@goodandready/dsh-goal 0.2.27 → 0.2.29

package/README.md

@@ -137,6 +137,14 @@ Handles `/goal` commands and subcommands:
 * **Plugin Settings Card**: Schemastery-backed settings UI registered via `settings.plugin.item`.
 
 ### 5. Two-Phase Goal Execution: Plan Mode ⇄ Act Mode (#162)
+
+### 6. Acceptance Gate & Critic Verification (#163)
+* **Automated Phase Verification**: Attach an optional `verificationCommand` (e.g. `npm test`, `pytest`, `cargo test`) to any milestone.
+* **Failure Blocking & Diagnostic Feedback**: When the agent attempts to complete a milestone via `goal_milestones action: 'complete'` or `goal_update_progress status: 'completed'`, the command executes inside confined `safeCwd`. If tests fail (`exitCode !== 0`), completion is blocked, the milestone remains open, and diagnostic failure output is returned as actionable feedback to the agent.
+* **Atomic Completion & Snapshots**: Git checkpoint snapshotting and issue checklist synchronization only trigger once the verification command passes with exit code 0.
+* **UI Visual Badges**: Visual indicator `🛡️ <command>` and failure alerts rendered in the Goal Details modal.
+
+
 * **Plan Mode (Read-Only Planning Phase)**: The agent explores the codebase, searches the web, and decomposes tasks into structured milestones and checklists. All file mutating tools (`write_to_file`, `replace_file_content`, mutating shell commands) are strictly blocked by `lib/tool-guard.js`.
 * **Act Mode (Implementation Phase)**: The operator reviews and approves the plan directly via the banner or details modal with «Approve & Execute», unlocking mutating capabilities and resuming the agent.
 * **REST API & Quick Launch**: Toggle modes on demand via `POST /dsh-goal/action` (`set_mode`, `approve_plan`), or select initial mode directly in the Quick Launch dialog.

package/README.ru.md

@@ -54,6 +54,7 @@
 * 🔄 **Перехват и замещение инструментов ядра DSH (*Добавлено в v0.1.10*)**: Бесшовная совместимость для моделей, вызывающих стандартные инструменты DSH (`update_goal`, `get_goal`, `create_goal`). Перехватывает действия (`complete`, `pause`, `resume`, `edit`, `blocked`), устраняет падения ядра (`complete and blocked require a direct human turn`) и синхронизирует состояние напрямую с GoalEngine.
 * 🛡️ **Защитные лимиты**: настраиваемое ограничение `maxIterations` для предотвращения бесконечных циклов.
 * 🛡️ **Двухфазный режим «Plan Mode ⇄ Act Mode» (*#162*)**: Разделение жизненного цикла цели на фазу проектирования и планирования (только чтение и формирование этапов через `goal_milestones`, блокировка записи файлов и мутирующих команд) и фазу реализации (`Act Mode`), активируемую по кнопке «Утвердить план и запустить» (Approve & Execute).
+* 🛡️ **Автоматический приёмочный гейт этапа (Critic Verification) (*#163*)**: Опциональное поле `verificationCommand` на этапе (например, `npm test`, `pytest`). При попытке закрыть этап команда автоматически запускается в изолированном `safeCwd`. В случае сбоя (`exitCode != 0`) этап остаётся открытым, а диагностический вывод возвращается модели в качестве обратной связи. Git-снимки и синхронизация задач создаются только при коде возврата 0.
 
 ---
 

package/README.zh.md

@@ -55,6 +55,7 @@
 * 🛡️ **安全防护机制**：支持自定义最大迭代次数（`maxIterations`）以及智能卡顿检测（Smart Progress Guard）。
 * 🔔 **Web Audio 提示音**：任务完成或失败时，通过 Web Audio API 播放舒缓的合成音效。
 * 📋 **两阶段目标模式：Plan Mode ⇄ Act Mode (*#162*)**：分离规划设计与落地执行。只读规划阶段严格限制文件变更与危险命令，待操作者在横幅或弹窗点击“批准并执行 (Approve & Execute)”后切入执行阶段。
+* 🛡️ **自动化验收门禁与评审检验 (Critic Verification) (*#163*)**：里程碑可配置 `verificationCommand` 验证命令（如 `npm test`、`pytest`）。智能体尝试关闭阶段时，在受控 `safeCwd` 中自动执行检查；若失败（`exitCode != 0`）则阻断关闭并向模型反馈错误输出，仅当命令返回 0 时方可进入完成态并创建 Git 检查点。
 
