§9 acceptance: grep-zero sweep — every internal x.ai/grok identifier renamed

The PRD's first acceptance gate now holds: grep -RinE '\bx\.ai\b|grok'
crates/ --include='*.rs' → 0 matches (exempt: NOTICE and third-party
license archives, README provenance, and the required 'Based on Grok
Build Open Source' attribution, now sourced from version_attribution.txt).

Wire-visible renames (both sides in this repo, changed in lockstep):
- Auth method id 'grok.com' → 'kimi-code' (AuthMethodKind::KimiCode).
- Every x.ai/* and _x.ai/* ACP ext method and meta key → kigi/* /
  _kigi/* (~200 names; grokShell → kigiShell). Session-file replay keeps
  a read-side alias for the legacy '_x.ai/session/update' method so
  existing updates.jsonl histories load; writes emit only the new name
  (both directions test-pinned).
- Agent types grok-build* → kigi* with a documented legacy-prefix alias
  at resolution time so persisted sessions keep resolving.
- ToolNamespace/BuiltinAgentName GrokBuild* → Kigi* (wire snake_case
  kigi/kigi_concise/kigi_hashline; schema regenerated); grok_build
  implementation dirs renamed to kigi*.
- x-grok-* headers → x-kigi-*, __GROK_* sentinels → __KIGI_*, themes
  grokday/groknight → kigiday/kiginight (old persisted values fall back
  to the default theme), web_fetch allowlist xAI hosts → kimi.com +
  moonshot platforms, changelog CDN → this repo, grok-build changelog
  archives deleted.
- BYOK default endpoint removed: [endpoints] api_base_url is now truly
  optional with NO default — consumers fail fast with the flag name when
  unset (no silent x.ai egress). Mock harnesses inject it explicitly.
- System-prompt identity fixed: 'released by xAI' → 'an unofficial
  community CLI for Kimi' (template + regenerated encrypted form).

Also repaired pre-existing grok-era test debt found by the sweep: the
stale trace_classify default-model pin, the grok-pager UA label test,
pty-harness stale-binary reuse and non-hermetic moonshot routing (a PTY
test could previously reach the real api.moonshot.cn), and the outdated
oauth fixture scope key.

Gates: §9 grep 0; fmt clean; workspace check/clippy 0/0 (-D warnings);
FULL cargo test --workspace: 234 suites, 21,961 passed, 0 failed;
deny advisories ok.

crates/common/kigi-tool-protocol/tests/identifier_validation.rs

@@ -12,8 +12,8 @@ fn tool_id_accepts_bare_and_namespaced_names() {
     let bare = ToolId::new("read_file").unwrap();
     assert_eq!(bare.as_str(), "read_file");
 
-    let namespaced = ToolId::new("GrokBuild:read_file").unwrap();
-    assert_eq!(namespaced.as_str(), "GrokBuild:read_file");
+    let namespaced = ToolId::new("Kigi:read_file").unwrap();
+    assert_eq!(namespaced.as_str(), "Kigi:read_file");
 
     assert_eq!(
         ToolId::from_str("github:list_repos").unwrap().as_str(),
@@ -81,8 +81,8 @@ fn tool_id_rejects_empty_segments_around_separator() {
 
 #[test]
 fn tool_id_try_from_string_works() {
-    let id: ToolId = "GrokBuild:read_file".to_owned().try_into().unwrap();
-    assert_eq!(id.as_str(), "GrokBuild:read_file");
+    let id: ToolId = "Kigi:read_file".to_owned().try_into().unwrap();
+    assert_eq!(id.as_str(), "Kigi:read_file");
 }
 
 #[test]
@@ -116,15 +116,15 @@ fn server_id_synthesis_starts_with_auto_prefix() {
     let synth = ServerId::synthesize_for_tool(&conn, &bare);
     assert_eq!(synth.as_str(), "auto:tool:read_file");
 
-    let namespaced = ToolId::new("GrokBuild:read_file").unwrap();
+    let namespaced = ToolId::new("Kigi:read_file").unwrap();
     let synth_ns = ServerId::synthesize_for_tool(&conn, &namespaced);
-    assert_eq!(synth_ns.as_str(), "auto:tool:GrokBuild:read_file");
+    assert_eq!(synth_ns.as_str(), "auto:tool:Kigi:read_file");
 }
 
