brainx · brainx · Jul 31, 2026 · Jul 29, 2026 · Jul 30, 2026 · Jul 30, 2026
diff --git a/.env.example b/.env.example
@@ -65,6 +65,9 @@ NOUS_API_KEY=
 OPENAI_API_KEY=
 ANTHROPIC_API_KEY=
 DEEPSEEK_API_KEY=
+KIMI_API_KEY=
+# Optional OpenAI-compatible Kimi K3 endpoint override.
+KIMI_BASE_URL=
 TELEGRAM_BOT_TOKEN=
 DISCORD_BOT_TOKEN=
 SLACK_BOT_TOKEN=
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Added a built-in Kimi K3 Hermes template with an optional compatible endpoint
+  override and an explicit, private `zeus audit init` Kimi K3 configuration.
 - Replaced the vulnerable cryptography and Pillow pins in the hash-locked Hermes
   Agent 0.19.0 CI environment with their first patched releases while retaining
   an exact, verified compatibility override for upstream metadata.

diff --git a/README.md b/README.md
@@ -23,7 +23,8 @@ tracks PID ownership, and exposes a small loopback CLI/API for operators.
 ## Why Zeus
 
 - Run multiple Hermes bots from one workspace without hand-copying profile directories.
-- Stamp out repeatable bot shapes from TOML templates: coding, research, support, DeepSeek, and custom profiles.
+- Stamp out repeatable bot shapes from TOML templates: coding, research,
+  support, DeepSeek, Kimi K3, and custom profiles.
 - Keep secrets out of templates by rendering per-profile `.env` files that stay ignored by git.
 - Supervise gateway processes with ownership markers before stop/status actions trust a PID.
 - Account for Hermes async delegation with explicit `max_async_children` caps in every built-in template.
@@ -58,9 +59,23 @@ It never reads dirty or untracked worktree content, and it does not edit,
 remediate, commit, push, schedule, deploy, notify, or coordinate across hosts.
 Cross-host policy remains outside Zeus.
 
-All four audit commands first discover the containing Git repository and its
+All five audit commands first discover the containing Git repository and its
 Zeus state context.
 
+### Initialize Kimi K3
+
+Select Kimi K3 for repository audits with an explicit initialization step:
+
+```bash
+zeus audit init
+```
+
+Initialization writes a private schema-v1 configuration containing provider
+`kimi-coding`, model `kimi-k3`, and the environment name `KIMI_API_KEY`. It
+stores no credential value, makes no provider request, creates no audit run,
+and refuses to replace an existing configuration. A missing configuration
+remains unconfigured until this command is run.
+
 ### Check readiness
 
 Run the non-mutating readiness preflight:
@@ -77,19 +92,11 @@ downloads nothing.
 ### Run an audit
 
 Only `audit run` requires those runtime prerequisites. Zeus never pulls the
-image. Before the first run, create private
-`$ZEUS_STATE_DIR/audit/config.json` with an explicit lowercase Hermes provider,
-model, and at least one provider-prefixed API key or authentication/access
-token. Endpoint and account metadata variables may be added alongside it:
-
-```json
-{
-  "schema_version": 1,
-  "provider": "deepseek",
-  "model": "deepseek-chat",
-  "provider_env": ["DEEPSEEK_API_KEY"]
-}
-```
+image. The `audit init` command creates the standard Kimi K3 selection at
+`$ZEUS_STATE_DIR/audit/config.json`. Operators can edit that private file to
+select another explicit lowercase Hermes provider and model or add permitted
+endpoint and account metadata environment names. For a compatible Kimi K3
+endpoint, add `KIMI_BASE_URL` alongside `KIMI_API_KEY` in `provider_env`.
 
 The state directory must be outside the worktree or ignored by `.gitignore`
 policy loaded from the exact committed `HEAD`; global excludes and
@@ -425,7 +432,31 @@ values fail bot creation without printing the value. Keep `./.env` mode `0600`;
 Zeus also writes the imported values only to the selected profile's mode-`0600`
 `.env` file.
 
