chore(agents): sync agent configs, models, capability index; cleanup junk

- Update agent model assignments (minimax/glm -> nemotron-3-ultra, kimi-k2.7-code, qwen3.5:397b) in .kilo/agents, kilo-meta.json, kilo.jsonc, capability-index.yaml
- Update orchestrator/agent prompts (complexity fast-path, verification tests, close-loop audit)
- Add .kilo/KILO_SPEC.md (Kilo Code specification reference)
- AGENTS.md: consolidate smartadmin agent rows
- Remove screenshot-dash.cjs (unused, contained hardcoded admin token); gitignore it
- Remove empty .kilo/milestones/

.kilo/agents/architect-indexer.md

@@ -1,7 +1,7 @@
 ---
 description: Indexes and maps project codebase architecture into .architect/ directory
 mode: all
-model: ollama-cloud/glm-5.2
+model: ollama-cloud/deepseek-v4-flash:0731
 color: "#10B981"
 permission:
   read: allow

.kilo/agents/browser-automation.md

@@ -1,7 +1,7 @@
 ---
 description: Browser automation agent using Playwright MCP for E2E testing, form filling, navigation, and web interaction
 mode: all
-model: ollama-cloud/minimax-m3
+model: ollama-cloud/kimi-k2.7-code
 variant: thinking
 permission:
   read: allow

.kilo/agents/code-skeptic.md

@@ -1,7 +1,7 @@
 ---
 description: Adversarial code reviewer. Finds problems and issues. Does NOT suggest implementations (GNS-2 Tier 0)
 mode: all
-model: ollama-cloud/glm-5.2
+model: ollama-cloud/kimi-k2.7-code
 variant: thinking
 color: "#E11D48"
 permission:
@@ -86,4 +86,17 @@ After completion, recommend next agent in event footer:
 - `security-auditor`: after performance reviewed
 
 
+## Verification Test Generation
+
+When bugs or issues are found, the skeptic MUST emit a verification test that would have caught each bug, plus the expected assertion. These tests are included in the GNS_EVENT footer as `verification_tests` so downstream agents (the-fixer) can run them.
+
+```js
+// Example: verification test for missing null check
+// test('should reject null user input', () => {
+//   expect(() => processUser(null)).toThrow('User cannot be null');
+// });
+```
+
+Each entry: `{test_name, test_code, catches}` — describes what the test catches.
+
 <gitea-commenting required="true" skill="gitea-commenting" />

.kilo/agents/context-compressor.md

@@ -1,7 +1,7 @@
 ---
 description: Intelligently manages token budget by summarizing conversation history, preserving critical State, and pruning redundant information before context overflow occurs
 mode: subagent
-model: ollama-cloud/minimax-m2.7
+model: ollama-cloud/nemotron-3-ultra
 variant: thinking
 color: "#7C3AED"
 permission:

.kilo/agents/flutter-developer.md

@@ -1,7 +1,7 @@
 ---
 description: Flutter mobile specialist for cross-platform apps, state management, and UI components
 mode: all
-model: ollama-cloud/minimax-m2.5
+model: ollama-cloud/qwen3.5:397b
 variant: thinking
 color: "#02569B"
 permission:

.kilo/agents/frontend-developer.md

@@ -1,7 +1,7 @@
 ---
-description: Handles UI implementation with multimodal capabilities. Accepts visual references like screenshots and mockups (GNS-2 Tier 1)
+description: Handles UI implementation with multimodal capabilities. Accepts visual references like screenshots and mockups. Follows landing-design-interpretation skill for visual/contrast/color tasks on landing pages (MANDATORY measurement-first protocol)
 mode: all
-model: ollama-cloud/minimax-m2.5
+model: ollama-cloud/qwen3.5:397b
 variant: thinking
 color: "#0EA5E9"
 permission:
@@ -62,6 +62,11 @@ Use the Task tool with `subagent_type` to delegate to other agents:
 4. **Responsive by default** — mobile-first approach
 5. **Component composition** — build small, reusable parts
 6. **Tool-First Enforcement** — Read existing component files with Read/Grep before modifying. Search for existing patterns before introducing new ones.
+7. **Landing Visual Protocol (MANDATORY)** — When task involves landing pages, colors, contrast, or readability:
+   - **STEP 1: Interpret** — Load `.kilo/skills/landing-design-interpretation/SKILL.md`. Translate human description to technical selectors.
+   - **STEP 2: Measure** — Use Docker-based measurement tools (Playwright contrast extraction, screenshot diff, or axe-core) to get exact color values and contrast ratios. **NEVER guess colors without measurement.**
+   - **STEP 3: Fix + Verify** — Apply minimal targeted CSS changes, then re-run measurement to confirm contrast >= 4.5:1.
+   - Reference: `.kilo/rules/landing-visual-debugging.md`
 
