xs]) => xs.includes(m)).map(([r]) => r).join(",") || "-"}`).join("\n") + "\n");
+      const command = (await ask("[a]dmit [d]isable [r]ole-add [x]ole-remove [q]uit: ")).trim().toLowerCase();
       if (command === "q" || command === "quit") return 0;
       const index = Number.parseInt((await ask("model number: ")).trim(), 10) - 1;
       if (!Number.isInteger(index) || !models[index]) continue;
       const model = models[index];
-      if (command === "p" || command === "x") updateProducer(runtime.dirs.workdir, model, command === "p" ? "promoted" : "demoted");
-      else if (command === "e" || command === "d") setModelState(runtime.dirs.workdir, model, command === "e" ? "enabled" : "disabled");
-      else if (command === "a" || command === "r") setModelState(runtime.dirs.workdir, model, "enabled", (await ask("role: ")).trim(), command === "r");
+      if (command === "a" || command === "d") setRouteState(runtime.dirs.workdir, model, command === "a" ? "admitted" : "disabled");
+      else if (command === "r" || command === "x") setRouteState(runtime.dirs.workdir, model, "admitted", (await ask("role: ")).trim(), command === "x");
     }
   } finally { rl.close(); }
 }
 
-export async function cmdProducerList(runtime: Runtime): Promise<number> {
-  const policy = loadProducerPolicy(runtime.dirs.workdir);
-  print(runtime.io, runtime.json, { ok: true, command: "producers list", policy }, [...policy.promoted.map((x) => `promoted ${x}`), ...policy.demoted.map((x) => `demoted ${x}`)].join("\n") || "no producer decisions");
+export async function cmdRouteList(runtime: Runtime): Promise<number> {
+  const policy = loadRoutePolicy(runtime.dirs.workdir);
+  print(runtime.io, runtime.json, { ok: true, command: "routes list", policy }, [...policy.admitted.map((x) => `admitted ${x}`), ...policy.disabled.map((x) => `disabled ${x}`)].join("\n") || "no route decisions");
   return 0;
 }
 

package/plugins/kxm/src/cli.ts

@@ -111,9 +111,9 @@ import {
   cmdVnextRunCancel,
   cmdVnextRunList,
   cmdHarnessList,
-  cmdProducerChange,
+  cmdRouteChange,
   cmdModelsScreen,
-  cmdProducerList,
+  cmdRouteList,
   cmdModelInventoryRefresh,
   cmdVnextRuntime,
 } from "./cli/vnext.ts";
@@ -415,7 +415,7 @@ function createProgram(ctx: CliContext, result: { code: number }): Command {
       result.code = await cmdVnextRunList(runtimeFrom(ctx, this));
     });
 
-  const modelsCmd = addGlobalOptions(program.command("models").description("Manage model catalogs, roles, and producer state"));
+  const modelsCmd = addGlobalOptions(program.command("models").description("Manage model catalogs, roles, and route state"));
   modelsCmd.action(async function modelsScreenAction(this: Command) { result.code = await cmdModelsScreen(runtimeFrom(ctx, this)); });
   modelsCmd.helpCommand("help", "Show models help");
   addGlobalOptions(modelsCmd.command("inventory-refresh").alias("refresh").description("Refresh the YAML model inventory with standard and Nous/OpenRouter prices"))
@@ -423,11 +423,11 @@ function createProgram(ctx: CliContext, result: { code: number }): Command {
       result.code = await cmdModelInventoryRefresh(runtimeFrom(ctx, this));
     });
 
