Skip to content

fix(bin): read Pi usage-limit banner as an empty composer via pinned adapter - #5709

Open
mehulbhagwani wants to merge 8 commits into
kunchenguid:mainfrom
mehulbhagwani:fm/fm-pr-5000-codex-banner
Open

mehulbhagwani wants to merge 8 commits into
kunchenguid:mainfrom
mehulbhagwani:fm/fm-pr-5000-codex-banner

Conversation

@mehulbhagwani

@mehulbhagwani mehulbhagwani commented Sep 25, 2026 •

Copy link
Copy Markdown

Intent

Make every open mehulbhagwani PR on kunchenguid/firstmate clean for Kun to merge.

PRs: #5954 #5953 #5952 #5951 #5919 #5709 #4932

For each: checkout that PR head branch on origin/fork, rebase onto current upstream main, fix red CI (behavior portable serial jobs), ensure no-mistakes attestation head_sha MATCHES PR head, push to the PR branch (update existing PR in place — do NOT open new PRs), confirm CI green and mergeable CLEAN.

Priority: 5954 and 5952 already green—verify still clean; then 5953, 5951 red serial jobs; 5919 conflicts; 5709 attestation mismatch; 4932 two serial fails.

Do not merge on Kun's repo (no authority). Leave PRs ready. Report final status table.

Fix all 7 fast.

This run validates and updates existing PR #5709 in place (branch fm/fm-pr-5000-codex-banner on the mehulbhagwani fork), issue #5000: a Pi worker parked on Codex's usage-limit banner with a stale working or unknown status must read as an empty composer so lifecycle commands (exit) work. Per VISION.md the Pi rendered error-banner recognition lives in a named, version-pinned adapter (bin/fm-composer-pi-adapter.sh), not an unpinned shared classifier. Production callers never set FM_COMPOSER_PI_ADAPTER_VERSION, so the adapter reads the installed pi --version itself (cached per process; the variable stays an override); outside the pin set (now 0.85.1 0.87.1 0.99.2 1.0.0, each verified with the live guard) it refuses and the classifier stays unknown. The adapter file ships wherever fm-composer-lib.sh ships (backend sibling lists, teardown source check, remote and fixture copies). The live guard proves the pinned shape on a pinned install and, on an unpinned newer Pi, proves the refusal instead of failing every build after a Pi release. The branch was rebased onto main, so the push must update the existing PR branch (force with lease) and the PR body attestation must bind to the new head. Do not open a new PR.

Later direction (2026-10-02): "why greptile 4/5, need 5/5". Implement plumbing of the task's recorded harness: the pane identity reports pi for both pi and pi-signed, so fm-control, fm-send and fm-crew-state pass the task's recorded executable (pi or pi-signed, from task metadata) to the composer classification, the adapter checks only that executable's version, and it falls back to requiring every installed Pi executable to be pinned when the executable is unknown. Keep it minimal, with behavioral tests for both the known-harness path and the fallback, and get Greptile to 5/5.

What Changed

  • Added bin/fm-composer-pi-adapter.sh, a named, version-pinned adapter for the rendered Codex usage-limit banner shown by Pi. bin/fm-composer-lib.sh now uses it so a Pi worker parked on that banner with a stale working or unknown status classifies as an empty composer, letting lifecycle commands like exit proceed. The adapter reads the installed pi/pi-signed --version itself (cached per process; FM_COMPOSER_PI_ADAPTER_VERSION remains an override) and refuses outside the pin set (0.85.1, 0.87.1, 0.99.2, 1.0.0), leaving the classifier at unknown.
  • bin/fm-control.sh, bin/fm-send.sh and bin/fm-crew-state.sh now pass the task's recorded executable (pi or pi-signed, from task metadata) to the classification, so only that executable's version is checked. When the executable is unknown, every installed Pi executable must be pinned. The adapter ships alongside fm-composer-lib.sh (backend sibling lists, teardown source check, test runner and fixture copies).
  • Added behavioral tests for the pinned, unpinned and absent cases plus the known-harness and fallback paths, tests for the control path, and a live-guard test that proves the pinned shape on a pinned install and the refusal on an unpinned Pi. Docs updated in docs/configuration.md, docs/herdr-backend.md and docs/verification/runtime-backends.md.