 ## Visual Quality Rules (Learned from Past Mistakes)
 
@@ -76,6 +81,7 @@ Use the Task tool with `subagent_type` to delegate to other agents:
 1. **Always check selector specificity** when styling reused components. If a global `.nav-link { color: white !important }` exists from navbar, scoped tab `.nav-link` MUST use higher specificity or `!important` override.
 2. **Verify contrast BEFORE shipping** — light gray text (`#6c757d`) on white (`#fff`) is only 4.6:1, which is borderline. For small text under 14px, use darker text (`#495057` or `#333`).
 3. **Don't assume Bootstrap defaults are safe** — its `.nav-tabs` may bring unwanted borders, margins, or radius. Always inspect computed styles.
+4. **Human Description Translation** — When human says "blends in", "disappears", "hard to read": immediately compute contrast ratio with `getComputedStyle` + Docker Playwright script. Do NOT trust visual intuition alone.
 
 ### Border & Shadow Hygiene
 1. **One visual hierarchy per component** — border OR shadow, not both simultaneously on the same element.
@@ -89,6 +95,7 @@ Use the Task tool with `subagent_type` to delegate to other agents:
 - [ ] Hover states are distinguishable from active states
 - [ ] Mobile: tabs don't overflow or wrap weirdly
 - [ ] Component looks intentional, not accidental
+- [ ] Contrast measurement run and documented for landing/visual tasks
 
 ## Output Format
 
@@ -135,6 +142,9 @@ This model can:
 - DO NOT make API design decisions
 - DO NOT skip accessibility
 - DO NOT ignore responsive design
+- DO NOT change landing page colors without running automated contrast measurement
+- DO NOT rely on visual intuition for color decisions on landing pages
+- DO NOT skip `.kilo/rules/landing-visual-debugging.md` protocol for visual tasks
 
 ## Handoff Protocol
 

.kilo/agents/go-developer.md

@@ -1,7 +1,7 @@
 ---
 description: Go backend specialist for Gin, Echo, APIs, and database integration (GNS-2 Tier 1)
 mode: all
-model: ollama-cloud/kimi-k2.6
+model: ollama-cloud/kimi-k2.7-code
 color: "#00ADD8"
 permission:
   read: allow

.kilo/agents/history-miner.md

@@ -1,7 +1,7 @@
 ---
 description: Analyzes git history to find duplicates and past solutions, preventing regression and duplicate work (GNS-2 Tier 0)
 mode: all
-model: ollama-cloud/glm-5.2
+model: ollama-cloud/deepseek-v4-flash:0731
 color: "#059669"
 permission:
   read: allow

.kilo/agents/incident-responder.md

@@ -1,7 +1,7 @@
 ---
 description: Server incident response and system hardening specialist. Handles live forensics, malware removal, persistence hunting, SSH-based server cleanup, and post-incident hardening. Works with any OS and panel.
 mode: all
-model: ollama-cloud/glm-5.2
+model: ollama-cloud/minimax-m3
 variant: thinking
 color: "#B91C1C"
 permission:

.kilo/agents/intake-agent.md

@@ -1,7 +1,7 @@
 ---
 description: Conversational interface — receives natural language from users, clarifies ambiguous requirements, produces structured tasks for orchestrator
 mode: all
-model: ollama-cloud/minimax-m2.7
+model: ollama-cloud/nemotron-3-ultra
 variant: thinking
 color: "#0891B2"
 permission:

