diff --git a/Makefile b/Makefile
index 424813f..c0a69c6 100644
--- a/Makefile
+++ b/Makefile
@@ -39,17 +39,17 @@ test-changed-charts:
 
 test-opencode-server-agents:
 	@set -euo pipefail; \
-	expected="$$(printf '%s\n' '---' "description: Use for bounded generic coding, debugging, or repository tasks when the assigning primary agent's execution budget is nearing completion or it otherwise needs execution capacity; the primary retains task interpretation, safety, delivery decisions, and final synthesis" 'mode: subagent' 'model: openai/gpt-6-sol' 'variant: default' '---')"; \
+	expected="$$(printf '%s\n' '---' "description: Use for bounded generic coding, debugging, or repository tasks when the assigning primary agent's execution budget is nearing completion or it otherwise needs execution capacity; the primary retains task interpretation, safety, delivery decisions, and final synthesis" 'mode: subagent' 'model: openai/gpt-6.1-sol' 'variant: medium' '---')"; \
 	test "$$(cat opencode-server/files/agents/terra.md)" = "$$expected"; \
-	expected_devops="$$(printf '%s\n' '---' 'description: Read-only DevOps integration and delivery reviewer for proposed designs or completed changes involving CI, GitHub Actions, shared workflows, artifacts, GitOps handoffs, runners, permissions, and deployment contracts; requires a supplied integration map and never implements or mutates systems' 'mode: subagent' 'model: openai/gpt-6-sol' 'permission:' '  "*": deny' '  edit: deny' '  bash: deny' '---')"; \
+	expected_devops="$$(printf '%s\n' '---' 'description: Read-only DevOps integration and delivery reviewer for proposed designs or completed changes involving CI, GitHub Actions, shared workflows, artifacts, GitOps handoffs, runners, permissions, and deployment contracts; requires a supplied integration map and never implements or mutates systems' 'mode: subagent' 'model: openai/gpt-6.1-sol' 'variant: medium' 'permission:' '  "*": deny' '  edit: deny' '  bash: deny' '---')"; \
 	actual_devops="$$(awk '{print} /^---$$/{n++; if (n==2) exit}' opencode-server/files/agents/devops-engineer.md)"; \
 	test "$$actual_devops" = "$$expected_devops"; \
-	! grep -Fq 'variant:' opencode-server/files/agents/devops-engineer.md; \
+	grep -Fqx 'variant: medium' opencode-server/files/agents/devops-engineer.md; \
 	grep -Fqx 'Use `DESIGN` mode only for a supplied proposal. Assess whether the proposed contracts, owners, validations, and delivery stages are sufficiently specified to proceed to implementation.' opencode-server/files/agents/devops-engineer.md; \
 	grep -Fqx 'Use `CHANGE` mode only for a completed diff and all affected workflows. Assess the implemented integration contract and supplied validation evidence. Flag needless bespoke automation even where no supplied contract expressly prohibits it.' opencode-server/files/agents/devops-engineer.md; \
 	grep -Fqx '## VERDICT: ADVANCE / HOLD / REJECT' opencode-server/files/agents/devops-engineer.md; \
 	for agent in default makeitwork xnoto career teacher; do grep -Fq '`devops-engineer` for CI, workflow, shared-workflow, artifact,' "opencode-server/files/agents/$$agent.md"; done; \
-	expected_cloud="$$(printf '%s\n' '---' 'description: Read-only preimplementation cloud architecture review for new services or material service-selection, topology, state, recovery, scaling, or cost changes; challenges supplied designs for requirements fit and unnecessary complexity, not routine changes or completed-code review' 'mode: subagent' 'model: openai/gpt-6-sol' 'variant: default' 'permission:' '  "*": deny' '  edit: deny' '  bash: deny' '---')"; \
+	expected_cloud="$$(printf '%s\n' '---' 'description: Read-only preimplementation cloud architecture review for new services or material service-selection, topology, state, recovery, scaling, or cost changes; challenges supplied designs for requirements fit and unnecessary complexity, not routine changes or completed-code review' 'mode: subagent' 'model: openai/gpt-6.1-sol' 'variant: medium' 'permission:' '  "*": deny' '  edit: deny' '  bash: deny' '---')"; \
 	actual_cloud="$$(awk '{print} /^---$$/{n++; if (n==2) exit}' opencode-server/files/agents/cloud-architecture-reviewer.md)"; \
 	test "$$actual_cloud" = "$$expected_cloud"; \
 	grep -Fqx '## Required inputs' opencode-server/files/agents/cloud-architecture-reviewer.md; \
@@ -77,15 +77,18 @@ test-opencode-server-agents:
 	done; \
 	for reviewer in adversarial-code-reviewer infra-security-reviewer recruiter-resume-reviewer; do \
 		reviewer_frontmatter="$$(awk '{print} /^---$$/{n++; if (n==2) exit}' "opencode-server/files/agents/$$reviewer.md")"; \
-		grep -Fqx 'model: openai/gpt-6-sol' <<< "$$reviewer_frontmatter"; \
-		grep -Fqx 'variant: high' <<< "$$reviewer_frontmatter"; \
+		grep -Fqx 'model: openai/gpt-6.1-sol' <<< "$$reviewer_frontmatter"; \
+		case "$$reviewer" in recruiter-resume-reviewer) variant=high ;; *) variant=xhigh ;; esac; \
+		grep -Fqx "variant: $$variant" <<< "$$reviewer_frontmatter"; \
 	done; \
 	for agent in luna qa-engineer; do \
 		luna_frontmatter="$$(awk '{print} /^---$$/{n++; if (n==2) exit}' "opencode-server/files/agents/$$agent.md")"; \
 		grep -Fqx 'model: openai/gpt-6-luna' <<< "$$luna_frontmatter"; \
-		test "$$(grep -Ec '^variant:' <<< "$$luna_frontmatter")" -eq 0; \
+		case "$$agent" in luna) variant=low ;; *) variant=medium ;; esac; \
+		grep -Fqx "variant: $$variant" <<< "$$luna_frontmatter"; \
 	done; \
-	grep -Fqx 'version: 0.5.3' opencode-server/Chart.yaml; \
+	grep -Fqx 'version: 0.5.4' opencode-server/Chart.yaml; \
+	grep -Fqx '  "model": "openai/gpt-6.1-sol",' opencode-server/files/opencode.json; \
 	grep -Fqx '  "default_agent": "default",' opencode-server/files/opencode.json; \
 	! grep -Fq 'twilio-docs' opencode-server/files/opencode.json; \
 	test ! -e opencode-server/files/skills/twilio-docs-troubleshooting; \
@@ -181,7 +184,7 @@ test-opencode-server-agents:
 	for agent in $$primary_agents; do \
 		frontmatter="$$(awk '{print} /^---$$/{n++; if (n==2) exit}' "opencode-server/files/agents/$$agent.md")"; \
 		grep -Fqx 'model: openai/gpt-6.1-sol' <<< "$$frontmatter"; \
-		test "$$(grep -Ec '^variant:' <<< "$$frontmatter")" -eq 0; \
+		grep -Fqx 'variant: medium' <<< "$$frontmatter"; \
 		policy="$$(tr -s '[:space:]' ' ' < "opencode-server/files/agents/$$agent.md")"; \
 		grep -Fqi 'without a custom project name' <<< "$$policy"; \
 		grep -Fqi 'retry once' <<< "$$policy"; \
@@ -243,8 +246,8 @@ test-opencode-server-agents:
 	grep -Fqx '  terra.md: |-' <<< "$$rendered"; \
 	grep -Fqx "    description: Use for bounded generic coding, debugging, or repository tasks when the assigning primary agent's execution budget is nearing completion or it otherwise needs execution capacity; the primary retains task interpretation, safety, delivery decisions, and final synthesis" <<< "$$rendered"; \
 	grep -Fqx '    mode: subagent' <<< "$$rendered"; \
-	grep -Fqx '    model: openai/gpt-6-sol' <<< "$$rendered"; \
-	grep -Fqx '    variant: default' <<< "$$rendered"; \
+	grep -Fqx '    model: openai/gpt-6.1-sol' <<< "$$rendered"; \
+	grep -Fqx '    variant: medium' <<< "$$rendered"; \
 	grep -Fqx '              - key: terra.md' <<< "$$rendered"; \
 	grep -Fqx '                path: agents/terra.md' <<< "$$rendered"; \
 	grep -Fqx '  devops-engineer.md: |-' <<< "$$rendered"; \
@@ -254,7 +257,7 @@ test-opencode-server-agents:
 	archive_dir="$$(mktemp -d)"; \
 	trap 'rm -rf "$$archive_dir"' EXIT; \
 	helm package opencode-server --destination "$$archive_dir" > /dev/null; \
-	archive="$$(find "$$archive_dir" -maxdepth 1 -type f -name 'opencode-server-0.5.3.tgz' -print -quit)"; \
+	archive="$$(find "$$archive_dir" -maxdepth 1 -type f -name 'opencode-server-0.5.4.tgz' -print -quit)"; \
 	test -n "$$archive"; \
 	archive_entries="$$(tar -tzf "$$archive")"; \
 	! grep -Fq 'twilio-docs-troubleshooting' <<< "$$archive_entries"; \
diff --git a/opencode-server/Chart.yaml b/opencode-server/Chart.yaml
index 7c21727..4ba8c55 100644
--- a/opencode-server/Chart.yaml
+++ b/opencode-server/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: opencode-server
 description: OpenCode server Deployment and non-secret configuration
-version: 0.5.3
+version: 0.5.4
 appVersion: "2.0.22"
 type: application
diff --git a/opencode-server/README.md b/opencode-server/README.md
index bc5d00b..7fd27d2 100644
--- a/opencode-server/README.md
+++ b/opencode-server/README.md
@@ -17,21 +17,54 @@ The chart copies these immutable package inputs into `/home/opencode/.config/ope
 - `files/agents/*.md` — owner-specific primary agents, the generic `terra` execution subagent, model-backed subagents for delegated passes, and specialized read-only SDLC subagents (adversarial code review, cloud architecture design review, DevOps integration and delivery review, QA coverage and documentation adequacy, release readiness, infrastructure security, documentation drafting)
 - `files/skills/*/SKILL.md` — specialized operational workflows
 
