pi-goal-list-loop-audit 0.28.27 → 0.28.29

package/extensions/goal-loop-core.ts

@@ -185,6 +185,10 @@ export interface Goal {
    * the retry resolves. Only consumed while paused with an "auditor quota:"
    * reason, so a stale value is unreachable by construction. */
   pendingCompletion?: { completionSummary?: string; verificationSummary?: string; at: string };
+  /** v0.28.28: provenance — who created this goal ("user", "list-cascade",
+   * "draft-confirmed", "draft-autoaccepted"). Ledgered on goal_created so
+   * "where did this come from" is answerable after the fact. */
+  createdVia?: string;
   /** v0.25.0 (contract item 22): auditor objections extracted as TODOs when
    * aggressiveMode keeps the goal active past the disapproval cap. Rendered
    * into every continuation prompt until the next audit clears them. */

package/extensions/loops/goal.ts

@@ -482,35 +482,65 @@ const COMPACTION_GRACE_MS = 3 * 60_000;
 // brake (1m, 2m, 4m, 8m, 16m cap). A successful turn resets both.
 const ERROR_RETRY_LADDER_MS = [5_000, 15_000, 45_000, 90_000, 180_000];
 let errorBrakeStreak = 0;
-const SEND_REARM_LEDGER_EVERY = 600; // 600 × 50ms = 30s
-const SEND_REARM_ESCALATE_AT = 6000; // 6000 × 50ms = 5 minutes
+const SEND_REARM_LEDGER_MILESTONES_MS = [2 * 60_000, 5 * 60_000, 10 * 60_000];
+// v0.28.29: escalation is TIME-based and ACTIVITY-gated. A busy session is
+// NORMAL — the user conversing, or one long subagent turn — and the old
+// flat-50ms × 6000-count rule misread 5 minutes of busy as "wedged" and
+// paused the goal (the polis field report). Escalate only after 15 minutes
+// of failed sends AND no session activity in the last 5 minutes (a wedged
+// queue shows no events at all; a busy one streams constantly).
+const SEND_REARM_ESCALATE_AFTER_MS = 15 * 60_000;
+const SEND_REARM_ESCALATE_SILENT_MS = 5 * 60_000;
+let continuationRearmSince = 0;
+let loopRearmSince = 0;
+let continuationRearmMilestone = 0;
+let loopRearmMilestone = 0;
+
+/** v0.28.29: busy-retry cadence backs off — 50ms for the first beats
+ * (instant pickup right after a turn ends), then 250ms, 1s, 5s, 15s, 30s
+ * cap. agent_end reschedules independently, so the slow tail costs nothing
+ * in the common case; it only caps the ledger/CPU spam of a long busy stretch. */
+function sendRearmDelayMs(streak: number): number {
+  if (streak <= 4) return 50;
+  if (streak <= 8) return 250;
+  if (streak <= 12) return 1_000;
+  if (streak === 13) return 5_000;
+  if (streak === 14) return 15_000;
+  return 30_000;
+}
 
 function accountSendRearm(ctx: ExtensionContext, kind: "continuation" | "loop"): void {
   const streak = kind === "continuation" ? ++continuationRearmStreak : ++loopRearmStreak;
   if (streak === 1) {
+    if (kind === "continuation") { continuationRearmSince = Date.now(); continuationRearmMilestone = 0; } else { loopRearmSince = Date.now(); loopRearmMilestone = 0; }
     appendLedger(ctx.cwd, "send_rearm_start", { kind });
     return;
   }
-  if (streak % SEND_REARM_LEDGER_EVERY === 0) {
-    appendLedger(ctx.cwd, "send_rearm_storm", { kind, streak, minutes: Math.round((streak * BACKOFF_IDLE_RETRY_MS) / 60000) });
+  const since = kind === "continuation" ? continuationRearmSince : loopRearmSince;
+  const elapsed = Date.now() - since;
+  const milestone = kind === "continuation" ? continuationRearmMilestone : loopRearmMilestone;
+  if (milestone < SEND_REARM_LEDGER_MILESTONES_MS.length && elapsed >= SEND_REARM_LEDGER_MILESTONES_MS[milestone]!) {
+    if (kind === "continuation") continuationRearmMilestone++; else loopRearmMilestone++;
