§9 acceptance: grep-zero sweep — every internal x.ai/grok identifier renamed

The PRD's first acceptance gate now holds: grep -RinE '\bx\.ai\b|grok'
crates/ --include='*.rs' → 0 matches (exempt: NOTICE and third-party
license archives, README provenance, and the required 'Based on Grok
Build Open Source' attribution, now sourced from version_attribution.txt).

Wire-visible renames (both sides in this repo, changed in lockstep):
- Auth method id 'grok.com' → 'kimi-code' (AuthMethodKind::KimiCode).
- Every x.ai/* and _x.ai/* ACP ext method and meta key → kigi/* /
  _kigi/* (~200 names; grokShell → kigiShell). Session-file replay keeps
  a read-side alias for the legacy '_x.ai/session/update' method so
  existing updates.jsonl histories load; writes emit only the new name
  (both directions test-pinned).
- Agent types grok-build* → kigi* with a documented legacy-prefix alias
  at resolution time so persisted sessions keep resolving.
- ToolNamespace/BuiltinAgentName GrokBuild* → Kigi* (wire snake_case
  kigi/kigi_concise/kigi_hashline; schema regenerated); grok_build
  implementation dirs renamed to kigi*.
- x-grok-* headers → x-kigi-*, __GROK_* sentinels → __KIGI_*, themes
  grokday/groknight → kigiday/kiginight (old persisted values fall back
  to the default theme), web_fetch allowlist xAI hosts → kimi.com +
  moonshot platforms, changelog CDN → this repo, grok-build changelog
  archives deleted.
- BYOK default endpoint removed: [endpoints] api_base_url is now truly
  optional with NO default — consumers fail fast with the flag name when
  unset (no silent x.ai egress). Mock harnesses inject it explicitly.
- System-prompt identity fixed: 'released by xAI' → 'an unofficial
  community CLI for Kimi' (template + regenerated encrypted form).

Also repaired pre-existing grok-era test debt found by the sweep: the
stale trace_classify default-model pin, the grok-pager UA label test,
pty-harness stale-binary reuse and non-hermetic moonshot routing (a PTY
test could previously reach the real api.moonshot.cn), and the outdated
oauth fixture scope key.

Gates: §9 grep 0; fmt clean; workspace check/clippy 0/0 (-D warnings);
FULL cargo test --workspace: 234 suites, 21,961 passed, 0 failed;
deny advisories ok.

crates/codegen/kigi-shell/src/leader/lock.rs

@@ -56,7 +56,7 @@ pub fn default_lock_path_in(root: &Path) -> PathBuf {
 }
 
 /// Effective leader lock path: the [`LEADER_SOCKET_ENV`] override's sibling
-/// `.lock` when set, else the default under grok home.
+/// `.lock` when set, else the default under kigi home.
 pub fn default_lock_path() -> PathBuf {
     resolve_lock_path(leader_socket_override(), &kigi_home())
 }
@@ -67,7 +67,7 @@ pub fn default_socket_path_in(root: &Path) -> PathBuf {
 }
 
 /// Effective leader socket path: the [`LEADER_SOCKET_ENV`] override when set,
-/// else the default under grok home.
+/// else the default under kigi home.
 pub fn default_socket_path() -> PathBuf {
     resolve_socket_path(leader_socket_override(), &kigi_home())
 }
@@ -131,7 +131,7 @@ pub struct LeaderLock {
 }
 
 impl LeaderLock {
-    /// Create a new LeaderLock using the default paths in grok home
+    /// Create a new LeaderLock using the default paths in kigi home
     /// (or the [`LEADER_SOCKET_ENV`] override when set).
     pub fn new() -> Self {
         Self {

