pi-goal-list-loop-audit 0.35.4 → 0.35.13

package/extensions/goal-loop-core.ts

@@ -95,6 +95,8 @@ export interface Task {
   status: "pending" | "in_progress" | "complete";
   /** Optional specialist hand-off for this task. */
   agentRole?: AgentRole;
+  /** Optional verification gate for milestone-checked tasks. */
+  verificationContract?: string;
   subtasks?: Task[];
 }
 
@@ -117,6 +119,7 @@ export const MAX_SUBTASKS_PER_TASK = 5;
 export interface TaskProposal {
   title: string;
   agentRole?: AgentRole;
+  verificationContract?: string;
   subtasks?: string[];
 }
 
@@ -145,6 +148,7 @@ export function buildTaskList(tasks: TaskProposal[]): TaskList {
       title: t.title.trim(),
       status: "pending" as const,
       ...(t.agentRole ? { agentRole: t.agentRole } : {}),
+      ...(t.verificationContract ? { verificationContract: t.verificationContract } : {}),
       subtasks: (t.subtasks ?? []).map((s, j) => ({
         id: `${i + 1}.${j + 1}`,
         title: s.trim(),
@@ -651,6 +655,9 @@ export interface ListItem {
   parentId?: string;
   /** Durable link from a repair/replan queue item back to the malformed item. */
   repairTarget?: ObjectiveRepairTarget;
+  /** Monotonic queue position persisted with the sidecar. Legacy items omit it
+   * and fall back to addedAt/id ordering during recovery. */
+  queueOrder?: number;
   addedAt: string;
 }
 
@@ -738,6 +745,10 @@ export interface MainModelRecovery {
   attempted: string[];
   /** Next safe probe time; persisted so reloads do not forget the wait. */
   retryAt?: string;
+  /** Next preferred-primary health probe while a fallback is serving. */
+  primaryProbeAt?: string;
+  /** A preferred-primary switch was accepted and awaits one supervised turn. */
+  primaryProbeInFlight?: boolean;
   /** Number of completed recovery waits; drives the bounded exponential cadence. */
   attempts: number;
   /** Human-readable provider failure excerpt. */
@@ -787,6 +798,8 @@ export function formatMainModelRecoveryStatus(recovery: MainModelRecovery | unde
     `  Skipped: ${skipped}`,
   ];
   if (recovery.retryAt) lines.push(`  Retry at: ${recovery.retryAt}`);
+  if (recovery.primaryProbeAt) lines.push(`  Preferred-primary probe at: ${recovery.primaryProbeAt}`);
+  if (recovery.primaryProbeInFlight) lines.push("  Preferred-primary probe: supervised turn pending");
   if (recovery.manualResumeRequired) lines.push("  Automatic probes: stopped; explicit resume required");
   return lines;
 }
@@ -839,6 +852,8 @@ export function sanitizeMainModelRecovery(value: unknown): MainModelRecovery | u
     ...(bounded(raw.recoveryEpisodeKey, 300) ? { recoveryEpisodeKey: bounded(raw.recoveryEpisodeKey, 300) } : {}),
     ...(Array.isArray(raw.recoveryNoticeKeys) ? { recoveryNoticeKeys: raw.recoveryNoticeKeys.filter((key): key is string => typeof key === "string").slice(-16).map((key) => key.slice(0, 300)) } : {}),
     ...(date(raw.retryAt) ? { retryAt: date(raw.retryAt) } : {}),
+    ...(date(raw.primaryProbeAt) ? { primaryProbeAt: date(raw.primaryProbeAt) } : {}),
+    ...(raw.primaryProbeInFlight === true ? { primaryProbeInFlight: true } : {}),
     ...(date(raw.firstFailureAt) ? { firstFailureAt: date(raw.firstFailureAt) } : {}),
     ...(date(raw.autoRetryUntil) ? { autoRetryUntil: date(raw.autoRetryUntil) } : {}),
     ...(raw.manualResumeRequired === true ? { manualResumeRequired: true } : {}),
@@ -964,16 +979,46 @@ export function queueItemPath(cwd: string, id: string): string {
   return path.join(piGlaDir(cwd), "goals", `${id}.queue.json`);
 }
 
