@hone-ai/cli 1.31.0 → 1.33.0

package/hone-cli.js

@@ -5522,11 +5522,16 @@ program
         const m = Math.floor((Date.now() - new Date(ts).getTime()) / 60000);
         return m < 60 ? `${m}m` : m < 1440 ? `${Math.floor(m / 60)}h` : `${Math.floor(m / 1440)}d`;
       };
-      console.log('RUN ID    STORY                 STATUS     STEP       AGE');
+      // A story ID cut to fit is marked as cut: pasted into `run-story <storyId>`, a bare prefix could name another story.
+      // ASCII on purpose: U+2026 is ambiguous-width, and a terminal that draws it double-width shifts the row.
+      const clip = (s, w) => (s.length > w ? `${s.slice(0, w - 3)}...` : s);
+      // HC-GF-108: the FULL run ID. The footer says `hone run-story <runId> --kill`, and an 8-character
+      // prefix is not a run ID; nor is one accepted as a target, since `12345678` is also a valid story ID.
+      console.log(['RUN ID'.padEnd(36), 'STORY'.padEnd(22), 'STATUS'.padEnd(10), 'STEP'.padEnd(10), 'AGE'].join(' '));
       for (const r of data.runs) {
         console.log([
-          String(r.id).slice(0, 8).padEnd(9),
-          String(r.story_id || '-').slice(0, 21).padEnd(22),
+          String(r.id).padEnd(36),
+          clip(String(r.story_id || '-'), 21).padEnd(22),
           String(r.status).padEnd(10),
           String(r.current_step || '-').padEnd(10),
           age(r.created_at),
@@ -5598,17 +5603,20 @@ program
   .command('run-story <storyId>')
   .description('Run the SDLC pipeline for a story via the orchestrator')
   .option('--mode <mode>', 'Execution mode: interactive or batch', 'interactive')
-  .option('--repo <name>', 'Repository name override (default: directory name)')
+  .option('--repo <name>', 'Repository name override (default: directory name). Also the repository a story ID is looked up in for --status, --kill and --approve')
   .option('--branch <name>', 'Git branch (default: current)')
-  .option('--status', 'Show status of the latest workflow run for this story')
-  .option('--kill', 'Kill the latest workflow run for this story')
+  .option('--status', 'Show status of a run: pass a run ID, or a story ID for that story\'s latest run in this repository')
+  .option('--kill', 'Kill a run: pass a run ID, or a story ID for that story\'s latest run in this repository')
   .option('--axes <axes>', 'Comma-separated classifier axes for this run (e.g. shared-chokepoint) — composition input (HC-COMM-010 C0)')
-  .option('--approve <step>', 'Approve a paused gate (e.g., --approve step_0). Exit codes: 2 = paused at a human gate, 3 = parked for your editor (execution.mode: editor)')
+  .option('--approve <step>', 'Approve a paused gate (e.g., --approve step_0) on a run ID, or on a story ID\'s latest run in this repository. Exit codes: 2 = paused at a human gate, 3 = parked for your editor (execution.mode: editor)')
   .option('--no-verify', 'HC-GF-064: do not run verify-patch automatically when the run pauses at step_4')
   .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
   .option('--poll-interval <s>', 'Poll interval in seconds', '5')
   .option('--story-file <path>', 'HC-GF-010: read the story text from a local file. Skips the GitHub-issue and Hone-roadmap lookups entirely, so a repo with neither can still run the pipeline.')
   .option('--description <text>', 'HC-GF-010: the story text, inline. Same effect as --story-file.')
+  .option('--acknowledge-failed-verdict', 'Approve a step whose verification did NOT pass under verification.gate: enforce (HC-GF-074). The server refuses that approval by default and names the failing gates; this is for a human who has read them and still wants to proceed.')
+  .option('--acknowledge-abort', 'Approve a step the agent ABORTED (HC-GF-069). An abort means the agent found nothing it could review or build, so approving advances past a step that produced no usable result — read the reason first. Exists so a human can override, which is why the refusal is not simply a hard block.')
+  .option('--no-follow', 'With --approve: post the approval and exit immediately instead of following the run to its next decision point (HC-GF-070). The default FOLLOWS, because a caller told to poll does not — which is why HC-GF-064 auto-verify never fired outside a TTY.')
   .option('--include-paths <paths>', 'Comma-separated list of source file paths to bundle into the codebase context (HC-019n-followup-12). Augments auto-detected paths from the issue body.')
   .option('--e2e-specs', 'HC-019n-followup-28: force step_3b (Playwright spec generation) ON for this run (overrides e2e.spec_generation config)')
   .option('--skip-e2e-specs', 'HC-019n-followup-28: force step_3b (Playwright spec generation) OFF for this run (overrides e2e.spec_generation config)')
@@ -5633,16 +5641,169 @@ program
       }
     } catch { /* never block a run on a banner */ }
 
