@hone-ai/cli 1.34.0 → 1.35.1

package/lib/agent-eval-pacing.js

@@ -0,0 +1,102 @@
+'use strict';
+/**
+ * agent-eval-pacing.js — HC-GF-199. Pace a calibration run from what the
+ * provider actually did.
+ *
+ * Measured 2026-09-19: three sequential calibration runs, no pacing of any kind.
+ * Run 1 completed 5 of 8; runs 2 and 3 completed NOTHING. Twenty-four
+ * consecutive generations on one subscription and the provider stopped
+ * answering, so the experiment measured provider availability rather than the
+ * judgment variance it was run to measure.
+ *
+ * WHY THIS IS NOT A SLEEP. A constant delay is fitted to one afternoon's limits.
+ * It goes stale silently, and the empty runs it then produces look like a
+ * regression in the thing under test rather than an outage in the instrument.
+ * The row for this story forbids it explicitly. Everything here is derived from
+ * observed outcomes: zero refusals means zero delay, and a provider that
+ * recovers is rewarded immediately.
+ *
+ * WHAT COUNTS AS A REFUSAL. Only `outcome: 'error'` — the probe did not
+ * complete. A graded WRONG answer (`outcome: 'fail'`) is a measurement, and
+ * backing off because the agent was wrong would slow a run that is working
+ * perfectly. That distinction is [[HC-GF-198]]'s, and it is load-bearing here.
+ */
+
+/** Base unit of backoff. Doubling starts here; it is not a tuned wait. */
+const BASE_DELAY_MS = 2_000;
+
+/**
+ * Ceiling on a single wait. An unbounded backoff is the hang HC-CI-026 exists
+ * to stop, wearing a different hat — a run that waits forever reports nothing
+ * and looks identical to one still working.
+ */
+const MAX_DELAY_MS = 60_000;
+
+/**
+ * Consecutive refusals after which the run gives up.
+ *
+ * Grinding on produces a row of nulls, burns generations against a provider
+ * that has already said no, and makes a dead run look like a fast one. Stopping
+ * and SAYING SO is the honest outcome — the same rule as HC-CI-016: a run that
+ * could not run is not a result.
+ */
+const STOP_AFTER_CONSECUTIVE = 3;
+
+/** Exponential backoff in the number of CONSECUTIVE refusals, capped. */
+function nextDelayMs(consecutiveRefusals) {
+  if (!consecutiveRefusals || consecutiveRefusals < 1) return 0;
+  return Math.min(BASE_DELAY_MS * (2 ** (consecutiveRefusals - 1)), MAX_DELAY_MS);
+}
+
+/** Has the provider refused enough times in a row to call it stopped? */
+function shouldStop(consecutiveRefusals) {
+  return consecutiveRefusals >= STOP_AFTER_CONSECUTIVE;
+}
+
+/**
+ * Bookkeeping over a run. `record` takes the scored probe result; `delayBeforeNext`
+ * says how long to wait before the next probe; `stopReason` is non-null once the
+ * provider should be treated as gone.
+ */
+function createPacer() {
+  let consecutive = 0;
+  let refusals = 0;
+  let waitedMs = 0;
+
+  return {
+    record(result) {
+      // Only a non-completion is a refusal. A wrong answer is data.
+      if (result && result.outcome === 'error') {
+        consecutive += 1;
+        refusals += 1;
+      } else {
+        consecutive = 0;
+      }
+    },
+    delayBeforeNext() {
+      return nextDelayMs(consecutive);
+    },
+    noteWaited(ms) {
+      waitedMs += ms;
+    },
+    stopReason() {
+      return shouldStop(consecutive)
+        ? `the provider refused ${consecutive} consecutive probes — stopping rather than `
+          + 'reporting a run it did not complete'
+        : null;
+    },
+    /** What the run should SAY about its own pacing. A degraded run must not look fast. */
+    summary() {
+      return { refusals, consecutiveAtEnd: consecutive, waitedMs };
+    },
+  };
+}
+
+module.exports = {
+  createPacer,
+  nextDelayMs,
+  shouldStop,
+  BASE_DELAY_MS,
+  MAX_DELAY_MS,
+  STOP_AFTER_CONSECUTIVE,
+};

