pi-goal-list-loop-audit 0.38.51 → 0.38.53

package/CHANGELOG.md

@@ -1,5 +1,68 @@
 # Changelog
 
+## 0.38.53 — Consent-safe GLLA delegation skill and list-draft staging (2026-09-13)
+
+Added the packaged `glla-delegate` skill for normal-chat goal/list delegation.
+It documents the consent ladder, main-session ownership, auto-activation warning,
+and tool-first usage without adding new runtime powers. Its quoted frontmatter
+is validated through Pi's public loader and the packed-file release gate.
+
+### Added
+
+- **Consent-safe delegation guidance:** explicit queue requests may use
+  `list_add`; discovered follow-ups are offered first; durable goals use
+  `propose_goal_draft`; speculative queueing, unowned activation, and agent
+  `/loop` control remain prohibited.
+- **Pasted-list policy:** supplied multi-line, bullet, numbered, and checklist
+  structure is preserved without an exact-versus-refined meta-question. Only a
+  genuinely ambiguous individual item remains eligible for clarification, with
+  one-record seeds retaining the normal draft path.
+- **Release/package coverage:** `skills/glla-delegate/SKILL.md` is allowlisted,
+  declared in `pi.skills`, required by the packed-artifact smoke, and loaded
+  with zero diagnostics in the release contract.
+
+### Fixed
+
+- **Draft staging:** interview and stale-entry gates remain ahead of Confirm;
+  confirmation remains ahead of conflict handling and enqueue.
+- **Paused list carryover:** a confirmed multi-item draft now routes its first
+  promotion through the carryover-aware activation choke point, archiving the
+  paused predecessor before starting the list head instead of leaving the batch
+  stranded behind it.
+
+## 0.38.52 — Second Gemini-gap: gate-inventory table + per-finding Test Results (2026-09-12)
+
+Surveyed five more Antigravity report screenshots
+(audit/SECOND-GEMINI-SUMMARY-GAP-2026-09-12.md) and closed the second gap
+in the terminal render only (chat + transcript + archive human layer;
+progress cards, status, widget, external notifies unchanged).
+
+### Added
+
+- **Agent-supplied gate inventory:** optional `complete_goal gateRows`
+  (one row per quality gate with scope and outcome notes, sanitized at
+  the claim boundary, max 10). The Verification Summary widens to
+  Quality Gate | Scope | Status | Notes and supersedes the mechanical
+  Tests rows. Statuses are mechanically derived, never claimed: PASS
+  only when the notes say pass with zero failures, FAIL on nonzero
+  failures, REPORTED otherwise — so bare-exit notes like `Clean exit 0`
+  honestly stay REPORTED. Absent inventory keeps the 3-col mechanical
+  table byte-identical.
+- **Per-finding test proof:** optional parallel `tests` array on each
+  `findingGroups` entry (`tests[i]` proves `findings[i]`, clipped to
+  findings, sanitized at the claim boundary). Nested area sections render
+  each as a `Test Results:` sub-bullet; the 4+-group table rides the
+  proof in the Evidence cell (`Evidence · Tests:`). Groups without tests
+  render exactly as v0.38.50.
+
+### Preserved
+
+- Chat close stays archive-only: no commit hash, emoji markers, or
+  artifact links in chat (survey rejects). The verbatim six-label
+  machine record, auditor-verified-before-posting, and the honesty
+  rules (PASS only on pass, NO VERDICT never renders, pipe escaping)
+  are unchanged.
+
 ## 0.38.51 — Bare /list drafts from context like bare /goal (2026-09-12)
 
 User note: empty `/list` could not start anything while empty `/goal`

package/README.md

@@ -157,7 +157,8 @@ quietly inventing an unbounded backlog.
 ```text
 /list "fix the cache. Done when: tests pass"
 /list plan.md                              # import a checklist or plan file
-/list                                     # show active and waiting items
+/list                                     # interview + Confirm for a context draft
+/list show                                # show active and waiting items
 /list start                                # activate the queued head, or draft one clear recent request
 /list next                                 # explicitly skip/activate the next item
 /list next <n>                             # explicitly choose a specific item
@@ -167,6 +168,13 @@ quietly inventing an unbounded backlog.
 /list cancel                               # stop the active item and drop waiting items
 ```
 
+A pasted multi-line, bulleted, numbered, or checklist-style list keeps its
+item wording and boundaries; GLLA does not ask for an “exact or refined” choice.
+Only a genuinely ambiguous individual item needs clarification. The packaged
+`skills/glla-delegate/SKILL.md` records the safe normal-chat delegation path:
+explicit queue requests may use `list_add`, while discovered follow-ups are
+offered first and durable goals remain Confirm-gated.
+
 Order is the default, not the law. Automatic advance normally uses the head of
 the queue, while `/list next <n>` or the agent's `list_activate` tool can choose
 another item. Numbering always matches `/list` output. After a list item is

package/docs/DESIGN-long-running-supervision.md

@@ -114,7 +114,10 @@ The full six-label recap lives verbatim in the archive (`## Completion summary`)
 and the status/history surfaces. The human layer in chat, transcript, and the
 archive's `## Terminal summary` renders the same facts as rich sections
 (`## Done: <objective> — <outcome>`, duration line, Key Findings grouped by area
-or tabulated at 4+ groups, Verification Summary table, Next, capped and clipped
+or tabulated at 4+ groups with per-finding `Test Results:` proof lines,
+Verification Summary table — widened to Quality Gate | Scope | Status | Notes
+with derived statuses when the agent supplies a gate inventory — Next, capped
+and clipped
 to fixed budgets). Width-bound and external surfaces (status line, widget card,
 external notifies) use the compact single-line projection of all six labels.
 Every terminal goal notification, including version-bearing already-shipped claims,

