pi-goal-list-loop-audit 0.24.9 → 0.25.0

package/README.md

@@ -200,7 +200,10 @@ No external watchdog plugin needed.
 /glla tokenlimit=0                   # explicitly no cap (the default)
 /glla wedgealert=30                  # hung-command alert minutes (default: 30, 0 = off)
 /glla autoresume=on                  # held goals/loops auto-resume in fresh sessions (unattended rigs)
-/glla auditcap=5                     # pause the goal after N consecutive auditor disapprovals (default 3, 0 = unlimited)
+/glla auditcap=5                     # pause the goal after N consecutive auditor disapprovals (default 5, 0 = unlimited)
+/glla aggressivemode=on               # keep-going defaults: autoResume, cap 10, stuck 10, wedge off, quota auto-retry, cap→TODOs
+/glla quotaretryminutes=60            # minutes before auto-retrying a quota-exhausted auditor
+/glla stuckmax=10                     # consecutive stuck interventions before a loop stops (default 5)
 /glla auditfeedbackchars=800         # cap the executor-visible auditor report (default 0 = full report)
 /glla autoaccept=on                  # drafts ACTIVATE without the Confirm dialog (unattended rigs)
 /glla project tokenlimit=500         # rare per-project override

package/extensions/goal-loop-auditor.ts

@@ -107,6 +107,7 @@ function buildGoalAuditorPrompt(goal: Goal, completionSummary: string | null | u
     "Use read/grep/find/ls/bash as needed to inspect real artifacts. Do not mutate files or run destructive commands.",
     "If the work is only an alpha scaffold, generated template, shallow draft, proxy milestone, or lacks the user-facing value requested, disapprove.",
     "If any explicit requirement is missing, weakly verified, contradicted, or not inspectable with the available evidence, disapprove.",
+    "Objective shift: if the executor's <completion_summary> explicitly states that the work has shifted to other items (different from the original <goal> objective), and the shift is justified — e.g. the original objective was blocked, the agent pivoted to higher-ROI items, and the new items are independently verified — accept the shift as evidence of reasonable engineering judgment. Do NOT rigidly disapprove because the original objective is not literally shipped; audit the shifted work on its merits and say so in the report.",
     "Return a concise audit report. The final line MUST be exactly one of:",
     "<approved/>",
     "<disapproved/>",

package/extensions/goal-loop-core.ts

@@ -9,6 +9,7 @@
 
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { execSync } from "node:child_process";
 
 // =================================================================
 // Types
@@ -144,6 +145,10 @@ export interface Goal {
   stopReason?: string;
   pauseReason?: string;
   pauseSuggestedAction?: string;
+  /** v0.25.0 (contract item 22): auditor objections extracted as TODOs when
+   * aggressiveMode keeps the goal active past the disapproval cap. Rendered
+   * into every continuation prompt until the next audit clears them. */
+  pendingTasks?: string[];
   activePath?: string;
   archivedPath?: string;
   usage: {
@@ -761,3 +766,155 @@ export function missingGllaTools(activeNames: readonly string[]): readonly GllaT
   const active = new Set(activeNames);
   return GLLA_TOOL_NAMES.filter((n) => !active.has(n));
 }
+
+// -----------------------------------------------------------------
+// v0.25.0 — eager-continuation contract helpers
+// -----------------------------------------------------------------
+
+/** Base defaults (aggressiveMode OFF). auditCap base raised 3 → 5 in
+ * v0.25.0 (contract item 7 — the "fairly eager" baseline). */
+export const BASE_AUDIT_CAP = 5;
+export const BASE_STUCK_MAX_INTERVENTIONS = 5;
+/** aggressiveMode defaults (contract item 5). Explicit per-key settings
+ * always win over these — aggressiveMode flips DEFAULTS, not user choices. */
+export const AGGRESSIVE_AUDIT_CAP = 10;
+export const AGGRESSIVE_STUCK_MAX_INTERVENTIONS = 10;
+export const DEFAULT_QUOTA_RETRY_MINUTES = 60;
+
+export interface EffectiveAggressiveSettings {
+  auditCap: number;
+  stuckMaxInterventions: number;
+  /** 0 = wedge alerts off. */
+  wedgeAlertMinutes: number;
+  autoResume: boolean;
+  aggressiveMode: boolean;
+}
+
+/** Layered resolution: explicit per-key value > aggressiveMode default >
+ * base default (contract items 5+7). Pure so tests can assert the matrix
+ * without a settings file. */
+export function resolveEffectiveAggressiveSettings(s: {
+  aggressiveMode?: boolean;
+  auditCap?: number;
+  stuckMaxInterventions?: number;
+  wedgeAlertMinutes?: number;
+  autoResume?: boolean;
+}): EffectiveAggressiveSettings {
+  const aggressiveMode = s.aggressiveMode === true;
+  return {
+    aggressiveMode,
+    auditCap: s.auditCap ?? (aggressiveMode ? AGGRESSIVE_AUDIT_CAP : BASE_AUDIT_CAP),
+    stuckMaxInterventions:
+      s.stuckMaxInterventions ?? (aggressiveMode ? AGGRESSIVE_STUCK_MAX_INTERVENTIONS : BASE_STUCK_MAX_INTERVENTIONS),
+    wedgeAlertMinutes: s.wedgeAlertMinutes ?? (aggressiveMode ? 0 : 30),
+    autoResume: s.autoResume ?? aggressiveMode,
+  };
+}
+
+/** Extract up to `cap` actionable objection lines from an auditor report
+ * (contract item 22): numbered/bulleted lines, most recent last-report
+ * wins, longest tails trimmed. Pure — the audit-cap branch and its test
+ * share this. */
+export function extractPendingTasks(report: string, cap = 5): string[] {
+  const out: string[] = [];
+  for (const raw of report.split("\n")) {
+    const line = raw.trim();
+    const m = line.match(/^(?:[-*•]|\d+[.)])\s+(.{8,200})$/);
+    if (!m) continue;
+    const text = m[1]!.trim();
+    // Skip pure-evidence bullets ("file X exists", "tests pass") — we want
+    // OBJECTIONS: missing/failing/not-done language.
+    if (!/miss|fail|not |no |lack|absent|doesn|didn|won|can'?t|remain|todo|fix|requir|incomplete|unverified/i.test(text)) continue;
+    if (!out.includes(text)) out.push(text);
+    if (out.length >= cap) break;
+  }
+  return out;
+}
+
+/** Contract item 23: is the auditor's IMPOSSIBLE reason about the WHOLE
+ * goal or only part of it? Default "full" (safe — keeps the pause);
+ * partial only on explicit subset language. */
+export function classifyImpossibleReason(reason: string): "partial" | "full" {
+  if (/\b(partial|some items|subset|remaining items|narrow|only .{0,30}(item|part|section)|the rest|rest of)\b/i.test(reason)) {
+    return "partial";
+  }
+  return "full";
+}
+
+/** Contract items 25/28: does this objective read as a full-audit /
+ * survey pivot? */
+export function isFullAuditObjective(objective: string): boolean {
+  return /full audit|survey|find all|task ?list|enumerate|audit the (whole |entire )?project/i.test(objective);
+}
+
+// --- Auto-committer daemon sentinel (contract item 31) ---
+
+/** Sentinel the auto-committer (dracon-sync) filter checks: when present,
+ * the daemon must not rewrite/commit in this repo. The agent writes it
+ * after detecting filter-branch damage (see DETACHED COMMIT DETECTION in
+ * the continuation prompt). */
+export const PAUSE_AUTO_COMMIT_SENTINEL = ".pause-auto-commit";
+
+export function pauseAutoCommit(cwd: string, reason: string): string {
+  const dir = path.join(cwd, ".pi-glla");
+  fs.mkdirSync(dir, { recursive: true });
+  const file = path.join(dir, PAUSE_AUTO_COMMIT_SENTINEL);
+  fs.writeFileSync(file, `pausedAt: ${nowIso()}\nreason: ${reason}\n`, "utf-8");
+  return file;
+}
+
+export function resumeAutoCommit(cwd: string): boolean {
+  const file = path.join(cwd, ".pi-glla", PAUSE_AUTO_COMMIT_SENTINEL);
+  try {
+    fs.unlinkSync(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function isAutoCommitPaused(cwd: string): boolean {
+  try {
+    fs.accessSync(path.join(cwd, ".pi-glla", PAUSE_AUTO_COMMIT_SENTINEL));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// --- Heartbeat ship-suppression (contract item 27) ---
+
+/** Suppress the heartbeat when work shipped very recently — a session
+ * that just committed is transitioning, not stalled. Pure; the tick
+ * gathers the timestamps. */
+export function shouldSuppressHeartbeatForRecentShip(args: {
+  nowMs: number;
+  lastShippedAtMs: number | null;
+  windowMs?: number;
+}): boolean {
+  const windowMs = args.windowMs ?? 5 * 60_000;
+  if (args.lastShippedAtMs === null) return false;
+  return args.nowMs - args.lastShippedAtMs < windowMs;
+}
+
+/** Best-effort "when did work last ship" for a repo: newest of the HEAD
+ * commit time and the .pi-glla state file mtime. Null when unknown. */
+export function lastShippedAtMs(cwd: string): number | null {
+  let best: number | null = null;
+  try {
+    const out = execSync("git log -1 --format=%ct", { cwd, stdio: ["ignore", "pipe", "ignore"] })
+      .toString()
+      .trim();
+    const sec = Number(out);
+    if (Number.isFinite(sec) && sec > 0) best = sec * 1000;
+  } catch {
+    /* not a git repo or no commits */
+  }
+  try {
+    const mtime = fs.statSync(path.join(cwd, ".pi-glla", "active.jsonl")).mtimeMs;
+    if (best === null || mtime > best) best = mtime;
+  } catch {
+    /* no state file yet */
+  }
+  return best;
+}