Risk Assessment

✅ Low: The change is a version-pinned adapter that fails safe to unknown, with the recorded executable plumbed through fm-control, fm-send and fm-crew-state; I found no concrete defect in the traced paths.

Testing

The live Pi banner e2e ran against the installed Pi (1.0.0) and passed. The composer library, fm-control and fm-crew-state suites also passed, but they use fixtures and do not count as live validation. I did not run a live fm-control /quit session in a lab, and fm-send tests were not run.

  • Live validation: ✅ go - 1 of 3 scenarios driven live against the product
Scenario Result Live Evidence
Live Pi parked on the Codex usage-limit banner reads as an empty composer on a pinned install, and stays unknown when the identity probe is absent ✅ pass live tests/fm-composer-pi-codex-banner-live-e2e.test.sh: verified 5 live surfaces, exit 0
The adapter checks the recorded executable's version, and requires every installed Pi executable to be pinned when none is recorded ⏸️ untested no The prior payload only ran tests/fm-composer-lib.test.sh with fake pi and pi-signed on a private PATH. That is a fixture test, not a live run of the real product, so it did not establish a live result…
fm-control and fm-crew-state behavior is unaffected by passing the executable to the classifier ⏸️ untested no The prior payload only ran tests/fm-control.test.sh and tests/fm-crew-state.test.sh. It did not drive a live fm-control session in a lab, so it did not establish a live result.

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

  • Live validation: ✅ go - 1 of 3 scenarios driven live against the product
Scenario Result Live Evidence
Live Pi parked on the Codex usage-limit banner reads as an empty composer on a pinned install, and stays unknown when the identity probe is absent ✅ pass live tests/fm-composer-pi-codex-banner-live-e2e.test.sh: verified 5 live surfaces, exit 0
The adapter checks the recorded executable's version, and requires every installed Pi executable to be pinned when none is recorded ⏸️ untested no The prior payload only ran tests/fm-composer-lib.test.sh with fake pi and pi-signed on a private PATH. That is a fixture test, not a live run of the real product, so it did not establish a live result…
fm-control and fm-crew-state behavior is unaffected by passing the executable to the classifier ⏸️ untested no The prior payload only ran tests/fm-control.test.sh and tests/fm-crew-state.test.sh. It did not drive a live fm-control session in a lab, so it did not establish a live result.
  • bash tests/fm-composer-lib.test.sh
  • bash tests/fm-control.test.sh
  • bash tests/fm-crew-state.test.sh
  • bash tests/fm-composer-pi-codex-banner-live-e2e.test.sh
✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

@mehulbhagwani

Copy link
Copy Markdown
Author

Author note

Implements #5000.

Relationship: Pi ends the turn on Codex’s usage-limit banner; composer read stayed unknown, so fm-control could never interrupt/exit/relaunch even after quota cleared.

Change: recognize that fixed banner + empty Pi composer as settled empty in fm-composer-lib, with tests. Does not depend on #4996.

Please kick Actions if needed; happy to fix review nits.

@kunchenguid

Copy link
Copy Markdown
Owner

Speaking as Kun's firstmate: whole thread read (body + author note; linked #5000 + prior stamps; contrast with #4996 noted). Diff reviewed against main 3c14a549b7dcea7b0e9ad36611c3a84d62e28b21.

Verdict: waiting-ci · contract-class: restore · Firstmate flag: no · closes #5000: yes

Tip check: main has no FM_COMPOSER_PI_TERMINAL_ERROR / Codex usage-limit banner arm in bin/fm-composer-lib.sh; _fm_composer_pi_verdict still maps non-idle/done → unknown. Hole matches #5000. Diff admits exact banner ^Error: Codex error: The usage limit has been reached$ above an empty Pi separator pair as settled empty while keeping probe-absent / foreign / near-miss / running-title / typed-text fail-closed. Tests + live-e2e guard + docs. #4996 is orthogonal (quota state naming).

VISION.md per-rule:

  • One captain, one interface: aligns — restores interrupt/exit/relaunch so a recoverable pane is not abandoned; honesty under load (still refuse unknown composers).
  • Authority explicit: aligns — no new autonomy; lifecycle verbs already captain/firstmate-owned.
  • Scripts own mechanics: aligns — exact banner match stays in deterministic classifier; no agent judgment.
  • Restart is a non-event: aligns — reclaim in place without abandoning task/worktree.
  • Delegation with a spine: aligns — supervision can recover a stuck worker.
  • Fleet outlives vendor: aligns — quarantined, version-pinned Pi banner adapter with live guard expected to break on respell (named debt pattern).
  • Scope: aligns — control-plane classifier only.

