feat(pi): configure nix-managed agent environment

[cameronraysmith]

No description provided.

[github-actions]

Triggered from #2725 by @​cameronraysmith.

Checking if we can fast forward main (8acee4e) to configure-pi-agent-environment (8bfc09d).

Target branch (main):

commit 8acee4e34a6d38866902bf904d6e7b4cc93ec946 (HEAD -> main, origin/main)
Author: Cameron Smith <cameron.ray.smith@gmail.com>
Date:   Sun Aug 16 15:25:38 2026 -0400

    test(pkgs/atomic): exercise the launcher against the finished store path
    
    doInstallCheck runs against $out while it is still being built and still
    writable. The split launcher's whole failure mode is resolving its sidecar
    payload relative to its own execPath, so the condition worth testing is the
    finished, read-only store path.
    
    passthru.tests.help runs the installed wrapper there and asserts three
    ANSI-free strings from the help banner, which is output only reachable
    through app.js; the launcher answers --version without importing it.
    modules/checks/package-tests.nix turns this into package-atomic-test-help on
    every system in the platform map.
    
    Verified severe by replacing an assertion with a pattern the help output does
    not contain and confirming the check fails.

Pull request (configure-pi-agent-environment):

commit 8bfc09d840cd6798e6f2bd8298b34944fd8793ef (pull_request/configure-pi-agent-environment)
Author: Cameron Smith <cameron.ray.smith@gmail.com>
Date:   Sun Aug 16 17:31:37 2026 -0400

    chore(pi-agent-extensions): add meta, correct version, drop dead code
    
    Add the meta block this package was the only mkDerivation-based by-name
    entry point to lack.
    The MIT license and the homepage are read from LICENSE and package.json
    at the pinned rev, sourceProvenance is fromSource because the install
    phase copies the upstream tree and rejects prebuilt node_modules, and
    mainProgram and changelog are omitted because upstream publishes
    neither.
    
    Replace the rev-valued version with the RFC-0107 unstable form derived
    from package.json's 0.1.0 and the pinned commit's 2026-07-28 committer
    date; upstream carries no tags.
    The structural check reads the package through lib.getName, so the
    derivation name change leaves its extensionPackageName oracle intact.
    
    Drop findutils, whose find already reaches the builder unconditionally
    through stdenv's initialPath, and drop the output node_modules scan,
    which cannot fire: the source scan clears the same tree that cp -R
    copies, and dontBuild leaves nothing between them that could introduce a
    directory.
    The source scan stays, since it is the assertion about the pinned
    upstream tree.

Can't fast forward main (8acee4e) to configure-pi-agent-environment (8bfc09d). main (8acee4e) is not a direct ancestor of configure-pi-agent-environment (8bfc09d). Branches appear to have diverged at e3c862d:

