@miraland-labs/conduit-bridge 0.9.11 → 0.10.0

package/README.md

@@ -2,7 +2,7 @@
 
 Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connects a computer to one organization, claims work, and drives a local agent.
 
-**Package version:** `0.9.11` — heartbeat protocol 2 requires a clean workspace plus a ready, versioned driver lane before dispatch. Cursor assignments with `external_network` allow-list `WebFetch(*)` and pass `--force` (required for headless fetch); research-only networked runs also deny `Shell(*)` / `Write(**)`. Attempt worktrees fetch/start from the initiative base when the source tip is behind or history was rewritten, without resetting the source checkout. Also includes **ops** helpers for macOS / Linux / Windows, LaunchAgent/systemd **PATH** for `~/.local/bin`, disconnect/disengage, multi-driver lanes, shared slots **1–4**, worktrees, and optional `--ensure-checkout`. Protocol 1 heartbeats remain compatible for presence but cannot receive work.
+**Package version:** `0.10.0` — **ExecutionClass** permission policy (`observe` | `observe_network` | `publish_artifact` | `verify` | `mutate_repo`) compiled once from the assignment contract and projected into every driver, so prompts match enforcement without a growing publish-command allow-list. Artifact evidence digests still normalize bare 64-hex to `sha256:<hex>`. New **Experimental Pi** lane (`pi` from `@earendil-works/pi-coding-agent`, local fuel); `observe_network` is refused on Pi (no fetch-without-bash). Heartbeat protocol 2 requires a clean workspace plus a ready, versioned driver lane before dispatch. Attempt worktrees fetch/start from the initiative base when the source tip is behind or history was rewritten, without resetting the source checkout. Also includes **ops** helpers for macOS / Linux / Windows, LaunchAgent/systemd **PATH** for `~/.local/bin`, disconnect/disengage, multi-driver lanes, shared slots **1–4**, worktrees, and optional `--ensure-checkout`. Protocol 1 heartbeats remain compatible for presence but cannot receive work.
 
 ## Prerequisites
 
@@ -12,6 +12,7 @@ Local Bridge CLI for [Conduit](https://github.com/miralandlabs/conduit). Connect
   - **Codex** — `codex`
   - **OpenCode** — `opencode`
   - **Cursor Agent** — `agent` (local fuel)
+  - **Pi** — `pi` (local fuel, Experimental; pin `@earendil-works/pi-coding-agent`)
   - **Kiro CLI** — `kiro-cli` (local fuel)
   - **Antigravity** — `agy` (local fuel)
 
@@ -77,13 +78,16 @@ repository delivery with PR/evidence and a successful rework cycle. All other la
 
 ## Grant enforcement
 
+Assignments compile to an **ExecutionClass**, then each driver projects that class:
+
 | Driver | Fuel | Mechanism |
 | --- | --- | --- |
-| `claude-code` | pump or local | `--allowedTools` / `--disallowedTools` per grant |
-| `codex` | pump or local | sandbox `read-only` / `workspace-write` |
-| `opencode` | pump or local | per-run `opencode.json` bash deny list |
-| `cursor` | local only | per-run `.cursor/cli.json` permissions |
+| `claude-code` | pump or local | `--allowedTools` / `--disallowedTools` per class |
+| `codex` | pump or local | sandbox `read-only` / `workspace-write` (+ network when class requires) |
+| `opencode` | pump or local | plan/build agent + per-run bash deny list |
+| `cursor` | local only | per-run `.cursor/cli.json` + `--force` when class needs open tools |
+| `pi` | local only | `--tools` class map (`observe_network` refused) |
 | `kiro` | local only | `--trust-tools` allowlist |
 | `antigravity` | local only | `-p --mode plan` / `accept-edits` |
 
-Cursor/Kiro/Antigravity require local fuel (`ops install` sets this for you).
+Cursor/Pi/Kiro/Antigravity require local fuel (`ops install` sets this for you).

package/dist/cli.js

@@ -131,8 +131,8 @@ async function join() {
         console.log(`Proposed roles: ${capabilities.join(", ")}`);
         console.log(`Assignments at once: ${leaseCapacity}`);
         console.log(`Fuel source: ${plannedFuel === "local" ? "local subscription" : "Conduit pump"}`
-            + (!fuelSource && plannedFuel === "local" ? " (auto: only Cursor/Kiro/Antigravity detected)" : ""));
-        console.log(`Execution drivers: ${Object.keys(DRIVERS).join(", ")} (cursor/kiro/antigravity require local fuel).`);
+            + (!fuelSource && plannedFuel === "local" ? " (auto: only local-fuel agents detected)" : ""));
+        console.log(`Execution drivers: ${Object.keys(DRIVERS).join(", ")} (cursor/pi/kiro/antigravity require local fuel).`);
         console.log("Use --machine <name> to override the computer label.\n");
         const response = await fetch(`${baseUrl}/runner/v1/connect/requests`, {
             method: "POST",
@@ -246,10 +246,10 @@ async function finishConnection(baseUrl, data, fuelSource) {
     console.log(`Confirmed capabilities (matching): ${config.capabilities.join(", ") || "none"}`);
     console.log(`Allowed actions: ${config.grants.join(", ") || "none"}`);
     console.log(`Fuel source: ${config.fuelSource === "local" ? "local subscription" : "Conduit /v1 (project owner BYOK on open orgs; org credentials on invite-only)"}`
-        + (fuelAutoLocal ? " (auto: only Cursor/Kiro/Antigravity detected)" : ""));
+        + (fuelAutoLocal ? " (auto: only local-fuel agents detected)" : ""));
     const localOnly = localFuelOnlyClients(detected);
     if (config.fuelSource === "conduit" && localOnly.length) {
-        console.log(`Note: ${localOnly.join(", ")} require local fuel per lane (set automatically for cursor/kiro/antigravity).`);
+        console.log(`Note: ${localOnly.join(", ")} require local fuel per lane (set automatically for cursor/pi/kiro/antigravity).`);
     }
     console.log("Heartbeats report capabilities for diagnostics only; matching uses the Connect confirmation. Detected clients never receive grants automatically.");
     console.log(`MCP setup: {"mcpServers":{"conduit":{"command":"npx","args":["-y","@miraland-labs/conduit-bridge","mcp"]}}}`);

package/dist/detect.js

@@ -7,6 +7,7 @@ const CLIENTS = [
     { command: "opencode", label: "OpenCode" },
     { command: "agent", label: "Cursor Agent" },
     { command: "cursor", label: "Cursor" },
+    { command: "pi", label: "Pi" },
     { command: "kiro-cli", label: "Kiro CLI" },
     { command: "agy", label: "Antigravity" },
     { command: "code", label: "Visual Studio Code" },
@@ -14,13 +15,13 @@ const CLIENTS = [
 /** Agents Conduit /v1 pump fuel can drive today. */
 const PUMP_CAPABLE_LABELS = new Set(["Claude Code", "Codex CLI", "OpenCode"]);
 /** Agents that only accept vendor login — Bridge refuses Conduit pump for these drivers. */
-const LOCAL_FUEL_ONLY_LABELS = new Set(["Cursor Agent", "Cursor", "Kiro CLI", "Antigravity"]);
+const LOCAL_FUEL_ONLY_LABELS = new Set(["Cursor Agent", "Cursor", "Pi", "Kiro CLI", "Antigravity"]);
 export function localFuelOnlyClients(detected) {
     return detected.filter((label) => LOCAL_FUEL_ONLY_LABELS.has(label));
 }
 /**
  * Default join fuel when `--fuel` is omitted.
- * Pump when any pump-capable client is present; local when only Cursor/Kiro/Antigravity are.
+ * Pump when any pump-capable client is present; local when only local-fuel agents are.
  */
 export function suggestFuelSource(detected) {
     const hasPumpCapable = detected.some((label) => PUMP_CAPABLE_LABELS.has(label));