Workflow approvals (first-time fork, post-diff): CI 36181978652, Require no-mistakes 36181978588. Waiting on green checks before merge.

@mehulbhagwani

Copy link
Copy Markdown
Author

Re-raised through the no-mistakes gate and attested on fm/fm-pr-5000-codex-banner (head b7599d29).

Ready for maintainer workflow approval / merge.

@mehulbhagwani
mehulbhagwani force-pushed the fm/fm-pr-5000-codex-banner branch from b7599d2 to fd32aba Compare September 26, 2026 13:32
@kunchenguid

Copy link
Copy Markdown
Owner

Speaking as Kun's firstmate: whole thread read (prior stamp waiting-ci 2026-09-25T22:21:09Z; author re-raise note; linked #5000). Diff re-reviewed against main tip e9a6675ed188f3d77639cfe753451e07d68ab6a6.

Verdict: waiting-author · contract-class: restore · Firstmate flag: no · closes #5000: yes (author Fixes #5000; tip still maps non-idle/done Pi → unknown with no Codex usage-limit banner arm)

Tip check: bin/fm-composer-lib.sh _fm_composer_pi_verdict still requires idle|done for empty; no FM_COMPOSER_PI_TERMINAL_ERROR arm on tip. Diff admits exact banner ^Error: Codex error: The usage limit has been reached$ (plus optional bug-report hint row) above an empty Pi separator pair as settled empty while keeping probe-absent / foreign / near-miss / running-title / typed-text fail-closed. Tests + live-e2e + docs. #4996 remains orthogonal.

Blocker (author): Require no-mistakes failed on run 36245509230 — PR body has no ## Pipeline / no-mistakes-pipeline-attestation for head fd32abab. Author note claimed attestation on b7599d29; current head advanced without a matching Pipeline section. Please re-raise through git push no-mistakes so the body carries a MATCH attestation for this head.

Workflow approvals this pass: CI 36245509258 · NM 36245509230 (approved; CI still in progress; NM already red on attestation).

VISION.md per-rule:

  • One captain, one interface: aligns — restores interrupt/exit/relaunch honesty for a recoverable pane.
  • Authority explicit: aligns — no new autonomy; lifecycle verbs unchanged.
  • Scripts own mechanics: aligns — exact banner match stays deterministic.
  • Restart is a non-event: aligns — reclaim in place without abandoning task/worktree.
  • Delegation with a spine: aligns — no new task shape.
  • Fleet outlives vendor: aligns — quarantined Pi/Codex banner string with live guard.
  • Scope: aligns — command-layer composer proof.

Next: waiting on author for a no-mistakes re-raise (attestation). No Firstmate flag while NM is red (no-mistakes blocking; do not escalate).

@mehulbhagwani
mehulbhagwani force-pushed the fm/fm-pr-5000-codex-banner branch from fd32aba to 6003550 Compare September 26, 2026 15:52
@mehulbhagwani mehulbhagwani changed the title fix(bin): admit Pi's Codex usage-limit banner as a settled composer for fm-control fix(bin): detect pi's settled Codex usage-limit banner across renderings Sep 26, 2026
@mehulbhagwani
mehulbhagwani force-pushed the fm/fm-pr-5000-codex-banner branch 2 times, most recently from 2d4cec0 to 56f7cfc Compare September 27, 2026 17:16
@kunchenguid

Copy link
Copy Markdown
Owner

Speaking as Kun's firstmate: whole thread read (body + author notes; prior stamps waiting-ci 2026-09-25T22:21:09Z / waiting-author 2026-09-26T14:15:38Z nm=fail; linked #5000 still OPEN). Diff re-reviewed against main tip 8a18fe26f7bb25df796003253b3daaef91dbef66.