package/lib/agent-eval-probes-stateful.js

@@ -0,0 +1,72 @@
+'use strict';
+/**
+ * agent-eval-probes-stateful.js — HC-GF-197.
+ *
+ * Calibration for the ONE judgment the sandbox chain depends on: does this story's acceptance need
+ * stored state? HC-GF-194 made step_0 record it as a required field, which fixed the MECHANISM —
+ * the question is now always asked and never silently defaulted. It did not fix the ANSWER: the
+ * same story came back true, false, true across three live runs.
+ *
+ * WHY THIS IS NOT AN `evals/` SCENARIO. That harness grades PROMPT TEXT — `runScenario(scenario,
+ * promptText)`, "zero LLM tokens" — and its llm-judge mode judges the prompt too ("Does the prompt
+ * clearly define the agent's role?"). An eval here would assert the prompt MENTIONS
+ * `requires_stored_state`, which HC-GF-194's regression test already pins, and would say nothing
+ * about whether the groomer answers correctly. `agent-eval` is the surface that runs the agent and
+ * grades its OUTPUT, which is what calibration means.
+ *
+ * GROUND TRUTH IS THE OWNER'S, NOT MINE. Labelled 2026-09-19 against HC-GF-173's rule — "starting
+ * from an EMPTY datastore, could this acceptance be checked without inserting anything?" — because
+ * scoring the groomer against my own reading of the rule would be measuring the thing in question.
+ * HC-GF-126 is the case that matters: labelled TRUE, and a live run answered FALSE, so that run was
+ * WRONG rather than defensibly borderline.
+ *
+ * Each probe carries the story's ACCEPTANCE, which is what the rule is about — not its title, and
+ * not its implementation notes, both of which mention datastores for stories that need none.
+ */
+
+/** Matches the recorded answer, tolerating the bold and backticked renderings the harvest does. */
+const ANSWERS = (v) => `requires_stored_state\`?\\**\\s*\`?\\s*:\\s*\\**\\s*${v}\\b`;
+
+/** A story whose acceptance CANNOT be checked against an empty datastore. */
+const needsState = (id, acceptance) => ({
+  id: `stateful-true-${id}`,
+  input: `Groom this story and produce your Routing block.\n\nStory ${id}\nAcceptance: ${acceptance}`,
+  // One grader, deliberately. An earlier draft added a second asserting the question was answered
+  // AT ALL — reasoning that a groomer emitting neither value would slip through. That is true of a
+  // `not_contains` check and false of this one: a positive regex for `true` already fails on
+  // silence and on `false`. Mutation confirmed it: deleting the second grader changed no outcome.
+  graders: [{ type: 'regex', pattern: ANSWERS('true'), flags: 'i' }],
+});
+
+/** A story whose acceptance is checkable with the datastore empty — real inputs already exist. */
+const needsNoState = (id, acceptance) => ({
+  id: `stateful-false-${id}`,
+  input: `Groom this story and produce your Routing block.\n\nStory ${id}\nAcceptance: ${acceptance}`,
+  graders: [{ type: 'regex', pattern: ANSWERS('false'), flags: 'i' }],
+});
+
+module.exports = [
+  // ── TRUE: a row must exist before the acceptance can be read ──
+  needsState('HC-GF-126',
+    'A fresh N-day trial reports exactly N with the DB clock forced ahead of the process clock, '
+    + 'and still reports N with it behind.'),
+  needsState('HC-GF-195',
+    'The expiry verdict the route reports and the one the key resolver enforces come from the same '
+    + 'clock, proven by a test that skews the process clock and shows both unchanged.'),
+  needsState('HC-GF-192',
+    "A stateful story's verification runs against the database the sandbox block declares, proven "
+    + 'by the run itself rather than by configuration.'),
+  needsState('HC-GF-105',
+    'Two failures sharing a cause signature pause the batch; two with different causes do not.'),
+
+  // ── FALSE: a diff, a file or a command is real data — seeding there tests the fixture author ──
+  needsNoState('HC-GF-188',
+    'A story naming a symbol in an oversized file either receives that symbol\'s region, or the '
+    + 'operator is told the named file was cut.'),
+  needsNoState('HC-GF-182',
+    'A new roadmap row whose premise greps docs/ without excluding the roadmap fails the gate.'),
+  needsNoState('HC-GF-186',
+    '`make ci` reports how many captured learnings are unpromoted.'),
+  needsNoState('HC-CI-024',
+    'An iteration run skips only the continuity and e2e gates, and says so.'),
+];