package/docs/INDEX.md

@@ -16,7 +16,7 @@ Policy contracts and recent changes live in the `audit/` directory of the
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.51 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.53 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen
@@ -25,7 +25,8 @@ Policy contracts and recent changes live in the `audit/` directory of the
   extensions, bounded zero-stream retry containment, crash-safe persistence,
   packed-artifact release verification, and the 2026-09-07 display/lifecycle/
   settings audit pass (abort-latch send guards, ownership compare-and-swap,
-  auditor inherit/clear parity) and the v0.38.25 post-objective summary
+  auditor inherit/clear parity), the v0.38.53 consent-safe `glla-delegate`
+  skill/list-drafting release, and the v0.38.25 post-objective summary
   (canonical approval render, persist + replay, audit-goal counts line), the v0.38.27 selective port of PRs #45/#46 (`/loop pause` soft-hold, widget subtask count), the v0.38.28 provenance-row closure fix, and the v0.38.29 compact active-card recovery/judgment projection; see CHANGELOG.md for the full trail.
 - `../README.md`: what the plugin is, install, quickstart, and the
   architectural guarantee (drafting + confirm + detached auditor).
@@ -37,6 +38,7 @@ Policy contracts and recent changes live in the `audit/` directory of the
 - `../README.md`: what the plugin is, install, quickstart
 - `SETTINGS.md`: canonical settings reference (files, precedence, every key)
 - `../INSTALL.md`: source install / local development setup
+- `../skills/glla-delegate/SKILL.md`: normal-chat goal/list delegation and consent ladder
 - `../CHANGELOG.md`: user-facing changelog; the first versioned heading is
   the current released package version (use `/glla version` to compare with
   the registry); post-release work may appear in `Unreleased` above it.

package/extensions/completion-summary.ts

@@ -1,4 +1,4 @@
-import type { FindingGroup, Goal, Status } from "./goal-loop-core.js";
+import type { FindingGroup, GateRow, Goal, Status } from "./goal-loop-core.js";
 import { fmtElapsed, truncateCells } from "./goal-loop-display.js";
 
