diff --git a/.env.example b/.env.example
index 30c59ea..c6405c5 100644
--- a/.env.example
+++ b/.env.example
@@ -9,8 +9,8 @@ HARNESS_PROVIDER=aforge
 # AForge headless command the SDK runs: `exec` (default) or `do`.
 # Read by agentfield>=0.1.130; any other value fails the harness call.
 AGENTFIELD_AFORGE_COMMAND=exec
-HARNESS_MODEL=openrouter/moonshotai/kimi-k2.5
-AI_MODEL=openrouter/moonshotai/kimi-k2.5
+HARNESS_MODEL=deepseek/deepseek-v4-flash-0731
+AI_MODEL=deepseek/deepseek-v4-flash-0731
 # SEC_AF_AFORGE_BIN=/absolute/path/to/aforge
 
 # Build-time only: where `docker compose build` fetches the AForge CLI from.
diff --git a/README.md b/README.md
index e7deba7..e94bdd5 100644
--- a/README.md
+++ b/README.md
@@ -493,8 +493,8 @@ jobs:
 |---|---|---|---|
 | `AGENTFIELD_SERVER` | Yes | `http://localhost:8080` | Control plane URL |
 | `OPENROUTER_API_KEY` | Yes | - | LLM provider credential |
-| `HARNESS_MODEL` | No | `moonshotai/kimi-k2.5` | Model for deep `.harness()` analysis |
-| `AI_MODEL` | No | `moonshotai/kimi-k2.5` | Model for fast `.ai()` gates and verdicts |
+| `HARNESS_MODEL` | No | `deepseek/deepseek-v4-flash-0731` | Model for deep `.harness()` analysis |
+| `AI_MODEL` | No | `deepseek/deepseek-v4-flash-0731` | Model for fast `.ai()` gates and verdicts |
 | `SEC_AF_MAX_TURNS` | No | `50` | Max harness turns per call |
 | `AGENTFIELD_API_KEY` | No | unset | API key for secured environments |
 | `SEC_AF_WORKSPACES_DIR` | No | `/workspaces` | Directory for cloned repos (falls back to `~/.sec-af/workspaces` if not writable) |
diff --git a/agentfield-package.yaml b/agentfield-package.yaml
index 360c8e3..e769094 100644
--- a/agentfield-package.yaml
+++ b/agentfield-package.yaml
@@ -51,10 +51,10 @@ user_environment:
       description: Optional path to the AForge binary (defaults to aforge on PATH)
     - name: HARNESS_MODEL
       description: Model the harness uses
-      default: openrouter/moonshotai/kimi-k2.5
+      default: deepseek/deepseek-v4-flash-0731
     - name: AI_MODEL
       description: Model for direct AI calls
-      default: openrouter/moonshotai/kimi-k2.5
+      default: deepseek/deepseek-v4-flash-0731
     - name: SEC_AF_WORKSPACES_DIR
       description: Directory where repos to scan are cloned (falls back to ~/.sec-af/workspaces if not writable)
       default: /workspaces
diff --git a/docker-compose.go.yml b/docker-compose.go.yml
index 5b234a6..d92daa9 100644
--- a/docker-compose.go.yml
+++ b/docker-compose.go.yml
@@ -53,8 +53,8 @@ services:
       - AGENT_CALLBACK_URL=http://sec-af-go:8013
       - HARNESS_PROVIDER=${HARNESS_PROVIDER:-aforge}
       - AGENTFIELD_AFORGE_COMMAND=${AGENTFIELD_AFORGE_COMMAND:-exec}
-      - HARNESS_MODEL=${HARNESS_MODEL:-openrouter/moonshotai/kimi-k2.5}
-      - AI_MODEL=${AI_MODEL:-openrouter/moonshotai/kimi-k2.5}
+      - HARNESS_MODEL=${HARNESS_MODEL:-deepseek/deepseek-v4-flash-0731}
+      - AI_MODEL=${AI_MODEL:-deepseek/deepseek-v4-flash-0731}
       # SEC_AF_AFORGE_BIN is deliberately NOT forwarded, exactly as the Python
       # sec-af service does not forward it (docker-compose.yml). Compose loads
       # the repo-root .env for BOTH stacks and .env.example documents
diff --git a/docker-compose.yml b/docker-compose.yml
index 6a48977..c8a977a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -31,8 +31,8 @@ services:
       - AGENT_CALLBACK_URL=http://sec-af:8003
       - HARNESS_PROVIDER=${HARNESS_PROVIDER:-aforge}
       - AGENTFIELD_AFORGE_COMMAND=${AGENTFIELD_AFORGE_COMMAND:-exec}
-      - HARNESS_MODEL=${HARNESS_MODEL:-openrouter/moonshotai/kimi-k2.5}
-      - AI_MODEL=${AI_MODEL:-openrouter/moonshotai/kimi-k2.5}
+      - HARNESS_MODEL=${HARNESS_MODEL:-deepseek/deepseek-v4-flash-0731}
+      - AI_MODEL=${AI_MODEL:-deepseek/deepseek-v4-flash-0731}
       - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
     volumes:
       - workspaces:/workspaces
diff --git a/go/README.md b/go/README.md
index 3c958cb..b80cba4 100644
--- a/go/README.md
+++ b/go/README.md
@@ -189,7 +189,7 @@ mirrors the Python node's corresponding artifact):
 | --- | --- | --- |
 | Code (`internal/config`, `src/sec_af/config.py`) | `minimax/minimax-m2.5` | Bare slug; the fallback when nothing is set. |
 | Docker image (`go/Dockerfile`, root `Dockerfile`) | `openrouter/minimax/minimax-m2.5` | Same model, `openrouter/`-prefixed for the harness router. |
-| Compose, `.env.example`, `agentfield-package.yaml` | `openrouter/moonshotai/kimi-k2.5` | A different model — the one an installed or composed node runs. |
+| Compose, `.env.example`, `agentfield-package.yaml` | `deepseek/deepseek-v4-flash-0731` | A different model — the one an installed or composed node runs. |
 
 `SEC_AF_MODEL` / `SEC_AF_AI_MODEL` win over `HARNESS_MODEL` / `AI_MODEL`, and
 either env var wins over every default above.
diff --git a/go/agentfield-package.yaml b/go/agentfield-package.yaml
index 10f6d23..8c7685b 100644
--- a/go/agentfield-package.yaml
+++ b/go/agentfield-package.yaml
@@ -52,10 +52,10 @@ user_environment:
       description: Optional path to the AForge binary (defaults to aforge on PATH)
     - name: HARNESS_MODEL
       description: Model the harness uses
-      default: openrouter/moonshotai/kimi-k2.5
+      default: deepseek/deepseek-v4-flash-0731
     - name: AI_MODEL
       description: Model for direct AI calls
-      default: openrouter/moonshotai/kimi-k2.5
+      default: deepseek/deepseek-v4-flash-0731
     - name: SEC_AF_WORKSPACES_DIR
       description: Directory where repos to scan are cloned (falls back to ~/.sec-af/workspaces if not writable)
       default: /workspaces