pi-goal-list-loop-audit 0.29.5 → 0.29.7

package/README.md

@@ -42,7 +42,7 @@ Five top-level commands — `/goal`, `/list`, `/loop`, `/glla`, `/review`:
 /goal audit                        # run the isolated auditor on the current goal now — no agent turn (v0.28.27)
 /goal tweak "<new objective>"      # edit in place (Confirm dialog)
 /goal archive                      # archived goals, newest first
-/glla                               # settings UI table · /glla key=value · /glla stats · /glla audits [N|full] · /glla postaudit · /glla autoaccept=on
+/glla                               # settings UI table · /glla key=value · /glla stats · /glla audits [N|full] · /glla postaudit · /glla wipe (nuclear reset, Confirm-gated) · /glla autoaccept=on
 /list fix the login bug, add dark mode, write docs   # dump it — the agent shapes it into items, one Confirm
 /list plan.md                      # file detected → bulk import, one Confirm (sisyphus/Ralph style)
 /list <paste a checklist>          # multi-line paste → same batch flow
@@ -194,7 +194,29 @@ running, you can see it — no command needed.
 A 15s heartbeat detects the precise stall condition — active goal/loop + idle
 session + nothing scheduled + quiet for 60s — and re-fires the continuation
 itself. Three consecutive zero-tool turns pause the goal / stop the loop.
-No external watchdog plugin needed.
+No external watchdog plugin needed. It also recovers **stranded audits**
+(v0.29.1): a goal stuck in `auditing` with no auditor session alive re-runs
+the stored claim after 90s instead of black-holing. Storm protection: the
+send→pause→notify path rearms once per cycle and loud-stops after a 6-error
+brake streak, so a broken provider can't spin forever.
+
+**User aborts mean STOP** (v0.29.4): Esc-aborting a turn stands the chain
+down with a named notify (`/goal resume` to continue) — it does NOT count
+toward stall warnings, does NOT auto re-fire, and the stand-down survives
+the heartbeat (v0.29.5). Five consecutive aborts still pause loudly as a
+backstop. A queued steer interrupt (`length`/`toolResult` races) is not an
+abort and resumes normally.
+
+## One active thing (auto-arbitrated)
+
+At most one goal/list-item/loop owns the active slot — activation guards
+refuse a second live thing in-session, and **session loads auto-arbitrate
+dirty stacked state** (v0.29.6): if a pre-guard project persisted a live
+loop AND a live goal, the one with the most recent activity keeps the slot
+and the loser is ARCHIVED (recoverable under `.pi-glla/archive/` / `/loop
+status`), never silently wiped. No picker, no per-start arbitration chores.
+The queued list is a backlog, not a second live thing — untouched.
+`/glla wipe` remains the manual, Confirm-gated clean slate.
 
