§9 acceptance: grep-zero sweep — every internal x.ai/grok identifier renamed

The PRD's first acceptance gate now holds: grep -RinE '\bx\.ai\b|grok'
crates/ --include='*.rs' → 0 matches (exempt: NOTICE and third-party
license archives, README provenance, and the required 'Based on Grok
Build Open Source' attribution, now sourced from version_attribution.txt).

Wire-visible renames (both sides in this repo, changed in lockstep):
- Auth method id 'grok.com' → 'kimi-code' (AuthMethodKind::KimiCode).
- Every x.ai/* and _x.ai/* ACP ext method and meta key → kigi/* /
  _kigi/* (~200 names; grokShell → kigiShell). Session-file replay keeps
  a read-side alias for the legacy '_x.ai/session/update' method so
  existing updates.jsonl histories load; writes emit only the new name
  (both directions test-pinned).
- Agent types grok-build* → kigi* with a documented legacy-prefix alias
  at resolution time so persisted sessions keep resolving.
- ToolNamespace/BuiltinAgentName GrokBuild* → Kigi* (wire snake_case
  kigi/kigi_concise/kigi_hashline; schema regenerated); grok_build
  implementation dirs renamed to kigi*.
- x-grok-* headers → x-kigi-*, __GROK_* sentinels → __KIGI_*, themes
  grokday/groknight → kigiday/kiginight (old persisted values fall back
  to the default theme), web_fetch allowlist xAI hosts → kimi.com +
  moonshot platforms, changelog CDN → this repo, grok-build changelog
  archives deleted.
- BYOK default endpoint removed: [endpoints] api_base_url is now truly
  optional with NO default — consumers fail fast with the flag name when
  unset (no silent x.ai egress). Mock harnesses inject it explicitly.
- System-prompt identity fixed: 'released by xAI' → 'an unofficial
  community CLI for Kimi' (template + regenerated encrypted form).

Also repaired pre-existing grok-era test debt found by the sweep: the
stale trace_classify default-model pin, the grok-pager UA label test,
pty-harness stale-binary reuse and non-hermetic moonshot routing (a PTY
test could previously reach the real api.moonshot.cn), and the outdated
oauth fixture scope key.

Gates: §9 grep 0; fmt clean; workspace check/clippy 0/0 (-D warnings);
FULL cargo test --workspace: 234 suites, 21,961 passed, 0 failed;
deny advisories ok.

crates/codegen/kigi-test-support/src/acp_client.rs

@@ -1,5 +1,5 @@
-//! ACP stdio clients for testing grok sessions end-to-end: the typed
-//! [`GrokStdioClient`] (`agent-client-protocol::ClientSideConnection` —
+//! ACP stdio clients for testing kigi sessions end-to-end: the typed
+//! [`KigiStdioClient`] (`agent-client-protocol::ClientSideConnection` —
 //! authentication, session lifecycle, permissions, notification streaming) and
 //! the raw-wire [`RawStdioClient`] (verbatim JSON-RPC lines for shapes the
 //! typed client can't produce), plus the shared subprocess spawn/stderr-capture
@@ -15,14 +15,14 @@ use kigi_acp_lib::LineBufferedRead;
 use tempfile::TempDir;
 use tokio_util::compat::{TokioAsyncReadCompatExt, TokioAsyncWriteCompatExt};
 
-use crate::env::{grok_binary, test_env_cmd_tokio};
+use crate::env::{kigi_binary, test_env_cmd_tokio};
 use crate::headless::stderr_tail;
 use crate::mock_server::MockInferenceServer;
 use crate::process::spawn_piped_with_stderr_capture;
 
