pi-goal-list-loop-audit 0.28.24 → 0.28.26

package/extensions/goal-loop-backoff.ts

@@ -162,6 +162,8 @@ export interface HeartbeatInput {
   /** Milliseconds since the last observed agent activity. */
   msSinceActivity: number;
   stallMs?: number;
+  /** v0.28.25: consecutive stall refires so far — spaces refires exponentially. */
+  consecutiveStalls?: number;
 }
 
 /** Should the heartbeat re-fire the continuation right now? */
@@ -169,7 +171,15 @@ export function shouldHeartbeatRefire(input: HeartbeatInput): boolean {
   if (!input.supervising) return false;
   if (!input.sessionIdle) return false;
   if (input.timerPending) return false;
-  return input.msSinceActivity >= (input.stallMs ?? HEARTBEAT_STALL_MS);
+  // v0.28.25: exponential spacing between stall refires — 1m, 2m, 4m, 8m
+  // (cap 8×). Field-observed in junk-runner: the flat 60s gate burned all
+  // 5 refires in ~4 minutes into a just-compacted session, pausing a
+  // resumable goal instead of giving the provider/queue time to recover.
+  // noteActivity() runs at each refire, so msSinceActivity measures the
+  // silence SINCE the last refire — scaling the threshold scales the gap.
+  const stallMs = input.stallMs ?? HEARTBEAT_STALL_MS;
+  const scale = 2 ** Math.min(input.consecutiveStalls ?? 0, 3);
+  return input.msSinceActivity >= stallMs * scale;
 }
 
 /**

package/extensions/goal-loop-core.ts

@@ -176,6 +176,15 @@ export interface Goal {
    * At 3 the goal pauses loudly — a broken auditor model must not spin a
    * silent retry-forever loop. Cleared on any real auditor run. */
   auditInfraStreak?: number;
+  /** v0.28.26: the completion claim captured when an audit attempt is
+   * quota-blocked. The quota retry re-runs the AUDITOR directly with this
+   * stored claim instead of re-engaging the agent — re-engaging produced a
+   * hallucinated-closure repetition loop in the field (π-games 2026-07-29:
+   * the agent concluded the goal was closed, stopped calling complete_goal,
+   * and repeated the same essay until the stall brake fired). Cleared when
+   * the retry resolves. Only consumed while paused with an "auditor quota:"
+   * reason, so a stale value is unreachable by construction. */
+  pendingCompletion?: { completionSummary?: string; verificationSummary?: string; at: string };
   /** v0.25.0 (contract item 22): auditor objections extracted as TODOs when
    * aggressiveMode keeps the goal active past the disapproval cap. Rendered
    * into every continuation prompt until the next audit clears them. */

package/extensions/loops/goal.ts

@@ -471,6 +471,17 @@ let loopRearmStreak = 0;
 // after the compact instead of giving pi room to recover.
 let compactionGraceUntil = 0;
 const COMPACTION_GRACE_MS = 3 * 60_000;
+// v0.28.25: provider-error retry cadence. Field-observed in dracon-utilities
+// (kimi, 19-session fleet on one provider account): a "concurrent request
+// limit" 403 storm got 5 retries BACK-TO-BACK (delay 0 after each errored
+// turn — the session is idle at agent_end, so scheduleContinuation fired
+// instantly) and the brake then cycled on a flat 60s cooldown for 1h 38m.
+// The condition clears on a minutes-to-fleet scale, not milliseconds:
+// ladder the inter-error retries (5s, 15s, 45s, 90s, 3m — the 5-retry
+// budget now spans ~5.5m) and escalate the brake cooldown per consecutive
+// brake (1m, 2m, 4m, 8m, 16m cap). A successful turn resets both.
+const ERROR_RETRY_LADDER_MS = [5_000, 15_000, 45_000, 90_000, 180_000];
+let errorBrakeStreak = 0;
 const SEND_REARM_LEDGER_EVERY = 600; // 600 × 50ms = 30s
 const SEND_REARM_ESCALATE_AT = 6000; // 6000 × 50ms = 5 minutes
 
