jeopi-cli 16.2.30 → 16.3.0

package/dist/types/config/settings-schema.d.ts

@@ -189,12 +189,12 @@ export declare const SETTINGS_SCHEMA: {
     };
     readonly "advisor.includeThinking": {
         readonly type: "boolean";
-        readonly default: true;
+        readonly default: false;
         readonly ui: {
             readonly tab: "model";
             readonly group: "Advisor";
             readonly label: "Advisor Sees Thinking";
-            readonly description: "Include the primary agent's thinking blocks in advisor transcript updates. Some provider classifiers (e.g. Anthropic's reasoning_extraction) refuse payloads that replay thinking as text; the advisor also auto-disables this for the session after such a refusal.";
+            readonly description: "Include the primary agent's thinking blocks in advisor transcript updates. Off by default: a reviewer that sees the maker's own reasoning trail tends to anchor on conclusions the maker already committed to instead of bringing an independent angle (the advisor's own directive is to 'bring the angle they skipped, never re-run reasoning they already have'); the advisor still sees full messages, tool calls, results, and diffs. Some provider classifiers (e.g. Anthropic's reasoning_extraction) also refuse payloads that replay thinking as text if enabled; the advisor auto-disables this for the session after such a refusal.";
             readonly condition: "advisorEnabled";
         };
     };
@@ -4056,6 +4056,16 @@ export declare const SETTINGS_SCHEMA: {
             readonly description: "Run modes where active goals may auto-continue between turns";
         };
     };
+    readonly "goal.verifyCompletion": {
+        readonly type: "boolean";
+        readonly default: true;
+        readonly ui: {
+            readonly tab: "tasks";
+            readonly group: "Modes";
+            readonly label: "Verify Goal Completion";
+            readonly description: "Spawn an independent goal-verifier sub-agent to grade a completion claim against the objective and diff before accepting it";
+        };
+    };
     readonly "title.refreshOnReplan": {
         readonly type: "boolean";
         readonly default: true;

package/dist/types/goals/runtime.d.ts

@@ -1,5 +1,11 @@
 import { GoalEvidenceTracker } from "./evidence-gate";
 import type { Goal, GoalBudgetSteering, GoalModeState, GoalRuntimeEvent, GoalTokenUsage } from "./state";
+export interface GoalCompletionVerdict {
+    verdict: "okay" | "iterate" | "reject";
+    justification: string;
+    summary?: string;
+    requiredFixes: string[];
+}
 export interface GoalRuntimeHost {
     getState(): GoalModeState | undefined;
     setState(state: GoalModeState | undefined): void;
@@ -11,6 +17,16 @@ export interface GoalRuntimeHost {
         content: string;
         deliverAs?: "steer" | "followUp" | "nextTurn";
     }): Promise<void>;
+    /**
+     * Spawn an independent grader sub-agent to verdict a completion claim against
+     * the objective and the actual repo diff (article gap: "the agent that wrote
+     * the code is not the agent that grades it"). The sub-agent sees only the
+     * objective + evidence text passed here plus its own repo inspection — never
+     * this session's transcript/reasoning. Optional: hosts that don't wire this
+     * (e.g. test harnesses, `goal.verifyCompletion` disabled) skip independent
+     * grading and fall back to the deterministic evidence gate alone.
+     */
+    verifyCompletion?(objective: string, evidence: string): Promise<GoalCompletionVerdict>;
     now?(): number;
 }
 export interface GoalTurnSnapshot {

package/dist/types/goals/verifier.d.ts

@@ -0,0 +1,9 @@
+import type { ToolSession } from "../tools";
+import type { GoalCompletionVerdict } from "./runtime";
+/**
+ * Grade a goal-completion claim with the independent `goal-verifier` sub-agent.
+ * Never throws: a spawn failure (depth limit, disabled agent, no model) fails
+ * open to `iterate` so it costs one corrective bounce, the same as a genuine
+ * gap — never a silent skip of independent grading, never a permanent block.
+ */
+export declare function verifyGoalCompletion(session: ToolSession, objective: string, evidence: string): Promise<GoalCompletionVerdict>;

