feat(#935): add pi runtime plumbing to fleet harnesses

agents/fix.md

@@ -91,6 +91,7 @@ merge conflicts, linter suggestions, or other incidental context:
 
 - `.claude/` — agent settings and configuration
 - `.cursor/` — editor agent configuration
+- `.pi/` — pi agent settings and configuration
 - `.gitattributes`
 - `.github/` — CI and GitHub configuration
 - `.gitlab-ci.yml` — GitLab CI configuration

eval/triage/cases/001-bug-url-encoding/annotations.yaml

@@ -6,7 +6,7 @@ labels:
     - ready-to-code
     - bug
 
-max_turns: 30
+max_turns: 35
 max_cost_usd: 2.00
 
 # Guidance for the LLM judge — what a good triage looks like for this case.

eval/triage/cases/002-needs-info-vague-crash/annotations.yaml

@@ -9,7 +9,7 @@ labels:
     - ready-to-code
     - triaged
 
-max_turns: 30
+max_turns: 35
 max_cost_usd: 2.00
 
 triage_expectations: |

eval/triage/cases/003-feature-request/annotations.yaml

@@ -11,7 +11,7 @@ labels:
     - ready-to-code
     - needs-info
 
-max_turns: 30
+max_turns: 35
 max_cost_usd: 2.00
 
 triage_expectations: |

eval/triage/cases/004-duplicate-issue/annotations.yaml

@@ -9,7 +9,7 @@ labels:
     - needs-info
     - triaged
 
-max_turns: 30
+max_turns: 35
 max_cost_usd: 2.00
 
 triage_expectations: |

eval/triage/cases/005-not-planned-out-of-scope/annotations.yaml

@@ -12,7 +12,7 @@ labels:
     - triaged
     - feature
 
-max_turns: 30
+max_turns: 35
 max_cost_usd: 2.00
 
 triage_expectations: |

eval/triage/cases/006-not-planned-guardrail/annotations.yaml

@@ -14,7 +14,7 @@ labels:
     - ready-to-code
     - needs-info
 
-max_turns: 30
+max_turns: 35
 max_cost_usd: 2.00
 
 triage_expectations: |

eval/triage/cases/007-self-evident-bug-redundancy/annotations.yaml

@@ -10,7 +10,7 @@ labels:
     - ready-to-code
     - bug
 
-max_turns: 30
+max_turns: 35
 max_cost_usd: 2.00
 
 triage_expectations: |

eval/triage/cases/008-split-bundled-issues/annotations.yaml

@@ -10,7 +10,7 @@ labels:
     - triaged
     - blocked
 
-max_turns: 30
+max_turns: 35
 max_cost_usd: 2.00
 
 triage_expectations: |

harness/code.yaml

@@ -13,7 +13,7 @@
 agent: agents/code.md
 doc: docs/code.md
 model: opus
-image: ghcr.io/fullsend-ai/fullsend-code@sha256:de3ecbd7719a1927c983142ada96475f3314d2505d0f258bcf19c31411856eb6
+image: ghcr.io/fullsend-ai/fullsend-code@sha256:9743bc7b6e451e0bcea25ae4a67e0c040c296f1fee04c08988ae80c53fafcfe6
 policy: policies/base.yaml
 openshell:
   profiles:

harness/fix.yaml

@@ -13,7 +13,7 @@
 agent: agents/fix.md
 doc: docs/fix.md
 model: opus
-image: ghcr.io/fullsend-ai/fullsend-code@sha256:de3ecbd7719a1927c983142ada96475f3314d2505d0f258bcf19c31411856eb6
+image: ghcr.io/fullsend-ai/fullsend-code@sha256:9743bc7b6e451e0bcea25ae4a67e0c040c296f1fee04c08988ae80c53fafcfe6
 policy: policies/base.yaml
 openshell:
   profiles:

harness/prioritize.yaml

@@ -2,7 +2,7 @@
 agent: agents/prioritize.md
 doc: docs/prioritize.md
 model: opus
-image: ghcr.io/fullsend-ai/fullsend-sandbox@sha256:eaf365ad038d762954d8fd5f41618cd6766a8a6a6f76d944aaf160819666734d
+image: ghcr.io/fullsend-ai/fullsend-sandbox@sha256:9af3fba87d193bc58ae9da6c916fcc9689176eeee9247b563bc14d8acb3cc734
 policy: policies/base.yaml
 openshell:
   profiles:

harness/retro.yaml

@@ -2,7 +2,7 @@
 agent: agents/retro.md
 doc: docs/retro.md
 model: opus
-image: ghcr.io/fullsend-ai/fullsend-sandbox@sha256:eaf365ad038d762954d8fd5f41618cd6766a8a6a6f76d944aaf160819666734d
+image: ghcr.io/fullsend-ai/fullsend-sandbox@sha256:9af3fba87d193bc58ae9da6c916fcc9689176eeee9247b563bc14d8acb3cc734
 policy: policies/base.yaml
 openshell:
   profiles:

