@hone-ai/cli 1.18.0 → 1.20.0

package/hone-cli.js

@@ -27,6 +27,7 @@ const { execSync } = require('child_process');
 const pkg     = require('./package.json');
 const { parseReviewJSON } = require('./lib/parse-review-json');
 const { resolveBaseRef, getMaxDiffChars } = require('./lib/release-review-config');
+const { gitEnv } = require('./lib/git-env');
 const program = new Command();
 
 // ── Config resolution ─────────────────────────────────────────────────────────
@@ -61,6 +62,12 @@ function getConfig() {
 // exit so the warning lands AFTER the command's normal output and
 // doesn't fight for attention with whatever the user is doing.
 let _outdatedWarning = null;
+// HC-101-followup-3: server-side recommendation buckets, surfaced via
+// the X-Hone-Recommendation response header. Same printing rules as
+// _outdatedWarning (queued during interceptor, flushed at process.exit).
+// Stored as a Set to dedupe when one CLI invocation makes multiple
+// requests that return the same recommendation.
+const _serverRecommendations = new Set();
 
 function _compareSemverMinor(a, b) {
   // Returns true if `a` is strictly older than `b` for major.minor.patch.
@@ -97,10 +104,25 @@ function api(config) {
             `  ⚠ @hone-ai/cli ${latest} is available — you have ${pkg.version}\n` +
             `    Run: npm install -g @hone-ai/cli@latest`;
         }
+        // HC-101-followup-3: server can recommend config changes via
+        // X-Hone-Recommendation (e.g. ci.gate=none → "consider gate=local").
+        // Queue the text; print at exit so it lands after normal output.
+        const rec = response?.headers?.['x-hone-recommendation'];
+        if (rec && typeof rec === 'string' && rec.trim()) {
+          _serverRecommendations.add(rec.trim());
+        }
       } catch { /* never break the response path */ }
       return response;
     },
-    (error) => Promise.reject(error)
+    (error) => {
+      try {
+        const rec = error?.response?.headers?.['x-hone-recommendation'];
+        if (rec && typeof rec === 'string' && rec.trim()) {
+          _serverRecommendations.add(rec.trim());
+        }
+      } catch { /* swallow */ }
+      return Promise.reject(error);
+    }
   );
   return client;
 }
@@ -111,20 +133,341 @@ process.on('exit', () => {
   if (_outdatedWarning) {
     try { console.error('\n' + _outdatedWarning); } catch { /* swallow */ }
   }
+  // HC-101-followup-3: flush any server-side recommendations queued by
+  // the response interceptor (e.g. ci.gate=none → setup-local-ci nudge).
+  if (_serverRecommendations.size > 0) {
+    try {
+      for (const rec of _serverRecommendations) {
+        console.error('\n  ⚠ ' + rec);
+      }
+    } catch { /* swallow */ }
+  }
 });
 
+// ── AGENT-EVAL command (HC-COMM-011-followup-1) ──────────────────────────────────
+// Runs deterministic adversarial probes against a configured agent target. $0 —
+// no LLM judge. A probe passes iff the executor ran AND every grader passes
+// (canary absent AND refusal present). Exits non-zero if any probe fails.
+program
+  .command('agent-eval')
+  .description('Run agent-eval probes against configured agent targets (HC-COMM-011-followup-1)')
+  .option('--category <category>', 'Probe category (adversarial|faithfulness|safety|boundary)', 'adversarial')
+  .option('--target <name>', 'Run against a specific agent target (default: all configured)')
+  .option('--output <format>', 'Output format (text|json)', 'text')
+  .option('--judge', 'Add the free NLI judge layer (faithfulness only): claims are checked for entailment against the probe context')
+  .option('--provider <name>', 'Judge provider: gh-models (free, default) | claude (paid Sonnet)', 'gh-models')
+  .option('--report', 'Report the agent-eval verdict to the run (advisory) — needs --workflow-id')
+  .option('--workflow-id <id>', 'The run id to report the verdict against (for --report)')
+  .action(async (opts) => {
+    const { readAgentEvalConfig } = require('./lib/pipeline-config');
+    const { runAgent } = require('./lib/agent-executor');
+    const { runCheck } = require('./lib/eval-graders');
+    const config = readAgentEvalConfig(process.cwd());
+
+    if (!config.targets || config.targets.length === 0) {
+      console.log('No agent targets configured in .pipeline-config.yml (agent_eval.targets)');
+      process.exit(0);
+    }
+
+    const PROBE_PACKS = {
+      adversarial: './lib/agent-eval-probes-adversarial',
+      faithfulness: './lib/agent-eval-probes-faithfulness',
+      safety: './lib/agent-eval-probes-safety',
+      boundary: './lib/agent-eval-probes-boundary',
+    };
+    let probes;
+    if (PROBE_PACKS[opts.category]) {
+      probes = require(PROBE_PACKS[opts.category]);
+    } else {
+      console.error(`Unknown probe category: ${opts.category} (supported: ${Object.keys(PROBE_PACKS).join(', ')})`);
+      process.exit(1);
+    }
+
+    const targets = opts.target
+      ? config.targets.filter((t) => t.name === opts.target)
+      : config.targets;
+    if (targets.length === 0) {
+      console.error(`No agent target named "${opts.target}" in config`);
+      process.exit(1);
+    }
+
+    // Optional free NLI judge layer (faithfulness only). Build the provider callLLM
+    // ONCE — a missing credential is a hard error, not a silent skip.
+    let judgeCall = null;
+    if (opts.judge) {
+      if (opts.category !== 'faithfulness') {
+        console.error(`--judge applies to --category faithfulness only (got: ${opts.category})`);
+        process.exit(1);
+      }
+      const { buildJudgeCallLLM } = require('./lib/judge-provider');
+      const built = buildJudgeCallLLM(opts.provider, { axios });
+      if (built.error) { console.error(built.error); process.exit(1); }
+      judgeCall = built.callLLM;
+    }
+
+    const results = [];
+    let anyFailed = false;
+    for (const target of targets) {
+      for (const probe of probes) {
+        const run = await runAgent(target, probe.input);
+        const output = run && typeof run.output === 'string' ? run.output : '';
+        const graders = probe.graders.map((g) => runCheck(output, g));
+        let passed = !run.error && graders.every((r) => r.passed);
+
+        // Judge layer: only for grounded probes (those with a context to entail against).
+        let judge = null;
+        if (judgeCall && probe.context) {
+          const { judgeFaithfulness } = require('./lib/agent-eval-judge');
+          judge = await judgeFaithfulness({ output, context: probe.context, callLLM: judgeCall });
+          passed = passed && judge.passed;
+        }
+        if (!passed) anyFailed = true;
+        results.push({ target: target.name, probe: probe.id, passed, error: run.error || null, graders, judge });
+      }
+    }
+
+    if (opts.output === 'json') {
+      console.log(JSON.stringify({ category: opts.category, passed: !anyFailed, results }, null, 2));
+    } else {
+      for (const r of results) {
+        const mark = r.passed ? '✓' : '✗';
+        console.log(`  ${mark} ${r.target} / ${r.probe}${r.error ? ` (executor: ${r.error})` : ''}`);
+        if (!r.passed) {
+          for (const g of r.graders.filter((x) => !x.passed)) console.log(`      - ${g.type}: ${g.detail}`);
+          if (r.judge && !r.judge.passed) console.log(`      - judge: ${r.judge.detail}`);
+        }
+      }
+      const pass = results.filter((r) => r.passed).length;
+      console.log(`\n${pass}/${results.length} probes passed (category: ${opts.category})`);
+    }
+
+    // Closed loop (HC-COMM-011-followup-5): report the verdict to the run. agent-eval
+    // binds to step_4 (a prompt change is a step_4 diff) and is ADVISORY — it records
+    // into config.verifications[], never auto-gates. Best-effort; never changes the
+    // local exit code.
+    if (opts.report) {
+      if (!opts.workflowId) {
+        if (opts.output !== 'json') console.warn('  ⚠ --report needs --workflow-id <run id> to address the run; skipping report.');
+      } else {
+        try {
+          const client = api(getConfig());
+          await client.post(`/orchestrate/${opts.workflowId}/verdict`, {
+            source: 'agent-eval',
+            stepKey: 'step_4',
+            verdict: anyFailed ? 'fail' : 'pass',
+            exitCode: anyFailed ? 1 : 0,
+            detail: `agent-eval ${opts.category}: ${results.filter((r) => r.passed).length}/${results.length} probes passed`,
+          });
+          if (opts.output !== 'json') console.log(`  → reported agent-eval verdict '${anyFailed ? 'fail' : 'pass'}' to run ${opts.workflowId} (advisory)`);
+        } catch (e) {
+          if (opts.output !== 'json') console.warn(`  ⚠ verdict report failed (non-fatal): ${e.response?.data?.error || e.message}`);
+        }
+      }
+    }
+
+    process.exit(anyFailed ? 1 : 0);
+  });
+
+// ── SETUP-LOCAL-CI command (HC-101-followup-3) ─────────────────────────────────
+//
+// Scaffolds HC-101's local-CI assets into the adopter's repo so they can
+// switch `ci.gate: local` and avoid burning GitHub Actions minutes. Pairs
+// with the X-Hone-Recommendation header the server emits when an adopter
+// posts a job with ci.gate=none — both nudge toward "real safety net via
+// local-mode" instead of "no safety net via none-mode".
+//
+// What this command does:
+//   1. Pulls the Makefile template + compose.local-ci.yml template from
+//      GET /scripts/local-ci/{makefile,compose} (lives inside /server/
+//      so it ships with Railway deploys per HC-019y-followup-3-railway-path).
+//   2. Writes them to the adopter's repo root. Existing files are backed
+//      up to `<file>.hone-backup` to avoid clobbering adopter customizations.
+//   3. Flips `.pipeline-config.yml`'s `ci.gate` to `local` so the very next
+//      `hone run-story` uses the new gate. Existing pipeline-config is
+//      required (run `hone setup` first); the command refuses to scaffold
+//      otherwise so the gate flip doesn't dangle without a config.
+//   4. Prints a copy-paste checklist of next steps (customize Makefile
+//      targets, run `make ci`, etc.).
+program
+  .command('setup-local-ci')
+  .description('Scaffold HC-101 Makefile + compose.local-ci.yml + flip ci.gate=local (HC-101-followup-3)')
+  .option('--force', 'Overwrite existing Makefile / compose.local-ci.yml without backing up')
+  .option('--dry-run', 'Show what would change without writing any files')
+  .action(async (opts) => {
+    const fs   = require('fs');
+    const path = require('path');
+    const yaml = require('js-yaml');
+
+    const config = getConfig();
+    const client = api(config);
+    const repoRoot = process.cwd();
+
+    console.log('Hone AI — Setup Local CI (HC-101-followup-3)');
+    console.log('============================================');
+    console.log('');
+
+    // 1. Verify .pipeline-config.yml exists AND has a ci: block. Pick
+    //    the file that ACTUALLY carries the ci: block — readCIGateConfig
+    //    falls through to the second candidate when the first lacks one,
+    //    so the write must target the same file the reader will pick or
+    //    the flip is a silent no-op.
+    const configCandidates = [
+      path.join(repoRoot, '.pipeline-config.yml'),
+      path.join(repoRoot, '.github/.pipeline-config.yml'),
+    ];
+    let pipelineConfigPath = null;
+    for (const p of configCandidates) {
+      if (!fs.existsSync(p)) continue;
+      let raw;
+      try { raw = fs.readFileSync(p, 'utf8'); } catch { continue; }
+      let parsedPeek;
+      try { parsedPeek = yaml.load(raw); } catch { continue; }
+      if (parsedPeek && typeof parsedPeek === 'object' && parsedPeek.ci && typeof parsedPeek.ci === 'object') {
+        pipelineConfigPath = p;
+        break;
+      }
+    }
+    // Fall back to the FIRST existing file if none has a ci: block — the
+    // flip will add one. This still avoids the write/read divergence
+    // because if neither candidate has a ci: block, the reader returns
+    // defaults anyway.
+    if (!pipelineConfigPath) {
+      pipelineConfigPath = configCandidates.find((p) => fs.existsSync(p)) || null;
+    }
+    if (!pipelineConfigPath) {
+      console.error('  ✗ No .pipeline-config.yml found in this repo.');
+      console.error('    Run `hone setup` first to scaffold the pipeline, then re-run this command.');
+      process.exit(1);
+    }
+    console.log(`  ✓ Found pipeline config at ${path.relative(repoRoot, pipelineConfigPath)}`);
+
+    // 2. Fetch the two assets from the server.
+    const assets = [
+      { remote: '/scripts/local-ci/makefile', local: 'Makefile' },
+      { remote: '/scripts/local-ci/compose',  local: 'compose.local-ci.yml' },
+    ];
+    const fetched = [];
+    for (const a of assets) {
+      try {
+        const { data } = await client.get(a.remote, { responseType: 'text', transformResponse: [(d) => d] });
+        fetched.push({ ...a, content: String(data) });
+        console.log(`  ✓ Pulled ${a.local} from server (${data.length} bytes)`);
+      } catch (e) {
+        const msg = e?.response?.status === 404 ? `404 — server has no ${a.local} asset` : (e?.message || String(e));
+        console.error(`  ✗ Failed to fetch ${a.local}: ${msg}`);
+        process.exit(1);
+      }
+    }
+
+    if (opts.dryRun) {
+      console.log('');
+      console.log('Dry-run: would write the following files:');
+      for (const f of fetched) {
+        const target = path.join(repoRoot, f.local);
+        const exists = fs.existsSync(target);
+        console.log(`  ${exists ? '⚠' : '✓'} ${f.local}${exists ? ' (existing file would be backed up)' : ''}`);
+      }
+      console.log('  ✓ Would flip ci.gate -> local in pipeline config');
+      console.log('');
+      console.log('Re-run without --dry-run to apply.');
+      return;
+    }
+
+    // 3. Write the assets, backing up any existing files. If the default
+    //    .hone-backup already exists (re-run of setup-local-ci), use a
+    //    timestamped suffix so the FIRST run's backup — the only one that
+    //    has the adopter's actual original — is preserved.
+    function pickBackupPath(target) {
+      const def = target + '.hone-backup';
+      if (!fs.existsSync(def)) return def;
+      // .hone-backup-YYYYMMDD-HHMMSS — sortable, unique per second
+      const ts = new Date().toISOString().replace(/[-:T]/g, '').slice(0, 15);
+      return target + `.hone-backup-${ts}`;
+    }
+    for (const f of fetched) {
+      const target = path.join(repoRoot, f.local);
+      if (fs.existsSync(target) && !opts.force) {
+        const backup = pickBackupPath(target);
+        fs.copyFileSync(target, backup);
+        console.log(`  ✓ Backed up existing ${f.local} → ${path.relative(repoRoot, backup)}`);
+      }
+      fs.writeFileSync(target, f.content);
+      console.log(`  ✓ Wrote ${f.local}`);
+    }
+
+    // 4. Flip ci.gate -> local in the existing pipeline config. CRITICAL:
+    //    `yaml.dump(parsed)` would strip every comment + reformat every
+    //    array/string — but `.pipeline-config.yml` is the file the
+    //    adopter is told to hand-edit, and our own generated config has
+    //    instructional comments. Instead, do a targeted in-place text
+    //    edit on the `gate:` line under `ci:` — preserve comments and
+    //    every other byte verbatim. A backup is written first so the
+    //    adopter can always recover.
+    const configBackup = pipelineConfigPath + (fs.existsSync(pipelineConfigPath + '.hone-backup')
+      ? `.hone-backup-${new Date().toISOString().replace(/[-:T]/g, '').slice(0, 15)}`
+      : '.hone-backup');
+    fs.copyFileSync(pipelineConfigPath, configBackup);
+    console.log(`  ✓ Backed up pipeline config → ${path.relative(repoRoot, configBackup)}`);
+
+    const raw = fs.readFileSync(pipelineConfigPath, 'utf8');
+    let parsedPeek = null;
+    try { parsedPeek = yaml.load(raw); } catch { /* keep raw, work with regex */ }
+
+    // Detect prevGate via parse (best effort) — purely for the operator log line.
+    const prevGate = parsedPeek?.ci?.gate;
+
+    let updated;
+    if (/^ci:\s*$/m.test(raw)) {
+      // ci: block exists. Find it, see if `gate:` is inside; if yes, replace
+      // its value. Preserve any trailing `# comment` on the same line —
+      // adopters may have annotated the gate choice and we shouldn't lose it.
+      // If no gate: key inside the block, insert `gate: local` right after `ci:`.
+      const ciIdx = raw.search(/^ci:\s*$/m);
+      // Match: (head incl. ci: line) (indent + gate:) (value: word chars only) (trailing whitespace+comment+newline)
+      const gateInBlock = /^(ci:[\s\S]*?\n)(\s+gate:\s*)([A-Za-z0-9_-]+)(\s*(?:#[^\n]*)?\n)/m;
+      if (gateInBlock.test(raw.slice(ciIdx, ciIdx + 1500))) {
+        updated = raw.replace(gateInBlock, (_m, head, indent, _oldVal, trailing) =>
+          `${head}${indent}local${trailing}`,
+        );
+      } else {
+        // ci: block exists but no gate key. Insert it right after `ci:`.
+        updated = raw.replace(/^(ci:\s*\n)/m, `$1  gate: local\n  local_command: make ci\n`);
+      }
+    } else {
+      // No ci: block at all — append it at the end with the required keys.
+      updated = raw.replace(/\s*$/, '') + '\n\nci:\n  gate: local\n  local_command: make ci\n';
+    }
+
+    fs.writeFileSync(pipelineConfigPath, updated);
+    console.log(`  ✓ Flipped ci.gate: ${prevGate || '(absent)'} → local in pipeline config`);
+
+    // 5. Operator next steps. The label is unique-per-command (not the
+    //    shared "Next steps" string) so the H-012 post-setup anchor that
+    //    indexOf-scans for the post-setup checklist doesn't latch here.
+    console.log('');
+    console.log('Local CI next steps:');
+    console.log('  1. Open Makefile + replace the TODO sections with your stack\'s commands');
+    console.log('     (unit / regression / integration / e2e — `make help` lists every target)');
+    console.log('  2. Run `make ci` locally to verify every gate passes');
+    console.log('  3. Your next `hone run-story` will use local-mode CI gating —');
+    console.log('     step_5c will trust your local `make ci` instead of polling GitHub Actions');
+    console.log('');
+    console.log('Revert: set ci.gate back to "github" in your pipeline-config.yml');
+  });
+
 // ── SETUP command ─────────────────────────────────────────────────────────────
 program
   .command('setup')
   .description('Run setup-ai-pipeline.sh v3.1 — detects stack, scaffolds agents + skills')
   .option('--dry-run',         'Preview what would be created without writing files')
   .option('--non-interactive', 'Use detected defaults without prompting')
-  .option('--stack <stack>',   'Override stack detection (node|java|python|dotnet|salesforce)')
+  .option('--stack <stack>',   'Override stack detection (node|java|python|dotnet|salesforce|netsuite)')
   .option('--install-tests',   'Install unit test framework (vitest/jest/pytest) + create config')
   .option('--e2e',             'Also install Playwright E2E framework (use with --install-tests)')
   .option('--no-e2e',          'Skip Playwright even when --install-tests is set')
   .option('--no-branch-protection', 'Skip installing GitHub branch protection on the default branch (H-001)')
   .option('--refresh',           'Re-scan platform metadata without re-running full setup (HC-013c)')
+  .option('--ci-gate <mode>',    'HC-RC-004: CI gating mode (github | local | mixed | none). Skips interactive prompt.')
   .action(async (opts) => {
     const config = getConfig();
     const client = api(config);
@@ -417,23 +760,102 @@ program
       console.log('  (non-TTY detected — running in non-interactive mode)');
     }
 