package/dist/driver.js

@@ -3,6 +3,8 @@ import { existsSync } from "node:fs";
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { z } from "zod";
+import { deniedCommands, executionClassPromptRules, parsePiJsonl, projectClaude, projectCoarseMode, projectCodex, projectCursor, projectKiroTools, projectPi, resolveExecutionClass, } from "./execution-class.js";
+export { branchCreateCommands, deniedCommands, isBoundedVerificationCommand, prCreateCommands, resolveExecutionClass, } from "./execution-class.js";
 function deliveryLanguageRule(language) {
     if (language === "zh") {
         return "- Write every human-facing delivery packet string (outcome, changes, verification, assumptions, risks, limitations, criterion text) in Chinese (Simplified). Keep JSON keys and enum token values in English.";
@@ -45,39 +47,20 @@ export function tierForRisk(risk) {
 export function isSafeModelName(value) {
     return /^[A-Za-z0-9][A-Za-z0-9._/-]{0,99}$/.test(value);
 }
-/**
- * Shell commands each grant authorizes — one source of truth mapped per driver
- * (`Bash(cmd:*)` for Claude, `Shell(cmd)` for Cursor) so the two cannot drift.
- * rev-parse/log are read-only but required: the delivery contract reports the
- * committed head sha, so a committing agent must be able to read it.
- */
-export const branchCreateCommands = ["git status", "git diff", "git add", "git commit", "git branch", "git switch", "git rev-parse", "git log"];
-export const prCreateCommands = ["git push", "gh pr create"];
-/** Grants → Claude Code tool allow-list. Privileged grants are never mapped. */
+/** Grants → Claude Code tool allow-list (mutate_repo mapping). Privileged grants are never mapped. */
 export function claudeToolsForGrants(grants, verificationCommands = []) {
-    const tools = [];
-    if (grants.includes("repo_read"))
-        tools.push("Read", "Glob", "Grep");
-    if (grants.includes("repo_write"))
-        tools.push("Edit", "Write");
-    if (grants.includes("test_run")) {
-        tools.push(...verificationCommands.filter(isBoundedVerificationCommand).map((command) => `Bash(${command}:*)`));
-    }
-    if (grants.includes("branch_create"))
-        tools.push(...branchCreateCommands.map((command) => `Bash(${command}:*)`));
-    if (grants.includes("pr_create"))
-        tools.push(...prCreateCommands.map((command) => `Bash(${command}:*)`));
-    return tools;
+    return projectClaude("mutate_repo", { grants, verificationCommands }).allowedTools;
 }
-/** Commands no driver may ever run, regardless of grants — one source for every driver's deny list. */
-export const deniedCommands = [
-    "git merge", "git rebase", "git reset --hard", "git push --force",
-    "npm run deploy", "pnpm deploy", "yarn deploy", "wrangler deploy",
-    "kubectl", "terraform apply",
-];
 export const claudeDeniedTools = deniedCommands.map((command) => `Bash(${command}:*)`);
-function isBoundedVerificationCommand(command) {
-    return /^(npm run (verify|typecheck|lint|test|build)|pnpm (verify|typecheck|lint|test|build)|yarn (verify|typecheck|lint|test|build)|cargo (test|check)|go test(?: \.\/\.\.\.)?|make (test|check))$/.test(command);
+function resolveRunClass(input) {
+    if (input.executionClass)
+        return input.executionClass;
+    return resolveExecutionClass({
+        grants: input.grants,
+        capabilities: input.capabilities,
+        deliverable: input.deliverable,
+        workRole: input.workRole,
+    });
 }
 export function buildAssignmentPrompt(context) {
     const packageContext = context.workPackage;
@@ -90,9 +73,6 @@ export function buildAssignmentPrompt(context) {
     const changeScope = packageContext?.change_scope?.length ? packageContext.change_scope : spec.change_scope;
     const evidence = packageContext?.required_evidence?.length ? packageContext.required_evidence : spec.required_evidence;
     const rework = packageContext?.rework_feedback ?? context.reworkFeedback;
-    const labeledArtifact = (packageContext?.deliverable ?? spec.deliverable) === "artifact";
-    // Research is discovery in the delivery report — never a published content-pack artifact.
-    const artifact = labeledArtifact && role !== "research";
     const lines = [
         `You are completing one delegated Conduit assignment as the ${role} role. Work only inside the current workspace.`,
         "",
@@ -135,48 +115,22 @@ export function buildAssignmentPrompt(context) {
         lines.push("", `REWORK FEEDBACK — an independent review returned this delivery; address every point\n${rework}`);
     const mustCommit = context.grants.includes("repo_write") && context.grants.includes("branch_create");
     const mustOpenPr = mustCommit && context.grants.includes("pr_create") && Boolean(changeScope?.length);
-    // Exactly what the driver's permission contract will allow, derived from the same source, so the
-    // prompt cannot drift from the enforcement.
-    const runnableCommands = [
-        ...(context.grants.includes("test_run") ? (context.verificationCommands ?? []).filter(isBoundedVerificationCommand) : []),
-        ...(context.grants.includes("branch_create") ? branchCreateCommands : []),
-        ...(context.grants.includes("pr_create") ? prCreateCommands : []),
-    ];
-    const hasExternalNetwork = (spec.required_capabilities ?? []).includes("external_network");
+    const executionClass = context.executionClass ?? resolveExecutionClass({
+        grants: context.grants,
+        capabilities: spec.required_capabilities,
+        deliverable: packageContext?.deliverable ?? spec.deliverable,
+        workRole: role,
+    });
     const languageRule = deliveryLanguageRule(packageContext?.working_language ?? spec.working_language);
-    lines.push("", "RULES", "- Stay within the change scope and boundaries.", ...(languageRule ? [languageRule] : []), 
-    // Name the executable commands. The shell allow-list is exact, so an agent that guesses at
-    // `bash scripts/validate-pack.sh`, `python3 ...` or `echo` gets every call rejected and concludes
-    // it has no shell at all — observed twice on live Daily Signal runs, both times while the
-    // permitted commands sat unused.
-    ...(runnableCommands.length
-        ? [
-            `- These are the ONLY shell commands you may run: ${runnableCommands.join("; ")}. Anything else is rejected — do not try variations, wrappers, or \`echo\`. Run the relevant ones and report their real output.`,
-        ]
-        : ["- You have no shell authority for this assignment. Do not attempt shell commands; verify by reading files and report what you could not verify as unknown."]), 
-    // Mirror .cursor/cli.json WebFetch(*) — without naming it, agents fall back to WebSearch (not
-    // allow-listable) or invent status/title after "User Rejected" on unlisted fetches.
-    ...(hasExternalNetwork
-        ? ["- This assignment includes external_network: WebFetch is allow-listed. Use WebFetch for live HTTP status and page content; do not invent origin responses. Prefer WebFetch over WebSearch."]
-        : []), ...(mustCommit
-        ? [
-            "- Your working branch is already checked out. Commit your repository changes on the current branch (git add + git commit) — do not create a new branch — and report the resulting sha as head_commit. A delivery that changed files without a commit is rejected.",
