# Roadmap

Current direction for plugin 2.5.2 and exact Kimi Code CLI 2.4.1 certification, updated 2026-11-02. The original filename is retained so existing links keep working. Release validation and publication evidence live in the [certification record](docs/upstream-2.4.1-certification.md), release notes, and [registry release log](docs/registry-releases.md).

For installation, start with the [multilingual README](./README.md). For release details, see the [changelog](./CHANGELOG.md). The exact compatibility table lives in [runtime/kimi-engine.ts](./runtime/kimi-engine.ts); the standing safety contracts live in [AGENTS.md](./AGENTS.md) and [docs/invariants.md](./docs/invariants.md).

## Where the project stands

The plugin supports **Claude Code, Codex, and DeepSeek Harness** through the same subprocess-first runtime. Each job retains one ordinary `kimi -p` prompt runner; DSH providers launch that same companion through the host's managed subprocess service rather than adding an ACP transport. On versions requiring swarm activation (currently exact 2.3.2, 2.3.3, 2.4.0 and 2.4.1), short-lived authenticated loopback `kimi web` processes activate and deactivate the same-job session around that runner; this is not a full RPC transport. The native-v2 safety model keeps plan mode unreachable in plugin-managed sessions and checks compatibility before spawning Kimi.

Plugin 2.5.2 preserves DSH as a third host with all seven operations and root-only npm distribution, hardens setup recovery, and requires explicitly patched DSH host/profile dependencies. Exact kimi-code 2.4.1 remains certified for all eight operations, along with every previously certified version. Plugin versions advance independently using ordinary SemVer; no version number substitutes for certification evidence.

| Available now | What that means for users |
| --- | --- |
| Ask, review and challenge | Read-only repository questions, diff reviews and adversarial feedback |
| Rescue | Bounded work in the user's working tree, with resumable sessions |
| Swarm and write-swarm | Parallel read-only reviews, or edits in a temporary worktree returned as a patch |
| Pursue (experimental) | Multi-turn, write-capable goal pursuit with a mandatory time budget |
| Jobs and cancellation | Persisted results, status, resume where supported, and process-tree teardown on POSIX |
| Model selection | Credential-safe offline inventory, explicit per-task aliases and native provider-setup guidance |
| Host setup | Separate Claude Code and Codex hooks, verified before managed work |
| Onboarding | English, Simplified Chinese, French and Japanese guides in one expandable README |
| Distribution | GitHub marketplaces plus the complete [`kimi-plugin-cc` npm package](https://www.npmjs.com/package/kimi-plugin-cc); future releases use GitHub OIDC publishing |

The optional Claude Code review gate remains disabled by default. Model listing does not test provider connectivity. A successful Moonshot K3 API test establishes that route, not universal support for every provider/model combination.

## Current priorities

These are maintenance commitments and open investigations, not promised release dates.

| Work | Status | Next useful step / completion evidence |
| --- | --- | --- |
| Certify upstream releases | Ongoing, required before extending support | Exact source audit, non-vacuous live controls, per-operation smoke that proves distinct swarm children and child-authored work, and full repository check. See the [compatibility playbook](./docs/upstream-compat-audit.md). |
| Plugin data-directory ownership ([#13](https://github.com/linxule/kimi-plugin-cc/issues/13)) | Fixed in 2.0.1 | Installed-package and worker regressions cover conflicting variables, existing state, explicit custom locations, symlink aliases, and visible Stop-hook skips. |
| Hook failure after verification (H1) | Read-only DETECTION slice delivered in 2.2.1; enforcement deferred | Pure-policy result monitor records `hook_escapes` on the job (status/result --json, stderr notice); never fails the run — the stream has no outcome field, and pre-hook upstream rejections, coexisting hooks and the repeat breaker produce the same text as drift. Open: enforcement on positive execution evidence (upstream `outcome` field — filed as MoonshotAI/kimi-code#4241 — or a hook trace), filesystem-dependent write coverage, swarm subagent calls, a setup-time coexisting-hook note. |
| Per-task thinking control (H5) | Closed as a requested knob in 2.2.1 | `--thinking <effort>` requests effort via env; provider/model no-op cases and absent stream-json deltas prevent claiming enforcement. |
| Subscription selection and fallback | Capability spike complete; blocked on upstream interfaces | [Specification](./docs/subscription-switching-spec.md) and [2.0.1 audit](./docs/subscription-capability-audit.md): regional selection first, then opt-in read-only ask continuation. Exact-source probes and review establish missing atomic routing, terminal quota evidence and exclusive failed-turn recovery. No feature release assigned. |
| Plan-mode safety | Current no-plan contract remains in force | An upstream ordering change needs source proof and real lifecycle tests before any relaxation. See the [native-v2 status](./docs/native-v2-status.md). |
| Multilingual onboarding | Delivered in this documentation follow-up; ongoing upkeep | Keep all four guides aligned when setup, commands, model selection or safety boundaries change. Detailed engineering docs remain in English. |

## Deliberate boundaries

- **POSIX first:** macOS/Linux shell entrypoints; Windows support is not currently offered.
- **No automatic application of swarm patches or Git commits:** the user or host owns those decisions.
- **No hidden model substitution or credential collection in chat:** provider setup stays in native Kimi; per-task model selection leaves the saved default alone.
- **No plan-mode workaround:** use the certified runtime path and fix the reported configuration or version mismatch.
- **No general RPC or model-activation workaround:** one ordinary print runner remains the model path. Exact 2.3.2, 2.3.3, 2.4.0 and 2.4.1 swarm uses only authenticated loopback activation/deactivation; activation shares the existing job budget, and verified cleanup is required for success.
- **Real model tests remain opt-in:** local certification and manual CI smoke use an authenticated account and incur model usage. The ordinary CI build/test gate runs without provider credentials. Enabling per-push paid smoke is a cost decision, not an unfinished implementation (H7).

## How work ships

1. Define the behavior and affected contracts; retain the distinction between source evidence, live evidence and untested assumptions.
2. Make the change in the runtime or surface sources and regenerate bundled artifacts when required.
3. Run the checks appropriate to the change and the required `bun run check`. Compatibility changes also require the exact-version live gates.
4. Record the result here or in the changelog. Publish only after release authorization; install and verify each host separately.

Documentation-only updates do not need a new plugin version. Keep command examples consistent across languages and preserve the stable links into the audit record below.

## Historical pre-GA plan

<details>
<summary>Open the original GA plan and closure notes (May–June 2026)</summary>

This is an archival record, not the current backlog. References to “before 1.1”, old engines, old hook ordering, proposed approaches and historical credentials handling describe their original context. The current priorities and linked contracts above take precedence. GA shipped on 2026-05-26.

## How alpha.3 actually performed

End-to-end smoke testing against kimi-code 0.1.1 confirmed:
- All 9 slash commands work
- PreToolUse hook + setup + check + uninstall lifecycle clean
- `/kimi:cancel` reaps the full kimi → bash chain (this was the alpha.2 regression — fixed)
- Strict-by-default verifier correctly rejected the stale block when the plugin upgraded paths
- 357 tests + drift gate clean

Smoke-test gap that alpha.4 closes: review hung past the timeout budget under default `kimi -p` flags because the budget was sized for the non-thinking path. User directive: keep thinking on everywhere — fix the budget, not the flag.

## What alpha.4 closes

- **G1 (UX blocker for review/challenge)** — raised KIMI_REVIEW_PROMPT_TIMEOUT_MS 600s→1800s, KIMI_ASK 300s→900s, introduced KIMI_RESCUE_PROMPT_TIMEOUT_MS=1800s. Removed `--no-thinking` from `commands/*.md`, `agents/*.md`, `runtime/parsing.ts` SUPPORTED_FLAGS and error templates. The parser now **hard-rejects** `--thinking` and `--no-thinking` with INVALID_ARGS — no escape hatch. (Round 2 multi-agent review caught the parser still advertising the flags after the doc removal; this iteration closes the gap.) Cleaned `kimi-errors.ts` nextStep hints that recommended `--no-thinking`.
- **G3 (functional gap)** — Added `warnIfSessionIdMissing` in `runtime/commands/cli-helpers.ts` and wired it into review/challenge/ask/rescue end-of-job paths. When kimi finishes a job but never announces a session id, the user sees a loud stderr warning that resume/replay won't work for that job. Hypothesis (a) — that `--no-thinking` suppressed the stderr announce — is moot now that thinking is the only documented path. If the warning ever fires in practice we have evidence to investigate hypothesis (b) (capture race) with a real reproducer.
- **L2 (helper duplication)** — Already-fixed-in-alpha.3 (the descendant-tree hotfix incidentally rewrote the cancel path and eliminated the helper duplication round-3 review had flagged).
- **G2 (verifier soft-recovery for nvm/asdf)** — Deferred to v1.1 (see H4 below). The user has not hit this in real workflow; current strict-equality behavior is correct safety-wise and the "Run /kimi:setup" remedy is documented in `docs/safety.md`.
- **G4 (TOCTOU)** — Ships GA with the known-limitation note in `docs/safety.md`. Upstream kimi-code issue still pending.

## GA blockers (must close before tagging 1.0.0)

**Empty as of v1.0.0.** Tagged 2026-05-26. Pre-GA closure sequence:

1. alpha.4 closed the original G1/G3 set (thinking-on budgets + loud session-id warning).
2. alpha.5 work (rolled into the GA tag directly) closed the kimi-code 0.2.0 stream-json session-meta compat gap (G6 — `runtime/stream-json.ts` + `runtime/cli-client.ts` consume the new `role:"meta", type:"session.resume_hint"` record).
3. H6 (wire-protocol version probe, formerly v1.0.x deferred) shipped with GA — `runtime/kimi-version-probe.ts` is wired into `/kimi:setup` to loud-warn on out-of-tested-range kimi versions.
4. Three convergent reviews (Claude opus + Codex via codex-rescue + a kimi 0.2.0 review-smoke under thinking-on) returned consistent verdicts: session-meta is the only 0.1.1→0.2.0 break that affects the plugin; hook contract, exit-code semantics, cancellation behavior, config schema, and output framing are byte-identical between kimi-code 0.1.1 and 0.2.0. Review-smoke additionally caught two issues in the candidate (stderr regex over-widening, missing challenge test), both fixed before the tag.

## High-priority but not GA-blocking (close before 1.1)

### H1 — Hook fail-open on runtime drift (Challenge Finding 1)

**Status (2.2.1) — DELIVERED as the read-only DETECTION slice; enforcement deferred**. The pure hook policy is replayed on streamed calls and each denied call's result is checked for the hook's denial (byte-exact, or with upstream's repeat-breaker decoration). Findings (`mismatch` / `unresolved`) are logged, persisted on the job row (`hook_escapes`), exposed in `status`/`result --json`, printed as a stderr notice and carried in timeout details; the run is not stopped and the job does not fail. The first cut (Codex, from the brief) stopped the run and failed the job `HOOK_ENFORCEMENT_ESCAPE`; two independent reviews the same day showed that severity is wrong on certified 2.2.0: Kimi's challenge found the coexisting-hook false alarm (first block wins in config order; the managed block is appended last) and the cancel/budget race, and the Claude code review verified in source that the repeat breaker decorates vetoed results from the 3rd identical call and that unknown tools, invalid args, sensitive paths and other `preflightToolCall`/`resolveExecution` rejections settle BEFORE the hook with their own text — so a plain model retry or a hallucinated `LS` would have failed the job and blocked the Stop gate. With no outcome field in the stream these are indistinguishable from a drifted hook, so the slice ships as evidence, not enforcement. Live control on the real 2.2.0 binary (2026-10-15): hook command pointed at a nonexistent script → upstream failed open, `Write` created the file, finding `mismatch` with excerpt `Wrote 7 bytes to ESCAPE.txt`; intact hook → byte-exact denial, Kimi answered `DENIED`, no finding; re-run on the shipped 2.2.1 build with the identical result (broken lane: job `completed`, `hook_escapes[0]` = `mismatch` with that excerpt, stderr notice printed, Kimi answered `WROTE`). Open: enforcement once positive execution evidence exists (upstream ask filed as MoonshotAI/kimi-code#4241 (`outcome` on print-mode tool records); plugin alternative: a per-job hook trace), filesystem-dependent write coverage, swarm subagent calls, a `setup --check` note for coexisting PreToolUse hooks ahead of the managed block. The earlier deferred discussion below is historical.

**Severity:** Architectural — affects the safety story under environmental change
**Effort:** Large (~2-3 days)

kimi-code's hook protocol treats exit-code-not-0-and-not-2 as ALLOW. If the hook crashes (Node ABI mismatch after upgrade, MODULE_NOT_FOUND, syntax error after a botched rebuild), if `/bin/sh` can't resolve the canonical Node path (LaunchAgent with sanitized PATH), or if it exceeds the 15s timeout, kimi-code silently allows every tool.

Setup's probe validates the install moment; the 2.2.1 monitor records streamed pure-policy mismatches after that check as evidence (not failures).

**Decision (for v1.1):** Runtime-side allowlist post-validation. The cli-client receives `tool_calls` records from kimi-code's stream-json; before the model's text response is finalized, re-validate that every emitted tool call is consistent with the current command's read-only allowlist. If a tool call lands that the hook should have blocked, hard-fail the job and surface a loud error. Belt-and-suspenders: hook stays as the primary gate, runtime catches hook escape.

**Status (v1.5.0 — deliberately still deferred).** Considered during the v1.5.0 open-thread sweep and consciously NOT rushed into the batch. Two reasons: (1) it is an explicitly ~2-3 day *architectural* change touching the cli-client hot path that all commands flow through, with subtle semantics (per-label write-class classification, failure semantics, and — for rescue/pursue/swarm-write, which legitimately write — re-running `evaluateRescueHookRequest` on each `tool_call`); and (2) it is **defense-in-depth behind a primary gate that is now field-proven** by the real-binary smokes (read-only write-denial, goal-mode per-turn gating, and the v1.4.1 write-swarm worktree confinement all GREEN against 0.18.0). Rushing a safety mechanism is worse than a clean deferral. Note the detection-after-execution caveat that bounds its value: by the time the cli-client sees a `tool_call` record, a hook that failed open would have already executed the tool — so runtime post-validation is a loud alarm + hard-fail, not prevention (as the original decision states). Remains a good dedicated next effort; the highest-value, lowest-risk slice is read-only commands (any write-class `tool_call` under a read-only label = escape → hard-fail).

### H2 — Session-id stderr format coupling — **CLOSED in v1.0.0**

**Status:** Closed by upstream + GA hotfix. kimi-code 0.2.0 shipped exactly the machine-readable session record this item prescribed: a `role:"meta", type:"session.resume_hint"` stream-json record on stdout (PR #47). The plugin consumes it directly in `runtime/stream-json.ts::validateMeta` + `runtime/cli-client.ts::consumeOutcomes`. The stderr regex remains as a 0.1.x compatibility fallback, anchored to full-UUID payload shape so a malformed line can't pin a garbage id (review-smoke caught the loose form during GA candidate testing).

### H3 — Stream-json parser coupled to kimi-code internals — **CLOSED (v1.0.0 partial → fully delivered v1.2.2)**

**Status (closed pre-GA):**
- Hard-coded line references removed from the doc-comment header of `runtime/stream-json.ts` (the kimi-code 0.2.0 work touched the relevant source lines and proved the line references stale).
- Unknown `meta.type` values are forward-compat: the parser surfaces them via the malformed channel for diagnostics but doesn't crash. This is the same posture H3 prescribed for "unknown record types": skip and continue.

**Remaining for v1.1:** Treating unknown top-level **roles** (not meta types — full unknown `role` strings) as forward-compat. Currently still flagged as malformed because consumers' assumptions about what `records[]` can contain are baked in. Changing this requires a sweep through the command handlers to confirm none of them break on an unrecognized role landing in their iteration.

**DELIVERED 2026-06-09 (v1.2.2).** The sweep (recorded in code comments) found the **only** `records[]` consumer is `reassembleProseFromRecords`, which reads `role === "assistant"` exclusively and skips everything else (`onRecord` has no production caller). So unknown roles are safe either way. Rather than churn the role-keyed `StreamJsonRecord` union (and its `.role` narrowing) by admitting an arbitrary-role member, an unknown non-empty **string** role is now surfaced **out-of-band** on `StreamJsonOutcome.unknownRecord` (`{role, raw}`) — the same posture as `meta`/`goalSummary` — and `cli-client` logs it (`event:"unknown_record"`) but keeps it out of `records[]`/`onRecord`. It is no longer counted as `malformed` (forward-compat framing, not error). A role-less line that isn't `goal.summary`, or a non-string role, stays `malformed` (genuinely unexpected). Tests: `stream-json.test.ts` (unknownRecord vs. malformed matrix), `cli-client.test.ts` (out-of-band, not malformed, assistant still captured).

### H5 — Per-spawn thinking control via kimi-code CLI (was alpha.4 internal bug)

**Status (2.2.1) — CLOSED as a requested knob**. `--thinking <effort>` sets `KIMI_MODEL_THINKING_EFFORT` per process (binding available since 0.22.0); without it the ambient env remains untouched, including on resume. Non-trait-driven providers silently ignore it; a base level already `off` ignores it; an `alwaysThinking` model receives `off` unnormalized. Only Moonshot `kimi*` providers are trait-driven in CLI 2.2.0. Stream-json emits no thinking deltas, so honoured effort cannot be observed and enforced control is not claimed. The review gate requests `off` by default, supports `inherit`/explicit effort, and still fails open on its 8 s timeout. The CLI still has no thinking flag; the old blocked design below is historical.

**Severity:** Functional — review-gate's 8s budget assumes thinking-off but cannot enforce it
**Effort:** Negotiation with kimi-code team + tiny buildArgs wiring on our side

kimi-code 0.1.1 has no `--no-thinking` / `--thinking` CLI flag. Thinking is controlled by `default_thinking` in `~/.kimi-code/config.toml` plus optional `[thinking].mode` override. The Round 2 Codex review caught alpha.4's broken attempt to emit `--no-thinking` in argv (kimi-code uses `allowUnknownOption(false)` and would crash the spawn).

The old `CliClientOptions.thinking` seam is replaced in 2.2.1 by `thinkingEffort`; `buildEnv` exports the requested value.

**Decision (for v1.1):** File an upstream kimi-code issue requesting `--thinking-mode <auto|on|off>` (or equivalent). Until upstream lands, review-gate behaves correctly only when the user has `default_thinking = false` or selects a non-thinking-capable model — documented in `docs/safety.md`.

### H4 — Verifier soft-recovery for Node version manager switches (was G2) — **DELIVERED in v1.2.1 (as diagnosis, not auto-refresh)**
**Severity:** UX-pain for users on nvm/asdf/mise/fnm
**Effort:** Medium (~half day)

**Delivered 2026-06-09 (v1.2.1).** Shipped as **precise drift diagnosis**, deliberately NOT the auto-refresh in the original decision below. `runtime/hooks/install-paths.ts` gained `parseHookShellCommand` (inverse of `buildHookShellCommand`) + `describeHookCommandDrift`; `evaluateInstalled` takes an optional `nodeExists` predicate and, on a structurally-valid command mismatch, classifies it — "Node binary drift" (pinned interpreter gone → the classic version-manager/Homebrew move), "Node binary changed" (both exist), or "Hook script path drift" (plugin moved/updated) — with the actionable `/kimi:setup` remedy. Surfaced from both `verifyHookInstalled` (the runtime gate behind rescue/swarm/pursue refusal + read-only warnings) and `/kimi:setup --check`. **Why diagnosis over auto-refresh:** silently rewriting the security-config block from a read-only verify path was judged riskier (surprising mutation of a security surface, could mask a real problem) than a clear, classified message; the strict exact-equality decision and the manual `/kimi:setup` remedy stay. Hash-based verification (long-term, below) remains unbuilt — not needed once the diagnosis makes the strict failure legible. Tests: `tests/runtime/install-paths.test.ts` (parser round-trip + classifier matrix), `tests/runtime/hook-install.test.ts` (node-drift + path-drift integration).

Promoted from GA-blocker to v1.1 candidate in alpha.4 triage. Current strict-equality verifier rejects a managed block whose Node binary path no longer matches `process.execPath` — correct safety posture but forces a re-run of `/kimi:setup` after every Node version switch. Documented in `docs/safety.md` under "Known limitation."

**Decision (for v1.1):** Two-pronged.
1. **Short-term:** Add a soft-recovery path — when the installed block's Node binary path differs from canonical but everything else matches AND the installed binary still exists, emit a stderr warning and auto-refresh the block (call setup install logic from verify path). Preserves strict-by-default but adds an explicit "we noticed your Node moved, refreshing the hook" UX.
2. **Long-term:** Hash-based verification — store SHA256 of `dist/hooks/approval-hook.js` in the managed block, verify the hash matches regardless of Node path.

### H6 — Wire-protocol version guard for future kimi-code minors — **CLOSED in v1.0.0**

**Status:** Shipped with GA via `runtime/kimi-version-probe.ts` + `/kimi:setup` integration. The setup probe spawns `kimi --version`, parses output, and pushes a loud warning to setup's warnings array when the version is outside the tested range. Soft-fail policy: probe failures (kimi missing, spawn error, unparseable output) record nothing. Since v1.8.0, safety-sensitive complete-config validation still probes the installed version to apply the correct upstream hook-event schema and fails closed when that version cannot be established; `KIMI_PLUGIN_CC_SKIP_VERSION_PROBE=1` suppresses only the compatibility-range warning probe, not this schema-selection gate.

When kimi-code 0.3.x lands, the only release-engineering step is to extend `KIMI_TESTED_MINORS` after end-to-end verification.

> **2026-05-27 follow-up (initial)**: 0.3.0 and 0.4.0 were audited (reports 31-35). `KIMI_TESTED_MINORS` deliberately held at `[{0,1}, {0,2}]` pending H7 (real-binary CI smoke) as the actual claim-enforcer.
>
> **2026-05-27 follow-up (v1.0.1 release)**: extended `KIMI_TESTED_MINORS` to `[{0,1}, {0,2}, {0,3}, {0,4}]` and shipped as v1.0.1 (tag `v1.0.1`). The trigger was a user-visible UX gap: `/kimi:setup` was warning users on 0.3.0/0.4.0 — versions we had explicitly audited — which read as a contradiction. Decision was to bump the constant now (manual audit is the claim-enforcer for this release) and let H7 retroactively strengthen the assertion. The "user-visible signal beats H7-first sequencing" call lives in the corresponding memo at `projects/kimi-plugin-cc/memos/2026-05-27-first-post-ga-upstream-compat-audit-playbook.md` (memex vault).

### H7 — Real-binary smoke against the installed kimi-code (local smoke DELIVERED 2026-05-28; CI scaffolding DELIVERED 2026-06-04)
**Severity:** Architectural — closes the structural-fragility concern from the 2026-05-27 audit's adversarial review (report 34 §1) and the 0.5.0 `rpc`-undefined tripwire (report 39 F1)
**Effort:** Medium (~1 day) — local smoke done; CI job remaining

Today `bun test` stubs the kimi process — no test exercises the full policy queue end-to-end against a real `kimi -p` binary. PR #26's policy queue refactor made our hook position (index 0) source-code-position-dependent with no upstream invariant test. A future upstream PR could reorder the queue and silently bypass our safety hook with no test failure on either side.

**Delivered (2026-05-28):** `tests/runtime/real-binary-smoke.test.ts` spawns the real `kimi -p --output-format stream-json` in an isolated `KIMI_CODE_HOME` (seeded from the operator's config + OAuth/credentials so it never mutates the real config or session store), installs the managed block via the real `runSetup` path, and for each of review / challenge / ask / review_gate forces a write attempt. It asserts (a) the target file is NOT created in the workspace and (b) the hook deny marker appears in the run — proving the model *attempted* a write and the hook *blocked* it, not that the model declined. Opt-in: skipped unless `KIMI_PLUGIN_CC_SMOKE=1` plus a resolvable binary + authenticated seed home, so `bun run check` stays green in CI/fresh clones. Run via `bun run smoke:real`. Verified green across all four labels against kimi-code 0.5.0 (≈10–12s per label).

**CI scaffolding delivered (2026-06-04).** Two GitHub Actions workflows (the repo previously had **no CI at all** — it relied on local `bun run check`):
- `.github/workflows/ci.yml` — `bun run check` on every push to `main` + every PR. No secrets, no kimi binary, smokes auto-skip. The per-push build/typecheck/test/drift net.
- `.github/workflows/smoke.yml` — the real-binary smokes (read-only **and** the `/kimi:pursue` goal-mode gate) on **manual dispatch**. Installs a pinned kimi-code via the temp-binary technique (`KIMI_PLUGIN_CC_KIMI_BIN`).

**The old "OAuth-only blocker" premise was wrong.** This item assumed kimi-code authenticates *only* via the `managed:kimi-code` OAuth store, requiring a brittle base64 credentials bundle as a secret. But kimi-code's **env-model channel** (`KIMI_MODEL_*`, `config/env-model.ts`, present since 0.6.0 / PR #212) is a clean single-API-key auth: set `KIMI_MODEL_NAME` + `KIMI_MODEL_API_KEY` and it synthesizes the default provider — no OAuth, no expiry. The smoke gate now accepts it (`tests/runtime/real-binary-smoke.test.ts`), and `smoke.yml` uses it. See `docs/ci.md`.

**Remaining (deliberate choices, not blockers):** (1) the operator adds `KIMI_MODEL_API_KEY` + `KIMI_MODEL_NAME` as repo secrets to activate `smoke.yml` (inert until then); (2) the smoke is **dispatch-only, not per-push/scheduled, by design** — a goal-mode run is ~1–2 min of real model tokens (the model retries the deny-wall for the full `--budget`), so per-push would bill every push. Flip on a `schedule:` trigger if continuous verification is wanted. Because the gate isn't yet *continuously* auto-run, `/kimi:pursue` stays labeled **experimental** (also honest because kimi-code's `goal-command` is itself an off-by-default experimental flag upstream).

### H8 — `/kimi:setup` surfaces installed kimi-code plugins (new for v1.1) — **DELIVERED in v1.2.1**
**Severity:** UX — closes the turn-waste concern from the 2026-05-27 audit's adversarial review (report 34 §4)
**Effort:** Small (~half day)

**Delivered 2026-06-09 (v1.2.1).** `runtime/commands/setup.ts::collectInstalledKimiPluginsNotice` reads `~/.kimi-code/plugins/installed.json` (path + `{plugins:[{id,enabled,…}]}` shape re-verified against `packages/agent-core/src/plugin/store.ts` at 0.12.0) and, on both the install and `--check` paths, pushes a non-blocking notice naming installed+enabled plugins with a one-liner that their tool calls are denied (and waste turns) under the read-only commands. Best-effort: missing/unreadable/malformed manifest → no notice; never blocks setup; never mutates the plugin list. Test: `tests/runtime/setup.test.ts` (H8 notice + absent-manifest cases).

kimi-code 0.4.0 (PR #119) added user-global plugin installation. Plugin-provided MCP tools register on every session creation. Our PreToolUse hook denies any unrecognized tool name for review/challenge/ask/review_gate, so plugins don't escalate privilege — but they DO add tool calls that get denied silently inside the kimi turn, wasting model turns. Users would file confused "kimi did nothing useful" bugs.

**Decision (for v1.1):** During `/kimi:setup`, probe `~/.kimi-code/plugins/installed.json` (kimi-code's home dir is `~/.kimi-code/`, not `~/.kimi/`; confirmed against `packages/agent-core/src/plugin/store.ts` + `docs/en/configuration/data-locations.md` in 0.4.0) and emit a non-blocking notice listing any installed kimi-code plugins, with a one-liner explaining that their MCP tool calls will be denied under review/challenge/ask. Don't block setup. Don't mutate the plugin list. Just set the user's expectations.

### H9 — Pin known-good kimi-code version range at setup (new for v1.1, extends H6) — **DELIVERED in v1.2.1 (clarification)**
**Severity:** Architectural — completes the H6/H7 pair
**Effort:** Small (~quarter day, once H7 lands)

**Delivered 2026-06-09 (v1.2.1).** Set-membership in `isInTestedRange` already warned for ANY untested `{major,minor}` (including above the range), so no separate `UPPER_BOUND` gate was needed. Added `maxTestedMinor()` and taught `formatVersionOutOfRangeWarning` to distinguish the common, less-suspicious case — a kimi-code release NEWER than our newest tested minor ("likely fine, but unverified; behaviors may have changed since our last compat audit") — from a below/gap version. This is the user-facing signal the adversarial review asked for (we've verified the index-0 hook contract up to this max). Test: `tests/runtime/kimi-version-probe.test.ts` (above-max note + `maxTestedMinor`).

H6 ships a "warn if version outside tested range" probe. H7 makes "tested" a real assertion (CI-enforced). H9 closes the loop by pinning a known-good upper bound (`>=0.2.0 <0.5.0` once 0.4.0 ships through H7) and emitting a setup-time warning above the upper bound. Adversarial review (report 34 §1) specifically called out that the hook-policy-index-0 contract is undocumented upstream — pinning a tested upper bound is the user-facing signal that we have verified the contract holds for this range.

**Decision (for v1.1):** Once H7 lands, extend `KIMI_TESTED_MINORS` with each newly-verified minor and add an `UPPER_BOUND` constant. Setup-time warning when `kimi --version` reports anything above the upper bound.

## Low-priority polish (open backlog)

### L1 — `dist/` drift hazard for developers who skip `bun run check` (Challenge Finding 7)
The drift gate catches forgotten rebuilds when developers run `bun run check`. Developers who only run `bun test` would miss it.

**Decision:** Document in `AGENTS.md` (already done). Add a `.husky` pre-commit hook in a follow-up if the gate ever silently fails.