-A change to any packaged file is chart content and requires a new `Chart.yaml` version. See [Agent instruction architecture](docs/agent-instruction-architecture.md) for the primary-agent, subagent, and shared-instruction design. Chart 0.5.3 standardizes the full cache-read procedure across all ten primaries, adds active writer-mapping bootstrap, and keeps the shared routing floor compact for subagents. Image/appVersion 2.0.22 and API version 2 remain unchanged; the consuming GitOps pin and its exact chart/API assertion must be updated separately after publication.
-
-The ten primary agents (`default`, `makeitwork`, `xnoto`, `career`, `teacher`,
-`grillmaster`, `homerepair`, `homesteader`, `lawnmowerman`, and `mechanic`)
-select `openai/gpt-6.1-sol` without a variant override. The six Terra-tier subagents
-(`terra`, `adversarial-code-reviewer`, `cloud-architecture-reviewer`,
-`devops-engineer`, `infra-security-reviewer`, and `recruiter-resume-reviewer`)
-select `openai/gpt-6-sol`, and the two Luna-tier subagents (`luna` and
-`qa-engineer`) select `openai/gpt-6-luna`; existing variants are preserved. The
-GLM and MiniMax subagents are unchanged. `opencode models openai` checks the model
-catalog; use `opencode models openai --refresh` if a model is absent. Catalog
-presence does not prove provider entitlement or successful inference. After an
-approved rollout, verify the changed models in a fresh session; existing
-sessions may retain their selected model. Configuration is loaded at server
-startup, not hot-reloaded.
+A change to any packaged file is chart content and requires a new `Chart.yaml` version. See [Agent instruction architecture](docs/agent-instruction-architecture.md) for the primary-agent, subagent, and shared-instruction design. Chart 0.5.4 aligns the global model and all existing Sol agents on GPT-6.1 Sol, adds explicit agent reasoning variants, and corrects stale cloud-reviewer terminology. Image/appVersion 2.0.22 and API version 2 remain unchanged; the consuming GitOps pin and its exact chart/API assertion must be updated separately after publication.
+
+The global model is `openai/gpt-6.1-sol`, and `default_agent` remains
+`default`. The configured OpenAI agent preferences are:
+
+| Agents | Model | Variant |
+| --- | --- | --- |
+| All ten primaries | `openai/gpt-6.1-sol` | `medium` |
+| `terra`, `cloud-architecture-reviewer`, `devops-engineer` | `openai/gpt-6.1-sol` | `medium` |
+| `adversarial-code-reviewer`, `infra-security-reviewer` | `openai/gpt-6.1-sol` | `xhigh` |
+| `recruiter-resume-reviewer` | `openai/gpt-6.1-sol` | `high` |
+| `luna` | `openai/gpt-6-luna` | `low` |
+| `qa-engineer` | `openai/gpt-6-luna` | `medium` |
+
+The Kimi, GLM, and MiniMax workers, 25-agent inventory, permissions, MCPs,
+provider wiring, image, and opt-in pilot are unchanged. No new agent is added.
+The reasoning policy follows [OpenAI model-selection guidance](https://developers.openai.com/api/docs/guides/model-selection):
+Luna low for focused work, Sol medium for coordinated revisable work, and Sol
+xhigh for decisions involving conflicting evidence. Recruiter high and QA
+medium are role-specific starting points, not benchmarked quality guarantees.
+Astra remains an exceptional, explicit owner-selected review option; no agent
+or automatic escalation is introduced. Avoid a universal high/max default.
+
+The chart preserves its supported legacy frontmatter format: a base model
+plus a separate `variant` field. The pinned OpenCode 2.0.22
+[agent loader](https://github.com/anomalyco/opencode/blob/527f0b931d1f9b3ebd34e106c51b31ce5db5b075/packages/core/src/config/plugin/agent.ts)
+converts that preference into a model reference with a variant. This is not a
+native V2 configuration conversion.
+
+A primary preference does not force a session's model or effort. OpenCode
+[V2 agents documentation](https://opencode.ai/v2/docs/agents) distinguishes
+session selection from agent preferences: selecting a primary does not change
+the stored model, while a subagent uses its configured model. The root default
+aligns unspecified session-model selection with Sol; clients can supply a
+model explicitly, and existing sessions keep their selection. The root model
+has no variant override; primary header `medium` is not proof that all primary
+sessions send medium effort. Verify web, TUI, API, and child-session paths
+separately. Configuration is loaded at server startup, not hot-reloaded.
+
+After an approved rollout, verify catalog presence and entitlement, a new
+unqualified session selecting `default`/Sol, unchanged persisted selection
+when switching primaries, explicit client selection taking precedence, and
+representative child agents using their configured models/variants. Use
+synthetic inputs for inference and tool-call checks; inspect only privacy-safe
+selection/effort metadata, never raw session payloads or credentials. Compare
+representative bounded Luna, coordinated Sol, and conflicting-evidence review
+tasks for outcome quality and complete-task usage/latency before claiming an
+improvement. Static CI does not exercise these behavioral cases.
 
