@hone-ai/cli 1.40.0 → 1.42.0

package/README.md

@@ -16,6 +16,13 @@ hone init --token <YOUR_TOKEN>
 A token is issued when your organization is provisioned. Without one the CLI installs fine but
 every server-backed command will refuse.
 
+The CLI talks to `https://hone-server-production.up.railway.app` unless you point it elsewhere.
+It picks the server from `hone init --api <url>` (saved to `~/.honerc` as `api`), then `HONE_API`,
+then `~/.honerc`, then that default. `hone init` without `--api` keeps the `api` already in
+`~/.honerc`. A value naming the retired default domain or any of its subdomains (it is no longer ours), or
+one that is not an http(s) URL, is refused: `init --api` exits 2, and `HONE_API` or `~/.honerc` is
+ignored with a one-line warning that names only the hostname.
+
 ## The three commands that matter
 
 ```bash

package/hone-cli.js

@@ -29,10 +29,12 @@ const { execSync, execFileSync } = require('child_process');
 // A source-regex asserting the variable name matched this very comment and passed while the
 // scrub was gutted.
 const { verdictEnv } = require('./lib/verdict-env');
+const { DEFAULT_API, resolveApiUrl, apiHostname } = require('./lib/default-api'); // HC-GF-396
 const { parseTimeoutSeconds } = require('./lib/timeout-option.js');
 // HC-GF-143 batch: both mappings were computed inline and asserted by nothing (HC-GF-136).
 const { promotePayload } = require('./lib/promote-payload');
 const { assetFetchList } = require('./lib/asset-fetch-list');
+const { adminRequestOptions, describeAdminRedirect } = require('./lib/admin-request'); // HC-GF-406
 // HC-CI-019-followup-3: no suite asserted a field of either, and this file cannot be required.
 const { detectExistingTestFramework } = require('./lib/detect-test-framework');
 const { classifySpec } = require('./lib/classify-spec');
@@ -43,7 +45,7 @@ const { resolveBaseRef, getMaxDiffChars } = require('./lib/release-review-config
 const { gitEnv } = require('./lib/git-env');
 const { collectIncludePaths } = require('./lib/include-paths');
 const { runArgsError, orchestratePath, apiPath, storyDir: storyDirIn, isGitRev, isStoryId } = require('./lib/run-target'); // HC-GF-270-followup-1, -2, -3, -4
-const { normalizeQuestion, questionLines, gateQuestionLines, countPhrase } = require('./lib/operator-question'); // HC-GF-234
+const { normalizeQuestion, questionLines, gateQuestionLines, countPhrase, scrub } = require('./lib/operator-question'); // HC-GF-234
 const program = new Command();
 
 // HC-GF-331: spawnSync's default stdout/stderr buffer is 1 MiB. A verification suite over that
@@ -110,7 +112,8 @@ function getConfig() {
   // Priority: env var → ~/.honerc → error
   const rc     = readRc();
   const token  = process.env.HONE_TOKEN  || rc.token;
-  const apiUrl = process.env.HONE_API     || rc.api || 'https://api.hone.ai';
+  // HC-GF-396: a retired or invalid HONE_API / rc.api counts as unset, with one stderr warning.
+  const { apiUrl } = resolveApiUrl({ env: process.env.HONE_API, rc: rc.api });
 
   if (!token) {
     console.error('Error: Hone token not found.');
@@ -1993,10 +1996,18 @@ program
   .command('init')
   .description('Save HONE_TOKEN and API URL to ~/.honerc')
   .option('--token <token>', 'Hone API token')
-  .option('--api <url>',     'Hone API base URL (default: https://api.hone.ai)')
+  .option('--api <url>',     `Hone API base URL (default: ${DEFAULT_API})`)
   .action(async (opts) => {
     const token  = opts.token || process.env.HONE_TOKEN;
-    const apiUrl = opts.api   || process.env.HONE_API || 'https://api.hone.ai';
+    // HC-GF-396: a retired or invalid --api exits 2 before anything is sent. Without --api, init
+    // resolves like every other command (HONE_API → ~/.honerc → default), so re-running it keeps a
+    // valid custom rc.api instead of resetting it.