-            ...(mustOpenPr
-                ? [
-                    "- This assignment includes pr_create: after committing, `git push -u origin HEAD` and `gh pr create` against the repository default branch, then set pull_request_url to that PR URL. Conduit merge-on-accept lands the PR when the owner Accepts — a head_commit without a PR leaves main unchanged and breaks later packages.",
-                ]
-                : ["- You may commit locally; opening a pull request is outside this assignment's grants."]),
-        ]
-        : artifact
-            ? [
-                // repo_write without branch_create: the agent may write, but the output is not repository
-                // content. `.conduit/` is already in .git/info/exclude, so this path is ignored by git and
-                // `git status` stays clean — which is the point for a content pack, and mandatory for
-                // anything binary.
-                "- This assignment delivers an artifact, not repository content. Write your output under `.conduit/artifacts/` — that path is excluded from git, so do not commit anything and do not report a head_commit.",
-                "- Publish the artifact to its destination and report each output in your evidence with the published URL and a sha256 digest. An artifact nobody can fetch is not a delivery.",
-            ]
-            : ["- You have no repository write authority for this assignment. Do not create, modify, or commit any file; a delivery reporting repository changes will be rejected. Record all findings, verification output, and conclusions in your final report instead."]), "- Never merge, deploy, force-push, push to protected branches, or touch production.", `- Hard-denied commands (all drivers): ${deniedCommands.join("; ")}.`, "- Do not invent evidence. Report unknown when you could not verify a criterion.", 
+    const classRules = executionClassPromptRules({
+        executionClass,
+        grants: context.grants,
+        verificationCommands: context.verificationCommands,
+        capabilities: spec.required_capabilities,
+        mustCommit,
+        mustOpenPr,
+    });
+    lines.push("", "RULES", "- Stay within the change scope and boundaries.", ...(languageRule ? [languageRule] : []), ...classRules, "- Never merge, deploy, force-push, push to protected branches, or touch production.", `- Hard-denied commands (all drivers): ${deniedCommands.join("; ")}.`, "- Do not invent evidence. Report unknown when you could not verify a criterion.", 
     // A met claim with nothing backing it is rejected server-side ("Met acceptance criteria require
     // mapped evidence"). Observed live: six criteria marked met, evidence mapped to four, whole
     // delivery lost. Say it here rather than let the agent discover it by failing.
@@ -222,6 +176,19 @@ export function parseAgentReport(text, acceptance) {
     }
     return { ...parsed.data, acceptance_results: parsed.data.acceptance_results.map((item) => ({ ...item, evidence_artifact_ids: [] })) };
 }
+/**
+ * Artifact publication receipts require `sha256:<64 hex>`. Agents often paste bare `shasum` output;
+ * accept that and canonicalize. Already-prefixed digests pass through (case-normalized hex).
+ */
+export function normalizeEvidenceDigest(digest) {
+    const trimmed = digest.trim();
+    const prefixed = /^sha256:([0-9a-f]{64})$/i.exec(trimmed);
+    if (prefixed)
+        return `sha256:${prefixed[1].toLowerCase()}`;
+    if (/^[0-9a-f]{64}$/i.test(trimmed))
+        return `sha256:${trimmed.toLowerCase()}`;
+    return trimmed;
+}
 /**
  * Tolerate benign agent-output noise before strict validation: drop empty/whitespace-only entries from
  * string arrays and remove empty optional scalars, so a single stray "" does not fail an otherwise-valid
@@ -251,6 +218,8 @@ function sanitizeReportShape(raw) {
             // Agents emit null/"" for optional fields they have no value for — treat as absent.
             if ("digest" in evidence && (typeof evidence.digest !== "string" || evidence.digest.trim() === ""))
                 delete evidence.digest;
+            else if (typeof evidence.digest === "string")
+                evidence.digest = normalizeEvidenceDigest(evidence.digest);
             // Drop non-URL / empty uris so an optional bad uri doesn't fail the whole report.
             if ("uri" in evidence && (typeof evidence.uri !== "string" || !z.string().url().max(4_000).safeParse(evidence.uri).success))
                 delete evidence.uri;
@@ -305,10 +274,14 @@ export const claudeCodeDriver = {
                 error: "machine set to local fuel but claude-code has no login (ANTHROPIC_* or ~/.claude)",
             };
         }
-        const tools = claudeToolsForGrants(input.grants, input.verificationCommands);
+        const executionClass = resolveRunClass(input);
+        const projected = projectClaude(executionClass, {
+            grants: input.grants,
+            verificationCommands: input.verificationCommands,
+        });
         // Fail closed: omitting --allowedTools would leave only the deny-list and
         // broaden the agent beyond the grant contract (privileged grants map to none).
-        if (!tools.length) {
+        if (!projected.allowedTools.length) {
             return {
                 status: "failed",
                 resultText: null,
@@ -321,9 +294,9 @@ export const claudeCodeDriver = {
             args.push("--model", input.model);
         if (input.resumeSessionId)
             args.push("--resume", input.resumeSessionId);
-        args.push("--allowedTools", tools.join(","));
-        args.push("--disallowedTools", claudeDeniedTools.join(","));
-        if (input.grants.includes("repo_write"))
+        args.push("--allowedTools", projected.allowedTools.join(","));
+        args.push("--disallowedTools", projected.disallowedTools.join(","));
+        if (projected.acceptEdits)
             args.push("--permission-mode", "acceptEdits");
         const { code, stdout, stderr } = await execute(input.executable ?? "claude", args, input.workspace, input.timeoutMs ?? 20 * 60_000, fuelSource === "conduit" ? input.fuel : undefined, fuelSource);
         let message = null;
@@ -351,7 +324,7 @@ export function codexSandboxForGrants(grants) {
 }
 /**
  * Codex exec arguments. The sandbox is the enforcement boundary: network stays
- * off inside workspace-write unless the canonical contract requires external_network.
+ * off inside workspace-write unless the class/capabilities require it.
  */
 export function codexExecArgs(input, sandbox) {
     // exec is non-interactive by design (no approval flag), and `exec resume`
@@ -361,7 +334,9 @@ export function codexExecArgs(input, sandbox) {
         : ["exec", "--json", "--sandbox", sandbox];
     if (input.model)
         args.push("-m", input.model);
-    if (sandbox === "workspace-write" && input.capabilities?.includes("external_network")) {
+    const networkAccess = input.networkAccess
+        ?? (sandbox === "workspace-write" && input.capabilities?.includes("external_network"));