 Pricing and account entitlement for `gpt-6.1-sol` have not been verified for
 this change. No token rates, relative savings, or total task-cost claims are
@@ -46,13 +79,14 @@ rollout; roll back only through a separate GitOps chart pin revision.
 ### Kimi provider-id migration
 
 The four Kimi subagents (`kimi`, `kimi-256k`, `docs-writer`, and
-`release-engineer`) and the global fallback model now select the
-`kimi-code-plan-cn` provider id. Upstream renamed `kimi-for-coding` to
+`release-engineer`) retain the `kimi-code-plan-cn` provider id. The historical
+migration also moved the global fallback to Kimi CN; chart 0.5.4 replaces only
+that root model with Sol while retaining the migrated Kimi worker/provider wiring. Upstream renamed `kimi-for-coding` to
 `kimi-code-plan-cn` for the same `api.kimi.com` endpoint and created a
 separate global Kimi provider
 ([models.dev commit](https://github.com/anomalyco/models.dev/commit/ae065079d839cd1e4d824007aa8acef87ff5465f));
 selecting that separate global provider would be its own owner decision
-requiring confirmation of the appropriate account. The chart migration changes only ids: the
+requiring confirmation of the appropriate account. That historical chart migration changed only ids: the
 `files/opencode.json` global fallback model, enabled-provider allowlist entry,
 and provider key, plus the four agent model prefixes. Model suffixes (`k3` and
 `k3-256k`), variants, prompt bytes, the `{env:KIMI_API_KEY}` reference, and the
@@ -66,11 +100,11 @@ After a confirmed rollout, check that the deployed OpenCode model catalog lists
 the `kimi-code-plan-cn` keys, then verify fresh-session inference and tool
 calls.
 
-The `devops-engineer` subagent is a parent-directed, read-only reviewer for supplied DESIGN proposals and completed CHANGE diffs covering CI, workflows, artifacts, GitOps handoffs, runners, and delivery integration. It uses `openai/gpt-6-sol` with the default model configuration and denies all native and MCP tools through a wildcard permission deny; it does not implement, dispatch, publish, merge, or mutate live systems.
+The `devops-engineer` subagent is a parent-directed, read-only reviewer for supplied DESIGN proposals and completed CHANGE diffs covering CI, workflows, artifacts, GitOps handoffs, runners, and delivery integration. It uses `openai/gpt-6.1-sol` with the medium variant and denies all native and MCP tools through a wildcard permission deny; it does not implement, dispatch, publish, merge, or mutate live systems.
 
 ### Cloud architecture design review
 
-The `cloud-architecture-reviewer` subagent ([`files/agents/cloud-architecture-reviewer.md`](files/agents/cloud-architecture-reviewer.md)) is a supplied-evidence, preimplementation design critic for new cloud services or material changes to service selection, topology, state placement, recovery, scaling, or recurring cost. It uses `openai/gpt-6-sol` with the default variant and denies all native and MCP tools through a wildcard permission deny, so it reviews only the parent-supplied design brief and evidence.
+The `cloud-architecture-reviewer` subagent ([`files/agents/cloud-architecture-reviewer.md`](files/agents/cloud-architecture-reviewer.md)) is a supplied-evidence, preimplementation design critic for new cloud services or material changes to service selection, topology, state placement, recovery, scaling, or recurring cost. It uses `openai/gpt-6.1-sol` with the medium variant and denies all native and MCP tools through a wildcard permission deny, so it reviews only the parent-supplied design brief and evidence.
 
 The review is requirements-led and simplicity-biased: it prefers established vendor- or canonical-owner-maintained solutions, challenges unsupported complexity, and no cloud vendor is preferred by default. The five code-capable primary agents (`default`, `makeitwork`, `xnoto`, `career`, `teacher`) route material designs to it with a compact design brief and skip routine changes within an established pattern; the existing pre-pull-request review gates are unchanged, and this design review does not replace them.
 
@@ -285,35 +319,30 @@ pinned independently through `memoryPilot.image` and keeps its v1 `web` args.
 The production v2 pin does not alter the pilot render, and this split does
 not activate, migrate, or repair the disabled pilot experiment.
 
-The historical 0.4.0 baseline comparison permits the QA reviewer's existing
-end-of-file correction and exactly seventeen approved model-header changes: the
-nine primary agents' exact `openai/gpt-5.6-terra` to `openai/gpt-6.1-sol`
-model change with removal of
-`variant: default`, the six Terra-tier subagents' exact Terra-to-Sol model-line
-change with each variant preserved, and the two Luna-tier subagents' exact
-Luna-to-GPT-6 model-line change; it also permits the ten-primary runtime protocol and scope migration; the
-historical render fixture adopts those explicitly enumerated prompts, while a
-pinned-base regression check preserves every post-operating-rules byte, and
-the homesteader confidentiality/workflow substitutions, plus the four Kimi subagents' exact model-prefix line updates
-from `kimi-for-coding` to `kimi-code-plan-cn` and the three exact
-`opencode.json` config-line substitutions. In addition, the comparison permits
-exactly one approved new agent file, `files/agents/mechanic.md`, absent from
-the historical baseline: the test asserts its absence in the extracted
-baseline and copies the current chart source in after the historical
-transforms. The historical counts above are unchanged; the mechanic agent did
-not exist in the historical baseline. In addition, the comparison permits
-exactly four approved production runtime changes applied to the extracted
-baseline before rendering: the production `values.yaml` image tag asserted
-exactly once and replaced from
-`1.18.29@sha256:ecc3bf96ee55dad226d9cde50d79aaa8a1215c47860c0fcdc71570461bf438b8`
-to `2.0.22@sha256:11f2b6c96d380867387fbee390c06cb47efffd9fdc37009b4cd40795b45dad19`,
-the production Deployment container args change from `web` to `serve`, the
-added single-replica `Recreate` strategy, and the explicit
-`OPENCODE_DB=opencode.db` environment entry; the pilot image is pinned
-separately and is not part of the production baseline render. Non-primary agent bytes remain identical to the historical fixture; primary source-to-ConfigMap byte parity and chart-archive parity remain exact, while a pinned-base check protects every primary operating-rules tail. These changes affect the
-production ConfigMap checksum, so a normal production pod rollout on the
-chart version pin can occur even when the pilot is disabled. See
-[Memory pilot](docs/memory-pilot.md) for the baseline comparison contract.
+The historical 0.4.0 baseline commit `32a6b91` remains fixed. Its original
+seventeen model-header migrations and the Kimi provider-id migration are
+retained as historical transforms. An additional exact reasoning-policy
+transform applies medium to the nine historical primaries; upgrades the six
+historical Sol subagents to GPT-6.1 Sol with the variants listed above; adds
+low/medium to Luna/QA; replaces only the cloud reviewer's stale Terra sentence;
+and changes the post-migration root Kimi CN model to Sol. Each old block must
+occur exactly once. The mechanic is still the sole approved new agent absent
+from that baseline and is copied from the current source.
+
+The existing ten-primary runtime-policy transform remains explicit; a separate
+pinned-base check protects every primary operating-rules tail. Non-primary
+bytes remain equal to the transformed historical fixture, with exactly the
+existing QA final-newline correction. Source-to-ConfigMap and archive byte
+parity remain enforced, and independent tests assert all eighteen OpenAI
+model/variant pairs and reject duplicate header keys. No blanket subagent copy
+or baseline rebase is permitted.
+
+The four production-runtime transforms remain the image tag `1.18.29` to the
+pinned `2.0.22`, `web` to `serve` args, single-replica `Recreate`, and
+`OPENCODE_DB=opencode.db`; the independently pinned v1 pilot is unchanged.
+These production configuration changes alter the checksum and can replace the
+production pod after GitOps selection even with the pilot disabled. See
+[Memory pilot](docs/memory-pilot.md) for the comparison contract.
 