.kilo/agents/markdown-validator.md

@@ -1,9 +1,10 @@
 ---
 description: Validates and corrects Markdown descriptions for Gitea issues
 mode: subagent
-model: ollama-cloud/minimax-m2.5
+model: ollama-cloud/nemotron-3-ultra
 variant: thinking
 permission:
+  bash: ask
   read: allow
   edit: allow
   write: allow

.kilo/agents/memory-manager.md

@@ -4,6 +4,7 @@ mode: subagent
 model: ollama-cloud/minimax-m3
 color: "#8B5CF6"
 permission:
+  bash: ask
   edit: allow
   read: allow
   write: allow

.kilo/agents/orchestrator.md

@@ -1,7 +1,7 @@
 ---
 description: Main dispatcher. Routes tasks between agents based on Issue status and manages the workflow state machine. NEVER does implementation work itself — ALWAYS delegates via Task tool. bash/write=allow for routing checks and protocol logs only.
 mode: all
-model: ollama-cloud/glm-5.1
+model: ollama-cloud/deepseek-v4-flash:0731
 variant: thinking
 color: "#7C3AED"
 permission:
@@ -110,6 +110,24 @@ Before EVERY action, run this gate:
 | Run test suite | ~5,000 tokens | ~500 tokens | sdet-engineer wins |
 | Review code | ~8,000 tokens | ~500 tokens | code-skeptic wins |
 
+## Complexity Fast-Path (BEFORE pipeline)
+
+Before routing to full pipeline, evaluate trivial tasks:
+
+| Signal | Action |
+|---|---|
+| Task = typo, config value, single-line fix | Direct: orchestrator → lead-developer → done |
+| Task = single file, <50 lines change | Direct: lead-developer → code-skeptic (1 reviewer) → done |
+| Task = research question, no code change | Direct: pattern-matcher or history-miner → done |
+| Task unclear or multi-file | Full pipeline with pre-flight gate |
+
+Skip history-miner, requirement-refiner, system-analyst for trivial tasks.
+Skip consensus voting for simple tasks.
+
+TCA check MUST pass before fast-path (otherwise full pipeline).
+
+Rationale (Microsoft Azure 2026-02): "Use the lowest level of complexity that reliably meets requirements." Multi-agent orchestration adds coordination overhead, latency, cost. For 30% of tasks that are trivial, skipping 5+ agents saves ~30K tokens.
+
 ## Delegation Routing
 
 ### By Status
@@ -351,4 +369,26 @@ Instead of re-reading all comments:
 After any agent completes:
 1. `reportChange(issueNumber, report)` → posts compact change table + GNS_EVENT footer
 2. Releases file claims, updates checkpoint budget
-3. Checks acceptance criteria → auto-close if all met
+3. Checks acceptance criteria → auto-close if all met
+
+## Adaptive Scaling by Complexity
+
+When dispatching agents, the orchestrator reads the `complexity` field from requirement-refiner output and selects scaling config from `.kilo/capability-index.yaml` → `adaptive_scaling`. The complexity value maps to one of: `trivial`, `simple`, `medium`, `complex`.
+
+- **trivial/simple**: single reviewer, no consensus, low token budget
+- **medium**: 2 reviewers with specific models, up to 3 iterations
+- **complex**: consensus mode with 3 agents, dispatched via `/consensus` (Agent Forest pattern)
+
+If `complexity: complex` AND `consensus: true`, the orchestrator dispatches via the consensus workflow instead of standard sequential review. Token budget and max iterations are read from the scaling config.
+
+### Effort Budget by Complexity (Mandatory)
+
+BEFORE dispatching, classify the task and apply this budget:
+
+- **Trivial** (typo, config value, single-line fix): invoke 1 agent only (lead-developer). Skip all reviewers.
+- **Simple** (single endpoint, 1 model + migration): invoke 1-2 agents. 1 reviewer max.
+- **Medium** (multi-file feature, 3-5 files): invoke 2-4 agents. 2 reviewers, 1 iteration loop.
+- **Complex** (subsystem refactor, security audit): invoke 4-10 agents. Consensus voting, 3 iteration max.
+
+If uncertain how many subagents: start with 1, escalate only on explicit failure.
+Never spawn >10 subagents without user confirmation.