@@ -592,6 +603,7 @@ function heartbeatTick(): void {
     timerPending: continuationTimer !== null || loopTimer !== null,
     msSinceActivity: Date.now() - lastActivityAt,
     stallMs: HEARTBEAT_STALL_MS,
+    consecutiveStalls,
   });
   // Wedge alert (v0.23.2): session BUSY but silent for the threshold —
   // the classic hung-command case (a test suite that never exits holds
@@ -688,7 +700,7 @@ function freshCtx(): ExtensionContext | null {
   }
 }
 
-function scheduleContinuation(ctx: ExtensionContext, force = false): void {
+function scheduleContinuation(ctx: ExtensionContext, force = false, delayMs?: number): void {
   if (!isActionableGoal()) return;
   rememberCtx(ctx);
   const goalId = state.goal!.id;
@@ -696,7 +708,7 @@ function scheduleContinuation(ctx: ExtensionContext, force = false): void {
   clearContinuationTimer();
   let delay = 0;
   try {
-    delay = ctx.isIdle() && !ctx.hasPendingMessages() ? 0 : BACKOFF_IDLE_RETRY_MS;
+    delay = delayMs ?? (ctx.isIdle() && !ctx.hasPendingMessages() ? 0 : BACKOFF_IDLE_RETRY_MS);
   } catch {
     return;
   }
@@ -935,6 +947,146 @@ function archiveCurrentGoal(ctx: ExtensionContext, status: Status, stopReason?:
   }
 }
 
