Добавить Pi как альтернативный agent backend

.start-issue/runs/issue-45.json

@@ -0,0 +1 @@
+{"schema_version":1,"state_revision":14,"updated_at":"2026-09-06T23:00:00Z","run_status":"ACTIVE","control_state":"FLOW","issue":{"number":45,"url":"https://github.com/dapi/code-converge/issues/45","source_revision":"gh issue view 45; comments=0; 2026-09-06"},"route_revision":1,"route":{"current":"Feature Flow","predicate_evidence":{"incident":"no active operational impact","bug":"no observed behavior contradicts an established expectation","small_change":"ineligible: public CLI/configuration and trust/process boundaries change; design required","epic":"one independently verifiable delivery unit","refactoring":"observable behavior changes","feature":"eligible: adds a second agent runtime with testable end-to-end outcome"},"history":[{"revision":1,"route":"Feature Flow","evidence":"routing.md predicates and issue #45 verified"}]},"closure_horizon":{"this_run":"Feature Flow through a safe checkpoint; full delivery requires commit, push, PR and CI evidence","separate_followups":"none"},"flow_state":{"canonical_owner":"memory-bank/flows/feature.md","phase":"Plan Ready","next_gate":"Delivery review and CI","first_unmet_predicate":"Published-head review and CI evidence are pending.","predicates":{"routing":"passed","bootstrap":"passed","problem_ready":"passed","solution_ready":"passed: explicit operator-runtime Pi boundary is recorded in design.md; ADR-003 remains accepted.","plan_ready":"passed","execution":"complete locally: Pi config, adapter, strict JSONL parsing and fresh fix stages implemented; delivery requested.","done":"pending published-head review and CI"}},"validation_profile":{"owner":"memory-bank/features/FT-045/brief.md","status":"selected","selected":"high-risk","rationale":"new cross-system agent integration with protocol/failure semantics and trusted process/security boundary","approval_ref":"AG-01: requester approval \u00ab\u043e\u0442\u043b\u0438\u0447\u043d\u043e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0439\u00bb, 2026-09-06; accepted high-risk profile, ADR-003 and macOS sandbox-exec policy."},"capabilities":{"worktree_write":"available","git_delivery_capability":"restricted","github_read":"available via authenticated gh","github_write":"not guaranteed","network":"available for GitHub and documentation reads","evidence":"effective restricted start-issue profile does not guarantee .git/GitHub mutation; no mutation probe performed"},"scope_refs":{"brief":"memory-bank/features/FT-045/brief.md","index":"memory-bank/features/FT-045/README.md","issue":"https://github.com/dapi/code-converge/issues/45"},"artifacts":["memory-bank/features/FT-045/README.md","memory-bank/features/FT-045/brief.md","memory-bank/features/FT-045/design.md","memory-bank/adr/ADR-003-agent-neutral-workflow-contract.md","memory-bank/features/FT-045/implementation-plan.md"],"evidence_refs":["authoritative sources read","gh issue view 45","Problem Ready predicate audit","Pi 0.85.1 local --help and authoritative JSON/security/usage/extensions documentation grounded protocol and no-sandbox constraints","make docs-lint after index update: pass","git diff --check: pass","attempted separate non-authoring artifact review: codex session 01a077f0-0d79-7711-8848-f297ce4299cd timed out before verdict; no review evidence claimed","AG-01 Human Gate: requester \u00ab\u043e\u0442\u043b\u0438\u0447\u043d\u043e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0439\u00bb on 2026-09-06; accepted high-risk validation, ADR-003 and sandbox-exec baseline with bounded writable Fix stages","AG-04: requester selected option 2 on 2026-09-06: investigate minimal sandbox-exec policy expansion with mandatory negative containment tests; unrestricted fallback remains prohibited","AG-04 sandbox probes 2026-09-06: local Pi 0.85.1 runs under default-deny profile with global-read baseline, home deny and explicit launcher/bundle/Node/root re-allows; review-root write denied; Fix-root write permitted while home write denied; curl DNS/network denied","Independent Pi review of current diff, 2026-09-06: five documentation findings; corrected status, AG-02 and AG-04 inconsistencies. Operator clarified Pi configuration/provider transport is out of Code-Converge scope.","STEP-01 neutral contract extraction, 2026-09-06: internal/agent now owns Agent, ReviewResult, Counts and strict parser; workflow consumes it; focused packages compile. Full test execution remains blocked by known dyld LC_UUID local Go test-binary failure.","Correction, 2026-09-06: the requester did not restrict the FT-045 backend to review-only. The prior OD-01/BLK-03 inference was withdrawn. Their read-only instruction applied only to the one-off independent Pi review.","STEP-02–STEP-05 feasibility correction, 2026-09-06: implementation investigation showed the accepted sandbox design cannot both deny the operator home (where Pi global configuration/credentials reside) and invoke the configured Pi provider without an approved credentials/provider transport bridge. No unsafe Pi adapter, configuration surface, or public CLI contract was retained. The neutral contract extraction remains the safe local checkpoint."],"worktree":{"path":"/Users/danil/worktrees/feature/issue-45-dobavit-pi-kak-alternativnyy-agentnyy-ba","branch":"feature/issue-45-dobavit-pi-kak-alternativnyy-agentnyy-ba","head":"c8f4e28","status":"modified: FT-045 artifacts"},"git":{"commit":null,"pr":null,"ci":null},"writer_lease":{"owner":"delivery-orchestrator","active":true},"handoffs":[],"loops":{"artifact_review":{"iteration":1,"limit":3,"episode_id":"route-1-problem-ready","baseline_candidate":"FT-045 brief state_revision 2","last_material_delta":"Problem Ready predicates manually audited; unavailable independent review was non-authoring but produced no verdict"},"implementation_review":{"iteration":0,"limit":3,"episode_id":null,"last_material_delta":null}},"last_completed_step":"STEP-05: explicit Pi backend selection, no-tool private-patch review, strict final JSONL parsing, fresh Pi fix stages and documentation are implemented and locally compile-checked.","next_action":{"owner":"delivery-orchestrator","action":"Commit, push, create pull request, obtain independent review and inspect CI.","stop_condition":"Do not merge until review and required CI evidence are recorded."}}