-Built-in templates include OpenRouter-backed bots and `deepseek-coding-bot`, which uses Hermes' native DeepSeek provider with `DEEPSEEK_API_KEY`. Example templates also cover gateway operations, log triage, and documentation writing.
+Built-in templates include OpenRouter-backed bots, `deepseek-coding-bot`, and
+`kimi-k3-coding-bot`. The Kimi template uses Hermes provider `kimi-coding` and
+model `kimi-k3`:
+
+```bash
+zeus bot create kimi-coder \
+  --template kimi-k3-coding-bot \
+  --env-from KIMI_API_KEY
+```
+
+Without `KIMI_BASE_URL`, Hermes uses Moonshot's international Open Platform
+default at `https://api.moonshot.ai/v1`. A vendor exposing an
+OpenAI-compatible Kimi K3 endpoint with model ID `kimi-k3` can be selected
+explicitly:
+
+```bash
+zeus bot create kimi-coder \
+  --template kimi-k3-coding-bot \
+  --env-from KIMI_API_KEY \
+  --env-from KIMI_BASE_URL
+```
+
+The template does not use Kimi Code subscription credentials or its `k3`
+subscription alias. Example templates also cover gateway operations, log
+triage, and documentation writing.
 
 Each template should set a bounded async delegation cap:
 

diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
@@ -70,12 +70,14 @@ Set `ZEUS_STATE_DIR` to use a different runtime root.
 
 ## Repository Audit Boundary
 
-Repository audit is a host-local command path with four actions: doctor, run,
-list, and show. It materializes the exact committed `HEAD`, never a dirty or
-untracked worktree. `AuditService` starts before normal service construction,
-loads settings without repository `.env`, and stores only private report
-artifacts. The packaged `zeus.bundled_skills.audit` instruction is the sole
-audit skill; general skill loading remains unavailable.
+Repository audit is a host-local command path with five actions: init, doctor,
+run, list, and show. `init` explicitly selects Kimi K3 by atomically creating a
+private configuration; it does not contact a provider or create a run. The run
+path materializes the exact committed `HEAD`, never a dirty or untracked
+worktree. `AuditService` starts before normal service construction, loads
+settings without repository `.env`, and stores only private configuration and
+report artifacts. The packaged `zeus.bundled_skills.audit` instruction is the
+sole audit skill; general skill loading remains unavailable.
 
 The audit path accepts only Hermes Agent 0.19.0 and an already preloaded,
 digest-qualified Docker image. A broker seals one Docker container with network

diff --git a/docs/AUDIT.md b/docs/AUDIT.md
@@ -27,7 +27,7 @@ The first version is intentionally narrow:
 - It does not add an HTTP API, a SQLite migration, or cross-host coordination.
 - It does not audit dirty or untracked worktree content.
 - It never remediates findings and does not schedule audit runs; an operator
-  explicitly invokes one of the four local audit commands.
+  explicitly invokes one of the five local audit commands.
 
 ## Chosen Architecture
 
@@ -64,7 +64,7 @@ The implementation is divided into focused internal modules:
   artifacts.
 - `zeus.audit_doctor` verifies Git, Hermes, Docker, image, mount, network, and
   private-path prerequisites.
-- `zeus.audit` exposes a thin `AuditService` used by all four CLI actions.
+- `zeus.audit` exposes a thin `AuditService` used by all five CLI actions.
 - `zeus.bundled_skills.audit` contains the versioned `SKILL.md`.
 
 `zeus.cli` only parses and presents audit commands. It does not contain
@@ -301,6 +301,24 @@ Unknown fields and invalid types fail closed. Schema version 1 supports:
 - `limits`: bounded overrides for run duration, command duration, finding
   count, model output, report artifacts, snapshot entries, and snapshot bytes.
 