### L3 — alpha.3 hotfix invariant note in `runtime/cli-client.ts`
Comment block at the start of the cancellation section should explain WHY we have both per-pid kill AND per-pid negative-pid kill AND the (now removed... wait, we kept it for defense-in-depth) root group-kill. A future maintainer might think the per-pid PGID kill is redundant with the root group-kill — explain the kimi-code spawn-shape reasoning.

**Decision:** Documentation polish; can ship any time.

### L4 — Plugin-manifest hook as an additive, comment-strip-immune enforcement layer (spike done 2026-07-16, DEFERRED)
kimi-code's own plugin system can carry our PreToolUse hook via `kimi.plugin.json`'s `hooks` field (the same `HookDefSchema`, merged into create+resume on the `-p` path since **0.20.1**, same stdin-JSON/exit-2-deny/any-block-wins contract), registered in the versioned JSON `~/.kimi-code/plugins/installed.json` — structurally immune to the config.toml comment-strip that drove v1.8.2. It would be **strictly additive** (invisible < 0.20.1; `KIMI_TESTED_MINORS` covers from 0.2.0, so config.toml stays the floor) and, only if config.toml were ever retired, could delete `managed-block.ts` (~787 lines) + most host-scoping forensics (host-scoping comes free as two `installed.json` entries keyed by `id`). **Blocker:** no *supported* headless enable path — no `kimi plugin` CLI verb, only the TUI `/plugins` trust flow. A direct-file-write route works today but rests on undocumented internals (the same "unlisted contract" risk class as the comment-strip incident); the node-sdk is unpublished (404) and the `kimi server` RPC is disproportionate.

**Decision (2026-07-16):** DEFER. v1.8.2 already fixed the practical seesaw pain, so this is non-urgent defense-in-depth, and building a safety-critical path on undocumented internals is the risk we just got burned by. Full spike + a drafted (unfiled) upstream feature-request for scriptable enablement live at `.claude/kimi-code-research/plugin-manifest-hook-feasibility-2026-07-16.md`. Revisit if upstream ships a `kimi plugin install/enable` verb or documents `installed.json`/`kimi.plugin.json` as a stable directly-writable contract.

## Anti-roadmap (deliberately out of scope)

- **Windows process-group reaping.** kimi-code 0.1.1 effectively doesn't support Windows with the same robustness; targeting POSIX-first is correct.
- **Reverting to in-band approval policy (v0.4 wire-style).** The cutover decision is firm — kimi-code dropped Wire transport. Defense-in-depth via H1 covers the same risk surface.
- **Reintroducing `--thinking` / `--no-thinking` as documented user flags.** User directive in alpha.4: thinking is always on for user-facing commands. The parser **hard-rejects** both flags with `INVALID_ARGS` (`THINKING_FLAG_REMOVED_MESSAGE`); there is no escape hatch. review-gate's runtime caller pins thinking-off via `CliClientOptions.thinking` as a reserved internal seam (currently a no-op since kimi-code 0.1.1 has no per-spawn CLI control — see Codex Round 2 finding).

## Ship-or-fix gate for GA — **MET**

**v1.0.0 tagged 2026-05-26.** Pre-tag state:
- alpha.4 closure scope (G1 + G3 + L2) ✓
- kimi-code 0.2.0 stream-json session-meta hotfix ✓
- H6 wire-protocol version probe ✓
- H2 closed by upstream + plugin consumption ✓
- H3 partially closed (unknown meta types forward-compat; unknown top-level roles deferred to v1.1) ✓
- Codex post-hotfix audit clean ✓
- Claude opus audit clean ✓
- kimi 0.2.0 review-smoke clean (8m 37s under 1800s thinking-on budget) ✓
- 391 tests pass, drift gate clean ✓

Remaining open items: H1 prevention and filesystem-dependent write coverage; its read-only alarm is delivered in 2.2.1. H5 is closed as a requested knob. H3/H4/H8/H9 are closed; H7 ships as opt-in real-binary smoke.

</details>

## Post-GA audit log

**2026-11-02 — Plugin 2.5.2: setup recovery and DSH dependency validation.** Setup recognizes marker comments and table headers outside multiline TOML strings, repairs mixed-host orphan comments without altering foreign hooks, and preserves line endings, blank lines, and quoted foreign matcher fields during pruning. DSH enforces a minimum 6000ms disposal grace, pins a stable Node executable, and exposes tool write boundaries to the model. DSH services and its tool adapter become optional host-provided peers, keeping ordinary npm consumers free of the harness dependency graph. Existing DSH hosts and profile-local harness packages require explicit `zod >=4.6.6` and `undici >=8.12.2` overrides; the plugin does not rewrite them automatically. Validation audits a fresh patched host and profile, verifies seven actual provider/tool registrations and Web boot, and audits a normal packed-package npm consumer in CI and publication. Incomplete or failed audit results refuse validation. Exact Kimi Code 2.4.1 real-binary smoke passes 24 tests and 167 assertions with no skips, including six goal turns with matching write denials, real rescue/Bash.cwd controls, resume/plan-taint refusal, and child-authored write-swarm patch confinement. Exact-source audit passes 16 tests and 97 assertions. The release full check passes 1,357 tests with 30 default opt-in skips (covered by the separate live/source runs), zero failures, and 17,486 assertions; 328-file package checks and fresh consumer/host/profile audits pass. Exact CLI certification is unchanged. Release commit `8b303bb6e49c581ad96c72bd031e8fd1643c9121`, CI run 41361753223, annotated tag/GitHub release `v2.5.2`, and npm publication run 41362262009 are complete. The registry artifact has SHA-1 `e620040dd35986a6929be7ad677642729a3126e7`, equals the workflow artifact, and carries provenance (log index `3636981979`). A fresh registry install reports zero production advisories and passes isolated setup/check for all three hosts. The DSH Discover index records the actual npm publication timestamp. See [registry and patched-host requirements](docs/registry-releases.md).

**2026-11-01 — Plugins 2.5.0 and 2.5.1: DSH host parity and root-only publication.** DeepSeek Harness becomes the third host with native `kimi_ask`, `kimi_review`, `kimi_challenge`, `kimi_rescue`, `kimi_pursue`, `kimi_swarm`, and `kimi_swarm_write`, all reusing the existing companion and `kimi -p` transport, managed hooks, exact-version certification, SQLite jobs, budgets, artifacts, and operation-specific write policies. DSH has its own host id, data root, setup/model/uninstall commands, profile model/thinking/budget/review-base settings, bounded output, and managed subprocess teardown; no ACP transport or second implementation is introduced. Live DSH smoke proves ask returns `4`, a managed-hook write denial creates no file, rescue writes only `DSH_OK`, and a two-target swarm-write returns a valid patch without applying it or touching the real workspace. Standalone artifact composition and Web boot pass on DSH 0.2.1-rc.5 and 0.2.2-alpha.2. Distribution is consolidated into the existing root npm package, so no second npm identity or Trusted Publishing binding is needed. The checkout audit is clean (downstream resolution is addressed in the 2.5.2 follow-up above), the full check passes 1,337 tests with 30 expected opt-in skips and zero failures, root package validation passes 328 files, and root-tarball DSH installation composes all seven tools. Release CI 41335810767 and publish workflow 41336273042 pass; v2.5.1 is published with SHA-1 `f0e42febcb14082be6a654b9b0830885242fd92a` and signed provenance (sigstore log index `3635166158`), and a fresh registry installation composes all seven tools and boots. The README now has complete English, Chinese, French, and Japanese DSH sections; `AGENTS.md` is reduced from 32,704 to 21,291 bytes with a 24 KB ceiling. The generated DSH Discover index carries version 2.5.1 and is validated, with release-time updates required through `DSH_PUBLISH_TIMESTAMP`. Community discovery PR [0xsline/awesome-deepseek-harness#779](https://github.com/0xsline/awesome-deepseek-harness/pull/779) is open.

**2026-10-31 — Plugin 2.4.5: exact CLI 2.4.1 certification.** Main-thread source review covers every changed production TypeScript file and the safety surfaces outside the seven monitor scopes; the 15 pinned construction/schema files are byte-identical to 2.4.0 and the tag scan passes 15 tests and 96 assertions. Plan ON writes a 1,831-byte plan file without a plan-Write hook; ordinary Write is denied, and forced EnterPlanMode rejects before the hook. Direct swarm OFF produces no children; preactivated ON correlates two child journals and managed denials, then verifies deactivation with the idle-reclaimer override. Expanded candidate and production matrices each pass 21 tests and 154 assertions without skips (410.84s and 453.88s), including real rescue confinement/provenance, deterministic Bash.cwd denial, and 278-byte child-authored patches with clean user trees and removed worktrees. Add only exact 2.4.1 to production, activation and reviewed hook-schema tables; preserve every no-plan, lifecycle, permission and legacy 0.41.x boundary. Independent Codex/Kimi review identified and drove fixes for custom-hook wording, correlated read-only and per-turn pursuit evidence, per-operation negative coverage and npm evidence packaging. Earlier review iterations are retained, but their Bash-inclusive goal evidence is superseded and not accepted for certification. The final prefix-hardened production matrix passed 24 tests and 167 assertions in 440.66s, with same-call Write denials marked `isError: true` in all seven call-derived turn IDs and the whole workspace empty at settlement. The literal standard `bun run check` passed 1,318 tests with 30 expected opt-in skips, zero failures and 17,319 assertions across 79 files in 358.83s after earlier timing-sensitive attempts; clean package validation passed 233 files and includes the certification record. Codex's final targeted re-review returned APPROVE, closing all original and subsequent findings. Plugin 2.4.5 was committed as `de8c195c2986443a088b674717133b164d2e4ef2`; release CI 41226096281 and publish workflow 41226438326 passed, and the v2.4.5 GitHub release is published. The registry tarball has SHA-1 `39f97a6de4b26ad51ac77305054682fcd5cd0164`, contains 233 files, matches the CI artifact, and passed fresh setup/check and version refusal for both hosts. Installed hosts and operator CLI pins remain unchanged.

**2026-10-29 — Plugin 2.4.4: exact CLI 2.4.0 certification.** Four independent source reviews cover the plan redesign, session/KAP lifecycle, and files outside the monitor's seven scopes; all return COMPAT-PRESERVED, and the tag scan passes 15 tests and 96 assertions. Revised plan-ON/OFF controls prove the resumed-plan bypass, ordinary Write denial, and deterministic removed-tool rejection before hooks. Direct swarm OFF produces no children; preactivated ON correlates two child journals and managed denials, then verifies deactivation. Expanded candidate and production matrices each pass 21 tests and 154 assertions without skips (440.82s and 431.51s), including real rescue confinement/provenance and deterministic Bash.cwd denial, with 278-byte child-authored patches, clean user trees and removed worktrees. Add only exact 2.4.0 to production, activation and reviewed hook-schema tables. A bounded 15-second graceful shutdown replaces the prior 5-second bound after a measured 6.743-second clean exit; plugin-owned lifecycle also disables ambient idle-session reclamation, verified by a 1 ms ambient ON control. Other lifecycle, recovery, no-plan, permission and legacy 0.41.x boundaries stay unchanged. The final full check passed 1,312 tests with 30 expected opt-in skips, zero failures and 16,838 assertions across 79 files; clean package validation passed 232 files after the gate rejected 11 ignored sync-conflict copies in an invalid 243-file attempt. Independent code review returned APPROVE and documentation closeout found no remaining blocker. Final repository/package evidence is recorded in the [2.4.0 evidence](docs/upstream-2.4.0-certification.md) and release notes; CI, commit, push, tag, publication and installed-host/operator-pin changes remain separate.

**2026-10-27 — Plugin 2.4.3: exact CLI 2.3.3 certification.** Four independent source reviews, the 15-test/92-assertion exact-tag scan, plan-ON/OFF controls and direct-OFF/preactivated-ON swarm controls passed. The candidate matrix passed 19 tests and 125 assertions without failures or skips; child-authored write-swarm produced a 306-byte patch with a clean user tree and removed worktree. Add only exact 2.3.3 to the production, activation and reviewed hook-schema tables. No-plan closures, permissions, concurrency, lifecycle/recovery ownership and the legacy 0.41.x boundary stay unchanged. KAP UI configuration changed outside the monitor's original six scopes; activation endpoints remain unchanged, and the audit playbook now includes their server/CLI dependency surface. Final production validation and publication are recorded in the [2.3.3 evidence](docs/upstream-2.3.3-certification.md) and release notes; installed hosts are unchanged.


**2026-10-26 — Plugin 2.4.2: recovery and spawn diagnostics.** Integrated contributor
PR #22 with its original commits, preserving structured process errors and bounding
the additional message. Added a Windows UTF-16 command-line guard and a credential-free
Windows CI lane; issue #14 remains open because argv transport and native Windows
support are not resolved. See [community validation](docs/windows-validation.md).

Exact CLI 2.3.2 swarm runs now journal launch intent/identity and pre-mutation session
ownership. Preview/apply recovery validates ownership, serializes attempts, refuses
uncertainty, disables the recorded session and captures retained work without applying
or deleting it. Terminal outcomes stay immutable; abandoned running jobs become failed.
Age-based orphan deletion is removed. A kill before identity persistence remains a
manual-inspection gap; no supervisor guarantee or Windows process recovery is claimed.
See [recovery mechanics](docs/swarm-recovery.md).

Validation: compiled forced-kill recovery, owner/claim refusal, terminal preservation,
post-print cancellation, identity replacement and journal-failure regressions passed.
The local full check passed 1,299 tests with 28 skipped and zero failures (16,199
assertions); subsequent shared-flag/help cleanup passed all 36 help checks and typecheck.
The first CI run passed the Windows controls but exposed a Linux proc/ps start-token
namespace mismatch in recovery and an existing MCP assertion that compared transient
process state. Recovery now independently revalidates both identity representations;
the MCP test compares stable identity and requires a live state. The focused follow-up
passed 10 tests with 90 assertions. Final commit checks are the authority for the exact
Linux suite and Windows controls. Package validation covers both bundled distributions. AGENTS.md has 2,007
bytes of headroom and its 32 KiB limit is enforced in `check`.

Release validation: frozen dependency install; exact 2.3.2 source scan (15 tests,
92 assertions); full check (1,303 pass, 28 opt-in skips, zero failures, 16,214
assertions); production-table exact-2.3.2 live smoke (19 pass, 125 assertions).
The live smoke includes distinct child journals, a 278-byte child-authored patch,
clean user worktree and out-of-root denial. The unchanged upstream source and
plan-ON/OFF certification controls remain documented in
[2.3.2 evidence](docs/upstream-2.3.2-certification.md); no certification row is added.
Package validation covers 232 files and both hosts. Credentials stayed in process
memory/environment; isolated empty homes avoided personal config and OAuth stores.
No installed hook or CLI pin changed. Publication follows the immutable-tag and
validated-tarball workflow in [registry releases](docs/registry-releases.md).

**2026-09-26 — Registry documentation check.** Confirmed npm 2.0.7, the validated
artifact, both isolated host setup checks, and the configured trusted publisher.
Updated the multilingual README, current compatibility guide, contributor
versioning guidance, roadmap, and publishing status. The certified CLI table and
runtime are unchanged. Historical certification records retain their original versions.

<details>
<summary>Open the dated release and compatibility audit history</summary>

- **2026-05-27** — kimi-code 0.3.0 (released 2026-05-26) and 0.4.0 (released 2026-05-27) audited by 4 independent reviewers (hook contract, stream-json, CLI surface, adversarial). Verdict: COMPAT-PRESERVED. No runtime changes required. Findings:
  - `packages/agent-core/src/agent/hooks/` byte-identical 0.2.0→0.4.0
  - `apps/kimi-code/src/cli/run-prompt.ts` byte-identical 0.2.0→0.4.0
  - PR #26's policy queue refactor places `PreToolCallHookPermissionPolicy` at index 0, before `auto-mode-approve` (4) and `yolo-mode-approve` (13) — our hook still fires first
  - All argv flags we use (`-p`, `-r`, `--output-format stream-json`, `-m`, `--skills-dir`) unchanged
  - `kimi -p` still hard-codes `permission: 'auto'`; resumed sessions still force-overridden to `'auto'`
  - Adversarial finding: hook-policy-index-0 is convention-only with no upstream invariant test → tracked as H7 (real-binary CI smoke) and H9 (pin upper bound)
  - New plugin system (PR #119) introduces silent turn-waste for users with kimi-code plugins installed → tracked as H8
  - Edits applied: AGENTS.md compat-range framing, `runtime/stream-json.ts` source-of-truth comment widened to "verified through 0.4.0", H7-H9 backlog added here.
  - Reports: `.claude/kimi-code-research/reports/31-upstream-04-hook-contract.md`, `32-upstream-04-stream-json.md`, `33-upstream-04-cli-surface.md`, `34-upstream-04-adversarial.md`, `35-upstream-04-synthesis.md`.

- **2026-05-28** — kimi-code 0.5.0 (released same day) audited by the same 4-reviewer playbook. Verdict: COMPAT-PRESERVED (unanimous). Patch release **v1.0.2** extends `KIMI_TESTED_MINORS` to include `{0, 5}` and tags `compat-verified-kimi-code-0.5.0`. Findings:
  - Hook engine relocated `packages/agent-core/src/agent/hooks/` → `packages/agent-core/src/session/hooks/` (commit `74e867a`) with byte-identical file contents; PreToolUse contract preserved end-to-end
  - `apps/kimi-code/src/cli/run-prompt.ts` and `packages/agent-core/src/rpc/events.ts` byte-identical 0.4.0→0.5.0 — stream-json wire format unchanged
  - `PreToolCallHookPermissionPolicy` still at policy index 0; queue order byte-identical to 0.4.0
  - Argv unchanged; new `--auto` flag is rejected when combined with `-p` (`options.ts:43–45` throws `OptionConflictError`) so it cannot bypass hook-based read-only enforcement
  - `--continue` resume + `forcePromptPermission` still override resumed-session permission to `'auto'`
  - The 1580-line `04-wire-records.diff` is internal persisted-AgentRecord changes (blobref offloading, migration v1.3) that do not surface through `kimi -p --output-format stream-json`
  - Adversarial finding (latent, does not bite in 0.5.0): `AgentOptions.rpc` downgraded from required to `SDKAgentRPC | undefined`; `PermissionManager.requestToolApproval` now silently auto-approves `'ask'` outcomes when `agent.rpc === undefined`. Every Agent constructor site in 0.5.0 production passes a non-undefined `rpc` proxy, so the branch is dead code, but type safety has weakened. Tracked as a v1.1 tripwire: re-verify rpc-supplied-at-every-callsite in future audits and check whether `installHeadlessHandlers` is still wired into prompt mode
  - Edits applied: `runtime/kimi-version-probe.ts` (`KIMI_TESTED_MINORS` extended), `runtime/stream-json.ts` (verified-through range extended to 0.5.0, resume-hint emission position clarified as session end), `runtime/hooks/approval-hook.ts` (path breadcrumb updated to `session/hooks/runner.ts`), AGENTS.md (Upstream compat paragraph, dual-source paragraph clarified), 5-file version bump 1.0.1 → 1.0.2
  - Reports: `.claude/kimi-code-research/reports/36-upstream-05-hook-contract.md`, `37-upstream-05-stream-json.md`, `38-upstream-05-cli-surface.md`, `39-upstream-05-adversarial.md`, `40-upstream-05-synthesis.md`.

- **2026-05-28 (follow-up to the 0.5.0 audit)** — H7 local real-binary smoke **delivered** in response to the report 39 F1 `rpc`-undefined tripwire. The finding is structurally unreachable through our subprocess path (our hook returns only `allow`/`deny` at policy index 0, never an `'ask'` outcome; `kimi -p`'s own auto-approve resolves the rest before any `'ask'` fallback — so the auto-approve-on-undefined-`rpc` branch is dead code for us twice over). No code fix is possible or needed on our side; the gap was that the index-0/deny chain was convention-verified, not test-verified. `tests/runtime/real-binary-smoke.test.ts` now asserts it end-to-end against the real binary (review/challenge/ask/review_gate each force a write → hook denies → no file written + deny marker present). Verified green across all four labels against kimi-code 0.5.0. Opt-in (`bun run smoke:real`); skipped under `bun run check`. CI wiring remains pending on an OAuth-credentials secret (see H7). No runtime changes; test + `package.json` `smoke:real` script + docs only.

- **2026-05-31** — kimi-code 0.6.0 (npm `latest`) audited by the same 4-reviewer playbook. Verdict: COMPAT-PRESERVED (unanimous), and for the first time **backed by a green real-binary smoke against the audited release** (`bun run smoke:real` vs the installed 0.6.0: 5 pass / 0 fail, all four read-only labels deny the forced write end-to-end). Patch release **v1.0.4** extends `KIMI_TESTED_MINORS` to include `{0, 6}` and tags `compat-verified-kimi-code-0.6.0`. Findings:
  - Hook engine (`session/hooks/`), policy queue order (`policies/index.ts`, hook still index 0 / `AutoModeApprovePermissionPolicy` at index 4 — the 5th policy), `pre-tool-call-hook.ts`, and `auto-mode-approve.ts` all byte-identical 0.5.0→0.6.0
  - CLI argv (`options.ts`/`commands.ts`) byte-identical (blob-SHA verified); `--auto` still rejected with `-p`; stream-json resume-hint writer (`writeResumeHint`/`PromptJsonWriter`) byte-identical by content — `session.resume_hint` unchanged
  - `run-prompt.ts` gained a +17-line resume-session workDir guard (`resolvePromptSession`, resume branch only); it runs *before* `forcePromptPermission` as a fail-closed gate and **structurally cannot fire for the plugin** — both resume sites (`ask.ts`, `rescue.ts`) spawn with `cwd: job.cwd`, the same SQLite value the session token was created under, so `target.workDir !== workDir` is always false. Invariant to preserve: never resume a captured token from a different cwd
  - The 0.5.0 latent tripwire evolved: `permission/index.ts` inverted the auto-approve fallback to `if (rpc?.requestApproval) {requestApproval} else {approved}` (and `agent/index.ts` widened `rpc` to `Partial<SDKAgentRPC>`). This is a genuinely new silent-approve branch when `rpc` exists but `requestApproval` is absent — but it is **dead code in `-p` mode** (only the `'ask'` path reaches it, shadowed by `AutoModeApprovePermissionPolicy` at index 4; and `requestApproval` is a required `SDKAgentAPI` member, always present in the CLI host). A hook `{kind:'deny'}` routes through `case 'deny' → {block:true}` with no rpc involvement. Confirmed structurally inert by the green smoke
  - Large internal `runtime.kaos → agent.kaos`/`session.kaos` plumbing refactor (CHANGELOG "Split RuntimeConfig into Kaos and ToolServices") preserves `agent.config.cwd === agent.kaos.getcwd() === workDir` — rescue cwd-confinement and pathClass unchanged. `provider-manager.ts` `ModelProvider`/`SingleModelProvider` extraction is internal (auth/model selection only)
  - `records/` removed `context.mark_last_user_prompt_blocked` — UserPromptSubmit-hook plumbing only (the plugin installs only a PreToolUse hook); never serialized to stream-json; cross-version resume is safe (`restoreAgentRecord` has no throwing `default`)
  - Two doc-only findings (NOT write bypasses): PR #186 removed the default 1000-step/turn cap (compute guardrail; bounded by the plugin's AbortController) and PR #212 added an opt-in `KIMI_MODEL_*` inherited-env channel (never touches hook config, stripped on config write-back). Both noted in `docs/safety.md` § "What this safety story does NOT cover". Experimental-flags infra (`flags/registry.ts`) ships with `FLAG_DEFINITIONS = []` — no flag can disable the hook
  - Smoke caveat (recorded per playbook): the first smoke run died at `auth.login_required` because the operator's local OAuth token had expired (machine state, not a 0.6.0 regression); after re-login it ran green. A skipped/auth-failed smoke is not a passed smoke — the green run is the one that counts
  - Edits applied: `runtime/kimi-version-probe.ts` (`KIMI_TESTED_MINORS` extended to `{0,6}`), `runtime/stream-json.ts` (verified-through range widened to 0.6.0, qualified that the run-prompt.ts change is the resume guard outside the writer), AGENTS.md (Version, Upstream-compat paragraph, dual-source paragraph), `docs/safety.md` (two findings), 5-file version bump 1.0.3 → 1.0.4
  - Reports: `.claude/kimi-code-research/reports/47-upstream-06-hook-contract.md`, `48-upstream-06-stream-json.md`, `49-upstream-06-cli-surface.md`, `50-upstream-06-adversarial.md`, `51-upstream-06-synthesis.md`.

- **2026-06-01 (forward-scan, not a triggered audit)** — Routine upstream check found **no new release**: npm `latest` is still `0.6.0` (published 2026-05-29, no `next`/`beta` dist-tags), GitHub `Latest` is `0.6.0`, local `kimi --version` is `0.6.0` — all already covered by v1.0.4 / `compat-verified-kimi-code-0.6.0`. No 4-reviewer audit, version bump, or tag warranted. As a free look at the *next* release, diffed `origin/main` (`a580cd3`, 12 commits ahead of the `@moonshot-ai/kimi-code@0.6.0` tag) against the six consumed surfaces. Provisional verdict on unreleased main: **COMPAT-PRESERVED**. Findings:
  - **Hook engine** (`session/hooks/`) and **permission policy queue** (`permission/`): **0-byte diffs** — byte-identical. The two surfaces the entire safety model rests on are untouched.
  - **CLI argv** (`options.ts`, `commands.ts`): byte-identical — no diff. `run-prompt.ts` gained only +2 lines adding `cron.fired` and `warning` to the *ignored*-events switch in `runPromptTurn`; both fall through to `return` (filtered, never written as stream-json records). Forward-compat-benign.
  - **Wire/records** (5.5 KB diff): internal-only. New `micro_compaction.apply` record type (#219, MicroCompaction) with restore-time stamping (`_restoring` widened from `boolean` to `RestoringContext | null`); `adaptiveThinking` provider plumbing (#232, `KIMI_MODEL_ADAPTIVE_THINKING`); `cancelAll(reason)` now propagates an abort reason to in-flight subagent tools (#236). `AGENT_WIRE_PROTOCOL_VERSION` stays `1.3` (gained a clarifying comment that new feature record types do not require a bump). None of this changes the stream-json **output shape** our parser consumes, and our cancellation is OS-signal / process-group based — independent of kimi's internal abort-reason plumbing.
  - **Re-confirm at next release (likely 0.7.0):** (1) `warning`/`cron.fired` stay filtered out of `-p` stdout (not surfaced as parseable records); (2) the stream-json parser shrugs off `micro_compaction.apply` if it ever reaches stdout. Both expected to pass; both are exactly what `bun run smoke:real` + the stream-json reviewer will verify when the release actually lands.
  - No edits to runtime, docs, or version files; no commit or tag (per the "don't tag for zero-code-change audits" anti-pattern — and the scanned code is still unreleased and will change before shipping). This bullet is the only artifact.