+    if (sandbox === "workspace-write" && networkAccess) {
         args.push("-c", "sandbox_workspace_write.network_access=true");
     }
     if (input.resumeSessionId)
@@ -416,8 +391,7 @@ export const codexDriver = {
                 error: "machine set to local fuel but codex has no login (OPENAI_API_KEY / CODEX_API_KEY / ~/.codex)",
             };
         }
-        const sandbox = codexSandboxForGrants(input.grants);
-        if (!sandbox) {
+        if (!hasMappedRepoAccess(input.grants)) {
             return {
                 status: "failed",
                 resultText: null,
@@ -425,8 +399,10 @@ export const codexDriver = {
                 error: "No Bridge-mapped Codex sandbox for active grants; refusing to start agent",
             };
         }
+        const executionClass = resolveRunClass(input);
+        const projected = projectCodex(executionClass, { capabilities: input.capabilities });
         // Prompt via stdin avoids ARG_MAX limits on large assignment contracts.
-        const { code, stdout, stderr } = await execute(input.executable ?? resolveCodexExecutable(), codexExecArgs(input, sandbox), input.workspace, input.timeoutMs ?? 20 * 60_000, fuelSource === "conduit" ? input.fuel : undefined, fuelSource, input.prompt);
+        const { code, stdout, stderr } = await execute(input.executable ?? resolveCodexExecutable(), codexExecArgs({ ...input, networkAccess: projected.networkAccess }, projected.sandbox), input.workspace, input.timeoutMs ?? 20 * 60_000, fuelSource === "conduit" ? input.fuel : undefined, fuelSource, input.prompt);
         const parsed = parseCodexJsonl(stdout);
         const resultText = parsed.resultText ?? (stdout || null);
         if (code !== 0) {
@@ -436,38 +412,19 @@ export const codexDriver = {
     },
 };
 /**
- * Grants + capabilities → Cursor CLI permissions (project .cursor/cli.json).
+ * Grants + capabilities → Cursor CLI permissions via ExecutionClass.
  * Current Cursor Agent schema accepts only `permissions.{allow,deny}` (no
  * `version` / `approvalMode`). Outside the allow list is denied without --force.
  *
- * `external_network` maps to WebFetch(*) plus `--force` on the run (see
+ * `observe_network` / networked mutate / publish_artifact use `--force` (see
  * cursorRunArgs). Field evidence: allow-listing WebFetch alone still yields
- * "User Rejected" under headless `-p`; `--force` is required for fetch to
- * succeed. Because `--force` auto-allows unlisted tools, research-only
- * networked assignments also deny Shell(*) and Write(**). Codex's parallel is
- * sandbox_workspace_write.network_access=true.
+ * "User Rejected" under headless `-p`; `--force` is required for fetch and for
+ * publish shell under open class policy. Research-only networked assignments
+ * deny Shell(*) and Write(**).
  */
-export function cursorPermissionsForGrants(grants, verificationCommands = [], capabilities = []) {
-    const allow = [];
-    if (grants.includes("test_run")) {
-        allow.push(...verificationCommands.filter(isBoundedVerificationCommand).map((command) => `Shell(${command})`));
-    }
-    if (grants.includes("branch_create"))
-        allow.push(...branchCreateCommands.map((command) => `Shell(${command})`));
-    if (grants.includes("pr_create"))
-        allow.push(...prCreateCommands.map((command) => `Shell(${command})`));
-    // Cursor docs: WebFetch(domainOrPattern); WebFetch(*) auto-approves any domain.
-    if (capabilities.includes("external_network"))
-        allow.push("WebFetch(*)");
-    const deny = deniedCommands.map((command) => `Shell(${command})`);
-    // --force opens anything not denied; lock shell/write when the assignment has no mutate/shell grants.
-    if (capabilities.includes("external_network")
-        && !grants.includes("repo_write")
-        && !grants.includes("test_run")
-        && !grants.includes("branch_create")
-        && !grants.includes("pr_create")) {
-        deny.push("Shell(*)", "Write(**)");
-    }
+export function cursorPermissionsForGrants(grants, verificationCommands = [], capabilities = [], deliverable = "repository", workRole) {
+    const executionClass = resolveExecutionClass({ grants, capabilities, deliverable, workRole });
+    const { allow, deny } = projectCursor(executionClass, { grants, verificationCommands, capabilities });
     return { allow, deny };
 }
 /**
@@ -486,8 +443,13 @@ export function cursorRunArgs(input) {
     const args = ["-p", "--output-format", "json", "--workspace", input.workspace];
     if (input.trustWorkspace)
         args.push("--trust");
-    // Headless WebFetch requires --force even when WebFetch(*) is allow-listed (Cursor CLI 2026.07+).
-    if (input.capabilities?.includes("external_network"))
+    const executionClass = resolveRunClass(input);
+    const force = input.force ?? projectCursor(executionClass, {
+        grants: input.grants,
+        capabilities: input.capabilities,
+    }).force;
+    // Headless WebFetch / open publish shell require --force (Cursor CLI 2026.07+).
+    if (force)
         args.push("--force");
     if (input.model)
         args.push("--model", input.model);
@@ -566,7 +528,13 @@ export const cursorDriver = {
         // local contract instead of making either version fail every attempt worktree.
         const help = await execute(executable, ["--help"], input.workspace, 15_000, undefined, "local");
         const trustWorkspace = help.code === 0 && cursorSupportsWorkspaceTrust(`${help.stdout}\n${help.stderr}`);
-        const configured = await withCursorPermissions(input.workspace, cursorPermissionsForGrants(input.grants, input.verificationCommands, input.capabilities ?? []), () => execute(executable, cursorRunArgs({ ...input, trustWorkspace }), input.workspace, input.timeoutMs ?? 20 * 60_000, undefined, "local"));
+        const executionClass = resolveRunClass(input);
+        const projected = projectCursor(executionClass, {
+            grants: input.grants,
+            verificationCommands: input.verificationCommands,
+            capabilities: input.capabilities ?? [],
+        });
+        const configured = await withCursorPermissions(input.workspace, { allow: projected.allow, deny: projected.deny }, () => execute(executable, cursorRunArgs({ ...input, trustWorkspace, executionClass, force: projected.force }), input.workspace, input.timeoutMs ?? 20 * 60_000, undefined, "local"));
         const { code, stdout, stderr } = configured;
         const parsed = parseCursorOutput(stdout);
         if (code !== 0 || parsed.isError) {
@@ -602,10 +570,17 @@ async function withCursorPermissions(workspace, permissions, run) {
 }
 /**
  * OpenCode routes through any OpenAI/Anthropic-compatible endpoint, so it runs
- * on Conduit pump fuel or a local login. Read-only assignments use its `plan`
- * agent (no edit/bash tools); write assignments use `build`.
+ * on Conduit pump fuel or a local login. Observe classes use its `plan`
+ * agent (no edit/bash tools); write/publish/verify use `build`.
  */
-export function openCodeAgentForGrants(grants) {
+function hasMappedRepoAccess(grants) {
+    return ["repo_read", "repo_write", "test_run", "branch_create", "pr_create"].some((grant) => grants.includes(grant));
+}