+`zeus audit init` explicitly selects the standard Kimi K3 configuration:
+
+```json
+{
+  "model": "kimi-k3",
+  "provider": "kimi-coding",
+  "provider_env": ["KIMI_API_KEY"],
+  "schema_version": 1
+}
+```
+
+Initialization discovers and revalidates the repository, enforces the same
+state-path policy as a run, and atomically creates the private configuration.
+It never replaces an existing configuration, reads or stores a credential
+value, contacts a provider, or creates an audit run. A failed initialization
+can leave newly created empty private directories, but not a partial
+configuration file.
+
 Version 1 has these hard ceilings:
 
 - one concurrent audit per repository;
@@ -331,6 +349,12 @@ selections block preflight. Every named variable must have a non-empty value at
 invocation. Model stdout and each final report artifact are individually capped
 at 1 MiB.
 
+Provider names normally derive their environment allowlist from their uppercase
+prefix. Hermes provider `kimi-coding` additionally accepts the official
+`KIMI_API_KEY` and `KIMI_BASE_URL` names. To use an OpenAI-compatible Kimi K3
+vendor endpoint, add `KIMI_BASE_URL` to `provider_env` alongside
+`KIMI_API_KEY`; the default initializer names only `KIMI_API_KEY`.
+
 The six supported categories are:
 
 1. security and trust boundaries;
@@ -342,17 +366,23 @@ The six supported categories are:
 
 ## CLI Contract
 
-Version 1 adds four local commands:
+Version 1 provides five local commands:
 
 ```text
+zeus audit init [--json]
 zeus audit doctor [--json]
 zeus audit run [--json]
 zeus audit list [--json]
 zeus audit show <run-id> [--json]
 ```
 
-All four commands discover the containing Git repository and its Zeus state
-context. `audit doctor` performs all non-model readiness checks. It reports
+All five commands discover the containing Git repository and its Zeus state
+context. `audit init` is the explicit provider-selection consent step. Human
+and JSON output identify only the provider, model, credential environment name,
+and next readiness command; they disclose neither a credential value nor a
+private absolute path.
+
+`audit doctor` performs all non-model readiness checks. It reports
 missing Docker, pinned Hermes, credential, or image prerequisites without
 creating a run or downloading dependencies.
 
@@ -535,8 +565,9 @@ The feature is additive and host-local:
 - Git repository discovery applies to every audit command. The supported Hermes
   release, Docker, configured provider credentials, and a preloaded immutable
   audit image are external runtime prerequisites for `audit run` only;
-  `audit doctor` checks readiness, while `audit list` and `audit show` do not
-  invoke those runtime checks.
+  `audit init` creates only private configuration, `audit doctor` checks
+  readiness, and `audit list` and `audit show` do not invoke those runtime
+  checks.
 - The existing generic Hermes adapter is not reused because it loads complete
   profile environments, permits generic passthrough, and buffers unbounded
   output. Audit subprocess construction has its own strict environment and

diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md
@@ -35,6 +35,10 @@ reconciliation evidence on one host.
 - Workspace-local configuration export and import that never exports secrets.
 - A local TUI for lifecycle status and reconciliation history.
 - Local plugin discovery with explicit trust and compatibility boundaries.
+- A harness-neutral Agent Client Protocol layer for startup, sessions,
+  prompt/event streaming, cancellation, inspection, permissions, and shutdown.
+  Grok Build is the proposed first adapter; this is an evaluation item, not a
+  Zeus 0.5.0 implementation commitment.
 
