M0: compilable skeleton — Kigi 0.1.0 fork surgery

Hard fork of xai-org/grok-build (Apache-2.0) re-targeted as Kigi, an
unofficial Kimi Code CLI community build.

Rename & identity
- 72 xai-*/xai-grok-* crates -> kigi-* (explicit: xai-grok-pager-bin ->
  kigi-bin [binary `kigi`], xai-grok-pager -> kigi-tui; rest mechanical);
  ptyctl, ptyctl-cli, third_party/ unchanged; proto package
  xai.grok.tools.v1 -> kigi.tools.v1
- Config home ~/.kigi (KIGI_SHARE_DIR override), env prefix GROK_* ->
  KIGI_*, `kigi --version` carries the unofficial-community-build notice
- clap identity, help text, startup banner, prompt templates rebranded
  (templates re-encrypted)

Deletions (PRD removal list #5/#6/#7/#9/#10)
- voice input (xai-grok-voice) and all TUI wiring
- telemetry: Mixpanel client, external OTel stream, Sentry, OTLP layers,
  trace/GCS/S3 upload queues (kigi-file-utils halved), workspace upload
  module & dc_log, heap-profile uploader, auth-diagnostics uploader,
  session-analytics halves of feedback; local zero-egress observability
  preserved in new kigi-log crate (unified log, --debug firehose,
  subsystem file logs, opt-in instrumentation)
- announcements (crate, remote-settings fields, TUI surfaces)
- plugin marketplace (crate, sources/browse/CTA/extensions-modal tab);
  direct plugin install/uninstall/update via kigi-agent git_install kept
- relay/gateway/assets endpoints and features (agent relay, headless
  relay transport, gateway bridge, LeaderEnvUrls); leader IPC socket now
  ~/.kigi/leader.sock + KIGI_LEADER_SOCKET, no ws-url derivation
- functional types rehomed instead of deleted: PermissionMode ->
  kigi-config-types, McpInitStrategy -> kigi-mcp, PrCreationSource ->
  session signals, TerminalDiagnostics -> kigi-pager-render, agent_id ->
  shell util

Endpoints
- kigi-env rewritten: single production KigiEndpoints {coding_api_base_url
  https://api.kimi.com/coding/v1 (KIGI_CODE_BASE_URL), oauth_host
  https://auth.kimi.com (KIGI_OAUTH_HOST), update_base_url (GitHub
  Releases API), upgrade_page_url}; GrokBuildEnvironment enum deleted

Toolchain & workspace hygiene
- Rust 1.97.0 pinned; edition 2024; full cargo update; git2 hoisted to
  workspace at 0.21 (Option->Result API migration), quick-xml 0.41
- Root Cargo.toml hand-maintained (PRD §8.1): version 0.1.0 inherited by
  all members, members sorted, unused deps pruned
- cargo-deny advisories gate (deny.toml with documented transitive
  exceptions); CI workflow (check/clippy/fmt/deny/test, macOS+Linux)
- cross-crate test seams re-gated behind `test-support` cargo feature;
  insta snapshot baselines renamed to the kigi_tui prefix
- clippy --workspace --all-targets: zero warnings; fmt clean

Fixes surfaced by the port
- updater probe/installer divergence (bin/kigi vs bin/grok symlink set)
- idle model-metadata refresh dead under KIGI_CODE_BASE_URL override
  (new is_effective_coding_endpoint_url, loopback+override aware)
- macOS symlinked-TMPDIR fixture canonicalization (foreign_sessions,
  fast-worktree); RSS measurement tests serialized via serial_test

Docs & legal (Apache §4)
- NOTICE added (upstream attribution + change statement); THIRD-PARTY
  notices sustained; kigi-tools ported-code notices extended; README,
  CONTRIBUTING, SECURITY, AGENTS.md rewritten

