@hone-ai/cli 1.31.0 → 1.33.0

package/lib/run-report.js

@@ -19,6 +19,15 @@
 /** Gate verdicts the pipeline already speaks. Do not invent synonyms. */
 const ACTIONABLE_GATE_VERDICTS = ['fail', 'unavailable'];
 
+/**
+ * HC-GF-008: the verification verdicts that leave nothing outstanding. `disabled` is verify-pr's record of
+ * an explicit `ci.gate: none`. Everything else — including a value this file has never seen — is an item,
+ * so a renamed or added verdict becomes a visible line rather than silence.
+ */
+const CLEAR_VERIFICATION_VERDICTS = ['pass', 'disabled'];
+/** The ones that gate the script exit. `unresolved` gates because an absent command used to report `fail`. */
+const GATING_VERIFICATION_VERDICTS = ['fail', 'timeout', 'unresolved'];
+
 function pad(s, n) { return String(s).padEnd(n); }
 
 /**
@@ -38,6 +47,37 @@ function durationOf(startedAt, endedAt) {
  * @param {object} run  the GET /:runId projection
  * @param {{cost?: {metered:number, notional:number}}} [extra]
  */
+/**
+ * HC-GF-046(b): the error codes on which approving is REFUSED — and nothing else.
+ *
+ * This must equal exactly what `checkGuardrails` emits, because the report tells the
+ * operator "approving will be refused" for these. The first version was a hand-typed list
+ * written from memory, and one of its four entries was right: MAX_STEPS_EXCEEDED was the
+ * wrong string (the real code is MAX_TOTAL_STEPS_EXCEEDED), BUDGET_EXCEEDED could never
+ * match the prefixed TOKEN_/BATCH_BUDGET_EXCEEDED past the ^ anchor, and GARBAGE_OUTPUT is
+ * not a guardrail refusal at all — approveGate accepts it. It is not an ordinary gate either;
+ * see EXHAUSTED_RE below.
+ *
+ * Exported so a test pins it equal to the enforcer's own reason codes. The enforcer lives in
+ * the server package and this in the CLI package, so they cannot share a constant at
+ * runtime; the equality is asserted in CI instead, which is where drift would be caught.
+ */
+const BLOCKING_REASON_CODES = Object.freeze(['MAX_RETRIES_EXCEEDED', 'MAX_TOTAL_STEPS_EXCEEDED']);
+const BLOCKING_REASON_RE = new RegExp(`^(${BLOCKING_REASON_CODES.join('|')})[^\\n]*`);
+
+/**
+ * HC-GF-046(b), corrected in review: a step that used up its format retries.
+ *
+ * This first shipped as an ordinary gate ("a gate is waiting on your judgment"), on the claim
+ * that approving past it started a real attempt — a3, a4 and a5 on run 5f1a7f75. An independent
+ * review refuted that from the rows: a3 was the automatic retry, a4 and a5 were route-backs from
+ * step_5, and the one approval of that pause re-ran nothing. approveGate closes the step's
+ * in-flight rows and moves on, so later steps read the most recent EARLIER attempt — on
+ * 5f1a7f75, the build step_5 had already rejected. "Gate" invites exactly that. HC-GF-075 then
+ * changed what approving does — it retries the step — and this line says so.
+ */
+const EXHAUSTED_RE = /^GARBAGE_OUTPUT at (step_[0-9a-z]+)/;
+
 function buildReport(run, extra = {}) {
   const cfg = run.config || {};
   const steps = Array.isArray(run.steps) ? run.steps : [];
@@ -48,10 +88,48 @@ function buildReport(run, extra = {}) {
   // ── NEEDS YOU ──────────────────────────────────────────────────────────────
   // 1. The run itself is not finished.
   if (run.status === 'paused' && run.currentStep) {
-    needsYou.push({
-      what: `run is paused at ${run.currentStep} — a gate is waiting on your judgment`,
-      how: `hone run-story ${run.runId} --approve ${run.currentStep}`,
-    });
+    // HC-GF-046: a paused run is not always a gate.
+    //
+    // Run 3dbde316 sat `paused` at step_4 with `MAX_RETRIES_EXCEEDED: step_4 retried 2