package/extensions/goal-settings.ts

@@ -0,0 +1,153 @@
+// pi-goal-list-loop-audit — v0.25.0
+// extensions/goal-settings.ts
+//
+// The settings layer, extracted from loops/goal.ts so tests can drive it
+// without importing the whole extension. Two-tier config (v0.7.0): GLOBAL
+// is the normal home, PROJECT the rare local override. Resolution:
+// project > global > defaults (per key).
+
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+
+import {
+  DEFAULT_AUDIT_FEEDBACK_CHARS,
+  DEFAULT_QUOTA_RETRY_MINUTES,
+  mergeSettings,
+  piGlaDir,
+} from "./goal-loop-core.ts";
+import type { SubagentModelStrategy } from "./goal-loop-subagents.js";
+
+export interface Settings {
+  /** "provider/model-id" or bare "model-id". Unset → session model. */
+  auditorModel?: string;
+  auditorThinkingLevel?: "off" | "minimal" | "low" | "medium" | "high" | "xhigh";
+  /** Shell command run on goal complete / goal pause / loop stop; message passed as $1. */
+  notifyCmd?: string;
+  /** Per-goal token budget; crossing it pauses the goal. Off by default
+   * (opt-in guard, v0.12.0): unset/0 = no budget. */
+  tokenLimit?: number;
+  /** v0.23.2: minutes of busy-but-silent before the wedge alert fires
+   * (hung-command detector). Unset = 45; 0 = off. */
+  wedgeAlertMinutes?: number;
+  /** on → restored goals/loops/lists auto-resume even in fresh sessions
+   * (unattended rigs). Default off: restore holds until /goal resume. */
+  autoResume?: boolean;
+  /** v0.24.2: pause the goal after N consecutive auditor disapprovals (0 = unlimited).
+   * Default 5 (raised from 3 in v0.25.0, contract item 7). */
+  auditCap?: number;
+  /** Maximum auditor-report characters returned to the executor after a
+   * disapproval (0 = full report). Default 0 (full report). */
+  auditFeedbackChars?: number;
+  /** v0.25.0: flip the continuation defaults toward keep-going
+   * (contract item 5): autoResume on, auditCap 10, stuckMax 10, wedge off,
+   * quota errors auto-retry silently. Explicit per-key settings still win. */
+  aggressiveMode?: boolean;
+  /** Minutes to wait before auto-retrying a quota-exhausted auditor when
+   * the upstream gave no Retry-After hint (contract item 11). Default 60. */
+  quotaRetryMinutes?: number;
+  /** Consecutive stuck interventions before a loop stops (default 5,
+   * 10 under aggressiveMode). */
+  stuckMaxInterventions?: number;
+  /** on → propose_* drafts activate WITHOUT the Confirm dialog and the
+   * interview floor is skipped — the seed carries the intent (unattended
+   * rigs). Default off: nothing activates before the user confirms. */
+  autoAcceptDrafts?: boolean;
+  /** v0.24.6: subagent model strategy for pi-subagents default agents that
+   * pin a model (Explore pins claude-haiku-4-5, which silently routes
+   * subagents to a different provider/quota pool than the session).
+   * "inherit-parent" (default) writes a managed ~/.pi/agent/agents/Explore.md
+   * override without the model pin so subagents share the session model and
+   * its quota; "agent-default" restores upstream behavior. Applies to NEW
+   * sessions (pi-subagents registers agents at session start). */
+  subagentModelStrategy?: SubagentModelStrategy;
+  /** v0.24.6: per-agent-type model pin, e.g. { "Explore": "minimax/MiniMax-M3" }.
+   * Always wins over subagentModelStrategy — the managed override is written
+   * WITH this pin regardless of strategy. */
+  subagentModelOverrides?: Record<string, string>;
+}
+
+export const DEFAULT_SETTINGS: Settings = {
+  // Unset = follow the pi session thinking level (user selects thinking in
+  // pi, auditor follows), floor "high" — the auditor is the verification
+  // gate, depth is worth more there than speed. /glla thinking= overrides.
+  auditorThinkingLevel: undefined,
+  // v0.24.6: subagents inherit the session model by default — one quota
+  // pool, no surprise 403s from a pinned default agent's provider.
+  subagentModelStrategy: "inherit-parent",
+  auditFeedbackChars: DEFAULT_AUDIT_FEEDBACK_CHARS,
+  // v0.25.0 (contract Section B): keep-going is opt-in via aggressiveMode;
+  // the dial flips DEFAULTS, never explicit per-key user settings.
+  aggressiveMode: false,
+  quotaRetryMinutes: DEFAULT_QUOTA_RETRY_MINUTES,
+};
+
+export function globalSettingsPath(): string {
+  return path.join(os.homedir(), ".pi", "agent", "pi-goal-list-loop-audit.settings.json");
+}
+
+export function projectSettingsPath(cwd: string): string {
+  return path.join(piGlaDir(cwd), "settings.json");
+}
+
+export function readSettingsFile(file: string): Partial<Settings> {
+  try {
+    if (!fs.existsSync(file)) return {};
+    const parsed = JSON.parse(fs.readFileSync(file, "utf-8"));
+    return typeof parsed === "object" && parsed !== null ? parsed as Partial<Settings> : {};
+  } catch {
+    return {};
+  }
+}
+
+export function loadSettings(cwd: string): Settings {
+  return mergeSettings(
+    DEFAULT_SETTINGS as unknown as Record<string, unknown>,
+    readSettingsFile(globalSettingsPath()) as Record<string, unknown>,
+    readSettingsFile(projectSettingsPath(cwd)) as Record<string, unknown>,
+  ) as unknown as Settings;
+}
+
+/** Every provenance-tracked key (the /glla headless display + UI). */
+export const SETTINGS_KEYS: Array<keyof Settings> = [
+  "auditorModel",
+  "auditorThinkingLevel",
+  "notifyCmd",
+  "tokenLimit",
+  "wedgeAlertMinutes",
+  "autoResume",
+  "autoAcceptDrafts",
+  "auditCap",
+  "auditFeedbackChars",
+  "subagentModelStrategy",
+  "subagentModelOverrides",
+  "aggressiveMode",
+  "quotaRetryMinutes",
+  "stuckMaxInterventions",
+];
+
+/** Where each effective setting comes from (for the /glla display). */
+export function settingsProvenance(cwd: string): Record<keyof Settings, { value: unknown; source: "project" | "global" | "default" }> {
+  const proj = readSettingsFile(projectSettingsPath(cwd));
+  const glob = readSettingsFile(globalSettingsPath());
+  const effective = loadSettings(cwd);
+  const out: Record<string, { value: unknown; source: "project" | "global" | "default" }> = {};
+  for (const k of SETTINGS_KEYS) {
+    if ((proj as Record<string, unknown>)[k] !== undefined) out[k] = { value: (proj as any)[k], source: "project" };
+    else if ((glob as Record<string, unknown>)[k] !== undefined) out[k] = { value: (glob as any)[k], source: "global" };
+    else out[k] = { value: (effective as any)[k], source: "default" };
+  }
+  return out as Record<keyof Settings, { value: unknown; source: "project" | "global" | "default" }>;
+}
+
+export function saveSettings(scope: "global" | "project", cwd: string, patch: Partial<Settings>): void {
+  const file = scope === "global" ? globalSettingsPath() : projectSettingsPath(cwd);
+  const current = readSettingsFile(file);
+  const next: Record<string, unknown> = { ...current };
+  for (const [k, v] of Object.entries(patch)) {
+    if (v === undefined) delete next[k]; // key=unset removes the key
+    else next[k] = v;
+  }
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(next, null, 2));
+}