-/// Spawn `grok agent stdio` with the canonical hermetic test env: the sandbox
+/// Spawn `kigi agent stdio` with the canonical hermetic test env: the sandbox
 /// from [`test_env_cmd_tokio`] plus the debug-logging kill-list, so the
-/// hermeticity setup exists exactly once for the typed ([`GrokStdioClient`])
+/// hermeticity setup exists exactly once for the typed ([`KigiStdioClient`])
 /// and raw ([`RawStdioClient`]) harnesses. `leading_args` go before the
 /// `agent stdio` subcommand (global flags); `extra_env` is applied after the
 /// kill-list so a test can still set e.g. `KIGI_DEBUG_LOG=1` explicitly.
@@ -33,7 +33,7 @@ fn spawn_agent_process(
     extra_env: &[(&str, &str)],
     leading_args: &[&str],
 ) -> (tokio::process::Child, Arc<std::sync::Mutex<Vec<u8>>>) {
-    let binary = grok_binary();
+    let binary = kigi_binary();
 
     let mut cmd = tokio::process::Command::new(&binary);
     cmd.args(leading_args)
@@ -107,11 +107,11 @@ impl acp::Client for TestAcpClient {
     }
 }
 
-/// Drives `grok agent stdio` via the ACP protocol over pipes.
+/// Drives `kigi agent stdio` via the ACP protocol over pipes.
 ///
 /// Handles the full lifecycle: spawn → initialize → authenticate → session → prompt.
 /// Child process is killed on drop.
-pub struct GrokStdioClient {
+pub struct KigiStdioClient {
     conn: acp::ClientSideConnection,
     _child: tokio::process::Child,
     home: Option<TempDir>,
@@ -119,7 +119,7 @@ pub struct GrokStdioClient {
     stderr: Arc<std::sync::Mutex<Vec<u8>>>,
 }
 
-impl GrokStdioClient {
+impl KigiStdioClient {
     pub async fn spawn(server: &MockInferenceServer, cwd: &Path) -> Self {
         let home = TempDir::new().expect("create temp home");
         Self::spawn_with_home(server, cwd, home).await
@@ -396,9 +396,9 @@ impl GrokStdioClient {
     }
 }
 
-/// Drives `grok agent stdio` with verbatim newline-delimited JSON-RPC lines.
+/// Drives `kigi agent stdio` with verbatim newline-delimited JSON-RPC lines.
 ///
-/// Exists for wire shapes the typed [`GrokStdioClient`] (`ClientSideConnection`,
+/// Exists for wire shapes the typed [`KigiStdioClient`] (`ClientSideConnection`,
 /// integer ids) can never produce — e.g. Xcode's Swift/Foundation `JSONEncoder`
 /// output: escaped-slash methods (`"session\/prompt"`) and string UUID request
 /// ids. Child process is killed on drop.

crates/codegen/kigi-test-support/src/env.rs

@@ -63,13 +63,13 @@ fn target_dir() -> PathBuf {
         .unwrap_or_else(|| workspace_root().join("target"))
 }
 
-fn local_grok_binary_path() -> PathBuf {
+fn local_kigi_binary_path() -> PathBuf {
     target_dir()
         .join("debug")
         .join(format!("kigi-tui{}", std::env::consts::EXE_SUFFIX))
 }
 
-fn ensure_local_grok_binary(binary: &Path) {
+fn ensure_local_kigi_binary(binary: &Path) {
     if binary.exists() {
         return;
     }
@@ -95,8 +95,8 @@ fn ensure_local_grok_binary(binary: &Path) {
     );
 }
 
-/// Resolve grok binary: `KIGI_BINARY` env (CI) or a locally built `kigi-tui` binary.
-pub fn grok_binary() -> PathBuf {
+/// Resolve kigi binary: `KIGI_BINARY` env (CI) or a locally built `kigi-tui` binary.
+pub fn kigi_binary() -> PathBuf {
     if let Ok(path) = std::env::var("KIGI_BINARY") {
         let p = PathBuf::from(path);
         assert!(p.exists(), "KIGI_BINARY does not exist: {}", p.display());
@@ -110,8 +110,8 @@ pub fn grok_binary() -> PathBuf {
         }
     }
 
-    let binary = local_grok_binary_path();
-    ensure_local_grok_binary(&binary);
+    let binary = local_kigi_binary_path();
+    ensure_local_kigi_binary(&binary);
     binary
 }
 
