refactor(supervise): delete piExecutor — no harness gets a bespoke executor

CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.118.0
+
+### pi runs through the bridge, like every other harness
+
+BREAKING. The bespoke pi executor is gone. cli-bridge already routes pi generically — `matches(m) => m === 'pi' || m.startsWith('pi/')` — so a second pi-only code path was duplication. A pi worker is now `createExecutor({ backend: 'bridge', bridgeUrl, bridgeBearer, model: 'pi/<provider>/<model>' })`, the same call every other harness uses.
+
+Removed public exports: `piExecutor`, `PI_RUNTIME`, `piSeamKey`, `PiSeam`, `PiExecutorOutput`, `preparePiMcp`, `piMcpAdapterAvailable`, `buildPiMcpServers`, `PI_MCP_ADAPTER`, `PI_MCP_ADAPTER_ENV`, `PI_MCP_CONFIG_FLAG`, `PiMcpMount`, `PiMcpMountOptions`, `PiMcpPreparation`, `PiMcpReceipt`. The `{ backend: 'pi' }` arm of `ExecutorConfig` is removed, and the executor registry no longer pre-registers a `'pi'` runtime.
+
+What the bridge path does BETTER, and the old executor dropped outright:
+
+- `profile.model.reasoningEffort` is lowered to pi's `--thinking`.
+- `profile.tools` is lowered to `--exclude-tools`.
+- `profile.resources` (context / skills / commands / subagents / instructions) is materialized into the run directory.
+- `profile.prompt.systemPrompt` is passed as a native `--system-prompt` file instead of being prepended to the task text.
+- Consequently a pi backend is now held to `fullProfileMaterialization` in `workerFromBackend`, not the prompt-and-model-only contract. A profile that changes axes the old executor silently dropped is now honored rather than rejected.
+
+What the bridge path does NOT do today, stated so no consumer is surprised:
+
+- `Executor.progress()` and `Executor.traceSource()` are absent on `bridgeExecutor`. This is missing for every harness on the bridge, not only pi; tracked as #683.
+- Mid-turn steering degrades. The bridge runs pi as `--print --mode json` with stdin closed, so a steer lands after the current run rather than at the next turn boundary, and an interrupt is a process-tree kill rather than pi's non-destructive injection.
+- `PiSeam.args`, `PiSeam.env`, and a per-worker `bin` have no wire equivalent. A caller that pinned a specific pi binary or injected per-worker environment must configure it on the bridge server instead.
+- `WORKER_TRACE_PROPAGATION` loses its `pi: true` row. The bridge has no environment channel to the worker, so a pi worker no longer inherits `TRACE_ID`/`PARENT_SPAN_ID` — honestly unpropagated rather than silently dropped, same as the other bridge-dispatched arms.
+- MCP for pi is now the bridge's concern. agent-runtime no longer writes a `--mcp-config` file or checks for the `pi-mcp-adapter` extension.
+
+Known consumers to migrate, none broken until they upgrade:
+
+- `loops` — `src/pi-worker.ts` and `extensions/pi/loops.ts`. The largest migration: `pi-worker.ts` builds the executor directly, and steering is the part that changes behaviour rather than just call shape. Pinned at 0.111.0.
+- `supervisor-lab` — `bench/deepswe/live.ts:193`. A single `backend: 'pi'` in a benchmark rig; a call-shape change. Pinned at 0.116.0.
+- `agent-eval-runtime-run-reader` — two test files reference the pi backend.
+
 ## 0.117.0
 
 - Run every supervisor, including the root, from one complete `AgentProfile`, preserve exact profile/task/candidate identity through recursive delegation, and reject execution paths that would silently drop profile fields.

docs/api/primitive-catalog.md

@@ -7,7 +7,7 @@
 
 # Primitive catalog — the never-stale anti-reinvention inventory
 
-> **GENERATED** from `@tangle-network/agent-runtime@0.117.0` and `@tangle-network/agent-eval@0.139.2` by `scripts/gen-primitive-catalog.mjs`. Do NOT hand-edit — run `pnpm run docs:api`. This is the mechanical companion to the JUDGMENT in `canonical-api.md` (§2 decision table + §1.5 AgentProfile law): that doc says WHICH primitive to reach for and what NOT to build; this catalog proves WHAT exists. Per-symbol signatures + `file:line` live in the per-module pages under `docs/api/`.
+> **GENERATED** from `@tangle-network/agent-runtime@0.118.0` and `@tangle-network/agent-eval@0.139.2` by `scripts/gen-primitive-catalog.mjs`. Do NOT hand-edit — run `pnpm run docs:api`. This is the mechanical companion to the JUDGMENT in `canonical-api.md` (§2 decision table + §1.5 AgentProfile law): that doc says WHICH primitive to reach for and what NOT to build; this catalog proves WHAT exists. Per-symbol signatures + `file:line` live in the per-module pages under `docs/api/`.
 
 ## 1. agent-runtime — own public surface
 
@@ -508,7 +508,7 @@ Import from `@tangle-network/agent-runtime/intelligence` — 166 exports.
 