-    // Resolve: if it looks like a UUID, use as runId directly.
-    // Otherwise treat as storyId — will be used for POST /orchestrate body.
-    const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(storyIdOrRunId);
-    const storyId = isUuid ? null : storyIdOrRunId;
-    const runId = isUuid ? storyIdOrRunId : null;
+    const { resolveRunTarget, isRunId } = require('./lib/run-target');
+    const isUuid = isRunId(storyIdOrRunId);
+    const repoName = opts.repo || path.basename(process.cwd());
+
+    // HC-GF-106: --status, --kill and --approve act on an EXISTING run, and all three resolve their
+    // argument here. Each used to forward it verbatim (`runId || storyIdOrRunId`), so a story ID was
+    // posted as a run ID and answered `Run not found` — while --help promised the story's latest run.
+    // A story is scoped to `repoName`, the name the start path below records, so it resolves to a run
+    // this checkout started. Never falls back to the argument: no run found means exit 1.
+    const existingRunId = async (flag) => {
+      const t = await resolveRunTarget({ client, idOrStory: storyIdOrRunId, repoName, flag });
+      if (t.error) { console.error(t.error); process.exit(1); }
+      if (t.source === 'story') {
+        // stderr: stdout is what a `--status --format json` caller parses, so the note stays out of it.
+        const at = t.run.current_step ? ` at ${t.run.current_step}` : '';
+        console.error(`→ ${storyIdOrRunId}: latest run in ${repoName} is ${t.runId} (${t.run.status}${at})`);
+      }
+      return t.runId;
+    };
+
+    // HC-GF-070: ONE poll loop, reachable from BOTH entry points.
+    //
+    // It used to be reachable from exactly one — the initial `run-story <storyId>` — so
+    // `--approve` posted, printed "Poll: ...", and returned. The caller was told to poll
+    // and, exactly as with the verify-patch nag that motivated HC-GF-064 (5 of 22 runs),
+    // nobody did. Every driver written against this re-implemented the loop and each had
+    // a different bug: a paused gate treated as terminal; a no-op approval hot-looping
+    // nine times; a gate advertised by a run whose driver had already exited. Not three
+    // driver bugs — one missing behaviour, three times.
+    //
+    // Its DECISIONS live in cli/lib/poll-decision.js as a pure function, because calling
+    // the same loop from a second place is only safe if what it decides is pinned.
+    const pollUntilDecision = async (pollRunId) => {
+      const { classifyPollState, POLL_OUTCOMES } = require('./lib/poll-decision');
+      const interval = parseInt(opts.pollInterval, 10) * 1000;
+      // HC-GF-064: at most ONE verification per attempt per process. Without this the
+      // advisory path re-verifies on every poll tick, because advisory never advances
+      // the run and the pause it re-observes is the same pause.
+      const _verifiedAttempts = new Set();
+
+      for (;;) {
+        await new Promise(r => setTimeout(r, interval));
+
+        let status;
+        try {
+          const { data: pollData } = await client.get(`/orchestrate/${pollRunId}`);
+          status = pollData;
+        } catch (e) {
+          console.error(`Poll error: ${e.message}`);
+          continue;
+        }
+
+        const d = classifyPollState(status);
+
+        if (d.outcome === POLL_OUTCOMES.COMPLETED) {
+          console.log(`✓ Workflow completed! Total tokens: ${(d.totalTokens || 0).toLocaleString()}`);
+          process.exit(d.exitCode);
+        }
+        if (d.outcome === POLL_OUTCOMES.TERMINAL_FAILURE) {
+          console.error(`✗ Workflow ${d.runStatus}: ${d.errorMessage}`);
+          process.exit(d.exitCode);
+        }
+        if (d.outcome === POLL_OUTCOMES.EDITOR_PARKED) {
+          console.log(editorParkedGuidance(pollRunId, d.stepKey, d.agent));
+          process.exit(d.exitCode);
+        }
+
+        if (d.outcome === POLL_OUTCOMES.HUMAN_GATE || d.outcome === POLL_OUTCOMES.EXHAUSTED) {
+          // HC-GF-075: an exhausted step is a decision, not a gate on an artifact. Say what approving
+          // does, and do NOT auto-verify — the attempt on record is the one the validator rejected,
+          // and a verdict on it would read as a verdict on the build.
+          const exhausted = d.outcome === POLL_OUTCOMES.EXHAUSTED;
+          if (exhausted) {
+            console.log(`⏸  Step ${d.stepKey} (${d.agent || 'unknown'}) used up its format retries and paused.`);
+            console.log(`  ${String(d.errorMessage || '').slice(0, 240)}`);
+            console.log(`  Inspect: hone show step ${pollRunId} ${d.stepKey}`);
+            console.log(`  Approving starts another cycle of ${d.stepKey} with a fresh format budget; it does not `
+              + 'accept an earlier attempt. guardrails.max_retries_per_step caps the cycles.');
+          } else {
+            console.log(`⏳ Step ${d.stepKey} (${d.agent || 'unknown'}) — awaiting approval`);
+          }
+
+          // HC-GF-064: verify BEFORE asking anyone to approve. The gate this feeds had
+          // existed since HC-019n-followup-34/35 and never fired, because nothing ever
+          // ran the executing step. Consent is DERIVED: `ci.local_command` being
+          // explicitly set is the adopter's own statement of how to test this repo (see
+          // cli/lib/auto-verify.js and docs/architecture/adr-verification-invocation.md).
+          // Never throws — a failure here must leave the operator exactly where they
+          // were, which is being asked to approve.
+          if (!exhausted) try {
+            const { decideAutoVerify, announce, shouldRepoll, alreadyVerified, verifyOutcomeLine } = require('./lib/auto-verify');
+            const decision = decideAutoVerify({
+              stepKey: d.stepKey,
+              repoRoot: process.cwd(),
+              noVerifyFlag: opts.verify === false,
+            });
+            if (decision.run && !alreadyVerified(d.attemptKey, _verifiedAttempts)) {
+              _verifiedAttempts.add(d.attemptKey);
+              console.log(announce(decision, pollRunId));
+              const { spawnSync } = require('child_process');
+              const r = spawnSync(process.execPath,
+                [process.argv[1], 'verify-patch', pollRunId, '--report'],
+                { stdio: 'inherit', env: process.env });
+              // A green verdict under `enforce` AUTO-APPROVES this gate, so the run may
+              // already have moved on. Re-poll rather than prompting for an approval that
+              // is no longer wanted — asking a human to approve something already approved
+              // is how an operator learns to distrust the output.
+              if (shouldRepoll({ gate: decision.gate, verdictOk: r.status === 0,
+                                 attemptKey: d.attemptKey, verifiedAttempts: null })) {
+                console.log('  → verified; enforce may have advanced the run. Re-checking...');
+                continue;
+              }
+              // HC-GF-008: keyed by verify-patch's exit code — "did not pass" only when a command ran and failed.
+              console.log(verifyOutcomeLine(r.status, decision.gate));
+            }
+          } catch (e) {
+            console.log(`  (auto-verify skipped: ${e.message})`);
+          }
+
+          if (process.stdin.isTTY) {
+            const readline = require('readline');
+            const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+            const answer = await new Promise(resolve => rl.question(exhausted ? `  Retry ${d.stepKey} with a fresh format budget? [y/n/kill] ` : '  Approve? [y/n/kill] ', resolve));
+            rl.close();
+
+            if (answer.toLowerCase() === 'y' || answer.toLowerCase() === 'yes') {
+              try {
+                await client.post(`/orchestrate/${pollRunId}/approve`, { stepKey: d.stepKey });
+                console.log('  Approved — workflow resuming...');
+              } catch (e) {
+                console.error(`  Approve failed: ${e.response?.data?.error || e.message}`);
+              }
+            } else if (answer.toLowerCase() === 'kill') {
+              try {
+                await client.post(`/orchestrate/${pollRunId}/kill`, { reason: 'CLI kill' });
+                console.log('  Workflow killed.');
+                process.exit(0);
+              } catch (e) {
+                console.error(`  Kill failed: ${e.message}`);
+              }
+            } else {
+              console.log(`  Skipped. Resume later: hone run-story ${pollRunId} --status`);
+              process.exit(0);
+            }
+          } else {
+            // Non-interactive (CI): exit 2 (paused, needs approval) — the contract
+            // adopter pipelines already branch on.
+            console.log(exhausted
+              ? `  Non-interactive mode. Retry with: hone run-story ${pollRunId} --approve ${d.stepKey}   (or --kill)`
+              : `  Non-interactive mode. Approve with: hone run-story ${pollRunId} --approve ${d.stepKey}`);
+            process.exit(d.exitCode);
+          }
+          continue;
+        }
+
+        if (d.stepKey) process.stdout.write(`  Running: ${d.stepKey} (${d.agent})...\r`);
+      }
+    };
 