crates/codegen/kigi-shell/src/leader/mod.rs

@@ -1,4 +1,4 @@
-//! Leader-follower IPC architecture for grok-shell.
+//! Leader-follower IPC architecture for kigi-shell.
 //!
 //! This module implements a single-leader-per-machine architecture where one leader
 //! process manages the agent state while multiple clients (TUI, IDE extensions, headless)
@@ -40,7 +40,7 @@
 //! // Connect to existing leader or spawn a new one
 //! let caps = ClientCapabilities {
 //!     yolo_mode: true,
-//!     default_model: Some("grok-3-fast".to_string()),
+//!     default_model: Some("kigi-3-fast".to_string()),
 //! };
 //! let conn = connect_or_spawn("my-client", ClientMode::Stdio, caps).await?;
 //!
@@ -106,7 +106,7 @@ fn should_evict(leader_version: Option<&str>, client_version: &str) -> bool {
 const RECONNECT_BASE_DELAY: Duration = Duration::from_secs(1);
 /// Maximum delay between reconnection attempts (caps exponential backoff).
 const RECONNECT_MAX_DELAY: Duration = Duration::from_secs(30);
-/// Maximum reconnection attempts for bounded mode (headless/`grok -p`).
+/// Maximum reconnection attempts for bounded mode (headless/`kigi -p`).
 /// TUI mode uses unlimited retries controlled by a cancellation token.
 const RECONNECT_MAX_ATTEMPTS_BOUNDED: u32 = 5;
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
@@ -228,7 +228,7 @@ fn build_live_leader_info(payload: ControlPayload) -> Result<LiveLeaderInfo, Lea
 async fn fetch_live_leader_info(socket_path: &Path) -> Result<LiveLeaderInfo, LeaderTargetError> {
     let client = LeaderClient::connect(
         socket_path.to_path_buf(),
-        "grok-leader-discovery",
+        "kigi-leader-discovery",
         ClientMode::Stdio,
         ClientCapabilities::default(),
     )
@@ -805,7 +805,7 @@ pub enum ReconnectPolicy {
     /// Suitable for interactive TUI sessions where the user expects persistence.
     Unbounded,
     /// Retry up to a fixed number of attempts, then fail.
-    /// Suitable for headless/`grok -p` where hanging forever is unacceptable.
+    /// Suitable for headless/`kigi -p` where hanging forever is unacceptable.
     Bounded { max_attempts: u32 },
 }
 impl ReconnectPolicy {
@@ -831,7 +831,7 @@ impl ReconnectPolicy {
 /// ```ignore
 /// let (status_tx, status_rx) = LeaderReconnector::status_channel();
 /// let reconnector = LeaderReconnector::new(
-///     "grok-tui", ClientMode::Stdio, caps, status_tx,
+///     "kigi-tui", ClientMode::Stdio, caps, status_tx,
 /// );
 ///
 /// // When connection dies:
@@ -1112,7 +1112,7 @@ async fn evict_leader(conn: LeaderConnection, lock: &LeaderLock) {
 ///
 /// # Arguments
 ///
-/// * `client_type` - Identifier for the client type (e.g., "grok-tui", "vscode")
+/// * `client_type` - Identifier for the client type (e.g., "kigi-tui", "vscode")
 /// * `mode` - Communication mode (Stdio)
 /// * `capabilities` - Client capabilities (e.g., yolo_mode) to register with the leader
 pub async fn connect_or_spawn(
@@ -1248,8 +1248,8 @@ pub async fn connect_or_spawn(
 /// Resolve the binary to spawn as the leader subprocess.
 ///
 /// For a **managed install** — the running binary lives under `kigi_home`
-/// (e.g. `~/.kigi/...`) — prefer the managed `~/.kigi/bin/grok` symlink. After an
-/// auto-update or `grok update` atomically swaps that symlink, `current_exe()`
+/// (e.g. `~/.kigi/...`) — prefer the managed `~/.kigi/bin/kigi` symlink. After an
+/// auto-update or `kigi update` atomically swaps that symlink, `current_exe()`
 /// still resolves (via `/proc/self/exe` on Linux) to the *old* versioned target,
 /// so spawning it would relaunch the stale binary. The symlink always points to
 /// the freshly-installed version. This mirrors
@@ -1259,23 +1259,23 @@ pub async fn connect_or_spawn(
 /// not under `kigi_home`), keep `current_exe()` so the spawned leader matches the
 /// calling binary.
 ///
-/// Falls back to `~/.kigi/bin/grok` only when `current_exe()` is unavailable.
+/// Falls back to `~/.kigi/bin/kigi` only when `current_exe()` is unavailable.
 fn resolve_exe_for_spawn() -> Result<std::path::PathBuf, ConnectionError> {