 The historical render fixture also applies one exact production ConfigMap metadata transform to the extracted baseline: it adds only `argocd.argoproj.io/sync-options: ServerSideApply=true` after the ConfigMap name. The ConfigMap data and full rendered-resource parity remain asserted; the resulting Deployment checksum change is therefore derived from that allowlisted metadata change, not excluded from comparison.
 
@@ -330,6 +359,18 @@ is deferred.
 4. Treat that pull request as a separate desired-state change gated by `kustomize-cluster` required checks. Its creation does not deploy or sync Argo CD.
 5. After the GitOps pin merge, verify the `gitops-workloads` root, `opencode` child Application, Deployment rollout, pods, events, and representative OpenCode behavior.
 
+### 0.5.4 consumer coordination gate
+
+At [kustomize-cluster revision 5d51403](https://github.com/makeitworkcloud/kustomize-cluster/blob/5d51403d9ec697f0ea020007ad5872cd222fbb95/.github/workflows/test.yml#L916),
+the consumer CI assertion couples chart `0.5.3` to exporter API selector
+`2`. The existing publisher changes only the Application pin, so the
+resulting `0.5.4` pin PR cannot pass that assertion until a separate consumer
+change updates its expected chart version to `0.5.4`, keeping selector `2`.
+Do not bypass the required checks. This chart does not edit consumer desired
+state, its tests, or the updater workflow; publication can complete while
+selection remains blocked. Reverify this gate against the consumer's current
+revision before coordinating its update.
+
 ### Historical 0.1.75 aggregate cutover
 
 Version 0.1.75 paired with the former `kustomize-cluster` gateway-member rename and is retained only as historical rollout context. The current direct-proxy design supersedes that aggregate route: OpenCode must use the direct client URLs in `files/opencode.json`, and `vmcp-gateway` must remain external-only.
diff --git a/opencode-server/docs/agent-instruction-architecture.md b/opencode-server/docs/agent-instruction-architecture.md
index 8ef2b90..60729d5 100644
--- a/opencode-server/docs/agent-instruction-architecture.md
+++ b/opencode-server/docs/agent-instruction-architecture.md
@@ -179,6 +179,55 @@ provenance and coverage evidence passes all checks. This is the exact recipe:
    current authorization, the verified snapshot, and full-index evidence to
    delegated workers; that evidence does not extend worker authority.
 
+### Model and reasoning policy
+
+The global model is `openai/gpt-6.1-sol`, and `default_agent` remains
+`default`. The configured OpenAI agent preferences are:
+
+| Agents | Model | Variant |
+| --- | --- | --- |
+| All ten primaries | `openai/gpt-6.1-sol` | `medium` |
+| `terra`, `cloud-architecture-reviewer`, `devops-engineer` | `openai/gpt-6.1-sol` | `medium` |
+| `adversarial-code-reviewer`, `infra-security-reviewer` | `openai/gpt-6.1-sol` | `xhigh` |
+| `recruiter-resume-reviewer` | `openai/gpt-6.1-sol` | `high` |
+| `luna` | `openai/gpt-6-luna` | `low` |
+| `qa-engineer` | `openai/gpt-6-luna` | `medium` |
+
+The Kimi, GLM, and MiniMax workers, 25-agent inventory, permissions, MCPs,
+provider wiring, image, and opt-in pilot are unchanged. No new agent is added.
+The reasoning policy follows [OpenAI model-selection guidance](https://developers.openai.com/api/docs/guides/model-selection):
+Luna low for focused work, Sol medium for coordinated revisable work, and Sol
+xhigh for decisions involving conflicting evidence. Recruiter high and QA
+medium are role-specific starting points, not benchmarked quality guarantees.
+Astra remains an exceptional, explicit owner-selected review option; no agent
+or automatic escalation is introduced. Avoid a universal high/max default.
+
+The chart preserves its supported legacy frontmatter format: a base model
+plus a separate `variant` field. The pinned OpenCode 2.0.22
+[agent loader](https://github.com/anomalyco/opencode/blob/527f0b931d1f9b3ebd34e106c51b31ce5db5b075/packages/core/src/config/plugin/agent.ts)
+converts that preference into a model reference with a variant. This is not a
+native V2 configuration conversion.
+
+A primary preference does not force a session's model or effort. OpenCode
+[V2 agents documentation](https://opencode.ai/v2/docs/agents) distinguishes
+session selection from agent preferences: selecting a primary does not change
+the stored model, while a subagent uses its configured model. The root default
+aligns unspecified session-model selection with Sol; clients can supply a
+model explicitly, and existing sessions keep their selection. The root model
+has no variant override; primary header `medium` is not proof that all primary
+sessions send medium effort. Verify web, TUI, API, and child-session paths
+separately. Configuration is loaded at server startup, not hot-reloaded.
+
+After an approved rollout, verify catalog presence and entitlement, a new
+unqualified session selecting `default`/Sol, unchanged persisted selection
+when switching primaries, explicit client selection taking precedence, and
+representative child agents using their configured models/variants. Use
+synthetic inputs for inference and tool-call checks; inspect only privacy-safe
+selection/effort metadata, never raw session payloads or credentials. Compare
+representative bounded Luna, coordinated Sol, and conflicting-evidence review
+tasks for outcome quality and complete-task usage/latency before claiming an
+improvement. Static CI does not exercise these behavioral cases.
+
 ### Subagents
 
 Subagents receive the short universal floor plus their dedicated agent
@@ -193,8 +242,8 @@ authorization, and final synthesis; it verifies material findings. Independent
 scopes may run in parallel.
 
 [`files/agents/terra.md`](../files/agents/terra.md) defines `terra`, a
-full-capable, generic execution subagent using `openai/gpt-6-sol` with
-the default variant. A primary may select it for bounded coding, debugging, or
+full-capable, generic execution subagent using `openai/gpt-6.1-sol` with
+the medium variant. A primary may select it for bounded coding, debugging, or
 repository tasks when it needs execution capacity. It does not change the
 `default` primary-agent selection or delegate primary ownership; the assigning
 primary must supply authority, scope, safety constraints, and completion
@@ -202,7 +251,7 @@ criteria in the task prompt.
 
 [`files/agents/devops-engineer.md`](../files/agents/devops-engineer.md) defines
 a parent-directed, read-only DevOps integration and delivery reviewer using
-`openai/gpt-6-sol` with no variant override. It reviews supplied DESIGN
+`openai/gpt-6.1-sol` with the medium variant. It reviews supplied DESIGN
 proposals and completed CHANGE diffs for CI, workflow, reusable-workflow,
 artifact, GitOps-handoff, runner, and delivery-integration contracts. All
 native and MCP tools are denied through a wildcard permission rule; the parent
@@ -212,7 +261,7 @@ retains implementation, mutation, and final authority.
 defines a supplied-evidence, read-only cloud architecture design reviewer that
 the code-capable primaries dispatch before implementing a new cloud service or
 a material change to service selection, topology, state placement, recovery,
-scaling, or recurring cost. It runs on `openai/gpt-6-sol` with the default
+scaling, or recurring cost. It runs on `openai/gpt-6.1-sol` with the medium
 variant, all native and MCP tools denied, and a bounded 500-800-word review
 budget; it does not switch models, dispatch specialists, or retrieve evidence
 itself. It may recommend a specialist for a named material risk; the primary
@@ -269,7 +318,7 @@ does all other unspecialized work.
 