-  const producersCmd = addGlobalOptions(program.command("producers").description("Promote or demote verified producer models"));
-  producersCmd.helpCommand("help", "Show producers help");
-  addGlobalOptions(producersCmd.command("list").description("List producer decisions")).action(async function producersListAction(this: Command) { result.code = await cmdProducerList(runtimeFrom(ctx, this)); });
-  for (const status of ["promote", "demote"] as const) {
-    addGlobalOptions(producersCmd.command(status).description(`${status} a model from the inventory`)).option("--model <id>", "Exact model id; omit to choose interactively").action(async function producerChangeAction(this: Command, options: { model?: string }) { result.code = await cmdProducerChange(runtimeFrom(ctx, this), status === "promote" ? "promoted" : "demoted", options.model); });
+  const routesCmd = addGlobalOptions(program.command("routes").description("Admit or disable verified model routes"));
+  routesCmd.helpCommand("help", "Show routes help");
+  addGlobalOptions(routesCmd.command("list").description("List route decisions")).action(async function routesListAction(this: Command) { result.code = await cmdRouteList(runtimeFrom(ctx, this)); });
+  for (const status of ["admit", "disable"] as const) {
+    addGlobalOptions(routesCmd.command(status).description(`${status === "admit" ? "Admit" : "Disable"} a model route from the inventory`)).option("--model <id>", "Exact model id; omit to choose interactively").action(async function routeChangeAction(this: Command, options: { model?: string }) { result.code = await cmdRouteChange(runtimeFrom(ctx, this), status === "admit" ? "admitted" : "disabled", options.model); });
   }
 
   const harnessCmd = addGlobalOptions(program.command("harness").description("Detect coding-agent harnesses and authentication"));

package/plugins/kxm/src/init-guide-setup.ts

@@ -10,7 +10,8 @@
  * This module writes only current vNext project resources:
  *   - `.kxm/agents/<role-slug>.yaml`   (kxm.agent.v1)
  *   - `.kxm/workflows/<slug>.yaml`     (kxm.workflow.v1)
- * It never writes retired legacy authority (`.kxm/config`, `.kxm/roster.json`)
+ * It never writes retired legacy authority (`.kxm/config`, retired
+ * `.kxm/roster.json`) or the trusted `.kxm/roster.yaml` policy
  * and does not use the kxm.role.v1 subsystem.
  */
 

package/plugins/kxm/src/mcp-server.ts

@@ -8,7 +8,7 @@ import { AGENT_COMMANDS_MAP, enforceToolPolicy, getMcpTools, reconcileInbox } fr
 import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 
-const VERSION = "0.7.29";
+const VERSION = "0.7.32";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();
 let meshClient: HubClient | undefined;