README.md

@@ -2,7 +2,7 @@
 
 `code-converge` (also known as `review-fixes` and `improver`) is a Go CLI that closes the agent-development loop: it asks an agent to review the current repository, fixes the findings, commits and publishes the result, and makes sure required CI is green when CI applies.
 
-`code-converge` supports [Codex](https://github.com/openai/codex) as its only agent. The command is intended to be run from the repository that should be reviewed.
+`code-converge` supports [Codex](https://github.com/openai/codex) by default and [Pi](https://github.com/badlogic/pi-mono) as an explicit alternative backend. The command is intended to be run from the repository that should be reviewed.
 
 ## Root help
 
@@ -140,16 +140,28 @@ flowchart TD
 
 Key points:
 
-- **Review** — resolves the intended pull-request base and runs one schema-constrained `codex exec` against a private merge-base-to-worktree snapshot, including committed, staged, unstaged and untracked changes. Only the final-message file is classified; terminal stdout/stderr are not review data.
-- **Fix** — `codex exec -`, stdin = fix-prompt + full review report. The stateless remediation session receives the findings it must address.
+- **Review** — resolves the intended pull-request base and runs the selected agent against a private merge-base-to-worktree snapshot, including committed, staged, unstaged and untracked changes. Only a strict structured final report is classified; terminal stdout/stderr are not review data.
+- **Fix** — the selected agent receives the fix prompt and full review report in a fresh session.
 - **Publish and CI** — host-process `git`/`gh` orchestration, with CI pinned to the published SHA.
 - **CI recovery** — a deterministically failed applicable check starts Fix CI, resets the fix cycle, and restarts from Review. A timeout never starts Fix CI.
 - **Budget** — `max-cycles` counts only fix attempts, not the initial review.
 - **Fail closed** — unknown output ≠ clean; mixed output = error.
 
+### Agent backend
+
+`agent-backend` chooses the agent: `codex` (the built-in default) or `pi`. Set it with `--agent-backend`, `CODE_CONVERGE_AGENT_BACKEND`, or `agent-backend` in `.code-converge/config.yaml`; the existing CLI > project > user > environment > built-in precedence applies. Pi uses the executable selected by `--pi-executable`, `CODE_CONVERGE_PI_EXECUTABLE`, or `pi-executable` in the same config file (default: `pi`).
+
+Pi uses the operator's existing Pi provider, model, thinking, credentials, and transport configuration. Code-Converge does not configure or copy these values. For a review it starts Pi statelessly with extensions, skills, prompt templates, themes, context files and tools disabled, and passes only the prepared private diff in the prompt. Pi's final JSONL assistant message must be exactly the same strict structured findings report accepted from Codex. Fix stages start a fresh Pi process in the current worktree. There is no fallback to Codex when a selected Pi invocation fails.
+
+Example:
+
+```sh
+code-converge --agent-backend pi
+```
+
 ### 1. Review
 
