Pi 0.81 lockstep Node rewrite (#3)

* docs: approve Pi 0.81 lockstep rewrite design

* docs: plan Pi 0.81 lockstep rewrite

* feat: rewrite for Pi 0.81 lockstep runtime

* fix: use valid OpenRouter Actions secret

* fix: pin agentic workflow cost accounting

* fix: separate GitHub App client and numeric IDs

* fix: satisfy release workflow shellcheck

* fix: keep workflow lint portable without Docker

* fix: route OpenCode review through Z.AI proxy

* fix: budget OpenCode review tool turns

* fix: serialize generated workflow validation

* fix: run workflow gates portably on Windows

* fix: skip Docker-only gh-aw lint on Windows

* fix: allow full bounded GLM runtime review

* fix: finish full bounded GLM review

* fix: submit bounded GLM review promptly

Author: srinitude

.gitattributes

@@ -31,3 +31,5 @@
 *.gz binary
 *.tgz binary
 *.lockb binary
+
+.github/workflows/*.lock.yml linguist-generated=true merge=ours

.github/aw/actions-lock.json

@@ -0,0 +1,14 @@
+{
+  "entries": {
+    "github/gh-aw-actions/setup-cli@v0.82.14": {
+      "repo": "github/gh-aw-actions/setup-cli",
+      "version": "v0.82.14",
+      "sha": "b6d1443e05b8716267fa19425b99aa4f12006b4a"
+    },
+    "github/gh-aw-actions/setup@v0.82.14": {
+      "repo": "github/gh-aw-actions/setup",
+      "version": "v0.82.14",
+      "sha": "b6d1443e05b8716267fa19425b99aa4f12006b4a"
+    }
+  }
+}

.github/scripts/patch-gh-aw-lock.mjs

@@ -0,0 +1,51 @@
+import { readFile, writeFile } from "node:fs/promises";
+
+const workflows = new URL("../workflows/", import.meta.url);
+
+async function patchCopilotByokOutput() {
+	const path = new URL("pi-upstream-lockstep.lock.yml", workflows);
+	const source = await readFile(path, "utf8");
+	const activation = source.match(/jobs:\n  activation:[\s\S]*?\n  agent:/)?.[0];
+	if (!activation) throw new Error("gh-aw activation job not found");
+	if (activation.includes("secret_verification_result:")) return;
+	const marker =
+		"      stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }}";
+	if (!activation.includes(marker)) throw new Error("gh-aw output marker not found");
+	const note = "# v0.82.14 BYOK compiler workaround; remove after upstream fixes conclusion guards.";
+	await writeFile(
+		path,
+		source.replace(marker, `${marker}\n      ${note}\n      secret_verification_result: ""`),
+	);
+}
+
+async function patchOpenCodeProvider() {
+	const path = new URL("pi-runtime-review.lock.yml", workflows);
+	const source = await readFile(path, "utf8");
+	const markers = [
+		['"autoupdate": false,', '"autoupdate": false,\n            "model": "awf-proxy/glm-5.2",'],
+		['"api": "http://172.30.0.30:10002"', '"api": "http://172.30.0.30:10000"'],
+		['"apiKey": "awf-copilot-proxy"', '"apiKey": "awf-openai-proxy"'],
+		['"claude-sonnet-4.5": {}', '"glm-5.2": {}'],
+	];
+	let patched = source;
+	for (const [oldValue, newValue] of markers) {
+		if (!patched.includes(oldValue) && !patched.includes(newValue)) {
+			throw new Error(`gh-aw OpenCode marker not found: ${oldValue}`);
+		}
+		if (!patched.includes(newValue)) patched = patched.replaceAll(oldValue, newValue);
+	}
+	await writeFile(path, patched);
+}
+
+async function patchMaintenanceChoice() {
+	const path = new URL("agentics-maintenance.yml", workflows);
+	const source = await readFile(path, "utf8");
+	if (source.includes("        default: 'none'\n        options:\n          - 'none'")) return;
+	const patched = source.replace("        default: ''\n        options:\n          - ''", "        default: 'none'\n        options:\n          - 'none'");
+	if (patched === source) throw new Error("gh-aw maintenance choice marker not found");
+	await writeFile(path, patched);
+}
+
+await patchCopilotByokOutput();
+await patchOpenCodeProvider();
+await patchMaintenanceChoice();

.github/scripts/verify-workflows.mjs

@@ -0,0 +1,48 @@
+import { spawnSync } from "node:child_process";
+import { readdir } from "node:fs/promises";
+import { resolve } from "node:path";
+
+const root = resolve(import.meta.dirname, "../..");
+const generated = [
+	".github/workflows/pi-runtime-review.lock.yml",
+	".github/workflows/pi-upstream-lockstep.lock.yml",
+	".github/workflows/agentics-maintenance.yml",
+];
+
+function result(command, args, stdio = "inherit") {
+	return spawnSync(command, args, { cwd: root, stdio, env: process.env });
+}
+
+function run(command, args) {
+	const child = result(command, args);
+	if (child.error) throw child.error;
+	if (child.status !== 0) process.exit(child.status ?? 1);
+}
+
+function canRun(command, args) {
+	const child = result(command, args, "ignore");
+	return !child.error && child.status === 0;
+}
+
+async function conventionalWorkflows() {
+	const directory = resolve(root, ".github/workflows");
+	const files = await readdir(directory);
+	return files
+		.filter((file) => file.endsWith(".yml") && !file.endsWith(".lock.yml"))
+		.map((file) => `.github/workflows/${file}`);
+}
+
+function verifyGeneratedFiles() {
+	if (canRun("git", ["diff", "--quiet", "--", ...generated])) return;
+	console.error("Compiled gh-aw workflows are stale. Run mise run workflows and commit them.");
+	run("git", ["diff", "--stat", "--", ...generated]);
+	process.exit(1);
+}
+
+run("gh-aw", ["compile", "--strict"]);
+run(process.execPath, [".github/scripts/patch-gh-aw-lock.mjs"]);
+if (process.platform !== "win32" && canRun("docker", ["info"])) run("gh-aw", ["lint"]);
+else console.log("Docker unavailable; strict gh-aw compile completed (generated lint runs on Docker-capable matrix jobs).");
+run("actionlint", await conventionalWorkflows());
+run("bun", ["test", "tests/workflows"]);
+verifyGeneratedFiles();