 #[test]
 fn server_id_synthesis_is_deterministic() {
     let conn = ConnectionId::new("conn-abc").unwrap();
-    let tool = ToolId::new("GrokBuild:read_file").unwrap();
+    let tool = ToolId::new("Kigi:read_file").unwrap();
     let a = ServerId::synthesize_for_tool(&conn, &tool);
     let b = ServerId::synthesize_for_tool(&conn, &tool);
     assert_eq!(

crates/common/kigi-tool-protocol/tests/jsonrpc_envelope.rs

@@ -217,7 +217,7 @@ fn full_call_envelope_serialises_to_expected_shape() {
         method: "tool.call".to_owned(),
         params: ToolCallParams {
             tool_call_id: ToolCallId::new("call_xyz").unwrap(),
-            tool_id: ToolId::new("GrokBuild:read_file").unwrap(),
+            tool_id: ToolId::new("Kigi:read_file").unwrap(),
             arguments: json!({"path": "/etc/hosts"}),
             deadline_ms: None,
             behavior_version: None,
@@ -230,7 +230,7 @@ fn full_call_envelope_serialises_to_expected_shape() {
     assert_eq!(v["id"], json!("req-9c4f"));
     assert_eq!(v["session_id"], json!("sess_abc"));
     assert_eq!(v["method"], json!("tool.call"));
-    assert_eq!(v["params"]["tool_id"], json!("GrokBuild:read_file"));
+    assert_eq!(v["params"]["tool_id"], json!("Kigi:read_file"));
     assert_eq!(v["params"]["tool_call_id"], json!("call_xyz"));
 }
 

crates/common/kigi-tool-protocol/tests/serde_roundtrip.rs

@@ -45,7 +45,7 @@ fn user() -> UserId {
 }
 
 fn tool() -> ToolId {
-    ToolId::new("GrokBuild:read_file").unwrap()
+    ToolId::new("Kigi:read_file").unwrap()
 }
 
 fn server() -> ServerId {
@@ -60,7 +60,7 @@ fn call_id() -> ToolCallId {
 fn id_types_round_trip_as_bare_strings() {
     assert_eq!(roundtrip(&session()), json!("sess_abc"));
     assert_eq!(roundtrip(&user()), json!("user_123"));
-    assert_eq!(roundtrip(&tool()), json!("GrokBuild:read_file"));
+    assert_eq!(roundtrip(&tool()), json!("Kigi:read_file"));
     assert_eq!(roundtrip(&server()), json!("srv-uuidv7"));
     assert_eq!(
         roundtrip(&ConnectionId::new("conn_42").unwrap()),
@@ -257,7 +257,7 @@ fn tool_registration_round_trips_with_and_without_server_id() {
         sessions: Some(vec![session()]),
         user_id: user(),
         server_id: None,
-        description: sample_description("read_file", Some("GrokBuild")),
+        description: sample_description("read_file", Some("Kigi")),
         input_schema: Some(json!({"type": "object"})),
         capabilities: None,
         notification_schemas: None,
@@ -392,7 +392,7 @@ fn registration_outcome_variants_round_trip() {
     for (outcome, expected_tag) in cases {
         let json = roundtrip(&outcome);
         assert_eq!(json["outcome"], json!(expected_tag));
-        assert_eq!(json["tool_id"], json!("GrokBuild:read_file"));
+        assert_eq!(json["tool_id"], json!("Kigi:read_file"));
     }
 }
 
