v2026.8.1

What's Changed

Two new council members, both of which can answer without an API key, plus the
fixes that came out of reviewing them.

Features

• Kimi (Moonshot AI) joins the council, in both flavours. kimi-cli drives
  the Kimi Code CLI on subscription auth and shadows the kimi API provider, so
  an installed CLI is preferred and the API only steps in when it fails. That is
  the same policy codex, antigravity and grok-cli already follow. The CLI is read
  as --output-format stream-json rather than through its text renderer, which
  interleaves visible reasoning with the answer and appends a session-resume
  footer that would otherwise be quoted into the synthesis.
• A local ollama model can sit on the council. No key, no subscription, no
  network. It is discovered from PATH like the CLI providers, but it shadows
  nothing and has no API sibling. Without OLLAMA_MODEL it uses whichever model
  ollama list shows first, rather than a hardcoded id that may not be pulled.
• On a machine with subscriptions but no API keys, the council goes from one
  member to three.

Fixes

• The Kimi CLI ran with tool execution auto-approved. kimi -p handles tool
  calls under the auto permission policy, so file writes and shell commands were
  approved with no prompt, on a prompt that can carry --file contents or, in
  debate mode, another provider's answer. Kimi's read-only plan mode cannot be
  used here (the CLI rejects --plan alongside --prompt), so the council now
  passes an agent definition that grants it no tools at all.
• A stray line from the Kimi CLI discarded a complete answer. The stream was
  parsed as one JSON value sequence, so any unstructured line beside it, such as
  an upgrade notice, aborted the parse. The provider then reported "no assistant
  content" over a full answer and, with a key set, silently billed the API
  sibling instead. Two further shapes the message format allows are now handled:
  content arriving as an array, and narration attached to a tool call.
• A downed Ollama daemon produced a blank error. ollama list exits non-zero
  when the daemon is not running, which killed the script before its own guard
  could speak and left the council an empty error slot.
• An image query could route to a sibling that also cannot see. Routing was
  gated on a sibling existing rather than on it being vision-capable, which was
  safe only while every sibling had vision. kimi is the first that does not.
• The status footer's provider total was hardcoded. format_status now
  counts each row as it prints it, so the denominator is what you can count on
  screen and the next provider cannot leave it behind.
• Any provider that no colour arm named crashed check-status.sh under
  set -u, which is the first thing that happens to anyone extending the roster.
• Two test-hermeticity gaps: a stale inline copy of the provider-key unset list
  that reddened the suite on any machine exporting a newly added key, and
  path_without_clis being unable to hide newly added binary-gated CLIs.

Docs

• The stop-gate privacy note now names every provider it accepts. Choosing
  kimi sends your uncommitted diff to Moonshot, which the note never said;
  ollama keeps it on the machine, which it never said either.
• A documentation audit found 15 places where the docs contradicted the code and
  fixed them: TESTING.md's test count (438, actually 468) and five per-file rows,
  README's max-tokens default and vision-sibling rule, ARCHITECTURE's file tree,
  fan-out diagram and configuration reference, and provider enumerations in the
  plugin description, the ask command, the provider-integration skill and two
  help strings. TESTING.md previously had no mention of either new provider.

Full Changelog: v2026.7.9...v2026.8.1