F3: Kimi inference pipeline + full grok cloud-surface excision

Sampler / inference (PRD F3): - kimi_compat.rs: single adaptation point for the Kimi chat/completions dialect (thinking-field mapping, model_id stripping, empty-content tool-call message fix, stream_options.include_usage), with kimi-cli source citations - Rate-limit handling reworked for Kimi/Moonshot semantics; UA kigi/{version} - /models replaces the xAI models-v2 endpoint everywhere; idle model refresh carries X-Msh-* device headers only (X-XAI-Token-Auth and x-grok-client-mode/CLIENT_MODE_HEADER machinery deleted) Cloud-surface excision (PRD §5, zero-egress): - remote/ conversations lane, cli-chat-proxy-types crate, prod/ dir, share command, credit bar: deleted (single local session lane; paginate() replaces merge_and_paginate) - Subscription/tier gate stack deleted end-to-end: AppView gate/tier/team/ZDR fields, app/subscription.rs watch loop, dispatch/billing.rs paywall + SuperGrok upsell, free-usage-exhausted chain, tier-restricted commands, GateInfo, RemoteSettings gate fields, SettingsUpdateNotification gate fields - /privacy + coding-data-sharing setting deleted (backed by a dead xAI RPC; Kigi is zero-egress — nothing to share or retain remotely) Auth UX correctness (user-reported): - Device-flow fixtures now mirror the live Kimi payload shape (https://www.kimi.com/code/authorize_device?user_code=..., verified against auth.kimi.com); the fabricated auth.kimi.com/device?code=... URLs are gone - open_browser_detached is a no-op under cfg(test): unit tests drove wiremock fixture URLs into the real browser (root cause of the "garbage mock link" ABCD-1234 tabs) - Welcome/pager-minimal rebrand: Grok Build -> Kigi, grok.com -> kimi.com, "Sign in to Grok" -> "Sign in to Kimi"
2026-07-17 16:05:51 -04:00
parent fe1f885bb3
commit ea0ce9d15f
231 changed files with 4730 additions and 26358 deletions
@@ -9,8 +9,6 @@ description = "Shared config loading for Grok — kigi_home, effective config (r
 base64 = { workspace = true }
 blake3 = { workspace = true }
 dunce = { workspace = true }
-# Shared signed deployment-config envelope contract with the cli-chat-proxy signer.
-prod-mc-cli-chat-proxy-types = { path = "../../../prod/mc/cli-chat-proxy-types" }
 ring = { workspace = true }
 semver = { workspace = true }
 serde = { workspace = true }
@@ -8,7 +8,64 @@
 //! Inert until a public key is provisioned: with no embedded keys the cache
 //! marker stays the (best-effort) authority.
 use base64::Engine;
-pub use prod_mc_cli_chat_proxy_types::{SignatureEnvelope, SignedPayload, now_unix};
+use serde::{Deserialize, Serialize};
+
+/// The payload format version the server currently signs. Bump when the payload
+/// gains semantics (e.g. an anti-replay counter or a key-fingerprint binding) so
+/// verifiers can distinguish generations; `0` means a pre-versioned payload.
+pub const SIGNED_PAYLOAD_VERSION: u32 = 1;
+
+/// The exact bytes the server signs: the served policy, the principal it is
+/// bound to, and an expiry. Serialized once on the server and shipped verbatim
+/// as `signed_payload`, so the client verifies the received bytes directly
+/// instead of re-canonicalizing (no cross-language serialization drift).
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct SignedPayload {
+    /// Payload format version ([`SIGNED_PAYLOAD_VERSION`]); `default` 0 so
+    /// pre-versioned sidecars parse and verify unchanged.
+    #[serde(default)]
+    pub version: u32,
+    #[serde(default)]
+    pub deployment_id: Option<String>,
+    #[serde(default)]
+    pub team_id: Option<String>,
+    #[serde(default)]
+    pub managed_config: Option<String>,
+    #[serde(default)]
+    pub requirements: Option<String>,
+    /// Strict (fail-closed) opt-in, carried in the SIGNED bytes so a local actor can't
+    /// flip enforcement. `default` false so an older/unsigned payload stays lenient.
+    #[serde(default)]
+    pub fail_closed: bool,
+    /// Unix seconds after which the signature is no longer trusted.
+    pub expires_at: u64,
+    /// Identifies the signing key, so a rotation can be distinguished.
+    pub key_id: String,
+}
+
+/// One signed envelope carried alongside the legacy policy fields in the
+/// deployment-config response (additive: old clients ignore it). Also the
+/// shape the client persists as its on-disk signature sidecar.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SignatureEnvelope {
+    /// The exact JSON string that was signed (a serialized [`SignedPayload`]).
+    pub signed_payload: String,
+    /// Base64 (standard) Ed25519 signature over `signed_payload`'s UTF-8 bytes.
+    pub signature: String,
+    /// Untrusted (outside the signed bytes): a hint for picking among multiple
+    /// envelopes, never for selecting the verifying key — only the signed
+    /// payload's `key_id` is authoritative.
+    #[serde(default)]
+    pub key_id: String,
+}
+
+/// Unix seconds now (saturating to 0 on a pre-epoch clock).
+pub fn now_unix() -> u64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0)
+}
 /// Compiled-in trusted Ed25519 public keys, `(key_id, raw 32 bytes)`; more than one
 /// entry only during a rotation. Empty ships dark (see [`verification_active`]).
 /// Compile-time, not an env flag: the local attacker controls their env.
@@ -956,3 +956,28 @@ fn rotation_selects_the_trusted_key_by_signed_key_id() {
        Err(SigError::SignatureMismatch)
    );
 }
+
+/// The version field round-trips, and a pre-versioned payload (no `version`
+/// key) defaults to 0 — old sidecars keep parsing.
+#[test]
+fn signed_payload_version_round_trips_and_defaults() {
+    let versioned = SignedPayload {
+        version: SIGNED_PAYLOAD_VERSION,
+        deployment_id: None,
+        team_id: Some("team-007".into()),
+        managed_config: None,
+        requirements: None,
+        fail_closed: false,
+        expires_at: 4_000_000_000,
+        key_id: "v1".into(),
+    };
+    let json = serde_json::to_string(&versioned).unwrap();
+    assert_eq!(
+        serde_json::from_str::<SignedPayload>(&json).unwrap(),
+        versioned
+    );
+
+    let legacy: SignedPayload =
+        serde_json::from_str(r#"{"expires_at": 1, "key_id": "v1"}"#).unwrap();
+    assert_eq!(legacy.version, 0, "pre-versioned payloads default to 0");
+}
@@ -7,11 +7,21 @@ use crate::loader::{apply_version_overrides_with_registered, load_toml_file};
 use crate::paths::{system_config_dir, user_kigi_home};
 use crate::version_overrides::{VersionOverrideError, apply_version_overrides};

