build(deps): update providers and bundled Pi

[steipete]

Refresh the infrastructure provider lockfile within the current major versions: AWS 6.27.0 → 6.66.0, archive 2.7.1 → 2.8.1, and random 3.7.2 → 3.9.1. Keep provider constraints and infrastructure definitions unchanged.

Update the bundled Pi coding agent from 0.52.6 to 0.52.12, the newest patch in its existing release series. Regenerate its dependency lockfile with npm, preserve the repository's JSON formatting, and refresh both Nix hashes from successful builds.

Add validation-only CI with SHA-pinned checkout v7.0.1 and setup-opentofu v2.0.2, using OpenTofu 1.12.6. CI initializes the locked providers without a state backend and validates configuration; it cannot apply infrastructure.

A separate Nix CI job builds the bundled Pi package and executes its version/help commands. The standalone package check is documented in nix/README.md.

Validation on Crabbox Linux:

• OpenTofu 1.12.6 release archive verified against its published SHA-256 checksum.
• tofu -chdir=infra/opentofu/aws init -backend=false -upgrade downloaded and verified signed provider packages and regenerated the lockfile.
• tofu -chdir=infra/opentofu/aws validate reports Success! The configuration is valid.
• The Pi package built with the existing followed nixpkgs using the expression committed as nix/tests/pi-package.nix. Its installed pi --version returned 0.52.12, and pi --help succeeded. Both Nix hashes correspond to the final formatted lockfile.
• No AWS credentials, remote state, plan, or apply was used. The retired fleet and disabled deployment workflows remain unchanged.

Maintainer review requested from @joshp123.

Held separately: a full flake update failed nix flake check --no-build while evaluating the updated OpenClaw package (path ...-openclaw is not valid), so flake inputs remain pinned. Pi 0.73.1 crosses later pre-1.0 release series and remains outside this patch update. No runtime/engine requirement changes, releases, or deployments are included.

Independent Codex autoreview: scoped-clean through P2 for the complete candidate.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 23, 2026, 5:39 AM ET / 09:39 UTC.

ClawSweeper review

What this changes

Updates three infrastructure providers and the bundled Pi coding agent, with pinned dependency checks and a standalone Nix package check.

Regression provenance

Possible regression — suspected (reviewed change). No predecessor PR is attributed.

Merge readiness

⛔ Blocked before merge - 6 items remain

This remains useful work absent from main, but the Pi update crosses documented breaking changes and needs upgrade proof before merge.

Priority: P2
Reviewed head: 5ee19ce837c16d7d68b214e6ae23b3f28deb003c
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Useful, well-scoped packaging work has positive build evidence, but an imported compatibility regression and missing upgrade coverage block readiness.
Proof confidence	🦐 gold shrimp (3/6)	Needs stronger real behavior proof before merge: Needs real behavior proof before merge: the captured Crabbox results establish package construction, installed version/help, and OpenTofu validation, but do not exercise Pi's changed package loading or persistent-settings upgrade. Existing-state migration compatibility remains unproven. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: Needs real behavior proof before merge: the captured Crabbox results establish package construction, installed version/help, and OpenTofu validation, but do not exercise Pi's changed package loading or persistent-settings upgrade. Existing-state migration compatibility remains unproven. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	10 items	Pinned introduced change: The introduced delta updates Pi from 0.52.6 to 0.52.12 and changes seven files; infrastructure definitions and flake inputs remain unchanged. Still necessary on main: GitHub main remains at the pinned base, which packages Pi 0.52.6 and the older providers. The repository PR inventory contains no merged replacement for this update; the releases endpoint returned no releases. Dependency contract applies: The derivation downloads and installs Pi's published executable, and the existing NixOS module supplies its persistent agent settings. Consequently, Pi's package-loading and settings contracts directly affect this update.
Findings	1 actionable finding	[P1] Preserve saved Pi package sources across the version bump
Security	None	None.

How this fits together

OpenTofu providers support infrastructure provisioning, while Nix packages Pi for the operator toolchain. The new CI checks these dependencies without deploying the retired fleet.

flowchart TD
  A[Dependency locks] --> B[Validation CI]
  B --> C[OpenTofu configuration check]
  B --> D[Nix package build]
  D --> E[Bundled Pi executable]
  F[Existing Pi settings and packages] --> E
  E --> G[Operator coding workflow]

Loading

Decision needed

Question	Recommendation
Should this update adopt Pi 0.52.12's breaking configuration and extension contracts with a supported migration, or defer the Pi bump?	Adopt with an upgrade path: Retain the Pi update after documenting accepted changes, handling saved package sources, and demonstrating existing-state compatibility.

Why: A patch-version designation does not establish compatibility, and accepting the upstream contract changes requires repository-owner intent.