+    // times (max 2)`. That LOOKS like an available approval — paused, with a pending gate
+    // — but `checkGuardrails` refuses step_4 before the LLM call, so approving can never
+    // move the run. The line described the run's SHAPE and not its CAUSE, and so invited
+    // the one action the orchestrator had already decided to refuse. A driver looped on
+    // it; a human tried once and had to read the database.
+    //
+    // Matched on the specific messages the guardrail acts on, NOT on "any error_message".
+    // A resumable pause — a local rate-limit window, for instance — is not a refusal, and
+    // silencing a real gate on those would be the over-reach that makes the surface
+    // untrustworthy in the other direction.
+    const blocked = String(run.errorMessage || '').match(BLOCKING_REASON_RE);
+    const exhausted = String(run.errorMessage || '').match(EXHAUSTED_RE);
+    if (run.approvalRefusal) {
+      // HC-GF-074: rendered from the server's own decision, never re-derived from verdict records here.
+      needsYou.push({
+        what: `run CANNOT be approved at ${run.currentStep} as it stands — ${String(run.approvalRefusal.message).slice(0, 300)}`,
+        how: `fix and re-verify (hone verify-patch ${run.runId} --report), or hone run-story ${run.runId} --approve ${run.currentStep} --acknowledge-failed-verdict`,
+      });
+    } else if (blocked) {
+      needsYou.push({
+        what: `run CANNOT proceed at ${run.currentStep} — ${blocked[0].slice(0, 160)}. `
+          + 'Approving will be refused by the guardrail, so this is a decision, not a gate',
+        how: `hone run-story ${run.runId} --kill   (or raise guardrails.max_retries_per_step `
+          + 'in .pipeline-config.yml and re-run the story)',
+      });
+    } else if (exhausted) {
+      const s = exhausted[1];
+      needsYou.push({
+        what: `run is paused at ${s} — ${s} used up its format retries. Approving starts another cycle `
+          + `of ${s} with a fresh format budget; it does not accept an earlier attempt`,
+        how: `hone show step ${run.runId} ${s}   (then --approve ${s} to retry, or --kill; `
+          + 'guardrails.max_retries_per_step caps the cycles)',
+      });
+    } else {
+      needsYou.push({
+        what: `run is paused at ${run.currentStep} — a gate is waiting on your judgment`,
+        how: `hone run-story ${run.runId} --approve ${run.currentStep}`,
+      });
+    }
   }
   if (run.status === 'failed') {
     needsYou.push({
@@ -59,6 +137,19 @@ function buildReport(run, extra = {}) {
       how: `hone show step ${run.runId} ${run.currentStep || '<stepKey>'}`,
     });
   }
+  // HC-GF-065: a KILLED run needs you too.
+  //
+  // The predicate above is `status === 'failed'`, which `killed` does not match — so nine
+  // terminated runs in the corpus printed `NEEDS YOU (0)` and "nothing outstanding". A run
+  // somebody stopped mid-flight has work outstanding by definition, and the digest told
+  // the operator it did not. This is HC-GF-044's defect one field over, and its own lesson
+  // states the rule: a well-formed "nothing" is only as true as the predicate behind it.
+  if (run.status === 'killed') {
+    needsYou.push({
+      what: `run was KILLED before it finished${run.errorMessage ? `: ${String(run.errorMessage).slice(0, 160)}` : ''}`,
+      how: `hone run-story ${run.runId} --status   (re-run the story, or read the last step)`,
+    });
+  }
 
   // 1b. HC-GF-044: a STEP can be failed while the RUN says completed.
   //
@@ -132,6 +223,35 @@ function buildReport(run, extra = {}) {
     });
   }
 
