pi-goal-list-loop-audit 0.34.19 → 0.34.48

package/README.md

@@ -2,15 +2,17 @@
 
 > **Mission control for autonomous pi.**
 
-Interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. Every goal starts as a **drafted contract you confirm** — nothing activates sight-unseen. The plugin then writes a durable goal to disk, drives the agent through an `agent_end`-driven loop, and on each `complete_goal` spawns an **isolated auditor in a fresh pi session** to verify the work is genuinely done. Stall recovery, structured decision pauses, and consent gates keep you in charge while it works.
+Interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. Every goal starts as a **drafted contract you confirm** — nothing activates sight-unseen. The plugin then writes a durable goal to disk, drives the agent through an `agent_end`-driven loop, and on each `complete_goal` queues a **detached auditor worker process** to verify the work without holding the main pi turn open. Stall recovery, structured decision pauses, and consent gates keep you in charge while it works.
 
-The auditor runs in a fresh session with no extensions, no skills, no prompts, no editor. It has only `read` / `grep` / `find` / `ls` / `bash`. It cannot see the implementing conversation. It cannot plant evidence. The implementer cannot fool it.
+The auditor runs in a fresh extension-less pi RPC process with no extensions, skills, prompts, themes, or context files. It has only `read` / `grep` / `find` / `ls` / `bash`. It cannot see the implementing conversation, cannot mutate glla state, and cannot plant evidence. Its durable result is identity-checked and revalidated by the parent before it can archive a goal.
+
+This is a detached process, not a nested session in the main pi process. `complete_goal` returns after writing the claim and job request; the status surface shows `auditor queued`, `auditor running`, or `audit recovery pending` while the worker runs or awaits a fresh lifecycle.
 
 ## Why this exists
 
 Most pi goal extensions — `pi-goal`, `pi-goal-x`, `pi-loop-mode`, `ralphi`, `tmustier-pi-ralph-wiggum` — let the same agent that did the work also be the verifier. **That's the bamboozle trap.** The agent that wrote the implementation also says "I'm done", and the loop trusts them.
 
-`pi-goal-list-loop-audit` separates **implementation** from **verification**. Two independent sessions, two independent read paths, two perspectives.
+`pi-goal-list-loop-audit` separates **implementation** from **verification**. Two independent processes, two independent read paths, two perspectives.
 
 ### Architectural guarantee
 
@@ -18,7 +20,7 @@ Most pi goal extensions — `pi-goal`, `pi-goal-x`, `pi-loop-mode`, `ralphi`, `t
 |---|---|
 | Goal intake | Drafting + Confirm/Reject dialog; nothing activates unconfirmed |
 | Implementation | `agent_end`-driven continuation loop with 5-minute hard backoff cap |
-| Completion | Isolated auditor session + **regression_shield**: raw command output required per verification-contract item, enforced orchestrator-side |
+| Completion | Detached extension-less auditor process + **regression_shield**: raw command output required per verification-contract item, enforced orchestrator-side |
 