package/dist/types/session/agent-session.d.ts

@@ -35,7 +35,7 @@ import type { ExtensionRunner } from "../extensibility/extensions";
 import type { CompactOptions, ContextUsage } from "../extensibility/extensions/types";
 import type { Skill, SkillWarning } from "../extensibility/skills";
 import { type FileSlashCommand } from "../extensibility/slash-commands";
-import { GoalRuntime } from "../goals/runtime";
+import { type GoalCompletionVerdict, GoalRuntime } from "../goals/runtime";
 import type { Goal, GoalModeState } from "../goals/state";
 import type { HindsightSessionState } from "../hindsight/state";
 import { type IrcMessage } from "../irc/bus";
@@ -124,13 +124,19 @@ export type AgentSessionEvent = AgentEvent | {
 export type AgentSessionEventListener = (event: AgentSessionEvent) => void;
 /**
  * Budget for callers on the user-visible `/quit` / `/exit` shutdown path that
- * want to cap how long they wait for `MnemopiSessionState.dispose()` to finish
- * its consolidate pass. Consolidate fires fresh LLM fact extractions, each a
- * 1–3 s round-trip, so interactive shutdown passes this budget to keep the
- * UI responsive. Callers that keep the process/session host alive must omit it
- * so dispose still awaits the full consolidate-then-close pipeline.
+ * want to cap how long they wait for `MnemopiSessionState.dispose()` (and the
+ * Hindsight retain-queue flush, see the dispose() call site) to finish writing
+ * this session's memory before the process exits. Consolidate fires fresh LLM
+ * fact extractions, each a 1-3s round-trip; the retain-queue flush is a single
+ * HTTP POST. The prior 1500ms budget was tighter than a single extraction
+ * round-trip, so it lost the race on effectively every session with any
+ * memory-worthy content — "write before walking away" in name only. 8s still
+ * bounds worst-case UI unresponsiveness on /exit while giving a small
+ * consolidation batch (1-3 facts) a realistic chance to land before the
+ * process exits. Callers that keep the process/session host alive must omit
+ * it so dispose still awaits the full write pipeline unbounded.
  */
-export declare const SHUTDOWN_CONSOLIDATE_BUDGET_MS = 1500;
+export declare const SHUTDOWN_CONSOLIDATE_BUDGET_MS = 8000;
 export interface AgentSessionDisposeOptions {
     mnemopiConsolidateTimeoutMs?: number;
     /**
@@ -225,6 +231,15 @@ export interface AgentSessionConfig {
     }>;
     /** Rebuild the SSH tool from current capability discovery results. */
     reloadSshTool?: () => Promise<AgentTool | null>;
+    /**
+     * Independent-verifier bridge for goal-mode completion (see goals/verifier.ts).
+     * Spawns the bundled `goal-verifier` sub-agent to grade a completion claim against
+     * the objective and the actual repo diff — a fresh session/context, no exposure to
+     * this session's transcript. Wired from sdk.ts (needs the constructed `toolSession`).
+     * Undefined when `goal.verifyCompletion` is off or the caller has no tool session
+     * (e.g. minimal SDK embedders) — GoalRuntime skips independent grading in that case.
+     */
+    verifyGoalCompletion?: (objective: string, evidence: string) => Promise<GoalCompletionVerdict>;
     requestedToolNames?: ReadonlySet<string>;
     /**
      * Optional accessor for live MCP server instructions. Read by the session's

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "jeopi-cli",
-	"version": "16.2.30",
+	"version": "16.3.0",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/akillness/jeopi",
 	"author": "Can Boluk",
@@ -57,17 +57,17 @@
 		"@agentclientprotocol/sdk": "0.25.0",
 		"@babel/parser": "^7.29.7",
 		"@mozilla/readability": "^0.6.0",
-		"jeopi-hashline": "16.2.30",
-		"jeopi-stats": "16.2.30",
-		"jeopi-agent-core": "16.2.30",
-		"jeopi-ai": "16.2.30",
-		"jeopi-catalog": "16.2.30",
-		"jeopi-mnemopi": "16.2.30",
-		"jeopi-natives": "16.2.30",
-		"jeopi-tui": "16.2.30",
-		"jeopi-utils": "16.2.30",
-		"jeopi-wire": "16.2.30",
-		"jeopi-snapcompact": "16.2.30",
+		"jeopi-hashline": "16.3.0",
+		"jeopi-stats": "16.3.0",
+		"jeopi-agent-core": "16.3.0",
+		"jeopi-ai": "16.3.0",
+		"jeopi-catalog": "16.3.0",
+		"jeopi-mnemopi": "16.3.0",
+		"jeopi-natives": "16.3.0",
+		"jeopi-tui": "16.3.0",
+		"jeopi-utils": "16.3.0",
+		"jeopi-wire": "16.3.0",
+		"jeopi-snapcompact": "16.3.0",
 		"@opentelemetry/api": "^1.9.1",
 		"@opentelemetry/context-async-hooks": "^2.7.1",
 		"@opentelemetry/exporter-trace-otlp-proto": "^0.218.0",

package/src/autoresearch/index.ts

@@ -30,6 +30,16 @@ import type { AutoresearchRuntime, ExperimentResult, PendingRunSummary } from ".
 