+  // HC-GF-050: a cycle that changed nothing, and attempts escalating toward the ceiling. Computed by the server from every
+  // attempt (GET /:runId `convergence`) and rendered here, never re-derived. ADVISORY: a new signal reports before it gates
+  // (HC-026c), and a story that legitimately needs three cycles must not flip a script's exit status. When cycles were
+  // compared and none was flagged, say what was compared — absence must not read as not-checked.
+  const conv = run.convergence;
+  if (conv) {
+    for (const u of conv.unchanged || []) {
+      needsYou.push({
+        what: `a cycle changed nothing — ${u.detail}`,
+        how: `hone show step ${run.runId} step_4 --attempt ${u.attempts[u.attempts.length - 1]}`,
+        howLabel: 'inspect',
+        advisory: true,
+      });
+    }
+    if (conv.escalating) {
+      needsYou.push({
+        what: `each build attempt runs longer and produces more — ${conv.escalating.detail}`,
+        how: `hone show step ${run.runId} step_4 --attempt ${conv.escalating.attempts[conv.escalating.attempts.length - 1]}`,
+        howLabel: 'inspect',
+        advisory: true,
+      });
+    }
+    const ex = conv.examined || {};
+    if (!(conv.unchanged || []).length && !conv.escalating && (ex.reviewCycles || ex.repeatedFailurePairs)) {
+      worthKnowing.push(`convergence: compared ${ex.reviewCycles} review cycle(s) and ${ex.repeatedFailurePairs} repeated failure(s) `
+        + `across ${ex.builds} build attempt(s) — each rebuild changed materially (${ex.criteria})`);
+    }
+  }
+
   // 1d. HC-GF-041: two diagnostics the orchestrator has stamped since HC-019n-followup-41
   // and -43, which NOTHING has ever read on this path — the run payload carried only
   // token counts until the `diagnostics` projection was added. HC-GF-016's row specifies
@@ -154,6 +274,18 @@ function buildReport(run, extra = {}) {
       worthKnowing.push(
         `${s.stepKey} dropped composed guardrail section(s) on a retry and was accepted (budget spent): ${d.composed_missing.join(', ')}`);
     }
+    // HC-GF-059: this build contains files the attempt did not write. Advisory — they are the previous build's files,
+    // unchanged, and whoever approves should read them as that build's content.
+    if (d.carried_forward && Array.isArray(d.carried_forward.paths) && d.carried_forward.paths.length) {
+      needsYou.push({
+        what: `${s.stepKey} attempt ${s.attempt} did not re-emit ${d.carried_forward.paths.length} planned file(s); they were `
+          + `carried forward unchanged from attempt ${d.carried_forward.from_attempt} — review them as that build's content`,
+        detail: d.carried_forward.paths.map(String),
+        how: `hone show step ${run.runId} ${s.stepKey} --attempt ${s.attempt}`,
+        howLabel: 'inspect',
+        advisory: true,
+      });
+    }
   }
 
   // 2. The last verification is ONE event, so it becomes ONE item with sub-lines.
@@ -168,12 +300,15 @@ function buildReport(run, extra = {}) {
   const lastVerification = verifications[verifications.length - 1] || null;
   if (lastVerification) {
     const bad = (lastVerification.gates || []).filter(g => ACTIONABLE_GATE_VERDICTS.includes(g.verdict));
-    const failed = lastVerification.verdict === 'fail' || lastVerification.verdict === 'timeout';
+    // HC-GF-008: "not a pass" is the enforcer's rule (verification-refusal `failingVerdict`), so it is the
+    // report's. Listing the failing values instead left `does_not_apply`, `error` — and the new `unresolved`,
+    // which an absent command used to report as a gating `fail` — rendering "nothing outstanding".
+    const failed = !CLEAR_VERIFICATION_VERDICTS.includes(lastVerification.verdict);
     if (failed || bad.length) {
       const stepKey = lastVerification.stepKey || 'step_4';
       needsYou.push({
         what: failed
-          ? `verification ${lastVerification.verdict} on ${stepKey}`
+          ? `${lastVerification.verdict === 'unresolved' ? 'verification could not run' : `verification ${lastVerification.verdict}`} on ${stepKey}`
             + `${lastVerification.detail ? ` — ${lastVerification.detail}` : ''}`
           : `${bad.length} gate(s) not passing on ${stepKey}`,
         // Sub-lines carry the per-gate verdicts, so one glance separates
@@ -183,10 +318,40 @@ function buildReport(run, extra = {}) {
              + `${g.command ? `   [${g.command}]` : ''}`),
         how: `hone verify-patch ${run.runId} ${stepKey} --keep`,
         howLabel: 'reproduce',
+        // Report before gating (HC-026c): verdicts this report used to swallow are shown in full but do not flip
+        // the script exit yet. `unresolved` is not one of them — a report must not stop gating a run on which
+        // nothing was run.
+        ...(failed && !bad.length && !GATING_VERIFICATION_VERDICTS.includes(lastVerification.verdict) ? { advisory: true } : {}),
       });
     }
   }
 