package/plugins/kxm/src/routes.ts

@@ -0,0 +1,68 @@
+import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { parse, stringify } from "yaml";
+
+const RETIRED_POLICY = ".kxm/producers.yaml";
+
+export interface RoutePolicy { schema: "kxm.routes.v2"; updatedAt: string; admitted: string[]; disabled: string[]; roles: Record<string, string[]>; }
+const empty = (): RoutePolicy => ({ schema: "kxm.routes.v2", updatedAt: new Date().toISOString(), admitted: [], disabled: [], roles: {} });
+export function loadRoutePolicy(root: string): RoutePolicy {
+  if (existsSync(join(root, RETIRED_POLICY))) throw new Error(`retired ${RETIRED_POLICY} present; use .kxm/routes.yaml (kxm.routes.v2)`);
+  const path = join(root, ".kxm", "routes.yaml");
+  if (!existsSync(path)) return empty();
+  const value = parse(readFileSync(path, "utf8")) as Partial<RoutePolicy>;
+  if (value?.schema !== "kxm.routes.v2" || !Array.isArray(value.admitted)) throw new Error("invalid .kxm/routes.yaml");
+  return { schema: "kxm.routes.v2", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : new Date().toISOString(), admitted: value.admitted.filter((x): x is string => typeof x === "string"), disabled: Array.isArray(value.disabled) ? value.disabled.filter((x): x is string => typeof x === "string") : [], roles: value.roles && typeof value.roles === "object" ? Object.fromEntries(Object.entries(value.roles).filter(([, v]) => Array.isArray(v)).map(([k, v]) => [k, (v as unknown[]).filter((x): x is string => typeof x === "string")])) : {} };
+}
+export function updateRouteState(root: string, model: string, state: "admitted" | "disabled"): RoutePolicy {
+  return setRouteState(root, model, state);
+}
+export function setRouteState(root: string, model: string, state: "admitted" | "disabled", role?: string, removeRole = false): RoutePolicy {
+  const policy = loadRoutePolicy(root);
+  policy.admitted = policy.admitted.filter((x) => x !== model);
+  policy.disabled = policy.disabled.filter((x) => x !== model);
+  if (state === "admitted") policy.admitted.push(model);
+  else policy.disabled.push(model);
+  if (role) {
+    if (!/^[a-z][a-z0-9_-]{0,63}$/i.test(role)) throw new Error("invalid role id");
+    const rolePath = join(root, ".kxm", "roles", `${role}.yaml`);
+    let roleFile: Record<string, unknown> = {};
+    if (existsSync(rolePath)) {
+      const parsed = parse(readFileSync(rolePath, "utf8"));
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) roleFile = parsed as Record<string, unknown>;
+    }
+    const roster = Array.isArray(roleFile.roster) ? roleFile.roster.filter((entry): entry is Record<string, unknown> => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry)) : [];
+    const existing = roster.findIndex((entry) => entry.model === model);
+    if (removeRole) { if (existing >= 0) roster.splice(existing, 1); }
+    else if (existing < 0) roster.push({ model, enabled: true });
+    roleFile.schema ??= "kxm.role.v1"; roleFile.id ??= role; roleFile.roster = roster;
+    mkdirSync(join(root, ".kxm", "roles"), { recursive: true });
+    writeFileSync(rolePath, stringify(roleFile), "utf8");
+  }
+  policy.updatedAt = new Date().toISOString();
+  mkdirSync(join(root, ".kxm"), { recursive: true });
+  writeFileSync(join(root, ".kxm", "routes.yaml"), stringify(policy), "utf8");
+  return policy;
+}
+
+export function listRoleBindings(root: string): Record<string, string[]> {
+  const dir = join(root, ".kxm", "roles"); const result: Record<string, string[]> = {};
+  if (!existsSync(dir)) return result;
+  for (const file of readdirSync(dir).filter((name) => name.endsWith(".yaml"))) {
+    const role = file.slice(0, -5); const value = parse(readFileSync(join(dir, file), "utf8")) as { roster?: Array<{ model?: unknown }> };
+    result[role] = (value.roster ?? []).map((entry) => entry.model).filter((model): model is string => typeof model === "string");
+  }
+  return result;
+}
+
+export function isRouteAdmitted(root: string, modelId: string): boolean {
+  const policy = loadRoutePolicy(root);
+  return policy.admitted.includes(modelId) && !policy.disabled.includes(modelId);
+}
+
+export function listInventoryModels(root: string): string[] {
+  const path = join(root, ".kxm", "models", "inventory.yaml");
+  if (!existsSync(path)) return [];
+  const value = parse(readFileSync(path, "utf8")) as { models?: Array<{ id?: unknown }> };
+  return (value.models ?? []).map((m) => m.id).filter((id): id is string => typeof id === "string");
+}

package/plugins/kxm/src/vnext-engine.ts

@@ -2,7 +2,7 @@ import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { parse } from "yaml";
-import { isProducerAdmitted, listRoleBindings } from "./producers.ts";
+import { isRouteAdmitted, listRoleBindings } from "./routes.ts";
 import {
   buildFormalContextPacket,
   buildHandoffManifest,
@@ -1317,7 +1317,7 @@ function resolveProducerRoute(
     };
   }
 
-  if (!isProducerAdmitted(projectRoot, selector)) {
+  if (!isRouteAdmitted(projectRoot, selector)) {
     return {
       error: {
         reason: "step_unsupported",

package/plugins/kxm/src/vnext-runtime-supervisor.ts

@@ -23,7 +23,7 @@ import {
   type VnextRuntimeContext,
 } from "./vnext-runtime.ts";
 import { createVnextOneShotProducer } from "./vnext-oneshot-producer.ts";
-import { isProducerAdmitted } from "./producers.ts";
+import { isRouteAdmitted } from "./routes.ts";
 import { VnextRunScheduler, createVnextSimulatedProducer, recordDriveReceipt, recoverVnextRun, vnextDrivePollProjection } from "./vnext-engine.ts";
 import { vnextDriveSession, vnextOpenDriveSessions } from "./vnext-runtime-owner.ts";
 