 ## Quick start
 
@@ -40,11 +42,11 @@ Five top-level commands — `/goal`, `/list`, `/loop`, `/glla`, `/review`:
 /goal resume                       # resume
 /goal cancel                       # abort
 /goal decide                       # re-open the decision picker (v0.28.23)
-/goal audit ["focus on payments"]    # one-shot project audit (v0.29.8): fix the non-decisions, present the decisions — findings in .pi-glla/audit-loop/findings.md
-/goal verify                       # run the isolated auditor on the current goal now — no agent turn (v0.28.27, renamed from /goal audit in v0.29.8)
+/goal audit "focus on payments"      # one-shot project audit; optional focus text
+/goal verify                       # queue a detached auditor for the current goal — no agent turn (v0.28.27, renamed from /goal audit in v0.29.8)
 /goal tweak "<new objective>"      # edit in place (Confirm dialog)
 /goal archive                      # archived goals, newest first
-/glla                               # settings UI table · /glla status (unified what's-running view) · /glla key=value · /glla stats · /glla audits [N|full] · /glla postaudit · /glla wipe (nuclear reset, Confirm-gated) · /glla autoaccept=on
+/glla                               # settings UI table · arguments are actions: /glla status · /glla stats · /glla audits [N|full] · /glla postaudit · /glla wipe (nuclear reset, Confirm-gated)
 /list fix the login bug, add dark mode, write docs   # dump it — the agent shapes it into items, one Confirm
 /list plan.md                      # file detected → bulk import, one Confirm (sisyphus/Ralph style)
 /list <paste a checklist>          # multi-line paste → same batch flow
@@ -215,16 +217,94 @@ Each loop is a different policy class on the same status machine.
 | Auditor can rubber-stamp after `bash true` | **regression_shield** (shipped v0.2.0): auditor must quote raw tool output per verification-contract item; orchestrator rejects evidence-free approvals |
 | `pause_goal` is fire-and-forget | Clear `pauseReason` surfaced in status + agent feedback |
 | Vague objective + weak auditor = rubber-stamp | Drafting phase with Confirm dialog + isolated auditor + shield |
-| Esc mid-audit just dies | Escape dialog: complete-without-audit / continue (shipped v0.2.0) |
+| Auditor holds the main turn open | Detached worker returns control immediately; `/goal cancel` discards the pending claim |
 | Auditor can't compact — context exhaustion mid-audit | Compaction enabled (v0.4.0); safe because the shield is orchestrator-side |
 | Agent can grow subtasks indefinitely | `propose_task_list` with 20/5 caps + Confirm dialog (v0.3.0) |
 
 ## Live TUI (always know it's on)
 
 A persistent `glla:` status segment + an above-editor widget show the current
-goal/loop at all times: objective, status, elapsed, tokens, next task or loop
-metric, pause reason, and live auditor progress during audits. If something is
-running, you can see it — no command needed.
+goal/list item/loop at all times: objective, durable state, elapsed time,
+tokens, next task or loop metric, pause reason, and live auditor progress
+during audits. If something is running, you can see it — no command needed.
+
+The status bar is the single activity HUD. It uses compact state capsules plus
+an animated pulse waveform so live work is obvious at a glance without turning
+the line into a progress meter. Fresh stream age is the proof of live work:
+
+```text
+glla: [▁▂▄▆█▆ LIVE · WORKING] 1m 09s · last stream 11s ago · 3 queued
+glla: [QUEUED] 44s · 18 queued
+```
+
+The waveform is evidence-gated and indeterminate: it moves only while fresh