+export function openCodeAgentForGrants(grants, executionClass) {
+    if (!hasMappedRepoAccess(grants))
+        return null;
+    if (executionClass)
+        return projectCoarseMode(executionClass) === "plan" ? "plan" : "build";
     if (["repo_write", "test_run", "branch_create", "pr_create"].some((grant) => grants.includes(grant)))
         return "build";
     if (grants.includes("repo_read"))
@@ -714,7 +689,8 @@ export const openCodeDriver = {
         if (fuelSource === "local" && !hasOpenCodeLogin()) {
             return { status: "failed", resultText: null, sessionId: null, error: "machine set to local fuel but opencode has no login (auth.json / provider key in ~/.local/share/opencode or ~/.config/opencode)" };
         }
-        const agent = openCodeAgentForGrants(input.grants);
+        const executionClass = resolveRunClass(input);
+        const agent = openCodeAgentForGrants(input.grants, executionClass);
         if (!agent) {
             return { status: "failed", resultText: null, sessionId: null, error: "No Bridge-mapped OpenCode agent for active grants; refusing to start agent" };
         }
@@ -738,7 +714,11 @@ export const openCodeDriver = {
  * (Antigravity-tier, not Claude-tier). Fine-grained command allowlisting would
  * need a kiro agent config file — deferred until it can be verified with a login.
  */
-export function kiroTrustedTools(grants) {
+export function kiroTrustedTools(grants, executionClass) {
+    if (!hasMappedRepoAccess(grants))
+        return [];
+    if (executionClass)
+        return projectKiroTools(executionClass);
     const tools = [];
     if (grants.includes("repo_read"))
         tools.push("fs_read");
@@ -765,7 +745,8 @@ export const kiroDriver = {
         if (fuelSource === "conduit") {
             return { status: "failed", resultText: null, sessionId: null, error: "kiro driver requires local fuel (KIRO_API_KEY or `kiro-cli login`). Run: npx @miraland-labs/conduit-bridge fuel local" };
         }
-        const trusted = kiroTrustedTools(input.grants);
+        const executionClass = resolveRunClass(input);
+        const trusted = kiroTrustedTools(input.grants, executionClass);
         if (!trusted.length) {
             return { status: "failed", resultText: null, sessionId: null, error: "No Bridge-mapped Kiro tools for active grants; refusing to start agent" };
         }
@@ -794,7 +775,11 @@ export const kiroDriver = {
  * enforcement is mode-level, not per-tool — coarser than Claude, the Cursor tier.
  * Write mode adds `--sandbox` for terminal restrictions. Output is plain text.
  */
-export function antigravityModeForGrants(grants) {
+export function antigravityModeForGrants(grants, executionClass) {
+    if (!hasMappedRepoAccess(grants))
+        return null;
+    if (executionClass)
+        return projectCoarseMode(executionClass) === "plan" ? "plan" : "accept-edits";
     if (["repo_write", "test_run", "branch_create", "pr_create"].some((grant) => grants.includes(grant)))
         return "accept-edits";
     if (grants.includes("repo_read"))
@@ -819,7 +804,8 @@ export const antigravityDriver = {
         if (!hasAntigravityLogin()) {
             return { status: "failed", resultText: null, sessionId: null, error: "antigravity has no login (set GEMINI_API_KEY or sign in with `agy`)" };
         }
-        const mode = antigravityModeForGrants(input.grants);
+        const executionClass = resolveRunClass(input);
+        const mode = antigravityModeForGrants(input.grants, executionClass);
         if (!mode) {
             return { status: "failed", resultText: null, sessionId: null, error: "No Bridge-mapped Antigravity mode for active grants; refusing to start agent" };
         }
@@ -831,12 +817,67 @@ export const antigravityDriver = {
         return { status: "completed", resultText: stdout, sessionId: null };
     },
 };
+/**
+ * Pi (`@earendil-works/pi-coding-agent`) — Experimental local-fuel lane.
+ * Class tools via `--tools`; observe_network fails closed (no fetch-without-bash).
+ */
+export function piRunArgs(input) {
+    const args = ["--mode", "json", "-p", "--no-session", "--tools", input.tools];
+    if (input.model)
+        args.push("--model", input.model);
+    args.push(input.prompt);
+    return args;
+}
+export const piDriver = {
+    name: "pi",
+    async run(input) {
+        const fuelSource = input.fuelSource === "local" ? "local" : "conduit";
+        if (fuelSource === "conduit") {
+            return {
+                status: "failed",
+                resultText: null,
+                sessionId: null,
+                error: "pi driver requires local fuel (provider API key or Pi login). Run: npx @miraland-labs/conduit-bridge fuel local",
+            };
+        }
+        if (!hasMappedRepoAccess(input.grants)) {
+            return {
+                status: "failed",
+                resultText: null,
+                sessionId: null,
+                error: "No Bridge-mapped Pi access for active grants; refusing to start agent",
+            };
+        }
+        const executionClass = resolveRunClass(input);
+        const projected = projectPi(executionClass);
+        if ("error" in projected) {
+            return { status: "failed", resultText: null, sessionId: null, error: projected.error };
+        }
+        const executable = input.executable ?? "pi";
+        const version = await execute(executable, ["--version"], input.workspace, 15_000, undefined, "local");
+        if (version.code !== 0 || !(version.stdout || version.stderr).trim()) {
+            return { status: "failed", resultText: null, sessionId: null, error: "pi preflight could not verify the installed CLI version" };
+        }
+        const { code, stdout, stderr } = await execute(executable, piRunArgs({ prompt: input.prompt, tools: projected.tools, model: input.model }), input.workspace, input.timeoutMs ?? 20 * 60_000, undefined, "local");
+        const parsed = parsePiJsonl(stdout);
+        if (code !== 0) {
+            return {
+                status: "failed",
+                resultText: parsed.resultText,
+                sessionId: parsed.sessionId,
+                error: (stderr || parsed.resultText || `pi exited with code ${code}`).slice(0, 20_000),
+            };
+        }
+        return { status: "completed", resultText: parsed.resultText, sessionId: parsed.sessionId };
+    },
+};
 /** Stable driver ids shown in Connect / CLI. Order is product preference, not exclusivity. */
 export const SUPPORTED_AGENTS = [
     { id: "claude-code", label: "Claude Code", executableHint: "claude" },
     { id: "codex", label: "Codex (ChatGPT)", executableHint: "codex" },
     { id: "cursor", label: "Cursor Agent", executableHint: "agent" },
     { id: "opencode", label: "OpenCode", executableHint: "opencode" },
+    { id: "pi", label: "Pi", executableHint: "pi" },
     { id: "kiro", label: "Kiro CLI", executableHint: "kiro-cli" },
     { id: "antigravity", label: "Antigravity (agy)", executableHint: "agy" },
 ];
@@ -845,6 +886,7 @@ export const DRIVERS = {
     codex: codexDriver,
     cursor: cursorDriver,
     opencode: openCodeDriver,
+    pi: piDriver,
     kiro: kiroDriver,
     antigravity: antigravityDriver,
 };

