@wichayutdew/pi-workflows 2.6.0 → 2.7.1

package/README.md

@@ -36,6 +36,36 @@ dictating your language, framework, or delivery process.
   `reviewer`, or `scout`; customize profiles under your user workflow
   directory's `agents/` folder.
 
+## Herdr workflow status
+
+When Pi runs delegated workflow steps, the parent agent may be idle while child work continues. Pi Workflows includes a Herdr companion extension that reports workflow lifecycle state so the pane remains **working** until the workflow completes, pauses, or is interrupted.
+
+The companion is inactive unless Herdr provides `HERDR_ENV=1`, `HERDR_SOCKET_PATH`, and `HERDR_PANE_ID`. It uses Herdr's existing managed Pi reporter, so it does not create a competing pane agent.
+
+### Install from npm
+
+```bash
+pi install npm:@wichayutdew/pi-workflows
+```
+
+Start a new Pi session in Herdr, then run a workflow normally. Herdr should show the pane as working while the workflow is active and display the terminal workflow message after completion or interruption.
+
+### Reapply after a Herdr update
+
+Herdr manages `~/.pi/agent/extensions/herdr-agent-state.ts`; an integration update can replace the workflow lifecycle patch. Locate the installed package with `pi list`, change into that package directory, and run:
+
+```bash
+npm run patch:herdr
+```
+
+The script patches the managed integration at its default location. It is idempotent, so it is safe to run after every Herdr update. To patch a non-default integration path, set `HERDR_PI_EXTENSION_PATH` before running the script:
+
+```bash
+HERDR_PI_EXTENSION_PATH=/path/to/herdr-agent-state.ts npm run patch:herdr
+```
+
+Restart Pi or run `/reload` after patching. If Herdr's managed extension changes shape and the script reports an unsupported layout, do not edit it manually; update Pi Workflows or report the integration change.
+
 ## Explore
 
