§9 acceptance: grep-zero sweep — every internal x.ai/grok identifier renamed

The PRD's first acceptance gate now holds: grep -RinE '\bx\.ai\b|grok'
crates/ --include='*.rs' → 0 matches (exempt: NOTICE and third-party
license archives, README provenance, and the required 'Based on Grok
Build Open Source' attribution, now sourced from version_attribution.txt).

Wire-visible renames (both sides in this repo, changed in lockstep):
- Auth method id 'grok.com' → 'kimi-code' (AuthMethodKind::KimiCode).
- Every x.ai/* and _x.ai/* ACP ext method and meta key → kigi/* /
  _kigi/* (~200 names; grokShell → kigiShell). Session-file replay keeps
  a read-side alias for the legacy '_x.ai/session/update' method so
  existing updates.jsonl histories load; writes emit only the new name
  (both directions test-pinned).
- Agent types grok-build* → kigi* with a documented legacy-prefix alias
  at resolution time so persisted sessions keep resolving.
- ToolNamespace/BuiltinAgentName GrokBuild* → Kigi* (wire snake_case
  kigi/kigi_concise/kigi_hashline; schema regenerated); grok_build
  implementation dirs renamed to kigi*.
- x-grok-* headers → x-kigi-*, __GROK_* sentinels → __KIGI_*, themes
  grokday/groknight → kigiday/kiginight (old persisted values fall back
  to the default theme), web_fetch allowlist xAI hosts → kimi.com +
  moonshot platforms, changelog CDN → this repo, grok-build changelog
  archives deleted.
- BYOK default endpoint removed: [endpoints] api_base_url is now truly
  optional with NO default — consumers fail fast with the flag name when
  unset (no silent x.ai egress). Mock harnesses inject it explicitly.
- System-prompt identity fixed: 'released by xAI' → 'an unofficial
  community CLI for Kimi' (template + regenerated encrypted form).

Also repaired pre-existing grok-era test debt found by the sweep: the
stale trace_classify default-model pin, the grok-pager UA label test,
pty-harness stale-binary reuse and non-hermetic moonshot routing (a PTY
test could previously reach the real api.moonshot.cn), and the outdated
oauth fixture scope key.

Gates: §9 grep 0; fmt clean; workspace check/clippy 0/0 (-D warnings);
FULL cargo test --workspace: 234 suites, 21,961 passed, 0 failed;
deny advisories ok.

crates/common/kigi-compaction/src/intra_compaction/compact.rs

@@ -30,7 +30,7 @@ use super::config::{IntraCompactionConfig, IntraCompactionMode, IntraSummarizer}
 use super::observer::IntraCompactionObserver;
 use super::traits::{CompactionStreamProc, CompactionTarget};
 use super::trigger::{IntraCompactionError, IntraCompactionResult, IntraCompactionTrigger};
-// The `Shared` summarizer reuses grok-build's full-replace summarization core
+// The `Shared` summarizer reuses kigi's full-replace summarization core
 // (the shared summarization core lives in `code_compaction`); intra_compaction intentionally
 // depends on `code_compaction` for it.
 use crate::code_compaction::{
@@ -196,14 +196,14 @@ where
     .await
 }
 
-/// `FullReplace` strategy (default): grok-build's full-replace — summarize the
+/// `FullReplace` strategy (default): kigi's full-replace — summarize the
 /// *whole* conversation (prior history + accumulated steps) in one pass and
 /// rebuild context from scratch via [`CompactionTarget::FullReplace`].
 ///
 /// Unlike the partial modes there is no tail-keep selection and no
-/// `<grok_user_queries>` preamble: the shared `code_compaction` summarizer
+/// `<kigi_user_queries>` preamble: the shared `code_compaction` summarizer
 /// (always [`IntraSummarizer::Shared`] here, regardless of `policy.summarizer`)
-/// preserves user intent itself, matching grok-build. The reduction and
+/// preserves user intent itself, matching kigi. The reduction and
 /// `min_compactable_tokens` guards are kept for parity with the partial modes.
 pub async fn apply_full_replace_compaction<T, S, P>(
     stream_proc: &S,
@@ -243,7 +243,7 @@ where
         "[IntraCompaction] starting full replace"
     );
 