     // Status mode
     if (opts.status) {
-      const statusId = runId || storyIdOrRunId;
       try {
+        const statusId = await existingRunId('--status');
         const { data } = await client.get(`/orchestrate/${statusId}`);
         if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
         console.log('');
@@ -5691,8 +5852,8 @@ program
 
     // Kill mode
     if (opts.kill) {
-      const killId = runId || storyIdOrRunId;
       try {
+        const killId = await existingRunId('--kill');
         const { data } = await client.post(`/orchestrate/${killId}/kill`, { reason: 'CLI kill' });
         console.log(`Workflow ${data.runId} killed.`);
       } catch (e) {
@@ -5704,15 +5865,37 @@ program
 
     // Approve mode
     if (opts.approve) {
-      const approveId = runId || storyIdOrRunId;
+      let approveId;
       try {
-        const { data } = await client.post(`/orchestrate/${approveId}/approve`, { stepKey: opts.approve });
+        approveId = await existingRunId(`--approve ${opts.approve}`);
+        await client.post(`/orchestrate/${approveId}/approve`,
+          { stepKey: opts.approve, acknowledgeAbort: opts.acknowledgeAbort === true,
+            acknowledgeFailedVerdict: opts.acknowledgeFailedVerdict === true });
         console.log(`Gate ${opts.approve} approved. Workflow resuming.`);
-        console.log(`Poll: hone run-story ${approveId} --status`);
       } catch (e) {
         console.error(`Failed: ${e.response?.data?.error || e.message}`);
         process.exit(1);
       }
+      // HC-GF-070: FOLLOW the run to its next decision point instead of returning here.
+      // Returning is what made every automated flow exit blind after each gate, and is
+      // the direct reason HC-GF-064's auto-verify — which lives at the step_4 pause —
+      // never fired outside an interactive terminal. Exit codes are unchanged: 0 done,
+      // 1 failed, 2 next human gate, 3 editor park.
+      if (opts.follow === false) {
+        console.log(`Poll: hone run-story ${approveId} --status`);
+        return;
+      }
+      // The initial invocation runs this inside the start-workflow try/catch; the
+      // approve path has none, and an unhandled rejection here would surface as a bare
+      // stack trace after a successful approval — the approval landed, so the exit code
+      // must say what happened to the RUN, not look like the approve failed.
+      try {
+        await pollUntilDecision(approveId);
+      } catch (e) {
+        console.error(`Approved, but following the run failed: ${e.message}`);
+        console.error(`Poll: hone run-story ${approveId} --status`);
+        process.exit(1);
+      }
       return;
     }
 