 /**
@@ -347,7 +347,8 @@ export function extractEvidenceTokens(text: string): { text: string; evidence: s
 /**
  * v0.38.50: enforce the total-findings budget across groups in order —
  * groups that go empty are dropped so the table/nesting never shows a
- * bare area header.
+ * bare area header. v0.38.52: parallel `tests` ride along clipped to the
+ * surviving findings so tests[i] still proves findings[i].
  */
 export function takeBudgetedGroups(groups: FindingGroup[]): FindingGroup[] {
   const out: FindingGroup[] = [];
@@ -356,7 +357,9 @@ export function takeBudgetedGroups(groups: FindingGroup[]): FindingGroup[] {
     if (remaining <= 0) break;
     const findings = group.findings.slice(0, remaining);
     if (findings.length === 0) continue;
-    out.push({ title: group.title, findings });
+    // v0.38.52: keep the parallel test lines aligned with the survivors.
+    const aligned = group.tests?.slice(0, findings.length);
+    out.push(aligned && aligned.length > 0 ? { title: group.title, findings, tests: aligned } : { title: group.title, findings });
     remaining -= findings.length;
   }
   return out;
@@ -407,7 +410,12 @@ export function requestEchoHeadline(kind: "Done" | "Aborted", objective: string
  * v0.38.50: agent-structured groups render as `#### n. Area` subsections
  * with nested evidence bullets; at RICH_TABLE_GROUP_THRESHOLD groups the
  * same facts render as an Area | Finding | Evidence table instead.
- * Without groups the flat six-label projection stays the fallback. */
+ * Without groups the flat six-label projection stays the fallback.
+ * v0.38.52: optional per-finding `tests` render as a `Test Results:`
+ * sub-bullet (nested) or ride the Evidence cell (table); optional agent
+ * `gates` widen the Verification table to Gate | Scope | Status | Notes
+ * with mechanically derived statuses, superseding the mechanical Tests
+ * rows. Without gates the 3-col mechanical table is byte-identical. */
 export function buildRichTerminalParts(args: {
   outcome: string;
   details: string[];
@@ -416,6 +424,7 @@ export function buildRichTerminalParts(args: {
   objective?: string;
   durationLine?: string | null;
   groups?: FindingGroup[];
+  gates?: GateRow[];
 }): RichTerminalParts {
   const { findings, tests, next } = partitionRichDetails(args.details);
   const headline = requestEchoHeadline("Done", args.objective, args.outcome);
@@ -425,21 +434,28 @@ export function buildRichTerminalParts(args: {
   if (useTable) {
     findingLines.push("| Area | Finding | Evidence |", "| --- | --- | --- |");
     for (const group of budgeted) {
-      for (const finding of group.findings) {
+      group.findings.forEach((finding, fi) => {
         const { text, evidence } = extractEvidenceTokens(finding);
         const { lead, body } = leadBody(text);
+        // v0.38.52: test proof rides the Evidence cell (tables have no
+        // sub-bullets); cells stay pipe-escaped and budgeted.
+        const proof = group.tests?.[fi]?.trim();
+        const evidenceCell = [evidence.join(", ") || "\u2014", ...(proof ? [`Tests: ${proof}`] : [])].join(" \u00b7 ");
         findingLines.push(
-          `| ${escapeTableCell(clipSummaryValue(group.title, RICH_OBJECTIVE_ECHO_CHARS))} | ${escapeTableCell(`**${lead}** \u2014 ${clipSummaryValue(body, RICH_VALUE_BUDGET)}`)} | ${escapeTableCell(evidence.join(", ") || "\u2014")} |`,
+          `| ${escapeTableCell(clipSummaryValue(group.title, RICH_OBJECTIVE_ECHO_CHARS))} | ${escapeTableCell(`**${lead}** \u2014 ${clipSummaryValue(body, RICH_VALUE_BUDGET)}`)} | ${escapeTableCell(clipSummaryValue(evidenceCell, RICH_VALUE_BUDGET))} |`,
         );
-      }
+      });
     }
   } else if (budgeted.length > 0) {
     budgeted.forEach((group, i) => {
       findingLines.push(`#### ${i + 1}. ${clipSummaryValue(group.title, RICH_OBJECTIVE_ECHO_CHARS)}`);
-      for (const finding of group.findings) {
+      group.findings.forEach((finding, fi) => {
         const { lead, body } = leadBody(finding);
         findingLines.push(`- **${lead}** \u2014 ${clipSummaryValue(body, RICH_VALUE_BUDGET)}`);
-      }
+        // v0.38.52: per-finding test proof (shot C) — absent stays absent.
+        const proof = group.tests?.[fi]?.trim();
+        if (proof) findingLines.push(`  - Test Results: ${clipSummaryValue(proof, RICH_VALUE_BUDGET)}`);
+      });
     });
   } else {
     findings.slice(0, RICH_FINDINGS_CAP).forEach((detail, i) => {
@@ -448,17 +464,33 @@ export function buildRichTerminalParts(args: {
     });
   }
   const tableRows: string[] = [];
-  for (const detail of tests.slice(0, 2)) {
-    const { body } = leadBody(detail);
-    tableRows.push(`| Tests | ${testsRowStatus(body)} | ${escapeTableCell(clipSummaryValue(body, RICH_VALUE_BUDGET))} |`);
+  const gates = (args.gates ?? []).slice(0, 10);
+  if (gates.length > 0) {
+    // v0.38.52 (shots B/D): the agent inventory supersedes the mechanical
+    // Tests rows — one curated gate list, never a duplicated one. Status
+    // is derived, never claimed: PASS only when the notes say pass with
+    // zero failures ("Clean exit 0"-style notes honestly stay REPORTED).
+    for (const row of gates) {
+      const derived = testsRowStatus(row.notes ?? "");
+      tableRows.push(`| ${escapeTableCell(clipSummaryValue(row.gate, RICH_OBJECTIVE_ECHO_CHARS))} | ${escapeTableCell(clipSummaryValue(row.scope?.trim() || "\u2014", RICH_VALUE_BUDGET))} | ${derived} | ${escapeTableCell(clipSummaryValue(row.notes?.trim() || "\u2014", RICH_VALUE_BUDGET))} |`);
+    }
+  } else {
+    for (const detail of tests.slice(0, 2)) {
+      const { body } = leadBody(detail);
+      tableRows.push(`| Tests | ${testsRowStatus(body)} | ${escapeTableCell(clipSummaryValue(body, RICH_VALUE_BUDGET))} |`);
+    }
   }
   const auditStatus = auditRowStatus(args.auditHistory);
   if (auditStatus !== "NO VERDICT") {
     const auditBody = args.countsLine.replace(/^\u2014\s*/, "").replace(/\.\s*$/, "");
-    tableRows.push(`| Audit | ${auditStatus} | ${escapeTableCell(clipSummaryValue(auditBody, RICH_VALUE_BUDGET))} |`);
+    if (gates.length > 0) {
+      tableRows.push(`| Audit | ${escapeTableCell(clipSummaryValue(auditBody, RICH_VALUE_BUDGET))} | ${auditStatus} | ${escapeTableCell(clipSummaryValue(auditBody, RICH_VALUE_BUDGET))} |`);
+    } else {
+      tableRows.push(`| Audit | ${auditStatus} | ${escapeTableCell(clipSummaryValue(auditBody, RICH_VALUE_BUDGET))} |`);
+    }
   }
   const tableLines = tableRows.length > 0
-    ? ["| Check | Status | Details |", "| --- | --- | --- |", ...tableRows]
+    ? [(gates.length > 0 ? "| Quality Gate | Scope | Status | Notes |" : "| Check | Status | Details |"), (gates.length > 0 ? "| --- | --- | --- | --- |" : "| --- | --- | --- |"), ...tableRows]
     : [];
   const nextLines = next.slice(0, RICH_NEXT_CAP).map((detail) => {
     const { lead, body } = leadBody(detail);
@@ -495,7 +527,7 @@ export function composeRichTerminalLines(parts: RichTerminalParts, opts?: { head
  * raw six-label recap stays verbatim in `## Completion summary` as the
  * machine layer. Headline follows terminal status; aborted records never
  * wear a `Done` headline. */
-export function buildRichArchiveSection(goal: Goal, status: Status, archivePath: string, findingGroups?: FindingGroup[]): string[] {
+export function buildRichArchiveSection(goal: Goal, status: Status, archivePath: string, findingGroups?: FindingGroup[], gateRows?: GateRow[]): string[] {
   const facts: CompletionSummaryFacts = { goal, status, archivePath };
   const summary = resolveCompletionSummary(facts, goal.completionSummary).summary;
   const brief = humanCompletionBrief(summary, 140, RICH_VALUE_BUDGET);
@@ -513,6 +545,7 @@ export function buildRichArchiveSection(goal: Goal, status: Status, archivePath:
     objective: goal.objective,
     durationLine: buildDurationLine(goal),
     groups: findingGroups,
+    gates: gateRows,
   });
   return [
     ...composeRichTerminalLines(parts, {
@@ -611,6 +644,12 @@ export interface TerminalApprovalRenderInput {
    * sanitized at claim time). Absent keeps the flat six-label fallback.
    */
   findingGroups?: FindingGroup[];
+  /**
+   * v0.38.52: agent-supplied verification gate rows (complete_goal
+   * gateRows, sanitized at claim time). Absent keeps the mechanical
+   * 3-col verification table.
+   */
+  gateRows?: GateRow[];
 }
 
 export interface TerminalApprovalRender {
@@ -689,6 +728,7 @@ export function buildTerminalApprovalRender(input: TerminalApprovalRenderInput):
     objective: input.goal.objective,
     durationLine: buildDurationLine(input.goal),
     groups: input.findingGroups,
+    gates: input.gateRows,
   });
   const chatBody = composeRichTerminalLines(richParts);
   const transcriptBody = composeRichTerminalLines(richParts);

package/extensions/goal-loop-core.ts

@@ -282,12 +282,21 @@ export type AuditorRecoveryFailureClass = "transport" | "timeout" | "no-verdict"
 export interface FindingGroup {
   title: string;
   findings: string[];
+  /**
+   * v0.38.52 (second Gemini-gap survey, shot C): optional per-finding
+   * test-result lines, aligned by index with `findings` (tests[i] proves
+   * findings[i]). Absent/short entries simply omit the sub-line — old
+   * claims without `tests` render byte-identical to v0.38.50.
+   */
+  tests?: string[];
 }
 
 export const MAX_FINDING_GROUPS = 6;
 export const MAX_GROUP_FINDINGS = 6;
 export const MAX_GROUP_TITLE_CHARS = 120;
 export const MAX_GROUP_FINDING_CHARS = 500;
+/** v0.38.52: per-finding test-result lines share the finding budget. */
+export const MAX_GROUP_TESTS_CHARS = 500;
 