-    // 2. Summarize the whole conversation through grok-build's shared core.
+    // 2. Summarize the whole conversation through kigi's shared core.
     //    FullReplace always uses the shared summarizer (it *is* the
     //    `code_compaction` path); `policy.summarizer` is ignored for this mode.
     let summary_text = sample_shared_summary_with_retries(sampler, &source_turns, policy).await?;
@@ -252,7 +252,7 @@ where
     //     the compaction. FullReplace drops the working tail, so append the
     //     harness-supplied `<system-reminder>` (verbatim ids) to the summary so
     //     the model can keep polling/cancelling them. Empty/None → no change.
-    //     Shared with Grok chat inter-compaction via `append_reminder_block` so
+    //     Shared with Kigi chat inter-compaction via `append_reminder_block` so
     //     both inject the reminder into the summary text identically, before the
     //     reduction guard below counts it.
     let summary_text = crate::append_reminder_block(summary_text, active_reminder);
@@ -483,10 +483,10 @@ where
         "[IntraCompaction] starting"
     );
 
-    // 3a. For `History` target, split prior `<grok_user_queries>` blocks
+    // 3a. For `History` target, split prior `<kigi_user_queries>` blocks
     //     out of any prior compaction summary items before sampling — same
     //     primitive inter-compaction uses, so the LLM never sees
-    //     `<grok_user_queries>` and won't re-emit it (which would snowball
+    //     `<kigi_user_queries>` and won't re-emit it (which would snowball
     //     with our explicit preamble across re-compactions). `Steps` target
     //     has no user-queries semantics and skips this entirely.
     let (turns_for_llm, prior_user_queries) = match target {
@@ -503,7 +503,7 @@ where
     // 3b. Sample the summary. The *summarization algorithm* is switchable via
     //     `policy.summarizer`; everything around it — tail selection, the
     //     reduction guard, the prefix-replace commit, the Steps/History modes,
-    //     and the `<grok_user_queries>` preamble below — stays intra's.
+    //     and the `<kigi_user_queries>` preamble below — stays intra's.
     let summary_text = match policy.summarizer {
         // Previous intra algorithm: per-target prompt, bounded retry, and NO
         // output cleaning — the raw model text flows straight to the preamble.
@@ -513,7 +513,7 @@ where
             sample_compaction_with_retries(sampler, &turns_for_llm, &prompt, timeout, policy)
                 .await?
         }
-        // New (default): grok-build's shared summarization core from
+        // New (default): kigi's shared summarization core from
         // `code_compaction` — `build_summary_prompt` + degenerate-reject +
         // `format_compact_summary` cleaning — run intra-locally.
         IntraSummarizer::Shared => {
@@ -521,7 +521,7 @@ where
         }
     };
 
-    // 3c. For `History` target, prepend a `<grok_user_queries>` preamble so
+    // 3c. For `History` target, prepend a `<kigi_user_queries>` preamble so
     //     the original user messages + attachment refs survive the
     //     summarization. Carries forward both prior (from earlier
     //     compactions) and current (from this round's `User` turns) via
@@ -631,14 +631,14 @@ fn build_prompt_for_target(
 
 /// `Shared` summarizer (default): sample through the shared retry loop
 /// [`sample_summary_with_retries`](crate::code_compaction::sample_summary_with_retries)
-/// — grok-build's summarization core (`build_summary_prompt` + bounded retry +
+/// — kigi's summarization core (`build_summary_prompt` + bounded retry +
 /// degenerate-reject + `format_compact_summary` cleaning) — then map the
 /// structured outcome onto [`IntraCompactionError`] and return the *cleaned*
 /// summary on success.
 ///
 /// The classification (degenerate/empty = transient; deterministic vs transient
 /// sampler errors, incl. context-length overflow) lives in the shared loop, so
-/// intra and grok-build stay in lock-step. Outcome mapping:
+/// intra and kigi stay in lock-step. Outcome mapping:
 /// - exhausted empty/degenerate run → [`IntraCompactionError::EmptyResponse`];
 /// - deterministic sampler error (incl. context overflow) →
 ///   [`IntraCompactionError::SamplerBuild`] (terminal);
@@ -656,7 +656,7 @@ where
     T: Send + Sync,
     P: CompactionSampler<Item = T> + ?Sized,
 {
-    // grok-build appends the summarization prompt as the final user message;
+    // kigi appends the summarization prompt as the final user message;
     // there is no separate system prompt for the compaction call.
     let prompt = CompactionPrompt {
         system: String::new(),
@@ -675,7 +675,7 @@ where
     )
     .await
     {
-        // grok-build returns the raw summary and cleans it in its assembler;
+        // kigi returns the raw summary and cleans it in its assembler;
         // intra has no assembler, so it cleans here (pre-refactor behavior).
         Ok(SampledSummary { summary, .. }) => Ok(format_compact_summary(&summary)),
         Err(SampleRetryError::Empty { .. }) => Err(IntraCompactionError::EmptyResponse),
@@ -694,7 +694,7 @@ where
 }
 
