fix: unquoted color, duplicate key, GLM downgrade + cross-platform validator

- Fix security-auditor.md color bare hex to quoted
- Fix orchestrator.md duplicate devops-engineer key
- Fix .kilo/kilo.jsonc: orchestrator + root model to kimi-k2.6:cloud
- Update agent-frontmatter-validation.md with diagnostic guide
- Update global.md with YAML frontmatter rules for all agents
- Update agent-architect.md + workflow-architect.md with color checklist
- Add scripts/validate-agents.cjs: zero-dependency, cross-platform, --fix flag, scans worktrees

.kilo/agents/agent-architect.md

@@ -46,14 +46,19 @@ Component creator: design and build new agents, workflows, and skills from @capa
 1. Analyze gap from @capability-analyst
 2. Check existing capabilities for overlap
 3. Design component (agent/workflow/skill)
-4. Create file with valid YAML frontmatter
+4. Create file with valid YAML frontmatter — **color must be double-quoted**: `"#RRGGBB"`
 5. Update AGENTS.md + capability-index.yaml
 6. Request review from @capability-analyst
 
 ## Validation Checklist
 - [ ] No duplicates with existing components
-- [ ] YAML frontmatter valid (quoted colors, correct model, mode)
-- [ ] Minimal permissions granted
+- [ ] YAML frontmatter valid
+- [ ] **color is double-quoted hex** (`"#DC2626"`, never `#DC2626`)
+- [ ] mode is `subagent` or `all` (never `primary`)
+- [ ] model includes provider prefix (`ollama-cloud/...`)
+- [ ] description is non-empty
+- [ ] all permission keys present (read, edit, write, bash, glob, grep, task)
+- [ ] task permissions use deny-by-default
 - [ ] Integration points correct
 - [ ] Index files updated
 

.kilo/agents/orchestrator.md

@@ -40,7 +40,6 @@ permission:
     "planner": allow
     "reflector": allow
     "memory-manager": allow
-    "devops-engineer": allow
 ---
 
 # Kilo Code: Orchestrator

.kilo/agents/security-auditor.md

@@ -2,7 +2,7 @@
 description: Scans for security vulnerabilities, OWASP Top 10, dependency CVEs, and hardcoded secrets
 mode: subagent
 model: ollama-cloud/deepseek-v4-pro-max
-color: #DC2626
+color: "#DC2626"
 permission:
   read: allow
   bash: allow

.kilo/agents/workflow-architect.md

@@ -41,5 +41,6 @@ Workflow designer: create and maintain slash command workflows with quality gate
 1. Validate workflow with test run
 2. Update AGENTS.md with new workflow
 3. Verify Gitea integration works
+4. **Validate YAML frontmatter** — color must be `"#RRGGBB"` (double-quoted, never bare)
 
 <gitea-commenting required="true" skill="gitea-commenting" />

.kilo/kilo.jsonc

@@ -4,13 +4,13 @@
   "skills": {
     "paths": [".kilo/skills"]
   },
-  "model": "ollama-cloud/glm-5.1",
+  "model": "ollama-cloud/kimi-k2.6:cloud",
   "default_agent": "orchestrator",
   "agent": {
     "orchestrator": {
-      "model": "ollama-cloud/glm-5.1",
+      "model": "ollama-cloud/kimi-k2.6:cloud",
       "variant": "thinking",
-      "description": "Main dispatcher. Routes tasks between agents based on Issue status. GLM-5.1 thinking for optimal routing.",
+      "description": "Main dispatcher. Routes tasks between agents based on Issue status. IF:92 for optimal routing.",
       "mode": "all",
       "permission": {
         "read": "allow",

.kilo/rules/agent-frontmatter-validation.md

@@ -4,23 +4,26 @@ Critical rules for modifying agent YAML frontmatter. Violations break Kilo Code.
 
 ## Color Format
 
-**ALWAYS use quoted hex colors in YAML frontmatter:**
+**ALWAYS use quoted hex colors in YAML frontmatter. NEVER generate unquoted colors:**
 
 ```yaml
-# ✅ Good
+# ✅ Good — quoted, safe
+model: ollama-cloud/glm-5.1
 color: "#DC2626"
-color: "#4F46E5"
-color: "#0EA5E9"
 
-# ❌ Bad - breaks YAML parsing
+# ❌ Bad — breaks YAML parsing, causes startup error
 color: #DC2626
-color: #4F46E5
-color: #0EA5E9
+
+# ❌ Bad — partially quoted, still invalid
+color: '#DC2626'
 ```
 
 ### Why
 
-Unquoted `#` starts a YAML comment, making the value empty or invalid.
+Unquoted `#` starts a YAML comment, making the value empty or invalid. This causes:
+- `Config file invalid: color: Invalid input`
+- Agent fails to load
+- Entire pipeline stalls
 
 ## Mode Values
 
@@ -116,6 +119,38 @@ for f in .kilo/agents/*.md; do
 done
 ```
 
+### Validation Script (Recommended)
+
+```bash
+node scripts/validate-agents.cjs
+```
+
+This script checks:
+- `color` is double-quoted and starts with `"#`
+- `mode` is `subagent` or `all`
+- `model` exists in `kilo-meta.json`
+- `description` is non-empty
+- All permission keys present
+- No duplicate keys
+- No trailing commas in YAML
+
+## Error Diagnosis
+
+If you see this error on startup:
+
+```
+Config file at .../agents/xxx.md is invalid: color: Invalid input
+```
+
+→ **Fix**: Wrap color in double quotes: `color: "#DC2626"`
+
+Common causes:
+1. AI generated `color: #DC2626` without quotes
+2. Copy-paste from documentation lost quotes
+3. Editor auto-format stripped quotes
+
+**Always verify with**: `grep -r "^color: #" .kilo/agents/ .kilo/commands/ .kilo/skills/`
+
 ## Common Mistakes
 
 ### 1. Unquoted Color

.kilo/rules/global.md

@@ -30,20 +30,19 @@
 - Avoid introductions, conclusions, and unnecessary explanations
 - Output text to communicate with the user; use tools to complete tasks
 
-## Markdown Structure
+## YAML Frontmatter Rules (All Agents)
 
-```markdown
-# Category Name
+When generating or editing any `.md` file with YAML frontmatter (agents, commands, skills, rules):
 
-- Rule 1
-- Rule 2
+- **color must be double-quoted**: always `"#RRGGBB"`, never bare `#RRGGBB`
+- **mode must be valid**: only `subagent` or `all`, never `primary`
+- **model must include provider**: `ollama-cloud/...`, never bare model ID
+- **description must be non-empty**
+- **all permission keys required**: read, edit, write, bash, glob, grep, task
+- **task permission uses deny-by-default** with explicit allow-list
 
-## Examples
-
-Example of expected behavior
+**Critical**: Unquoted `#` starts a YAML comment and breaks the parser with:
 ```
-
-## References
-
-When referencing code, include file path with line number:
-`file_path:line_number`
+Config file invalid: color: Invalid input
+```
+Always verify generated frontmatter with: `node scripts/validate-agents.cjs`