pi-goal-list-loop-audit 0.29.0 → 0.29.2

package/extensions/goal-loop-forever.ts

@@ -417,7 +417,8 @@ export function auditMeasureCmd(): string {
  * Each iteration: fresh audit pass → append NEW findings → fix the top
  * open ones → check them off with the fix commit. Honesty laws: never
  * fabricate findings, never rewrite the file's history, never check a box
- * without the fix commit existing.
+ * without the fix commit existing (committed with the repo's configured
+ * identity, on the current branch — no invented identities or branches).
  */
 export function auditTarget(): string {
   return `Audit the project for real problems and fix them, iteration by iteration. Every iteration: (1) run a FRESH audit pass over the codebase — spawn Explore subagents for breadth — hunting real issues: bugs, broken flows, regressions, drift between docs and code, dead code, security holes. Not style nits, not speculative refactors. (2) Append every NEW finding as one checkbox line "- [ ] SEVERITY: short description (file:line)" to ${AUDIT_FINDINGS_REL} (create the file on the first finding; append-only — never delete, rewrite, or reorder existing lines; never re-report a finding already listed). (3) Fix the highest-severity OPEN finding(s) — real fixes, committed — then check the box: "- [x] … — fixed in <commit>". (4) Honesty law: never fabricate findings to look busy; never mark a finding fixed without the fix commit existing. When a full audit pass surfaces nothing new AND no open findings remain, say so plainly — the orchestrator counts open findings every iteration and the plateau stop ends the loop when the well is dry.`;