* 8bfc09d840cd6798e6f2bd8298b34944fd8793ef chore(pi-agent-extensions): add meta, correct version, drop dead code
* c76b08b270051910cad7a0236830f031380bc1c0 docs(pi): record the at-prefix strip and the empty-field control
* b0dbe66d680a1d0dfdbf26d518a661745940ee01 docs(pi): relocate module comments and record theme provenance
* 3f1b25694e3177e6594cc53faa2d96420d7cbf51 docs(pi): add the check file header and rationale comments
* 9f09dedfeb2f4a4d351f8ea860a6218608906fd2 test(pi): harden resource kind, wip reason, and rules discovery
* 9d5bc81fd6587c958a590e55f62a9f71fa7a3484 test(pi): tighten compaction, skill sink, and stale-version assertions
* 15ed59509ea7b70f801ee3ed4dfa55149033ae68 refactor(pi): one encoding for conditional path emission
* 6ea78fca0b75549f3b388f13020b3b755e6447f4 refactor(pi): delete dead bindings and subsumed disjuncts
* 2fdb1bc8434ec7f763592e24d867cb154f15458e test(pi): typecheck the policy harness
* 237bcd582d222cccd9f80e8efaba9e3a158a1056 test(pi): lower smoke eval-time throws into build-time guards
* 084591b73ca969e0c162f3fa9686d153bb7a7e6b refactor(pi): hoist the shared runtime-state probes
* ad861c63485000ebe6d7e5f2bace13718b662f56 refactor(pi): give shellCases row constructors and group comments
* 2b93917c1da41afb025ca9e350089fb03ee9b25a refactor(pi): collapse the repository case tables
* 6ac0eedb0d61aefa588e8c7e7fe9dec5693d8244 refactor(pi): extract the jj probe prefix and drop write-only fields
* 0b2a8d4b842e099bda30257278678837f57e7612 refactor(pi): extract the shared HTTP-client argv walker
* d8874f7f6858a844b5478e9ddfde76c792523cd7 test(pi): bind the structural oracle to the deployed policy sources
* cbb23e2830cf154840632db03622d1814893b8de test(pi): drive headless cases through the pinned gate handler
* b6000e59c59d0df04a8fd54c3ca1cd69aa0efac2 test(pi): cover colocated jj and git repository identity
* 94b69eed02ca6d3ca6ad1bb98217259efac2757e test(pi): make jj scenario fixtures a table, assert the Nix-to-TypeScript join
* d081819673c497e0176d73d05079bec838ddadc5 test(pi): fail unrecognized policy case kinds
* e7e1ee1103fd9be7d4bdcc48ec2a2fefce85acae fix(pi): regenerate jj command inventory, model informational globals
* 6f040c574e2dd3c1883e123bcdd19b108f43986b fix(pi): treat a curl request body as mutating regardless of -X
* c1799f1d2fd358a7731591f9886b1a2f15ac64ec fix(pi): block pi config package mutation
* 5575b059eb42552d21cb8bac6122c89adfd4fb75 test(pi): redesign aggregate smoke check
* 75a20b161ffd390c6b9314bb8bf743cc693b841a docs(openspec): archive pi agent environment
* 85cd4ebc26fe6906aa12130c2648a1a21516b779 docs(openspec): sync pi agent environment spec
* a6e1f4280f4c88d339648bb281f37c0b1fa64d4c docs(openspec): reflect on pi agent environment
* 99c32bab9a7c646ef0db6c5a1d9e1d062d2bf679 docs(openspec): verify pi agent environment
* d10d29756db7344b9a5b057e6bbce929bdd06ddb test(pi): verify remediated live policy
* 93db7d568af49becb7fa4eeb4961d1a9d72f8a76 fix(pi): honor curl get negation order
* 7f2550782accdffa0c08428d8c4db19c61e5892c fix(pi): preserve recognized shell reads
* 0956a95614cd53cc62564959d0c811370ea950d3 fix(pi): fail closed on unclassified shell mutations
* 45a8d153fc3e03af9243dc6b4d4e8f472698431d test(pi): verify activated environment
* 8dc8e67a3ca69a3712b31a5ade46a3c96ecd5055 docs(pi): record Darwin rollback generation
* 18a9127423be61b063b778421d482c268afd3da9 test(pi): verify pre-activation environment
* fc27885b7073311c60853b96fcab235366c0f6a7 test(pi): verify aggregate agent startup
* c2eb12bc093610a88be7df749929b286a309c21f fix(pi): model jj development join correctly
* bb558848e392b18513c745f7dcbe7f0a7a33c9a7 feat(pi): enforce agent safety policy
* 7a7be1c138038e064cca458c5f997d528bb4c03e feat(pi): compose exact resources and theme
* 11ac4eaf1b5529bb7df98eac913af440d2b67c4c feat(pi): package selected extensions
* b86e617febb4dca0d19ded023961cee630a44341 docs(pi): plan nix managed environment
| * 8acee4e34a6d38866902bf904d6e7b4cc93ec946 test(pkgs/atomic): exercise the launcher against the finished store path
| * 2bf3cd65888dd3a630184047887d8b6f247f0788 fix(pkgs/atomic): keep the postgres symlink hydration idempotent
| * 6c84d6dfeec800ffcafb1cd6058a4ac097247e75 feat(apps): expose the atomic update script as a flake app
| * 98adbdffd116569a641a83614dcd3f9fb197ff13 feat(pkgs): package the atomic coding agent from its release tarball
|/  
* e3c862d3e408cff108a945c84cd4d4a5141d52c4 chore(quota-axi): bump to 0.1.28 via the package updater

commit e3c862d3e408cff108a945c84cd4d4a5141d52c4
Author: Cameron Smith <cameron.ray.smith@gmail.com>
Date:   Sun Aug 16 13:55:51 2026 -0400

    chore(quota-axi): bump to 0.1.28 via the package updater
    
    Firstmate's quota-axi floor is FM_QUOTA_AXI_MIN=0.1.25 (bin/fm-quota-axi-lib.sh
    in the firstmate home); the pin at 0.1.17 sat below it, so firstmate reported
    the tool as unusable. The npm registry latest is 0.1.28, which clears the floor.
    
    Version, src hash, npmDepsHash, and the package-lock.json sidecar were all
    regenerated by pkgs/by-name/quota-axi/update.sh rather than hand-edited. The
    registry-tarball sourcing is unchanged: the GitHub repo carries a
    pnpm-lock.yaml buildNpmPackage cannot read.
    
    `just update-package quota-axi` does not work for the axi-family updaters: the
    recipe runs the script from its /nix/store path, and the script derives both
    its package directory and the npm package name from BASH_SOURCE, so it looks
    for /nix/store/package.nix and fails. Ran ./update.sh from the package
    directory instead. All five axi update.sh copies share this property.
    
    Checks run, chosen as the narrowest set that would fail if this bump were
    wrong: checks.aarch64-darwin.package-quota-axi (builds the derivation the diff
    edits), .treefmt (the two edited files are formatted sources), and
    .home-manager-crs58 (the sole consumer, via the ai aggregate in
    modules/home/ai/firstmate) whose home-path/bin/quota-axi reports 0.1.28. The
    rest of the check set is unrelated to this package and was left out.

Rebase locally, and then force push to configure-pi-agent-environment.