+stream/tool activity is present, and says nothing about completion percentage.
+Activity is otherwise intentionally honest:
+
+| Indicator | Meaning |
+|---|---|
+| `LIVE · WORKING` | Fresh stream/tool evidence is arriving; the pulse and `last stream` age make that visible. |
+| `BUSY` | pi is occupied, but no fresh stream evidence justifies a live pulse. |
+| `QUEUED` | A continuation is waiting to start; no work is fabricated. |
+| `IDLE` | The durable item remains active, but no recent work is observed. |
+| `auditor …` | A detached, extension-less verifier is queued, running, quiet, or waiting for its verdict. |
+| `QUOTA WALL` | The provider rejected the request for a quota/plan window; saved work is waiting for a durable probe. |
+
+Quota walls deliberately do **not** get more blind request retries. A bare
+429/rate-limit response is treated as a transient throttle; explicit plan,
+usage, billing, reset, and provider-code language is classified more strongly.
+For example, MiniMax's `Token Plan rate limit reached … (2062)` asks for an
+upgrade or pay-as-you-go billing and is not the same thing as a per-minute
+throttle. Output/context-token stops are handled separately and never become a
+quota wall. pi's request-local retry counter is bounded; glla owns the longer
+recovery window: generic throttles use `15m → 30m → 1h → 2h → 4h → 5h`; a
+plan wall with no reset hint starts at `1h → 2h → 4h → 5h`. Automatic probes
+stop after 24h.
+A provider hint is honored when it is within the five-hour probe budget; a
+week-long hint is shown and held for manual action instead of scheduling a
+hidden week-long timer. With global `autoResume=on`, pending probes survive a
+session reload. After the safety horizon, `/list resume`, `/goal resume`, or
+`/loop resume` explicitly starts a fresh bounded window. For continuous work,
+configure ordered **Main model backups** in `/glla` using a model from a
+different provider or billing/quota pool — another model on the same exhausted
+plan is not a real fallback.
+
+Classification is conservative: explicit 429/rate-limit/plan-limit/token-plan
+signals are quota walls; ordinary `503 temporarily unavailable`, `403
+forbidden`, auth failures, and ambiguous provider prose are not relabeled as
+quota. Credit/billing exhaustion gets a manual-action hold. The raw provider
+message remains in the ledger/durable state for diagnosis, while the card
+shows the classified reason and recovery action.
+
+The quota-specific card hides raw provider JSON while preserving it in durable
+state and the ledger:
+
+```text
+glla: ⟦⏳ QUOTA WALL · next probe in 10m 48s⟧ · 1 queued
+├─ QUOTA WALL · Token Plan usage limit · 1 waiting in list
+├─ waiting — nothing for you to do · next probe in 10m 48s
+```
+
+Increasing pi's per-request retry count is usually the wrong fix for a
+multi-hour plan cap: it prolongs the 429 noise and delays the durable pause;
+it does not make the provider reset sooner. A provider that says "reset in a
+week" therefore does not cause a week of unattended probes.
+
+For long-running `/list` work, the card adds a compact queue trail with the
+immediate next item and its truthful wait age while `/list` remains the
+canonical full queue view:
+
+```text
+● Fix the current issue · list item · active · 42m
+├─ ✓ bash tests/display.test.ts (35s) · next: update docs
+├─ ↳ 23 waiting · up next: refresh the release notes · waiting 12m 04s
+└─ 23 queued · /list · /glla
+```
+
+The card does not duplicate the animated activity badge. This keeps the
+visual surface calm while still making a long-running list feel alive and
+answering the useful questions: **what is active, is it really moving, and
+what is next?**
 