 ## Config (one global place, rarely opened)
 
@@ -206,17 +228,21 @@ No external watchdog plugin needed.
 /glla tokenlimit=10000000            # per-goal token budget (default: off) → GLOBAL
 /glla tokenlimit=0                   # explicitly no cap (the default)
 /glla wedgealert=30                  # hung-command alert minutes (default: 30, 0 = off)
-/glla autoresume=on                  # auto-resume goals/loops on ANY session start (default: load HELD, never auto-start — explicit /goal resume, /list resume, or /loop; off: never)
+/glla autoresume=on                  # auto-resume goals/loops on ANY session start (default: load HELD, never auto-start — explicit /goal resume, /list resume, or /loop; off: never) — GLOBAL-only (v0.29.5): project-level keys are inert
 /glla auditcap=5                     # pause the goal after N consecutive auditor disapprovals (default 5, 0 = unlimited)
 /glla aggressivemode=on               # keep-going defaults: autoResume, cap 10, stuck 10, wedge off, quota auto-retry, cap→TODOs
 /glla quotaretryminutes=60            # minutes before auto-retrying a quota-exhausted auditor
 /glla stuckmax=10                     # consecutive stuck interventions before a loop stops (default 5)
 /glla auditfeedbackchars=800         # cap the executor-visible auditor report (default 0 = full report)
-/glla autoaccept=on                  # drafts ACTIVATE without the Confirm dialo... (every draft dialog also offers "always auto-accept" inline)unattended rigs)
+/glla autoaccept=on                  # drafts ACTIVATE without the Confirm dialog (v0.29.4: they start immediately — autoResume no longer gates drafts; every draft dialog also offers "always auto-accept" inline)
 /glla project tokenlimit=500         # rare per-project override
 ```
 
-Resolution per key: **project > global > defaults**. The auditor defaults to
+Resolution per key: **project > global > defaults** — EXCEPT `autoResume`,
+which is **global-only** (v0.29.5): per-project opt-ins from old versions
+silently overrode the global hold at launch (the junk-runner incident), so
+the launch-restore gate and the reviewer-enqueue gate read only the global
+file now. The auditor defaults to
 your pi session model. When the session provider is extension-registered the
 auditor can't auth it — you're told once (info level) with the fix:
 `/glla model=provider/id`, set once, rarely touched again. The plugin never
@@ -232,7 +258,12 @@ history and is available through `/goal status` regardless.
 floor — every `propose_*` draft (goal, list batch, loop, task list)
 activates the moment the agent proposes it, with a notification and a
 `draft_autoaccepted` ledger entry (auto-accept is never silent). The seed
-carries the intent. Pair with `autoresume=on` for fully unattended rigs.
+carries the intent. Since v0.29.4 auto-accepted drafts **start immediately**
+— the draft path is decoupled from `autoResume`, which gates ONLY
+launch-time restore of persisted state ("load it but don't auto-start it").
+For fully unattended rigs you typically want both on; for attended rigs,
+`autoaccept=on` + `autoresume=off` is the sweet spot (new drafts go, old
+state holds).
 
 ## Subagents
 
@@ -330,7 +361,7 @@ prompts/
   goal-loop-forever-draft.md   # /loop drafting prompt
 scripts/
   smoke.sh                     # live integration harness (tmux + real models)
-tests/                         # 545 tests across 58 files, no live pi required (mock-ctx harness drives the orchestrator)
+tests/                         # 613 tests across 58 files, no live pi required (mock-ctx harness drives the orchestrator)
 docs/DESIGN.md                 # architectural decisions
 PLAN.md                        # milestones, decisions, gates
 ```

package/docs/DESIGN.md

@@ -44,6 +44,52 @@ below; later releases append addenda rather than rewrite history.
 - **`notify=<cmd>`**: fire-and-forget shell-out on goal complete / goal pause /
   loop stop, message as `$1`. Settings parser is quote-aware.
 