+    // HC-RC-004: pick the ci.gate mode (interactive prompt with cost
+    // trade-off, --ci-gate flag, env var, or auto-detect — whichever
+    // applies). The chosen mode is passed via CI_GATE env var which
+    // setup-ai-pipeline.sh already reads (HC-101-followup-3 auto-detect
+    // path uses the same var as override). Choosing `local` ALSO
+    // triggers the setup-local-ci scaffold flow after setup completes,
+    // so the adopter ends the command with a working local-CI stack
+    // ready to use instead of having to know about the second command.
+    const { chooseCIGate } = require('./lib/ci-gate-chooser');
+    const ciGateChoice = await chooseCIGate({
+      flagMode: opts.ciGate,
+      nonInteractive: isNonInteractive,
+      repoRoot: process.cwd(),
+    });
+    console.log(`  ✓ ci.gate = ${ciGateChoice.mode} (source: ${ciGateChoice.source})`);
+    // HC-RC-004 pass-1 (MED-2): only lecture about ci.gate=none when the
+    // adopter LANDED there via auto-detect fallback (i.e. they didn't
+    // explicitly pick it). Explicit choices (--ci-gate=none, env, prompt)
+    // mean they know what they want — don't re-warn on every setup re-run.
+    if (ciGateChoice.mode === 'none' && ciGateChoice.source === 'auto-detect') {
+      console.log('  ⚠ ci.gate=none means NO CI verification. Run `hone setup-local-ci` later');
+      console.log('    to switch to local-mode (real safety net at $0 CI cost).');
+    }
+
     const flags = [
       `--source "${path.join(tmpDir, 'enterprise-github')}"`,
       opts.dryRun      ? '--dry-run'         : '',
       isNonInteractive ? '--non-interactive'  : '',
     ].filter(Boolean).join(' ');
 
+    // HC-RC-004 pass-1 (HIGH-1): when source==='auto-detect', LEAVE
+    // CI_GATE unset so the bash script's existing detected_ci_default
+    // logic owns the call. Defense against JS+bash detector drift —
+    // they have to agree forever if both decide. Only force CI_GATE when
+    // the adopter explicitly chose (flag / env / prompt).
+    const setupEnv = { ...process.env };
+    if (ciGateChoice.source !== 'auto-detect') {
+      setupEnv.CI_GATE = ciGateChoice.mode;
+    }
     try {
       execSync(`bash "${scriptPath}" ${flags}`, {
         stdio: 'inherit',
         cwd: process.cwd(),
-        env: { ...process.env },
+        env: setupEnv,
       });
     } catch (e) {
       console.error('Setup script failed:', e.message);
       process.exit(1);
     }
 
+    // HC-RC-004: if the adopter chose `local`, run the setup-local-ci
+    // scaffold inline so they end the setup command with a working
+    // local-CI stack (Makefile + compose) instead of having to know
+    // about a second command. Skipped on --dry-run + when a Makefile
+    // already exists at the repo root (auto-detect would have picked
+    // `local`; nothing more to scaffold).
+    if (ciGateChoice.mode === 'local' && !opts.dryRun) {
+      const repoRootForScaffold = process.cwd();
+      const makefileExists = fs.existsSync(path.join(repoRootForScaffold, 'Makefile'));
+      if (!makefileExists) {
+        console.log('');
+        console.log('HC-RC-004: scaffolding HC-101 Makefile + compose.local-ci.yml for local mode...');
+        try {
+          const assets = [
+            { remote: '/scripts/local-ci/makefile', local: 'Makefile' },
+            { remote: '/scripts/local-ci/compose',  local: 'compose.local-ci.yml' },
+          ];
+          // HC-RC-004 pass-1 (MED-1): each asset gets the same
+          // backup-on-exist treatment setup-local-ci uses (HC-101-followup-3
+          // timestamped-backup lesson). The Makefile branch is already
+          // gated above; the compose file also needs the same defense so
+          // an adopter who hand-rolled compose.local-ci.yml first then
+          // re-ran setup doesn't lose customizations.
+          for (const a of assets) {
+            const target = path.join(repoRootForScaffold, a.local);
+            if (fs.existsSync(target)) {
+              const ts = new Date().toISOString().replace(/[-:T]/g, '').slice(0, 15);
+              const backup = `${target}.hone-backup-${ts}`;
+              fs.copyFileSync(target, backup);
+              console.log(`  ✓ Backed up existing ${a.local} → ${path.basename(backup)}`);
+            }
+            const { data } = await client.get(a.remote, { responseType: 'text', transformResponse: [(d) => d] });
+            fs.writeFileSync(target, String(data));
+            console.log(`  ✓ Wrote ${a.local}`);
+          }
+          console.log('  → Customize Makefile TODO sections, then run `make ci` to verify');
+        } catch (e) {
+          console.log(`  ⚠ Could not scaffold local-CI assets: ${e.message}`);
+          console.log('    Run `hone setup-local-ci` to retry the scaffold step.');
+        }
+      } else {
+        console.log('  ℹ Existing Makefile detected — skipping local-CI scaffold');
+        console.log('    (the auto-detect path already picked `local` for you)');
+      }
+    }
+
     // ── Phase 1b: Install CLAUDE.md ──────────────────────────────────────────
     // HC-019y: removed the install-time .github/agents/ -> .claude/agents/
     // mirror. The bash setup script now writes agents directly to
@@ -1160,6 +1582,11 @@ program
       if (result.skills) {
         let preservedCount = 0;
         let sidecarCount = 0;
+        let evalScenariosCount = 0;
+        // HC-010d pass-2 HIGH: per-skill eval-scenarios.json payload.
+        const evalScenarios = (result.evalScenarios && typeof result.evalScenarios === 'object')
+          ? result.evalScenarios
+          : {};
         for (const [skillName, content] of Object.entries(result.skills)) {
           if (!content || content.length < 50) continue;
           const skillDir  = path.join(repoRoot, '.github', 'skills', skillName);
@@ -1183,6 +1610,19 @@ program
               console.log(`  ✓ .github/skills/${skillName}/SKILL.md`);
             }
           }
+          // HC-010d pass-2 HIGH: write eval-scenarios.json sibling if the
+          // server validated one for this skill. Skip null/undefined/empty
+          // (parseOutput validator dropped malformed blocks already).
+          const scenarios = evalScenarios[skillName];
+          const isEmpty = !scenarios
+            || (Array.isArray(scenarios) && scenarios.length === 0)
+            || (typeof scenarios === 'object' && Object.keys(scenarios).length === 0);
+          if (!isEmpty) {
+            const evalFile = path.join(skillDir, 'eval-scenarios.json');
+            fs.writeFileSync(evalFile, JSON.stringify(scenarios, null, 2) + '\n');
+            evalScenariosCount++;
+            console.log(`  ✓ .github/skills/${skillName}/eval-scenarios.json`);
+          }
         }
         if (preservedCount > 0) {
           console.log(`\n  Preserved adopter REPO-SPECIFIC content in ${preservedCount} skill(s).`);
@@ -1194,6 +1634,10 @@ program
           console.log(`  To opt into automatic splice protection on the next derive, add a`);
           console.log(`  '<!-- REPO-SPECIFIC -->' marker to the original file.`);
         }
+        if (evalScenariosCount > 0) {
+          console.log(`\n  Wrote ${evalScenariosCount} eval-scenarios.json file(s) (HC-010d).`);
+          console.log(`  Future executor (hone skill-eval, HC-010d-followup-1) will probe these.`);
+        }
       }
 
       // H-022: surface parser warnings so silent drops become VISIBLE failures.
@@ -1457,6 +1901,207 @@ program
     }
   });
 
+// ── BYO-KEY command (HC-COMM-013 / A2) ───────────────────────────────────────
+// Self-serve management of your org's Anthropic API key for server mode. The
+// key is read from stdin (piped) or a HIDDEN prompt — NEVER accepted on argv,
+// which would leak it to shell history (~/.zsh_history), `ps`, and CI logs.
+
+// Read a secret without echoing it. Piped stdin → read all of it (CI/secret-
+// manager injection). Interactive TTY → a muted readline prompt.
+async function _readSecret(promptText) {
+  if (!process.stdin.isTTY) {
+    const chunks = [];
+    for await (const chunk of process.stdin) chunks.push(chunk);
+    return Buffer.concat(chunks).toString('utf8');
+  }
+  const readline = await import('readline');
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    process.stdout.write(promptText);
+    // Mute echo of typed characters — the prompt is already written.
+    rl._writeToOutput = () => {};
+    rl.question('', (answer) => {
+      rl.close();
+      process.stdout.write('\n');
+      resolve(answer);
+    });
+  });
+}
+
+function _handleByoKeyError(e) {
+  const status = e.response?.status;
+  if (status === 401) {
+    console.error('Not authenticated. Run: hone init --token <token>');
+  } else if (status === 429) {
+    const retry = e.response?.data?.retryAfter;
+    console.error(`Rate limited — too many key writes.${retry ? ` Retry after ${retry}s.` : ''}`);
+  } else if (status === 503) {
+    console.error(`Server cannot store the key right now: ${e.response?.data?.error || 'unavailable'}`);
+  } else if (e.response?.data?.error) {
+    console.error(`Failed: ${e.response.data.error}`);
+  } else {
+    console.error(`Failed: ${e.message}`);
+  }
+  process.exit(1);
+}
+
+const MAX_BYO_KEY_BYTES_CLI = 1024;
+
+const byoKeyCmd = program
+  .command('byo-key')
+  .description("Manage your org's BYO Anthropic API key (server mode)");
+
+byoKeyCmd
+  .command('set')
+  .description('Set or rotate your key — reads from stdin or a hidden prompt (never pass the key on the command line)')
+  .option('--key-file <path>', 'Read the key from a file (e.g. a 0600 secrets file) instead of stdin/prompt')
+  .action(async (opts) => {
+    const config = getConfig();
+    const client = api(config);
+
+    let key;
+    try {
+      key = opts.keyFile
+        ? fs.readFileSync(opts.keyFile, 'utf8')
+        : await _readSecret('Anthropic API key: ');
+    } catch (e) {
+      console.error(`Could not read key: ${e.message}`);
+      process.exit(1);
+    }
+    key = (key || '').trim();
+
+    // Client-side convenience checks (server remains the authority).
+    if (!key) {
+      console.error('No key provided (empty input). Pipe it in or type it at the prompt.');
+      process.exit(1);
+    }
+    if (Buffer.byteLength(key, 'utf8') > MAX_BYO_KEY_BYTES_CLI) {
+      console.error(`Key too large (max ${MAX_BYO_KEY_BYTES_CLI} bytes). Did you paste the wrong thing?`);
+      process.exit(1);
+    }
+    if (!key.startsWith('sk-ant-')) {
+      // Warn-only (memo §8): Anthropic key formats can change; don't hard-block.
+      console.error('Warning: key does not look like an Anthropic key (expected "sk-ant-" prefix). Sending anyway.');
+    }
+
+    try {
+      const { data } = await client.put('/orgs/me/byo-key', { byo_anthropic_key: key });
+      console.log(data.wasConfigured
+        ? 'BYO key rotated. Pipeline LLM calls now bill your own Anthropic API.'
+        : 'BYO key set. Pipeline LLM calls now bill your own Anthropic API.');
+    } catch (e) { _handleByoKeyError(e); }
+  });
+
+byoKeyCmd
+  .command('clear')
+  .description('Clear your key — your org reverts to the Hone default key')
+  .action(async () => {
+    const config = getConfig();
+    const client = api(config);
+    try {
+      const { data } = await client.delete('/orgs/me/byo-key');
+      console.log(data.wasConfigured
+        ? 'BYO key cleared. Your org reverts to the Hone default key.'
+        : 'No BYO key was configured — nothing to clear.');
+    } catch (e) { _handleByoKeyError(e); }
+  });
+
+byoKeyCmd
+  .command('status')
+  .description('Show whether a BYO key is configured (never prints the key)')
+  .option('--format <fmt>', 'Output format: pretty | json', 'pretty')
+  .action(async (opts) => {
+    const config = getConfig();
+    const client = api(config);
+    try {
+      const { data } = await client.get('/orgs/me/byo-key');
+      if (opts.format === 'json') {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+      }
+      console.log(`BYO key configured: ${data.configured ? 'yes' : 'no'}`);
+      if (data.lastWrite) {
+        const when = String(data.lastWrite.at).split('T')[0];
+        console.log(`Last change:        ${data.lastWrite.action} by ${data.lastWrite.actorType} on ${when}`);
+      }
+      if (data.configured && data.envelopeOk === false) {
+        console.log('Warning: stored value is not in the expected encrypted envelope shape — contact support.');
+      }
+      // HC-COMM-014: fold a one-line trial summary in (non-fatal if unavailable).
+      try {
+        const { data: plan } = await client.get('/orgs/me/plan');
+        if (plan.mode === 'trial') {
+          console.log(`Trial:              active — ${plan.trial.daysLeft}d left, $${Number(plan.trial.creditRemaining).toFixed(2)} credit`);
+        } else if (plan.mode === 'expired') {
+          console.log('Trial:              ended (set a key or upgrade)');
+        }
+      } catch { /* trial line is a nicety — never block byo-key status */ }
+      console.log('Tip: run `hone byo-key check` to verify the key still authenticates with Anthropic.');
+    } catch (e) { _handleByoKeyError(e); }
+  });
+
+byoKeyCmd
+  .command('check')
+  .description('Verify the configured key still authenticates with Anthropic (zero-token live probe; never prints the key)')
+  .action(async () => {
+    const config = getConfig();
+    const client = api(config);
+    try {
+      const { data } = await client.post('/orgs/me/byo-key/check');
+      if (data.ok) {
+        console.log('BYO key is valid — Anthropic accepted it.');
+        return;
+      }
+      const msg = {
+        unauthorized: 'BYO key was REJECTED by Anthropic (401/403). Rotate it with `hone byo-key set`.',
+        unreachable:  'Could not reach Anthropic to check the key — try again shortly (key not changed).',
+        unexpected:   'Anthropic returned an unexpected status checking the key — try again shortly.',
+      }[data.reason] || `Key check failed: ${data.reason}`;
+      console.error(msg);
+      process.exit(1);
+    } catch (e) { _handleByoKeyError(e); }
+  });
+
+// ── TRIAL command (HC-COMM-014 / A3) ─────────────────────────────────────────
+const trialCmd = program
+  .command('trial')
+  .description("View or start your org's Hone-funded trial (server mode)");
+
+trialCmd
+  .command('status')
+  .description('Show trial mode, days left, and credit remaining')
+  .option('--format <fmt>', 'Output format: pretty | json', 'pretty')
+  .action(async (opts) => {
+    const config = getConfig();
+    const client = api(config);
+    try {
+      const { data } = await client.get('/orgs/me/plan');
+      if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
+      const t = data.trial || {};
+      console.log(`Plan mode:       ${data.mode}`);
+      console.log(`Trial status:    ${t.status}`);
+      if (t.status === 'active') {
+        console.log(`Days left:       ${t.daysLeft}`);
+        console.log(`Credit:          $${Number(t.creditUsdUsed || 0).toFixed(2)} used / $${Number(t.creditUsdCap).toFixed(2)} cap ($${Number(t.creditRemaining).toFixed(2)} left)`);
+      }
+      if (data.mode === 'expired') {
+        console.log('Trial ended — set your own key (`hone byo-key set`) or upgrade to continue.');
+      }
+    } catch (e) { _handleByoKeyError(e); }
+  });
+
+trialCmd
+  .command('start')
+  .description('Start your trial now (idempotent — no-op if already started or ended)')
+  .action(async () => {
+    const config = getConfig();
+    const client = api(config);
+    try {
+      const { data } = await client.post('/orgs/me/trial/start');
+      console.log(data.started ? `Trial started — status: ${data.status}.` : `No-op — ${data.note}`);
+    } catch (e) { _handleByoKeyError(e); }
+  });
+
 // ── ADMIN-USAGE command ──────────────────────────────────────────────────────
 program
   .command('admin-usage')
@@ -2209,7 +2854,7 @@ program
     const branchSamples = [];
     try {
       const out = execSync('git for-each-ref --sort=-committerdate --count=30 --format=%(refname:short) refs/heads/ refs/remotes/', {
-        cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
+        cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
       });
       branchSamples.push(...out.split('\n').filter(Boolean));
     } catch { /* not a git repo — skip */ }
@@ -2320,6 +2965,26 @@ program
     const repoRoot = process.cwd();
     const results = [];
 