@@ -5723,7 +5906,6 @@ program
       process.exit(1);
     }
 
-    const repoName = opts.repo || path.basename(process.cwd());
     let branch = opts.branch;
     if (!branch) {
       try { branch = execSync('git symbolic-ref --short HEAD', { encoding: 'utf8' }).trim(); } catch { branch = null; }
@@ -6263,130 +6445,7 @@ program
       console.log(`Poll: ${data.pollUrl}`);
       console.log('');
 
-      // Poll loop
-      const interval = parseInt(opts.pollInterval, 10) * 1000;
-      // HC-GF-064: at most ONE verification per attempt per process. Without this the
-      // advisory path re-verifies on every poll tick, because advisory never advances
-      // the run and the pause it re-observes is the same pause.
-      const _verifiedAttempts = new Set();
-      while (true) {
-        await new Promise(r => setTimeout(r, interval));
-
-        let status;
-        try {
-          const { data: pollData } = await client.get(`/orchestrate/${data.runId}`);
-          status = pollData;
-        } catch (e) {
-          console.error(`Poll error: ${e.message}`);
-          continue;
-        }
-
-        if (status.status === 'completed') {
-          console.log(`✓ Workflow completed! Total tokens: ${(status.totalTokens || 0).toLocaleString()}`);
-          process.exit(0);
-        }
-
-        if (status.status === 'failed' || status.status === 'killed') {
-          console.error(`✗ Workflow ${status.status}: ${status.errorMessage || 'unknown'}`);
-          process.exit(1);
-        }
-
-        if (status.status === 'paused' && status.awaitingApproval) {
-          const step = status.steps.find(s => s.stepKey === status.currentStep);
-          // HC-COMM-010-followup-1: an editor-parked run is a gate the EDITOR
-          // satisfies, not a human — never offer --approve here (B4 refuses it).
-          if (isEditorParked(status)) {
-            console.log(editorParkedGuidance(data.runId, status.currentStep, step?.agent));
-            process.exit(EDITOR_PARKED_EXIT_CODE);
-          }
-          console.log(`⏳ Step ${status.currentStep} (${step?.agent || 'unknown'}) — awaiting approval`);
-
-          // HC-GF-064: verify BEFORE asking anyone to approve.
-          //
-          // The gate this feeds has existed since HC-019n-followup-34/35 and had never
-          // fired — 22 of 22 runs advisory, 5 of 22 with any verdict at all — because
-          // nothing ever ran the executing step. The only prompt was a run-report line,
-          // and 5-of-22 is what that nag was worth.
-          //
-          // Consent is DERIVED: `ci.local_command` being explicitly set is the adopter's
-          // own statement of how to test this repo (see cli/lib/auto-verify.js and
-          // docs/architecture/adr-verification-invocation.md). Never throws — a failure
-          // here must leave the operator exactly where they were, which is being asked
-          // to approve.
-          try {
-            const { decideAutoVerify, announce, shouldRepoll, alreadyVerified } = require('./lib/auto-verify');
-            const attemptKey = `${status.currentStep}#${step?.attempt ?? 1}`;
-            const decision = decideAutoVerify({
-              stepKey: status.currentStep,
-              repoRoot: process.cwd(),
-              noVerifyFlag: opts.verify === false,
-            });
-            if (decision.run && !alreadyVerified(attemptKey, _verifiedAttempts)) {
-              _verifiedAttempts.add(attemptKey);
-              console.log(announce(decision, data.runId));
-              const { spawnSync } = require('child_process');
-              const r = spawnSync(process.execPath,
-                [process.argv[1], 'verify-patch', data.runId, '--report'],
-                { stdio: 'inherit', env: process.env });
-              // A green verdict under `enforce` AUTO-APPROVES this gate, so the run may
-              // already have moved on. Re-poll rather than prompting for an approval that
-              // is no longer wanted — asking a human to approve something already approved
-              // is how an operator learns to distrust the output.
-              if (shouldRepoll({ gate: decision.gate, verdictOk: r.status === 0,
-                                 attemptKey, verifiedAttempts: null })) {
-                console.log('  → verified; enforce may have advanced the run. Re-checking...');
-                continue;
-              }
-              console.log(r.status === 0
-                ? `  → verified and recorded (gate: ${decision.gate}). The gate still needs you.`
-                : '  → verification did not pass; the gate still needs you.');
-            }
-          } catch (e) {
-            console.log(`  (auto-verify skipped: ${e.message})`);
-          }
-
-          // Interactive prompt
-          if (process.stdin.isTTY) {
-            const readline = require('readline');
-            const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-            const answer = await new Promise(resolve => {
-              rl.question('  Approve? [y/n/kill] ', resolve);
-            });
-            rl.close();
-
-            if (answer.toLowerCase() === 'y' || answer.toLowerCase() === 'yes') {
-              try {
-                await client.post(`/orchestrate/${data.runId}/approve`, { stepKey: status.currentStep });
-                console.log('  Approved — workflow resuming...');
-              } catch (e) {
-                console.error(`  Approve failed: ${e.response?.data?.error || e.message}`);
-              }
-            } else if (answer.toLowerCase() === 'kill') {
-              try {
-                await client.post(`/orchestrate/${data.runId}/kill`, { reason: 'CLI kill' });
-                console.log('  Workflow killed.');
-                process.exit(0);
-              } catch (e) {
-                console.error(`  Kill failed: ${e.message}`);
-              }
-            } else {
-              console.log(`  Skipped. Resume later: hone run-story ${data.runId} --status`);
-              process.exit(0);
-            }
-          } else {
-            // Non-interactive (CI): exit with code 2 (paused, needs approval)
-            console.log(`  Non-interactive mode. Approve with: hone run-story ${data.runId} --approve ${status.currentStep}`);
-            process.exit(2);
-          }
-          continue;
-        }
-
-        // Still running
-        const currentStep = status.steps.find(s => s.status === 'running');
-        if (currentStep) {
-          process.stdout.write(`  Running: ${currentStep.stepKey} (${currentStep.agent})...\r`);
-        }
-      }
+      await pollUntilDecision(data.runId);
     } catch (e) {
       if (e.response?.status === 429) {
         console.error(`Max concurrent workflows reached. ${e.response.data.error}`);
@@ -7484,7 +7543,7 @@ showCmd
 // to apply — structure is not applicability.
 program
   .command('check-patch <workflowId>')
-  .description('Verify step_4\'s diff applies to the current working tree (condition 5)')
+  .description('Verify step_4\'s diff applies to HEAD — the tree verify-patch and emit-pr apply it to (condition 5)')
   .option('--step-key <key>', 'Step to check (default: step_4)', 'step_4')
   .option('--attempt <n>', 'Specific attempt number (default: latest)')
   .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
@@ -7492,7 +7551,7 @@ program
     const { execFileSync } = require('child_process');
     const os = require('os');
     const { extractDiff, interpretApplyCheck } = require('./lib/patch-apply');
-    const { extractFileBlocks, buildDiff, nodeMaterializeIO, MaterializeError } = require('./lib/materialize-diff');
+    const { extractFileBlocks, buildDiff, headMaterializeIO, MaterializeError, hasMaterializableWork } = require('./lib/materialize-diff');
     const { gitEnv } = require('./lib/git-env');
     const config = getConfig();
     const client = api(config);
@@ -7526,10 +7585,10 @@ program
         `○ ${opts.stepKey} declared NO CHANGES — nothing to apply.`);
       return;
     }
-    if (blocks.files.length > 0 || (blocks.edits && blocks.edits.length > 0) || blocks.deletes.length > 0) {
+    if (hasMaterializableWork(blocks)) {
       let built;
       try {
-        built = buildDiff(blocks, nodeMaterializeIO({ cwd: process.cwd() }));
+        built = buildDiff(blocks, headMaterializeIO({ cwd: process.cwd() }));
       } catch (e) {
         if (e instanceof MaterializeError) {
           emit({ ok: false, verdict: 'does_not_apply', reason: e.code, detail: e.message },
@@ -7542,8 +7601,9 @@ program
       source = 'file-blocks';
       noChanges = built.partCount === 0;
       if (noChanges) {
-        emit({ ok: true, verdict: 'no_changes' },
-          `○ ${opts.stepKey} file blocks were identical to the tree — nothing to apply.`);
+        // HC-GF-077: identical to HEAD, not to the working copy — the editor's uncommitted edits are not HEAD.
+        emit({ ok: true, verdict: 'already_in_head', source: 'file-blocks', detail: `HEAD already contains ${opts.stepKey}'s files` },
+          `○ HEAD already contains ${opts.stepKey}'s files — nothing to apply.`);
         return;
       }
     } else {
@@ -7562,16 +7622,25 @@ program
       }
     }
 
