Hi,
Alerts (deliveries) don't have access to workflow's vars. You have to ship data through one of the activity's properties, usually title or message.
In the initialization script of the alert activity (under Advanced), add this:
activity.message = instance.vars.items;
And then in your alert:
<% var items = new XML(dataSource.message); ... %>
I have a library that formalizes this approach and provides a shared scope across workflows and deliveries, should be how the product works really.
Thanks,
-Jon