 /**
  * Bound agent-supplied finding groups at the trust boundary. Drops
@@ -313,11 +322,64 @@ export function sanitizeFindingGroups(value: unknown): FindingGroup[] | undefine
       if (text) findings.push(text);
     }
     if (findings.length === 0) continue;
-    groups.push({ title, findings });
+    // v0.38.52: optional test-result lines ride parallel to findings.
+    // Non-string entries drop; the array is clipped to the finding count
+    // so tests[i] always proves findings[i] after budgeting.
+    let tests: string[] | undefined;
+    if (Array.isArray(raw.tests)) {
+      const parsed: string[] = [];
+      for (const entry of raw.tests) {
+        if (typeof entry !== "string") continue;
+        const text = entry.trim().slice(0, MAX_GROUP_TESTS_CHARS);
+        if (text) parsed.push(text);
+      }
+      if (parsed.length > 0) tests = parsed.slice(0, findings.length);
+    }
+    groups.push(tests ? { title, findings, tests } : { title, findings });
   }
   return groups.length > 0 ? groups : undefined;
 }
 
+/**
+ * v0.38.52 (second Gemini-gap survey, shots B/D): one agent-supplied
+ * verification gate row for the widened terminal table. Presentation
+ * only — the six-label completionSummary stays the audited substance.
+ * Status is NEVER agent-controlled: the renderer derives PASS/FAIL/
+ * REPORTED mechanically from `notes` via testsRowStatus, so a gate can
+ * only claim PASS when its notes say so with zero failures.
+ */
+export interface GateRow {
+  gate: string;
+  scope?: string;
+  notes?: string;
+}
+
+export const MAX_GATE_ROWS = 10;
+export const MAX_GATE_GATE_CHARS = 120;
+export const MAX_GATE_SCOPE_CHARS = 200;
+export const MAX_GATE_NOTES_CHARS = 400;
+
+/**
+ * Bound agent-supplied gate rows at the trust boundary. Drops blank
+ * gates; clips cells. Returns undefined when nothing valid survives —
+ * the mechanical 3-col table stays the fallback.
+ */
+export function sanitizeGateRows(value: unknown): GateRow[] | undefined {
+  if (!Array.isArray(value)) return undefined;
+  const rows: GateRow[] = [];
+  for (const entry of value) {
+    if (rows.length >= MAX_GATE_ROWS) break;
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const raw = entry as Record<string, unknown>;
+    const gate = typeof raw.gate === "string" ? raw.gate.trim().slice(0, MAX_GATE_GATE_CHARS) : "";
+    if (!gate) continue;
+    const scope = typeof raw.scope === "string" ? raw.scope.trim().slice(0, MAX_GATE_SCOPE_CHARS) : "";
+    const notes = typeof raw.notes === "string" ? raw.notes.trim().slice(0, MAX_GATE_NOTES_CHARS) : "";
+    rows.push({ gate, ...(scope ? { scope } : {}), ...(notes ? { notes } : {}) });
+  }
+  return rows.length > 0 ? rows : undefined;
+}
+
 export interface PendingCompletion {
   completionSummary?: string;
   verificationSummary?: string;
@@ -352,6 +414,12 @@ export interface PendingCompletion {
    * Absent means the flat six-label render stays the fallback.
    */
   findingGroups?: FindingGroup[];
+/**
+ * v0.38.52: agent-supplied verification gate rows for the widened
+ * terminal table (complete_goal gateRows, sanitized at claim time).
+ * Absent means the mechanical 3-col table stays the fallback.
+ */
+gateRows?: GateRow[];
   /**
    * Durable one-shot recovery fence. A parked claim may receive one
    * automatic retry after a validated healthy lifecycle/recovery event;
@@ -2213,6 +2281,10 @@ function normalizePendingCompletion(value: unknown): PendingCompletion {
   // garbage at the boundary degrades to absent (flat fallback), never
   // to a half-structured projection.
   const sanitizedGroups = sanitizeFindingGroups(raw.findingGroups);
+  // v0.38.52: agent-supplied gate rows survive reloads sanitized; garbage
+  // at the boundary degrades to absent (mechanical fallback), never to a
+  // half-structured projection.
+  const sanitizedGates = sanitizeGateRows(raw.gateRows);
   return {
     ...canonicalOrUnknown,
     ...(auditorCandidateRefs !== undefined ? { auditorCandidateRefs } : {}),
@@ -2226,6 +2298,7 @@ function normalizePendingCompletion(value: unknown): PendingCompletion {
     ...(auditorFailureAt ? { auditorFailureAt } : {}),
     ...(timeoutEscalation !== undefined ? { timeoutEscalation } : {}),
     ...(sanitizedGroups ? { findingGroups: sanitizedGroups } : {}),
+    ...(sanitizedGates ? { gateRows: sanitizedGates } : {}),
     ...(phase === "running" || phase === "recovery-pending" || phase === "retry-waiting" ? { phase } : {}),
     ...(typeof raw.retryAttempts === "number"
       ? { retryAttempts: raw.retryAttempts }