-use prod_mc_cli_chat_proxy_types::FAIL_CLOSED_KEY;
-/// The canonical opt-in key + string parse live in the shared types crate, next to
-/// the signed payload that carries the flag, so the server-side signer and this
-/// client parse the same semantics.
-pub use prod_mc_cli_chat_proxy_types::fail_closed_flag_from_str;
+/// The `requirements.toml` opt-in key for strict (fail-closed) enforcement.
+/// Lives next to the signed payload that carries the flag
+/// ([`crate::signed_policy::SignedPayload::fail_closed`]) so the two sides
+/// can't drift.
+pub const FAIL_CLOSED_KEY: &str = "fail_closed";
+
+/// Read the `fail_closed` opt-in from a requirements-TOML string — THE canonical
+/// parse shared by every caller so the semantics can't drift.
+/// Invalid TOML or a non-bool value → `false`.
+pub fn fail_closed_flag_from_str(requirements: &str) -> bool {
+    toml::from_str::<toml::Value>(requirements)
+        .ok()
+        .and_then(|v| v.get(FAIL_CLOSED_KEY).and_then(toml::Value::as_bool))
+        .unwrap_or(false)
+}

 /// Read the `fail_closed` opt-in from a parsed requirements layer — same semantics as
 /// [`fail_closed_flag_from_str`]. Env tightening (file vs `KIGI_MANAGED_CONFIG_FAIL_CLOSED`)