+    const resolved = resolveApiUrl({ flag: opts.api, env: process.env.HONE_API, rc: readRc().api });
+    if (resolved.error) {
+      console.error(`Error: ${resolved.error}`);
+      process.exit(2);
+    }
+    const apiUrl = resolved.apiUrl;
 
     if (!token) {
       console.error('Error: --token is required (or set HONE_TOKEN env var).');
@@ -2025,7 +2036,7 @@ program
     fs.writeFileSync(RC_PATH, JSON.stringify(rc, null, 2), { mode: 0o600 });
 
     console.log(`✓ Config saved to ${RC_PATH}`);
-    console.log(`  API: ${apiUrl}`);
+    console.log(`  API: ${apiHostname(apiUrl)}`);
     console.log('');
     console.log('You can now run "hone setup" in any repository.');
   });
@@ -2493,13 +2504,12 @@ program
   .option('--format <fmt>', 'Output format: pretty | json', 'pretty')
   .action(async (opts) => {
     const rc = readRc();
-    const apiUrl = process.env.HONE_API || rc.api || 'https://api.hone.ai';
+    const { apiUrl } = resolveApiUrl({ env: process.env.HONE_API, rc: rc.api });
     const adminKey = requireAdminKey();
 
     try {
       const { data } = await axios.get(`${apiUrl}/admin/usage`, {
-        headers: { 'x-admin-key': adminKey, 'User-Agent': `@hone-ai/cli/${pkg.version}` },
-        timeout: 15000,
+        ...adminRequestOptions(adminKey, `@hone-ai/cli/${pkg.version}`),
       });
 
       if (opts.format === 'json') {
@@ -2544,7 +2554,10 @@ program
 
       console.log('');
     } catch (e) {
-      if (e.response?.status === 401) {
+      const redirect = describeAdminRedirect(e);
+      if (redirect) {
+        console.error(redirect);
+      } else if (e.response?.status === 401) {
         console.error('Invalid admin key. Check HONE_ADMIN_KEY or ~/.honerc admin_key.');
       } else {
         console.error(`Failed to fetch admin dashboard: ${e.message}`);
@@ -3102,9 +3115,9 @@ program
     }
 
     const adminKey = requireAdminKey();
-    // `getConfig()` already resolves the base (HONE_API -> ~/.honerc -> default) and exits with a
-    // usable message when no token is configured. Re-deriving it here would have added a TENTH
-    // copy of the `api.hone.ai` literal that [[HC-GF-236]] is trying to reduce to one.
+    // `getConfig()` already resolves the base through `resolveApiUrl()` (HONE_API -> ~/.honerc ->
+    // default, HC-GF-396) and exits with a usable message when no token is configured. Re-deriving
+    // it here would bypass the retired-host guard in cli/lib/default-api.js.
     const config = getConfig();
     const apiUrl = config.apiUrl;
 
@@ -3120,8 +3133,7 @@ program
       const { data } = await axios.post(`${apiUrl}/admin/learnings/absorb`, {
         orgId, ids: wanted, repo: opts.repo, absorbedIn: destination,
       }, {
-        headers: { 'x-admin-key': adminKey, 'User-Agent': `@hone-ai/cli/${pkg.version}` },
-        timeout: 15000,
+        ...adminRequestOptions(adminKey, `@hone-ai/cli/${pkg.version}`),
       });
 
       if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
@@ -3141,7 +3153,9 @@ program
       if (data.skipped.length) process.exitCode = 1;
     } catch (e) {
       const status = e.response?.status;
-      if (status === 401)      console.error('Invalid admin key. Check HONE_ADMIN_KEY or ~/.honerc admin_key.');
+      const redirect = describeAdminRedirect(e);
+      if (redirect)            console.error(redirect);
+      else if (status === 401) console.error('Invalid admin key. Check HONE_ADMIN_KEY or ~/.honerc admin_key.');
       else if (status === 429) console.error('Too many failed admin-auth attempts from this address. Wait for the window to pass.');
       else if (status === 503) console.error(`Server cannot absorb right now: ${e.response?.data?.error || 'unavailable'}`);
       else                     console.error(`Absorb failed: ${e.response?.data?.error || e.message}`);
@@ -3951,7 +3965,9 @@ function bundleDirectory(dir, root, files, maxFiles, currentCount) {
 
       if (entry.isDirectory()) {
         bundleDirectory(fullPath, root, files, maxFiles, Object.keys(files).length);
-      } else if (EXTENSIONS.test(entry.name)) {
+      } else if (EXTENSIONS.test(entry.name) && !pathRefusal(relPath, { mode: 'egress' })) {
+        // HC-GF-398: `config/secrets.yml` and `secrets.json` pass the extension filter; derive sends them to the
+        // server whole, so the egress refusal applies here as it does to every other whole-content send.