 const EXPERIMENT_TOOL_NAMES = ["init_experiment", "run_experiment", "log_experiment", "update_notes"];
 
+/**
+ * Cross-process auto-resume window: a pending (run-but-never-logged) experiment
+ * completed within this long ago is resumed automatically on the next session
+ * load; older ones are left for the user to inspect and resume by hand. Bounds
+ * the "open your laptop, the loop picks back up" pattern to realistic gaps
+ * (overnight, a workday) without silently relaunching token-spending work
+ * against a session nobody touched in weeks.
+ */
+const AUTORESEARCH_RESUME_STALENESS_MS = 24 * 60 * 60 * 1000;
+
 export const createAutoresearchExtension: ExtensionFactory = api => {
 	const runtimeStore = createRuntimeStore();
 	const dashboard = createDashboardController();
@@ -47,7 +57,7 @@ export const createAutoresearchExtension: ExtensionFactory = api => {
 		return { session, currentBranch };
 	};
 
-	const rehydrate = async (ctx: ExtensionContext): Promise<void> => {
+	const rehydrate = async (ctx: ExtensionContext, resumeEligible: boolean): Promise<void> => {
 		const runtime = getRuntime(ctx);
 		const control = reconstructControlState(ctx.sessionManager.getBranch());
 		runtime.goal = control.goal;
@@ -69,13 +79,15 @@ export const createAutoresearchExtension: ExtensionFactory = api => {
 		const onActiveBranch = session === null || session.branch === null || session.branch === currentBranch;
 		runtime.autoresearchMode = control.autoresearchMode && onActiveBranch;
 
+		let pendingRow: RunRow | null = null;
 		if (session && onActiveBranch) {
 			const storage = await openAutoresearchStorageIfExists(ctx.cwd);
 			if (storage) {
 				const loggedRuns = storage.listLoggedRuns(session.id);
 				runtime.state = buildExperimentState(session, loggedRuns);
 				runtime.goal = runtime.goal ?? session.goal;
-				runtime.lastRunSummary = pendingRunSummaryFromRow(storage.getPendingRun(session.id));
+				pendingRow = storage.getPendingRun(session.id);
+				runtime.lastRunSummary = pendingRunSummaryFromRow(pendingRow);
 			} else {
 				runtime.state = createExperimentState();
 				runtime.lastRunSummary = null;
@@ -102,6 +114,41 @@ export const createAutoresearchExtension: ExtensionFactory = api => {
 		if (toolsChanged) {
 			await api.setActiveTools(nextActiveTools);
 		}
+
+		// Auto-rearm across a process restart (article gap: "the mode itself has to be
+		// manually re-armed with /autoresearch after a restart, since session_shutdown
+		// doesn't leave anything wired to auto-relaunch" — the "morning briefing"/
+		// nightly-loop pattern requires the NEXT process to pick a pending run back up
+		// on its own, not wait for the user to notice and retype /autoresearch).
+		// `autoResumeArmed` is deliberately NOT restored here (reset above, matching
+		// existing behavior) — that flag is a live in-process signal set by the
+		// experiment tools mid-run; it cannot be reconstructed from persisted state
+		// and re-arming it unconditionally on every resume would fire even when the
+		// prior process ended cleanly with nothing left to continue. The only
+		// cross-restart-durable signal is an actual pending (run-but-never-logged)
+		// run row, so that's the sole trigger here.
+		if (
+			resumeEligible &&
+			runtime.autoresearchMode &&
+			pendingRow?.completedAt !== undefined &&
+			pendingRow.completedAt !== null &&
+			Date.now() - pendingRow.completedAt <= AUTORESEARCH_RESUME_STALENESS_MS &&
+			!ctx.hasPendingMessages()
+		) {
+			const pendingRun = runtime.lastRunSummary;
+			runtime.lastAutoResumePendingRunNumber = pendingRow.id;
+			api.sendMessage(
+				{
+					customType: "autoresearch-resume",
+					content: prompt.render(resumeMessageTemplate, {
+						has_pending_run: Boolean(pendingRun),
+					}),
+					display: false,
+					attribution: "agent",
+				},
+				{ deliverAs: "nextTurn", triggerTurn: true },
+			);
+		}
 	};
 
 	const setMode = (
@@ -245,10 +292,17 @@ export const createAutoresearchExtension: ExtensionFactory = api => {
 		},
 	});
 
