docs(kimi): README and KB parity for the Kimi provider

README gains the Kimi setup block, tech-stack row, and checklist entry
(the provider prose also finally names Codex/Gemini, which it had
skipped). The agent-facing KB's provider enum sentence catches up too -
it still called OPENAI reserved and omitted GEMINI - and gains the Kimi
runtime detail plus a config-reference section for the four Kimi
settings.

README.md

@@ -56,7 +56,7 @@ CEO (You, the human)
                    └── UX/UI Cell (6 agents: 2 Devs, 1 QA, 1 PM, 1 Documenter, 1 PR Reviewer)
 ```
 
-The 25 agents = Intake + Secretary + PR Reviewer + the Board (3) + Main PM + the three 6-agent cells (18). Agents run on Anthropic Claude by default, or on xAI Grok (the official `grok` CLI on a SuperGrok subscription) — see the provider note under Configuration.
+The 25 agents = Intake + Secretary + PR Reviewer + the Board (3) + Main PM + the three 6-agent cells (18). Agents run on Anthropic Claude by default, or on xAI Grok, OpenAI Codex, Google Gemini, or Moonshot Kimi K3 (each on its own official CLI and subscription, no metered API key) — see the provider note under Configuration.
 
 ## How it works
 
@@ -114,6 +114,8 @@ You need **Docker** + **Docker Compose** and a Claude Code auth directory on the
 
 **Optional — run agents on xAI Grok instead of Claude.** RoboCo can spawn agents on xAI's official `grok` CLI authenticated by a SuperGrok subscription (no metered API key). Run `grok login` once on the host and point `ROBOCO_HOST_GROK_DIR` at the resulting `~/.grok` so it mounts into Grok agents; the orchestrator keeps the ~6h token refreshed for you. See the Grok block in `.env.example` (`ROBOCO_HOST_GROK_DIR`, `ROBOCO_GROK_AGENT_IMAGE`, `ROBOCO_GROK_CLI_MODEL`, `ROBOCO_GROK_REASONING_EFFORT`).
 
+**Optional — run agents on Moonshot Kimi K3 instead of Claude.** RoboCo can spawn agents on Moonshot's official `kimi` (kimi-code) CLI authenticated by a Kimi subscription (OAuth device-code login, no metered API key). Run `kimi login` once on the host; `ROBOCO_HOST_KIMI_DIR` points at the resulting `~/.kimi-code` (optional — defaults sensibly) and mounts read-write, since every Kimi agent shares the host's one rotating credential chain. See the Kimi block in `.env.example` (`ROBOCO_HOST_KIMI_DIR`, `ROBOCO_KIMI_CLI_MODEL` — default `kimi-code/k3`, `kimi-code/kimi-for-coding` is the cheaper lever).
+
 ### Option 1 — Run the pre-built images (quickest)
 
 Every release publishes all RoboCo images to both the GitHub Container Registry and Docker Hub, so you can run the full stack without building anything. One command brings it up:
@@ -303,7 +305,7 @@ uv run mypy roboco/
 | RAG Engine | in-house (asyncpg + pgvector, hybrid retrieval) |
 | Embeddings | qwen3-embedding:0.6b (Ollama) |
 | Local LLM | Ollama (glm-5.2:cloud) |
-| Cloud LLM | Claude API (Anthropic) + xAI Grok (official `grok` CLI, SuperGrok subscription) + OpenAI (official `codex` CLI, ChatGPT subscription) + Google Gemini (official `gemini` CLI, OAuth login) |
+| Cloud LLM | Claude API (Anthropic) + xAI Grok (official `grok` CLI, SuperGrok subscription) + OpenAI (official `codex` CLI, ChatGPT subscription) + Google Gemini (official `gemini` CLI, OAuth login) + Moonshot Kimi K3 (official `kimi` CLI, Kimi subscription) |
 | Package Manager | uv |
 
 ## Status
@@ -320,7 +322,7 @@ uv run mypy roboco/
 - [x] RAG/Knowledge base (in-house pgvector engine)
 - [x] Agent orchestrator
 - [x] CEO approval workflow
-- [x] Pluggable agent providers (Claude Code + xAI Grok + OpenAI Codex + Google Gemini, each on its official CLI)
+- [x] Pluggable agent providers (Claude Code + xAI Grok + OpenAI Codex + Google Gemini + Moonshot Kimi K3, each on its official CLI)
 - [x] Inbound PR review (read-only PR-reviewer + CEO supersede/dismiss queue)
 - [x] Self-healing CI loop for RoboCo's own repo (default-off, CEO-gated)
 - [x] Business Goals tab with a live Company Scorecard (delivery, spend-vs-budget, lead time)

docs/rag/architecture/agent-model.md