 - [Getting started guide](./GETTING_STARTED.md) — install Pi Workflows and

package/dist/index.js

@@ -518,6 +518,75 @@ function parseTransitions(value, path, errors) {
   }
   return transitions;
 }
+function parseArtifactContract(value, path, errors) {
+  if (value === undefined)
+    return;
+  if (!isJsonObject(value)) {
+    errors.push(`${path}: expected an object`);
+    return;
+  }
+  rejectUnknownKeys(value, [
+    "maxChars",
+    "requiredSubstrings",
+    "forbiddenSubstrings",
+    "equalOccurrenceGroups",
+    "onValidationFailure"
+  ], path, errors);
+  if (value.maxChars === undefined) {
+    errors.push(`${path}.maxChars: expected an integer from 1 to 200000`);
+  }
+  const maxChars = readInteger(value.maxChars, 200000, `${path}.maxChars`, errors, { min: 1, max: 200000 });
+  const parseSubstrings = (field) => {
+    const values = readStringList(value[field], `${path}.${field}`, errors, /.+/);
+    if (values.length > 32) {
+      errors.push(`${path}.${field}: at most 32 values are allowed`);
+    }
+    values.forEach((substring, index) => {
+      if (substring.length > 1024) {
+        errors.push(`${path}.${field}[${index}]: exceeds 1024 characters`);
+      }
+    });
+    return values;
+  };
+  const equalOccurrenceGroups = (() => {
+    if (value.equalOccurrenceGroups === undefined)
+      return [];
+    if (!Array.isArray(value.equalOccurrenceGroups)) {
+      errors.push(`${path}.equalOccurrenceGroups: expected an array`);
+      return [];
+    }
+    if (value.equalOccurrenceGroups.length > 32) {
+      errors.push(`${path}.equalOccurrenceGroups: at most 32 groups are allowed`);
+    }
+    return value.equalOccurrenceGroups.reduce((groups, group, index) => {
+      const groupPath = `${path}.equalOccurrenceGroups[${index}]`;
+      const values = readStringList(group, groupPath, errors, /.+/);
+      if (values.length < 2) {
+        errors.push(`${groupPath}: at least two values are required`);
+      }
+      if (values.length > 32) {
+        errors.push(`${groupPath}: at most 32 values are allowed`);
+      }
+      values.forEach((substring, valueIndex) => {
+        if (substring.length > 1024) {
+          errors.push(`${groupPath}[${valueIndex}]: exceeds 1024 characters`);
+        }
+      });
+      return [...groups, values];
+    }, []);
+  })();
+  const onValidationFailure = value.onValidationFailure === undefined ? undefined : readString(value.onValidationFailure, `${path}.onValidationFailure`, errors);
+  if (onValidationFailure !== undefined && onValidationFailure !== "retry") {
+    errors.push(`${path}.onValidationFailure: expected retry`);
+  }
+  return {
+    maxChars,
+    requiredSubstrings: parseSubstrings("requiredSubstrings"),
+    forbiddenSubstrings: parseSubstrings("forbiddenSubstrings"),
+    equalOccurrenceGroups,
+    ...onValidationFailure === "retry" ? { onValidationFailure } : {}
+  };
+}
 function parseGate(value, path, errors) {
   if (value === undefined)
     return;
@@ -530,7 +599,8 @@ function parseGate(value, path, errors) {
     "submitOutcome",
     "approvedOutcome",
     "rejectedOutcome",
-    "timeoutMs"
+    "timeoutMs",
+    "artifactContract"
   ], path, errors);
   const providerValue = value.provider === undefined ? "prompt" : readString(value.provider, `${path}.provider`, errors);
   const provider = providerValue === "prompt" || providerValue === "plannotator" ? providerValue : undefined;
@@ -540,6 +610,7 @@ function parseGate(value, path, errors) {
   const submitOutcome = readString(value.submitOutcome, `${path}.submitOutcome`, errors, { pattern: OUTCOME_PATTERN });
   const approvedOutcome = readString(value.approvedOutcome, `${path}.approvedOutcome`, errors, { pattern: OUTCOME_PATTERN });
   const rejectedOutcome = readString(value.rejectedOutcome, `${path}.rejectedOutcome`, errors, { pattern: OUTCOME_PATTERN });
+  const artifactContract = parseArtifactContract(value.artifactContract, `${path}.artifactContract`, errors);
   if (provider === "prompt" && value.timeoutMs !== undefined) {
     errors.push(`${path}.timeoutMs: only valid with provider "plannotator"`);
   }
@@ -553,12 +624,14 @@ function parseGate(value, path, errors) {
     provider,
     submitOutcome,
     approvedOutcome,
-    rejectedOutcome
+    rejectedOutcome,
+    ...artifactContract ? { artifactContract } : {}
   } : {
     provider,
     submitOutcome,
     approvedOutcome,
     rejectedOutcome,
+    ...artifactContract ? { artifactContract } : {},
     timeoutMs: readInteger(value.timeoutMs, 30000, `${path}.timeoutMs`, errors, { min: 1000, max: 30000 })
   };
 }
@@ -649,6 +722,9 @@ function parseWorkflowStep(value, stepId, path, errors) {
     if (Object.hasOwn(transitions, gate.submitOutcome)) {
       errors.push(`${path}.transitions: submitOutcome is handled by the gate and must not be a transition`);
     }
+    if (gate.artifactContract?.onValidationFailure === "retry" && !Object.hasOwn(transitions, "retry")) {
+      errors.push(`${path}.transitions: artifact-contract retry requires a "retry" transition`);
+    }
   }
   if (workspace) {
     workspace.bindOn.forEach((outcome) => {
@@ -1429,17 +1505,19 @@ var directWorkerCommand = (request) => [
   "--print",
   request.task
 ];
-function directWorkerResponse(request, code, signal, stderr) {
+function directWorkerResponse(request, code, signal, stderr, diagnostic) {
   const status = code === 0 ? "completed" : signal ? "cancelled" : "failed";
   return {
     requestId: request.requestId,
     agent: request.agent,
     status,
     ...code === null ? {} : { exitCode: code },
-    ...status !== "completed" && stderr.trim() ? { error: stderr.trim().slice(-4000) } : {}
+    ...status !== "completed" && stderr.trim() ? { error: stderr.trim().slice(-4000) } : {},
+    ...diagnostic ? { diagnostic } : {}
   };
 }
 var MAX_PROGRESS_DETAIL_CHARS = 480;
+var MAX_DIAGNOSTIC_CALLS = 64;
 var SECRET_KEY = /authorization|cookie|password|secret|token|api[-_]?key/i;
 function redactProgressValue(value, key = "") {
   if (SECRET_KEY.test(key))
@@ -1461,6 +1539,52 @@ function formatToolCall(toolName, args) {
   const rendered = JSON.stringify(redactProgressValue(args));
   return `call ${toolName} ${rendered}`.slice(0, MAX_PROGRESS_DETAIL_CHARS);
 }
+var createDiagnostic2 = () => ({
+  settled: false,
+  truncated: false,
+  calls: new Map
+});
+var diagnosticSnapshot = (diagnostic) => ({
+  settled: diagnostic.settled,
+  truncated: diagnostic.truncated,
+  calls: [...diagnostic.calls.values()]
+});
+var recordWorkerDiagnostic = (line, diagnostic) => {
+  let event;
+  try {
+    const parsed = JSON.parse(line);
+    if (typeof parsed !== "object" || parsed === null)
+      return;
+    event = parsed;
+  } catch {
+    return;
+  }
+  if (event.type === "agent_settled") {
+    diagnostic.settled = true;
+    return;
+  }
+  if (event.type !== "tool_execution_start" && event.type !== "tool_execution_end" || typeof event.toolName !== "string" || typeof event.toolCallId !== "string") {
+    return;
+  }
+  if (!diagnostic.calls.has(event.toolCallId)) {
+    if (diagnostic.calls.size >= MAX_DIAGNOSTIC_CALLS) {
+      diagnostic.truncated = true;
+      return;
+    }
+    diagnostic.calls.set(event.toolCallId, {
+      id: event.toolCallId,
+      name: event.toolName,
+      state: "started"
+    });
+  }
+  if (event.type === "tool_execution_end") {
+    diagnostic.calls.set(event.toolCallId, {
+      id: event.toolCallId,
+      name: event.toolName,
+      state: event.isError === false ? "completed" : "failed"
+    });
+  }
+};
 function workerProgressFromJsonLine(line, requestId, toolCount, responseText = "") {
   let event;
   try {
@@ -1533,6 +1657,7 @@ function createSubagentDelegationClient(spawnWorker = spawn) {
       let stdoutBuffer = "";
       let toolCount = 0;
       let responseText = "";
+      const diagnostic = createDiagnostic2();
       const stdoutDecoder = new StringDecoder("utf8");
       const consumeWorkerLines = () => {
         while (true) {
@@ -1542,6 +1667,7 @@ function createSubagentDelegationClient(spawnWorker = spawn) {
             return;
           const line = stdoutBuffer.slice(0, newline);
           stdoutBuffer = stdoutBuffer.slice(newline + 1);
+          recordWorkerDiagnostic(line, diagnostic);
           const progress = workerProgressFromJsonLine(line, request.requestId, toolCount, responseText);
           toolCount = progress.toolCount;
           responseText = progress.responseText;
@@ -1572,7 +1698,7 @@ function createSubagentDelegationClient(spawnWorker = spawn) {
         if (active?.process === child)
           active = undefined;
         options.signal?.removeEventListener("abort", abort);
-        resolve3(directWorkerResponse(request, code, signal, stderr));
+        resolve3(directWorkerResponse(request, code, signal, stderr, diagnosticSnapshot(diagnostic)));
       });
     });
   };
@@ -1595,19 +1721,6 @@ function createSubagentDelegationClient(spawnWorker = spawn) {
   };
 }
 
