GitHub goal delivery: close Pi attested-admission gaps

[johnnygreco]

Goal

Implement the 2026-09-02 Pi attested-admission review plan across OpenShell Research, the johnnygreco/pi fork, and the johnnygreco/OpenShell fork: close history-admission coverage gaps, bind whole outbound context, make the real demo self-verifying, add bridge caller identity, and finish with cross-repository QA and documentation.

Source Of Truth

Governing sources, in order, when instructions conflict:

1. Active user goal and explicit user corrections.
2. This progress tracker.
3. The active implementation issue or PR scope.
4. /home/ubuntu/workspaces/2/reports/pi-admission-review/plan.md and companion report.md, reviewed 2026-09-02.
5. Repository instructions and current behavior.

No backward compatibility is required unless an active issue says otherwise. Keep Pi generic, OpenShell harness-agnostic, and Pi message-shape knowledge in Egress Gate/runtime integration.

Shared Context

• Research: johnny/pi-attested-admission at 0bf33ca; draft PR feat(egress-gate): add attested Pi prompt admission #38.
• Pi: johnny/before-user-message-commit at 177b42723; fork draft PR feat(coding-agent): add user message append hook johnnygreco/pi#1.
• OpenShell: openshell/pi-egress-admission at abf1a625; fork draft PR feat(supervisor): add managed Pi admission bridge johnnygreco/OpenShell#1.
• All branches include the 2026-09-02 upstream heads through normal merges; fork main branches were fast-forwarded. No feature branch was rebased or force-pushed.
• Existing draft PRs remain the only implementation/reviewer surfaces. Moving them ready or merging requires user/repository direction.
• Ambition ceiling: this is a proof of concept. Optional Phase 2b, speculative hardening, compatibility layers, future-proof abstractions, and release/deployment automation remain excluded.

Delivered Guarantees

• Every supported Pi history origin is admitted before final live-context/JSONL append. Atomic assistant denial removes text, thinking, and tool calls and prevents denied tool execution.
• One provider-context admission binds every ordered user/tool entry; egress detects earlier-entry tampering, added/dropped entries, and mismatched replacements.
• Append-time allows may omit attestations; provider-context admission remains mandatory for egress.
• Only a launched exec receives a usable bridge capability through an inherited descriptor; token registration is race-safe and revoked at process exit.
• Pi production changes remain generic; OpenShell bridge primitives remain harness-agnostic; Egress Gate/runtime integration owns Pi message shapes.
• README, architecture docs, OpenShell middleware docs, comments, manifests, example commands, and the dated QA report match the implemented POC.

Known Limits

• The real ./demo.sh verify was not mocked and remains externally blocked on this host by absent prepared ignored workspaces/runtime and unset PI_MODEL_API_KEY, EGRESS_GATE_HOST_IP, and PI_MODELS_PATH.
• Assistant thinking is scanned at egress but is not append-admitted or context-hashed.
• Assistant tool calls are inspected and denyable but immutable; a redaction targeting them fails closed.
• Provider-specific history rewrites may fail closed for cross-transport tool history/orphaned calls.
• Same-user process memory reading remains a documented capability-token residual risk.
• Pi npm run check still stops on unchanged upstream packages/ai generated-catalog drift; focused post-merge suites pass.
• OpenShell delegated Branch Checks and Helm Lint contexts remain pending; local pre-commit/test/Go CI and Docker smoke E2E pass.

Validation Strategy

• Research/Egress Gate: make check and make check-py311 — 377/377 each.
• Pi: post-merge and final focused suites passed; formatter/dependency/import/lock gates passed before unchanged upstream TypeScript catalog failures.
• OpenShell: mise run pre-commit, mise run test, mise run go:ci, focused bridge/token/provider tests, and mise run e2e:docker passed.
• Documentation renderer, strict docs build, artifact preview, and final Research GitHub checks passed.
• Final multi-agent panel review at the three current heads is clean with no blocker/high/medium findings.

Issue Checklist

• Phase 0: establish final admission contracts #51 Phase 0: establish final contracts and remove superseded paths
• Phase 1: route every Pi history append through admission #52 Phase 1: route every Pi history append through admission
• Phase 2: bind and verify the whole outbound context #53 Phase 2: bind and verify the whole outbound context
• Phase 3: make the admission demo self-verifying #54 Phase 3: make the demo self-verifying and document admission — code/docs complete; real demo externally blocked
• Phase 4: authenticate admission bridge callers #55 Phase 4: authenticate admission bridge callers — implementation/review complete; live unauthenticated case shares the demo blocker
• Phase 5: complete Pi admission integration QA #56 Phase 5: complete cross-repository QA and blog alignment

Current State

• Implementation, upstream integration, QA documentation, and head-matched review are complete at Research 0bf33ca, Pi 177b42723, and OpenShell abf1a625.
• Final Review Records are posted to all three draft PRs.
• Phase 3 and Phase 4 issues remain open only for the configured real-demo run. Required sequence: prepare the documented forks/runtime and environment, then run ./demo.sh reset && ./demo.sh verify without mocks.
• No further implementation work is authorized by this tracker unless that run exposes a concrete defect.

Final Status

Implementation and independent review complete. Goal remains open pending the externally blocked real end-to-end demo required by #54 and #55.