agent-policy-kit 0.1.0 → 0.2.0

package/AGENT_INSTALL.md

@@ -4,6 +4,8 @@ APK is configuration-only. Native files remain independent after npm package/sou
 
 Perform authorized technical setup/removal yourself; do not hand the owner a shell checklist. Use JSON plans/results, preserve main models, credentials, permissions, unrelated settings and later edits. Never log in, collect credentials, accept terms, start model tasks, publish, weaken sandboxes or bypass trust to force installation success. Private backups can contain existing secrets; keep state private.
 
+Captured output stays JSON. Use --json explicitly when a terminal is attached. Interactive users receive a readable summary. Run show to inspect existing user-level native subagent settings without APK receipts or client executables. Show reads current supported fields, including manual edits, but does not resolve project, managed or session precedence. An incomplete read exits with code 3 while retaining independent client results. Doctor remains the owned-configuration integrity check.
+
 ## 1. Select the requested release
 
 Package version is configuration-release version. Read that version's CHANGELOG.md or release output for what changed, why and migration limits. Check the installed tool versions, actual provisioned model aliases and current official model/effort documentation before applying. Preserve explicit user choices; a newer package/model is not an instruction to switch silently. See [model maintenance](docs/model-updates.md) and the dated [model catalog/presets](docs/model-catalog.md).
@@ -11,8 +13,8 @@ Package version is configuration-release version. Read that version's CHANGELOG.
 After publication, pinned invocation is supported:
 
 ```sh
-npx --yes --ignore-scripts --package agent-policy-kit@0.1.0 agent-policy release
-npx --yes --ignore-scripts --package agent-policy-kit@0.1.0 agent-policy setup --release
+npx --yes --ignore-scripts --package agent-policy-kit@0.2.0 agent-policy release
+npx --yes --ignore-scripts --package agent-policy-kit@0.2.0 agent-policy setup --release
 ```
 
 Before publication, replace the registry spec with the verified local .tgz. For several commands, install to a temporary or user-owned prefix with npm install --prefix PREFIX TARBALL --ignore-scripts --no-audit --no-fund, then invoke PREFIX/node_modules/.bin/agent-policy. No stable runtime prefix, sudo or shell-profile changes are needed.
@@ -32,7 +34,9 @@ agent-policy setup \
   --apply
 ```
 
-Use --codex, --claude, --kimi and/or --antigravity to select tools. Each tool must list every selected role exactly once. --roles and --max-concurrent are required in this mode. :native means effort null. Antigravity accepts role=tier without an effort. Split the model/effort pair at its last colon. Keep the visible shell quotes and line continuations. The optional --avoid-TOOL lists preserve routing guidance. An omitted list is empty.
+Use --codex, --claude, --kimi, --antigravity and/or --grok to select tools. Each tool must list every selected role exactly once. --roles and --max-concurrent are required in this mode. :native means effort null. Antigravity accepts role=tier and Grok Build accepts role=model, both without an effort. Split the model/effort pair at its last colon. Keep the visible shell quotes and line continuations. The optional --avoid-TOOL lists preserve routing guidance. An omitted list is empty.
+
+Optional --codex-max-concurrent, --claude-max-concurrent, --kimi-max-concurrent, --antigravity-max-concurrent and --grok-max-concurrent override --max-concurrent for their selected tool. They accept whole numbers from 1 to 32 and require the corresponding tool argument. JSON preferences can instead set clients[tool].maxConcurrent. Omitted overrides use the top-level fallback.
 
 Explicit arguments are setup/install-only and cannot combine with --client, --release, --preset, --policy or --config. Duplicate flags and incomplete role maps fail before writes. Omit --apply to plan first. Explicit commands allow deliberate owned replacement and record custom source with no named preset provenance. The native files do not retain a dependency on the codec or package.
 
@@ -48,7 +52,7 @@ Optional top-level selectedRoles selects worker, reviewer, explorer, tester, wri
 
 Use model-supported native effort levels. null means no explicit pin. A known catalog model rejects unsupported explicit effort. Keep at most one non-null pin per selected Kimi alias. Preset identity and custom source are reported separately. Tools omitted from clients are not selected.
 
-Run detect and inspect the setup plan. Working executable identity is required; stale directories are not presence. Automatic targets use standard native roots. Nondefault CODEX_HOME/CLAUDE_CONFIG_DIR/KIMI_CODE_HOME returns a per-client zero-write prerequisite rather than configuring a dormant folder. Explicit --home selects the standard layout under that intended base; preserve exact --home/--state-dir for later inspection/removal. It does not remap arbitrary native roots.
+Run detect and inspect the setup plan. Working executable identity is required; stale directories are not presence. Automatic targets use standard native roots. Nondefault CODEX_HOME/CLAUDE_CONFIG_DIR/KIMI_CODE_HOME/GROK_HOME returns a per-client zero-write prerequisite rather than configuring a dormant folder. Explicit --home selects the standard layout under that intended base; preserve exact --home/--state-dir for later inspection/removal. It does not remap arbitrary native roots.
 
 ## 3. Apply the concrete reviewed plan
 
@@ -64,7 +68,7 @@ The available role names are apk-worker/apk-reviewer/apk-explorer/apk-tester/apk
 
 ## 4. Native limits
 
-Codex/Claude have native defaults/caps with higher-priority setting and execution-path exceptions. Kimi role-to-pool selection and concurrency are guidance. Antigravity uses native Pro/Flash/Flash Lite/inherit tiers, with no documented per-role effort or universal hard cap. avoidModels is guidance. A pinned configuration does not prove provider identity, entitlement, task quality or unchanged alias resolution. Never add a runtime gate to strengthen a missing native feature.
+Codex/Claude have native defaults/caps with higher-priority setting and execution-path exceptions. Kimi role-to-pool selection and concurrency are guidance. Antigravity uses native Pro/Flash/Flash Lite/inherit tiers, with no documented per-role effort or universal hard cap. Grok Build writes agents/apk-ROLE.md, per-role models and a general-purpose fallback in config.toml [subagents.models], and a native [subagents] max_concurrent cap; it has no per-role effort, so subagents use the main session effort. avoidModels is guidance. A pinned configuration does not prove provider identity, entitlement, task quality or unchanged alias resolution. Never add a runtime gate to strengthen a missing native feature.
 
 ## 5. Removal and incompatible formats
 

package/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 Each npm version is one configuration release: its presets, native role definitions, instructions and configuration page. Published versions are not rewritten. Applying another release is explicit; package installation alone changes no settings.
 
+## 0.2.0 — 2026-11-01
+
+### Why this release
+
+Subagents draw on the same plan limits as the main session, and every parallel session adds to that usage. Without explicit choices, subagents can inherit the most expensive model and use up a weekly limit within days. This release names the work modes by how much of a plan subagents may use, adds per-tool parallel limits, a read-only settings check and Grok Build support.
+
+### Who should update
+
+Anyone who wants Grok Build roles, per-tool parallel limits or the renamed modes. Re-running setup with 0.2.0 applies the new preset values: Top-tier now uses Opus 5.5, GPT-6.1 Sol and K3 at high effort, with top models behind an opt-in switch, and Kimi's Standard Docs writer uses K3 256K. Installations of 0.1.0 keep working unchanged until setup is run again.