 /// Map an [`IntraCompactionError`] to a stable, low-cardinality `status`
-/// metric label. Keep these in sync with the doc string on Grok chat's
+/// metric label. Keep these in sync with the doc string on Kigi chat's
 /// `IntraCompactionCount` metric.
 pub fn error_status_label(err: &IntraCompactionError) -> &'static str {
     match err {
@@ -753,7 +753,7 @@ where
 /// summarizer).
 ///
 /// Structured variants map directly. The `Other` fallback string-matches
-/// the literal error messages produced by the Grok chat sampler —
+/// the literal error messages produced by the Kigi chat sampler —
 /// keep these in sync if either side changes (the
 /// `compaction_sample_error_to_intra*` tests below guard the mapping).
 fn compaction_sample_error_to_intra(err: CompactionSampleError) -> IntraCompactionError {
@@ -882,7 +882,7 @@ mod tests {
 
     #[test]
     fn compaction_sample_error_to_intra_maps_empty_response() {
-        // The literal message emitted by the Grok chat sampler when the
+        // The literal message emitted by the Kigi chat sampler when the
         // response channel produces no content.
         let intra = compaction_sample_error_to_intra(CompactionSampleError::Other(
             anyhow::anyhow!("Compaction scheduler returned no response channel content"),
@@ -1536,7 +1536,7 @@ mod tests {
     }
 
     /// `Arc<MockItem>` also satisfies the builder bound via the blanket impl
-    /// — guards the forwarding that Grok chat (`Arc<GrokTurn>`) relies on.
+    /// — guards the forwarding that Kigi chat (`Arc<KigiTurn>`) relies on.
     #[test]
     fn arc_blanket_impl_forwards_builder_methods() {
         let item = Arc::new(MockItem::user("hello"));

crates/common/kigi-compaction/src/intra_compaction/config.rs

@@ -4,7 +4,7 @@ use serde::{Deserialize, Serialize};
 
 /// Which targets intra-compaction may compact.
 ///
-/// - `FullReplace` (default): grok-build's full-replace strategy — summarize
+/// - `FullReplace` (default): kigi's full-replace strategy — summarize
 ///   the *whole* conversation (prior history + accumulated steps) and rebuild
 ///   context from scratch as `[system] + [summary]`. Drives the shared
 ///   `code_compaction` summarizer directly; no tail is kept.
@@ -56,7 +56,7 @@ pub enum IntraSummarizer {
 ///
 /// When `enabled = false` (default), no intra-compaction runs for that agent.
 ///
-/// Uses **percentage** thresholds (borrowed from grok-shell's
+/// Uses **percentage** thresholds (borrowed from kigi-shell's
 /// `CompactionPolicy`) for portability across models with different context
 /// windows.
 ///
@@ -65,7 +65,7 @@ pub enum IntraSummarizer {
 /// LLM call, audit) and a **mode-specific** block whose fields are each read by
 /// only a subset of modes (see the per-field `[...]` tags). In particular,
 /// `FullReplace` — the default — ignores `min_steps_before_compact` at trigger
-/// time (token threshold only, matching grok-build) and also ignores
+/// time (token threshold only, matching kigi) and also ignores
 /// `summarizer`, `target_threshold_percent`, `steps_trigger_ratio`, and
 /// `user_message_truncate_chars`. The field remains on this config for all
 /// modes (YAML / remote agent config / defaults); only enforcement is mode-dependent.
@@ -107,7 +107,7 @@ pub struct IntraCompactionConfig {
     /// **Enforcement:** applied for `StepsOnly` / `HistoryOnly` /
     /// `HistoryThenSteps`. **Ignored** when [`mode`](Self::mode) is
     /// [`IntraCompactionMode::FullReplace`] (token threshold alone, same idea
-    /// as grok-build full-replace auto-compact). Worthless early passes are
+    /// as kigi full-replace auto-compact). Worthless early passes are
     /// still limited by [`min_compactable_tokens`](Self::min_compactable_tokens)
     /// / reduction guards after a trigger.
     pub min_steps_before_compact: u32,
@@ -192,7 +192,7 @@ pub struct IntraCompactionConfig {
     //    preamble). --
     /// [HistoryOnly / HistoryThenSteps] Character threshold above which an
     /// original user message gets middle-truncated when included in the
-    /// `<grok_user_queries>` preamble prepended to the history compaction
+    /// `<kigi_user_queries>` preamble prepended to the history compaction
     /// summary. Mirrors the inter-compaction Basic threshold. Has no
     /// effect for `Steps` target — steps compaction has no user-queries
     /// preamble. Default: `3000`. (Not always exposed by remote agent-config

