pr explain: add pi as a third, API-metered runner #150

New issue

Closed

opened 2026-08-19 23:39:58 +01:00 by vnprc-agent · 1 comment

vnprc-agent commented

2026-08-19 23:39:58 +01:00

Contributor

allod pr explain accepts exactly two runners, --codex and --claude, both subscription CLIs. Tonight both were throttled at once while the operator needed a report to clear a deploy-blocking review (allod/archetypes#39), and the tool had no answer. Pi is already installed fleet-wide and meters a different budget — API credits — so it is the natural third runner: not a preference, a fallback that works precisely when the other two are exhausted together.

The design keeps every property the two-runner allowlist was protecting:

Maximal scrub, zero exceptions. Pi authenticates from its own credential store under HOME (verified empirically: a print-mode run answers with every *_API_KEY and auth-token variable stripped from the environment). Unlike codex (CODEX_HOME, CODEX_ACCESS_TOKEN) and claude (ANTHROPIC_CONFIG_DIR, OAuth tokens), the pi runner needs no credential passthrough at all — the sanitized-environment list applies to it unweakened.
Equivalent isolation. pi -p --no-session --no-extensions --no-skills --no-prompt-templates --no-context-files --no-approve is pi's spelling of codex's --ignore-user-config --ignore-rules: nothing project-local in the untrusted caged checkout is loaded or trusted, and no session state persists.
Honest disclosure. Pi is not a subscription, so consent, provenance, and every operator-facing message now say what the operator is spending through a single shared display-name mapping: codex subscription CLI, claude subscription CLI, pi API CLI. The provenance validator enforces the same label.
Same contract everywhere else. Effort maps directly (--thinking accepts the tool's full low..max vocabulary), the model defaults to pi's configured default, the prompt arrives on stdin, and all cage postconditions, call budgets, and validation are runner-independent. The job directory reaches pi only through the ALLOD_PR_EXPLAIN_JOB_DIR contract, since pi has no --add-dir.

Tests mirror the claude coverage: exact hardened argv, environment deny-list plus the two other runners' credentials explicitly absent, 0700 job directory, three-call clean run, and the API-metered disclosure line.

`allod pr explain` accepts exactly two runners, `--codex` and `--claude`, both subscription CLIs. Tonight both were throttled at once while the operator needed a report to clear a deploy-blocking review (allod/archetypes#39), and the tool had no answer. Pi is already installed fleet-wide and meters a *different* budget — API credits — so it is the natural third runner: not a preference, a fallback that works precisely when the other two are exhausted together. The design keeps every property the two-runner allowlist was protecting: - **Maximal scrub, zero exceptions.** Pi authenticates from its own credential store under `HOME` (verified empirically: a print-mode run answers with every `*_API_KEY` and auth-token variable stripped from the environment). Unlike codex (`CODEX_HOME`, `CODEX_ACCESS_TOKEN`) and claude (`ANTHROPIC_CONFIG_DIR`, OAuth tokens), the pi runner needs no credential passthrough at all — the sanitized-environment list applies to it unweakened. - **Equivalent isolation.** `pi -p --no-session --no-extensions --no-skills --no-prompt-templates --no-context-files --no-approve` is pi's spelling of codex's `--ignore-user-config --ignore-rules`: nothing project-local in the untrusted caged checkout is loaded or trusted, and no session state persists. - **Honest disclosure.** Pi is not a subscription, so consent, provenance, and every operator-facing message now say what the operator is spending through a single shared display-name mapping: `codex subscription CLI`, `claude subscription CLI`, `pi API CLI`. The provenance validator enforces the same label. - **Same contract everywhere else.** Effort maps directly (`--thinking` accepts the tool's full `low..max` vocabulary), the model defaults to pi's configured default, the prompt arrives on stdin, and all cage postconditions, call budgets, and validation are runner-independent. The job directory reaches pi only through the `ALLOD_PR_EXPLAIN_JOB_DIR` contract, since pi has no `--add-dir`. Tests mirror the claude coverage: exact hardened argv, environment deny-list plus the two other runners' credentials explicitly absent, 0700 job directory, three-call clean run, and the API-metered disclosure line.