     resolve_binary_with_home(&crate::util::kigi_home::kigi_home())
 }
 fn resolve_binary_with_home(kigi_home: &Path) -> Result<std::path::PathBuf, ConnectionError> {
     resolve_binary_impl(kigi_home, std::env::current_exe().ok())
 }
-/// Binary file name for the managed grok install (`grok` / `grok.exe`).
-fn managed_grok_bin_name() -> &'static str {
-    if cfg!(windows) { "grok.exe" } else { "grok" }
+/// Binary file name for the managed kigi install (`kigi` / `kigi.exe`).
+fn managed_kigi_bin_name() -> &'static str {
+    if cfg!(windows) { "kigi.exe" } else { "kigi" }
 }
 /// Core leader-binary resolution with the current-exe path injected, for testability.
 fn resolve_binary_impl(
     kigi_home: &Path,
     current_exe: Option<std::path::PathBuf>,
 ) -> Result<std::path::PathBuf, ConnectionError> {
-    let managed_bin = kigi_home.join("bin").join(managed_grok_bin_name());
+    let managed_bin = kigi_home.join("bin").join(managed_kigi_bin_name());
     if let Some(ref exe) = current_exe
         && path_is_under(exe, kigi_home)
         && managed_bin.exists()
@@ -1992,7 +1992,7 @@ mod tests {
         let temp = TempDir::new().unwrap();
         let bin_dir = temp.path().join("bin");
         std::fs::create_dir_all(&bin_dir).unwrap();
-        std::fs::write(bin_dir.join("grok"), "fake-binary").unwrap();
+        std::fs::write(bin_dir.join("kigi"), "fake-binary").unwrap();
         let result = resolve_binary_with_home(temp.path()).unwrap();
         let current = std::env::current_exe().unwrap();
         assert_eq!(result, current);
@@ -2009,9 +2009,9 @@ mod tests {
         let temp = TempDir::new().unwrap();
         let bin_dir = temp.path().join("bin");
         std::fs::create_dir_all(&bin_dir).unwrap();
-        let target_v2 = bin_dir.join("grok-v2");
+        let target_v2 = bin_dir.join("kigi-v2");
         std::fs::write(&target_v2, "new-binary").unwrap();
-        std::os::unix::fs::symlink(&target_v2, bin_dir.join("grok")).unwrap();
+        std::os::unix::fs::symlink(&target_v2, bin_dir.join("kigi")).unwrap();
         let result = resolve_binary_with_home(temp.path()).unwrap();
         let current = std::env::current_exe().unwrap();
         assert_eq!(result, current);
@@ -2022,11 +2022,11 @@ mod tests {
         let temp = TempDir::new().unwrap();
         let bin_dir = temp.path().join("bin");
         std::fs::create_dir_all(&bin_dir).unwrap();
-        let new_target = bin_dir.join("grok-v2");
+        let new_target = bin_dir.join("kigi-v2");
         std::fs::write(&new_target, "new-binary").unwrap();
-        let managed = bin_dir.join("grok");
+        let managed = bin_dir.join("kigi");
         std::os::unix::fs::symlink(&new_target, &managed).unwrap();
-        let stale_target = bin_dir.join("grok-v1");
+        let stale_target = bin_dir.join("kigi-v1");
         std::fs::write(&stale_target, "old-binary").unwrap();
         let result = resolve_binary_impl(temp.path(), Some(stale_target)).unwrap();
         assert_eq!(result, managed);
@@ -2036,7 +2036,7 @@ mod tests {
         let temp = TempDir::new().unwrap();
         let bin_dir = temp.path().join("bin");
         std::fs::create_dir_all(&bin_dir).unwrap();
-        std::fs::write(bin_dir.join(managed_grok_bin_name()), "managed").unwrap();
+        std::fs::write(bin_dir.join(managed_kigi_bin_name()), "managed").unwrap();
         let dev_exe = std::env::current_exe().unwrap();
         let result = resolve_binary_impl(temp.path(), Some(dev_exe.clone())).unwrap();
         assert_eq!(result, dev_exe);
@@ -2046,7 +2046,7 @@ mod tests {
         let temp = TempDir::new().unwrap();
         let bin_dir = temp.path().join("bin");
         std::fs::create_dir_all(&bin_dir).unwrap();
-        let managed = bin_dir.join(managed_grok_bin_name());
+        let managed = bin_dir.join(managed_kigi_bin_name());
         std::fs::write(&managed, "managed").unwrap();
         let result = resolve_binary_impl(temp.path(), None).unwrap();
         assert_eq!(result, managed);