- **2026-06-03** — kimi-code shipped **three minors in five days** (0.7.0 + 0.8.0 on 2026-06-02, 0.9.0 on 2026-06-03), a 61-commit catch-up from the verified 0.6.0. Certified the whole jump in one cumulative 0.6.0→0.9.0 pass via the playbook's 4-reviewer audit **plus an independent cross-model (codex) adversarial pass**. Verdict: **COMPAT-PRESERVED** (unanimous across all 5 review streams), backed by a GREEN `bun run smoke:real` against **both** the installed 0.8.0 binary and a temp-installed 0.9.0 binary (via the `KIMI_PLUGIN_CC_KIMI_BIN` override — auth seeded from the real home; never mutated the operator's install). Patch release **v1.0.5** extends `KIMI_TESTED_MINORS` to `{0,7}`, `{0,8}`, `{0,9}` and tags `compat-verified-kimi-code-0.9.0`. Findings:
  - The 2026-06-01 forward-scan predictions all held: `warning`/`cron.fired` stay filtered out of `-p` stdout; the parser shrugs off internal feature records (`micro_compaction.apply` etc.) — none reach the `-p` stream-json surface. Hook engine (`session/hooks/engine.ts`, `runner.ts`) and the stream-json writer (`writeResumeHint`/`PromptJsonWriter`) are byte-identical 0.6.0→0.9.0; `policies/index.ts` still puts `PreToolCallHookPermissionPolicy` at index 0 (auto-approve index 4).
  - **Permission approval hooks (#336, 0.8.0)** — `PermissionRequest`/`PermissionResult` added to `HOOK_EVENT_TYPES`. Fire-and-forget OBSERVABILITY only (`fireAndForgetTrigger` + leading `void`, never call `blockDecision`), emitted only inside the `rpc.requestApproval`/ask branch — dead in `-p` auto mode (shadowed by auto-mode-approve), structurally incapable of denying. No enforcement migration; keep PreToolUse-deny as-is (report 57).
  - **Headless goal mode (#270, 0.8.0)** — `kimi -p "/goal ..."` → `runHeadlessGoal`, double-gated behind the experimental flag `goal-command` (default false, env `KIMI_CODE_EXPERIMENTAL_GOAL_COMMAND`) AND a `/goal`-prefixed prompt. Unreachable for the plugin (sets no `KIMI_CODE_EXPERIMENTAL_*`, never sends `/goal`). Confirmed by report 58 that even *inside* the continuation loop the PreToolUse hook fires on every tool call (index 0) — no autonomous-continuation approval bypass. Goal mode also writes a `{"type":"goal.summary",...}` stdout line (no `role`) before the resume hint; it routes to the parser's malformed channel (fail-safe), and is only emitted in goal mode anyway.
  - **`deny-all` policy (#338, 0.9.0)** — `unshift`-ed only onto SUBAGENT policy stacks (`subagent-host.ts:199`) for the `/btw` side-channel; a deny (more restrictive), never the main `-p` agent. The sole `policies` mutation in the 0.9.0 tree.
  - **Default-approve set grew** — `GetGoal`/`SetGoalBudget`/`UpdateGoal` added (`CreateGoal` is NOT). No fs/git/config side effects; the plugin's read-only enforcement is allow-list/deny-by-default, so new upstream tools can't slip through.
  - **New sibling subcommands** (`provider`/`acp`/`login`/`upgrade`) and `KimiHarness`→`createKimiHarness` factory: do not alter `-p` parsing or permission/hook defaults. ACP (#368) is an IDE transport the plugin never spawns.
  - **Doc-only finding (NOT a write bypass):** background auto-upgrade (#334, 0.8.0) is on by default; the plugin's own `-p` spawns never swap the binary (source forced `unsupported`), but a user's interactive TUI can drift to an unaudited version out-of-band. The version probe is the net; raises priority of **H9**. Added to `docs/safety.md` § "What this safety story does NOT cover" (plus a note that the new permission hook events are observability, not a decision surface).
  - Edits applied: `runtime/kimi-version-probe.ts` (`KIMI_TESTED_MINORS` → `{0,7}/{0,8}/{0,9}`), `runtime/stream-json.ts` (verified-through widened to 0.9.0), AGENTS.md (Version, Upstream-compat paragraph, dual-source paragraph), `docs/safety.md` (auto-upgrade drift + permission-hook-events items), `docs/upstream-compat-audit.md` (self-upgrade note), this log entry, 5-file version bump 1.0.4 → 1.0.5.
  - Reports: `.claude/kimi-code-research/reports/52-upstream-09-hook-contract.md`, `53-…-stream-json.md`, `54-…-cli-surface.md`, `55-…-adversarial.md`, `56-…-feature-parity-map.md`, `57-…-permission-hooks-deep-dive.md`, `58-…-goal-mode-feasibility.md`, `59-…-codex-adversarial.md`, `60-…-synthesis.md`.
  - **Feature track (new this audit, for v1.1 decision — NOT shipped in v1.0.5):** the 0.6→0.9 wave is largely Claude-Code-parity, but almost all of it is TUI-only or internal model-quality plumbing invisible to a `kimi -p` wrapper. Exactly one feature creates new plugin surface — **headless goal mode → a flagged `/kimi:pursue` command** (report 58: GO-for-prototype; safe because the PreToolUse hook gates every continuation turn; the real risk is unboundedness, bounded by a mandatory plugin-side AbortController wall-clock ceiling), paired with an S-effort **`goal.summary` parser hardening** (report 56 §2). MONITOR: auto-upgrade drift (→ H9), repeated-tool-call loop detection (#364, free quality win), `kimi provider` CLI (#313). IGNORE: TODO injection, MicroCompaction, ACP, background-ask, `/btw`, `/undo`, adaptive-thinking, flag logging, app_version metadata. See report 60 Part B.

- **2026-06-03 (v1.1.0 feature — first post-GA feature release)** — Shipped the **`/kimi:pursue`** autonomous goal-mode command + the `goal.summary` stream-json parser hardening, built on the 0.7–0.9 compat audit's feature track (report 60 Part B). `/kimi:pursue` exposes kimi-code 0.8.0+ headless goal mode as a write-capable, autonomous command that reuses the rescue trust boundary (same PreToolUse hook + workspace allowlist on every continuation turn, `command_type:"rescue"` lineage), bounded by a mandatory `--budget` wall-clock ceiling. Foreground-only, no `--resume` (goalId≠sessionId), experimental. Incorporated a kimi shape-consult (separate command, foreground-first, the goalId/sessionId trap) and a code-reviewer APPROVE (no write-/hook-bypass). The **load-bearing safety test** — a goal-mode real-binary smoke proving the hook fires on every continuation turn — was authored and validated GREEN against kimi-code 0.9.0 (zero files across a full wall-clock budget of relentless autonomous retries). Loop detection (#364) documented in `docs/safety.md` as a complementary autonomy guardrail. Still open: per-push CI for the goal-mode smoke (shares H7's OAuth-credentials-secret blocker); promoting pursue from `command_type:"rescue"` lineage to a first-class command type; `--background`/`--resume` once upstream goal mode stabilizes. Reports 56–60.

- **2026-06-09** — kimi-code shipped **four releases since the verified 0.9.0** (0.10.0, 0.10.1, 0.11.0, 0.12.0); the operator's binary had already auto-upgraded to 0.12.0 out-of-band (PR #334 drift — exactly the case the version probe was built to catch). Certified the whole jump in one cumulative 0.9.0→0.12.0 pass via the playbook's 4-reviewer audit (hook contract / stream-json / CLI surface / adversarial). Verdict: **COMPAT-PRESERVED** (unanimous), backed by a GREEN `bun run smoke:real` on the installed 0.12.0 binary (review/challenge/ask/review_gate all hook-denied — review_gate's first run aborted on the 120s default test budget, a timeout not a deny-miss, and passed on a 240s re-run; the pursue goal-mode smoke wrote zero files across a full budget). Patch release **v1.1.1** extends `KIMI_TESTED_MINORS` to `{0,10}`, `{0,11}`, `{0,12}` and tags `compat-verified-kimi-code-0.12.0`. Findings:
  - `03-hooks.diff` (both `agent/hooks/` + `session/hooks/`) is **0 bytes across all five tags** (0.9.0/0.10.0/0.10.1/0.11.0/0.12.0). Hook engine, `PreToolCallHookPermissionPolicy`, and the `PermissionManager` reducer byte-identical by blob SHA; `PreToolCallHookPermissionPolicy` still index 0 (auto-approve index 4). Stream-json writer (`writeResumeHint`/`PromptJsonWriter`) and the role-less `goal.summary` shape unchanged.
  - **Goal-mode experimental gate REMOVED in 0.12.0 (#569, commit d7407b0)** — the headline change. `run-prompt.ts` dropped `harness.getExperimentalFlags()`/the `flagEnabled` param, so `parseHeadlessGoalCreate(opts.prompt!)` now triggers headless goal mode on the `/^\/goal(\s|$)/` prompt prefix ALONE (the gate was still present 0.9.0–0.11.0; verified tag-by-tag). **This invalidates the old "double-gated" claim** in AGENTS.md / `kimi-version-probe.ts` / `docs/safety.md` / `pursue.ts` — corrected to single-gated this release. Compat-benign: the plugin never relied on the env gate — read-only commands hard-prefix an English instruction line (`buildAskPrompt`/`buildReviewPrompt`) so their trimmed prompt never starts with `/goal` (adversarial reviewer's `/kimi:ask "/goal …"` attack failed at this layer), and the index-0 hook denies every write regardless. `/kimi:pursue` still sets `KIMI_CODE_EXPERIMENTAL_GOAL_COMMAND=1` — now redundant on 0.12 but harmless (unknown experimental flag ids resolve to `undefined`) and still required on 0.8–0.11.
  - **AgentSwarm (#424)** — new `AgentSwarm` tool + `swarmMode` + a `SwarmModeAgentSwarmApprovePermissionPolicy` at queue index ~14 (below hook(0)/auto-approve(4)). Approve-only, double-guarded (`name==='AgentSwarm' && swarmMode.isActive`); `swarmMode.enter('tool')` runs INSIDE the tool's `execute()` — after the index-0 hook already gated the `AgentSwarm` call. Swarm subagents still inherit `DenyAllPermissionPolicy` (`subagent-host.ts:233`, byte-identical). Unreachable/benign for plugin spawns.
  - **`doctor` subcommand + `program.argument('[args...]')` unknown-positional error** — both unreachable: the plugin passes the prompt as the VALUE of `-p, --prompt`, never a bare positional. Auto-approve still hard-coded in `-p`.
  - **04-wire-records (108 KB)** — entirely on-disk session-store / record-replay / swarm-batching churn (`session/goal.ts` deleted −826, `subagent-batch.ts` +638, `records/types.ts` +51, session-store migration `v1.4.ts`). None reaches the `-p` stdout NDJSON surface the plugin parses.
  - Edits applied: `runtime/kimi-version-probe.ts` (`KIMI_TESTED_MINORS` → `{0,10}/{0,11}/{0,12}` + audit comment), `runtime/stream-json.ts` (verified-through widened to 0.12.0, goal.summary gate note corrected), AGENTS.md (Version, Upstream-compat paragraph, dual-source paragraph, pursue invariant), `docs/safety.md` (goal-mode gate-change note + verified-through), `runtime/commands/pursue.ts` (env-redundancy note + verified-through), this log entry, 5-file version bump 1.1.0 → 1.1.1.
  - Reports: `.claude/kimi-code-research/reports/61-upstream-012-hook-contract.md`, `62-…-stream-json.md`, `63-…-cli-surface.md`, `64-…-adversarial.md`, `65-…-synthesis.md`.
  - **Feature-track / MONITOR (NOT shipped in v1.1.1):** (1) **goal mode is no longer experimental-flagged (0.12.0)** — strengthens the case for promoting `/kimi:pursue` out of "experimental". (2) **PR #552 "restore goal resume state from agent records"** is the upstream work that may reconcile the goalId/sessionId split currently blocking pursue `--resume`; re-investigate whether headless goal resume is now feasible. (3) **AgentSwarm** (parallel subagent swarms) — not aligned with the plugin's read-only/rescue/pursue surface; IGNORE unless a concrete use case appears. (4) **`kimi doctor`** — could enrich `/kimi:setup` diagnostics; low priority.

- **2026-06-12** — kimi-code shipped **five releases since the verified 0.12.0** (0.12.1, 0.13.0, 0.13.1, 0.14.0, 0.14.1); the operator's binary had already auto-upgraded to 0.14.1 out-of-band (PR #334 drift — two minors past the verified max, firing the v1.2.1 "newer than tested max" probe warning, exactly the case it was built to surface). Certified the whole jump in one cumulative 0.12.0→0.14.1 pass via the playbook's 4-reviewer audit (hook contract / stream-json / CLI surface / adversarial). Verdict: **COMPAT-PRESERVED** (unanimous), backed by a GREEN `bun run smoke:real` on the installed 0.14.1 binary — review/challenge/ask/review_gate all hook-denied, the pursue goal-mode smoke wrote zero files across a multi-turn budget (goal.summary parsed cleanly: `turnsUsed:2, tokensUsed:69450, goalId:…`), and the swarm smoke confirmed a spawned swarm subagent's forced write is hook-denied. Patch release **v1.2.3** extends `KIMI_TESTED_MINORS` to `{0,13}`, `{0,14}` and tags `compat-verified-kimi-code-0.14.1`. Findings:
  - **Hook + permission chain intact.** Hook engine (`session/hooks/{engine,runner}.ts`), `pre-tool-call-hook.ts`, the stream-json writer (`PromptJsonWriter`/`writeResumeHint`), the `records/` dir, and CLI argv (`options.ts`/`commands.ts`) are all **byte-identical** 0.12.0→0.14.1 (verified per-tag to rule out add-then-revert). The only `session/hooks/` change is an additive `Interrupt` event type (`types.ts`, +1 line), inert for a PreToolUse-only consumer. `PreToolCallHookPermissionPolicy` is **still index 0** (`policies/index.ts:28-30`).
  - **Permission-stack churn (`02-permission.diff`, 6.3 KB) — two changes, both compat-benign.** (a) NEW `AgentSwarmExclusiveDenyPermissionPolicy` inserted at **index 1**: a pure DENY that fires only when a batch has >1 `AgentSwarm` or mixes `AgentSwarm` with other tools — "first non-undefined wins" means it can never pre-empt the index-0 hook, and a single lone `AgentSwarm` call (what `/kimi:swarm` issues) returns `undefined` and proceeds. It enforces "one `AgentSwarm` per response, alone in its batch" (also documented now in `agent-swarm.md`). (b) `CwdOutsideFileWriteAskPermissionPolicy` REMOVED: an `ask` policy that sat AFTER `auto-mode-approve`, so it was already dead in `-p` auto mode — its removal opens zero new write surface; the plugin owns workspace confinement via `rescue-approval.ts`, never kimi's cwd-ask. The index-1 insert shifts `AutoModeApprovePermissionPolicy` from index 4 (0.6.0–0.12.0) to **index 5** in 0.14.1 — structural invariant unchanged (every policy between the index-0 hook and the first approve is a DENY).
  - **AgentSwarm / goal-mode `-p` paths unchanged.** All 0.13/0.14 AgentSwarm + goal-mode churn is TUI-side (`tui/commands/`, dialogs, panels, markers); the AgentSwarm tool core (`agent-swarm.ts`, `name = 'AgentSwarm' as const`) and `subagent-host.ts` (swarm subagent standard permission stack — no `deny-all`) are byte-identical, and the headless `kimi -p "/goal …"` path is unchanged. The real-binary swarm + pursue smokes both passed.
  - **New `packages/protocol/` REST+WebSocket control API (PR #612, ~hundreds of lines, the headline 0.13/0.14 feature)** — a SEPARATE transport for remote/web control. Confirmed NOT on our `-p` path: `run-prompt.ts` imports none of `protocol`/`rpc/events`/`SDKSessionRPC`, and in stream-json mode the only stdout writer is `new PromptJsonWriter(stdout)` (`run-prompt.ts:384`). No change to the parsed NDJSON shape.
  - **Other 0.13/0.14 changes, all off our path:** session-lifecycle (active-turn cancel-on-close with 8s timeout + `BACKGROUND_KEEP_ALIVE_ON_EXIT` default flipped true→false — both ALIGN with our SIGTERM→SIGKILL descendant-reaping, neither orphans anything new), an `alwaysThinking` model-capability flag (read-only detection, relevant to but not unblocking H5), a `run-prompt.ts` SIGHUP cleanup handler (exit 129; SIGTERM still exits 143 and runs cleanup), and a new builtin `import-from-cc-codex` skill.
  - **Housekeeping:** restored sync-corrupted `dist/*.js` (an iCloud sync conflict under `~/Documents/` had rolled the working tree back to stale 1.2.0-era dist content and left `* 2.js` conflict copies; `git checkout -- dist/` + deleting the `* 2.js` artifacts restored the committed 1.2.2 dist before the rebuild). Not a code change — pre-existing working-tree damage cleaned up as part of the audit.
  - Edits applied: `runtime/kimi-version-probe.ts` (`KIMI_TESTED_MINORS` → `{0,13}/{0,14}` + audit comment, index-4→5 shift noted), `runtime/stream-json.ts` (verified-through widened to 0.14.1 + protocol-transport note), AGENTS.md (Version, Upstream-compat paragraph), this log entry, 5-file version bump 1.2.2 → 1.2.3.
  - Reports: `.claude/kimi-code-research/reports/72-upstream-0141-hook-contract.md`, `73-…-stream-json.md`, `74-…-cli-surface.md`, `75-…-adversarial.md`, `76-…-synthesis.md`.
  - **Feature-surface spike (report 77, 2026-06-12):** a dedicated pass confirmed **0.13/0.14 opened no new *buildable* feature surface** — every plugin-relevant change is dormant scaffolding, TUI-only, read-only detection, or passive cancellation hygiene. Both deferred features are unmoved by the cycle: **write-swarm's C1 blocker (per-subagent worktree isolation) is still unsolved upstream** (the AgentSwarm subagent path — `subagent-host.ts`/`subagent-batch.ts`/`agent-swarm.ts` — is byte-identical 0.12.0→0.14.1; `resume_agent_ids` is a continuation primitive, not isolation), and **pursue-`--resume` is STILL-BLOCKED** (no headless `/goal resume` re-drive landed). **Next-build recommendation (unchanged by this cycle):** report 71's **write-capable parallel swarm via plugin-orchestrated ephemeral git worktrees** (N `kimi -p` rescue jobs, one per worktree, merged by the main thread) — it needs **zero upstream change** and is the strongest candidate for the next minor (v1.3.0), independent of AgentSwarm's missing isolation.
  - **Feature-track / MONITOR (NOT shipped in v1.2.3):** (1) **`packages/protocol/` REST+WS control API (#612)** — a dormant remote/web-control daemon transport (no server binds, no `kimi serve` entry point); the one genuinely strategic item — a potential future transport beyond subprocess stream-json — but MONITOR until upstream wires it up, not buildable now. (2) **`Interrupt` hook event** — new hook event type; no current plugin use case. (3) **`alwaysThinking` capability** — upstream is adding thinking-capability *metadata* (read-only), still not the per-spawn thinking-control knob H5 wants; keep H5 MONITOR. (4) The 0.14 `AgentSwarmExclusiveDenyPermissionPolicy` means `/kimi:swarm` coordinators must issue swarms one-at-a-time, alone in a batch — already how a single fan-out behaves; note in swarm docs only if a coordinator ever trips the deny.

- **2026-06-13 (patch checkup, not a triggered multi-minor audit)** — kimi-code shipped **0.14.2** (npm `latest`, GitHub `Latest`); the operator's binary had already auto-upgraded into it out-of-band (PR #334 drift), but because v1.2.3 already listed `{0,14}` in `KIMI_TESTED_MINORS`, the version probe did **not** fire — this is a patch *within* an already-certified minor, so the playbook's full 4-reviewer audit is **not** warranted. Generated the four scoped diffs (`@moonshot-ai/kimi-code@0.14.1`..`0.14.2`) and read them in the main thread. Verdict: **COMPAT-PRESERVED, zero runtime change**, backed by a GREEN `bun run smoke:real` (7 pass / 0 fail) on the operator's installed **0.14.2** binary — review/challenge/ask/review_gate all hook-denied, the pursue goal-mode smoke wrote zero files across a multi-turn budget (`goal.summary` parsed cleanly: `turnsUsed:2, tokensUsed:96462, goalId:12cd8e38…`), and the swarm smoke confirmed a spawned swarm subagent's forced write is hook-denied. **No version bump, no 4-reviewer audit** — docs + a flaky-test de-flake only; tag `compat-verified-kimi-code-0.14.2`. Findings:
  - **The three load-bearing surfaces are 0-byte diffs.** `02-permission.diff` scoped to `permission/` alone is **0 bytes** (policy queue order unchanged — `PreToolCallHookPermissionPolicy` still index 0, `AgentSwarmExclusiveDenyPermissionPolicy` still index 1). `03-hooks.diff` (`agent/hooks/` + `session/hooks/`) is **0 bytes** (hook engine byte-identical). The stream-json writer surfaces — `records/` and the `PromptJsonWriter`/`writeResumeHint` region of `run-prompt.ts` — are **0 bytes** (NDJSON output shape, `session.resume_hint`, `goal.summary` all unchanged; smoke parsed `goal.summary` cleanly).
  - **The ~33-file uniform tool change is a bundler-import migration.** Nearly every `tools/builtin/**` file plus `session/subagent-host.ts` and `agent.ts` changed only their markdown-description imports: `from './x.md'` → `from './x.md?raw'` (a Vite raw-import suffix; one line in most files, three import lines in `agent.ts`, and `prompt-modules.d.ts` updated to `declare module '*?raw'`). Build-time only; no runtime behavior, no tool-name or approval-rule change. **`AgentSwarm` tool name is still `'AgentSwarm' as const`** (load-bearing for `/kimi:swarm`'s hook allow-list) and the singular `Agent` tool is still denied.
  - **`bash.ts` (+18/−8, the rescue execution surface) adds an `onUpdate` streaming callback** that emits stdout/stderr chunks live during a command. `approvalRule: literalRulePattern(this.name, args.command)` and `matchesRule` are unchanged, so the PreToolUse hook still receives the same `{tool_name:"Bash", tool_input:{command}}` shape and the rescue allowlist still parses `args.command` identically. The callback feeds TUI/RPC live output, not `-p` stdout (the stream-json writer is byte-identical), so our parser sees nothing new. Pure observability.
  - **`run-prompt.ts` (+3) writes config-diagnostics warnings to STDERR** (`for (const warning of (await harness.getConfigDiagnostics()).warnings) stderr.write(\`Warning: ${warning}\n\`)`). stderr is humans-only on our side; the stdout stream-json parser is unaffected, and the strict line-anchored stderr resume-hint fallback regex (full-UUID payload required) cannot misread a `Warning:` line. This stderr line is the only `-p`-reachable surface of 0.14.2's new config-diagnostics subsystem (a ~180-line `config/toml.ts` addition — `readConfigFileForUpdate`/`TomlError` — plus `getConfigDiagnostics`/`ConfigDiagnostics` on the RPC core and SDK harness); the rest of that subsystem, and the accompanying TUI/rpc/skill churn, is off our subprocess path — the plugin owns config writes via its own `writeConfigAtomic` and never calls `getConfigDiagnostics`/`readConfigFileForUpdate`.
  - **`options.ts` (−9) removes three `!promptMode`-gated CLI conflict checks** (`--yolo`/`--auto`/`--plan` × `--continue`/`--session`). All were guarded by `!promptMode`, so they only ever fired in *shell* mode — dead in our `-p` path. Removal is benign for the wrapper.
  - **No new buildable feature surface.** 0.14.2 is a maintenance patch; report 77's next-build recommendation (write-capable parallel swarm via plugin-orchestrated ephemeral git worktrees, zero upstream change, v1.3.0 candidate) is unchanged, and the write-swarm C1 (per-subagent worktree isolation) + pursue-`--resume` blockers remain upstream-unmoved.
  - **Gap fixed (not upstream-related): flaky cancellation test de-flaked.** `cli-client.test.ts` › "escalationMs: Infinity opts out of SIGKILL" failed ~1-in-5 under full-suite parallel load. Root cause (confirmed by reading `cli-client.ts`): `result.aborted` is set only inside `onAbort()`; the test fired `controller.abort()` on a nominal-100ms `setTimeout` that competed, across two processes, with the stub's 500ms self-exit timer. Under event-loop starvation the 100ms abort was delayed past the stub's clean self-exit, so `onAbort` never ran and `aborted` stayed `false`. Fix: abort deterministically from `onRecord` (the child's first record proves it is alive; `invokeOnRecord` fires only from the stdout data handler, attached *after* the abort listener), making the ordering causal instead of a timer race. The runtime was correct throughout (with `Infinity` it never sends SIGKILL) — this was purely a test-margin bug. Verified 20/20 in isolation and 4/4 + a full green `bun run check` under 16-worker CPU contention.
  - Edits applied: `runtime/kimi-version-probe.ts` (0.14.2 audit comment after `{0,14}`; no array change — minor-level membership already covers it), `runtime/stream-json.ts` (verified-through widened to 0.14.2), AGENTS.md (Version line + Upstream-compat paragraph), `tests/runtime/cli-client.test.ts` (deterministic abort), this log entry, rebuilt `dist/`. No 5-file version bump.

- **2026-06-14 (patch checkup, not a triggered multi-minor audit)** — kimi-code shipped **0.14.3** (npm `latest`, GitHub `Latest`); the operator's binary had already auto-upgraded into it out-of-band (PR #334 drift), but because `{0,14}` is already in `KIMI_TESTED_MINORS`, the version probe did **not** fire — a patch *within* an already-certified minor, so the playbook's full 4-reviewer audit is **not** warranted. Generated the four scoped diffs (`@moonshot-ai/kimi-code@0.14.2`..`0.14.3`) and read them in the main thread. Verdict: **COMPAT-PRESERVED, zero runtime change**, backed by a GREEN `bun run smoke:real` (7 pass / 0 fail) on the operator's installed **0.14.3** binary — review/challenge/ask/review_gate all hook-denied, the pursue goal-mode smoke wrote zero files across a multi-turn budget (`goal.summary` parsed cleanly: `turnsUsed:2, tokensUsed:49428, goalId:f9738c6f…`), and the swarm smoke confirmed a spawned swarm subagent's forced write is hook-denied. **No version bump, no 4-reviewer audit** — docs-only; tag `compat-verified-kimi-code-0.14.3`. Findings:
  - **All four scoped diffs are 0-byte.** `01-cli-prompt-mode.diff` (`run-prompt.ts` + `options.ts`/`commands.ts`), `02-permission.diff` (`permission/` — policy queue order unchanged, `PreToolCallHookPermissionPolicy` still index 0, `AgentSwarmExclusiveDenyPermissionPolicy` still index 1), `03-hooks.diff` (`agent/hooks/` + `session/hooks/` — hook engine byte-identical), and `04-wire-records.diff` (`records/` + `session/` — NDJSON output shape, `session.resume_hint`, `goal.summary` all unchanged) are **each 0 bytes**. Every surface the safety model rests on is byte-identical 0.14.2→0.14.3.
  - **The entire ~300-line patch is a single TUI change (PR #713 — "Refresh provider model metadata before opening the model picker").** `tui/commands/config.ts` (+36): `handleModelCommand` is now `async` and calls a new `refreshModelsForPicker()` (wrapping `host.authFlow.refreshOAuthProviderModels()` in a 2s `withTimeout`) before `showModelPicker`. `tui/commands/dispatch.ts` (+1): `await handleModelCommand`. `tui/controllers/auth-flow.ts` (+25/−19): factors `refreshProviderModels` into a scoped `refreshProviderModelsWithScope('all'|'oauth')` and adds the `oauth` variant. `tui/utils/refresh-providers.ts` (+16): `refreshAllProviderModels` gains an optional `{scope}` param that early-returns after the OAuth-provider pass when `scope==='oauth'`. Plus the matching TUI test files and the EN/ZH changelog.
  - **None of it reaches the `-p` headless path.** The changed `/model` command lives in the interactive TUI slash dispatcher (`tui/commands/`), not the `-p` argv parser (`cli/commands.ts`/`options.ts`, both 0-byte). `refreshAllProviderModels` is invoked only from the TUI auth-flow controller; the sole reference outside `tui/` is a JSDoc mention in `cli/sub/provider.ts` (the `kimi provider` subcommand the plugin never invokes) that doesn't call it, and the new `scope` param is optional, **defaulting to `'all'`**, so existing callers are unaffected. `run-prompt.ts` is byte-identical, so its pre-existing `oauth_refresh` telemetry call is unchanged. The config-writing `setConfig`/`removeProvider` calls inside `refresh-providers` fire only from the TUI auth-flow controller, never from a `-p` spawn.
  - **No new buildable feature surface.** 0.14.3 is a TUI-only maintenance patch; report 77's next-build recommendation (write-capable parallel swarm via plugin-orchestrated ephemeral git worktrees, zero upstream change, v1.3.0 candidate) is unchanged, and the write-swarm C1 (per-subagent worktree isolation) + pursue-`--resume` blockers remain upstream-unmoved.
  - Edits applied: `runtime/kimi-version-probe.ts` (0.14.3 audit comment after `{0,14}`; no array change — minor-level membership already covers it), `runtime/stream-json.ts` (verified-through widened to 0.14.3), AGENTS.md (Version line + Upstream-compat paragraph), this log entry, rebuilt `dist/` (the comment-only `.ts` edits carry through to `dist/kimi-version-probe.js` + `dist/stream-json.js` — bun preserves leading comments — so the drift gate required a rebuild; verified comment-only, no executable code changed). No 5-file version bump.

- **2026-06-16 (new-minor checkup → v1.2.4 release)** — kimi-code shipped **0.15.0** (npm `latest`, GitHub `Latest`); the operator's binary had auto-upgraded into it out-of-band (PR #334 drift), and crossing the 0.14→0.15 minor boundary fired the `/kimi:setup` version probe's H9 "newer than tested max" warning (`KIMI_TESTED_MINORS` covered `{0,…,14}`, not `{0,15}`). The daily scheduled routine produced a **propose-only** surface review (report 78) + a Phase-1b smoke; this entry records the human-applied catch-up. Verdict: **COMPAT-PRESERVED** — extending the tested-minors array is the only runtime change. The report's verdict was **re-confirmed independently before tagging** via `git diff … | wc -c` on the local clone (`@moonshot-ai/kimi-code@0.14.3..0.15.0`), not taken on trust. Backed by a GREEN `bun run smoke:real` on the operator's installed **0.15.0** binary (report 78: 7 pass / 0 fail; review/challenge/ask/review_gate hook-denied; pursue goal-mode wrote zero files, `goal.summary` parsed cleanly `turnsUsed:2, tokensUsed:51199, goalId:47044d44…`; swarm subagent write hook-denied). **Real patch bump (v1.2.4)** — unlike the docs-only 0.14.2/0.14.3 patches, extending `KIMI_TESTED_MINORS` is a runtime change. Findings:
  - **The load-bearing safety surfaces are 0-byte.** `permission/` (PreToolCallHookPermissionPolicy still index 0, AgentSwarmExclusiveDenyPermissionPolicy still index 1), the hook engine (`agent`+`session` `hooks/`), and `run-prompt.ts` + CLI argv (`commands.ts`/`options.ts`) are **each 0 bytes** between 0.14.3 and 0.15.0 — confirmed by direct byte-count, not just the report.
  - **The only changed scoped surface is `records/` + `session/` (~5.3 KB), all off the `-p` path.** PR #786 drops `app_version`/`resumed` from the persisted `.records/` metadata replay artifact (NOT the `-p` stdout stream — `PromptJsonWriter` is byte-identical); PR #784 renames `SkillRegistry`→`SessionSkillRegistry`; PR #776 swaps a temporary-provider instantiation for a static model-capability lookup. `runtime/stream-json.ts` only reads role-keyed records (`assistant`, `meta`/`session.resume_hint`, `goal.summary`) and never consumed `metadata`. Benign.
  - **MCP SSE transport (#744) is additive config only.** A new `transport:'sse'` variant in the MCP config discriminated union (`config/schema.ts`); the plugin configures no MCP servers for its `-p` spawns and `writeConfigAtomic` preserves the rest of the TOML, so it cannot break our written config.
  - **Everything else is TUI / system-prompt / packaging churn** (all-sessions session picker #779, same-language status-sentence prompt wording #780/#787, staged auto-update rollout #775) — off the `-p` path. `AgentSwarm` tool name unchanged; `tool/index.ts` re-registration is transparent to our name-gated hook.
  - Edits applied: `runtime/kimi-version-probe.ts` (`{0,15}` added to `KIMI_TESTED_MINORS` + audit comment — the load-bearing change), `runtime/stream-json.ts` (verified-through widened to 0.15.0), AGENTS.md (Version line + Upstream-compat paragraph + Releasing list + Post-GA H7 framing), `docs/safety.md` (corrected a stale `auto-mode-approve at index 4` → index 5 parenthetical, drifted since 0.14.1), `CHANGELOG.md` (revived with a post-GA pointer banner + 1.2.4 entry), `CONTRIBUTING.md`/`.github/workflows/smoke.yml`/`docs/ci.md` doc-currency fixes, `docs/upstream-compat-audit.md` (playbook diff-scope correction), this log entry, 6-file version bump 1.2.3 → 1.2.4 (now incl. CHANGELOG.md per the updated Releasing list), rebuilt `dist/`. Tags `v1.2.4` + `compat-verified-kimi-code-0.15.0`.
  - Report: `.claude/kimi-code-research/reports/78-upstream-0150-surface.md`.