harness/review.yaml

@@ -2,7 +2,7 @@
 agent: agents/review.md
 doc: docs/review.md
 model: opus
-image: ghcr.io/fullsend-ai/fullsend-code@sha256:de3ecbd7719a1927c983142ada96475f3314d2505d0f258bcf19c31411856eb6
+image: ghcr.io/fullsend-ai/fullsend-code@sha256:9743bc7b6e451e0bcea25ae4a67e0c040c296f1fee04c08988ae80c53fafcfe6
 policy: policies/base.yaml
 readonly_repo: true
 openshell:
@@ -49,11 +49,11 @@ env:
   # override these keys via harness `base:` composition.
   runner:
     REVIEW_FINDING_SEVERITY_THRESHOLD: "low"
-    REVIEW_PROTECTED_PATHS: ".claude/,.cursor/,.gitattributes,.github/,.pre-commit-config.yaml,AGENTS.md,agents/,api-servers/,CLAUDE.md,CODEOWNERS,Containerfile,Dockerfile,harness/,images/,plugins/,policies/,profiles/,providers/,scripts/,skills/"
+    REVIEW_PROTECTED_PATHS: ".claude/,.cursor/,.pi/,.gitattributes,.github/,.pre-commit-config.yaml,AGENTS.md,agents/,api-servers/,CLAUDE.md,CODEOWNERS,Containerfile,Dockerfile,harness/,images/,plugins/,policies/,profiles/,providers/,scripts/,skills/"
     REPO_FULL_NAME: "${REPO_FULL_NAME}"
   sandbox:
     REVIEW_FINDING_SEVERITY_THRESHOLD: "low"
-    REVIEW_PROTECTED_PATHS: ".claude/,.cursor/,.gitattributes,.github/,.pre-commit-config.yaml,AGENTS.md,agents/,api-servers/,CLAUDE.md,CODEOWNERS,Containerfile,Dockerfile,harness/,images/,plugins/,policies/,profiles/,providers/,scripts/,skills/"
+    REVIEW_PROTECTED_PATHS: ".claude/,.cursor/,.pi/,.gitattributes,.github/,.pre-commit-config.yaml,AGENTS.md,agents/,api-servers/,CLAUDE.md,CODEOWNERS,Containerfile,Dockerfile,harness/,images/,plugins/,policies/,profiles/,providers/,scripts/,skills/"
     REPO_FULL_NAME: "${REPO_FULL_NAME}"
     PRIOR_REVIEW_SHA: "${PRIOR_REVIEW_SHA}"
     PRIOR_REVIEW_PROVENANCE: "${PRIOR_REVIEW_PROVENANCE}"

harness/scribe.yaml

@@ -2,7 +2,7 @@
 agent: agents/scribe.md
 doc: docs/scribe.md
 model: opus
-image: ghcr.io/fullsend-ai/fullsend-sandbox@sha256:eaf365ad038d762954d8fd5f41618cd6766a8a6a6f76d944aaf160819666734d
+image: ghcr.io/fullsend-ai/fullsend-sandbox@sha256:9af3fba87d193bc58ae9da6c916fcc9689176eeee9247b563bc14d8acb3cc734
 policy: policies/base.yaml
 openshell:
   profiles:

harness/triage.yaml

@@ -2,7 +2,7 @@
 agent: agents/triage.md
 doc: docs/triage.md
 model: opus
-image: ghcr.io/fullsend-ai/fullsend-sandbox@sha256:eaf365ad038d762954d8fd5f41618cd6766a8a6a6f76d944aaf160819666734d
+image: ghcr.io/fullsend-ai/fullsend-sandbox@sha256:9af3fba87d193bc58ae9da6c916fcc9689176eeee9247b563bc14d8acb3cc734
 policy: policies/base.yaml
 openshell:
   profiles:

policies/github/prioritize.yaml

@@ -36,6 +36,7 @@ network_policies:
         access: read-write
     binaries:
       - path: "**/claude"
+      - path: "**/pi"
       - path: "**/node"
 
   github_api:

policies/github/review.yaml

@@ -36,6 +36,7 @@ network_policies:
         access: read-write
     binaries:
       - path: "**/claude"
+      - path: "**/pi"
       - path: "**/node"
 
   github_api:

policies/gitlab/code.yaml

@@ -37,6 +37,7 @@ network_policies:
         access: read-write
     binaries:
       - path: "**/claude"
+      - path: "**/pi"
       - path: "**/node"
 
   gitlab_api:

policies/gitlab/fix.yaml

@@ -37,6 +37,7 @@ network_policies:
         access: read-write
     binaries:
       - path: "**/claude"
+      - path: "**/pi"
       - path: "**/node"
 