 ## Self-watchdog (liveness is built in)
 
@@ -232,7 +312,7 @@ A 15s heartbeat detects the precise stall condition — active goal/loop + idle
 session + nothing scheduled + quiet for 60s — and re-fires the continuation
 itself. Three consecutive zero-tool turns pause the goal / stop the loop.
 No external watchdog plugin needed. It also recovers **stranded audits**
-(v0.29.1): a goal stuck in `auditing` with no auditor session alive re-runs
+(v0.29.1): a goal stuck in `auditing` with no detached worker alive re-runs
 the stored claim after 90s instead of black-holing. Storm protection: the
 send→pause→notify path rearms once per cycle and loud-stops after a 6-error
 brake streak, so a broken provider can't spin forever. A confirmed queued
@@ -277,33 +357,39 @@ The queued list is a backlog, not a second live thing — untouched.
 
 ## Config (one global place, rarely opened)
 
-```
-/glla                                # open the settings UI
-/glla model=provider/id              # auditor model override → GLOBAL
-/glla thinking=high                  # auditor thinking → GLOBAL
-/glla notify='cmd "$1"'              # custom push cmd · unset = auto-detect (notify-send/osascript) · off = silent → GLOBAL
-/glla tokenlimit=10000000            # per-goal token budget (default: off) → GLOBAL
-/glla tokenlimit=0                   # explicitly no cap (the default)
-/glla wedgealert=30                  # hung-command alert minutes (default: 30, 0 = off)
-/glla autoresume=on                  # auto-resume goals/loops on ANY session start (default: load HELD, never auto-start — explicit /goal resume, /list resume, or /loop; off: never) — GLOBAL-only (v0.29.5): project-level keys are inert
-/glla auditcap=5                     # pause the goal after N consecutive auditor disapprovals (default 5, 0 = unlimited)
-/glla aggressivemode=on               # keep-going defaults: autoResume, cap 10, stuck 10, wedge off, quota auto-retry, cap→TODOs
-/glla quotaretryminutes=60            # minutes before auto-retrying a quota-exhausted auditor
-/glla stuckmax=10                     # consecutive stuck interventions before a loop stops (default 5)
-/glla auditfeedbackchars=800         # cap the executor-visible auditor report (default 0 = full report)
-/glla autoaccept=on                  # drafts ACTIVATE without the Confirm dialog (v0.29.4: they start immediately — autoResume no longer gates drafts; every draft dialog also offers "always auto-accept" inline)
-/glla project tokenlimit=500         # rare per-project override
-```
+Open `/glla` to edit these settings in the table (the rows show effective values and provenance):
+
+- Auditor model and thinking level
+- Auditor fallback model
+- Notify command, token limit, and wedge-alert minutes
+- Auto-resume, auto-accept drafts, decision popup, and carryover policy
+- Ordered main-session backups and recovery cadence
+- Audit cap/report size, aggressive mode, quota retry, and stall brakes
+
+The argument namespace is reserved for actions such as `/glla status`, `/glla
+resume`, `/glla stats`, `/glla audits`, `/glla tooloverride`, and `/glla wipe`.
+There is no top-level `/glla key=value` setting syntax.
 
 Resolution per key: **project > global > defaults** — EXCEPT `autoResume`,
 which is **global-only** (v0.29.5): per-project opt-ins from old versions
 silently overrode the global hold at launch (the junk-runner incident), so
 the launch-restore gate and the reviewer-enqueue gate read only the global
-file now. The auditor defaults to
-your pi session model. When the session provider is extension-registered the
-auditor can't auth it — you're told once (info level) with the fix:
-`/glla model=provider/id`, set once, rarely touched again. The plugin never
-picks a model itself. Thinking follows the session too (floor `high`).
+file now. Main-session backups are global and ordered: a quota/provider error
+switches to the next authenticated candidate before another supervised turn;
+when every candidate is down, glla cancels the provider-held retry and uses a
+bounded `15m → 30m → 1h → 2h → 4h → 5h` probe ladder. Automatic recovery stops
+at 24h (or earlier when the provider supplies a reset beyond the five-hour
+budget), preserves the saved work, and requires an explicit `/goal resume`,
+`/list resume`, or `/loop resume` to start a fresh window. A quota window
+returning within that horizon therefore resumes saved work without manual
+intervention; no blind 50ms resend loop is introduced. The detached auditor uses an explicit cascade: primary
+`auditorModel` → optional fallback pin → the pi session model. If a selected
+model fails after launch, the worker retries it once and then advances through
+that same cascade; every candidate is still audited in a detached,
+extension-less process. There is no in-process fallback into the parent
+session. If the bounded cascade is exhausted, the exact completion claim is
+stored and the goal pauses for `/goal resume`; infrastructure is never treated
+as a verdict.
 
 On disapproval, the executor receives the full auditor report by default
 (`auditFeedbackChars=0`, since v0.24.9 — a truncated report loses exactly the
@@ -313,9 +399,10 @@ history and is available through `/goal status` regardless.
 
 `autoaccept=on` skips BOTH the Confirm dialog and the drafting interview
 floor — every `propose_*` draft (goal, list batch, loop, task list)
-activates the moment the agent proposes it, with a notification and a
-`draft_autoaccepted` ledger entry (auto-accept is never silent). The seed
-carries the intent. Since v0.29.4 auto-accepted drafts **start immediately**
+activates the moment the agent proposes it, and a completed `/list audit`
+fan-out queues its generated finding items without a second confirmation.
+Both paths notify loudly; auto-accept is never silent. The seed carries the
+intent. Since v0.29.4 auto-accepted drafts **start immediately**
 — the draft path is decoupled from `autoResume`, which gates ONLY
 launch-time restore of persisted state ("load it but don't auto-start it").
 For fully unattended rigs you typically want both on; for attended rigs,
@@ -346,8 +433,8 @@ are workers** (v0.23.8):
 ## Token guard
 
