Pi attested-admission integration QA
+Date: 2026-09-02 UTC
+Live-session update: 2026-09-03 UTC, through 02:40:14
++ This report records the final proof-of-concept integration state across + Pi, OpenShell, and OpenShell Research. It contains only sanitized command + summaries: no credentials, request bodies, model output, environment + values, or local workspace paths. +
+ +Reviewed revisions
+| Repository | Integration head | Upstream base |
|---|---|---|
| Pi | 177b42723d072b7954a5b1690ccf62c97f075b37 | e266507b606b9552fa277252644054afd4384b11 |
| OpenShell | 4d7194dc8166bfafc7236e0212d2e88aee4f7231 | a6b757d35f983fe4415427484ad06533d32e9e4b |
| OpenShell Research | ff8319a69255ce0f858691095c6ea9f24d9b603f | 743839dae47621c13a3bc339bad2a2c8d0167591 |
Validation
+| Repository | Result |
|---|---|
| Pi | Focused suite passed: 38/38 after the assistant atomic-deny fix. npm run check passed its preliminary gates and reported only unchanged upstream packages/ai catalog TypeScript drift. |
| OpenShell | Passed: pre-commit, the full repository test and CI lanes, and mise run go:ci. The merged proxy-delivery end-to-end case passed; the broader Docker lane later failed a separate policy-reload case because its sandbox emitted no JSON result. |
| OpenShell Research | Passed: make check and make check-py311, 377/377 tests in each environment after the upstream merge, plus formatting, lint, typing, dependency audit, 11/11 documentation-renderer tests, the clean strict documentation build, and an HTTP 200 artifact preview. |
| Independent review | Previously reviewed Pi and OpenShell work clean: no blocker, high, or medium findings. The later proxy-delivery branch integration was validated but not independently re-reviewed when this report was updated. |
Live end-to-end result
+
+ The configured machine completed the real ./demo.sh verify
+ workflow and an extended interactive Pi session. The required verifier
+ cases passed: denied input was not written, redacted input was persisted
+ only as [REDACTED], unauthorized bridge and unattested
+ provider calls were rejected, stock Pi could not bypass attestation, and
+ an admitted tool-result replacement persisted correctly. The
+ model-dependent tool-denial case skipped because the model did not choose
+ to call Bash; this is the verifier's documented non-failing outcome.
+
Exploratory session review
+
+ The reviewed session is the persistent Pi JSONL session created at
+ 2026-09-03T01:45:53Z, ID
+ 01a064f1-a65a-7fe8-ab58-e20a67f868d7. The review used the
+ session structure and sanitized Egress Gate decision log; it did not copy
+ credentials or provider request bodies into this report.
+
| Area | Observed behavior | Finding |
|---|---|---|
| Standard Pi workflow | +One 158-entry JSONL session preserved 14 user messages, 76 assistant messages, 63 tool results, model and thinking-level changes, and one compaction event. Pi created and edited six chapter files and resumed work across repeated turns. | +Working. Persistent sessions, the normal tools, workspace writes, long-running interaction, and the standard TUI path were active. | +
| Credential isolation | +When Pi inspected every PI_* environment variable, it saw model, provider, reasoning, and session metadata but no model API key or OpenShell resolver value. |
+ Working. Proxy-delivered provider authentication kept the credential out of the agent environment. | +
| Reasoning controls | +The session began at high, changed to xhigh, and persisted 72 assistant thinking blocks. Provider usage separately reported reasoning tokens. |
+ Working as a model feature. The model produced reasoning and Pi retained it as ordinary session state. | +
| Compaction | +Pi compacted after a 69,090-token turn. The next provider request used 26,727 input tokens, then read the on-disk progress ledger and returned an accurate current story summary. | +Working. The compacted summary describes only the discarded prefix and looks stale in isolation, but firstKeptEntryId retains the Chapter 4 completion and the retained tail contains Chapters 5 and 6. |
+
| Provider failure | +Immediately after switching to xhigh, one continue submission produced four retries containing Connection error., empty content, and zero token usage. |
+ Failure, not denial. The session does not contain an HTTP status or lower-level cause, so it cannot distinguish the provider, proxy, or network source. The later request succeeded without a configuration change; correlation does not prove that xhigh caused it. |
+
| Reasoning-only completion | +The next continue request returned 810 output tokens, of which 807 were reported as reasoning. It stopped successfully with one thinking block, no visible text, and no tool call. The user had to submit write it before work continued. |
+ Usability failure. This was a provider completion accepted by Pi, not an admission denial. It should first be reproduced against the same endpoint with stock Pi before changing the integration. | +
| Denied-message audit | +All 14 user entries visible in the reviewed JSONL were persisted, but an input denied before append is intentionally absent. The content-safe Egress Gate log has request IDs but no session ID, submission ID, or timestamp that can correlate a denial to this session. | +Observability gap. Pi can prove what was appended; it cannot prove from its own history whether another submitted message was denied. The model's claim that no denial occurred was therefore stronger than its evidence. | +
| Thinking admission | +Assistant thinking is persisted, can be sent on later provider turns, and consumes context. The current append envelope and attested context omit it; only request-time policy scanning covers it when it appears on the wire. | +Security-model gap. The current proof of concept does not guarantee that all persisted or provider-visible reasoning was admitted and bound into the context attestation. | +
| Sandbox utilities | +The model attempted to use bc and file, which are absent from the image. Both Bash tool results were recorded as successful because a later command in each shell invocation exited successfully. |
+ Minor environment/diagnostic issue. It did not stop the workflow, but demonstrates that a successful tool result does not imply every command in a compound shell command succeeded. | +
Decision-log evidence and limits
+
+ Since the latest Egress Gate server-start record, the content-safe log
+ contains 80 allows and two denials with
+ reason_code=attestation_missing. It contains no middleware
+ errors and no regex-denial reason. This supports the conclusion that the
+ visible interactive failures were not middleware denials. It cannot prove
+ which session or submission produced a record because the current log
+ deliberately omits the correlation fields needed for that join.
+
Recommended follow-up
+-
+
- Add content-free denial audit metadata that can be correlated by sandbox, session, and submission without retaining the denied text or adding it to model context. +
- Bring assistant thinking inside the same append-admission and whole-context attestation contract as other persisted provider-visible content. +
- Reproduce the reasoning-only completion and the four connection retries with stock Pi against the same endpoint. Preserve standard Pi behavior unless the integration is shown to be responsible. +
- Expose enough transport error detail to distinguish an upstream/provider failure from a middleware denial without logging request content or credentials. +
Verified design boundary
++ One policy fingerprint connects append-time admission, provider-context + admission, and provider egress. The attestation binds one hash of the + complete ordered user/tool context. System/developer and assistant content + is scanned by the request policy at egress but is not included in that + hash. Denied additions do not enter Pi's live or persisted history. +
+ +Known limits
+-
+
- Image inputs are unsupported by this example and fail closed. +
- Provider-context admission precedes transport-specific history rewrites; switching transports with existing tool history or sending orphaned tool calls may fail closed. +
- Admission payloads are limited to 4 MiB and attestations expire after 300 seconds. +
- The per-exec bridge token remains in Pi process memory; a same-user process able to read that memory could copy it. +
- This is a proof of concept. Phase 2b provenance-ledger work, additional message hashing, and production deployment automation remain out of scope. +