package/dist/drivers.js

@@ -11,10 +11,11 @@ const LABEL_TO_DRIVER = {
     OpenCode: "opencode",
     "Cursor Agent": "cursor",
     Cursor: "cursor",
+    Pi: "pi",
     "Kiro CLI": "kiro",
     Antigravity: "antigravity",
 };
-const LOCAL_FUEL_ONLY_DRIVERS = new Set(["cursor", "kiro", "antigravity"]);
+const LOCAL_FUEL_ONLY_DRIVERS = new Set(["cursor", "pi", "kiro", "antigravity"]);
 export function isSupportedDriverId(id) {
     return Object.prototype.hasOwnProperty.call(DRIVERS, id);
 }

package/dist/execution-class.js

@@ -0,0 +1,278 @@
+/**
+ * ExecutionClass — one permission policy compiled from the assignment contract,
+ * then projected into each driver. Ends per-command allow-list republish churn.
+ */
+/** Bounded verification commands a `test_run` grant may execute. */
+export function isBoundedVerificationCommand(command) {
+    return /^(npm run (verify|typecheck|lint|test|build)|pnpm (verify|typecheck|lint|test|build)|yarn (verify|typecheck|lint|test|build)|cargo (test|check)|go test(?: \.\/\.\.\.)?|make (test|check))$/.test(command);
+}
+/** Shell commands each grant authorizes — mapped per driver so they cannot drift. */
+export const branchCreateCommands = [
+    "git status", "git diff", "git add", "git commit", "git branch", "git switch", "git rev-parse", "git log",
+];
+export const prCreateCommands = ["git push", "gh pr create"];
+/** Commands no driver may ever run, regardless of grants. */
+export const deniedCommands = [
+    "git merge", "git rebase", "git reset --hard", "git push --force",
+    "npm run deploy", "pnpm deploy", "yarn deploy", "wrangler deploy",
+    "kubectl", "terraform apply",
+];
+/** Land commands denied for publish_artifact / observe* (delivery gate still enforces). */
+export const landCommands = ["git commit", "git push", "gh pr create"];
+export const EXECUTION_CLASSES = [
+    "observe",
+    "observe_network",
+    "publish_artifact",
+    "verify",
+    "mutate_repo",
+];
+export function resolveExecutionClass(input) {
+    const grants = input.grants;
+    const capabilities = input.capabilities ?? [];
+    const deliverable = input.deliverable ?? "repository";
+    const workRole = input.workRole ?? null;
+    const hasWrite = grants.includes("repo_write");
+    const hasLand = grants.includes("branch_create") || grants.includes("pr_create");
+    const hasTest = grants.includes("test_run");
+    const hasRead = grants.includes("repo_read");
+    const external = capabilities.includes("external_network");
+    if (deliverable === "artifact" && workRole !== "research" && hasWrite)
+        return "publish_artifact";
+    if (external && !hasWrite && !hasLand && !hasTest)
+        return "observe_network";
+    // verify before observe: repo_read+test_run is the usual verify shape and must keep shell.
+    if (hasTest && !hasWrite && !hasLand)
+        return "verify";
+    if (!hasWrite && !hasLand && !hasTest && (hasRead || workRole === "research"))
+        return "observe";
+    return "mutate_repo";
+}
+/**
+ * Live HTTP is a property of the assignment's capabilities, not of its class.
+ *
+ * Every surface used to enumerate classes here, and the lists disagreed: the prompt promised WebFetch
+ * whenever the capability was present, Cursor granted it only for `observe_network`/`publish_artifact`/
+ * `mutate_repo`, Claude never granted it, and Codex granted it by capability. A `verify` assignment
+ * with `external_network` was therefore told to fetch by a prompt no driver could honour. One
+ * predicate, read by all of them, is what keeps that from recurring for the next class added.
+ *
+ * `observe_network` implies the capability by construction (`resolveExecutionClass` only returns it
+ * when `external_network` is present); it stays in the test so a spec that loses its capability list
+ * in transit still fails toward the class it was stamped with.
+ */
+export function allowsExternalFetch(executionClass, capabilities = []) {
+    return executionClass === "observe_network" || capabilities.includes("external_network");
+}
+export function executionClassPromptRules(input) {
+    const { executionClass, grants, verificationCommands = [], capabilities = [], mustCommit, mustOpenPr, } = input;
+    // Derived, never passed in: a caller-supplied `artifact` flag let the prompt order a publish that
+    // the class had already denied. The class is the single source of truth for both halves.
+    const artifact = executionClass === "publish_artifact";
+    const rules = [];
+    const grantShell = [
+        ...(grants.includes("test_run") ? verificationCommands.filter(isBoundedVerificationCommand) : []),
+        ...(grants.includes("branch_create") ? branchCreateCommands : []),
+        ...(grants.includes("pr_create") ? prCreateCommands : []),
+    ];
+    if (executionClass === "publish_artifact") {
+        rules.push("- You have shell authority to write under `.conduit/artifacts/` and publish the artifact (HTTPS URL + sha256 digest). Do not invent command wrappers — publish with ordinary tools (for example gh gist, curl, shasum). Do not commit or open a pull request.");
+    }
+    else if (executionClass === "observe" || executionClass === "observe_network") {
+        rules.push("- You have no shell authority for this assignment. Do not attempt shell commands; verify by reading files and report what you could not verify as unknown.");
+    }
+    else if (grantShell.length) {
+        rules.push(`- These are the ONLY shell commands you may run: ${grantShell.join("; ")}. Anything else is rejected — do not try variations, wrappers, or \`echo\`. Run the relevant ones and report their real output.`);
+    }
+    else {
+        rules.push("- You have no shell authority for this assignment. Do not attempt shell commands; verify by reading files and report what you could not verify as unknown.");
+    }
+    if (allowsExternalFetch(executionClass, capabilities)) {
+        rules.push("- This assignment includes external_network: WebFetch is allow-listed. Use WebFetch (or the driver's live-fetch tool) for live HTTP status and page content; do not invent origin responses. Prefer WebFetch over WebSearch.");
+    }
+    if (mustCommit) {
+        rules.push("- Your working branch is already checked out. Commit your repository changes on the current branch (git add + git commit) — do not create a new branch — and report the resulting sha as head_commit. A delivery that changed files without a commit is rejected.");
+        if (mustOpenPr) {
+            rules.push("- This assignment includes pr_create: after committing, `git push -u origin HEAD` and `gh pr create` against the repository default branch, then set pull_request_url to that PR URL. Conduit merge-on-accept lands the PR when the owner Accepts — a head_commit without a PR leaves main unchanged and breaks later packages.");
+        }
+        else {
+            rules.push("- You may commit locally; opening a pull request is outside this assignment's grants.");
+        }
+    }
+    else if (artifact) {
+        rules.push("- This assignment delivers an artifact, not repository content. Write your output under `.conduit/artifacts/` — that path is excluded from git, so do not commit anything and do not report a head_commit.", "- Publish the artifact to its destination and report each output in your evidence with the published HTTPS URL and digest exactly as `sha256:` plus the 64-character hex hash (bare hex from shasum is normalized, but prefer the prefixed form). An artifact nobody can fetch is not a delivery.");
+    }
+    else if (executionClass === "mutate_repo" && grants.includes("repo_write")) {
+        // Write without land grants: tools may edit files, but commit/PR stay outside the contract.