+    appendLedger(ctx.cwd, "send_rearm_storm", { kind, streak, minutes: Math.round(elapsed / 60000) });
   }
-  if (streak >= SEND_REARM_ESCALATE_AT) {
-    if (kind === "continuation") continuationRearmStreak = 0; else loopRearmStreak = 0;
+  if (elapsed >= SEND_REARM_ESCALATE_AFTER_MS && Date.now() - lastActivityAt >= SEND_REARM_ESCALATE_SILENT_MS) {
+    if (kind === "continuation") { continuationRearmStreak = 0; continuationRearmSince = 0; } else { loopRearmStreak = 0; loopRearmSince = 0; }
     escalateSendRearmStorm(ctx, kind);
   }
 }
 
 function escalateSendRearmStorm(ctx: ExtensionContext, kind: "continuation" | "loop"): void {
-  // Same loud-terminal shape as escalateStallNow (v0.24.7): a 5-minute
-  // re-arm storm means the session never goes idle for us — wedged queue
-  // or a busy-forever session. Bounded and surfaced, not silent.
-  const mins = Math.round((SEND_REARM_ESCALATE_AT * BACKOFF_IDLE_RETRY_MS) / 60000);
-  appendLedger(ctx.cwd, "send_rearm_escalated", { kind, streak: SEND_REARM_ESCALATE_AT });
+  // Same loud-terminal shape as escalateStallNow (v0.24.7). v0.28.29: this
+  // only fires on a REAL wedge now (15m of failed sends + 5m of zero
+  // session activity) — busy-but-alive sessions never reach it.
+  const mins = Math.round(SEND_REARM_ESCALATE_AFTER_MS / 60000);
+  const silent = Math.round(SEND_REARM_ESCALATE_SILENT_MS / 60000);
+  appendLedger(ctx.cwd, "send_rearm_escalated", { kind, afterMinutes: mins, silentMinutes: silent });
   if (kind === "loop" && isLoopActive()) {
     clearLoopTimer();
-    state.loop = { ...state.loop!, active: false, stopReason: `send-retry storm: ${mins}m of 50ms re-arms — the session never went idle for the loop turn. Restart pi, then /loop start again.` };
+    state.loop = { ...state.loop!, active: false, stopReason: `send-retry storm: ${mins}m of re-arms with no session activity for ${silent}m — the session is wedged. Restart pi, then /loop start again.` };
     persistState(ctx);
-    ctx.ui.notify(`Loop stopped: send-retry storm (${mins}m). Restart pi and /loop start.`, "warning");
+    ctx.ui.notify(`Loop stopped: send-retry storm (${mins}m, session silent ${silent}m). Restart pi and /loop start.`, "warning");
     notifyExternal(ctx, "Loop stopped: send-retry storm.");
     return;
   }
@@ -518,10 +548,10 @@ function escalateSendRearmStorm(ctx: ExtensionContext, kind: "continuation" | "l
     updateGoal({
       status: "paused",
       pauseKind: "error",
-      pauseReason: `send-retry storm: ${mins}m of 50ms re-arms — the session never went idle for the continuation`,
-      pauseSuggestedAction: "The session never went idle for the send (wedged queue or permanently busy). Restart pi, then /goal resume.",
+      pauseReason: `send-retry storm: ${mins}m of re-arms with no session activity for ${silent}m — the session never went idle for the continuation`,
+      pauseSuggestedAction: "The session produced no events while the send retried (wedged queue). Restart pi, then /goal resume.",
     }, ctx);
-    ctx.ui.notify(`Goal paused: send-retry storm (${mins}m). Restart pi, then /goal resume.`, "warning");
+    ctx.ui.notify(`Goal paused: send-retry storm (${mins}m, session silent ${silent}m). Restart pi, then /goal resume.`, "warning");
     notifyExternal(ctx, "Goal paused: send-retry storm.");
   }
 }
@@ -736,10 +766,10 @@ function sendContinuation(goalId: string): void {
     return;
   }
   if (!ctx.isIdle() || ctx.hasPendingMessages()) {
-    // v0.28.5 (E3): count + ledger + escalate the re-arm storm.