.kilo/agents/pattern-matcher.md

@@ -1,7 +1,7 @@
 ---
 description: Proactively finds similar successful solutions from past projects BEFORE work starts, providing recommendations instead of just duplicate detection
 mode: subagent
-model: ollama-cloud/minimax-m2.7
+model: ollama-cloud/nemotron-3-ultra
 variant: thinking
 color: "#059669"
 permission:

.kilo/agents/performance-engineer.md

@@ -5,6 +5,7 @@ model: ollama-cloud/minimax-m3
 variant: thinking
 color: "#0D9488"
 permission:
+  write: ask
   edit: allow
   read: allow
   bash: allow

.kilo/agents/pipeline-judge.md

@@ -1,10 +1,11 @@
 ---
 description: Automated pipeline judge. Evaluates workflow execution by running tests, measuring token cost and wall-clock time. Produces objective fitness scores. Never writes code - only measures and scores.
 mode: all
-model: ollama-cloud/qwen3.5:397b
+model: ollama-cloud/kimi-k2.7-code
 variant: thinking
 color: "#DC2626"
 permission:
+  write: ask
   edit: allow
   read: allow
   bash: allow
@@ -96,4 +97,14 @@ After completion, recommend next agent in event footer:
 - `security-auditor`: after performance reviewed
 
 
+## SOP Adherence Scoring
+
+Fitness score now includes `sop_adherence` as a component:
+
+```
+fitness = (test_pass_rate × 0.40) + (quality_gates_rate × 0.25) + (efficiency_score × 0.20) + (sop_adherence × 0.15)
+```
+
+Where `sop_adherence = matched_steps / total_sop_steps`, read from `.kilo/workflows/pipeline-sop.yaml`. The judge reads the workflow-cross-checker's `sop_check` results from GNS_EVENT footers to compute this component.
+
 <gitea-commenting required="true" skill="gitea-commenting" />

.kilo/agents/planner.md

@@ -5,6 +5,7 @@ model: ollama-cloud/minimax-m3
 variant: thinking
 color: "#F59E0B"
 permission:
+  bash: ask
   edit: allow
   read: allow
   write: allow

.kilo/agents/product-owner.md

@@ -1,7 +1,7 @@
 ---
 description: Manages issue checklists, status labels, tracks progress and coordinates with human users
 mode: all
-model: ollama-cloud/minimax-m2.5
+model: ollama-cloud/nemotron-3-ultra
 variant: thinking
 permission:
   read: allow