-`code-converge` runs non-interactive `codex exec --output-schema <schema> --output-last-message <message> -` in the current directory. By default it resolves one review base in this order: an explicit review-base setting, the base of one open pull request for the current branch and its configured push/provider repository (or `origin` when Git's usual push-remote settings are absent), `branch.<current>.gh-merge-base`, then exactly one remote default-branch ref. Provider discovery verifies the PR head repository and branch against the current branch's provider identity, resolves the PR base branch against one remote-tracking ref and compares its commit SHA with the provider's advertised base SHA. If that uniquely selected remote-tracking ref is stale, Code-Converge fetches only the advertised base branch into that ref, then verifies the SHA again; a failed or still-mismatched refresh is an actionable operational error. It never fetches for an explicit review-base, an ambiguous/local-only candidate, or any other discovery source. The resolved base SHA is pinned for every review in the run. Code-Converge computes the merge-base and prepares a private Git index from that tree plus the current worktree; this includes committed, staged, unstaged and untracked changes without modifying the real index or worktree. A review-only Git helper applies that index only after confirming that a Git command targets the reviewed repository, while absolute Git paths, repository-creation commands, and commands targeting another repository retain their normal index. Code-Converge forces its wrapper-first `PATH` and neutral shell-startup settings through the per-review Codex shell policy, disables login-shell startup, and removes inherited Git repository/index/config transports and exported shell functions for that review. This prevents startup files or caller state from reordering `PATH`, replacing `git`, or redirecting Git away from the intended repository/index. The helper reads its private configuration from a sidecar file, so an `include_only` policy that allows `PATH` needs no extra helper variables; `GIT_INDEX_FILE` is not exported to Codex. All paths recorded in that sidecar must be valid UTF-8; unsupported Linux byte paths fail before the helper is created rather than being replaced during JSON encoding. Reviewed-root commands that explicitly enable Git split-index are rejected before they can create shared-index state outside the disposable command index. The review instruction compares `git diff --cached` from the computed merge base through the scoped helper. Ambiguous, missing, or unrefreshable candidates fail with a diagnostic before Codex starts. Provider discovery through `gh` is optional; unavailable `gh` or authentication falls through to local Git sources. No PR or other remote mutation occurs.
+With the default backend, `code-converge` runs non-interactive `codex exec --output-schema <schema> --output-last-message <message> -` in the current directory. By default it resolves one review base in this order: an explicit review-base setting, the base of one open pull request for the current branch and its configured push/provider repository (or `origin` when Git's usual push-remote settings are absent), `branch.<current>.gh-merge-base`, then exactly one remote default-branch ref. Provider discovery verifies the PR head repository and branch against the current branch's provider identity, resolves the PR base branch against one remote-tracking ref and compares its commit SHA with the provider's advertised base SHA. If that uniquely selected remote-tracking ref is stale, Code-Converge fetches only the advertised base branch into that ref, then verifies the SHA again; a failed or still-mismatched refresh is an actionable operational error. It never fetches for an explicit review-base, an ambiguous/local-only candidate, or any other discovery source. The resolved base SHA is pinned for every review in the run. Code-Converge computes the merge-base and prepares a private Git index from that tree plus the current worktree; this includes committed, staged, unstaged and untracked changes without modifying the real index or worktree. A review-only Git helper applies that index only after confirming that a Git command targets the reviewed repository, while absolute Git paths, repository-creation commands, and commands targeting another repository retain their normal index. Code-Converge forces its wrapper-first `PATH` and neutral shell-startup settings through the per-review Codex shell policy, disables login-shell startup, and removes inherited Git repository/index/config transports and exported shell functions for that review. This prevents startup files or caller state from reordering `PATH`, replacing `git`, or redirecting Git away from the intended repository/index. The helper reads its private configuration from a sidecar file, so an `include_only` policy that allows `PATH` needs no extra helper variables; `GIT_INDEX_FILE` is not exported to Codex. All paths recorded in that sidecar must be valid UTF-8; unsupported Linux byte paths fail before the helper is created rather than being replaced during JSON encoding. Reviewed-root commands that explicitly enable Git split-index are rejected before they can create shared-index state outside the disposable command index. The review instruction compares `git diff --cached` from the computed merge base through the scoped helper. Ambiguous, missing, or unrefreshable candidates fail with a diagnostic before Codex starts. Provider discovery through `gh` is optional; unavailable `gh` or authentication falls through to local Git sources. No PR or other remote mutation occurs.
 
 `--review-base <ref>`, `CODE_CONVERGE_REVIEW_BASE` and `.code-converge/review-base` explicitly select the base using the normal configuration precedence. A branch already merged into the selected base has no committed delta but still reviews worktree changes; a fully clean run follows the existing clean/no-change path. It uses the model and reasoning effort resolved from the selected mode and any explicit stage overrides.