         try {
           const content = fs.readFileSync(fullPath, 'utf8');
           if (content.length < 50_000) { // skip very large files
@@ -3974,6 +3990,7 @@ function sleep(ms) {
 // `require('../hone-cli.js')` — making require.main the bin wrapper,
 // not hone-cli.js, so the gate never fired and parse never ran.)
 const { splicePreserveRepoSpecific } = require('./lib/splice-repo-specific');
+const { pathRefusal } = require('./lib/path-refusal');
 
 // ── STATUS command (H-009) ────────────────────────────────────────────────────
 // Show pipeline state for a story (or use --all for every in-flight story).
@@ -5994,14 +6011,19 @@ program
     try {
       // HC-GF-092: advertise what this CLI can honour. The server serves the highest it also
       // knows, so an older CLI — which sends nothing — keeps being served contract 1.
-      const { data } = await client.get(orchestratePath([runId, 'step-instruction'], { contracts: '1,2' }));
+      // HC-GF-399: contract 3 anchors edits on HEAD, so only a checkout with a commit advertises it; a
+      // repository with no commit is served 2, as before. A git timeout fails here rather than guessing.
+      const { editorContractsFor } = require('./lib/tree-artifact');
+      const { data } = await client.get(orchestratePath([runId, 'step-instruction'], { contracts: editorContractsFor(process.cwd()) }));
       if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
       console.log(`Step:      ${data.stepKey} (${data.agent})`);
       console.log(`Contract:  ${data.contractVersion}`);
       console.log('─'.repeat(60));
       console.log(data.instruction);
       console.log('─'.repeat(60));
-      console.log(`Submit with: hone submit-step ${runId} ${data.stepKey} --file <output.txt>`);
+      // HC-GF-399: the submit command the SERVED contract asks for — `--file` only under contract 1.
+      const how = String(data.contractVersion) === '1' ? '--file <output.txt>' : `--from-tree --contract ${data.contractVersion}`;
+      console.log(`Submit with: hone submit-step ${runId} ${data.stepKey} ${how}`);
     } catch (e) {
       const st = e.response?.status;
       if (st === 409) console.error(`No step awaiting the editor: ${e.response.data?.error || ''} (run status: ${e.response.data?.runStatus || '?'})`);
@@ -6035,26 +6057,62 @@ program
         console.error('Contract 2 is the from-tree contract: the instruction told the agent to write the files with its own tools. Re-run with --from-tree, or fetch a contract 1 instruction if you really did assemble the output by hand.');
         process.exit(1);
       }
+      // HC-GF-399: contract 3 sends region edits proven against HEAD, which only a render from the tree can do.
+      if (String(opts.contract) === '3' && !opts.fromTree) {
+        console.error('Contract 3 is a from-tree contract: it sends region edits proven against HEAD from what you wrote. Re-run with --from-tree.');
+        process.exit(1);
+      }
       if (!opts.file && !opts.fromTree) { console.error('Provide the output via --file <path> (the text your editor produced), or --from-tree to render it from the working tree.'); process.exit(1); }
       const fs = require('fs');
       let output;
+      let reviewDiff = null;
+      let warned = false;
       if (opts.fromTree) {
         const { renderFromTree } = require('./lib/tree-artifact');
-        const rendered = renderFromTree({ repoRoot: process.cwd(), testReport: opts.testReport });
+        const rendered = renderFromTree({ repoRoot: process.cwd(), testReport: opts.testReport, contract: String(opts.contract), stepKey });
         output = rendered.text;
         // Say what was left out BEFORE the submission, not after: a file the tree has and the
         // artifact does not is a decision the operator has to be able to see.
         for (const s2 of rendered.skipped) console.error(`not included: ${s2.path} — ${s2.reason}`);
         console.error(`from-tree: ${rendered.files.length} file(s), ${rendered.deletes.length} deletion(s), ${rendered.skipped.length} skipped`);
+        // HC-GF-399: under contract 3, what went as region edits and every file that fell back to whole, with why.
