The GOAP-lite Selector Built behind a flag · pilot pending

How a goal-directed group of states picks its next state — deterministically, from the slot contract, while the LLM stays language-only. This is phase 7 (the last) of the goal hierarchy.

What & why

Today a flow's states are wired into a hand-authored chain: ask_name → ask_phone → ask_address. That chain is brittle — it can't adapt when a caller front-loads three facts at once, or withholds one, or answers out of order. The GOAP-lite selector replaces the chain inside a GoalSegment: the segment owns a slot contract, and after every caller turn the FSM recomputes which member state to enter next, based on which target slots are still unfilled. The member states become capabilities ("I can collect name + phone") rather than fixed next-steps.

Why “GOAP-lite”?

GOAP (Goal-Oriented Action Planning, from game AI — F.E.A.R.) picks actions by their preconditions and effects to reach a goal, instead of hard-coding behavior chains. Full GOAP runs a planner (A* over world states) — too open-ended and opaque for a phone call where every “tick” is an expensive caller turn and safety demands determinism.

RIFF borrows only the idea, not the planner: states declare what slots they collect/repair and their preconditions, and the selector does one cheap, deterministic thing — pick the next state that can satisfy the next missing slot. No search, no planner opacity. That’s the “-lite.”

The mechanism

The whole selector is this pure function — deterministic, no LLM in the loop:

# the FSM picks the next member state of a GoalSegment
def choose_next(segment, ctx):
    apply_slot_observations(ctx)               # extraction/validation only
    if exit_guard(segment, ctx):               return segment.exit_target
    repair = first_repair_needed(segment, ctx) # a slot invalid / low-confidence?
    if repair:                                 return repair.state
    slot = first_unsatisfied_slot(segment, ctx)
    if slot is None:                           return segment.exit_target
    candidates = [s for s in states_that_collect(slot) if preconditions_hold(s, ctx)]
    if not candidates:                         return segment.fallback_state
    return min(candidates, key=deterministic_cost_tuple)

Read it top to bottom: validate what we have → can we leave? → is anything broken (repair first)? → what’s the next missing slot? → which state can collect it? → pick deterministically. The order encodes the policy.

Failure modes & deterministic defenses

The dual gate (how it stays safe)

The selector hooks into StateManager.evaluate_next_step at exactly one place — after the declared transitions: loop and before the missing-slot ask fallback. So authored exits, tool/confirm branches, and the when: stalled recovery all still win; the selector only acts when no declared edge fired. And it acts only behind two locks:

# riff/state_manager.py — evaluate_next_step, after the declared transition loop
if os.environ.get("RIFF_GOAP_SELECTOR") == "1":          # lock 1: runtime flag
    seg = active_segment_for_state(self.flow, ctx.current_state)
    if seg is not None:                                 # lock 2: state is in a selector:goap_lite segment
        dec = choose_next(self.flow, seg, ctx, evaluate_guard)
        if dec and dec.to_state != ctx.current_state:
            return NextStep(recommended_action="transition", candidate_transition=dec.to_state, ...)

With the flag unset (default), the first if is false and the whole block is skipped — proven no-op: 121 unit tests pass unchanged, and weather/coffee/austin_plumbing score 10.0 with RIFF_GOAP_SELECTOR=1 (they have no goap segments, so lock 2 never opens). With the flag on and a member state, the selector routes deterministically: e.g. ask_name with the name filled → ask_phone for the next missing slot, “goap_lite: collect phone via ask_phone”.

What's shipped vs. remaining

The hardest, riskiest piece — deterministic recovery when a caller stonewalls a required slot — shipped earlier as the stalled guard + sets: primitive (commit e22399d), which is choose_next’s fallback_state branch made concrete. See Stall recovery. What remains is hardening (lint) and proving it on a real flow (pilot + held-out), not the core mechanism.

Use case

A booking flow’s collect segment has three target slots (name, phone, address) and three member states. A cooperative caller front-loads all three in one breath: the selector sees all slots filled, exit_guard passes, and it jumps straight to read-back — no walking empty “ask” states. A withholding caller gives only two: the selector routes to the state that collects the third; if they keep stonewalling, the stalled recovery edge books a default and exits gracefully instead of looping to escalation. One contract, every caller shape handled — without a hand-wired chain.

Where it fits

The selector is the action half of the goal hierarchy: the GoalSegment schema declares the contract, the group-cohesion metric measures how well a group’s states already work together, and the selector is how a group would be driven to maximize that cohesion — deterministically, with the LLM kept to language. It is the last phase precisely because it depends on everything below it being in place.