package/extensions/loops/goal.ts

@@ -32,7 +32,14 @@ import {
   buildTaskSummary,
   auditFeedbackExcerpt,
   DEFAULT_AUDIT_FEEDBACK_CHARS,
+  DEFAULT_QUOTA_RETRY_MINUTES,
   DEFAULT_TOKEN_LIMIT,
+  classifyImpossibleReason,
+  extractPendingTasks,
+  isFullAuditObjective,
+  lastShippedAtMs,
+  resolveEffectiveAggressiveSettings,
+  shouldSuppressHeartbeatForRecentShip,
   mergeSettings,
   parseListImport,
 
@@ -67,6 +74,22 @@ import {
   writeGoalMd,
   missingGllaTools,
 } from "../goal-loop-core.js";
+import {
+  isQuotaError,
+  parseQuotaError,
+  scheduleQuotaRetry,
+  cancelQuotaRetry,
+} from "../quota-retry.js";
+import {
+  DEFAULT_SETTINGS,
+  SETTINGS_KEYS,
+  globalSettingsPath,
+  loadSettings,
+  projectSettingsPath,
+  saveSettings,
+  settingsProvenance,
+  type Settings,
+} from "../goal-settings.js";
 import { runGoalCompletionAuditor } from "../goal-loop-auditor.js";
 import {
   REPETITION,
@@ -239,7 +262,7 @@ function heartbeatTick(): void {
   // the entire goal hostage; field-observed at 5,056s and 6,800s on the
   // same wedged tool call). Independent of the refire path, which only
   // watches idle sessions.
-  const wedgeMinutes = loadSettings(ctx.cwd).wedgeAlertMinutes ?? WEDGE_ALERT_DEFAULT_MINUTES;
+  const wedgeMinutes = resolveEffectiveAggressiveSettings(loadSettings(ctx.cwd)).wedgeAlertMinutes ?? WEDGE_ALERT_DEFAULT_MINUTES;
   if (
     shouldWedgeAlert({
       supervising: isSupervising(),
@@ -256,6 +279,18 @@ function heartbeatTick(): void {
     notifyExternal(ctx, msg);
   }
   if (!fire) return;
+  // v0.25.0 (contract item 27): a session that SHIPPED in the last 5
+  // minutes (commit or ledger write) is transitioning, not stalled —
+  // suppress the refire so rapid iteration isn't interrupted.
+  if (
+    shouldSuppressHeartbeatForRecentShip({
+      nowMs: Date.now(),
+      lastShippedAtMs: lastShippedAtMs(ctx.cwd),
+    })
+  ) {
+    appendLedger(ctx.cwd, "heartbeat_suppressed", { reason: "recent ship (<5m)" });
+    return;
+  }
   noteActivity();
   appendLedger(ctx.cwd, "heartbeat_refire", { nudgesSoFar: heartbeatNudges });
   ctx.ui.notify("Heartbeat: supervisor active but session stalled — re-firing continuation.", "info");
@@ -371,12 +406,29 @@ function continuationPrompt(goal: Goal): string {
   } catch {
     tmpl = "[template-not-found]";
   }
+  // v0.25.0 (contract items 22/28): conditional directives — aggressiveMode
+  // TODOs from the audit cap, and the full-audit fan-out directive when the
+  // objective reads as a survey pivot.
+  const directives: string[] = [];
+  const effSettings = resolveEffectiveAggressiveSettings(loadSettings(freshCtx()?.cwd ?? process.cwd()));
+  if (goal.pendingTasks && goal.pendingTasks.length > 0) {
+    directives.push(
+      `## AUDITOR TODO LIST (from ${goal.pauseReason?.includes("cap") ? "the disapproval cap" : "the last audit"})\n\nAddress these objections, in order, before re-calling complete_goal:\n${goal.pendingTasks.map((t, i) => `${i + 1}. ${t}`).join("\n")}`,
+    );
+  }
+  if (effSettings.aggressiveMode && isFullAuditObjective(goal.objective)) {
+    directives.push(
+      "## FULL-AUDIT MODE (aggressiveMode + survey objective)\n\nThis objective is a survey, not a single fix. Spawn 3+ `Explore` subagents NOW — one per subsystem, in a single message so they run in parallel — synthesize their findings, and call `propose_task_list` with the result. Do not start fixing before the task list exists.",
+    );
+  }
+  const dynamicDirectives = directives.length > 0 ? directives.join("\n\n") : "(no active directives)";
   return tmpl
     .replace(/\$\{GOAL_ID\}/g, goal.id)
     .replace(/\$\{OBJECTIVE\}/g, goal.objective)
     .replace(/\$\{VERIFICATION_CONTRACT\}/g, goal.verificationContract || "(none — auditor will decide based on objective)")
     .replace(/\$\{TASK_LIST\}/g, taskSummary)
-    .replace(/\$\{NEXT_PENDING_TASK_BLOCK\}/g, nextBlock);
+    .replace(/\$\{NEXT_PENDING_TASK_BLOCK\}/g, nextBlock)
+    .replace(/\$\{DYNAMIC_DIRECTIVES\}/g, dynamicDirectives);
 }
 