+        rules.push("- You may create and modify files in the workspace. Do not commit or open a pull request — this assignment has no branch_create/pr_create authority. A delivery reporting head_commit or pull_request_url will be rejected.");
+    }
+    else {
+        rules.push("- You have no repository write authority for this assignment. Do not create, modify, or commit any file; a delivery reporting repository changes will be rejected. Record all findings, verification output, and conclusions in your final report instead.");
+    }
+    return rules;
+}
+export function projectCursor(executionClass, input) {
+    const grants = input.grants;
+    const verificationCommands = input.verificationCommands ?? [];
+    const capabilities = input.capabilities ?? [];
+    const deny = [
+        ...deniedCommands.map((command) => `Shell(${command})`),
+        ...((executionClass === "publish_artifact" || executionClass === "observe" || executionClass === "observe_network")
+            ? landCommands.map((command) => `Shell(${command})`)
+            : []),
+    ];
+    if (executionClass === "observe" || executionClass === "observe_network") {
+        deny.push("Shell(*)", "Write(**)");
+    }
+    const allow = [];
+    if (allowsExternalFetch(executionClass, capabilities))
+        allow.push("WebFetch(*)");
+    if (executionClass === "mutate_repo" || executionClass === "verify") {
+        if (grants.includes("test_run")) {
+            allow.push(...verificationCommands.filter(isBoundedVerificationCommand).map((command) => `Shell(${command})`));
+        }
+        if (executionClass === "mutate_repo") {
+            if (grants.includes("branch_create"))
+                allow.push(...branchCreateCommands.map((command) => `Shell(${command})`));
+            if (grants.includes("pr_create"))
+                allow.push(...prCreateCommands.map((command) => `Shell(${command})`));
+        }
+    }
+    // Headless WebFetch and the open publish shell are the two things Cursor will not do unprompted.
+    const force = allowsExternalFetch(executionClass, capabilities) || executionClass === "publish_artifact";
+    return { allow, deny, force };
+}
+export function projectClaude(executionClass, input) {
+    const grants = input.grants;
+    const verificationCommands = input.verificationCommands ?? [];
+    // allowedTools is a whitelist, so an unnamed tool is a denied tool: Claude honoured no
+    // external_network assignment at all until this was added, whatever the prompt said.
+    const fetchTools = allowsExternalFetch(executionClass, input.capabilities) ? ["WebFetch"] : [];
+    const landDeny = landCommands.map((command) => `Bash(${command}:*)`);
+    const nucleusDeny = deniedCommands.map((command) => `Bash(${command}:*)`);
+    const disallowedTools = [
+        ...nucleusDeny,
+        ...((executionClass === "publish_artifact" || executionClass === "observe" || executionClass === "observe_network")
+            ? landDeny
+            : []),
+    ];
+    if (executionClass === "observe" || executionClass === "observe_network") {
+        return { allowedTools: ["Read", "Glob", "Grep", ...fetchTools], disallowedTools, acceptEdits: false };
+    }
+    if (executionClass === "publish_artifact") {
+        return {
+            allowedTools: ["Read", "Glob", "Grep", "Edit", "Write", "Bash", ...fetchTools],
+            disallowedTools,
+            acceptEdits: true,
+        };
+    }
+    if (executionClass === "verify") {
+        return {
+            allowedTools: [
+                "Read",
+                ...verificationCommands.filter(isBoundedVerificationCommand).map((command) => `Bash(${command}:*)`),
+                ...fetchTools,
+            ],
+            disallowedTools,
+            acceptEdits: false,
+        };
+    }
+    // mutate_repo — current grant mapping
+    const tools = [];
+    if (grants.includes("repo_read"))
+        tools.push("Read", "Glob", "Grep");
+    if (grants.includes("repo_write"))
+        tools.push("Edit", "Write");
+    if (grants.includes("test_run")) {
+        tools.push(...verificationCommands.filter(isBoundedVerificationCommand).map((command) => `Bash(${command}:*)`));
+    }
+    if (grants.includes("branch_create"))
+        tools.push(...branchCreateCommands.map((command) => `Bash(${command}:*)`));
+    if (grants.includes("pr_create"))
+        tools.push(...prCreateCommands.map((command) => `Bash(${command}:*)`));
+    tools.push(...fetchTools);
+    return {
+        allowedTools: tools,
+        disallowedTools,
+        acceptEdits: grants.includes("repo_write"),
+    };
+}
+export function projectCodex(executionClass, input) {
+    const capabilities = input.capabilities ?? [];
+    const networkAccess = allowsExternalFetch(executionClass, capabilities);
+    // Read-only is the sandbox for the one class that may not write; everything else needs the
+    // workspace. Network is the shared predicate, so Codex cannot drift from Cursor and Claude again.
+    if (executionClass === "observe")
+        return { sandbox: "read-only", networkAccess };
+    return { sandbox: "workspace-write", networkAccess };
+}
+/** Coarse mode for OpenCode / Antigravity. */
+export function projectCoarseMode(executionClass) {
+    if (executionClass === "observe" || executionClass === "observe_network")
+        return "plan";
+    return "build";
+}
+export function projectKiroTools(executionClass) {
+    if (executionClass === "observe" || executionClass === "observe_network")
+        return ["fs_read"];
+    if (executionClass === "verify")
+        return ["fs_read", "execute_bash"];
+    return ["fs_read", "fs_write", "execute_bash"];
+}
+export function projectPi(executionClass) {
+    switch (executionClass) {
+        case "observe":
+            return { tools: "read,grep,find,ls" };
+        case "observe_network":
+            return {
+                error: "Pi cannot enforce observe_network; use Cursor/Codex or add OS sandbox later",
+            };
+        case "publish_artifact":
+        case "mutate_repo":
+            return { tools: "read,write,edit,bash,grep,find,ls" };
+        case "verify":
+            return { tools: "read,bash,grep,find,ls" };
+    }
+}
+/** Extract final assistant text from `pi --mode json` JSONL. */
+export function parsePiJsonl(stdout) {
+    let resultText = null;
+    let sessionId = null;
+    const texts = [];
+    for (const line of stdout.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith("{"))
+            continue;
+        let event;
+        try {
+            event = JSON.parse(trimmed);
+        }
+        catch {
+            continue;
+        }
+        const session = [event.sessionId, event.session_id].find((value) => typeof value === "string");
+        if (typeof session === "string")
+            sessionId = session;
+        if (event.type === "message_end" || event.type === "agent_end" || event.type === "assistant") {
+            const content = event.message?.content ?? event.message?.text ?? event.text ?? event.result;
+            if (typeof content === "string" && content.trim())
+                resultText = content;
+            else if (Array.isArray(content)) {
+                const joined = content
+                    .map((part) => (typeof part === "string" ? part : (part && typeof part === "object" && "text" in part ? String(part.text) : "")))
+                    .filter(Boolean)
+                    .join("\n");
+                if (joined)
+                    resultText = joined;
+            }
+        }
+        if (event.type === "text" && typeof event.text === "string")
+            texts.push(event.text);
+    }
+    if (!resultText && texts.length)
+        resultText = texts.join("\n");
+    if (!resultText && stdout.trim()) {
+        // Fall back to whole stdout so parseAgentReport can still find a fenced block.
+        resultText = stdout;
+    }
+    return { resultText, sessionId };
+}