 The existing `make test-opencode-server-agents` target statically covers the
 `cloud-architecture-reviewer` packaging: exact frontmatter (description,
-Sol model, default variant, subagent mode, wildcard and `edit`/`bash` tool
+Sol model, medium variant, subagent mode, wildcard and `edit`/`bash` tool
 denies), the mandatory headings and policy markers, the routing markers in
 the five code-capable primaries, the 25-agent inventory with ConfigMap and
 mount keys, and byte-exact archive inclusion. Functional review quality is
diff --git a/opencode-server/docs/memory-pilot.md b/opencode-server/docs/memory-pilot.md
index 3532137..103414e 100644
--- a/opencode-server/docs/memory-pilot.md
+++ b/opencode-server/docs/memory-pilot.md
@@ -124,63 +124,38 @@ data.
 
 ## Baseline and checksum parity
 
-The pilot tests retain the historical 0.4.0 baseline commit `32a6b91` and
-allow only enumerated agent changes: the QA reviewer's existing end-of-file
-correction plus exactly seventeen approved model-header changes, eight
-explicit knowledge-first sections placed before their named agents' operating
-rules, one owner-context routing section for `default`, the homesteader's
-explicit confidentiality and workflow replacements, and the approved Kimi
-provider-id migration of four further frontmatter model-prefix updates and
-three exact `files/opencode.json` config-line substitutions. In addition, the
-comparison permits exactly one approved new agent file,
-`files/agents/mechanic.md`, which does not exist in the historical 0.4.0
-baseline: the test asserts its absence in the extracted baseline and copies
-the current chart source in after the historical transforms. The comparison
-also permits exactly four approved production runtime changes applied to the
-extracted baseline before rendering: the production `values.yaml` image tag
-asserted exactly once and replaced from
-`1.18.29@sha256:ecc3bf96ee55dad226d9cde50d79aaa8a1215c47860c0fcdc71570461bf438b8`
-to `2.0.22@sha256:11f2b6c96d380867387fbee390c06cb47efffd9fdc37009b4cd40795b45dad19`,
-the production Deployment container args change from `web` to `serve`, the
-added single-replica `Recreate` strategy, and the explicit
-`OPENCODE_DB=opencode.db` environment entry. The pilot remains on the
-historical v1 image through the separate `memoryPilot.image` values and keeps
-its v1 `web` args; the production v2 runtime changes do not alter the pilot
-render. The historical constants — the seventeen approved model-header
-changes, the eight knowledge-first sections, the `default` owner-context
-section, the homesteader substitutions, and the Kimi migration — are
-unchanged. The baseline
-`files/agents/qa-engineer.md` lacks a final newline; the render comparison
-appends exactly one. The nine primary files (`career.md`, `default.md`,
-`grillmaster.md`, `homerepair.md`, `homesteader.md`, `lawnmowerman.md`,
-`makeitwork.md`, `teacher.md`, and `xnoto.md`) receive the exact frontmatter
-replacement from `openai/gpt-5.6-terra` plus `variant: default` to
-`openai/gpt-6.1-sol` with no variant override. The eight named primaries
-(all except `default.md`) receive explicit literal policy paragraphs with
-one asserted early anchor; `default` receives its own explicit read-only
-routing paragraph. The homesteader substitutions are independently asserted
-to occur once. The six Terra-tier files (`adversarial-code-reviewer.md`,
-`cloud-architecture-reviewer.md`, `devops-engineer.md`,
-`infra-security-reviewer.md`, `recruiter-resume-reviewer.md`, and `terra.md`)
-receive the exact model-line replacement from `openai/gpt-5.6-terra` to
-`openai/gpt-6-sol` with each existing variant preserved. The two Luna-tier
-files (`luna.md` and `qa-engineer.md`) receive the exact model-line
-replacement from `openai/gpt-5.6-luna` to `openai/gpt-6-luna`. The four Kimi
-subagents (`kimi.md` to `kimi-code-plan-cn/k3`; `kimi-256k.md`,
-`docs-writer.md`, and `release-engineer.md` to `kimi-code-plan-cn/k3-256k`,
-each existing variant preserved) receive the exact model-prefix line
-replacement from `kimi-for-coding` to `kimi-code-plan-cn`, and the baseline
-`files/opencode.json` receives exactly three config-line substitutions: the
-global fallback model, the enabled-provider allowlist entry, and the provider
-key. The test asserts each old block exists exactly once before replacing it;
-all other agent bytes and production render comparisons remain enforced.
-Static checks cannot prove actual knowledge retrieval or application; use the
-fresh-session acceptance matrix in [Agent instruction architecture](agent-instruction-architecture.md)
-after separately approved rollout. These changes affect the production
-ConfigMap checksum relative to the published 0.4.0 chart, so a normal
-production pod rollout on the chart version pin can occur even when the pilot
-is disabled. No claim is made that the current production manifest or checksum
-exactly matches the original baseline.
+The historical 0.4.0 baseline commit `32a6b91` remains fixed. Its original
+seventeen model-header migrations and the Kimi provider-id migration are
+retained as historical transforms. An additional exact reasoning-policy
+transform applies medium to the nine historical primaries; upgrades the six
+historical Sol subagents to GPT-6.1 Sol with the variants in the [chart model policy](../README.md#packaged-configuration); adds
+low/medium to Luna/QA; replaces only the cloud reviewer's stale Terra sentence;
+and changes the post-migration root Kimi CN model to Sol. Each old block must
+occur exactly once. The mechanic is still the sole approved new agent absent
+from that baseline and is copied from the current source.
+
+The existing ten-primary runtime-policy transform remains explicit; a separate
+pinned-base check protects every primary operating-rules tail. Non-primary
+bytes remain equal to the transformed historical fixture, with exactly the
+existing QA final-newline correction. Source-to-ConfigMap and archive byte
+parity remain enforced, and independent tests assert all eighteen OpenAI
+model/variant pairs and reject duplicate header keys. No blanket subagent copy
+or baseline rebase is permitted.
+
+The four production-runtime transforms remain the image tag `1.18.29` to the
+pinned `2.0.22`, `web` to `serve` args, single-replica `Recreate`, and
+`OPENCODE_DB=opencode.db`; the independently pinned v1 pilot is unchanged.
+These production configuration changes alter the checksum and can replace the
+production pod after GitOps selection even with the pilot disabled. See
+[the chart README](../README.md) for the comparison contract.
+
+The historical production ConfigMap transform still adds exactly
+`argocd.argoproj.io/sync-options: ServerSideApply=true`. Rendered resource
+and data parity remain enforced; no checksum exclusions are introduced.
+Static checks cannot prove inference, effective effort, or knowledge retrieval;
+use the fresh-session acceptance matrix in
+[Agent instruction architecture](agent-instruction-architecture.md) after a
+separately approved rollout.
 