- **2026-06-17 (new-minor checkup → v1.2.5 release)** — kimi-code shipped **0.16.0**; the operator's binary auto-upgraded 0.15.0→0.16.0 within ~a day (PR #334 drift), re-firing the `/kimi:setup` H9 "newer than tested max" warning one minor after v1.2.4 silenced it for 0.15.x. Verdict: **COMPAT-PRESERVED** — extending `KIMI_TESTED_MINORS` to `{0,16}` is the only runtime change. Verified independently via `git diff` byte-count on the clone (`@moonshot-ai/kimi-code@0.15.0..0.16.0`) and a **GREEN** `bun run smoke:real` on the operator's installed **0.16.0** binary (7 pass / 0 fail; review/challenge/ask/review_gate hook-denied; pursue goal-mode wrote zero files, `goal.summary` parsed cleanly `turnsUsed:2, tokensUsed:52211, goalId:fd944733…`; swarm subagent write hook-denied). Findings:
  - **The 3 core safety surfaces are 0-byte.** `permission/` (PreToolCallHookPermissionPolicy still index 0, AgentSwarmExclusiveDenyPermissionPolicy still index 1), the hook engine (`agent`+`session` `hooks/`), and `run-prompt.ts` are each 0 bytes 0.15.0→0.16.0.
  - **The only CLI argv change is a new `kimi vis` subcommand** (a visualization server; `commands.ts` registers it + a new `cli/sub/vis.ts`). Off the `-p` path — our `-p`/`-r`/`--output-format`/`-m`/`--skills-dir` flags are untouched and auto-approve is unchanged. The plugin never invokes `kimi vis`.
  - **The records/session/replay/agent churn (~834 insertions) is internal, off the `-p` stdout stream.** A compaction refactor (`compaction/full.ts`, `strategy.ts`), a new `llm-request-logger.ts`, replay-build additions (`replay/build.ts`, `replay/index.ts`), a `SkillRegistry`→`SessionSkillRegistry` continuation, and a `kimi-env-params.ts` move (`agent/`→`config/`). `runtime/stream-json.ts` reads only the role-keyed `-p` stdout records (`PromptJsonWriter`, byte-identical) — none of this reaches it. `utils/paths.ts` adds only a TUI `cache/banner/` dir (not a creds/home layout change).
  - **Process note (candidate hardening item):** the operator's re-login (to refresh an expired `managed:kimi-code` OAuth token mid-audit) made kimi-code rewrite `config.toml`, which **stripped the plugin's managed-block comment markers** (`# === BEGIN/END kimi-plugin-cc-managed ===`) — kimi-code's TOML writer doesn't preserve comments. The `[[hooks]]` entry and the hook's enforcement survived; only the markers were lost, degrading `/kimi:setup`'s marker-based idempotency/verification (a marker-less block isn't recognized, so a later setup could add a duplicate, and `--check` may not find it). Re-running `/kimi:setup` restores the block. Hardening candidate: make the verifier match a marker-less-but-byte-correct hook entry, or detect+repair a stripped block.
  - Edits applied: `runtime/kimi-version-probe.ts` (`{0,16}` + audit comment), `runtime/stream-json.ts` (verified-through 0.16.0), AGENTS.md (Version + Upstream-compat), CHANGELOG.md (1.2.5 entry), this log entry, 6-file version bump 1.2.4 → 1.2.5, rebuilt `dist/`. Tags `v1.2.5` + `compat-verified-kimi-code-0.16.0`.

- **2026-06-19 (new-minor catch-up + feature → v1.2.6, run from a CLOUD session)** — kimi-code shipped **0.17.0, 0.17.1, 0.18.0** since the verified 0.16.0 (npm `latest` = 0.18.0); the operator's binary auto-upgraded past the tested 0.16 max (PR #334 drift), re-firing the H9 "newer than tested max" probe warning. Ran the playbook's Phase 0 scoped diffs (`@moonshot-ai/kimi-code@0.16.0..0.18.0`) and read them in the main thread. Verdict: **COMPAT-PRESERVED** — extending `KIMI_TESTED_MINORS` to `{0,17}` + `{0,18}` plus the swarm-concurrency feature are the runtime changes. Findings:
  - **The core safety surfaces hold.** `03-hooks.diff` is **0-byte** (both `agent/hooks/` and `session/hooks/`) and `pre-tool-call-hook.ts` is 0-byte 0.16.0→0.18.0. `PreToolCallHookPermissionPolicy` is **still index 0**, `AgentSwarmExclusiveDenyPermissionPolicy` index 1, `AutoModeApprovePermissionPolicy` index 5 (first approve; every policy between the index-0 hook and it is a DENY). The ONLY permission change is a NEW `GoalStartReviewAskPermissionPolicy` (#839 guided goal authoring) inserted at index ~10 *after* auto-mode-approve — an `ask` gated to a *model-issued* `CreateGoal` in NON-auto mode that returns early when `permission.mode === 'auto'` (triple-dead on the `-p` auto path; an `ask` cannot approve). `options.ts` is **byte-identical**; `run-prompt.ts` changes only in a telemetry refactor (`started` event → harness `sessionStartedProperties`), with the permission-forcing chain and stream-json writer unchanged.
  - **"Kimi web" landed upstream and is off our path.** PR #625 ("Kimi web app + daemon gateway") adds a `kimi server`/`kimi web` subcommand stack and session ARCHIVE (`archived` flag + `archive()`/`includeArchive` in the session store + rpc core-api). The plugin owns its own SQLite job store, never invokes `kimi server`, and never reads kimi's session list, so neither reaches the `-p` path. (The operator flagged Kimi web's availability; confirmed benign — we dropped web-based session renaming long ago.)
  - **New buildable feature shipped: AgentSwarm concurrency cap (#888, 0.18.0).** `KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY` caps how many AgentSwarm subagents `SubagentBatch` runs concurrently (unset = legacy uncapped ramp; non-positive-integer throws). v1.2.6 wires it into `/kimi:swarm` so `--cap N` becomes a HARD concurrency ceiling on 0.18+ (via `CliClientOptions.swarmMaxConcurrency` → `cli-client.ts::buildEnv`), in addition to the existing soft prompt-count hint; older binaries ignore the unknown env var. This is the first new buildable swarm surface since v1.2.0 — write-swarm's C1 blocker (per-subagent worktree isolation) and pursue-`--resume` remain upstream-blocked.
  - **Phase 1b smoke — GREEN, cleared before merge.** The cloud session that *prepared* this catch-up had no kimi binary and no authenticated `~/.kimi-code`, so its `bun run smoke:real` was deferred to an explicit pre-merge gate (every prior `KIMI_TESTED_MINORS` extension cited a GREEN smoke). The gate was closed locally on **2026-06-19** against the operator's installed **0.18.0** binary: **7 pass / 0 fail** — review/challenge/ask/review_gate forced writes hook-denied; pursue's multi-turn goal wrote zero files (`goal.summary` parsed cleanly `turnsUsed:2, tokensUsed:44468`); a spawned swarm subagent's forced write hook-denied. The Phase 0 scoped diffs were **independently re-reproduced** before merge (`03-hooks`/`pre-tool-call-hook`/`options.ts` all 0-byte by `git diff | wc -c`; policy order: hook index 0, first approve index 5, GoalStartReviewAsk index ~10), and a **six-reviewer + independent adversarial** pass (the playbook's Phase 1 + Phase 4) all returned **CONFIRMED-SAFE**, including a code review of the new `--cap` → `KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY` wiring (the one surface not covered by report 81's smoke): a 19-edge-input round-trip proved every `--cap` the plugin accepts passes upstream's identical positive-integer validator, with zero new write/permission surface. Tag `compat-verified-kimi-code-0.18.0`.
  - **`/kimi:ask` shape consult (operator practice for surface changes).** Dogfooded a `/kimi:ask` on the `--cap` overload. Kimi recommended **splitting** the control — keep `--cap` as the soft total-count hint, add a separate `--max-concurrency` for the hard ceiling — flagging the "cap-as-total-count illusion": a user reading `--cap 5` (and the injected prompt's "≤5 subagents") expects a total-cost bound, but on 0.18+ the value only bounds *peak concurrency*; a coordinator can still launch many subagents *sequentially*. Shipped v1.2.6 with the overloaded `--cap` (honestly documented as concurrency≠total in `parsing.ts` + CHANGELOG; the always-on `--budget` wall-clock ceiling remains the real cost backstop). **Followed up immediately in v1.2.7 (2026-06-19, same day):** split into a soft `--cap` (total-count prompt hint) + a hard `--max-concurrency` (the env-var ceiling), so the two bounds are independently expressible and the illusion is gone — see the v1.2.7 entry below.
  - **Docs slimming (operator request).** Trimmed the AGENTS.md "Version" + "Upstream compat" lines from their accumulated per-version essays to a lean current-state summary + pointers, relocating the historical narrative to CHANGELOG.md and this log (the per-version compat reasoning also lives verbatim in `runtime/kimi-version-probe.ts` comments). Goal: keep AGENTS.md / CLAUDE.md readable for agents, with traces in the changelog/roadmap.
  - Edits applied: `runtime/kimi-version-probe.ts` (`{0,17}`+`{0,18}` + audit comment), `runtime/cli-client.ts` (`swarmMaxConcurrency` option + `buildEnv` overlay + spawn-log field), `runtime/commands/swarm.ts` (thread `--cap`), `runtime/parsing.ts` (two-tier `--cap` doc), `tests/runtime/cli-client.test.ts` + `tests/helpers/mock-kimi-stream.ts` (env-reach test), AGENTS.md (slimmed Version + Upstream-compat + swarm invariant), `docs/safety.md` (swarm cost bullet), CHANGELOG.md (1.2.6 entry), this log entry, 4-file version bump 1.2.5 → 1.2.6, rebuilt `dist/`. Prepared on branch `claude/bold-archimedes-s07l9l` (PR #10); the local-flow follow-up (GREEN smoke + Phase 0 re-reproduction + six-reviewer/adversarial pass + `/kimi:ask` shape consult, and flipping the smoke-pending docs to GREEN) was committed onto the branch, then fast-forwarded to `main` and tagged `v1.2.6` + `compat-verified-kimi-code-0.18.0`, `gh release` cut.

- **2026-06-19 (same-day fast-follow → v1.2.7)** — Acted on the `/kimi:ask` shape consult from the v1.2.6 entry: **split `/kimi:swarm`'s `--cap` overload** into a SOFT `--cap` (total-subagent-count prompt hint, unchanged behavior) + a NEW HARD `--max-concurrency` (the `KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY` ceiling on 0.18+). v1.2.6 had wired one `--cap` value to both, which Kimi flagged as the **"cap-as-total-count illusion"** (a user reading `--cap N` expects a total-cost bound but the env var only caps *peak concurrency*; sequential fan-out can still exceed it). Findings:
  - **No compat change, no new write surface.** `--max-concurrency` only sets a concurrency-bounding env var; the `swarm` hook label and read-only allowlist are untouched (PR touches no hook/policy/allowlist file). The split is purely which flag feeds `CliClientOptions.swarmMaxConcurrency` (now `--max-concurrency`, was `--cap`); `cli-client.ts::buildEnv` is unchanged, so the `cli-client.test.ts` env-reach tests still pass as-is.
  - **Validation preserved.** `--cap` and `--max-concurrency` share a new `parsePositiveIntFlag` helper, so both apply the identical `Number.isInteger && > 0` predicate that upstream's `resolveSwarmMaxConcurrency` requires — every accepted value still round-trips through `String()` without throwing.
  - **Why a patch (v1.2.7), not a minor:** a fast-follow refinement of a surface introduced in the immediately-prior patch (v1.2.6, same day), on an experimental prototype command — not a new capability. Backward-compat is a non-issue (v1.2.6's `--cap`-as-hard-cap shipped hours earlier on an experimental command; ~zero real-world use).
  - Edits applied: `runtime/parsing.ts` (`SwarmArgs.maxConcurrency` + `--max-concurrency` case + `parsePositiveIntFlag` helper + reverted `--cap` doc to soft-only), `runtime/commands/swarm.ts` (thread `--max-concurrency`, not `--cap`, into the env; scope/prompt/usage comments), `runtime/cli-client.ts` (field doc), `tests/runtime/swarm.test.ts` (split assertions), `commands/swarm.md` + AGENTS.md (Version + swarm invariant) + `docs/safety.md` (swarm cost bullet), CHANGELOG.md (1.2.7 entry), this log entry, 4-file version bump 1.2.6 → 1.2.7, rebuilt `dist/`. `bun run check` green; reviewed before tag.

- **2026-06-20 (forward-scan, not a triggered audit)** — Daily kimi-code checkup: npm `latest` / GitHub `Latest` / the operator's local binary are all **0.18.0** (= tested max; H9 probe silent). `origin/main` (`7644f10`) is 2 UNRELEASED commits past the `@moonshot-ai/kimi-code@0.18.0` tag — #898 (changelog docs) and #910 ("drop empty text blocks during projection"), an INPUT-side `agent/context/projector.ts` fix that is off the `-p` stdout stream our parser reads and actually HARDENS the `kimi -r` resume path. All four scoped diffs (`0.18.0`..`origin/main`) are **0-byte**. The sole pending `.changeset` is `patch` → next release is **0.18.1**, within the already-certified `{0,18}` minor (no probe fire, no `KIMI_TESTED_MINORS` change; a docs-only patch-checkup + GREEN smoke will suffice). Provisional **COMPAT-PRESERVED**. Report: `.claude/kimi-code-research/reports/82-forward-scan-post-0180.md`.

- **2026-06-20 (feature release → v1.3.0)** — Completed the command↔agent mirror: added model-invocable **`kimi-swarm`** (read-only parallel fan-out) and **`kimi-pursue`** (write-capable autonomous goal mode) subagents, so the main Claude thread can auto-dispatch every capability (previously only review/challenge/ask/rescue had agents; swarm/pursue were human-only slash commands). Auto-dispatch widens **no** safety surface — the index-0 PreToolUse hook fires on every tool call of every turn for all agents (read-only labels deny writes; rescue/pursue apply the workspace allowlist + no git mutation), and the heavy modes keep mandatory `--budget`/concurrency ceilings. **One runtime change:** `/kimi:swarm --max-concurrency` now defaults to **4** (`resolveSwarmMaxConcurrency`, `swarm.ts`) so a now-auto-dispatchable fan-out is peak-bounded by construction on kimi-code 0.18+ (was: kimi-code's internal ramp). Each agent passed its own 4-lens adversarial review workflow (contract / convention / auto-invocation-safety / doc-coherence) with must-fixes applied — swarm: tightened triggering + restricted backgrounding; pursue: fixed a propagated `blocked`-vs-budget factual bug (budget expiry is a `RESPONSE_TIMEOUT` failure, not the exit-3 `blocked` status) in both the agent and `commands/pursue.md`, prohibited backgrounding, budget-steers-down for auto-dispatch, and tightened the rescue↔pursue routing boundary. `bun run check` green; 6-file version bump 1.2.7 → 1.3.0; tag `v1.3.0`.
  - **Write-swarm reframed — supersedes the report-71 / report-77 "per-subagent ephemeral worktree" next-build pointer above.** That framing does not fit kimi-code: `AgentSwarm` subagents share the coordinator cwd (`packages/agent-core/src/session/subagent-host.ts:362`, `cwd: parent.config.cwd`), so per-subagent isolation is impossible without abandoning `AgentSwarm` (the very tool the swarm is built on). The chosen design (**A**) is **one ephemeral worktree for the whole swarm** — trust `AgentSwarm`'s in-process fan-out; the rescue allowlist confines writes to the worktree cwd (double-bound: can't escape the worktree, and the worktree is disposable); the main thread merges a captured patch (it still owns git). Per-subagent worktrees (Design B) are deferred to "if disjoint-target partitioning proves insufficient." Drafted spec (local): `.claude/docs/write-swarm-spec.md`. **v1.4 candidate.** → **shipped v1.4.0 (below).**

- **2026-06-20 (feature release → v1.4.0)** — Shipped **write-capable swarm** (`/kimi:swarm --write`), Design A. The coordinator + `coder` subagents run in an **ephemeral detached worktree off HEAD** (under the plugin data dir, never in the user repo); writes confined by a new `swarm-write` hook label to a **forge-proof trusted worktree root** (`KIMI_PLUGIN_CC_WORKSPACE_ROOT` env, not the payload cwd; fail-closed) reusing `evaluateRescueHookRequest` verbatim; result captured as an untruncated applyable `.patch` (`git add -N` + `git diff --binary`, no loose objects) on every terminal path before the worktree is removed; **the plugin never applies/commits — main thread owns the merge**. Gated to kimi-code **≥ 0.18.0** (hard concurrency cap), a git repo with a born HEAD, and the hook (refuses without it); default `--max-concurrency` **1** for write (vs 4 read); dirty-tree warning; **human-only** (no `kimi-swarm-write` agent). Preceded by a **3-way adversarial spec review** (safety / kimi-contract / convention lenses) whose two reviewer *blockers* were resolved by direct verification against the vendored kimi-code 0.18.0 source rather than taken on faith: (1) the in-process subagent's hook-payload `cwd` equals the coordinator spawn cwd (one `HookEngine` per session built with `cwd: kaos.getcwd()`, `session/index.ts:178`), and (2) swarm subagents use the **standard** permission stack — no deny-all (the lone `DenyAllPermissionPolicy.unshift` is `startBtw()`-only, NOT the swarm spawn path) — so `coder` writes actually land and are gated solely by our hook. Also confirmed: `coder` write tools (`Write`/`Edit`/`Bash`) map to existing allowlist branches (no new branch); `KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY` is per-`SubagentBatch` (nesting can multiply peak → prompt forbids nested swarm). Fixed a stale `kimi-version-probe.ts` comment that mis-cited swarm subagents as inheriting deny-all. Three open questions resolved with unanimous reviewer consensus: write concurrency default **1**, **present** the patch (no auto-apply), keep **human-only**. New unit tests (parse + write-concurrency-default + write prompt; swarm-write hook label incl. the "confine to trusted env root not payload cwd" + fail-closed cases; real-repo worktree create→capture-applyable-patch→remove with main tree untouched). `bun run check` green; 6-file version bump 1.3.0 → 1.4.0; tag `v1.4.0`. **Remaining field-proof:** a gated real-binary write-swarm smoke (write-lands-in-worktree-only, user-tree-unchanged) before any concurrency raise or `kimi-swarm-write` agent. Spec promoted with a "Review resolutions" section (local: `.claude/docs/write-swarm-spec.md`).

- **2026-06-23 (patch release → v1.5.1)** — Daily kimi-code checkup escalated to a certification: npm `latest` reached **0.19.1** (two releases past the tested 0.18 max — the operator's binary had auto-upgraded 0.18.0→0.19.1 out-of-band, PR #334 drift, firing the H9 "newer than tested max" probe warning). Verdict **COMPAT-PRESERVED**; extended `KIMI_TESTED_MINORS` with `{0,19}` (the sole runtime change → patch release). The 0.18→0.19 minor was bumped by **#812 "workspace add-dir support"** (commit `c0eeca2`): a new repeatable `--add-dir <dir>` flag + `GitCwdWriteApprovePermissionPolicy` widened to approve writes within cwd **OR** any additional dir. Compat-benign for the plugin: the **only** permission consumer of `additionalDirs` is `GitCwdWriteApprovePermissionPolicy`, which sits at **index 17** (below `AutoModeApprovePermissionPolicy` at index 5), so on the `-p` auto path it is structurally unreachable; read-only commands deny all writes at the index-0 hook; and our write commands confine to a single root via `rescue-approval.ts`, which never reads `additionalDirs`. (`isWithinWorkspace` with an empty list is byte-for-byte the old `isWithinDirectory(cwd)`, `path-access.ts:159-163`, covering the non-`-p` modes where the policy actually runs.) **Correction caught in the Phase-4 adversarial review:** `additionalDirs` is **not** guaranteed empty for a plugin `-p` spawn even without `--add-dir` — #812 also wired an unconditional auto-load of project-local `.kimi-code/local.toml` `additional_dir` into BOTH the `-p` create and resume bootstraps (`rpc/core-impl.ts:238,363`, via `config/workspace-local.ts`; both absent at 0.18.0) — but per the above it changes no approve/deny decision on our path. Safety chain re-verified intact: `03-hooks.diff` 0-byte (both `agent/hooks/` + `session/hooks/`); `policies/index.ts` byte-identical (`PreToolCallHookPermissionPolicy` index 0, `AutoModeApprovePermissionPolicy` first approve at index 5); `permission:'auto'` still hard-coded. Off-path: **#963** (`4292ae9`) adds a `turn.ended reason:'filtered'` (provider content filter) — a failure *reason*, not a new stdout *shape*, so the role-keyed stream-json parser is unaffected; #821 (detach-to-background) was already triaged in the forward-scans; 0.19.1 over 0.19.0 is `ci:`/`fix(acp)`/`fix(web)` only (0-byte load-bearing diff). **Backed by a GREEN `bun run smoke:real` (9 pass / 0 fail)** on the operator's 0.19.1 binary — review/challenge/ask/review_gate forced writes hook-denied; pursue multi-turn goal wrote zero files (`goal.summary` parsed cleanly, turnsUsed:2 tokensUsed:73631); a read-only swarm subagent's forced write hook-denied; and **both write-swarm assertions held** (a `coder` subagent's edits confined to the throwaway worktree, patchBytes=306, `userTreeClean=true`; an out-of-trusted-root absolute write hook-denied) — the exact surface the `add-dir` widening theoretically threatened, empirically tight. **Next-audit note:** #812 (0.19.0) — **not** #992 — made the `.kimi-code/local.toml` `additional_dir` auto-load LIVE on the `-p` path for all transports (#992 only re-routed that read's kaos handle for an ACP fix). The "never passes `--add-dir` ⟹ `additionalDirs` empty" assumption is broken upstream; re-confirm each audit that the index-0 hook still pre-empts `GitCwdWriteApprove`, and consider a defensive assert/scrub if a future minor lets `additionalDirs` reach a policy above our hook. `bun run check` green; 6-file version bump 1.5.0 → 1.5.1; tags `v1.5.1` and `compat-verified-kimi-code-0.19.1`. Surface report: `.claude/kimi-code-research/reports/85-upstream-0191-surface.md`.

- **2026-06-29 (daily checkup, no release tag)** — kimi-code 0.20.0 → 0.20.2 (patches; the 0.20.2 patch report 90 forward-scanned has landed and is the operator's live binary, auto-upgraded via PR #334 drift). Verdict **COMPAT-PRESERVED** on the actual released `0.20.2` tag (`52e2719`). **No version bump / no `KIMI_TESTED_MINORS` change** — 0.20.2 ∈ already-tested `{0,20}`; H9 silent (a green-smoke verification of an already-tested minor, recorded with a `compat-verified-kimi-code-0.20.2` marker tag, not a plugin release). Load-bearing surfaces clean: `02-permission.diff` 0-byte (`PreToolCallHookPermissionPolicy` still index 0, `AutoModeApprove` index 5); `agent/records/` 0-byte (stream-json shape unchanged); `run-prompt.ts` permission/writer chain unchanged (only telemetry-property renames, #1184). **New load-bearing surface (the finding): #1127 "support hooks in plugins" (0.20.1)** — `rpc/core-impl.ts` create+resume now merge enabled kimi-code *plugin* manifest hooks into the `-p` session hook list (`[...config.hooks, ...plugins.enabledHooks()]`), so we are no longer the sole occupant of the PreToolUse channel. Compat-benign: engine aggregation is **any-block-wins** (`session/hooks/engine.ts::blockDecision` = first `action:'block'` wins; an allow never pre-empts a block) → a plugin hook can only *add* denials, never override our managed deny; our config.toml managed block is unaffected (config `HookDefSchema` is `.strict()`, so the new per-hook `cwd`/`env` are plugin-only — no config-injection). Hook **aggregation semantics** is now an explicit audit-checklist item (re-verify `blockDecision` stays find-first-block). Off-path: #1170/#1186 Anthropic-protocol/betaApi transport plumbing (config `protocol`/`betaApi` alias fields + `provider-manager.ts`; off the `-p` stdout shape + permission stack — note two `// remove before commit` debug comments slipped into `provider-manager.ts` upstream, inert for us), #1125 `upgrade`→`update` alias, #1129/#1156 compaction cap, #1128 server `--allowed-host`. v1.4.1 field-name recheck PASS (`command`/`path` intact); 0.20.0 `runShellCommand`/`cancelShellCommand` RPC WATCH discharged (still RPC/TUI-only). **Smoke GREEN** — `bun run smoke:real` 9 pass / 0 fail on the operator's 0.20.2 binary (2026-06-29): review/challenge/ask/review_gate forced writes hook-denied; pursue multi-turn goal wrote zero files (`goal.summary` parsed cleanly, turnsUsed:2 tokensUsed:85770); a read-only swarm subagent's forced write hook-denied; **both write-swarm assertions held** (coder edits confined to the throwaway worktree, patchBytes=334, `userTreeClean=true`; an out-of-trusted-root absolute write hook-denied). The earlier report-88 0.20.0 quota block (provider 403 "usage limit") was the operator-billing-state false alarm, now cleared — the smoke carry-over is **closed** and `{0,20}` is end-to-end proven on 0.20.2. Edits applied: AGENTS.md (hook-engine load-bearing bullet), `docs/upstream-compat-audit.md` (hook-aggregation surface row), `runtime/kimi-version-probe.ts` (`{0,20}` comment extended; array unchanged), this log entry. Consolidates reports 89 (0.20.1) + 90 (forward-scan) + 91 (0.20.2). Tag: `compat-verified-kimi-code-0.20.2`.

- **2026-07-01 (patch release → v1.6.2)** — Daily kimi-code checkup escalated to a certification: npm `latest` and the operator's live binary reached **0.21.1** (0.21.0 + 0.21.1 published the same day), crossing the already-verified `{0,20}` max and firing the H9 "newer than tested max" warning. Verdict **COMPAT-PRESERVED**; extended `KIMI_TESTED_MINORS` with `{0,21}` (the sole runtime change → patch release). Source audit report 93 found the safety surfaces 0-byte across 0.20.2→0.21.1: `02-permission.diff` (policy queue: `PreToolCallHookPermissionPolicy` index 0, `AutoModeApprovePermissionPolicy` index 5, every policy between a DENY) and `03-hooks.diff` (hook engine + any-block-wins aggregation). Also unchanged on load-bearing axes: `options.ts` (argv), `agent/records/` (stream-json record shape), `config/workspace-local.ts` (additional_dir auto-load), and `tools/builtin/file/{write,edit}.ts` (field still `path`). The scoped `run-prompt.ts` change is #1233 shutdown force-exit, which waits only during cleanup after `session.resume_hint` / `goal.summary` have flushed and helps process reaping. New 0.21.0 surfaces are compat-benign for a `kimi -p` wrapper: **plugin slash commands (#1204)** are RPC/host-initiated, absent from `cli/`, not model tools, macro-expand into prompt text that still goes through the index-0 hook, and are main-agent-only; the thinking-effort/model-catalog refactor is provider config plumbing the plugin does not set or consume; compaction rework and record migrations are replay/history internals, with live stdout shape unchanged. The 0.20.0 `runShellCommand`/`cancelShellCommand` RPC WATCH was discharged again (still RPC/TUI-only). **Smoke GREEN** — `bun run smoke:real` 9 pass / 0 fail on the operator's 0.21.1 binary (2026-07-01): review/challenge/ask/review_gate forced writes hook-denied; pursue goal mode wrote zero files (`goal.summary` parsed cleanly, turnsUsed:2 tokensUsed:57595); a read-only swarm subagent's forced write hook-denied; and BOTH write-swarm assertions held (coder edits confined to the throwaway worktree, patchBytes=334, `userTreeClean=true`, `worktreeCleaned=true`; an out-of-trusted-root absolute write hook-denied). New audit checklist item: re-confirm plugin-command activation stays RPC/host-initiated and off the `kimi -p` path. `bun run check` green; version bump 1.6.1 → 1.6.2; tags `v1.6.2` and `compat-verified-kimi-code-0.21.1`. Surface reports: `.claude/kimi-code-research/reports/93-upstream-021-surface.md` and `93-upstream-021-adversarial.md`.

