pi-goal-list-loop-audit 0.36.0 → 0.36.1

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 0.36.1 — crash-safe persistence and packed-release verification (2026-08-31)
+
+### Fixed
+  Terminal archival now records a durable intent before publication and
+  reconciles interrupted archive/state commits on startup, preventing a
+  published archive from resurrecting an active goal or permanently fencing
+  the next archive attempt.
+
+  Destructive queue operations now fail closed when sidecar cleanup cannot be
+  proven successful. List clear/cancel/remove, group close, carryover, wipe,
+  and repair-source consumption preserve recoverable durable work instead of
+  mutating memory and allowing a failed deletion to reappear after restart.
+
+  The active ledger now rotates into immutable, ownership-fenced segments and
+  keeps a complete current-state snapshot in the active file. Startup recovery
+  handles the rename-before-rewrite interruption window while forensic history
+  remains available.
+
+  Bounded scanners and streaming reducers now back list depth, log tails,
+  switch logs, postaudit cadence, and multi-project statistics. Detached
+  auditor scratch now has a read-only health report plus age-bounded cleanup
+  limited to worker identities proven dead; ambiguous directories remain
+  untouched.
+
+  The runtime-global bridge now has one compile-checked registration registry
+  and typed high-risk lifecycle fields, reducing silent name and shape drift.
+
+### Changed
+  `release:check` now packs, installs, and imports the actual npm tarball in a
+  temporary directory, including the shipped goal entry point and auditor
+  launcher/worker paths. No registry publish is performed by the smoke.
+
 ## 0.36.0 — event-driven long-running supervision (2026-08-28)
 
 ### Added

package/README.md

@@ -259,6 +259,9 @@ templates, themes, or context files, so its model must be usable in a plain pi
 session. It is independent verification, not an OS sandbox: the auditor's
 `bash` tool can still change files if a prompt or verifier tells it to. Keep
 verification commands bounded and treat repository permissions accordingly.
+On Linux, both direct contract checks and the detached auditor enforce a
+256-process process-group ceiling to contain recursive helper/test launches;
+cross-platform timeout and process-tree cleanup remain in place as well.
 
 ## Recommended pi extensions
 

package/docs/DESIGN-long-running-supervision.md

@@ -22,6 +22,11 @@ GLLA automation is **event-driven and progress-aware**, not duration-guessed.
   Detached auditors have no unconditional wall-clock expiry: legacy wall
   metadata is ignored, while confirmed silence and an individual tool timeout
   remain the bounded safety mechanisms.
+- Project verification commands run in an owned process group. On Linux, GLLA
+  also counts that group every 100ms and aborts it above 256 processes; this
+  catches recursive test/helper launches before a long wall timeout can become
+  a host-wide process or swap storm. The limit is a containment result, never
+  an automatic retry.
 - Timers remain useful for per-attempt backoff, watchdogs, and host safety. A
   timer is never evidence that work completed and is not the definition of a
   long-running process's lifetime. Detached-auditor first-event silence starts

package/docs/INDEX.md

@@ -18,14 +18,15 @@ For shipped docs, the relevant entry points are:
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.36.0 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.36.1 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen
   subagent recovery, bounded repair/replan recovery, production RPC child
   stopping, mandatory hermetic auditor-extension validation, optional provider
-  extensions, and bounded zero-stream retry containment — see CHANGELOG.md for
-  the full trail.
+  extensions, bounded zero-stream retry containment, crash-safe persistence,
+  and packed-artifact release verification — see CHANGELOG.md for the full
+  trail.
 - `../README.md` — what the plugin is, install, quickstart, and the
   architectural guarantee (drafting + confirm + detached auditor).
 - `../INSTALL.md` — manual install / symlink setup; the recommended

package/extensions/goal-commands.ts

@@ -14,8 +14,8 @@ import { renderAgentsPanel, tailChildTranscript, TRANSCRIPT_HEADER_SCAN_MAX_BYTE
 import { state, replaceState } from "./goal-state.js";
 import {
   DEFAULT_TOKEN_LIMIT, Goal, ListItem, Status, appendLedger, archiveDir, archivedGoalPath, bumpGoalRevision, sanitizeProviderDisplayText,
-  computeListDepth, clearQueueItemFiles, deleteQueueItemFile, extractVerificationContract, formatAuditLog, formatGoalAuditHistory, formatMainModelRecoveryStatus, queueItemSidecarCount,
-  formatListDepth, goalArgsNeedDrafting, ledgerPath, newGoalId, nowIso, parseListImport, parseListItemDeclaration,
+  computeListDepthFromLedger, clearQueueItemFiles, deleteQueueItemFile, deleteQueueItemFileResult, extractVerificationContract, formatAuditLog, formatGoalAuditHistory, formatMainModelRecoveryStatus, queueItemSidecarCount,
+  formatListDepth, goalArgsNeedDrafting, ledgerPath, newGoalId, nowIso, parseListImport, parseListItemDeclaration, readLedgerTail,
   assignQueueOrder, compareQueueItems, readAuditLog, readQueueFromDisk, routeGoalArgs, routeListText, sanitizeDisplayText, sanitizeProviderAuditReport, statusLabel,
   visibleListPosition, visibleListPositions,
   writeQueueItemFile, type ModeCommand, type State, LIST_MUTATING_SUBCOMMANDS, SETTINGS_MUTATING_ACTIONS,
@@ -26,7 +26,7 @@ import type { AuditDisplayProgress } from "./goal-loop-display.js";
 import { fmtElapsed } from "./goal-loop-display.js";
 import { AUDIT_FINDINGS_REL, HELD_ON_RESTORE, LOOP_AUDIT_MARKER, listAuditCollectTarget, projectAuditTarget } from "./goal-loop-forever.js";
 import { buildLoopCompletionSummary, compactCompletionSummary, compactTerminalCompletionSummary } from "./completion-summary.js";
-import { ProjectRollup, discoverGllaProjects, filterPremature, formatRollupJson, formatRollupTable, parseLedgerEntries, rollupProject } from "./goal-loop-stats.js";
+import { ProjectRollup, discoverGllaProjects, filterPremature, formatRollupJson, formatRollupTable, rollupProject } from "./goal-loop-stats.js";
 import { OVERRIDABLE_AGENT_TYPES, resolveEffectiveSubagentModel } from "./goal-loop-subagents.js";
 import { Settings, globalSettingsPath, loadSettings, projectSettingsPath, saveSettings, settingsProvenance } from "./goal-settings.js";
 import { resolveGllaStateDir } from "./glla-state-root.js";
@@ -36,7 +36,7 @@ import type { SettingsSectionId } from "./settings-menu.js";
 import { cmdLoop, clearLoopTimer, finishLoopGit, isLoopActive, scheduleLoopTick } from "./goal-loop.js";
 import { chooseObjectiveConflict, liveObjectives } from "./goal-objective-conflict.js";
 import { formatGllaVersion } from "./glla-version.js";
-import { cancelDetachedGoalCompletionAuditor } from "./goal-loop-auditor-process.js";
+import { cancelDetachedGoalCompletionAuditor, cleanupDeadAuditJobs, inspectAuditJobHealth } from "./goal-loop-auditor-process.js";
 import { releaseAuditorSurface } from "./loops/goal-auditor-surface.js";
 import { inferStartFromSession, type StartContextInference } from "./start-context.js";
 
@@ -1233,13 +1233,7 @@ async function cmdList(args: string, ctx: ExtensionContext): Promise<void> {
   if (sub === "depth") {
     // v0.25.3: long-running state at a glance — queue depth, oldest item
     // age, average item duration from archived list-policy goals.
-    let entries: Array<{ type: string; value?: any }> = [];
-    try {
-      entries = parseLedgerEntries(fs.readFileSync(ledgerPath(ctx.cwd), "utf-8"));
-    } catch {
-      /* no ledger yet */
-    }
-    const stats = computeListDepth(listQueue(), entries, Date.now());
+    const stats = computeListDepthFromLedger(listQueue(), ctx.cwd, Date.now());
     ctx.ui.notify(`/list depth: ${formatListDepth(stats)}`, "info");
     return;
   }
@@ -1416,6 +1410,11 @@ async function cmdList(args: string, ctx: ExtensionContext): Promise<void> {
     // stale-handle reload would resurrect the cleared items.
     const dropped = listQueue();
     const clearedSidecars = clearQueueItemFiles(ctx.cwd);
+    if (clearedSidecars.failed.length > 0) {
+      appendLedger(ctx.cwd, "list_clear_sidecar_cleanup_failed", { count: clearedSidecars.failed.length, sidecars: clearedSidecars.failed });
+      ctx.ui.notify(`List clear refused — ${clearedSidecars.failed.length} queue sidecar(s) could not be removed. The in-memory list is unchanged; fix disk access and retry.`, "warning");
+      return;
+    }
     replaceState({ ...state, list: [] });
     persistState(ctx);
     appendLedger(ctx.cwd, "list_cleared", { count: dropped.length, sidecars: clearedSidecars.removed });
@@ -1453,6 +1452,12 @@ async function cmdList(args: string, ctx: ExtensionContext): Promise<void> {
     // v0.35.0: clear the union of RAM and disk queue state. Orphaned
     // sidecars otherwise resurrected after a stale reload.
     const clearedSidecars = clearQueueItemFiles(ctx.cwd);
+    if (clearedSidecars.failed.length > 0) {
+      appendLedger(ctx.cwd, "list_cancel_sidecar_cleanup_failed", { count: clearedSidecars.failed.length, sidecars: clearedSidecars.failed });
+      ctx.ui.notify(`List cancellation is incomplete — ${clearedSidecars.failed.length} queue sidecar(s) could not be removed. Waiting items remain recoverable; fix disk access and retry.`, "warning");
+      if (activeIsListItem) ctx.abort();
+      return;
+    }
     replaceState({ ...state, list: [] });
     persistState(ctx);
     appendLedger(ctx.cwd, "list_cancelled", { abortedActive: activeIsListItem, dropped, sidecars: clearedSidecars.removed });
@@ -1536,7 +1541,12 @@ async function cmdList(args: string, ctx: ExtensionContext): Promise<void> {
     // cannot resurrect the removed item. Without this, the new fallback
     // (cmdList → readQueueFromDisk) would show the removed item after
     // a stale-handle /list, contradicting the user's explicit remove.
-    deleteQueueItemFile(ctx.cwd, removed.id);
+    const deleted = deleteQueueItemFileResult(ctx.cwd, removed.id);
+    if (deleted.failed) {
+      appendLedger(ctx.cwd, "list_remove_sidecar_delete_failed", { id: removed.id, path: deleted.path });
+      ctx.ui.notify(`Remove refused — the durable sidecar for ${displaySlice(removed.objective, 80)} could not be removed. The item remains queued; fix disk access and retry.`, "warning");
+      return;
+    }
     replaceState({ ...state, list: queue.filter((_, i) => i !== n) });
     persistState(ctx);
     appendLedger(ctx.cwd, "list_removed", { id: removed.id, objective: removed.objective });
@@ -1894,13 +1904,12 @@ function cmdLog(args: string, ctx: ExtensionContext): void {
   const n = Math.min(Math.max(parseInt(nMatch?.[1] ?? "15", 10) || 15, 1), 100);
   let entries: Array<{ type: string; at?: string; value?: any }> = [];
   try {
-    entries = parseLedgerEntries(fs.readFileSync(ledgerPath(ctx.cwd), "utf-8"));
+    entries = readLedgerTail(ctx.cwd, n, (entry) => all || !LOG_NOISE.has(entry.type));
   } catch {
     ctx.ui.notify("No ledger yet — .pi-glla/active.jsonl doesn't exist.", "info");
     return;
   }
-  const visible = all ? entries : entries.filter((e) => !LOG_NOISE.has(e.type));
-  const tail = visible.slice(-n);
+  const tail = entries;
   if (tail.length === 0) {
     ctx.ui.notify("Ledger is empty (no non-noise events yet).", "info");
     return;
@@ -1925,13 +1934,12 @@ function cmdSwitchlog(args: string, ctx: ExtensionContext): void {
   const n = Math.min(Math.max(parseInt(nMatch?.[1] ?? "15", 10) || 15, 1), 100);
   let entries: Array<{ type: string; at?: string; value?: any }> = [];
   try {
-    entries = parseLedgerEntries(fs.readFileSync(ledgerPath(ctx.cwd), "utf-8"));
+    entries = readLedgerTail(ctx.cwd, n, (entry) => entry.type === "model_switch" || entry.type === "forbidden_model_switch");
   } catch {
     ctx.ui.notify("No ledger yet — .pi-glla/active.jsonl doesn't exist.", "info");
     return;
   }
-  const switches = entries.filter((e) => e.type === "model_switch" || e.type === "forbidden_model_switch");
-  const tail = switches.slice(-n);
+  const tail = entries;
   if (tail.length === 0) {
     ctx.ui.notify("No model switches recorded yet — /glla switchlog shows the model_switch / forbidden_model_switch trail.", "info");
     return;
@@ -2049,8 +2057,12 @@ async function cmdGllaWipe(ctx: ExtensionContext, entryChecked = false): Promise
     // sidecars otherwise resurrected after a stale reload.
     const clearedSidecars = clearQueueItemFiles(ctx.cwd);
     failedSidecars = clearedSidecars.failed;
-    replaceState({ ...state, list: [] });
-    appendLedger(ctx.cwd, "list_cleared", { via: "glla_wipe", count: n, sidecars: clearedSidecars.removed });
+    if (failedSidecars.length === 0) {
+      replaceState({ ...state, list: [] });
+      appendLedger(ctx.cwd, "list_cleared", { via: "glla_wipe", count: n, sidecars: clearedSidecars.removed });
+    } else {
+      appendLedger(ctx.cwd, "glla_wipe_queue_cleanup_failed", { count: failedSidecars.length, sidecars: failedSidecars });
+    }
   }
   if (loop) {
     clearLoopTimer();
@@ -2291,6 +2303,18 @@ async function cmdGllaCancel(ctx: ExtensionContext): Promise<void> {
 }
 
 function cmdAudits(args: string, ctx: ExtensionContext): void {
+  if (/\bhealth\b/.test(args)) {
+    const report = /\bcleanup\b/.test(args)
+      ? cleanupDeadAuditJobs(ctx.cwd)
+      : inspectAuditJobHealth(ctx.cwd);
+    const action = /\bcleanup\b/.test(args) ? "cleanup" : "health";
+    ctx.ui.notify(
+      `glla audit-job ${action}: ${report.total} director${report.total === 1 ? "y" : "ies"} · ${report.live} live · ${report.dead} proven dead · ${report.ambiguous} ambiguous · ${report.bytes} bytes${report.cleanupCandidates > 0 ? ` · ${report.cleanupCandidates} old dead candidate(s)` : ""}.` +
+      (report.ambiguous > 0 ? " Ambiguous locks were preserved." : ""),
+      report.ambiguous > 0 ? "warning" : "info",
+    );
+    return;
+  }
   const full = /\bfull\b/.test(args);
   const all = /\b(?:all|global|log)\b/.test(args);
   const nMatch = args.match(/\b(\d+)\b/);
@@ -2301,7 +2325,7 @@ function cmdAudits(args: string, ctx: ExtensionContext): void {
       ctx.ui.notify(`Latest audit on this goal — ${fromGoal.model} (${fromGoal.at})\n${sanitizeProviderAuditReport(fromGoal.report)}`, "info");
       return;
     }
-    const latest = readAuditLog(ctx.cwd).at(-1);
+    const latest = readAuditLog(ctx.cwd, 1).at(-1);
     ctx.ui.notify(latest ? `Latest audit — ${latest.verdict} (${latest.model}, ${latest.at})\n${sanitizeProviderAuditReport(latest.report)}` : "No audits logged yet.", "info");
     return;
   }
@@ -2366,9 +2390,10 @@ export function cmdGllaBug(message: string, ctx: ExtensionContext): string {
   lines.push(`Captured at ${now.toISOString()} without mutating active.jsonl or goal md.`);
   lines.push("");
   try {
-    const ledgerPath = path.join(gllaDir, "active.jsonl");
-    const raw = fs.readFileSync(ledgerPath, "utf8").split("\n").filter(Boolean);
-    const tail = raw.slice(-20).join("\n").slice(0, 6000);
+    const tail = readLedgerTail(ctx.cwd, 20)
+      .map((entry) => JSON.stringify(entry))
+      .join("\n")
+      .slice(0, 6000);
     lines.push("### Recent active.jsonl tail (last 20 lines, read-only snapshot)");
     lines.push("```jsonl");
     lines.push(tail || "(empty)");

package/extensions/goal-loop-auditor-process.ts

@@ -8,7 +8,7 @@
  */
 
 import * as fs from "node:fs/promises";
-import { constants as fsConstants, readFileSync, readlinkSync, readdirSync, realpathSync, rmSync } from "node:fs";
+import { constants as fsConstants, readFileSync, readlinkSync, readdirSync, realpathSync, rmSync, statSync } from "node:fs";
 import { spawn as nodeSpawn, spawnSync as nodeSpawnSync, type ChildProcess, type SpawnOptions } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import * as path from "node:path";
@@ -675,8 +675,8 @@ function processAlive(pid: number): boolean {
   try {
     process.kill(pid, 0);
     return true;
-  } catch {
-    return false;
+  } catch (err) {
+    return (err as NodeJS.ErrnoException).code === "EPERM";
   }
 }
 
@@ -707,6 +707,112 @@ function durableWorkerPids(cwd: string, logicalAttemptId: string): Array<{ pid:
   return out;
 }
 
+export type AuditJobHealthStatus = "live" | "dead" | "ambiguous";
+
+export interface AuditJobHealthEntry {
+  attemptId: string;
+  dir: string;
+  ageMs: number;
+  bytes: number;
+  status: AuditJobHealthStatus;
+  pid?: number;
+  reason?: string;
+}
+
+export interface AuditJobHealthReport {
+  root: string;
+  scannedAt: string;
+  total: number;
+  live: number;
+  dead: number;
+  ambiguous: number;
+  bytes: number;
+  cleanupCandidates: number;
+  entries: AuditJobHealthEntry[];
+}
+
+/** A deliberately conservative threshold: an auditor that is merely slow is
+ * not a stale directory. Explicit cleanup only considers older directories
+ * whose worker PID is proven dead and whose lock advertises role=worker. */
+export const AUDIT_JOB_CLEANUP_MIN_AGE_MS = 15 * 60_000;
+
+function auditJobDirectoryBytes(dir: string): number {
+  let bytes = 0;
+  try {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (!entry.isFile()) continue;
+      try { bytes += statSync(path.join(dir, entry.name)).size; } catch { /* health is best effort per file */ }
+    }
+  } catch {
+    /* unreadable contents remain represented by the ambiguous lock status */
+  }
+  return bytes;
+}
+
+/** Read-only project-wide audit-job inventory. It never signals a process and
+ * never removes an ambiguous or unreadable directory. */
+export function inspectAuditJobHealth(cwd: string, nowMs = Date.now()): AuditJobHealthReport {
+  const root = path.join(piGlaDir(cwd), "audit-jobs");
+  const entries: AuditJobHealthEntry[] = [];
+  let dirs: Array<{ name: string; isDirectory: () => boolean }> = [];
+  try {
+    dirs = readdirSync(root, { withFileTypes: true });
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code === "ENOENT") {
+      return { root, scannedAt: new Date(nowMs).toISOString(), total: 0, live: 0, dead: 0, ambiguous: 0, bytes: 0, cleanupCandidates: 0, entries };
+    }
+    return { root, scannedAt: new Date(nowMs).toISOString(), total: 0, live: 0, dead: 0, ambiguous: 1, bytes: 0, cleanupCandidates: 0, entries: [{ attemptId: "<audit-jobs-root>", dir: root, ageMs: 0, bytes: 0, status: "ambiguous", reason: "root unreadable" }] };
+  }
+  for (const entry of dirs) {
+    if (!entry.isDirectory()) continue;
+    const dir = path.join(root, entry.name);
+    let ageMs = 0;
+    try { ageMs = Math.max(0, nowMs - statSync(dir).mtimeMs); } catch { ageMs = 0; }
+    const bytes = auditJobDirectoryBytes(dir);
+    let status: AuditJobHealthStatus = "ambiguous";
+    let pid: number | undefined;
+    let reason: string | undefined = "missing or unreadable worker lock";
+    try {
+      const lock = JSON.parse(readFileSync(path.join(dir, "lock"), "utf8")) as Record<string, unknown>;
+      pid = typeof lock.pid === "number" ? lock.pid : Number(lock.pid);
+      if (lock.role === "worker" && Number.isInteger(pid) && pid > 1) {
+        if (workerProcessMatches(cwd, pid, dir)) {
+          status = "live";
+          reason = undefined;
+        } else if (!processAlive(pid)) {
+          status = "dead";
+          reason = "worker PID is not alive";
+        } else {
+          reason = "PID is alive but worker identity does not match this job";
+        }
+      } else {
+        reason = "lock is not a worker-owned identity";
+      }
+    } catch {
+      /* preserve ambiguous */
+    }
+    entries.push({ attemptId: entry.name, dir, ageMs, bytes, status, ...(pid !== undefined ? { pid } : {}), ...(reason ? { reason } : {}) });
+  }
+  const live = entries.filter((entry) => entry.status === "live").length;
+  const dead = entries.filter((entry) => entry.status === "dead").length;
+  const ambiguous = entries.filter((entry) => entry.status === "ambiguous").length;
+  const bytes = entries.reduce((sum, entry) => sum + entry.bytes, 0);
+  const cleanupCandidates = entries.filter((entry) => entry.status === "dead" && entry.ageMs >= AUDIT_JOB_CLEANUP_MIN_AGE_MS).length;
+  return { root, scannedAt: new Date(nowMs).toISOString(), total: entries.length, live, dead, ambiguous, bytes, cleanupCandidates, entries };
+}
+
+/** Explicit, age-bounded cleanup for only proven-dead worker identities.
+ * Ambiguous locks are intentionally left for operator inspection. */
+export function cleanupDeadAuditJobs(cwd: string, maxAgeMs = AUDIT_JOB_CLEANUP_MIN_AGE_MS, nowMs = Date.now()): AuditJobHealthReport {
+  const report = inspectAuditJobHealth(cwd, nowMs);
+  for (const entry of report.entries) {
+    if (entry.status !== "dead" || entry.ageMs < maxAgeMs || entry.pid === undefined) continue;
+    if (processAlive(entry.pid) || workerProcessMatches(cwd, entry.pid, entry.dir)) continue;
+    try { rmSync(entry.dir, { recursive: true, force: true }); } catch { /* preserve the next health report */ }
+  }
+  return inspectAuditJobHealth(cwd, nowMs);
+}
+
 /** Reap workers left behind when their owning pi host died. This is the
  * cross-process companion to activeChildren, which intentionally cannot
  * survive a host restart. */