ci: provision Pi runtime 0.84.1 in the test step (Invariant R) #1164

Merged

mos-dt-0 merged 1 commits from ci/provision-pi-runtime into next

2026-08-12 01:50:57 +00:00

Author	SHA1	Message	Date
Jason WoltjeandClaude Fable 5	b79708fdc7	ci: provision Pi runtime 0.84.1 in the test step (Invariant R) ci/woodpecker/pr/ci Pipeline was successful Details invariant_r_unittest.py (landing with the lease-remediation stack, PR #1109) hard-requires an installed `pi` binary pinned to the measured version: it boots Pi's real tool registry and proves the broker's read-only carve-out resolves to real, unshadowed builtins. Absent runtime fails loud by design — so CI must provide it. Install @earendil-works/[email protected].1 (the canonical Pi; @mariozechner/* is embedded-legacy) at step level in the test step. Step-level rather than baked into Dockerfile.ci because ci-image publishes are currently blocked on registry UNAUTHORIZED; baking it in is the follow-up once registry auth is fixed, at which point this line degrades to a fast no-op guard like the openssl line above it. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Dtdjx4Gxude9fwyLezCrhh	2026-08-11 20:16:32 -05:00

Author

SHA1

Message

Date

Jason WoltjeandClaude Fable 5

b79708fdc7

ci: provision Pi runtime 0.84.1 in the test step (Invariant R)

ci/woodpecker/pr/ci Pipeline was successful

Details

invariant_r_unittest.py (landing with the lease-remediation stack, PR
#1109) hard-requires an installed `pi` binary pinned to the measured
version: it boots Pi's real tool registry and proves the broker's
read-only carve-out resolves to real, unshadowed builtins. Absent
runtime fails loud by design — so CI must provide it.

Install @earendil-works/[email protected].1 (the canonical Pi;
@mariozechner/* is embedded-legacy) at step level in the test step.
Step-level rather than baked into Dockerfile.ci because ci-image
publishes are currently blocked on registry UNAUTHORIZED; baking it in
is the follow-up once registry auth is fixed, at which point this line
degrades to a fast no-op guard like the openssl line above it.

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Dtdjx4Gxude9fwyLezCrhh

2026-08-11 20:16:32 -05:00