package/lib/agent-eval-score.js

@@ -0,0 +1,70 @@
+'use strict';
+/**
+ * agent-eval-score.js — HC-GF-198.
+ *
+ * A probe has THREE outcomes, not two. `agent-eval` scored `passed = !run.error && graders.every(…)`,
+ * so a probe that never answered was recorded identically to one that answered wrongly. Measured on
+ * HC-GF-197's first calibration: 8 probes, 3 timed out, and the reported figure was 4/8 where 4 of
+ * the 5 that COMPLETED were correct — understating the agent by 20 points and sending a reader
+ * after a correctness problem that was really a latency one.
+ *
+ * This is HC-GF-193 mirrored. There a suite that ran ZERO tests exited 0 and read as a pass; here an
+ * agent that answered NOTHING reads as a wrong answer. Both collapse "no result" into a verdict.
+ *
+ * A TIMEOUT IS STILL NOT OK. Excluding it from accuracy must not make it invisible: a target that
+ * times out on every probe would then report a clean run with no accuracy at all, which is the same
+ * defect a third time. It is reported as its own outcome, counted separately, and still fails the
+ * command's exit — visible, excluded from the score, never silently fine.
+ */
+
+/**
+ * The outcome of one probe.
+ *
+ * @param {{error?: string|null}} run        what the executor returned
+ * @param {Array<{passed: boolean}>} graders grader results (empty when the run errored)
+ * @returns {{outcome: 'pass'|'fail'|'error', passed: boolean, error: string|null}}
+ */
+function scoreProbe(run, graders = []) {
+  const error = (run && run.error) || null;
+  if (error) return { outcome: 'error', passed: false, error };
+  const passed = graders.length > 0 && graders.every((g) => g.passed);
+  return { outcome: passed ? 'pass' : 'fail', passed, error: null };
+}
+
+/**
+ * What a set of probe results means together.
+ *
+ * `accuracy` is over COMPLETED probes only and is null when none completed — a ratio with an empty
+ * denominator is not 0%, and printing 0% for "nothing ran" is the defect this file exists to fix.
+ *
+ * @param {Array<{outcome: string}>} results
+ * @returns {{total, completed, correct, errored, accuracy: string|null, ok: boolean}}
+ */
+function summarizeProbes(results = []) {
+  const total = results.length;
+  const errored = results.filter((r) => r.outcome === 'error').length;
+  const correct = results.filter((r) => r.outcome === 'pass').length;
+  const completed = total - errored;
+  return {
+    total,
+    completed,
+    correct,
+    errored,
+    accuracy: completed > 0 ? `${correct}/${completed}` : null,
+    // Any wrong answer OR any probe that never answered fails the command. A run nobody could
+    // score is not a run that passed.
+    ok: errored === 0 && correct === completed && total > 0,
+  };
+}
+
+/** One line a reader can act on, keeping the two failure kinds apart. */
+function describeProbeSummary(s) {
+  const acc = s.accuracy === null
+    ? 'no probe completed, so there is no accuracy to report'
+    : `${s.accuracy} of the probes that completed`;
+  return s.errored > 0
+    ? `${acc} — ${s.errored} of ${s.total} never answered (timeout or spawn failure) and are NOT counted as wrong answers`
+    : `${acc}`;
+}
+
+module.exports = { scoreProbe, summarizeProbes, describeProbeSummary };

package/lib/agent-executor.js

@@ -18,7 +18,7 @@ const { spawn } = require('child_process');
  * @param {object} target - agent target config {name, invoke: {command}}
  * @param {string} probeInput - probe input text to pass via stdin
  * @param {object} opts - options {timeout: 5000}
- * @returns {Promise<{output: string} | {error: string, exitCode?: number}>}
+ * @returns {Promise<{output: string} | {error: string, exitCode?: number, stderr?: string}>}
  */
 async function runAgent(target, probeInput, opts = {}) {
   if (!target || !target.invoke || !target.invoke.command) {
@@ -26,6 +26,13 @@ async function runAgent(target, probeInput, opts = {}) {
   }
 
   const timeout = opts.timeout ?? 5000;
+  // HC-GF-199: the child's stderr was captured into `errorBuffer` and NEVER
+  // READ — measured, two references in this file: one declaration, one append.
+  // The provider's own explanation of why it refused was collected and thrown
+  // away, which is precisely the signal honest backoff and diagnosis need.
+  // Bounded because a chatty failure must not blow up the JSON report.
+  const STDERR_CAP = 4096;
+  const tail = (s) => (s.length > STDERR_CAP ? s.slice(-STDERR_CAP) : s);
   const command = target.invoke.command;
 
