feat(goal-loop): harness-owned persistence loop that works until the goal is complete #1001

Motivation

Agents stop too early. A model ends its turn at the first natural pause, leaving multi-step objectives half-finished until a human re-prompts. Agent Code owns the send interface (SessionManager.deliverPromptToAgent) and observes every turn boundary (turn_completed semantic events), so the harness — not the model — should keep an agent working until a goal is genuinely complete.

Prior art researched: provider Stop hooks are rejected as the driver (Claude Code force-stops after 9 consecutive blocks — kills every ralph/ultrawork-style mode; OpenCode has no block-capable Stop hook). Ralph Wiggum (official Anthropic plugin) validates the shape: persistence + explicit completion signal + iteration cap. Full analysis in the design spec.

Intended behavior

• New built-in MCP domain goal_loop with two tools:
  • goal_loop_start(goal, loopPrompt) — the agent writes the continuation prompt itself when the user asks to "run a loop on X".
  • goal_loop_complete(outcome: 'done' | 'blocked', summary) — breaks the loop; instructed to be called only when the goal is utterly and completely satisfied, blocked for honest needs-the-user exits.
• Harness-owned GoalLoopService (main process): on turn_completed without completion, delivers the continuation prompt (with iteration N/cap header) via deliverPromptToAgent. One active loop per session.
• User prompts mid-loop are steering, not breaks; loop resumes after the steered turn settles.
• Safety: iteration cap (default 25) that pauses with a control modal (resume / raise / stop); paused(error) after 3 consecutive delivery failures; durable state so crashes surface as paused(interrupted).
• Control modal: live goal/iteration/state view plus pause/resume/raise-cap/stop actions; palette commands (goal-loop-preview, goal-loop-stop); Cmd+Shift+G peek; Settings row, default-on.

Acceptance criteria

• goal_loop_start / goal_loop_complete callable over the real built-in MCP host, scoped to the owning session (cross-session calls rejected)
• Loop continues across idle turns without any provider hooks, for Claude, Codex, and OpenCode sessions
• Cap pauses (never hard-kills) and the modal can resume / raise / stop
• User steering during an active loop does not break or double-deliver
• App restart surfaces the loop as paused(interrupted) with one-click resume
• Unit + system tests per the spec's testing section; npm run check relevant gates pass (typecheck, keybindings)

Design spec: docs/superpowers/specs/2026-09-18-goal-loop-design.md on feat/agent-goal-loop.