@hone-ai/cli 1.29.0 → 1.30.0

package/lib/run-report.js

@@ -60,6 +60,102 @@ function buildReport(run, extra = {}) {
     });
   }
 
+  // 1b. HC-GF-044: a STEP can be failed while the RUN says completed.
+  //
+  // Everything above keys on `run.status`. Nothing read `steps[].status`, so a run
+  // reported `completed` that contained a `failed` step produced ZERO items and the
+  // empty-state branch then printed the affirmative "nothing outstanding". Observed on
+  // run 08c27392: `Status: completed` / `Error: MAX_RETRIES_EXCEEDED: step_5 retried 2
+  // times` / `✗ step_5 (code-reviewer) failed`, and then `NEEDS YOU (0)`. The STEPS block
+  // below rendered the failure correctly, so the data was present and read — only the
+  // actionable layer missed it.
+  //
+  // This is the exact class HC-GF-016 exists to prevent, and the sharp part is that its
+  // empty-state rule was HONOURED: the section rendered and named what it checked. It
+  // checked the wrong field. A well-formed "nothing" is only as true as its predicate.
+  //
+  // DELIBERATELY INDEPENDENT OF HC-GF-043. That story stops the orchestrator writing
+  // `completed` over a failed step, which would make THIS run fire here via the branch
+  // above. It would not help a `completed` run whose step failed for any other reason, or
+  // a report built from a run recorded before that fix shipped. Both are needed; neither
+  // substitutes for the other.
+  //
+  // Keyed on the step's OWN state, and `rejected` counts alongside `failed`: a rejected
+  // gate is a human decision awaiting follow-up, not a null result.
+  const brokenSteps = steps.filter(s => s.status === 'failed' || s.gateResult === 'rejected');
+  for (const s of brokenSteps) {
+    // Skip the one the run-level item already names, so one problem is one entry.
+    if (run.status === 'failed' && s.stepKey === run.currentStep) continue;
+    // HC-GF-036(b): a step that RETURNED AN ADVERSE VERDICT did not break. Saying
+    // "code-reviewer FAILED" for a reviewer that ran correctly and said no is the same
+    // conflation that was inflating batch failure_rates — and it points the operator at
+    // the wrong thing to fix. The verdict kinds name the agent's own vocabulary.
+    const kind = (s.diagnostics && s.diagnostics.failure_record || {}).failure_kind;
+    const VERDICT = {
+      review_reject: 'returned a FAIL review',
+      security_high: 'raised a HIGH security finding',
+      security_medium: 'raised a MEDIUM security finding',
+      test_fail: 'reported failing tests',
+      lint_fail: 'reported lint errors',
+      perf_finding: 'raised a performance finding',
+      validator_rejected: 'produced output the format validator rejected',
+    };
+    const what = kind && VERDICT[kind]
+      ? `${s.stepKey} (${s.agent || 'agent'}) ${VERDICT[kind]}`
+      : `${s.stepKey} (${s.agent || 'agent'}) ${s.status === 'failed' ? 'FAILED' : 'was REJECTED'}`;
+    needsYou.push({
+      what: `${what} — the run is recorded ${run.status}, so nothing downstream will revisit it`,
+      how: `hone show step ${run.runId} ${s.stepKey}`,
+      howLabel: 'inspect',
+    });
+  }
+
+  // 1c. HC-GF-041: a retry that came back with LESS than the attempt it replaces.
+  //
+  // The newest attempt REPLACES the previous one for every downstream consumer, so this
+  // silently deletes work. Twice it was caught only because an agent refused to treat
+  // absence as evidence — step_5d's `UNVERIFIED-HIGH / source-unavailable`, and a
+  // reviewer's "I will not approve a P0 reliability primitive I have not read". Neither
+  // is a mechanism; both were luck. This is the mechanism.
+  //
+  // NEEDS YOU, not WORTH KNOWING: the artifact every later step reads is not the one a
+  // human approved, and only a human can say whether that is acceptable.
+  for (const s of steps) {
+    const reg = s.diagnostics && s.diagnostics.artifact_regression;
+    if (!reg) continue;
+    needsYou.push({
+      what: `${s.stepKey} attempt ${s.attempt} carries less than the attempt it replaces`
+        + ` — and it is the one every later step reads`,
+      detail: (reg.reasons || []).map(String),
+      how: `hone show step ${run.runId} ${s.stepKey} --attempt ${s.attempt}`,
+      howLabel: 'compare',
+    });
+  }
+
+  // 1d. HC-GF-041: two diagnostics the orchestrator has stamped since HC-019n-followup-41
+  // and -43, which NOTHING has ever read on this path — the run payload carried only
+  // token counts until the `diagnostics` projection was added. HC-GF-016's row specifies
+  // these be rendered; this is the first build where they can be.
+  //
+  // Both are written ONLY when non-empty, so an absent key means "checked, none found"
+  // and must not be rendered as a reassuring zero — silence here is correct, an invented
+  // "none" would be a claim the report cannot support for a run that never ran the check.
+  for (const s of steps) {
+    const d = s.diagnostics || {};
+    if (Array.isArray(d.invented_paths) && d.invented_paths.length) {
+      needsYou.push({
+        what: `${s.stepKey} named ${d.invented_paths.length} path(s) that do not exist in the repo, and was accepted anyway`,
+        detail: d.invented_paths.map(String),
+        how: `hone show step ${run.runId} ${s.stepKey}`,
+        howLabel: 'inspect',
+      });
+    }
+    if (Array.isArray(d.composed_missing) && d.composed_missing.length) {
+      worthKnowing.push(
+        `${s.stepKey} dropped composed guardrail section(s) on a retry and was accepted (budget spent): ${d.composed_missing.join(', ')}`);
+    }
+  }
+
   // 2. The last verification is ONE event, so it becomes ONE item with sub-lines.
   //    Listing "verification failed" and "lint failed" separately gave two entries
   //    for one problem resolved by one fix — and NEEDS YOU is a list of DISTINCT
@@ -92,10 +188,16 @@ function buildReport(run, extra = {}) {
   }
 
   // ── WORTH KNOWING ──────────────────────────────────────────────────────────
-  // Retries: the step produced something the pipeline rejected at least once.
+  // Retries: the step ran more than once. HC-GF-041(c): this used to append "(its
+  // first output was rejected)", which the report never checked and which is often
+  // FALSE — on run 08c27392 step_4's attempt 1 was `completed | approved` and it was
+  // attempt 2 that got rejected; a route-back retries a step whose first output was
+  // fine. Narrating an unchecked cause inside the tool built to be derived-never-
+  // narrated is the defect HC-GF-016 exists to prevent. State the count, which is
+  // measured, and let the regression check below say when something is wrong.
   for (const s of steps) {
     if (Number(s.attempts) > 1) {
-      worthKnowing.push(`${s.stepKey} retried — ${s.attempts} attempts (its first output was rejected)`);
+      worthKnowing.push(`${s.stepKey} ran ${s.attempts} times`);
     }
   }
   // The two "blind run" tells, both from HC-GF-006's preflight reasoning.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hone-ai/cli",
-  "version": "1.29.0",
+  "version": "1.30.0",
   "description": "Hone AI — Enterprise SDLC Pipeline CLI",
   "main": "hone-cli.js",
   "bin": {