-class SubagentDelegationClient {
-  #client = createSubagentDelegationClient();
-  get activeRequestId() {
-    return this.#client.activeRequestId;
-  }
-  delegate(request, options) {
-    return this.#client.delegate(request, options);
-  }
-  cancelActiveAndWait(waitMs) {
-    return this.#client.cancelActiveAndWait(waitMs);
-  }
-}
-
 // src/policy/completion-batch.ts
 var isRecord3 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var toolCalls = (message) => {
@@ -4005,6 +4118,13 @@ function workflowStatusSnapshot() {
 }
 function updateStatus() {
   refreshStatusWhileRunning.call(this);
+  const run = this.run;
+  this.pi.events.emit("pi-workflows:state", {
+    state: run?.status === "running" ? "working" : run?.status === "awaiting-gate" || run?.status === "paused" ? "blocked" : run?.status === "completed" ? "completed" : "interrupted",
+    workflowId: run?.workflowId,
+    stepId: run?.currentStepId,
+    message: run?.status === "completed" ? `Workflow "${run.workflowId}" completed` : run?.status === "paused" ? run.pauseReason : undefined
+  });
   if (!this.latestContext)
     return;
   if (this.legacyProgressWidgetContext !== this.latestContext) {
@@ -6493,6 +6613,26 @@ function createStepExecutionActions() {
   };
 }
 