package/extensions/loops/goal.ts

@@ -114,6 +114,7 @@ import {
 } from "../goal-settings.js";
 import {
   DEFAULT_REVIEWER_CONFIG,
+  normalizeObjective,
   resolveReviewerConfig,
   reviewerMenuOptions,
   runReviewer,
@@ -546,6 +547,21 @@ function escalateSendRearmStorm(ctx: ExtensionContext, kind: "continuation" | "l
     notifyExternal(ctx, "Loop stopped: send-retry storm.");
     return;
   }
+  if (
+    state.goal &&
+    (state.goal.status === "auditing" || completionAuditInFlight || state.goal.pendingCompletion)
+  ) {
+    // v0.29.1: NEVER storm-pause the completion lifecycle. An isolated
+    // auditor run takes minutes and the main session is EXPECTED to be
+    // silent while it works — 15m of wedged re-arms + that silence is the
+    // exact trigger shape, so completing a goal under a wedged queue used
+    // to guarantee a mid-audit pause (field-observed in pully + hellhunter
+    // + junk-runner: "complete ending in a pause retry storm"). The audit
+    // lifecycle owns its own pauses (quota etc.).
+    appendLedger(ctx.cwd, "send_rearm_escalated_suppressed", { reason: "audit-lifecycle" });
+    ctx.ui.notify("Send-retry storm during the completion audit — NOT pausing; the auditor's silence is expected. If pi is wedged, restart; the stored claim survives.", "info");
+    return;
+  }
   if (state.goal && state.goal.status === "active") {
     updateGoal({
       status: "paused",
@@ -606,6 +622,30 @@ function heartbeatTick(): void {
   // worse, the stall escalation would PAUSE the goal — silently cancelling
   // the interruptedAt → auto-resume-on-restart promise the footer shows.
   if (extensionApiStale) return;
+  // v0.29.1: stranded-audit recovery. A goal left in "auditing" with NO
+  // in-flight audit means the auditor's result never landed (wedged queue
+  // ate the tool result; compaction/restart mid-audit). Field-observed in
+  // pully: 12h+ stuck "auditing" while the model had already confabulated
+  // the closure narrative. The audit silence is expected ONLY while
+  // completionAuditInFlight — its absence here means the run is orphaned.
+  // Recover: a stored claim re-runs the auditor directly; otherwise resume
+  // active so the agent re-calls complete_goal.
+  if (
+    state.goal?.status === "auditing" &&
+    !completionAuditInFlight &&
+    Date.now() - lastActivityAt >= 90_000
+  ) {
+    appendLedger(ctx.cwd, "stranded_audit_recovered", { goalId: state.goal.id, via: state.goal.pendingCompletion ? "stored-claim" : "resume-active" });
+    if (state.goal.pendingCompletion) {
+      ctx.ui.notify("Recovering a completion audit whose result never landed — re-running the auditor with the stored claim.", "info");
+      void retryStoredCompletionAudit(ctx, "quota-retry");
+    } else {
+      updateGoal({ status: "active" }, ctx);
+      ctx.ui.notify("A completion audit was interrupted (its result never landed). Resuming — re-call complete_goal when the deliverable still stands.", "warning");
+      scheduleContinuation(ctx, true);
+    }
+    return;
+  }
   // v0.26.5: pending-latch watchdog — a queued continuation whose turn
   // trigger was dropped (field-observed post-compaction: continuation
   // ACCEPTED at compact+0s, then 22 minutes of silence). The stuck latch
@@ -970,7 +1010,7 @@ function archiveCurrentGoal(ctx: ExtensionContext, status: Status, stopReason?:
     try { fs.unlinkSync(goalMdPath(ctx.cwd, goal.id)); } catch {}
   }
   state = { ...state, goal: { ...goal, status, archivedPath: path.relative(ctx.cwd, target) || target, stopReason } };
-  appendLedger(ctx.cwd, "goal_archived", { goalId: goal.id, status, stopReason });
+  appendLedger(ctx.cwd, "goal_archived", { goalId: goal.id, status, stopReason, objective: goal.objective.slice(0, 300) });
   persistState(ctx);
   // Loop 2: a list-sourced goal COMPLETED → auto-activate the next item.
   // Aborts are user actions (/list next, /goal cancel, list_activate) which
@@ -1672,8 +1712,57 @@ async function cmdTweak(args: string, ctx: ExtensionContext): Promise<void> {
  * contract extraction) → appended to the queue → persisted → first item
  * activated when nothing is running. Returns the count enqueued.
  */
+// v0.29.1: zombie-twin guard. A draft/enqueue whose objective matches a
+// goal COMPLETED in the last 24h re-creates just-finished work — field-
+// observed in junk-runner: the INFRA-NEW-18 close was re-drafted 3 minutes
+// after the auditor approved it and autoaccept waved the twin straight in,
+// where it stormed for 9h against a dead provider. Normalized compare (goal
+// ids stripped), 24h lookback, loud skip — never silent.
+const DUPLICATE_LOOKBACK_MS = 24 * 60 * 60 * 1000;
+const LEDGER_TAIL_BYTES = 256 * 1024;
+function recentlyCompletedObjectives(cwd: string): Set<string> {
+  const done = new Set<string>();
+  try {
+    const p = ledgerPath(cwd);
+    const size = fs.statSync(p).size;
+    const buf = Buffer.alloc(Math.min(size, LEDGER_TAIL_BYTES));
+    const fd = fs.openSync(p, "r");
+    fs.readSync(fd, buf, 0, buf.length, Math.max(0, size - buf.length));
+    fs.closeSync(fd);
+    const cutoff = Date.now() - DUPLICATE_LOOKBACK_MS;
+    for (const line of buf.toString("utf-8").split("\n")) {
+      if (!line.includes('"goal_archived"') || !line.includes('"complete"')) continue;
+      try {
+        const e = JSON.parse(line);
+        if (e?.type !== "goal_archived" || e.value?.status !== "complete") continue;
+        if (!(Date.parse(e.ts ?? "") >= cutoff)) continue;
+        // v0.29.1+ entries carry the objective inline; older entries fall
+        // back to the archived goal file (## Objective → "> …" line).
+        let objective = typeof e.value?.objective === "string" ? e.value.objective : "";
+        if (!objective && e.value?.goalId) {
+          try {
+            const md = fs.readFileSync(archivedGoalPath(cwd, e.value.goalId), "utf-8");
+            objective = md.split("## Objective")[1]?.split("\n").find((l: string) => l.startsWith("> "))?.slice(2) ?? "";
+          } catch { /* archived file gone — skip */ }
+        }
+        if (objective) done.add(normalizeObjective(objective));
+      } catch { /* malformed line — skip */ }
+    }
+  } catch { /* no ledger yet */ }
+  return done;
+}
+
 function enqueueItems(ctx: ExtensionContext, texts: string[], source: string, opts?: { autoActivate?: boolean }): number {
-  const items = texts.map((text) => {
+  const recentlyDone = recentlyCompletedObjectives(ctx.cwd);
+  const fresh = texts.filter((t) => !recentlyDone.has(normalizeObjective(extractVerificationContract(t).objective)));
+  const skipped = texts.length - fresh.length;
+  if (skipped > 0) {
+    const first = texts.find((t) => recentlyDone.has(normalizeObjective(extractVerificationContract(t).objective))) ?? "";
+    appendLedger(ctx.cwd, "list_duplicate_skipped", { source, count: skipped, objective: first.slice(0, 200) });
+    ctx.ui.notify(`Skipped ${skipped} item(s) duplicating work COMPLETED in the last 24h (zombie-twin guard): ${first.slice(0, 90)}`, "warning");
+  }
+  if (fresh.length === 0) return 0;
+  const items = fresh.map((text) => {
     const extracted = extractVerificationContract(text);
     return { id: newGoalId(), objective: extracted.objective, verificationContract: extracted.verificationContract || undefined, addedAt: nowIso() };
   });
@@ -3258,6 +3347,20 @@ function registerAgentTools(pi: any, ctx: ExtensionContext): void {
           details: {},
         };
       }
+      // v0.29.1: zombie-twin guard — a draft (auto-accepted OR confirmed)
+      // whose objective duplicates a goal COMPLETED in the last 24h is
+      // re-creating finished work. The Confirm dialog never said it was a
+      // duplicate, so the gate belongs here. Junk-runner field case: the
+      // just-approved INFRA-NEW-18 close re-drafted itself 3 minutes later.
+      if (recentlyCompletedObjectives(liveCtx.cwd).has(normalizeObjective(p.objective.trim()))) {
+        draftingTarget = null;
+        appendLedger(liveCtx.cwd, "draft_duplicate_skipped", { kind: isListDraft ? "list" : "goal", objective: p.objective.trim().slice(0, 200) });
+        liveCtx.ui.notify(`Draft REJECTED (zombie-twin guard): this objective matches a goal completed in the last 24h. Tell the user the work is already done.`, "warning");
+        return {
+          content: [{ type: "text", text: "This draft duplicates a goal that was COMPLETED within the last 24 hours (normalized objective match). Do NOT re-propose the same work. Report to the user that the objective is already done (see /glla audits or the archive) and ask what genuinely new work to take on instead." }],
+          details: {},
+        };
+      }
       const confirmedTarget = draftingTarget;
       draftingTarget = null;
       const full = p.objective.trim() + (normContract ? `\nDone when:\n${normContract}` : "");
@@ -5344,6 +5447,22 @@ export default function (pi: ExtensionAPI): void {
         // 60-second provider hiccup waiting on a manual /goal resume.
         const detail = text.trim() ? ` (last: ${text.trim().replace(/\s+/g, " ").slice(0, 160)})` : "";
         const reason = `5 consecutive errors${detail}`;
+        // v0.29.1: brake-cycle CAP. The v0.28.25 ladder slows the thrash
+        // (1m→16m) but never STOPS it — junk-runner/hellhunter/pully each
+        // burned 4+ pause↔retry cycles against provider windows that last
+        // hours. After 6 consecutive brakes: park, no more auto-retries.
+        if (errorBrakeStreak >= 6) {
+          updateGoal({
+            status: "paused",
+            pauseKind: "error",
+            pauseReason: `${reason} — 6 error-brakes in a row; the provider has been erroring for an extended window`,
+            pauseSuggestedAction: "Check the provider/account (quota, outage), then /goal resume. No more automatic retries.",
+          }, ctx);
+          ctx.ui.notify(`${goalNoun()} parked: ${reason} — 6 brakes in a row, no more auto-retries. Check the provider, then /goal resume.`, "warning");
+          notifyExternal(ctx, `${goalNoun()} parked: provider erroring across 6 error-brake cycles.`);
+          appendLedger(ctx.cwd, "error_brake_capped", { streak: errorBrakeStreak, reason });
+          return;
+        }
         // v0.28.25: the cooldown escalates per CONSECUTIVE brake — a fleet-wide
         // 403 window is not cleared by re-braking every 60 seconds.
         const cooldownMs = 60_000 * 2 ** Math.min(errorBrakeStreak, 4);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.29.0",
+  "version": "0.29.2",
   "description": "Goal. Loop. Audit. Done. \u2014 a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor \u2014 only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",

