pi-goal-list-loop-audit 0.38.53 → 0.38.55

package/CHANGELOG.md

@@ -1,5 +1,80 @@
 # Changelog
 
+## 0.38.55 — Full-parity terminal card, lenient auditor, agent resume (2026-09-16)
+
+### Full-parity terminal card
+
+The post-objective summary now shares everything the archive knows (owner:
+full parity with the long example closes): a `## Done — auditor …`
+verdict banner opens the card, findings/values render uncapped (Next
+keeps the one-concrete-action rule — DECIDED 2026-09-15), the
+verification table always renders in full (the green PASS-line collapse is
+retired), gate rows carry an optional repro `command` with its own Command
+column, commit hashes stay visible, and a `### Final Repository State`
+section (branch, HEAD, tree cleanliness, best-effort) closes the card
+ahead of the record trailer. One surface per fact is preserved: the banner
+owns the verdict, the footer stays liveness-only.
+
+### Agent-side resume
+
+Agent-side resume (field incident Screenshot_20260916_090307): a paused goal
+whose blocker the user waives in conversation no longer bounces back to the
+user as a pointless `/goal resume` round-trip. The new `resume_goal` tool is
+the agent-side equivalent of `/goal resume` — same ownership/staleness
+admission, but it schedules nothing (the live turn owns what happens next)
+and refuses everything it must not touch: live loops, `/glla pause` freezes,
+pending main-model recovery, stale sessions, and non-paused states name the
+real user command. A cold-load hold releases like any explicit work command
+(same as `/goal resume`); a stored completion claim re-fires through a new
+`agent` audit origin with the manual-equivalent fresh cycle. The paused
+`complete_goal` refusal now points at `resume_goal` first.
+
+### Auditor retries like main (unified recovery envelope)
+
+Field evidence (hellhunter/junk-runner 2026-09-16): a burned auditor
+candidate chain parked with "automatic recovery is stopped" while the
+main model would have kept probing for hours. The auditor is just
+provider requests, so it now reuses the same retry/accounting machinery:
+a burned chain clears its cursor and enters the shared durable-retry
+ladder (eager 5s, then hourly :00:30 probes, 24h horizon; no
+auditor-only attempt cap), a recognizably backend-side failure (5xx, network,
+auth, or quota-wall wording) skips its backend's other rungs instead of
+burning a launch each — while an ambiguous worker death still walks the
+chain so the session fallback is tried — and parked auditor claims ride the
+shared hourly ticker as a backstop. The card now reads "next:
+auto-retry in …" while the ladder owns the wait; "automatic recovery
+is stopped" remains only for a genuinely unrecoverable cursor-
+persistence failure.
+
+## 0.38.54 — Opt-in context-checkpoint projection (2026-09-14)
+
+The per-turn `context`-hook projection rewrote history on every turn, busting
+the provider prefix-cache (upstream issue #53). Projection is now opt-in:
+the hook leaves the transcript append-only by default so the cache holds
+across turns, while the fresh continuation prompt still carries live durable
+state every turn.
+
+### Added
+
+- **`contextCheckpointProjection` setting (default off):** explicit opt-in
+  restores the legacy per-turn splice of a bounded continuation checkpoint.
+  Carried in `SETTINGS_KEYS` with junk-normalization to unset, a row in the
+  `/glla` settings Other tab with an on/off editor, and a `docs/SETTINGS.md`
+  entry (release-gate docs coverage holds).
+
+### Fixed
+
+- **Prompt-cache continuity:** with projection off (the default) the hook
+  returns no message rewrite and records no projection event, preserving
+  cache-prefix reuse turn over turn.
+
+### Tests
+
+- Both hook paths pinned (default-off passthrough + opt-in splice), junk
+  normalization, menu row off/default, editor round-trip, and docs coverage.
+  Full suite 2163 pass / 2 skip / 0 fail; `tsc` clean; `git diff --check`
+  clean.
+
 ## 0.38.53 — Consent-safe GLLA delegation skill and list-draft staging (2026-09-13)
 
 Added the packaged `glla-delegate` skill for normal-chat goal/list delegation.

package/INSTALL.md

@@ -31,11 +31,11 @@ GLLA loads into new pi sessions. If pi is already open, reload that session:
 
 ## Updating
 
-The status line always shows the running version (`glla: … · v0.38.48`).
+The status line always shows the running version (`glla: … · vX.Y.Z`).
 When the npm registry is ahead, it also nudges:
 
 ```text
-glla: … · v0.38.47 · update v0.38.48 available
+glla: … · vX.Y.Z · update vA.B.C available
 ```
 