   return new Promise((resolve) => {
@@ -46,6 +53,21 @@ async function runAgent(target, probeInput, opts = {}) {
       child = spawn('sh', ['-c', command], {
         stdio: ['pipe', 'pipe', 'pipe'],
         detached: true,
+        // HC-GF-199: run where the CALLER says, not wherever the CLI happens to
+        // be. The calibration packs exercise the real story-groomer prompt,
+        // which instructs the agent to WRITE its artifacts — and it did, into
+        // this repository, for a story nobody groomed. A measurement must not
+        // mutate the thing it measures. Defaults to the current directory so
+        // every existing pack behaves exactly as before.
+        cwd: opts.cwd || process.cwd(),
+        // HC-GF-199: isolating the cwd breaks any target command that resolves a
+        // repo path RELATIVELY — and this repo's own did. Give every command an
+        // absolute anchor so it can load from the repo while writing to the
+        // sandbox. Measured: without this, the prompt load threw MODULE_NOT_FOUND,
+        // the shell group carried on, and the provider was called with an EMPTY
+        // system prompt — producing plausible output in the wrong format that the
+        // graders scored as a WRONG ANSWER, at full generation cost.
+        env: { ...process.env, HONE_REPO_ROOT: opts.repoRoot || process.cwd() },
       });
     } catch (e) {
       // Spawn failed (e.g., sh not found — unlikely but possible)
@@ -99,19 +121,19 @@ async function runAgent(target, probeInput, opts = {}) {
 
       // If we timed out, return timeout error
       if (timedOut) {
-        return resolve({ error: 'timeout', exitCode: null });
+        return resolve({ error: 'timeout', exitCode: null, stderr: tail(errorBuffer) });
       }
 
       // If process was killed by a signal (e.g., SIGSEGV = signal 11 → exit code 139)
       if (signal) {
         const signalCode = signal === 'SIGSEGV' ? 11 : (signal === 'SIGKILL' ? 9 : 0);
         const exitCodeForSignal = 128 + signalCode;
-        return resolve({ error: 'process crashed', exitCode: exitCodeForSignal });
+        return resolve({ error: 'process crashed', exitCode: exitCodeForSignal, stderr: tail(errorBuffer) });
       }
 
       // Non-zero exit code
       if (exitCode !== 0) {
-        return resolve({ error: 'command failed', exitCode });
+        return resolve({ error: 'command failed', exitCode, stderr: tail(errorBuffer) });
       }
 