+// src/integrations/subagents/diagnostics.ts
+var READ_ONLY_TOOLS = new Set([
+  "read",
+  "ls",
+  "grep",
+  "structured_output"
+]);
+var classifyRecoverySafety = (diagnostic) => {
+  if (!diagnostic || !diagnostic.settled || diagnostic.truncated) {
+    return "incomplete";
+  }
+  if (diagnostic.calls.some((call) => call.state !== "completed" || !READ_ONLY_TOOLS.has(call.name))) {
+    return "unsafe";
+  }
+  return "read-only";
+};
+
+// src/harness/delegation-recovery.ts
+var shouldRetryMissingCompletion = (diagnostic, subagentAttemptCount) => subagentAttemptCount === 1 && classifyRecoverySafety(diagnostic) === "read-only";
+
 // src/harness/delegation-response-actions.ts
 function hasErrorCode(error, code) {
   return error instanceof Error && "code" in error && error.code === code;
@@ -6568,7 +6708,15 @@ async function finishDelegation(active, response) {
       serializedResult = await this.dependencies.readDelegatedResult(active);
     } catch (error) {
       if (hasErrorCode(error, "ENOENT")) {
-        throw new Error(`Subagent "${active.agent}" completed without producing the required correlated structured_output result`, { cause: error });
+        const subagentAttemptCount = this.run.currentStepAttempts?.filter((attempt) => attempt.kind === "subagent").length ?? 0;
+        if (shouldRetryMissingCompletion(response.diagnostic, subagentAttemptCount)) {
+          cleanupAttempted = true;
+          await this.cleanupDelegation(active);
+          this.launchCurrentStep(workflow);
+          return;
+        }
+        const diagnosticState = response.diagnostic ? `settled=${response.diagnostic.settled}, truncated=${response.diagnostic.truncated}, calls=${response.diagnostic.calls.length}` : "unavailable";
+        throw new Error(`Subagent "${active.agent}" completed without producing the required correlated structured_output result (request ${active.requestId}; diagnostic ${diagnosticState})`, { cause: error });
       }
       throw error;
     }
@@ -6700,6 +6848,44 @@ function createDelegationControlActions() {
   };
 }
 
+// src/harness/artifact-contract.ts
+function countOccurrences(value, substring) {
+  let count = 0;
+  let offset = 0;
+  while (true) {
+    const match = value.indexOf(substring, offset);
+    if (match === -1)
+      return count;
+    count += 1;
+    offset = match + substring.length;
+  }
+}
+function validateArtifactContract(artifact, contract) {
+  if (!contract)
+    return;
+  if (artifact.length > contract.maxChars) {
+    return `gate artifact exceeds ${contract.maxChars} characters`;
+  }
+  const required = contract.requiredSubstrings.find((substring) => !artifact.includes(substring));
+  if (required) {
+    return `gate artifact is missing required text: ${JSON.stringify(required)}`;
+  }
+  const forbidden = contract.forbiddenSubstrings.find((substring) => artifact.includes(substring));
+  if (forbidden) {
+    return `gate artifact contains forbidden text: ${JSON.stringify(forbidden)}`;
+  }
+  for (const group of contract.equalOccurrenceGroups) {
+    const counts = group.map((substring) => countOccurrences(artifact, substring));
+    if (counts.some((count) => count === 0)) {
+      return `gate artifact is missing required repeated text: ${JSON.stringify(group)}`;
+    }
+    if (!counts.every((count) => count === counts[0])) {
+      return `gate artifact has unequal repeated text counts: ${JSON.stringify(group)}`;
+    }
+  }
+  return;
+}
+
 // src/harness/gate-submission-action.ts
 function isCurrentGateRequest(run, originalRun, requestId) {
   return run !== undefined && run.runId === originalRun.runId && run.currentStepId === originalRun.currentStepId && run.pendingGate?.requestId === requestId && run.pendingGate.reviewId === undefined && (run.status === "awaiting-gate" || run.status === "paused");
@@ -6710,6 +6896,22 @@ async function submitGate(workflow, originalRun, outcome, summary, artifact) {
   const step = workflow.definition.steps[originalRun.currentStepId];
   if (!step?.gate)
     throw new Error("Current step has no gate");
+  const contractError = validateArtifactContract(artifact, step.gate.artifactContract);
+  if (contractError) {
+    if (step.gate.artifactContract?.onValidationFailure !== "retry") {
+      throw new Error(contractError);
+    }
+    const retrySummary = `Artifact contract failed: ${contractError}`;
+    this.run = advanceRun(workflow, originalRun, "retry", retrySummary, this.dependencies.now());
+    this.persist();
+    this.updateStatus();
+    this.settleAfterTransition(workflow, {
+      stepId: originalRun.currentStepId,
+      outcome: "retry",
+      summary: retrySummary
+    });
+    return;
+  }
   this.run = beginGate(workflow, originalRun, outcome, artifact, requestId, this.dependencies.now(), summary);
   this.persist();
   this.restoreBaselineTools();
@@ -7397,6 +7599,24 @@ var DEFAULT_CHILD_RUNTIME_DEPENDENCIES = {
   tokensAreEqual
 };
 
