Lineage. This is an in-tree hard fork that never renamed anything. All four workspace packages are still published as @earendil-works/pi-agent-core, pi-ai, pi-coding-agent and pi-tui, pinned at pi's version 0.7.3; pi-coding-agent still declares bin: pi; and 72 of pi's worked example extensions survive under examples/extensions/. The loop itself is a light touch — packages/agent/src/agent-loop.ts is 963 lines against pi's 796 — while the orchestrator ballooned: core/agent-session.ts is 10,946 lines, 7.2% of the whole source tree in one file, against pi's 3,344.
The interpreter as the tool. core/kernel/index.ts (1,597 L) owns a real Python process through KernelManager, with bootstrap.ts (929 L) preparing the runtime and fork-server.ts (363 L) existing purely so a kernel starts fast enough to feel instant. The model's Python reaches back through a typed channel — HOST_COMM_TARGET = "host.request" and createHostRequestHandler — and renders diffs, attachments and inter-agent messages through custom display MIME types. Skills are importable Python packages, so third-party extension happens inside the model's runtime rather than around it.
Continuity. Sessions are one append-only .jsonl file plus an artifact directory (core/session-manager.ts, 2,090 L), which is what makes resume and fork cheap. Above that sits the daemon: daemon-mode.ts (7,095 L), daemon-supervisor.ts (5,239 L), daemon-agent-connection.ts (2,113 L) and a 1,187-line wire protocol. Turns can be re-entered with nobody watching, by heartbeat, cron schedule, standing goal or bounded autonomous mode (cron-jobs.ts 1,735 L, autonomous.ts 593 L, goals.ts 290 L), and agents message each other directly through the agent-message skill.
Safety, by subtraction. An exhaustive search of non-test source finds no sandbox-exec, bubblewrap, Landlock, seccomp or restricted-token path; @anthropic-ai/sandbox-runtime is a devDependency and sandboxing ships as an example extension. What remains is small and honest: prompt-admission.ts (42 L) gates what enters a prompt, output-guard.ts (74 L) what leaves a tool, and rlm-max-depth.ts (13 L) caps recursion. Given that the primary tool executes arbitrary model-written Python with your permissions, this is the most exposed posture in the atlas — and the one most clearly documented as such.