Enable fleet agents on the pi runtime

[waynesun09]

Problem

fullsend can now run agents on pi (earendil-works/pi, @earendil-works/pi-coding-agent) via runtime: pi (fullsend-ai/fullsend#6464, implementation in fullsend-ai/fullsend#6467). Selecting that runtime is a one-line org/per-repo config change; the fleet definitions in this repo still assume Claude Code (**/claude in sandbox policies, protected-path lists with .claude/ but not .pi/, docs with no runtime note) and pin sandbox images by digest that predate the pi install.

This is the fleet-side tracker that mirrors fullsend#6464. Do not change the production default away from Claude Code here.

Updated 2026-08-22 after verifying paths against dc7858b: policy/profile paths, the protected-path copies, the env file path, and the image-digest pins were corrected; nothing about the scope changed.

One issue, not one per agent

Runtime selection is org/per-repo (defaults.runtime / runtime:), not a per-harness field. The code that must change is shared:

• sandbox policy/profile binary allowlists
• protected-path lists (.pi/ next to .claude/ / .cursor/)
• the harness image: digest pins
• a short runtime-support note in each in-scope agent doc

Splitting by agent would duplicate that plumbing, hide the pilot sequence, and create four issues that all block on the same image pin. Agents that cannot run on pi yet (review, retro) fail for a platform reason (no Task/sub-agent tool), not a missing per-agent PR — that work lives in fullsend (sub-agent extension), not here.

Blocked on

Unblocked 2026-08-23 — no fullsend release is needed: sandbox-images.yml publishes both images on every push to main (the latest GitHub release is still v0.36.0 from 2026-08-11, which predates pi; the images carry the main revision).

• feat(#6464): add the pi runtime (stream parser, Bootstrap/Run, Vertex provider, enablement) fullsend#6467 merged (d11b396c, 2026-08-22) — PiRuntime, ValidRuntimes(), sandbox PI_VERSION=0.84.2 pin, vendored pi-anthropic-vertex

• fullsend-sandbox and fullsend-code published with pi from main — current :latest (v0.37.0, revision 1f027be, 2026-08-23, image env carries PI_CODING_AGENT_DIR=/sandbox/pi-config):

  • ghcr.io/fullsend-ai/fullsend-sandbox@sha256:9af3fba87d193bc58ae9da6c916fcc9689176eeee9247b563bc14d8acb3cc734
  • ghcr.io/fullsend-ai/fullsend-code@sha256:9743bc7b6e451e0bcea25ae4a67e0c040c296f1fee04c08988ae80c53fafcfe6

  These move with every push to main; the C1 PR should pin whatever :latest resolves to at PR time (skopeo inspect --raw docker://ghcr.io/fullsend-ai/<image>:latest | sha256sum for the index digest) and re-verify pi is present (skopeo inspect … | jq '.Env' shows PI_*, or podman run --rm --entrypoint pi <image> --version).

• (fullsend-side) behaviour-suite BEHAVIOUR_CAPABILITIES=runtime-pi flip — fullsend e2e.yml change, tracked on fullsend#6464; not a blocker for this repo

In scope

C1 — plumbing (one PR, safe before the pilot)

• Binary allowlists — add **/pi next to **/claude everywhere the Claude CLI is listed. Today that is profiles/fullsend-vertex-ai.yaml (used via profiles: by the GitHub triage/code/fix/retro harnesses) plus the inline policies policies/github/{prioritize,review}.yaml, policies/gitlab/{triage,prioritize,code,fix,review,retro}.yaml and policies/jira/triage.yaml. npm-global pi is a node shebang so **/node already covers today's image; **/pi is required if/when a standalone binary is used, and keeps the rows symmetrical.
• Protected paths — add .pi/ wherever .claude/ is listed and keep the copies in sync: harness/review.yaml (REVIEW_PROTECTED_PATHS, both the GitHub and the GitLab block), scripts/post-review-test.sh (the test fixture of the same list; scripts/post-review.sh itself reads the env var), skills/pr-review/SKILL.md (the protected-path list and the .claude/** classification glob), agents/fix.md "Protected paths".
• Image pins — the images above are now published: bump image: in harness/{triage,prioritize,retro,scribe}.yaml (fullsend-sandbox@sha256:…) and harness/{code,fix,review}.yaml (fullsend-code@sha256:…) to the new digests, as was done by hand in fix(#123): pin harness images to immutable sha256 digests #658. Safe for Claude runs (same image plus the pi install) and the one step that actually makes runtime: pi runnable with these harnesses.
• env/gcp-vertex.env: no GOOGLE_CLOUD_LOCATION alias. The vendored twoGiants/pi-anthropic-vertex provider reads CLOUD_ML_REGION first; GOOGLE_CLOUD_PROJECT / ANTHROPIC_VERTEX_PROJECT_ID / GOOGLE_APPLICATION_CREDENTIALS / CLAUDE_CODE_USE_VERTEX are already exported, and fullsend's pi runtime pins GOOGLE_CLOUD_PROJECT to ANTHROPIC_VERTEX_PROJECT_ID for the run.

C2 — opt-in pilot (after C1 + image)

Pilot on a disposable org/repo that already has repo-scoped Vertex WIF. Do not set runtime: pi as the fullsend-ai org default. Knobs if a model id or the Bash allowlist needs adjusting during the pilot: FULLSEND_PI_MODEL, FULLSEND_PI_PROVIDER, FULLSEND_PI_BASH_ALLOWLIST=enforce (runner env; see fullsend docs/runtimes.md).