-    // Write to a temp file and run git apply --check against the current repo.
+    // Write to a temp file and run git apply --check against HEAD. HC-GF-077: against an index read from HEAD,
+    // not the working copy — an editor's uncommitted edits are exactly what emit-pr's branch will NOT contain.
     const tmp = path.join(os.tmpdir(), `hone-check-patch-${Date.now()}.diff`);
     let result;
     try {
       fs.writeFileSync(tmp, diff);
       let code = 0, stderr = '';
       try {
-        execFileSync('git', ['apply', '--check', tmp], {
-          cwd: process.cwd(), env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
-        });
+        const index = path.join(os.tmpdir(), `hone-check-index-${process.pid}-${Date.now()}`);
+        try {
+          try {
+            execFileSync('git', ['read-tree', `--index-output=${index}`, 'HEAD'], { cwd: process.cwd(), env: gitEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
+          } catch { // no commit yet: every path is new, so check against the empty tree
+            execFileSync('git', ['read-tree', '--empty', `--index-output=${index}`], { cwd: process.cwd(), env: gitEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
+          }
+          execFileSync('git', ['apply', '--check', '--cached', tmp], {
+            cwd: process.cwd(), env: gitEnv({ GIT_INDEX_FILE: index }), encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+          });
+        } finally { try { fs.unlinkSync(index); } catch { /* best-effort */ } }
       } catch (e) {
         code = e.status || 1;
         stderr = (e.stderr || '').toString();
@@ -7587,7 +7656,7 @@ program
     } else {
       emit({ ok: false, verdict: 'failed', source, detail: result.detail },
         `✗ ${opts.stepKey} diff does NOT apply: ${result.detail}\n` +
-        `  The output is a well-formed diff but does not match the working tree — ` +
+        `  The output is a well-formed diff but does not match HEAD — ` +
         `exactly the defect condition 5 catches that condition 4 cannot.`);
       process.exit(2);  // distinct exit: 2 = does-not-apply, 1 = no-diff/fetch
     }
@@ -7615,8 +7684,8 @@ program
   .action(async (workflowId, opts) => {
     const { execFileSync, spawnSync } = require('child_process');
     const os = require('os');
-    const { extractFileBlocks, buildDiff, nodeMaterializeIO, MaterializeError } = require('./lib/materialize-diff');
-    const { resolveCommand, verdictFromRun, EXIT, resolveAuxGates, classifyGateRun } = require('./lib/verify-patch');
+    const { extractFileBlocks, buildDiff, headMaterializeIO, MaterializeError, hasMaterializableWork } = require('./lib/materialize-diff');
+    const { resolveCommandDetailed, verdictFromRun, verifyCommandEnv, EXIT, resolveAuxGates, classifyGateRun } = require('./lib/verify-patch');
     const { gitEnv } = require('./lib/git-env');
     const config = getConfig();
     const client = api(config);
@@ -7627,12 +7696,17 @@ program
     };
 