 // =================================================================
@@ -1201,7 +1253,9 @@ async function runLoopTick(ctx: ExtensionContext, event?: any): Promise<void> {
   }
   // v0.24.0: the top of the stuck ladder — bounded and surfaced, same
   // philosophy as a plateau stop. The loop ends WITH the reason, not in silence.
-  if (outcome.kind !== "stop" && (loop.consecutiveStuck ?? 0) >= REPETITION.maxInterventions) {
+  // v0.25.0: aggressiveMode raises the ladder (default 5 → 10, explicit wins).
+  const maxStuckInterventions = resolveEffectiveAggressiveSettings(loadSettings(ctx.cwd)).stuckMaxInterventions;
+  if (outcome.kind !== "stop" && (loop.consecutiveStuck ?? 0) >= maxStuckInterventions) {
     loop.active = false;
     loop.stopReason = `stuck — ${loop.lastStuckReason} (${loop.consecutiveStuck} consecutive interventions)`;
     persistState(ctx);
@@ -1501,6 +1555,7 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
     parameters: Type.Object({
       completionSummary: Type.Optional(Type.String({ description: "1-paragraph completion claim" })),
       verificationSummary: Type.Optional(Type.String({ description: "Per-item evidence for the verification contract" })),
+      newObjective: Type.Optional(Type.String({ description: "v0.25.0 (contract item 15): when the work has legitimately shifted, pass the new objective here — it atomically replaces the goal objective AND the audit proceeds against the NEW objective in this same call. Do not use to dodge a legitimate disapproval; the auditor sees the change." })),
     }),
     async execute(_id, params, signal, _onUpdate, execCtx) {
       const foreign0 = foreignToolGuard(execCtx);
@@ -1508,8 +1563,19 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
       if (!state.goal || state.goal.status !== "active") {
         return { content: [{ type: "text", text: "No active goal." }], details: {} };
       }
-      const p = params as { completionSummary?: string; verificationSummary?: string };
-      updateGoal({ status: "auditing" }, ctx);
+      const p = params as { completionSummary?: string; verificationSummary?: string; newObjective?: string };
+      // v0.25.0 (contract item 15): atomic objective update + audit in one
+      // call — the objective-drift disapprove loop (ship shifted work →
+      // auditor disapproves the ORIGINAL objective) ends here. Ledgered so
+      // the shift is auditable.
+      if (p.newObjective?.trim()) {
+        const oldObjective = state.goal.objective;
+        const { objective: cleanObj, verificationContract } = extractVerificationContract(p.newObjective.trim());
+        updateGoal({ objective: cleanObj, ...(verificationContract ? { verificationContract } : {}) }, ctx);
+        appendLedger(ctx.cwd, "goal_tweaked", { via: "complete_goal.newObjective", from: oldObjective.slice(0, 200), to: cleanObj.slice(0, 200) });
+        ctx.ui.notify(`Objective updated (complete_goal newObjective): ${cleanObj.slice(0, 80)}`, "info");
+      }
+      updateGoal({ status: "auditing", pendingTasks: undefined }, ctx);
       const settings = loadSettings(ctx.cwd);
       const { model: auditorModel, error: modelError, via } = resolveAuditorModel(ctx, settings.auditorModel);
       if (modelError) {
@@ -1600,6 +1666,29 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
       // Bounded and surfaced: the goal pauses and the user decides.
       if (result.impossible) {
         const reason = result.impossibleReason || "(no reason given)";
+        // v0.25.0 (contract item 23): under aggressiveMode, a PARTIAL
+        // impossible (some items can't ship) keeps the loop going — the
+        // agent narrows to the remainder. A FULL impossible still pauses:
+        // auto-resuming a provably unwinnable objective just burns tokens.
+        const effectiveImp = resolveEffectiveAggressiveSettings(loadSettings(ctx.cwd));
+        if (effectiveImp.aggressiveMode && classifyImpossibleReason(reason) === "partial") {
+          updateGoal({
+            status: "active",
+            auditHistory: history,
+            pauseReason: `auditor verdict: IMPOSSIBLE (partial) — ${reason}`,
+            pauseSuggestedAction: "Narrow the objective past the impossible part (complete_goal newObjective or /goal tweak) and continue",
+          }, ctx);
+          ctx.ui.notify(`Auditor: part of the goal is IMPOSSIBLE — ${reason.slice(0, 100)}. aggressiveMode: narrowing and continuing.`, "warning");
+          appendLedger(ctx.cwd, "impossible_partial_continue", { reason: reason.slice(0, 200) });
+          scheduleContinuation(ctx, true);
+          return {
+            content: [{
+              type: "text",
+              text: `The auditor says PART of this goal can never be satisfied: ${reason}\n\naggressiveMode is ON, so the goal stays ACTIVE. Do NOT keep attempting the impossible part. Narrow the objective to the remaining shippable items — pass newObjective to complete_goal at completion time (or pause_goal proposing /goal tweak if the narrowing needs the user's call) — and continue working the rest now.`,
+            }],
+            details: {},
+          };
+        }
         updateGoal({
           status: "paused",
           auditHistory: history,
@@ -1622,6 +1711,42 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
       // The wild-caught case: 6 silent "disapprovals" that were really a dead
       // auditor model. The agent must be able to tell the difference.
       if (result.error && !result.disapproved) {
+        // v0.25.0 (contract Section C): quota errors used to re-fire the
+        // continuation FOREVER against a window that resets in an hour.
+        // Now: pause with a one-shot scheduled retry at the upstream's own
+        // Retry-After hint (default quotaRetryMinutes).
+        if (isQuotaError(result.error)) {
+          const settingsNow = loadSettings(ctx.cwd);
+          const defaultSec = (settingsNow.quotaRetryMinutes ?? DEFAULT_QUOTA_RETRY_MINUTES) * 60;
+          const quota = parseQuotaError(result.error, defaultSec);
+          const retryMin = Math.max(1, Math.round(quota.retryAfterSec / 60));
+          updateGoal({
+            status: "paused",
+            auditHistory: history,
+            pauseReason: `auditor quota: ${result.error}`,
+            pauseSuggestedAction: `Quota auto-retry in ${retryMin}m — or /goal resume to retry now`,
+          }, ctx);
+          appendLedger(ctx.cwd, "goal_paused", { reason: `auditor quota: retry in ${quota.retryAfterSec}s (${quota.fromUpstream ? "upstream hint" : "default"})` });
+          scheduleQuotaRetry(ctx, quota.retryAfterSec, result.error, () => {
+            // Re-check: only auto-resume if STILL paused for the quota
+            // reason (a user /goal pause during the window is not stomped).
+            if (state.goal && state.goal.status === "paused" && (state.goal.pauseReason ?? "").startsWith("auditor quota:")) {
+              updateGoal({ status: "active" }, ctx);
+              appendLedger(ctx.cwd, "goal_resumed", { via: "quota-retry" });
+              if (resolveEffectiveAggressiveSettings(loadSettings(ctx.cwd)).aggressiveMode) {
+                ctx.ui.notify("Auto-resume fired (event: auditor quota window elapsed). Continue working.", "info");
+              }
+              scheduleContinuation(ctx, true);
+            }
+          });
+          return {
+            content: [{
+              type: "text",
+              text: `The auditor hit a QUOTA / rate-limit error (infrastructure, NOT a verdict): ${result.error}\nThe goal is PAUSED with an automatic retry scheduled in ${retryMin} minute(s)${quota.fromUpstream ? " (upstream Retry-After hint)" : " (default window — /glla quotaretryminutes=N to change)"}. Your completion claim was not evaluated; do not change your deliverable for this. /goal resume retries immediately.`,
+            }],
+            details: {},
+          };
+        }
         updateGoal({
           status: "active",
           auditHistory: history,
@@ -1668,7 +1793,8 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
       // goal the auditor can NEVER approve used to re-continue forever.
       // auditCap consecutive disapprovals → pause + notify, bounded and
       // surfaced like every other stop in this stack.
-      const auditCap = settings.auditCap ?? 3;
+      const effectiveCap = resolveEffectiveAggressiveSettings(settings);
+      const auditCap = effectiveCap.auditCap;
       const configuredFeedbackChars = settings.auditFeedbackChars;
       const auditFeedbackChars = Number.isInteger(configuredFeedbackChars) && configuredFeedbackChars! >= 0
         ? configuredFeedbackChars!
@@ -1683,6 +1809,32 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
         : `\n\nReport truncated at the configured limit. /goal status shows the full report; change future feedback with /glla auditfeedbackchars=N (0 = full report).`;
       const trailingDisapprovals = countTrailingDisapprovals(history);
       if (auditCap > 0 && trailingDisapprovals >= auditCap) {
+        // v0.25.0 (contract item 22): aggressiveMode turns the cap into a
+        // TODO list and keeps going — the objections become pendingTasks
+        // rendered into every continuation until addressed. OFF preserves
+        // the pause (contract item 24 test 2).
+        if (effectiveCap.aggressiveMode) {
+          const pendingTasks = extractPendingTasks(result.output, 5);
+          updateGoal({
+            status: "active",
+            auditHistory: history,
+            pendingTasks,
+            pauseReason: `auditor disapproved ${trailingDisapprovals}× consecutively (cap ${auditCap}) — aggressiveMode: continuing with TODOs`,
+          }, ctx);
+          const todoBlock = pendingTasks.length > 0
+            ? pendingTasks.map((t, i) => ` ${i + 1}. ${t}`).join("\n")
+            : " (no discrete objections extracted — re-read the latest report in /goal status)";
+          ctx.ui.notify(`Auditor disapproved ${trailingDisapprovals}× (cap). Treating as TODOs:\n${todoBlock}`, "warning");
+          appendLedger(ctx.cwd, "audit_cap_keep_going", { trailingDisapprovals, auditCap, pendingTasks });
+          scheduleContinuation(ctx, true);
+          return {
+            content: [{
+              type: "text",
+              text: `The auditor has disapproved ${trailingDisapprovals} times in a row (cap ${auditCap}), but aggressiveMode is ON — the goal stays ACTIVE and the objections are now your TODO list:\n${todoBlock}\n\nLatest report (${auditFeedbackLabel}):\n${auditFeedback}\n\nWork the TODOs in order. If the auditor is WRONG about an objection, follow WHEN THE AUDITOR DISAPPROVES: investigate, quote its objection, compare against what you shipped, and present the user YOUR ASSESSMENT. If the objective itself has drifted, pass newObjective to complete_goal.`,
+            }],
+            details: {},
+          };
+        }
         updateGoal({
           status: "paused",
           auditHistory: history,
@@ -1695,7 +1847,7 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
         return {
           content: [{
             type: "text",
-            text: `The auditor has now disapproved ${trailingDisapprovals} times in a row (cap ${auditCap}). The goal is PAUSED — continuing to re-attempt without addressing the pattern wastes tokens. Latest report (${auditFeedbackLabel}):\n${auditFeedback}\n\nDo not call complete_goal again. Summarize the repeated objections for the user and ask how to proceed (/goal status shows all reports; /goal resume resumes).`,
+            text: `The auditor has now disapproved ${trailingDisapprovals} times in a row (cap ${auditCap}). The goal is PAUSED — continuing to re-attempt without addressing the pattern wastes tokens.\n\nBefore asking the user, INVESTIGATE:\n1. Read the audit history (the auditor's previous reports — /goal status shows them; state.goal.auditHistory holds them).\n2. Identify the SPECIFIC objections — quote them.\n3. Compare against what you actually shipped (commits, diffs, test output, screenshots).\n4. Form a clear opinion: is the auditor right, wrong, or partially right?\n5. Present the user YOUR ASSESSMENT with quoted objections and shipped evidence — not a generic menu of options.\n\nLatest report (${auditFeedbackLabel}):\n${auditFeedback}\n\nDo not call complete_goal again until the pattern is addressed. /goal resume resumes; /goal tweak fixes a drifted objective.`,
           }],
           details: {},
         };
@@ -2264,111 +2416,6 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
 // Settings (auditor model, thinking level)
 // =================================================================
 
