Pi is the smallest complete agent of the six. It ships seven tools — read, bash, edit, write, grep, find, ls — and only turns on four of them by default. There is no MCP, no sandbox, no permission prompt, no subagent system, no web UI. That is not an omission; it is the thesis.
Everything a competitor ships as a subsystem, Pi ships as an example extension. Permission gates, sandboxing, subagent delegation, todo lists, plan mode and git checkpoints all live in examples/extensions/ — about 75 worked programs, including a Doom overlay used as a TUI stress test. The product surface is the extension API: 34 lifecycle hooks, including ones that rewrite the entire message list, mutate raw provider payloads and replace Pi's own compaction.
The two places Pi does invest heavily are the provider layer and the session tree. Forty providers across ten wire protocols sit behind one streaming abstraction, with seven OAuth flows and per-call key resolution so refreshed tokens take effect mid-session. Sessions are an append-only tree in one JSONL file where model changes and tool-set changes are entries, so forking replays the exact configuration at any node.
Security is a documented refusal. docs/security.md argues that a partial in-process sandbox "would be easy to misunderstand as a security boundary", so Pi ships none and points at containers instead. The only enforced boundary is project trust: whether repo-local extensions and settings are allowed to load at all.