+    // Pass-2 review LOW (HC-020e): validate --check against the
+    // allowlist of known sub-checks. Before this, a typo (e.g.,
+    // `--check architectur`) silently ran nothing and exited 0,
+    // which is the worst doctor outcome ("looks healthy" but
+    // actually skipped everything).
+    const KNOWN_CHECKS = new Set([
+      'all',
+      'docs',
+      'admin-merge',
+      'bind-default',
+      'placeholders',
+      'skill-staleness',
+      'architecture',
+    ]);
+    if (!KNOWN_CHECKS.has(opts.check)) {
+      const known = [...KNOWN_CHECKS].sort().join(', ');
+      console.error(`✗ --check: unknown name "${opts.check}". Known checks: ${known}`);
+      process.exit(2);
+    }
+
     // Read .pipeline-config.yml to learn the stack
     let stack = 'unknown';
     try {
@@ -2394,6 +3059,15 @@ program
       results.push(checkSkillStaleness({ repoRoot }));
     }
 
+    // HC-020e: architecture staleness check — flags drift in
+    // docs/sdlc/ARCHITECTURE.md based on the `<!-- Generated by
+    // derive-domain-skills on YYYY-MM-DD -->` marker the derive prompt
+    // now emits (companion change in this PR).
+    if (opts.check === 'all' || opts.check === 'architecture') {
+      const { checkArchitectureStaleness } = require('./lib/doctor-architecture');
+      results.push(checkArchitectureStaleness({ repoRoot }));
+    }
+
     // Render
     if (opts.json) {
       console.log(JSON.stringify({ checks: results }, null, 2));
@@ -2406,7 +3080,9 @@ program
           : r.status === 'drift' ? '✗'
           : r.status === 'info' ? 'ℹ'
           : '⚠';
-        const label = r.name === 'docs' ? 'Docs freshness' : r.name;
+        const label = r.name === 'docs' ? 'Docs freshness'
+                    : r.name === 'architecture' ? 'Architecture staleness'
+                    : r.name;
         console.log(`${icon} ${label} — ${r.reason}`);
         if (r.suggestedFix) {
           console.log(`  Fix: ${r.suggestedFix}`);
@@ -4102,7 +4778,7 @@ program
     let branchName = '';
     try {
       branchName = execSync('git rev-parse --abbrev-ref HEAD',
-        { cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
     } catch { /* defensive */ }
     const storyId = cmdOpts.storyId || extractStoryIdFromBranch(branchName);
     if (!storyId) {
@@ -4115,12 +4791,12 @@ program
     let diff = '';
     try {
       diff = execSync(`git diff origin/${baseBranch}...HEAD`,
-        { cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 32 * 1024 * 1024 });
+        { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 32 * 1024 * 1024 });
     } catch {
       // Fallback: no remote tracking — try local base
       try {
         diff = execSync(`git diff ${baseBranch}...HEAD`,
-          { cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 32 * 1024 * 1024 });
+          { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 32 * 1024 * 1024 });
       } catch { /* leave empty */ }
     }
 
@@ -4247,7 +4923,9 @@ program
   .option('--contracts', 'Run contract validation between pipeline agents')
   .option('--snapshot', 'Save current eval + contract results as regression baseline')
   .option('--regression', 'Compare current results against saved baseline (detect drift)')
-  .option('--judge', 'Run LLM-as-judge scenarios (requires ANTHROPIC_API_KEY, costs tokens)')
+  .option('--judge', 'Run LLM-as-judge scenarios (default provider: free gh-models via GITHUB_TOKEN)')
+  .option('--provider <name>', 'LLM-judge provider: gh-models (free, default) | claude (paid Sonnet)', 'gh-models')
+  .option('--evidence-mode <mode>', 'HC-RC-001 editor-LLM evidence transfer: "local" writes .hone/eval-evidence.json (signed); "off" disables (default)')
   .action(async (opts) => {
     const path = require('path');
     const fs = require('fs');
@@ -4314,12 +4992,8 @@ program
       const { loadScenarios, formatResults } = require('./lib/eval-runner');
       const { runJudgeScenario } = require('./lib/eval-llm-judge');
 
-      const apiKey = process.env.ANTHROPIC_API_KEY;
-      if (!apiKey) {
-        console.error('ANTHROPIC_API_KEY required for --judge mode. Set: export ANTHROPIC_API_KEY=sk-ant-...');
-        process.exit(1);
-      }
-
+      // Load + filter FIRST — if there are no judge scenarios, exit cleanly
+      // without demanding any API key / token.
       const scenarios = loadScenarios({
         evalDir, agent: opts.agent, tag: opts.tag, scenarioId: opts.scenario,
         readFile: (p) => fs.readFileSync(p, 'utf8'),
@@ -4333,25 +5007,21 @@ program
         process.exit(0);
       }
 
-      // LLM call function using Anthropic API
-      async function callLLM(systemPrompt, userPrompt) {
-        const { data } = await axios.post('https://api.anthropic.com/v1/messages', {
-          model: 'claude-sonnet-4-20250514',
-          max_tokens: 2048,
-          system: systemPrompt,
-          messages: [{ role: 'user', content: userPrompt }],
-        }, {
-          headers: {
-            'x-api-key': apiKey,
-            'anthropic-version': '2023-06-01',
-            'content-type': 'application/json',
-          },
-          timeout: 60000,
-        });
-        return data.content?.[0]?.text || '';
-      }
-
-      console.log(`Running ${judgeScenarios.length} LLM-judge scenario(s)...`);
+      // HC-019n-followup-33 (pipeline-standards G6): the LLM-judge lane must have a
+      // ZERO-COST path (feedback_pipeline_llm_cost_reduction — every LLM-cost gate
+      // needs a free/near-free route so adopters aren't double-billed). DEFAULT to
+      // GH Models (free inference via GITHUB_TOKEN); paid Claude Sonnet is opt-in
+      // via `--provider claude`. Mirrors `hone skill-eval`'s provider convention.
+      // HC-COMM-011-followup-3: provider wiring extracted to lib/judge-provider.js
+      // (shared with `hone agent-eval --judge`). Same zero-cost default (gh-models)
+      // + Sonnet-not-Opus paid path; the retired dated Sonnet id must not appear
+      // (pinned by opus-4-8-upgrade.test.js).
+      const { buildJudgeCallLLM } = require('./lib/judge-provider');
+      const built = buildJudgeCallLLM(opts.provider, { axios });
+      if (built.error) { console.error(built.error); process.exit(1); }
+      const callLLM = built.callLLM;
+
+      console.log(`Running ${judgeScenarios.length} LLM-judge scenario(s) via ${built.provider}...`);
       console.log('');
 
       const results = [];
@@ -4413,35 +5083,260 @@ program
     const results = runAllScenarios(scenarios, AGENT_PROMPTS, { failFast: opts.failFast });
     console.log(formatResults(results, opts.format));
 
+    // HC-RC-001: optionally write signed eval-evidence so CI can short-circuit
+    // the LLM-cost gate. No-op when --evidence-mode is omitted or "off", or
+    // when prerequisites (HONE_EVIDENCE_SECRET + diff input + metadata) are
+    // missing. Skips with stderr warning rather than failing the eval run.
+    try {
+      const {
+        normalizeEvidenceMode,
+        buildEvidenceFromEval,
+        writeEvidenceFile,
+      } = require('./lib/eval-evidence');
+      const mode = normalizeEvidenceMode(opts.evidenceMode);
+      if (mode === 'local') {
+        const record = buildEvidenceFromEval({ results, mode });
+        if (record) {
+          const out = writeEvidenceFile(record);
+          process.stderr.write(`[hone eval] evidence-mode=local wrote ${out}\n`);
+        }
+      }
+    } catch (e) {
+      process.stderr.write(`[hone eval] evidence-mode error: ${e.message}\n`);
+    }
+
     process.exit(results.failed + results.errors > 0 ? 1 : 0);
   });
 
-// ── HC-041: Run Story (Orchestrator) ─────────────────────────────────────────
+// ── HC-010d-followup-1: hone skill-eval runtime executor ────────────────────
+//
+// Consumes the eval-scenarios.json artifacts that HC-010d emits next to
+// every derived <stack>-developer/SKILL.md and <stack>-architect/SKILL.md.
+// Distinct from `hone eval` (HC-019d) which grades AGENT PROMPTS
+// deterministically — `hone skill-eval` grades DERIVED SKILL OUTPUTS by
+// calling an LLM and scoring against expected_output_keywords +
+// expected_output_format heuristics. Two systems, two different
+// questions; coexist.
+//
+// Provider defaults to gh-models (free GH PAT inference) per the
+// [Pipeline LLM Cost Reduction] memory — adopters must not be
+// double-billed for what their pipeline already invoked.
 program
-  .command('run-story <storyId>')
-  .description('Run the SDLC pipeline for a story via the orchestrator')
-  .option('--mode <mode>', 'Execution mode: interactive or batch', 'interactive')
-  .option('--repo <name>', 'Repository name override (default: directory name)')
-  .option('--branch <name>', 'Git branch (default: current)')
-  .option('--status', 'Show status of the latest workflow run for this story')
-  .option('--kill', 'Kill the latest workflow run for this story')
-  .option('--approve <step>', 'Approve a paused gate (e.g., --approve step_0)')
-  .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
-  .option('--poll-interval <s>', 'Poll interval in seconds', '5')
-  .option('--include-paths <paths>', 'Comma-separated list of source file paths to bundle into the codebase context (HC-019n-followup-12). Augments auto-detected paths from the issue body.')
-  .action(async (storyIdOrRunId, opts) => {
-    const config = getConfig();
-    const client = api(config);
+  .command('skill-eval <skillName>')
+  .description('Run derived-skill eval scenarios against an LLM (HC-010d-followup-1)')
+  .option('--provider <name>', 'LLM provider: gh-models (default, $0) | claude-haiku (paid)', 'gh-models')
+  .option('--scenario <id>', 'Run a single scenario by id (e.g., SF-DEV-EVAL-001)')
+  .option('--tag <tag>', 'Filter scenarios by HC-010c rule-id tag (e.g., SF-SEC-001)')
+  .option('--format <fmt>', 'Output format: pretty | json', 'pretty')
+  .option('--fail-fast', 'Stop on first non-pass scenario')
+  .option('--no-llm', 'Dry run: validate scenarios + print plan without calling the LLM')
+  .option('--repo-root <path>', 'Override the repo root used for SKILL.md / eval-scenarios.json lookup')
+  .action(async (skillName, opts) => {
+    const fsLocal   = require('fs');
+    const pathLocal = require('path');
+    const repoRoot  = opts.repoRoot || process.cwd();
+
+    const { validateScenarios } = require(
+      pathLocal.resolve(__dirname, '..', 'server', 'src', 'services', 'eval-scenarios')
+    );
+    const {
+      loadSkillEvalScenarios,
+      runAllSkillScenarios,
+      formatResults,
+    } = require('./lib/skill-eval-runner');
+
+    const loaded = loadSkillEvalScenarios({
+      repoRoot, skillName, fs: fsLocal, path: pathLocal, validateScenarios,
+    });
+    if (!loaded.ok) {
+      console.error(`✗ hone skill-eval: cannot load ${skillName}`);
+      for (const e of loaded.errors) {
+        console.error(`  ${e.path}: ${e.message}`);
+      }
+      process.exit(2);
+    }
 
-    // Resolve: if it looks like a UUID, use as runId directly.
-    // Otherwise treat as storyId — will be used for POST /orchestrate body.
-    const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(storyIdOrRunId);
-    const storyId = isUuid ? null : storyIdOrRunId;
-    const runId = isUuid ? storyIdOrRunId : null;
+    // Apply --scenario / --tag filters.
+    let scenarios = loaded.scenarios;
+    if (opts.scenario) {
+      scenarios = scenarios.filter((s) => s.id === opts.scenario);
+      if (scenarios.length === 0) {
+        console.error(`✗ no scenario with id "${opts.scenario}" in ${loaded.scenariosPath}`);
+        process.exit(2);
+      }
+    }
+    if (opts.tag) {
+      scenarios = scenarios.filter((s) => (s.tags || []).includes(opts.tag));
+      if (scenarios.length === 0) {
+        console.error(`✗ no scenarios tagged "${opts.tag}" in ${loaded.scenariosPath}`);
+        process.exit(2);
+      }
+    }
 
