prime-agent epic: pi-coding-agent kit ships first (sequencing note) #398

Summary

A new acq-kit, pi-coding-agent (earendil-works/pi, npm @earendil-works/pi-coding-agent), ships ahead of the in-flight prime-agent kit (#368).

Rationale

A completed consensus review picked pi specifically to validate the unprivileged/agent-owned/startup-only install pattern on a materially simpler target — no native-module postinstall step, no Python/IPython kernel bootstrap — before returning to prime-agent's heavier kernel-bootstrap complexity. This is a sequencing decision, not a replacement: the prime-agent epic (#368) remains open and unaffected.

What shipped

• integrations/isolation/acq-kits/pi-coding-agent/ — spec.yaml, README.md, and a single startup-phase install script.
• Installs via the standard npm registry path (npm install -g --ignore-scripts, pinned version, unprivileged per-user prefix, bounded fetch timeout), deliberately avoiding pi.dev's mutable curl-pipe-to-shell installer.
• Verified live on msb: fresh install, idempotent re-run, malicious version-string rejection, old-Node rejection, CA-decode-failure logging, registry-timeout bounding.

Deliberately deferred (tracked here, not silently dropped)

• USAi model-provider config (~/.pi/agent/models.json): no catalog emitter exists yet for pi's config shape (dollar-prefixed apiKey for env-var interpolation, flat contextWindow/maxTokens fields — verified against pi's own docs). A pi.mjs emitter (parallel to the existing integrations/providers/usai/emitters/prime-agent.mjs and opencode.mjs) needs to land before this kit can configure a model provider automatically. Until then, users authenticate pi manually inside the sandbox.
• Runtime egress verification: does the installed pi binary itself phone home to pi.dev (update checks, telemetry)? Not yet traced live — the kit's caps.network.allow deliberately does not include pi.dev pending that verification.

Cross-references

• Parent/related epic: Epic: ship the canonical prime-agent acq-kit on GSA-TTS #368 (prime-agent kit)
• Sibling pattern this kit follows: integrations/isolation/acq-kits/openchamber/