@@ -149,14 +149,14 @@ pub fn git_workdir() -> TempDir {
     dir
 }
 
-/// Point grok at the mock server with a fake API key and telemetry disabled.
+/// Point kigi at the mock server with a fake API key and telemetry disabled.
 pub fn test_env_cmd_tokio(
     cmd: &mut tokio::process::Command,
     mock_url: &str,
     home: &std::path::Path,
 ) {
     cmd.env("HOME", home)
-        // HOME alone does not sandbox grok on Windows: the product resolves
+        // HOME alone does not sandbox kigi on Windows: the product resolves
         // `~` via `USERPROFILE`/Known Folders (`std::env::home_dir()`), so
         // without an explicit KIGI_SHARE_DIR every spawned child shares the real
         // `%USERPROFILE%\.kigi` — test 1's models_cache.json (which embeds

crates/codegen/kigi-test-support/src/headless.rs

@@ -1,6 +1,6 @@
-//! Headless mode (`grok -p`) test runner.
+//! Headless mode (`kigi -p`) test runner.
 //!
-//! Runs the grok binary as a subprocess with the mock server, captures output.
+//! Runs the kigi binary as a subprocess with the mock server, captures output.
 
 use std::path::Path;
 use std::process::ExitStatus;
@@ -9,7 +9,7 @@ use std::time::Duration;
 use tempfile::TempDir;
 use tokio::io::AsyncReadExt as _;
 
-use crate::env::{grok_binary, test_env_cmd_tokio};
+use crate::env::{kigi_binary, test_env_cmd_tokio};
 use crate::mock_server::MockInferenceServer;
 
 pub struct HeadlessResult {
@@ -21,7 +21,7 @@ pub struct HeadlessResult {
 
 const HEADLESS_TIMEOUT_SECS: u64 = 60;
 
-/// Run `grok` with the given args against the mock server, with a 60s timeout.
+/// Run `kigi` with the given args against the mock server, with a 60s timeout.
 /// Uses an isolated HOME and disables telemetry.
 pub async fn run_headless(
     server: &MockInferenceServer,
@@ -29,7 +29,7 @@ pub async fn run_headless(
     cwd: &Path,
 ) -> HeadlessResult {
     let home = TempDir::new().expect("create temp home");
-    let mut cmd = tokio::process::Command::new(grok_binary());
+    let mut cmd = tokio::process::Command::new(kigi_binary());
     cmd.args(args)
         .current_dir(cwd)
         .stdin(std::process::Stdio::null())
@@ -41,10 +41,10 @@ pub async fn run_headless(
 }
 
 pub async fn run_headless_with_cmd(mut cmd: tokio::process::Command) -> HeadlessResult {
-    let binary = grok_binary();
+    let binary = kigi_binary();
     let mut child = cmd
         .spawn()
-        .unwrap_or_else(|e| panic!("failed to spawn grok binary at {}: {e}", binary.display()));
+        .unwrap_or_else(|e| panic!("failed to spawn kigi binary at {}: {e}", binary.display()));
 
     let stdout = child.stdout.take().expect("child stdout missing");
     let stderr = child.stderr.take().expect("child stderr missing");
@@ -70,7 +70,7 @@ pub async fn run_headless_with_cmd(mut cmd: tokio::process::Command) -> Headless
     {
         Ok(result) => (
             result.unwrap_or_else(|e| {
-                panic!("failed to wait for grok binary {}: {e}", binary.display())
+                panic!("failed to wait for kigi binary {}: {e}", binary.display())
             }),
             false,
         ),
@@ -78,7 +78,7 @@ pub async fn run_headless_with_cmd(mut cmd: tokio::process::Command) -> Headless
             let _ = child.kill().await;
             let status = child.wait().await.unwrap_or_else(|e| {
                 panic!(
-                    "failed to kill timed out grok binary {}: {e}",
+                    "failed to kill timed out kigi binary {}: {e}",
                     binary.display()
                 )
             });

crates/codegen/kigi-test-support/src/leader.rs

@@ -1,4 +1,4 @@
-//! Leader-mode (`grok agent --leader stdio`) test harness.
+//! Leader-mode (`kigi agent --leader stdio`) test harness.
 //!
 //! Spawns the real binary as a stdio client whose bridge elects a leader
 //! subprocess hosting the actual sessions, speaks ACP over pipes, and
@@ -14,16 +14,16 @@ use agent_client_protocol::{self as acp, Agent as _};
 use kigi_acp_lib::LineBufferedRead;
 use tokio_util::compat::{TokioAsyncReadCompatExt, TokioAsyncWriteCompatExt};
 