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: Needs real behavior proof before merge: the captured Crabbox results establish package construction, installed version/help, and OpenTofu validation, but do not exercise Pi's changed package loading or persistent-settings upgrade. Existing-state migration compatibility remains unproven. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Preserve saved Pi package sources across the version bump (P1) - For an existing installation with a saved package source such as github.com/org/repo or git@github.com:org/repo, this bump changes a previously valid Git source into a local path. Pi 0.52.12's parseGitUrl requires a git: prefix for those forms, and PackageManager.resolvePackageSources consequently stops resolving the installed Git package. The supplied settings migration does not convert package sources. Provide a supported conversion/compatibility path, or defer the bump; version/help checks cannot detect this loss of installed extensions or skills.
• Resolve merge risk (P1) - Pi also changes custom model-list semantics and extension API fields; maintainers have not explicitly accepted those upgrade impacts or defined the supported migration.
• Resolve merge risk (P1) - Fresh and existing-state Pi behavior remains unverified beyond version/help, including settings migration and loading previously installed packages.
• Complete next step (P2) - Resolve the Pi compatibility decision and add fresh/upgrade evidence to the PR body. Terminal output or redacted logs count; screenshots or recordings are welcome when they show the behavior. Redact credentials and private details. Updating the body should trigger review automatically; otherwise ask a maintainer to comment @clawsweeper re-review.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

• [P1] Preserve saved Pi package sources across the version bump — nix/tools/pi-coding-agent.nix:4-8

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Validation scope	2 jobs added; 0 deployment steps	The workflow exercises infrastructure validation and Pi packaging without reactivating the retired fleet.

Merge-risk options

Maintainer options:

1. Resolve the Pi upgrade contract (recommended)
   Obtain acceptance of the upstream breaking changes and provide a migration plus real upgrade evidence before landing the Pi bump.
2. Separate the Pi update
   Pause the Pi version change while allowing the provider and validation improvements to proceed independently.

Technical review

Best possible solution:

Ship the dependency refresh with a maintainer-approved Pi upgrade contract, preserved package loading, and demonstrated compatibility with existing settings.

Do we have a high-confidence way to reproduce the issue?

Yes, by source inspection: a saved unprefixed Git package source accepted by 0.52.6 becomes a local path in 0.52.12. No runtime reproduction was executed.

Is this the best way to solve the issue?

Unclear as submitted: the dependency and validation approach is reasonable, but the Pi upgrade needs an explicit compatibility path rather than relying on its patch-version number.

Full review comments:

• [P1] Preserve saved Pi package sources across the version bump — nix/tools/pi-coding-agent.nix:4-8
  For an existing installation with a saved package source such as github.com/org/repo or git@github.com:org/repo, this bump changes a previously valid Git source into a local path. Pi 0.52.12's parseGitUrl requires a git: prefix for those forms, and PackageManager.resolvePackageSources consequently stops resolving the installed Git package. The supplied settings migration does not convert package sources. Provide a supported conversion/compatibility path, or defer the bump; version/help checks cannot detect this loss of installed extensions or skills.
  Confidence: 0.96

Overall correctness: patch is incorrect
Overall confidence: 0.93

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 2d6a4b74197e.

Labels

Label changes:

• add P2: This is bounded dependency maintenance with upgrade concerns, without evidence of an urgent live-fleet failure.
• add merge-risk: 🚨 compatibility: The bundled Pi update changes saved package-source interpretation, custom model-list behavior, and extension contracts.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Needs real behavior proof before merge: the captured Crabbox results establish package construction, installed version/help, and OpenTofu validation, but do not exercise Pi's changed package loading or persistent-settings upgrade. Existing-state migration compatibility remains unproven. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P2: This is bounded dependency maintenance with upgrade concerns, without evidence of an urgent live-fleet failure.
• merge-risk: 🚨 compatibility: The bundled Pi update changes saved package-source interpretation, custom model-list behavior, and extension contracts.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Needs real behavior proof before merge: the captured Crabbox results establish package construction, installed version/help, and OpenTofu validation, but do not exercise Pi's changed package loading or persistent-settings upgrade. Existing-state migration compatibility remains unproven. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Pinned introduced change: The introduced delta updates Pi from 0.52.6 to 0.52.12 and changes seven files; infrastructure definitions and flake inputs remain unchanged. (nix/tools/pi-coding-agent.nix:4, 5ee19ce837c1)
• Still necessary on main: GitHub main remains at the pinned base, which packages Pi 0.52.6 and the older providers. The repository PR inventory contains no merged replacement for this update; the releases endpoint returned no releases. (nix/tools/pi-coding-agent.nix:4, 2d6a4b74197e)
• Dependency contract applies: The derivation downloads and installs Pi's published executable, and the existing NixOS module supplies its persistent agent settings. Consequently, Pi's package-loading and settings contracts directly affect this update. (nix/modules/clawdinator.nix:678, 5ee19ce837c1)
• Verified dependency identity: The npm package identifies gitHead 479eedd46fc671ce003b33ea3f577ed4d8d1fd2d and the former badlogic/pi-mono repository; GitHub resolves that repository to earendil-works/pi. (479eedd46fc6)
• Saved package-source incompatibility: Compared with Pi 0.52.6 at 5fd6542e04856c538220b2a4ef091bf8355399ba, the new parser rejects unprefixed Git shorthand. PackageManager then treats the saved source as a local path instead of resolving its installed Git package. (packages/coding-agent/src/utils/git.ts:139, 479eedd46fc6)
• Additional upgrade contracts: Upstream documents changed ContextUsage extension fields and stricter Git syntax in 0.52.10. Source comparison also confirms that custom provider model lists now merge with built-ins instead of replacing them. (packages/coding-agent/CHANGELOG.md:31, 479eedd46fc6)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Handle previously valid saved Git package sources and document the accepted Pi compatibility changes.
• Provide redacted fresh-install and upgrade output showing settings preservation and installed package loading.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.