feat(dreaming): add Pi AgentSession planning harness

[NicholaiVogel]

Summary

• adds @earendil-works/pi-coding-agent and a Pi-backed AgentSession factory using the daemon’s resolved Pi model and credentials
• makes the Refactor: make agentic dreaming and pipeline dreaming two ways of doing the same thing. #913 ingest planner route Pi providers through an AgentSession, returning only a strict plan body to the existing daemon-owned validation/apply/lease seam
• exposes capability-constrained context inspection and plan submission tools; no tool has direct database or filesystem write access

Relationship

Stacked on #946 (#913 unified ingest) because this consumes its leased context → plan → deterministic apply boundary.

Verification

• bun test platform/daemon/src/pipeline/ingest platform/daemon/src/pipeline/extraction-queue.test.ts --timeout 120000 (101 passing)
• bun run --filter @signet/daemon build (passed)

PR readiness

• Spec alignment validated (INDEX.md + dependencies.yaml)
• Agent scoping verified on all new/changed data queries
• Input/config validation and bounds checks added
• Error handling and fallback paths tested (no silent swallow)
• Security checks applied to admin/mutation endpoints
• Docs updated for API/spec/status changes
• Regression tests added for each bug fix
• Lint/typecheck/tests pass locally

No public API or spec status changed; the documentation readiness item is not applicable to this internal planning-harness change.

[aaf2tbz]

Reviewed by hand: No appearing faults or edge cases. Code looks clean and imports / exports align with their callee values and definitions / aligned functions.

[NicholaiVogel]

Requesting changes before merge.

1. platform/daemon/src/pipeline/pi-provider.ts:413 does not enforce the advertised two-tool boundary. Pi documents noTools: "builtin" as disabling only its built-in tools. Without an explicit tools allowlist and isolated resource loader, the session loads project and user Pi extensions and activates their registered tools. That lets untrusted ingest content steer extension tools after it is returned by inspect_dream_context.

2. platform/daemon/src/pipeline/ingest/planner.ts:149 drops signal, timeoutMs, and maxTokens on the AgentSession path. The normal provider call receives them. A stuck agent can block the sequential ingest worker indefinitely and ignores pause or shutdown cancellation.

Please isolate the AgentSession to the two daemon-owned tools and preserve a bounded, abortable planning call. I am preparing that correction now.

[NicholaiVogel]

Fixed in e07b33f.

• Isolated the Pi session with an explicit two-tool allowlist, no extensions/context files, and a runtime capability assertion.
• Preserved cancellation, timeout, and token limits. The router now forwards AgentSession planning for Pi-backed memory-extraction workloads and falls back to the JSON planner for non-Pi targets.
• Made malformed plans real tool errors, restored graph-operation guidance, and surfaced provider failures.

Verified with:

• bun test ./src/inference-router.test.ts ./src/pipeline/ingest/agent-planner.test.ts ./src/pipeline/ingest/planner.test.ts (20 passing)
• bun run --filter @signet/daemon build
• bunx @biomejs/biome lint on the touched files

[NicholaiVogel]

Follow-up: amended the fix as b9a69ce.

The isolated resource loader is now reloaded before AgentSession creation, so the dreaming-specific system prompt is actually installed. The real-session regression test asserts that prompt as well as the two-tool surface.

The focused suite remains 20 passing and the daemon build passes.