-export function writeQueueItemFile(cwd: string, item: ListItem): { path: string; wrote: boolean } {
+export interface QueueItemWriteResult {
+  path: string;
+  wrote: boolean;
+  /** True when the persistence boundary rejected the write. A collision or
+   * symlink refusal is a normal wrote=false result, not a persistence error. */
+  failed?: boolean;
+}
+
+/** Write one queue sidecar atomically. The default is idempotent/no-overwrite;
+ * repair metadata updates may explicitly request an atomic replacement. All
+ * filesystem failures go through the persistence-degradation boundary and
+ * clean up the temporary file before returning to the caller. */
+export function writeQueueItemFile(cwd: string, item: ListItem, options: { replace?: boolean } = {}): QueueItemWriteResult {
   const file = queueItemPath(cwd, item.id);
-  if (fs.existsSync(file)) return { path: file, wrote: false }; // idempotent — never overwrite
-  try {
+  const replace = options.replace === true;
+  if (!replace && fs.existsSync(file)) return { path: file, wrote: false }; // idempotent — never overwrite
+  const result = runPersistStep("writeQueueItemFile", () => {
+    if (replace) {
+      try {
+        if (fs.lstatSync(file).isSymbolicLink()) return { path: file, wrote: false, failed: true };
+      } catch (err) {
+        if ((err as NodeJS.ErrnoException).code !== "ENOENT") throw err;
+      }
+    }
     fs.mkdirSync(path.dirname(file), { recursive: true });
-  } catch { /* ensureDirs on the goals/ path handles this */ }
-  const tempPath = `${file}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-  fs.writeFileSync(tempPath, JSON.stringify({ schema: 1, type: "queue-item", ...item }), "utf-8");
-  fs.renameSync(tempPath, file);
-  return { path: file, wrote: true };
+    const tempPath = `${file}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+    try {
+      fs.writeFileSync(tempPath, JSON.stringify({ schema: 1, type: "queue-item", ...item }), "utf-8");
+      fs.renameSync(tempPath, file);
+      return { path: file, wrote: true };
+    } finally {
+      try {
+        if (fs.existsSync(tempPath)) fs.unlinkSync(tempPath);
+      } catch {
+        // The landing write already succeeded or the original error is more
+        // useful; a later cleanup pass can remove an orphaned temp file.
+      }
+    }
+  });
+  return result ?? { path: file, wrote: false, failed: true };
 }
 
 export function deleteQueueItemFile(cwd: string, id: string): boolean {
@@ -1022,8 +1067,8 @@ export function readQueueFromDisk(cwd: string, excludeIds: ReadonlySet<string> =
   const dir = path.join(piGlaDir(cwd), "goals");
   let names: string[];
   try { names = fs.readdirSync(dir); } catch { return []; }
-  // readdir order is filesystem-dependent; queue semantics and the public
-  // reader contract are id order, so normalize before parsing sidecars.
+  // readdir order is filesystem-dependent; parse every sidecar first and
+  // apply compareQueueItems below so durable queue order survives recovery.
   names.sort();
   const out: ListItem[] = [];
   for (const name of names) {
@@ -1035,6 +1080,20 @@ export function readQueueFromDisk(cwd: string, excludeIds: ReadonlySet<string> =
     if (!e || e.schema !== 1 || e.type !== "queue-item") continue;
     if (typeof e.id !== "string" || typeof e.objective !== "string") continue;
     if (excludeIds.has(e.id)) continue;
+    const repairTarget = e.repairTarget && typeof e.repairTarget === "object"
+      && typeof e.repairTarget.id === "string"
+      && typeof e.repairTarget.objective === "string"
+      && typeof e.repairTarget.source === "string"
+      && Array.isArray(e.repairTarget.reasons)
+      && e.repairTarget.reasons.every((reason: unknown) => typeof reason === "string")
+      ? {
+          id: e.repairTarget.id,
+          objective: e.repairTarget.objective,
+          ...(typeof e.repairTarget.verificationContract === "string" ? { verificationContract: e.repairTarget.verificationContract } : {}),
+          reasons: e.repairTarget.reasons,
+          source: e.repairTarget.source,
+        } satisfies ObjectiveRepairTarget
+      : undefined;
     out.push({
       id: e.id,
       objective: e.objective,
@@ -1044,10 +1103,12 @@ export function readQueueFromDisk(cwd: string, excludeIds: ReadonlySet<string> =
       // v0.34.81: subtask binding round-trips from the sidecar the same way
       // parallelSafe does — must be a string id matching another queue item.
       ...(typeof e.parentId === "string" && e.parentId ? { parentId: e.parentId } : {}),
+      ...(repairTarget ? { repairTarget } : {}),
+      ...(typeof e.queueOrder === "number" && Number.isFinite(e.queueOrder) && e.queueOrder >= 0 ? { queueOrder: e.queueOrder } : {}),
       addedAt: typeof e.addedAt === "string" ? e.addedAt : new Date().toISOString(),
     });
   }
-  return out;
+  return out.sort(compareQueueItems);
 }
 