@@ -487,7 +487,7 @@ async function startVnextRuntimeSupervisorInner(
                     const value = model as Record<string, unknown>;
                     const provider = typeof value.provider === "string" ? value.provider : undefined;
                     const modelName = typeof value.model === "string" ? value.model : undefined;
-                    if (!provider || !modelName || !isProducerAdmitted(projectRoot, `${provider}/${modelName}`)) {
+                    if (!provider || !modelName || !isRouteAdmitted(projectRoot, `${provider}/${modelName}`)) {
                       throw new Error("producer_route_not_admitted");
                     }
                     return { provider, model: modelName };

package/schemas/policy-draft/README.md

@@ -5,7 +5,7 @@ operator settings, live registry identities, or admission.
 
 - Live project models remain `kxm.model.v1` under `schemas/vnext/`.
 - Live CLI roles remain `kxm.role.v1`.
-- Runner admission remains `.kxm/roster.json` via the trusted control Git loader.
+- Runner admission remains `.kxm/roster.yaml` via the trusted control Git loader.
 - This directory is not discovered as a vNext project resource.
 
 Pure validation lives in `plugins/kxm/src/policy-draft.mjs`

package/scripts/roster-policy.mjs

@@ -1,13 +1,15 @@
 /** Unwired developer policy foundation. No dispatch or acceptance authority. */
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { lstatSync, readFileSync, realpathSync } from 'node:fs';
+import { existsSync, lstatSync, readFileSync, realpathSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import YAML from 'yaml';
 import { NATIVE_PI_BRAKE_PROVIDERS, PI_ALLOWED_PROVIDERS, PI_ANTIGRAVITY_MODEL_ID, PI_NATIVE_VENDOR_PROVIDERS, ROUTES } from './harness-run.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const POLICY = '.kxm/roster.json';
+const POLICY = '.kxm/roster.yaml';
+const RETIRED_POLICY = '.kxm/roster.json';
 const TRUSTED = 'refs/remotes/origin/main';
 const ROLES = ['writer', 'planner', 'reviewer-arch', 'reviewer-cli', 'experiment'];
 const ALIASES = Object.freeze({ 'x-ai': 'xai', moonshotai: 'moonshot', 'google-ai': 'google', qwen: 'alibaba' });
@@ -54,6 +56,7 @@ function frozen(value) {
   return value;
 }
 function control() {
+  if (existsSync(path.join(ROOT, RETIRED_POLICY))) refuse(`retired ${RETIRED_POLICY} present; use ${POLICY}`);
   if (realpathSync(gitText('rev-parse', '--show-toplevel')) !== realpathSync(ROOT)) refuse('module is outside its control repository');
   const head = gitText('rev-parse', '--verify', 'HEAD^{commit}');
   const trusted = gitText('rev-parse', '--verify', `${TRUSTED}^{commit}`);
@@ -159,7 +162,8 @@ export function validateRosterDocument(policy, readBlob) {
 }
 function validate(bytes, commit) {
   let policy;
-  try { policy = JSON.parse(bytes.toString('utf8')); } catch { refuse('invalid policy JSON'); }
+  try { policy = YAML.parse(bytes.toString('utf8')); } catch { refuse('invalid policy YAML'); }
+  if (policy === undefined || policy === null || typeof policy !== 'object' || Array.isArray(policy)) refuse('invalid policy YAML');
   return validateRosterDocument(policy, source => blobAt(commit, source).bytes);
 }
 export function loadTrustedRosterPolicy() {