package/extensions/loops/goal-auditor-hooks.ts

@@ -1442,13 +1442,15 @@ async function retryStoredCompletionAudit(origin: CompletionAuditOrigin = "provi
       // v0.38.37: the deliberate non-do the agent claimed, if any.
       ...(claim.leftOut ? { leftOut: claim.leftOut } : {}),
       // v0.38.50: agent-structured finding groups ride the audited claim.
+      // v0.38.52: same for the gate inventory.
       ...(claim.findingGroups ? { findingGroups: claim.findingGroups } : {}),
+      ...(claim.gateRows ? { gateRows: claim.gateRows } : {}),
       extras: inspectionSessionPath
         ? [`Auditor session kept for review: pi --session ${inspectionSessionPath} (or pi --fork ${inspectionSessionPath}).`]
         : [],
     });
     const approvalObjective = state.goal.objective;
-    const archived = archiveCurrentGoal(liveCtx, "complete", `auditor ${result.model} approved (${origin})`, {}, { findingGroups: claim.findingGroups });
+    const archived = archiveCurrentGoal(liveCtx, "complete", `auditor ${result.model} approved (${origin})`, {}, { findingGroups: claim.findingGroups, gateRows: claim.gateRows });
     if (!archived) {
       // archiveCurrentGoal already preserved the live record and warned the
       // user. Keep the approved claim recoverable, but never emit a terminal

package/extensions/loops/goal-list-queue.ts

@@ -860,7 +860,7 @@ async function startDrafting(ctx: ExtensionContext, target: "goal" | "list" | "l
   // concatenation produced "…regular draft.Goal drafting — deep planning: …".
   const seededHint = (planNote ? `${planNote} ` : "") + (
     target === "list"
-      ? `${label}: free-text is valid without a "Done when:" clause — the agent will turn it into short list items and grill for concrete per-item contracts (nothing activates until you confirm). To skip drafting, include a per-item "Done when:" clause.`
+      ? `${label}: free-text is valid without a "Done when:" clause — the agent will turn it into short list items and grill for concrete per-item contracts (nothing activates until you confirm). If the seed is already a pasted multi-line, bulleted, numbered, or checklist-style list, use its wording and structure as supplied; do not ask whether it should be exact or refined. To skip drafting, include a per-item "Done when:" clause.`
       : target === "loop"
         ? `${label}: a loop target needs a metric and a direction — the agent will help you design them first (nothing activates until you confirm). Skip the interview entirely: /loop start "<target>" (bare = infinite metricless) or /loop start "<target>" measure="<cmd>" direction=min|max [window=5] [max=50] [time=h] [tokens=n] [branch=1].`
         : `${label}: the objective has no "Done when:" clause — the agent will grill you about it first (nothing activates until you confirm). Skip the interview entirely: /goal start <objective>.`);
@@ -877,7 +877,10 @@ async function startDrafting(ctx: ExtensionContext, target: "goal" | "list" | "l
           "for the big version. When the user has many items to enqueue at once ('queue these 50 audits'), propose them ALL AT " +
           "ONCE with the items[] parameter — one Confirm for the whole batch, never 50 separate proposals. Each items[] entry " +
           "is still a SHORT task — never an aggregate wrapper ('land all N findings' with a '≥N commits' contract is the " +
-          "canonical anti-pattern: the auto-committer squashes, the count fails, the auditor disapproves finished work).]",
+          "canonical anti-pattern: the auto-committer squashes, the count fails, the auditor disapproves finished work). " +
+          "For a pasted multi-line, bulleted, numbered, or checklist-style seed, preserve the supplied wording and structure, " +
+          "strip only import syntax and empty headings/lines, and propose items[] directly — do not ask whether it should be exact " +
+          "or refined; clarify only a genuinely ambiguous individual item.]",
       );
   }
   // v0.14.0: the LLM grills (its strength — v0.13.0's canned questionnaire

package/extensions/loops/goal-orchestrator.ts

@@ -30,6 +30,7 @@ import { state, replaceState, persistStateLine } from "../goal-state.js";
 
 import {
   type FindingGroup,
+  type GateRow,
   type Goal,
   type Policy,
   type State,
@@ -1102,7 +1103,8 @@ function archiveCurrentGoal(
   patch: Partial<Pick<Goal, "auditHistory" | "completionSummary" | "pendingTasks">> = {},
   // v0.38.50: agent-structured finding groups ride the audited claim into
   // the archive rich section only — abort/wip paths omit it (flat fallback).
-  opts?: { findingGroups?: FindingGroup[] },
+  // v0.38.52: same for the gate inventory.
+  opts?: { findingGroups?: FindingGroup[]; gateRows?: GateRow[] },
 ): boolean {
   if (!state.goal) return false;
   if (status !== "complete" && status !== "aborted") return false;
@@ -1151,7 +1153,7 @@ function archiveCurrentGoal(
   // it carries the same rich markdown as chat over the verbatim
   // six-label machine record. Built from the terminal goal AFTER the
   // summary fence resolves, so chat and archive cannot disagree.
-  const richSection = buildRichArchiveSection(terminalGoal, status, archivePath, opts?.findingGroups);
+  const richSection = buildRichArchiveSection(terminalGoal, status, archivePath, opts?.findingGroups, opts?.gateRows);
   const richMd = `${md}\n## Terminal summary\n\n${richSection.join("\n")}\n`;
   // An existing same-id archive is an immutable fence. Check it before
   // publishing an intent so an unrelated/sentinel winner can never make the