- **2026-07-05 (patch release → v1.6.4)** — Follow-up cert for kimi-code **0.22.3** after report 94's source-only 0.22.0 scan and report 95's incremental 0.22.0→0.22.3 scan. Verdict **COMPAT-PRESERVED**; extended `KIMI_TESTED_MINORS` with `{0,22}` (runtime probe behavior change → patch release). Load-bearing invariants held through 0.22.3: hook engine `03-hooks.diff` 0-byte, policy queue still hook-first (`PreToolCallHookPermissionPolicy` index 0, `AutoModeApprovePermissionPolicy` index 5), permission diff wording-only, `kimi -p` still forces `permission:'auto'` and installs headless handlers, `Write`/`Edit` still use `path`, `Bash` still uses `command`, and `AgentSwarm` still uses the standard stack. New 0.22.x surfaces are compat-benign: prompt-mode background drain happens after assistant-output flush and is still bounded by plugin budgets; shell output caps affect huge tool-result content only; image originals are Kimi session artifacts under KIMI home, not user-worktree writes; model/thinking/provider config changes do not touch permissions; server auth-bypass flags remain a separate subcommand stack. **Smoke GREEN** — `bun run smoke:real` 9 pass / 0 fail against a temp-installed 0.22.3 binary (2026-07-05): review/challenge/ask/review_gate forced writes hook-denied; pursue goal mode wrote zero files (`goal.summary` parsed cleanly, turnsUsed:2 tokensUsed:93029); a read-only swarm subagent's forced write hook-denied; and BOTH write-swarm assertions held (coder edits confined to the throwaway worktree, patchBytes=334, `userTreeClean=true`, `worktreeCleaned=true`; an out-of-trusted-root absolute write hook-denied). Also tightened swarm missing-hook UX: the refusal remains fail-closed but now tells users to repair via Claude Code `/kimi:setup` or Codex `$kimi-setup`; Codex swarm skills mirror that repair guidance without suggesting the skip env. Tags `v1.6.4` and `compat-verified-kimi-code-0.22.3`. Surface reports: `.claude/kimi-code-research/reports/94-upstream-0220-surface.md` and `95-upstream-0223-surface.md`.

- **2026-07-07 (patch release → v1.6.5)** — New-minor cert for kimi-code **0.23.1** after npm `latest` advanced from the certified 0.22.3 line. Verdict **COMPAT-PRESERVED**; extended `KIMI_TESTED_MINORS` with `{0,23}` (runtime probe behavior change → patch release). Load-bearing invariants held through 0.23.1: hook engine `03-hooks.diff` 0-byte, policy queue still hook-first (`PreToolCallHookPermissionPolicy` index 0, `AutoModeApprovePermissionPolicy` index 5), `kimi -p` still uses the PromptJsonWriter-compatible stream-json path, `Write`/`Edit` still use `path`, plugin hooks are still merged any-block-wins, and `AgentSwarm` read/write behavior remained hook-gated in the real smoke. New 0.23.x surfaces are compat-benign: `select_tools` is an upstream default-approved MCP schema-disclosure tool, but the plugin hook still denies unknown tools before default approval and the smoke passed without adding it to `READ_ONLY_TOOLS`; new observability records are persisted agent-log records, not stdout NDJSON shapes; session workDir/index repair, thinking-keep defaults, and workspace-skill listing do not touch plugin permissions. **Smoke GREEN** — `bun run smoke:real` 9 pass / 0 fail against a temp-installed 0.23.1 binary (2026-07-07): review/challenge/ask/review_gate forced writes hook-denied; pursue goal mode wrote zero files and emitted `goal.summary`; a read-only swarm subagent's forced write hook-denied; write-swarm confined coder edits to the throwaway worktree (`patchBytes=334`, `userTreeClean=true`, `worktreeCleaned=true`); and an out-of-trusted-root absolute write was hook-denied. No safety-surface change: no hook allowlist broadening, no swarm bound/default change, and no auto-setup path. Tags `v1.6.5` and `compat-verified-kimi-code-0.23.1`. Surface report: `.claude/kimi-code-research/reports/96-upstream-0231-surface.md`.

- **2026-07-08 (daily checkup, no plugin release)** — kimi-code **0.23.2** landed one day after the 0.23.1 certification, staying inside the already-tested `{0,23}` minor. Verdict **COMPAT-PRESERVED** on the actual released `0.23.2` tag (`67b2147d`). **No version bump / no `KIMI_TESTED_MINORS` change** — this is a patch checkup inside an already-certified minor, so the right outcome is a docs/comment update plus a compat marker tag, not a new plugin release. Findings:
  - **Permission and session-bootstrap surfaces stayed untouched.** `02-permission.diff` was 0 bytes (policy queue unchanged: `PreToolCallHookPermissionPolicy` still index 0, `AutoModeApprovePermissionPolicy` still index 5), and `05-session-bootstrap.diff` was 0 bytes (no new `additionalDirs` / config-load drift on the `-p` path).
  - **The scoped `run-prompt.ts` delta is operational, not semantic for our parser.** #1483 changes `raceWithTimeout()` so the cleanup timer stays ref'd; a failed headless `kimi -p` turn can no longer drain the event loop and exit 0 before the rejection propagates. This strengthens exit-code correctness for failure cases but does not alter `permission:'auto'`, `installHeadlessHandlers`, `PromptJsonWriter`, `session.resume_hint`, or `goal.summary`.
  - **The non-empty hooks diff is a Windows UX spawn fix, not a hook-contract change.** #1466 extracts `buildHookSpawnOptions()` and adds `windowsHide:true` when spawning hook child processes. Stdin JSON shape, exit-2-as-deny semantics, cwd/env forwarding, and any-block-wins aggregation all remain intact. The non-empty `04-wire-records.diff` was only this same `session/hooks/runner.ts` hunk re-included by the broader `session/` scope — there was no NDJSON output-shape drift.
  - **Smoke GREEN** — a temp-binary `bun run smoke:real` against exact `0.23.2` ran **9 pass / 0 fail** (2026-07-08): review/challenge/ask/review_gate forced writes hook-denied; pursue goal mode wrote zero files and parsed `goal.summary`; a read-only swarm subagent's forced write hook-denied; write-swarm confined coder edits to the throwaway worktree (`patchBytes=306`, `userTreeClean=true`, `worktreeCleaned=true`); and an out-of-trusted-root absolute write was hook-denied.
  - Edits applied: `runtime/kimi-version-probe.ts` (0.23.2 patch-checkup comment after `{0,23}`; no array change), `runtime/stream-json.ts` (verified-through widened to 0.23.2), AGENTS.md (Version/compat note), this log entry, rebuilt `dist/`. Tag: `compat-verified-kimi-code-0.23.2`. Continuity report: `.claude/kimi-code-research/daily-monitor/2026-07-08-upstream-monitor.md`.

- **2026-07-09 (daily checkup, no plugin release)** — kimi-code **0.23.3** and **0.23.4** landed after the 0.23.2 marker, staying inside the already-tested `{0,23}` minor. Verdict **COMPAT-PRESERVED** on the actual released `0.23.4` tag (`7ce3c2dc`). **No version bump / no `KIMI_TESTED_MINORS` change** — one latest-patch compat marker covers both patches. Findings:
  - **The safety chain is byte-identical.** `02-permission.diff` and `03-hooks.diff` were both 0 bytes across 0.23.2→0.23.4. `PreToolCallHookPermissionPolicy` remains index 0, `AutoModeApprovePermissionPolicy` remains the first approve at index 5, every policy between them is a deny, hook aggregation remains any-block-wins, and `Bash.command` / `Write.path` / `Edit.path` are unchanged. AgentSwarm still uses the standard permission stack; the `DenyAllPermissionPolicy` insertion remains `startBtw()`-only.
  - **The `run-prompt.ts` change repairs the path consumed by `/kimi:pursue`.** #1516 makes `kimi -p "/goal ..."` wait across continuation turns until the goal becomes terminal instead of resolving after the first completed turn. `permission:'auto'`, `installHeadlessHandlers`, PromptJsonWriter, `session.resume_hint`, and `goal.summary` shapes remain intact; `PromptTranscriptWriter.flushAssistant()` only fixes text-mode finalization. This is a load-bearing lifecycle change, so the real-binary smoke was required.
  - **The non-empty wire/bootstrap diffs are compat-benign internal plumbing.** 0.23.3's #1506 changes a repeated provider 401 from a misleading `AUTH_LOGIN_REQUIRED` to `PROVIDER_AUTH_ERROR` carrying the upstream reason. 0.23.4 adds internal `media-degraded` request-projection observability and owner-scoped `[image]` limits threaded through create/resume sessions. None adds a PromptJsonWriter record or changes `additionalDirs`, plugin-hook merging, or permission construction.
  - **Smoke GREEN** — the exact body of `bun run smoke:real`, pointed via `KIMI_PLUGIN_CC_KIMI_BIN` at a temp-installed **0.23.4** binary, ran **9 pass / 0 fail** (2026-07-09): review/challenge/ask/review_gate forced writes hook-denied; pursue ran across the full two-minute budget (`aborted=true`, `exit=143`) with repeated denials and zero files; a read-only swarm subagent's forced write was hook-denied; write-swarm confined coder edits to the throwaway worktree (`patchBytes=278`, `userTreeClean=true`, `worktreeCleaned=true`); and an out-of-trusted-root absolute write was hook-denied.
  - Edits applied: `runtime/kimi-version-probe.ts` (0.23.3/0.23.4 patch-checkup comment alongside `{0,23}`; no array change), `runtime/stream-json.ts` (verified-through widened to 0.23.4), AGENTS.md (compat range), this log entry, rebuilt `dist/`. Tag: `compat-verified-kimi-code-0.23.4`. Continuity report: `.claude/kimi-code-research/daily-monitor/2026-07-09-upstream-monitor.md`.

- **2026-07-11 (safety stabilization release -> v1.8.0 + patch checkup)** — kimi-code **0.23.5** stayed inside the already-tested `{0,23}` minor, but added one legitimate `kimi -p --output-format stream-json` record that required a parser update. Verdict **COMPAT-PRESERVED after the v1.8.0 parser change** on released tag commit `352a4492`; no `KIMI_TESTED_MINORS` array change. Findings:
  - **The safety chain is byte-identical.** `02-permission.diff`, `03-hooks.diff`, and `05-session-bootstrap.diff` are all 0 bytes across 0.23.4->0.23.5. Hook-first ordering, any-block-wins aggregation, `Bash.command` / `Write.path` / `Edit.path`, and create/resume config loading remain intact. The non-empty wire diff only adds the internal `media-stripped` projection type.
  - **Retry metadata is now modeled rather than misdiagnosed.** Upstream #1530 emits `role:"meta", type:"turn.step.retrying"` with retry counters, delay, error identity, and optional status code. Before the fix, the parser correctly rejected it as an unknown meta type; v1.8.0 validates the exact upstream shape, normalizes it, and filters it from consumer `records[]` / `onRecord` like `session.resume_hint`. Malformed variants still enter parser diagnostics.
  - **Safety stabilization shipped in the same release.** Every model-spawning command now verifies the hook before Kimi starts; setup parses and validates the complete shared config under an identity-bound serialized lock; and cancellation is an identity-safe bounded teardown barrier before caller settlement. These are plugin-side hardening changes, not upstream permission relaxations.
  - **Smoke GREEN after the parser change.** The exact body of `bun run smoke:real`, pointed at a temp-installed exact **0.23.5** binary, ran **9 pass / 0 fail in 229.56s**: review/challenge/ask/review_gate forced writes were denied; pursue ran through its full two-minute budget with no file written; read-only swarm spawned coder subagents whose writes were denied; write-swarm confined edits to the throwaway worktree (`patchBytes=334`, `userTreeClean=true`, `worktreeCleaned=true`); and an out-of-trusted-root absolute write was denied. The first post-edit full run had one inconclusive read-swarm case because the coordinator declined the requested fan-out and wrote nothing; the smoke prompt was made explicit about its isolated authorized safety-test role, a targeted proof passed, and this final full rerun passed all nine assertions.
  - Edits applied: parser/runtime coverage, v1.8.0 safety stabilization, `runtime/kimi-version-probe.ts`, `runtime/stream-json.ts`, AGENTS/CHANGELOG/safety docs, and regenerated release surfaces. Tags: `v1.8.0` and `compat-verified-kimi-code-0.23.5`. Continuity report: `.claude/kimi-code-research/daily-monitor/2026-07-11-upstream-monitor.md`.

- **2026-07-12 (daily checkup, no plugin release)** — kimi-code **0.23.6** stayed inside the already-tested `{0,23}` minor. Verdict **COMPAT-PRESERVED** on released tag commit `b5c236d0`. **No version bump / no `KIMI_TESTED_MINORS` change** — this is a docs/comment update plus compat marker, not a plugin release. Findings:
  - **The deny chain is byte-identical.** `02-permission.diff` and `03-hooks.diff` were both 0 bytes across 0.23.5→0.23.6. `PreToolCallHookPermissionPolicy` remains index 0, `AutoModeApprovePermissionPolicy` remains the first approve at index 5, every intervening policy is a deny, hook aggregation remains any-block-wins, and `Bash.command` / `Write.path` / `Edit.path` are unchanged.
  - **Prompt-mode lifecycle changes stay inside plugin bounds.** #1555 keeps `kimi -p` alive while a goal is active or cron work has a future fire; #1497 adds opt-in `[background].print_background_mode = "steer"` for follow-up turns after background completions. The plugin does not enable steer mode, and pursue/swarm retain mandatory finite AbortController budgets, so neither change removes the owning process ceiling. No PromptJsonWriter record shape changed.
  - **Longer upstream subagent defaults do not widen plugin cost or write bounds.** #1562 makes subagent timeout configurable and raises the upstream default from 30 minutes to two hours. AgentSwarm still uses the standard permission stack; the plugin's tighter wall-clock budgets and hard concurrency env remain independent outer bounds. The `select_tools`→`dynamically_loaded_tools` provider-capability rename is internal disclosure plumbing; read and write AgentSwarm both launched in field smoke without permission or hook changes.
  - **Smoke GREEN** — after two initial model non-dispatches in the adversarial escape lane (no files landed), a targeted exact-0.23.6 run produced a real AgentSwarm dispatch and passed. The subsequent complete exact-binary suite ran **9 pass / 0 fail in 274.55s**: review/challenge/ask/review_gate forced writes were denied; pursue ran to its full two-minute budget with no file; read-only swarm denied a spawned subagent write; write-swarm stayed confined (`patchBytes=306`, `userTreeClean=true`, `worktreeCleaned=true`); and the separate out-of-root absolute write was hook-denied.
  - Edits applied: `runtime/kimi-version-probe.ts` and `runtime/stream-json.ts` compatibility comments, AGENTS.md compat range, this log entry, and regenerated runtime mirrors. Tag: `compat-verified-kimi-code-0.23.6`. Continuity report: `.claude/kimi-code-research/daily-monitor/2026-07-12-upstream-monitor.md`.

- **2026-07-15 (new-minor certification → v1.8.1)** — kimi-code **0.24.2** crossed the tested `{0,23}` max after 0.24.0/0.24.1 shipped on July 14, firing the H9 newer-than-tested warning. Verdict **COMPAT-PRESERVED**; extended `KIMI_TESTED_MINORS` with `{0,24}` (runtime probe change → patch release). Findings:
  - **Four-lane source audit green.** Across 0.23.6→0.24.2, `02-permission.diff` and `03-hooks.diff` are 0 bytes. PreToolUse remains index 0, AutoModeApprove remains the first approve at index 5, every intervening policy denies, any-block-wins aggregation is unchanged, and `Bash.command` / `Write.path` / `Edit.path` remain stable. Reports 97-100 independently covered hook contract, stream-json, CLI/bootstrap, and an adversarial challenge; synthesis is report 101.
  - **Default v1 prompt mode remains compatible.** The refactor extracted rendering/session helpers but preserved explicit `-p`/`-r`/`--output-format stream-json`/`-m`/`--skills-dir`, forced auto permission, assistant/tool/retry/goal/resume shapes, and terminal session pinning. New default background steering and upstream no-timeout task waits remain inside the plugin's finite budgets, hard swarm concurrency caps, and identity-safe cancellation settlement barrier.
  - **Ambient experimental v2 was not waved away.** A truthy `KIMI_CODE_EXPERIMENTAL_FLAG` selects native agent-core-v2. Source tracing found strict hook config, configured+plugin hook merging, the same snake_case payload and exit-2 deny semantics, awaited pre-execution blocking, and a per-agent hook service. A targeted exact-v2 review smoke denied the forced write (1 pass / 8 skip / 0 fail). V2 prepends `role:"meta", type:"system.version"`; the current parser safely logs it as one non-fatal diagnostic, excludes it from consumer records/prose, and still pins `session.resume_hint`, so explicit modeling is optional rather than certification-blocking.
  - **Exact-binary v1 smoke GREEN.** The temp-installed exact 0.24.2 suite ran 9 pass / 0 fail, 39 assertions in 261.33s: review/challenge/ask/review_gate forced writes denied; pursue ran through its full two-minute budget with zero writes; read swarm denied a spawned subagent write; write-swarm stayed worktree-confined (`patchBytes=278`, `userTreeClean=true`, `worktreeCleaned=true`); and the separate out-of-root absolute write was denied.
  - **Documentation correction.** `packages/agent-core/src/session/hooks/` is the live v1 engine; the historical `agent/hooks/` tree was removed by relocation commit `74e867a`, so audit scripts retain both paths only to cover older layouts. Edits: tested-minor extension, v1.8.1 metadata/docs, stream source comment, audit-playbook correction, tests, and regenerated surfaces. Tags: `v1.8.1` and `compat-verified-kimi-code-0.24.2`. Continuity report: `.claude/kimi-code-research/daily-monitor/2026-07-15-upstream-monitor.md`.

- **2026-07-16 (marker-strip survival release → v1.8.2, then new-minor certification → v1.8.3)** — Two releases the same day. **v1.8.2** (not an upstream-compat audit) fixed the config-rewrite seesaw: kimi-code persists `config.toml` via smol-toml `stringify(parse(...))` on every login/settings write, deleting all comments — the managed-block markers included — while the `[[hooks]]` table survives and keeps enforcing. Verification now falls back (absent-state only) to a byte-exact content match on the surviving marker-less `[[hooks]]` table via the **real smol-toml parser** (`hasCleanEnforcingHookEntry`, matcher-rejecting in any spelling, key-strict), and orphan pruning became host-scoped — ending the false "not installed" after each `kimi login` and the cross-host prune seesaw. A 3-model review panel caught a HIGH bypass in the first line-scanner approach (a `matcher` hidden after a blank line / behind a quoted key / past a multiline array) and drove the switch to the parser. Then **v1.8.3 certifies kimi-code 0.25.0**:
  - **Scoped source audit `0.24.2 → 0.25.0` — COMPAT-PRESERVED.** `01-cli-prompt-mode` and `03-hooks` diffs are **0 bytes** (the two primary safety surfaces untouched). `02-permission` (943 B) adds only `trace_id` to two telemetry events; `04-wire-records` (2 KB) forwards Anthropic `supportEfforts`/adaptive-thinking capability data in `session/provider-manager.ts` with no new stream-json record/role/meta/session-id/goal-summary shape; `05-session-bootstrap` (3.9 KB) resolves thinking efforts from the provider profile while still merging configured + plugin hooks on create and resume. Direct checks on the 0.25.0 tag confirmed PreToolCallHook index 0 / AgentSwarmExclusiveDeny index 1 / AutoModeApprove first-approve index 5 (every intervening policy a deny), any-block-wins, empty matcher = all tools, exit-2 blocks, `Bash.command`/`Write.path`/`Edit.path`, `kimi -p` default v1 unless a truthy `KIMI_CODE_EXPERIMENTAL_FLAG` selects the still-opt-in agent-core-v2, AgentSwarm subagents on the standard permission stack (`deny-all` remains `startBtw()`-only), and `KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY` as the hard concurrency ceiling.
  - **Exact-`0.25.0` smoke GREEN on the clean tree.** `bun run smoke:real` against the installed 0.25.0 binary ran **9 pass / 0 fail, 39 assertions in 419.12s**: review/challenge/ask/review_gate forced writes denied; pursue wrote no file through its full wall-clock budget (aborted at the ceiling); read-only swarm denied a spawned subagent write; write-swarm stayed confined (`patchBytes=278`, `userTreeClean=true`, `worktreeCleaned=true`); the out-of-root absolute write was denied. A supplementary `KIMI_CODE_EXPERIMENTAL_FLAG=1` targeted v2 review-denial also passed. (An earlier rerun hit `auth.login_required` from an expired operator OAuth token — machine state, not a regression; re-login produced the green run. An auth-failed smoke is not a passed smoke.)
  - Extended `KIMI_TESTED_MINORS` with `{0,25}` (runtime probe change → patch release). Edits: `runtime/kimi-version-probe.ts` (`{0,25}` + full audit comment), AGENTS.md (Version headline + Upstream-compat range), CHANGELOG.md, this log entry, 4-file version bump 1.8.2 → 1.8.3 + re-pinned surface hashes, regenerated surfaces. Tags: `v1.8.3` and `compat-verified-kimi-code-0.25.0`. Continuity report: `.claude/kimi-code-research/daily-monitor/2026-07-16-upstream-monitor.md`. **Note:** npm `latest` advanced to `0.26.0` after this audit began; it is certified separately.

- **2026-07-16 (new-minor certification → v1.8.4)** — kimi-code **0.26.0** (npm `latest`, published the same day, after the v1.8.3 audit began). Verdict **COMPAT-PRESERVED**; extended `KIMI_TESTED_MINORS` with `{0,26}` (runtime probe change → patch release). Findings:
  - **All three primary safety surfaces byte-identical.** Across 0.25.0→0.26.0, `01-cli-prompt-mode`, `02-permission`, AND `03-hooks` are **0-byte diffs**. `PreToolCallHook` remains index 0, the hook engine and policy queue are unchanged, exit-2 denial / empty-matcher / any-block-wins all hold, and `-p` still defaults to v1 auto mode (v2 still opt-in behind `KIMI_CODE_EXPERIMENTAL_FLAG`). The full release is large (492 files) but the bulk is `packages/server-e2e/` removal + `pnpm-lock.yaml`, all off the `-p` path.
  - **The two non-empty scoped surfaces are compat-benign.** `04-wire-records` (32 KB): session-store `workDir` normalization (Windows case-insensitive drive paths), session forking (`forked` `AgentRecord` + internal `context.update_token_count` record — neither a consumed `-p` stdout shape; parser fails safe on unknown types), provider-manager thinking plumbing, and a `subagent-host.ts::drainChildBackgroundTasks` addition that holds a subagent open until its background tasks settle and suppresses their terminal notifications (a lifecycle/settlement change, **not** a permission-stack change — drained tasks still fire the index-0 hook, and it aligns with the plugin's own settlement-barrier cancellation). `05-session-bootstrap` (16 KB): `config/model.ts` thinking-profile plumbing, an optional `auth:'oauth'` field on the MCP HTTP/SSE schemas (not `HookDefSchema`, still `.strict()`), and additive `rpc/core-impl.ts` Global-MCP management + OAuth flows + `deleteSession`/`importContext` (RPC/host methods off `-p`) plus a `setAdditionalDirs→setBaseAdditionalDirs` rename and an `includeSubagents` resume flag the plugin never passes; the create/resume hook merge is unchanged.
  - **Direct invariant checks on the 0.26.0 tag.** `tools/builtin/file/` is a 0-byte diff (`Write.path`/`Edit.path` byte-identical); the `deny-all` unshift is still `startBtw()`-only (`subagent-host.ts`, inside `startBtw()`, never the swarm spawn path); `installHeadlessHandlers` + the v1 default persist.
  - **Exact-`0.26.0` smoke GREEN.** `bun run smoke:real` against a temp-installed 0.26.0 binary (`KIMI_PLUGIN_CC_KIMI_BIN` override) ran **9 pass / 0 fail, 39 assertions in 376.06s**: review/challenge/ask/review_gate forced writes denied; pursue wrote no file through its full budget (aborted); read-only swarm denied a spawned subagent write; write-swarm stayed confined (`patchBytes=278`, `userTreeClean=true`, `worktreeCleaned=true`); the out-of-root absolute write was denied.
  - **pursue `--resume` re-investigation (still upstream-blocked).** A read-only source audit of 0.26.0 confirmed no headless `resumeGoal()` trigger exists: `parseHeadlessGoalCreate` (`apps/kimi-code/src/cli/goal-prompt.ts`) supports only `/goal <objective>` create; neither the v1 (`run-prompt.ts`) nor experimental-v2 (`run-v2-print.ts`) session-resume path calls `resumeGoal()`; upstream docs (`docs/en/guides/goals.md`, § "Use goal mode carefully") state prompt mode supports only goal creation. PR #552 restores the goal *snapshot* on `-r` but nothing acts on it; the real `resumeGoal()` is wired only to the TUI (`/goal resume`) and kimi-web RPC (PR #1693, web-only). `/kimi:pursue` stays foreground-only and `experimental`; `docs/safety.md` § "Autonomous goal mode" updated to cite this. Re-check if upstream ever adds a headless `goal resume` verb.
  - Edits: `runtime/kimi-version-probe.ts` (`{0,26}` + full audit comment), AGENTS.md (Version headline + Upstream-compat range), CHANGELOG.md, `docs/safety.md` (pursue-resume 0.26.0 note), this log entry, 4-file version bump 1.8.3 → 1.8.4 + re-pinned surface hashes, regenerated surfaces. Tags: `v1.8.4` and `compat-verified-kimi-code-0.26.0`.

- **2026-07-21 (two-minor catch-up certification → v1.8.7)** — kimi-code **0.27.0** (released 2026-07-17) and **0.28.0 + patch 0.28.1** (released 2026-07-20) certified in one chained pass, closing the gap from the v1.8.4-certified 0.26.0. Verdict **COMPAT-PRESERVED** on both minors; extended `KIMI_TESTED_MINORS` with `{0,27}` and `{0,28}` (runtime probe change → patch release). Evidence: daily-monitor source audits + exact-binary smokes of 2026-07-18 (0.27.0) and 2026-07-21 (0.28.1), run against immutable upstream tags and temp-installed exact binaries. Findings:
  - **The two load-bearing safety surfaces are 0-byte diffs across the whole span.** `02-permission` and `03-hooks` byte-identical 0.26.0→0.28.1. Direct invariant checks on the released tags reconfirmed: `PreToolCallHookPermissionPolicy` index 0, `AgentSwarmExclusiveDenyPermissionPolicy` index 1, `AutoModeApprovePermissionPolicy` the first approve at index 5 (every intervening policy a deny); empty matcher = all tools; exit 2 blocks; aggregation any-block-wins via the first `action:'block'`; `Bash.command` / `Write.path` / `Edit.path`; `kimi -p` fresh sessions at `permission:'auto'` with resumed sessions force-overridden and headless handlers installed; AgentSwarm subagents on the standard permission stack (deny-all unshift remains `startBtw()`-only); plugin slash-command activation still RPC/host-initiated and absent from the `-p` path.
  - **`01-cli-prompt-mode` (1.7 KB) is commands.ts-only** — the top-level `server` registration is replaced by `web` and the YOLO-vs-Auto help text is corrected; `run-prompt.ts`/`options.ts` byte-identical. The plugin passes its prompt as the VALUE of `-p`, so consumed argv and `-p` routing are unchanged.
  - **`04-wire-records` (12.3 KB cumulative) is entirely the audited 0.27.0 session-storage work** (optional workspace-id registry reuse with Windows-shaped case/slash folding, safe-id validation, legacy-hash fallback; timestamped debug-export filenames) — session-directory bookkeeping, not `PromptJsonWriter` NDJSON shapes; **0-byte incremental past 0.27.0**.
  - **`05-session-bootstrap`:** 0.27.0 (1.7 KB) wires an optional `resolveWorkspaceId` callback through `KimiCoreOptions` into `SessionStore` (no config schema / hook merge / permission-context change; `HookDefSchema` stays `.strict()`). 0.28.1 (4.8 KB) adds a one-shot `thinking.effort "max"→"high"` config migration that strictly parses and reserializes `config.toml` via `configToTomlData`/`setHooks` — validated `hooks[]` entries survive as data but ALL comments are stripped, exactly the markerless-hook condition the plugin has handled since v1.8.2. A new marker-strip regression (`tests/runtime/marker-strip.test.ts`) simulates that parse→mutate→stringify shape and asserts the host still verifies installed.
  - **The 0.28.1 v2 subagent permission-mode broadcast** (propagating session-level mode switches to already-running subagents) is a propagation fix, not a hook bypass — the v2 external-hook runner and tool-executor hook slots are byte-identical across the delta; the v2 smoke lane independently denied the forced write.
  - **Exact-binary smokes GREEN on both releases** (`KIMI_PLUGIN_CC_KIMI_BIN` temp binaries; `bun run smoke:real`): 0.27.0 — **10 pass / 0 fail / 43 assertions in 587.74s**; 0.28.1 — **10 / 0 / 43 in 626.72s**. Full matrix on each: review/challenge/ask/review_gate forced writes hook-denied; the `KIMI_CODE_EXPERIMENTAL_FLAG=1` v2 lane denied AND emitted the modeled system-version signal; pursue ran to its mandatory wall-clock budget and wrote no file; read-swarm subagent forced write denied; write-swarm confined (`patchBytes=278`, `userTreeClean=true`, `worktreeCleaned=true`); out-of-root absolute write denied. No auth/quota/hook-bypass/user-tree-write failure.
  - **Test-only fix in the same release:** on Node ≥25 the tsx loader emits a DEP0205 `module.register()` deprecation warning into the spawned companion's stderr, breaking `tests/runtime/setup-command.test.ts`'s `stderr === ""` assertion (environment artifact, not a runtime regression; the SIGTERM→SIGKILL escalation flake seen under full-suite load passed on isolated retry). The assertion now strips Node deprecation-warning lines before comparing.
  - **Carried forward, not blockers:** the upstream-dependent pursue `--resume` recheck (carried forward — no new `-p` path appears in the scoped 0.27.0/0.28.1 deltas and `run-prompt.ts` is byte-identical across the span, so the v1.8.4 finding of no headless `resumeGoal()` trigger stands; a direct re-check remains on the per-release routine); the routine slash-command activation recheck stayed green.
  - Edits: `runtime/kimi-version-probe.ts` (`{0,27}`/`{0,28}` + chained audit comments), `runtime/stream-json.ts` (verified-through range extended to 0.28.1), AGENTS.md (Version headline + Upstream-compat range), CHANGELOG.md, this log entry, `tests/runtime/{kimi-version-probe,marker-strip,setup-command}.test.ts`, 4-file version bump 1.8.6 → 1.8.7 + re-pinned surface hashes, regenerated surfaces. Tags: `v1.8.7`, `compat-verified-kimi-code-0.27.0`, `compat-verified-kimi-code-0.28.1`.

