M0: compilable skeleton — Kigi 0.1.0 fork surgery

Hard fork of xai-org/grok-build (Apache-2.0) re-targeted as Kigi, an
unofficial Kimi Code CLI community build.

Rename & identity
- 72 xai-*/xai-grok-* crates -> kigi-* (explicit: xai-grok-pager-bin ->
  kigi-bin [binary `kigi`], xai-grok-pager -> kigi-tui; rest mechanical);
  ptyctl, ptyctl-cli, third_party/ unchanged; proto package
  xai.grok.tools.v1 -> kigi.tools.v1
- Config home ~/.kigi (KIGI_SHARE_DIR override), env prefix GROK_* ->
  KIGI_*, `kigi --version` carries the unofficial-community-build notice
- clap identity, help text, startup banner, prompt templates rebranded
  (templates re-encrypted)

Deletions (PRD removal list #5/#6/#7/#9/#10)
- voice input (xai-grok-voice) and all TUI wiring
- telemetry: Mixpanel client, external OTel stream, Sentry, OTLP layers,
  trace/GCS/S3 upload queues (kigi-file-utils halved), workspace upload
  module & dc_log, heap-profile uploader, auth-diagnostics uploader,
  session-analytics halves of feedback; local zero-egress observability
  preserved in new kigi-log crate (unified log, --debug firehose,
  subsystem file logs, opt-in instrumentation)
- announcements (crate, remote-settings fields, TUI surfaces)
- plugin marketplace (crate, sources/browse/CTA/extensions-modal tab);
  direct plugin install/uninstall/update via kigi-agent git_install kept
- relay/gateway/assets endpoints and features (agent relay, headless
  relay transport, gateway bridge, LeaderEnvUrls); leader IPC socket now
  ~/.kigi/leader.sock + KIGI_LEADER_SOCKET, no ws-url derivation
- functional types rehomed instead of deleted: PermissionMode ->
  kigi-config-types, McpInitStrategy -> kigi-mcp, PrCreationSource ->
  session signals, TerminalDiagnostics -> kigi-pager-render, agent_id ->
  shell util

Endpoints
- kigi-env rewritten: single production KigiEndpoints {coding_api_base_url
  https://api.kimi.com/coding/v1 (KIGI_CODE_BASE_URL), oauth_host
  https://auth.kimi.com (KIGI_OAUTH_HOST), update_base_url (GitHub
  Releases API), upgrade_page_url}; GrokBuildEnvironment enum deleted

Toolchain & workspace hygiene
- Rust 1.97.0 pinned; edition 2024; full cargo update; git2 hoisted to
  workspace at 0.21 (Option->Result API migration), quick-xml 0.41
- Root Cargo.toml hand-maintained (PRD §8.1): version 0.1.0 inherited by
  all members, members sorted, unused deps pruned
- cargo-deny advisories gate (deny.toml with documented transitive
  exceptions); CI workflow (check/clippy/fmt/deny/test, macOS+Linux)
- cross-crate test seams re-gated behind `test-support` cargo feature;
  insta snapshot baselines renamed to the kigi_tui prefix
- clippy --workspace --all-targets: zero warnings; fmt clean

Fixes surfaced by the port
- updater probe/installer divergence (bin/kigi vs bin/grok symlink set)
- idle model-metadata refresh dead under KIGI_CODE_BASE_URL override
  (new is_effective_coding_endpoint_url, loopback+override aware)
- macOS symlinked-TMPDIR fixture canonicalization (foreign_sessions,
  fast-worktree); RSS measurement tests serialized via serial_test

Docs & legal (Apache §4)
- NOTICE added (upstream attribution + change statement); THIRD-PARTY
  notices sustained; kigi-tools ported-code notices extended; README,
  CONTRIBUTING, SECURITY, AGENTS.md rewritten

