Jason WoltjeandClaude Fable 5 b79708fdc7 ci: provision Pi runtime 0.84.1 in the test step (Invariant R) ...

invariant_r_unittest.py (landing with the lease-remediation stack, PR
#1109) hard-requires an installed `pi` binary pinned to the measured
version: it boots Pi's real tool registry and proves the broker's
read-only carve-out resolves to real, unshadowed builtins. Absent
runtime fails loud by design — so CI must provide it.

Install @earendil-works/[email protected].1 (the canonical Pi;
@mariozechner/* is embedded-legacy) at step level in the test step.
Step-level rather than baked into Dockerfile.ci because ci-image
publishes are currently blocked on registry UNAUTHORIZED; baking it in
is the follow-up once registry auth is fixed, at which point this line
degrades to a fast no-op guard like the openssl line above it.

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Dtdjx4Gxude9fwyLezCrhh

2026-08-11 20:16:32 -05:00

..

ci-image.yml

CI: add pre-baked ci-base image (producer) [Phase 1a] (#637)

2026-06-22 22:20:48 +00:00

ci.yml

ci: provision Pi runtime 0.84.1 in the test step (Invariant R)

2026-08-11 20:16:32 -05:00

publish.yml

ci(#462): add durable next publish pipeline (#687)

2026-06-25 05:45:09 +00:00