-interface Settings {
-  /** "provider/model-id" or bare "model-id". Unset → session model. */
-  auditorModel?: string;
-  auditorThinkingLevel?: "off" | "minimal" | "low" | "medium" | "high" | "xhigh";
-  /** Shell command run on goal complete / goal pause / loop stop; message passed as $1. */
-  notifyCmd?: string;
-  /** Per-goal token budget; crossing it pauses the goal. Off by default
-   * (opt-in guard, v0.12.0): unset/0 = no budget. */
-  tokenLimit?: number;
-  /** v0.23.2: minutes of busy-but-silent before the wedge alert fires
-   * (hung-command detector). Unset = 45; 0 = off. */
-  wedgeAlertMinutes?: number;
-  /** on → restored goals/loops/lists auto-resume even in fresh sessions
-   * (unattended rigs). Default off: restore holds until /goal resume. */
-  autoResume?: boolean;
-  /** v0.24.2: pause the goal after N consecutive auditor disapprovals (0 = unlimited). Default 3. */
-  auditCap?: number;
-  /** Maximum auditor-report characters returned to the executor after a
-   * disapproval (0 = full report). Default 0 (full report). */
-  auditFeedbackChars?: number;
-  /** on → propose_* drafts activate WITHOUT the Confirm dialog and the
-   * interview floor is skipped — the seed carries the intent (unattended
-   * rigs). Default off: nothing activates before the user confirms. */
-  autoAcceptDrafts?: boolean;
-  /** v0.24.6: subagent model strategy for pi-subagents default agents that
-   * pin a model (Explore pins claude-haiku-4-5, which silently routes
-   * subagents to a different provider/quota pool than the session).
-   * "inherit-parent" (default) writes a managed ~/.pi/agent/agents/Explore.md
-   * override without the model pin so subagents share the session model and
-   * its quota; "agent-default" restores upstream behavior. Applies to NEW
-   * sessions (pi-subagents registers agents at session start). */
-  subagentModelStrategy?: SubagentModelStrategy;
-  /** v0.24.6: per-agent-type model pin, e.g. { "Explore": "minimax/MiniMax-M3" }.
-   * Always wins over subagentModelStrategy — the managed override is written
-   * WITH this pin regardless of strategy. */
-  subagentModelOverrides?: Record<string, string>;
-}
-
-const DEFAULT_SETTINGS: Settings = {
-  // Unset = follow the pi session thinking level (user selects thinking in
-  // pi, auditor follows), floor "high" — the auditor is the verification
-  // gate, depth is worth more there than speed. /glla thinking= overrides.
-  auditorThinkingLevel: undefined,
-  // v0.24.6: subagents inherit the session model by default — one quota
-  // pool, no surprise 403s from a pinned default agent's provider.
-  subagentModelStrategy: "inherit-parent",
-  auditFeedbackChars: DEFAULT_AUDIT_FEEDBACK_CHARS,
-};
-
-// Two-tier config (v0.7.0): GLOBAL is the normal home — you set things once
-// and rarely open this again. PROJECT is the rare local override.
-// Resolution: project > global > defaults (per key).
-function globalSettingsPath(): string {
-  return path.join(os.homedir(), ".pi", "agent", "pi-goal-list-loop-audit.settings.json");
-}
-
-function projectSettingsPath(cwd: string): string {
-  return path.join(piGlaDir(cwd), "settings.json");
-}
-
-function readSettingsFile(file: string): Partial<Settings> {
-  try {
-    if (!fs.existsSync(file)) return {};
-    const parsed = JSON.parse(fs.readFileSync(file, "utf-8"));
-    return typeof parsed === "object" && parsed !== null ? parsed as Partial<Settings> : {};
-  } catch {
-    return {};
-  }
-}
-
-function loadSettings(cwd: string): Settings {
-  return mergeSettings(
-    DEFAULT_SETTINGS as unknown as Record<string, unknown>,
-    readSettingsFile(globalSettingsPath()) as Record<string, unknown>,
-    readSettingsFile(projectSettingsPath(cwd)) as Record<string, unknown>,
-  ) as unknown as Settings;
-}
-
-/** Where each effective setting comes from (for the /glla display). */
-function settingsProvenance(cwd: string): Record<keyof Settings, { value: unknown; source: "project" | "global" | "default" }> {
-  const proj = readSettingsFile(projectSettingsPath(cwd));
-  const glob = readSettingsFile(globalSettingsPath());
-  const effective = loadSettings(cwd);
-  const out: Record<string, { value: unknown; source: "project" | "global" | "default" }> = {};
-  const keys: Array<keyof Settings> = ["auditorModel", "auditorThinkingLevel", "notifyCmd", "tokenLimit", "wedgeAlertMinutes", "autoResume", "autoAcceptDrafts", "auditCap", "auditFeedbackChars", "subagentModelStrategy", "subagentModelOverrides"];
-  for (const k of keys) {
-    if ((proj as Record<string, unknown>)[k] !== undefined) out[k] = { value: (proj as any)[k], source: "project" };
-    else if ((glob as Record<string, unknown>)[k] !== undefined) out[k] = { value: (glob as any)[k], source: "global" };
-    else out[k] = { value: (effective as any)[k], source: "default" };
-  }
-  return out as Record<keyof Settings, { value: unknown; source: "project" | "global" | "default" }>;
-}
-
-function saveSettings(scope: "global" | "project", cwd: string, patch: Partial<Settings>): void {
-  const file = scope === "global" ? globalSettingsPath() : projectSettingsPath(cwd);
-  const current = readSettingsFile(file);
-  const next: Record<string, unknown> = { ...current };
-  for (const [k, v] of Object.entries(patch)) {
-    if (v === undefined) delete next[k]; // key=unset removes the key
-    else next[k] = v;
-  }
-  fs.mkdirSync(path.dirname(file), { recursive: true });
-  fs.writeFileSync(file, JSON.stringify(next, null, 2));
-}
-
 /**
  * Session thinking level with a "high" floor (v0.8.5): the auditor follows
  * the thinking level the user selected in pi; if none is set, audits run at
@@ -2448,6 +2495,9 @@ async function openSettingsUI(ctx: ExtensionContext): Promise<void> {
           `Notify command — ${show("notifyCmd", "(off)")}`,
           `Token limit per goal — ${show("tokenLimit", "(off)")}`,
           `Wedge alert minutes — ${show("wedgeAlertMinutes", `(${WEDGE_ALERT_DEFAULT_MINUTES}m default)`)}`,
+          `Aggressive mode — ${show("aggressiveMode", "(off)")}`,
+          `Quota retry minutes — ${show("quotaRetryMinutes", `(${DEFAULT_QUOTA_RETRY_MINUTES}m default)`)}`,
+          `Stuck max interventions — ${show("stuckMaxInterventions", "(5 default)")}`,
           `Subagent model strategy — ${show("subagentModelStrategy", "(inherit-parent)")}`,
           `Subagent Explore model pin — ${loadSettings(ctx.cwd).subagentModelOverrides?.Explore ?? "(follows strategy)"}`,
           `Audit feedback characters — ${show("auditFeedbackChars", "(full report)")}`,
@@ -2484,6 +2534,31 @@ async function openSettingsUI(ctx: ExtensionContext): Promise<void> {
           else if (!v.trim()) saveSettings("global", ctx.cwd, { wedgeAlertMinutes: undefined });
           else ctx.ui.notify(`Not a non-negative integer: ${v}`, "warning");
         }
+      } else if (choice.startsWith("Aggressive mode")) {
+        const v = await ctx.ui.select("Aggressive mode (flips DEFAULTS toward keep-going — explicit per-key settings still win)", [
+          "off — current behavior: pause at the audit cap, wedge alerts on, manual resume",
+          "on — autoResume, audit cap 10, stuck max 10, wedge alerts off, quota auto-retry, cap disapprovals become a TODO list and the goal KEEPS GOING",
