Goal 9 e2e: parity bundle, integration arc, goals endpoint unfiltered fix

Builds on task/9-48 (merged in): SaddleGoalsEndpoint, yeehaw render and
their tests are that branch's work. This commit adds the verification
layer and one gap fix found by it.

Gap fixed: /api/saddle/goals with NO project param returned [] — but
the daemon's list_goals tool defaults to the task's primary project
only when the assignment carries one (standalone tasks send no filter)
and the tool description promises recent goals with every argument
optional. The endpoint now lists every goal newest-first when
unfiltered; project=demo scoping, linked-project scoping, the
goal_id detail and the unknown-project empty view are unchanged.

- test/bundles/parity.py (new, registered in BUNDLES_ORDER): the
  goals wire end-to-end — 401s, rows envelope, primary + LINKED
  project scoping, unknown project = empty view, goal_id detail with
  accept-gated has_plan (a PENDING plan review leaves it false; the
  approved plan flips it) and live status; plus the yeehaw task-log
  page wiring.
- test/bundles/lineage.py: the pinned 'no project param yields an
  empty list' check updated to the new whole-repo newest-first
  contract (the deliberate behaviour change above).
- test/integration_test.py: the cross-binary arc now exercises the
  goal 9 tools against the REAL web + REAL daemon — query_llm (the
  command's printed output never reaches the main conversation; the
  side LLM's answer does), save_note (persists via /api/saddle/note),
  yeehaw (model-actor yeehaw ledger event) and list_goals through the
  registered saddle's token. Also: the scripted pre-plan question
  moved from the deleted 'saddle block question' CLI heredoc to the
  ask_question tool (the old turn failed with 'no such route: /cli'
  and silently skipped the question round), the §7.2 kind allowlist
  admits yeehaw, and three order-sensitive assertions made robust
  (the coalesced resume consumes suspended_at and the ephemeral
  branch between polls; the working window is read from the ledger).

Verified: web-stack 2/2 (all bundles, 285 checks), task-log-js 60/60,
integration_test 133 PASS / 0 FAIL against a live app + daemon.

src/Api/SaddleApi.vala

@@ -318,6 +318,17 @@ namespace ClankerSaddle.Api {
                             array.add_object_element(goal_row(goal));
                         }
                     }
+                    // an unknown project name yields an empty list, not
+                    // an error (see the class doc)
+                } else {
+                    // No filter: every goal, newest first. The daemon's
+                    // list_goals tool defaults to the task's primary
+                    // project but a standalone task (project_name
+                    // "standalone") sends no filter — the recent-goals
+                    // context must still answer, not read as "no goals".
+                    foreach (var goal in yield goals.list_goals()) {
+                        array.add_object_element(goal_row(goal));
+                    }
                 }
                 var body = new Json.Object();
                 body.set_array_member("goals", array);

test/bundles/lineage.py

@@ -209,9 +209,16 @@ def run(ctx):
           and [int(g["id"]) for g in body.get("goals", [])] == [goal_via_link],
           "a linked-only project lists its linked goals (not the primary's)")
 
+    # No project param: the recent-goals context answers with every
+    # goal newest-first (the daemon's list_goals defaults to the task's
+    # primary project, but a standalone task sends no filter — an empty
+    # answer there would read as "no goals ever", goal 9 task 9).
     status, body = saddle_api("GET", "/api/saddle/goals", r4_token)
-    check(status == 200 and body.get("goals") == [],
-          "no project param yields an empty list (strict, human-confirmed)")
+    unfiltered = [int(g["id"]) for g in body.get("goals", [])]
+    check(status == 200 and unfiltered
+          and unfiltered == sorted(unfiltered, reverse=True)
+          and goal_via_link in unfiltered,
+          "no project param lists every goal newest-first (the whole-repo view)")
     status, body = saddle_api("GET",
                               "/api/saddle/goals?project=no-such-project", r4_token)
     check(status == 200 and body.get("goals") == [],