.kilo/agents/prompt-optimizer.md

@@ -4,6 +4,7 @@ mode: subagent
 model: ollama-cloud/minimax-m3
 variant: thinking
 permission:
+  bash: ask
   read: allow
   edit: allow
   write: allow
@@ -92,4 +93,15 @@ Tier 1 (Task Agent / Orchestrator-Mediated Cascade)
 ```
 
 
+## Integrate Episodic Lessons
+
+When optimizing an agent's prompt, read `.kilo/logs/episodic-lessons.jsonl` for lessons tagged `applied_to` containing that agent name. Integrate relevant lessons into the improved prompt. Each lesson includes the failure pattern, the fix, and the issue that triggered it.
+
+```bash
+# Filter lessons for a specific agent
+cat .kilo/logs/episodic-lessons.jsonl | grep '"applied_to":\[.*"lead-developer".*\]'
+```
+
+Lessons with `success: false` indicate patterns to avoid; `success: true` indicate patterns to reinforce.
+
 <gitea-commenting required="true" skill="gitea-commenting" />

.kilo/agents/reflector.md

@@ -1,10 +1,12 @@
 ---
 description: Self-reflection agent using Reflexion pattern - learns from mistakes
 mode: subagent
-model: ollama-cloud/glm-5.2
+model: ollama-cloud/minimax-m3
 variant: thinking
 color: "#10B981"
 permission:
+  bash: ask
+  write: ask
   edit: allow
   read: allow
   grep: allow
@@ -63,3 +65,13 @@ After completion, recommend next agent in event footer:
 - `code-skeptic`: after code written
 - `performance-engineer`: after code tested
 - `security-auditor`: after performance reviewed
+
+## Episodic Learning
+
+At pipeline end, the reflector reads the last N entries (default 20) from `.kilo/logs/agent-executions.jsonl` and `.kilo/logs/episodic-lessons.jsonl` (if present), extracts success/failure patterns, and appends new lessons to `episodic-lessons.jsonl`.
+
+```jsonl
+{"ts":"ISO","lesson":"pattern description","from_agent":"agent-name","issue":N,"applied_to":["agent1","agent2"],"success":true}
+```
+
+Lessons are tagged with `applied_to` listing agent names that should integrate them. The prompt-optimizer reads these lessons when improving prompts.

.kilo/agents/release-manager.md

@@ -1,7 +1,7 @@
 ---
 description: Manages git operations, semantic versioning, branching, and deployments. Ensures clean history
 mode: all
-model: ollama-cloud/glm-5.2
+model: ollama-cloud/deepseek-v4-flash:0731
 permission:
   read: allow
   edit: allow

.kilo/agents/requirement-refiner.md

@@ -1,7 +1,7 @@
 ---
 description: Converts vague ideas and bug reports into strict User Stories with acceptance criteria checklists (GNS-2 Tier 0)
 mode: all
-model: ollama-cloud/glm-5.2
+model: ollama-cloud/minimax-m3
 variant: thinking
 color: "#4F46E5"
 permission:

.kilo/agents/security-auditor.md

@@ -1,10 +1,11 @@
 ---
 description: Scans for security vulnerabilities, OWASP Top 10, dependency CVEs, and hardcoded secrets (GNS-2 Tier 0)
 mode: all
-model: ollama-cloud/glm-5.2
+model: ollama-cloud/kimi-k2.7-code
 variant: thinking
 color: "#DC2626"
 permission:
+  write: ask
   edit: allow
   read: allow
   bash: allow
@@ -205,4 +206,15 @@ After completion, recommend next agent in event footer:
 - `security-auditor`: after performance reviewed
 
 
+## Verification Test Generation
+
+When vulnerabilities are found, the auditor MUST emit a verification test (e.g., a request that should be rejected) that would have caught the vulnerability. These are included in the GNS_EVENT footer as `verification_tests`.
+
+```bash
+# Example: verification test for SQL injection
+# curl -X POST /api/login -d "username=' OR 1=1--" | should return 400
+```
+
+Each entry: `{test_name, test_code, catches}` — describes the vulnerability it catches.
+
 <gitea-commenting required="true" skill="gitea-commenting" />

.kilo/agents/smartadmin-builder.md

@@ -1,7 +1,7 @@
 ---
 description: SmartAdmin template builder — generates and edits admin panel EJS templates using the 721-component SmartAdmin library. Understands component classes, page structure, and produces backend-ready frontend pages.
 mode: subagent
-model: ollama-cloud/minimax-m2.5
+model: ollama-cloud/qwen3.5:397b
 variant: thinking
 variant_strategy: task_size_based
 color: "#2563EB"

.kilo/agents/smartadmin-form-agent.md

@@ -1,7 +1,7 @@
 ---
 description: Form engine specialist for SmartAdmin. Generates complete form HTML with validation attributes and JS handlers using Bootstrap form groups, Select2, datepickers, and form wizards.
 mode: subagent
-model: ollama-cloud/minimax-m2.5
+model: ollama-cloud/qwen3.5:397b
 variant: thinking
 variant_strategy: task_size_based
 color: "#10B981"

.kilo/agents/smartadmin-interactive-agent.md

@@ -1,7 +1,7 @@
 ---
 description: Interactive elements specialist for SmartAdmin. Generates HTML element snippets and event handler JS for buttons, dropdowns, nav-tabs, collapse, and modal triggers.
 mode: subagent
-model: ollama-cloud/kimi-k2.6
+model: ollama-cloud/kimi-k2.7-code
 variant: thinking
 variant_strategy: task_size_based
 color: "#8B5CF6"

.kilo/agents/smartadmin-notify-agent.md

@@ -1,7 +1,7 @@
 ---
 description: Notification/feedback UI specialist for SmartAdmin. Generates alert HTML snippets and JS trigger functions using Bootstrap alerts, modals, and toasts.
 mode: subagent
-model: ollama-cloud/glm-5.2
+model: ollama-cloud/deepseek-v4-flash:0731
 variant: thinking
 variant_strategy: task_size_based
 color: "#F59E0B"

.kilo/agents/smartadmin-viz-agent.md

@@ -1,7 +1,7 @@
 ---
 description: Data visualization specialist for SmartAdmin. Generates EJS snippets and JS initialization code for ApexCharts, Peity, Easy Pie, and SmartTable.
 mode: subagent
-model: ollama-cloud/deepseek-v4-pro
+model: ollama-cloud/deepseek-v4-flash:0731
 variant: thinking
 variant_strategy: task_size_based
 color: "#0EA5E9"

.kilo/agents/stakeholder-bridge.md

@@ -1,7 +1,7 @@
 ---
 description: Translates technical outputs into business language for non-technical stakeholders, generates executive summaries and progress reports
 mode: subagent
-model: ollama-cloud/minimax-m2.7
+model: ollama-cloud/nemotron-3-ultra
 variant: thinking
 color: "#DC2626"
 permission:

.kilo/agents/the-fixer.md

@@ -1,7 +1,7 @@
 ---
 description: Iteratively fixes bugs based on specific error reports and test failures (GNS-2 Tier 1)
 mode: all
-model: ollama-cloud/glm-5.2
+model: ollama-cloud/kimi-k2.7-code
 variant: thinking
 color: "#F59E0B"
 permission:
@@ -118,4 +118,14 @@ Tier 1 (Task Agent / Orchestrator-Mediated Cascade)
 ```
 