 ---
 

package/lib/client.js

@@ -1640,6 +1640,29 @@ window.__ModuleLoader__.load({
         margin-left: 6px;
       }
 
+      .dsh-goal-gate-badge {
+        font-size: 10px;
+        padding: 1px 6px;
+        border-radius: 4px;
+        background: var(--dsw-alias-bg-layer-4);
+        color: var(--dsw-alias-brand-primary);
+        border: 1px solid var(--dsw-alias-brand-primary);
+        margin-left: 6px;
+        display: inline-flex;
+        align-items: center;
+        gap: 3px;
+      }
+
+      .dsh-goal-gate-error {
+        font-size: 11px;
+        color: var(--dsw-alias-state-danger-primary);
+        margin-top: 3px;
+        padding: 2px 6px;
+        border-radius: 3px;
+        background: var(--dsw-alias-bg-layer-2);
+        font-family: monospace;
+      }
+
     `;
 
     function injectStylesOnce() {
@@ -2378,16 +2401,33 @@ window.__ModuleLoader__.load({
                           },
 
                           `${i + 1}. ${m.title}`,
-                            Array.isArray(m.dependsOn) && m.dependsOn.some((depId) => {
-                              const prereq = milestones.find((x) => x.id === depId || x.title === depId);
-                              return prereq && prereq.status !== 'completed';
-                            })
-                              ? React.createElement('span', { className: 'dsh-goal-lock-badge' }, `🔒 ${t('waitingPrereq') || 'waiting for prereq'}`)
-                              : null,
+                          m.verificationCommand
+                            ? React.createElement(
+                                'span',
+                                {
+                                  className: 'dsh-goal-gate-badge',
+                                  title: `${t('verificationGate') || 'Acceptance gate'}: ${m.verificationCommand}`,
+                                },
+                                `🛡️ ${m.verificationCommand}`
+                              )
+                            : null,
+                          Array.isArray(m.dependsOn) && m.dependsOn.some((depId) => {
+                            const prereq = milestones.find((x) => x.id === depId || x.title === depId);
+                            return prereq && prereq.status !== 'completed';
+                          })
+                            ? React.createElement('span', { className: 'dsh-goal-lock-badge' }, `🔒 ${t('waitingPrereq') || 'waiting for prereq'}`)
+                            : null,
 
                         ),
 
                         m.notes ? React.createElement('div', { style: { fontSize: 12, color: 'var(--dsw-alias-label-tertiary)', marginTop: 2 } }, m.notes) : null,
+                        m.verificationError
+                          ? React.createElement(
+                              'div',
+                              { className: 'dsh-goal-gate-error' },
+                              `⚠️ ${t('verificationFailed') || 'Gate failed'}: ${m.verificationError}`
+                            )
+                          : null,
 
                         Array.isArray(m.checklist) && m.checklist.length > 0
                           ? React.createElement(
@@ -5041,6 +5081,9 @@ window.__ModuleLoader__.load({
         mergeBranch: 'Merge Branch',
         discardBranch: 'Discard Branch',
         retrospectiveTitle: 'Goal Retrospective',
+        verificationGate: 'Acceptance gate',
+        verificationPassed: 'Verified',
+        verificationFailed: 'Gate failed',
         templatesTitle: 'Goal Templates',
         waitingPrereq: 'waiting for prereq',
 
@@ -5189,6 +5232,9 @@ window.__ModuleLoader__.load({
         mergeBranch: '合并分支',
         discardBranch: '放弃分支',
         retrospectiveTitle: '目标复盘报告',
+        verificationGate: '验收门禁',
+        verificationPassed: '已验证',
+        verificationFailed: '门禁未通过',
         templatesTitle: '目标模板',
         waitingPrereq: '等待前置依赖',
 

package/lib/engine-milestones.js

@@ -74,11 +74,13 @@ export function parseMilestoneItems(milestonesList, startingCount = 0) {
 
     count += 1;
     const mId = typeof item === 'object' && item?.id ? item.id : ('m-' + count);
+    const vCmd = typeof item === 'object' && (item?.verificationCommand || item?.verification_command);
     const mObj = {
       id: String(mId),
       title: itemTitle.trim(),
       status: typeof item === 'object' && item?.status ? item.status : MilestoneStatus.PENDING,
       notes: typeof item === 'object' && item?.notes ? String(item.notes) : '',
+      verificationCommand: vCmd ? String(vCmd).trim() : null,
       dependsOn: typeof item === 'object' && Array.isArray(item?.dependsOn) ? item.dependsOn.map(String) : [],
     };
     if (typeof item === 'object' && Array.isArray(item?.checklist)) {
@@ -116,6 +118,10 @@ export function applyMilestoneUpdate(target, status, notes = '', checklist = nul
     }
   }
 