Out of scope for M0 (tracked): Kimi auth/inference (M1), search/fetch,
command parity, config import (M2), Computer Hub excision & final
brand-token sweep (M2), distribution & self-update rewrite (M3).

crates/codegen/kigi-shell/src/util/config/resolve/compaction.rs

@@ -0,0 +1,142 @@
+/// Default auto-compact threshold (% of context window) when no source sets it.
+pub const DEFAULT_AUTO_COMPACT_THRESHOLD_PERCENT: u8 = 85;
+
+/// Env-var override for `auto_compact_threshold_percent`. Parsed as `u8`;
+/// out-of-range or unparseable values are ignored.
+pub(crate) const ENV_AUTO_COMPACT_THRESHOLD_PERCENT: &str = "KIGI_AUTO_COMPACT_THRESHOLD_PERCENT";
+
+/// Resolve auto-compact threshold percent (0-100) for the given model.
+///
+/// Two scopes (per-model and global) across two tiers (user TOML and
+/// remote settings). User-tier always wins over remote; within a tier, per-model
+/// wins over global. Env var sits on top as a per-process override.
+///
+/// Precedence (highest first):
+///   1. env `KIGI_AUTO_COMPACT_THRESHOLD_PERCENT`
+///   2. user TOML `[model.<id>].auto_compact_threshold_percent`
+///      (read from `cfg.config_models`; the effective merge of user +
+///      managed `[model.<id>]` sections)
+///   3. user TOML `[session].auto_compact_threshold_percent`
+///      (read from `cfg.session.auto_compact_threshold_percent: Option<u8>`)
+///   4. remote settings per-model `ModelInfo.auto_compact_threshold_percent`
+///      (populated from `grok_build_models[i].auto_compact_threshold_percent`;
+///      intentionally NOT collapsed via `ConfigModelOverride::apply` so the
+///      user-vs-GB per-model distinction is preserved)
+///   5. remote settings global `RemoteSettings.auto_compact_threshold_percent`
+///      (populated from `grok_build_settings.auto_compact_threshold_percent`)
+///   6. default `DEFAULT_AUTO_COMPACT_THRESHOLD_PERCENT` (85)
+///
+/// Values outside `0..=100` from the env var are ignored with a debug log and
+/// the resolver falls through to the next tier. TOML/remote fields are typed
+/// `u8` and so naturally constrained.
+pub fn resolve_auto_compact_threshold_percent(
+    cfg: &crate::agent::config::Config,
+    model_id: &str,
+    model: Option<&crate::agent::config::ModelInfo>,
+) -> u8 {
+    resolve_auto_compact_threshold_percent_from_tiers(
+        cfg.config_models
+            .get(model_id)
+            .and_then(|m| m.auto_compact_threshold_percent),
+        cfg.session.auto_compact_threshold_percent,
+        model.and_then(|m| m.auto_compact_threshold_percent),
+        cfg.remote_settings
+            .as_ref()
+            .and_then(|r| r.auto_compact_threshold_percent),
+    )
+}
+
+/// Lower-level form of [`resolve_auto_compact_threshold_percent`] that takes
+/// the four tiers as plain `Option<u8>` values rather than reaching into a
+/// `Config`. Useful from sites that don't hold a `Config` reference (e.g.,
+/// subagent spawn paths where the parent's config tiers are plumbed in
+/// explicitly and the per-model lookup uses the SUBAGENT's resolved model id,
+/// not the parent's).
+///
+/// Precedence: env > `user_per_model` > `user_global` > `gb_per_model`
+/// > `gb_global` > `DEFAULT_AUTO_COMPACT_THRESHOLD_PERCENT`.
+pub fn resolve_auto_compact_threshold_percent_from_tiers(
+    user_per_model: Option<u8>,
+    user_global: Option<u8>,