 // =================================================================
@@ -1432,6 +1493,29 @@ export function nowIso(): string {
   return new Date().toISOString();
 }
 
+/** Stable queue ordering: new sidecars use queueOrder; legacy sidecars fall
+ * back to their durable timestamp and id instead of filesystem enumeration. */
+export function compareQueueItems(a: Pick<ListItem, "id" | "addedAt" | "queueOrder">, b: Pick<ListItem, "id" | "addedAt" | "queueOrder">): number {
+  const aOrder = typeof a.queueOrder === "number" && Number.isFinite(a.queueOrder) ? a.queueOrder : undefined;
+  const bOrder = typeof b.queueOrder === "number" && Number.isFinite(b.queueOrder) ? b.queueOrder : undefined;
+  if (aOrder !== undefined && bOrder !== undefined && aOrder !== bOrder) return aOrder - bOrder;
+  const added = a.addedAt.localeCompare(b.addedAt);
+  if (added !== 0) return added;
+  if (aOrder !== undefined && bOrder === undefined) return -1;
+  if (aOrder === undefined && bOrder !== undefined) return 1;
+  return a.id.localeCompare(b.id);
+}
+
+/** Assign durable positions to newly enqueued items. Existing positions are
+ * retained, so a reload/recovery cannot reorder a confirmed batch. */
+export function assignQueueOrder<T extends ListItem>(items: readonly T[], existing: readonly ListItem[] = []): T[] {
+  let next = existing.reduce((max, item) => {
+    const order = typeof item.queueOrder === "number" && Number.isFinite(item.queueOrder) ? item.queueOrder : -1;
+    return Math.max(max, order);
+  }, -1) + 1;
+  return items.map((item) => item.queueOrder === undefined ? { ...item, queueOrder: next++ } : item);
+}
+
 /**
  * v0.34.59: revision token — return {goalId, revision} for use as a
  * (focus-token, sandbox-check) at async boundaries. The orchestrator
@@ -1547,6 +1631,9 @@ export const LONG_RUNNING_JUDGMENT_POLICY = `LONG-RUNNING JUDGMENT POLICY:
 - Preserve the objective and verification contract as the source of truth. The default answer is the durable, maintainable root-cause fix — decide it and proceed; do not stop at a cosmetic workaround merely because it is faster.
 - "Band-aid now vs do it proper" is NEVER a question: when the durable fix is the clearly best call, do it — no ask_user_question, no pause_goal, no "which do you prefer" framing. Record the choice and the reasoning in the turn.
 - Use an opportunistic workaround only when the durable fix is genuinely unsafe, impossible, or blocked right now; the workaround must be reversible and testable, and its durable follow-up is recorded (ledger or comment) instead of silently treated as final.
+- Premium engineering standards are mandatory: code must be cleanly typed, tested, architecturally sound, and resilient across lifecycle boundaries. Never lower test standards, fake assertions, or bypass types.
+- Autonomous pivot strategy: if an implementation approach fails verification after 2 attempts, do not loop on the same failing line. Autonomously step back, diagnose the root invariant, and pivot to a clean alternative architecture.
+- Non-interruption & sensible defaults: never pause a multi-hour run for obvious choices, cosmetic naming, or non-blocking secondary questions. Pick the sensible architectural default, implement it, record the rationale, and continue. Defer non-blocking notes to the final completion summary.
 - Decide autonomously through local implementation choices without interrupting the user. Ask one focused question ONLY at a genuine trade-off where the user's preference materially changes the outcome: an irreversible/destructive external action, a missing permission/credential, or two options with comparable real cost.
 - In unattended mode, choose the safest contract-preserving path and continue. If no safe choice exists, raise a concrete DECIDE question with a recommended default; never ask a vague progress question or wait on a guessed provider/quota reset.`;
 