+        if (rendered.edited.length || rendered.fallbacks.length) {
+          console.error(`from-tree: ${rendered.edited.length} file(s) sent as region edits against ${rendered.headSha.slice(0, 12)}`);
+          for (const f of rendered.fallbacks) console.error(`whole: ${f.path} (${f.reason})`);
+        }
+        // HC-GF-390: for a build, the base diff of each file emitted whole whose original the reviewers saw only in
+        // windows. Sent beside the artifact, stored apart from it, and never a reason this submit fails.
+        if (stepKey === 'step_4') {
+          try {
+            const { computeReviewDiff } = require('./lib/review-diff');
+            reviewDiff = computeReviewDiff({ repoRoot: process.cwd(), rendered,
+              warn: (line) => { warned = true; console.error(line); } });
+          } catch (e) { reviewDiff = null; warned = true; console.error(`review diff not sent: ${e.message}`); }
+          // HC-GF-399: review-diff.js resolves HEAD itself. If that is not the commit the render was taken against,
+          // HEAD moved during the submit, and the diff would describe a different base — drop it, and say so.
+          if (reviewDiff && !require('./lib/tree-artifact').reviewDiffBaseMatches(reviewDiff, rendered)) {
+            warned = true;
+            console.error(`review diff not sent: computed against ${reviewDiff.headSha.slice(0, 12)}, the render against ${rendered.headSha.slice(0, 12)} (HEAD moved during submit)`);
+            reviewDiff = null;
+          }
+          if (reviewDiff) {
+            console.error(`review diff: ${reviewDiff.stats.files} file(s), ${reviewDiff.notes.length} note(s), against ${reviewDiff.headSha.slice(0, 12)}`);
+            for (const n of reviewDiff.notes) console.error(`  review diff note: ${n}`);
+          } else {
+            console.error(warned ? 'review diff: none (see above)' : 'review diff: none (no modified file over the bundle cap)');
+          }
+        }
       } else {
         output = fs.readFileSync(opts.file, 'utf8');
       }
       const { data } = await client.post(
         orchestratePath([runId, 'step', stepKey, 'editor-output']),
-        { contractVersion: opts.contract, output }
+        { contractVersion: opts.contract, output,
+          ...(reviewDiff ? { reviewDiff: require('./lib/review-diff').toWire(reviewDiff) } : {}) }
       );
       if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
       console.log(`Step ${data.stepKey} completed (executed_by: ${data.executedBy}); gate: ${data.gateResult}.`);
+      if (data.reviewDiffIgnored) console.error(`review diff not stored: ${data.reviewDiffIgnored} (the reviewers see the files unverified, as before)`);
       console.log(`Approve when reviewed: hone run-story ${runId} --approve ${data.stepKey}`);
       console.log('Verification is unchanged — check-patch/verify-patch judge this output, not trust.');
     } catch (e) {
@@ -6107,10 +6165,6 @@ function runContextIo(apiConfig) {
     e2eSpecMode: () => pc.readE2eSpecMode(cwd),
     verificationGate: () => pc.readVerificationGateConfig(cwd),
     verificationGateSources: () => pc.readVerificationGateSources(cwd),
-    readPlanText: () => {
-      const planPath = path.join(cwd, '.github', 'EXECUTION_PLAN.yml');
-      return fs.existsSync(planPath) ? fs.readFileSync(planPath, 'utf8') : '';
-    },
     exists: (rel) => { const abs = inRepo(rel); return !!abs && fs.existsSync(abs); },
     isDirectory: (rel) => { const abs = inRepo(rel); try { return !!abs && fs.statSync(abs).isDirectory(); } catch { return false; } },
     readFile: (rel) => {
@@ -6200,6 +6254,7 @@ program
   .option('--include-paths <paths>', 'Source file paths to bundle into the codebase context (HC-019n-followup-12). Comma-separated, and the flag may be repeated; both forms accumulate. Augments auto-detected paths from the issue body.', collectIncludePaths, [])
   .option('--e2e-specs', 'HC-019n-followup-28: force step_3b (Playwright spec generation) ON for this run (overrides e2e.spec_generation config)')
   .option('--skip-e2e-specs', 'HC-019n-followup-28: force step_3b (Playwright spec generation) OFF for this run (overrides e2e.spec_generation config)')
+  .option('--consult-architect', 'HC-GF-397: run the architect consult (step_0b) even when the groomer says architect_engaged: false. It can only add the consult, never skip it.')