     // 1. Fetch step_4 output.
+    // HC-GF-074: the attempt this run verified — reported with the verdict below.
+    let verifiedAttempt;
     let output, runConfig;
     try {
       const url = `/orchestrate/${workflowId}/step/${opts.stepKey}` +
         (opts.attempt ? `?attempt=${opts.attempt}` : '');
       const r = await client.get(url);
       output = r.data?.output;
+      // HC-GF-074: remember WHICH attempt this is. Without --attempt the server returns the latest, and the verdict
+      // used to be reported with `attempt: null` — so no verdict on record could say which build it judged.
+      verifiedAttempt = r.data?.attempt != null ? Number(r.data.attempt) : undefined;
       // best-effort: pull the run's ci_local_command for the default
       try {
         const runR = await client.get(`/orchestrate/${workflowId}`);
@@ -7648,7 +7722,7 @@ program
     // 2. Materialize the diff (shared with check-patch/emit-pr, followup-23/27).
     // Condition 6 presupposes 5.
     const blocks = extractFileBlocks(output);
-    const hasWork = blocks.files.length > 0 || (blocks.edits && blocks.edits.length > 0) || blocks.deletes.length > 0;
+    const hasWork = hasMaterializableWork(blocks);
     if (blocks.noChanges || !hasWork) {
       emit({ ok: false, verdict: 'no_diff', reason: 'no_changes_or_diff' },
         `✗ ${opts.stepKey} produced no file changes to verify.`);
@@ -7656,7 +7730,7 @@ program
     }
     let diff;
     try {
-      diff = buildDiff(blocks, nodeMaterializeIO({ cwd: process.cwd() })).diff;
+      diff = buildDiff(blocks, headMaterializeIO({ cwd: process.cwd() })).diff;
     } catch (e) {
       if (e instanceof MaterializeError) {
         emit({ ok: false, verdict: 'does_not_apply', reason: e.code, detail: e.message },
@@ -7665,17 +7739,17 @@ program
       }
       throw e;
     }
-    if (!diff.trim()) {
-      emit({ ok: true, verdict: 'no_changes' },
-        `○ ${opts.stepKey} file blocks matched the tree — nothing to verify.`);
-      return;
-    }
+    // HC-GF-077: an empty diff against HEAD means HEAD already contains the step's files. That is nothing to
+    // APPLY, not nothing to VERIFY — the command still runs, on HEAD as it is. The old early return exited 0
+    // without running anything, and auto-verify called that "verified and recorded".
+    const alreadyInHead = !diff.trim();
+    if (alreadyInHead && opts.format !== 'json') console.log(`  ○ HEAD already contains ${opts.stepKey}'s files — verifying HEAD as it is`);
 
     // 3. Isolated worktree from HEAD.
     const wt = fs.mkdtempSync(path.join(os.tmpdir(), 'hone-verify-'));
     const diffFile = path.join(os.tmpdir(), `hone-verify-${Date.now()}.diff`);
     fs.writeFileSync(diffFile, diff);
-    const command = resolveCommand(opts.command, runConfig?.ci_local_command, { cwd: process.cwd() }) // followup-7: file re-read + Makefile/npm-aware default;
+    const { command, source: commandSource } = resolveCommandDetailed(opts.command, runConfig?.ci_local_command, { cwd: process.cwd() }); // followup-7 tiers; HC-GF-008: the source says whether `make ci` was a guess
     let cleanupDone = false;
     const cleanup = () => {
       if (cleanupDone || opts.keep) return;
@@ -7704,9 +7778,9 @@ program
       execFileSync('git', ['worktree', 'add', '--detach', wt, 'HEAD'],
         { cwd: process.cwd(), env: gitEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
 