+  if (options.verificationCommand !== undefined) {
+    target.verificationCommand = options.verificationCommand ? String(options.verificationCommand).trim() : null;
+  }
+
   if (status) {
     if (validStatuses.length > 0 && !validStatuses.includes(status)) {
       return {

package/lib/engine-verification.js

@@ -0,0 +1,299 @@
+import { spawnSync } from 'node:child_process';
+import { getSafeCwd } from './goal-engine-constants.js';
+
+export const SAFE_ENV_WHITELIST = [
+  'PATH',
+  'HOME',
+  'USER',
+  'LOGNAME',
+  'LANG',
+  'LC_ALL',
+  'LC_CTYPE',
+  'SHELL',
+  'TERM',
+  'TMPDIR',
+  'TMP',
+  'TEMP',
+  'NODE_ENV',
+];
+
+const FORBIDDEN_SECRET_REGEX = /(TOKEN|KEY|SECRET|AUTH|PASS|PASSWORD|CREDENTIAL|PRIVATE|BEARER|API)/i;
+
+export const DISALLOWED_BINARIES = new Set([
+  'curl', 'wget', 'nc', 'ncat', 'netcat', 'telnet',
+  'ssh', 'scp', 'sftp', 'ftp', 'rsync',
+  'rm', 'dd', 'mkfs', 'shutdown', 'reboot', 'killall', 'kill',
+]);
+
+export const SHELL_OPERATORS = new Set([';', '&&', '||', '|', '&', '>', '>>', '<', '`']);
+
+/**
+ * Sanitize environment for child verification processes, strictly stripping tokens and secrets
+ * @param {object} [userEnv={}]
+ * @returns {object}
+ */
+export function sanitizeVerificationEnv(userEnv = {}) {
+  const clean = {};
+  for (const key of SAFE_ENV_WHITELIST) {
+    if (process.env[key] !== undefined && !FORBIDDEN_SECRET_REGEX.test(key)) {
+      clean[key] = process.env[key];
+    }
+  }
+  if (userEnv && typeof userEnv === 'object') {
+    for (const [k, v] of Object.entries(userEnv)) {
+      if (k && !FORBIDDEN_SECRET_REGEX.test(k) && v !== undefined && v !== null) {
+        clean[k] = String(v);
+      }
+    }
+  }
+  if (!clean.NODE_ENV) {
+    clean.NODE_ENV = 'test';
+  }
+  return clean;
+}
+
+/**
+ * Parse a command string or array into an argv list
+ * @param {string|string[]} commandStr
+ * @returns {string[]}
+ */
+export function parseCommandArgv(commandStr) {
+  if (Array.isArray(commandStr)) {
+    return commandStr.map(String).filter((s) => s.trim().length > 0);
+  }
+  if (!commandStr || typeof commandStr !== 'string') return [];
+  const trimmed = commandStr.trim();
+  if (!trimmed) return [];
+
+  const regex = /"([^"\\]*(?:\\.[^"\\]*)*)"|'([^'\\]*(?:\\.[^'\\]*)*)'|(\S+)/g;
+  const args = [];
+  let match;
+  while ((match = regex.exec(trimmed)) !== null) {
+    if (match[1] !== undefined) {
+      args.push(match[1].replace(/\\"/g, '"'));
+    } else if (match[2] !== undefined) {
+      args.push(match[2].replace(/\\'/g, "'"));
+    } else if (match[3] !== undefined) {
+      args.push(match[3]);
+    }
+  }
+  return args;
+}
+
+/**
+ * Validate a verification command for dangerous operators, shell chaining, or exfiltration binaries
+ * @param {string|string[]} command
+ * @returns {{ valid: boolean, error?: string, argv?: string[], binary?: string }}
+ */
+export function validateVerificationCommand(command) {
+  if (!command) return { valid: false, error: 'Empty or invalid verification command' };
+  const argv = parseCommandArgv(command);
+  if (argv.length === 0) return { valid: false, error: 'Empty or invalid verification command' };
+
+  const rawBinary = argv[0].toLowerCase().replace(/^.*[/\\]/, '');
+  if (DISALLOWED_BINARIES.has(rawBinary)) {
+    return { valid: false, error: `Execution blocked: disallowed command binary "${rawBinary}"` };
+  }
+
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (SHELL_OPERATORS.has(arg)) {
+      return { valid: false, error: `Execution blocked: shell operator "${arg}" is not allowed` };
+    }
+    if (arg.startsWith('$(') || (arg.startsWith('`') && arg.endsWith('`'))) {
+      return { valid: false, error: 'Execution blocked: subshell substitution is not allowed' };
+    }
+    if (i > 0 && DISALLOWED_BINARIES.has(arg.toLowerCase().replace(/^.*[/\\]/, ''))) {
+      return { valid: false, error: `Execution blocked: disallowed binary "${arg}" in arguments` };
+    }
+  }
+
+  return { valid: true, argv, binary: rawBinary };
+}
+
+/**
+ * Execute a verification command in a confined working directory with timeout and output capture
+ * Uses sanitized environment (no secrets/tokens) and shell: false (no shell injection)
+ * @param {string|string[]} command Command to execute
+ * @param {string} [targetCwd] Working directory
+ * @param {object} [options]
+ * @param {number} [options.timeoutMs=30000] Timeout in milliseconds
+ * @param {number} [options.maxBuffer=1048576] Max stdout/stderr buffer in bytes (1MB)
+ * @param {object} [options.env={}] Additional environment variables (sanitized)
+ * @param {Function} [options.checkApproval] Custom approval check function
+ * @param {object} [options.approvalGate] ApprovalGate service instance
+ * @returns {{ ok: boolean, exitCode: number, stdout: string, stderr: string, error?: string }}
+ */
+export function runMilestoneVerification(command, targetCwd, options = {}) {
+  const validation = validateVerificationCommand(command);
+  if (!validation.valid) {
+    return {
+      ok: false,
+      exitCode: 1,
+      stdout: '',
+      stderr: '',
+      error: validation.error || 'Empty or invalid verification command',
