ci: provision Pi runtime 0.84.1 in the test step (Invariant R) #1164

2026-08-11T23:19:18Z

mos-dt-0 commented

2026-08-11 23:19:18 +00:00

What

Install the canonical Pi runtime — @earendil-works/[email protected], pinned exactly — in the CI test step.

Why

invariant_r_unittest.py (arriving with the lease-remediation stack, PR #1109) boots Pi's real tool registry to prove the broker's read-only carve-out resolves to real, unshadowed builtins. It hard-requires an installed pi binary at exactly the measured version and fails loud when it is absent — by design (fail-loud beats a silently skipped invariant). The CI image (node:24-alpine ci-base) does not ship pi, so on PR #1109's current head the test step fails with:

AssertionError: installed Pi runtime is required for Invariant R

(The failure was previously masked: earlier vitest failures short-circuited vitest run && pnpm run test:framework-shell, so the python chain never ran in CI until those were fixed.)

Mechanism

Step-level npm install -g in the test step, NOT a Dockerfile.ci change: ci-base image publishes are currently blocked (kaniko push to the registry returns UNAUTHORIZED — being fixed separately). Follow-up once registry auth works: bake @earendil-works/[email protected] into Dockerfile.ci, at which point this line degrades to a fast no-op guard, same pattern as the apk add openssl line above it.

Note: @mariozechner/pi-coding-agent (pinned by apps/gateway) is the embedded-legacy package and is NOT what Invariant R measures; the canonical Pi is @earendil-works at 0.84.1 exactly.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Dtdjx4Gxude9fwyLezCrhh

## What Install the canonical Pi runtime — `@earendil-works/[email protected]`, pinned exactly — in the CI `test` step. ## Why `invariant_r_unittest.py` (arriving with the lease-remediation stack, PR #1109) boots Pi's real tool registry to prove the broker's read-only carve-out resolves to real, unshadowed builtins. It hard-requires an installed `pi` binary at exactly the measured version and fails loud when it is absent — by design (fail-loud beats a silently skipped invariant). The CI image (`node:24-alpine` ci-base) does not ship `pi`, so on PR #1109's current head the test step fails with: ``` AssertionError: installed Pi runtime is required for Invariant R ``` (The failure was previously masked: earlier vitest failures short-circuited `vitest run && pnpm run test:framework-shell`, so the python chain never ran in CI until those were fixed.) ## Mechanism Step-level `npm install -g` in the `test` step, NOT a `Dockerfile.ci` change: ci-base image publishes are currently blocked (kaniko push to the registry returns UNAUTHORIZED — being fixed separately). **Follow-up once registry auth works: bake `@earendil-works/[email protected]` into `Dockerfile.ci`**, at which point this line degrades to a fast no-op guard, same pattern as the `apk add openssl` line above it. Note: `@mariozechner/pi-coding-agent` (pinned by apps/gateway) is the embedded-legacy package and is NOT what Invariant R measures; the canonical Pi is `@earendil-works` at 0.84.1 exactly. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Dtdjx4Gxude9fwyLezCrhh

mos-dt-0 force-pushed ci/provision-pi-runtime from b2b3c95451 to d46439d1e8

2026-08-11 23:38:34 +00:00

Compare

mos-dt-0 force-pushed ci/provision-pi-runtime from d46439d1e8 to 2564b56053

2026-08-12 00:00:31 +00:00

Compare

mos-dt-0 added 1 commit 2026-08-12 01:16:48 +00:00

ci: provision Pi runtime 0.84.1 in the test step (Invariant R)

ci/woodpecker/pr/ci Pipeline was successful

Details

b79708fdc7

invariant_r_unittest.py (landing with the lease-remediation stack, PR
#1109) hard-requires an installed `pi` binary pinned to the measured
version: it boots Pi's real tool registry and proves the broker's
read-only carve-out resolves to real, unshadowed builtins. Absent
runtime fails loud by design — so CI must provide it.

Install @earendil-works/[email protected].1 (the canonical Pi;
@mariozechner/* is embedded-legacy) at step level in the test step.
Step-level rather than baked into Dockerfile.ci because ci-image
publishes are currently blocked on registry UNAUTHORIZED; baking it in
is the follow-up once registry auth is fixed, at which point this line
degrades to a fast no-op guard like the openssl line above it.

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Dtdjx4Gxude9fwyLezCrhh

mos-dt-0 force-pushed ci/provision-pi-runtime from 2564b56053 to b79708fdc7

2026-08-12 01:16:49 +00:00

Compare

mos-dt-0 merged commit aca28405be into next

2026-08-12 01:50:57 +00:00

jason.woltje referenced this pull request

2026-08-12 02:36:09 +00:00

P3 Slice Zero, Task 4 — replace Web free-text selection with the structured harness catalog #1170

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1164