+
+### Migration and rollback
+
+Preset ids (`fast`, `balanced`, `quality`), receipt format v4 and ownership, drift and rollback behavior are unchanged. Version 1 share links still open; new links use version 2 and carry each tool's parallel limit. Applying 0.1.0 again restores its owned settings, as the synthetic upgrade/downgrade gate verifies. Grok Build is new, so it has nothing to migrate.
+
+### Presets and model catalog
+
+The model catalog snapshot is dated 2026-10-30; Grok Build entries were checked on 2026-11-01 against the Grok Build 1.0.70 user guide and the xAI model list. An independent audit compared every preset, tool and role with the catalog and the documentation tables, and a test now keeps those tables in sync. Configuration checks are not model-quality evaluations.
+
+### What changed
+
+- Add Grok Build as a fifth coding tool, listed after Antigravity. APK writes `agents/apk-<role>.md` role files (Reviewer and Code explorer use the read-only `permission_mode: plan`), per-role models and a `general-purpose` fallback copied from the first selected role (the Coder when selected) in `config.toml` `[subagents.models]`, a native `[subagents] max_concurrent` cap and a delegation block in `AGENTS.md` under `$GROK_HOME` (default `~/.grok`). Per-role effort is not configurable, so every Grok choice has effort null and the page shows no effort controls. Presets use Grok Build 0.1, xAI's fast coding model, for light work and Grok 4.7 for stronger roles; Grok 4.6 and 4.5 stay available in Custom. Explicit commands use `--grok`, `--grok-max-concurrent` and `--avoid-grok`. Removal restores the original settings and refuses on local edits.
+
+- Rename work modes to Light, Standard and Top-tier and describe them by how much of a plan's limits subagents use. Preset ids and share-link ids are unchanged. Top-tier now uses Opus 5.5, GPT-6.1 Sol and K3 at high effort for code, review and tests. A per-tool switch under Top-tier opts those roles into Fable 5.1, GPT-6 Astra or K3.1 Pro; it is off by default. Top models no longer run at xhigh/max, because native default subagent settings copy the first selected role (the Coder when selected) to subagents started without a named role.
+
+- Explain each configuration step with a short ? note, and stop repeating vendor billing or version documentation in the work-mode notice.
+
+- Start a fresh or reset form with every subagent role selected, and give the empty coding-tool field the same appearance as the empty role field.
+
+- Automatically deploy the latest website from verified main while preserving exact tagged release pages and older share links. Configuration guards keep commands pinned to published package capabilities; npm releases remain explicit.
+
+- Credit Mykola Maksymenko in the configuration page and package metadata. Link the supplied LinkedIn profile and related projects, with static author/project structured data and a release-specific canonical URL.
+
+- Interactive terminals get readable setup, doctor, release and show output; captured output keeps the existing JSON contract, and `--json` forces JSON.
+
+- `agent-policy show` reads the current user-level subagent settings of every tool, before or after APK installation, without writing files. The page footer offers it as "Check current settings" with a copy button.
+
+- Each tool has its own parallel limit from 1 to 32, set in its details on the page or with `--TOOL-max-concurrent`; policies accept `clients[tool].maxConcurrent`.
+
+- The page adds Add all for roles and tools, a GitHub link in the header, Reset form beside the release line, and preset switching for a single selected tool without a needless confirmation.
+
 ## 0.1.0 — 2026-10-30
 
 ### Why this release

package/README.md

@@ -1,5 +1,7 @@
 # Agent Policy Kit
 
+Created and maintained by [Mykola Maksymenko](https://www.linkedin.com/in/nick-maximenko/).
+
 Coding agents can delegate specific tasks to temporary subagents. Those tasks vary in complexity and importance. A single model for every task is rarely the best balance of capability, speed and cost.
 
 Agent Policy Kit lets you match subagent roles with models and effort. It configures your coding tools’ native environment, then exits. The main agent still decides when to delegate, and its model stays unchanged.
@@ -17,7 +19,7 @@ flowchart LR
 
 ## Choose your setup
 
-Open the [configuration page](https://agent-policy-kit.maksymenko-ml.workers.dev/v/0.1.0/) in your browser. Choose roles and coding tools, keep a preset or adjust each role, then copy the fully expanded setup command. The page address saves your visible choices for sharing. APK creates only the selected roles in installed, selected tools.
+Open the [configuration page](https://agent-policy-kit.trymenow.io/v/0.2.0/) in your browser. Choose roles and coding tools, keep a preset or adjust each role, then copy the fully expanded setup command. The page address saves your visible choices for sharing. APK creates only the selected roles in installed, selected tools.
 
 The [bundled page](site/index.html) also works offline. APK has no proxy, background process or runtime during your normal coding sessions. You can remove the npm package afterward.
 
@@ -34,20 +36,35 @@ Choose only the roles you need:
 | Docs writer | Verified docs, examples and release notes |
 | Task runner | Prescribed commands and mechanical edits; uncertain decisions return to the parent |
 
-Fast & economical favors bounded work and lighter models. Balanced puts more capability into implementation and verification. Quality first uses frontier models for demanding work, with higher usage and latency possible. All choices remain editable. Claude Fable in Quality may use additional usage credits.
+Subagents draw on the same plan limits as your main session, and every parallel session adds to that usage. Choose the mode by how much of your plan subagents may use. Light uses light models for every role, so limits last longest; it suits entry plans and many parallel sessions. Standard gives code, review, tests and docs stronger models and keeps search and routine work on light models; it fits most plans. Top-tier uses high-end models for most roles; it uses limits fastest and suits top plans with few parallel sessions. A switch under Top-tier opts each tool into its top model (Fable, Astra or K3.1 Pro) for those roles; it is off by default. All choices remain editable. Claude Fable may use additional usage credits on plans that do not include it.
 
 See the [exact preset choices and rationale](docs/model-catalog.md#how-the-presets-are-designed). Recommendations contain no personal model bans. They configure the environment; the main agent still chooses whether to delegate.
 
 ## Use a specific release's defaults
 
 ```sh
-npx --yes --ignore-scripts --package agent-policy-kit@0.1.0 agent-policy setup --release --apply
+npx --yes --ignore-scripts --package agent-policy-kit@0.2.0 agent-policy setup --release --apply
 ```
 
 Omit --apply to preview. Each version includes its own presets, instructions and configuration page. [Release notes](CHANGELOG.md) explain what changed and why; [release usage](docs/releases.md) covers upgrade and downgrade.
 
 Prefer your AI agent to handle installation or removal? Give it the [AI operator guide](AGENT_INSTALL.md).
 
+## Read your current setup
+
+Run `agent-policy show` to read existing user-level subagent settings, including settings created before APK. Use `--client codex` to inspect one tool. The command shows roles, models, effort and concurrency without changing files or starting model tasks. Project and session settings can override these user-level values.
+
+Configuration commands show a short summary in an interactive terminal. Captured output remains JSON. Add `--json` to request JSON explicitly.
+
+Open an individual coding tool's details to set its maximum concurrent subagents from 1 to 32. Each tool has its own limit per session. Presets start at Light 2, Standard 3 and Top-tier 2; a manual limit makes that tool Custom. Kimi and Antigravity treat it as guidance; Grok Build applies it as a native cap.
+
 [Model catalog](docs/model-catalog.md) · [Support](docs/compatibility.md) · [Model updates](docs/model-updates.md) · [Privacy](docs/privacy.md) · [Verification](docs/verification.md)
 
-Node.js 22.x (22.13+) or 24+; macOS/Linux. Version 0.1.0. MIT licensed.