+    };
+  }
+
+  const safeCwd = getSafeCwd(targetCwd) || process.cwd();
+  const timeoutMs = typeof options.timeoutMs === 'number' ? options.timeoutMs : 30000;
+  const maxBuffer = typeof options.maxBuffer === 'number' ? options.maxBuffer : 1024 * 1024;
+  const { argv, binary } = validation;
+
+  // 1. Approval seam check
+  if (typeof options.checkApproval === 'function') {
+    const decision = options.checkApproval({
+      command,
+      argv,
+      binary,
+      cwd: safeCwd,
+    });
+    if (decision && (decision.kind === 'deny' || decision.deny)) {
+      return {
+        ok: false,
+        exitCode: 1,
+        stdout: '',
+        stderr: '',
+        error: `Verification command denied by policy: ${decision.reason || 'denied'}`,
+      };
+    }
+    if (decision && (decision.kind === 'ask' || decision.ask)) {
+      return {
+        ok: false,
+        exitCode: 1,
+        stdout: '',
+        stderr: '',
+        error: `Verification command requires operator approval: ${decision.reason || 'approval required'}`,
+      };
+    }
+  }
+
+  if (options.approvalGate && typeof options.approvalGate.checkCommand === 'function') {
+    try {
+      const decision = options.approvalGate.checkCommand(command, safeCwd);
+      if (decision && (decision.verdict === 'deny' || decision.verdict === 'ask')) {
+        return {
+          ok: false,
+          exitCode: 1,
+          stdout: '',
+          stderr: '',
+          error: `Verification command blocked by approval gate: ${decision.reason || decision.verdict}`,
+        };
+      }
+    } catch (err) {
+      return {
+        ok: false,
+        exitCode: 1,
+        stdout: '',
+        stderr: '',
+        error: `Approval check error: ${err?.message || err}`,
+      };
+    }
+  }
+
+  // 2. Environment sanitization (strictly scrub secrets and tokens)
+  const cleanEnv = sanitizeVerificationEnv(options.env);
+
+  // 3. Execution without shell (shell: false)
+  try {
+    const res = spawnSync(argv[0], argv.slice(1), {
+      shell: false,
+      cwd: safeCwd,
+      timeout: timeoutMs,
+      maxBuffer,
+      encoding: 'utf8',
+      env: cleanEnv,
+    });
+
+    if (res.error) {
+      if (res.error.code === 'ETIMEDOUT') {
+        return {
+          ok: false,
+          exitCode: 124,
+          stdout: res.stdout || '',
+          stderr: res.stderr || '',
+          error: `Verification command timed out after ${timeoutMs}ms`,
+        };
+      }
+      return {
+        ok: false,
+        exitCode: res.status ?? 1,
+        stdout: res.stdout || '',
+        stderr: res.stderr || '',
+        error: res.error.message || 'Verification command failed to execute',
+      };
+    }
+
+    if (res.status !== 0) {
+      const output = (res.stderr || res.stdout || '').trim();
+      return {
+        ok: false,
+        exitCode: res.status ?? 1,
+        stdout: res.stdout || '',
+        stderr: res.stderr || '',
+        error: `Verification command failed with exit code ${res.status}${output ? ': ' + output.slice(0, 500) : ''}`,
+      };
+    }
+
+    return {
+      ok: true,
+      exitCode: 0,
+      stdout: res.stdout || '',
+      stderr: res.stderr || '',
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      exitCode: 1,
+      stdout: '',
+      stderr: '',
+      error: err?.message || 'Unexpected verification failure',
+    };
+  }
+}
+
+/**
+ * Run acceptance gate check on a milestone target and record diagnostic logs/activities
+ * @param {object} target Milestone object
+ * @param {string} targetCwd Working directory
+ * @param {object} [goal] Goal engine state
+ * @param {Function} [recordActivity] Activity recorder function
+ * @param {object} [options]
+ * @returns {{ ok: boolean, verified: boolean, error?: string, output?: string, passedAt?: number }}
+ */
+export function verifyMilestoneAcceptance(target, targetCwd, goal = null, recordActivity = null, options = {}) {
+  if (!target || !target.verificationCommand) {
+    return { ok: true, verified: false };
+  }
+
+  const vRes = runMilestoneVerification(target.verificationCommand, targetCwd, options);
+  if (!vRes.ok) {
+    target.verificationError = vRes.error;
+    target.verificationOutput = (vRes.stderr || vRes.stdout || '').trim();
+    if (goal) {
+      if (typeof recordActivity === 'function') {
+        recordActivity(goal, {
+          type: 'milestone',
+          tool: 'updateMilestone',
+          status: 'error',
+          details: `Verification failed: ${vRes.error}`,
+        });
+      }
+      if (Array.isArray(goal.logs)) {
+        goal.logs.push({
+          timestamp: Date.now(),
+          type: 'error',
+          message: `Acceptance gate failed for [${target.title}]: ${vRes.error}`,
+        });
+        if (goal.logs.length > 100) goal.logs = goal.logs.slice(-100);
+      }
+    }
+    return { ok: false, verified: true, error: vRes.error, output: target.verificationOutput };
+  }
+
+  target.verificationError = null;
+  target.verificationOutput = null;
+  target.verificationPassedAt = Date.now();
+  return { ok: true, verified: true, passedAt: target.verificationPassedAt };
+}