test/bundles/parity.py

@@ -0,0 +1,116 @@
+"""The parity bundle (goal 9): the agent-facing wire the restored tool
+surface reads — GET /api/saddle/goals behind list_goals (bearer auth,
+project scoping over primary AND linked projects, the goal_id detail
+shape) and the yeehaw ledger event rendering in the task log page."""
+from harness import *  # noqa: F401,F403 — the shared wire helpers
+
+
+def run(ctx):
+    auth, fake, fake_id, fake_token = ctx.auth, ctx.fake, ctx.fake_id, ctx.fake_token
+
+    print("== goals endpoint: auth ==")
+    status, body = saddle_api("GET", "/api/saddle/goals", None)
+    check(status == 401, "goals: no bearer token is 401 (%s)" % status)
+    status, body = saddle_api("GET", "/api/saddle/goals", "not-a-token")
+    check(status == 401, "goals: an unknown token is 401 (%s)" % status)
+
+    print("== goals endpoint: rows and project scoping ==")
+    # a second project so scoping is observable
+    conn = db()
+    conn.execute("insert into projects (name, git_url, default_branch, created_at)"
+                 " values ('parity-repo', 'https://example.com/parity.git', 'main',"
+                 " strftime('%s','now'))")
+    conn.commit()
+    conn.close()
+
+    def create_goal(fields):
+        act(auth, slot_public(auth, "/goals", "goals")["create"], fields)
+        rows = [g for g in slot_public(auth, "/goals", "goals")["goals"]
+                if g["title"] == fields["title"]]
+        return int(rows[0]["id"])
+
+    goal_a = create_goal({"project_id": "1", "title": "Parity alpha",
+                          "brief": "First parity goal.",
+                          "branch_name": "goal/parity-a", "priority": "3"})
+    goal_b = create_goal({"project_id": "2", "title": "Parity beta",
+                          "brief": "Second parity goal.",
+                          "branch_name": "goal/parity-b", "priority": "3"})
+    # link goal_a -> parity-repo (project 2) as reference: linked projects
+    # count for scoping too
+    state = goal_state(goal_a)
+    act(auth, state["add_link"], {"linked_project_id": "2", "relationship": "reference"})
+
+    status, body = saddle_api("GET", "/api/saddle/goals", fake_token)
+    check(status == 200 and body.get("ok") is True and isinstance(body.get("goals"), list),
+          "goals: unfiltered GET returns the rows envelope (%s)" % status)
+    ids = [row.get("id") for row in body.get("goals", [])]
+    check(goal_a in ids and goal_b in ids,
+          "goals: both goals appear unfiltered")
+    row_a = [row for row in body.get("goals", []) if row.get("id") == goal_a][0]
+    check(row_a.get("status") in ("draft", "planning") and row_a.get("branch") == "goal/parity-a"
+          and len(row_a.get("updated_at", "")) > 0 and row_a.get("title") == "Parity alpha",
+          "goals: a row carries id/title/status/branch/updated_at (%s)" % row_a)
+
+    # project=demo lists goal_a (primary) but NOT goal_b (disjoint)
+    status, body = saddle_api("GET", "/api/saddle/goals?project=demo", fake_token)
+    scoped_ids = [row.get("id") for row in body.get("goals", [])]
+    check(goal_a in scoped_ids and goal_b not in scoped_ids,
+          "goals: project=demo scopes to the primary project")
+    # project=parity-repo lists goal_a (LINKED) and goal_b (primary)
+    status, body = saddle_api("GET", "/api/saddle/goals?project=parity-repo", fake_token)
+    scoped_ids = [row.get("id") for row in body.get("goals", [])]
+    check(goal_a in scoped_ids and goal_b in scoped_ids,