+Node.js 22.x (22.13+) or 24+; macOS/Linux. Version 0.2.0. MIT licensed.
+
+## Related projects
+
+Other open-source projects by [Mykola Maksymenko](https://www.linkedin.com/in/nick-maximenko/):
+
+- [Agents Can Communicate (ACC)](https://github.com/automatis-tools/agents-can-communicate) connects independent AI coding sessions across clients for local questions, code reviews, and handoffs. [Website](https://getacc.dev/).
+- [Automatis Skills](https://github.com/automatis-tools/automatis-skills) provides reusable engineering skills for GitHub workflows, Git cleanup, port conflicts, and technical writing.

package/bin/agent-policy.mjs

@@ -10,9 +10,11 @@ import {EXPLICIT_FIELDS,parseExplicitOptions} from '../src/explicit.mjs';
 import {nativeHomeConflict} from '../src/native.mjs';
 import {detectClients,resolveClient,summarizeDetection} from '../src/detect.mjs';
 import {bundledReleaseInfo,presetPreferences} from '../src/release.mjs';
+import {formatResult,useJsonOutput} from '../src/output.mjs';
 const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const version=JSON.parse(fs.readFileSync(path.join(root,'package.json'))).version;
-const print=value=>process.stdout.write(JSON.stringify(value,null,2)+'\n');
+let outputContext={command:'',apply:false,json:process.argv.includes('--json')};
+const print=value=>process.stdout.write(useJsonOutput({isTTY:process.stdout.isTTY,json:outputContext.json})?JSON.stringify(value,null,2)+'\n':formatResult(outputContext.command,value,{version,apply:outputContext.apply}));
 const fail=code=>{throw Object.assign(new Error(code),{code});};
 const safeCode=code=>typeof code==='string'&&/^[A-Z_]{1,64}$/.test(code)?code:'OPERATION_FAILED';
 function loadPolicy(file) {
@@ -32,30 +34,36 @@ Usage: agent-policy <command> [options]
   install       Plan one --client or all detected clients
   uninstall     Plan owned removals; add --apply to remove
   doctor        Check owned native configuration without model calls
+  show          Read current user-level native subagent configuration
 
-Options: --client codex|claude|kimi|agy --home PATH --state-dir PATH
+Options: --client codex|claude|kimi|agy|grok --home PATH --state-dir PATH
          --policy FILE | --release [--preset fast|balanced|quality] | --config BASE64URL
          --roles worker,reviewer,explorer,tester,writer,routine --max-concurrent 3
          --codex ROLE=MODEL:EFFORT,... --claude ROLE=MODEL:EFFORT,...
-         --kimi ROLE=ALIAS:EFFORT,... --antigravity ROLE=TIER,...
-         --avoid-codex MODELS --avoid-claude MODELS --avoid-kimi MODELS --avoid-antigravity MODELS
-         --apply --help --version
+         --kimi ROLE=ALIAS:EFFORT,... --antigravity ROLE=TIER,... --grok ROLE=MODEL,...
+         --codex-max-concurrent N --claude-max-concurrent N
+         --kimi-max-concurrent N --antigravity-max-concurrent N --grok-max-concurrent N
+         --avoid-codex MODELS --avoid-claude MODELS --avoid-kimi MODELS --avoid-antigravity MODELS --avoid-grok MODELS
+         --apply --json --help --version
 
-Explicit tool input requires --roles and --max-concurrent. Use :native for unpinned effort.
-Include every selected role for each selected tool. Avoid lists are comma-separated.
+Explicit tool input requires --roles and --max-concurrent. Use :native for unpinned effort. Antigravity and Grok Build take ROLE=TIER and ROLE=MODEL with no effort.
+Include every selected role for each selected tool. Per-tool concurrency overrides the shared fallback.
+Avoid lists are comma-separated.
 State defaults to AGENT_POLICY_HOME or ~/.agent-policy-kit.
+Terminal output is readable text; captured output is JSON. --json always prints JSON.
 This configurator exits after setup. Native files work without the package.`);}
 async function main(){
   const {values:opts,positionals,tokens}=parseArgs({allowPositionals:true,strict:true,tokens:true,options:{
     client:{type:'string'},home:{type:'string'},'state-dir':{type:'string'},policy:{type:'string'},
-    apply:{type:'boolean',default:false},help:{type:'boolean'},version:{type:'boolean'},
+    apply:{type:'boolean',default:false},json:{type:'boolean',default:false},help:{type:'boolean'},version:{type:'boolean'},
     release:{type:'boolean',default:false},config:{type:'string'},preset:{type:'string'},
     ...Object.fromEntries(EXPLICIT_FIELDS.map(name=>[name,{type:'string'}])),
   }});
   if(opts.version){console.log(version);return;}
   const command=positionals[0];
+  outputContext={command,apply:opts.apply,json:opts.json};
   if(opts.help||!command||command==='help'){help();return;}
-  if(!['instructions','init','detect','release','setup','install','uninstall','doctor'].includes(command)) fail('UNKNOWN_COMMAND');
+  if(!['instructions','init','detect','release','setup','install','uninstall','doctor','show'].includes(command)) fail('UNKNOWN_COMMAND');
   if(positionals.length!==1) fail('UNEXPECTED_ARGUMENT');
   const seen=new Set();for(const token of tokens)if(token.kind==='option'&&EXPLICIT_FIELDS.includes(token.name)){if(seen.has(token.name))fail('DUPLICATE_OPTION');seen.add(token.name);}
   const explicitValues=Object.fromEntries(EXPLICIT_FIELDS.filter(name=>opts[name]!==undefined).map(name=>[name,opts[name]])),explicit=Object.keys(explicitValues).length>0;
@@ -74,6 +82,13 @@ async function main(){
   const selectedState=opts['state-dir']??process.env.AGENT_POLICY_HOME??path.join(home,'.agent-policy-kit');
   if(!path.isAbsolute(selectedState)) fail('STATE_PATH_MUST_BE_ABSOLUTE');
   const stateDir=path.resolve(selectedState);
+  if(command==='show'){
+    if(opts.apply||opts.policy!==undefined||opts.preset!==undefined)fail('CONFLICTING_OPTIONS');
+    const {readConfiguration}=await import('../src/inspect.mjs');
+    const report=await readConfiguration({client:client??null,home,stateDir,explicitHome:Boolean(opts.home)});
+    print(report);if(Object.values(report.clients).some(c=>c.status==='attention'))process.exitCode=3;
+    return;
+  }
   const builtin=path.join(root,`policies/${preset}.json`);
   let policyPath=bundled?builtin:opts.policy?path.resolve(opts.policy):fs.existsSync(path.join(stateDir,'policy.json'))?path.join(stateDir,'policy.json'):builtin;
   if(command==='detect'){print(summarizeDetection(client?[await resolveClient(client)]:await detectClients()));return;}
@@ -134,7 +149,7 @@ async function main(){
       catch(error){configuration={status:'attention',reason:safeCode(error.code)};}
     }
     report.clients[selected]={detection,configuration,modelExecution:'not_checked',
-      concurrency:['codex','claude'].includes(selected)?'native_setting_with_client_exceptions':'instructions_only',
+      concurrency:['codex','claude','grok'].includes(selected)?'native_setting_with_client_exceptions':'instructions_only',
       models:selected==='agy'?'native_tiers':selected==='kimi'?'native_pool_with_routing_guidance':'native_role_settings'};
   }
   print(report);

package/docs/architecture.md

@@ -2,7 +2,7 @@
 
 APK runs only for configuration commands. It detects installed CLIs, reads release/custom preferences, writes native files and exits. Native agent operation never imports or launches APK.