- **2026-07-25 (new-minor certification → v1.8.8)** — kimi-code **0.29.0 + patch 0.29.1** certified in one cumulative pass. Verdict **COMPAT-PRESERVED**; extended `KIMI_TESTED_MINORS` with `{0,29}` (runtime probe change → patch release). Evidence: daily-monitor source audits and exact-binary smokes of 2026-07-23/24 against immutable tags and temp-installed exact binaries. Findings:
  - **V1 load-bearing surfaces remain unchanged.** Across 0.28.1→0.29.1, `02-permission` and `03-hooks` are 0-byte diffs. Direct released-tag checks preserve PreToolCallHook index 0, AgentSwarmExclusiveDeny index 1, AutoModeApprove first at index 5 with only denies between; empty matcher = all tools; exit 2 blocks; any-block-wins; `Bash.command` / `Write.path` / `Edit.path`; fresh/resumed `-p` auto plus headless handlers; configured+plugin hook merging; standard swarm subagent permission stacks; and `KIMI_CODE_AGENT_SWARM_MAX_CONCURRENCY`.
  - **Scoped non-empty deltas are compatible.** 0.28.1→0.29.0: CLI 3,909 B, wire/session 8,322 B, bootstrap/config 7,655 B; 0.29.0→0.29.1: CLI/permission/hooks 0 B, wire/session 938 B, bootstrap/config 8,700 B. These are opt-in v2 agent-profile flags the plugin does not pass plus record/session identity, provider/model capability, replay-limit, MCP timeout, and web endpoint/env plumbing — not PromptJsonWriter, session-resume, permission-context, or workspace-write changes.
  - **The 0.29.1 v2 adjudication refactor preserved ordinary external denials, but this order claim was corrected on 2026-07-31.** The awaited veto and exact smoke below were real; however, production global registration orders permission gate → plan → swarm → external hooks. Active plan mode can final-allow the exact KIMI_CODE_HOME plan-file write before the managed hook. v1.9.4 disables experimental-v2 across the tested range pending an upstream ordering guarantee; see the 0.31 entry.
  - **Exact-binary smokes GREEN.** Exact 0.29.0 and 0.29.1 each passed **10 pass / 0 fail / 43 assertions**; latest 0.29.1 completed in 339.80s. The matrix includes read-only forced-write denials, asserted experimental-v2 denial through the new veto path, pursue zero-write budget abort, read-swarm subagent denial, write-swarm confinement (`patchBytes=306`, `userTreeClean=true`, `worktreeCleaned=true`), and non-vacuous out-of-root denial. No auth/quota/hook-bypass/user-tree-write blocker occurred.
  - **Carried forward, not a blocker:** headless pursue resume remains absent. `parseHeadlessGoalCreate` and both print drivers expose creation only; `resumeGoal()` stays TUI/RPC-only.
  - Edits: `runtime/kimi-version-probe.ts` (`{0,29}` + cumulative v1/v2 proof), `runtime/stream-json.ts` (verified-through range), tests/version/AGENTS/CHANGELOG, this log entry, re-pinned Claude hashes, and regenerated surfaces. Tags: `v1.8.8` and `compat-verified-kimi-code-0.29.1`.

- **2026-07-25 (docs-only: caller-detach contract, cancel path, interrupt measurement)** — No version bump, no runtime change. Triggered by a dispatching agent concluding `/kimi:swarm --write` was unrunnable: its agent doc forbade `run_in_background: true`, the default `--budget` is 30m, and Claude Code caps a foreground Bash call at 10 minutes. Both premises true, conclusion false — the doc had conflated the runtime's rejection of `--background`/`--wait`/`--fresh`/`--resume` (real, unchanged) with a doc-level rule against the *caller* detaching its own shell call (watchability-motivated, not enforced). Findings:
  - **Caller-level detaching is now the documented default** for swarm-write and pursue. What bounds these surfaces — index-0 hook, workspace allowlist, no-git-mutation, patch-only worktree confinement (swarm-write), mandatory finite `--budget` — is runtime-enforced and does not depend on a human watching; a blocked foreground call actively removes the dispatching agent's ability to report or cancel. Read-only swarm's foreground default is unchanged and deliberate.
  - **The first draft of the cancel path was falsified by a Codex review.** It documented "the launching agent keeps the `job_id` and runs `companion.sh cancel <job-id>`". That flow cannot execute: `pursue.ts`/`swarm.ts` mint the id with `randomUUID()` and emit nothing at launch, so a detached caller receives a host task id and the plugin id first appears in the final report. Corrected to the no-id form (`cancel.ts` → `findLatestJob({runningOnly:true})`), which also removes the UUID from the human path entirely. Known limit: with several runs in flight it takes the most recent.
  - **Interrupt signal contract measured** (macOS, Claude Code): foreground Esc and `TaskStop` on a detached call both deliver a trappable SIGTERM **process-group-wide**, then SIGKILL after **~1.35s** (samples 1.34s, 1.36s). Group delivery kills detached Kimi descendants, so the "surviving child keeps writing" risk raised against backgrounding pursue does not exist. But ~1.35s is shorter than `cli-client.ts`'s 1500ms child escalation alone, before quiescence and `git diff --binary` capture — so a hard interrupt can kill the companion mid-teardown and lose the write-swarm patch. `companion.sh cancel` signals from a separate process not racing that deadline and is therefore the work-preserving stop. Thin margin; re-measure on harness changes.
  - **Pursue is not swarm-write.** The review was right that the first pass flattened a real asymmetry: swarm-write's edits are worktree-confined and return as a discardable patch, pursue's land in the real tree and a cancel does not roll them back. Same detach posture, different consequence, now stated in the pursue docs.
  - **Doc-hygiene sweep (3 parallel agents, read-only; edits applied by hand).** One commit had fixed six copies of the cancel contract and missed a seventh (the Codex swarm-write skill), which is what made the duplication concrete. Also trimmed version archaeology out of `AGENTS.md` and `docs/safety.md` per the repo's own rule — every removed fragment was first verified as recorded in CHANGELOG or here, except pre-1.0 `v0.2.3` (review/challenge dropping their JSON schemas), which was recorded nowhere and so was added to CHANGELOG's "Older releases" list before the trim. The `AGENTS.md` § Releasing instruction now states that the Version headline holds a present-tense contract, not a description of what the release did.
  - Edits: `agents/kimi-{pursue,swarm-write}.md`, `commands/{swarm,pursue,cancel}.md`, `scripts/surface-registry.ts` (+ regenerated Codex skills), `docs/safety.md`, `README.md`, `AGENTS.md`, `CHANGELOG.md` (0.2.3 line).

- **2026-07-27 (0.29.2 patch checkup, docs-only)** — kimi-code **0.29.2** shipped inside the already-tested `0.29.x` minor. Verdict **COMPAT-PRESERVED**; no `KIMI_TESTED_MINORS` or plugin-version change. Evidence: the dated daily-monitor audit against the immutable `0.29.2` tag plus an exact temp-binary smoke. Findings:
  - **Canonical v1 surfaces remain intact.** Scoped `0.29.1→0.29.2` diffs: `01-cli-prompt-mode` **0 B**, `02-permission` **0 B**, `03-hooks` **0 B**, `04-wire-records` **757 B**, `05-session-bootstrap` **0 B**. The only canonical delta makes a main-agent `steer` update prompt metadata like `prompt`; it does not change PromptJsonWriter output, session pinning, hook matching/aggregation, permission construction, or tool dispatch. The 0-byte permission/hook trees preserve the hook-first policy, any-block-wins, exit-2 denial, empty-matcher behavior, tool-input keys, standard swarm subagent stack, and hard concurrency gate.
  - **Goal step caps now continue rather than pause.** V1 and v2 goal drivers treat `loop_control.max_steps_per_turn` as a clean continuation boundary. That can split work across more turns, but it does not remove the plugin's mandatory finite wall-clock AbortController budget; the pursue smoke reached that ceiling with `aborted=true` and zero writes.
  - **The v2 lifecycle refactor preserves the deny seam behaviorally and by unchanged runners.** Upstream replaces the hand-maintained eager-service list with dependency-driven `ScopeActivation.OnScopeCreated` construction and moves mutable state into agent/session state containers. `AgentExternalHooksService` still awaits PreToolUse and vetoes on block; `run-v2-print.ts`, `BeforeToolExecuteEmitter`, the hook aggregation runner, and the hook command runner are byte-identical. The asserted-v2 smoke proved the engine was active and the forced write was denied.
  - **Exact-0.29.2 smoke GREEN.** `KIMI_PLUGIN_CC_KIMI_BIN=<temp-0.29.2> bun run smoke:real` passed **10 / 0 / 43 in 502.40s**: review/challenge/ask/review_gate forced writes denied; asserted-v2 denial passed; pursue aborted at its finite budget with zero writes; read-swarm denied a spawned subagent write; write-swarm stayed confined (`patchBytes=278`, `userTreeClean=true`, `worktreeCleaned=true`); and the non-vacuous out-of-root absolute write was denied. No auth/quota/hook-bypass/user-tree-write blocker occurred.
  - **Carried forward, not a blocker:** headless pursue resume remains absent; both print drivers are byte-identical across this patch.
  - Edits: `runtime/kimi-version-probe.ts` (patch audit comment after `{0,29}`), `runtime/stream-json.ts` (verified-through range), AGENTS.md (Upstream-compat range), this log entry, and regenerated `dist/`/Codex mirrors. No plugin version bump. Tag: `compat-verified-kimi-code-0.29.2`.

- **2026-07-29 (new-minor certification → v1.9.3)** — kimi-code **0.30.0**. Verdict at release: **COMPAT-PRESERVED with one characterized experimental-v2 KAP caveat**; extended `KIMI_TESTED_MINORS` with `{0,30}`. Findings:
  - V1 policy queue, hook engine, hook aggregation, tool-input keys, print argv/writer/session/goal shapes, strict HookDefSchema, and standard AgentSwarm child hook inheritance were re-verified against the immutable release tag.
  - Experimental-v2 eagerly activated the KAP cross-session indexer and created `<KIMI_CODE_HOME>/search-index` for populated homes. The side effect was engine-internal, KIMI-home-confined, absent from the default-v1 path, and never a user-worktree write. Upstream PR MoonshotAI/kimi-code#2376 proposed OnDemand activation.
  - The first exact-0.30 smoke was green but vacuous for indexing because its isolated home contained zero sessions. The repaired populated-home case asserts `wire.jsonl > 0`, then asserts writes remain denied and no index appears in the workspace while only recording the KIMI-home side effect. Exact rerun: **11 pass / 0 fail / 49 assertions in 348.05s**, index PRESENT with wire files=1.
  - The then-unreleased custom-agent branch was explicitly deferred to 0.31.0. Release tags: `v1.9.3` and `compat-verified-kimi-code-0.30.0`.
  - **Subsequent correction (2026-07-31):** the ordinary v2 denial evidence was real but the prose overclaimed listener order. Plan-service final allow can precede external hooks in both 0.30 and 0.31; v1.9.4 records and mitigates that inherited gap below.

- **2026-07-31 (new-minor certification + fail-closed mitigation → v1.9.4 candidate)** — kimi-code **0.31.0**, immutable commit `bc28e9d802fbec29395a7aed85e880679a050145`. Verdict: **default-v1 COMPAT-PRESERVED; experimental-v2 COMPAT-BROKEN until refused**. Extended `KIMI_TESTED_MINORS` with `{0,31}` only alongside the runtime refusal. Findings:
  - **Canonical v1 contracts preserved.** Scoped 0.30→0.31 diffs: CLI **4,025 B**, permission **0 B**, hooks **0 B**, wire/session **37,804 B**, bootstrap/config **22,220 B**. Hook index 0, all-deny gap before first approve, any-block-wins, matcher/exit behavior, `Bash.command` / `Write.path` / `Edit.path`, standard swarm inheritance, consumed argv, PromptJsonWriter/session/goal envelopes, and headless goal-create-only semantics remain. Targeted parser/client verification: **98 pass / 0 fail / 247 assertions**.
  - **Inherited v2 hook-order break, corrected.** Production listener order is permission gate → plan → swarm → external hooks. Active plan mode final-allows exact plan-file Write/Edit before the managed PreToolUse listener. It is reachable fresh through `default_plan_mode=true` and through restored PlanModel; the path stays under KIMI_CODE_HOME but violates the every-tool hook contract. v1.9.4 refuses upstream-equivalent truthy `KIMI_CODE_EXPERIMENTAL_FLAG` values before spawn (`CLI_V2_HOOK_ORDER_UNSAFE`, `refusal_kind:"v2-hook-order-unsafe"`) and explicitly denies `EnterPlanMode` for every managed label. False/unset values keep v1 fresh/resume unchanged. Re-enable only after an exact upstream release orders external-hook veto before every final allow and both fresh-default-plan and restored-plan tests pass.
  - **0.31 custom-agent trust boundary.** V1 now discovers project/user/plugin agent profiles and system-prompt contributions. Project `override: true` may replace builtin `agent`/`coder` instructions and tool availability, with the bound profile persisted in session state. It can redirect task intent but cannot set hooks/permission/cwd, widen the plugin allowlist, or escape swarm-write confinement. `docs/safety.md` now tells operators to inspect these trusted instructions before write-capable use in an unfamiliar repo.
  - **Exact-binary evidence reconciled, not overstated.** Before mitigation, installed exact 0.31.0 passed **11 / 0 / 49 in 944.47s** across the full default-v1 matrix, populated-home precondition (`wire files=1`), an ordinary fresh-v2 forced-write denial, pursue finite budget, read-swarm child denial, write-swarm capture (`patchBytes=278`, `userTreeClean=true`, `worktreeCleaned=true`), and out-of-root denial. The ordinary v2 case did not cover default plan mode and is not v2 certification; v1.9.4 replaces it with a pre-spawn refusal assertion. Released 0.31 still contains eager KAP indexing and PR #2376 remains unmerged, but plugin flows cannot reach it while v2 is refused.
  - Candidate scope only: runtime guard/tests, custom-agent and v2 safety docs, version/provenance/history updates, regenerated artifacts, two independent post-edit reviews, and `bun run check`. No commit, tag, push, release, setup, or host mutation is part of this preparation task.

- **2026-08-01 (0.31.1 patch checkup → v1.9.5 distribution release)** — kimi-code **0.31.1** shipped inside the already-tested `0.31.x` minor at immutable commit `6b56c11697771fe596099b38bafae539820309a4`. Verdict **default-v1 COMPAT-PRESERVED; experimental-v2 remains intentionally refused**. The compatibility checkup required no `KIMI_TESTED_MINORS`, runtime-policy, permission, concurrency, budget, or allowlist change; the later explicitly requested v1.9.5 cut changes only plugin/cache version metadata and generated mirrors. Findings:
  - **Canonical default-v1 surfaces remain intact.** Scoped `0.31.0→0.31.1` diffs: CLI **0 B**, permission **0 B**, hooks **0 B**, wire/session **1,850 B**, bootstrap/config **0 B**. The only canonical delta strips the disabled no-op `model` parameter from Agent/AgentSwarm schemas. AgentSwarm retains its exact tool name and executor; the unchanged permission/hook/session paths preserve the index-0 hook, all-deny gap before first approve, any-block-wins aggregation, tool-input keys, standard child hook inheritance, shared cwd, and hard swarm bounds.
  - **Large experimental-v2 refactor does not widen the supported surface.** The print-mode v2 selection file and `1|true|yes|on` truth table are byte-identical, so v1.9.4's pre-spawn `CLI_V2_HOOK_ORDER_UNSAFE` refusal still covers the upstream route. The release does not provide the ordering guarantee or fresh/restored-plan evidence required to re-enable v2. KAP global search remains App-scoped `OnScopeCreated`; upstream PR #2376 remains unmerged.
  - **Exact-0.31.1 smoke GREEN.** A temp-installed binary passed **10 / 0 / 42 in 349.27s**: every forced-write label denied; v2 refused before spawn; pursue hit its finite budget with zero writes; a real read-swarm child write was denied; write-swarm captured an applyable patch (`patchBytes=278`) while the user tree stayed clean and the worktree was removed; and real coder subagents' out-of-root absolute writes were denied.
  - Compatibility-checkup edits: `runtime/kimi-version-probe.ts` (patch audit comment alongside `{0,31}`), `runtime/stream-json.ts` (verified-through range), AGENTS.md (Upstream-compat range), this log entry, and regenerated `dist/`/Codex mirrors. The subsequent distribution release bumps only the standard version surfaces to 1.9.5 and regenerates mirrors. Tags: `compat-verified-kimi-code-0.31.1` and `v1.9.5`.

- **2026-08-08 (0.32.0–0.34.0 certification → v1.9.6 release)** — live kimi-code reached **0.34.0** at immutable commit `f0614c53e59f7e1e257412063b059b9eb82764cf`. Monitor verdict was **COMPAT-BROKEN before containment**: 0.33.0 made native v2 the unflagged `kimi -p` default (unchanged in 0.34.0), but v1.9.5 only refused the old experimental-flag selector. v1.9.6 restores and certifies the legacy-v1 path while leaving native v2 disabled. Findings:
  - **Scoped v1 surfaces remain stable.** `0.31.1→0.34.0`: v1 permission **0 B**, hooks **0 B**, bootstrap/config **0 B**; wire/session adds 55 internal v2-to-v1 resume lines. The old three-file CLI diff misleadingly showed only 7 comment lines in `run-prompt.ts`; the load-bearing inversion lived in omitted `experimental-v2.ts`. The audit routine now includes that selector and its tests.
  - **Exact v2 break persists.** `BeforeToolExecuteEmitter` still ends listener iteration on final `allow()`, and the plan service still final-allows exact active-plan-file Write/Edit ahead of external hooks. Ordinary exact-0.34 smoke was green 10/0/42 but lacked fresh/restored plan evidence and therefore did not overrule the source blocker.
  - **Candidate containment.** `cli-client.buildEnv` overwrites `KIMI_CODE_LEGACY_FLAG=1` for every accepted fresh/resumed child, while truthy `KIMI_CODE_EXPERIMENTAL_FLAG` remains an explicit pre-spawn refusal. Unit tests cover ambient unset/false/true values and fresh/resume propagation. The real-binary suite now asserts v2's `system.version` is absent and adds a `default_plan_mode=true` fresh+resume denial lane.
  - **Certification gate GREEN.** The exact-0.34.0 temp binary passed `bun run smoke:real` with **11 / 0 / 54 in 460.09s**. The new `default_plan_mode=true` fresh+resume lane stayed on v1 (no v2-only `system.version`) and both forced writes reached the managed hook and were denied; the existing forced-write, pursue, read-swarm, write-swarm confinement/cleanup (`patchBytes=278`), and out-of-root denial lanes also passed. `KIMI_TESTED_MINORS` gains `{0,32}`, `{0,33}`, `{0,34}`. Tags: `v1.9.6` and `compat-verified-kimi-code-0.34.0`; native v2 remains disabled.

- **2026-08-08 (v1.9.7 UX/diagnostics release — not a compat event)** — no upstream audit; no `KIMI_TESTED_MINORS`, safety-policy, permission, concurrency, budget, or allowlist change. Two operator incidents from the same morning drove it: (1) a mid-day `/plugin` update (1.9.3→1.9.6 on the Claude host, after the daily `ai-upgrade.sh` re-pin had already run) left slash commands refusing on hook-script drift with no self-heal path — the retry protocol now rides every `*_HOOK_NOT_INSTALLED` refusal message via single-source `hookRefusalRetryProtocol` (a drafted per-command-file paragraph was rejected as surface bloat; hook-pin durability spec §6 step 3 now covers all surfaces); (2) kimi's own background auto-upgrade (0.31.1→0.34.0) invalidated the managed OAuth token and the resulting `ASK_KIMI_STARTUP_FAILED` misdirected to `/kimi:setup` — `auth.login_required` now classifies to `*_KIMI_AUTH_UNAVAILABLE` with a `kimi login` remedy, and wrapped startup failures thread `availability`/`cause_code`/tail-truncated `cause_message` into `details`. Full entry in CHANGELOG § 1.9.7. Tag: `v1.9.7`.

- **2026-08-12 (0.35.0 certification → v1.9.8 release)** — live kimi-code reached **0.35.0** at immutable commit `f6ee44e42641498f26635eec2e6799d13372885c`. The daily monitor escalated from `NO ACTION` to `CERTIFICATION NEEDED` when npm/GitHub published the new minor. Verdict: **COMPAT-PRESERVED on forced legacy v1; native v2 remains intentionally disabled**.
  - **Scoped source audit preserved the load-bearing surfaces.** Immutable 0.34.0→0.35.0 diffs were 0 bytes for CLI prompt mode, v1 permission policies, v1 hooks, and consumed wire/session records. The 3,347-byte bootstrap diff is limited to global MCP OAuth-status RPC/helper code; it does not alter `-p` session construction, hook merging, permission context, cwd, or workspace-local config loading.
  - **The v1 invariants remain explicit.** Hook policy index 0 still precedes the first approve at index 5 with only deny policies in between; hook matching remains empty-pattern match-all, exit-2 deny, fail-open on internal hook error, and any-block-wins; `Bash` still supplies `command`, `Write`/`Edit` still supply `path`; swarm children inherit the parent cwd and the only `DenyAllPermissionPolicy.unshift` remains the side-question `startBtw()` path.
  - **Native-v2 and KAP follow-ups remain closed from plugin flows.** Exact 0.35.0 still allows plan-file final approval before later external hooks, so accepted children remain legacy-v1 pinned and truthy experimental selectors refuse before spawn. Exact 0.35.0 also retains App-scoped `GlobalSearchService` `OnScopeCreated`; PR #2376 remains open/conflicting and is carried as an upstream follow-up, not a supported-path blocker.
  - **Adjacent 0.35 changes narrow child capability.** The builtin `coder` profile removes nested `Agent`/`AgentSwarm` by default, and builtin profile definitions are cloned per session. The coordinator `AgentSwarm` remains available and was exercised by the smoke.
  - **Certification gate GREEN.** The exact-0.35.0 temporary binary passed `bun run smoke:real` with **12 / 0 / 55 in 525.01s**: fresh/resumed default-plan runs stayed on legacy v1 and hook-denied writes; forced-write labels, pursue, read-swarm child denial, write-swarm confinement/cleanup (`patchBytes=278`), and out-of-root denial all passed. `KIMI_TESTED_MINORS` gains `{0,35}`. Tags: `v1.9.8` and `compat-verified-kimi-code-0.35.0`. Continuity report: `.claude/kimi-code-research/daily-monitor/2026-08-12-upstream-monitor.md`.