+    gb_per_model: Option<u8>,
+    gb_global: Option<u8>,
+) -> u8 {
+    fn clamp_env(raw: i64) -> Option<u8> {
+        if (0..=100).contains(&raw) {
+            Some(raw as u8)
+        } else {
+            tracing::debug!(
+                source = "env",
+                value = raw,
+                "auto_compact_threshold_percent out of range 0..=100; ignoring"
+            );
+            None
+        }
+    }
+    let from_env = || -> Option<u8> {
+        std::env::var(ENV_AUTO_COMPACT_THRESHOLD_PERCENT)
+            .ok()
+            .and_then(|s| s.parse::<i64>().ok())
+            .and_then(clamp_env)
+    };
+
+    from_env()
+        .or(user_per_model)
+        .or(user_global)
+        .or(gb_per_model)
+        .or(gb_global)
+        .unwrap_or(DEFAULT_AUTO_COMPACT_THRESHOLD_PERCENT)
+}
+
+/// Client default per-compaction wall-clock budget (seconds). Fleet p99 of
+/// successful compactions is ~181s (≈225s at 400K+ input), so 300s clears the
+/// legit tail with margin while cutting a runaway from the ~600s deadline.
+pub const DEFAULT_COMPACTION_WALL_CLOCK_BUDGET_SECS: u64 = 300;
+
+/// Below this, a configured budget is almost certainly a misconfig (fleet
+/// success p99 ~181s); logged at `warn`, not clamped.
+const COMPACTION_WALL_CLOCK_BUDGET_WARN_SECS: u64 = 120;
+
+/// Env override for the compaction wall-clock budget (seconds). Parsed as
+/// `u64`; unparseable values fall through.
+const ENV_COMPACTION_WALL_CLOCK_BUDGET_SECS: &str = "KIGI_COMPACTION_WALL_CLOCK_SECS";
+
+/// Resolve the per-compaction wall-clock budget (seconds). Precedence: env
+/// `KIGI_COMPACTION_WALL_CLOCK_SECS` > remote settings global
+/// `RemoteSettings.compaction_wall_clock_budget_secs` >
+/// [`DEFAULT_COMPACTION_WALL_CLOCK_BUDGET_SECS`] (a per-model `ModelInfo` tier
+/// would slot in ahead of the global one).
+///
+/// `0` **disables** it. Low values are warned, not clamped — any "safe" clamp
+/// (e.g. 30s) would itself cut legit compactions, trading one silent failure for
+/// another; ops own the value.
+pub fn resolve_compaction_wall_clock_budget_secs(gb_global: Option<u64>) -> u64 {
+    let from_env = std::env::var(ENV_COMPACTION_WALL_CLOCK_BUDGET_SECS)
+        .ok()
+        .and_then(|s| s.trim().parse::<u64>().ok());
+    let resolved = from_env
+        .or(gb_global)
+        .unwrap_or(DEFAULT_COMPACTION_WALL_CLOCK_BUDGET_SECS);
+    if resolved > 0 && resolved < COMPACTION_WALL_CLOCK_BUDGET_WARN_SECS {
+        tracing::warn!(
+            budget_secs = resolved,
+            "compaction wall-clock budget {resolved}s is below {COMPACTION_WALL_CLOCK_BUDGET_WARN_SECS}s \
+             and may cut legitimate compactions (fleet success p99 ~181s); set 0 to disable"
+        );
+    }
+    resolved
+}
+
+#[cfg(test)]
+mod compaction_wall_clock_budget_tests {
+    use super::resolve_compaction_wall_clock_budget_secs as resolve;
+
+    // Assumes KIGI_COMPACTION_WALL_CLOCK_SECS is unset in the test env.
+    #[test]
+    fn default_global_disable_and_no_clamp() {
+        assert_eq!(resolve(None), 300); // client default
+        assert_eq!(resolve(Some(450)), 450); // server global wins
+        assert_eq!(resolve(Some(0)), 0); // 0 explicitly disables (no clamp)
+        assert_eq!(resolve(Some(5)), 5); // low values pass through (warned, not clamped)
+    }
+}