 
-One npm version is one configuration release. src/release.mjs exposes its presets, catalog date and notes. policies contains Fast/Balanced/Quality data; models/catalog.json is the dated native model/effort snapshot. The self-contained page is generated from that same version and data. src/explicit.mjs supplies the pure command codec to Node and is embedded in the page at build time. Commands always expand selected role values, even for presets. The CLI converts complete maps to normal validated policy. Required code/light fallbacks copy the first explicit role and are unused by the complete per-role map. No browser/backend/provider request is needed to compose a command.
+One npm version is one configuration release. src/release.mjs exposes its presets, catalog date and notes. policies contains Light/Standard/Top-tier data (ids fast/balanced/quality); models/catalog.json is the dated native model/effort snapshot. The self-contained page is generated from that same version and data. src/explicit.mjs supplies the pure command codec to Node and is embedded in the page at build time. Commands always expand selected role values, even for presets. The CLI converts complete maps to normal validated policy. Required code/light fallbacks copy the first explicit role and are unused by the complete per-role map. No browser/backend/provider request is needed to compose a command.
 
 src/share.mjs validates and encodes the visible form state into the URL fragment. It never runs native operations or stores clipboard history. The page restores only release-compatible state, then applies normal command validation.
 

package/docs/compatibility.md

@@ -6,6 +6,7 @@
 | Claude Code | User role Markdown with model/effort, native default/concurrency env, routing instructions | Force settings and native execution-path exceptions can override the intended mapping |
 | Kimi Code | User role Markdown, existing secondary-model pool, per-alias effort, routing instructions | Model-role selection and max concurrency are guidance; provisioned aliases/capabilities are required |
 | Antigravity | User role Markdown with Pro/Flash/Flash Lite/inherit tiers and routing instructions | No concrete provider pin, documented per-role effort, or universal native max-three cap |
+| Grok Build | User role Markdown (read-only roles use permission_mode plan), per-role models and a general-purpose fallback in config.toml, native max_concurrent, routing instructions | No documented per-role effort; subagents use the main session effort. Higher-priority project/explicit settings still follow Grok Build rules |
 
 These are preferences implemented through native features. APK does not participate in later agent operation and does not enforce policy on every request. avoidModels is guidance. No hook, wrapper or proxy is installed to bypass native limits.
 
@@ -19,3 +20,4 @@ Primary references checked for this design:
 - [Claude native subagents](https://code.claude.com/docs/en/sub-agents).
 - [Kimi configuration](https://github.com/MoonshotAI/kimi-code/blob/main/docs/en/configuration/config-files.md) and [agent definitions](https://github.com/MoonshotAI/kimi-code/blob/main/docs/en/customization/agents.md).
 - [Antigravity native subagents](https://antigravity.google/docs/subagents?tab=cli).
+- [Grok Build subagents](https://github.com/xai-org/grok-build/blob/main/crates/codegen/xai-grok-pager/docs/user-guide/16-subagents.md), observed with Grok Build 1.0.70 and an isolated GROK_HOME.

package/docs/configuration-page.md

@@ -6,14 +6,14 @@ Open site/index.html in Google Chrome. The page is one self-contained HTML file.
 
 1. Add the subagent roles you need. A green check confirms a nonempty role selection. Each question-mark button explains its description and native prompt. Removing a role also removes its configuration rows. Readding it preserves its choices in the current page session.
 2. Add your coding tools. A green check confirms a nonempty tool selection. New tools append to the list. The first becomes active. From the second onward, All is active by default. A manually selected tool or All stays active during later additions. All configures the selected tools together. The CLI, not the browser, detects which selected tools are installed.
-3. Choose a work mode. No mode is selected initially. Each selected tool needs a chosen mode before the command becomes available. The first choice has no replacement warning. Individual tools always show every selected role's model and supported effort. All offers shared presets. Custom can be selected manually and is also set by model or effort edits. Each tool shows its own mode beneath its name. Individual presets warn before changing that tool. Replacing genuinely edited values, mixed per-tool bases or partially chosen modes from All warns before changing all selected tools. Selecting Custom alone without changing values does not create an overwrite warning. Cancel preserves the choices.
-4. Copy the setup command and run it in a terminal. Incomplete selections identify the missing steps with links. Invalid model settings disable copying and clear the previous command. Clipboard failure selects the full command for manual copying.
+3. Choose a work mode. No mode is selected initially. Each selected tool needs a chosen mode before the command becomes available. The first choice has no replacement warning. Individual tool details show every selected role's model and supported effort, followed by that tool's parallel limit. The shared All view hides these controls. All offers shared presets. Custom can be selected manually and is also set by model or effort edits. Each tool shows its own mode beneath its name. Individual presets warn before changing that tool. Replacing genuinely edited values, mixed per-tool bases or partially chosen modes from All warns before changing all selected tools. Selecting Custom alone without changing values does not create an overwrite warning. Cancel preserves the choices.
+4. Copy the setup command and run it in a terminal. Incomplete selections identify the missing steps with links. Invalid model settings or per-tool limits disable copying and clear the previous command. Clipboard failure selects the full command for manual copying.
 
-The page starts empty. A completed third step requires selected modes and valid model settings. A fourth green check means the current command was successfully copied, not installed. Configuration changes clear that check; opening another tool without changing values preserves it. Reset form clears selections, modes, copy status and the URL fragment without changing any installed native files. Parallelism follows the release recommendation. Effort buttons fill their section and show supported explicit levels. A dash means no native effort setting. Unpinned values remain unpinned until changed. Kimi roles sharing a model alias share its effort. Antigravity offers only native tiers. Other tools also accept custom native model IDs, subject to CLI and account support.
+The page starts with every subagent role selected and no coding tool. A completed third step requires selected modes and valid model settings. A fourth green check means the current command was successfully copied, not installed. Configuration changes clear that check; opening another tool without changing values preserves it. Reset form clears selections, modes, copy status and the URL fragment without changing any installed native files. Light uses 2 parallel subagents, Standard uses 3 and Top-tier uses 2. Selecting a preset restores its models, effort and parallel limit for the targeted tools. Editing a limit marks only that tool Custom. Effort buttons fill their section and show supported explicit levels. A dash means no native effort setting. Unpinned values remain unpinned until changed. Kimi roles sharing a model alias share its effort. Antigravity offers only native tiers. Other tools also accept custom native model IDs, subject to CLI and account support.
 
-The command is pinned to this page's package version. It always expands every selected tool and role into visible model/effort arguments. Presets fill the form but do not shorten or hide the command. Tools follow their selected order. --roles carries the selected role IDs and --max-concurrent carries the existing cap. Nonempty --avoid-TOOL lists preserve existing model-avoidance guidance. Omitted tools are not configured.
+The command is pinned to this page's package version. It always expands every selected tool and role into visible model/effort arguments. Presets fill the form but do not shorten or hide the command. Tools follow their selected order. --roles carries the selected role IDs and --max-concurrent carries the shared fallback. Optional --codex-max-concurrent, --claude-max-concurrent, --kimi-max-concurrent and --antigravity-max-concurrent carry independent overrides. Nonempty --avoid-TOOL lists preserve existing model-avoidance guidance. Omitted tools are not configured.