-use crate::env::grok_binary;
+use crate::env::kigi_binary;
 use crate::mock_server::MockInferenceServer;
 use crate::process::spawn_piped_with_stderr_capture;
 
 /// Env var naming the binary that elects/hosts the leader in a two-binary
-/// (version-skew) test. Falls back to [`grok_binary`]'s resolution.
+/// (version-skew) test. Falls back to [`kigi_binary`]'s resolution.
 pub const LEADER_BINARY_ENV: &str = "KIGI_BINARY_LEADER";
 
 /// Env var naming the binary for the second (usually newer) client in a
-/// two-binary test. Falls back to [`grok_binary`]'s resolution.
+/// two-binary test. Falls back to [`kigi_binary`]'s resolution.
 pub const CLIENT_BINARY_ENV: &str = "KIGI_BINARY_CLIENT";
 
 fn role_binary(env_key: &str) -> PathBuf {
@@ -32,17 +32,17 @@ fn role_binary(env_key: &str) -> PathBuf {
         assert!(p.exists(), "{env_key} does not exist: {}", p.display());
         return p;
     }
-    grok_binary()
+    kigi_binary()
 }
 
 /// Binary for the leader-electing side of a version-skew test
-/// (`KIGI_BINARY_LEADER`, else the shared [`grok_binary`] resolution).
+/// (`KIGI_BINARY_LEADER`, else the shared [`kigi_binary`] resolution).
 pub fn leader_binary() -> PathBuf {
     role_binary(LEADER_BINARY_ENV)
 }
 
 /// Binary for the client side of a version-skew test (`KIGI_BINARY_CLIENT`,
-/// else the shared [`grok_binary`] resolution).
+/// else the shared [`kigi_binary`] resolution).
 pub fn client_binary() -> PathBuf {
     role_binary(CLIENT_BINARY_ENV)
 }
@@ -93,7 +93,7 @@ impl acp::Client for LeaderAcpClient {
     }
 
     async fn ext_notification(&self, args: acp::ExtNotification) -> acp::Result<()> {
-        if &*args.method == "x.ai/leader_reconnected" {
+        if &*args.method == "kigi/leader_reconnected" {
             self.capture
                 .reconnected_count
                 .fetch_add(1, Ordering::SeqCst);
@@ -102,7 +102,7 @@ impl acp::Client for LeaderAcpClient {
     }
 }
 
-/// A `grok agent --leader stdio` client subprocess speaking ACP over pipes.
+/// A `kigi agent --leader stdio` client subprocess speaking ACP over pipes.
 /// The leader subprocess it elects hosts the actual sessions.
 pub struct LeaderStdioClient {
     pub conn: acp::ClientSideConnection,
@@ -114,7 +114,7 @@ pub struct LeaderStdioClient {
 
 impl LeaderStdioClient {
     pub async fn spawn(server: &MockInferenceServer, cwd: &Path, home: &Path) -> Self {
-        Self::spawn_with_binary(&grok_binary(), server, cwd, home).await
+        Self::spawn_with_binary(&kigi_binary(), server, cwd, home).await
     }
 
     /// [`Self::spawn`] with an explicit binary, for two-binary version-skew
@@ -128,7 +128,7 @@ impl LeaderStdioClient {
         let mut cmd = tokio::process::Command::new(binary);
         cmd.args(["agent", "--leader", "stdio"])
             .current_dir(cwd)
-            // Hermetic env: the developer's shell may export GROK_* vars
+            // Hermetic env: the developer's shell may export KIGI_* vars
             // (e.g. KIGI_LEADER_SOCKET pointing at a REAL leader on this
             // machine). env_clear + explicit allowlist guarantees the test
             // can never touch a leader outside its sandbox home.
@@ -330,8 +330,8 @@ pub async fn wait_for_new_leader(home: &Path, old_pid: u32, timeout: Duration) -
 