 ## Out of scope
 

diff --git a/docs/TEMPLATE_AUTHORING.md b/docs/TEMPLATE_AUTHORING.md
@@ -95,3 +95,41 @@ zeus bot create deepseek-coder --template deepseek-coding-bot --env DEEPSEEK_API
 ```
 
 Do not commit rendered profile `.env` files.
+
+## Kimi K3
+
+The built-in `kimi-k3-coding-bot` uses Hermes provider `kimi-coding` and model
+`kimi-k3`:
+
+```toml
+[hermes]
+required_env = ["KIMI_API_KEY", "KIMI_BASE_URL"]
+
+[hermes.model]
+provider = "kimi-coding"
+default = "kimi-k3"
+```
+
+Pass the Moonshot Open Platform key by environment name:
+
+```bash
+zeus bot create kimi-coder \
+  --template kimi-k3-coding-bot \
+  --env-from KIMI_API_KEY
+```
+
+The model configuration deliberately omits `base_url` and `api_mode`; Hermes
+uses Moonshot's international endpoint at `https://api.moonshot.ai/v1` when
+`KIMI_BASE_URL` is absent. To use a vendor that exposes an OpenAI-compatible
+Kimi K3 endpoint with model ID `kimi-k3`, supply both declared names:
+
+```bash
+zeus bot create kimi-coder \
+  --template kimi-k3-coding-bot \
+  --env-from KIMI_API_KEY \
+  --env-from KIMI_BASE_URL
+```
+
+`--env-from` keeps values out of command arguments. This template does not
+accept Kimi Code subscription credentials or substitute the subscription model
+alias `k3`.
diff --git a/scripts/repo_check.sh b/scripts/repo_check.sh
@@ -54,6 +54,7 @@ scripts/verify_real_hermes.sh
 scripts/fresh_vps_verify.sh
 templates/coding-bot.toml
 templates/deepseek-coding-bot.toml
+templates/kimi-k3-coding-bot.toml
 templates/docs-writer-bot.toml
 templates/gateway-operator.toml
 templates/log-triage-bot.toml
@@ -62,6 +63,7 @@ templates/support-gateway.toml
 zeus/bundled_templates/__init__.py
 zeus/bundled_templates/coding-bot.toml
 zeus/bundled_templates/deepseek-coding-bot.toml
+zeus/bundled_templates/kimi-k3-coding-bot.toml
 zeus/bundled_templates/docs-writer-bot.toml
 zeus/bundled_templates/gateway-operator.toml
 zeus/bundled_templates/log-triage-bot.toml

diff --git a/scripts/wheel_smoke.sh b/scripts/wheel_smoke.sh
@@ -89,6 +89,7 @@ esac
 for template_id in \
   coding-bot \
   deepseek-coding-bot \
+  kimi-k3-coding-bot \
   docs-writer-bot \
   gateway-operator \
   log-triage-bot \

diff --git a/templates/kimi-k3-coding-bot.toml b/templates/kimi-k3-coding-bot.toml
@@ -0,0 +1,38 @@
+id = "kimi-k3-coding-bot"
+name = "Kimi K3 Coding Bot"
+description = "Repository maintenance and implementation bot backed by Kimi K3 through Hermes."
+version = "0.1.0"
+soul = """
+You are a coding-focused Hermes agent backed by Kimi K3. Ground claims in files, commands, test output, and commit evidence. Prefer small, maintainable changes and call out uncertainty directly.
+"""
+
+[hermes]
+required_env = ["KIMI_API_KEY", "KIMI_BASE_URL"]
+
+[hermes.model]
+provider = "kimi-coding"
+default = "kimi-k3"
+
+[hermes.terminal]
+backend = "docker"
+cwd = "."
+home_mode = "profile"
+timeout = 300
+docker_image = "nikolaik/python-nodejs:python3.11-nodejs20@sha256:8f958bdc1b4a422bfafd97cab4f69836401f616ae985d4b57a53d254f5bcb038"
+docker_mount_cwd_to_workspace = false
+
+[hermes.gateway]
+enabled = true
+
+[hermes.delegation]
+max_iterations = 50
+max_concurrent_children = 3
+max_async_children = 3
+child_timeout_seconds = 0
+subagent_auto_approve = false
+
+[metadata]
+use_case = "Repository maintenance using Kimi K3 through Hermes"
+risk_level = "medium"
+recommended_restart_policy = "manual"
+tags = ["coding", "kimi", "kimi-k3"]