   .action(async (storyIdOrRunId, opts) => {
     const config = getConfig();
     const client = api(config);
@@ -6678,6 +6733,7 @@ program
       explicitSource: opts.storyFile ? { kind: 'file', label: path.basename(String(opts.storyFile)) } : { kind: 'description' },
       includePaths: opts.includePaths,
       axes: opts.axes,
+      consultArchitect: opts.consultArchitect,
     });
     printRunContextNotes(storyCtx.notes.pre);
     printRunContextNotes(repoCtx.notes);
@@ -7227,7 +7283,7 @@ program
   .option('--dry-run', 'Show what would be reviewed without calling the LLM', false)
   .option('--max-files <n>', 'Max source files to include in review', '40')
   .option('--provider <name>', 'LLM provider: opus (paid, needs ANTHROPIC_API_KEY). gh-models was retired 2026-07-30; there is no default')
-  .option('--cache <mode>', 'HC-RC-002-followup-1 content-hash cache: on | off (default on)', 'on')
+  .option('--cache <mode>', 'content-hash cache: on stores the review at the Hone API (14 days) and replays it for the same diff; off sends nothing (default on)', 'on')
   .action(async (opts) => {
     const { execSync } = require('child_process');
     const fs = require('fs');
@@ -7461,10 +7517,34 @@ program
         banner(`Cache disabled: contentHash computation failed: ${e.message}`);
       }
     }
+    // Exit code — defense in depth:
+    //   (a) structured check against the parsed JSON, then
+    //   (b) loose substring check on the raw response (catches LLMs that
+    //       emit markdown-formatted CRITICAL findings without strict JSON).
+    // HC-GF-407: one decision for a fresh review and a replayed one, so a cached CRITICAL still blocks.
+    const blocksDeploy = (parsed, responseText) => {
+      let hasCritical = false, doNotDeploy = false;
+      if (parsed) {
+        hasCritical = (parsed.summary?.critical || 0) > 0 ||
+                      (Array.isArray(parsed.findings) &&
+                       parsed.findings.some(f => String(f.severity).toUpperCase() === 'CRITICAL'));
+        doNotDeploy = parsed.recommendation === 'DO_NOT_DEPLOY';
+      }
+      if (!hasCritical) {
+        // Loose match — case-insensitive, no quote requirement. False-positive
+        // tolerance is acceptable here because the cost of a false-positive is
+        // "CI shows yellow, human looks at the report"; the cost of a false-
+        // negative is "real CRITICAL bug ships to prod undetected".
+        hasCritical = /\bCRITICAL\b/.test(responseText);
+      }
+      if (!doNotDeploy) {
+        doNotDeploy = /\bDO_NOT_DEPLOY\b/.test(responseText);
+      }
+      return hasCritical || doNotDeploy;
+    };
     if (cacheEnabled && cacheContentHash) {
-      const config = getConfig();
-      const apiBase = (config && config.apiBase) || process.env.HONE_API_BASE;
-      const token = (config && config.token) || process.env.HONE_TOKEN;
+      // HC-GF-407: the cache goes to the API every other command uses, with the same token.
+      const { apiUrl: apiBase, token } = getConfig();
       const cached = await lookupReviewCache({
         axios,
         apiBase,
@@ -7506,6 +7586,15 @@ program
             ? cached.response
             : JSON.stringify(cached.response, null, 2));
         }
+        // The store keeps the parsed review, or `{ raw }` when the model wrote no JSON; either way the
+        // serialised replay carries the text the loose check reads.