       // Success

package/lib/asset-fetch-list.js

@@ -0,0 +1,72 @@
+'use strict';
+/**
+ * asset-fetch-list.js — the agent-stub and skill files `hone setup` pulls from the server.
+ *
+ * Extracted by HC-GF-143's batch: HC-GF-136's gate found `key`, `promise` and `write` computed
+ * inline and asserted by nothing. `key` is what the operator sees when a fetch fails, and `write`
+ * decides where the bytes land — a wrong path installs an adopter's agent into the wrong directory
+ * and the run reports success.
+ *
+ * Pure: the caller injects the fetch and the two writers, so the mapping is testable without a
+ * network or a filesystem.
+ */
+
+/**
+ * @param {object} args
+ * @param {string[]} args.agents      agent names
+ * @param {string[]} args.skills      skill names
+ * @param {(url: string) => Promise<any>} args.get
+ * @param {(agent: string, data: any) => void} args.writeAgent
+ * @param {(skill: string, data: any) => void} args.writeSkill
+ * @returns {Array<{key: string, promise: Promise<any>, write: (data: any) => void}>}
+ */
+/**
+ * The derived skills in a `/skills/:repo/derived` response — or nothing.
+ *
+ * HC-GF-184: a named function rather than an inline ternary, because the inline version was
+ * effectively untestable. A non-array `skills` (say the string "nope") iterates as CHARACTERS, and
+ * the per-item shape check rejects each one, so the wrong container and the right one produce the
+ * same visible result — a mutation of the container check survived every test. Returning the list
+ * makes the decision observable on its own.
+ */
+function derivedSkillsFrom(data) {
+  if (!data || !Array.isArray(data.skills)) return [];
+  return data.skills.filter(
+    s => s && typeof s.skill_name === 'string' && typeof s.content === 'string');
+}
+
+function assetFetchList({ agents = [], skills = [], derivedRepo = null, get, writeAgent, writeSkill }) {
+  return [
+    ...agents.map(agent => ({
+      key: `${agent}.agent.md`,
+      promise: get(`/scripts/agent-stub/${agent}`),
+      write: (data) => writeAgent(agent, data),
+    })),
+    ...skills.map(skill => ({
+      key: `skills/${skill}/SKILL.md`,
+      promise: get(`/skills/${skill}`),
+      write: (data) => writeSkill(skill, data),
+    })),
+    // ── HC-GF-184: the per-repo DERIVED set ────────────────────────────────────────────────────
+    // The list above is hand-typed, so it names the eight enterprise baselines and can never name a
+    // derived skill. Measured 2026-09-18: `node-developer` and `node-architect` had sat in
+    // skill_snapshots since the previous day while `.github/skills/` held the baselines only — the
+    // pipeline could read them, the adopter's editor could not, and `last_derived` read as "in use".
+    //
+    // ADDITIVE ON PURPOSE. The three copies of that list (here, the derive parser, the step
+    // declarations) are a real chokepoint, but unifying them would change what every existing
+    // adopter receives. This adds one request that returns `{skills: []}` for a repo that has never
+    // derived, so setup behaves exactly as before for them.
+    ...(derivedRepo ? [{
+      key: `skills/<derived for ${derivedRepo}>`,
+      promise: get(`/skills/${derivedRepo}/derived`),
+      // Tolerant by construction: this runs mid-setup, AFTER the baseline has landed, so a shape
+      // change at the endpoint must not abort an adopter's install half-written.
+      write: (data) => {
+        for (const s of derivedSkillsFrom(data)) writeSkill(s.skill_name, s.content);
+      },
+    }] : []),
+  ];
+}
+
+module.exports = { assetFetchList, derivedSkillsFrom };

package/lib/auto-verify.js

@@ -50,13 +50,35 @@ const VERIFIABLE_STEP = 'step_4';
  * how to stop it — the surprise is the real cost of this feature, and an unexplained
  * surprise is the version that gets it reverted.
  */
-function decideAutoVerify({ stepKey, repoRoot, noVerifyFlag = false, env = process.env } = {}) {
+function decideAutoVerify({ stepKey, repoRoot, noVerifyFlag = false, env = process.env, assessment } = {}) {
   const gate = safeGate(repoRoot);
   const off = (reason) => ({ run: false, reason, command: null, gate });
 
   if (noVerifyFlag) return off('--no-verify was passed');
   if (String(env.HONE_NO_AUTO_VERIFY || '') === '1') return off('HONE_NO_AUTO_VERIFY=1');
 
+  // ── HC-GF-270: consent to run YOUR tests is not consent to run a STRANGER'S code ──────
+  //
+  // `ci.local_command` is the adopter saying how to test this repo. It is not the adopter
+  // saying "execute whatever patch the pipeline produced from whatever text it was given",
+  // and until now this function had no input about where that text came from: a story
+  // fetched from a GitHub issue by a non-collaborator reached the provisioning install
+  // (which runs the PATCHED manifest's `postinstall`) as the operator, before anyone read it.
+  //
+  // FAILS CLOSED, and deliberately BEFORE the stepKey check: a caller that forgot to assess
+  // must produce a pause, never a bypass. The assessment is the caller's, not ours, so that
+  // deleting this check and deleting the trusted set in story-provenance.js are two
+  // separately-mutatable layers (Checklist B item 6) — the reason trust is not derived here.
+  if (!assessment || typeof assessment !== 'object') {
+    const reason = 'no story provenance assessment was supplied — refusing to execute this '
+      + 'patch until the caller says where its story text came from';
+    return { ...off(reason), untrusted: { label: 'unassessed', reason } };
+  }
+  if (!assessment.trusted) {
+    const reason = assessment.reason || 'this run\'s story text came from a source Hone does not trust';
+    return { ...off(reason), untrusted: { label: assessment.label || 'untrusted', reason } };
+  }
+
   // Only step_4. A verdict for any other step has no gate to inform, so running an
   // adopter's suite there would spend their time for nothing.
   if (stepKey !== VERIFIABLE_STEP) {
@@ -100,7 +122,9 @@ function readYamlBlock(repoRoot, key) {
 
 function safeCi(repoRoot) {
   try { return readCIConfigDetails(repoRoot); }
-  catch { return { local_command: null, local_command_explicit: false, install_command: null }; }
+  // readCIConfigDetails catches its own read and parse failures, so this is belt-and-braces: if it
+  // ever throws, an empty object reads as "no ci.local_command", which is no consent (HC-GF-270).
+  catch { return {}; }
 }
 function safeGate(repoRoot) {
   try { return readVerificationGateConfig(repoRoot) || 'advisory'; }
@@ -116,6 +140,39 @@ function announce(decision, runId) {
   ].join('\n');
 }
 