package/extensions/loops/goal-tools.ts

@@ -134,6 +134,7 @@ isGoalRevisionCurrent,
   buildDurableChoiceRecord,
   normalizeDurableDeferRecommendationInput,
   sanitizeFindingGroups,
+  sanitizeGateRows,
 } from "../goal-loop-core.js";
 import {
   applyValidatedBatch,
@@ -540,6 +541,7 @@ function registerAgentTools(pi: any): void {
       findingGroups: Type.Optional(Type.Array(Type.Object({
         title: Type.String({ maxLength: 120, description: "Work-area name (e.g. a subsystem, screen, or phase)" }),
         findings: Type.Array(Type.String({ maxLength: 500 }), { maxItems: 6, description: "Findings in this area as `Lead: body with path:line evidence` (max 6 per area)" }),
+        tests: Type.Optional(Type.Array(Type.String({ maxLength: 500 }), { maxItems: 6, description: "v0.38.52: optional per-finding test-result lines, aligned by index with findings (tests[i] proves findings[i]); each renders as a `Test Results:` sub-line" })),
       }), {
         maxItems: 6,
         description:
@@ -549,6 +551,18 @@ function registerAgentTools(pi: any): void {
           "Presentation only — the six-label completionSummary stays the audited substance, and file:line tokens are never invented. " +
           "Omit for single-area work — the flat six-label render stays the fallback.",
       })),
+      gateRows: Type.Optional(Type.Array(Type.Object({
+        gate: Type.String({ maxLength: 120, description: "Gate name (e.g. Unit Tests, Typecheck, E2E, Production Build)" }),
+        scope: Type.Optional(Type.String({ maxLength: 200, description: "What the gate covered (e.g. suites, tiers, invariants)" })),
+        notes: Type.Optional(Type.String({ maxLength: 400, description: "Outcome notes with counts (e.g. 743 passed, 0 failed). Status is DERIVED from these notes — PASS only when they say pass with zero failures, never claimed." })),
+      }), {
+        maxItems: 10,
+        description:
+          "v0.38.52: optional verification gate inventory for the terminal summary. " +
+          "Widens the Verification table to Quality Gate | Scope | Status | Notes and supersedes the mechanical Tests rows. " +
+          "Presentation only — the six-label completionSummary stays the audited substance, and counts are never invented. " +
+          "Omit when there is no gate inventory — the mechanical 3-col table stays the fallback.",
+      })),
     }),
     async execute(_id, params, signal, _onUpdate, execCtx) {
       const foreign0 = foreignToolGuard(execCtx);
@@ -572,7 +586,7 @@ function registerAgentTools(pi: any): void {
         }
         return { content: [{ type: "text", text: `No active goal — it is ${state.goal.status}.` }], details: {} };
       }
-      const p = params as { completionSummary?: string; verificationSummary?: string; newObjective?: string; leftOut?: string; findingGroups?: unknown };
+      const p = params as { completionSummary?: string; verificationSummary?: string; newObjective?: string; leftOut?: string; findingGroups?: unknown; gateRows?: unknown };
       if (state.goal.repairTarget) {
         return {
           content: [{ type: "text", text: `This repair card cannot be completed yet. Redraft the original target as a confirmed task list with propose_task_list (include objective: ${state.goal.repairTarget.objective.slice(0, 180)}), then continue the real work.` }],
@@ -787,7 +801,9 @@ function registerAgentTools(pi: any): void {
       }
       // v0.38.50: agent-structured finding groups ride the same claim —
       // sanitized once at the boundary, rendered only after approval.
+      // v0.38.52: same for the agent-supplied gate inventory.
       const sanitizedGroups = sanitizeFindingGroups(p.findingGroups);
+      const sanitizedGates = sanitizeGateRows(p.gateRows);
       const completionClaim = beginCompletionAudit(ctx, {
         completionSummary: finalSummary,
         verificationSummary: p.verificationSummary,
@@ -795,6 +811,7 @@ function registerAgentTools(pi: any): void {
         // the terminal render — the only source the summary may cite.
         ...(p.leftOut?.trim() ? { leftOut: p.leftOut.trim().slice(0, 500) } : {}),
         ...(sanitizedGroups ? { findingGroups: sanitizedGroups } : {}),
+        ...(sanitizedGates ? { gateRows: sanitizedGates } : {}),
         at: nowIso(),
       }, "complete-goal");
       if (!completionClaim) {
@@ -1252,6 +1269,7 @@ function registerAgentTools(pi: any): void {
         // v0.38.50: same for agent-structured finding groups.
         const escLeftOut = state.goal.pendingCompletion?.leftOut;
         const escFindingGroups = state.goal.pendingCompletion?.findingGroups;
+        const escGateRows = state.goal.pendingCompletion?.gateRows;
         updateGoal({ status: "active", auditHistory: history, pendingCompletion: undefined, pauseReason: "audit aborted by user (Esc)" }, ctx);
         const abortConfirmCtx = freshCtxForGeneration(auditGeneration);
         if (!abortConfirmCtx) return staleToolResult();
@@ -1294,8 +1312,9 @@ function registerAgentTools(pi: any): void {
             // captured from it above.
             ...(escLeftOut ? { leftOut: escLeftOut } : {}),
             ...(escFindingGroups ? { findingGroups: escFindingGroups } : {}),
+            ...(escGateRows ? { gateRows: escGateRows } : {}),
           });
-          if (!archiveCurrentGoal(ctx, "complete", terminalReason, {}, { findingGroups: escFindingGroups })) {
+          if (!archiveCurrentGoal(ctx, "complete", terminalReason, {}, { findingGroups: escFindingGroups, gateRows: escGateRows })) {
             return {
               content: [{ type: "text", text: "The audit was aborted, but the terminal archive could not be persisted. The goal remains active; fix persistence and retry." }],
               details: {},
@@ -1351,14 +1370,16 @@ function registerAgentTools(pi: any): void {
           // v0.38.37: the deliberate non-do rides the durable claim.
           ...(durableCompletionClaim.leftOut ? { leftOut: durableCompletionClaim.leftOut } : {}),