 
-Each tool uses role=model:effort entries. :native means no explicit effort pin. Antigravity uses role=tier without an effort suffix. The parser splits at the last colon, preserving model IDs that contain colons or @. Every selected role must be present exactly once for every selected tool. The generated command reports custom provenance because its values are explicit, even when a preset filled the form.
+Each tool uses role=model:effort entries. :native means no explicit effort pin. Antigravity uses role=tier and Grok Build uses role=model, both without an effort suffix. The parser splits at the last colon, preserving model IDs that contain colons or @. Every selected role must be present exactly once for every selected tool. The generated command reports custom provenance because its values are explicit, even when a preset filled the form.
 
 The complete command is visible in a read-only field that grows to fit its contents. Copy preserves the visible POSIX shell line continuations. Soft wrapping adds no additional newlines. [Native field sizing](https://developer.chrome.com/docs/css-ui/css-field-sizing) handles content and window-size changes without a JavaScript resize helper. The page never executes the command or grants model access.
 
@@ -21,7 +21,9 @@ Role/tool changes use native View Transitions with a reduced-motion setting and
 
 ## Share a setup
 
-Each form edit replaces the current URL fragment with its visible state. Copy the page address to share it. The fragment contains roles, tool order, mode/base, selected model/effort pairs, cap and editing scope. It excludes clipboard completion and unselected cached choices. Opening a link restores the form, including unfinished choices and model drafts. Command validation still blocks incomplete or invalid settings.
+The Max at once field appears only in individual coding-tool details. It accepts whole numbers from 1 to 32. Each tool retains its own limit while switching the editing view. Model-preset selection restores that tool's preset limit. Invalid selected-tool limits block the command and copy action. Invalid cached settings on unselected tools do not block selected tools. Kimi and Antigravity use the value as guidance rather than a native hard cap.
+
+Each form edit replaces the current URL fragment with its visible state. Copy the page address to share it. Version 2 fragments contain roles, tool order, mode/base, selected model/effort pairs, each tool's limit and editing scope. Version 1 scalar-limit links remain readable. Their exact count is preserved; a count that differs from the current preset makes the restored tool Custom. It excludes clipboard completion and unselected cached choices. Opening a link restores the form, including unfinished choices and model drafts. Command validation still blocks incomplete or invalid settings.
 
 src/share.mjs is the pure browser/Node codec. It uses versioned base64url JSON with strict IDs, fields, duplicate-key, size, UTF-8 and release checks. The fragment stays in the browser and needs no database or config lookup service. Invalid or mismatched-release links show an error and cannot produce an applicable command. Missing-step links scroll/focus without overwriting the setup fragment.
 
@@ -36,3 +38,7 @@ Serve site/index.html from any static host. It can become part of getacc.dev wit
 The current version is unreleased. Its page labels that status. Before npm publication, use the verified local tarball as described in the [AI operator guide](../AGENT_INSTALL.md). The checks do not publish or deploy anything.
 
 The introduction includes a collapsed “How it works and why you need it” explanation aligned with the README. Native details/summary supports keyboard toggling; opening/closing takes 200 ms and honors reduced motion. The hosted versioned URL preserves release-specific shared links.
+
+The footer credits Mykola Maksymenko and links to his supplied LinkedIn profile, Agents Can Communicate and Automatis Skills. Package author metadata is the source for the visible byline, title, author tags and static JSON-LD Person/project/page relationship. The canonical URL follows the homepage origin and bundled release version. These links load only when followed; no social widgets or runtime metadata requests are added.
+
+The latest hosted root can update its interface and author metadata from reviewed main independently of npm publication. Published versioned pages remain exact snapshots. Configuration-sensitive changes must match a published package before the host build accepts them. See [deployment](deployment.md).

package/docs/deployment.md

@@ -0,0 +1,31 @@
+# Website deployment
+
+The latest configurator at https://agent-policy-kit.trymenow.io/ follows reviewed main after Verify package succeeds. npm publication remains a separate, explicitly authorized operation.
+
+## Automatic path
+
+GitHub Actions runs Deploy configurator after a successful same-repository push verification on main. A successful version-tag verification can retry a site build after a package release. The deployment workflow always checks out main, never the triggering branch or tag's code. It verifies successful main-push CI for the checked-out commit and rechecks the latest main immediately before upload. Stale runs skip; deployments are serialized.
+
+The production environment permits the main branch only. It has no required-reviewer pause, so normal merges need no manual deployment. workflow_dispatch provides a main-only retry after an external outage or delayed npm publication.
+
+## Latest page and archived releases
+
+The root page uses the current main interface and author metadata. Its declared configuration version and generated command must already exist in npm, and configuration-sensitive source must match that version's reachable Git tag. A model/catalog/role/policy/explicit-option change requires a corresponding configuration release before it can be served.
+
+The /v/VERSION/ pages are copied byte for byte from reachable release tags. They are not rebuilt with the latest template. Old root share links redirect only to a known same-origin archived release; malformed, unknown and offline links retain safe errors. The root canonical URL stays the project root.
+
+npm run build:host requires full Git history/tags and anonymous registry access. It refuses unknown files/symlinks in the generated output and stops before replacing dist when release validation fails.
+
+## One-time credentials
+
+The GitHub production environment stores CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN as encrypted environment secrets. The deployment API token needs Workers Scripts edit for the target Cloudflare account. Routing is excluded from the generated CI configuration: domain changes remain explicit infrastructure operations, so the CI token needs no zone, DNS, KV or R2 permissions.
+
+Do not store the interactive Wrangler OAuth token or refresh token in CI. Create a separate deployment token and keep its value out of Git/npm, logs and artifacts. Cloudflare may scope Workers Scripts edit to the account rather than one Worker; the workflow additionally fixes the target Worker name and checks out trusted main code only.
+
+Deployment tooling is pinned to Wrangler 4.151.3 and installed with lifecycle scripts disabled before Cloudflare credentials are passed to the upload step. Account secrets are not exposed to PR test jobs.
+
+## Validation and retry
+
+Before upload, the workflow builds the allowlisted static output and verifies current main/CI. After upload, it checks ordinary HTTPS responses against local latest/archive bytes. A failed gate leaves the existing deployment in place. A post-upload HTTP mismatch fails the workflow and needs investigation; it does not silently claim success.
+
+Use the Deploy configurator workflow's main-only manual retry for transient service failures. No tag, npm package or PR is merged or published by this workflow.

package/docs/design/2026-11-01-grok-build-support.md

@@ -0,0 +1,30 @@
+# Grok Build support
+
+## Intent
+
+Many programmers use Grok Build next to Codex, Claude Code, Kimi Code and Antigravity. APK should configure Grok Build subagent roles the same way: one command writes native settings once and exits, with no runtime component.
+
+## Verified native surface (Grok Build 1.0.70, bundled user guide)
+
+- Profile: `$GROK_HOME`, default `~/.grok`. An isolated `GROK_HOME` is honored (checked with `grok inspect --json` on a temporary profile).
+- Roles: Markdown agent definitions in `~/.grok/agents/*.md` with YAML frontmatter (`name`, `description`, prompt body). User agents appear in the `spawn_subagent` type list. Bundled read-only agents use `permission_mode: plan`.