 
+## Run Verification Tests
+
+When fixing issues reported by code-skeptic or security-auditor, the fixer MUST first read the `verification_tests` from the previous agent's GNS_EVENT footer and run them as the FIRST step of verification, before applying its own fixes. This ensures the reported issues are reproducible and the fix addresses them.
+
+1. Parse GNS_EVENT footer from the review agent's comment
+2. Extract `verification_tests` array
+3. Run each test — confirm it fails (reproduces the bug)
+4. Apply fix, then re-run — confirm it passes
+5. Report results in GNS_EVENT footer
+
 <gitea-commenting required="true" skill="gitea-commenting" />

.kilo/agents/visual-tester.md

@@ -1,7 +1,7 @@
 ---
 description: Strategy-aware visual testing orchestrator. Selects between vlmkit, vrt, and Midscene.js based on issue content. Runs in Docker only. Requires visual-testing and docker-visual-testing skills.
 mode: all
-model: ollama-cloud/kimi-k2.6
+model: ollama-cloud/kimi-k2.7-code
 color: "#DC2626"
 variant: thinking
 permission:

.kilo/agents/workflow-architect.md

@@ -1,9 +1,10 @@
 ---
 description: Creates and maintains workflow definitions with complete architecture, Gitea integration, and quality gates
 mode: subagent
-model: ollama-cloud/glm-5.2
+model: ollama-cloud/minimax-m3
 variant: thinking
 permission:
+  bash: ask
   read: allow
   edit: allow
   write: allow

.kilo/agents/workflow-cross-checker.md

@@ -186,4 +186,19 @@ If `BLOCKED`: "Resolve: [blocker]; current assignee stays orchestrator until unb
 } -->
 ```
 
+## SOP Adherence Check
+
+The cross-checker verifies that the current pipeline step matches the expected step in `.kilo/workflows/pipeline-sop.yaml`. It compares step name, agent, and verification criteria against the SOP definition. Reports `sop_violation` in the GNS_EVENT footer if mismatch is detected.
+
+```yaml
+# SOP check output in GNS_EVENT:
+# "sop_check": {
+#   "expected_step": "code_review",
+#   "actual_step": "code_review",
+#   "expected_agent": "code-skeptic",
+#   "actual_agent": "code-skeptic",
+#   "match": true
+# }
+```
+
 <gitea-commenting required="true" />