 ## Security posture
 
diff --git a/opencode-server/files/agents/adversarial-code-reviewer.md b/opencode-server/files/agents/adversarial-code-reviewer.md
index 95c0318..067725e 100644
--- a/opencode-server/files/agents/adversarial-code-reviewer.md
+++ b/opencode-server/files/agents/adversarial-code-reviewer.md
@@ -1,8 +1,8 @@
 ---
 description: Independent hostile review of a completed implementation immediately before its pull request is opened; use for any non-trivial code, chart, workflow, or documentation change and for owner-requested second opinions; not for research, planning, trivial rewording, or implementation
 mode: subagent
-model: openai/gpt-6-sol
-variant: high
+model: openai/gpt-6.1-sol
+variant: xhigh
 permission:
   edit: deny
   bash: deny
diff --git a/opencode-server/files/agents/career.md b/opencode-server/files/agents/career.md
index de75c27..a15643e 100644
--- a/opencode-server/files/agents/career.md
+++ b/opencode-server/files/agents/career.md
@@ -2,6 +2,7 @@
 description: Career agent for resume tailoring, job-search evaluation, interview preparation, and application pipeline support, using the career knowledge subset in makeitworkcloud/agent-knowledge
 mode: primary
 model: openai/gpt-6.1-sol
+variant: medium
 ---
 
 # Career Agent
diff --git a/opencode-server/files/agents/cloud-architecture-reviewer.md b/opencode-server/files/agents/cloud-architecture-reviewer.md
index 2b72d99..784137c 100644
--- a/opencode-server/files/agents/cloud-architecture-reviewer.md
+++ b/opencode-server/files/agents/cloud-architecture-reviewer.md
@@ -1,8 +1,8 @@
 ---
 description: Read-only preimplementation cloud architecture review for new services or material service-selection, topology, state, recovery, scaling, or cost changes; challenges supplied designs for requirements fit and unnecessary complexity, not routine changes or completed-code review
 mode: subagent
-model: openai/gpt-6-sol
-variant: default
+model: openai/gpt-6.1-sol
+variant: medium
 permission:
   "*": deny
   edit: deny
@@ -56,7 +56,7 @@ validation evidence before implementation can begin.
 - Do not replace security threat modeling, DevOps integration review, QA test
   design, or completed-implementation review. Recommend a specialist only for
   a named material risk outside this review's scope; the parent dispatches it.
-- This agent uses Terra with the default variant. Do not switch models,
+- This agent uses GPT-6.1 Sol with the medium variant. Do not switch models,
   reasoning effort, or providers, or claim automatic escalation/failover. If a
   consequential tradeoff cannot be resolved from the supplied evidence, return
   it to the parent for a targeted decision or separately authorized review.
diff --git a/opencode-server/files/agents/default.md b/opencode-server/files/agents/default.md
index 6df0a79..f0f78ca 100644
--- a/opencode-server/files/agents/default.md
+++ b/opencode-server/files/agents/default.md
@@ -2,6 +2,7 @@
 description: Default full-capable primary agent for bounded research, repository work, planning, and owner-authorized changes
 mode: primary
 model: openai/gpt-6.1-sol
+variant: medium
 ---
 
 # Default Primary Agent
diff --git a/opencode-server/files/agents/devops-engineer.md b/opencode-server/files/agents/devops-engineer.md
index 5e653e0..aed4add 100644
--- a/opencode-server/files/agents/devops-engineer.md
+++ b/opencode-server/files/agents/devops-engineer.md
@@ -1,7 +1,8 @@
 ---
 description: Read-only DevOps integration and delivery reviewer for proposed designs or completed changes involving CI, GitHub Actions, shared workflows, artifacts, GitOps handoffs, runners, permissions, and deployment contracts; requires a supplied integration map and never implements or mutates systems
 mode: subagent
-model: openai/gpt-6-sol
+model: openai/gpt-6.1-sol
+variant: medium
 permission:
   "*": deny
   edit: deny
diff --git a/opencode-server/files/agents/grillmaster.md b/opencode-server/files/agents/grillmaster.md
index fb46d3e..0dbb28f 100644
--- a/opencode-server/files/agents/grillmaster.md
+++ b/opencode-server/files/agents/grillmaster.md
@@ -2,6 +2,7 @@
 description: Grillmaster agent for creative, evidence-led charcoal cooking on the owner's confirmed kettle setup, using the grillmaster knowledge subset in makeitworkcloud/agent-knowledge
 mode: primary
 model: openai/gpt-6.1-sol
+variant: medium
 ---
 
 # Grillmaster Agent
diff --git a/opencode-server/files/agents/homerepair.md b/opencode-server/files/agents/homerepair.md
index e2fe26c..47f41b1 100644
--- a/opencode-server/files/agents/homerepair.md
+++ b/opencode-server/files/agents/homerepair.md
@@ -2,6 +2,7 @@
 description: Image-assisted household repair triage and safe DIY planning for painting, drywall, tile, grout, fixtures, doors, cabinets, and routine maintenance
 mode: primary
 model: openai/gpt-6.1-sol
+variant: medium
 ---
 
 # Home Repair Agent
diff --git a/opencode-server/files/agents/homesteader.md b/opencode-server/files/agents/homesteader.md
index c8a18ea..29c36ae 100644
--- a/opencode-server/files/agents/homesteader.md
+++ b/opencode-server/files/agents/homesteader.md
@@ -2,6 +2,7 @@
 description: Confidential homestead knowledge and project steward using GitHub MCP with private-repository safeguards
 mode: primary
 model: openai/gpt-6.1-sol
+variant: medium
 ---
 
 # Homesteader Agent
diff --git a/opencode-server/files/agents/infra-security-reviewer.md b/opencode-server/files/agents/infra-security-reviewer.md
index 63e1905..9bc3087 100644
--- a/opencode-server/files/agents/infra-security-reviewer.md
+++ b/opencode-server/files/agents/infra-security-reviewer.md
@@ -1,8 +1,8 @@
 ---
 description: Adversarial security review of infrastructure-affecting changes — OpenTofu, Kubernetes, Helm, GitHub Actions workflows, SOPS/KSOPS, network exposure, IAM/RBAC, and supply-chain pins — before merge of security-relevant changes; refuses secret retrieval or printing; not for runtime exploitation, account access, or implementation
 mode: subagent
-model: openai/gpt-6-sol
-variant: high
+model: openai/gpt-6.1-sol
+variant: xhigh
 permission:
   edit: deny
   bash: deny
diff --git a/opencode-server/files/agents/lawnmowerman.md b/opencode-server/files/agents/lawnmowerman.md
index 2c59eee..f0dcc69 100644
--- a/opencode-server/files/agents/lawnmowerman.md
+++ b/opencode-server/files/agents/lawnmowerman.md
@@ -2,6 +2,7 @@
 description: Lawnmowerman agent for real-time, image-assisted small engine repair — troubleshooting lawnmowers and other small outdoor power equipment, using the lawnmowerman knowledge subset in makeitworkcloud/agent-knowledge
 mode: primary
 model: openai/gpt-6.1-sol
+variant: medium
 ---
 
 # Lawnmowerman Agent
diff --git a/opencode-server/files/agents/luna.md b/opencode-server/files/agents/luna.md
index 8f2ec32..1f7572b 100644
--- a/opencode-server/files/agents/luna.md
+++ b/opencode-server/files/agents/luna.md
@@ -2,4 +2,5 @@
 description: Use for bounded reasoning-sensitive comparisons, test design, small bug analysis, or well-specified coding tasks where speed and token efficiency matter; not for high-level planning or final decisions
 mode: subagent
 model: openai/gpt-6-luna
+variant: low
 ---
diff --git a/opencode-server/files/agents/makeitwork.md b/opencode-server/files/agents/makeitwork.md
index e1caf41..9d381f2 100644
--- a/opencode-server/files/agents/makeitwork.md
+++ b/opencode-server/files/agents/makeitwork.md
@@ -2,6 +2,7 @@
 description: Make IT Work Cloud agent for organization repositories, GitOps, CI validation, and protected infrastructure changes
 mode: primary
 model: openai/gpt-6.1-sol
+variant: medium
 ---
 