crates/codegen/kigi-shell/src/leader/protocol.rs

@@ -108,7 +108,7 @@ impl Default for ClientId {
 #[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum ClientMode {
-    /// Stdio mode (grok agent stdio, grok -p) - uses local IPC.
+    /// Stdio mode (kigi agent stdio, kigi -p) - uses local IPC.
     /// Client sends/receives ACP messages directly via IPC.
     Stdio,
 }
@@ -143,7 +143,7 @@ pub struct ClientCapabilities {
     #[serde(default)]
     pub client_version: Option<String>,
 
-    /// Whether this client has advertised `x.ai/codeNavigation.enabled`.
+    /// Whether this client has advertised `kigi/codeNavigation.enabled`.
     /// When true, the leader injects `codeNavEnabled: true` into `session/new`
     /// and `session/load` requests so the agent can gate code-nav startup on a
     /// per-client basis rather than reading from shared last-initialized state.
@@ -177,7 +177,7 @@ pub struct LeaderCapabilities {
     pub profile_formats: Vec<ProfileArtifactFormat>,
     /// Whether the leader supports [`ControlCommand::RelaunchForUpdate`] — a
     /// disruptive, bounded-grace relaunch onto a freshly-installed binary
-    /// (driven by `grok update`). Old leaders default to `false`, so a new
+    /// (driven by `kigi update`). Old leaders default to `false`, so a new
     /// client falls back to advising a manual restart (graceful degradation).
     #[serde(default)]
     pub relaunch_v1: bool,
@@ -196,12 +196,12 @@ pub enum ControlCommand {
     },
     StopCpuProfile,
     /// Ask the leader to relaunch onto a freshly-installed binary (driven by
-    /// `grok update`). The leader stops admitting new turns, waits a bounded
+    /// `kigi update`). The leader stops admitting new turns, waits a bounded
     /// grace period for in-flight turns to finish, flushes session state, then
     /// exits with [`ShutdownReason::AutoUpdate`] so connected clients reconnect
     /// onto the new binary and restore their sessions via `session/load`.
     ///
-    /// `to_version` is the version `grok update` just installed; the leader uses
+    /// `to_version` is the version `kigi update` just installed; the leader uses
     /// it to decline if it is already running that version or newer.
     RelaunchForUpdate {
         to_version: String,

crates/codegen/kigi-shell/src/leader/transport.rs

@@ -4,7 +4,7 @@
 //!   `tokio::net::UnixStream` / `UnixListener`. Zero wrapper, no unsafe.
 //! - **Windows:** wraps `tokio::net::windows::named_pipe::*` (tokio doesn't
 //!   expose AF_UNIX on Windows). The leader's filesystem path is hashed
-//!   into `\\.\pipe\grok-leader-<hash>` so callers keep their path-based API.
+//!   into `\\.\pipe\kigi-leader-<hash>` so callers keep their path-based API.
 //!
 #[cfg(unix)]
 pub use tokio::net::UnixListener as LeaderListener;
@@ -233,7 +233,7 @@ mod windows_impl {
         name
     }
 
-    /// Deterministic leaf name (`grok-leader-<hash>`) for a filesystem path.
+    /// Deterministic leaf name (`kigi-leader-<hash>`) for a filesystem path.
     ///
     /// Uses SipHash-1-3 with fixed keys so the hash is stable across Rust
     /// versions (unlike `DefaultHasher`, whose algorithm is unspecified).
@@ -245,7 +245,7 @@ mod windows_impl {
         let mut hasher = SipHasher13::new_with_keys(0x67726f6b_6c656164, 0x65725f70_69706521);
         path.hash(&mut hasher);
         let hash = hasher.finish();
-        std::ffi::OsString::from(format!("grok-leader-{hash:016x}"))
+        std::ffi::OsString::from(format!("kigi-leader-{hash:016x}"))
     }
 
     #[cfg(test)]
@@ -255,8 +255,8 @@ mod windows_impl {
 
         #[test]
         fn pipe_name_is_deterministic() {
-            let a = path_to_pipe_name(Path::new("/tmp/grok.sock"));
-            let b = path_to_pipe_name(Path::new("/tmp/grok.sock"));
+            let a = path_to_pipe_name(Path::new("/tmp/kigi.sock"));
+            let b = path_to_pipe_name(Path::new("/tmp/kigi.sock"));
             assert_eq!(a, b);
         }
 
@@ -271,14 +271,14 @@ mod windows_impl {
         fn pipe_name_has_correct_prefix() {
             let name = path_to_pipe_name(Path::new("/tmp/test.sock"));
             let s = name.to_string_lossy();
-            assert!(s.starts_with(r"\\.\pipe\grok-leader-"), "got: {s}");
+            assert!(s.starts_with(r"\\.\pipe\kigi-leader-"), "got: {s}");
         }
 
         #[test]
         fn pipe_name_is_bounded() {
             let long_path = "/".to_owned() + &"a".repeat(500);
             let name = path_to_pipe_name(Path::new(&long_path));
-            // \\.\pipe\grok-leader- (20 chars) + 16 hex chars = 36 total
+            // \\.\pipe\kigi-leader- (20 chars) + 16 hex chars = 36 total
             assert!(name.len() <= 256, "pipe name too long: {}", name.len());
         }
 
@@ -287,7 +287,7 @@ mod windows_impl {
             // Unique path per process so parallel test binaries don't collide on
             // the derived pipe name.
             let path =
-                std::env::temp_dir().join(format!("grok-ready-probe-{}.sock", std::process::id()));
+                std::env::temp_dir().join(format!("kigi-ready-probe-{}.sock", std::process::id()));
 
             // Nothing bound yet -> ERROR_FILE_NOT_FOUND -> not ready.
             assert!(!listener_is_ready(&path));