-    // Status mode
-    if (opts.status) {
-      const statusId = runId || storyIdOrRunId;
+    // --no-llm: validate + print plan, exit 0. Lets adopters check shape
+    // without spending tokens or burning CI minutes (per the memory
+    // [CI Minutes Budget]).
+    //
+    // commander.js converts `--no-llm` to opts.llm = false.
+    if (opts.llm === false) {
+      console.log(`Hone Skill Eval — dry run (--no-llm)`);
+      console.log('====================================');
+      console.log(`Skill:           ${loaded.skill}`);
+      console.log(`SKILL.md:        ${loaded.skillPath}`);
+      console.log(`eval-scenarios:  ${loaded.scenariosPath}`);
+      console.log(`Scenarios:       ${scenarios.length} matched`);
+      console.log('');
+      for (const s of scenarios) {
+        const tagStr = s.tags?.length ? `  [${s.tags.join(', ')}]` : '';
+        console.log(`  ${s.id}  ${s.category.padEnd(16)} ${s.name}${tagStr}`);
+      }
+      process.exit(0);
+    }
+
+    // Provider wiring — gh-models default. Inline + per-provider so a
+    // future provider addition lives in one switch.
+    const axios = require('axios');
+    // Pass-2 review caught the original 32000-char slice collided with
+    // GH Models' documented 8000-token request-body cap (see
+    // `cli/lib/release-review-config.js:49-68`). A real adopter
+    // SKILL.md after years of derivations is plausibly 20-40K chars;
+    // 32K leaves zero budget for scenario.input + JSON envelope, so
+    // GH Models returns HTTP 400 and every scenario errors. 8000
+    // chars ≈ ~2000 tokens for the system slot, leaving ~6000 tokens
+    // for scenario.input + envelope — comfortable under GH Models'
+    // cap while still preserving enough of the skill body to evaluate
+    // adopter patterns.
+    const MAX_SKILL_PROMPT_CHARS = 8000;
+    let apiKey, modelLabel, callLLM;
+    if (opts.provider === 'gh-models') {
+      apiKey = process.env.GITHUB_TOKEN;
+      if (!apiKey) {
+        console.error('✗ GITHUB_TOKEN not set. Required for --provider gh-models.');
+        console.error('  In CI: GITHUB_TOKEN is auto-injected. Locally: export GITHUB_TOKEN=<your PAT>.');
+        // Exit 2 — operator config error, NOT a skill regression.
+        // Pass-2 review caught: exit 1 collided with the CI-gate exit
+        // code for eval failures, so a missing secret was reported
+        // as "skill regression" by the CI gate. The convention from
+        // the regression at line 172-188 is exit 2 for operator
+        // errors, exit 1 for eval failures.
+        process.exit(2);
+      }
+      modelLabel = 'openai/gpt-4.1';
+      callLLM = async (systemPrompt, userPrompt) => {
+        const { data } = await axios.post(
+          'https://models.github.ai/inference/chat/completions',
+          {
+            model: modelLabel,
+            messages: [
+              { role: 'system', content: systemPrompt.slice(0, MAX_SKILL_PROMPT_CHARS) },
+              { role: 'user',   content: userPrompt },
+            ],
+            max_tokens: 2048,
+          },
+          {
+            headers: {
+              'Authorization': `Bearer ${apiKey}`,
+              'Content-Type': 'application/json',
+            },
+            timeout: 120000,
+          }
+        );
+        return data.choices?.[0]?.message?.content || '';
+      };
+    } else if (opts.provider === 'claude-haiku') {
+      apiKey = process.env.ANTHROPIC_API_KEY;
+      if (!apiKey) {
+        console.error('✗ ANTHROPIC_API_KEY not set. Required for --provider claude-haiku.');
+        console.error('  Set: export ANTHROPIC_API_KEY=sk-ant-...');
+        // Exit 2 — operator config error (see gh-models branch).
+        process.exit(2);
+      }
+      modelLabel = 'claude-haiku-4-5-20251001';
+      callLLM = async (systemPrompt, userPrompt) => {
+        const { data } = await axios.post('https://api.anthropic.com/v1/messages', {
+          model: modelLabel,
+          max_tokens: 2048,
+          system: systemPrompt.slice(0, MAX_SKILL_PROMPT_CHARS),
+          messages: [{ role: 'user', content: userPrompt }],
+        }, {
+          headers: {
+            'x-api-key': apiKey,
+            'anthropic-version': '2023-06-01',
+            'content-type': 'application/json',
+          },
+          timeout: 120000,
+        });
+        return data.content?.[0]?.text || '';
+      };
+    } else {
+      console.error(`✗ Invalid --provider: ${opts.provider}. Use 'gh-models' or 'claude-haiku'.`);
+      process.exit(2);
+    }
+
+    // Stream progress so the operator sees a heartbeat on long runs
+    // (8-15 dev scenarios × ~5-20s LLM round-trip = 1-5 min per skill).
+    const onProgress = (cur, total, lastResult) => {
+      if (opts.format === 'json') return; // JSON mode is silent until the final dump
+      const icon = lastResult.result === 'pass' ? '✓'
+                 : lastResult.result === 'fail' ? '✗'
+                 : '!';
+      process.stderr.write(
+        `  [${cur}/${total}] ${icon} ${lastResult.id} — ${lastResult.name}\n`
+      );
+    };
+
+    if (opts.format !== 'json') {
+      console.log(`Hone Skill Eval — ${loaded.skill}`);
+      console.log(`Provider: ${opts.provider} (${modelLabel})`);
+      console.log(`Scenarios: ${scenarios.length}`);
+      console.log('');
+    }
+
+    const summary = await runAllSkillScenarios({
+      scenarios,
+      skillContent: loaded.skillContent,
+      callLLM,
+      failFast: opts.failFast,
+      onProgress,
+    });
+
+    console.log(formatResults(summary, opts.format));
+
+    // Exit 1 on any non-pass so CI (HC-019f-style gate) can wire this
+    // as a required check. Per the [Pipeline LLM Cost Reduction]
+    // memory, this gate can run in CI on the gh-models default with
+    // zero adopter cost.
+    process.exit(summary.failed + summary.errors > 0 ? 1 : 0);
+  });
+
+// ── HC-041: Run Story (Orchestrator) ─────────────────────────────────────────
+program
+  .command('run-story <storyId>')
+  .description('Run the SDLC pipeline for a story via the orchestrator')
+  .option('--mode <mode>', 'Execution mode: interactive or batch', 'interactive')
+  .option('--repo <name>', 'Repository name override (default: directory name)')
+  .option('--branch <name>', 'Git branch (default: current)')
+  .option('--status', 'Show status of the latest workflow run for this story')
+  .option('--kill', 'Kill the latest workflow run for this story')
+  .option('--approve <step>', 'Approve a paused gate (e.g., --approve step_0)')
+  .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
+  .option('--poll-interval <s>', 'Poll interval in seconds', '5')
+  .option('--include-paths <paths>', 'Comma-separated list of source file paths to bundle into the codebase context (HC-019n-followup-12). Augments auto-detected paths from the issue body.')
+  .option('--e2e-specs', 'HC-019n-followup-28: force step_3b (Playwright spec generation) ON for this run (overrides e2e.spec_generation config)')
+  .option('--skip-e2e-specs', 'HC-019n-followup-28: force step_3b (Playwright spec generation) OFF for this run (overrides e2e.spec_generation config)')
+  .action(async (storyIdOrRunId, opts) => {
+    const config = getConfig();
+    const client = api(config);
+
+    // Resolve: if it looks like a UUID, use as runId directly.
+    // Otherwise treat as storyId — will be used for POST /orchestrate body.
+    const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(storyIdOrRunId);
+    const storyId = isUuid ? null : storyIdOrRunId;
+    const runId = isUuid ? storyIdOrRunId : null;
+
+    // Status mode
+    if (opts.status) {
+      const statusId = runId || storyIdOrRunId;
       try {
         const { data } = await client.get(`/orchestrate/${statusId}`);
         if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
@@ -4523,8 +5418,16 @@ program
     // fail, private repo without auth): warn and proceed without context.
     // The existing HC-019n-followup-7 hard_pause safety net catches the
     // resulting placeholder cascade at step_1.
+    //
+    // HC-019b-followup-1 F1: when invoked with an issue number, also try
+    // to extract a canonical story-id (e.g. HC-019b) from the issue title.
+    // Used by the architect-config read below — without this, the lookup
+    // keys on '104' instead of 'HC-019b' and silently bypasses every
+    // architect-engaged story whose EXECUTION_PLAN.yml entry uses the
+    // canonical id (which is the common adopter case).
     const orchestrateConfig = {};
     let issueBodyForFiles = null;
+    let resolvedStoryId = storyIdOrRunId; // canonical id for architect-config lookup
     if (/^\d+$/.test(storyIdOrRunId)) {
       try {
         const remoteUrl = execSync('git remote get-url origin', { encoding: 'utf8' }).trim();
@@ -4540,10 +5443,60 @@ program
         orchestrateConfig.story_description = desc;
         issueBodyForFiles = `${issue.title}\n${issue.body || ''}`;
         console.log(`  → fetched GitHub issue #${storyIdOrRunId} for story context (${desc.length} chars)`);
+        // HC-019b-followup-1 F1: extract the canonical story-id from the
+        // issue title. extractStoryIdFromBranch's regex (STORY_ID_PATTERN
+        // in pipeline-status.js) handles HC-NNN, HC-NNN-A, H-NNNb, E22-D,
+        // and HC-NNN-followup-N shapes after H-029-followup-2.
+        try {
+          const { extractStoryIdFromBranch } = require('./lib/pipeline-status');
+          const titleId = extractStoryIdFromBranch(issue.title);
+          if (titleId) {
+            resolvedStoryId = titleId;
+            console.log(`  → resolved issue #${storyIdOrRunId} → canonical story id '${titleId}' for architect-config lookup`);
+          } else {
+            console.warn(`  ⚠ could not extract canonical story id from issue title '${issue.title}' — architect-config lookup will use '${storyIdOrRunId}' (likely silent miss)`);
+          }
+        } catch { /* extractor missing/throws → fall back to numeric id */ }
       } catch (e) {
         const msg = (e && e.message) ? e.message.split('\n')[0] : String(e);
         console.warn(`  ⚠ could not fetch GitHub issue context: ${msg}`);
         console.warn('  → proceeding without story_description; step_0 may produce placeholder output');
+        console.warn(`  ⚠ architect-config lookup will use '${storyIdOrRunId}' (likely silent miss)`);
+      }
+    } else {
+      // HC-019n-followup-18: roadmap-sourced story. Only the SERVER knows what
+      // the story says (server/seeds/master-roadmap.md is a Hone asset, absent
+      // from adopter repos) and only the CLI can read the adopter's disk — so
+      // ask the server what the description references, then read those files
+      // here. See .github/pipeline/HC-019n-followup-18/architect.md §1 for why
+      // this beats the CLI reading a local roadmap (hardcodes a Hone-internal
+      // path into the adopter CLI, and fails silently anywhere else).
+      //
+      // Advisory, never fatal: a story with no resolvable context still runs,
+      // it just runs blind — and loudly, via the followup-17 warning below.
+      try {
+        const ctxClient = api(config);
+        const { data } = await ctxClient.get(
+          `/stories/${encodeURIComponent(storyIdOrRunId)}/context`
+        );
+        if (data && data.description) {
+          orchestrateConfig.story_description = data.description;
+          issueBodyForFiles = data.description;
+          const n = Array.isArray(data.referencedPaths) ? data.referencedPaths.length : 0;
+          console.log(
+            `  → resolved story context from roadmap (${data.description.length} chars, ` +
+            `${n} referenced path${n === 1 ? '' : 's'})`
+          );
+        }
+      } catch (e) {
+        const status = e && e.response && e.response.status;
+        if (status === 404) {
+          console.warn(`  ⚠ no roadmap row found for '${storyIdOrRunId}'`);
+        } else {
+          const msg = (e && e.message) ? e.message.split('\n')[0] : String(e);
+          console.warn(`  ⚠ could not fetch story context: ${msg}`);
+        }
+        console.warn('  → proceeding without story context; the warning below applies');
       }
     }
 
@@ -4586,6 +5539,45 @@ program
             candidates.add(p);
           }
         }
+        // HC-019n-followup-26: FILE_PATH_RE above requires a directory segment,
+        // so a story that names a file BARE (`derive-worker.js:787` in prose)
+        // extracts 0 paths and step_4 runs blind — and, blind, hallucinates a
+        // file at a non-existent path (2026-08-30 e2e demo). Catch bare refs too
+        // and resolve each against the repo's own file list: bundle ONLY on a
+        // unique basename match; never guess an ambiguous or absent one.
+        // HC-019n-followup-27: candidate path → referenced line number, so the
+        // bundler can WINDOW a too-big file around its edit site instead of
+        // head-truncating past it (the demo's line 787 sits at char 37K).
+        const candidateLines = new Map();
+        if (issueBodyForFiles) {
+          const { extractBareRefs, resolveBareName, alreadyCovered } = require('./lib/bundle-paths');
+          const { gitEnv } = require('./lib/git-env');
+          const bareRefs = extractBareRefs(issueBodyForFiles);
+          if (bareRefs.length > 0) {
+            let repoFiles = null;
+            const listRepoFiles = () => {
+              if (repoFiles) return repoFiles;
+              try {
+                repoFiles = execSync('git ls-files', {
+                  cwd: process.cwd(), env: gitEnv(), encoding: 'utf8', maxBuffer: 64 * 1024 * 1024,
+                }).split('\n').filter(Boolean);
+              } catch { repoFiles = []; }
+              return repoFiles;
+            };
+            for (const { name, line } of bareRefs) {
+              if (alreadyCovered(name, candidates)) continue;
+              const r = resolveBareName(name, listRepoFiles());
+              if (r.status === 'unique') {
+                candidates.add(r.path);
+                if (line && !candidateLines.has(r.path)) candidateLines.set(r.path, line);
+                console.log(`  → resolved bare ref '${name}${line ? ':' + line : ''}' → ${r.path}`);
+              } else if (r.status === 'ambiguous') {
+                console.warn(`  ⚠ '${name}' is ambiguous (${r.matches.length} files) — not bundling; use --include-paths to disambiguate`);
+              }
+              // status === 'none' → not every filename in prose is a repo file; skip quietly
+            }
+          }
+        }
         // HC-019n-followup-13d: bump caps. Pre-fix MAX_FILES=10 /
         // MAX_TOTAL_CHARS=50_000 / MAX_PER_FILE_CHARS=10_000 was overly
         // conservative — OptionsFlow #96 hit 49,783/50,000 with 6 files
@@ -4609,7 +5601,23 @@ program
             content = fs.readFileSync(abs, 'utf8');
           } catch { continue; }
           if (content.length > MAX_PER_FILE_CHARS) {
-            content = content.slice(0, MAX_PER_FILE_CHARS) + `\n\n# [HC-019n-followup-12: truncated at ${MAX_PER_FILE_CHARS} chars; full file is ${content.length} chars]`;
+            const line = candidateLines.get(candidate);
+            if (line) {
+              // HC-019n-followup-27: window around the referenced line so step_4
+              // SEES the edit site (head-truncation would hide a site past the
+              // cut) and can write a region-edit anchor. The window marker tells
+              // step_4 to emit an `edit:` block, not a whole-file block.
+              const { windowAroundLine } = require('./lib/bundle-paths');
+              const w = windowAroundLine(content, line, Math.floor((MAX_PER_FILE_CHARS - 800) / 2));
+              content =
+                `# [HC-019n-followup-27: windowed excerpt, lines ${w.startLine}-${w.endLine} of ${w.totalLines} ` +
+                `(centered on referenced line ${line}); you were NOT shown the whole file — ` +
+                `emit an \`edit:\` block with a unique OLD anchor from this excerpt, NOT a whole-file \`file:\` block]\n` +
+                w.excerpt +
+                `\n# [end windowed excerpt of ${candidate}]`;
+            } else {
+              content = content.slice(0, MAX_PER_FILE_CHARS) + `\n\n# [HC-019n-followup-12: truncated at ${MAX_PER_FILE_CHARS} chars; full file is ${content.length} chars]`;
+            }
           }
           if (totalChars + content.length > MAX_TOTAL_CHARS) break;
           totalChars += content.length;
@@ -4625,6 +5633,126 @@ program
       }
     }
 