+        ]);
+        if (v) {
+          saveSettings("global", ctx.cwd, { aggressiveMode: v.startsWith("on") });
+          ctx.ui.notify(`Aggressive mode ${v.startsWith("on") ? "ON — goals keep going past the audit cap; objections become TODOs" : "off"}.`, "info");
+        }
+      } else if (choice.startsWith("Quota retry minutes")) {
+        const v = await ctx.ui.input("Minutes before auto-retrying a quota-exhausted auditor", `positive integer; empty = default ${DEFAULT_QUOTA_RETRY_MINUTES}`);
+        if (v !== undefined) {
+          const n = Number.parseInt(v.trim(), 10);
+          if (Number.isFinite(n) && n > 0) saveSettings("global", ctx.cwd, { quotaRetryMinutes: n });
+          else if (!v.trim()) saveSettings("global", ctx.cwd, { quotaRetryMinutes: undefined });
+          else ctx.ui.notify(`Not a positive integer: ${v}`, "warning");
+        }
+      } else if (choice.startsWith("Stuck max interventions")) {
+        const v = await ctx.ui.input("Consecutive stuck interventions before a loop stops", "positive integer; empty = default 5 (10 under aggressiveMode)");
+        if (v !== undefined) {
+          const n = Number.parseInt(v.trim(), 10);
+          if (Number.isFinite(n) && n > 0) saveSettings("global", ctx.cwd, { stuckMaxInterventions: n });
+          else if (!v.trim()) saveSettings("global", ctx.cwd, { stuckMaxInterventions: undefined });
+          else ctx.ui.notify(`Not a positive integer: ${v}`, "warning");
+        }
       } else if (choice.startsWith("Subagent model strategy")) {
         const v = await ctx.ui.select("Subagent model (pi-subagents default agents)", [
           "inherit-parent — subagents share your session model + its quota pool (fixes separate-provider 403s; search agents may run on a pricier model)",
@@ -2554,6 +2629,9 @@ async function cmdSettings(args: string, ctx: ExtensionContext): Promise<void> {
         fmt("autoAcceptDrafts", "autoAccept"),
         fmt("auditCap", "auditCap"),
         fmt("auditFeedbackChars", "auditFeedbackChars"),
+        fmt("aggressiveMode", "aggressiveMode"),
+        fmt("quotaRetryMinutes", "quotaRetryMinutes"),
+        fmt("stuckMaxInterventions", "stuckMaxInterventions"),
         `\nglobal:  ${globalSettingsPath()}`,
         `project: ${projectSettingsPath(ctx.cwd)}`,
         `Set with: /glla key=value (global) · /glla project key=value (project override)`,
@@ -2652,6 +2730,43 @@ async function cmdSettings(args: string, ctx: ExtensionContext): Promise<void> {
           ctx.ui.notify(`auditfeedbackchars must be a non-negative integer (0 = full report), got: ${value}`, "warning");
         }
       }
+    } else if (key === "aggressivemode" || key === "aggressive") {
+      if (["on", "true", "1", "yes"].includes(value)) {
+        patch.aggressiveMode = true;
+        changed = true;
+        ctx.ui.notify("aggressivemode=on: autoResume, audit cap 10, stuck max 10, wedge off, quota auto-retry — and audit-cap disapprovals become TODOs while the goal KEEPS GOING. Explicit per-key settings still win.", "warning");
+      } else if (["off", "false", "0", "no", "unset"].includes(value)) {
+        patch.aggressiveMode = undefined;
+        changed = true;
+      } else {
+        ctx.ui.notify(`aggressivemode must be on or off, got: ${value}`, "warning");
+      }
+    } else if (key === "quotaretryminutes") {
+      if (["unset", "default"].includes(value)) {
+        patch.quotaRetryMinutes = undefined;
+        changed = true;
+      } else {
+        const n = Number.parseInt(value, 10);
+        if (Number.isInteger(n) && n > 0) {
+          patch.quotaRetryMinutes = n;
+          changed = true;
+        } else {
+          ctx.ui.notify(`quotaretryminutes must be a positive integer, got: ${value}`, "warning");
+        }
+      }
+    } else if (key === "stuckmax" || key === "stuckmaxinterventions") {
+      if (["unset", "default"].includes(value)) {
+        patch.stuckMaxInterventions = undefined;
+        changed = true;
+      } else {
+        const n = Number.parseInt(value, 10);
+        if (Number.isInteger(n) && n > 0) {
+          patch.stuckMaxInterventions = n;
+          changed = true;
+        } else {
+          ctx.ui.notify(`stuckmax must be a positive integer, got: ${value}`, "warning");
+        }
+      }
     } else if (key === "thinking" || key === "auditorthinkinglevel") {
       if (["off", "minimal", "low", "medium", "high", "xhigh"].includes(value)) {
         patch.auditorThinkingLevel = value as Settings["auditorThinkingLevel"];
@@ -2662,7 +2777,7 @@ async function cmdSettings(args: string, ctx: ExtensionContext): Promise<void> {
     }
   }
   if (!changed) {
-    ctx.ui.notify("Nothing changed. Use key=value (model, thinking, notify, tokenlimit, autoresume, auditcap, auditfeedbackchars), optionally prefixed with 'project'.", "info");
+    ctx.ui.notify("Nothing changed. Use key=value (model, thinking, notify, tokenlimit, autoresume, auditcap, auditfeedbackchars, aggressivemode, quotaretryminutes, stuckmax), optionally prefixed with 'project'.", "info");
     return;
   }
   saveSettings(scope, ctx.cwd, patch);
@@ -2783,8 +2898,11 @@ export default function (pi: ExtensionAPI): void {
       ["notify=", "desktop push command: /glla notify='notify-send pi \"$1\"'"],
       ["tokenlimit=", "per-goal token budget (0 = off): /glla tokenlimit=2000000"],
       ["autoresume=", "on: auto-resume held goals/loops in fresh sessions"],
-      ["auditcap=", "N: pause goal after N consecutive auditor disapprovals (default 3, 0 = unlimited)"],
+      ["auditcap=", "N: pause goal after N consecutive auditor disapprovals (default 5, 0 = unlimited)"],
       ["auditfeedbackchars=", "cap on executor-visible disapproval report chars (0 = full report, the default)"],
+      ["aggressivemode=", "on: keep-going defaults — autoResume, cap 10, stuck 10, wedge off, quota auto-retry, cap→TODOs"],
+      ["quotaretryminutes=", "N: minutes before auto-retrying a quota-exhausted auditor (default 60)"],
+      ["stuckmax=", "N: consecutive stuck interventions before a loop stops (default 5)"],
       ["autoaccept=", "on: drafts activate without the Confirm dialog (unattended rigs)"],
       ["project", "write a project override: /glla project key=value"],
     ]),
@@ -2910,7 +3028,15 @@ export default function (pi: ExtensionAPI): void {
     // starts working before you can even load your session. Sessions with
     // history ("resume"/"reload"/"fork") auto-resume; /glla autoresume=on
     // opts a project into auto-resume everywhere (unattended rigs).
-    const autoResume = shouldAutoResumeOnSessionStart(event?.reason, loadSettings(ctx.cwd).autoResume);
+    const autoResume = shouldAutoResumeOnSessionStart(event?.reason, resolveEffectiveAggressiveSettings(loadSettings(ctx.cwd)).autoResume);
+    // v0.25.0 (contract item 6): aggressiveMode announces every auto-event.
+    if (
+      autoResume &&
+      resolveEffectiveAggressiveSettings(loadSettings(ctx.cwd)).aggressiveMode &&
+      (isLoopActive() || (state.goal && state.goal.status === "active") || listQueue().length > 0)
+    ) {
+      ctx.ui.notify("Auto-resume fired (event: session start). Continue working.", "info");
+    }
     if (isLoopActive()) {
       const l = state.loop!;
       if (autoResume) {