+/**
+ * v0.28.26: quota-window retry for a STORED completion claim. The auditor
+ * was quota-blocked at complete_goal time; the claim (completionSummary +
+ * verificationSummary) was persisted on the goal, and when the quota window
+ * elapses we re-run the AUDITOR directly — no agent turn. Re-engaging the
+ * agent to re-submit an unchanged claim produced a hallucinated-closure
+ * repetition loop in the field (π-games: the model concluded the goal was
+ * closed, repeated the same essay 4×+, stormed continuations, compacted 14×
+ * in 35 minutes, and burned the stall brake).
+ *
+ * Outcomes: approved → close + cascade (archiveCurrentGoal handles list
+ * advance + reviewer); quota again → re-pause with a fresh scheduled retry
+ * (claim preserved); anything else (disapproved, impossible, non-quota
+ * infra) → hand back to the agent: resume active + continuation, verdict
+ * durable in auditHistory.
+ */
+async function retryStoredCompletionAudit(ctx: ExtensionContext): Promise<void> {
+  const goal = state.goal;
+  if (!goal?.pendingCompletion) return;
+  if (completionAuditInFlight) return;
+  const liveCtx = freshCtx() ?? ctx;
+  const claim = goal.pendingCompletion;
+  updateGoal({ status: "auditing" }, liveCtx);
+  appendLedger(liveCtx.cwd, "goal_resumed", { via: "quota-retry-direct-audit" });
+  liveCtx.ui.notify("Auditor quota window elapsed — retrying the audit with your stored completion claim (no agent turn needed).", "info");
+  const settings = loadSettings(liveCtx.cwd);
+  const { model: auditorModel, error: modelError, via } = resolveAuditorModel(liveCtx, settings.auditorModel);
+  if (modelError) liveCtx.ui.notify(`Auditor model issue: ${modelError}`, "warning");
+  latestAuditProgress = { label: "quota-retry", lastEventAt: Date.now() };
+  completionAuditInFlight = true;
+  const auditStartMs = Date.now();
+  let result: Awaited<ReturnType<typeof runGoalCompletionAuditor>>;
+  try {
+    ({ result } = await runWithInfraRetry(
+      () =>
+        runGoalCompletionAuditor({
+          ctx: liveCtx,
+          goal: state.goal!,
+          completionSummary: claim.completionSummary,
+          verificationSummary: claim.verificationSummary,
+          model: auditorModel,
+          thinkingLevel: settings.auditorThinkingLevel ?? getSessionThinkingLevel(),
+          onProgress: (progress) => {
+            latestAuditProgress = { currentTool: progress.currentTool, label: progress.label, elapsedMs: progress.elapsedMs, lastEventAt: Date.now() };
+            refreshUI(liveCtx);
+          },
+        }),
+      { onRetry: (err) => appendLedger(liveCtx.cwd, "audit_infra_retry", { goalId: state.goal?.id, error: err.slice(0, 200) }) },
+    ));
+  } finally {
+    completionAuditInFlight = false;
+    latestAuditProgress = null;
+  }
+  if (!state.goal) return; // aborted mid-audit
+
+  // Record the run in history (same compact shape as the tool path).
+  const auditorRan = result.output.trim().length > 0;
+  const history = state.goal.auditHistory ?? [];
+  if (auditorRan) {
+    result.output = stripThinkBlocks(result.output);
+    history.push({
+      at: nowIso(),
+      approved: result.approved,
+      disapproved: result.disapproved,
+      impossible: result.impossible,
+      impossibleReason: result.impossibleReason,
+      model: result.model,
+      thinkingLevel: result.thinkingLevel,
+      report: result.output,
+      error: result.error,
+      regressionShieldPassed: result.regressionShieldPassed,
+      regressionShieldMissing: result.regressionShieldMissing,
+      durationMs: Date.now() - auditStartMs,
+    } as any);
+    if (history.length > 20) history.splice(0, history.length - 20);
+  }
+
+  if (result.approved) {
+    updateGoal({ auditHistory: history, pendingCompletion: undefined }, liveCtx);
+    const objective = state.goal.objective;
+    archiveCurrentGoal(liveCtx, "complete", `auditor ${result.model} approved (quota-retry)`);
+    liveCtx.ui.notify(`Goal complete — auditor ${result.model} approved on the quota retry.`, "info");
+    notifyExternal(liveCtx, `Goal complete (auditor approved on quota-retry): ${objective.slice(0, 120)}`);
+    return;
+  }
+
+  if (result.error && !result.disapproved && isQuotaError(result.error)) {
+    // Still quota'd — re-pause with a fresh window, claim preserved.
+    const settingsNow = loadSettings(liveCtx.cwd);