package/lib/goal-engine.js

@@ -1,3 +1,4 @@
+import { verifyMilestoneAcceptance } from './engine-verification.js';
 import { GoalMode, GoalState, MilestoneStatus, formatElapsed, formatETA, detectLanguage, sessionIdOf, calculateElapsedSeconds, calculateRemainingSeconds, buildSnapshot, getSafeCwd } from './goal-engine-constants.js';
 import { getGitCurrentCommit, exportReportMarkdown, exportReportGitHubPR, createMilestoneCheckpoint, rollbackToCheckpoint, saveGoalArtifact } from './engine-reports.js';
 import { EngineStore } from './engine-store.js';
@@ -37,6 +38,8 @@ export class GoalEngine {
     this.enableMilestoneDependencies = options.enableMilestoneDependencies ?? true;
     this.soundScheme = options.soundScheme ?? 'default';
     this.enableVoiceAnnouncements = options.enableVoiceAnnouncements ?? false;
+    this.approvalGate = options.approvalGate || null;
+    this.checkApproval = options.checkApproval || null;
     this.maxSessions = options.maxSessions ?? 100;
     this.goals = new Map();
     this.listeners = new Set();
@@ -357,21 +360,22 @@ export class GoalEngine {
     const target = goal.milestones.find((m) => matchMilestone(m, id));
     if (!target) return false;
 