 The nudge comes from a daily sidecar check (`.pi-glla/update-check.json`),
@@ -117,10 +117,16 @@ waiting for a decision.
 ```text
 /list "refactor the cache. Done when: tests pass"
 /list plan.md
-/list
+/list                                     # interview + Confirm for a context draft
+/list show                                # show active and waiting items
+/list add <text...>                        # queue one item directly (no interview)
+/list import <file>                        # import a file: one Confirm for the whole batch
 /list start
 /list next
 /list resume
+/list remove <n>
+/list clear
+/list cancel
 
 /loop
 /loop start                                  # one clear recent target, metricless

package/README.md

@@ -166,18 +166,22 @@ quietly inventing an unbounded backlog.
 /list remove <n>
 /list clear
 /list cancel                               # stop the active item and drop waiting items
+/list add <text...>                        # queue one item directly (no interview)
+/list import <file>                        # import a file: one Confirm for the whole batch
 ```
 
 A pasted multi-line, bulleted, numbered, or checklist-style list keeps its
 item wording and boundaries; GLLA does not ask for an “exact or refined” choice.
-Only a genuinely ambiguous individual item needs clarification. The packaged
+Only a genuinely ambiguous individual item needs clarification. The direct
+`/list add` path skips the interview but not consent: pasted text and files
+still get one Confirm for the whole batch before anything is queued. The packaged
 `skills/glla-delegate/SKILL.md` records the safe normal-chat delegation path:
 explicit queue requests may use `list_add`, while discovered follow-ups are
 offered first and durable goals remain Confirm-gated.
 
 Order is the default, not the law. Automatic advance normally uses the head of
 the queue, while `/list next <n>` or the agent's `list_activate` tool can choose
-another item. Numbering always matches `/list` output. After a list item is
+another item. Numbering always matches `/list show` output. After a list item is
 approved and archived, the next queued item starts automatically; no manual
 `/list next` is needed between items.
 
@@ -313,9 +317,9 @@ GLLA is the supervisor. These companions add capabilities around it:
   count + `/glla agents`. If you see the same run stacked 3× or panels
   swapping order, set pi-subagents `inlineToolDisplay: "summary"` (one
   stable row per run) and pin `fleetViewPlacement`; GLLA's own richness is
-  the `subagentDisplayRichness` setting (`/glla` → Subagents): `rich`
-  (default: worker rows + task linkage), `compact` (count line), `quiet`
-  (hung/aborting workers only). Upstream triple-render report:
+  the `subagentDisplayRichness` setting (`/glla` → Subagents): `quiet`
+  (default: troubled workers + the count line; HUNG is never silent),
+  `compact` (count line), `rich` (all worker rows). Upstream triple-render report:
   nicobailon/pi-subagents#1931.
 
 Install (or keep pinned):

package/docs/DESIGN-long-running-supervision.md

@@ -115,10 +115,14 @@ and the status/history surfaces. The human layer in chat, transcript, and the
 archive's `## Terminal summary` renders the same facts as rich sections
 (`## Done: <objective> — <outcome>`, duration line, Key Findings grouped by area
 or tabulated at 4+ groups with per-finding `Test Results:` proof lines,
-Verification Summary table — widened to Quality Gate | Scope | Status | Notes
-with derived statuses when the agent supplies a gate inventory — Next, capped
-and clipped
-to fixed budgets). Width-bound and external surfaces (status line, widget card,
+Verification Summary table — widened to Quality Gate | Command | Scope |
+Status | Notes when any gate row carries a repro command, else Quality
+Gate | Scope | Status | Notes — with derived statuses when the agent
+supplies a gate inventory — uncapped findings/values (Next keeps the
+one-concrete-action rule), and a Final
+Repository State section (branch, HEAD, tree) closing the card behind a
+verdict banner that opens it (`## Done — auditor approved (N verdicts)`
+and siblings). Width-bound and external surfaces (status line, widget card,
 external notifies) use the compact single-line projection of all six labels.
 Every terminal goal notification, including version-bearing already-shipped claims,
 explicit goal/list cancellation, and `/glla wipe`, carries either the rich sections

package/docs/DESIGN-subagent-visibility.md

@@ -96,7 +96,8 @@ silence ages re-laid out the editor every tick). v0.38.22 keeps the doctrine's
 safety property by other means — `renderAgentsWidgetLines` buckets silence
 ages exactly like the compact line, so the widget key only moves on genuine
 state transitions — and restores rich ambient rows behind the
-`subagentDisplayRichness` ladder (`rich` default / `compact` / `quiet`, HUNG
+`subagentDisplayRichness` ladder (`quiet` canonical default since the
+2026-09-07 flip — `rich` was the default before / `compact` / `quiet`, HUNG
 never silent), plus — until v0.38.23 — the task-linkage header
 (`→ <objective>`) only GLLA can show. v0.38.23 removes the header (the
 card head already names the objective), collapses worker rows to one