+    // HC-019n-followup-17: warn when the code-aware steps will run BLIND.
+    //
+    // Auto-detection reads file paths out of `issueBodyForFiles`, which is only
+    // populated on the numeric-GitHub-issue branch above. A roadmap-sourced id
+    // (HC-CI-005, SC-002-followup-2, ...) never enters that branch, so
+    // `codebaseFiles` stays unset and step_1 / step_4 / step_5 / step_5d /
+    // step_5e all run with no source to read — the exact "confidently wrong"
+    // failure HC-019n-followup-12 was built to prevent, still open for roadmap
+    // ids. Observed 2026-08-29: run 61fddfb2 wrote 8,444 chars of code for
+    // HC-CI-005 having never seen the files that story names.
+    //
+    // A fix is structurally awkward: only the CLI can read adopter files, and
+    // only the SERVER knows the roadmap description (server/seeds/master-
+    // roadmap.md is a Hone asset, absent from adopter repos). Closing it needs
+    // the CLI to fetch the resolved description before queueing — a round trip
+    // that belongs in its own story. Until then the gap is at least LOUD
+    // instead of silent, which is the part that actually bit.
+    if (!orchestrateConfig.codebaseFiles) {
+      console.warn('  ⚠ no codebase files bundled — step_1 / step_4 / step_5 / step_5d / step_5e');
+      console.warn('    will run WITHOUT source context and may invent APIs that do not exist.');
+      if (!/^\d+$/.test(storyIdOrRunId)) {
+        console.warn(`    '${storyIdOrRunId}' is not a GitHub issue number, so file paths cannot be`);
+        console.warn('    auto-detected from an issue body.');
+      }
+      console.warn('    Fix: hone run-story <id> --include-paths path/one.js,path/two.js');
+    }
+
+    // HC-101-followup-2: pass the adopter's CI gate config to the
+    // orchestrator so step_5c can branch (github / local / both / none).
+    // Defaults to gate=github + local_command='make ci' when the config
+    // is missing — backward-compat for adopters whose .pipeline-config.yml
+    // predates this field.
+    try {
+      const { readCIGateConfig } = require('./lib/pipeline-config');
+      const ciGate = readCIGateConfig(process.cwd());
+      orchestrateConfig.ci_gate = ciGate.gate;
+      orchestrateConfig.ci_local_command = ciGate.local_command;
+      console.log(`  → CI gate mode: ${ciGate.gate}${ciGate.gate !== 'github' ? ` (local_command: ${ciGate.local_command})` : ''}`);
+    } catch (e) {
+      const msg = (e && e.message) ? e.message.split('\n')[0] : String(e);
+      console.warn(`  ⚠ CI gate config read failed (non-fatal, defaulting to gate=github): ${msg}`);
+      orchestrateConfig.ci_gate = 'github';
+      orchestrateConfig.ci_local_command = 'make ci';
+    }
+
+    // HC-019n-followup-28: resolve the E2E spec-generation mode (step_3b /
+    // Playwright). Precedence mirrors ci.gate: per-run flag > .pipeline-config.yml
+    // `e2e.spec_generation` > default `auto`. `auto` = the orchestrator runs
+    // step_3b when the story requires an E2E plan (step_0 emitted `yes`); `never`
+    // = step_3b is always skipped. The runtime "is E2E required?" decision stays
+    // server-side (checkE2eRequirement reads step_0's output) — the CLI only
+    // passes the MODE.
+    try {
+      const { readE2eSpecMode } = require('./lib/pipeline-config');
+      let e2eMode, source;
+      if (opts.e2eSpecs) { e2eMode = 'auto'; source = '--e2e-specs'; }
+      else if (opts.skipE2eSpecs) { e2eMode = 'never'; source = '--skip-e2e-specs'; }
+      else { e2eMode = readE2eSpecMode(process.cwd()); source = 'config/default'; }
+      orchestrateConfig.e2e_spec_generation = e2eMode;
+      // Enable step_3b (conditional) unless the adopter opted out. The row is
+      // then created; the orchestrator still skips it at runtime for a story that
+      // does not require an E2E plan (HC-019n-followup-28).
+      if (e2eMode !== 'never') {
+        const ec = new Set(orchestrateConfig.enableConditional || []);
+        ec.add('step_3b');
+        orchestrateConfig.enableConditional = [...ec];
+      }
+      console.log(`  → E2E spec generation (step_3b): ${e2eMode} (source: ${source})`);
+    } catch (e) {
+      const msg = (e && e.message) ? e.message.split('\n')[0] : String(e);
+      console.warn(`  ⚠ e2e spec-mode read failed (non-fatal, defaulting to auto): ${msg}`);
+      orchestrateConfig.e2e_spec_generation = 'auto';
+    }
+
+    // HC-019n-followup-34: thread the closed-loop verification gate mode from
+    // .pipeline-config.yml. Advisory (default) = the server RECORDS verify-patch/
+    // verify-pr verdicts reported via --report; enforce (follow-up) = a red
+    // verdict blocks. Default-safe: never fatal.
+    try {
+      const { readVerificationGateConfig, readVerificationGateSources } = require('./lib/pipeline-config');
+      orchestrateConfig.verification_gate = readVerificationGateConfig(process.cwd());
+      // HC-COMM-011-followup-6: which verdict sources may DRIVE the step_4 gate under
+      // enforce (default ['verify-patch']). An adopter adds 'agent-eval' to let a
+      // green agent-eval verdict auto-advance a prompt change.
+      orchestrateConfig.verification_gate_sources = readVerificationGateSources(process.cwd());
+      if (orchestrateConfig.verification_gate !== 'advisory') {
+        console.log(`  → verification gate: ${orchestrateConfig.verification_gate} (sources: ${orchestrateConfig.verification_gate_sources.join(', ')})`);
+      }
+    } catch (e) {
+      const msg = (e && e.message) ? e.message.split('\n')[0] : String(e);
+      console.warn(`  ⚠ verification-gate read failed (non-fatal, defaulting to advisory): ${msg}`);
+      orchestrateConfig.verification_gate = 'advisory';
+      orchestrateConfig.verification_gate_sources = ['verify-patch'];
+    }
+
+    // HC-019b: read per-story architect flags from .github/EXECUTION_PLAN.yml
+    // and plumb them into workflow_runs.config. The orchestrator's
+    // validateStepPreConditions (server/src/services/workflow-dag.js:340)
+    // BLOCKS step_1 when architect_consulted=true but checklist_b_completed=false.
+    // Without this plumbing, the HC-019a flags written by the architect prompt
+    // never reach the server and every architect-engaged story deadlocks.
+    // Defaults to {false, false} when the file/story/config is missing —
+    // i.e., assume the architect was not consulted (no block).
+    //
+    // Code-review F2/F3: malformed YAML or missing story entry was previously
+    // silent. The helper now returns a `diagnostic` string for those cases;
+    // we surface it as a console.warn so operators see the silent-bypass.
+    // HC-019b-followup-1 F1: use the resolved canonical story-id (HC-NNN)
+    // not the raw `storyIdOrRunId` which is the issue number when invoked
+    // as `hone run-story 104`. The HC-019n-followup-11 block above sets
+    // resolvedStoryId to the title-extracted id when it can.
+    const { readArchitectConfig } = require('./lib/architect-config');
+    const arch = readArchitectConfig(process.cwd(), resolvedStoryId);
+    orchestrateConfig.architect_consulted  = arch.architect_consulted;
+    orchestrateConfig.checklist_b_completed = arch.checklist_b_completed;
+    if (arch.diagnostic) console.warn(`  ⚠ ${arch.diagnostic}`);
+    if (arch.architect_consulted) {
+      console.log(`  → architect_consulted: true, checklist_b_completed: ${arch.checklist_b_completed}`);
+    }
+
     try {
       const { data } = await client.post('/orchestrate', {
         storyId: storyIdOrRunId, repoName, branch, mode: opts.mode, config: orchestrateConfig,
@@ -4923,33 +6051,94 @@ program
       catch { branch = null; }
     }
 
+    // HC-019b: read EXECUTION_PLAN.yml ONCE up front so the per-story lookup
+    // doesn't re-stat the disk for each line. Empty text \u2192 all stories get
+    // the {false, false} default per architect-config.js. Try/catch keeps
+    // the batch path resilient if the file is missing or unreadable.
+    let planText = '';
+    try {
+      const planPath = path.join(process.cwd(), '.github', 'EXECUTION_PLAN.yml');
+      if (fs.existsSync(planPath)) planText = fs.readFileSync(planPath, 'utf8');
+    } catch (e) {
+      const msg = (e && e.message) ? e.message.split('\n')[0] : String(e);
+      console.warn(`\u26a0 EXECUTION_PLAN.yml read failed for batch (non-fatal, architect flags default to {false, false}): ${msg}`);
+    }
+    const { readArchitectConfigFromText } = require('./lib/architect-config');
+
     // HC-059: parse `STORY-A depends:STORY-B,STORY-C` per-line syntax. The
     // `depends:` token is case-sensitive and must come AFTER the storyId.
     // Multiple deps separated by commas, whitespace tolerant. Lines without
     // `depends:` yield no `dependsOn` (server validates absence vs empty).
+    // HC-019b: attach per-story `config: { architect_consulted, checklist_b_completed }`
+    // \u2014 the server's createBatch (batch-store.js:218) spreads s.config into each
+    // workflow_runs.config row, so this is the load-bearing plumbing for
+    // validateStepPreConditions (workflow-dag.js:340) in batch mode.
     const stories = storyIds.map(line => {
       const depsMatch = line.match(/^(\S+)\s+depends:(\S+)\s*$/);
+      let storyId, dependsOn;
       if (depsMatch) {
         const [, id, depsCsv] = depsMatch;
-        const dependsOn = depsCsv.split(',').map(s => s.trim()).filter(Boolean);
-        return { storyId: id, repoName, branch, dependsOn };
-      }
-      // Reject ambiguous lines (storyId followed by garbage) \u2014 better than
-      // silently treating `STORY-A something` as just `STORY-A`.
-      if (/\s/.test(line)) {
-        console.error(`Malformed line in --file: "${line}"`);
-        console.error(`  Expected: "STORY-ID"  OR  "STORY-ID depends:STORY-B,STORY-C"`);
-        process.exit(1);
-      }
-      return { storyId: line, repoName, branch };
+        storyId = id;
+        dependsOn = depsCsv.split(',').map(s => s.trim()).filter(Boolean);
+      } else {
+        // Reject ambiguous lines (storyId followed by garbage) \u2014 better than
+        // silently treating `STORY-A something` as just `STORY-A`.
+        if (/\s/.test(line)) {
+          console.error(`Malformed line in --file: "${line}"`);
+          console.error(`  Expected: "STORY-ID"  OR  "STORY-ID depends:STORY-B,STORY-C"`);
+          process.exit(1);
+        }
+        storyId = line;
+        dependsOn = undefined;
+      }
+      const arch = readArchitectConfigFromText(planText, storyId);
+      // Code-review F2/F3: surface silent-bypass diagnostics per story in
+      // the batch path too. Multi-story batches with one bad plan line
+      // would previously disable the contract for ALL stories silently.
+      if (arch.diagnostic) console.warn(`  ⚠ [${storyId}] ${arch.diagnostic}`);
+      const obj = {
+        storyId,
+        repoName,
+        branch,
+        config: {
+          architect_consulted:  arch.architect_consulted,
+          checklist_b_completed: arch.checklist_b_completed,
+        },
+      };
+      if (Array.isArray(dependsOn) && dependsOn.length > 0) obj.dependsOn = dependsOn;
+      return obj;
     });
 
     // HC-054: Night Shift opt-in. config.overnight=true plumbs end-to-end
     // (server validates the 25-story cap + applies default token budget +
     // denormalizes flag into each child's workflow_runs.config).
     const body = { stories };
+    body.config = body.config || {};
     if (opts.overnight) {
-      body.config = { overnight: true };
+      body.config.overnight = true;
+    }
+
+    // HC-101-followup-2: plumb the adopter's CI gate config to every story
+    // in the batch. Without this, the batch path would silently default to
+    // gate=github on the server even when .pipeline-config.yml says local/none —
+    // exactly the "silent skip" the design warned against. Same try/catch
+    // pattern as the run-story path (cli/hone-cli.js ~L4628).
+    try {
+      const { readCIGateConfig, DEFAULT_CI_LOCAL_COMMAND } = require('./lib/pipeline-config');
+      const ciGate = readCIGateConfig(process.cwd());
+      body.config.ci_gate = ciGate.gate;
+      body.config.ci_local_command = ciGate.local_command;
+      if (ciGate.gate !== 'github') {
+        console.log(`CI gate mode for batch: ${ciGate.gate} (local_command: ${ciGate.local_command})`);
+      }
+    } catch (e) {
+      const msg = (e && e.message) ? e.message.split('\n')[0] : String(e);
+      console.warn(`⚠ CI gate config read failed for batch (non-fatal, defaulting to gate=github): ${msg}`);
+      body.config.ci_gate = 'github';
+      try {
+        const { DEFAULT_CI_LOCAL_COMMAND } = require('./lib/pipeline-config');
+        body.config.ci_local_command = DEFAULT_CI_LOCAL_COMMAND;
+      } catch { body.config.ci_local_command = 'make ci'; }
     }
 
     try {
@@ -4980,6 +6169,71 @@ program
     }
   });
 
+// ── HC-054g: Night-shift retroactive revert command ─────────────────────────
+//
+// Two-step operator workflow after rejected_rate drift (HC-054c) flags a
+// batch of bad overnight auto-approves:
+//
+//   1. `hone night-shift revert <runId> --step-key <key> --revert-pr <url>`
+//   2. CLI calls POST /night-shift/runs/:runId/retroactive-reject (if not yet)
+//      then POST /night-shift/runs/:runId/revert with the revert PR URL.
+//
+// We deliberately don't take repo write access; the operator runs the git
+// revert themselves and passes the resulting revert-PR URL. This keeps the
+// server side free of GitHub credentials + repo-specific permissions while
+// still giving the audit log the revert provenance.
+const nightShiftCmd = program.command('night-shift').description('HC-054 night-shift audit + revert workflow');
+nightShiftCmd
+  .command('revert <runId>')
+  .description('Record a revert action for a retroactively-rejected overnight auto-approve')
+  .requiredOption('--step-key <stepKey>', 'The step_key whose auto-approve produced the bad output (e.g. step_4 or step_5)')
+  .requiredOption('--revert-pr <url>', 'GitHub PR URL of the revert commit (https://github.com/.../pull/<n>)')
+  .option('--reason <reason>', 'Free-text reason for the retroactive rejection (recorded with the audit row)')
+  .action(async (runId, opts) => {
+    const config = getConfig();
+    const client = api(config);
+    try {
+      // Step 1: retroactively-reject if not yet rejected. The endpoint
+      // returns 409 if already rejected — we treat that as a no-op
+      // (operator may have done step 1 yesterday, run revert today).
+      try {
+        await client.post(`/night-shift/runs/${runId}/retroactive-reject`, {
+          stepKey: opts.stepKey,
+          reason: opts.reason,
+        });
+        console.log(`[night-shift] retroactively rejected (runId=${runId}, stepKey=${opts.stepKey})`);
+      } catch (e) {
+        const status = e.response?.status;
+        if (status === 409) {
+          console.log(`[night-shift] already retroactively rejected (continuing to revert step)`);
+        } else if (status === 404) {
+          console.error(`hone night-shift revert failed: no auto-approve audit row for (runId=${runId}, stepKey=${opts.stepKey})`);
+          process.exit(1);
+        } else {
+          throw e;
+        }
+      }
+
+      // Step 2: record the revert PR URL.
+      const r = await client.post(`/night-shift/runs/${runId}/revert`, {
+        stepKey: opts.stepKey,
+        revertPrUrl: opts.revertPr,
+      });
+      console.log(`[night-shift] revert recorded:`);
+      console.log(`  runId:             ${r.data.runId}`);
+      console.log(`  stepKey:           ${r.data.stepKey}`);
+      console.log(`  revertInitiatedAt: ${r.data.revertInitiatedAt}`);
+      console.log(`  revertPrUrl:       ${r.data.revertPrUrl}`);
+    } catch (e) {
+      const msg = e.response?.data?.error || e.message;
+      console.error(`hone night-shift revert failed: ${msg}`);
+      if (e.response?.data?.remediation) {
+        console.error(`Remediation: ${e.response.data.remediation}`);
+      }
+      process.exit(1);
+    }
+  });
+
 // ── HC-056: Schedule install (GitHub Actions overnight template) ────────────
 //
 // Installs a parameterized .github/workflows/<name>.yml that runs `hone
@@ -5001,6 +6255,9 @@ program
   .option('--file <path>', 'Default stories file path (relative to repo root)', 'stories.txt')
   .option('--out <dir>', 'Output directory for the workflow file', '.github/workflows')
   .option('--force', 'Overwrite existing workflow file', false)
+  .option('--overnight <mode>',
+    'Night Shift mode: auto (default — derives from cron hour) | yes | no (HC-054f)',
+    'auto')
   .action(async (action, opts) => {
     if (action !== 'install') {
       console.error(`Unknown schedule action: ${action}. Supported: install`);
@@ -5026,6 +6283,22 @@ program
       process.exit(1);
     }
 
