FORGE-kimi-code

Kimi Code AAA Configuration

arifOS-ACT Embedding

Before using this skill on any mutating, irreversible, or high-blast-radius task:

1. ART — Attune (what is the real task?), Recognize (what class of power?), Test (fit · authority · evidence · blast · reversible).
2. Kernel — Route to arifOS for F1–F13 judgment if action class is Maker/Messenger/Mutator/Destroyer/Sovereign.
3. ACT — Apply narrow, Constrain scope, Trace witness, STOP before corruption.
4. Receipt — Leave evidence of what changed, why, and under whose authority.

When to Use

• Kimi Code CLI fails with LLM 404, MCP source: not found, or missing federation tools
• Migrating from legacy kimi-cli (uv, v1.47) to kimi-code (v0.18+)
• Onboarding Kimi as warga AAA (FI-008)
• Auditing mcp.json, config.toml, or KIMI_CODE_HOME drift

When NOT to Use

• Do not use to rotate secrets in kunci-root.env without 888_HOLD
• Do not enable default_yolo = true for constitutional work
• Do not wire A-FORGE HTTP :7071/mcp as primary ingress (single-session SDK limit)

Canonical Paths (af-forge VPS)

Official Docs

• Install & first launch: https://platform.kimi.ai/docs/guide/kimi-cli-support
• Config files: https://www.kimi.com/code/docs/kimi-code-cli/configuration/config-files.html
• MCP: https://moonshotai.github.io/kimi-cli/en/customization/mcp.html
• Migrate: kimi migrate (interactive — config only recommended)

Audit Checklist

1. Binary: which kimi → /usr/local/bin/kimi → exec ~/.kimi-code/bin/kimi
2. Home: echo $KIMI_CODE_HOME → /root/.kimi-code (ONE-HOME 2026-08-24)
3. Doctor: kimi doctor → OK config.toml
4. Auth: OAuth via /login — never use dead KIMI_API_KEY from kunci-root.env (causes 404)
5. MCP launchers: All stdio servers use mcp-launchers/*.sh (bash), not inline sh -lc with source
6. A-FORGE: stdio via aforge.sh — not HTTP for Kimi primary ingress
7. Serena: arifOS/.serena/project.yml and A-FORGE/.serena/project.yml exist
8. Warga: identity carried by $KIMI_CODE_HOME/SYSTEM.md (FI-008 preamble revived 2026-08-24) — [agent_identity] in config.toml is DEAD-v2 scaffolding, do not resurrect

Fix Patterns

LLM 404 resource_not_found_error

Root cause: stale KIMI_API_KEY in environment overrides OAuth.

unset KIMI_API_KEY
kimi login   # or /login in TUI
kimi doctor

Wrapper at /usr/local/bin/kimi already unsets KIMI_API_KEY.

sh: 35: source: not found

Root cause: MCP stdio launchers invoked via sh with bash-only source.

Fix: use dedicated bash scripts in mcp-launchers/ with #!/usr/bin/env bash and . /root/.env (not source).

MCP 11/13 connected, meyhem/github still loading

Ensure disabled: true on legacy servers in mcp.json. Start fresh session: /new.

Health Verification

# De-hardcoded v1.0.1 — ports sourced from federation organ registry
PROBE_HOST="${FEDERATION_PROBE_HOST:-127.0.0.1}"
REGISTRY="${FEDERATION_REGISTRY:-/root/AAA/federation/organs.yaml}"
PORTS=$(python3 -c "
import yaml, sys
try:
    with open('$REGISTRY') as f: r = yaml.safe_load(f)
    print(' '.join(str(o.get('port','')) for o in r.get('organs',[]) if o.get('port')))
except Exception as e:
    sys.stderr.write(f'registry read failed: {e}\n')
    sys.exit(1)
" 2>/dev/null) || PORTS="8088 8081 18082 18083 7071 3001"   # fallback to known-good if registry unreachable
for p in $PORTS; do
  curl -sf "http://$PROBE_HOST:$p/health" >/dev/null && echo ":$p OK" || echo ":$p FAIL"
done
kimi doctor

Escalation

De-hardcoding Log (v1.0.1)

• Health Verification ports — sourced from /root/AAA/federation/organs.yaml (organ registry), overridable via $FEDERATION_REGISTRY
• Probe host — $FEDERATION_PROBE_HOST env, defaults to 127.0.0.1 (LOCALHOST_IS_PASSWORD doctrine)
• A-FORGE source path — $AFORGE_HOME env, defaults to /root/A-FORGE (backward compatible)
• Fallback port list — kept inline as last-resort if registry read fails; mirrors known-good ports
• Canonical paths table (lines 83–90) — intentionally left as documentation, since these are reference material not executable code

DITEMPA BUKAN DIBERI.