Out of scope for M0 (tracked): Kimi auth/inference (M1), search/fetch,
command parity, config import (M2), Computer Hub excision & final
brand-token sweep (M2), distribution & self-update rewrite (M3).

crates/common/kigi-computer-hub-sdk/src/donate_pump.rs

@@ -0,0 +1,206 @@
+//! Shared donation transport: a bounded retry buffer + in-order drain
+//! barrier, parameterized over a `donate` closure. Traces, logs, and
+//! metrics all pump through this; failed sends are retained briefly,
+//! overflow drops payloads — telemetry, never correctness.
+
+use std::collections::VecDeque;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use opentelemetry_proto::tonic::common::v1::{AnyValue, KeyValue, any_value};
+use opentelemetry_proto::tonic::resource::v1::Resource;
+use tokio::sync::{mpsc, oneshot};
+
+/// Bound on payloads queued before the pump drains them.
+pub(crate) const PENDING_FLUSHES: usize = 8;
+/// Payloads retained across failed sends (disconnect/reconnect window).
+pub(crate) const RETRY_CAP: usize = 8;
+
+// ---------------------------------------------------------------------------
+// Shared OTLP encoding helpers
+//
+// Reused by the log and metric donation clients so the AnyValue/KeyValue/
+// Resource construction lives in one place instead of being copy-pasted per
+// client. (`trace_donate` builds its payload via `opentelemetry_sdk`'s own
+// conversion and does not use these.)
+// ---------------------------------------------------------------------------
+
+/// Current wall-clock time as Unix-epoch nanoseconds (OTLP `time_unix_nano`).
+pub(crate) fn now_unix_nanos() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_nanos() as u64)
+        .unwrap_or(0)
+}
+
+/// OTLP string `AnyValue`.
+pub(crate) fn string_value(s: String) -> AnyValue {
+    AnyValue {
+        value: Some(any_value::Value::StringValue(s)),
+    }
+}
+
+/// OTLP string-valued `KeyValue`.
+pub(crate) fn string_kv(key: &str, value: String) -> KeyValue {
+    KeyValue {
+        key: key.to_owned(),
+        value: Some(string_value(value)),
+        ..Default::default()
+    }
+}
+
+/// OTLP `Resource` carrying just `service.name`.
+pub(crate) fn make_resource(service_name: String) -> Resource {
+    Resource {
+        attributes: vec![string_kv("service.name", service_name)],
+        ..Default::default()
+    }
+}
+
+pub(crate) enum PumpMsg {
+    /// Base64 OTLP request, ready for the wire.
+    Payload(String),
+    /// In-order drain fence — a barrier, not a timeout.
+    Barrier(oneshot::Sender<()>),
+}
+
+/// Resolves once every payload queued before this call has had a send
+/// attempt. Call after the producer's flush (e.g. `fastrace::flush()`).
+pub(crate) async fn drain_via(tx: &mpsc::Sender<PumpMsg>) {
+    let (ack_tx, ack_rx) = oneshot::channel();
+    if tx.send(PumpMsg::Barrier(ack_tx)).await.is_ok() {
+        let _ = ack_rx.await;
+    }
+}
+
+/// `donate` hands the payload back so a failed send retains it
+/// without cloning.
+pub(crate) async fn run_pump<D, F>(mut rx: mpsc::Receiver<PumpMsg>, donate: D)
+where
+    D: Fn(String) -> F,
+    F: std::future::Future<Output = (bool, String)>,
+{
+    let mut retry: VecDeque<String> = VecDeque::new();
+    while let Some(msg) = rx.recv().await {
+        match msg {
+            PumpMsg::Payload(payload) => {
+                if retry.len() == RETRY_CAP {
+                    retry.pop_front();
+                    tracing::debug!("donation retry buffer full; dropping oldest payload");
+                }
+                retry.push_back(payload);
+            }
+            PumpMsg::Barrier(ack) => {
+                attempt_sends(&mut retry, &donate).await;