 Every goal tracks real token usage; crossing the budget pauses the goal.
-Off by default (opt-in) — set a budget with `/glla tokenlimit=<n>`. A high
-value like 10000000 is a runaway threshold, not a big-goal threshold
+Off by default (opt-in) — set Token limit in the `/glla` settings table. A
+high value like 10000000 is a runaway threshold, not a big-goal threshold
 (real research/feature goals legitimately burn 2-4M). Loop 3 doesn't need
 this cap — it has its own brakes
 (max iterations + plateau).
@@ -359,12 +446,15 @@ but silent for a long stretch because ONE unbounded command (a test suite
 that never exits, a dev server) is holding the whole goal hostage. The
 heartbeat watches the wall clock: busy + no activity for 30 minutes →
 in-session warning + your configured notify push, once per interval while
-it persists. Tune with `/glla wedgealert=<minutes>` (0 = off).
+it persists. Tune Wedge alert minutes in the `/glla` settings table (0 = off).
 
 Every other wait is bounded too: continuation retries are milliseconds,
 stuck backoff caps at 5 minutes then pauses, measure commands get a 10m
-hard timeout, and the auditor aborts after 10m with zero session activity
-(infrastructure error, never a verdict).
+hard timeout, and the detached auditor aborts after 10m with no activity while no
+read-only tool is running. A long-running verification tool is allowed to
+finish, but the worker has a 30m wall-clock safety cap. Both paths are
+infrastructure errors, never verdicts; interrupted claims remain stored for a
+direct retry after `/goal resume`.
 
 ## Compatibility (what goes well, what conflicts)
 
@@ -391,10 +481,10 @@ and removed pi-tasks. If you truly need session-wide dependency DAGs beyond
 one ordered queue, it exists — but installing both is not the ideal combo.
 
 **Two footnotes**: (1) extension-registered providers work in the main session
-but not the auditor's extension-less session — if audits fail auth, set the
-override once with `/glla model=`. (2) `pi-notify-agent` notifies on every
+but not the auditor's extension-less session — if audits fail auth, choose
+an auditor model in `/glla` settings. (2) `pi-notify-agent` notifies on every
 turn; glla pushes fire only where there is something to DO (pauses, verdicts,
-storms, wedge) and work out of the box — with no `notify=` configured glla
+storms, wedge) and work out of the box — with no notify command configured glla
 auto-detects `notify-send`/`osascript`; `notify=off` silences, `notify='<cmd>'`
 customizes.
 
@@ -404,7 +494,8 @@ customizes.
 extensions/
   loops/goal.ts                # /goal + /list commands, agent tools, loop driver
   goal-loop-core.ts            # types, JSONL state, pure helpers
-  goal-loop-auditor.ts         # isolated auditor (fresh session, no extensions)
+  goal-loop-auditor.ts         # auditor prompt + legacy in-process helper
+  goal-loop-auditor-process.ts # detached worker protocol + shield revalidation
   goal-loop-shield.ts          # regression_shield (pure, dependency-free)
   goal-loop-display.ts         # status line + /goal status rendering
   goal-loop-forever.ts         # /loop measure/parse/plateau helpers
@@ -415,8 +506,9 @@ prompts/
   goal-loop-forever.md         # /loop driver prompt
   goal-loop-forever-draft.md   # /loop drafting prompt
 scripts/
+  goal-auditor-worker.mjs      # extension-less RPC auditor child process
   smoke.sh                     # live integration harness (tmux + real models)
-tests/                         # 614 tests across 58 files, no live pi required (mock-ctx harness drives the orchestrator)
+tests/                         # current test count is reported by `bun test`; no live pi required for the suite
 docs/DESIGN.md                 # architectural decisions
 PLAN.md                        # milestones, decisions, gates
 ```
@@ -433,6 +525,17 @@ cd pi-goal-list-loop-audit
 pi install .
 ```
 