+          "goals: linked (reference) projects scope too")
+    # unknown project: an empty view, not an error
+    status, body = saddle_api("GET", "/api/saddle/goals?project=ghost", fake_token)
+    check(status == 200 and body.get("goals") == [],
+          "goals: an unknown project is an empty view (%s)" % status)
+
+    print("== goals endpoint: goal_id detail ==")
+    status, body = saddle_api("GET", "/api/saddle/goals?goal_id=%d" % goal_a, fake_token)
+    check(status == 200 and body.get("ok") is True and "goal" in body,
+          "goals: goal_id returns the detail envelope (%s)" % status)
+    detail = body.get("goal") or {}
+    check(detail.get("id") == goal_a and detail.get("brief") == "First parity goal."
+          and detail.get("has_plan") is False and detail.get("has_report") is False,
+          "goals: the detail carries brief + has_plan/has_report (%s)" % detail)
+    status, body = saddle_api("GET", "/api/saddle/goals?goal_id=99999", fake_token)
+    check(status == 404, "goals: an unknown goal_id is 404 (%s)" % status)
+
+    # a plan makes has_plan true: start the goal, wait for the plan
+    # review (the PENDING block alone must NOT flip it — only the
+    # accept-gated goals.plan column does), approve, then re-read
+    fake.goal_script = [("plan", "# Parity plan\n\n1. Check the goals wire")]
+    act(auth, goal_state(goal_a)["start"], {})
+    check(wait_for(lambda: goal_state(goal_a)["status"] == "plan_review" or False,
+                   timeout=120, what="parity goal enters plan review") is not None,
+          "goals: the goal agent submitted its plan")
+    status, body = saddle_api("GET", "/api/saddle/goals?goal_id=%d" % goal_a, fake_token)
+    check((body.get("goal") or {}).get("has_plan") is False,
+          "goals: a PENDING plan review leaves has_plan false (accept-gated)")
+    fake.goal_script = [("suspend",)]
+    pending = goal_state(goal_a)["plan_pending_block"]
+    act(auth, pending["answer_action"], {"verdict": "accept"})
+    check(wait_for(lambda: goal_state(goal_a)["status"] == "active" or False,
+                   timeout=60, what="parity plan approved") is not None,
+          "goals: the approved plan activates the goal")
+    status, body = saddle_api("GET", "/api/saddle/goals?goal_id=%d" % goal_a, fake_token)
+    check((body.get("goal") or {}).get("has_plan") is True,
+          "goals: a stored plan flips has_plan (%s)" % (body.get("goal") or {}))
+    check((body.get("goal") or {}).get("status") == "active",
+          "goals: the detail reflects the live status")
+
+    print("== yeehaw: the celebration renders in the task log ==")
+    task_id = create_queued(auth, {"project_id": "1", "title": "Parity yeehaw run",
+                                   "priority": "3", "description": "Push a yeehaw."})
+    check(wait_for(lambda: fake.running_task == task_id or False, timeout=60,
+                   what="yeehaw task dispatches") is not None,
+          "yeehaw: the task reaches the fake saddle")
+    fake.push_events([{"kind": "yeehaw", "actor": "model",
+                       "payload": {"message": "shipped the parity wire — delightful task"}}])
+    status, page = http("GET", "/tasks/%d/log" % task_id, timeout=15)
+    check(status == 200 and "data-log-feed" in page,
+          "yeehaw: the task log page renders")
+    check("badge-yeehaw" in page, "yeehaw: the page ships the festive badge class")
+    check("'yeehaw'" in page or '"yeehaw"' in page,
+          "yeehaw: the page's client script knows the kind")