crates/common/kigi-compaction/src/intra_compaction/mod.rs

@@ -3,7 +3,7 @@
 //! [`CompactionItemBuilder`](crate::CompactionItemBuilder).
 //!
 //! Harness wiring (trigger call sites, LLM transport, metrics backends,
-//! state commit) stays per-harness; the Grok chat host
+//! state commit) stays per-harness; the Kigi chat host
 //! wraps these entry points with its tokenizer + metrics observers.
 
 pub mod compact;

crates/common/kigi-compaction/src/intra_compaction/observer.rs

@@ -1,10 +1,10 @@
 //! Observability seam for intra-compaction.
 //!
 //! The shared orchestrator reports terminal outcomes through this trait so
-//! each harness can emit its own metrics (Grok chat: its own metrics
+//! each harness can emit its own metrics (Kigi chat: its own metrics
 //! counters/histograms in the harness crate)
 //! without the shared crate depending on a metrics backend. Emission points
-//! and label values are part of the behavior contract — Grok chat's
+//! and label values are part of the behavior contract — Kigi chat's
 //! observer preserves them byte-for-byte.
 
 use std::time::Duration;

crates/common/kigi-compaction/src/intra_compaction/traits.rs

@@ -20,7 +20,7 @@ pub enum CompactionTarget {
     /// inter-compaction.
     History,
     /// Replace the *whole* conversation (prior history + accumulated steps)
-    /// with a single summary — grok-build's full-replace strategy. No tail is
+    /// with a single summary — kigi's full-replace strategy. No tail is
     /// kept; the read-view is [`CompactionStreamProc::get_all_turns_for_compaction`].
     FullReplace,
 }
@@ -37,8 +37,8 @@ impl CompactionTarget {
 }
 
 /// Minimal interface the compaction orchestrator needs from the agent's
-/// stream processor. Implemented by Grok chat's
-/// `StreamProcessor` (`Item = Arc<GrokTurn>`).
+/// stream processor. Implemented by Kigi chat's
+/// `StreamProcessor` (`Item = Arc<KigiTurn>`).
 ///
 /// Two read-views are exposed:
 ///
@@ -89,7 +89,7 @@ pub trait CompactionStreamProc: Send + Sync {
     ///
     /// The `Self::Item: Send` bound lets the default hold the history vec across
     /// the second `await` while keeping the boxed future `Send`; every concrete
-    /// item type (`Arc<GrokTurn>`) already satisfies it.
+    /// item type (`Arc<KigiTurn>`) already satisfies it.
     async fn get_all_turns_for_compaction(&self) -> Vec<Self::Item>
     where
         Self::Item: Send,

crates/common/kigi-compaction/src/intra_compaction/trigger.rs

@@ -111,7 +111,7 @@ pub enum IntraCompactionError {
 /// `min_steps_before_compact` remains on [`IntraCompactionConfig`] for every
 /// mode, but is **not** enforced when
 /// [`mode`](IntraCompactionConfig::mode) is
-/// [`IntraCompactionMode::FullReplace`] — that path matches grok-build's
+/// [`IntraCompactionMode::FullReplace`] — that path matches kigi's
 /// full-replace trigger (token threshold alone) so a large first-step prompt
 /// can still compact. Partial modes still gate on min steps.
 pub fn should_compact(
@@ -200,7 +200,7 @@ mod tests {
         assert_eq!(p.mode, IntraCompactionMode::FullReplace);
         assert_eq!(p.min_steps_before_compact, 3);
         // Field is present; FullReplace only uses the token threshold
-        // (parity with grok-build auto-compact).
+        // (parity with kigi auto-compact).
         let t = should_compact(&p, 90_000, 100_000, 0).expect("should trigger");
         assert_eq!(t.step, 0);
         assert!(should_compact(&p, 90_000, 100_000, 2).is_some());