@@ -1722,9 +1809,13 @@ export function extractVerificationContract(raw: string): { objective: string; v
 
   // Inline fallback: users write one-liners like
   //   "Create x.txt. Done when: grep -q ok x.txt"
-  // where the marker is mid-line. Split at the first inline marker.
+  // where the marker is mid-line. Split at the first inline marker. Keep
+  // bare `verify` out of the broad marker alternative: it is also a normal
+  // imperative (`Run the audit and verify ... Done when: ...`) and must not
+  // truncate the objective before the actual Done when marker. `Verify:`
+  // remains supported as the explicit short marker form.
   if (!verificationContract) {
-    const m = raw.match(/^(.*?)(?:\.|;)??\s+(?:done when|verified when|verify|verification)\b[^:]*:\s*(.+)$/is);
+    const m = raw.match(/^(.*?)(?:\.|;)?\s+(?:(?:done when|verified when|verification)\b[^:]*:|verify\s*:)\s*(.+)$/is);
     if (m) {
       objective = (m[1] ?? "").trim().replace(/[.;]\s*$/, "");
       verificationContract = (m[2] ?? "").trim();
@@ -2189,10 +2280,12 @@ export function formatAuditLog(entries: AuditLogEntry[]): string {
 // =================================================================
 
 /** Which auditor infra errors are worth an automatic retry? User aborts
- * and missing-model config are NOT — retrying can't help them. */
+ * and missing-model config are NOT — retrying can't help them. Timeouts and
+ * watchdog stalls are retriable infrastructure failures. */
 export function isRetriableInfraError(error?: string): boolean {
   if (!error) return false;
-  if (/aborted/i.test(error)) return false;
+  if (/^(?:Auditor (?:exceeded|stalled)|.*(?:timed?\s*out|timeout|inactivity))/i.test(error)) return true;
+  if (/^(?:Auditor aborted\.?$|user (?:interrupt|abort)|cancelled by user)/i.test(error.trim())) return false;
   if (/no (?:auditor )?model/i.test(error)) return false;
   return true;
 }

package/extensions/goal-loop-display.ts

@@ -96,6 +96,23 @@ export interface RecentActionDisplay {
 /** v0.33.0: widget extras — the refire streak plus the recent-action feed. */
 export type GoalDisplayActivity = "active" | "awaiting-first-turn" | "working" | "busy" | "queued" | "idle";
 
+export interface ModelProvenanceDisplay {
+  /** The primary model reference selected for the supervised work. */
+  primary?: string;
+  /** Whether the primary is an explicit pin or inherited from the session. */
+  primarySource?: "pinned" | "inherited";
+  /** Ordered backup references available to the main-model recovery policy. */
+  fallbackRefs?: string[];
+  /** References rejected by the explicit forbidden-model gate. */
+  skippedForbiddenRefs?: string[];
+  /** Model reference observed at the current main-host turn boundary. */
+  handledTurn?: string;
+  /** Model reference currently executing the detached audit, if any. */
+  handledAudit?: string;
+  /** Candidate provenance for the detached audit (setting/fallback/session). */
+  handledAuditSource?: string;
+}
+
 export interface WidgetExtras {
   stalls?: number;
   recent?: RecentActionDisplay[];
@@ -121,6 +138,8 @@ export interface WidgetExtras {
   auditorProgressSignals?: boolean;
   /** Effective global main-model backup order for truthful recovery HUDs. */
   mainModelFallbacks?: string[];
+  /** Truthful model-selection provenance for the active goal card/footer. */
+  modelProvenance?: ModelProvenanceDisplay;
 }
 