+/**
+ * HC-GF-270 — what the operator sees INSTEAD of a verification.
+ *
+ * A pause the operator cannot explain is indistinguishable from a broken pipeline, and the
+ * fix for that is not fewer pauses, it is a pause that names the issue, the author, the
+ * association that disqualified it, and the two commands that move forward: read the patch,
+ * then run it having read it. `--trust-source` is on the SECOND line on purpose — an
+ * operator who copies the first line has read the diff.
+ */
+function provenanceNotice(assessment, { runId, source = {}, stepKey = 'step_4' } = {}) {
+  const src = (source && typeof source === 'object' && !Array.isArray(source)) ? source : {};
+  // HC-GF-270 code review (LOW-6): one shape. `ref` is {owner,repo,number} or null for every
+  // kind, and the human-readable name of a non-issue source lives in `label` — so this reads
+  // the same two fields whatever kind produced the run, and a new kind cannot break it.
+  const r = src.ref;
+  const ref = (r && typeof r === 'object' && !Array.isArray(r) && r.owner && r.repo && r.number != null)
+    ? `${r.owner}/${r.repo}#${r.number}`
+    : (typeof src.label === 'string' && src.label.trim() !== '' ? src.label.trim() : 'unknown');
+  return [
+    '',
+    '  ⏸  NEEDS YOU — auto-verify did NOT run: this run\'s story text came from a source Hone does not trust.',
+    `      source:  ${ref}${src.html_url ? `  (${src.html_url})` : ''}`,
+    `      author:  ${src.author || 'unknown'}   author_association: ${src.association || 'unknown'}`,
+    `      reason:  ${(assessment && assessment.reason) || 'untrusted'}`,
+    '',
+    '      Verifying would run this patch — the provisioning install FIRST — as you, with your',
+    '      $HOME and your network. Nothing has been executed.',
+    `      1. read it:  hone show step ${runId} ${stepKey}`,
+    `      2. run it:   hone verify-patch ${runId} --report --trust-source`,
+    '',
+  ].join('\n');
+}
+
 
 /**
  * After a verdict is posted, should the caller RE-POLL (the run may have moved) or fall
@@ -180,8 +237,15 @@ function verifyOutcomeLine(status, gate) {
     case EXIT.UNRESOLVED: return '  → verification could not run (see above) — nothing is known about this build; the gate still needs you.';
     case EXIT.NO_DIFF: return '  → nothing was verified: no diff to apply, or the step output could not be fetched (see above); the gate still needs you.';
     case EXIT.DOES_NOT_APPLY: return '  → nothing was verified: the diff did not apply (see above); the gate still needs you.';
+    // HC-GF-270 code review (INFO): the one arm of the exit-code contract that was extended in
+    // verify-patch.js/emit-pr.js and not here. Unreachable from the poll loop today — it only
+    // spawns when the assessment is trusted — but an exit code that means "refused" must never
+    // render as "exited N without a verdict", which reads as a crash. The map is the contract;
+    // a hole in it is a defect waiting for the second caller.
+    case EXIT.UNTRUSTED_SOURCE: return '  → nothing was verified: this run\'s story text came from a source Hone '
+      + 'does not trust (see above). Read the patch, then re-run with --trust-source; the gate still needs you.';
     default: return `  → verify-patch exited ${status} without a verdict (see above); the gate still needs you.`;
   }
 }
 
-module.exports = { decideAutoVerify, announce, readVerificationAuto, shouldRepoll, alreadyVerified, verdictReportLine, verifyOutcomeLine, VERIFIABLE_STEP };
+module.exports = { decideAutoVerify, announce, provenanceNotice, readVerificationAuto, shouldRepoll, alreadyVerified, verdictReportLine, verifyOutcomeLine, VERIFIABLE_STEP };