package/.kxm/producers.yaml

@@ -1,53 +0,0 @@
-schema: kxm.producers.v1
-updatedAt: 2026-09-16T14:55:00.000Z
-promoted:
-  - anthropic/fable
-  - openai/gpt-5.6-sol
-  - xai/grok-4.6
-  - openrouter/qwen/qwen3-coder-plus
-  # Qualified 2026-09-16 from the refreshed catalog (.kxm/models/inventory.yaml,
-  # fetchedAt 2026-09-16T14:54:53Z). Quality evidence (side-by-side runs) is
-  # queued — pending OpenRouter auth; not in any role rotation yet.
-  - openrouter/qwen/qwen3.8-flash # 1M ctx, thinking; $0.15/M in, $0.47/M out
-  - openrouter/z-ai/glm-5.3-flash # 1.31M ctx, thinking; $0.09/M in, $0.30/M out
-  # Qualified 2026-09-16 via live probes on the native z.ai coding plan
-  # (provider zai-coding-cn, subscription/unmetered): smoke + repo-shaped edit
-  # probe + vision probe (screenshot color read) all passed. glm-5.3-highspeed
-  # and glm-5v-turbo NOT admitted: plan returns 429 1311 (not in subscription).
-  # glm-4.6v verified for vision but not admitted (superseded by 5.3-flash).
-  - zai-coding-cn/glm-5.3 # 1M ctx, thinking; coding-plan subscription
-  - zai-coding-cn/glm-5.3-flash # 1M ctx, thinking, vision; coding-plan subscription
-  # Qualified 2026-09-16 via live probes (smoke; subscription/unmetered):
-  # agy = Antigravity CLI (google sub, Gemini kebab ids bake in the effort tier;
-  # harness default is flash-high). qwen-token-plan edit probe passed on
-  # qwen3.8-flash. deepseek-v4.1-flash and glm-5.x on qwen-token-plan are
-  # third-party models hosted by that plan.
-  - google/gemini-3.8-flash-medium # agy harness, 1M ctx
-  - google/gemini-3.8-flash-high # agy harness, 1M ctx; oneshot default for agy
-  - qwen-token-plan/qwen3.8-flash # 1M ctx, thinking, vision; edit probe passed
-  - qwen-token-plan/qwen3.8-max # 1M ctx, thinking, vision
-  - qwen-token-plan/deepseek-v4.1-flash # 1M ctx, thinking, vision
-demoted: []
-enabled:
-  - anthropic/fable
-  - openai/gpt-5.6-sol
-  - xai/grok-4.6
-  - openrouter/qwen/qwen3-coder-plus
-  - openrouter/qwen/qwen3.8-flash
-  - openrouter/z-ai/glm-5.3-flash
-  - zai-coding-cn/glm-5.3
-  - zai-coding-cn/glm-5.3-flash
-  - google/gemini-3.8-flash-medium
-  - google/gemini-3.8-flash-high
-  - qwen-token-plan/qwen3.8-flash
-  - qwen-token-plan/qwen3.8-max
-  - qwen-token-plan/deepseek-v4.1-flash
-disabled: []
-roles:
-  implementer:
-    - xai/grok-4.6
-    - openrouter/qwen/qwen3-coder-plus
-  critic-arch:
-    - anthropic/fable
-  critic-cli:
-    - openai/gpt-5.6-sol