+        const replay = cached.response;
+        const replayParsed = replay && typeof replay === 'object' ? replay : null;
+        if (blocksDeploy(replayParsed, typeof replay === 'string' ? replay : JSON.stringify(replay))) {
+          banner('');
+          banner('CRITICAL issues found. Fix before deploying.');
+          process.exit(1);
+        }
         process.exit(0);
       }
     }
@@ -7617,9 +7706,8 @@ program
       // Total tokens billed for this run = inputTokens + outputTokens —
       // those are the tokens a future hit would save.
       if (cacheEnabled && cacheContentHash) {
-        const config = getConfig();
-        const apiBase = (config && config.apiBase) || process.env.HONE_API_BASE;
-        const token = (config && config.token) || process.env.HONE_TOKEN;
+        // HC-GF-407: the cache goes to the API every other command uses, with the same token.
+        const { apiUrl: apiBase, token } = getConfig();
         // Cache the parsed JSON when available (cleaner replay), otherwise
         // wrap the raw text in { raw } so the cache always stores an object.
         const responseForCache = parsed && typeof parsed === 'object'
@@ -7640,28 +7728,8 @@ program
         }).catch(() => { /* logged inside helper */ });
       }
 
-      // 8. Exit code — defense in depth:
-      //   (a) structured check against the parsed JSON, then
-      //   (b) loose substring check on the raw response (catches LLMs that
-      //       emit markdown-formatted CRITICAL findings without strict JSON).
-      let hasCritical = false, doNotDeploy = false;
-      if (parsed) {
-        hasCritical = (parsed.summary?.critical || 0) > 0 ||
-                      (Array.isArray(parsed.findings) &&
-                       parsed.findings.some(f => String(f.severity).toUpperCase() === 'CRITICAL'));
-        doNotDeploy = parsed.recommendation === 'DO_NOT_DEPLOY';
-      }
-      if (!hasCritical) {
-        // Loose match — case-insensitive, no quote requirement. False-positive
-        // tolerance is acceptable here because the cost of a false-positive is
-        // "CI shows yellow, human looks at the report"; the cost of a false-
-        // negative is "real CRITICAL bug ships to prod undetected".
-        hasCritical = /\bCRITICAL\b/.test(responseText);
-      }
-      if (!doNotDeploy) {
-        doNotDeploy = /\bDO_NOT_DEPLOY\b/.test(responseText);
-      }
-      if (hasCritical || doNotDeploy) {
+      // 8. Exit code (blocksDeploy, above).
+      if (blocksDeploy(parsed, responseText)) {
         banner('');
         banner('CRITICAL issues found. Fix before deploying.');
         process.exit(1);
@@ -7698,7 +7766,7 @@ program
 const showCmd = program.command('show').description('Inspect orchestrator step output (HC-019n-followup-6)');
 showCmd
   .command('step <workflowId> <stepKey>')
-  .description('Print the actual LLM output of an orchestrator step (latest attempt by default)')
+  .description('Print a step\'s model output (the latest attempt; for step_0b, every attempt, newest first)')
   .option('--attempt <n>', 'Specific attempt number (default: latest)')
   .option('--prompt', 'Also print the exact prompt this step sent to the model (HC-GF-055)')
   .action(async (workflowId, stepKey, opts) => {
@@ -7757,6 +7825,38 @@ showCmd
       console.log(`── output (the LLM's actual response) ──────────────────`);
       console.log(s.output || '(no output recorded — step may not have completed)');
       console.log(`────────────────────────────────────────────────────────`);
+      // HC-GF-379-followup-1: step_0b lists every consult attempt, newest first. Only when no --attempt/--prompt was given
+      // and the latest attempt is a safe integer > 1 (1e300 is an integer and `n--` never moves it); capped, because
+      // isSafeInteger still admits 2^53. Every past attempt's error is caught HERE: the exit(1) below is for the latest.
+      // The step response carries no failure_record (orchestrate.js SELECT), so no past attempt claims a verdict.