 /**
@@ -181,6 +200,57 @@ function budgetFor(width: number | undefined, prefixCols: number, floor: number)
   return Math.max(floor, width - WIDGET_HORIZONTAL_MARGIN - prefixCols);
 }
 
+function uniqueModelRefs(refs: readonly string[] | undefined): string[] {
+  const out: string[] = [];
+  const seen = new Set<string>();
+  for (const value of refs ?? []) {
+    if (typeof value !== "string") continue;
+    const ref = value.trim();
+    if (!ref || seen.has(ref.toLowerCase())) continue;
+    seen.add(ref.toLowerCase());
+    out.push(ref);
+  }
+  return out;
+}
+
+/**
+ * Keep model selection provenance on the same always-visible card as the
+ * goal. These are projections of observed/configured refs, not a guess from
+ * elapsed time: the primary source is explicit, forbidden refs stay visible
+ * as skipped, and the handled refs are separate from the configured order.
+ */
+function modelSourceLabel(source: string): string {
+  const key = source.trim().toLowerCase();
+  if (key === "setting" || key === "pinned" || key === "auditor-pin") return "pinned";
+  if (key === "session" || key === "session-fallback") return "inherited from session";
+  if (key.includes("fallback")) return "fallback";
+  return source.trim();
+}
+
+function modelProvenanceLines(provenance: ModelProvenanceDisplay | undefined, width?: number): string[] {
+  if (!provenance) return [];
+  const budget = budgetFor(width, 3, 60);
+  const lines: string[] = [];
+  const primary = typeof provenance.primary === "string" ? provenance.primary.trim() : "";
+  if (primary) {
+    const source = provenance.primarySource === "pinned" ? "pinned" : "inherited from session";
+    lines.push(`model: primary ${truncate(primary, budget)} · ${source}`);
+  }
+  const fallbacks = uniqueModelRefs(provenance.fallbackRefs);
+  if (fallbacks.length > 0) lines.push(`fallbacks: ${truncate(fallbacks.join(" → "), budget)}`);
+  const skipped = uniqueModelRefs(provenance.skippedForbiddenRefs);
+  if (skipped.length > 0) lines.push(`skipped forbidden: ${truncate(skipped.join(", "), budget)}`);
+  const handledTurn = typeof provenance.handledTurn === "string" ? provenance.handledTurn.trim() : "";
+  if (handledTurn) lines.push(`handled turn: ${truncate(handledTurn, budget)}`);
+  const handledAudit = typeof provenance.handledAudit === "string" ? provenance.handledAudit.trim() : "";
+  if (handledAudit) {
+    const source = provenance.handledAuditSource?.trim() ? modelSourceLabel(provenance.handledAuditSource) : "";
+    const via = source ? ` · via ${truncate(source, 24)}` : "";
+    lines.push(`handled audit: ${truncate(handledAudit, Math.max(16, budget - via.length))}${via}`);
+  }
+  return lines;
+}
+
 // ---- semantic colors (optional; tests call without a theme → plain strings) ----
 
 export type DisplayColor = "accent" | "success" | "warning" | "error" | "muted" | "dim";
@@ -351,6 +421,10 @@ function auditRecoveryPending(g: Goal): boolean {
 // ---- status line (one-liner, always-on) ----
 