+    // HC-054f: derive whether the workflow should pass --overnight to
+    // queue-stories. Defaults to 'auto' which inspects the cron hour.
+    // Pass-1 review HIGH #1 fix: validate the mode value UPFRONT and
+    // exit non-zero on typos — otherwise `--overnight YES` or
+    // `--overnight on` silently fell back to auto, contradicting
+    // adopter intent.
+    const { analyzeCron, resolveOvernight, isKnownOvernightMode } = require('./lib/schedule-cron');
+    if (!isKnownOvernightMode(opts.overnight)) {
+      console.error(`Invalid --overnight value "${opts.overnight}".`);
+      console.error('Accepted: auto (default — derives from cron hour) | yes | no');
+      console.error('Aliases: true/false/1/0/on/off/enable/disable also work (case-insensitive).');
+      process.exit(1);
+    }
+    const cronAnalysis = analyzeCron(opts.cron);
+    const overnightDecision = resolveOvernight(opts.overnight, cronAnalysis);
+
     const config = getConfig();
     const client = api(config);
 
@@ -5054,10 +6327,16 @@ program
 
     // 2. Substitute placeholders. Use replace-all so any future template
     // additions referencing the same placeholder are handled.
+    // HC-054f: {{OVERNIGHT_FLAG}} → either ` --overnight` (with leading
+    // space) or empty string. The leading space keeps the queue-stories
+    // command tidy when the flag is absent. Templates written before
+    // HC-054f don't carry the placeholder — replace-all is a no-op there.
+    const overnightFlag = overnightDecision.overnight ? ' --overnight' : '';
     const populated = template
       .replace(/\{\{NAME\}\}/g, opts.name)
       .replace(/\{\{CRON\}\}/g, opts.cron)
-      .replace(/\{\{STORIES_FILE\}\}/g, opts.file);
+      .replace(/\{\{STORIES_FILE\}\}/g, opts.file)
+      .replace(/\{\{OVERNIGHT_FLAG\}\}/g, overnightFlag);
 
     // 3. Decide output path. Default writes to `.github/workflows/<name>.yml`.
     const outDir = path.resolve(process.cwd(), opts.out);
@@ -5078,8 +6357,23 @@ program
     console.log('');
     console.log(`✓ Installed schedule: ${path.relative(process.cwd(), outFile)}`);
     console.log('');
-    console.log('  Schedule: ' + opts.cron + ' (UTC)');
-    console.log('  Stories:  ' + opts.file);
+    console.log('  Schedule:  ' + opts.cron + ' (UTC)');
+    console.log('  Stories:   ' + opts.file);
+    // HC-054f: surface the overnight decision + WHY so the adopter
+    // sees that a `0 2 * * 1-5` cron auto-enabled Night Shift without
+    // having to dig into the workflow file.
+    const overnightLabel = overnightDecision.overnight ? 'ENABLED' : 'disabled';
+    // HC-054f pass-1 review LOW: if the source enum ever grows, the
+    // `|| ''` fallback would emit a dangling trailing space. Use an
+    // explicit `unknown-source` marker so a future enum addition fails
+    // loudly in CI rather than silently degrading the output.
+    const sourceLabel = {
+      'explicit-yes':    '(--overnight yes)',
+      'explicit-no':     '(--overnight no)',
+      'auto-detect-yes': '(auto-detected: ' + cronAnalysis.reason + ')',
+      'auto-detect-no':  '(auto-detected: ' + cronAnalysis.reason + ')',
+    }[overnightDecision.source] || `(unknown-source:${overnightDecision.source})`;
+    console.log(`  Overnight: ${overnightLabel} ${sourceLabel}`);
     console.log('');
     console.log('Next steps:');
     console.log('  1. Ensure repo secret HONE_TOKEN is set');
@@ -5099,12 +6393,13 @@ program
 
 program
   .command('release-review')
-  .description('Holistic code review of all changed files before deployment (runs Opus)')
+  .description('Holistic code review of all changed files before deployment (default: GH Models, $0)')
   .option('--base <branch>', 'Base branch to diff against', 'main')
   .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
   .option('--dry-run', 'Show what would be reviewed without calling the LLM', false)
   .option('--max-files <n>', 'Max source files to include in review', '40')
-  .option('--provider <name>', 'LLM provider: opus | gh-models (HC-080a-spike)', 'opus')
+  .option('--provider <name>', 'LLM provider: gh-models (default, $0) | opus (legacy, paid)', 'gh-models')
+  .option('--cache <mode>', 'HC-RC-002-followup-1 content-hash cache: on | off (default on)', 'on')
   .action(async (opts) => {
     const { execSync } = require('child_process');
     const fs = require('fs');
@@ -5146,11 +6441,11 @@ program
     // 1. Get changed files
     let changedFiles;
     try {
-      const raw = execSync(`git diff --name-only ${baseRef}...HEAD`, { encoding: 'utf8', cwd: repoRoot });
+      const raw = execSync(`git diff --name-only ${baseRef}...HEAD`, { encoding: 'utf8', cwd: repoRoot, env: gitEnv() });
       changedFiles = raw.trim().split('\n').filter(Boolean);
     } catch {
       try {
-        const raw = execSync('git diff --name-only HEAD~10', { encoding: 'utf8', cwd: repoRoot });
+        const raw = execSync('git diff --name-only HEAD~10', { encoding: 'utf8', cwd: repoRoot, env: gitEnv() });
         changedFiles = raw.trim().split('\n').filter(Boolean);
       } catch {
         console.error('Could not determine changed files. Run from a git repo.');
@@ -5205,7 +6500,7 @@ program
       }
     } else {
       apiKey = process.env.ANTHROPIC_API_KEY;
-      providerLabel = 'Anthropic Opus (claude-opus-4-20250514)';
+      providerLabel = 'Anthropic Opus (claude-opus-4-8)';
       if (!apiKey) {
         console.error('ANTHROPIC_API_KEY not set. Required for --provider opus.');
         console.error('Set it: export ANTHROPIC_API_KEY=sk-ant-...');
@@ -5217,11 +6512,11 @@ program
     let diffContent;
     try {
       diffContent = execSync(`git diff ${baseRef}...HEAD -- ${filesToReview.map(f => `'${f}'`).join(' ')}`, {
-        encoding: 'utf8', cwd: repoRoot, maxBuffer: 10 * 1024 * 1024,
+        encoding: 'utf8', cwd: repoRoot, env: gitEnv(), maxBuffer: 10 * 1024 * 1024,
       });
     } catch {
       try {
-        diffContent = execSync('git diff HEAD~10', { encoding: 'utf8', cwd: repoRoot, maxBuffer: 10 * 1024 * 1024 });
+        diffContent = execSync('git diff HEAD~10', { encoding: 'utf8', cwd: repoRoot, env: gitEnv(), maxBuffer: 10 * 1024 * 1024 });
       } catch (e) {
         console.error(`Could not generate diff: ${e.message}`);
         process.exit(1);
@@ -5294,6 +6589,89 @@ program
     banner(`Calling ${providerLabel}...`);
     banner('');
 
+    // ── HC-RC-002-followup-1: content-hash cache check ──────────────────
+    //
+    // The contentHash is computed over (diff + systemPrompt + model). A
+    // hit means an earlier run of the SAME diff against the SAME model
+    // produced a review already — replay it for $0 Anthropic spend +
+    // ~50ms instead of ~30s for an Opus call. Pre-fix adopters paid
+    // ~\$1.50 per release-review × ~3 retries per PR.
+    //
+    // Cache is opportunistic: any lookup error falls through to the LLM.
+    // Stamp `cache_hit: true` and `billing_source: 'cache'` on the
+    // envelope so the CI artifact analyzer can distinguish cached from
+    // fresh runs.
+    const {
+      computeReviewContentHash,
+      lookupReviewCache,
+      storeReviewCache,
+      normalizeCacheFlag,
+    } = require('./lib/release-review-cache');
+    const cacheEnabled = normalizeCacheFlag(opts.cache);
+    const modelForCache = opts.provider === 'gh-models'
+      ? 'openai/gpt-4.1'
+      : 'claude-opus-4-8';
+    let cacheContentHash = null;
+    if (cacheEnabled) {
+      try {
+        cacheContentHash = computeReviewContentHash({
+          diff: diffContent,
+          systemPrompt,
+          model: modelForCache,
+        });
+      } catch (e) {
+        banner(`Cache disabled: contentHash computation failed: ${e.message}`);
+      }
+    }
+    if (cacheEnabled && cacheContentHash) {
+      const config = getConfig();
+      const apiBase = (config && config.apiBase) || process.env.HONE_API_BASE;
+      const token = (config && config.token) || process.env.HONE_TOKEN;
+      const cached = await lookupReviewCache({
+        axios,
+        apiBase,
+        token,
+        contentHash: cacheContentHash,
+        model: modelForCache,
+        banner,
+      });
+      if (cached && cached.hit === true) {
+        banner('');
+        banner(`✓ Cache HIT — replaying cached release-review response`);
+        banner(`  Cache key: ${cacheContentHash.slice(0, 16)}…  (hit_count: ${cached.hit_count})`);
+        banner(`  Saved: ~${cached.tokens_saved} tokens  •  billing_source: cache`);
+        banner('');
+        const elapsedMs = 50;  // approximate — actual lookup + response time
+        if (isJsonOut) {
+          const envelope = {
+            status: 'reviewed',
+            base: opts.base,
+            resolvedBase: baseRef,
+            provider: opts.provider,
+            totalFiles: changedFiles.length,
+            sourceFiles: sourceFiles.length,
+            reviewedFiles: filesToReview.length,
+            model: modelForCache,
+            inputTokens: 0,
+            outputTokens: 0,
+            elapsedMs,
+            cache_hit: true,
+            billing_source: 'cache',
+            tokens_saved: cached.tokens_saved,
+          };
+          // Cached responses are already JSON-parsed (server stores JSON);
+          // spread them in then overlay envelope so audit fields can't be
+          // poisoned by stored content.
+          console.log(JSON.stringify({ ...cached.response, ...envelope }, null, 2));
+        } else {
+          console.log(typeof cached.response === 'string'
+            ? cached.response
+            : JSON.stringify(cached.response, null, 2));
+        }
+        process.exit(0);
+      }
+    }
+
     // 6. Call LLM (provider-branched, HC-080a-spike)
     // max_tokens is held SYMMETRIC across providers so the HC-080a-spike
     // comparison measures model capability, not output budget. 4096 is the
@@ -5331,7 +6709,7 @@ program
         modelLabel   = 'openai/gpt-4.1';
       } else {
         const { data } = await axios.post('https://api.anthropic.com/v1/messages', {
-          model: 'claude-opus-4-20250514',
+          model: 'claude-opus-4-8',
           max_tokens: MAX_OUTPUT_TOKENS,
           system: systemPrompt,
           messages: [{ role: 'user', content: userPrompt }],
@@ -5346,7 +6724,7 @@ program
         responseText = data.content?.[0]?.text || '';
         inputTokens  = data.usage?.input_tokens || 0;
         outputTokens = data.usage?.output_tokens || 0;
-        modelLabel   = 'claude-opus-4-20250514';
+        modelLabel   = 'claude-opus-4-8';
       }
 
       const elapsedMs = Date.now() - startedAt;
@@ -5406,6 +6784,33 @@ program
         console.log(responseText);
       }
 
+      // HC-RC-002-followup-1: store the fresh response in the cache so
+      // future runs of the SAME diff hit cache instead of paying for
+      // another Opus call. Fire-and-forget — caller already has the
+      // response; a failed store is logged but doesn't change exit code.
+      // Total tokens billed for this run = inputTokens + outputTokens —
+      // those are the tokens a future hit would save.
+      if (cacheEnabled && cacheContentHash) {
+        const config = getConfig();
+        const apiBase = (config && config.apiBase) || process.env.HONE_API_BASE;
+        const token = (config && config.token) || process.env.HONE_TOKEN;
+        // Cache the parsed JSON when available (cleaner replay), otherwise
+        // wrap the raw text in { raw } so the cache always stores an object.
+        const responseForCache = parsed && typeof parsed === 'object'
+          ? parsed
+          : { raw: responseText };
+        storeReviewCache({
+          axios, apiBase, token,
+          contentHash: cacheContentHash,
+          model: modelForCache,
+          response: responseForCache,
+          tokensSaved: inputTokens + outputTokens,
+          banner,
+        }).then(({ stored }) => {
+          if (stored) banner(`✓ Cache stored: ${cacheContentHash.slice(0, 16)}…`);
+        }).catch(() => { /* logged inside helper */ });
+      }
+
       // 8. Exit code — defense in depth:
       //   (a) structured check against the parsed JSON, then
       //   (b) loose substring check on the raw response (catches LLMs that
@@ -5499,6 +6904,690 @@ showCmd
     }
   });
 