package/extensions/quota-retry.ts

@@ -0,0 +1,90 @@
+// pi-goal-list-loop-audit — v0.25.0
+// extensions/quota-retry.ts
+//
+// Quota-aware retry (eager-continuation contract, Section C). Before this
+// module, an auditor that failed with a 429 / quota error re-fired the
+// continuation loop FOREVER (the error branch just rescheduled), burning
+// tokens against a quota window that only resets in an hour. Now a quota
+// error pauses the goal with a scheduled one-shot retry at the upstream's
+// own Retry-After hint (default 60m, configurable via quotaRetryMinutes).
+
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+
+export interface QuotaError {
+  raw: string;
+  /** Seconds until retry, from the upstream hint or the default. */
+  retryAfterSec: number;
+  /** True when retryAfterSec came from the upstream (Retry-After /
+   * "retry in Ns"), false when the default was used. */
+  fromUpstream: boolean;
+}
+
+/** Match 429, "quota", "rate limit", "temporarily rate-limited upstream",
+ * credit exhaustion — the shapes we have caught in the wild (OpenRouter,
+ * MiniMax, Anthropic). */
+export function isQuotaError(error: string | undefined): boolean {
+  if (!error) return false;
+  return /429|quota|rate.?limit|temporarily|credits?|key limit exceeded|insufficient.?balance|too many requests/i.test(error);
+}
+
+/** Parse the retry window out of an error string. Understands:
+ *  - `Retry-After: 5` (header echoed into the error text)
+ *  - `retry after 30 seconds` / `retry in 2m` prose
+ *  - default 3600s when no hint (contract item 11). */
+export function parseQuotaError(error: string, defaultRetryAfterSec = 3600): QuotaError {
+  let m = error.match(/retry-after:\s*(\d+)/i);
+  if (m) {
+    const sec = Number(m[1]);
+    if (Number.isFinite(sec) && sec >= 0) return { raw: error, retryAfterSec: sec, fromUpstream: true };
+  }
+  m = error.match(/retry (?:after|in)\s+(\d+)\s*(s|sec|seconds|m|min|minutes|h|hours?)/i);
+  if (m) {
+    const n = Number(m[1]);
+    const unit = m[2]!.toLowerCase();
+    const mult = unit.startsWith("h") ? 3600 : unit.startsWith("m") ? 60 : 1;
+    if (Number.isFinite(n) && n >= 0) return { raw: error, retryAfterSec: n * mult, fromUpstream: true };
+  }
+  return { raw: error, retryAfterSec: defaultRetryAfterSec, fromUpstream: false };
+}
+
+let quotaRetryTimer: NodeJS.Timeout | null = null;
+
+/** Test hook — is a quota retry currently scheduled? */
+export function isQuotaRetryPending(): boolean {
+  return quotaRetryTimer !== null;
+}
+
+/** Cancel any pending quota retry (e.g. the user resumed manually). */
+export function cancelQuotaRetry(): void {
+  if (quotaRetryTimer) {
+    clearTimeout(quotaRetryTimer);
+    quotaRetryTimer = null;
+  }
+}
+
+/** Schedule a one-shot auto-resume after the quota window. The fire
+ * callback re-checks the goal is STILL paused for the quota reason before
+ * resuming (contract item 10/12 — a user /goal pause during the window
+ * must not be stomped). */
+export function scheduleQuotaRetry(
+  ctx: ExtensionContext,
+  retryAfterSec: number,
+  reason: string,
+  fire: () => void,
+): void {
+  cancelQuotaRetry();
+  const ms = Math.max(1_000, retryAfterSec * 1_000);
+  quotaRetryTimer = setTimeout(() => {
+    quotaRetryTimer = null;
+    try {
+      fire();
+    } catch {
+      /* session may be gone; session_start will re-evaluate */
+    }
+  }, ms);
+  quotaRetryTimer.unref?.();
+  ctx.ui.notify(
+    `Auditor quota exhausted — auto-retry in ${Math.round(retryAfterSec / 60)}m (${reason.slice(0, 80)}). /goal resume retries now.`,
+    "info",
+  );
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.24.9",
+  "version": "0.25.0",
   "description": "Goal. Loop. Audit. Done. — a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor — only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",

package/prompts/goal-loop-continuation.md

@@ -37,9 +37,11 @@ ${TASK_LIST}
 
 ${NEXT_PENDING_TASK_BLOCK}
 
+${DYNAMIC_DIRECTIVES}
+
 ## Available tools
 
-You have `read`, `write`, `edit`, `bash`, `grep`, `find`, `ls`, and the goal toolkit (`propose_task_list`, `complete_task`, `update_task_status`, `pause_goal`, `complete_goal`), plus the list tools (`list_add`, `list_status`, `list_activate`) — when the user asks to queue more work ("add these to my list", "queue these 10 things"), call `list_add` with the items; when unsure what is running or waiting, call `list_status`.
+You have `read`, `write`, `edit`, `bash`, `grep`, `find`, `ls`, the `Agent` subagent tool, and the goal toolkit (`propose_task_list`, `complete_task`, `update_task_status`, `pause_goal`, `complete_goal`), plus the list tools (`list_add`, `list_status`, `list_activate`) — when the user asks to queue more work ("add these to my list", "queue these 10 things"), call `list_add` with the items; when unsure what is running or waiting, call `list_status`.
 
 If the objective decomposes into milestones and no task list exists yet, call `propose_task_list` early — the user confirms it, then you track progress with `complete_task` / `update_task_status` as you go (not in a batch at the end). Limits: 20 tasks, 5 subtasks per task.
 
@@ -47,9 +49,61 @@ When the agent calls any of these, the orchestrator tracks the call and persists
 
 ## EXECUTION DISCIPLINE
 
-- **Delegate independent chunks to subagents.** When the work contains parallel, independent streams — surveying separate subsystems, reading disjoint file sets, running independent verifications — spawn `Agent` subagents (`Explore` for read-only research, `general-purpose` for implementation) instead of serializing everything through your own context. You remain the single writer: synthesize subagent findings and apply edits yourself.
+- **Default to subagents.** For any task that decomposes into independent chunks, spawn `Agent` subagents. Use `Explore` for read-only research, `general-purpose` for implementation, `Plan` for architecture. Spawn multiple in PARALLEL — don't serialise through your own context. You remain the single writer: synthesize findings and apply edits yourself.
+- **Eager continuation.** When in doubt, KEEP GOING on sub-tasks. If a subagent fails, retry with a different approach. Don't ask permission to continue — just continue. Pause only when you are genuinely blocked on information that does not exist in the repo, or the user explicitly pauses you.
 - **Bound every long command.** Wrap test suites, builds, and dev servers in `timeout <seconds>` (e.g. `timeout 120 bun test src/lib`). An unbounded command that hangs burns an hour; a bounded one burns two minutes and tells you it hung. If a command produces no output for many minutes, treat it as hung: kill it, diagnose why, rerun bounded.
 