+    const defaultSec = (settingsNow.quotaRetryMinutes ?? DEFAULT_QUOTA_RETRY_MINUTES) * 60;
+    const quota = parseQuotaError(result.error, defaultSec);
+    const retryMin = Math.max(1, Math.round(quota.retryAfterSec / 60));
+    updateGoal({
+      status: "paused",
+      auditHistory: history,
+      pauseKind: "wait",
+      pauseResumeAt: new Date(Date.now() + quota.retryAfterSec * 1000).toISOString(),
+      pauseReason: `auditor quota: ${result.error}`,
+      pauseSuggestedAction: `Quota auto-retry in ${retryMin}m — or /goal resume to retry now`,
+    }, liveCtx);
+    appendLedger(liveCtx.cwd, "goal_paused", { reason: `auditor quota: retry in ${quota.retryAfterSec}s (stored-claim retry)` });
+    liveCtx.ui.notify(`Auditor still quota-limited — next auto-retry in ${retryMin}m (your completion claim is stored; no action needed).`, "warning");
+    scheduleQuotaRetry(liveCtx, quota.retryAfterSec, result.error, () => {
+      if (state.goal && state.goal.status === "paused" && (state.goal.pauseReason ?? "").startsWith("auditor quota:") && state.goal.pendingCompletion) {
+        void retryStoredCompletionAudit(liveCtx);
+      }
+    });
+    return;
+  }
+
+  // Any other outcome — disapproved, impossible, non-quota infra — belongs
+  // to the agent: resume and let the continuation drive the next step. The
+  // verdict is durable in auditHistory + /goal status.
+  updateGoal({
+    status: "active",
+    auditHistory: history,
+    pendingCompletion: undefined,
+    pauseReason: result.disapproved
+      ? `auditor disapproved on quota-retry — see /goal status`
+      : result.impossible
+        ? `auditor verdict: IMPOSSIBLE on quota-retry — ${(result.impossibleReason ?? "").slice(0, 120)}`
+        : `auditor infrastructure error on quota-retry: ${(result.error ?? "").slice(0, 120)}`,
+  }, liveCtx);
+  liveCtx.ui.notify(
+    result.disapproved
+      ? `Auditor (quota-retry) DISAPPROVED — resuming; the report is in /goal status.`
+      : result.impossible
+        ? `Auditor (quota-retry): goal IMPOSSIBLE — ${(result.impossibleReason ?? "").slice(0, 100)}. Resuming; consider /goal tweak.`
+        : `Auditor (quota-retry) hit an infrastructure error — resuming; re-call complete_goal when ready.`,
+    "warning",
+  );
+  appendLedger(liveCtx.cwd, "quota_retry_audit_verdict", {
+    approved: false,
+    disapproved: result.disapproved,
+    impossible: result.impossible,
+    error: result.error?.slice(0, 160),
+  });
+  scheduleContinuation(liveCtx, true);
+}
+
 /**
  * v0.26.0: bind the reviewer to the live session. Sources for finding
  * extraction: the archived goal markdown + its audit reports + the
@@ -2562,6 +2714,9 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
             status: "paused",
             auditHistory: history,
             auditInfraStreak: undefined, // quota reached the auditor — infra streak broken
+            // v0.28.26: store the claim — the quota retry re-runs the
+            // auditor DIRECTLY with it (no agent turn to confuse).
+            pendingCompletion: { completionSummary: p.completionSummary, verificationSummary: p.verificationSummary, at: nowIso() },
             pauseKind: "wait",
             pauseResumeAt: new Date(Date.now() + quota.retryAfterSec * 1000).toISOString(),
             pauseReason: `auditor quota: ${result.error}`,
@@ -2572,6 +2727,13 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
             // Re-check: only auto-resume if STILL paused for the quota
             // reason (a user /goal pause during the window is not stomped).
             if (state.goal && state.goal.status === "paused" && (state.goal.pauseReason ?? "").startsWith("auditor quota:")) {
+              // v0.28.26: a stored claim retries the AUDITOR directly — the
+              // agent is not needed to re-submit an unchanged claim, and
+              // re-engaging it produced hallucinated-closure loops.
+              if (state.goal.pendingCompletion) {
+                void retryStoredCompletionAudit(ctx);
+                return;
+              }
               updateGoal({ status: "active" }, ctx);
               appendLedger(ctx.cwd, "goal_resumed", { via: "quota-retry" });
               if (resolveEffectiveAggressiveSettings(loadSettings(ctx.cwd)).aggressiveMode) {
@@ -4821,33 +4983,46 @@ export default function (pi: ExtensionAPI): void {
       if (consecutiveErrorIterations >= 5) {