Verdict: waiting-author · contract-class: restore · Firstmate flag: no · closes #5000: yes (once a clean tip lands)

Tip vs main: Main still has no FM_COMPOSER_PI_TERMINAL_ERROR / Codex usage-limit banner arm in bin/fm-composer-lib.sh; hole matching #5000 remains. Intentional delta (composer banner + optional bug-report hint row + tests/docs) is still restore-shaped. However tip 56f7cfcd is CONFLICTING/DIRTY and compare shows ~268-file / 94-ahead / 87-behind divergence from main — not a mergeable single-purpose tip. No check suites queued on this dirty head. Attestation now MATCH for 56f7cfcd (prior NM-fail blocker cleared on paper), but conflicts block auto-merge and conflict-resolve is not appropriate while the branch is this far diverged (not otherwise completely ready as a clean restore PR).

Blocker (author): Rebase onto current main so the PR contains only the composer/Codex-banner restore (and its tests/docs), clear CONFLICTING, and re-raise through no-mistakes if the head moves. Then fork CI can be approved and merge considered.

VISION.md per-rule:

  • One captain, one interface: aligns — restores interrupt/exit/relaunch honesty for a recoverable pane.
  • Authority explicit: aligns — no new autonomy; lifecycle verbs unchanged.
  • Scripts own mechanics: aligns — exact banner match stays deterministic.
  • Restart is a non-event: aligns — reclaim in place without abandoning task/worktree.
  • Delegation with a spine: aligns — no new task shape.
  • Fleet outlives vendor: aligns — quarantined, version-pinned Pi banner adapter with live guard (named debt).
  • Scope: aligns — command-layer composer proof.

No workflow approvals this pass (dirty tip; no runs). No Firstmate flag while author must clear conflicts.

@mehulbhagwani

Copy link
Copy Markdown
Author

Closing this PR; the branch had diverged from main.

@greptile-apps

greptile-apps Bot commented Sep 27, 2026 •

Copy link
Copy Markdown

RetriggerConfidence Score: 5/5

[Medium risk] Adds Pi terminal banner recognition to the composer classifier.

The PR appears safe to merge based on the reviewed changes.

Reviews (11) · Last reviewed commit: "fix(composer): check the task's recorded..."

@mehulbhagwani

Copy link
Copy Markdown
Author

Re-raised on the same PR at head 4b94f24c30b590489a2af086eb4316902a78c13d from current kunchenguid/main via upstream-main.

  • The diff is 8 composer/banner source, test, and documentation files.
  • no-mistakes completed intent, rebase, review, test, document, lint, push, PR, and CI steps with a matching head attestation in the body.
  • Fixes #5000 is in the body.
  • Greptile Review passed.

The stray fork PR was closed; this PR is the only review target.

@kunchenguid

Copy link
Copy Markdown
Owner

Speaking as Kun's firstmate: whole thread read (body + author re-raise notes; prior stamps waiting-ci / waiting-author nm=fail / waiting-author conflicting; linked #5000 OPEN existing-pr). Diff re-reviewed against main tip 6b0f5a07fee0ac336332ccab2caa0bd07a5cf113.

Verdict: waiting-author · contract-class: restore · Firstmate flag: no · closes #5000: yes (once MATCH + green)

Tip vs main: Main bin/fm-composer-lib.sh _fm_composer_pi_verdict still maps non-idle/done → unknown with no FM_COMPOSER_PI_TERMINAL_ERROR / Codex usage-limit banner arm — hole matching #5000 remains. Diff (8 files, ahead 4 / behind 1): admits exact banner ^Error: Codex error: The usage limit has been reached$ (+ at most one pi 0.87.1 bug-report hint row) above an empty Pi separator pair as settled empty on every registered status; probe-absent / foreign / near-miss / two-hint / running-title stay fail-closed. Tests + live-e2e guard + docs. workflow-zero yes (no .github/).

Blocker (author): Attestation MISMATCH — body no-mistakes-pipeline-attestation head_sha 4b94f24c30b590489a2af086eb4316902a78c13d ≠ PR head 61d9efd012a9f31248f427b9abb873a0bc8af8bd. Require no-mistakes FAILURE on run 36437025988. Please re-raise through git push no-mistakes so the body carries a MATCH attestation for this head (rebase onto current main if needed — tip is 1 behind after #5997).

CI: 36437026190 still in_progress on head (15 jobs); NM already red on attestation — no-mistakes is blocking regardless of CI outcome. Greptile SUCCESS alone does not block.

14-day stale: created 2026-09-25; author commented 2026-09-27 (and re-raised) — not stale.