+## WHEN THE AUDITOR DISAPPROVES
+
+If the orchestrator tells you the auditor disapproved, **investigate before asking the user**:
+
+1. Read the audit history (the latest reports via `/goal status`, or `state.goal.auditHistory` directly).
+2. For each disapproval, identify the SPECIFIC objections the auditor raised — quote them.
+3. Compare against what you actually shipped (commits, file diffs, test output, screenshots).
+4. Form a clear opinion: is the auditor right, wrong, or partially right?
+5. Present the user with YOUR ASSESSMENT, not a generic menu of options. Example format:
+
+   "The auditor's last 3 reports all complain about saves-3 not shipping. The current objective IS saves-3, but the work shipped is menu-3 + kingdom-2 (different items). I shipped those because [reason]. The auditor is disapproving because the original objective isn't literally shipped. Three options: A. /goal tweak the objective to menu-3+kingdom-2, then /goal resume — B. Re-scope saves-3 and ship it — C. Pivot to a different item entirely."
+
+Do NOT ask the user to choose between generic options like "/goal resume / Move on silently / Different item". Those options tell the user nothing. Always include YOUR ASSESSMENT with quoted objections and shipped evidence.
+
+## PIVOT DETECTION
+
+When the user says "do a full audit", "survey the project", "find all problems", "mark a tasklist", or similar — the goal is a SURVEY, not a single fix. You must:
+
+1. Call `propose_task_list` IMMEDIATELY with the structured task list of items you find.
+2. Each task should be SHORT (minutes, not hours).
+3. Use subagents to PARALLEL-survey different subsystems (game logic, UI, audio, tests, docs) — one `Explore` agent per subsystem, spawned in a single message.
+4. Don't ship a single bug fix and then ask if the user wants to continue — the user already said "do a full audit".
+5. After the task list is confirmed, work through tasks systematically with `complete_task` / `update_task_status`.
+
+## WHEN SUBAGENTS HIT QUOTA ERRORS
+
+If a subagent fails with `Key limit exceeded (total limit)`, `429 Too Many Requests`, or another rate-limit error, the parent model and subagent model have DIFFERENT quota pools. Two fixes:
+
+1. **Switch subagent model strategy to `inherit-parent`** (`/glla` → Settings → Subagent model strategy). The subagent then shares your session model and its quota pool.
+2. **Wait for the upstream quota to reset.** OpenRouter free keys typically reset every 24h. Check the error message for the specific key URL.
+
+Do NOT spawn more subagents of the failed type until quota resets — you will just pile up more failed calls. Do the work inline meanwhile, or spawn a different agent type.
+
+## DETACHED COMMIT DETECTION
+
+If your commits keep getting rewritten away (same content, new SHA — or worse, content reverted), check the auto-committer daemon BEFORE diagnosing yourself as stuck or broken:
+
+```bash
+git reflog --date=iso | grep -E "filter-branch|filter-repo"
+git reflog --date=iso | grep -E ": reset:"
+ps -fea | grep -E "dracon-sync|filter-repo" | grep -v grep
+```
+
+The auto-committer (`dracon-sync daemon`) may be running `auto_rewrite_large_blobs` on your commits. The fix is NOT to keep re-committing — it is to:
+
+1. Pause the daemon (`dracon-sync pause`, or write the `.pi-glla/.pause-auto-commit` sentinel via the goal tools).
+2. Investigate the rewrite trigger (daemon config `max_push_blob_bytes`, `auto_rewrite_large_blobs`).
+3. Add `.pi-glla/` to the daemon's exclude list.
+
+Do NOT conclude "the loop is too eager" or "I am broken" before checking what the daemon is doing — the daemon rewriting your commits makes YOUR loop look broken when it is not.
+
 ## TASK WORKFLOW
 
 Use tasks as PROGRESS TRACKERS during your work — not as a post-hoc checklist to batch-mark at the end.
@@ -70,6 +124,8 @@ verificationSummary: "Concrete evidence per item (file path, test result, comman
 
 Then call `complete_goal`. The orchestrator will spawn an **isolated auditor** in a fresh session to verify, and either accept (mark goal complete) or reject (continue work).
 
+If your work has shifted to items different from the original objective (the original was blocked, higher-ROI items emerged): pass `newObjective` to `complete_goal` to atomically update the objective and audit against the NEW one — do NOT call `complete_goal` on the original objective after shipping different work, the auditor will disapprove because the original isn't shipped. Alternatively `pause_goal` proposing a `/goal tweak` if the shift needs the user's call.
+
 When the goal is genuinely blocked and you cannot make progress without user input:
 
 ```
@@ -78,7 +134,7 @@ pause_goal({reason: "...", suggestedAction: "..."})
 
 ## HARD RULES
 
-- **Do not modify the objective autonomously.** The objective is the user's; if it has drifted from what makes sense, call `pause_goal` and propose a `/goal tweak` instead.
+- **Do not modify the objective silently.** The objective is the user's; if it has drifted from what makes sense, use `complete_goal`'s `newObjective` at completion time, or `pause_goal` and propose a `/goal tweak` mid-flight — never just work on something else and claim the original.
 - **Do not pretend completion.** If verification evidence is missing, call `pause_goal` instead of `complete_goal`.
 - **Do not polish doorknobs.** If you are out of work and the goal is satisfied, call `complete_goal` instead of inventing a side-improvement.
 - **Do not give up early.** If a task is hard, run it down properly. The auditor will catch doorknobs; the agent's job is to do the real work.

package/prompts/goal-loop-draft.md

@@ -14,6 +14,11 @@ request into a **confirmed goal contract**. Do NOT start substantive work yet.
    fine otherwise and for free-form answers.
 2. Targeted read-only research is allowed when it helps define a better
    contract (read a file, check the repo layout). Do NOT implement anything.
+   **Default to subagents for research**: spawn an `Explore` `Agent` subagent
+   (in parallel with your own reading when there are several areas) rather
+   than paging large files through the drafting context yourself. Eager
+   continuation applies here too — if a subagent fails, just continue with
+   another approach or a `general-purpose` agent; don't stall the draft.
 3. The contract needs, at minimum:
    - **objective** — what to do, concretely.
    - **verification contract** — how an independent auditor can tell it is

package/prompts/goal-loop-forever-metricless.md

@@ -24,6 +24,12 @@ Start your reply with exactly one line: `HYPOTHESIS: <what you will change and w
 Then make **ONE** concrete, inspectable change that advances the target.
 Then stop.
 
+**Default to subagents.** If identifying the change needs research, spawn an
+`Explore` `Agent` subagent (several in parallel for disjoint areas); if the
+change decomposes, use `general-purpose`. Eager continuation: if a subagent
+fails, retry with a different approach — just continue, don't stall the loop
+asking permission. You remain the single writer: apply the edit yourself.
+
 ${INTERVENTION_NOTE}
 ${REGRESSION_NOTE}
 ${STRATEGY_NOTE}

package/prompts/goal-loop-forever.md

@@ -28,6 +28,12 @@ Start your reply with exactly one line: `HYPOTHESIS: <what you will change and w
 Then make **ONE** small, concrete change that moves the metric in the right
 direction. Then stop.
 
+**Default to subagents.** If identifying the change needs research, spawn an
+`Explore` `Agent` subagent (several in parallel for disjoint areas); if the
+change decomposes, use `general-purpose`. Eager continuation: if a subagent
+fails, retry with a different approach — just continue, don't stall the loop
+asking permission. You remain the single writer: apply the edit yourself.
+
 ${INTERVENTION_NOTE}
 ${REGRESSION_NOTE}
 ${STRATEGY_NOTE}