+## Publishing for other users
+
+The npm package is public, but `publishConfig.access=public` does not publish
+it by itself. Maintainers should configure npm Trusted Publishing for
+`.github/workflows/publish.yml`, run `npm run release:check`, push a matching
+`v<version>` tag, and publish a GitHub Release. That workflow then runs the
+full checks and `npm publish --provenance --access public` without a long-lived
+npm token. See [`docs/RELEASING.md`](docs/RELEASING.md); verify the result with
+`npm view pi-goal-list-loop-audit version dist-tags.latest` before telling
+users to upgrade.
+
 ## License
 
 MIT

package/docs/DESIGN.md

@@ -59,9 +59,10 @@ architectural decisions that changed the SHAPE of the system:
   `autoResume` (on → any session start resumes; off → never) is **global-only**
   (v0.29.5) after a stale per-project opt-in silently overrode the global hold.
 - **Drafts and restores are decoupled** (v0.29.4): `autoAcceptDrafts` is the
-  pre-consent for in-session drafts — they START immediately. `autoResume`
-  gates only launch-time restore. "The session auto-starts in some cases ok;
-  launching pi must not."
+  pre-consent for in-session drafts — they START immediately — and for the
+  generated finding batch at the end of `/list audit`. Direct bulk imports
+  remain Confirm-gated. `autoResume` gates only launch-time restore. "The
+  session auto-starts in some cases ok; launching pi must not."
 - **User aborts mean STOP** (v0.29.4/0.29.5): an aborted turn is exempt from
   stall accounting, stands the chain down with no auto re-fire, and the
   stand-down gates the heartbeat + post-compaction refires. The 5-abort loud
@@ -73,7 +74,8 @@ architectural decisions that changed the SHAPE of the system:
   Confirm-gated clean slate.
 - **The completion lifecycle owns its pauses** (v0.29.1): storm/stall
   escalation never pauses `auditing` goals; a stranded `auditing` state (no
-  live auditor, 90s stale) re-runs the stored claim; send/pause/notify storms
+  live auditor; lifecycle rebinds retry stored claims immediately (the 90s
+  heartbeat path is only a fallback); send/pause/notify storms
   rearm once per cycle; the provider-error brake (v0.28.13) keeps cross-cycle
   memory and parks after 6 consecutive errors.
 - **The audit loop is the project reviewer** (v0.29.0): `/loop audit` runs
@@ -110,6 +112,91 @@ architectural decisions that changed the SHAPE of the system:
   deprecated deserialization compatibility fields; they do not select a
   transport.
 