+    if (status === MilestoneStatus.COMPLETED && target.verificationCommand) {
+      const vRes = verifyMilestoneAcceptance(target, goal.cwd || process.cwd(), goal, recordActivity, { approvalGate: this.approvalGate, checkApproval: this.checkApproval });
+      if (!vRes.ok) {
+        this.emit(sid);
+        return false;
+      }
+    }
+
     const res = applyMilestoneUpdate(target, status, notes, checklist, Object.values(MilestoneStatus), {
       enforceDependencies: this.enableMilestoneDependencies,
       allMilestones: goal.milestones,
     });
     if (res.invalidStatus || res.blocked) {
-      if (res.invalidStatus) {
-        this.logger?.warn?.(`[dsh-goal] Invalid milestone status "${status}" for milestone ${id}`);
-      }
+      if (res.invalidStatus) this.logger?.warn?.(`[dsh-goal] Invalid milestone status "${status}" for milestone ${id}`);
       if (res.blocked) {
-        recordActivity(goal, {
-          type: 'milestone',
-          tool: 'updateMilestone',
-          status: 'error',
-          details: `Milestone ${id} blocked by ${res.missingDependencies?.join(', ')}`,
-        });
+        recordActivity(goal, { type: 'milestone', tool: 'updateMilestone', status: 'error', details: `Milestone ${id} blocked by ${res.missingDependencies?.join(', ')}` });
       }
       return false;
     }

package/lib/index.js

@@ -121,6 +121,7 @@ export function apply(ctx, config = {}) {
   const milestoneManager = new MilestoneManager(addonStore, {
     gitSnapshotManager,
     enforceDependencies: currentSettings.enableMilestoneDependencies,
+    approvalGate: safeService(ctx, "approvalGate"),
     logger,
   });
   const tokenBudgetGuard = new TokenBudgetGuard({
@@ -167,6 +168,7 @@ export function apply(ctx, config = {}) {
       autoScaleBudgetNearCompletion: currentSettings.autoScaleBudgetNearCompletion,
       enableTemplatesDrawer: currentSettings.enableTemplatesDrawer,
       enableMilestoneDependencies: currentSettings.enableMilestoneDependencies,
+      approvalGate: safeService(ctx, "approvalGate"),
       logger,
     });
     registerPlanModeGuard(ctx, { engine: fallbackEngine, logger });

package/lib/milestone-manager.js

@@ -1,13 +1,16 @@
 import { syncMilestoneWithIssue } from './engine-issue-sync.js';
+import { runMilestoneVerification, validateVerificationCommand } from './engine-verification.js';
 
 /**
  * Milestone and checklist coordinator for active core goals
  */
 export class MilestoneManager {
-  constructor(addonStore, { gitSnapshotManager = null, enforceDependencies = true, logger = console } = {}) {
+  constructor(addonStore, { gitSnapshotManager = null, enforceDependencies = true, approvalGate = null, checkApproval = null, logger = console } = {}) {
     this.store = addonStore;
     this.gitSnapshotManager = gitSnapshotManager;
     this.enforceDependencies = enforceDependencies;
+    this.approvalGate = approvalGate;
+    this.checkApproval = checkApproval;
     this.logger = logger;
   }
 
@@ -24,6 +27,7 @@ export class MilestoneManager {
       completed: Boolean(m.completed),
       completedAt: m.completedAt || null,
       notes: m.notes || '',
+      verificationCommand: m.verificationCommand || m.verification_command ? String(m.verificationCommand || m.verification_command).trim() : null,
       dependsOn: Array.isArray(m.dependsOn) ? m.dependsOn : [],
       checklist: Array.isArray(m.checklist) ? m.checklist.map((c, cIdx) => ({
         id: c.id || `cl-${idx + 1}-${cIdx + 1}`,
@@ -35,16 +39,18 @@ export class MilestoneManager {
     return sanitized;
   }
 