 # Make IT Work Cloud Agent
diff --git a/opencode-server/files/agents/mechanic.md b/opencode-server/files/agents/mechanic.md
index 11c26aa..3dfdf38 100644
--- a/opencode-server/files/agents/mechanic.md
+++ b/opencode-server/files/agents/mechanic.md
@@ -2,6 +2,7 @@
 description: Mechanic agent for real-time, photo-assisted car and truck maintenance and diagnostics — vehicle identification by owner-confirmed VIN, manufacturer-sourced specifications and procedures, using the mechanic knowledge subset in makeitworkcloud/agent-knowledge
 mode: primary
 model: openai/gpt-6.1-sol
+variant: medium
 ---
 
 # Mechanic Agent
diff --git a/opencode-server/files/agents/qa-engineer.md b/opencode-server/files/agents/qa-engineer.md
index 1dec958..498b7f3 100644
--- a/opencode-server/files/agents/qa-engineer.md
+++ b/opencode-server/files/agents/qa-engineer.md
@@ -2,6 +2,7 @@
 description: Test design, CI-coverage analysis, and test/documentation adequacy assessment for a proposed or completed change, plus test-quality triage of failing checks; read-only analyst that never claims local test execution; not for implementation or final delivery claims
 mode: subagent
 model: openai/gpt-6-luna
+variant: medium
 permission:
   edit: deny
   bash: deny
diff --git a/opencode-server/files/agents/recruiter-resume-reviewer.md b/opencode-server/files/agents/recruiter-resume-reviewer.md
index 5473b16..6ebaa24 100644
--- a/opencode-server/files/agents/recruiter-resume-reviewer.md
+++ b/opencode-server/files/agents/recruiter-resume-reviewer.md
@@ -1,7 +1,7 @@
 ---
 description: Independent high-reasoning recruiter-perspective review for a tailored resume immediately before export; read-only and never an authoring or delivery agent
 mode: subagent
-model: openai/gpt-6-sol
+model: openai/gpt-6.1-sol
 variant: high
 permission:
   edit: deny
diff --git a/opencode-server/files/agents/teacher.md b/opencode-server/files/agents/teacher.md
index 247c3d2..86d4724 100644
--- a/opencode-server/files/agents/teacher.md
+++ b/opencode-server/files/agents/teacher.md
@@ -2,6 +2,7 @@
 description: Owner-specific agent that retrieves task guidance from a private knowledge subset
 mode: primary
 model: openai/gpt-6.1-sol
+variant: medium
 ---
 
 # Teacher Agent
diff --git a/opencode-server/files/agents/terra.md b/opencode-server/files/agents/terra.md
index 7f90d20..75b1efa 100644
--- a/opencode-server/files/agents/terra.md
+++ b/opencode-server/files/agents/terra.md
@@ -1,6 +1,6 @@
 ---
 description: Use for bounded generic coding, debugging, or repository tasks when the assigning primary agent's execution budget is nearing completion or it otherwise needs execution capacity; the primary retains task interpretation, safety, delivery decisions, and final synthesis
 mode: subagent
-model: openai/gpt-6-sol
-variant: default
+model: openai/gpt-6.1-sol
+variant: medium
 ---
diff --git a/opencode-server/files/agents/xnoto.md b/opencode-server/files/agents/xnoto.md
index 5be3259..9be5ab3 100644
--- a/opencode-server/files/agents/xnoto.md
+++ b/opencode-server/files/agents/xnoto.md
@@ -2,6 +2,7 @@
 description: xnoto agent for personal repositories, client configuration, releases, and workstation-bounded changes
 mode: primary
 model: openai/gpt-6.1-sol
+variant: medium
 ---
 
 # xnoto Agent
diff --git a/opencode-server/files/opencode.json b/opencode-server/files/opencode.json
index 4e40aa2..d601d69 100644
--- a/opencode-server/files/opencode.json
+++ b/opencode-server/files/opencode.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://opencode.ai/config.json",
-  "model": "kimi-code-plan-cn/k3",
+  "model": "openai/gpt-6.1-sol",
   "default_agent": "default",
   "agent": {
     "build": {"disable": true},
diff --git a/opencode-server/tests/test_memory_pilot_render.py b/opencode-server/tests/test_memory_pilot_render.py
index 84ea595..cf05bca 100644
--- a/opencode-server/tests/test_memory_pilot_render.py
+++ b/opencode-server/tests/test_memory_pilot_render.py
@@ -135,6 +135,43 @@ def _apply_approved_model_changes(self, baseline_chart):
         for name in APPROVED_LUNA_MODEL_FILES:
             self._replace_frontmatter_line(agents_dir, name, b"model: openai/gpt-5.6-luna\n", b"model: openai/gpt-6-luna\n")
 
+    def _apply_approved_reasoning_policy(self, baseline_chart):
+        agents_dir = os.path.join(baseline_chart, "files", "agents")
+        for name in APPROVED_PRIMARY_MODEL_FILES:
+            self._replace_frontmatter_line(agents_dir, name, b"model: openai/gpt-6.1-sol\n", b"model: openai/gpt-6.1-sol\nvariant: medium\n")
+        changes = {
+            "adversarial-code-reviewer.md": (b"high", b"xhigh"),
+            "infra-security-reviewer.md": (b"high", b"xhigh"),
+            "recruiter-resume-reviewer.md": (b"high", b"high"),
+            "cloud-architecture-reviewer.md": (b"default", b"medium"),
+            "terra.md": (b"default", b"medium"),
+            "devops-engineer.md": (None, b"medium"),
+        }
+        for name, (old_variant, new_variant) in changes.items():
+            old = b"model: openai/gpt-6-sol\n"
+            if old_variant is not None:
+                old += b"variant: " + old_variant + b"\n"
+            new = b"model: openai/gpt-6.1-sol\nvariant: " + new_variant + b"\n"
+            self._replace_frontmatter_line(agents_dir, name, old, new)
+        for name, variant in (("luna.md", b"low"), ("qa-engineer.md", b"medium")):
+            self._replace_frontmatter_line(agents_dir, name, b"model: openai/gpt-6-luna\n", b"model: openai/gpt-6-luna\nvariant: " + variant + b"\n")
+        path = os.path.join(agents_dir, "cloud-architecture-reviewer.md")
+        with open(path, "rb") as handle:
+            content = handle.read()
+        old = b"This agent uses Terra with the default variant."
+        self.assertEqual(content.count(old), 1)
+        content = content.replace(old, b"This agent uses GPT-6.1 Sol with the medium variant.")
+        with open(path, "wb") as handle:
+            handle.write(content)
+        path = os.path.join(baseline_chart, "files", "opencode.json")
+        with open(path, "rb") as handle:
+            content = handle.read()
+        old = b'"model": "kimi-code-plan-cn/k3",'
+        self.assertEqual(content.count(old), 1)
+        content = content.replace(old, b'"model": "openai/gpt-6.1-sol",')
+        with open(path, "wb") as handle:
+            handle.write(content)
+
     def _apply_approved_homesteader_changes(self, baseline_chart):
         path = os.path.join(baseline_chart, "files", "agents", "homesteader.md")
         with open(path, "rb") as handle:
@@ -236,6 +273,7 @@ def _extract_baseline(self, tmp):
         self._apply_approved_model_changes(baseline_chart)
         self._apply_approved_homesteader_changes(baseline_chart)
         self._apply_approved_provider_migration(baseline_chart)
+        self._apply_approved_reasoning_policy(baseline_chart)
         self._apply_approved_new_agent_files(baseline_chart)
         self._apply_primary_runtime_policy(baseline_chart)
         self._apply_approved_production_runtime_changes(baseline_chart)
@@ -319,7 +357,7 @@ def test_approved_new_agent_file_set_is_exactly_mechanic(self):
 