         // v0.28.5 (E8): carry the REAL error text — the pause used to say
         // literally "5 consecutive errors: error" (stopReason, not the
-        // provider error). And give transient flakes ONE capped auto-resume
-        // (60s, reason re-checked) — the E8 incident lost 1.5h to a
+        // provider error). And give transient flakes ONE auto-resume per brake
+        // (escalating cooldown, reason re-checked) — the E8 incident lost 1.5h to a
         // 60-second provider hiccup waiting on a manual /goal resume.
         const detail = text.trim() ? ` (last: ${text.trim().replace(/\s+/g, " ").slice(0, 160)})` : "";
         const reason = `5 consecutive errors${detail}`;
+        // v0.28.25: the cooldown escalates per CONSECUTIVE brake — a fleet-wide
+        // 403 window is not cleared by re-braking every 60 seconds.
+        const cooldownMs = 60_000 * 2 ** Math.min(errorBrakeStreak, 4);
+        const cooldownMin = Math.round(cooldownMs / 60_000);
+        errorBrakeStreak++;
         updateGoal({
           status: "paused",
           pauseKind: "wait",
-          pauseResumeAt: new Date(Date.now() + 60_000).toISOString(),
+          pauseResumeAt: new Date(Date.now() + cooldownMs).toISOString(),
           pauseReason: reason,
-          pauseSuggestedAction: "Transient provider flake? The goal auto-resumes once in 60s if still paused for this reason — or /goal resume now.",
+          pauseSuggestedAction: `Transient provider flake? The goal auto-resumes once in ${cooldownMin}m if still paused for this reason — or /goal resume now.`,
         }, ctx);
         ctx.ui.notify(`Goal paused: ${reason}.`, "warning");
         notifyExternal(ctx, `Goal paused: ${reason}.`);
         appendLedger(ctx.cwd, "goal_paused", { reason });
-        scheduleQuotaRetry(ctx, 60, reason, () => {
+        scheduleQuotaRetry(ctx, cooldownMs / 1000, reason, () => {
           // Re-check: only auto-resume if STILL paused for the error brake
           // (a user /goal pause during the window is not stomped).
           if (state.goal && state.goal.status === "paused" && (state.goal.pauseReason ?? "").startsWith("5 consecutive errors")) {
             updateGoal({ status: "active" }, ctx);
             appendLedger(ctx.cwd, "goal_resumed", { via: "error-brake-retry" });
-            ctx.ui.notify("Auto-resumed after the 5-error brake (60s cooldown).", "info");
+            ctx.ui.notify("Auto-resumed after the 5-error brake (cooldown elapsed).", "info");
             scheduleContinuation(ctx, true);
           }
         }, "5 consecutive errors — auto-retry");
         return;
       }
+      // v0.28.25: under the brake, the retry rides the exponential ladder —
+      // NOT the immediate scheduleContinuation at the bottom of this handler
+      // (an errored turn leaves the session idle, so the default delay is 0:
+      // exactly how 5 retries fired back-to-back in dracon-utilities).
+      const retryDelayMs = ERROR_RETRY_LADDER_MS[Math.min(consecutiveErrorIterations - 1, ERROR_RETRY_LADDER_MS.length - 1)];
+      appendLedger(ctx.cwd, "error_retry_backoff", { attempt: consecutiveErrorIterations, delayMs: retryDelayMs });
+      scheduleContinuation(ctx, true, retryDelayMs);
+      return;
     } else if (stopReason === "aborted") {
       // v0.28.5 (E8): user aborts are not provider errors. Separate brake,
       // honest message, and NO auto-resume — aborting five turns in a row
@@ -4868,6 +5043,7 @@ export default function (pi: ExtensionAPI): void {
     } else {
       consecutiveErrorIterations = 0;
       consecutiveAbortIterations = 0;
+      errorBrakeStreak = 0; // v0.28.25: a healthy turn clears the brake cooldown
     }
 
     // No wall-clock cap by design: a goal ends via completion, explicit

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.28.24",
+  "version": "0.28.26",
   "description": "Goal. Loop. Audit. Done. \u2014 a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor \u2014 only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",

package/schemas/goal.schema.json

@@ -53,6 +53,7 @@
     "interruptedAt": { "type": "string" },
     "interruptedReason": { "type": "string" },
     "auditInfraStreak": { "type": "number" },
+    "pendingCompletion": { "type": "object" },
     "activePath": { "type": "string" },
     "archivedPath": { "type": "string" },
     "usage": {