package/dist/execution.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { z } from "zod";
 import { ConduitRequestError } from "./client.js";
 import { redactSecrets } from "./config.js";
-import { DRIVERS, agentReportTemplate, buildAssignmentPrompt, evidenceKinds, fuelEndpoint, parseAgentReport, pickModelCandidate, tierForRisk } from "./driver.js";
+import { DRIVERS, agentReportTemplate, buildAssignmentPrompt, evidenceKinds, fuelEndpoint, normalizeEvidenceDigest, parseAgentReport, pickModelCandidate, resolveExecutionClass, tierForRisk } from "./driver.js";
 import { pickDriverForClaim, resolveDriverFuel } from "./drivers.js";
 import { attemptWorktreePath, createAttemptWorktree, proveResumeWorktree, quarantineAttemptWorktree, removeAttemptWorktree, } from "./attempt-worktree.js";
 import { buildWorkspaceBrief, ensureCommitAvailable, normalizeRepositoryUrl, resolveAttemptStartCommit } from "./brief.js";
@@ -326,7 +326,32 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
     }
     // Same list the driver hands to the permission contract, so the prompt states exactly what is
     // executable rather than leaving the agent to guess and hit rejections.
-    const prompt = buildAssignmentPrompt({ taskId, objective: task.objective, spec, grants, workspace: attemptWorkspace, currentHead: worktreeStart, reworkFeedback, workPackage, verificationCommands: liveBrief?.verification ?? [] });
+    const executionClass = resolveExecutionClass({
+        grants,
+        capabilities: spec.required_capabilities,
+        deliverable,
+        workRole: workPackage?.work_role ?? spec.work_role,
+    });
+    if (typeof spec.execution_class === "string" && spec.execution_class !== executionClass) {
+        console.error(`Assignment ${taskId}: stamped execution_class=${spec.execution_class} differs from Bridge-derived ${executionClass}; using Bridge-derived class for launch`);
+    }
+    // An artifact deliverable that does not classify as publish_artifact cannot write the file it is
+    // being asked to publish, so the run is doomed before it starts. Refuse here rather than spend an
+    // agent run and fail at the delivery gate with a missing artifact and no stated cause. Reachable
+    // when a control plane older than the artifact-grant normalization dispatches such a package —
+    // exactly the window between publishing Bridge and deploying the control plane.
+    if (artifactDelivery && executionClass !== "publish_artifact") {
+        const detail = `Artifact deliverable resolved to execution class ${executionClass}, which cannot write or publish it. The work package needs the repo_write grant.`;
+        console.error(`Assignment ${taskId}: ${detail}`);
+        // Not retryable: retrying cannot add a grant, so this must reach the owner as a plan correction
+        // rather than burn attempts. Same terminal path every other launch failure uses.
+        await queueTerminal(client, taskId, {
+            action: "fail",
+            body: { error: detail, retryable: false, idempotency_key: `bridge:fail:${active.attemptId}:artifact-class` },
+        });
+        return;
+    }
+    const prompt = buildAssignmentPrompt({ taskId, objective: task.objective, spec, grants, workspace: attemptWorkspace, currentHead: worktreeStart, reworkFeedback, workPackage, verificationCommands: liveBrief?.verification ?? [], executionClass });
     const resuming = Boolean(options.forceResumeSessionId);
     await client.attemptRequest(taskId, "progress", {
         phase: "changing",
@@ -383,6 +408,9 @@ async function runClaimedAssignment(client, config, driver, workspace, brief, ta
             grants,
             capabilities: spec.required_capabilities ?? [],
             verificationCommands: liveBrief?.verification ?? [],
+            deliverable,
+            workRole: workPackage?.work_role ?? spec.work_role,
+            executionClass,
             resumeSessionId,
             timeoutMs,
             model: selection.model,
@@ -629,9 +657,9 @@ async function prepareDelivery(client, attemptId, taskId, report) {
         // Publication receipts require a digest on every acceptance artifact. Textual agent
         // evidence has no file to hash, so default to a canonical content digest of the
         // evidence itself — deterministic and verifiable against the stored metadata.
-        const digest = item.digest ?? `sha256:${createHash("sha256")
+        const digest = normalizeEvidenceDigest(item.digest ?? `sha256:${createHash("sha256")
             .update(JSON.stringify({ kind: item.kind, name: item.name, details: item.details, acceptance_criteria: item.acceptance_criteria }))
-            .digest("hex")}`;
+            .digest("hex")}`);
         const response = await client.attemptRequest(taskId, "artifacts", {
             kind: item.kind, name: item.name, uri, digest,
             metadata: { details: item.details, acceptance_criteria: item.acceptance_criteria },
@@ -666,7 +694,10 @@ export function validateDeliveryReport(report, spec, grants = []) {
         const published = report.evidence.some((item) => {
             if (!["preview", "research", "documentation"].includes(item.kind))
                 return false;
-            if (!item.uri || !item.digest || !/^sha256:[0-9a-f]{64}$/i.test(item.digest))
+            if (!item.uri || !item.digest)
+                return false;
+            const digest = normalizeEvidenceDigest(item.digest);
+            if (!/^sha256:[0-9a-f]{64}$/i.test(digest))
                 return false;
             try {
                 const protocol = new URL(item.uri).protocol;

package/dist/ops.js

@@ -11,7 +11,7 @@ import { describePreflightIssue, runBridgePreflight } from "./preflight.js";
 export const OPS_VERBS = [
     "connect", "install", "online", "offline", "status", "doctor", "disconnect", "uninstall",
 ];
-const LOCAL_FUEL_DRIVERS = new Set(["cursor", "kiro", "antigravity"]);
+const LOCAL_FUEL_DRIVERS = new Set(["cursor", "pi", "kiro", "antigravity"]);
 export function defaultOpsEnvPath(home = homedir()) {
     return join(home, ".config", "conduit", "ops.env");
 }

package/dist/preflight.js

@@ -21,6 +21,7 @@ const DRIVER_COMMAND = {
     codex: "codex",
     cursor: "agent",
     opencode: "opencode",
+    pi: "pi",
     kiro: "kiro-cli",
     antigravity: "agy",
 };
@@ -48,6 +49,9 @@ async function localAuthenticationReady(driver, workspace, run) {
         const status = await run(executableFor(driver), ["whoami"], workspace);
         return status.code === 0 && !/not logged in|not authenticated|login required/i.test(`${status.stdout}\n${status.stderr}`);
     }
+    // Pi stores provider auth in its own config; CLI has no stable whoami — version probe is enough.
+    if (driver === "pi")
+        return true;
     return false;
 }
 export async function runBridgePreflight(input, deps = {}) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@miraland-labs/conduit-bridge",
-  "version": "0.9.11",
-  "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Kiro / Antigravity agents for a Conduit organization",
+  "version": "0.10.0",
+  "description": "Conduit Bridge CLI — join, connect, disconnect, multi-driver lanes, and run Claude Code / Codex / Cursor / OpenCode / Pi / Kiro / Antigravity agents for a Conduit organization",
   "type": "module",
   "bin": {
     "conduit": "dist/cli.js"