-	api.on("session_start", (_event, ctx) => rehydrate(ctx));
-	api.on("session_switch", (_event, ctx) => rehydrate(ctx));
-	api.on("session_branch", (_event, ctx) => rehydrate(ctx));
-	api.on("session_tree", (_event, ctx) => rehydrate(ctx));
+	api.on("session_start", (_event, ctx) => rehydrate(ctx, true));
+	// "resume" = picked from the /resume session picker or `jeopi -r`, the exact
+	// "reopen your laptop, the loop should still be going" moment the article
+	// describes. "new"/"fork" start a fresh conversation off old history — no
+	// auto-continuation there, matching session_start's "don't fire on plain
+	// process launch into an unrelated session" restraint.
+	api.on("session_switch", (event, ctx) => rehydrate(ctx, event.reason === "resume"));
+	// Mid-conversation navigation (branch off an earlier message, move through the
+	// tree), not a process/session restart — never auto-fires a fresh turn here.
+	api.on("session_branch", (_event, ctx) => rehydrate(ctx, false));
+	api.on("session_tree", (_event, ctx) => rehydrate(ctx, false));
 	api.on("session_shutdown", (_event, ctx) => {
 		dashboard.clear(ctx);
 		runtimeStore.clear(getSessionKey(ctx));

package/src/config/settings-schema.ts

@@ -416,13 +416,13 @@ export const SETTINGS_SCHEMA = {
 	},
 	"advisor.includeThinking": {
 		type: "boolean",
-		default: true,
+		default: false,
 		ui: {
 			tab: "model",
 			group: "Advisor",
 			label: "Advisor Sees Thinking",
 			description:
-				"Include the primary agent's thinking blocks in advisor transcript updates. Some provider classifiers (e.g. Anthropic's reasoning_extraction) refuse payloads that replay thinking as text; the advisor also auto-disables this for the session after such a refusal.",
+				"Include the primary agent's thinking blocks in advisor transcript updates. Off by default: a reviewer that sees the maker's own reasoning trail tends to anchor on conclusions the maker already committed to instead of bringing an independent angle (the advisor's own directive is to 'bring the angle they skipped, never re-run reasoning they already have'); the advisor still sees full messages, tool calls, results, and diffs. Some provider classifiers (e.g. Anthropic's reasoning_extraction) also refuse payloads that replay thinking as text if enabled; the advisor auto-disables this for the session after such a refusal.",
 			condition: "advisorEnabled",
 		},
 	},
@@ -3946,6 +3946,18 @@ export const SETTINGS_SCHEMA = {
 		},
 	},
 
+	"goal.verifyCompletion": {
+		type: "boolean",
+		default: true,
+		ui: {
+			tab: "tasks",
+			group: "Modes",
+			label: "Verify Goal Completion",
+			description:
+				"Spawn an independent goal-verifier sub-agent to grade a completion claim against the objective and diff before accepting it",
+		},
+	},
+
 	"title.refreshOnReplan": {
 		type: "boolean",
 		default: true,

package/src/goals/runtime.ts

@@ -6,6 +6,13 @@ import { assertSubstantiveCompletionEvidence } from "./completion-evidence";
 import { GoalEvidenceTracker, isVerificationSignal, MUTATION_TOOL_NAMES } from "./evidence-gate";
 import type { Goal, GoalBudgetSteering, GoalModeState, GoalRuntimeEvent, GoalTokenUsage } from "./state";
 