@@ -847,7 +847,7 @@ fn tool_registration_round_trips() {
         sessions: Some(vec![session()]),
         user_id: user(),
         server_id: None,
-        description: ToolDescription::new("read_file", "d").with_namespace("GrokBuild"),
+        description: ToolDescription::new("read_file", "d").with_namespace("Kigi"),
         input_schema: None,
         capabilities: None,
         notification_schemas: None,
@@ -936,13 +936,13 @@ fn session_lifecycle_payloads_round_trip() {
     let bind_result = SessionBindServerResult {
         tools: vec![ToolDescription::new("my_tool", "desc")],
         binary_version: Some("1.0.15".to_owned()),
-        unserved_tool_ids: vec!["GrokBuild:monitor".to_owned()],
+        unserved_tool_ids: vec!["Kigi:monitor".to_owned()],
         resolve_error: Some("missing_tool_config: no explicit tool configuration".to_owned()),
     };
     let v = roundtrip(&bind_result);
     assert_eq!(v["tools"].as_array().unwrap().len(), 1);
     assert_eq!(v["binary_version"], json!("1.0.15"));
-    assert_eq!(v["unserved_tool_ids"], json!(["GrokBuild:monitor"]));
+    assert_eq!(v["unserved_tool_ids"], json!(["Kigi:monitor"]));
     assert_eq!(
         v["resolve_error"],
         json!("missing_tool_config: no explicit tool configuration")
@@ -1140,7 +1140,7 @@ fn hook_frame_round_trips_with_optional_fields() {
 fn session_event_turn_started_round_trips_via_re_export() {
     let event = SessionEvent::TurnStarted {
         turn_number: 10,
-        model_id: "grok-3".into(),
+        model_id: "kigi-3".into(),
         yolo_mode: true,
     };
     let v = roundtrip(&event);
@@ -1196,8 +1196,8 @@ fn tools_changed_round_trips_with_per_array_skip_when_empty() {
         updated: vec![tool()],
     };
     let v = roundtrip(&populated);
-    assert_eq!(v["added"][0], json!("GrokBuild:read_file"));
-    assert_eq!(v["updated"][0], json!("GrokBuild:read_file"));
+    assert_eq!(v["added"][0], json!("Kigi:read_file"));
+    assert_eq!(v["updated"][0], json!("Kigi:read_file"));
     assert!(!v.as_object().unwrap().contains_key("removed"));
 }
 
@@ -1479,12 +1479,12 @@ fn tool_error_wire_render_limited_omits_card_id_when_none() {
 #[test]
 fn tool_error_wire_terminal_error_round_trips_with_string_code() {
     let err = ToolErrorWire::TerminalError {
-        tool_id: ToolId::new("GrokBuild:bash").unwrap(),
+        tool_id: ToolId::new("Kigi:bash").unwrap(),
         message: "exit 137".to_owned(),
     };
     let v = roundtrip(&err);
     assert_eq!(v["code"], json!("terminal_error"));
-    assert_eq!(v["tool_id"], json!("GrokBuild:bash"));
+    assert_eq!(v["tool_id"], json!("Kigi:bash"));
     assert_eq!(v["message"], json!("exit 137"));
 }
 

crates/common/kigi-tool-protocol/tests/tool_id_derivation.rs

@@ -26,10 +26,8 @@ fn bare_name_derives_to_tool_id_without_namespace() {
 
 #[test]
 fn namespaced_name_derives_to_namespaced_tool_id() {
-    let derived = entry("read_file", Some("GrokBuild"))
-        .derive_tool_id()
-        .unwrap();
-    assert_eq!(derived, ToolId::new("GrokBuild:read_file").unwrap());
+    let derived = entry("read_file", Some("Kigi")).derive_tool_id().unwrap();
+    assert_eq!(derived, ToolId::new("Kigi:read_file").unwrap());
 }
 
 #[test]
@@ -58,9 +56,9 @@ fn empty_name_yields_empty_id_error() {
 #[test]
 fn duplicate_derivations_in_a_batch_are_detectable() {
     let batch = [
-        entry("read_file", Some("GrokBuild")),
-        entry("write_file", Some("GrokBuild")),
-        entry("read_file", Some("GrokBuild")),
+        entry("read_file", Some("Kigi")),
+        entry("write_file", Some("Kigi")),
+        entry("read_file", Some("Kigi")),
     ];
 
     let mut seen = std::collections::HashMap::new();
@@ -76,15 +74,13 @@ fn duplicate_derivations_in_a_batch_are_detectable() {
     }
     assert_eq!(duplicates.len(), 1, "exactly one duplicate id expected");
     let (id, indices) = &duplicates[0];
-    assert_eq!(id, &ToolId::new("GrokBuild:read_file").unwrap());
+    assert_eq!(id, &ToolId::new("Kigi:read_file").unwrap());
     assert_eq!(indices, &vec![0, 2]);
 }
 
 #[test]
 fn derivation_does_not_collide_across_namespaces() {
-    let a = entry("read_file", Some("GrokBuild"))
-        .derive_tool_id()
-        .unwrap();
+    let a = entry("read_file", Some("Kigi")).derive_tool_id().unwrap();
     let b = entry("read_file", Some("github")).derive_tool_id().unwrap();
     let c = entry("read_file", None).derive_tool_id().unwrap();
     assert_ne!(a, b);