 export interface AuditDisplayProgress {
+  /** Model reference selected for the currently running detached attempt. */
+  model?: string;
+  /** Candidate provenance: pinned setting, fallback pin, or session fallback. */
+  via?: string;
   currentTool?: string;
   /** JSON-safe tool arguments from the detached worker; display only a safe target summary. */
   currentToolArgs?: string;
@@ -1114,6 +1188,14 @@ function goalLines(g: Goal, state: State, audit: AuditDisplayProgress | null | u
       lines.push(`${i === 0 ? "├─" : "│ "} ${paint(theme, "dim", line.replace(/^Main-model recovery: /, ""))}`);
     });
   }
+  // Model provenance is a card fact, not a notification: keep it visible
+  // across active, interrupted, auditing, and paused branches. In
+  // particular, never replace a configured forbidden ref with "none" — the
+  // skipped line explains why it did not handle the turn.
+  const provenance = modelProvenanceLines(extras?.modelProvenance, width);
+  provenance.forEach((line, i) => {
+    lines.push(`${i === 0 ? "├─" : "│ "} ${paint(theme, "dim", line)}`);
+  });
   if (interrupted) {
     const resumeCmd = isList ? "/list resume" : "/goal resume";
     if (interruptedForNoStart(g)) {

package/extensions/goal-loop-shield.ts

@@ -129,3 +129,58 @@ export function parseAuditorVerdict(output: string): { approved: boolean; disapp
     impossibleReason: impossibleMatch?.[1]?.trim().slice(0, 300) || undefined,
   };
 }
+
+/**
+ * v0.35.7: Extract mechanical shell command gates from a verification contract.
+ * Captures explicit commands (e.g. `npm test`, `tsc --noEmit`, `cargo test`)
+ * for deterministic fast-fail pre-auditing before spawning the heavy LLM worker.
+ */
+export function extractMechanicalCheckCommands(contract: string): string[] {
+  if (!contract) return [];
+  const items = contractItems(contract);
+  const commands: string[] = [];
+  for (const item of items) {
+    const backtickMatch = /`([^`]+)`/.exec(item);
+    let candidate = backtickMatch ? backtickMatch[1]!.trim() : item.trim();
+    if (!backtickMatch) {
+      candidate = candidate.replace(/\s+(?:passes(?:\s+cleanly|\s+with\s+zero\s+errors)?|exits\s+0|returns\s+0|cleanly).*$/i, "").trim();
+    }
+    if (/^(?:npm\s+(?:test|run\s+[\w:-]+)|bun\s+(?:test|run\s+[\w:-]+)|pnpm\s+(?:test|run\s+[\w:-]+)|yarn\s+(?:test|[\w:-]+)|tsc\b|cargo\s+(?:test|check|build)|pytest\b|python\s+-m\s+unittest|go\s+test|vitest\b|jest\b|make\s+test|git\s+diff|test\s+-[a-z])/i.test(candidate)) {
+      commands.push(candidate);
+    }
+  }
+  return commands;
+}
+
+export interface MechanicalCheckResult {
+  passed: boolean;
+  failedCommand?: string;
+  output?: string;
+  exitCode?: number;
+}
+
+/**
+ * v0.35.7: Execute mechanical pre-audit checks deterministically.
+ */
+export function runMechanicalPreAuditChecks(cwd: string, commands: string[], timeoutMs = 60000): MechanicalCheckResult {
+  if (!commands || commands.length === 0) return { passed: true };
+  const { execSync } = require("node:child_process");
+  for (const cmd of commands) {
+    try {
+      execSync(cmd, { cwd, timeout: timeoutMs, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" });
+    } catch (err: any) {
+      const exitCode = typeof err.status === "number" ? err.status : (typeof err.code === "number" ? err.code : 1);
+      const stdout = err.stdout ? String(err.stdout) : "";
+      const stderr = err.stderr ? String(err.stderr) : "";
+      const output = (stdout + "\n" + stderr).trim() || err.message || "Command failed";
+      return {
+        passed: false,
+        failedCommand: cmd,
+        output: output.slice(0, 4000),
+        exitCode,
+      };
+    }
+  }
+  return { passed: true };
+}
+