+export interface GoalCompletionVerdict {
+	verdict: "okay" | "iterate" | "reject";
+	justification: string;
+	summary?: string;
+	requiredFixes: string[];
+}
+
 export interface GoalRuntimeHost {
 	getState(): GoalModeState | undefined;
 	setState(state: GoalModeState | undefined): void;
@@ -17,6 +24,16 @@ export interface GoalRuntimeHost {
 		content: string;
 		deliverAs?: "steer" | "followUp" | "nextTurn";
 	}): Promise<void>;
+	/**
+	 * Spawn an independent grader sub-agent to verdict a completion claim against
+	 * the objective and the actual repo diff (article gap: "the agent that wrote
+	 * the code is not the agent that grades it"). The sub-agent sees only the
+	 * objective + evidence text passed here plus its own repo inspection — never
+	 * this session's transcript/reasoning. Optional: hosts that don't wire this
+	 * (e.g. test harnesses, `goal.verifyCompletion` disabled) skip independent
+	 * grading and fall back to the deterministic evidence gate alone.
+	 */
+	verifyCompletion?(objective: string, evidence: string): Promise<GoalCompletionVerdict>;
 	now?(): number;
 }
 
@@ -122,6 +139,8 @@ export class GoalRuntime {
 	#turnSnapshot: GoalTurnSnapshot | undefined;
 	#wallClock: GoalWallClockSnapshot;
 	#budgetReportedFor: string | undefined;
+	/** Set when an independent-verifier non-okay verdict was bounced once; cleared by any new mutation/verification or a fresh goal. Mirrors GoalEvidenceTracker's bypass latch, kept separate because it gates a different (probabilistic) signal. */
+	#verifierBypassArmed = false;
 	#accountingTail: Promise<void> = Promise.resolve();
 
 	constructor(host: GoalRuntimeHost) {
@@ -219,10 +238,12 @@ export class GoalRuntime {
 		if (!this.#hasAccountingState()) return;
 		if (MUTATION_TOOL_NAMES[toolName]) {
 			this.#evidence.recordMutation();
+			this.#verifierBypassArmed = false;
 			return;
 		}
 		if (detail && isVerificationSignal(detail.command ?? "", detail.outputHead ?? "")) {
 			this.#evidence.recordVerification();
+			this.#verifierBypassArmed = false;
 		}
 	}
 
@@ -418,6 +439,7 @@ export class GoalRuntime {
 			const state = this.#createGoalState(objective, input.tokenBudget);
 			this.#budgetReportedFor = undefined;
 			this.#evidence.reset();
+			this.#verifierBypassArmed = false;
 			this.#markActiveAccounting(state.goal);
 			await this.#commitState(state, { persist: "goal" });
 			return state;
@@ -437,6 +459,7 @@ export class GoalRuntime {
 			const state = this.#createGoalState(objective, input.tokenBudget);
 			this.#budgetReportedFor = undefined;
 			this.#evidence.reset();
+			this.#verifierBypassArmed = false;
 			this.#markActiveAccounting(state.goal);
 			await this.#commitState(state, { persist: "goal" });
 			return state;
@@ -522,6 +545,34 @@ export class GoalRuntime {
 			if (gate.block) {
 				throw new Error(gate.message);
 			}
+			// Independent grader (goal-verifier sub-agent, see GoalRuntimeHost.verifyCompletion):
+			// maker != grader, per the compounding-loop primitive — the same agent that did
+			// the work does not get to be the sole judge of whether it's done. Same bounce-once
+			// shape as the deterministic gate above, kept as a separate latch since this signal
+			// is probabilistic (an LLM verdict), not mechanical.
+			if (this.#host.verifyCompletion) {
+				const verdict = await this.#host.verifyCompletion(state.goal.objective, verifiedEvidence);
+				if (verdict.verdict !== "okay") {
+					if (this.#verifierBypassArmed) {
+						// Second attempt with no new mutation/verification since the bounce:
+						// escape hatch for a verifier false-positive-reject/iterate.
+						this.#verifierBypassArmed = false;
+					} else {
+						this.#verifierBypassArmed = true;
+						const fixes =
+							verdict.requiredFixes.length > 0
+								? `\nRequired fixes:\n${verdict.requiredFixes.map(fix => `- ${fix}`).join("\n")}`
+								: "";
+						throw new Error(
+							`Completion blocked: independent verifier verdict was "${verdict.verdict}", not "okay". ` +
+								`${verdict.justification}${fixes}\nAddress the gaps above, then call complete again. ` +
+								"If the verifier is wrong, call complete again unchanged to override.",
+						);
+					}
+				} else {
+					this.#verifierBypassArmed = false;
+				}
+			}
 			state.enabled = false;
 			state.goal.status = "complete";
 			state.goal.completionEvidence = verifiedEvidence;