-      // 4. Apply the diff INTO the worktree (real apply, isolated).
+      // 4. Apply the diff INTO the worktree (real apply, isolated) — unless HEAD already holds it.
       let applied = true, applyDetail = '';
-      try {
+      if (!alreadyInHead) try {
         execFileSync('git', ['-C', wt, 'apply', diffFile], { env: gitEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
       } catch (e) {
         applied = false;
@@ -7732,12 +7806,14 @@ program
         if (opts.format !== 'json') console.log(`  running: ${command}  (in isolated worktree, timeout ${opts.timeout}s)`);
         const run = spawnSync(command, {
           cwd: wt, shell: true, encoding: 'utf8',
-          timeout: Number(opts.timeout) * 1000, env: gitEnv(),
+          timeout: Number(opts.timeout) * 1000, env: verifyCommandEnv(gitEnv()),
           stdio: ['ignore', 'pipe', 'pipe'],
         });
         const timedOut = run.error && run.error.code === 'ETIMEDOUT';
-        const v = verdictFromRun({ code: run.status, timedOut, stdout: run.stdout, stderr: run.stderr });
-        const sym = v.verdict === 'pass' ? '✓' : v.verdict === 'timeout' ? '⏱' : '✗';
+        const v = verdictFromRun({ code: run.status, timedOut, stdout: run.stdout, stderr: run.stderr, command, source: commandSource });
+        // HC-GF-077: nothing was applied when HEAD already held the step — say what the command actually ran on.
+        if (alreadyInHead && v.verdict === 'pass') v.detail = "tests passed on HEAD, which already contains the step's files";
+        const sym = v.verdict === 'pass' ? '✓' : v.verdict === 'timeout' ? '⏱' : v.verdict === 'unresolved' ? '○' : '✗';
 
         // HC-GF-023: on a failure the operator needs the OUTPUT, not a quote from it.
         // The full log is written OUTSIDE the worktree (cleanup removes the worktree)
@@ -7782,7 +7858,7 @@ program
           for (const gate of resolveAuxGates({ configured: ciCfg, cwd: process.cwd() })) {
             const gr = spawnSync(gate.command, {
               cwd: wt, shell: true, encoding: 'utf8',
-              timeout: Number(opts.timeout) * 1000, env: gitEnv(),
+              timeout: Number(opts.timeout) * 1000, env: verifyCommandEnv(gitEnv()),
               stdio: ['ignore', 'pipe', 'pipe'],
             });
             const c = classifyGateRun({
@@ -7822,11 +7898,20 @@ program
           verdict: reportVerdict,
           exitCode,
           detail: reportDetail,
-          attempt: opts.attempt ? Number(opts.attempt) : undefined,
+          attempt: opts.attempt ? Number(opts.attempt) : verifiedAttempt,
           headSha,
           gates: reportGates.length ? reportGates : undefined,
         });
-        if (opts.format !== 'json') console.log(`  → reported verdict '${reportVerdict}' to the server (advisory)`);
+        if (opts.format !== 'json') {
+          // HC-GF-070: name the gate that is actually configured. This said "(advisory)"
+          // unconditionally, and printed it on a run where `enforce` was auto-approving
+          // step_4 on the strength of that very verdict.
+          const { verdictReportLine } = require('./lib/auto-verify');
+          const { readVerificationGateConfig } = require('./lib/pipeline-config');
+          let gate = 'advisory';
+          try { gate = readVerificationGateConfig(process.cwd()) || 'advisory'; } catch { /* label only */ }
+          console.log(verdictReportLine(reportVerdict, gate));
+        }
       } catch (e) {
         if (opts.format !== 'json') console.warn(`  ⚠ verdict report failed (non-fatal): ${e.response?.data?.error || e.message}`);
       }
@@ -7851,7 +7936,12 @@ program
       else console.log(renderReport(report));
       // Exit non-zero when the operator has something to do, so `hone run-report`
       // is usable as a gate in a script and not merely as prose.
-      process.exit(report.needsYou.length ? 1 : 0);
+      //
+      // HC-GF-065: count the GATING items, not every item. An advisory — currently
+      // "verification never ran" — is shown in full but must not flip this exit code:
+      // it fires on every unverified terminal run, and gating on it would turn a
+      // passing adopter CI red the day they upgrade. HC-026c: report before you gate.
+      process.exit((report.gatingCount ?? report.needsYou.length) ? 1 : 0);
     } catch (e) {
       console.error(`run-report failed: ${e.response?.data?.error || e.message}`);
       process.exit(1);
@@ -7882,8 +7972,8 @@ program
   .action(async (workflowId, opts) => {
     const { execFileSync, spawnSync } = require('child_process');
     const os = require('os');
-    const { extractFileBlocks, buildDiff, nodeMaterializeIO, MaterializeError } = require('./lib/materialize-diff');
-    const { resolveCommand, verdictFromRun } = require('./lib/verify-patch');
+    const { extractFileBlocks, buildDiff, headMaterializeIO, MaterializeError, hasMaterializableWork } = require('./lib/materialize-diff');
+    const { resolveCommandDetailed, verdictFromRun, verifyCommandEnv } = require('./lib/verify-patch');
     const {
       EXIT, buildBranchName, buildCommitMessage, buildPrBody, decidePublish,
     } = require('./lib/emit-pr');
@@ -7923,7 +8013,7 @@ program
     // 2. Materialize the diff (shared with check-patch/verify-patch,
     // followup-23/27). Condition 7 presupposes 5.
     const blocks = extractFileBlocks(output);
-    const hasWork = blocks.files.length > 0 || (blocks.edits && blocks.edits.length > 0) || blocks.deletes.length > 0;
+    const hasWork = hasMaterializableWork(blocks);
     if (blocks.noChanges || !hasWork) {
       emit({ ok: false, verdict: 'no_diff', reason: 'no_changes_or_diff' },
         `✗ ${opts.stepKey} produced no file changes to emit.`);
@@ -7931,7 +8021,7 @@ program
     }
     let diff;
     try {
-      diff = buildDiff(blocks, nodeMaterializeIO({ cwd: process.cwd() })).diff;
+      diff = buildDiff(blocks, headMaterializeIO({ cwd: process.cwd() })).diff;
     } catch (e) {
       if (e instanceof MaterializeError) {
         emit({ ok: false, verdict: 'does_not_apply', reason: e.code, detail: e.message },
@@ -7941,8 +8031,9 @@ program
       throw e;
     }
     if (!diff.trim()) {
-      emit({ ok: true, verdict: 'no_changes' },
-        `○ ${opts.stepKey} file blocks matched the tree — nothing to emit.`);
+      // HC-GF-077: empty against HEAD — the base branch already holds the change, so there is nothing to emit.
+      emit({ ok: true, verdict: 'already_in_head', detail: `HEAD already contains ${opts.stepKey}'s files` },
+        `○ HEAD already contains ${opts.stepKey}'s files — nothing to emit.`);
       return;
     }
 
@@ -7989,7 +8080,7 @@ program
     const wt = fs.mkdtempSync(path.join(os.tmpdir(), 'hone-emit-'));
     const diffFile = path.join(os.tmpdir(), `hone-emit-${Date.now()}.diff`);
     fs.writeFileSync(diffFile, diff);
-    const command = resolveCommand(opts.command, runConfig?.ci_local_command, { cwd: process.cwd() }) // followup-7: file re-read + Makefile/npm-aware default;
+    const { command, source: commandSource } = resolveCommandDetailed(opts.command, runConfig?.ci_local_command, { cwd: process.cwd() }); // followup-7 tiers; HC-GF-008: the source says whether `make ci` was a guess
     // `worktree add -b` creates the branch ref BEFORE apply/verify. If we bail
     // before a successful commit (apply fails, verify fails), that empty branch
     // (pointing at HEAD) must be torn down too — else "a failing diff never
@@ -8047,19 +8138,21 @@ program
           if (opts.format !== 'json') console.log(`  verifying: ${command}  (in isolated worktree, timeout ${opts.timeout}s)`);
           const run = spawnSync(command, {
             cwd: wt, shell: true, encoding: 'utf8',
-            timeout: Number(opts.timeout) * 1000, env: gitEnv(),
+            timeout: Number(opts.timeout) * 1000, env: verifyCommandEnv(gitEnv()),
             stdio: ['ignore', 'pipe', 'pipe'],
           });
           const timedOut = run.error && run.error.code === 'ETIMEDOUT';
-          const v = verdictFromRun({ code: run.status, timedOut, stdout: run.stdout, stderr: run.stderr });
+          const v = verdictFromRun({ code: run.status, timedOut, stdout: run.stdout, stderr: run.stderr, command, source: commandSource });
           if (v.verdict === 'pass') {
             verifyState = 'pass';
           } else {
             verifyOk = false;
-            const sym = v.verdict === 'timeout' ? '⏱' : '✗';
+            // HC-GF-008: a command that never started is not a failed verify.
+            const unresolved = v.verdict === 'unresolved';
+            const sym = unresolved ? '○' : v.verdict === 'timeout' ? '⏱' : '✗';
             emit({ ok: false, verdict: v.verdict, command, detail: v.detail },
-              `${sym} verify failed, no branch emitted: ${v.detail}\n  (command: ${command})`);
-            exitCode = v.exitCode; // 3 tests-failed or 4 timeout
+              `${sym} ${unresolved ? 'verify could not run, no branch emitted' : 'verify failed, no branch emitted'}: ${v.detail}\n  (command: ${command})`);
+            exitCode = v.exitCode; // 3 tests-failed, 4 timeout, 7 unresolved
           }
         }
 
@@ -8219,7 +8312,9 @@ program
       if (!command) { try { command = readCIGateConfig(repoRoot).local_command; } catch { command = 'make ci'; } }
       command = command || 'make ci';
       if (opts.format !== 'json') console.log(`  running local CI: ${command} (timeout ${opts.timeout}s)`);
-      const run = spawnSync(command, { cwd: repoRoot, shell: true, encoding: 'utf8', timeout: Number(opts.timeout) * 1000, stdio: ['ignore', 'inherit', 'inherit'] });
+      // HC-GF-008: the adopter's own command, without make state inherited from whoever ran hone.
+      const { verifyCommandEnv } = require('./lib/verify-patch');
+      const run = spawnSync(command, { cwd: repoRoot, shell: true, encoding: 'utf8', timeout: Number(opts.timeout) * 1000, stdio: ['ignore', 'inherit', 'inherit'], env: verifyCommandEnv(gitEnv()) });
       local = { code: run.status == null ? 1 : run.status, timedOut: !!(run.error && run.error.code === 'ETIMEDOUT') };
     }