+## Addendum v0.5.0–v0.29.6 (current state — the long-session era)
+
+The v0.4.0 addendum closed the scaffold era. v0.5.0 through v0.29.6 are 25+
+releases of unattended-rig hardening; the full record is CHANGELOG.md. The
+architectural decisions that changed the SHAPE of the system:
+
+- **Self-watchdog is baked in** (v0.5.0): a 15s heartbeat owns liveness —
+  supervising + idle + nothing scheduled + 60s quiet → re-fire. External
+  liveness plugins are retired.
+- **The restore gate** (v0.26.9 tri-state; hardened v0.28.30, v0.29.4): a
+  bare `pi` start HOLDS everything and paints it — nothing auto-starts from
+  persisted state. In-session reload/fork/compaction continues automatically.
+  `autoResume` (on → any session start resumes; off → never) is **global-only**
+  (v0.29.5) after a stale per-project opt-in silently overrode the global hold.
+- **Drafts and restores are decoupled** (v0.29.4): `autoAcceptDrafts` is the
+  pre-consent for in-session drafts — they START immediately. `autoResume`
+  gates only launch-time restore. "The session auto-starts in some cases ok;
+  launching pi must not."
+- **User aborts mean STOP** (v0.29.4/0.29.5): an aborted turn is exempt from
+  stall accounting, stands the chain down with no auto re-fire, and the
+  stand-down gates the heartbeat + post-compaction refires. The 5-abort loud
+  pause is the backstop.
+- **One active thing, auto-arbitrated** (v0.28.21 guards; v0.29.6 load-time
+  arbitration): at most one live artifact. Dirty stacked states at load are
+  resolved deterministically — most recent activity keeps the slot, the loser
+  is archived (recoverable), no picker. `/glla wipe` (v0.28.31) is the manual,
+  Confirm-gated clean slate.
+- **The completion lifecycle owns its pauses** (v0.29.1): storm/stall
+  escalation never pauses `auditing` goals; a stranded `auditing` state (no
+  live auditor, 90s stale) re-runs the stored claim; send/pause/notify storms
+  rearm once per cycle; the provider-error brake (v0.28.13) keeps cross-cycle
+  memory and parks after 6 consecutive errors.
+- **The audit loop is the project reviewer** (v0.29.0): `/loop audit` runs
+  fresh audit passes every iteration, appends findings to
+  `.pi-glla/audit-loop/findings.md`, fixes the top open ones; the orchestrator
+  counts open boxes as the measure and the plateau stop ends it. The
+  reviewer's reflexive fire-audit-on-clean cascade is opt-in (it paid for
+  verification twice and was hydra fuel).
+- **Git discipline is prompt-law** (v0.29.2): continuation/draft prompts
+  forbid inventing git identities or branches (field incidents: agents
+  committing as `phase-e-agent <phase-e@local>`).
+- **Reviewer = strategist, not verifier** (v0.24.6–v0.29.0): the reviewer
+  scans sources and proposes list items through the standard drafting +
+  Confirm path; it never audits work — the isolated auditor is the only
+  verifier.
+
 ## Addendum v0.4.0 (completion)
 
 - **Auditor compaction enabled** (flaw #3 — the last open one). Safety:

package/extensions/loops/goal.ts

@@ -1003,6 +1003,43 @@ function updateGoal(patch: Partial<Goal>, ctx: ExtensionContext): void {
   persistState(ctx);
 }
 