+## Addendum v0.34.21 (completion-audit lifecycle observability)
+
+- **The durable claim owns recovery state**: `pendingCompletion.phase` is
+  `running`, `recovery-pending`, or `quota-waiting`. Missing phase is legacy
+  state and is treated as recovery-pending after a fresh lifecycle event.
+  The isolated attempt id and wall deadline prevent an old generation from
+  finalizing a newer attempt.
+- **Rebind recovery is immediate but consent-aware**: a replacement
+  `session_start` converts an old running claim to recovery-pending and
+  retries it immediately when the lifecycle handoff or global `autoResume`
+  supplies consent. A cold startup with autoResume off paints the pending
+  claim and waits for `/goal resume`.
+- **Auditor bounds have two layers**: no-event inactivity aborts after 10m
+  only when no read-only tool is active; a live verification tool may finish,
+  but the complete isolated run has a 30m wall-clock cap. Both outcomes are
+  infrastructure failures, never verdicts, and the stored claim remains
+  retryable.
+
+## Addendum v0.34.22 (detached completion auditor)
+
+- **Completion verification is process-isolated, not nested**: `complete_goal`
+  persists the claim and job request, then returns immediately. A detached
+  extension-less worker launches `pi --mode rpc` with only `read`, `grep`,
+  `find`, `ls`, and `bash`; it never receives the parent `ExtensionContext`,
+  never loads glla extensions or project context files, and never writes goal
+  state. This removes the previous nested `AgentSession` from the main pi
+  process and prevents a provider stall in the auditor from occupying the
+  executor's turn.
+- **Durable job protocol**: request, progress, lock, and result files live
+  under `.pi-glla/audit-jobs/<attemptId>/`. Requests and results are hashed and
+  atomically written. The parent validates attempt/request identity, verdict
+  markers, read-tool use, and `regression_shield` before applying any result.
+  A result from a stale generation is ignored; fresh lifecycle recovery creates
+  a new attempt. Cancellation clears the pending claim and best-effort stops
+  the worker.
+- **Truthful asynchronous UI**: `auditor queued`, `auditor running`, and
+  `audit recovery pending` are distinct. The main session can continue
+  rendering and accepting input while the worker audits; completion/archive or
+  disapproval/continuation happens only after durable result consumption.
+- **Bounded worker liveness**: no session event for 10 minutes while no
+  read-only tool is active aborts the worker; a 30-minute wall-clock bound
+  always wins. Both are infrastructure failures, never verdicts, and the claim
+  remains retryable.
+
+## Addendum v0.34.24 (dispatch proof and display projection safety)
+
+- **Accepted is not started**: every automated follow-up records a versioned,
+  generation/owner-bound dispatch in `.pi-glla/continuation-dispatch.json`
+  before calling `sendMessage({ triggerTurn: true })`. `before_agent_start`
+  with the matching marker is the strongest proof; compatible low-level start
+  events are accepted for older pi builds. The sidecar is cleared only after
+  proof or an explicit terminal send outcome.
+- **No blind trigger storm**: an accepted dispatch has one bounded start-proof
+  timer. If no start event arrives, glla records an unresolved dispatch, keeps
+  the goal/list item durable, stands down automatic sends, and tells the user
+  how to use a fresh lifecycle or explicit resume. It does not inject terminal
+  input, restart pi, or treat a successful API return as a turn.
+- **Generation-safe recovery**: replacement/shutdown clears in-memory pending
+  state; a new session records and clears any old sidecar, then the existing
+  restore/autoResume consent rules decide whether to retry. Late foreign or
+  old-generation events cannot acknowledge a new dispatch.
+- **Display-only sanitization**: terminal/ANSI/OSC, bidi, and zero-width
+  controls are removed from status, widget, notification, confirmation, and
+  status-tool projections. Persisted objectives, contracts, prompts, ledger
+  values, and auditor inputs remain unchanged.
+
+## Addendum v0.34.31 (main-session model recovery)
+
+- **Ordered global backups**: `mainModelFallbacks` is an explicit ordered list
+  of `provider/model` references. A provider/quota error can rotate the MAIN
+  session through authenticated candidates; the detached auditor's model
+  cascade remains a separate subsystem.
+- **No accepted-send inference**: model rotation occurs only after a provider
+  failure is observed (or after a 15-minute, five-minute-silent provider-held
+  retry storm). A successful `sendMessage()` return is never treated as a
+  started turn.
+- **Durable recovery instead of abandonment**: when all candidates fail,
+  `.pi-glla/active.jsonl` stores the primary, active candidate, attempted set,
+  retry time, and supervisor kind. Recovery probes back off 15m → 30m →
+  hourly forever (configurable base), while a paused goal/held loop remains
+  resumable. A fresh startup obeys the existing `autoResume` consent gate.
+- **Successful-turn reset**: a real non-error agent end clears the recovery
+  cycle. Manual model selection cancels it; goal/list/loop cancellation clears
+  its timer and durable state.
+
 ## Addendum v0.4.0 (completion)
 
 - **Auditor compaction enabled** (flaw #3 — the last open one). Safety:
@@ -137,10 +224,10 @@ Single loop only — **loop 1**, the single ordered goal.
 
 The single most important property of this plugin is that the implementing agent cannot bamboozle the verifier. The way to achieve this structurally:
 
-1. The auditor runs in a **fresh pi agent session**.
-2. The auditor has **no extensions, no skills, no prompts, no themes**.
+1. The auditor runs in a **detached pi RPC process with a fresh agent session**.
+2. The auditor has **no extensions, no skills, no prompts, no themes, and no context files**.
 3. The auditor has only **read-only tools**: `read`, `grep`, `find`, `ls`, `bash` (and `bash` is for re-running user's verifier scripts, not arbitrary).
-4. The auditor **cannot see the implementing conversation**.
+4. The auditor **cannot see the implementing conversation or mutate glla state**.
 