+// src/integrations/subagents/child-runtime-repair.ts
+var COMPLETION_REPAIR_PROMPT = [
+  "The delegated step settled without its required correlated result.",
+  "Do not repeat completed work and do not execute work tools.",
+  "Call `structured_output` exactly once, alone, with one configured outcome and the required summary, artifact, and workspace fields."
+].join(`
+`);
+var needsCompletionRepair = ({
+  policy,
+  dependencies
+}) => {
+  try {
+    return !dependencies.fileSystem.exists(policy.resultPath);
+  } catch {
+    return false;
+  }
+};
+
 // src/integrations/subagents/child-runtime-files.ts
 var verifyChildWorkingDirectory = (policy, dependencies) => {
   let expected;
@@ -7494,7 +7714,8 @@ var INITIAL_STATE = {
   activePolicy: undefined,
   policyError: undefined,
   invalidCompletionCalls: new Set,
-  effectiveTools: new Set
+  effectiveTools: new Set,
+  repairRequested: false
 };
 var errorMessage2 = (error) => error instanceof Error ? error.message : String(error);
 var invalidPolicyInput = (pi, policyError, images) => {
@@ -7560,7 +7781,8 @@ var registerSubagentChildRuntime = (pi, options = {}) => {
         ...state,
         activePolicy: extracted.policy,
         policyError: undefined,
-        effectiveTools
+        effectiveTools,
+        repairRequested: false
       };
     } catch (error) {
       const policyError = errorMessage2(error);
@@ -7593,6 +7815,19 @@ ${childSystemPrompt(state.activePolicy)}`
   pi.on("turn_start", () => {
     state = { ...state, invalidCompletionCalls: new Set };
   });
+  pi.on("agent_settled", () => {
+    const policy = state.activePolicy;
+    if (!policy || state.repairRequested || !needsCompletionRepair({ policy, dependencies })) {
+      return;
+    }
+    state = {
+      ...state,
+      repairRequested: true,
+      effectiveTools: new Set([CHILD_COMPLETION_TOOL])
+    };
+    pi.setActiveTools([CHILD_COMPLETION_TOOL]);
+    pi.sendUserMessage(COMPLETION_REPAIR_PROMPT, { deliverAs: "followUp" });
+  });
   pi.on("message_end", (event) => {
     if (!state.activePolicy)
       return;
@@ -7696,6 +7931,6 @@ function createPiWorkflowsExtension(dependencies) {
 var piWorkflowsExtension = createPiWorkflowsExtension(DEFAULT_DEPENDENCIES4);
 var src_default = piWorkflowsExtension;
 export {
-  src_default as default,
-  createPiWorkflowsExtension
+  createPiWorkflowsExtension,
+  src_default as default
 };

package/examples/starter-kit/agents/planner.md

@@ -1,3 +1,7 @@
+---
+thinking: high
+---
+
 You are the planning role for one workflow step.
 
 Stay within the step's declared permissions. Establish facts before conclusions,

package/examples/starter-kit/agents/reviewer.md

@@ -1,3 +1,7 @@
+---
+thinking: xhigh
+---
+
 You are the independent review role for one workflow step.
 
 Remain read-only unless the step explicitly grants a different authority.

package/examples/starter-kit/agents/scout.md

@@ -1,3 +1,7 @@
+---
+thinking: medium
+---
+
 You are the investigation role for one workflow step.
 
 Stay read-only. Gather the smallest set of decisive evidence, distinguish facts

package/examples/starter-kit/agents/worker.md

@@ -1,3 +1,7 @@
+---
+thinking: high
+---
+
 You are the implementation role for one workflow step.
 
 Treat the approved workflow artifact and declared permissions as the complete

package/examples/starter-kit/agents/workspace-preparer.md

@@ -1,3 +1,7 @@
+---
+thinking: low
+---
+
 You are the workspace preparation role for one workflow step.
 
