[pelikhan]

Summary

• Upgrade @earendil-works/pi-agent-core, @earendil-works/pi-ai, and the Pi workflow CLI to 1.2.0, with the dependency lockfile resolved in GitHub Actions.
• Upgrade repository gh-aw tooling, generated workflows, setup-action pins, maintenance files, and routing guidance from v0.91.5 to latest prerelease v0.91.9.
• Fix ShellCheck findings through the new compiler's shell generation and a meaningful Codex readiness diagnostic. Remove unsupported Codex bash: false while retaining generated shell_tool: false.
• Preserve Gemini's manual-only workflow and correct its stale schedule assertion. Keep the existing deprecated Gemini integration instead of switching to experimental Agy.

Breaking-change review

Rig uses the retained Pi Agent API, chat model lookup, and built-in Models.streamSimple streams. It does not use removed experimental harness exports, custom stream subclasses, theme schemas, before_agent_start handlers, or MCP resource counts. No adapter rewrite is necessary.

Validation

• Final CI: passed dependency install, typecheck, sample catalog, lint, all 690 unit tests (including 52 Pi tests), markdown sample typechecks, and skill validation.
• Updated Copilot setup: passed.
• All 15 agentic workflows compile with v0.91.9. ShellCheck passes all 793 generated run-step resources without suppressions.
• Pi dry-run gate passes strict/staged validation, model checks, and ShellCheck. Optional Docker scanners were not run.

Security and live-test scope

No confirmed vulnerabilities were found in the upgrade review; repository permissions, credential paths, firewall isolation, and Codex native-shell disablement remain intact. The live Pi agentic workflow was not dispatched: review evidence for the separately installed coding-agent CLI's resolved runtime dependency provenance remains incomplete. The normal Pi lock is restored; no diagnostic-only lock or temporary bootstrap workflow remains.

The existing fixed-time monthly schedule warning and Gemini deprecation notice remain; neither affects the passing Pi dry-run gate.

[github-actions]

🧠 Matt Pocock Skills Reviewer is reviewing this pull request using Matt Pocock's engineering skills...