           // v0.38.50: agent-structured finding groups ride the same claim.
+          // v0.38.52: same for the gate inventory.
           ...(durableCompletionClaim.findingGroups ? { findingGroups: durableCompletionClaim.findingGroups } : {}),
+          ...(durableCompletionClaim.gateRows ? { gateRows: durableCompletionClaim.gateRows } : {}),
           extras: inspectionSessionPath
             ? [`Auditor session kept for review: pi --session ${inspectionSessionPath} (or pi --fork ${inspectionSessionPath}).`]
             : [],
         });
         const manualObjective = state.goal.objective;
         const manualGoalId = state.goal.id;
-        const archived = archiveCurrentGoal(ctx, "complete", terminalReason, {}, { findingGroups: durableCompletionClaim.findingGroups });
+        const archived = archiveCurrentGoal(ctx, "complete", terminalReason, {}, { findingGroups: durableCompletionClaim.findingGroups, gateRows: durableCompletionClaim.gateRows });
         if (!archived) {
           // The archive helper preserves the live objective and emits the
           // persistence warning. Stop here: an approved verdict is not a
@@ -2419,17 +2440,26 @@ function registerAgentTools(pi: any): void {
         // v0.23.7: show ALL items in full — the user approves the whole
         // batch; hidden items would be approved blind.
         const preview = p.items.map((t, i) => `  ${i + 1}. ${t}`).join("\n");
-        const batchActivates = !state.goal || state.goal.status === "complete" || state.goal.status === "aborted";
+        const startsFromEmpty = !state.goal || state.goal.status === "complete" || state.goal.status === "aborted";
+        const replacesPaused = state.goal?.status === "paused";
+        const batchActivates = startsFromEmpty || replacesPaused;
+        const activationNote = startsFromEmpty
+          ? listQueue().length > 0
+            ? "\n\n(Confirming starts the current list head immediately.)"
+            : "\n\n(List is empty — confirming ACTIVATES the first proposed item immediately as the active goal.)"
+          : replacesPaused
+            ? "\n\n(A paused objective is held — confirming resolves that carryover and ACTIVATES the current list head. Reject if you only wanted to queue these items.)"
+            : "";
         let batchConfirmed = false;
         if (autoAccept) {
           batchConfirmed = true;
-          liveCtx.ui.notify(`List batch auto-accepted (Auto-accept drafts = on in /glla settings): ${p.items.length} items${batchActivates ? " — item 1 ACTIVATES now" : ""}.`, "info");
+          liveCtx.ui.notify(`List batch auto-accepted (Auto-accept drafts = on in /glla settings): ${p.items.length} items${batchActivates ? " — the list head ACTIVATES now" : ""}.`, "info");
           appendLedger(liveCtx.cwd, "draft_autoaccepted", { kind: "batch", count: p.items.length });
         } else {
           const c = await confirmDraft(
             liveCtx,
             "Confirm list batch",
-            `${p.items.length} items:\n${preview}${batchActivates ? "\n\n(List is empty — confirming ACTIVATES item 1 immediately as the active goal.)" : ""}`,
+            `${p.items.length} items:\n${preview}${activationNote}`,
           );
           const afterConfirm = freshCtxForGeneration(draftGeneration);
           if (!afterConfirm) {
@@ -2468,10 +2498,25 @@ function registerAgentTools(pi: any): void {
         }
         draftingTarget = null;
         await ((globalThis as any).restoreDrafterModel?.() ?? Promise.resolve());
-        const wasIdle = !state.goal || state.goal.status === "complete" || state.goal.status === "aborted";
+        // enqueueItems owns the empty/terminal-slot auto-start. A paused
+        // objective is different: preserve the one-confirm batch, then route
+        // promotion through the same carryover-aware choke point so the
+        // paused record is archived before the new list head starts.
+        const slotWasEmpty = !state.goal || state.goal.status === "complete" || state.goal.status === "aborted";
+        const pausedBeforeEnqueue = state.goal?.status === "paused";
         const n = enqueueItems(liveCtx, p.items, "drafted batch");
-        if (wasIdle) {
-          return { content: [{ type: "text", text: `${n} items confirmed; first activated (list was empty). Begin work now.` }], details: {} };
+        if (n === 0) {
+          return { content: [{ type: "text", text: "No new list items were queued — the proposed batch was empty after duplicate/persistence checks." }], details: {} };
+        }
+        if (pausedBeforeEnqueue && state.goal?.status === "paused") {
+          const activated = activateNextListItem(liveCtx);
+          if (activated) {
+            return { content: [{ type: "text", text: `${n} items confirmed; the list head activated after paused carryover resolution. Begin work now.` }], details: {} };
+          }
+          return { content: [{ type: "text", text: `${n} items confirmed and queued (${listQueue().length} waiting), but activation was held. The paused objective remains recoverable; retry list activation after fixing the reported issue.` }], details: {} };
+        }
+        if (slotWasEmpty && state.goal?.status === "active" && state.goal.policy === "list") {
+          return { content: [{ type: "text", text: `${n} items confirmed; the first list item activated. Begin work now.` }], details: {} };
         }
         return { content: [{ type: "text", text: `${n} items confirmed and added to the list (${listQueue().length} waiting).` }], details: {} };
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.38.51",
+  "version": "0.38.53",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",
@@ -29,6 +29,7 @@
   },
   "files": [
     "extensions",
+    "skills",
     "prompts",
     "schemas",
     "scripts",
@@ -45,6 +46,9 @@
   "pi": {
     "extensions": [
       "extensions/loops/goal.ts"
+    ],
+    "skills": [
+      "skills/glla-delegate"
     ]
   },
   "scripts": {

