[feat] Gate Pi native builtins through the permission relay - #5066

Merged

mmabrouk merged 13 commits into

docs/pi-builtin-gating

Jul 5, 2026

Commits on Jul 5, 2026

docs(agent-workflows): pi-builtin-gating design workspace (relay-gated Pi builtins)
mmabrouk
committed
docs(pi-builtin-gating): address review round 1
mmabrouk
committed
docs(pi-builtin-gating): review round 2: the folder is the delivery vehicle either way
mmabrouk
committed
docs(pi-builtin-gating): fold the Codex round-2 re-review (7 fixes)
mmabrouk
committed
docs(pi-builtin-gating): Phase 0 stage-A spike PASSED; add the match projection
mmabrouk
committed
feat(runner): relay permission record + builtin identity table (pi-gating phase 1)
mmabrouk
committed
feat(runner): extension builtin gating + grant enforcement + env plumbing (pi-gating phases 2+3)
mmabrouk
committed
docs: pi-builtin-gating implemented + live-QA'd; sync the documentation pages
mmabrouk
committed
test(service): replay pin for the gated-bash paused envelope
mmabrouk
committed
feat(runner): land the shared-file hunks (pi-gating phases 1-4 completion)
mmabrouk
committed
feat(runner): land the shared-file gating hunks (phases 1-4 completion)
mmabrouk
committed
test(runner): run-plan gating cases + relay permission test alignment (phase completion)
mmabrouk
committed
docs: CodeRabbit round on the implementation PR
mmabrouk
committed