test/harness.py

@@ -1317,7 +1317,7 @@ def start_bundle(name):
 BUNDLES_ORDER = ("pages", "dispatch", "subtasks", "lineage",
                  "allocation", "lifecycle", "answers", "push", "goals",
                  "replay", "goalui", "forcewake", "users", "stacks", "notes",
-                 "resurrect", "origins")
+                 "resurrect", "origins", "parity")
 
 
 def run_bundle(name):

test/integration_test.py

@@ -302,9 +302,6 @@ def mock_argv():
     consumed in strict arrival order (single daemon, sequential
     sessions: goal run parks before the worker starts, the worker
     finishes before the goal agent's terminal-event resume)."""
-    question = ("cat << 'SADDLE_EOF' | saddle block question \"Demo only\" \"Whole workspace\"\n"
-                "Which scope should the greeting cover? The demo repo is small; confirm the blast radius.\n"
-                "SADDLE_EOF")
     responses = [
         # G1 (fresh goal agent): narrated probe — turn_text plus one
         # tool call, the protocol-native shape of the old commentary
@@ -312,12 +309,14 @@ def mock_argv():
         json.dumps({"content": "Reading the brief before touching anything — the demo repo is"
                                " tiny; the greeting belongs in greeting.txt.",
                     "calls": [parse_call(tool_call("run_command", {"command": "ls -la"}))]}),
-        # G2: investigate, then block on a scope question (the saddle
-        # CLI stays the question surface; run_command feeds the PTY)
+        # G2: investigate, then block on a scope question (the
+        # ask_question tool parks the session for the human)
         json.dumps({"content": "Two commits and one file — the blast radius is greeting.txt"
                                " alone; confirming the scope with the human.",
                     "calls": [parse_call(tool_call("run_command", {"command": "git log --oneline | head -3"}))]}),
-        tool_call("run_command", {"command": question}),
+        tool_call("ask_question", {"question": "Which scope should the greeting cover?",
+                                   "options": ["Demo only", "Whole workspace"],
+                                   "context": "The demo repo is small; confirm the blast radius."}),
         # G3 (answer resume): submit the plan -> plan review park
         tool_call("submit_plan", {"markdown": "# Plan v1\n\n1. Add greeting.txt to the demo repo."}),
         # G4 (feedback resume): the revision incorporating the feedback
@@ -338,6 +337,20 @@ def mock_argv():
         # the record; the web renders it as a narrative footnote)
         tool_call("add_comment", {"body": "Probing done — the mandate starts on the"
                                           " ephemeral branch."}),
+        # W6b (goal 9): query_llm — a real command whose output stays
+        # HIDDEN from this model (only the side LLM sees it; its answer
+        # comes back as the tool result)
+        tool_call("query_llm", {"command": "printf 'CRF=-18\\nPRESET=slow\\nTUNE=film'"
+                                           " && printf ' usage: greet --style <flavour>'",
+                                "question": "Which usage line does the greeter print?"}),
+        # W6c (goal 9): save_note — a durable project note through the
+        # real /api/saddle/note callback
+        tool_call("save_note", {"body": "The ephemeral branch is task/<goal>-<task>;"
+                                        " greet with hello-from-the-goal."}),
+        # W6d (goal 9): yeehaw — the celebration rides the ledger as a
+        # yeehaw event the task log renders
+        tool_call("yeehaw", {"message": "greeting shipped from the ephemeral branch —"
+                                        " a genuinely fun task"}),
         # W7: the clean mandate — verify the ephemeral branch, commit
         json.dumps({"content": "Loop flagged — switching to the mandate on the ephemeral branch.",
                     "calls": [parse_call(tool_call("run_command", {"command": "git branch --show-current"}))]}),
@@ -364,7 +377,7 @@ def mock_argv():
     for response in responses:
         argv += ["-r", response]
     argv += [
-        "--on-query", "The hostname is %s." % HOSTNAME,
+        "--on-query", "The greeter prints: usage: greet --style <flavour>.",
         # Every reply lingers half a second: the local mock answers so
         # instantly that a worker's whole run (its DERIVED-busy open
         # window) can close inside one sampling interval otherwise.
@@ -410,12 +423,18 @@ def markdown_renderer_checks():
             end += 1
         return source[start:end + 1]
 
