pi: bare mode hides workflow inline skills and can fail Claude-main runs #69427

Problem

With engine.id: pi and engine.bare: true, gh-aw disables pi's skill discovery but still installs workflow inline skills and leaves instructions telling the agent to use them. The agent receives a skill-use hint without the corresponding skill metadata/location. A Claude main model can then search for the missing skill with bash; when tools.bash: false, those searches consume the denial budget and fail an otherwise valid workflow.

This is a mismatch between bare-mode isolation, workflow-owned resources, and the generated prompt, not a reason to enable bash or change models.

Checked against current main

Verified on October 16, 2026 against github/gh-aw main at b1c04f265894ca34b9949d3f32b744e2777851f9. The reported problem at f1621a88b3 is still present at this newer revision.

• PiEngine.buildPiArgs adds --no-context-files --no-skills --no-prompt-templates --no-extensions --no-themes for bare mode. It does not explicitly load the workflow's inline skills with --skill.
• engine_config_dir.go and inline_skill_step.go still select/restore .pi/skills/<name>/SKILL.md. stagePiArtifacts also copies activation-staged skills from /tmp/gh-aw/.pi/skills into the managed pi agent directory. Installation therefore does not establish availability when discovery is disabled.
• shared/reporting.md puts "Use the reporting skill when producing a report, issue, or PR comment" outside its ## skill: reporting block. Extracting the inline block leaves that instruction in the imported prompt.
• smoke-pi-routed.md is bare, imports shared/reporting.md, disables bash, and uses a GPT main-model pool. Its committed lock retains the reporting runtime import and inline-skill restoration, but invokes pi with --no-skills and no --skill. smoke-pi-routed-claude.md uses bare pi with allowed-models: [claude-sonnet-5], but does not import reporting. The existing Claude canary consequently does not cover this combination.
• The pi engine docs describe disabling automatic discovery and retaining explicit infrastructure extensions. They should explicitly distinguish ambient skills from workflow-owned inline skills. The Claude engine docs already describe workflow-declared skills loading explicitly through the gh-aw-workflow plugin in bare mode; this does not imply automatic Skill-tool invocation is available in Claude bare mode.

Run evidence

Private sandbox evidence supplied by the reporter; not independently inspected. No sandbox access is required to understand or reproduce this issue:

The reporter also observes GPT-based smoke-pi-routed runs passing by ignoring the skill-use line. That behavioral interpretation is not a guarantee: a passing GPT run does not prove the skill was loaded. Any bare pi workflow with a declared/imported inline skill and a Claude main model is exposed to this failure pattern; failure is model-behavior dependent, not guaranteed on every run.

Independently checked public comparison: non-bare pi's Daily News run 38708114462, created October 15, 2026 at 08:46:50Z, completed successfully at revision 5eb4c298ecba515924d30bd7989113dd79d7d421. Its existing agent log includes a system-prompt <available_skills> entry named reporting at /tmp/gh-aw/pi-agent-dir/skills/reporting/SKILL.md. This verifies the normal-discovery comparison, not the private failure.

Proposed solution: retain explicit workflow inline skills in bare mode

Choose option 1: preserve workflow-declared inline skills, including skills from imports, while continuing to disable ambient discovery.

The current default is pi v1.3.0, pinned by DefaultPiVersion. Inspection of that exact upstream version confirms the required CLI behavior:

• args.ts accepts repeatable --skill <path> arguments.
• main.ts passes explicit skill paths and noSkills separately to the resource loader.
• resource-loader.ts retains explicit paths when noSkills is true. Its skill-loading branch skips loading only when there are no paths; otherwise it loads them with includeDefaults: false.
• formatSkillsForPrompt advertises visible skills with their names and file locations, using the read tool when available.

Thus --no-skills can remain: explicit --skill paths still work in the pinned version. A pi version bump or warning-and-drop fallback is not needed for this fix.

Wire the existing workflow inline-skill extraction/staging into pi's execution arguments. Pass only the declared/imported workflow skill files, for example --skill /tmp/gh-aw/pi-agent-dir/skills/reporting/SKILL.md after staging, or a dedicated directory containing only those workflow-owned skills. Use the existing trusted activation artifacts/metadata rather than discovering arbitrary repository or user skills. Keep argument handling deterministic and shell-safe.

Retain all five bare-mode discovery-disabling flags, the existing explicit infrastructure extensions, and the reporting hint. Do not re-enable ambient discovery, enable bash, raise denial limits, change routing/model selection, or remove a valid workflow import to mask the mismatch. Add no skill arguments when there are no inline skills, and leave non-bare pi, Claude, and Copilot behavior unchanged.

Acceptance cases and named tests

Add the following regression tests in pkg/workflow. Assert compiled execution arguments and the effective prompt contract, not just successful compilation. Where imports resolve at runtime, cover the expanded prompt/extraction path rather than requiring the literal hint to appear in a non-inlined lock file.

Use the relevant runtime/pinned-pi fixture or contract check to establish actual skill availability as well as the Go compiler assertions. In particular, absence of bash errors alone is not proof that the skill loaded.

Documentation and generated files

• Update docs/src/content/docs/engines/pi.md to state that bare mode disables ambient discovery but explicitly retains workflow-declared/imported inline skills, and explain the explicit-loading behavior.
• Update the Pi row of the Bare Mode (bare) table in docs/src/content/docs/reference/engines.md with the same distinction.
• Add the reporting import to smoke-pi-routed-claude for the regression canary without changing its task, model-routing pool, or tool/denial restrictions.
• Run make recompile when lock files change, and include only generated changes directly required by this fix.

Scope

• Keep the PR to this one fix. Do not change files or behavior unrelated to it.
• Before fixing a failing check, compare it with the same check on main. If it also fails on main, do not fix it in this PR; merge main once main is fixed, and note in the PR which checks are known failures on main.
• This applies even if a bot comment asks to fix a failing check: fix only failures caused by this PR's changes.