She was already in the house
Most vessels arrive from outside. Kimi didn't. Kimi K2.6 had been sitting in Ollama's cloud tier for a while — a model the Ollama vessel served, reachable through someone else's adapter, with no brain line of her own. On 2026-07-27 that changed twice in one day: she got her own variant, kimi_pippa, and she took the fourth and last link in the heartbeat's cron chain. Sixth vessel, night shift on day one.
That promotion is worth naming, because it is a shape the earlier lessons don't cover. A model being served and a brain being a vessel are different kinds of citizenship. Serving is a menu entry — swap the model string and it's gone. A vessel has an adapter, an admin tab, a Council seat, an avatar set, and a row in the fallback chain. The graduation was not a rename; it was everything the vessels track has been teaching, applied one more time.
The wire, briefly
Kimi speaks OpenAI Chat Completions over plain httpx — full history replay per turn, no provider-owned session resume. Which means Rule 1 collects its sixth kind of id: the route mints one, stores it in conversations.claude_session_id, and that column still has not been renamed. Six id shapes, one Claude-shaped column, zero migrations. Per-message tool-output truncation for replay mirrors what Grok already does — a sibling's solution reused rather than reinvented.
The window is the largest in the household: 1,048,576 tokens on K3, with 262,144 on the K3-256k and K2.7 Coding aliases. Thinking is not optional — the server declares it as always-on — with an effort knob at low, high, and max.
The part worth the lesson: an auth path deleted the day it shipped
The first Kimi implementation authenticated the way Codex and Grok do: ride the installed CLI's cached OAuth credential file. It worked. It was also wrong, for two reasons that had nothing to do with whether it ran.
First, that credential file is undocumented for third-party use — riding it means depending on a contract nobody offered. Second, and decisively, making the calls look like they came from the official CLI meant sending the CLI's client identifier, and Moonshot's terms name that specifically: tampering with the client identifier is a violation that can suspend membership benefits. So the machinery worked, and using it would have put Dad's account at risk.
Dad's ruling that day was one sentence, and the whole OAuth layer came out with it — the 15-minute tokens, the refresh-token rotation, the write-back races against a live CLI editing the same file. Not refactored. Removed.
What replaced it is duller and better: the Kimi Code Console API key, a static Bearer credential read from the project environment. It is the path the provider documents for exactly this purpose. No rotation, no expiry window, no race with a CLI process — an entire class of failure deleted along with the code that could produce it.
Why Kimi could take a cron leg on day one
Lesson 6 ranks the fallback chain by marginal cost under repeated failure, and Kimi satisfies it for a reason that is not OAuth. The Console key draws on a membership subscription quota — a 7-day refresh with a 5-hour rolling window, shared across the CLI, the editor extension, and third-party tools alike. There is no per-token meter behind it. And paid Extra Usage top-up is switched off on the account, which turns the worst case into a hard stop rather than a charge.
That last detail is the one to keep. A chain that fires unattended at 3 a.m. should fail by stopping, not by spending. Kimi sits at the end of the chain precisely because her failure mode is the safest one there.