Wave 1 (no sub-agent / Task assumption):

• triage — /fs-triage produces a schema-valid result; post-script labels/comments as today; metrics.json runtime is pi; skills/analyze-transcript reads the transcripts/<agent>-<timestamp>_<id>.jsonl session file
• prioritize — same bar

Wave 2 (Write/Edit/Bash, plugins/gopls-lsp is Claude-only and already warned/skipped by PiRuntime):

• code — /fs-code on a trivial issue opens a PR; protected-path + secret-scan post-script still gate
• fix — /fs-fix on that PR applies a review finding

Docs (only the agents that actually ran):

• docs/{triage,prioritize,code,fix}.md — "Runtime support" sections landed in feat(#971): runtime docs, explicit effort in every harness, eval runtime/model overrides #975 (299f264), plus a README Runtimes column and a LOCAL.md overrides section
• docs/{review,retro}.md — landed in feat(#971): runtime docs, explicit effort in every harness, eval runtime/model overrides #975 with updated wording: they run to schema-valid results on pi in a single context (verified locally); the production sub-agent roster stays Claude-only until the pi Agent tool (tracked on fullsend#6527)

Out of scope (not v1)

• review / retro on pi — both dispatch Claude Code Agent/Task sub-agents (skills/pr-review/sub-agents/*). pi core has no equivalent; that is a fullsend runtime follow-up (a hash-pinned sub-agent extension spawning children with the full fullsend flag set), not a fleet prompt change.
• scribe / org-customized agents — they live in fullsend-ai/.fullsend, not this repo.
• plugins/gopls-lsp — Claude plugin format; PiRuntime already skips plugins: with a warning.
• Per-harness runtime: override — out of scope upstream.
• Changing production defaults.runtime in fullsend-ai/.fullsend.
• Bedrock / Azure model access for pi — fullsend-side follow-up (provider extension + cloud-agnostic OIDC refresh), tracked on fullsend#6464.

Acceptance criteria

• C1 PR merged; make test / post-review unit tests still pass (REVIEW_PROTECTED_PATHS copies stay in sync); harness digests point at images that contain pi
• Wave 1 pilot via the real dispatch path (/fs-triage, /fs-prioritize on a disposable repo): schema-valid output and post-scripts (labels/comments) under pi — the local runs verified the agents end-to-end but used --no-post-script, so post-scripts and GitHub dispatch under pi are the one thing still unexercised
• Wave 2 pilot via dispatch: /fs-code opens a PR (protected-path + secret-scan post-scripts gate), /fs-fix applies a finding
• Docs match the matrix (all seven agents documented in feat(#971): runtime docs, explicit effort in every harness, eval runtime/model overrides #975; review/retro stated as single-context on pi, sub-agent roster Claude-only)
• Production fullsend-ai org still defaults to Claude Code (nothing in C1/feat(#971): runtime docs, explicit effort in every harness, eval runtime/model overrides #975/fullsend#6534 changed a default; pi remains opt-in and labelled experimental)

Related

• Track pi (earendil-works/pi) as a supported agent runtime fullsend#6464 — platform tracker (PiRuntime, sub-agent and multi-cloud follow-ups)
• feat(#6464): add the pi runtime (stream parser, Bootstrap/Run, Vertex provider, enablement) fullsend#6467 — implementation PR (parser, Bootstrap/Run, Vertex extension, ValidRuntimes(), behaviour scenario, docs)
• refactor(runtime): make sandbox tool hooks and runner capabilities runtime-neutral fullsend#6355 — runtime-neutral sandbox hooks (ADR 0090) the pi adapter uses
• Tool allowlist: diagnose un-normalized (non-Claude-vocabulary) tool names from runtime adapters fullsend#608 — tool-name case (pi uses lowercase bash/read; adapter translates)
• fix(#123): pin harness images to immutable sha256 digests #658 — the previous by-hand harness image digest bump

[fullsend-ai-triage]

🤖 Triage · ⚠️ Cancelled · Started 5:28 PM UTC · Ended 5:32 PM UTC

Commit: dc7858b · View workflow run →

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 5:34 PM UTC · Completed 5:38 PM UTC

Commit: dc7858b · View workflow run →

[fullsend-ai-triage]

This issue is blocked on upstream work in fullsend-ai/fullsend:

1. fullsend#6467 (open PR) — adds the pi runtime (stream parser, Bootstrap/Run, Vertex provider extension, ValidRuntimes(), sandbox PI_VERSION pin). This must merge before any fleet-side changes can land.
2. fullsend#6464 (open issue) — the platform-level tracker for pi as a supported runtime. Tracks follow-ups like sub-agent extensions (needed for review/retro on pi) and multi-cloud provider support.
3. Image rebuild — after #6467 merges, fullsend-sandbox and fullsend-code images must be rebuilt and published. The harnesses in this repo pin images by @sha256 digest, so the new digests are required before the C1 PR can be completed.

The related dependency fullsend#6355 (runtime-neutral sandbox hooks, ADR 0090) has already merged, so that prerequisite is resolved.

Once #6467 lands and images are published, the C1 plumbing PR (binary allowlists, protected paths, image-digest bumps) can proceed, followed by the C2 opt-in pilot on a disposable repo.

Blocked by:

• feat(#6464): add the pi runtime (stream parser, Bootstrap/Run, Vertex provider, enablement) fullsend#6467
• Track pi (earendil-works/pi) as a supported agent runtime fullsend#6464

[waynesun09]

/fs-triage

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 12:35 PM UTC · Completed 12:39 PM UTC

Commit: a0a2c25 · View workflow run →