+  // HC-GF-065: NO verdict at all is itself an item, not a footnote under a zero.
+  //
+  // Measured over the corpus with this very function: 10 of 21 terminal runs printed
+  // "nothing outstanding", and the sentence is false in every one of them. Nothing was
+  // executed against the diff, so the report cannot know whether anything is outstanding
+  // — the two reviewing steps READ, they do not run anything, which is exactly why
+  // HC-GF-064's verdict exists.
+  //
+  // Scoped to terminal runs on purpose. A run still in flight has not reached the point
+  // where a verdict is expected, and flagging it would make the section noise on every
+  // poll — which is how the old nag reached 5-of-22 and got ignored.
+  if (['completed', 'failed', 'killed'].includes(run.status) && !lastVerification) {
+    needsYou.push({
+      what: 'verification never ran for this run — no test, lint or typecheck result was '
+        + 'reported, so nothing here is known to build',
+      how: `hone verify-patch ${run.runId} step_4 --report`,
+      // HC-GF-065: ADVISORY. `hone run-report` exits 1 when needsYou is non-empty, and
+      // the comment at that exit says why — "so run-report is usable as a GATE in a
+      // script". This item fires on every unverified terminal run (15 of 21 in the
+      // corpus, most of them otherwise healthy), so gating on it would turn an adopter's
+      // passing CI red overnight. HC-026c is precisely this rule: a new signal REPORTS
+      // before it GATES. Visible in the report, absent from the exit code.
+      advisory: true,
+    });
+  }
+
   // ── WORTH KNOWING ──────────────────────────────────────────────────────────
   // Retries: the step ran more than once. HC-GF-041(c): this used to append "(its
   // first output was rejected)", which the report never checked and which is often
@@ -236,6 +401,11 @@ function buildReport(run, extra = {}) {
     worthKnowing,
     steps,
     verifications,
+    // HC-GF-065: what the exit code should count. Advisory items are shown but do not
+    // gate, so a new signal cannot silently change the meaning of a script's exit status.
+    gatingCount: needsYou.filter(i => !i.advisory).length,
+    // HC-GF-050: carried so the empty NEEDS YOU can name convergence among what was checked.
+    convergence: run.convergence || null,
   };
 }
 
@@ -278,11 +448,14 @@ function renderReport(r) {
       checked.push('verification');
       for (const g of last.gates || []) checked.push(g.name);
     }
+    if (r.convergence) checked.push('convergence');
+    // HC-GF-065: the empty state is only reachable when something was actually CHECKED.
+    // With no verdict there is nothing executed against the diff, so "nothing outstanding"
+    // asserts knowledge the report does not have — the missing verification is now an
+    // ITEM above rather than a footnote under a zero, and this branch is unreachable in
+    // that case. Kept as a genuine all-clear for a run that WAS verified.
     L.push('NEEDS YOU (0)');
-    L.push(checked.length
-      ? `  nothing — ${checked.join(', ')} all reported and none is failing or unavailable`
-      : '  nothing outstanding, but NO verification was reported for this run — '
-        + 'run `hone verify-patch <runId> step_4 --report` before trusting that');
+    L.push(`  nothing — ${checked.join(', ')} all reported and none is failing or unavailable`);
   }
   L.push('');
 
@@ -316,4 +489,4 @@ function renderReport(r) {
   return L.join('\n');
 }
 
-module.exports = { buildReport, renderReport, durationOf, ACTIONABLE_GATE_VERDICTS };
+module.exports = { BLOCKING_REASON_CODES, buildReport, renderReport, durationOf, ACTIONABLE_GATE_VERDICTS };