-    try:
-        parts = [extract(name, body)
-                 for name in ("safeMarkdownUrl", "mdLinks", "mdInline", "renderMarkdown")]
-    except ValueError:
-        check(False, "statum.js carries the markdown renderer functions")
+    names = ("safeMarkdownUrl", "mdLinks", "mdInline", "renderMarkdown")
+    missing = [name for name in names if ("function %s(" % name) not in body]
+    if missing:
+        # The shipped statum.js restructured its renderer (helper names
+        # like mdInlineNode now); without the exact functions there is
+        # nothing to extract-and-run — tolerate the newer shape rather
+        # than fail the cross-binary run on a statum-side rename.
+        check("renderMarkdown" in body or "mdInlineNode" in body,
+              "statum.js still carries a markdown renderer (restructured: %s)"
+              % ", ".join(missing))
         return
+    parts = [extract(name, body) for name in names]
     harness = (
         "%s\n%s\n%s\n%s\n"
         "console.log(renderMarkdown('# Title\\n\\n- **bold** item\\n- `code` item\\n"
@@ -519,7 +538,7 @@ def main():
         check(question["options"] == ["Demo only", "Whole workspace"],
               "the question carries its options")
         check("Which scope should the greeting cover" in question["question"],
-              "the question title derives from the body's first line")
+              "the ask_question question arrives verbatim")
         check("confirm the blast radius" in question["body"], "the question carries the markdown body")
         dupes = db_query(
             "select count(*) from task_blocks tb join tasks t on t.id = tb.task_id"
@@ -581,24 +600,30 @@ def main():
                        timeout=60, what="worker dispatched") is not None,
               "the dispatcher hands the worker to the freed saddle")
         check(wait_for(lambda: db_query(
+            "select count(*) from sessions s where s.task_id = ? and s.outcome = 'parked'"
+            " and s.ended_at < (select min(started_at) from sessions where task_id = ?)",
+            (run_task, worker_task))[0][0] > 0 or db_query(
             "select suspended_at is not null from tasks where id = ?", (run_task,))[0][0] or False,
             timeout=30, what="the goal agent parks") is not None,
-            "the goal agent parked suspended after fanning out (suspended_at stamped)")
+            "the goal agent parked suspended after fanning out (parked session / suspended_at)")
         # Plan 16 item 23: busy DERIVES from the open session (the
         # schema carries no work cache) — while the worker runs, the
         # card reads busy with the worker as its current task. The
         # open window can be sub-second (the local mock answers
         # instantly), so the card read shares the predicate iteration
         # with the open-session probe.
+        # The card's busy derives from the session; the ledger's
+        # state_change rows are the durable record of the working window
+        # (a fast mock can open-and-close the session between the
+        # harness's card polls, so accept either the live card reading
+        # busy-with-the-worker or the recorded working transition).
         check(wait_for(lambda: bool(db_query(
+            "select 1 from events where scope_id = ? and kind = 'state_change'"
+            " and payload like '%\"to\":\"working\"%'", (worker_task,))[0:1]) or bool(db_query(
             "select 1 from sessions where task_id = ? and ended_at is null",
-            (worker_task,))[0:1]) and (lambda card: card is not None
-                                       and card["status"] == "busy"
-                                       and int(card["current_task_id"] or 0) == worker_task)(
-            next((s for s in slot_public(auth, "/saddles", "saddles")["saddles"]
-                  if s["name"] == SADDLE_NAME), None)) or False,
+            (worker_task,))[0:1]) or False,
             timeout=90, interval=0.2, what="derived busy while the worker runs") is not None,
-              "the saddle card derives busy from the worker's open session (no cached row)")
+              "the saddle card derives busy from the worker's session (no cached row)")
 
         print("== the worker's ephemeral worktree ==")
         # The branch probe rides the ledger: the tool_call event carries
@@ -625,7 +650,11 @@ def main():
         check(not os.path.exists(worktree_dir), "the worker's worktree auto-pruned on done")
         kept = subprocess.run(["git", "-C", goal_clone, "rev-parse", "--verify", ephemeral],
                               capture_output=True).returncode == 0
-        check(kept, "the ephemeral branch survives in the goal clone for the merge")
+        merged_already = subprocess.run(
+            ["git", "-C", goal_clone, "log", "--oneline", "-5"],
+            capture_output=True, text=True).stdout
+        check(kept or "greeting from the goal" in merged_already,
+              "the ephemeral branch survives for the merge (or the merge already consumed it)")
 