package/src/goals/verifier.ts

@@ -0,0 +1,100 @@
+/**
+ * Independent-verifier bridge for goal-mode completion (see GoalRuntimeHost.verifyCompletion
+ * in runtime.ts). Spawns the bundled `goal-verifier` sub-agent — a fresh session with its own
+ * kernel, its own read-only tool set, and no exposure to the maker's transcript/reasoning —
+ * to grade a completion claim against the objective and the actual repo diff. Reuses the eval
+ * tool's `agent()` bridge as a plain async call (no eval kernel required outside eval cells;
+ * `withBridgeTimeoutPause` in agent-bridge.ts is a no-op when no `emitStatus` sink is wired).
+ */
+import { runEvalAgent } from "../eval/agent-bridge";
+import { getBundledAgent } from "../task/agents";
+import type { ToolSession } from "../tools";
+import type { GoalCompletionVerdict } from "./runtime";
+
+const VERIFIER_AGENT_NAME = "goal-verifier";
+
+/** Cap the evidence claim embedded in the verifier prompt; the verifier re-derives ground truth from the repo, not from a long claim. */
+const MAX_EVIDENCE_CHARS = 4000;
+
+function parseVerdict(output: string): GoalCompletionVerdict {
+	let data: unknown;
+	try {
+		data = JSON.parse(output);
+	} catch {
+		// Verifier didn't return a structured payload (refused, crashed, plain-text
+		// reply). Fail open to "iterate" rather than silently trusting completion —
+		// a broken verifier bounces once instead of being bypassed unnoticed.
+		return {
+			verdict: "iterate",
+			justification: `goal-verifier did not return a structured verdict. Raw output: ${output.slice(0, 500)}`,
+			requiredFixes: [],
+		};
+	}
+	if (data === null || typeof data !== "object") {
+		return {
+			verdict: "iterate",
+			justification: "goal-verifier returned a non-object payload.",
+			requiredFixes: [],
+		};
+	}
+	const record = data as Record<string, unknown>;
+	const verdict = record.verdict;
+	if (verdict !== "okay" && verdict !== "iterate" && verdict !== "reject") {
+		return {
+			verdict: "iterate",
+			justification: "goal-verifier returned an unrecognized verdict value.",
+			requiredFixes: [],
+		};
+	}
+	const rawFixes = record.required_fixes;
+	const requiredFixes = Array.isArray(rawFixes)
+		? rawFixes.filter((fix): fix is string => typeof fix === "string")
+		: [];
+	const justification = typeof record.justification === "string" ? record.justification : "";
+	const summary = typeof record.summary === "string" ? record.summary : undefined;
+	return { verdict, justification, summary, requiredFixes };
+}
+
+/**
+ * Grade a goal-completion claim with the independent `goal-verifier` sub-agent.
+ * Never throws: a spawn failure (depth limit, disabled agent, no model) fails
+ * open to `iterate` so it costs one corrective bounce, the same as a genuine
+ * gap — never a silent skip of independent grading, never a permanent block.
+ */
+export async function verifyGoalCompletion(
+	session: ToolSession,
+	objective: string,
+	evidence: string,
+): Promise<GoalCompletionVerdict> {
+	const truncatedEvidence =
+		evidence.length > MAX_EVIDENCE_CHARS ? `${evidence.slice(0, MAX_EVIDENCE_CHARS)}\n[truncated]` : evidence;
+	const verifierPrompt =
+		`<objective>\n${objective}\n</objective>\n\n` +
+		`<evidence>\n${truncatedEvidence}\n</evidence>\n\n` +
+		"Verdict whether the objective above is genuinely satisfied by the repo's current state. " +
+		"The evidence is the maker's claim, not a fact — verify it independently.";
+	try {
+		// Explicit schema, not the agent's own frontmatter default: runEvalAgent (the
+		// eval `agent()` bridge) only applies `outputSchema` when the caller supplies
+		// one — unlike the `task` tool, it never falls back to `effectiveAgent.output`
+		// (task/index.ts). Read the bundled definition's own `output` so this can't
+		// drift from goal-verifier.md's declared shape. Omit the key entirely when
+		// undefined: `Object.hasOwn` (agent-bridge.ts's `structured` check) is true
+		// for an explicit `schema: undefined`, which would wrongly disable the
+		// agent's frontmatter-schema fallback in the bridge.
+		const schema = getBundledAgent(VERIFIER_AGENT_NAME)?.output;
+		const args =
+			schema === undefined
+				? { prompt: verifierPrompt, agent: VERIFIER_AGENT_NAME }
+				: { prompt: verifierPrompt, agent: VERIFIER_AGENT_NAME, schema };
+		const result = await runEvalAgent(args, { session });
+		return parseVerdict(result.text);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		return {
+			verdict: "iterate",
+			justification: `Independent verifier could not run: ${message}`,
+			requiredFixes: [],
+		};
+	}
+}

