fix: default to deepseek/deepseek-v4-flash-0731 (drop invalid openrouter/ prefix)

.env.example

@@ -16,8 +16,8 @@ AGENTFIELD_AFORGE_COMMAND=exec
 # AFORGE_VERSION=v0.1.0
 
 # Optional: Model overrides
-HARNESS_MODEL=openrouter/moonshotai/kimi-k2.5
-AI_MODEL=openrouter/moonshotai/kimi-k2.5
+HARNESS_MODEL=deepseek/deepseek-v4-flash-0731
+AI_MODEL=deepseek/deepseek-v4-flash-0731
 
 # Optional: Cloud credentials (read-only, for prove mode only)
 # AWS

Dockerfile

@@ -63,8 +63,8 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     AGENTFIELD_SERVER=http://agentfield:8080 \
     HARNESS_PROVIDER=aforge \
     AGENTFIELD_AFORGE_COMMAND=exec \
-    HARNESS_MODEL=openrouter/moonshotai/kimi-k2.5 \
-    AI_MODEL=openrouter/moonshotai/kimi-k2.5 \
+    HARNESS_MODEL=deepseek/deepseek-v4-flash-0731 \
+    AI_MODEL=deepseek/deepseek-v4-flash-0731 \
     PORT=8005 \
     HOME=/home/cloudsecurity \
     PYTHONPATH=/app/src \

agentfield-package.yaml

@@ -59,10 +59,10 @@ user_environment:
       description: Optional path to the AForge binary (defaults to aforge on PATH)
     - name: HARNESS_MODEL
       description: Model the harness uses
-      default: openrouter/moonshotai/kimi-k2.5
+      default: deepseek/deepseek-v4-flash-0731
     - name: AI_MODEL
       description: Model for direct AI calls
-      default: openrouter/moonshotai/kimi-k2.5
+      default: deepseek/deepseek-v4-flash-0731
     - name: AWS_ACCESS_KEY_ID
       description: AWS access key for read-only scanning
       type: secret

docker-compose.go.yml

@@ -44,8 +44,8 @@ services:
       - AGENT_CALLBACK_URL=http://cloudsecurity-go:8015
       - HARNESS_PROVIDER=${HARNESS_PROVIDER:-aforge}
       - AGENTFIELD_AFORGE_COMMAND=${AGENTFIELD_AFORGE_COMMAND:-exec}
-      - HARNESS_MODEL=${HARNESS_MODEL:-openrouter/moonshotai/kimi-k2.5}
-      - AI_MODEL=${AI_MODEL:-openrouter/moonshotai/kimi-k2.5}
+      - HARNESS_MODEL=${HARNESS_MODEL:-deepseek/deepseek-v4-flash-0731}
+      - AI_MODEL=${AI_MODEL:-deepseek/deepseek-v4-flash-0731}
       - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
       # XDG_DATA_HOME is set here and NOT in docker-compose.yml — a deliberate
       # packaging difference (divergence 6 in go/README.md). Both nodes read the

docker-compose.yml

@@ -32,8 +32,8 @@ services:
       - AGENT_CALLBACK_URL=http://cloudsecurity-af:8005
       - HARNESS_PROVIDER=${HARNESS_PROVIDER:-aforge}
       - AGENTFIELD_AFORGE_COMMAND=${AGENTFIELD_AFORGE_COMMAND:-exec}
-      - HARNESS_MODEL=${HARNESS_MODEL:-openrouter/moonshotai/kimi-k2.5}
-      - AI_MODEL=${AI_MODEL:-openrouter/moonshotai/kimi-k2.5}
+      - HARNESS_MODEL=${HARNESS_MODEL:-deepseek/deepseek-v4-flash-0731}
+      - AI_MODEL=${AI_MODEL:-deepseek/deepseek-v4-flash-0731}
       - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
       - PYTHONUNBUFFERED=1
       # Cloud provider credentials (read-only, for prove mode)

go/Dockerfile

@@ -82,8 +82,8 @@ ARG OPENCODE_VERSION=1.17.15
 ENV AGENTFIELD_SERVER=http://agentfield:8080 \
     HARNESS_PROVIDER=aforge \
     AGENTFIELD_AFORGE_COMMAND=exec \
-    HARNESS_MODEL=openrouter/moonshotai/kimi-k2.5 \
-    AI_MODEL=openrouter/moonshotai/kimi-k2.5 \
+    HARNESS_MODEL=deepseek/deepseek-v4-flash-0731 \
+    AI_MODEL=deepseek/deepseek-v4-flash-0731 \
     PORT=8015 \
     NODE_ID=cloudsecurity \
     HOME=/home/cloudsecurity \

go/README.md

@@ -223,7 +223,7 @@ The node is configured entirely through the environment.
 
 Note: the code default model is `openrouter/minimax/minimax-m2.5`, while the
 Docker image / compose / manifest set
-`HARNESS_MODEL=openrouter/moonshotai/kimi-k2.5`. The env var always wins; both
+`HARNESS_MODEL=deepseek/deepseek-v4-flash-0731`. The env var always wins; both
 defaults are intentional (they mirror the Python node).
 
 ## Deliberate divergences from the Python node

go/agentfield-package.yaml

@@ -55,10 +55,10 @@ user_environment:
       description: Optional path to the AForge binary (defaults to aforge on PATH)
     - name: HARNESS_MODEL
       description: Model the harness uses
-      default: openrouter/moonshotai/kimi-k2.5
+      default: deepseek/deepseek-v4-flash-0731
     - name: AI_MODEL
       description: Model for direct AI calls
-      default: openrouter/moonshotai/kimi-k2.5
+      default: deepseek/deepseek-v4-flash-0731
     - name: AWS_ACCESS_KEY_ID
       description: AWS access key for read-only scanning
       type: secret

go/docker-entrypoint.sh

@@ -19,7 +19,7 @@ set -e
 # than the one the node passes to opencode with -m, which is exactly the
 # whitelist mismatch this script exists to prevent. The image bakes
 # HARNESS_MODEL, so without the first hop CLOUDSECURITY_MODEL could never win.
-MODEL="${CLOUDSECURITY_MODEL:-${HARNESS_MODEL:-openrouter/moonshotai/kimi-k2.5}}"
+MODEL="${CLOUDSECURITY_MODEL:-${HARNESS_MODEL:-deepseek/deepseek-v4-flash-0731}}"
 
 # opencode keys models under a provider by the slug *without* the provider
 # prefix, e.g. "openrouter/z-ai/glm-5.2" -> provider "openrouter", key "z-ai/glm-5.2".