     accountSendRearm(ctx, "continuation");
     continuationScheduledFor = goalId;
-    continuationTimer = setTimeout(() => sendContinuation(goalId), BACKOFF_IDLE_RETRY_MS);
+    // v0.28.29: backing-off cadence (was flat 50ms — 6,000 spins in 5m).
+    continuationTimer = setTimeout(() => sendContinuation(goalId), sendRearmDelayMs(continuationRearmStreak));
     continuationTimer.unref?.();
     return;
   }
@@ -750,7 +780,7 @@ function sendContinuation(goalId: string): void {
       content: continuationPrompt(state.goal!),
       display: false,
     }, { triggerTurn: true, deliverAs: "followUp" });
-    continuationRearmStreak = 0; // v0.28.5 (E3): a landed send clears the storm
+    continuationRearmStreak = 0; continuationRearmSince = 0; // v0.28.5 (E3): a landed send clears the storm
     appendLedger(ctx.cwd, "goal_continuation_sent", { goalId });
   } catch (err) {
     appendLedger(ctx.cwd, "goal_continuation_send_failed", { goalId, error: err instanceof Error ? err.message : String(err) });
@@ -895,18 +925,19 @@ function notifyPersistenceState(ctx: ExtensionContext): void {
   }
 }
 
-function setGoal(goal: Goal, ctx: ExtensionContext): void {
+function setGoal(goal: Goal, ctx: ExtensionContext, via = "user"): void {
   // v0.28.14: never silently orphan a live goal — a paused/active goal
   // being replaced is archived honestly first (the old behavior left it in
   // goals/ but untracked: "older goals lying around leading to confusion").
   if (state.goal && state.goal.id !== goal.id && (state.goal.status === "active" || state.goal.status === "paused")) {
     archiveCurrentGoal(ctx, "aborted", `replaced by goal ${goal.id}`);
   }
+  goal.createdVia = via; // v0.28.28: provenance — answerable from the ledger + /glla log
   state = { ...state, goal }; // preserve list AND loop (v0.28.14: the bare reconstruction used to nuke a held/active loop whenever a goal was set)
   const file = writeGoalMd(ctx.cwd, goal);
   state.goal!.activePath = path.relative(ctx.cwd, file) || file;
   persistState(ctx);
-  appendLedger(ctx.cwd, "goal_created", { goalId: goal.id, objective: goal.objective, policy: goal.policy });
+  appendLedger(ctx.cwd, "goal_created", { goalId: goal.id, objective: goal.objective, policy: goal.policy, via });
 }
 
 function updateGoal(patch: Partial<Goal>, ctx: ExtensionContext): void {
@@ -1142,7 +1173,7 @@ function fireReviewer(
       manual: opts.manual,
       ledgerEntries,
       sources,
-      enqueueListItems: (objectives) => enqueueItems(ctx, objectives, "reviewer"),
+      enqueueListItems: (objectives) => enqueueItems(ctx, objectives, "reviewer", { autoActivate: loadSettings(ctx.cwd).autoResume === true }),
       proposeGoal: (objective, reason) => {
         try {
           extensionApi?.sendUserMessage(
@@ -1212,7 +1243,7 @@ function activateNextListItem(ctx: ExtensionContext, n = 1): boolean {
   state = { ...state, list: rest };
   const goal = createGoal(next.objective, ctx, "list");
   if (next.verificationContract) goal.verificationContract = next.verificationContract;
-  setGoal(goal, ctx);
+  setGoal(goal, ctx, "list-cascade");
   iterationCounter = 0;
   consecutiveErrorIterations = 0;
   consecutiveAbortIterations = 0;
@@ -1631,7 +1662,7 @@ async function cmdTweak(args: string, ctx: ExtensionContext): Promise<void> {
  * contract extraction) → appended to the queue → persisted → first item
  * activated when nothing is running. Returns the count enqueued.
