fix: opencode config

README.md

@@ -60,7 +60,9 @@ has a connected provider. The worker leaves jobs queued while the runtime is una
 Models use OpenCode's `provider/model` format. Planning, implementation, and research can use
 different providers. Optional `AGENTCI_PLAN_VARIANT` and `AGENTCI_IMPLEMENT_VARIANT` values are
 passed directly to OpenCode for providers that support variants. `AGENTCI_RESEARCH_VARIANT`
-configures the research subagent and defaults to `high`.
+configures the research subagent and defaults to `high`. `AGENTCI_EXPLORE_MODEL` and
+`AGENTCI_EXPLORE_VARIANT` configure OpenCode's explore agent and default to
+`openai/gpt-5.6-luna` with `low`.
 
 `AGENTCI_OPENCODE_VERSION` controls the npm version or range installed into the image and defaults
 to `^1`. The build verifies that the resolved version is still OpenCode 1.x and prints it. Compose
@@ -75,10 +77,10 @@ are root-owned and read-only, and external skill discovery is disabled, so an ag
 instructions for later repositories. CodeGraph, Context7, and `gh_grep` are configured as MCP
 servers. Set `AGENTCI_CONTEXT7_API_KEY` to raise Context7 rate limits.
 
-The `research` subagent has the same unrestricted permissions as every other agent. Its prompt
-asks it to focus on external evidence, but this is guidance rather than an isolation boundary.
-Agent CI initializes or refreshes CodeGraph before every turn and locally excludes `.codegraph/`
-from Git.
+The `research` subagent can only use Exa web search, Context7, and the `gh_grep` public-code search
+MCP. All filesystem, shell, editing, task, and other tools are denied for that agent. Exa is enabled
+with `OPENCODE_ENABLE_EXA=1`. Agent CI initializes or refreshes CodeGraph before every parent turn
+and locally excludes `.codegraph/` from Git.
 
 ### Security boundary