 /// Wait for evidence that the bridge finished its reconnect replay.
 ///
-/// The `x.ai/leader_reconnected` ext notification is dropped by the typed
-/// `ClientSideConnection` (bare `x.ai/*` methods are rejected by the ACP
+/// The `kigi/leader_reconnected` ext notification is dropped by the typed
+/// `ClientSideConnection` (bare `kigi/*` methods are rejected by the ACP
 /// decoder), so we wait for the replayed `session/load` to emit session
 /// notifications instead: the notification count rises above `baseline`.
 pub async fn wait_for_replay_notifications(

crates/codegen/kigi-test-support/src/lib.rs

@@ -5,18 +5,18 @@
     unreachable_code,
     dead_code
 )]
-//! Shared test utilities for grok-build crates: mock inference server, SSE
+//! Shared test utilities for kigi crates: mock inference server, SSE
 //! generators, ACP stdio client, headless runner, env sandbox.
 //!
 //! Provides:
 //! - [`MockInferenceServer`] — Mock /v1/chat/completions + /v1/responses with request logging
-//! - [`GrokStdioClient`] — ACP client that drives `grok agent stdio` as a subprocess
+//! - [`KigiStdioClient`] — ACP client that drives `kigi agent stdio` as a subprocess
 //! - [`RawStdioClient`] — raw-wire ACP driver for bytes the typed client can't
 //!   produce (Foundation `\/` methods, string UUID ids)
-//! - [`leader::LeaderStdioClient`] — ACP client that drives `grok agent --leader stdio` (unix)
-//! - [`run_headless`] — Run `grok -p` against the mock server and capture output
+//! - [`leader::LeaderStdioClient`] — ACP client that drives `kigi agent --leader stdio` (unix)
+//! - [`run_headless`] — Run `kigi -p` against the mock server and capture output
 //! - [`git_workdir`] — Create a temp directory with git repo (forces libgit2 init)
-//! - [`grok_binary`] — Resolve the grok binary path (KIGI_BINARY env or cargo_bin)
+//! - [`kigi_binary`] — Resolve the kigi binary path (KIGI_BINARY env or cargo_bin)
 //! - [`spawn_counting_server`] — Connection-counting HTTP/1.1 server for wire/pooling tests
 //! - [`uds_proxy::UdsProxy`] — Frame-aware fault-injection proxy for leader IPC sockets (unix)
 pub mod acp_client;
@@ -31,9 +31,9 @@ pub mod scripted;
 pub mod sse;
 #[cfg(unix)]
 pub mod uds_proxy;
-pub use acp_client::{GrokStdioClient, RawStdioClient};
+pub use acp_client::{KigiStdioClient, RawStdioClient};
 pub use counting_server::spawn_counting_server;
-pub use env::{EnvGuard, git_workdir, grok_binary};
+pub use env::{EnvGuard, git_workdir, kigi_binary};
 pub use headless::{
     HeadlessResult, assert_headless_success, assert_no_crashes, run_headless,
     run_headless_with_cmd, stderr_tail,

crates/codegen/kigi-test-support/src/process.rs

@@ -4,7 +4,7 @@ use std::sync::Arc;
 
 /// Pipe all three stdio handles, `kill_on_drop`, spawn, and drain the child's
 /// stderr into the returned buffer on a background task. The one spawn path
-/// shared by every subprocess harness in this crate (`GrokStdioClient`,
+/// shared by every subprocess harness in this crate (`KigiStdioClient`,
 /// `RawStdioClient`, `leader::LeaderStdioClient`); env/args stay with the
 /// callers, whose hermeticity models differ (sandbox-inherit vs `env_clear`).
 /// The drain future is `Send`, so this works on and off a `LocalSet`.
@@ -21,7 +21,7 @@ pub(crate) fn spawn_piped_with_stderr_capture(
     let program = cmd.as_std().get_program().to_string_lossy().into_owned();
     let mut child = cmd
         .spawn()
-        .unwrap_or_else(|e| panic!("failed to spawn grok at {program}: {e}"));
+        .unwrap_or_else(|e| panic!("failed to spawn kigi at {program}: {e}"));
 
     let stderr = Arc::new(std::sync::Mutex::new(Vec::new()));
     let stderr_capture = stderr.clone();

crates/codegen/kigi-test-support/src/sse.rs

@@ -1,6 +1,6 @@
 //! SSE stream generators for mock inference endpoints.
 //!
-//! These produce the exact wire format that the grok sampling client expects,
+//! These produce the exact wire format that the kigi sampling client expects,
 //! validated against the real sampling client.
 
 use axum::response::sse::Event;