  */
-function enqueueItems(ctx: ExtensionContext, texts: string[], source: string): number {
+function enqueueItems(ctx: ExtensionContext, texts: string[], source: string, opts?: { autoActivate?: boolean }): number {
   const items = texts.map((text) => {
     const extracted = extractVerificationContract(text);
     return { id: newGoalId(), objective: extracted.objective, verificationContract: extracted.verificationContract || undefined, addedAt: nowIso() };
@@ -1640,7 +1671,16 @@ function enqueueItems(ctx: ExtensionContext, texts: string[], source: string): n
   persistState(ctx);
   appendLedger(ctx.cwd, "list_imported", { source, count: items.length });
   if (!state.goal || state.goal.status === "complete" || state.goal.status === "aborted") {
-    activateNextListItem(ctx);
+    // v0.28.28: unsolicited sources (the reviewer) do NOT auto-start the
+    // head unless autoResume is on — "I cancelled a goal and the next one
+    // started itself" was the field complaint. User-driven imports keep
+    // the immediate-start behavior (opts default true).
+    if (opts?.autoActivate === false) {
+      ctx.ui.notify(`Queued ${items.length} item(s) from ${source} — /list next when ready (auto-start is opt-in: /glla autoresume=on).`, "info");
+      appendLedger(ctx.cwd, "list_autoactivation_held", { source, count: items.length });
+    } else {
+      activateNextListItem(ctx);
+    }
   }
   return items.length;
 }
@@ -2001,8 +2041,8 @@ function sendLoopTurn(): void {
   if (!isLoopActive() || !extensionApi) return;
   const ctx = freshCtx();
   if (!ctx || !ctx.isIdle() || ctx.hasPendingMessages()) {
-    if (ctx) accountSendRearm(ctx, "loop"); // v0.28.5 (E3)
-    loopTimer = setTimeout(() => sendLoopTurn(), BACKOFF_IDLE_RETRY_MS);
+    if (ctx) accountSendRearm(ctx, "loop");
+    loopTimer = setTimeout(() => sendLoopTurn(), sendRearmDelayMs(loopRearmStreak)); // v0.28.29: backing-off cadence
     loopTimer.unref?.();
     return;
   }
@@ -2049,7 +2089,7 @@ function sendLoopTurn(): void {
     }, { triggerTurn: true, deliverAs: "followUp" });
     // v0.26.1: the send path is ledgered — the hegemon zombie spun 619
     // refires with zero visibility into whether sends were landing.
-    loopRearmStreak = 0; // v0.28.5 (E3): a landed turn clears the storm
+    loopRearmStreak = 0; loopRearmSince = 0; // v0.28.5 (E3): a landed turn clears the storm
     appendLedger(ctx.cwd, "loop_turn_sent", { iteration: loop.iteration });
   } catch (err) {
     // stale API — next agent_end reschedules (but if none comes, the
@@ -3167,13 +3207,34 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
         persistState(liveCtx);
         appendLedger(liveCtx.cwd, "list_added", { id: item.id, objective: item.objective, drafted: true });
         if (!state.goal || state.goal.status === "complete" || state.goal.status === "aborted") {
+          // v0.28.28: an AUTO-ACCEPTED draft does not auto-start unless
+          // autoResume is on — accepting a draft is not consent to start.