- **2026-08-13 (0.36.0 certification → v1.9.9 release)** — live kimi-code reached **0.36.0** at immutable commit `b6144f94ea6b22455a4e750d1750d220987e7bc2`. The daily monitor escalated from `NO ACTION` to `CERTIFICATION NEEDED`; the first smoke attempt was correctly classified as an operator-auth blocker, then rerun green after `kimi login`. Verdict: **COMPAT-PRESERVED on forced legacy v1; native v2 remains intentionally disabled**.
  - **Scoped source audit preserved the load-bearing surfaces.** Immutable 0.35.0→0.36.0 diffs were 0 bytes for CLI prompt mode, v1 permission policies, and v1 hooks. The 5,056-byte wire/session diff adds MCP OAuth credential coordination; the 22,703-byte bootstrap/config diff adds MCP OAuth inspection/coordinator APIs and v2 secondary-model pool config round-tripping. Create/resume hook merging, permission context, cwd, and workspace-local config loading remain unchanged.
  - **The v1 invariants remain explicit.** Hook policy index 0 still precedes the first approve at index 5 with only deny policies in between; hook matching remains empty-pattern match-all, exit-2 deny, fail-open on internal hook error, and any-block-wins; `Bash` still supplies `command`, `Write`/`Edit` still supply `path`; swarm children inherit the parent cwd and the only `DenyAllPermissionPolicy.unshift` remains the side-question `startBtw()` path.
  - **Native-v2 and KAP follow-ups remain closed from plugin flows.** Exact 0.36.0 still allows plan-file final approval before later external hooks, so accepted children remain legacy-v1 pinned and truthy experimental selectors refuse before spawn. The added secondary-model pool configuration is v2-only and excluded from the v1 model recipe; it does not widen the plugin's write surface. PR #2376 remains an upstream follow-up, not evidence for re-enabling v2.
  - **Certification gate GREEN.** The exact-0.36.0 temporary binary passed `bun run smoke:real` with **12 / 0 / 55 in 534.57s**: forced-write labels were hook-denied; the v2 selector was refused before spawn; fresh/resumed default-plan runs stayed on v1; pursue fired the hook on every continuation turn; read-swarm child writes were denied; write-swarm stayed confined (`patchBytes=278`, `user tree clean`, worktree removed); and the out-of-root coder write was denied. `KIMI_TESTED_MINORS` gains `{0,36}`. Tags: `v1.9.9` and `compat-verified-kimi-code-0.36.0`. Continuity report: `.claude/kimi-code-research/daily-monitor/2026-08-13-upstream-monitor.md`.
- **2026-08-24 (0.37.0–0.38.0 certification → v1.9.10 release)** — npm/GitHub latest is **0.38.0**, immutable commit `0999454bdcb5ddd98f39bffee434dcf0a810f394` (tag object `488fe6bb311959227c8c2602e12486e48f8b5446`). The daily monitor escalated across two new minors; verdict: **COMPAT-PRESERVED on forced legacy v1; native v2 remains intentionally disabled**.
  - **Scoped source audit:** intermediate 0.37.0→0.37.1 and 0.37.1→0.37.2 diffs were 0 bytes across all five audit surfaces. The cumulative 0.36.1→0.38.0 audit found 1,805 bytes in CLI prompt mode (only an off-path hidden `__update_download` command), 0 bytes in permission, 0 bytes in hooks, 8,525 bytes in wire/session (MCP OAuth/session plumbing plus a 0.38 background-write drain), and 47,360 bytes in session bootstrap/config (MCP registry/OAuth plus create/resume wiring). Hook merge, cwd, policy order, matching, tool-input keys, and standard swarm-child permission inheritance remain unchanged. The new `WaitFor` tool is v2-only and outside the plugin read-only allowlist.
  - **Safety containment remains load-bearing:** exact 0.38.0 still permits plan-file final approval before the external hook in native v2, so accepted children force `KIMI_CODE_LEGACY_FLAG=1` and truthy `KIMI_CODE_EXPERIMENTAL_FLAG` values refuse before spawn. KAP indexing and upstream PR #2376 remain follow-ups, not reasons to re-enable v2.
  - **Certification gate GREEN:** the exact-0.38.0 temporary binary passed `bun run smoke:real` with **12 / 0 / 55 in 381.64s**. Forced-write labels, v2 refusal, fresh/resumed default-plan v1 pinning, per-turn pursue hook enforcement, read-swarm child denial, write-swarm confinement (`patchBytes=278`, user tree clean, worktree removed), and non-vacuous out-of-root denial all passed. No auth/quota, hook-bypass, or user-tree-write blocker occurred.
  - **Release gate and publication:** `KIMI_TESTED_MINORS` now includes `{0,37}` and `{0,38}`. The exact smoke passed 12/0/55 in 381.64s; the post-edit repository gate passed 692/0/10 with 2,155 assertions. v1.9.10 publishes the verified boundary with regenerated mirrors; tags are `v1.9.10` and `compat-verified-kimi-code-0.38.0`. Continuity report: `.claude/kimi-code-research/daily-monitor/2026-08-24-upstream-monitor.md`.
- **2026-08-27 (0.39.0 certification → v1.9.11 release)** — npm/GitHub latest is **0.39.0**, published 2026-08-27T11:36Z (tag `@moonshot-ai/kimi-code@0.39.0`, checkout commit `52e8d19d`) — ~3.5 hours after the daily monitor's `NO ACTION` run, and the operator binary self-upgraded the same day, making this a same-day `CERTIFICATION NEEDED` turnaround. Five reviewers (hook contract, stream-json, CLI/bootstrap, adversarial, plus a dedicated v2 veto-ordering re-audit over the release's agent-core-v2 churn — diffstat: 337 changed files under `packages/agent-core-v2/src`, computed in synthesis report 116) + exact-binary smoke. Verdict: **COMPAT-PRESERVED on forced legacy v1; native v2 remains intentionally disabled (V2-STILL-UNSAFE)**.
  - **Scoped source audit:** 0.38.0→0.39.0 diffs were 0 bytes for CLI prompt mode (including the engine selector `experimental-v2.ts` and all six of its call sites), v1 permission policies, v1 hooks, and the whole wire/session scope. The only non-empty scoped surface (9,060 bytes, `rpc/core-impl.ts`) is MCP-registry `cwd` threading plus an OAuth `verify` tri-state; `createSessionWithOverrides`/`resumeSessionWithOverrides` and the `config/` dir are byte-unchanged. All standing v1 invariants re-verified at the tag: hook at policy index 0 with only denies before the first approve (index 5), find-first-block aggregation, exit-2 deny, `.strict()` HookDefSchema, `path`/`command` tool-input keys, `subagent-host.ts` byte-identical (deny-all still `startBtw()`-only).
  - **Scoped-diff blind spots read and recipe widened:** `tools/policies/path-access.ts` (+49) and `tools/builtin/shell/bash.ts` changed outside every scoped diff — a win32-only `cygpath` shell-path-bridge refactor, provably identity on POSIX (bridge gated on `osKind === 'Windows' && shellName === 'bash'`) and post-hook defense-in-depth regardless; narrowing, not widening, on win32. The adversarial pass additionally established that `packages/node-sdk` (source of `createKimiHarness`, ~1k changed lines) and `packages/kaos` are on the v1 `-p` path but were never scoped — benign this release (additive MCP `cwd` threading; `setTowerMode` hard-throws on v1). The audit playbook gains a `06-v1-tools-sdk.diff` scope covering `agent-core/src/tools/`, node-sdk v1 portions, and kaos.
  - **New experimental features are v2-only and inert on the pinned path:** tower mode (`KIMI_CODE_EXPERIMENTAL_TOWER`; TUI `/tower`; control-tower orchestration with `.tower/` file protocol, worktree workers, review-gated merges) has zero agent-core presence and the v1 flag registry (closed literal union) cannot express it; subagent fork (`KIMI_CODE_EXPERIMENTAL_SUBAGENT_FORK` / `[experimental] subagent_fork`; child inherits caller conversation snapshot + binding) is likewise v2-only, and the v1 `AgentSwarm` schema is `.strict()` so a model-supplied `fork` argument is rejected. Both flags are subsumed by `KIMI_CODE_EXPERIMENTAL_FLAG`, already refused pre-spawn; a user writing `[experimental] subagent_fork = true` into the shared config.toml is inert under v1 and does not trip the plugin's hooks-scoped validation (the v1 root config schema is non-strict, and `[swarm]`/`[experimental]` tables are tolerated by design).
  - **v2 veto-ordering re-audit (report 115):** the plan-file final-allow defect is unchanged across the release's large v2 churn — `event.allow()` still has exactly one call site (`planService.ts:117`), the event contract still short-circuits later listeners on final allow, plan still registers before external hooks by import order with no priority mechanism, and `default_plan_mode` still arms on fresh `-p` before auto mode is set. Upstream's own `packages/agent-core-v2/docs/Permission.md` documents `allow()` as reserved for the plan-file guard ("must bypass the entire permission chain") and lists explicit listener ordering as an open design question — the defect is design-intended with the fix explicitly undecided, so the v2 refusal is gated on a released ordering contract, not a pending bugfix. Tower and fork are gated behind this same defect and add no new final-allow listeners (tower's three listeners and the new toolDedupe service veto only; toolResultTruncation does not subscribe to that channel). Carry-forward for any future re-enable: tower workers are pinned `setMode('auto')` at spawn; toolDedupe can short-circuit a repeated call before external hooks see it (safe today — the tool does not execute).
  - **Operator-facing notes (not plugin-contract changes):** experimental Remote Control (`KIMI_CODE_EXPERIMENTAL_REMOTE_CONTROL`, `kimi rc`/`kimi web --remote-control`) can patch `hooks` through a tunneled `POST /api/v1/config`, remotely removing the managed PreToolUse entry via v2's comment-stripping config rewrite — the plugin catches this fail-closed at the next spawn's byte-exact verification (an altered entry refuses as drift, a removed one as not-installed; same `/kimi:setup` remedy). The tunnel also forwards the long-lived OAuth refresh token as relay bearer to hard-coded `wss://code-rc.kimi.com`, and RC's mandatory loopback bind selects kap-server's most permissive branch (PTY routes on, auth-failure rate limiter off) while the relay makes it internet-reachable. The `kimi rc` subcommand is registered unconditionally and gate-refused at action time — re-verify that shape if a future release moves the gate. RC's lock is `<KIMI_CODE_HOME>/server/rc.json` (no collision with the plugin's config lock); RC reads but never writes the credential store.
  - **Certification gate GREEN:** the exact-0.39.0 temporary binary passed `bun run smoke:real` with **12 / 0 / 55 in 554.49s** (unpiped exit 0). Forced-write labels, v2 pre-spawn refusal, fresh/resumed default-plan v1 pinning (`system.version` absent), per-turn pursue hook enforcement, read-swarm child denial, write-swarm confinement (`patchBytes=278`, user tree clean, worktree removed), and non-vacuous out-of-root denial all passed. The post-edit repository gate passed **692 pass / 10 skip / 0 fail with 2,161 assertions** (the fixture change adds 6 assertions to the 2,155 baseline). `KIMI_TESTED_MINORS` gains `{0,39}`. Tags: `v1.9.11` and `compat-verified-kimi-code-0.39.0`. Reports: `.claude/kimi-code-research/reports/111`–`116-upstream-0390-*.md`. Continuity report: `.claude/kimi-code-research/daily-monitor/2026-08-27-upstream-monitor.md`.
- **2026-08-27 (upstream engagement opened: v2 veto-ordering fix — docs-only, no release)** — the standing v2 blocker moved from "documented refusal" to "active upstream engagement." Devrel outreach (Chinese-primary note; three-model attribution) was sent via the Moonshot devrel WeChat contact on 2026-08-27, with a **disclosed T+3-day timer**: a formal issue (full file:line evidence at the 0.39.0 tag) files at MoonshotAI/kimi-code on ~2026-08-30 unless the team steers earlier; the issue text leaves mechanism choice to upstream. A **working reference implementation** is held in pocket, unsent: branch `feat/external-guard-phase` on the local 0.39.0 clone (HEAD `227d8ae0`, 14 files +942/−22) adds a guaranteed-first external-guard registration (`registerBeforeToolExecuteGuard`, named-method shape; guard may veto, never final-allow — narrowed event type omits `allow()`; guard drain settles before the default phase opens; only the external-hooks subscription opts in, 11 other production call sites untouched; plan's tested `allow()` semantics preserved byte-for-byte). Evidence: full agent-core-v2 suite 5926/5932 (only the 6 pre-existing glob env failures), targeted files 174/174 (independently re-run), a **vacuity gate** (src reverted to tag: all 24 acceptance-cited new tests fail unpatched; one labeled regression pin exempt) and a **mutation gate** (phase partition neutralized: 18 discriminating tests fail, plan/executor anchors stay green), anchors byte-untouched, no-comments/typecheck clean. Process: Codex Phase-2 implementation → three-model adversarial gauntlet (Kimi mutation-tested MERGE-READY; Grok forced the named-method API and the type-level `allow()` removal; DeepSeek's tag-revert experiment exposed 5 vacuous tests, since fixed) → Codex Phase-4 fix round. Workspace (gitignored, local): `.claude/kimi-code-research/upstream-v2-hook-coverage/` — `ISSUE_DRAFT.md` (v5), `DEVREL_NOTE.md`, `PATCH_DESIGN.md`, `PHASE2_IMPL_REPORT.md`, `PHASE3_{KIMI,GROK,DEEPSEEK}_REVIEW.md`, `PHASE4_SYNTHESIS.md`, `PHASE4_FIX_REPORT.md`, `external-guard-phase.patch` (sha256 `8efaf407…e407a49`). **No plugin contract changes:** the v2 refusal stays gated on a *released* ordering contract exactly as the compat line states; if upstream ships any shape of the guarantee, the path is the normal exact-tag certification with fresh `default_plan_mode=true` + restored-plan smoke evidence.
- **2026-08-29 (engine-provenance hardening + exact 0.39.1 patch certification → v1.9.12)** — every model operation now creates and persists an exact forced-legacy execution plan before its job row, replays that plan through detached workers, and revalidates it at the final spawn boundary. New provenance fields record the real operation, intended/observed engine, exact kimi version/command tuple, certification source, and resume lineage; old rows stay unknown unless positive saved-log evidence proves otherwise. A forced-v1 run that emits native-v2's pre-tool `system.version` marker stops record delivery, tears down the owned process tree, and fails with `CLI_ENGINE_PROVENANCE_MISMATCH`. Rescue/pursue/swarm-write trust only plugin-owned `KIMI_PLUGIN_CC_WORKSPACE_ROOT`, never upstream payload `cwd`; write-swarm probes from its actual worktree spawn cwd. Kimi's independent release-blocker review found no v2-containment hole and forced two fixes before release: setup/operator guidance now owns the new fail-closed untested-minor refusal with no production bypass, and corrupt persisted plans are deserialized inside rescue/pursue/swarm cleanup so jobs cannot remain stranded as running. The 0.39.0→0.39.1 audit is 0 bytes across all six playbook scopes; exact 0.39.1 and live upstream main `9d2304c` still put the plan-file final allow before external hooks, with no upstream issue/PR or released ordering API, so native v2 stays disabled and `NATIVE_V2_CERTIFIED_OPERATIONS` remains empty. Exact-0.39.1 smoke GREEN: **12 / 0 / 55 in 400.68s**, including fresh/resumed legacy pinning, pursue every-turn enforcement, real swarm-child denial, write-worktree confinement (`patchBytes=278`, user tree clean, worktree removed), and out-of-root denial. The final `bun run check` gate passed **706 / 10 intentional real-binary skips / 0 / 2,203 assertions** across 38 files. `KIMI_TESTED_MINORS` remains `{0,39}`. Tags: `v1.9.12` and `compat-verified-kimi-code-0.39.1`; continuity report: `.claude/kimi-code-research/daily-monitor/2026-08-29-upstream-monitor.md`.
- **2026-09-01 (upstream bug filed: v2 hook-ordering defect → MoonshotAI/kimi-code#3431 — docs-only, no release)** — the devrel T+3 timer (2026-08-30) passed without a reply, so the formal issue went in, **reframed from an embedder request into a bug report** after reading upstream CONTRIBUTING (`External PRs are accepted for approved bug fixes only… wait for a maintainer`s `/approve``; external feature PRs are not accepted) and the track record on comparable external hook-security issues (#1905/#2099/#3360: zero maintainer comments for 1–6 weeks; last 60 merged PRs all core team). Expected-behavior anchor is upstream`s own `docs/en/customization/hooks.md:105` (`PreToolUse`: "Triggered before a tool call (before permission checks); the tool will not execute if blocked"). **First-ever live reproduction** on the real 0.39.1 binary (nobody had executed the bypass before — it was source-argued): isolated home, `default_plan_mode = true`, one deny-all PreToolUse hook; in the same `kimi -p` session the hook denied `Glob`, then the plan-file `Write` executed with zero hook invocations; `KIMI_CODE_LEGACY_FLAG=1` control blocked it (three independent sessions, incl. the issue`s pasteable Block 1 run verbatim). **Mechanism corrected:** a wire-harness probe suggested external hooks register first, but instrumenting the shipped bundle proved plan is listener #0 and external hooks #1 in production — both subscribe from constructors and activate in the same DI cascade pass, so `index.ts` feature-import order decides; `test/wire/` hand-seeds `IAgentExternalHooksService` (`test/harness/agent.ts:1366-1369`) and proves nothing either way. AGENTS.md`s previously stated v2 order (permission gate → plan → …) was wrong and is corrected above. Issue text went through a codex/kimi/grok cc-fleet round (unanimous FILE AFTER FIXES) plus a kimi verification pass; the three rejected-by-me reviewer points were keeping a one-sentence wire-harness caveat, keeping the grep-verified "sole `allow()`" claim, and citing Permission.md only for its open ordering question rather than as an expected-behavior anchor. **#2376 closed by us** (unlinked, 33 days untouched). Reference fix rebased conflict-free onto upstream `main` `7bc5b202` as `feat/external-guard-phase-main` @ `6e5e69b7` (typecheck clean, 176/176 targeted, full suite green bar 8 pre-existing `workspaceInstanceManager` failures; the patch`s own `resume.test.ts` cases are non-discriminating regression pins because of the harness seeding) — held until `/approve`. **Option 4 (plugin-side reachability-by-construction) analyzed and NOT adopted:** sound-but-fragile; at both refs the bypass is one boolean (`planKey.active`) with three plugin-closable arming vectors (`default_plan_mode`, `EnterPlanMode` — already hook-denied — and journal-replayed `plan_mode.enter` on resume), but adopting it swaps the channel property the provenance gate demands for a listener-population property re-proven per release; kept as a documented bridge with its minimum acceptable shape (`.claude/kimi-code-research/upstream-v2-hook-coverage/OPTION4_REACHABILITY.md`). Side findings: unreleased #3290 dangerous-bash blocking is skipped under `nonInteractive: true` (v2 print sets it); `[experimental]` config tables can enable experimental flags without the env master switch — add to the audit checklist. Devrel follow-up deliberately held; engage maintainers on the issue first. Workspace: `.claude/kimi-code-research/upstream-v2-hook-coverage/` (`ISSUE_DRAFT_v7_bug.md`, `repro-0391/`, `PROD_ORDER_TRACE.md`, `CITATIONS_0391.md`, `OPTION4_REACHABILITY.md`, `external-guard-phase.rebased-main.patch`). No plugin contract changes; native v2 stays fail-closed.
- **2026-09-02 (kimi-code 0.40.0 certified — v1.9.13, patch release)** — same-day catch-up: npm published 0.40.0 at 05:58Z (tag `@moonshot-ai/kimi-code@0.40.0`, immutable commit `e27ee608`, 48 commits past 0.39.1); the Codex daily monitor flagged `BLOCKER` at 08:09 because the exact-binary smoke went 3/9 red on `auth.login_required` with `records=[]` — the documented operator-auth false alarm, cleared once operator auth was valid again (an isolated-home `kimi -p` probe answered `OK` before any re-run; no login was performed by this session). **Scoped audit (reports 117-120: Opus hook-contract, Opus CLI/stream/bootstrap, Codex adversarial, synthesis):** permission, hooks, wire/session 0 bytes; CLI prompt mode = `--yolo`/`--auto` help text + new top-level `fork`/`session` subcommands (off `-p`); bootstrap/config = the single additive `ModelAliasBaseSchema.protocol` enum line, which is the entire `packages/agent-core` source change; v1 tools/SDK additive (telemetry, session-list `includeArchived`, tower `base`), schemas/kaos/the v1 `createKimiHarness` entry point unchanged. Every load-bearing v1 contract re-cited at the tag (hook index 0, denies-only through index 4, `blockDecision` find-first-block, exit-2 deny, empty matcher = all, fail-open, plugin-hook merge at `core-impl.ts:447/627`, `permission:'auto'` at `run-prompt.ts:376`, `btw`-only deny-all unshift at `subagent-host.ts:287`). **Yesterday's `[experimental]` side finding resolved narrow:** `isKimiV2Enabled()` reads one env var and has no config service, so no `config.toml` key defeats the legacy pin; config CAN enable a registered v1 flag at L3 without the env master switch, but the v1 registry holds only `tool-select`/`secondary-model` — now an audit-checklist item. #3427 (config beats env) is v2-only; #3434 (legacy acp-adapter removal; `acp` subcommand only) is off `-p`. **v2 defect unchanged:** plan `index.ts:330` before externalHooks `:338`, sole `.allow()` at `planService.ts:112`, `toolExecutor/` 0 bytes; #3431 open, zero comments. `repro-0391/repro.ts both` re-run on the 0.40.0 binary still reproduces (v2 session `7d5f93f4`: hook denied `Glob`, plan-file `Write` executed unlogged; v1 control `243d2256` blocked it) — now a standing checklist step proving the refusal is non-vacuous. **New v2-only hazard:** #3444 (`b4ae7f87`) dropped `RuntimeWorkspaceView.resolve()`'s root assertion; `bashTool.ts:191` resolves `cwd` without `assertAllowed`, so v2 Bash can escape workspace roots — zero shared code with v1/kaos, unreachable on the pinned path, strengthens the refusal. The v2 dangerous-command ask policy is skipped under `nonInteractive`. Operator notes: v2 writeback (#3392) preserves config.toml formatting per domain (markers survive more often; no writer of the `hooks` domain exists yet), `kimi doctor` validates against the v2 schema (hook schema identical to v1). **Smoke GREEN on the exact temp binary: 12 pass / 0 fail / 55 assertions in 383.45s** (write-swarm `patchBytes=306`, user tree clean, worktree removed). `KIMI_TESTED_MINORS` gains `{0,40}`; comments in `kimi-version-probe.ts`, `stream-json.ts`, AGENTS.md, and the playbook's boundary section updated. Tags: `v1.9.13`, `compat-verified-kimi-code-0.40.0`. **Same-day follow-ups:** first comment posted on #3431 (0.40.0 re-run, mechanism unchanged at the tag, one sentence on #3444, PR offered on `/approve`); #3444 deliberately not filed separately — its commit title (`allow Bash cwd outside the workspace roots`) marks it as intended design, so it stays refusal evidence; the untested-minor test fixtures now derive from `maxTestedMinor()` (commit `1ed9a2b`), so future boundary moves are a one-file edit.
- **2026-09-03 (kimi-code 0.40.1 patch checkup — docs-only, no release)** — npm/GitHub published 0.40.1 on 2026-09-02 (immutable commit `0d45dddc`; release note = #3469, a kimi-cli migration-prompt condition fix). Codex daily monitor classified it `PATCH CHECKUP`; verified this session. Scoped diff 0.40.0→0.40.1: CLI prompt mode, v1 permission policies, hook engine, wire/session, bootstrap/config all **0 bytes**; v1 tools/SDK is 3,245 bytes of additive `suggestFiles` facade whose v1 implementation returns `undefined` (v2-only feature). Standing v2 reproduction re-run on the installed 0.40.1 binary: native-v2 wrote the plan file with the deny-all hook seeing only `Glob`; forced-v1 control blocked it — refusal and child-only `KIMI_CODE_LEGACY_FLAG=1` pin remain non-vacuous. #3431 still open, zero maintainer response. Unreleased `origin/main` (20 commits past the tag) touches no v1 permission/hook/`run-prompt.ts` path; on v2 it refactors `planService.ts` telemetry context (sole `event.allow()` untouched) and **removes the `staleGuard` feature (#3517)** — when that ships, the production listener order documented in AGENTS.md (`… swarm → staleGuard → permission gate …`) needs its `staleGuard` entry dropped; plan → external hooks ordering is unchanged. No smoke (playbook: patch with 0-byte consumed scopes), no `KIMI_TESTED_MINORS` change, `{0,40}` already covers it. **Host rollout closed:** the Claude Code host was still on 1.9.6 (tested set ended 0.34.x, so every model command would have refused kimi 0.40.1 at the version probe) while Codex was already on 1.9.13; updated via `/plugin` + `/kimi:setup` (pruned the stale marker-less 1.9.6 block, re-adorned markers, probe ok). **v2/tower decision re-affirmed:** nothing plugin-side to do — native v2 stays gated on a released ordering contract (Option 4 bridge still not adopted), tower is v2-only by construction (unreleased #3461 adds `config.toml` tower config, still v2), and the reference-fix PR stays held for a maintainer `/approve`. Devrel ping deliberately deferred to ~2026-09-08 if #3431 is still silent. Continuity report: `.claude/kimi-code-research/daily-monitor/2026-09-03-upstream-monitor.md`.

- **2026-09-06 (kimi-code 0.41.0 certification → v1.9.14)** — exact upstream commit `95478e8c7ba248fd2470d5bb151555ec7fedd19d`, compared with 0.40.0. Reports 121–125: four independent source reviewers (hook, stream/bootstrap, CLI, adversarial) and synthesis; all COMPAT-PRESERVED on forced legacy-v1. CLI/shared writer, entire v1 core, permission, hooks, wire/session, bootstrap/config, and kaos are unchanged; SDK scope is 3,933 bytes of additive `suggestFiles` (v1 returns `undefined`) plus a comment. Extra-scope dependency review found no v1 break. Reuses the same-day monitor's exact-0.41.0 smoke: **12 pass / 0 fail / 55 assertions, 383.88s**; release changes only boundary/version, the known-minor assertion, docs/comments and generated surfaces. The earlier September 5 auth blocker was cleared by that September 6 run. The v2 fresh-default-plan repro still bypasses the hook (Glob denied, 658-byte plan Write unlogged); v1 control blocks Write. **Documentation corrections:** `staleGuard` is deleted (#3517), and the old package `Permission.md` is deleted (#3481), so its ordering discussion is historical. Auto-mode dangerous-command checks are skipped (#3529), but nonInteractive print was already excluded in 0.40.0; this is not a new loss on `-p`. V2 print shutdown now quiesces producers and flushes journals (#3531), a future lifecycle-audit item. [Current v2 brief](docs/native-v2-status.md) records released/unreleased boundaries. `main` at `af81bb92` adds attachment-name and UI/visualizer work without fixing ordering; open #3552/#3537 are watchlist only. #3431 has no maintainer response; September 8 conditional follow-up is authorized, reference-fix PR held for `/approve`, reachability bridge still unadopted. `KIMI_TESTED_MINORS` gains `{0,41}`; native-v2 matrix stays empty. Tags: `v1.9.14`, `compat-verified-kimi-code-0.41.0`. Full release gate result is recorded in certification synthesis 125.

- **2026-09-09 (full native-v2 migration → v1.10.0, MAJOR — the plugin now runs on agent-core-v2)** — kimi-code **0.42.0** (immutable commit `6954d2c8bf94a5c7fc29cc6ae35b15d042cc4dcb`, published 06:24Z) deleted the entire legacy `agent-core` package and `KIMI_CODE_LEGACY_FLAG` (removal commit `bb16383a`, #3542 — **not mentioned in its changelog**), making `kimi -p` native-v2 unconditionally. The daily monitor classified this a **BLOCKER**: the exact-0.42.0 smoke went 9/12 red on `CLI_ENGINE_PROVENANCE_MISMATCH` (the plugin refusing the v2 marker), and the standing repro showed the plan-file bypass reachable in both unflagged and `KIMI_CODE_LEGACY_FLAG=1` modes (the flag is now inert). Certified 0.41.0/v1.9.14 stayed the shipped deployment while this migration was developed on the `v2-migration` branch. A cross-machine handoff packet (`kimi-code-v2-migration-2026-09-09`, verified by an M5 Codex receipt) proposed the destination; this session executed it.
  - **New certification basis (docs/native-v2-certification-provenance.md §2, amended).** Upstream still registers the plan feature before external hooks at exact 0.42.0 — re-confirmed in the shipped `dist/main.mjs` bundle (`registerFeature(PlanFeature)` at byte 9848672 vs `ExternalHooksFeature` at 9908324) — and provides no ordering contract. Basis A (released ordering guarantee) is therefore unavailable; #3431 stays open as the preferred end state. Native v2 is certified on **Basis B (reachability by construction):** the plan-file guard (`features/plan/planService.ts:110`) is the engine's ONLY chain-breaking `event.allow()`, it fires only while plan mode is ACTIVE, and the plugin closes every arming vector for a `kimi -p` session. Exhaustive audit (three parallel source agents + shipped-bundle proof) established the vectors at 0.42.0: `default_plan_mode` config, the `EnterPlanMode` tool, and journal-replayed plan state on resume; NOT reachable — kap-server routes, TUI `/plan`, `--plan` argv, agent profiles, subagent/fork/tower inheritance (`snapshotExcluded`), undo. `restore()` folds ONLY `agents/*/wire.jsonl`, so a raw journal scan is a complete taint check.
  - **Live evidence on the real 0.42.0 binary** (isolated seeded homes, deny-all hook): plan mode OFF → an ordinary `Write` and an `EnterPlanMode` attempt both reached the hook and were denied, no side effects; plan mode ON (`default_plan_mode=true`) → the plan-file `Write` bypassed the hook (only `Glob` seen) and a `plan_mode.enter` journal record was written — the load-bearing negative control proving the refusal is non-vacuous. The journal scanner classified the clean session `clean` and the plan-ON session `tainted`.
  - **Implementation** (WP-A/B/C/D). `runtime/native-v2-preflight.ts` (new): pre-spawn parse of the same `config.toml` refuses `default_plan_mode` unless absent/`false` (`CLI_V2_PLAN_MODE_CONFIGURED`), refuses `[experimental]` tower/subagent_fork from config or per-flag env (`CLI_V2_EXPERIMENTAL_UNSAFE`), and refuses a plan-tainted resume (`KIMI_SESSION_PLAN_TAINTED`); fail-closed (O_NOFOLLOW, size-capped, bounded enumeration) on unreadable/oversized/symlinked inputs. `runtime/kimi-engine.ts`: `selectIntendedEngine` (exact-version `NATIVE_V2_CERTIFIED` → v2, else `KIMI_TESTED_MINORS` → v1, else refuse), per-engine `assertCertifiedCapability`, `safety_profile` field (`native-v2-no-plan/1`, forged/unknown rows refused at spawn), `assertResumeEngineCompatible` refuses unknown lineage for v2 (`KIMI_SESSION_LINEAGE_UNKNOWN`). `runtime/cli-client.ts`: `KIMI_CODE_NO_AUTO_UPDATE=1` every spawn, legacy pin only for v1, spawn-boundary re-check of the experimental flag + preflight, and v2 provenance (marker required as first line, must equal probed version, marker-before-record else teardown). `runtime/rescue-approval.ts`: `Bash.cwd` confined to the trusted root (realpath/symlink/`.git`/existence) before the command policy — closes the 0.40.0 #3444 out-of-workspace-cwd gap for writes. `runtime/hooks/approval-policy.ts`: `EnterPlanMode`/`ExitPlanMode` denied for every label. `tests/audit/v2-tag-scan.test.ts` (new): mechanized per-tag re-proof of the construction (`.allow()` count == 1, before-execute subscriber set, `enter()` callers, config section, tool field names, `--plan` rejection), skipped unless `KIMI_CODE_SOURCE_TAG_DIR` is set. `runtime/job-store.ts`: additive nullable `safety_profile` column.
  - **Continuation cost (stated in the release notes):** pre-0.42 sessions (v1 or unknown provenance) are no longer resumable — the v1 engine is gone from the binary — so `ask --resume`/`rescue --resume` refuse with a fresh-session remedy; nothing is deleted, status/result/replay stay inspectable. `KIMI_TESTED_MINORS` is unchanged (legacy table, capped 0.41); v2 certification is per exact version and per operation, appended only after the tag scan + live control + smoke.
  - **Delegation:** WP-A (Bash cwd) and WP-C (preflight module) implemented via the Codex rescue runtime and independently verified; WP-B (engine/provenance kernel) by a Fable fork; WP-D (command wiring), docs, tag scan, and integration by the main thread. Full-repo gates: typecheck clean; `bun run check` **784 pass / 0 fail / 2,382 assertions** (drift gate included). Two environmental test issues fixed along the way: iCloud conflict-copies swept from the generated dirs before staging, and `installed-script.test.ts`'s repo-copy `beforeAll` excludes `.claude`/`.tmp` and gets a 60s timeout (its recursive copy is slow on synced storage). Continuity: `.claude/kimi-code-research/daily-monitor/2026-09-09-upstream-monitor.md`, `.claude/kimi-code-research/upstream-v2-hook-coverage/CLAUDE_042_EVIDENCE_2026-09-09.md`, and the handoff packet's `receipts/CLAUDE-REVIEW-*.md`.
  - **Second-round hardening (same day, after a model handover to Fable 5.1).** Independent re-read of the whole runtime diff plus a second Codex adversarial pass, a second Kimi review, and a docs audit. Gaps closed: (1) native-v2 **resume** had never been exercised live — proven via `ask -r` through the checkout (marker first, same session id, `resumed_from_job_id` linked, prior turn recalled) and turned into smoke lane 3b (fresh → resumed → `plan_mode.enter` appended to the REAL `agents/main/wire.jsonl` → next resume refuses pre-spawn, journal byte-size unchanged); (2) the journal scan's `plan_mode.*`/`plan.*` premise was not pinned — `planOps.ts` now hash-pinned with the durable type set asserted and `restore()` shown to fold by literal `record.type`; `permission.set_mode` verified as a separate `manual|yolo|auto` state; (3) Codex round 2, seven findings all fixed with regression tests: **P1** upstream's loader camelCases top-level TOML keys so `defaultPlanMode = true` bypassed the literal `default_plan_mode` check (preflight now mirrors `snakeToCamel` verbatim, `app/config/toml.ts` pinned; `[experimental]` verified to keep raw keys), **P1** hidden `-C` continue alias in prefix args (full root-flag reserve set), **P1** Stop hook resolved a relative `KIMI_CODE_HOME` against the plugin root for verification but the payload cwd for the child (now one resolution against the payload cwd; test proven load-bearing by stashing the fix), **P2** null-source lineage exemption, **P2** unknown-role/malformed lines ahead of the marker, **P2** stderr session pin on v2 plans, **P2** multi-line marker version; (4) docs still described v1 internals — the compat-audit dependency table and all six Phase-0 diff scopes cited the deleted `packages/agent-core/`, safety.md/AGENTS.md used `PreToolCallHookPermissionPolicy`/"policy index 0" language, safety.md still said v2 was "fail-closed disabled"; all rewritten against paths verified on the 0.42.0 tree, and a refusal-code inventory table added to safety.md. (5) Kimi round 2 converged on the resume gap (already closed by lane 3b; its residual — no audit-time pin of the session-store layout — closed by pinning upstream's `wire-scan.ts` and asserting the `sessions/`/`session_<uuid>`/`agents/` builders) and added two low-severity edges, both fixed: a goal-terminal pursue exit (3/6) could resolve a v2 plan with no marker (`assertGoalRunProvenance`), and a readdir `EACCES` in the journal scan escaped the classified refusal. Gate after hardening: **826 pass / 24 skip / 0 fail**; tag scan 15/15; full real-binary smoke on 0.42.0 after all fixes 13 pass / 0 fail / 66 assertions (517.8s). **Upstream:** the 0.42.0 re-check was posted on MoonshotAI/kimi-code#3431 (comment 5608505956): legacy engine removed (#3542), same bypass, plan still imported ahead of external hooks (`src/index.ts` L347 vs L363), sole `allow()` at `planService.ts:110`; the reference-fix offer stands pending `/approve`. **Kimi release-level review (post-publish, via the installed 1.10.0 plugin):** verdict APPROVE — round-2 code and the 1.9→1.10 upgrade path clean; two low doc inaccuracies fixed docs-only (the refusal table claimed `retryable_after_setup: false` on three pre-1.10 codes that omit it — queued for the next release: add the field to `CLI_V2_HOOK_ORDER_UNSAFE`, `INVALID_ENV` and the legacy-v1 `KIMI_CAPABILITY_NOT_CERTIFIED` throw sites; README test count now sourced from `bun test`). **Rollout on the dev machine:** Claude cache 1.10.0 + `/kimi:setup`; Codex marketplace added and `kimi@kimi-marketplace` 1.10.0 installed via the Codex CLI + `$kimi-setup`; both host-scoped blocks coexist.