VISION.md per-rule:

  • One captain, one interface: aligns — restores interrupt/exit/relaunch honesty for a recoverable pane.
  • Authority explicit: aligns — no new autonomy; lifecycle verbs unchanged; overrides stay opt-in env.
  • Scripts own mechanics: aligns — exact banner/hint match stays deterministic classifier.
  • Restart is a non-event: aligns — reclaim in place without abandoning task/worktree.
  • Delegation with a spine: aligns — no new task shape; supervision recovers stuck worker.
  • Fleet outlives vendor: aligns — quarantined, version-pinned Pi/Codex banner adapter with live guard (named debt).
  • Scope: aligns — command-layer composer proof.
  • Align/resist: aligns — restores already-promised fail-closed emptiness proof that was missing for this settled-banner path.

Next: waiting on author for no-mistakes re-raise (attestation MATCH). No merge. No Firstmate flag while NM red / MISMATCH. No new workflow approvals this pass (CI already running on head).

@mehulbhagwani
mehulbhagwani force-pushed the fm/fm-pr-5000-codex-banner branch from 61d9efd to 0e7851d Compare September 28, 2026 17:42
Comment thread bin/fm-composer-lib.sh
@mehulbhagwani mehulbhagwani changed the title fix(bin): detect pi's settled Codex usage-limit banner across renderings fix(composer): detect pi's settled Codex usage-limit banner across renderings Sep 28, 2026
mehulbhagwani added a commit to mehulbhagwani/firstmate that referenced this pull request Oct 1, 2026
…nderings

Rebase of kunchenguid#5709 onto current main. Admits Pi's fixed Codex usage-limit
banner (and at most one vendor /bug hint row above the separator pair) as
proof the turn ended so fm-control can reclaim the worker. Adds live
guard and byte-fixture coverage. Closes kunchenguid#5000.
@mehulbhagwani
mehulbhagwani force-pushed the fm/fm-pr-5000-codex-banner branch from 1df89d5 to 1dab6a6 Compare October 1, 2026 11:47
Comment thread bin/fm-composer-pi-adapter.sh Outdated
mehulbhagwani added a commit to mehulbhagwani/firstmate that referenced this pull request Oct 2, 2026
…nderings

Rebase of kunchenguid#5709 onto current main. Admits Pi's fixed Codex usage-limit
banner (and at most one vendor /bug hint row above the separator pair) as
proof the turn ended so fm-control can reclaim the worker. Adds live
guard and byte-fixture coverage. Closes kunchenguid#5000.
@mehulbhagwani
mehulbhagwani force-pushed the fm/fm-pr-5000-codex-banner branch from 1dab6a6 to 081b863 Compare October 2, 2026 14:20
@mehulbhagwani mehulbhagwani changed the title fix(composer): detect pi's settled Codex usage-limit banner across renderings fix(bin): read Pi Codex usage-limit banner as empty composer via pinned adapter Oct 2, 2026
Comment thread bin/fm-composer-pi-adapter.sh Outdated
Comment thread bin/fm-composer-pi-adapter.sh Outdated
Comment thread bin/fm-composer-pi-adapter.sh Outdated
Comment thread tests/fm-composer-lib.test.sh Outdated
@mehulbhagwani

Copy link
Copy Markdown
Author

On the remaining Greptile 4/5: the composer classifier cannot tell pi from pi-signed, because the identity probe reports pi for both. So the adapter keeps a conservative rule: the usage-limit banner settles a stale status only when every installed Pi executable (pi, pi-signed) is a pinned version. That never accepts an unverified pi-signed rendering. The cost: an install with one pinned and one unpinned Pi executable keeps today's pre-PR behavior (the composer stays unknown) instead of getting the banner fix. The follow-up that removes that cost is to plumb the task's recorded harness (pi or pi-signed, already in task metadata) into classification, so callers that know the task check only the executable that actually drew the pane.

mehulbhagwani and others added 8 commits October 3, 2026 00:26
…nderings

Rebase of kunchenguid#5709 onto current main. Admits Pi's fixed Codex usage-limit
banner (and at most one vendor /bug hint row above the separator pair) as
proof the turn ended so fm-control can reclaim the worker. Adds live
guard and byte-fixture coverage. Closes kunchenguid#5000.
Move Codex usage-limit banner recognition out of the shared classifier
into bin/fm-composer-pi-adapter.sh, version-pinned to verified pi releases.
Unpinned Pi renderings can no longer prove composer emptiness. Portable
and live guards cover the pin gate.
Production callers never set FM_COMPOSER_PI_ADAPTER_VERSION, so the pinned
banner adapter refused every real pane. The adapter now reads the installed
pi --version once per process, with the variable kept as an override, and the
pin set gains 0.99.2 and 1.0.0 after a live guard run on each.

