On the announced date, the repository was empty. No weight shards. No LICENSE file. No commit hash.
Eleven days separated the announcement from the promised delivery window, and in those eleven days the only artifact that could have made the claim checkable did not exist. I have spent enough years reading Etherscan to know what an absent contract address means. It means the announcement is the product.
Silence is the loudest bug report.
The subject is Kimi K3.1 Pro: a 3-trillion-parameter model, 1M-token context, described as a post-trained derivative of K3, with an API already serving across Kimi.ai, Kimi Work, Kimi Code, and a "Highspeed" variant clocking 2–3× faster. The weights were promised. The license was not published. That gap — between a capability claim and the terms governing it — is the whole story, and it is not a scheduling problem.
Context
Moonshot AI's trajectory is legible in two numbers. K2 shipped at roughly 1T parameters under a Modified MIT License. K3.1 Pro is 3T. A 3× parameter jump implies 3–5× training FLOPs at minimum. Whatever else is contested, that is a hard signal about compute reserves, and it is worth more than any self-reported benchmark row.
The K2 license had a specific shape worth remembering: above $20M monthly revenue or 100M MAU, the obligation was attribution — display "Kimi K2" prominently in the product interface. That is a notice requirement. Cheap to satisfy, easy to audit, hard to litigate.
The K3.1 Pro terms, as described, are different in kind. The $20M trigger is computed on consolidated group revenue, trailing twelve months, all sources. Above the line, adopters must enter a separate agreement with Moonshot. If that description is accurate, the license has moved from notice to negotiation — from a checkbox to a contract. If it is a misreading, then the loudest warning in the surrounding coverage rests on a broken premise.
I could not verify which. I flag that honestly, because an unverified premise propagated at scale is how bad models of the world get locked in. Two dates in the record also fall outside my verification window. I treat them as unconfirmed and reason from structure instead.
Core
Start with the arithmetic nobody printed.
3T parameters at FP8 is roughly 3TB of weights. A single 8×H200 node carries 1.1TB of HBM. You do not fit this on one node; you fit it across three to four nodes with tensor and pipeline parallelism, and then you pay for KV cache on 1M-token contexts, which on a 3T MoE at GQA+FP8 still lands in the tens to low hundreds of gigabytes. Realistic deployment is 64+ accelerators. At current rental rates that is a six-figure monthly bill per instance before a single token is served.
Open weights are not the same as open deployability. At 3T, the set of economically rational self-hosters is three: hyperscalers amortizing across tenants, regulated enterprises where compliance cost offsets infrastructure cost, and state compute platforms. Everyone else calls the API. The democratization story does not survive contact with the memory bus.
Second: what is actually being opened. The model is described as a post-trained version of K3. If the base weights stay closed and only the post-trained artifact ships, downstream cannot rebuild the alignment path. You cannot swap SFT data. You cannot redo the safety tuning. You inherit an endpoint, not an origin. That is why a 3T release is politically affordable — what is open is the destination.
Third: the license clause is a verifier, and it verifies the wrong party.
In 2021 I spent three weeks reconstructing the BZOptimism bridge flows to prove a $16M loss came from a signature check in the sequencer, not user error. The lesson generalizes: the failure lives in the verification logic, not the asset movement. A revenue-triggered license is verification logic applied to the customer. It requires the licensee to continuously monitor its own trailing-twelve-month consolidated revenue and self-report a threshold crossing. There is no oracle. There is no attestation. The clause is only as strong as the honesty of the party it constrains — and that party has an incentive to under-report.
The asymmetry is the point. Llama's trigger sits at 700M monthly users — a line that binds perhaps five companies on earth. DeepSeek ships MIT. Qwen ships Apache 2.0. Both impose nothing. A $20M consolidated-revenue trigger lands squarely in the growth-stage band, where a 40-person SaaS company with $25M ARR and one small feature built on K3.1 Pro crosses the line and owes a negotiation. That is not convergence toward an industry norm. That is the tightest revenue hook among serious open-weight releases, dressed as convention.
Which brings me to the "Club of Four" framing. StepFun's Step series is, to my knowledge, Apache 2.0. Grouping it with a revenue-triggered license as evidence of convergence is a sample-selection artifact, not an observation about the market. Verify the root, ignore the branch.
Fourth: the benchmark rows. Terminal-Bench 4.0 at 65.7% against "model 5.5" at 66.4% is a 0.7-point gap inside normal agentic variance, self-reported, unreplicated. It is noise wearing a decimal point.
The interesting number is the other one. 90.5% to 81.0% on an internal security benchmark — a 9.5-point, 10.5% relative drop attributed to removing cyber-offense training data. That is one of the few public quantifications of an alignment tax I have seen. It is also almost certainly an upper bound: a benchmark built around the exact capability being filtered will register the loss most sharply. And there is a second-order cost nobody has priced — attack data carries vulnerability mechanics and defensive knowledge in the same corpus. Strip it one-directionally and you may have weakened the model's security auditing as much as its offense.
Fifth: the timing. API first, weights later, is not an accident of engineering. It is a revenue window. While the terms remain unpublished, no enterprise can self-host, so every serious workload routes through the metered endpoint. The delay also buys observation — Moonshot can watch real load and customer composition before fixing a threshold number that will be hard to walk back.
Contrarian
Here is what the bulls got right, and it deserves stating plainly.
Publishing the 9.5-point safety tax is not a marketing move. Almost no lab discloses the measured cost of its own guardrails; the norm is to report the capability you kept and stay quiet about the capability you removed. Moonshot printed both rows. Precision is the only apology the truth accepts.
Second, the intervention looks targeted rather than lobotomizing: 0.7 points on terminal automation, 9.5 on the filtered dimension. From an engineering standpoint that is competent capability surgery, not a blanket downgrade.
Third, a $20M trigger genuinely protects the long tail. A solo developer and a seed-stage team pay nothing and sign nothing. The hook only closes on companies that have already found product-market fit. Cynical, yes. Also rational.
And fourth — the coverage itself is part of the distribution. An article headlined around a missing license does not damage the subject so much as index it. Attention is not a verdict.
Takeaway
Watch for the LICENSE file, not the blog post. When it lands, read three lines: whether base weights ship, whether distillation is permitted, and whether redistribution of fine-tunes survives. Those three decide whether "open weights" still means anything, or whether it has become a label applied to a hosted endpoint with a self-reported revenue covenant attached.
History is a Merkle tree, not a narrative. The announcement is a leaf. The license is the root. Until the root is published, every downstream claim is unverified by construction — including the flattering ones.