- **2026-09-09 (v1.10.1, patch — refusal contract made exact)** — Kimi's post-publish release-level review of 1.10.0 (verdict APPROVE) found the `docs/safety.md` refusal table claiming `retryable_after_setup: false` on three pre-1.10 refusal shapes that omitted the field (`CLI_V2_HOOK_ORDER_UNSAFE`, `INVALID_ENV` ×3 paths, legacy-v1 `KIMI_CAPABILITY_NOT_CERTIFIED`). Behaviour was fail-safe (the retry gate retries only on literal `true`), so 1.10.0's docs were corrected in place first; this patch then adds the field (plus `refusal_kind: "v1-version-not-certified"`) so code and contract match byte-for-byte. No policy/engine/certification change; exact certified kimi-code stays 0.42.0. Shipped as its own version because runtime bytes must never change under an existing version-stamped cache. **Follow-up (same evening, tests only):** the review gate showed *enabled* after `/kimi:setup` — not a default change (`DEFAULT_CONFIG.reviewGateEnabled` is `false`; plain setup preserves the stored flag) but test pollution: the Claude Code shell exported the *codex* plugin's `CLAUDE_PLUGIN_DATA`, and tests spreading `process.env` wrote their gate fixture + mock jobs into that live store. Fixed by a bun test preload that scrubs host plugin env (`bunfig.toml` → `tests/helpers/preload.ts`); the gate was reset to off in both data dirs; a Claude Code bug report was drafted for the cross-plugin env leak.
- **2026-09-14 (v1.10.2, security maintenance patch)** — Backported the complete upstream fixes for smol-toml EOF-comment infinite loops (GHSA-7w5x-hrqm-74c2) and shell-quote quadratic token finalization (GHSA-395f-4hp3-45gv) into source and both plugin distributions. Vendor provenance and audit limitations are explicit; bounded Node regressions cover source and shipped mirrors. Updated development tooling and added grouped weekly Bun/Actions updates with CI auditing. A missing-Kimi test-fixture assumption was repaired; runtime approval policy and exact kimi-code 0.42.0 certification are unchanged. Frozen installs, audit, generated surfaces, and full checks pass. This maintenance release did not run paid provider smoke or change installed host caches/configuration.
- **2026-09-15 (v1.10.3, certification patch — kimi-code 0.43.0 + 0.43.1)** — The daily upstream monitor (Codex, 06:44 BST) flagged `CERTIFICATION NEEDED` for 0.43.0 (published 2026-09-14); by the time the slice ran, npm `latest` was **0.43.1** (published 06:57 BST) and the operator's binary had auto-upgraded into it, refusing every spawn. Certified both exact versions in one pass, every gate per version: **tag scan 15/15** on the exact 0.43.0 (`ffa94fae`) and 0.43.1 (`75ac010b`) trees with new hash rows (the seven load-bearing files are byte-identical across 0.43.0/0.43.1; five identical to 0.42.0; the two that moved are the restore refactor — `restore()` now folds `wire.readRestorable()`, a pure `restorableChain()` filter over the same `wire.jsonl`, before `readJournal()`, so the journal taint scan stays a strict superset; the scan now asserts that structurally). **Plan-ON live control** reproduced the bypass on both binaries (hook saw `Glob` only, plan file written — refusal still load-bearing; #3431 still open/unanswered). **Plan-OFF control** (new `repro-clean.ts`, two separate prompts) showed `Write` and `EnterPlanMode` hook-denied on both. **Smoke:** 13 pass / 0 fail / 0 skip on the operator's installed **0.43.1** (312 s) and on a temp-installed exact **0.43.0** via `KIMI_PLUGIN_CC_KIMI_BIN` (285 s) — every native-v2 lane: all read-only labels hook-denied, the goal-mode run wrote zero files across the budget (0.43.1: `turnsUsed:8`, paused on the plugin abort; 0.43.0: `turnsUsed:10`), default-plan preflight and resume/taint lanes, swarm subagent write denied, and write-swarm confined to its worktree with a captured patch (0.43.1: `patchBytes=278 userTreeClean=true worktreeCleaned=true`; 0.43.0: `patchBytes=278 userTreeClean=true worktreeCleaned=true`). Human reads: `run-v2-print.ts` (prompt path moved onto `IAgentLoopService.submit()`, no argv/provenance change), subscriber set unchanged (sole `.allow()` at `planService.ts:110`), experimental flags (`AUTO_SESSION_TITLE` removed, nothing added), 0.43.1's `[secondary_model]` validation (diagnostics only), upstream's 24h goal-limit removal (plugin `--budget` unaffected), and the 0.43.0→0.43.1 `_base/di/**` diff (disposal-path cleanup only; service resolution and child-scope creation untouched, so swarm-subagent hook isolation stands — flagged by Codex's release review as missing from the first draft of this entry). Process finding: two isolated homes refreshing a copied OAuth grant concurrently invalidated the operator's token (`The provided authorization grant is invalid`; `kimi login` fixed it) — the playbook now says run controls/smokes sequentially. Runtime change: `NATIVE_V2_CERTIFIED_VERSIONS` += `0.43.0`, `0.43.1`; no policy change.

- **2026-09-17 (plugin 2.0.0)** — Certified exact
  kimi-code 2.0.0 (`1b89e4b039f052d10f258464413b2047acca12ba`) under the existing
  no-plan construction. Plugin certification versions now match upstream.
  Source review: hook/gate/DI surfaces unchanged; wire flush targets the same
  journal; swarm scope eviction and rebuilding retain normal lifecycle hooks.
  Setup's major-version schema gate now accepts the exact reviewed 2.0.0
  event contract, refusing unreviewed patches/minors and prereleases. Tag scan
  15/15 with schema pins. Plan-ON reproduced the bypass; plan-OFF denied
  Write/EnterPlanMode. Full smoke 12 pass / 1 fail (coordinator did not fan out,
  no escape file); one targeted retry after fixture-prompt clarification
  passed with the original assertions and a surfaced denial reason. Goal:
  five turns, zero files; write-swarm: 278-byte patch, clean user tree and
  removed worktree. Candidate smoke uses a test-process-only version row;
  production certification was extended only after the live lanes passed.
  Added credential-safe `setup --models [--json]`, native provider-setup
  guidance, and explicit-model routing instructions for both hosts. Review
  gate follows the configured default unless overridden. One authorized
  Moonshot K3 API test passed without changing the subscription default.
  Final `bun run check`: 847 pass / 26 skip / 0 fail (build, typecheck,
  generated surfaces and drift gate green). User authorized temporary
  config/OAuth copies for certification, sequential execution and cleanup.
  Release and Codex-only host upgrade authorized separately. Evidence:
  `.claude/kimi-code-research/certification-2.0.0/`.
- **2026-09-17 (documentation follow-up to 2.0.0)** — Rebuilt the README around first-time onboarding for both hosts: prerequisites, install and first request, workflow choice, model selection, job follow-up, updates and troubleshooting. English, Simplified Chinese, French and Japanese use GitHub-native expandable sections in the same file. Reorganized this roadmap to lead with current capability, remaining investigations and release discipline; retained the original GA plan and full dated audit record as history. No runtime, safety-policy or version change.

- **2026-09-17 (documentation currentness audit)** — Updated safety, migration, contributor, runtime, script, test, and CI guidance to match 2.0.0. Corrected the exact-version certification procedure, credential handling for live smoke, retry guidance, and reasoning-setting claims in Claude command and agent instructions. Updated the manual smoke default to 2.0.0 and repaired internal links. Earlier migration instructions remain labeled as history. No runtime logic, certification boundary, or version change.

- **2026-09-17 (v2.0.1, plugin maintenance)** — Fixed #13 for standard installed packages by deriving the expected data directory from the loaded package and refusing conflicting shared host variables before store access. Added the absolute `KIMI_PLUGIN_CC_DATA` override for custom data parents; custom checkouts retain unambiguous legacy variables. Existing state stays in place. Background workers pin the selected root, and the Stop hook reports resolution failures as visible skips. Added both-host installed regressions, preserved symlink aliases, and updated the old precedence expectation. Includes the documentation currentness audit above. Full check: 861 pass / 26 skip / 0 fail. No real-provider calls or installed-host changes. This is an authorized maintenance-version exception; certified CLI versions remain unchanged, with 2.0.0 recommended.

</details>


- **2026-09-19 (plugin 2.0.3)** — Certified exact kimi-code 2.0.1 (`caf7d4e2`) after four source audits, 15/15 tag scan, plan-ON/OFF controls and 15/15 sequential live smoke with no retries. Added a narrow pursue goal-status permission to fix repeated UpdateGoal denial; older coexisting host hooks remain enforcing and can still veto it. Adopted independent plugin SemVer numbering. [Evidence and limitations](docs/upstream-2.0.1-certification.md). No host rollout in this slice.

- **2026-09-20 (plugin 2.0.4)** — Certified exact kimi-code 2.0.2 (`9d07f634`) for all eight operations after four source reviews, 15/15 tag scan, plan-ON/OFF controls and 15/15 sequential live smoke (84 assertions, no retries). Reviewed exact hook schema and source hashes; future versions remain fail-closed. The known plan-file bypass persists, so plan mode remains unreachable in managed sessions. [Evidence and limitations](docs/upstream-2.0.2-certification.md). Publication authorized; no installed-host or operator CLI changes.

- **2026-09-20 (plugin 2.0.5, build correction)** — Bound SQLite constructors explicitly so the locked TypeScript 7.0.2 compiler preserves session-repair instantiation. Added four emitted-JavaScript regressions across Node/Bun and root/Codex distributions: all fail before and pass after, with unchanged read-only previews. v2.0.4's local gate used stale dependencies; its published tag is unchanged. Release instructions now require frozen dependencies and successful CI before publication. Exact CLI certification remains through 2.0.2; no policy or installed-host changes. [Evidence](docs/release-2.0.5-build-fix.md).

- **2026-09-24 (plugin 2.0.6)** — Certified exact kimi-code 2.1.0 (`52437299`) and 2.1.1 (`f67e6398`) for all eight operations after four source reviews, each exact 15/15 tag scan, separate plan-ON/OFF controls and sequential candidate smoke. Hook schema accepts only the reviewed exact versions; legacy-v1 remains capped at 0.41.x. Documented the internal Git subprocess trust boundary and 2.1.1 rollback of 2.1.0 hardening. [Evidence and validation](docs/upstream-2.1-certification.md). This task did not update installed hosts or the operator CLI; the final operator probe reports 2.1.0 rather than the morning report's 2.0.2, with the intervening source undetermined.
- **2026-10-14 (plugin 2.0.8)** — Certified exact kimi-code 2.2.0 (`472192c3`, npm-published 15:35 UTC the same day, after the morning monitor's NO ACTION) for all eight operations: four source reviews (hook contract, stream-json, CLI/config/trust, adversarial — all COMPAT-PRESERVED; lead re-verified the load-bearing claims against the tree), tag scan 15/15 with a new row whose twelve hashes are byte-identical to 2.1.1, plan-ON control reproduced the bypass on the exact binary (Glob denied, 784 B plan written with no Write hook payload), plan-OFF denied Write and EnterPlanMode, candidate smoke 15/15 (84 assertions, 438.8 s; goal run 8 turns/0 files; write-swarm 278 B patch, clean tree, worktree removed). New or changed since 2.1.1 and classified: tower's before-execute listeners 5→7 (both veto-only; tower still refused pre-spawn), `notify_user` (pre-existing flag, now TUI-visible; inert under `-p`, tool hook-denied), `KIMI_CODE_TRUST_WORKSPACE` env (new; trusts any cwd → project MCP stdio bootstrap outside the hook; the plugin now deletes it in `buildEnv`). Same release ships the field-report fixes: `--budget` on ask/rescue/review/challenge, partial output preserved on timeout, honest advice, `--help`. Process findings: an iCloud conflict copy (`goalService 2.ts`) in the upstream clone turned the tag scan red — ~500 copies removed; `.claude/` and `node_modules/` moved to `.nosync` directories behind symlinks (iCloud skips the `.nosync` suffix; `.gitignore` patterns dropped their trailing slashes to keep matching the links); subagents wrapping Codex/Kimi background jobs are not woken on completion — poll the job log/store. [Evidence](docs/upstream-2.2.0-certification.md). Operator binary stayed 2.1.1 throughout; installed hosts not updated. CI on the release commit failed `bun audit` on a same-day advisory (GHSA-r4xh-jqrq-34v2, smol-toml ≤ 1.8.0); the test-only dependency moved to 1.9.1 and the vendored 1.6.1 subset's bounded quadratic `parseKey` on trusted `config.toml` is documented in its README with the 1.9.x port as the next integration review. Open follow-ups from the reviews: `JobStore` opens its first pragma before setting the busy timeout (`SQLITE_BUSY` on a racing `status`); recover a timed-out native-v2 session id from the session directory; surface an inherited `--budget` in the launch banner; make the smoke harness echo its candidate tuple. Release mechanics: `v2.0.8` tagged on `9eecea4` and released on GitHub (the marketplaces both hosts install from); the tag-triggered npm publish — the first OIDC publication — failed, first on npm parsing the bare `package/<file>.tgz` argument as a GitHub shorthand (fixed in `publish.yml`: anchored `./` path), then with `404 Not Found - PUT …/kimi-plugin-cc` on the manual re-dispatch, i.e. the OIDC token exchange was refused; the npmjs.com trusted-publisher binding had expired unused; recreated it (with *Allow npm publish*) and the re-dispatch published 2.0.8 with provenance (run 38650044033). Both local hosts were updated to 2.0.8 and re-pinned (`claude plugin update kimi@kimi-marketplace`; `codex plugin marketplace upgrade` + `codex plugin add kimi@kimi-marketplace`).
- **2026-10-15 (plugin 2.2.0)** — Maintenance release whose number deliberately aligns with the certified CLI (2.2.0 remains the certified maximum; the table is unchanged and the number is not evidence — AGENTS.md "Releasing" now says so). Closes the four follow-ups from the 2.0.8 reviews plus GHSA-r4xh-jqrq-34v2: the vendored TOML parser is now unmodified smol-toml 1.9.1 (all seven modules byte-identical to the npm package; `findTopLevelHooksAssignment` ported to the 1.9.1 `ParseContext` walk, mirroring `parse.js`; a 2k/8k/32k linear-scaling regression guards the old quadratic `parseKey`; the GHSA-7w5x EOF-comment test keeps its three malformed inputs and child timeout, adapting only to 1.9.1's wording and null-prototype tables). A budget-timed-out native-v2 job now recovers its session id from the session store — fail-closed: exactly one `state.json` with `version:2`, same realpath cwd, `createdAt` in `[spawnedAt, settledAt]` (no pre-spawn slack), an id no other job on this host uses, AND whose `agents/main/wire.jsonl` first user message carries the job's exact prompt (`prompt_digest`). The digest binding came out of Kimi's adversarial design review (job `8fc309e8`): time+cwd alone would have adopted a concurrent TUI session, another host's finished job (stores are host-local) or a `state.json` planted by repository code under rescue, and a planted clean journal could replay attacker-written turns into the next resume; verified against the five real timeouts since 10-13 — each matched exactly one on-disk session by digest, and one prompt matched two sessions (same prompt run twice), so digest alone is not unique and the window + exactly-one rule stay. Recovery is skipped when no `system.version` marker was observed (resume would refuse as lineage-unknown anyway); `kimi_session_id_source` (`announced`/`recovered_session_dir`) and `error.details.session_recovery` record what happened; a recovered id still passes `assertPersistedResumeLineage` and the raw plan-taint scan. Inherited budgets print at launch and `budget_source` (`explicit`/`inherited`/`default`; legacy non-null rows `unknown`) appears in status and `result --json`. Smaller: 30 s timeouts on the spawn-heavy installed-data tests (iCloud `fileproviderd` churn), README install pin, `aborted` detail derived from the settled result. New re-verify-each-audit row in docs/upstream-compat-audit.md for the session state/journal shape the recovery depends on; the upstream ask (announce the session id at turn start, which would make the module dead code) is recorded there as a follow-up and was filed on 2026-10-15 as MoonshotAI/kimi-code#4240 (with #4241 asking for an `outcome` field on stream-json tool lines). Implemented by Codex from a brief; every claim verified against the tree (vendored bytes `cmp`-identical; the four sandbox-only test failures pass outside the sandbox, 117/117). Kimi's diff review approved with four minor findings, all applied (stray symlinked store entries are skipped rather than disabling recovery host-wide; `journal_missing` is distinguished from `digest_mismatch`; a failed write of an announced id is labelled `session_id_persistence`, not `session_recovery`; a drift test pins the walker's hand-copied parse() defaults to the vendored source). The Claude code review found the one defect that mattered: the recovery scan's 4,096-entry cap (mirrored from the preflight) counted every entry under `sessions/` — on this host already 2,494 entries plus 247 `.index-dirty`/`.index-cache` markers, growing by one per run — so recovery would have reported `enumeration_capped` for good within months; fixed by skipping dot-entries uncounted, raising the pathological-tree guard to 65,536, skipping any session directory whose mtime predates the spawn before reading it, and matching the journal on a bounded 4 MiB prefix instead of refusing large journals (the first cut of that prefix trim used `/[^\n]*$/`, which backtracks quadratically on megabyte lines and spun the test at 100 % CPU — the new large-journal test caught it before commit). Full check 1060 pass / 28 opt-in skips / 0 fail / 4048 assertions; real-binary smoke on the operator's pinned 2.2.0 install (`KIMI_PLUGIN_CC_KIMI_BIN=~/.local/share/kimi-plugin-cc/kimi-bin/current`, production table) 15 pass / 0 fail / 84 assertions in 365 s (goal run paused at the smoke budget after 6 turns, write-swarm 278 B patch with a clean user tree).

- **2026-10-15 (plugin 2.2.1)** — Closes the two remaining pre-1.1 items at the severity the evidence supports. **H5** ships as a requested, never enforced, per-run thinking effort: `--thinking <effort>` on ask/review/challenge/rescue/pursue/swarm exports upstream's `KIMI_MODEL_THINKING_EFFORT` binding (0.22.0+, `[thinking].forcedEffort`, stripped on every config write-back, so config.toml is never touched); the review gate requests `off` by default (`KIMI_PLUGIN_CC_REVIEW_GATE_THINKING`: `inherit` or another effort); the request is persisted (`thinking_effort`, shown as `thinking_effort_requested`), replayed by detached workers, and not inherited on resume. Honoured only by trait-driven providers (the three Moonshot `kimi*` definitions in 2.2.0) and only when the base level is not already `off`; stream-json carries no thinking deltas, so the plugin cannot observe the outcome — verified live: `kimi -p --output-format text` printed its reasoning on stderr by default and none with the env set. The user's default usage pattern is untouched: without the flag nothing is exported. **H1** ships as the read-only DETECTION slice (`runtime/hook-escape.ts`): the pure PreToolUse policy (`decideHookOutcomePure`, split out of `decideHookOutcome` with every decision and reason byte preserved) is replayed on streamed tool calls and each denied call's result is checked for the hook's denial; findings are logged, persisted (`hook_escapes`), exposed in `status`/`result --json`, printed as a stderr notice and carried in timeout details — the run is never stopped and the job never fails on them (see the H1 status above for why the first cut's stop-and-fail was wrong on certified 2.2.0). Live control on the real binary: hook command → nonexistent script, upstream failed open, `Write` created the file, finding `mismatch` excerpt `Wrote 7 bytes to ESCAPE.txt`; intact hook → byte-exact denial, no finding. Process: implemented by Codex from a brief (20 min); my read of the diff fixed the empty gate env, the invariants version line, a spliced AGENTS sentence and the refusal-table framing; Kimi's adversarial challenge (6 findings) and the Claude code review (3 verified in source) converged on the false-alarm paths — coexisting hooks first-block-wins in config order, cancel/budget races, the repeat breaker decorating vetoed results, pre-hook `preflightToolCall`/`resolveExecution` rejections — and drove the detection-only reshape, the `carriesDenial` decoration handling, the `mismatch`/`unresolved` vocabulary and the gate staying fail-open. **Incident:** the H5 live control ran in a temporary home holding a *copy* of `~/.kimi-code/credentials`; the copy refreshed the OAuth token, the provider rotated the refresh token, the copy was deleted and the real store was left with a revoked grant (`The provided authorization grant is invalid`) — the operator had to `kimi login` again. Never copy the token store into a temporary home; the live-control script now symlinks the real `credentials/` directory (one store, no divergent refresh) and lanes run strictly sequentially. Checks: full `bun run check` 1098 pass / 28 opt-in skips / 0 fail / 14,215 assertions (drift gate clean); real-binary smoke on the operator's pinned exact 2.2.0 install: 15 pass / 0 fail / 84 assertions in 512 s (goal run paused at the smoke budget after 6 turns; write-swarm 278 B patch, user tree clean, worktree removed). The smoke harness now symlinks the token stores instead of copying them (see the incident). Spurious single 5 s-timeout flakes appeared only while three suites, the live control and Kimi's run shared the host; each passed alone.

- **2026-10-22 (plugin 2.2.2; CLI 2.3.0 certification)** — Exact source audit, 15/15 tag scan and three non-vacuous controls passed; candidate smoke 15 pass / 0 fail / 84 assertions in 316.41 s, no skips or paid retries. All eight native-v2 operation rows now include exact 2.3.0; legacy minors stay capped at 0.41. Preserve stdout-only occupied-session errors as bounded diagnostics, pin the stale-reload path, and correct the monitor classification: concurrent trusted-journal edits are the existing explicit residual, not a newly demonstrated in-boundary bypass. No speculative race guard, hook relaxation or host changes. Full check on a 381-file byte-verified isolated copy: 1104 pass / 28 opt-in skips / 0 fail; original Documents checkout had installed-data fixture timeouts, retained in evidence. Package gate passed (196 files); code and doc reviews found no remaining actionable defects. [Full evidence](./docs/upstream-2.3.0-certification.md). Release follow-through is authorized as plugin 2.2.2; installed hosts and the operator CLI pin remain unchanged.

- **2026-10-23 (plugin 2.3.1; CLI 2.3.1 certification and Kimi prompt/comment pass)** — Exact source audit, 15/15 tag scan and three non-vacuous controls passed; candidate smoke 15 pass / 0 fail / 84 assertions in 324.53 s, no skips. All eight native-v2 operation rows now include exact 2.3.1; legacy minors stay capped at 0.41. Four independent source reviews found no new plan-arming, hook, print-protocol or print-mode takeover break. Document the new ambient lock-disable, conditional POSIX `ps`/PATH and legacy-trust-migration residuals instead of treating locks as enforcement. The same release strengthens operation-specific Kimi prompts and metadata separation, fixes untracked/base review scope, reserved-word goals and incomplete patch capture, and removes roughly 2,300 lines of stale comment archaeology while preserving current invariants. `AGENTS.md`, contributor guidance and the compatibility runbooks now capture those rules. [Full evidence](./docs/upstream-2.3.1-certification.md). A byte-verified isolated full check passed 1,134 tests with zero failures and the package gate passed 196 files. Release commit `20011ff` passed CI; the annotated `v2.3.1` tag and release-event publish run `39977818482` passed, and the registry tarball matches the CI artifact byte-for-byte (SHA-1 `e309448480a2ce841b49840cdaeeed37acc6c50b`, 196 files). Installed hosts and the operator CLI pin remain unchanged.

- **2026-10-25 (plugin 2.4.1; exact CLI 2.3.2 certified and published)** — Exact 2.3.2 at commit `b8dd3a134060c6e80ba4a1659335cd63b68483f2` is certified for all eight operations. Plugin and CLI versions advance independently; legacy-v1 remains capped at 0.41.x. Release commit `06a0a47f2b34dffb8dd71e7ce93646212e74ed19` passed CI run 40236704464; annotated `v2.4.1` and publish run 40237085945 are live. npm `latest` is 2.4.1 with 224 files and SHA-1 `77fe6daaa0f23750cc9b5d857bdbdd5107a7d4ce`, byte-identical to the CI artifact; fresh registry and artifact installs passed both host setup/checks. Final closeout CI run 40238295139 passed.
  - **Source and plan gates:** the exact-tag scan passed 15 tests with 92 assertions after its reviewed hash-row addition; 15 load-bearing construction/schema files are byte-identical to 2.3.1. Plan-ON reproduced the bypass (first marker 2.3.2, a 740-byte plan file, no plan-file Write at the deny-all hook); separate plan-OFF controls denied ordinary Write and EnterPlanMode with no target or plan file.
  - **Swarm break and hardened candidate evidence:** upstream 2.3.2 removes model self-activation of `AgentSwarm` in fresh print. The initial 15/15 smoke with 84 assertions was rejected as vacuous: a direct OFF control returned `Swarm mode is off`, created zero child journals and no probe files, yet exited 0. The hardened candidate matrix passed 15/15 with 115 assertions and no skips. Every assigned Write/Edit `path` and `toolCallId` is correlated with its own denial or successful result; unrelated denials and coordinator-only patches do not count. Targeted read swarm passed with two child journals and managed denials; write swarm passed with two child-authored edits, a 278-byte patch, clean user tree/HEAD and removed worktree; out-of-root swarm passed with two child journals and rescue denials. Targeted OFF/ON controls prove the activation path rather than inferring it from tool-call records, aggregate denials or patches.
  - **Bounded activation, not a transport replacement:** only versions requiring it (currently exact 2.3.2) run the planned CLI as `web --no-open --host 127.0.0.1 --port 0 --log-level error`. Authenticated loopback `/meta` verifies backend v2, exact version and no dangerous auth bypass; `/config` supplies the default alias when no explicit or environment model applies. The plugin creates a session, binds model plus auto permission and `swarm_mode:true`, verifies status, shuts down and requires manual `swarm_mode.enter`. One ordinary `kimi -p -r` runner then performs the prompt; the id source is `preactivated` and the returned print session must match. `runSwarm` solely owns one bounded deactivation: normal cleanup uses remaining budget, failure recovery has a separate two-second cancellation-aware bound, and print/session failures stay primary. Post-mutation identity or process/group uncertainty blocks success and preserves diagnostics plus the write worktree. A same-PID/start-token process that changes PGID remains active and is not a validated signal target. Older versions stay on direct `kimi -p`, and MCP uses the same implementation.
  - **Additional completed checks:** offline lifecycle and process tests passed 58/58 with 284 assertions over real Node mock-web processes and loopback REST, including late-fork, changed-PGID and reparented survivors, root-continuity probes, cancellation, timeout cleanup, nonzero-print preservation and process/group recovery; engine and setup tests passed 97/97 with 1,305 assertions; focused runtime suites passed 142/142; timeout/session recovery passed 41/41; and compiled controls passed normal-survivor cleanup, late-fork uncertainty and changed-PGID uncertainty under Node. Root loss requires a previously observed matching identity; first-missing roots and actual errors/timeouts remain unverified. Reparenting and PGID moves preserve the current verified child identity for revalidation. The final production run passed 19/19 with 125 assertions in 296.67 seconds; the final full `bun run check` passed 1,268 tests with zero failures and 16,055 assertions across 78 files; package validation passed 224 files.
  - **Publication and closeout:** independent review is complete (Claude: no blockers; Codex: RESOLVED). Release CI run 40236704464 and publish run 40237085945 passed. The annotated `v2.4.1` tag and GitHub release are live; npm `latest` is 2.4.1 with 224 files and SHA-1 `77fe6daaa0f23750cc9b5d857bdbdd5107a7d4ce`, byte-identical to the CI artifact. Fresh registry and CI-artifact installs passed both host setup/checks. The process-tree teardown, single-owner cleanup, primary-error, recovery-retention and per-call evidence findings have regression coverage. Final closeout CI run 40238295139 passed. Working record: `.claude/kimi-code-research/reports/2026-10-25-2.3.2-synthesis.md` plus the later hardened-matrix and control results summarized here.