 This is borrowed directly from `pi-goal-x/extensions/goal-auditor.ts:148-156`. The pattern is sound; we don't improve on it in v0.1.0, we just **fork the proven source and add regression_shield**.
 
@@ -205,7 +292,9 @@ This is a **clean break** by decision of the user. We do not interop with `pi-go
 | `extensions/loops/goal.ts` | Loops 1+2 (single goal + list of goals) | shipped |
 | `extensions/loops/forever.ts` | Loop 3 (metric loop helpers) | shipped |
 | `extensions/goal-loop-core.ts` | Shared state machine, types, JSONL | shipped |
-| `extensions/goal-loop-auditor.ts` | Isolated auditor with regression_shield | shipped |
+| `extensions/goal-loop-auditor.ts` | Auditor prompt + compatibility helper | shipped |
+| `extensions/goal-loop-auditor-process.ts` | Detached worker protocol, IPC, and shield revalidation | shipped |
+| `scripts/goal-auditor-worker.mjs` | Extension-less RPC auditor child | shipped |
 | `extensions/goal-loop-display.ts` | Status line + /goal status rendering | shipped |
 | `prompts/goal-loop-continuation.md` | Templated continuation prompt | ~80 |
 | `prompts/goal-loop-auditor.md` | Templated auditor prompt | ~80 |
@@ -226,7 +315,7 @@ type Status =
 
 States owned by the orchestrator:
 - `active` → next iteration
-- `auditing` → auditor running
+- `auditing` → detached auditor queued/running (or recovery pending)
 - `complete` → archived
 - `paused` → user-resumable
 - `aborted` → user-cancelled
@@ -253,7 +342,7 @@ This protects against model-generated summaries losing fidelity.
 
 | Trigger | Action |
 |---|---|
-| `Esc` during auditor | Pause; user picks "complete without audit" or "continue" |
+| Detached auditor running | Main turn remains free; `/goal cancel` discards the pending claim and stops the worker best-effort |
 | `Esc` during agent turn | Pause |
 | User `/goal pause` | Pause |
 | User `/goal cancel` | Abort (wipes active goal) |

package/docs/RELEASING.md

@@ -0,0 +1,49 @@
+# Releasing to npm
+
+This repository publishes `pi-goal-list-loop-audit` through the GitHub Release
+workflow at `.github/workflows/publish.yml`.
+
+## One-time npm setup
+
+In npm package settings, add a **Trusted Publisher** for:
+
+- GitHub owner/repository: `DraconDev/pi-goal-list-loop-audit`
+- workflow file: `.github/workflows/publish.yml`
+- environment: leave unset unless the repository deliberately protects the job
+  with an npm environment
+
+The workflow uses npm OIDC provenance. Do not add a long-lived `NPM_TOKEN` to
+the repository.
+
+## Release checklist
+
+```bash
+npm version <major.minor.patch> --no-git-tag-version
+npm run release:check
+# review the diff, then commit package.json + package-lock.json + changelog
+# create and push the matching tag, for example:
+git tag v<major.minor.patch>
+git push origin main v<major.minor.patch>
+```
+
+Create a GitHub Release from that tag. Publishing happens only after the
+release is marked **published**; the workflow checks that the tag equals the
+`package.json` version, runs the complete test/typecheck/package inspection,
+and then runs:
+
+```bash
+npm publish --provenance --access public
+```
+
+Verify availability from a separate machine or shell:
+
+```bash
+npm view pi-goal-list-loop-audit version dist-tags.latest
+npm install -g pi-goal-list-loop-audit
+# or in pi:
+pi install npm:pi-goal-list-loop-audit
+```
+
+`publishConfig.access=public` is necessary for the scoped/public policy, but
+it does not publish anything by itself. A commit, tag, or GitHub Release alone
+is not proof that npm has the package; the registry check above is the proof.