@@ -64,7 +64,7 @@ Stored in `model_config` JSON:
 - Temperature
 - Other settings
 
-The **provider** selects the agent backend, resolved through the `ProviderRegistry` (`roboco/llm/providers/`). `ModelProvider` is `ANTHROPIC` (default — Claude Code), `GROK` (xAI's official `grok` CLI, model `grok-build`, on a SuperGrok subscription), `LOCAL`, `OLLAMA_CLOUD`, or `OPENAI` (reserved). An agent with no dedicated provider falls back to the built-in Claude Code spawn. Grok auth is the host `~/.grok` subscription mount (auto-refreshed by the orchestrator), not a metered API key.
+The **provider** selects the agent backend, resolved through the `ProviderRegistry` (`roboco/llm/providers/`). `ModelProvider` is `ANTHROPIC` (default — Claude Code), `GROK` (xAI's official `grok` CLI, model `grok-build`, on a SuperGrok subscription), `GEMINI` (Google's official `gemini` CLI, OAuth login), `OPENAI` (OpenAI's official `codex` CLI, ChatGPT subscription), `KIMI` (Moonshot's official `kimi`/kimi-code CLI, Kimi subscription via OAuth device-code login), `LOCAL`, or `OLLAMA_CLOUD`. An agent with no dedicated provider falls back to the built-in Claude Code spawn. All four run on a mounted host subscription credential rather than a metered API key; Codex, Gemini, and Kimi are one-shot delivery-role runtimes only (no Intake/Secretary), while Grok additionally drives the interactive Intake and Secretary chats. Grok's `~/.grok` is auto-refreshed by the orchestrator; Kimi's `~/.kimi-code` is mounted read-write and shared across every Kimi agent, since Moonshot's refresh token is rotation-with-short-reuse-grace and every container redeems the same rotating chain. Kimi runs headless via `-p` with stream-json output, scopes tools through rendered deny-rules plus a `PreToolUse` bash-guard wrapper hook (no CLI-flag tool-removal equivalent), captures usage by summing `wire.jsonl`'s token buckets, and parks on rate-limit (exit 75) or an expired/missing credential (exit 78) exactly like Grok/Codex/Gemini so the orchestrator can pause and later revive it.
 
 ## Agent-Specific Fields
 

docs/rag/architecture/config-reference.md

@@ -74,6 +74,17 @@ Agents whose provider is `GROK` run xAI's official `grok` CLI. Auth is the host
 | `ROBOCO_GROK_IDLE_KILL_SECONDS` | `900` | Kill + evict a Grok container that has been ACTIVE-yet-idle (no gateway verb) this long |
 | `ROBOCO_GROK_MAX_COST_USD` | `0.0` | Per-agent Grok cost ceiling (USD); `0` disables |
 
+## Kimi provider (Moonshot AI)
+
+Agents whose provider is `KIMI` run Moonshot AI's official `kimi` (kimi-code) CLI. Auth is the host Kimi subscription (OAuth device-code login via `kimi login`), not a metered API key — the credential dir is mounted read-write and shared across every Kimi agent plus the orchestrator, since Moonshot's refresh token is rotation-with-short-reuse-grace rather than truly reusable.
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `ROBOCO_HOST_KIMI_DIR` | `~/.kimi-code` | Host dir holding `credentials/`/`oauth/`, mounted read-write and shared across every Kimi agent; the CLI's own cross-process lock serializes token redemptions. Set up once with `kimi login`. |
+| `ROBOCO_KIMI_CLI_MODEL` | `kimi-code/k3` | Kimi CLI model alias; `kimi-code/kimi-for-coding` is the cheaper cost lever |
+| `ROBOCO_KIMI_RATE_LIMIT_RETRY_AFTER_SECONDS` | `60` | Park-and-retry delay after a rate-limit/quota sniff (exit 75) |
+| `ROBOCO_KIMI_AUTH_RETRY_AFTER_SECONDS` | `60` | Park-and-retry delay after a missing/expired credential (exit 78) |
+
 ## Feature flags
 
 Env-gated subsystems. Most are default-off; `ROBOCO_OVERLOAD_BREAK_ENABLED`, `ROBOCO_RESEARCH_ENABLED`, and `ROBOCO_PROVISIONING_ENABLED` ship default-**on**. Each takes effect on the next backend restart; the panel's Settings → Feature Flags card toggles the panel-exposed ones (`roboco/services/settings.py`'s `FEATURE_FLAGS`) without hand-editing env — a few security/topology flags below are env-only by design and are called out as such.