Re-plan PR #1203 (Kimi harness) against converged main: security refusal for trust pre-write, delivery-path re-derivation, plan re-approval, verified-delivery measurement #1620

Problem

PR #1203 (Mohid, "Support Kimi Code CLI as a builder", Spec/plan 1201) is complete and was reported green on 2026-08-09, then sat un-re-reviewed by maintainers for 26 days. Main moved underneath it (1,603 commits, CONFLICTING in 7 files), and three of its four core seams were rebuilt in that window. The 2026-09-04 3-way integration review (gemini APPROVE; codex + claude REQUEST_CHANGES, high confidence) found the design sound but the branch un-mergeable as-is. Owner decision 2026-09-04: maintainers execute the re-plan, building on Mohid's branch with his commits and authorship intact.

Scope (this lane)

Work on branch builder/pir-1201 (maintainerCanModify=true; gh pr checkout 1203). Never rebase or squash — merge origin/main in and add commits on top.

1. Re-derive the delivery-path integration against converged main (semantic, not mechanical):
   • Write edge: writeMessagePaced → submitMessagePaced + in-lock precheck (Serializer convergence: route mailbox write edge through submitToSession (serialize gated deliveries vs interrupt/escape) #1365/PR [PIR #1365] Serializer convergence: one lock at the terminal write edge #1492). Kimi's pacing overrides must ride the new helper.
   • Gate details: every new Kimi GateVerdict detail must be added to MailboxGateDetail and isUnverifiableVerdict (packages/sdk/src/hold-verdict.ts, F1 — Tower-vs-PTY dimension divergence causes indefinite false-busy (render gate) #1482/PR Stop suggesting 'afx interrupt' against a human who is just typing (render gate dims + held-verdict detail) #1604). Delete the local re-fork of isClassifierStuck and delegate. A stuck Kimi hold (no-region-start, multi-row-draft when its box-geometry premise drifts) must escalate, never render as "a human at the line".
   • Marker anchoring: reconcile Kimi's findMarkerRow changes with cursor-row/palette anchoring (Render gate: tighten the loose agy prompt marker (AGY_MARKER = /^> /) #1474/PR [Air #1474] Render gate: anchor the agy prompt marker to the cursor row and marker palette #1491) — use the GateProfile anchor fields rather than a parallel mechanism.
   • Drop launchLoopTail changes already on main.
2. Workspace-trust pre-write — security (verified; [Security] Committed workspace configuration can execute commands without trust or approval #1328 class): ensureKimiWorkspaceTrust must refuse (log why, let the dialog appear and the gate hold) when the worktree contains project-level MCP config (.mcp.json, .kimi-code/mcp.json). Additionally gate the pre-write behind an explicit .codev/config.json opt-in (e.g. harness.kimi.autoTrustWorkspace: true, default false) — document in the harness config docs. Test both refusals.
3. Re-measure under verified delivery (tower: delivery write edge — verify-or-retry 'delivered', settle-before-write, loud size limit (silent-loss residuals of #1564/#1521) #1573/tower: HOTFIX — echo-verify re-write loop re-injects a delivered message unboundedly (3.3.2 regression from #1573; zero re-writes after a completed write) #1584): drive a real Kimi (≥0.33.0) session through the production paced write + echo verification and record what its composer/transcript does to the header (claude markdown-eats ###; Kimi is unmeasured). If Kimi cannot be verified, its profile must be configured so deliveries land delivered-unverified loudly, never a loop. Evidence into codev/evidence/.
4. Update the plan to the shipped architecture (codev/plans/1201-*.md: mailbox task delivery, --agent-file role injection, guarded -c resume, trust record, version floor 0.33.0) → plan-approval gate. The approved artifact must describe the code.
5. Live demo re-run against the current Kimi CLI (check its latest version; the branch was measured at 0.34.0 and it ships weekly) under the dev-approval gate, with the 7 scenarios from the original review doc.
6. Keep the version floor at 0.33.0 (do not lower — unmeasured engine below it).

Out of scope (file as follow-ups, referencing #1203)

• PreToolUse write-guard parity for Kimi builders (Builder worktree write-guard: prevent writes anchored at the main checkout root #1018 class).
• codev doctor premise probe for the render-gate box-growth assumption.
• Kimi echo-verification tolerance work beyond the measurement above (tower: bound redelivery when echo verification never confirms (#1573 residual) #1578).

Acceptance

• PR Support Kimi Code CLI as a builder (PIR #1201) #1203 MERGEABLE, CI green, plan re-approved, dev-approval evidence attached, security refusals tested, all three lanes' KEY_ISSUES addressed or explicitly dispositioned in the review doc.
• Courteous PR comment on Support Kimi Code CLI as a builder (PIR #1201) #1203 summarizing exactly what changed and why, crediting Mohid's original work.

Refs: #1201 (spec), #1203 (PR), #1328 (security class), #1365, #1482, #1474, #1573, #1584, #1578.