+// v0.29.6: stacked-state auto-arbitration (user directive: "auto archive /
+// wipe extra goals/loops/lists … make sure that we only have one"). Dirty
+// pre-guard states can persist a live loop AND a live goal; the 0.28.21
+// decision picker asked the user to arbitrate artifacts they didn't
+// remember at every pi start. Now deterministic: MOST RECENT ACTIVITY
+// keeps the slot; the loser is ARCHIVED (recoverable), never wiped. The
+// queued list is a backlog, not a live artifact — untouched.
+function autoArbitrateStackedState(ctx: ExtensionContext): void {
+  const loop = state.loop?.active ? state.loop : undefined;
+  const goal = state.goal && state.goal.status !== "complete" && state.goal.status !== "aborted" ? state.goal : undefined;
+  if (!loop || !goal) return; // at most one live artifact — the invariant holds
+  const lastMeasure = loop.history.length > 0 ? loop.history[loop.history.length - 1] : undefined;
+  const loopMs = Date.parse(lastMeasure?.at ?? loop.startedAt ?? "") || 0;
+  const goalMs = Date.parse(goal.updatedAt ?? goal.createdAt ?? "") || 0;
+  const keepGoal = goalMs > loopMs; // tie → the loop keeps the slot (0.28.21 default)
+  appendLedger(ctx.cwd, "stacked_state_auto_arbitrated", {
+    kept: keepGoal ? "goal" : "loop",
+    goalId: goal.id,
+    goalMs,
+    loopMs,
+    loopIteration: loop.iteration,
+    loopTarget: loop.target.slice(0, 120),
+  });
+  if (keepGoal) {
+    // Same shape as /loop stop: the loop record stays in state (inactive)
+    // with an honest reason — /loop status still shows it.
+    state = { ...state, loop: { ...loop, active: false, stopReason: "auto-arbitrated on session load: the goal was more recent (one active thing)" } };
+    persistState(ctx);
+  } else {
+    archiveCurrentGoal(ctx, "aborted", "auto-arbitrated on session load: the loop was more recent (one active thing)");
+  }
+  ctx.ui.notify(
+    `Stacked state auto-arbitrated (one active thing): kept the ${keepGoal ? "goal" : "loop"} — more recent activity — and archived the ${keepGoal ? `loop (iter ${loop.iteration}, best ${loop.bestValue ?? "n/a"})` : `goal (${goal.id})`}. Recoverable: /loop status · .pi-glla/archive/ · /glla wipe for a clean slate.`,
+    "info",
+  );
+}
+
 function archiveCurrentGoal(ctx: ExtensionContext, status: Status, stopReason?: string): void {
   if (!state.goal) return;
   const goal = state.goal;
@@ -5192,6 +5229,9 @@ export default function (pi: ExtensionAPI): void {
     } catch (err) {
       ctx.ui.notify(`glla subagent override sync failed: ${err instanceof Error ? err.message : String(err)}`, "warning");
     }
+    // v0.29.6: stacked-state auto-arbitration FIRST — one live artifact
+    // survives before the restore gate decides hold-vs-resume for it.
+    autoArbitrateStackedState(ctx);
     // Restore gate (v0.26.9 tri-state): a human LOADING a session
     // ("startup"/"new"/"resume", or no reason) HOLDS — the popup shows what
     // is waiting and nothing starts until they resume explicitly. In-session
@@ -5276,31 +5316,10 @@ export default function (pi: ExtensionAPI): void {
         ctx.ui.notify(`List has ${listQueue().length} item(s) waiting — /list next to activate the head.`, "info");
       }
     }
-    // v0.28.21: enforce one-active-thing at the restore boundary for DIRTY
-    // legacy states — pre-guard versions could persist an active goal AND
-    // an active/held loop; the chain above handles the loop first, and the
-    // goal would otherwise stay active and fire on agent_end. Pause it:
-    // at most one thing owns the active slot, and nothing auto-starts.
-    if (state.loop && state.goal && state.goal.status === "active") {
-      updateGoal({
-        status: "paused",
-        pauseKind: "decision",
-        // v0.29.3: third option — the wipe escape. Old projects stack a
-        // goal AND a loop AND a list from pre-guard versions; arbitrating
-        // between two artifacts the user doesn't even remember is the odd
-        // part — "i feel like wipe does [make sense]". Wipe keeps its own
-        // Confirm (destructive), so picking it is safe to offer.
-        pauseOptions: ["Stop the loop, then resume the goal (/loop stop)", "Cancel the goal (/goal cancel) — the loop keeps running", "Wipe everything — clean slate for stale leftovers (/glla wipe)"],
-        pauseRecommended: 1,
-        pauseReason: "held on session load — the loop owns the active slot (one active thing at a time)",
-        pauseSuggestedAction: "/loop to work the loop, or /loop stop then /goal resume to work the goal",
-      }, ctx);
-      ctx.ui.notify(
-        `Goal held — a loop also exists; one active thing at a time. /loop to resume the loop, or /loop stop then /goal resume.`,
-        "info",
-      );
-      maybeDecisionPopup(ctx);
-    }
+    // v0.29.6: the 0.28.21 loop-vs-goal decision picker is SUPERSEDED by
+    // auto-arbitration above — stacked states resolve deterministically
+    // (most recent activity keeps the slot; the loser is archived) before
+    // the restore gate, so a live loop and a live goal cannot coexist here.
     // Always paint on session load (v0.22.1): the branches above only reach
     // refreshUI via persistState, so a goal that was ALREADY paused (or any
     // state that doesn't mutate on load) rendered nothing — "can't tell if

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.29.5",
+  "version": "0.29.7",
   "description": "Goal. Loop. Audit. Done. \u2014 a pi-coding-agent extension that supervises long-running work, with isolated auditor on each completion. Beat bamboozling by design: the auditor runs in a fresh session with no extensions, no skills, no editor \u2014 only the read tools needed to verify your goal.",
   "license": "MIT",
   "author": "dracon",