 
 class PrimaryModelContract(unittest.TestCase):
-    def test_exactly_ten_primary_headers_use_gpt_6_1_sol_without_variant(self):
+    def test_exactly_ten_primary_headers_use_gpt_6_1_sol_medium(self):
         expected = {"default.md", "makeitwork.md", "xnoto.md", "career.md", "teacher.md", "grillmaster.md", "homerepair.md", "homesteader.md", "lawnmowerman.md", "mechanic.md"}
         actual = set()
         for path in sorted(glob.glob(os.path.join(CHART_DIR, "files", "agents", "*.md"))):
@@ -336,12 +374,85 @@ def test_exactly_ten_primary_headers_use_gpt_6_1_sol_without_variant(self):
                 with self.subTest(agent=name):
                     self.assertEqual(header.get("mode"), "primary")
                     self.assertEqual(header.get("model"), "openai/gpt-6.1-sol")
-                    self.assertNotIn("variant", header)
+                    self.assertEqual(header.get("variant"), "medium")
                     keys = [key.value for key, value in yaml.compose(parts[1]).value]
                     self.assertEqual(len(keys), len(set(keys)), "duplicate frontmatter key")
         self.assertEqual(actual, expected)
 
 
+class OpenAIModelVariantContract(unittest.TestCase):
+    EXPECTED = {
+        "default.md": ("openai/gpt-6.1-sol", "medium"),
+        "makeitwork.md": ("openai/gpt-6.1-sol", "medium"),
+        "xnoto.md": ("openai/gpt-6.1-sol", "medium"),
+        "career.md": ("openai/gpt-6.1-sol", "medium"),
+        "teacher.md": ("openai/gpt-6.1-sol", "medium"),
+        "grillmaster.md": ("openai/gpt-6.1-sol", "medium"),
+        "homerepair.md": ("openai/gpt-6.1-sol", "medium"),
+        "homesteader.md": ("openai/gpt-6.1-sol", "medium"),
+        "lawnmowerman.md": ("openai/gpt-6.1-sol", "medium"),
+        "mechanic.md": ("openai/gpt-6.1-sol", "medium"),
+        "terra.md": ("openai/gpt-6.1-sol", "medium"),
+        "cloud-architecture-reviewer.md": ("openai/gpt-6.1-sol", "medium"),
+        "devops-engineer.md": ("openai/gpt-6.1-sol", "medium"),
+        "adversarial-code-reviewer.md": ("openai/gpt-6.1-sol", "xhigh"),
+        "infra-security-reviewer.md": ("openai/gpt-6.1-sol", "xhigh"),
+        "recruiter-resume-reviewer.md": ("openai/gpt-6.1-sol", "high"),
+        "luna.md": ("openai/gpt-6-luna", "low"),
+        "qa-engineer.md": ("openai/gpt-6-luna", "medium"),
+    }
+
+    def assert_header(self, text, expected):
+        parts = text.split("---\n", 2)
+        self.assertEqual(len(parts), 3)
+        self.assertEqual(parts[0], "")
+        keys = [key.value for key, value in yaml.compose(parts[1]).value]
+        self.assertEqual(len(keys), len(set(keys)), "duplicate frontmatter key")
+        header = yaml.safe_load(parts[1])
+        self.assertEqual((header.get("model"), header.get("variant")), expected)
+        return header
+
+    def test_source_and_rendered_openai_headers_match_exact_matrix(self):
+        data = by_kind(render_docs([]), "ConfigMap")["data"]
+        actual = set()
+        for path in sorted(glob.glob(os.path.join(CHART_DIR, "files", "agents", "*.md"))):
+            name = os.path.basename(path)
+            with open(path, "r", encoding="utf-8") as handle:
+                text = handle.read()
+            header = yaml.safe_load(text.split("---\n", 2)[1])
+            if str(header.get("model", "")).startswith("openai/"):
+                actual.add(name)
+            if name in self.EXPECTED:
+                with self.subTest(agent=name):
+                    self.assert_header(text, self.EXPECTED[name])
+                    self.assert_header(data[name] + "\n", self.EXPECTED[name])
+        self.assertEqual(actual, set(self.EXPECTED))
+        self.assertEqual(len(actual), 18)
+
+    def test_header_contract_rejects_missing_wrong_and_duplicate_selections(self):
+        expected = ("openai/gpt-6.1-sol", "medium")
+        valid = "---\nmodel: openai/gpt-6.1-sol\nvariant: medium\n---\n"
+        self.assert_header(valid, expected)
+        invalid = (
+            valid.replace("variant: medium\n", ""),
+            valid.replace("gpt-6.1-sol", "gpt-6-sol"),
+            valid.replace("variant: medium", "variant: max"),
+            valid.replace("variant: medium", "variant: unsupported"),
+            valid.replace("variant: medium", "variant: medium\nvariant: medium"),
+            valid.replace("model: openai/gpt-6.1-sol", "model: openai/gpt-6.1-sol\nmodel: openai/gpt-6.1-sol"),
+        )
+        for text in invalid:
+            with self.subTest(frontmatter=text):
+                with self.assertRaises(AssertionError):
+                    self.assert_header(text, expected)
+
+    def test_cloud_body_matches_medium_sol_header(self):
+        text = chart_file("files", "agents", "cloud-architecture-reviewer.md")
+        self.assertEqual(text.count("This agent uses GPT-6.1 Sol with the medium variant."), 1)
+        self.assertNotIn("This agent uses Terra", text)
+        self.assertIn("Do not switch models", text)
+
+
 class PersistentKnowledgePolicyContract(unittest.TestCase):
     def test_all_primary_agents_have_early_identical_runtime_protocol_and_scope(self):
         agents_dir = os.path.join(CHART_DIR, "files", "agents")
@@ -474,14 +585,14 @@ def setUpClass(cls):
             cls.content = handle.read()
         cls.policy = " ".join(cls.content.split()).lower()
 
-    def test_frontmatter_is_gpt_6_1_sol_primary_without_variant(self):
+    def test_frontmatter_is_gpt_6_1_sol_primary_medium(self):
         parts = self.content.split("---\n", 2)
         self.assertEqual(len(parts), 3)
         header = parts[1]
         self.assertIn("description: ", header)
         self.assertEqual(header.count("mode: primary\n"), 1)
         self.assertEqual(header.count("model: openai/gpt-6.1-sol\n"), 1)
-        self.assertNotIn("variant:", header)
+        self.assertEqual(header.count("variant: medium\n"), 1)
 
     def test_knowledge_home_namespace_and_layout(self):
         self.assertIn("docs/agents/mechanic/", self.content)
@@ -626,7 +737,10 @@ def test_default_render_carries_no_pilot_surfaces(self):
 
     def test_opencode_json_uses_migrated_kimi_provider(self):
         cfg = json.loads(self.config_map["data"]["opencode.json"])
-        self.assertEqual(cfg["model"], "kimi-code-plan-cn/k3")
+        self.assertEqual(cfg["model"], "openai/gpt-6.1-sol")
+        self.assertEqual(cfg["default_agent"], "default")
+        for agent in ("build", "plan"):
+            self.assertTrue(cfg["agent"][agent]["disable"], agent)
         self.assertEqual(cfg["enabled_providers"], ["kimi-code-plan-cn", "minimax-coding-plan", "openai", "zai-coding-plan"])
         self.assertEqual(cfg["provider"], {"kimi-code-plan-cn": {"options": {"apiKey": "{env:KIMI_API_KEY}"}}})
         self.assertNotIn("kimi-for-coding", cfg["provider"])