From 1bc5ebf9da21e1126429e5284e22b5e0a707bac1 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 22 Jul 2026 11:22:09 +0000
Subject: [PATCH] [docs] document Pi engine network defaults

---
 docs/src/content/docs/reference/network.md | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/docs/src/content/docs/reference/network.md b/docs/src/content/docs/reference/network.md
index 935f20c7ae2..dc6ce5dd3f8 100644
--- a/docs/src/content/docs/reference/network.md
+++ b/docs/src/content/docs/reference/network.md
@@ -183,6 +183,23 @@ network:
 
 Each engine has a built-in default domain list for its CLI authentication. See [`domains.go`](https://github.com/github/gh-aw/blob/main/pkg/workflow/domains.go) for the full lists.
 
+### Pi engine defaults
+
+The experimental Pi engine now runs with `PI_OFFLINE: 1` in compiled workflows. In offline mode, Pi does not require outbound access to `api.pi.ai` for normal agent execution.
+
+Pi initialization may still contact `pi.dev` during auth or web-portal flows, so `pi.dev` is included in the Pi engine's built-in default domain list.
+
+This means that workflows using `engine: pi` usually do **not** need to add either host manually:
+
+```yaml wrap
+engine: pi
+network:
+  allowed:
+    - defaults
+```
+
+If you maintain a custom allowlist with strict host pinning, include `pi.dev` when Pi needs its initialization flow.
+
 ### Firewall Log Level
 
 Control the verbosity of AWF firewall logs using `log-level`. Options: `debug` (verbose), `info` (default), `warn`, `error`.