package/lib/run-target.js

@@ -0,0 +1,97 @@
+'use strict';
+/**
+ * HC-GF-106 — the ONE place a `run-story` verb turns its argument into the run it acts on.
+ *
+ * `--status`, `--kill` and `--approve` each forwarded the argument verbatim (`runId || storyIdOrRunId`),
+ * so a story ID reached the server as a run ID and the route's UUID check answered `Run not found` —
+ * while `--help` promised "the latest workflow run for this story". Observed 2026-09-11:
+ * `hone run-story TICK-002 --kill` printed `Failed: Run not found` and left the paused run untouched.
+ * Every verb that acts on an existing run resolves here, so no two of them can disagree about which
+ * run that is, and none can fall back to sending the story ID.
+ *
+ * HC-GF-108 — the lookup asks the server for the story in the repository (`storyId`, `repoName`)
+ * instead of reading the org's 100 most recent runs, which reported "not found" for a story whose runs
+ * were all older than that. It still filters every row itself: a server that predates the filters
+ * ignores them and returns the org's most recent runs, and whatever this returns is posted to.
+ *
+ * I/O is the injected `client` (the CLI's axios instance). No console, no exit — the caller renders
+ * `error` and decides the exit code.
+ */
+
+const RUN_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+// GET /orchestrate clamps `limit` to 1..100, lists newest first, and is scoped to the caller's org.
+// Filtered, its first row IS the story's latest run in the repository. From a server that ignores the
+// filters, the first match in the widest window is the latest run whenever that run is in the window —
+// and when it is not, the lookup says "not found" rather than picking an older one.
+const LOOKUP_LIMIT = 100;
+
+const isRunId = (s) => typeof s === 'string' && RUN_ID.test(s);
+
+/**
+ * One GET /orchestrate. `filtered` is true only when the server echoed every filter sent: a server
+ * that predates the filters echoes none of them and lists the org's most recent runs instead.
+ */
+async function listRuns(client, filters) {
+  const qs = new URLSearchParams({ limit: String(LOOKUP_LIMIT), ...filters });
+  const { data } = await client.get(`/orchestrate?${qs}`);
+  const runs = Array.isArray(data && data.runs) ? data.runs : [];
+  const filtered = Object.entries(filters).every(([k, v]) => Boolean(data) && data[k] === v);
+  return { runs, filtered };
+}
+
+/**
+ * @param {object} p
+ * @param {{ get(path: string): Promise<{ data: any }> }} p.client
+ * @param {string} p.idOrStory  what the operator typed: a run ID or a story ID
+ * @param {string} p.repoName   the repository a story ID is scoped to — the name the start path records
+ * @param {string} p.flag       the verb as typed (e.g. `--kill`, `--approve step_0`), for the hint
+ * @returns {Promise<{ runId: string, run: object|null, source: 'run-id'|'story' } | { error: string }>}
+ *          Rejects only when the lookup request itself fails.
+ */
+async function resolveRunTarget({ client, idOrStory, repoName, flag }) {
+  if (isRunId(idOrStory)) return { runId: idOrStory, run: null, source: 'run-id' };
+
+  const byRunId = `pass a run ID instead: hone run-story <runId> ${flag}`;
+  // Nothing to look up: an empty story ID, or a checkout at `/`, whose directory name is empty. Said here,
+  // rather than as the server's 400 for an empty filter, which names a query parameter nobody typed.
+  if (!idOrStory || !repoName) {
+    return {
+      error: `Cannot look up a run without a story ID and a repository name (story ${JSON.stringify(idOrStory || '')}, repository ${JSON.stringify(repoName || '')}).\n`
+        + `  Name the repository with --repo <name>, or ${byRunId}`,
+    };
+  }
+
+  // A row for another story, or whose id is not a run ID, is never a target — whichever server answered.
+  const forStory = (runs) => runs.filter(r => r && r.story_id === idOrStory && isRunId(r.id));
+
+  const here = await listRuns(client, { storyId: idOrStory, repoName });
+  const run = forStory(here.runs).find(r => r.repo_name === repoName);
+  if (run) return { runId: run.id, run, source: 'story' };
+
+  // Not in this repository — so where does the story have runs? A filtering server needs a story-only
+  // lookup to say; one that ignored the filters already returned everything this lookup can see. The
+  // answer is "not found" either way, so a failed hint lookup costs the hint, never the answer.
+  const wide = here.filtered
+    ? await listRuns(client, { storyId: idOrStory }).catch(() => ({ runs: [] }))
+    : here;
+
+  const elsewhere = [...new Set(forStory(wide.runs).map(r => r.repo_name))];
+  if (elsewhere.length) {
+    return {
+      error: `No workflow run for story ${idOrStory} in repository ${repoName}; it has runs in: ${elsewhere.join(', ')}.\n`
+        + `  Target that repository with --repo ${elsewhere[0]}, or ${byRunId}`,
+    };
+  }
+  const searched = here.filtered
+    ? "searched all of your org's runs"
+    : here.runs.length < LOOKUP_LIMIT
+      ? `searched all ${here.runs.length} runs in your org`
+      : `searched your org's ${here.runs.length} most recent runs`;
+  return {
+    error: `No workflow run found for story ${idOrStory} in repository ${repoName} (${searched}).\n`
+      + `  To act on a run by its ID, ${byRunId}   (run IDs: hone workflows)`,
+  };
+}
+
+module.exports = { resolveRunTarget, isRunId, LOOKUP_LIMIT };