+          if (autoAccept && loadSettings(liveCtx.cwd).autoResume !== true) {
+            liveCtx.ui.notify(`Auto-accepted and QUEUED (autoResume off — not auto-started): ${extracted.objective.slice(0, 80)} — /list next when ready.`, "info");
+            appendLedger(liveCtx.cwd, "list_autoactivation_held", { source: "draft-autoaccepted", count: 1 });
+            return { content: [{ type: "text", text: "Draft accepted and added to the list, but NOT started (the user's autoResume setting is off — auto-accepted drafts queue, they don't auto-start). Do NOT begin work. Tell the user: /list next starts it." }], details: {} };
+          }
           activateNextListItem(liveCtx);
           return { content: [{ type: "text", text: "Confirmed and activated (list was empty). Begin work now." }], details: {} };
         }
         return { content: [{ type: "text", text: `Confirmed and added to the list (${listQueue().length} waiting). It activates when the current goal completes.` }], details: {} };
       }
       const goal = createGoal(full, liveCtx);
-      setGoal(goal, liveCtx);
+      setGoal(goal, liveCtx, autoAccept ? "draft-autoaccepted" : "draft-confirmed");
+      // v0.28.28: auto-accepted goal drafts are created HELD when autoResume
+      // is off — auto-accept delegates the Confirm click, not the decision
+      // to start. Explicit user-confirmed drafts still start immediately.
+      if (autoAccept && loadSettings(liveCtx.cwd).autoResume !== true) {
+        updateGoal({
+          status: "paused",
+          pauseKind: "blocked",
+          pauseReason: "auto-accepted draft — held for the user's go-ahead (autoResume off)",
+          pauseSuggestedAction: "/goal resume to start · /goal cancel to drop · /glla autoresume=on starts auto-accepted drafts automatically",
+        }, liveCtx);
+        appendLedger(liveCtx.cwd, "draft_held", { goalId: goal.id, reason: "autoaccept-autoresume-off" });
+        liveCtx.ui.notify(`Draft auto-accepted and HELD (autoResume off): ${goal.objective.slice(0, 80)} — /goal resume to start, /goal cancel to drop.`, "info");
+        return { content: [{ type: "text", text: "Goal accepted but HELD (the user's autoResume setting is off — auto-accepted drafts do not auto-start). Do NOT begin work. Tell the user: /goal resume starts it, /goal cancel drops it." }], details: {} };
+      }
       iterationCounter = 0;
       consecutiveErrorIterations = 0;
       consecutiveAbortIterations = 0;
@@ -4085,6 +4146,42 @@ function cmdStats(args: string, ctx: ExtensionContext): void {
  * log (.pi-glla/audits.jsonl). Default: last 10 verdicts, one line each.
  * "full" prints the latest report in full.
  */
+/**
+ * v0.28.28: /glla log [N] — human-readable tail of the event ledger (the
+ * forensic trail: who created/resumed/paused goals, from where). Skips the
+ * high-frequency noise entries (state snapshots, re-arm internals) unless
+ * "all" is passed. N defaults to 15.