+- Per-role model: `[subagents.models] <agent-name> = "<model>"` in `~/.grok/config.toml` (config reference: per-subagent model override).
+- Fallback model: `[subagents.models] general-purpose = "<model>"`. Without it, a subagent without a named type inherits the parent model.
+- Parallelism: `[subagents] max_concurrent` is a native cap.
+- Instructions: `~/.grok/AGENTS.md` holds global rules.
+- Effort: resolution is spawn override, role, persona, then parent session. Agent frontmatter effort is undocumented, so APK does not pin per-role effort. Subagents use the main session's effort, as with Antigravity.
+- Compatibility: Grok reads `~/.claude/CLAUDE.md` by default. APK does not change that.
+
+## Decisions
+
+- Client id `grok`, label "Grok Build".
+- Role files `apk-<role>.md`; Reviewer and Code explorer are read-only through `permission_mode: plan`.
+- Models come from `[subagents.models]`, plus the `general-purpose` fallback copied from the Coder choice, matching the other tools' default subagent model.
+- Catalog: documented xAI ids `grok-4.7` (default, flagship), `grok-4.6`, `grok-4.5` and `grok-build-0.1` (fast coding model). Per-role effort is unavailable, so every Grok choice has `effort: null`.
+- Presets target all users, not one plan: Light uses `grok-build-0.1` for every role; Standard uses `grok-4.7` for code, review and tests and `grok-build-0.1` for the rest; Top-tier also uses `grok-4.7` for exploration and docs, keeping `grok-build-0.1` for the task runner. Parallel defaults follow the shared 2/3/2. Account access varies by plan. No top-model switch for Grok.
+- Explicit command: `--grok`, `--grok-max-concurrent`, `--avoid-grok`, following the existing per-tool pattern.
+- Ownership, drift refusal, receipts and uninstall follow the existing adapters; TOML edits are surgical, like Codex.
+
+## Out of scope
+
+Personas, roles TOML, plugin agents, project-level `.grok/` files, live model execution and any change to the main session's model or effort.

package/docs/development.md

@@ -14,7 +14,7 @@ npm run test:cache primes public dependency metadata on a fresh machine before t
 
 npm test includes both unit tests and the installed-tarball gate. The gate needs macOS sandbox-exec or Linux bubblewrap. It must actually deny checkout access; unavailable isolation fails rather than skipping. Use a normal approved host if a managed sandbox forbids nesting.
 
-src/policy.mjs validates shared preferences. src/detect.mjs probes executable identity. Native generation and the installer write ordinary role/config/instruction files. src/setup.mjs coordinates detected clients; bin/agent-policy.mjs exposes JSON configuration commands.
+src/policy.mjs validates shared preferences. src/detect.mjs probes executable identity. Native generation and the installer write ordinary role/config/instruction files. src/setup.mjs coordinates detected clients. src/inspect.mjs reads bounded native subagent fields without writes or executable probing. src/output.mjs formats readable terminal results. bin/agent-policy.mjs retains captured JSON output and supports explicit --json.
 
 Test with temporary homes. Preserve existing transaction, complete-read-set, rollback, ownership, symlink and privacy checks. The package gate must remove the npm package after setup and verify standalone native configuration consumers still read files with no dependency on package/source/state. Consumer fixtures are not actual native model execution.
 

package/docs/installation.md

@@ -2,7 +2,13 @@
 
 Follow the [AI operator guide](../AGENT_INSTALL.md). npx, a temporary prefix or an installed tarball can run this one-shot configurator. Native files never depend on those locations afterward.
 
-Use setup --release --preset balanced to preview a version's default choices; add --apply to configure. Fast and Quality are alternative named presets. The [page](../site/index.html) generates either an exact named-preset command or a --config command for edited choices. Commands are pinned to that page's APK version.
+Use setup --release --preset balanced to preview Standard, a version's default choices; add --apply to configure. --preset fast selects Light and --preset quality selects Top-tier. The [page](../site/index.html) generates explicit role, model, effort and concurrency arguments. Commands are pinned to that page's APK version.
+
+Interactive terminals show readable results. Captured output remains JSON, and --json always requests JSON. A preview writes nothing. A repeated application reports unchanged clients. Partial results identify the clients that need attention.
+
+Run `agent-policy show` to read current user-level native subagent settings before or after APK setup. Add `--client codex` for one tool or `--json` for machine output. It needs neither client executables nor APK receipts. Relevant native-home environment variables select the active user profile. An explicit --home selects standard client directories under that home. The command never changes files or calls a model.
+
+Show reads Codex TOML roles, Claude/Antigravity/Grok Build Markdown role fields (Grok Build models come from config.toml [subagents.models]), and Kimi's native secondary-model pool. Kimi APK role mappings and APK concurrency instructions are labeled as guidance. Missing pins stay unspecified. Supported Markdown fields use plain, single-quoted or JSON-compatible double-quoted scalar values. Unsupported role syntax, unsafe files and incomplete reads produce explicit attention statuses and exit code 3. External role-file references, project/managed settings, plugins and session overrides are not resolved. Show displays supported current values even when APK-managed files have local edits. It does not print prompts, credentials, raw configuration or private paths.
 
 Only genuine detected and selected clients receive files. A standard native profile is required for automatic setup; nondefault native-home environment roots get a zero-write prerequisite. Explicit --home selects the standard layout under an intentional target. Preserve original --home/--state-dir for later removal.
 
@@ -13,3 +19,5 @@ Kimi requires provisioned model entries. A missing preferred catalog alias may r
 Explicit release/custom replacement has no physical uninstall gap. Old ownership is verified, desired files are rendered over the original user baseline, and rollback protects the installed release. Doctor inspects actual applied version/source/preset without needing current presets or canonical preferences.
 
 After success the npm package can be removed. Native clients may need fresh sessions; no kit launcher is needed. Reinvoke a compatible APK for owned uninstall. Keep private receipts/backups if future removal is desired. [Recovery](recovery.md) handles drift or interrupted transactions without overwriting later user edits.
+
+The configuration page keeps per-tool limits in individual tool details. Light starts at 2, Standard at 3 and Top-tier at 2. A manual limit marks only that tool Custom. Explicit commands can use --TOOL-max-concurrent overrides alongside the shared --max-concurrent fallback. Preset selection restores its cap as well as its models and effort.

package/docs/model-catalog.md

@@ -8,6 +8,7 @@ models/catalog.json is the release snapshot, checked on 2026-10-30 UTC (2026-10-
 | Claude Code | 14 versioned IDs, 4 family aliases and inherit | [Native model configuration](https://code.claude.com/docs/en/model-config), CLI 2.1.312 |
 | Kimi Code | 6 upstream models through preferred native aliases | [Current Kimi Code models](https://www.kimi.com/code/docs/en/kimi-code/models), CLI 2.4.0 provisioned metadata |
 | Antigravity | Pro, Flash, Flash Lite and inherit tiers | CLI 1.4.10 parser and [subagent documentation](https://antigravity.google/docs/subagents?tab=cli) |
+| Grok Build | Grok 4.7, 4.6, 4.5 and Grok Build 0.1 model IDs (checked 2026-11-01) | [xAI models](https://docs.x.ai/developers/models) and [Grok Build subagents](https://github.com/xai-org/grok-build/blob/main/crates/codegen/xai-grok-pager/docs/user-guide/16-subagents.md), CLI 1.0.70 |
 
 Hidden security/utility models, session modes and private deployments are separate from this native subagent inventory. Custom IDs remain available where the native format supports them.