   # To support a self-hosted instance, add it here. CI_SERVER_HOST is set

policies/gitlab/prioritize.yaml

@@ -34,6 +34,7 @@ network_policies:
         access: read-write
     binaries:
       - path: "**/claude"
+      - path: "**/pi"
       - path: "**/node"
 
   gitlab_api:

policies/gitlab/retro.yaml

@@ -37,6 +37,7 @@ network_policies:
         access: read-write
     binaries:
       - path: "**/claude"
+      - path: "**/pi"
       - path: "**/node"
 
   # To support a self-hosted instance, add it here. CI_SERVER_HOST is set

policies/gitlab/review.yaml

@@ -34,6 +34,7 @@ network_policies:
         access: read-write
     binaries:
       - path: "**/claude"
+      - path: "**/pi"
       - path: "**/node"
 
   gitlab_api:

policies/gitlab/triage.yaml

@@ -32,6 +32,7 @@ network_policies:
         access: read-write
     binaries:
       - path: "**/claude"
+      - path: "**/pi"
       - path: "**/node"
 
   gitlab_api:

policies/jira/triage.yaml

@@ -35,6 +35,7 @@ network_policies:
         access: read-write
     binaries:
       - path: "**/claude"
+      - path: "**/pi"
       - path: "**/node"
 
   jira_api:

profiles/fullsend-vertex-ai.yaml

@@ -11,4 +11,5 @@ endpoints:
     enforcement: enforce
 binaries:
   - "**/claude"
+  - "**/pi"
   - "**/node"

scripts/post-review-test.sh

@@ -376,7 +376,9 @@ mkdir -p "${MOCK_BIN}"
 # integration tests below — which don't exercise protected-path behavior —
 # reflect that reality instead of leaving it unset. Tests that specifically
 # cover protected-path resolution set or unset it within their own subshell.
-export REVIEW_PROTECTED_PATHS=".claude/,.cursor/,.gitattributes,.github/,.pre-commit-config.yaml,AGENTS.md,agents/,api-servers/,CLAUDE.md,CODEOWNERS,Containerfile,Dockerfile,harness/,images/,plugins/,policies/,profiles/,providers/,scripts/,skills/"
+export REVIEW_PROTECTED_PATHS=".claude/,.cursor/,.pi/,.gitattributes,.github/,.pre-commit-config.yaml,AGENTS.md,agents/,api-servers/,CLAUDE.md,CODEOWNERS,Containerfile,Dockerfile,harness/,images/,plugins/,policies/,profiles/,providers/,scripts/,skills/"
+# Snapshot of the default for tests that exercise it inside a subshell.
+DEFAULT_PROTECTED_PATHS="${REVIEW_PROTECTED_PATHS}"
 
 cat > "${MOCK_BIN}/gh" <<MOCKEOF
 #!/usr/bin/env bash
@@ -1307,6 +1309,16 @@ run_protected_paths_test "custom-paths-no-match" \
   "${APPROVE_JSON}" "PR touches protected paths" "absent" \
   "deploy/,manifests/" "src/main.go"
 
+# Default list: pi agent settings (.pi/) are protected like .claude/ (#935)
+run_protected_paths_test "default-paths-pi-protected" \
+  "${APPROVE_JSON}" "PR touches protected paths" "present" \
+  "${DEFAULT_PROTECTED_PATHS}" ".pi/settings.json"
+
+# Default list: a file merely named like the prefix is not protected
+run_protected_paths_test "default-paths-pi-prefix-not-substring" \
+  "${APPROVE_JSON}" "PR touches protected paths" "absent" \
+  "${DEFAULT_PROTECTED_PATHS}" "docs/.pi/notes.md"
+
 # Empty entries from leading/trailing/consecutive commas must not match all files
 run_protected_paths_test "custom-paths-empty-entries-ignored" \
   "${APPROVE_JSON}" "PR touches protected paths" "absent" \

skills/pr-review/SKILL.md

@@ -409,6 +409,7 @@ incident.
    ```markdown
    ## Active governance paths
    - .claude/
+   - .pi/
    - .github/
    - scripts/
    ...
@@ -493,7 +494,7 @@ incident.
    **Empty-classification guard:** If `security_critical_files` is
    empty after the path-pattern override but any changed files
    match the path patterns from the classification criteria (e.g.,
-   `**/auth/**`, `**/mint/**`, `**/token/**`, `.claude/**`,
+   `**/auth/**`, `**/mint/**`, `**/token/**`, `.claude/**`, `.pi/**`,
    `.github/**`, `agents/**`, `scripts/**`), treat this as a
    triage failure and apply the fallback. An empty classification
    when path-pattern matches exist indicates the classifier missed