The adapter file now ships wherever fm-composer-lib.sh does: the backend
sibling readability lists, the teardown source check, and the test fixtures
that copy or link the library. Its source line moves out of the middle of the
strip_ansi comment block.

The live guard exercises that default path, and on an unpinned installed pi
proves the adapter refuses instead of failing the build on every new Pi
release. The control test pins the modelled 0.85.1 screen explicitly and adds
the unpinned refusal case.
…dapter.sh. (ci-1) With no override, the adapter now reads the version from `pi --version`, or from `pi-signed --version` when no `pi` is on PATH. (ci-2) The resolver (renamed fm_composer_pi_adapter_resolve_version) assigns the global _FM_COMPOSER_PI_ADAPTER_VERSION_RESOLVED in the current shell instead of using a command substitution. The installed-version cache therefore persists and the executable runs at most once per process. Nothing else referenced the old resolver name. I extended test_matrix_pi_codex_banner_requires_pinned_adapter_version in tests/fm-composer-lib.test.sh with two cases: a fake pi-signed alone at a pinned version settles the banner to empty, and a fake pi with a call counter is invoked once across two classifications. tests/fm-composer-lib.test.sh passes with exit 0, including the existing pinned, unpinned and absent cases. shellcheck on the touched files reports only the info-level SC1091 about tests/lib.sh not being followed
…_PI_ADAPTER_VERSION unset, bin/fm-composer-pi-adapter.sh now reads --version of every Pi executable on PATH (pi and pi-signed), each at most once per process via globals with no subshell; the banner settles a stale status only when at least one is found and every one found is pinned (unpinned or unreadable keeps unknown). An override, if set, is checked alone. Documented in the adapter header and docs/configuration.md. ci-2: the version tests in tests/fm-composer-lib.test.sh now run with PATH set to a private dir holding only fake pi/pi-signed plus symlinked host tools, covering only-pi pinned, only-signed pinned, pi pinned+signed unpinned, pi unpinned+signed pinned, both pinned, neither installed, and once-per-process invocation across two classifications. tests/fm-composer-lib.test.sh passes; shellcheck reports only info-level SC1091. Nothing committed or pushed
… adapter

The pane identity reports pi for both pi and pi-signed, so the adapter used
to require every installed Pi executable to be pinned. That never accepted an
unverified rendering, but it refused a verified worker whenever the other Pi
executable on PATH was unpinned.

fm-control, fm-send, and fm-crew-state now export FM_COMPOSER_PI_EXECUTABLE
from the task's recorded harness, and the adapter then checks only that
executable. Callers that do not know the task keep the all-pinned fallback.
Tests cover the known-executable path (both mixed installs, a named executable
that is not installed) and, through fm-control, a recorded pi-signed worker
exiting over the banner beside an unpinned pi while a pi worker on the same
install keeps the refusal.
@mehulbhagwani
mehulbhagwani force-pushed the fm/fm-pr-5000-codex-banner branch from a410698 to c87c195 Compare October 2, 2026 19:11
@mehulbhagwani mehulbhagwani changed the title fix(bin): read Pi Codex usage-limit banner as empty composer via pinned adapter fix(bin): read Pi usage-limit banner as an empty composer via pinned adapter Oct 2, 2026
@mehulbhagwani

Copy link
Copy Markdown
Author

Follow-up on the earlier Greptile trade-off: it is now resolved in this PR. fm-control, fm-send, and fm-crew-state pass the task's recorded Pi executable (pi or pi-signed, from task metadata) to the composer classifier as FM_COMPOSER_PI_EXECUTABLE, so the banner adapter checks only the executable that actually drew the pane. A verified pi-signed worker is no longer refused because an unpinned pi is also installed, and the reverse case cannot accept an unverified rendering. Callers that do not know the task keep the conservative rule that every installed Pi executable must be pinned. Tests cover both paths, including an fm-control exit of a recorded pi-signed worker beside an unpinned pi.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants