pi-goal-list-loop-audit 0.38.47 → 0.38.48

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.38.48 — atomic task batches + pending-task completion gate (2026-09-11)
+
+### Added
+
+- **update_task_batch tool:** validate whole → verify every `complete` milestone's `verificationContract` → copy + apply → persist once. A rejected batch or a mid-batch milestone failure leaves state untouched.
+- **Pending-task completion gate:** `complete_goal` with open committed tasks is refused BEFORE the auditor, naming each open item (`- <id>: "<title>" (<status>)`) with a `complete_goal_tasks_refused` ledger entry. Refusal mutates nothing and cannot be bypassed via `newObjective` (gate sits before the pivot branch).
+- **Deferral exemption:** `record_goal_judgment` accepts `taskId` only with `choice=deferred`; stamps `task.deferred = { reason, followUp, at }` in the same persist as the ledger entry. `inline` + `taskId` and unknown ids are refused with no ledger change.
+
+### Tests
+
+- `tests/task-atomicity-gate.test.ts`: 7 pure-core + 10 MockPi pins (mid-batch kill untouched, refusal names each task, deferral pass-through). `tsc` clean.
+
 ## 0.38.47 — layered prompts: skeleton plus on-demand detail (2026-09-11)
 
 ### Changed

package/docs/INDEX.md

@@ -16,7 +16,7 @@ Policy contracts and recent changes live in the `audit/` directory of the
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.47 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.48 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/extensions/goal-loop-core.ts

@@ -97,6 +97,15 @@ export function workCommand(mode: Policy | "loop" | undefined, command: string):
   return `${workCommandRoot(mode)} ${command}`;
 }
 
+export interface TaskDeferral {
+  /** Why the durable action is unsafe, impossible, or blocked right now. */
+  reason: string;
+  /** The bounded durable follow-up. */
+  followUp: string;
+  /** ISO timestamp of the recorded judgment. */
+  at: string;
+}
+
 export interface Task {
   id: string;
   title: string;
@@ -106,6 +115,11 @@ export interface Task {
   /** Optional verification gate for milestone-checked tasks. */
   verificationContract?: string;
   subtasks?: Task[];
+  /** A recorded deferral (via record_goal_judgment choice=deferred + taskId)
+   * exempts this task from the complete_goal pending-task gate. The
+   * exemption is durable state, not prose: the ledger holds the judgment,
+   * this stamp is the gate-readable pointer. */
+  deferred?: TaskDeferral;
 }
 
 export interface TaskList {

package/extensions/loops/goal-tools.ts

@@ -134,6 +134,16 @@ isGoalRevisionCurrent,
   buildDurableChoiceRecord,
   normalizeDurableDeferRecommendationInput,
 } from "../goal-loop-core.js";
+import {
+  applyValidatedBatch,
+  collectOpenTasks,
+  findTask,
+  formatOpenTaskRefusal,
+  patchTaskCopy,
+  validateTaskBatch,
+  withTaskStatus,
+  type TaskStatusUpdate,
+} from "../task-batch.js";
 import {
   createContinuationDispatch,
   dispatchMatchesOwner,
@@ -556,6 +566,22 @@ function registerAgentTools(pi: any): void {
           details: {},
         };
       }
+      // v0.38.48: pending-task completion gate — a claim with open
+      // committed tasks is refused BEFORE the auditor, naming each open
+      // item. Tasks carrying a recorded deferral (record_goal_judgment
+      // choice=deferred + taskId) are exempt. Placed before newObjective:
+      // a pivot must not silently orphan committed tasks — finish them or
+      // defer them explicitly first. Refusal mutates nothing.
+      if (state.goal.taskList) {
+        const openTasks = collectOpenTasks(state.goal.taskList);
+        if (openTasks.length > 0) {
+          appendLedger(ctx.cwd, "complete_goal_tasks_refused", {
+            goalId: state.goal.id,
+            open: openTasks.map((t) => ({ id: t.id, title: t.title, status: t.status })),
+          });
+          return { content: [{ type: "text", text: formatOpenTaskRefusal(openTasks) }], details: {} };
+        }
+      }
       // v0.25.0 (contract item 15): atomic objective update + audit in one
       // call — the objective-drift disapprove loop (ship shifted work →
       // auditor disapproves the ORIGINAL objective) ends here. Ledgered so
@@ -1913,6 +1939,7 @@ function registerAgentTools(pi: any): void {
       durableFix: Type.Optional(Type.String({ maxLength: 500, description: "The maintainable root-cause action to show in the goal card" })),
       deferRecommendations: Type.Optional(Type.Array(Type.String({ maxLength: 500 }), { maxItems: 8, description: "Earlier bounded workaround/defer recommendations to retain as UI evidence" })),
       durableBlocked: Type.Optional(Type.Boolean({ description: "True only when the durable action is unsafe, impossible, or blocked for this turn" })),
+      taskId: Type.Optional(Type.String({ description: "v0.38.48: with choice=deferred, attach this deferral to a task so the complete_goal pending-task gate exempts it. Only valid with choice=deferred." })),
     }),
     async execute(_id, params, signal, _onUpdate, execCtx) {
       const foreignJudgment = foreignToolGuard(execCtx);
@@ -1930,7 +1957,20 @@ function registerAgentTools(pi: any): void {
         durableFix?: string;
         deferRecommendations?: string[];
         durableBlocked?: boolean;
+        taskId?: string;
       };
+      // v0.38.48: a task-linked deferral exempts that task from the
+      // complete_goal pending-task gate. Inline needs no exemption (the fix
+      // ships now); an unknown task is refused before anything is recorded.
+      const taskId = p.taskId?.trim() || undefined;
+      if (taskId && p.choice !== "deferred") {
+        return { content: [{ type: "text", text: "taskId is only valid with choice=deferred — an inline judgment implements the fix now and needs no task exemption. Nothing was recorded." }], details: {} };
+      }
+      const goal = state.goal;
+      const deferredTask = taskId ? (goal.taskList ? findTask(goal.taskList, taskId) : null) : undefined;
+      if (taskId && !deferredTask) {
+        return { content: [{ type: "text", text: `No task "${taskId}" in this goal's task list — the judgment was NOT recorded.` }], details: {} };
+      }
       const record = buildDurableChoiceRecord(p.choice, p.reason, p.followUp);
       if (!record.reason) {
         return { content: [{ type: "text", text: "A non-empty reason is required to record a durable-vs-defer judgment." }], details: {} };
@@ -1938,19 +1978,30 @@ function registerAgentTools(pi: any): void {
       if (record.choice === "deferred" && !record.followUp) {
         return { content: [{ type: "text", text: "A deferred judgment also requires a durable follow-up." }], details: {} };
       }
-      const goal = state.goal;
       const durableDeferRecommendation = durableDeferFactsForGoal(goal, record, p);
       const landed = appendLedger(ctx.cwd, "durable_defer_choice", {
         goalId: goal.id,
         ...record,
+        ...(taskId ? { taskId, taskTitle: deferredTask!.title } : {}),
         durableDeferRecommendation,
       });
       if (!landed) {
         return { content: [{ type: "text", text: "The durable-vs-defer judgment could not be persisted; no choice was recorded." }], details: {} };
       }
-      if (!updateGoal({ durableDeferRecommendation }, ctx)) {
+      // v0.38.48: the task stamp rides the SAME persist as the UI
+      // projection — one write, never a stamped-but-unprojected split.
+      // record.followUp is proven non-empty for deferred above; a taskId
+      // always implies deferred (refused otherwise), so the non-null
+      // assertion holds exactly when a stamp is written.
+      const patch: Record<string, unknown> = { durableDeferRecommendation };
+      if (taskId && goal.taskList) {
+        patch.taskList = patchTaskCopy(goal.taskList, taskId, {
+          deferred: { reason: record.reason, followUp: record.followUp!, at: nowIso() },
+        });
+      }
+      if (!updateGoal(patch as Parameters<typeof updateGoal>[0], ctx)) {
         return {
-          content: [{ type: "text", text: `Recorded durable-vs-defer judgment: ${record.choice}, but its UI recommendation projection could not be persisted.` }],
+          content: [{ type: "text", text: `Recorded durable-vs-defer judgment: ${record.choice} in the ledger, but its persistence failed${taskId ? " — the task exemption did NOT land, so the gate will still block" : ""}. Retry.` }],
           details: {},
         };
       }
@@ -1959,7 +2010,7 @@ function registerAgentTools(pi: any): void {
       // from the state ledger through Goal.durableDeferRecommendation.
       refreshUI(ctx, true);
       return {
-        content: [{ type: "text", text: `Recorded durable-vs-defer judgment: ${record.choice}.` }],
+        content: [{ type: "text", text: `Recorded durable-vs-defer judgment: ${record.choice}.${taskId ? ` Task ${taskId} ("${deferredTask!.title}") is now exempt from the complete_goal pending-task gate.` : ""}` }],
         details: {},
       };
     },
@@ -2160,25 +2211,25 @@ function registerAgentTools(pi: any): void {
         return { content: [{ type: "text", text: "No task list in this goal." }], details: {} };
       }
       const tl = state.goal.taskList;
-      const queue: any[] = [...tl.tasks];
-      while (queue.length > 0) {
-        const t = queue.shift();
-        if (t.id === p.id && t.status !== "complete") {
-          const checkRes = await verifyTaskMilestone(ctx, t.verificationContract, signal);
-          if (checkRes) {
-            return {
-              content: [{
-                type: "text",
-                text: `Task ${p.id} milestone verification FAILED for command \`${checkRes.failedCommand}\` (exit code ${checkRes.exitCode}):\n\n${checkRes.output}\n\nTask ${p.id} remains in_progress. Fix the failure before marking complete.`,
-              }],
-              details: {},
-            };
-          }
-          t.status = "complete";
-          updateGoal({ taskList: tl }, ctx);
-          return { content: [{ type: "text", text: `Task ${p.id} marked complete.` }], details: {} };
+      // v0.38.48: copy-swap — the live list is never mutated in place, so a
+      // kill between verify and persist (or a persist failure) cannot leave
+      // partial state. Message strings are unchanged (pinned by tests).
+      const t = findTask(tl, p.id);
+      if (t && t.status !== "complete") {
+        const checkRes = await verifyTaskMilestone(ctx, t.verificationContract, signal);
+        if (checkRes) {
+          return {
+            content: [{
+              type: "text",
+              text: `Task ${p.id} milestone verification FAILED for command \`${checkRes.failedCommand}\` (exit code ${checkRes.exitCode}):\n\n${checkRes.output}\n\nTask ${p.id} remains in_progress. Fix the failure before marking complete.`,
+            }],
+            details: {},
+          };
+        }
+        if (!updateGoal({ taskList: withTaskStatus(tl, p.id, "complete") }, ctx)) {
+          return { content: [{ type: "text", text: `Task ${p.id} could not be marked complete — the persist failed and no state changed. Retry.` }], details: {} };
         }
-        if (t.subtasks) queue.push(...t.subtasks);
+        return { content: [{ type: "text", text: `Task ${p.id} marked complete.` }], details: {} };
       }
       return { content: [{ type: "text", text: `Task ${p.id} not found.` }], details: {} };
     },
@@ -2202,32 +2253,86 @@ function registerAgentTools(pi: any): void {
         return { content: [{ type: "text", text: "No task list in this goal." }], details: {} };
       }
       const tl = state.goal.taskList;
-      const queue: any[] = [...tl.tasks];
-      while (queue.length > 0) {
-        const t = queue.shift();
-        if (t.id === p.id) {
-          if (p.status === "complete") {
-            const checkRes = await verifyTaskMilestone(ctx, t.verificationContract, signal);
-            if (checkRes) {
-              return {
-                content: [{
-                  type: "text",
-                  text: `Task ${p.id} milestone verification FAILED for command \`${checkRes.failedCommand}\` (exit code ${checkRes.exitCode}):\n\n${checkRes.output}\n\nTask ${p.id} remains ${t.status}. Fix the failure before marking complete.`,
-                }],
-                details: {},
-              };
-            }
+      // v0.38.48: copy-swap (see complete_task). Message strings unchanged.
+      const t = findTask(tl, p.id);
+      if (t) {
+        if (p.status === "complete") {
+          const checkRes = await verifyTaskMilestone(ctx, t.verificationContract, signal);
+          if (checkRes) {
+            return {
+              content: [{
+                type: "text",
+                text: `Task ${p.id} milestone verification FAILED for command \`${checkRes.failedCommand}\` (exit code ${checkRes.exitCode}):\n\n${checkRes.output}\n\nTask ${p.id} remains ${t.status}. Fix the failure before marking complete.`,
+              }],
+              details: {},
+            };
           }
-          t.status = p.status;
-          updateGoal({ taskList: tl }, ctx);
-          return { content: [{ type: "text", text: `Task ${p.id} → ${p.status}` }], details: {} };
         }
-        if (t.subtasks) queue.push(...t.subtasks);
+        if (!updateGoal({ taskList: withTaskStatus(tl, p.id, p.status) }, ctx)) {
+          return { content: [{ type: "text", text: `Task ${p.id} could not move to ${p.status} — the persist failed and no state changed. Retry.` }], details: {} };
+        }
+        return { content: [{ type: "text", text: `Task ${p.id} → ${p.status}` }], details: {} };
       }
       return { content: [{ type: "text", text: `Task ${p.id} not found.` }], details: {} };
     },
   }));
 
+  pi.registerTool(defineTool({
+    name: "update_task_batch",
+    label: "Update task batch",
+    description: "Atomically update several tasks at once: the whole batch is validated first, milestones are verified, then all statuses persist in one write. Any failure rejects the batch and leaves state untouched.",
+    parameters: Type.Object({
+      updates: Type.Array(Type.Object({
+        id: Type.String({ description: "Task id to update" }),
+        status: Type.Union([Type.Literal("pending"), Type.Literal("in_progress"), Type.Literal("complete")]),
+      }), { description: "Status updates to apply atomically (each task id at most once)" }),
+    }),
+    async execute(_id, params, signal, _onUpdate, execCtx) {
+      const foreignBatch = foreignToolGuard(execCtx);
+      if (foreignBatch) return { content: [{ type: "text", text: foreignBatch }], details: {} };
+      const ctx = currentToolContext(execCtx);
+      if (!ctx) return staleToolResult();
+      const p = params as { updates: TaskStatusUpdate[] };
+      if (!state.goal || !state.goal.taskList) {
+        return { content: [{ type: "text", text: "No task list in this goal." }], details: {} };
+      }
+      const tl = state.goal.taskList;
+      // Phase 1 — validate the WHOLE batch before any verification runs.
+      const validation = validateTaskBatch(tl, p.updates);
+      if (!validation.ok) {
+        return { content: [{ type: "text", text: validation.error }], details: {} };
+      }
+      // Phase 2 — verify every milestone moving to complete. All failures
+      // are collected so one bad milestone does not hide another; NOTHING
+      // is applied until every verification passes (mid-batch kill here
+      // leaves state unchanged — the copy below does not exist yet).
+      const failures: string[] = [];
+      for (const e of validation.entries) {
+        if (e.status === "complete" && e.task.status !== "complete") {
+          const checkRes = await verifyTaskMilestone(ctx, e.task.verificationContract, signal);
+          if (checkRes) {
+            failures.push(`Task ${e.task.id} milestone verification FAILED for command \`${checkRes.failedCommand}\` (exit code ${checkRes.exitCode}):\n\n${checkRes.output}`);
+          }
+        }
+      }
+      if (failures.length > 0) {
+        return {
+          content: [{
+            type: "text",
+            text: `Task batch rejected — ${failures.length} milestone verification${failures.length === 1 ? "" : "s"} failed. No task was changed:\n\n${failures.join("\n\n")}`,
+          }],
+          details: {},
+        };
+      }
+      // Phase 3 — copy, apply, persist ONCE.
+      if (!updateGoal({ taskList: applyValidatedBatch(tl, validation.entries) }, ctx)) {
+        return { content: [{ type: "text", text: "Task batch could not persist — the write failed and no state changed. Retry." }], details: {} };
+      }
+      const applied = validation.entries.map((e) => `${e.task.id} → ${e.status}`).join(", ");
+      return { content: [{ type: "text", text: `Task batch applied (${validation.entries.length}): ${applied}.` }], details: {} };
+    },
+  }));
+
   pi.registerTool(defineTool({
     name: "propose_goal_draft",
     label: "Propose goal draft",

package/extensions/task-batch.ts

@@ -0,0 +1,156 @@
+// Task-batch atomicity core (v0.38.48).
+//
+// The single-task tools used to mutate the live task list in place and then
+// persist — a mid-batch kill (or a late verification failure) left partial
+// state behind with no record of what was intended. This module is the whole
+// mutation discipline:
+//
+//   validate whole (ids resolve, no duplicates) → verify milestones →
+//   copy + apply → persist once.
+//
+// Everything here is pure except the injected verify/persist callbacks, so
+// the contract is pinnable without a harness: a rejected batch returns the
+// ORIGINAL list object untouched, and the tools persist exactly once.
+
+import type { Task, TaskList } from "./goal-loop-core.js";
+
+export type TaskStatus = "pending" | "in_progress" | "complete";
+
+export interface TaskStatusUpdate {
+  id: string;
+  status: TaskStatus;
+}
+
+export interface ValidatedTaskUpdate {
+  task: Task;
+  status: TaskStatus;
+}
+
+export type BatchValidation =
+  | { ok: true; entries: ValidatedTaskUpdate[] }
+  | { ok: false; error: string };
+
+/** Breadth-first search over top-level tasks and subtasks, in list order. */
+export function findTask(taskList: TaskList, id: string): Task | null {
+  const queue: Task[] = [...taskList.tasks];
+  while (queue.length > 0) {
+    const t = queue.shift()!;
+    if (t.id === id) return t;
+    if (t.subtasks) queue.push(...t.subtasks);
+  }
+  return null;
+}
+
+/**
+ * Validate the WHOLE batch before anything is verified, copied, or
+ * persisted. Every id must resolve and appear exactly once; statuses must
+ * be legal. Any failure names the offending entry and changes nothing.
+ */
+export function validateTaskBatch(
+  taskList: TaskList,
+  updates: TaskStatusUpdate[],
+): BatchValidation {
+  if (!Array.isArray(updates) || updates.length === 0) {
+    return { ok: false, error: "Task batch is empty — pass at least one {id, status} update." };
+  }
+  const seen = new Set<string>();
+  const entries: ValidatedTaskUpdate[] = [];
+  for (const u of updates) {
+    if (!u || typeof u.id !== "string" || !u.id) {
+      return { ok: false, error: "Task batch rejected — every update needs a non-empty string id. No task was changed." };
+    }
+    if (u.status !== "pending" && u.status !== "in_progress" && u.status !== "complete") {
+      return { ok: false, error: `Task batch rejected — update for \"${u.id}\" carries an illegal status ${JSON.stringify((u as { status: unknown }).status)}. No task was changed.` };
+    }
+    if (seen.has(u.id)) {
+      return { ok: false, error: `Task batch rejected — duplicate update for task \"${u.id}\" in one batch (each task may appear once). No task was changed.` };
+    }
+    seen.add(u.id);
+    const task = findTask(taskList, u.id);
+    if (!task) {
+      return { ok: false, error: `Task batch rejected — task \"${u.id}\" not found. No task was changed.` };
+    }
+    entries.push({ task, status: u.status });
+  }
+  return { ok: true, entries };
+}
+
+/**
+ * Apply validated entries to a DEEP COPY. The input list is never mutated,
+ * so a kill between copy and persist (or a persist failure) leaves the
+ * caller's state object exactly as it was.
+ */
+export function applyValidatedBatch(
+  taskList: TaskList,
+  entries: ValidatedTaskUpdate[],
+): TaskList {
+  const next: TaskList = JSON.parse(JSON.stringify(taskList)) as TaskList;
+  for (const e of entries) {
+    const target = findTask(next, e.task.id);
+    // Proven by validateTaskBatch against the same shape — a missing target
+    // here would mean the list changed under us; fail loudly, never partial.
+    if (!target) throw new Error(`Task batch apply failed — task \"${e.task.id}\" vanished mid-batch. No persist was attempted.`);
+    target.status = e.status;
+  }
+  return next;
+}
+
+/** Copy with an arbitrary patch merged into one task; the input list is untouched. */
+export function patchTaskCopy(
+  taskList: TaskList,
+  id: string,
+  patch: Partial<Task>,
+): TaskList {
+  const next: TaskList = JSON.parse(JSON.stringify(taskList)) as TaskList;
+  const target = findTask(next, id);
+  if (!target) throw new Error(`patchTaskCopy: task "${id}" not found.`);
+  Object.assign(target, patch);
+  return next;
+}
+
+/** Copy with a single task's status replaced; the input list is untouched. */
+export function withTaskStatus(
+  taskList: TaskList,
+  id: string,
+  status: TaskStatus,
+): TaskList {
+  const task = findTask(taskList, id);
+  if (!task) throw new Error(`withTaskStatus: task \"${id}\" not found.`);
+  return applyValidatedBatch(taskList, [{ task, status }]);
+}
+
+export interface OpenTaskInfo {
+  id: string;
+  title: string;
+  status: TaskStatus;
+}
+
+/**
+ * Every committed task (top-level and subtask) still open, in list order.
+ * Complete tasks and tasks carrying a recorded deferral are not open — a
+ * deferral is an explicit durable-vs-defer judgment, not abandonment.
+ */
+export function collectOpenTasks(taskList: TaskList): OpenTaskInfo[] {
+  const open: OpenTaskInfo[] = [];
+  const queue: Task[] = [...taskList.tasks];
+  while (queue.length > 0) {
+    const t = queue.shift()!;
+    if (t.status !== "complete" && !t.deferred) {
+      open.push({ id: t.id, title: t.title, status: t.status });
+    }
+    if (t.subtasks) queue.push(...t.subtasks);
+  }
+  return open;
+}
+
+/** The refusal text for the complete_goal pending-task gate. Names every open task. */
+export function formatOpenTaskRefusal(open: OpenTaskInfo[]): string {
+  const lines = open.map((t) => `- ${t.id}: \"${t.title}\" (${t.status})`);
+  return (
+    `complete_goal REFUSED — ${open.length} open committed task${open.length === 1 ? " is" : "s are"} still unfinished:\n` +
+    lines.join("\n") +
+    `\n\nFinish them with complete_task or update_task_batch, or record an explicit ` +
+    `deferral for a genuinely blocked item with record_goal_judgment ` +
+    `(choice=\"deferred\", taskId=\"<id>\"). The claim was NOT sent to the auditor and no state changed.`
+  );
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.38.47",
+  "version": "0.38.48",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",