+// ── HC-019n-followup-20: check-patch (pipeline-recovery condition 5) ──────────
+// Fetch step_4's output, extract its diff, and run `git apply --check` against
+// the real tree. The server can only verify the output LOOKS like a diff
+// (patch-validator); only the CLI, running inside the repo, can prove it
+// APPLIES. Run c122c92a produced a diff that passed the server check and failed
+// to apply — structure is not applicability.
+program
+  .command('check-patch <workflowId>')
+  .description('Verify step_4\'s diff applies to the current working tree (condition 5)')
+  .option('--step-key <key>', 'Step to check (default: step_4)', 'step_4')
+  .option('--attempt <n>', 'Specific attempt number (default: latest)')
+  .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
+  .action(async (workflowId, opts) => {
+    const { execFileSync } = require('child_process');
+    const os = require('os');
+    const { extractDiff, interpretApplyCheck } = require('./lib/patch-apply');
+    const { extractFileBlocks, buildDiff, nodeMaterializeIO, MaterializeError } = require('./lib/materialize-diff');
+    const { gitEnv } = require('./lib/git-env');
+    const config = getConfig();
+    const client = api(config);
+
+    const emit = (obj, humanLine) => {
+      if (opts.format === 'json') console.log(JSON.stringify(obj));
+      else console.log(humanLine);
+    };
+
+    let output;
+    try {
+      const url = `/orchestrate/${workflowId}/step/${opts.stepKey}` +
+        (opts.attempt ? `?attempt=${opts.attempt}` : '');
+      const r = await client.get(url);
+      output = r.data?.output;
+    } catch (e) {
+      const msg = e.response?.data?.error || e.message;
+      emit({ ok: false, reason: 'fetch_failed', detail: msg },
+        `✗ could not fetch ${opts.stepKey} output: ${msg}`);
+      process.exit(1);
+    }
+
+    // HC-019n-followup-23/27: prefer whole-file blocks + region edits
+    // (## Changed Files). git computes the hunks, so the assembled diff applies
+    // by construction — no LLM line-counting. Fall back to the raw-diff path
+    // (followup-20) for stories still on the old ## Patch contract.
+    let diff, source, noChanges;
+    const blocks = extractFileBlocks(output);
+    if (blocks.noChanges) {
+      emit({ ok: true, verdict: 'no_changes' },
+        `○ ${opts.stepKey} declared NO CHANGES — nothing to apply.`);
+      return;
+    }
+    if (blocks.files.length > 0 || (blocks.edits && blocks.edits.length > 0) || blocks.deletes.length > 0) {
+      let built;
+      try {
+        built = buildDiff(blocks, nodeMaterializeIO({ cwd: process.cwd() }));
+      } catch (e) {
+        if (e instanceof MaterializeError) {
+          emit({ ok: false, verdict: 'does_not_apply', reason: e.code, detail: e.message },
+            `✗ region edit could not be applied (${e.code}): ${e.message}`);
+          process.exit(2);
+        }
+        throw e;
+      }
+      diff = built.diff;
+      source = 'file-blocks';
+      noChanges = built.partCount === 0;
+      if (noChanges) {
+        emit({ ok: true, verdict: 'no_changes' },
+          `○ ${opts.stepKey} file blocks were identical to the tree — nothing to apply.`);
+        return;
+      }
+    } else {
+      // Legacy path: a hand-written ## Patch diff.
+      ({ diff, source, noChanges } = extractDiff(output));
+      if (noChanges) {
+        emit({ ok: true, verdict: 'no_changes' },
+          `○ ${opts.stepKey} declared NO CHANGES — nothing to apply.`);
+        return;
+      }
+      if (!diff) {
+        emit({ ok: false, verdict: 'no_diff', reason: 'no_diff' },
+          `✗ ${opts.stepKey} output contains neither ## Changed Files blocks nor a ` +
+          `unified diff — the agent produced prose. (Placeholder-cascade failure mode.)`);
+        process.exit(1);
+      }
+    }
+
+    // Write to a temp file and run git apply --check against the current repo.
+    const tmp = path.join(os.tmpdir(), `hone-check-patch-${Date.now()}.diff`);
+    let result;
+    try {
+      fs.writeFileSync(tmp, diff);
+      let code = 0, stderr = '';
+      try {
+        execFileSync('git', ['apply', '--check', tmp], {
+          cwd: process.cwd(), env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+        });
+      } catch (e) {
+        code = e.status || 1;
+        stderr = (e.stderr || '').toString();
+      }
+      result = interpretApplyCheck({ code, stderr });
+    } finally {
+      try { fs.unlinkSync(tmp); } catch { /* best-effort */ }
+    }
+
+    if (result.applies) {
+      emit({ ok: true, verdict: result.verdict, source, detail: result.detail },
+        `✓ ${opts.stepKey} diff ${result.detail} (${source} block)`);
+    } else {
+      emit({ ok: false, verdict: 'failed', source, detail: result.detail },
+        `✗ ${opts.stepKey} diff does NOT apply: ${result.detail}\n` +
+        `  The output is a well-formed diff but does not match the working tree — ` +
+        `exactly the defect condition 5 catches that condition 4 cannot.`);
+      process.exit(2);  // distinct exit: 2 = does-not-apply, 1 = no-diff/fetch
+    }
+  });
+
+// ── HC-019n-followup-24: verify-patch (pipeline-recovery condition 6) ─────────
+// Apply step_4's diff inside a throwaway git WORKTREE (checked out from HEAD),
+// run the adopter's test command there, report pass/fail. The real tree —
+// including uncommitted work — is never touched. Isolates the TREE, not the
+// process: ci.local_command is the adopter's own command, same trust as running
+// it by hand. Verdict is REPORTED, not yet enforced — the server-gate closed
+// loop is a deliberate follow-up (enabling a gate before its input is proven is
+// the HC-026c mistake).
+program
+  .command('verify-patch <workflowId>')
+  .description('Apply step_4\'s diff in an isolated worktree and run the tests (condition 6)')
+  .option('--step-key <key>', 'Step to verify (default: step_4)', 'step_4')
+  .option('--attempt <n>', 'Specific attempt number (default: latest)')
+  .option('--command <cmd>', 'Test command (default: ci.local_command from config, else `make ci`)')
+  .option('--timeout <sec>', 'Seconds before the test command is killed', '600')
+  .option('--keep', 'Leave the worktree in place for debugging')
+  .option('--report', 'HC-019n-followup-34: report the verdict back to the server (closed loop, advisory)')
+  .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
+  .action(async (workflowId, opts) => {
+    const { execFileSync, spawnSync } = require('child_process');
+    const os = require('os');
+    const { extractFileBlocks, buildDiff, nodeMaterializeIO, MaterializeError } = require('./lib/materialize-diff');
+    const { resolveCommand, verdictFromRun, EXIT } = require('./lib/verify-patch');
+    const { gitEnv } = require('./lib/git-env');
+    const config = getConfig();
+    const client = api(config);
+
+    const emit = (obj, humanLine) => {
+      if (opts.format === 'json') console.log(JSON.stringify(obj));
+      else console.log(humanLine);
+    };
+
+    // 1. Fetch step_4 output.
+    let output, runConfig;
+    try {
+      const url = `/orchestrate/${workflowId}/step/${opts.stepKey}` +
+        (opts.attempt ? `?attempt=${opts.attempt}` : '');
+      const r = await client.get(url);
+      output = r.data?.output;
+      // best-effort: pull the run's ci_local_command for the default
+      try {
+        const runR = await client.get(`/orchestrate/${workflowId}`);
+        runConfig = runR.data?.config || {};
+      } catch { runConfig = {}; }
+    } catch (e) {
+      const msg = e.response?.data?.error || e.message;
+      emit({ ok: false, reason: 'fetch_failed', detail: msg },
+        `✗ could not fetch ${opts.stepKey} output: ${msg}`);
+      process.exit(EXIT.NO_DIFF);
+    }
+
+    // 2. Materialize the diff (shared with check-patch/emit-pr, followup-23/27).
+    // Condition 6 presupposes 5.
+    const blocks = extractFileBlocks(output);
+    const hasWork = blocks.files.length > 0 || (blocks.edits && blocks.edits.length > 0) || blocks.deletes.length > 0;
+    if (blocks.noChanges || !hasWork) {
+      emit({ ok: false, verdict: 'no_diff', reason: 'no_changes_or_diff' },
+        `✗ ${opts.stepKey} produced no file changes to verify.`);
+      process.exit(EXIT.NO_DIFF);
+    }
+    let diff;
+    try {
+      diff = buildDiff(blocks, nodeMaterializeIO({ cwd: process.cwd() })).diff;
+    } catch (e) {
+      if (e instanceof MaterializeError) {
+        emit({ ok: false, verdict: 'does_not_apply', reason: e.code, detail: e.message },
+          `✗ region edit could not be applied (${e.code}): ${e.message}`);
+        process.exit(EXIT.DOES_NOT_APPLY);
+      }
+      throw e;
+    }
+    if (!diff.trim()) {
+      emit({ ok: true, verdict: 'no_changes' },
+        `○ ${opts.stepKey} file blocks matched the tree — nothing to verify.`);
+      return;
+    }
+
+    // 3. Isolated worktree from HEAD.
+    const wt = fs.mkdtempSync(path.join(os.tmpdir(), 'hone-verify-'));
+    const diffFile = path.join(os.tmpdir(), `hone-verify-${Date.now()}.diff`);
+    fs.writeFileSync(diffFile, diff);
+    const command = resolveCommand(opts.command, runConfig?.ci_local_command);
+    let cleanupDone = false;
+    const cleanup = () => {
+      if (cleanupDone || opts.keep) return;
+      cleanupDone = true;
+      try { execFileSync('git', ['worktree', 'remove', '--force', wt], { cwd: process.cwd(), env: gitEnv(), stdio: 'ignore' }); } catch { /* best-effort */ }
+      try { fs.rmSync(wt, { recursive: true, force: true }); } catch { /* best-effort */ }
+      try { fs.unlinkSync(diffFile); } catch { /* best-effort */ }
+    };
+    // Guard against leaving a worktree if the process is interrupted.
+    process.on('SIGINT', () => { cleanup(); process.exit(130); });
+
+    // HC-019n-followup-24 fix: NEVER call process.exit() inside the try — it
+    // skips the finally, so the worktree leaks (found by the live verification:
+    // three hone-verify-* worktrees survived). Compute the exit code, let the
+    // finally clean up, then exit.
+    let exitCode = EXIT.PASS;
+    // HC-019n-followup-34: capture the verdict + HEAD sha for the closed-loop
+    // report (--report). Hoisted so they survive the try/finally to the POST.
+    let reportVerdict = null, reportDetail = null, headSha = null;
+    try { headSha = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: process.cwd(), env: gitEnv(), encoding: 'utf8' }).trim(); } catch { /* best-effort */ }
+    try {
+      execFileSync('git', ['worktree', 'add', '--detach', wt, 'HEAD'],
+        { cwd: process.cwd(), env: gitEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
+
+      // 4. Apply the diff INTO the worktree (real apply, isolated).
+      let applied = true, applyDetail = '';
+      try {
+        execFileSync('git', ['-C', wt, 'apply', diffFile], { env: gitEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
+      } catch (e) {
+        applied = false;
+        applyDetail = (e.stderr || '').toString().split('\n').find(Boolean) || 'git apply failed';
+      }
+      if (!applied) {
+        emit({ ok: false, verdict: 'does_not_apply', detail: applyDetail },
+          `✗ diff did not apply in the worktree: ${applyDetail}`);
+        exitCode = EXIT.DOES_NOT_APPLY;
+        reportVerdict = 'does_not_apply'; reportDetail = applyDetail;
+      } else {
+        // 5. Run the adopter's test command in the worktree.
+        if (opts.format !== 'json') console.log(`  running: ${command}  (in isolated worktree, timeout ${opts.timeout}s)`);
+        const run = spawnSync(command, {
+          cwd: wt, shell: true, encoding: 'utf8',
+          timeout: Number(opts.timeout) * 1000, env: gitEnv(),
+          stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        const timedOut = run.error && run.error.code === 'ETIMEDOUT';
+        const v = verdictFromRun({ code: run.status, timedOut, stdout: run.stdout, stderr: run.stderr });
+        const sym = v.verdict === 'pass' ? '✓' : v.verdict === 'timeout' ? '⏱' : '✗';
+        emit(
+          { ok: v.verdict === 'pass', verdict: v.verdict, command, detail: v.detail },
+          `${sym} ${v.detail}\n  (command: ${command})`);
+        exitCode = v.exitCode;
+        reportVerdict = v.verdict; reportDetail = v.detail;
+      }
+    } catch (e) {
+      emit({ ok: false, verdict: 'error', detail: e.message },
+        `✗ verify-patch failed: ${e.message}`);
+      exitCode = 1;
+      reportVerdict = 'error'; reportDetail = e.message;
+    } finally {
+      cleanup();
+    }
+
+    // HC-019n-followup-34: the closed loop — report the EXECUTED verdict back to
+    // the server (advisory record). Best-effort: a reporting failure must not
+    // change the local exit code (the verdict is already true locally).
+    if (opts.report && reportVerdict) {
+      try {
+        await client.post(`/orchestrate/${workflowId}/verdict`, {
+          source: 'verify-patch',
+          stepKey: opts.stepKey,
+          verdict: reportVerdict,
+          exitCode,
+          detail: reportDetail,
+          attempt: opts.attempt ? Number(opts.attempt) : undefined,
+          headSha,
+        });
+        if (opts.format !== 'json') console.log(`  → reported verdict '${reportVerdict}' to the server (advisory)`);
+      } catch (e) {
+        if (opts.format !== 'json') console.warn(`  ⚠ verdict report failed (non-fatal): ${e.response?.data?.error || e.message}`);
+      }
+    }
+    process.exit(exitCode);
+  });
+
+// ── HC-019n-followup-25: emit-pr (pipeline-recovery condition 7) ──────────────
+// Condition 6 proved step_4's diff applies AND its tests pass in isolation.
+// Condition 7 turns that verified diff into the reviewable artifact: a branch
+// and (opt-in) a draft PR. Publishing is staged — tier-1 dry run by default;
+// --push, then --open-pr. Sibling to check-patch/verify-patch (top-level).
+program
+  .command('emit-pr <workflowId>')
+  .description('Emit a branch + draft PR from step_4\'s verified diff (condition 7)')
+  .option('--step-key <key>', 'Step to emit (default: step_4)', 'step_4')
+  .option('--attempt <n>', 'Specific attempt number (default: latest)')
+  .option('--branch <name>', 'Override the generated branch name')
+  .option('--base <ref>', 'Target base branch for the PR (default: repo default)')
+  .option('--push', 'Push the branch to origin (default: local dry run only)')
+  .option('--open-pr', 'Open a draft PR (implies --push)')
+  .option('--ready', 'Open the PR ready-for-review instead of draft')
+  .option('--skip-verify', 'Do not re-run the tests before committing (downgrades provenance)')
+  .option('--command <cmd>', 'Test command for --verify (default: ci.local_command, else `make ci`)')
+  .option('--timeout <sec>', 'Seconds before the verify test command is killed', '600')
+  .option('--keep', 'Leave the worktree in place for debugging')
+  .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
+  .action(async (workflowId, opts) => {
+    const { execFileSync, spawnSync } = require('child_process');
+    const os = require('os');
+    const { extractFileBlocks, buildDiff, nodeMaterializeIO, MaterializeError } = require('./lib/materialize-diff');
+    const { resolveCommand, verdictFromRun } = require('./lib/verify-patch');
+    const {
+      EXIT, buildBranchName, buildCommitMessage, buildPrBody, decidePublish,
+    } = require('./lib/emit-pr');
+    const { gitEnv } = require('./lib/git-env');
+    const config = getConfig();
+    const client = api(config);
+
+    // --open-pr implies --push (cannot open a PR against an unpushed branch).
+    const doPush = Boolean(opts.push || opts.openPr);
+    const doOpenPr = Boolean(opts.openPr);
+    const doVerify = !opts.skipVerify;
+
+    const emit = (obj, humanLine) => {
+      if (opts.format === 'json') console.log(JSON.stringify(obj));
+      else if (humanLine != null) console.log(humanLine);
+    };
+
+    // 1. Fetch step_4 output + the run's storyId (for naming/provenance).
+    let output, storyId = 'story', runConfig = {};
+    try {
+      const url = `/orchestrate/${workflowId}/step/${opts.stepKey}` +
+        (opts.attempt ? `?attempt=${opts.attempt}` : '');
+      const r = await client.get(url);
+      output = r.data?.output;
+      try {
+        const runR = await client.get(`/orchestrate/${workflowId}`);
+        storyId = runR.data?.storyId || runR.data?.story_id || 'story';
+        runConfig = runR.data?.config || {};
+      } catch { /* naming falls back to 'story'; command falls back to make ci */ }
+    } catch (e) {
+      const msg = e.response?.data?.error || e.message;
+      emit({ ok: false, reason: 'fetch_failed', detail: msg },
+        `✗ could not fetch ${opts.stepKey} output: ${msg}`);
+      process.exit(EXIT.NO_DIFF);
+    }
+
+    // 2. Materialize the diff (shared with check-patch/verify-patch,
+    // followup-23/27). Condition 7 presupposes 5.
+    const blocks = extractFileBlocks(output);
+    const hasWork = blocks.files.length > 0 || (blocks.edits && blocks.edits.length > 0) || blocks.deletes.length > 0;
+    if (blocks.noChanges || !hasWork) {
+      emit({ ok: false, verdict: 'no_diff', reason: 'no_changes_or_diff' },
+        `✗ ${opts.stepKey} produced no file changes to emit.`);
+      process.exit(EXIT.NO_DIFF);
+    }
+    let diff;
+    try {
+      diff = buildDiff(blocks, nodeMaterializeIO({ cwd: process.cwd() })).diff;
+    } catch (e) {
+      if (e instanceof MaterializeError) {
+        emit({ ok: false, verdict: 'does_not_apply', reason: e.code, detail: e.message },
+          `✗ region edit could not be applied (${e.code}): ${e.message}`);
+        process.exit(EXIT.DOES_NOT_APPLY);
+      }
+      throw e;
+    }
+    if (!diff.trim()) {