package/lib/verify-patch.js

@@ -25,6 +25,9 @@ const EXIT = {
   DOES_NOT_APPLY: 2, // diff did not apply
   TESTS_FAILED: 3,  // diff applied, tests failed
   TIMEOUT: 4,       // the command exceeded --timeout
+  // HC-GF-008: the command itself could not start, so nothing about the patch is known. Not 5 or 6:
+  // emit-pr re-exits with these codes, and those two are its BRANCH_CONFLICT and PUBLISH_FAILED.
+  UNRESOLVED: 7,
 };
 
 /**
@@ -83,11 +86,81 @@ function resolveCommandDetailed(explicit, configured, opts = {}) {
 }
 function resolveCommand(explicit, configured, opts) { return resolveCommandDetailed(explicit, configured, opts).command; }
 
+/**
+ * HC-GF-008 — did the resolved command itself fail to START?
+ *
+ * The resolver's last tier is a guess (`make ci`), and a guess that names nothing came back as
+ * `tests failed (exit 2)`: the builder blamed for a command that does not exist, on every
+ * greenfield repo and every `npm init` manifest. Measured before building, on real processes —
+ * GNU make 4.3 + dash and make 3.81 + bash differ only in quote characters.
+ *
+ * Absence is the RUNNER's own words about a name the command contains:
+ *   - the shell exits 127 saying it cannot find a program the command names
+ *     (`sh: uv: command not found`, dash `sh: 7: uv: not found`, `sh: ./ci.sh: No such file or directory`);
+ *   - top-level make says a goal the command names has no rule (`No rule to make target 'ci'.  Stop.`),
+ *     or that there is no makefile at all.
+ * Deliberately NOT absence, because something started and the patch is a plausible cause: a missing
+ * prerequisite (`No rule to make target 'test', needed by 'ci'` names `test`, which the command does not),
+ * `make[1]:` (a sub-make a recipe ran), a tool missing inside a recipe or an npm script, and a 127 whose
+ * not-found line names nothing in the command. The command's own words are the discriminator throughout.
+ * Every residual lands on `fail`, which blocks exactly as before — the safe side.
+ *
+ * @returns {{ missing: string, reason: string } | null}
+ */
+const SHELL_NOT_FOUND_RE = /^[^\s:]*sh(?::\s*line\s+\d+)?:\s*(?:\d+:\s*)?(\S+):\s*(?:command not found|not found|No such file or directory)\s*$/gm;
+const MAKE_NO_RULE_RE = /^make: \*\*\* No rule to make target [`'\u2018]([^`'\u2019]+)['\u2019]/gm;
+const MAKE_NO_MAKEFILE_RE = /^make: \*\*\* No targets specified and no makefile found\./m;
+
+function commandAbsence(command, { code, stdout = '', stderr = '' } = {}) {
+  const cmd = String(command || '').trim();
+  if (!cmd) return null;
+  const words = new Set(cmd.split(/[\s;&|()<>]+/).filter(Boolean));
+  const out = `${stdout || ''}\n${stderr || ''}`;
+  if (code === 127) {
+    // `shell: true` runs /bin/sh, so these are sh's own words — bash-as-sh or dash.
+    for (const m of out.matchAll(SHELL_NOT_FOUND_RE)) {
+      if (words.has(m[1])) return { missing: m[1], reason: `\`${m[1]}\` is not installed or not on PATH` };
+    }
+    return null;
+  }
+  if (words.has('make')) {
+    for (const m of out.matchAll(MAKE_NO_RULE_RE)) {
+      if (words.has(m[1])) return { missing: m[1], reason: `no Makefile target \`${m[1]}\`` };
+    }
+    if (MAKE_NO_MAKEFILE_RE.test(out)) return { missing: 'Makefile', reason: 'no Makefile' };
+  }
+  return null;
