# FORGE-kimi-code

> Configure, audit, and align Kimi Code CLI as AAA warga FI-008 with arifOS kernel and A-FORGE stdio actuator.

- Skill: `ariffazil/forge-kimi-code` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add ariffazil/forge-kimi-code`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ariffazil/forge-kimi-code/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: ariffazil (https://skillmd.com/u/ariffazil)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/ariffazil/forge-kimi-code

---


# Kimi Code AAA Configuration

## arifOS-ACT Embedding

Before using this skill on any mutating, irreversible, or high-blast-radius task:
1. **ART** — Attune (what is the real task?), Recognize (what class of power?), Test (fit · authority · evidence · blast · reversible).
2. **Kernel** — Route to arifOS for F1–F13 judgment if action class is Maker/Messenger/Mutator/Destroyer/Sovereign.
3. **ACT** — Apply narrow, Constrain scope, Trace witness, STOP before corruption.
4. **Receipt** — Leave evidence of what changed, why, and under whose authority.


## When to Use

- Kimi Code CLI fails with LLM 404, MCP `source: not found`, or missing federation tools
- Migrating from legacy `kimi-cli` (uv, v1.47) to `kimi-code` (v0.18+)
- Onboarding Kimi as warga AAA (FI-008)
- Auditing `mcp.json`, `config.toml`, or `KIMI_CODE_HOME` drift

## When NOT to Use

- Do not use to rotate secrets in `kunci-root.env` without 888_HOLD
- Do not enable `default_yolo = true` for constitutional work
- Do not wire A-FORGE HTTP `:7071/mcp` as primary ingress (single-session SDK limit)

## Canonical Paths (af-forge VPS)

| Path | Purpose |
|------|---------|
| `/root/.kimi-code/bin/kimi` | kimi-code binary (v0.41.0 = upstream latest, verified 2026-09-07; npm `@moonshot-ai/kimi-code`) |
| `/usr/local/bin/kimi` | Federation wrapper (sets `KIMI_CODE_HOME`, unsets dead `KIMI_API_KEY`) |
| `/root/.kimi-code` | `$KIMI_CODE_HOME` — ONE-HOME 2026-08-24 (was `.arifos/agents/kimi`, now the identity archive: hooks/launchers/agents live there, referenced by absolute path) |
| `/root/.kimi-code/mcp.json` | User-global MCP — count = this file, do not hardcode (13 entries, 8 enabled / 5 disabled at 2026-09-07; legacy copy at `.arifos/agents/kimi/mcp.json` is archive) |
| `/root/.mcp.json` | Project-root MCP when cwd is `/root` |
| `/root/AAA/agents/kimi-code/WARGAAA_CARD.md` | Warga identity card |

## Official Docs

- Install & first launch: https://platform.kimi.ai/docs/guide/kimi-cli-support
- Config files: https://www.kimi.com/code/docs/kimi-code-cli/configuration/config-files.html
- MCP: https://moonshotai.github.io/kimi-cli/en/customization/mcp.html
- Migrate: `kimi migrate` (interactive — config only recommended)

## Audit Checklist

1. **Binary:** `which kimi` → `/usr/local/bin/kimi` → exec `~/.kimi-code/bin/kimi`
2. **Home:** `echo $KIMI_CODE_HOME` → `/root/.kimi-code` (ONE-HOME 2026-08-24)
3. **Doctor:** `kimi doctor` → `OK config.toml`
4. **Auth:** OAuth via `/login` — **never** use dead `KIMI_API_KEY` from `kunci-root.env` (causes 404)
5. **MCP launchers:** All stdio servers use `mcp-launchers/*.sh` (bash), not inline `sh -lc` with `source`
6. **A-FORGE:** stdio via `aforge.sh` — not HTTP for Kimi primary ingress
7. **Serena:** `arifOS/.serena/project.yml` and `A-FORGE/.serena/project.yml` exist
8. **Warga:** identity carried by `$KIMI_CODE_HOME/SYSTEM.md` (FI-008 preamble revived 2026-08-24) — `[agent_identity]` in config.toml is DEAD-v2 scaffolding, do not resurrect

## Fix Patterns

### LLM 404 `resource_not_found_error`

Root cause: stale `KIMI_API_KEY` in environment overrides OAuth.

```bash
unset KIMI_API_KEY
kimi login   # or /login in TUI
kimi doctor
```

Wrapper at `/usr/local/bin/kimi` already unsets `KIMI_API_KEY`.

### `sh: 35: source: not found`

Root cause: MCP stdio launchers invoked via `sh` with bash-only `source`.

Fix: use dedicated bash scripts in `mcp-launchers/` with `#!/usr/bin/env bash` and `. /root/.env` (not `source`).

### MCP 11/13 connected, meyhem/github still loading

Ensure `disabled: true` on legacy servers in `mcp.json`. Start fresh session: `/new`.

## Health Verification

```bash
# De-hardcoded v1.0.1 — ports sourced from federation organ registry
PROBE_HOST="${FEDERATION_PROBE_HOST:-127.0.0.1}"
REGISTRY="${FEDERATION_REGISTRY:-/root/AAA/federation/organs.yaml}"
PORTS=$(python3 -c "
import yaml, sys
try:
    with open('$REGISTRY') as f: r = yaml.safe_load(f)
    print(' '.join(str(o.get('port','')) for o in r.get('organs',[]) if o.get('port')))
except Exception as e:
    sys.stderr.write(f'registry read failed: {e}\n')
    sys.exit(1)
" 2>/dev/null) || PORTS="8088 8081 18082 18083 7071 3001"   # fallback to known-good if registry unreachable
for p in $PORTS; do
  curl -sf "http://$PROBE_HOST:$p/health" >/dev/null && echo ":$p OK" || echo ":$p FAIL"
done
kimi doctor
```

## Escalation

| Condition | Action |
|-----------|--------|
| OAuth revoked | `/login` in Kimi TUI |
| A-FORGE stdio fails | `cd ${AFORGE_HOME:-/root/A-FORGE} && npm run build` then retry |
| Cross-repo architecture change | 888_HOLD → Arif |

## De-hardcoding Log (v1.0.1)

- **Health Verification ports** — sourced from `/root/AAA/federation/organs.yaml` (organ registry), overridable via `$FEDERATION_REGISTRY`
- **Probe host** — `$FEDERATION_PROBE_HOST` env, defaults to `127.0.0.1` (LOCALHOST_IS_PASSWORD doctrine)
- **A-FORGE source path** — `$AFORGE_HOME` env, defaults to `/root/A-FORGE` (backward compatible)
- **Fallback port list** — kept inline as last-resort if registry read fails; mirrors known-good ports
- **Canonical paths table** (lines 83–90) — intentionally left as documentation, since these are reference material not executable code

DITEMPA BUKAN DIBERI.