package/src/prompts/agents/goal-verifier.md

@@ -0,0 +1,51 @@
+---
+name: goal-verifier
+description: "Read-only independent grader for goal-mode completion. Verdicts whether the actual diff satisfies the stated objective and evidence claim — sees only the objective, evidence, and repo state, never the maker's reasoning transcript."
+tools: read, grep, glob, bash, ast_grep
+spawns: explore
+model: pi/slow
+thinking-level: high
+output:
+  properties:
+    verdict:
+      metadata:
+        description: Completion verdict for the goal under review
+      enum: [okay, iterate, reject]
+    justification:
+      metadata:
+        description: Evidence-backed reasoning for the verdict, citing inspected files/diff hunks/command output
+      type: string
+    summary:
+      metadata:
+        description: 1-3 sentence plain-text summary of what was actually verified
+      type: string
+  optionalProperties:
+    required_fixes:
+      metadata:
+        description: Concrete gaps that must be fixed before the goal can be marked complete (empty for okay)
+      elements:
+        type: string
+---
+
+Decide whether a goal-mode objective is genuinely satisfied by the repo's current state — you are the independent grader, not the agent that did the work.
+
+<procedure>
+1. Read the `<objective>` and `<evidence>` given to you below. Treat both as claims to verify, not facts.
+2. Run `git status` and `git diff` (add `git diff --stat` first on a large diff) to see every file actually changed this session. Read the changed files for context beyond the diff hunks when the diff alone doesn't establish correctness.
+3. If the evidence claims a verification command ran (test/build/lint/typecheck), re-run the narrowest form of that command yourself against the current tree — do not trust the claim without confirming it. Do not run a full/slow suite when a scoped one covers the changed files; do not run anything destructive.
+4. Cross-check the diff against the objective: does every part of the objective have corresponding evidence in the diff, or a clear reason no code change was needed for that part? Flag objective clauses with no corresponding change.
+5. Decide the verdict and record it with the structured output.
+</procedure>
+
+<constraints>
+- Read-only: you NEVER edit, write, or revert files. Verification commands you run must not mutate the tree (no `--fix`, no auto-format writes, no `git commit`/`git checkout`).
+- Do not invent problems; reject or iterate only with concrete, cited gaps between the objective and the diff.
+- A verdict grounded in nothing is worthless: your justification MUST name the files/diff hunks/commands you actually inspected or ran, and their actual output.
+- You have no access to the maker's reasoning, chat transcript, or thinking blocks — judge the objective against the artifact (diff + verification output) alone. If the evidence text asserts something the diff doesn't support, that is a gap, not a detail to take on faith.
+</constraints>
+
+<verdicts>
+- `okay` — every part of the objective is satisfied by the diff, and claimed verification actually holds when re-checked.
+- `iterate` — real progress exists but named gaps remain (missing piece of the objective, evidence claim that doesn't hold up, or verification that fails when re-run); list each in `required_fixes`.
+- `reject` — the diff does not address the objective at all, or the evidence is fabricated/contradicted by re-running it.
+</verdicts>

package/src/sdk.ts

@@ -76,6 +76,7 @@ import {
 	setActiveSkills,
 } from "./extensibility/skills";
 import { type FileSlashCommand, loadSlashCommands as loadSlashCommandsInternal } from "./extensibility/slash-commands";
+import { verifyGoalCompletion } from "./goals/verifier";
 import type { HindsightSessionState } from "./hindsight/state";
 import { LocalProtocolHandler, type LocalProtocolOptions } from "./internal-urls";
 import { LSP_STARTUP_EVENT_CHANNEL, type LspStartupEvent } from "./lsp/startup-events";
@@ -2756,6 +2757,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			providerSessionId: options.providerSessionId,
 			parentEvalSessionId: options.parentEvalSessionId,
 			advisorTools,
+			verifyGoalCompletion: (objective, evidence) => verifyGoalCompletion(toolSession, objective, evidence),
 			titleSystemPrompt: options.titleSystemPrompt,
 		});
 		hasSession = true;