Phase 1: route every Pi history append through admission

[johnnygreco]

Objective

Route every Pi history mutation through one generic admission boundary before it reaches live context or JSONL, including assistant output, summaries, extension messages, and bash output.

Context

• Tracker: GitHub goal delivery: close Pi attested-admission gaps #50
• Depends on Phase 0 final hook/schema names.
• Pi must remain OpenShell-agnostic. The runtime extension maps generic Pi origins to OpenShell/Egress Gate envelopes.

Scope

• Pi agent-core: add beforeAssistantMessageAppend, applied at both finalization sites before context mutation and message_end.
• Pi coding-agent: replace per-kind admission methods with generic admitMessage(message, {origin, source?}); add MessageOrigin; route user, tool result, assistant, compaction summary, branch summary, extension message, and bash execution append paths through one private helper.
• Preserve ordering after input/template/skill, afterToolCall, and session_before_compact transformations.
• Denials: user/custom/summary/bash fail visibly without append; tool result uses existing protocol-safe marker; assistant replaces text blocks while preserving thinking/tool calls.
• Runtime adapter/Egress Gate: origin-specific hook/envelope mapping and strict adapters with immutable-field validation; Describe advertises every binding.
• Non-goals: whole-context attestation, provider schema redesign, caller identity.
• Backward compatibility: not required.
• Dependencies: Phase 0 merged/accepted on all affected branches.

Implementation Notes

Use the hook/envelope table in the tracker source plan. Images fail closed. Do not add one Pi extension hook per origin; the public Pi surface is the generic admitMessage method plus the necessary agent-core assistant finalization hook.

Acceptance Criteria

• Every named origin is admitted before live context and JSONL.
• Denied raw text is absent; replacements are persisted and emitted.
• Assistant deny/replacement preserves tool calls and does not poison the next turn.
• Immediate/deferred bash and all custom-message delivery paths are covered.

Required Validation

• Pi: npm run check and focused agent/coding-agent tests per Pi AGENTS.md.
• Research: make check and JS adapter tests.
• Integration: poisoned-session regression scenario.

PR Expectations

Review Pi API minimality separately from adapter/schema correctness. Explicitly report production/test line counts and any append path intentionally excluded.

[johnnygreco]

Phase 1 started after Phase 0 completed review-clean.

Implementation is split by repository to avoid overlapping edits:

• Pi: one generic admitMessage API, the minimum assistant-finalization hook, and routing of the explicitly named append origins.
• Research/Egress Gate runtime integration: origin-specific envelopes/adapters and Describe bindings that consume the generic Pi API.

POC ceiling remains binding: implement only the paths and guarantees named in this issue, use the smallest direct design, add no compatibility shims, speculative generalization, or unrelated cleanup, and do not modify OpenShell/protobuf in this phase.

[johnnygreco]

Phase 1 implementation and independent review are complete on the existing draft PRs.

• Pi fork PR Add Reachy Mini OpenShell demo project #1 head: c58c59f00
• Research PR feat(egress-gate): add attested Pi prompt admission #38 head: 6ddc86e
• OpenShell/protobuf: unchanged in this phase

All seven named origins are routed through the single generic Pi admission API before history mutation. The review found and fixed two concrete bypass/interoperability defects; all affected reviewers re-reviewed the fixes clean. Review Records are posted on both existing draft PRs.

No new implementation PRs, compatibility paths, per-origin Pi hooks, Phase 2 machinery, or unrelated cleanup were added.