 ### Execution kernel — recursive atom, supervision, executors, round-synchronous loop
 
-Import from `@tangle-network/agent-runtime/kernel` — 700 exports.
+Import from `@tangle-network/agent-runtime/kernel` — 685 exports.
 
 | Symbol | Kind | Summary |
 |---|---|---|
@@ -530,7 +530,6 @@ Import from `@tangle-network/agent-runtime/kernel` — 700 exports.
 | `authorStrategy` | function | Author + load a strategy from losses. Throws when the author emits no loadable module; |
 | `bestSoFar` | function | The best-so-far fold — the ONE definition of "how good was the run after k results", shared by |
 | `breadthStrategy` | function | BREADTH: K independent rollouts (each own artifact), verifier picks the best. |
-| `buildPiMcpServers` | function | Build the canonical `{ mcpServers }` body the adapter reads, from `AgentProfile.mcp`. |
 | `buildSteerContext` | function | Build the `SteerContext` a combinator reads to steer (its `loopUntil.until`, `widen` gate, any |
 | `canDisplace` | function | The repair keep-best guard: a challenger displaces the incumbent only when it is |
 | `canonicalizeAuthoredProfile` | function | Lift a profile the supervisor AUTHORED into the canonical shape every executor reads. |
@@ -629,12 +628,10 @@ Import from `@tangle-network/agent-runtime/kernel` — 700 exports.
 | `pendingWaits` | function | The waits a journaled tree shows as ARMED but never woken — what a resumed run re-arms with the |
 | `pickBestDelivered` | function | The single argmax both the default finalizer and `finalizeBestDelivered` share: highest |
 | `pickChampion` | function | The champion pick over a means table. 'score' takes the best mean score (ties → |
-| `piMcpAdapterAvailable` | function | True when pi can actually consume MCP config — i.e. `pi-mcp-adapter` is installed. Ported from |
 | `pipeline` | function | `pipeline(stages)` — run the stages in order, feeding each stage's `done` deliverable into the |
 | `plateau` | function | "The objective has stopped climbing." Fires when the best-so-far curve has risen by no more than |
 | `plateauLength` | function | How many trailing entries of a best-so-far curve are within `minDelta` of the curve's value |
 | `pollFor` | function | Build a bounded `poll` spec from a duration. |
-| `preparePiMcp` | function | The one call `piExecutor` makes before spawning pi: decide what pi must be told, fail loud if it |
 | `printBenchmarkReport` | function | Pretty-print a report — the "free optimization" verdict, with the cost vector. |
 | `probeSandboxCapabilities` | function | Probe (and memoize per client) what the loop may rely on. A client without a |
 | `profileRichnessFinding` | function | Turn a {@link ProfileRichness} verdict into a bus-routable `AnalystFinding` (area `profile-quality`). |
@@ -734,12 +731,6 @@ Import from `@tangle-network/agent-runtime/kernel` — 700 exports.
 | `EVIDENCE_MAX_CHARS` | const | Hard cap on one worker's evidence block so the brain's context cannot blow up. |
 | `mcpSecretEnvMetadataKey` | const | The `AgentProfileMcpServer.metadata` key the declarative secret-env map |
 | `NOTE_MAX_CHARS` | const | Cap on the worker's closing note inside the evidence block. |
-| `PI_MCP_ADAPTER` | const | The pi extension that gives pi MCP at all. Everything here is gated on it being loadable. |
-| `PI_MCP_ADAPTER_ENV` | const | Overrides adapter detection for installs whose path does not carry the adapter's name. |
-| `PI_MCP_CONFIG_FLAG` | const | The adapter-registered flag that names this run's config file (`pi-mcp-adapter` `index.ts:252`). |
-| `PI_RUNTIME` | const | The runtime name `piExecutor` registers under. |
-| `piExecutor` | const | Build the `Executor` for one pi worker. Registered as runtime `'pi'`. |
-| `piSeamKey` | const | Seam key the registry threads a `PiSeam` through (`ExecutorContext.seams['pi']`). |
 | `refine` | const | Built-in `Strategy`: attempt → `observe()` reads the trace → steer the next attempt → repeat (deepen one lineage). |
 | `runLoop` | const | Pre-rename name for {@link runAgentRounds}; identical function, kept so existing |
 | `sample` | const | Built-in `Strategy`: K independent attempts, keep the best-verifying (best-of-N / resample). |
@@ -874,13 +865,7 @@ Import from `@tangle-network/agent-runtime/kernel` — 700 exports.
 | `Persona` | interface | The "act like X" record. A thin composition over the keystone's `AgentSpec`: it pairs the |
 | `PersonaContext` | interface | The persona context blob — who the loop is acting as. Open by intent: a persona names its |
 | `PersonaExecutors` | interface | How a persona supplies executor resolution. Either a pre-built registry (factories already |
-| `PiExecutorOutput` | interface | What one pi run reports about the terminal assistant turn, plus any derived MCP mount. |
-| `PiMcpMount` | interface | What the caller must call once pi has exited, and where the config landed. |
-| `PiMcpMountOptions` | interface | Where one worker execution's private config directory is created, and what it is called. |
-| `PiMcpPreparation` | interface | Everything `piExecutor` needs between "profile in hand" and "pi spawned". |
-| `PiMcpReceipt` | interface | What pi was actually given, as opposed to what the profile declared. This is the observable that |
 | `PipelineStage` | interface | `pipeline(stages)` — sequential composition: each stage's `Outcome.deliverable` feeds the next |
-| `PiSeam` | interface | How to launch pi in its out-of-process RPC mode, and how long to wait on it. |
 | `PriorCoordination` | interface | Coordination evidence loaded from prior processes of one durable supervised run. |
 | `ProfileRichness` | interface | Per-field verdict on one authored profile — the raw material the bench renders + scores. |
 | `ProfileRichnessThresholds` | interface | Thresholds below which a system prompt is treated as a thin stub. Tunable per call. |