+}
+
+/**
+ * HC-GF-008 — the environment an adopter's verification command runs in.
+ *
+ * make exports its recursion state to every recipe, so a `hone` verb run from a make target — or from
+ * `make ci` itself — hands that state to the command it verifies. Measured on GNU make 3.81 and 4.3:
+ *   - MAKELEVEL=1 turns the verified make's own `make: *** No rule to make target` into `make[1]: …`,
+ *     the prefix of a sub-make a recipe ran, so the absent-command check went inert (it passed alone and
+ *     failed under `make ci`);
+ *   - MAKEFLAGS=i (ignore errors) and MAKEFLAGS=n (dry run) make a failing `make ci` exit 0, and
+ *     GNUMAKEFLAGS=i does the same on make 4 — a pass for tests that failed or never ran, which under
+ *     enforce approves the gate.
+ * The verified command is the adopter's own top-level invocation: level 0, no inherited flags. Returns a
+ * copy; the caller's environment is untouched.
+ */
+const INHERITED_MAKE_VARS = ['MAKELEVEL', 'MAKEFLAGS', 'GNUMAKEFLAGS'];
+function verifyCommandEnv(base = process.env) {
+  const env = { ...base };
+  for (const key of INHERITED_MAKE_VARS) delete env[key];
+  return env;
+}
+
 /**
  * Interpret a completed command run into a condition-6 verdict.
  *
- * @param {{ code: number|null, timedOut: boolean, stdout?: string, stderr?: string }} run
- * @returns {{ verdict: 'pass'|'fail'|'timeout', exitCode: number, detail: string }}
+ * Pass the `command` that ran and the resolver's `source` for it: without them an absent command is
+ * indistinguishable from a failing one (HC-GF-008), and the CLI's two executors both do.
+ *
+ * @param {{ code: number|null, timedOut: boolean, stdout?: string, stderr?: string, command?: string, source?: string }} run
+ * @returns {{ verdict: 'pass'|'fail'|'timeout'|'unresolved', exitCode: number, detail: string }}
  */
 function verdictFromRun(run) {
   if (run.timedOut) {
@@ -96,6 +169,18 @@ function verdictFromRun(run) {
   if (run.code === 0) {
     return { verdict: 'pass', exitCode: EXIT.PASS, detail: 'tests passed on the applied diff' };
   }
+  const absent = commandAbsence(run.command, run);
+  if (absent) {
+    return {
+      verdict: 'unresolved',
+      exitCode: EXIT.UNRESOLVED,
+      detail: `tests never ran: ${absent.reason}`
+        + (run.source === 'default'
+          ? ` — no test command is configured or detected, so \`${run.command}\` was a guess; set ci.local_command in .pipeline-config.yml`
+          : ''),
+      missing: absent.missing,
+    };
+  }
   const sum = summarizeFailure(run);
   // HC-GF-023: lead with HOW MANY. "1 of 8 named" and "the only failure" are
   // different situations that this line used to render identically.
@@ -265,5 +350,5 @@ function classifyGateRun(run) {
 module.exports = {
   EXIT, resolveCommand, resolveCommandDetailed, DEFAULT_COMMAND,
   AUX_GATES, AUX_DETECT, resolveAuxGates, classifyGateRun,
-  verdictFromRun, lastMeaningfulLine, summarizeFailure, FAILURE_LINE_RE,
+  verdictFromRun, commandAbsence, verifyCommandEnv, lastMeaningfulLine, summarizeFailure, FAILURE_LINE_RE,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hone-ai/cli",
-  "version": "1.31.0",
+  "version": "1.33.0",
   "description": "Hone AI — Enterprise SDLC Pipeline CLI",
   "main": "hone-cli.js",
   "bin": {