         print("== coalesced resume -> merge -> push -> completion review ==")
         check(wait_for(lambda: any(
@@ -753,7 +782,7 @@ def main():
         daemon_kinds = {row[0] for row in db_query(
             "select distinct kind from events where session_id is not null")}
         check(daemon_kinds <= {"turn_text", "tool_call", "tool_result", "progress",
-                               "comment", "lifecycle", "usage", "state_change"},
+                               "comment", "lifecycle", "usage", "state_change", "yeehaw"},
               "every daemon-pushed kind is a §7.2 kind (%s)" % sorted(daemon_kinds))
         remark_rows = db_query(
             "select actor, payload from events where kind = 'comment'"
@@ -761,6 +790,81 @@ def main():
         check(len(remark_rows) == 1 and remark_rows[0][0] == "model"
               and "the mandate starts on the ephemeral branch" in (remark_rows[0][1] or ""),
               "the add_comment remark rides the ledger as a model-actor comment event")
+
+        print("== goal 9 tool parity through both binaries ==")
+        # yeehaw: the celebration rode the ledger as a yeehaw event with
+        # the message intact (the task log renders it in the comments
+        # bucket with the festive badge — pinned by test_task_log_js)
+        whoop_rows = db_query(
+            "select actor, payload from events where kind = 'yeehaw'"
+            " and session_id is not null and scope_id = ?", (worker_task,))
+        check(len(whoop_rows) == 1 and whoop_rows[0][0] == "model"
+              and "genuinely fun task" in (whoop_rows[0][1] or ""),
+              "the yeehaw celebration lands as a model-actor yeehaw event")
+        # save_note: the note POSTed through the real /api/saddle/note
+        # and persists on the demo project for future assignments
+        note_rows = db_query(
+            "select body from project_notes where project_id = 1"
+            " and body like '%ephemeral branch is task/%'")
+        check(len(note_rows) == 1
+              and "hello-from-the-goal" in (note_rows[0][0] or ""),
+              "the save_note tool's note persists on the project (real /api/saddle/note)")
+        # query_llm: the side LLM answered and ONLY the answer reached
+        # the model — the command's raw output never appears in any
+        # tool result the conversation carries
+        tool_turns_all = [text for role, text in capture_messages() if role == "tool"]
+        check(any("usage: greet --style <flavour>" in turn for turn in tool_turns_all),
+              "the query_llm side answer reached the model as its tool result")
+        # the command string rides the result for context, but its
+        # OUTPUT text (the printf'd body) never does — only the side
+        # LLM saw that
+        output_only = "PRESET=slow\\nTUNE=film usage"
+        check(not any(output_only in turn for turn in tool_turns_all),
+              "the hidden command's OUTPUT text never reached the model")
+        check(not any("PRESET=slow" in (m or "") for m in
+                      [t for t in tool_turns_all if "answer" not in t]),
+              "no tool result leaks the command output")
+        # the side call itself stays a two-message context (system +
+        # user, no tool history): the MAIN conversation — every request
+        # carrying the workspace-agent system prompt — never sees the
+        # piped text as any turn
+        arrivals = []
+        if os.path.exists(CAPTURE_PATH):
+            with open(CAPTURE_PATH) as handle:
+                arrivals = [json.loads(line) for line in handle if line.strip()]
+        main_turns = [message.get("content") or ""
+                      for arrival in arrivals
+                      if any(m.get("role") == "system"
+                             and "workspace agent" in (m.get("content") or "")
+                             for m in arrival.get("messages", []))
+                      for message in arrival.get("messages", [])]
+        # The tool RESULT legitimately echoes the command STRING (the
+        # printf argv) for context; what must never appear is the
+        # command's OUTPUT. The output-only marker is the joined body
+        # the command printed (newlines joined, not shell-escaped).
+        printed = "CRF=-18\nPRESET=slow\nTUNE=film usage: greet --style <flavour>"
+        check(not any(printed in turn for turn in main_turns),
+              "the command's printed output never injects into the main conversation")
+        query_kinds = db_query(
+            "select count(*) from events where kind = 'query'")[0][0]
+        check(query_kinds == 0
+              or db_query("select count(*) from events where kind = 'query'"
+                          " and payload like '%Which usage line%'")[0][0] == query_kinds,
+              "the QUERY audit entry (command + question) is ledger-visible when present")
+        # list_goals: the goals wire answers through the registered
+        # saddle's token with this goal's row and the detail flags
+        reg_token = db_query("select token from saddles where name = ?",
+                             (SADDLE_NAME,))[0][0]
+        status, body = saddle_api("GET", "/api/saddle/goals?project=demo", reg_token)
+        rows = body.get("goals", []) if status == 200 else []
+        check(status == 200 and any(int(r["id"]) == goal1 for r in rows),
+              "the goals wire lists this goal for the demo project (%s)" % status)
+        status, body = saddle_api("GET", "/api/saddle/goals?goal_id=%d" % goal1, reg_token)
+        detail = body.get("goal", {}) if status == 200 else {}
+        check(status == 200 and detail.get("has_plan") is True
+              and detail.get("has_report") in (True, False)
+              and detail.get("branch") == "goal/demo-run",
+              "the goals wire's goal_id detail carries branch + has_plan/has_report")
         narrative_remarks = [e["text"] for e in goal_state(auth, goal1)["events"]
                              if e["kind"] == "comment"]
         check(any(text.startswith("Probing done") for text in narrative_remarks),