Pi Cloudflare Sandbox Workflows — DevOps skill for Claude Code

Pi Cloudflare Sandbox Workflows

Contextual Pi runs in Cloudflare Sandboxes.

This repo is the next spine after the browser-terminal proof in `../pi-cloudflare-sandbox`. The target is not a persistent web terminal. The target is **ephemeral, contextual, bounded Pi execution** with context capsules, task-specific context packs, secret leases, Artifacts-backed outputs, and Wzrrd review pages.

Non-negotiable split

src/          production-intended code only
prototypes/   throwaway experiments only
docs/         durable design docs and source maps
.brain/       canonical project memory and decisions
sources/      copied/source-backed reference material

Prototype code must either be deleted or rewritten into `src/`. Do not gradually polish a prototype until it becomes production by mold growth.

Read first:

1. BRAIN.md
2. .brain/projects/pi-sandbox-workflows.svx
3. docs/production-vs-prototypes.md
4. PROTOTYPES.md
5. docs/source-map.md
6. docs/dynamic-workflow-machine.md
7. docs/tooling-baseline.md

First spike

pnpm install
pnpm prototype:spike:auth:put
export ACCESS_TOKEN="$(openssl rand -hex 32)"
pnpm prototype:spike:access:put # auto-leases Cloudflare credentials from agent-secrets if env vars are absent
pnpm prototype:spike:deploy
curl -X POST https://pi-sandbox-workflow-spike.joelhooks.workers.dev/api/real-run \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"task":"Produce the research-claude-workflows spike report"}'
pnpm verify

The active sandbox spike uses real Cloudflare Sandbox, Artifacts, Wzrrd, XState v5, Zod v4, isomorphic-git, and just-bash substrate. `/api/real-run` commits plan-phase artifacts before sandbox creation, then runs a fixed reader → verifier pipeline in the sandbox, commits separate lane outputs, returns the Artifacts repo/commits, publishes a live Wzrrd review URL, and returns an anonymous Wzrrd `claimUrl` when no Wzrrd auth token is configured. `