 Inspect the current repository state before mutation. Create or reuse only the

package/examples/starter-kit/investigate.workflow.yaml

@@ -1,7 +1,7 @@
 version: 1
 id: investigate
 command: investigate
-description: Derive, approve, investigate, and independently validate an evidence-backed finding
+description: 'Derive, approve, investigate, and independently validate an evidence-backed finding. Example: /investigate PROJ-123 Root cause of elevated 500 error rates in checkout service'
 start: retrieve
 maxStepVisits: 12
 summaryMaxChars: 30000
@@ -12,48 +12,30 @@ steps:
       file: steps/investigate/retrieve.md
     agent: scout
     permissions:
-      tools: [read, ls, bash]
-      mcp: &jira-read-mcp
-        - atlassian/atlassian_getAccessibleAtlassianResources
-        - atlassian/atlassian_getJiraIssue
-        - atlassian/atlassian_getJiraIssueRemoteIssueLinks
-        - atlassian/atlassian_searchJiraIssuesUsingJql
-      extensions: [pi-web-tools]
-      skills: &retrieve-skills [caveman, coding-standards, brainstorming]
+      tools: [read, ls, bash, mcp]
+      mcp: [atlassian, context7, sourcegraph, glean, grafana]
+      extensions: [/]
+      skills: [jira-ticket, start-triage, search-code-sourcegraph, caveman]
       bash:
-        mode: allow-list
-        allow: &inspection-bash
-          - executable: grep
-          - executable: head
-          - executable: ls
-          - executable: pwd
-          - executable: rg
-          - executable: stat
-          - executable: tail
-          - executable: wc
-          - executable: git
-            argsPrefixes:
-              [
-                [status],
-                [diff],
-                [grep],
-                [log],
-                [ls-files],
-                [rev-parse],
-                [show],
-                [merge-base],
-                [rev-list],
-                [worktree, list],
-              ]
-    requires:
-      tools: [read, ls, bash]
-      skills: *retrieve-skills
+        mode: unrestricted
     gate:
       provider: plannotator
       submitOutcome: submit
       approvedOutcome: approved
       rejectedOutcome: changes-requested
       timeoutMs: 30000
+      artifactContract:
+        maxChars: 6000
+        requiredSubstrings:
+          - '## Brief description'
+          - '## Goals'
+          - '## Boundaries'
+          - '## Evidence & sources'
+          - '## Report destination'
+          - '## Open evidence gaps'
+        forbiddenSubstrings:
+          - 'The complete gate artifact is the exact Markdown saved at'
+        onValidationFailure: retry
     transitions:
       approved: investigate
       changes-requested: retrieve
@@ -65,23 +47,20 @@ steps:
       file: steps/investigate/investigate.md
     agent: worker
     permissions:
-      tools: [read, ls, bash, edit, write]
-      mcp: &investigation-mcp
-        - atlassian
-        - gitlab
-        - glean
-        - superset
-        - sourcegraph
-        - context7/resolve-library-id
-        - context7/query-docs
-        - gh_grep/searchGitHub
-      extensions: [pi-web-tools]
-      skills: &investigation-skills [caveman, coding-standards]
+      tools: [read, ls, bash, write, mcp]
+      mcp: [atlassian, context7, sourcegraph, glean, grafana, gitlab]
+      extensions: [/]
+      skills:
+        [
+          coding-standards,
+          systematic-debugging,
+          start-triage,
+          grafana-logs,
+          search-code-sourcegraph,
+          caveman,
+        ]
       bash:
         mode: unrestricted
-    requires:
-      tools: [read, ls, bash, edit, write]
-      skills: *investigation-skills
     transitions:
       ready: validate
       retry: investigate
@@ -92,21 +71,12 @@ steps:
       file: steps/investigate/validate.md
     agent: reviewer
     permissions:
-      tools: [read, ls, bash]
-      mcp: *investigation-mcp
-      extensions: [pi-web-tools]
-      skills:
-        &validation-skills [
-          caveman,
-          coding-standards,
-          systematic-debugging,
-          verification-before-completion,
-        ]
+      tools: [read, ls, bash, mcp]
+      mcp: [atlassian, sourcegraph, glean, gitlab]
+      extensions: [/]
+      skills: [verification-before-completion, caveman]
       bash:
         mode: unrestricted
-    requires:
-      tools: [read, ls, bash]
-      skills: *validation-skills
     transitions:
       approved: $done
       gaps: investigate