The binary allowlist binds ~/.pi/agent/skills, which is empty here —
real skills live in ~/.dotfiles/ai/skills, and settings.json (which
points pi there) is not in the allowlist, so pi inside the container
only ever reads the empty default dir. Retargeting the user-layer
mount shadows the inherited bind.

Assisted-by: GLM-5.2 via pi

diff --git a/.config/ramekin/config.kdl b/.config/ramekin/config.kdl
index 9cff048a..0a7f57a0 100644
--- a/.config/ramekin/config.kdl
+++ b/.config/ramekin/config.kdl
@@ -1,7 +1,6 @@
 // Machine default profile. Selects the builtin trivial `pi`; agent config
-// (AGENTS.md, settings.json, models.json, keybindings.json, extensions,
-// skills) rides in through the binary allowlist off ~/.pi/agent, so nothing
-// needs restating here. `-p claude` for the other builtin.
+// (AGENTS.md, skills) rides in through the binary allowlist off ~/.pi/agent,
+// so nothing needs restating here. `-p claude` for the other builtin.
 profile "pi"
 
 // Pi against Amazon Bedrock. Pi selects the provider by flag (no env
@@ -25,8 +24,9 @@ mounts {
   "~/.claude/output-styles"
 
   // Pi's settings.json points `skills` here rather than at ~/.pi/agent/skills,
-  // so the container needs the path the setting names.
-  "~/.dotfiles/ai/skills"
+  // but settings.json isn't in the binary allowlist, so pi inside reads only
+  // the default dir. Retarget the mount to shadow the (empty) inherited bind.
+  "~/.dotfiles/ai/skills" target="/root/.pi/agent/skills"
 
   // Shadow the workspace's .envrc so repo secrets never reach the agent.
   "/dev/null" target=".envrc"