package/prompts/goal-loop-continuation.md

@@ -150,6 +150,7 @@ When the user must CHOOSE between paths, use `pause_goal` with `kind="decision"`
 
 - **Do not modify the objective silently.** The objective is the user's; if it has drifted from what makes sense, use `complete_goal`'s `newObjective` at completion time, or `pause_goal` and propose a `/goal tweak` mid-flight — never just work on something else and claim the original.
 - **Do not pretend completion.** If verification evidence is missing, call `pause_goal` instead of `complete_goal`.
+- **Git discipline: never touch identity or branches.** Commit with the repo's configured identity exactly as-is — no `git config user.*`, no per-commit `git -c user.name=…` overrides, no invented identities like `<task>-agent <…@local>` (field-observed: a phase agent branded itself `phase-e-agent <phase-e@local>` and polluted the history). No creating or switching branches either — commit on the branch you found (usually `main`) and push to its upstream. If git refuses a commit for a missing identity, STOP and ask the user — never invent one.
 - **Do not polish doorknobs.** If you are out of work and the goal is satisfied, call `complete_goal` instead of inventing a side-improvement.
 - **Do not give up early.** If a task is hard, run it down properly. The auditor will catch doorknobs; the agent's job is to do the real work.
 

package/prompts/goal-loop-forever-metricless.md

@@ -45,6 +45,8 @@ ${STRATEGY_NOTE}
 - Never repeat yourself: before acting, check what earlier iterations
   already did (git log / the artifacts themselves) and pick the next
   unaddressed piece of the spec.
+- Git discipline: commit with the repo's configured identity as-is, on the
+  branch you found — never set `git config user.*` or invent an identity.
 - When the spec is genuinely, verifiably exhausted — every section
   addressed, every case handled — say so plainly in your reply instead of
   inventing cosmetic work. The user watches an honest loop gladly; a

package/prompts/goal-loop-forever.md

@@ -44,6 +44,10 @@ ${STRATEGY_NOTE}
 - Do not modify the measure command or anything it reads for configuration;
   gaming the metric is bamboozling and the plateau detector will simply stop
   the loop.
+- Git discipline: commit with the repo's configured identity as-is, on the
+  branch you found — never set `git config user.*`, never use per-commit
+  identity overrides, never invent `<task>-agent <…@local>` identities or
+  scratch branches.
 - The spec is ALIVE: if the target needs sharpening or the metric no longer
   captures "better", call propose_loop_refine with your rationale — the user
   confirms or rejects. Never game or silently abandon the metric; refine it.