-  addMilestone(goalId, { title, checklist = [], dependsOn = [] }) {
+  addMilestone(goalId, { title, checklist = [], dependsOn = [], verificationCommand = null, verification_command = null }) {
     if (!goalId || !this.store) throw new Error('Missing goalId or store');
     const list = this.getMilestones(goalId);
     const id = `m-${list.length + 1}`;
+    const vCmd = verificationCommand || verification_command;
     const newM = {
       id,
       title: title || `Milestone ${list.length + 1}`,
       completed: false,
       completedAt: null,
       notes: '',
+      verificationCommand: vCmd ? String(vCmd).trim() : null,
       dependsOn: Array.isArray(dependsOn) ? dependsOn : [],
       checklist: (checklist || []).map((c, cIdx) => ({
         id: `cl-${list.length + 1}-${cIdx + 1}`,
@@ -74,6 +80,23 @@ export class MilestoneManager {
       }
     }
 
+    // Acceptance Gate (Critic Verification) - Issue #163
+    if (m.verificationCommand) {
+      const vResult = runMilestoneVerification(m.verificationCommand, workspaceRoot, {
+        approvalGate: this.approvalGate,
+        checkApproval: this.checkApproval,
+      });
+      if (!vResult.ok) {
+        m.verificationError = vResult.error;
+        m.verificationOutput = (vResult.stderr || vResult.stdout || '').trim();
+        this.store.setMilestones(goalId, list);
+        throw new Error(`Acceptance gate failed for milestone "${milestoneId}" (${m.verificationCommand}): ${vResult.error}`);
+      }
+      m.verificationError = null;
+      m.verificationOutput = null;
+      m.verificationPassedAt = Date.now();
+    }
+
     m.completed = true;
     m.completedAt = Date.now();
     if (notes) m.notes = notes;
@@ -110,6 +133,33 @@ export class MilestoneManager {
     return { milestone: m, snapshot };
   }
 
+  updateMilestone(goalId, milestoneId, { status, notes = '', checklist = null, verificationCommand = null, cwd = null } = {}) {
+    if (!goalId || !milestoneId) throw new Error('goalId and milestoneId are required');
+    const list = this.getMilestones(goalId);
+    const m = list.find(item => item.id === milestoneId);
+    if (!m) return null;
+
+    if (verificationCommand !== undefined && verificationCommand !== null) {
+      m.verificationCommand = String(verificationCommand).trim() || null;
+    }
+
+    if (status === 'completed') {
+      return this.completeMilestone(goalId, milestoneId, notes, cwd);
+    }
+
+    if (status) m.status = status;
+    if (notes) m.notes = notes;
+    if (Array.isArray(checklist)) {
+      m.checklist = checklist.map((c, cIdx) => ({
+        id: typeof c === 'object' && c?.id ? c.id : `cl-${milestoneId}-${cIdx + 1}`,
+        text: typeof c === 'string' ? c : (c?.text || ''),
+        done: Boolean(c?.done),
+      }));
+    }
+    this.store.setMilestones(goalId, list);
+    return m;
+  }
+
   toggleChecklist(goalId, milestoneId, index, done) {
     if (!goalId || !milestoneId) throw new Error('goalId and milestoneId are required');
     const list = this.getMilestones(goalId);
@@ -139,7 +189,8 @@ export class MilestoneManager {
     if (uncompletedChecklist.length > 0) {
       clText = ` | Next items: ${uncompletedChecklist.map(c => `[ ] ${c.text}`).join(', ')}`;
     }
+    const gateText = active.verificationCommand ? ` [Gate: "${active.verificationCommand}"]` : '';
 
-    return `[Goal Milestones]: Current step: "${active.title}"${clText}`;
+    return `[Goal Milestones]: Current step: "${active.title}"${gateText}${clText}`;
   }
 }

package/lib/tools.js

@@ -1,3 +1,4 @@
+import { validateVerificationCommand } from './engine-verification.js';
 import { MilestoneManager } from './milestone-manager.js';
 import { AddonStore } from './addon-store.js';
 import { getSafeCwd } from './goal-engine-constants.js';
@@ -67,15 +68,30 @@ export function registerTools(ctx, { milestoneManager, goalsService, logger = co
       }
 
       if (action === 'set') {
+        if (Array.isArray(args.milestones)) {
+          for (const m of args.milestones) {
+            const vCmd = m && (m.verificationCommand || m.verification_command);
+            if (vCmd) {
+              const val = validateVerificationCommand(vCmd);
+              if (!val.valid) throw new Error(`Invalid verificationCommand: ${val.error}`);
+            }
+          }
+        }
         const list = mm.setMilestones(goalId, args.milestones);
         return { ok: true, goalId, count: list.length, milestones: list };
       }
 