package/docs/DESIGN.md

@@ -546,7 +546,7 @@ active → auditing          (complete_goal called)
 auditing → complete        (auditor <approved/>)
 auditing → active          (auditor <disapproved/>; reset iteration counter)
 active → paused            (pause_goal called, or stuck > 5 min, or empty turn)
-paused → active            (user /goal resume)
+paused → active            (user /goal resume, or resume_goal when the user authorized continuation in conversation)
 active → aborted           (user /goal cancel)
 ```
 

package/docs/INDEX.md

@@ -16,7 +16,7 @@ Policy contracts and recent changes live in the `audit/` directory of the
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.53 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.55 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen
@@ -25,14 +25,16 @@ Policy contracts and recent changes live in the `audit/` directory of the
   extensions, bounded zero-stream retry containment, crash-safe persistence,
   packed-artifact release verification, and the 2026-09-07 display/lifecycle/
   settings audit pass (abort-latch send guards, ownership compare-and-swap,
-  auditor inherit/clear parity), the v0.38.53 consent-safe `glla-delegate`
-  skill/list-drafting release, and the v0.38.25 post-objective summary
-  (canonical approval render, persist + replay, audit-goal counts line), the v0.38.27 selective port of PRs #45/#46 (`/loop pause` soft-hold, widget subtask count), the v0.38.28 provenance-row closure fix, and the v0.38.29 compact active-card recovery/judgment projection; see CHANGELOG.md for the full trail.
+  auditor inherit/clear parity), the v0.38.25 post-objective summary
+  (canonical approval render, persist + replay, audit-goal counts line), the v0.38.27 selective port of PRs #45/#46 (`/loop pause` soft-hold, widget subtask count), the v0.38.28 provenance-row closure fix, the v0.38.29 compact active-card recovery/judgment projection, and the v0.38.53 consent-safe `glla-delegate`
+  skill/list-drafting release, and the v0.38.54 opt-in context-checkpoint
+  projection (prompt-cache continuity, issue #53), and the v0.38.55 full-parity
+  terminal card, unified auditor-retry envelope, and agent-side resume_goal;
+  see CHANGELOG.md for the full trail.
 - `../README.md`: what the plugin is, install, quickstart, and the
   architectural guarantee (drafting + confirm + detached auditor).
-- `../INSTALL.md`: source install / local development setup; the recommended
-  companion plugins and the `auditor reads / writes are path-checked`
-  note.
+- `../INSTALL.md`: source install / local development setup and the
+  recommended companion plugins.
 
 ## Entry points
 - `../README.md`: what the plugin is, install, quickstart

package/docs/SETTINGS.md

@@ -73,6 +73,7 @@ copies are ignored (the recovery runtime reads the global file):
 | `subagentModelStrategy` | `"inherit-parent"` | Default subagent model policy for new sessions. |
 | `subagentModelOverrides` | unset | Per-agent-type model pin; always wins over strategy. |
 | `subagentFallbacks` | unset | Per-role fallback chains (first eligible ref wins). |
+| `subagentDisplayRichness` | `"quiet"` | Ambient worker UI: `"quiet"` (default, troubled workers + count line) / `"compact"` / `"rich"`. |
 | `aggressiveMode` | `true` | Keep-going defaults (`false` = pause-first policy). |
 | `stuckMaxInterventions` | `5` (10 aggressive) | Consecutive stuck interventions before a loop stops. |
 | `subagentHangEscalationMinutes` | `30` | Confirmed no-progress minutes before child-specific abort (`0` = warn only). |
@@ -82,4 +83,5 @@ copies are ignored (the recovery runtime reads the global file):
 | `stallSimilarityThreshold` | `0.6` | Trigram similarity above this (tool-less) is a nudge. |
 | `postaudit` | unset | Post-completion audit config (same shape as legacy `reviewer`). |
 | `toolOverrides` | unset | Per-tool allow/hide/per-tool-config overrides. |
+| `contextCheckpointProjection` | `false` (off) | Per-turn `context`-hook splice of a bounded continuation checkpoint. Off (default) leaves the transcript append-only so the provider prefix-cache holds; the fresh continuation prompt still carries live state. On restores the legacy projection (busts the cache). |
 | `reviewer` | legacy | Deprecated alias for `postaudit`; migrated on load, `postaudit` wins. |

package/extensions/approval-render-store.ts

@@ -20,8 +20,11 @@ const MAX_STORED_RENDERS = 20;
 const MAX_REPLAY_PER_CONTACT = 5;
 // v0.38.30 audit: bound the sidecar behind the "each is ~1KB" comment — a
 // long approval trailer used to grow the 20-entry file without bound.
-const MAX_RENDER_CHAT_LINES = 60;
-const MAX_RENDER_LINE_CHARS = 1000;
+// v0.38.55 audit: raised for the uncapped full-parity card (findings +
+// full table + repo state routinely exceed 60 lines) — a stored render
+// must replay verbatim, so the store bound stays above realistic cards.
+const MAX_RENDER_CHAT_LINES = 150;
+const MAX_RENDER_LINE_CHARS = 2000;
 
 export function approvalRenderStorePath(cwd: string): string {
   return path.join(piGlaDir(cwd), "pending-approval-renders.json");