package/plugins/kxm/src/producers.ts

@@ -1,71 +0,0 @@
-import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from "node:fs";
-import { join } from "node:path";
-import { parse, stringify } from "yaml";
-
-export interface ProducerPolicy { schema: "kxm.producers.v1"; updatedAt: string; promoted: string[]; demoted: string[]; enabled: string[]; disabled: string[]; roles: Record<string, string[]>; }
-const empty = (): ProducerPolicy => ({ schema: "kxm.producers.v1", updatedAt: new Date().toISOString(), promoted: [], demoted: [], enabled: [], disabled: [], roles: {} });
-export function loadProducerPolicy(root: string): ProducerPolicy {
-  const path = join(root, ".kxm", "producers.yaml");
-  if (!existsSync(path)) return empty();
-  const value = parse(readFileSync(path, "utf8")) as Partial<ProducerPolicy>;
-  if (value?.schema !== "kxm.producers.v1" || !Array.isArray(value.promoted) || !Array.isArray(value.demoted)) throw new Error("invalid .kxm/producers.yaml");
-  return { schema: "kxm.producers.v1", updatedAt: typeof value.updatedAt === "string" ? value.updatedAt : new Date().toISOString(), promoted: value.promoted.filter((x): x is string => typeof x === "string"), demoted: value.demoted.filter((x): x is string => typeof x === "string"), enabled: Array.isArray(value.enabled) ? value.enabled.filter((x): x is string => typeof x === "string") : [], disabled: Array.isArray(value.disabled) ? value.disabled.filter((x): x is string => typeof x === "string") : [], roles: value.roles && typeof value.roles === "object" ? Object.fromEntries(Object.entries(value.roles).filter(([, v]) => Array.isArray(v)).map(([k, v]) => [k, (v as unknown[]).filter((x): x is string => typeof x === "string")])) : {} };
-}
-export function updateProducer(root: string, model: string, status: "promoted" | "demoted"): ProducerPolicy {
-  const policy = loadProducerPolicy(root);
-  policy.promoted = policy.promoted.filter((x) => x !== model);
-  policy.demoted = policy.demoted.filter((x) => x !== model);
-  policy[status].push(model);
-  policy.updatedAt = new Date().toISOString();
-  mkdirSync(join(root, ".kxm"), { recursive: true });
-  writeFileSync(join(root, ".kxm", "producers.yaml"), stringify(policy), "utf8");
-  return policy;
-}
-export function setModelState(root: string, model: string, state: "enabled" | "disabled", role?: string, removeRole = false): ProducerPolicy {
-  const policy = loadProducerPolicy(root);
-  policy.enabled = policy.enabled.filter((x) => x !== model);
-  policy.disabled = policy.disabled.filter((x) => x !== model);
-  policy[state].push(model);
-  if (role) {
-    if (!/^[a-z][a-z0-9_-]{0,63}$/i.test(role)) throw new Error("invalid role id");
-    const rolePath = join(root, ".kxm", "roles", `${role}.yaml`);
-    let roleFile: Record<string, unknown> = {};
-    if (existsSync(rolePath)) {
-      const parsed = parse(readFileSync(rolePath, "utf8"));
-      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) roleFile = parsed as Record<string, unknown>;
-    }
-    const roster = Array.isArray(roleFile.roster) ? roleFile.roster.filter((entry): entry is Record<string, unknown> => Boolean(entry) && typeof entry === "object" && !Array.isArray(entry)) : [];
-    const existing = roster.findIndex((entry) => entry.model === model);
-    if (removeRole) { if (existing >= 0) roster.splice(existing, 1); }
-    else if (existing < 0) roster.push({ model, enabled: true });
-    roleFile.schema ??= "kxm.role.v1"; roleFile.id ??= role; roleFile.roster = roster;
-    mkdirSync(join(root, ".kxm", "roles"), { recursive: true });
-    writeFileSync(rolePath, stringify(roleFile), "utf8");
-  }
-  policy.updatedAt = new Date().toISOString();
-  mkdirSync(join(root, ".kxm"), { recursive: true });
-  writeFileSync(join(root, ".kxm", "producers.yaml"), stringify(policy), "utf8");
-  return policy;
-}
-
-export function listRoleBindings(root: string): Record<string, string[]> {
-  const dir = join(root, ".kxm", "roles"); const result: Record<string, string[]> = {};
-  if (!existsSync(dir)) return result;
-  for (const file of readdirSync(dir).filter((name) => name.endsWith(".yaml"))) {
-    const role = file.slice(0, -5); const value = parse(readFileSync(join(dir, file), "utf8")) as { roster?: Array<{ model?: unknown }> };
-    result[role] = (value.roster ?? []).map((entry) => entry.model).filter((model): model is string => typeof model === "string");
-  }
-  return result;
-}
-
-export function isProducerAdmitted(root: string, modelId: string): boolean {
-  const policy = loadProducerPolicy(root);
-  return policy.enabled.includes(modelId) && policy.promoted.includes(modelId) && !policy.disabled.includes(modelId) && !policy.demoted.includes(modelId);
-}
-
-export function listInventoryModels(root: string): string[] {
-  const path = join(root, ".kxm", "models", "inventory.yaml");
-  if (!existsSync(path)) return [];
-  const value = parse(readFileSync(path, "utf8")) as { models?: Array<{ id?: unknown }> };
-  return (value.models ?? []).map((m) => m.id).filter((id): id is string => typeof id === "string");
-}