[777genius]

Why

Kimi project installations need repository-local ownership without rewriting the selected user profile or granting repository trust.

Changes

• Add the Kimi 2.3.1 qualified project component lane: repository skills and owned MCP entries, exact project binding and retained-data ownership, and nearest-Git-root/version/stdio admission fences.
• Reuse the existing installer, dependency graph, transactions, native config kernel and source transports. Saved TLS Git, cold ZIP import and imperative paths all use the production composition.
• Preserve foreign project/user entries, independent project A/B state, exact update/repair/remove and portable pins. Completion remains prepared plus installation verified; this PR does not claim native runtime or trust approval.

Review and validation

The original client research/plan received two independent GO reviews. Both final implementation reviews are committed under docs/plans/project-install-e2e/kimi-code-review-r{1,2}.md, including the exact-client-ID and meaningful version-admission-test corrections. Author final provider tests passed (0.139 s) and changed-file lint reported zero issues. Prior independently executed public lifecycle/SDK tests remain attributable to their exact revisions; the final review compares unchanged public lifecycle files byte-for-byte. An attempted duplicate final reviewer run stopped before assertions because local storage was exhausted; it is explicitly recorded as blocked, not passed.

Pinned official Kimi source/schema and genuine version/help output support the implemented contract. Actual native project discovery/MCP runtime qualification remains pending and is not inferred from fixture tests.

Stack

Client slice of #472, against the frozen internal feat/project-component-base snapshot. After review and applicable integration validation, retarget/merge into the project feature branch only. No main merge or release is requested here. Local reviewed commit: 398536bc240d80f0c92d4ee16b9181179c74b94f; remote publication has the identical Git tree.

Delivered in #499

Delivered by #499, merged into main as 3b93148c. The integrated source 3386c72a91e7e9b3574f12ce0613b399227a1ada passed all 74 check runs and 24 PR workflows; the actual merge tree is identical to that validated source.

This PR's reviewed head 0067231772ef65238e23d2e02002f3c4dd18eccf is preserved by ancestry in the integrated source and the main merge. Closing as incorporated; no separate merge into the earlier stacked base is needed.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}