[waveywaves]

Summary

• keep Pi evidence at schema_version: v1 while recording native input, output, cache-read, and cache-write separately
• recompute total_tokens from base input plus output instead of trusting Pi's cache-inclusive totalTokens
• compare stored evidence independently with raw Pi records in the compatibility suite
• record the cache-active Pi 1.3.0 result as supported

This implements the Pi-only #3720, a slice of the broader cross-provider #3706. The focused tracker was created after this PR opened to keep subsequent work issue-first. This PR does not close the broader all-provider tracker.

Trace provider checklist

• Evidence keeps input, output, total, cache read, and cache write semantics explicit.
• Provider-reported cost remains authoritative.
• Invalid counters and overflow paths produce deterministic warnings.
• Parsing reads the copied selected-branch session and preserves resumed history.
• Unit tests cover real test data, malformed totals, overflow, resumed usage, and source comparison.
• The live Pi compatibility check ran with the pinned version and model.
• The compatibility matrix and token-accounting documentation are updated from the live result.
• No new dependency, generated artifact, hook, or CLI wiring change is required.
• Changed source files retain the current license header.

Validation

• go test -race -shuffle=on -count=1 ./internal/trace/pi ./internal/trace/e2e
• go build ./...
• go vet ./...
• golangci-lint run --new-from-rev upstream/main
• CHAINLOOP_E2E_HARNESS=Pi CHAINLOOP_E2E_MODEL=openrouter/anthropic/claude-haiku-5.5 CHAINLOOP_E2E_FEATURE='Cache token accounting' make -C app/cli test-trace-e2e

The live run had nonzero cache reads and writes and passed with the matrix expecting Yes.

make -C app/cli test still hits two existing local-environment failures that reproduce unchanged on upstream/main: cmd/TestLoadAuthToken when CHAINLOOP_TOKEN is inherited, and Codex TestCopySessionData* on the macOS storage-root path. The changed Pi and E2E packages pass under the race detector.

AI assistance

Vibhav's Pi assisted with implementation, testing, and review. Both commits are signed, DCO-compliant, and carry Assisted-by: Vibhav's Pi.

The repository requires a skip-ai-session label because the available Chainloop login cannot access the chainloop project to upload the session. GitHub denied the label update with HTTP 403 (repository admin rights required), so a maintainer must apply it. This does not bypass code, test, DCO, or signature checks.

[chainloop-platform]

PR validation — ✅ 3 passing

Status	Policy	Material	Messages
✅ Passed	pr-min-approvals	pr-info	-
✅ Passed	pr-description-required	pr-info	-
✅ Passed	pr-user-story-linked	pr-info	-

_{View attestation ↗}

AI Session Checks — ⏭️ bypassed by label

AI Coding Session Check Bypassed

This PR carries the skip-ai-session label, so the AI coding session check was bypassed.

Learn more about Chainloop Trace.

Security Checks — ✅ 6 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

✅ iac-scan

Status	Policy	Messages
✅ Passed	iac-misconfiguration	-

Scans not applied (2)

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed

_{View attestation ↗}

Security context

✅ Nothing this change touches has a recorded security-fix history.

_{View in Chainloop ↗ · How this works ↗}

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 7 files

_{View guided diff | Re-trigger cubic}

[migmartri]

I see, so I was confused thinking that PI itself went to v2, when the change proposed a change in our session spec to v2. As @jiparis said, I'd not do it for now, let's just make the change in the calculation since there are no schema changes.

Also, can you make sure chainloop trace init adds support for pi?

[migmartri]

Thanks!

What's left for pi?

[waveywaves]

@migmartri 😆

What's left for pi? Last time

The core provider and trace init --pi landed are already merged, and this PR fixes cache accounting. There is also a PR open to enable Pi tracing in this repository.

I’d suggest grouping the remaining Pi work into three phases:

1. Verify the experience we already have: control-plane attestation (Trace: verify Pi control-plane attestation at push #3718), welcome message (Trace: verify Pi interactive welcome message #3722), credentials warning (Trace: verify Pi credentials warning #3723), and post-push link (Trace: verify Pi post-push session link #3724).

2. Add more root-session evidence: skills (Trace: record Pi skill loads in session evidence #3714), spec pointers (Trace: replace exact Pi spec-source copies with pointers #3715), pasted images (Trace: extract and replace pasted images in Pi transcripts #3716), and context and compactions (Trace: record Pi root context and compactions #3721).

3. Cover child sessions: subagent evidence (Trace: capture Pi subagent evidence from a pinned result format #3713).

This is a suggested way to organize the followups, not a list of things Pi needs before it’s useful. Happy to adjust the order around what would help people most. I would prioritze 3 then 2 and have 1 as good first issues. These would also probably require feature flags or config based on what the user would and wouldn't like to enable for the target harness for collection.

[migmartri]

What's left for pi? Last time

uups, sorry that message was cut off and sounded rude.

In fact what I wanted to say was "Last time I tried it, pi didn't appear in chainloop trace init as an option".

But that's not the case anymore