+                let _ = ack.send(());
+                continue;
+            }
+        }
+        attempt_sends(&mut retry, &donate).await;
+    }
+}
+
+/// Send in order, stopping at the first failure; the remainder stays
+/// queued for the next wake.
+async fn attempt_sends<D, F>(retry: &mut VecDeque<String>, donate: &D)
+where
+    D: Fn(String) -> F,
+    F: std::future::Future<Output = (bool, String)>,
+{
+    while let Some(payload) = retry.pop_front() {
+        let (ok, payload) = donate(payload).await;
+        if !ok {
+            tracing::debug!("donation send failed; retaining payload for retry");
+            retry.push_front(payload);
+            break;
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Arc;
+    use std::sync::atomic::{AtomicBool, Ordering};
+
+    use parking_lot::Mutex;
+
+    use super::*;
+
+    fn payload(tag: u64) -> PumpMsg {
+        PumpMsg::Payload(format!("payload-{tag}"))
+    }
+
+    /// The drain barrier acks even while the link is down.
+    #[tokio::test]
+    async fn pump_retries_failed_payloads_across_reconnect() {
+        let healthy = Arc::new(AtomicBool::new(false));
+        let sent: Arc<Mutex<Vec<String>>> = Arc::new(Mutex::new(Vec::new()));
+        let (tx, rx) = mpsc::channel::<PumpMsg>(PENDING_FLUSHES);
+        let pump = {
+            let healthy = Arc::clone(&healthy);
+            let sent = Arc::clone(&sent);
+            tokio::spawn(run_pump(rx, move |p: String| {
+                let healthy = Arc::clone(&healthy);
+                let sent = Arc::clone(&sent);
+                async move {
+                    if healthy.load(Ordering::SeqCst) {
+                        sent.lock().push(p.clone());
+                        (true, p)
+                    } else {
+                        (false, p)
+                    }
+                }
+            }))
+        };
+
+        tx.send(payload(1)).await.unwrap();
+        tx.send(payload(2)).await.unwrap();
+        drain_via(&tx).await;
+        assert!(sent.lock().is_empty(), "nothing sent while link is down");
+
+        healthy.store(true, Ordering::SeqCst);
+        drain_via(&tx).await;
+        assert_eq!(*sent.lock(), vec!["payload-1", "payload-2"]);
+
+        drop(tx);
+        pump.await.expect("pump must exit cleanly");
+    }
+
+    #[tokio::test]
+    async fn pump_retry_buffer_drops_oldest_beyond_cap() {
+        let sent: Arc<Mutex<Vec<String>>> = Arc::new(Mutex::new(Vec::new()));
+        let healthy = Arc::new(AtomicBool::new(false));
+        let (tx, rx) = mpsc::channel::<PumpMsg>(RETRY_CAP + 2);
+        let pump = {
+            let healthy = Arc::clone(&healthy);
+            let sent = Arc::clone(&sent);
+            tokio::spawn(run_pump(rx, move |p: String| {
+                let healthy = Arc::clone(&healthy);
+                let sent = Arc::clone(&sent);
+                async move {
+                    if healthy.load(Ordering::SeqCst) {
+                        sent.lock().push(p.clone());
+                        (true, p)
+                    } else {
+                        (false, p)
+                    }
+                }
+            }))
+        };
+
+        for i in 0..=(RETRY_CAP as u64) {
+            tx.send(payload(i + 1)).await.unwrap();
+        }
+        drain_via(&tx).await;
+
+        healthy.store(true, Ordering::SeqCst);
+        drain_via(&tx).await;
+        {
+            let sent = sent.lock();
+            assert_eq!(sent.len(), RETRY_CAP, "buffer bounded at RETRY_CAP");
+            assert_eq!(sent[0], "payload-2", "oldest payload evicted first");
+        }
+
+        drop(tx);
+        pump.await.expect("pump must exit cleanly");
+    }
+}