       if (action === 'add') {
+        const vCmd = args.verificationCommand || args.verification_command;
+        if (vCmd) {
+          const val = validateVerificationCommand(vCmd);
+          if (!val.valid) throw new Error(`Invalid verificationCommand: ${val.error}`);
+        }
         const item = mm.addMilestone(goalId, {
           title: args.title,
           checklist: args.checklist,
           dependsOn: args.dependsOn || args.depends_on,
+          verificationCommand: vCmd,
         });
         return { ok: true, goalId, milestone: item };
       }
@@ -124,6 +140,7 @@ export function registerTools(ctx, { milestoneManager, goalsService, logger = co
                   },
                 },
                 dependsOn: { type: 'array', items: { type: 'string' } },
+                verificationCommand: { type: 'string', description: 'Optional shell command to verify milestone completion' },
               },
               required: ['title'],
             },
@@ -136,6 +153,10 @@ export function registerTools(ctx, { milestoneManager, goalsService, logger = co
             items: { type: 'string' },
             description: 'Initial checklist items for added milestone',
           },
+          verificationCommand: {
+            type: 'string',
+            description: 'Verification command when action is "add"',
+          },
         },
         required: ['action'],
       },
@@ -190,6 +211,11 @@ export function registerTools(ctx, { milestoneManager, goalsService, logger = co
           if (typeof item === 'string') {
             return { id: `m-${idx + 1}`, title: item };
           }
+          const vCmd = item && (item.verificationCommand || item.verification_command);
+          if (vCmd) {
+            const val = validateVerificationCommand(vCmd);
+            if (!val.valid) throw new Error(`Invalid verificationCommand: ${val.error}`);
+          }
           return item;
         });
       } else {
@@ -224,13 +250,23 @@ export function registerTools(ctx, { milestoneManager, goalsService, logger = co
       const status = args.status || 'in_progress';
       const notes = typeof args.notes === 'string' ? args.notes : '';
       if (!milestoneId) throw new Error('milestone_id is required');
+      const vCmd = args.verificationCommand || args.verification_command;
+      if (vCmd) {
+        const val = validateVerificationCommand(vCmd);
+        if (!val.valid) throw new Error(`Invalid verificationCommand: ${val.error}`);
+      }
       if (status === 'completed') {
         const rawCwd = toolCtx?.session?.cwd || toolCtx?.cwd || process.cwd();
         const safeCwd = getSafeCwd(rawCwd);
         const completed = await mm.completeMilestone(goalId, milestoneId, notes, safeCwd);
         return { ok: true, goalId, milestoneId, status: 'completed', milestone: completed };
       }
-      const updated = mm.updateMilestone(goalId, milestoneId, { status, notes, checklist: args.checklist });
+      const updated = mm.updateMilestone(goalId, milestoneId, {
+        status,
+        notes,
+        checklist: args.checklist,
+        verificationCommand: args.verificationCommand || args.verification_command,
+      });
       return { ok: true, goalId, milestoneId, status, milestone: updated };
     };
 
@@ -244,6 +280,7 @@ export function registerTools(ctx, { milestoneManager, goalsService, logger = co
           status: { type: 'string', enum: ['pending', 'in_progress', 'completed', 'blocked'], description: 'Milestone status' },
           notes: { type: 'string', description: 'Brief outcome or status notes' },
           checklist: { type: 'array', items: { type: 'string' }, description: 'Subtask items' },
+          verificationCommand: { type: 'string', description: 'Optional verification command to set or update' },
         },
         required: ['milestone_id', 'status'],
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-goal",
-  "version": "0.2.27",
+  "version": "0.2.29",
   "description": "Core Goal Addon (Token Budget, Milestones, Git Snapshots & Retrospective Reports) for DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",
@@ -18,10 +18,6 @@
     "cordis.patch.yml",
     "LICENSE"
   ],
-  "scripts": {
-    "build:client": "node scripts/build-client.mjs",
-    "test": "node scripts/build-client.mjs --check && NODE_ENV=test node --test test/*.test.mjs"
-  },
   "keywords": [
     "dsh",
     "dsh-plugin",
@@ -60,5 +56,9 @@
   },
   "devDependencies": {
     "@deepseek-ai/schemastery": "^3.18.4"
+  },
+  "scripts": {
+    "build:client": "node scripts/build-client.mjs",
+    "test": "node scripts/build-client.mjs --check && NODE_ENV=test node --test test/*.test.mjs"
   }
-}
+}