+ */
+const LOG_NOISE = new Set(["state", "send_rearm_start", "heartbeat_suppressed_tick"]);
+function cmdLog(args: string, ctx: ExtensionContext): void {
+  const all = /\ball\b/.test(args);
+  const nMatch = args.match(/\b(\d+)\b/);
+  const n = Math.min(Math.max(parseInt(nMatch?.[1] ?? "15", 10) || 15, 1), 100);
+  let entries: Array<{ type: string; at?: string; value?: any }> = [];
+  try {
+    entries = parseLedgerEntries(fs.readFileSync(ledgerPath(ctx.cwd), "utf-8"));
+  } catch {
+    ctx.ui.notify("No ledger yet — .pi-glla/active.jsonl doesn't exist.", "info");
+    return;
+  }
+  const visible = all ? entries : entries.filter((e) => !LOG_NOISE.has(e.type));
+  const tail = visible.slice(-n);
+  if (tail.length === 0) {
+    ctx.ui.notify("Ledger is empty (no non-noise events yet).", "info");
+    return;
+  }
+  const lines = tail.map((e) => {
+    const t = (e.at ?? "").slice(11, 19);
+    const v = e.value ?? {};
+    const detail = Object.entries(v)
+      .filter(([k]) => k !== "goalId" && k !== "report")
+      .map(([k, val]) => `${k}=${typeof val === "string" ? val.slice(0, 60) : JSON.stringify(val)?.slice(0, 60)}`)
+      .join(" ");
+    return `${t}  ${e.type}${detail ? `  ${detail}` : ""}`;
+  });
+  ctx.ui.notify(`Ledger tail (last ${tail.length}${all ? "" : " non-noise"} events — /glla log <N> for more, /glla log all to include noise):\n${lines.join("\n")}`, "info");
+}
+
 function cmdAudits(args: string, ctx: ExtensionContext): void {
   const full = /\bfull\b/.test(args);
   const all = /\b(?:all|global|log)\b/.test(args);
@@ -4136,6 +4233,12 @@ async function cmdSettings(args: string, ctx: ExtensionContext): Promise<void> {
     cmdAudits(trimmed.slice("audits".length).trim(), ctx);
     return;
   }
+  // v0.28.28: /glla log [N] — the raw event trail, human-readable. "Log it
+  // so we can look back and see where we are doing things wrong."
+  if (/^log\b/.test(trimmed)) {
+    cmdLog(trimmed.slice("log".length).trim(), ctx);
+    return;
+  }
   if (/^reviewer\b/.test(trimmed)) {
     await cmdReviewerSettings(ctx);
     return;
@@ -4526,6 +4629,7 @@ export default function (pi: ExtensionAPI): void {
       ["autoresume=", "default: hold when a session is loaded, auto-resume on reload/fork; on: always auto-resume; off: never"],
       ["decisionpopup=", "on|off: decision pauses pop the select() picker (default on; the widget card always lists the options, /goal decide reopens the picker)"],
       ["auditcap=", "N: pause goal after N consecutive auditor disapprovals (default 5, 0 = unlimited)"],
+      ["log", "event-trail tail: /glla log [N] — who created/resumed/paused what, from where (v0.28.28)"],
       ["auditfeedbackchars=", "cap on executor-visible disapproval report chars (0 = full report, the default)"],
       ["aggressivemode=", "on: keep-going defaults — autoResume, cap 10, stuck 10, wedge off, quota auto-retry, cap→TODOs"],
       ["quotaretryminutes=", "N: minutes before auto-retrying a quota-exhausted auditor (default 60)"],
@@ -4628,8 +4732,8 @@ export default function (pi: ExtensionAPI): void {
     // v0.28.24: a compaction is LEGITIMATE busy time — reset the send-rearm
     // storm streaks (π-web nearly escalated a "send-retry storm" pause during
     // a 3.5-minute compact) and open the post-compaction stall grace.
-    continuationRearmStreak = 0;
-    loopRearmStreak = 0;
+    continuationRearmStreak = 0; continuationRearmSince = 0;
+    loopRearmStreak = 0; loopRearmSince = 0;
     compactionGraceUntil = Date.now() + COMPACTION_GRACE_MS;
     const settle = setTimeout(() => {
       const c = freshCtx();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.28.27",
+  "version": "0.28.29",
   "description": "Goal. Loop. Audit. Done. \u2014 a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor \u2014 only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",

package/schemas/goal.schema.json

@@ -54,6 +54,7 @@
     "interruptedReason": { "type": "string" },
     "auditInfraStreak": { "type": "number" },
     "pendingCompletion": { "type": "object" },
+    "createdVia": { "type": "string" },
     "activePath": { "type": "string" },
     "archivedPath": { "type": "string" },
     "usage": {