 
@@ -15,11 +16,11 @@ Hidden security/utility models, session modes and private deployments are separa
 
 | Upstream ID | Native effort levels | Default | Role in this release |
 |---|---|---|---|
-| k3.1-pro | low / high / max | high | Optional flagship; Quality uses explicit max for code/review/tests |
+| k3.1-pro | low / high / max | high | Optional flagship; Top-tier top-model switch for code/review/tests |
 | k3.1-pro-highspeed | low / high / max | high | Optional faster-output variant |
-| k3 | low / high / max | high | Quality exploration/documentation |
-| k3-256k | low / high / max | high | Balanced implementation/review/tests |
-| kimi-for-coding | low / high / max | max | K2.8 Preview; Fast and lighter Balanced work |
+| k3 | low / high / max | high | Top-tier code, review, tests, exploration and documentation |
+| k3-256k | low / high / max | high | Standard implementation, review, tests and docs |
+| kimi-for-coding | low / high / max | max | K2.8 Preview; Light, Standard exploration and routine work, Top-tier Task runner |
 | kimi-for-coding-highspeed | Fixed thinking; no effort override | Unpinned | Optional K2.7 Code Highspeed |
 
 Both K3.1 Pro variants require thinking. Kimi documents approximately twice the quota usage for Pro Highspeed versus regular Pro; account tier controls access and context limits. The old kimi.ai/help page still lists only four IDs, so it is not the current inventory source. Native aliases use the kimi-code/ prefix; setup still requires an existing provisioned alias or a unique matching upstream model. It never creates provider credentials.
@@ -38,46 +39,51 @@ Account/provider access varies. Custom model IDs remain available for supported
 
 ## How the presets are designed
 
-These are starting recommendations for different priorities, reviewed on 2026-10-30. No comparative task benchmark was run. The four vendors' effort labels and subscription usage are not directly comparable.
+These are starting recommendations, reviewed on 2026-10-30. Subagent usage counts against the same plan limits as the main session, and every parallel session adds to it. The presets therefore differ in how much of the plan subagents may use, not in a claimed quality ranking. No comparative task benchmark was run. Vendors' effort labels and subscription usage are not directly comparable, so one role can get different levels in different tools.
 
-- **Fast & economical:** bounded tasks on lighter models. Reviews and test creation receive extra reasoning because checking edge cases differs from executing known steps. Kimi uses one efficient alias at one coherent effort; Antigravity uses Flash for code and Flash Lite for lighter work.
-- **Balanced:** stronger implementation, review and test creation, with lighter fact gathering and mechanical work. Kimi uses K3 256K for code to keep its quota footprint below the full-context K3 variant; larger-context choices remain editable.
-- **Quality first:** demanding implementation, review and tests get frontier models and deeper supported reasoning. Exploration, documentation and mechanical steps use choices suited to those roles rather than automatically selecting the largest model everywhere. Kimi keeps one effort per shared alias; Pro max is reserved for code/review/tests, while K3 handles exploration and docs at high effort.
+- **Light:** light models for every role, so plan limits last longest. It suits entry plans and many parallel sessions. In Codex and Claude Code, reviews and test creation receive extra reasoning because checking edge cases differs from executing known steps. Kimi roles share one alias and therefore one effort, kept low to save quota; Antigravity has no per-role effort and uses Flash for code and Flash Lite for lighter work.
+- **Standard:** stronger implementation, review, test creation and documentation, with light models for fact gathering and mechanical work. Antigravity's light tier for exploration and docs is Flash. Codex runs Luna at high for exploration, OpenAI's suggested starting level for Luna; Claude's Haiku explorer uses its native default, medium. No role uses Astra, Fable or K3.1 Pro. Kimi uses K3 256K for code to keep its quota footprint below the full-context K3 variant; larger-context choices remain editable.
+- **Top-tier:** Opus 5.5, GPT-6.1 Sol and K3 at high effort for implementation, review and tests. It uses limits fastest and suits top plans with few parallel sessions. Exploration and documentation use the same high-end model; only the Task runner stays lighter. Kimi keeps one effort per shared alias, and because K2.8 has no medium level its Task runner rises from low to high. Antigravity has one top tier, Pro, so its Standard and Top-tier differ only in exploration, docs and the Task runner.
+- **Top models switch:** under Top-tier, a per-tool switch replaces the Coder, Reviewer and Test writer model with the tool's top model: Fable 5.1, GPT-6 Astra or K3.1 Pro, still at high effort. Antigravity and Grok Build have no such tier. The switch is off by default because these models use limits much faster and native default subagent settings copy the first selected role (the Coder when selected) to subagents started without a named role. It is part of Top-tier, not a separate preset, and share links keep it.
 
-No preset bans any model. An unselected model remains available in Custom. Explicit personal avoid lists are still supported in user policy/CLI input. The shared concurrency ceiling of three is a modest operational default, not a claim that a particular parallelism level improves quality; native enforcement varies by client.
+Top-tier, with or without top models, pins high rather than xhigh or max. Native default subagent settings copy the first selected role (the Coder when selected), so a higher level would also apply to every subagent started without a named role. OpenAI recommends starting Astra at Light and places High and Extra High in the same band for difficult multi-step work. Anthropic describes high as the level for work where verification matters and xhigh as deeper reasoning at higher token spend; high is Fable's native default. Higher levels remain available in Custom.
 
-### Fast & economical
+No preset bans any model. An unselected model remains available in Custom. Explicit personal avoid lists are still supported in user policy/CLI input. Parallelism defaults are Light 2, Standard 3 and Top-tier 2 for each tool. They bound simultaneous delegation rather than starting tasks or measuring quality. Light keeps short work bounded. Standard allows three independent responsibilities to overlap. Top-tier limits concurrent long-running work on heavier models. These are product defaults, not benchmark results. Each tool can override its limit in its details. Native enforcement varies by client.
