fix(buzz-acp): deliver complete Pi system prompts

[salman1993]

Summary

Managed Pi agents now receive Buzz's complete, framed system prompt: <base>, <agent-instructions>, fetched <core-memory>, and any team, huddle, or canvas instructions. Their first ordinary user message starts with <context> through the existing system-prompt capability gate. Other adapters keep their existing transport and fallback behavior.

Each Pi adapter owns a private launcher. Session creation writes one immutable prompt file; subprocess restoration selects that same file by Pi's session ID. This prevents concurrent sessions from sharing memory and preserves the prompt through reload. Session invalidation removes the files. Native launch and snapshot failures propagate instead of silently using an incomplete prompt.

Install the updated harness and restart managed Pi agents to use the new transport. Existing transcript history is not rewritten. The change is limited to native pi-acp; custom Pi harnesses still use their existing behavior.

Related issue

Follow-up to #7335, which moved only the unframed base into Pi's native prompt. No duplicate open issue or PR found for the complete Pi system-prompt transport.

Testing

• cargo test -p buzz-acp --test pi_native_launcher -- --ignored passed against the installed Pi CLI. It exports Pi's live state and asserts exactly one framed base, profile, and core-memory section, using a synthetic transcript and no model calls.
• target/debug/buzz-acp models --agent-command /path/to/pi-acp --agent-args '' --json passed with pi-acp 0.0.33 and Pi 0.84.4 in an isolated working directory and Pi settings directory. This exercises the real adapter, generated launcher, and native Pi startup.

Live checks ran on macOS. The package testing guide also explains why reopening a transcript with a profile-only prompt cannot recover the original system prompt.

Generated with Codex

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 218633b8fd6ee41aee8eb18ba9806e8d90694751...253c43b207c19b1f7423c2f7623b00b4339f80b6.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 253c43b207c19b1f7423c2f7623b00b4339f80b6 to authorize a new review.
Any previous review applies only to its recorded range.

[salman1993]

🤖 Review: changes required

1. Major — crates/buzz-acp/src/pi_launcher.rs:166 — Windows CI cannot compile this change. On x86_64-pc-windows-msvc, the Unix-only builder.mode(...) block is removed, so builder is not mutated and -D warnings rejects let mut builder. The same job also rejects launcher_script(executable.as_ref(), ...) at line 62 as clippy::useless_asref. Impact: the required Windows Rust job fails at exact head 253c43b207c19b1f7423c2f7623b00b4339f80b6, so this head is not shippable. CI log: https://github.com/block/buzz/actions/runs/34278587041/job/102237923266

2. Major — crates/buzz-acp/src/acp.rs:676-683 — an intentionally empty Buzz prompt erases Pi’s native coding prompt. Repro scenario: configure managed pi-acp with --no-base-prompt, no persona/system prompt, core disabled or absent, and no team/huddle/canvas instructions. combined_system_prompt is None, but this branch still snapshots ""; native.rs:19-26 then always passes that empty file as pi --system-prompt. Pi interprets this as replacement, so the agent starts without either Buzz instructions or Pi’s default system prompt. Before this PR, the launcher omitted --system-prompt when the Buzz base was absent. Preserve native Pi behavior when no composed prompt exists, and add an all-sections-absent regression test (the current base-disabled test still supplies profile and memory).

Verification: I inspected the complete diff and Pi restore path, and ran the full cargo test -p buzz-acp package suite at the exact head: 924 unit tests plus integration targets passed. FastValidator independently ran the required real-Pi RPC export at the same head: one each of <base>, <agent-instructions>, and <core-memory> was observed. A relay-backed end-to-end ACP session was not run; crates/buzz-acp/TESTING.md prescribes the real-Pi workflow rather than a relay-backed command.

[salman1993]

doesn't look like a clean solution so closing it