package/prompts/goal-loop-continuation.md

@@ -205,4 +205,4 @@ The orchestrator's backstop is the stall watchdog: three consecutive turns with
 
 `complete_goal` submits a nonterminal claim, not a completion verdict. While the detached audit is pending, do not say the goal is done/complete/approved or present a final success summary. Do not wait or poll. If a response is needed, give one brief pending-status sentence. GLLA posts the concrete outcome-first summary into chat after verified approval and durable archive, without needing another user prompt. Do not duplicate that summary. A rejected claim remains unfinished and repair work continues.
 
-The agent-written completionSummary is user-facing evidence, not a step log: open with the outcome in plain words, then one verifiable result per label with its proof inline (test counts, file paths, commit refs) — never raw run stats. Keep each label value to one or two short clauses so it survives the renderer's clause-boundary clipping (rich sections budget ~200 chars per value); cite human-readable proof (counts, versions, repo-relative paths, PR numbers) and never machine paths (/var/tmp logs, tarballs — those live in the archive only). Cut values at clause boundaries, never mid-word; write Next: as one concrete follow-up action or none (audit-self-referential lines like "verdict decides" are stripped at render); pass what was deliberately left out as the complete_goal leftOut parameter — it renders as the closing bullet, and is omitted when absent. When the work spans distinct areas (subsystems, screens, phases), group the findings with the complete_goal findingGroups parameter — one group per area, each finding as `Lead: body` with repo-relative `path:line` evidence tokens (never invented paths); 4+ groups render as an Area | Finding | Evidence table, fewer as nested area sections. Single-area work omits findingGroups — the flat six-label render stays the fallback.
+The agent-written completionSummary is user-facing evidence, not a step log: open with the outcome in plain words, then one verifiable result per label with its proof inline (test counts, file paths, commit refs) — never raw run stats. Keep each label value to one or two short clauses so it survives the renderer's clause-boundary clipping (rich sections budget ~200 chars per value); cite human-readable proof (counts, versions, repo-relative paths, PR numbers) and never machine paths (/var/tmp logs, tarballs — those live in the archive only). Cut values at clause boundaries, never mid-word; write Next: as one concrete follow-up action or none (audit-self-referential lines like "verdict decides" are stripped at render); pass what was deliberately left out as the complete_goal leftOut parameter — it renders as the closing bullet, and is omitted when absent. When the work spans distinct areas (subsystems, screens, phases), group the findings with the complete_goal findingGroups parameter — one group per area, each finding as `Lead: body` with repo-relative `path:line` evidence tokens (never invented paths); 4+ groups render as an Area | Finding | Evidence table, fewer as nested area sections. Add per-finding test proof with the parallel `tests` array (tests[i] proves findings[i]) — each renders as a `Test Results:` sub-line. When the work ran named quality gates (unit, typecheck, E2E, build, invariants), pass the complete_goal gateRows inventory — one row per gate with scope and outcome notes; the Verification table widens to Quality Gate | Scope | Status | Notes with mechanically derived statuses (PASS only when the notes say pass with zero failures) and supersedes the mechanical Tests rows. Single-area work omits findingGroups — the flat six-label render stays the fallback; work with no gate inventory omits gateRows — the mechanical 3-col table stays the fallback.

package/prompts/goal-loop-draft.md

@@ -71,6 +71,17 @@ While drafting, watch the seed's shape and recommend the right mode:
 The user invoked `/goal` with no objective. Your job is to turn their vague
 request into a **confirmed goal contract**. Do NOT start substantive work yet.
 
+## Pasted list seeds
+
+When this prompt is being used for `/list` and the user supplies a multi-line,
+bulleted, numbered, or checklist-style seed, use its structure and wording as
+provided. Strip only import syntax and empty headings/lines, then propose the
+resulting items together through `items[]`. Do not ask whether the user wants
+the list exact or refined: there is no such choice. Clarify only a genuinely
+ambiguous individual item; never turn a complete pasted list into a
+meta-choice. A direct user request to add such a list may use the normal
+bulk-enqueue path instead of drafting.
+
 ## Protocol
 
 1. If the request is vague, ask ONE focused question at a time. Offer a

package/prompts/goal-loop-plan.md

@@ -49,6 +49,16 @@ confirms.
    earn its place — decisions, constraints, and checkable outcomes only.
    Do not pad with boilerplate the user did not ask for.
 
+## Pasted list seeds
+
+When plan mode is used for `/list` and the user supplies a multi-line,
+bulleted, numbered, or checklist-style seed, preserve its item boundaries and
+wording as supplied. Normalize only import syntax and empty headings/lines;
+do not ask whether the list should be exact or refined. Clarify only a
+genuinely ambiguous individual item, never turn a complete pasted list into a
+meta-choice. Research may deepen contracts and verification, but it must not
+rewrite a clear pasted list merely to make it sound more polished.
+
 ## Hard rules (unchanged from regular drafting)
 
 - Do NOT start implementing during planning. Research is read-only.

package/scripts/release-pack-smoke.mjs

@@ -49,6 +49,7 @@ try {
     "scripts/goal-auditor-launch.mjs",
     "scripts/goal-auditor-worker.mjs",
     "scripts/release-pack-smoke.mjs",
+    "skills/glla-delegate/SKILL.md",
   ];
   const listing = run("tar", ["-tzf", tarball]);
   for (const file of required) {

package/skills/glla-delegate/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: glla-delegate
+description: "Use GLLA's audited goals and list queue from normal chat: queue explicit work, offer follow-ups before adding them, or draft a confirmed goal. Includes safe handling for pasted list-like input."
+---
+
+# GLLA delegation
+
+GLLA is not a scratch task list. A queued item becomes an audited goal, and
+when the queue is idle its first item may activate immediately. Use these
+tools in the main session only:
+
+- `list_status` is read-only and safe for inspection.
+- If the user explicitly asks to queue, add, backlog, or list work, call
+  `list_add` with the requested items. Do not turn a direct queue request
+  into an unnecessary interview.
+- If you discover a useful follow-up while doing other work, finish the
+  current request and offer to queue it first. Queue it without another
+  question only when the user has given standing permission such as
+  “queue follow-ups as you find them.”
+- If one durable, multi-hour objective is warranted, interview only what is
+  genuinely unknown, then call `propose_goal_draft`; the user's Confirm
+  dialog is the activation gate. Never activate a speculative raw seed.
+- Never call `list_activate` for an item the user has not selected or clearly
+  authorized. Never control `/loop` bounds, metrics, or stopping on the
+  user's behalf.
+
+## Pasted list-like input
+
+When the user supplies a multi-line, bulleted, numbered, or checklist-style
+list and asks to use or add it, use the structure and wording as supplied.
+Strip only import syntax and empty headings/lines, then pass the resulting
+items in one `list_add` call. Do **not** ask whether the user wants the list
+“exact” or “refined”; there is no such choice. Clarify only a genuinely
+ambiguous individual item, never turn a complete pasted list into a
+meta-choice.
+
+If a `/list` drafting session is already active, do not bypass its Confirm
+gate with `list_add`: pass the complete pasted set once as `items[]` to
+`propose_goal_draft` instead. This keeps one confirmation for the whole
+batch and prevents partial activation.
+
+Use the tools, not slash-command text, when acting. Worker and subagent
+sessions do not own GLLA state; respect a foreign-session refusal instead of
+routing around it.