 
-| Role | Codex | Claude Code | Kimi Code | Antigravity |
-|---|---|---|---|---|
-| Coder | Luna · medium | Haiku 5.5 · medium | K2.8 Preview · low | Flash |
-| Reviewer | Luna · high | Haiku 5.5 · high | K2.8 Preview · low | Flash |
-| Code explorer | Luna · low | Haiku 5.5 · low | K2.8 Preview · low | Flash Lite |
-| Test writer | Luna · high | Haiku 5.5 · high | K2.8 Preview · low | Flash |
-| Docs writer | Luna · low | Haiku 5.5 · low | K2.8 Preview · low | Flash Lite |
-| Task runner | Luna · low | Haiku 5.5 · low | K2.8 Preview · low | Flash Lite |
+### Light
 
-### Balanced
+| Role | Codex | Claude Code | Kimi Code | Antigravity | Grok Build |
+|---|---|---|---|---|---|
+| Coder | Luna · medium | Haiku 5.5 · medium | K2.8 Preview · low | Flash | Grok Build 0.1 |
+| Reviewer | Luna · high | Haiku 5.5 · high | K2.8 Preview · low | Flash | Grok Build 0.1 |
+| Code explorer | Luna · low | Haiku 5.5 · low | K2.8 Preview · low | Flash Lite | Grok Build 0.1 |
+| Test writer | Luna · high | Haiku 5.5 · high | K2.8 Preview · low | Flash | Grok Build 0.1 |
+| Docs writer | Luna · low | Haiku 5.5 · low | K2.8 Preview · low | Flash Lite | Grok Build 0.1 |
+| Task runner | Luna · low | Haiku 5.5 · low | K2.8 Preview · low | Flash Lite | Grok Build 0.1 |
 
-| Role | Codex | Claude Code | Kimi Code | Antigravity |
-|---|---|---|---|---|
-| Coder | Sol · medium | Sonnet 5.5 · medium | K3 256K · high | Pro |
-| Reviewer | Sol · high | Sonnet 5.5 · high | K3 256K · high | Pro |
-| Code explorer | Luna · high | Haiku 5.5 · medium | K2.8 Preview · low | Flash |
-| Test writer | Sol · high | Sonnet 5.5 · high | K3 256K · high | Pro |
-| Docs writer | Sol · medium | Sonnet 5.5 · medium | K2.8 Preview · low | Flash |
-| Task runner | Luna · low | Haiku 5.5 · low | K2.8 Preview · low | Flash Lite |
+### Standard
 
-### Quality first
+| Role | Codex | Claude Code | Kimi Code | Antigravity | Grok Build |
+|---|---|---|---|---|---|
+| Coder | Sol · medium | Sonnet 5.5 · medium | K3 256K · high | Pro | Grok 4.7 |
+| Reviewer | Sol · high | Sonnet 5.5 · high | K3 256K · high | Pro | Grok 4.7 |
+| Code explorer | Luna · high | Haiku 5.5 · medium | K2.8 Preview · low | Flash | Grok Build 0.1 |
+| Test writer | Sol · high | Sonnet 5.5 · high | K3 256K · high | Pro | Grok 4.7 |
+| Docs writer | Sol · medium | Sonnet 5.5 · medium | K3 256K · high | Flash | Grok 4.7 |
+| Task runner | Luna · low | Haiku 5.5 · low | K2.8 Preview · low | Flash Lite | Grok Build 0.1 |
 
-| Role | Codex | Claude Code | Kimi Code | Antigravity |
-|---|---|---|---|---|
-| Coder | Astra · xhigh | Fable 5.1 · xhigh | K3.1 Pro · max | Pro |
-| Reviewer | Astra · xhigh | Fable 5.1 · xhigh | K3.1 Pro · max | Pro |
-| Code explorer | Sol · high | Opus 5.5 · high | K3 · high | Pro |
-| Test writer | Astra · xhigh | Fable 5.1 · xhigh | K3.1 Pro · max | Pro |
-| Docs writer | Sol · high | Opus 5.5 · high | K3 · high | Pro |
-| Task runner | Sol · medium | Sonnet 5.5 · medium | K2.8 Preview · high | Flash |
+### Top-tier
+
+| Role | Codex | Claude Code | Kimi Code | Antigravity | Grok Build |
+|---|---|---|---|---|---|
+| Coder | Sol · high | Opus 5.5 · high | K3 · high | Pro | Grok 4.7 |
+| Reviewer | Sol · high | Opus 5.5 · high | K3 · high | Pro | Grok 4.7 |
+| Code explorer | Sol · high | Opus 5.5 · high | K3 · high | Pro | Grok 4.7 |
+| Test writer | Sol · high | Opus 5.5 · high | K3 · high | Pro | Grok 4.7 |
+| Docs writer | Sol · high | Opus 5.5 · high | K3 · high | Pro | Grok 4.7 |
+| Task runner | Sol · medium | Sonnet 5.5 · medium | K2.8 Preview · high | Flash | Grok Build 0.1 |
+
+With the top models switch on, Coder, Reviewer and Test writer use Astra · high in Codex, Fable 5.1 · high in Claude Code and K3.1 Pro · high in Kimi Code.
 
 ## Reasons and access requirements
 
@@ -87,6 +93,8 @@ Anthropic's [model comparison](https://platform.claude.com/docs/en/models/overvi
 
 [Kimi's model table](https://www.kimi.com/code/docs/en/kimi-code/models.html) describes K2.8 Preview's efficient thinking and the smaller quota footprint of K3 256K. Pro Highspeed has the same capabilities as regular Pro at a quota premium, so it is optional rather than a default for either economical or quality priorities. Selected aliases must be provisioned and Pro must have thinking enabled. Roles sharing one alias share its native effort setting.
 
+Grok Build 0.1 is xAI's fast coding model and serves light work; Grok 4.7 is the flagship and serves code, review, tests and docs. Light uses Grok Build 0.1 everywhere, Standard adds Grok 4.7 for code, review, tests and docs, and Top-tier also uses it for exploration. Grok 4.6 and 4.5 stay available in Custom. Account access to each model varies by plan. Per-role effort is unavailable, and there is no top models switch for Grok Build.
+
 Antigravity recommendations use only its native role tiers. The CLI's Pro/Flash/Flash Lite selectors do not freeze the underlying provider model, and there is no per-role effort field. Account access and native precedence still apply; see [support](compatibility.md).
 
 Native default effort means no explicit override. Unsupported effort fields are omitted. Explicit levels are filtered by model and native client; Kimi additionally checks provisioned support_efforts. It never silently changes the main agent's effort to satisfy a helper's setting.

package/docs/npm-release.md

@@ -18,8 +18,10 @@ Patch releases can correct documentation/configuration bugs; intentional recomme
 
 The package includes CHANGELOG.md and its matching page. Its CLI requires no compilation; only the page data is regenerated. No lifecycle install script mutates native settings.
 
-After explicit publication authorization, create the corresponding git version tag/release with the reviewed changelog text and publish that exact tarball through npm's normal authenticated process. Releases may target a verified feature-branch commit before its draft PR is merged. Never merge, mark a draft ready or enable auto-merge. Recheck registry contents and public page links after an authorized release.
+After explicit publication authorization, create the corresponding git version tag/release with the reviewed changelog text and publish that exact tarball through npm's normal authenticated process. Publish application and npm releases only from reviewed commits already present in main. Before publication, fetch origin and require git merge-base --is-ancestor HEAD origin/main to succeed. Never merge, mark a draft ready or enable auto-merge. Recheck registry contents and public page links after an authorized release.
 
 ## Static page
 
-Host each release's generated site/index.html at an immutable versioned path. A latest landing URL may link the current one. The public configurator uses an assets-only Cloudflare Worker: no Worker JavaScript, API, database or paid bindings. Run npm run build:host and wrangler deploy with the pinned Wrangler version in wrangler.jsonc. The root redirects to /v/VERSION/ so shared links retain their release. Before deploying a later version, retain earlier release pages under dist/v/ using their tagged package artifacts; never overwrite an already published versioned page. The deploy directory is allowlisted by scripts/build-host.mjs and excludes repository files and private evidence. Local preview uses Google Chrome.
+The latest site deploys automatically from reviewed main after CI, while each published /v/VERSION/ page remains an exact tagged snapshot. npm publication stays explicit. See [website deployment](deployment.md) for configuration guards, archive preservation, credentials and main-only retry.
+
+The public domain is https://agent-policy-kit.trymenow.io/. The workers.dev address remains available for earlier links. Domain-only infrastructure changes use wrangler triggers deploy and compare deployment/version IDs before and after. CI website deployment deliberately omits routing changes and does not publish npm packages.