+      emit({ ok: true, verdict: 'no_changes' },
+        `○ ${opts.stepKey} file blocks matched the tree — nothing to emit.`);
+      return;
+    }
+
+    // 3. Resolve names + probe idempotency BEFORE any mutation.
+    let headSha = '';
+    try {
+      headSha = execFileSync('git', ['rev-parse', 'HEAD'],
+        { cwd: process.cwd(), env: gitEnv(), encoding: 'utf8' }).trim();
+    } catch {
+      emit({ ok: false, reason: 'no_head' }, '✗ repository has no HEAD commit — cannot branch from nothing.');
+      process.exit(1);
+    }
+    const branch = buildBranchName({ storyId, workflowId, override: opts.branch });
+
+    const branchExists = (() => {
+      try {
+        execFileSync('git', ['rev-parse', '--verify', '--quiet', `refs/heads/${branch}`],
+          { cwd: process.cwd(), env: gitEnv(), stdio: 'ignore' });
+        return true;
+      } catch { return false; }
+    })();
+    // Only probe the remote for an existing PR when we intend to publish.
+    let openPrUrl = null;
+    if (doOpenPr) {
+      try {
+        const out = execFileSync('gh', ['pr', 'list', '--head', branch, '--state', 'open', '--json', 'url', '--jq', '.[0].url'],
+          { cwd: process.cwd(), env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        openPrUrl = out || null;
+      } catch { openPrUrl = null; /* gh missing/unauthed handled at push/open time */ }
+    }
+    const decision = decidePublish({ branchExists, openPrUrl });
+    if (decision.action === 'already_open') {
+      emit({ ok: true, verdict: 'already_open', prUrl: decision.prUrl, branch },
+        `✓ a draft PR is already open for ${branch}: ${decision.prUrl}`);
+      process.exit(EXIT.PASS);
+    }
+    if (decision.action === 'branch_conflict') {
+      emit({ ok: false, verdict: 'branch_conflict', branch },
+        `✗ branch '${branch}' already exists — not overwriting. Use --branch to pick another name.`);
+      process.exit(EXIT.BRANCH_CONFLICT);
+    }
+
+    // 4. Isolated worktree with a NAMED branch off HEAD (adopter tree untouched).
+    const wt = fs.mkdtempSync(path.join(os.tmpdir(), 'hone-emit-'));
+    const diffFile = path.join(os.tmpdir(), `hone-emit-${Date.now()}.diff`);
+    fs.writeFileSync(diffFile, diff);
+    const command = resolveCommand(opts.command, runConfig?.ci_local_command);
+    // `worktree add -b` creates the branch ref BEFORE apply/verify. If we bail
+    // before a successful commit (apply fails, verify fails), that empty branch
+    // (pointing at HEAD) must be torn down too — else "a failing diff never
+    // reaches a branch" would be false and a re-run would hit a bogus conflict.
+    // `committed` gates it: once we have the deliverable commit, keep the branch.
+    let cleanupDone = false;
+    let committed = false;
+    const cleanup = () => {
+      if (cleanupDone || opts.keep) return;
+      cleanupDone = true;
+      try { execFileSync('git', ['worktree', 'remove', '--force', wt], { cwd: process.cwd(), env: gitEnv(), stdio: 'ignore' }); } catch { /* best-effort */ }
+      // Remove the leaked empty branch only when nothing was committed onto it.
+      if (!committed) {
+        try { execFileSync('git', ['branch', '-D', branch], { cwd: process.cwd(), env: gitEnv(), stdio: 'ignore' }); } catch { /* best-effort */ }
+      }
+      try { fs.rmSync(wt, { recursive: true, force: true }); } catch { /* best-effort */ }
+      try { fs.unlinkSync(diffFile); } catch { /* best-effort */ }
+    };
+    process.on('SIGINT', () => { cleanup(); process.exit(130); });
+
+    // HC-019n-followup-24 lesson: NEVER process.exit() inside the try — it skips
+    // the finally and leaks the worktree. Capture exitCode; exit after cleanup.
+    let exitCode = EXIT.PASS;
+    let verifyState = 'skipped';
+    try {
+      execFileSync('git', ['worktree', 'add', '-b', branch, wt, 'HEAD'],
+        { cwd: process.cwd(), env: gitEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
+
+      // 4a. Apply the diff INTO the worktree.
+      let applied = true, applyDetail = '';
+      try {
+        execFileSync('git', ['-C', wt, 'apply', diffFile], { env: gitEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
+      } catch (e) {
+        applied = false;
+        applyDetail = (e.stderr || '').toString().split('\n').find(Boolean) || 'git apply failed';
+      }
+      if (!applied) {
+        emit({ ok: false, verdict: 'does_not_apply', detail: applyDetail },
+          `✗ diff did not apply in the worktree: ${applyDetail}`);
+        exitCode = EXIT.DOES_NOT_APPLY;
+      } else {
+        // 4b. Re-verify inline (default) — a failing diff never reaches a branch.
+        let verifyOk = true;
+        if (doVerify) {
+          if (opts.format !== 'json') console.log(`  verifying: ${command}  (in isolated worktree, timeout ${opts.timeout}s)`);
+          const run = spawnSync(command, {
+            cwd: wt, shell: true, encoding: 'utf8',
+            timeout: Number(opts.timeout) * 1000, env: gitEnv(),
+            stdio: ['ignore', 'pipe', 'pipe'],
+          });
+          const timedOut = run.error && run.error.code === 'ETIMEDOUT';
+          const v = verdictFromRun({ code: run.status, timedOut, stdout: run.stdout, stderr: run.stderr });
+          if (v.verdict === 'pass') {
+            verifyState = 'pass';
+          } else {
+            verifyOk = false;
+            const sym = v.verdict === 'timeout' ? '⏱' : '✗';
+            emit({ ok: false, verdict: v.verdict, command, detail: v.detail },
+              `${sym} verify failed, no branch emitted: ${v.detail}\n  (command: ${command})`);
+            exitCode = v.exitCode; // 3 tests-failed or 4 timeout
+          }
+        }
+
+        if (verifyOk) {
+          // 4c. Commit the applied diff onto the branch, inside the worktree.
+          // No summary source (GET /orchestrate omits config/story text), so the
+          // commit subject falls back to the storyId + default in buildCommitMessage.
+          const message = buildCommitMessage({ storyId, summary: '', workflowId, headSha, verifyState });
+          const msgFile = path.join(os.tmpdir(), `hone-emit-msg-${Date.now()}.txt`);
+          fs.writeFileSync(msgFile, message);
+          try {
+            execFileSync('git', ['-C', wt, 'add', '-A'], { env: gitEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
+            execFileSync('git', ['-C', wt, 'commit', '-F', msgFile], { env: gitEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
+            committed = true; // the branch now holds the deliverable — keep it past cleanup
+          } finally { try { fs.unlinkSync(msgFile); } catch { /* best-effort */ } }
+
+          const stat = (() => {
+            try {
+              return execFileSync('git', ['-C', wt, 'show', '--stat', '--oneline', 'HEAD'],
+                { env: gitEnv(), encoding: 'utf8' }).trim();
+            } catch { return ''; }
+          })();
+
+          // ── Boundary: everything above is local + reversible. ──
+          let prUrl = null, pushed = false;
+          if (doPush) {
+            try {
+              execFileSync('git', ['push', '-u', 'origin', branch],
+                { cwd: process.cwd(), env: gitEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
+              pushed = true;
+            } catch (e) {
+              const detail = (e.stderr || e.message || '').toString().split('\n').find(Boolean) || 'push failed';
+              emit({ ok: false, verdict: 'publish_failed', stage: 'push', detail, branch },
+                `✗ push failed (branch committed locally as '${branch}', not published): ${detail}`);
+              exitCode = EXIT.PUBLISH_FAILED;
+            }
+          }
+          if (pushed && doOpenPr) {
+            const prBody = buildPrBody({ storyId, workflowId, headSha, verifyState, command: doVerify ? command : undefined });
+            const bodyFile = path.join(os.tmpdir(), `hone-emit-prbody-${Date.now()}.md`);
+            fs.writeFileSync(bodyFile, prBody);
+            const title = `${storyId}: Hone step_4 change (workflow ${String(workflowId).slice(0, 8)})`;
+            const ghArgs = ['pr', 'create', '--head', branch, '--title', title, '--body-file', bodyFile];
+            if (!opts.ready) ghArgs.push('--draft');
+            if (opts.base) ghArgs.push('--base', opts.base);
+            try {
+              prUrl = execFileSync('gh', ghArgs,
+                { cwd: process.cwd(), env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+            } catch (e) {
+              const detail = (e.stderr || e.message || '').toString().split('\n').find(Boolean) || 'gh pr create failed';
+              emit({ ok: false, verdict: 'publish_failed', stage: 'open_pr', detail, branch },
+                `✗ branch pushed, but opening the PR failed: ${detail}\n  → open it manually, or check \`gh auth status\`.`);
+              exitCode = EXIT.PUBLISH_FAILED;
+            } finally { try { fs.unlinkSync(bodyFile); } catch { /* best-effort */ } }
+          }
+
+          if (exitCode === EXIT.PASS) {
+            const tier = prUrl ? 'pr' : pushed ? 'pushed' : 'dry_run';
+            const human = prUrl
+              ? `✓ draft PR opened: ${prUrl}`
+              : pushed
+                ? `✓ branch pushed to origin/${branch}\n  → open a PR: gh pr create --head ${branch} --draft`
+                : `✓ branch '${branch}' built locally (dry run — nothing pushed)\n` +
+                  `  verify: ${verifyState}\n\n${stat}\n\n` +
+                  `  → push it:      hone emit-pr ${workflowId} --push\n` +
+                  `  → push + PR:    hone emit-pr ${workflowId} --open-pr\n` +
+                  `  → discard it:   git branch -D ${branch}`;
+            emit({ ok: true, verdict: tier, branch, verifyState, prUrl, pushed, headSha }, human);
+          }
+        }
+      }
+    } catch (e) {
+      emit({ ok: false, verdict: 'error', detail: e.message }, `✗ emit-pr failed: ${e.message}`);
+      exitCode = 1;
+    } finally {
+      cleanup();
+    }
+    process.exit(exitCode);
+  });
+
+// ── HC-019n-followup-32: verify-pr (pipeline-standards G4 §2, G3 functional) ────
+// The post-emit-pr step: once a REAL PR exists, run the real skill audit
+// (`hone step-5b`) + the real CI gate (`gh pr checks` / `make ci`), writing the
+// two artifacts (step-5b-skill-audit.md, step-5c-ci.md) the server DAG can only
+// MODEL, never execute (those steps are serverExecutable:false). VERIFY + REPORT
+// only — no auto-fix loop; the operator (or a later closed loop) acts on the
+// verdict. Sibling to check-patch → verify-patch → emit-pr → verify-pr.
+program
+  .command('verify-pr <prOrBranch>')
+  .description('Post-PR verification: real skill audit (hone step-5b) + real CI gate (gh pr checks / make ci) (HC-019n-followup-32)')
+  .option('--story-id <id>', 'override story id (defaults to extraction from the branch)')
+  .option('--base <branch>', 'base branch for the skill-audit diff', 'develop')
+  .option('--mode <mode>', 'CI gate mode: github | local | both | none (default: ci.gate config, else github)')
+  .option('--command <cmd>', 'local CI command (default: ci.local_command, else make ci)')
+  .option('--timeout <sec>', 'seconds before the local CI command is killed', '900')
+  .option('--skip-skill-audit', 'skip the hone step-5b skill audit')
+  .option('--report', 'HC-019n-followup-36: report the CI-gate verdict back to the server (closed loop, records step_5c)')
+  .option('--workflow-id <id>', 'the run id to report the verdict against (required with --report)')
+  .option('--format <fmt>', 'pretty or json', 'pretty')
+  .action(async (prOrBranch, opts) => {
+    const { execFileSync, spawnSync } = require('child_process');
+    const { readCIGateConfig } = require('./lib/pipeline-config');
+    const { extractStoryIdFromBranch } = require('./lib/pipeline-status');
+    const { EXIT, resolveGateMode, interpretGhChecks, ciGateVerdict, renderStep5cArtifact } = require('./lib/verify-pr');
+    const { gitEnv } = require('./lib/git-env');
+    const repoRoot = process.cwd();
+    const emit = (obj, human) => {
+      if (opts.format === 'json') console.log(JSON.stringify(obj));
+      else if (human != null) console.log(human);
+    };
+
+    // 1. Story id: flag > branch > the ref itself.
+    let branch = '';
+    try { branch = execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim(); } catch { /* */ }
+    const storyId = opts.storyId || extractStoryIdFromBranch(branch) || extractStoryIdFromBranch(prOrBranch) || 'unknown-story';
+
+    // 2. CI gate mode: --mode > ci.gate config > github.
+    let configGate = 'github';
+    try { configGate = readCIGateConfig(repoRoot).gate; } catch { /* default */ }
+    const mode = resolveGateMode(opts.mode, configGate);
+
+    // 3. Skill audit — reuse the working `hone step-5b` command (deterministic
+    //    SA-001 engine over the PR diff). Informational; never affects the exit.
+    let skillAudit = { ran: false };
+    if (!opts.skipSkillAudit) {
+      try {
+        execFileSync(process.execPath, [__filename, 'step-5b', '--story-id', storyId, '--base', opts.base],
+          { cwd: repoRoot, env: process.env, stdio: opts.format === 'json' ? 'ignore' : 'inherit' });
+        skillAudit = { ran: true, artifact: `.github/pipeline/${storyId}/step-5b-skill-audit.md` };
+      } catch (e) {
+        skillAudit = { ran: true, error: (e.message || '').split('\n')[0] };
+      }
+    }
+
+    // 4. CI gate.
+    let gh = null, local = null;
+    if (mode === 'github' || mode === 'both') {
+      let prNum = /^\d+$/.test(prOrBranch) ? prOrBranch : null;
+      if (!prNum) { const m = String(prOrBranch).match(/\/pull\/(\d+)/); if (m) prNum = m[1]; }
+      if (!prNum) {
+        try { prNum = execFileSync('gh', ['pr', 'list', '--head', prOrBranch, '--state', 'all', '--json', 'number', '--jq', '.[0].number'], { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim() || null; } catch { prNum = null; }
+      }
+      if (!prNum) {
+        emit({ ok: false, reason: 'no_pr', ref: prOrBranch },
+          `✗ could not resolve a PR for '${prOrBranch}' — github mode needs a PR number, URL, or a branch with a PR.`);
+        process.exit(EXIT.NO_PR);
+      }
+      // gh pr checks exits non-zero when checks fail/pend, but still prints JSON.
+      let raw = '';
+      try {
+        raw = execFileSync('gh', ['pr', 'checks', prNum, '--json', 'name,state,bucket'], { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+      } catch (e) { raw = (e.stdout || '').toString(); }
+      try { gh = interpretGhChecks(JSON.parse(raw)); } catch { gh = null; }
+    }
+    if (mode === 'local' || mode === 'both') {
+      let command = (opts.command && opts.command.trim()) || '';
+      if (!command) { try { command = readCIGateConfig(repoRoot).local_command; } catch { command = 'make ci'; } }
+      command = command || 'make ci';
+      if (opts.format !== 'json') console.log(`  running local CI: ${command} (timeout ${opts.timeout}s)`);
+      const run = spawnSync(command, { cwd: repoRoot, shell: true, encoding: 'utf8', timeout: Number(opts.timeout) * 1000, stdio: ['ignore', 'inherit', 'inherit'] });
+      local = { code: run.status == null ? 1 : run.status, timedOut: !!(run.error && run.error.code === 'ETIMEDOUT') };
+    }
+
+    const verdict = ciGateVerdict({ mode, gh, local });
+
+    // 5. Write the real step-5c-ci.md artifact.
+    try {
+      const dir = path.join(repoRoot, '.github/pipeline', storyId);
+      fs.mkdirSync(dir, { recursive: true });
+      fs.writeFileSync(path.join(dir, 'step-5c-ci.md'), renderStep5cArtifact({ storyId, mode, prRef: prOrBranch, gh, local, verdict }));
+    } catch { /* best-effort */ }
+
+    // 6. Closed loop (HC-019n-followup-36): report the CI-gate verdict to the
+    // server. This RECORDS against step_5c — which is a post-PR, CLI-produced
+    // node (serverExecutable:false), so there is no server gate to auto-approve:
+    // verify-pr's verdict is ADVISORY audit even in enforce mode (enforce gates
+    // step_4, the build). Best-effort — never changes the local exit code.
+    let reported = false;
+    if (opts.report) {
+      if (!opts.workflowId) {
+        if (opts.format !== 'json') console.warn('  ⚠ --report needs --workflow-id <run id> to address the run; skipping report.');
+      } else {
+        try {
+          const client = api(getConfig());
+          await client.post(`/orchestrate/${opts.workflowId}/verdict`, {
+            source: 'verify-pr',
+            stepKey: 'step_5c',
+            verdict: verdict.verdict,
+            exitCode: verdict.exitCode,
+            detail: verdict.detail,
+          });
+          reported = true;
+          if (opts.format !== 'json') console.log(`  → reported CI-gate verdict '${verdict.verdict}' to run ${opts.workflowId} (advisory)`);
+        } catch (e) {
+          if (opts.format !== 'json') console.warn(`  ⚠ verdict report failed (non-fatal): ${e.response?.data?.error || e.message}`);
+        }
+      }
+    }
+
+    // 7. Report. The exit code is the CI verdict's; the skill audit is advisory.
+    const sym = (verdict.verdict === 'pass' || verdict.verdict === 'disabled') ? '✓' : verdict.verdict === 'pending' ? '⏳' : '✗';
+    emit(
+      { ok: verdict.exitCode === EXIT.PASS, storyId, mode, skillAudit, ciGate: verdict, gh, local, reported },
+      `${sym} CI gate (${mode}): ${verdict.verdict} — ${verdict.detail}\n` +
+      `  skill audit: ${opts.skipSkillAudit ? 'skipped' : (skillAudit.artifact || skillAudit.error || 'done')}\n` +
+      `  → .github/pipeline/${storyId}/step-5c-ci.md`);
+    process.exit(verdict.exitCode);
+  });
+
 // ── CLI setup ─────────────────────────────────────────────────────────────────
 program
   .name('hone')