+      const latest = s.attempt;
+      if (stepKey === 'step_0b' && opts.attempt === undefined && !opts.prompt && Number.isSafeInteger(latest) && latest > 1) {
+        const MAX_PAST_ATTEMPTS = 50;
+        const oldest = Math.max(1, latest - MAX_PAST_ATTEMPTS);
+        const findingLines = (text) => {
+          const ls = String(text == null ? '' : text).split('\n');
+          const at = ls.findIndex((l) => /^##\s+Findings\b/i.test(l));
+          if (at < 0) return null;
+          const end = ls.findIndex((l, i) => i > at && /^##\s/.test(l));
+          return ls.slice(at + 1, end < 0 ? ls.length : end).map((l) => scrub(l).trim()).filter(Boolean);
+        };
+        console.log('');
+        console.log('── earlier step_0b attempts, newest first ──────────────');
+        for (let n = latest - 1; n >= oldest; n--) {
+          try {
+            const past = (await client.get(orchestratePath([workflowId, 'step', stepKey], { attempt: String(n) }))).data || {};
+            console.log(`── attempt ${n} · ${scrub(past.status || 'unknown')} · verdict not recorded ──`);
+            const f = findingLines(past.output);
+            if (f === null) console.log('  (no Findings section)');
+            else for (const l of f) console.log(`  ${l}`);
+          } catch (e) {
+            const err = e.response?.data?.error ?? e.message;
+            const code = e.response?.status ? ` (HTTP ${e.response.status})` : '';
+            console.log(`── attempt ${n} · could not be fetched${code}: ${scrub(typeof err === 'string' ? err : JSON.stringify(err))}`);
+          }
+        }
+        if (oldest > 1) console.log(`  ${oldest - 1} older attempt(s) not shown — use --attempt <n>`);
+      }
     } catch (e) {
       const msg = e.response?.data?.error || e.message;
       console.error(`hone show step failed: ${msg}`);
@@ -7952,6 +8052,8 @@ program
     // fail-open this gate exists to close.
     let runStoryId = null;
     let runFetchFailed = false;
+    // HC-GF-390-followup-1: undefined = the server sent no `reviewDiff` key; `{stored}` or `{reason}` otherwise.
+    let reviewDiffFetch;
     try {
       const url = orchestratePath([workflowId, 'step', opts.stepKey], { attempt: opts.attempt });
       const r = await client.get(url);
@@ -7975,6 +8077,22 @@ program
         runConfig = runR.data?.config || {};
         runStoryId = runR.data?.storyId || runR.data?.story_id || null;
       } catch (e) { runConfig = {}; runFetchFailed = e && e.message === 'run id mismatch' ? 'mismatch' : true; }
+      // HC-GF-390-followup-1: the base diff the reviewers will be shown for this build. Fetched on its own
+      // connection, for step_4 only; a server that does not know `?reviewDiff=1` omits the key and nothing is sent.
+      // HC-GF-390-followup-2: and only under --report — the check exists to gate what reviewers are shown, and only
+      // a posted check does that. Without it the fetch, the git work and a NEEDS YOU nobody hears about are skipped.
+      if (opts.stepKey === 'step_4' && opts.report) {
+        try {
+          const rdR = await client.get(
+            orchestratePath([workflowId, 'step', 'step_4'], { attempt: verifiedAttempt, reviewDiff: '1' }),
+            require('./lib/fresh-connection').freshConnection());
+          if (rdR.data && Object.prototype.hasOwnProperty.call(rdR.data, 'reviewDiff')) {
+            if (rdR.data.runId && !sameRun(rdR.data.runId)) reviewDiffFetch = { reason: 'fetch_failed' };
+            else if (rdR.data.attempt == null || Number(rdR.data.attempt) !== verifiedAttempt) reviewDiffFetch = { reason: 'attempt_mismatch' };
+            else reviewDiffFetch = { stored: rdR.data.reviewDiff };
+          }
+        } catch { reviewDiffFetch = { reason: 'fetch_failed' }; }
+      }
     } catch (e) {
       const msg = e.response?.data?.error || e.message;
       emit({ ok: false, reason: 'fetch_failed', detail: msg },
@@ -8089,6 +8207,21 @@ program
     let sandboxTeardown = [];
     const ciCfg = require('./lib/pipeline-config').readCIConfigDetails(process.cwd());
     try { headSha = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: process.cwd(), env: gitEnv(), encoding: 'utf8' }).trim(); } catch { /* best-effort */ }
+    // HC-GF-390-followup-1: does the stored base diff match THIS repo's HEAD? Reported with the verdict, read only by
+    // the reviewers' context. It never changes this command's verdict or exit code.
+    let reviewDiffCheck;
+    if (reviewDiffFetch) {
+      const { checkReviewDiff, toWireCheck } = require('./lib/review-diff-check');
+      const r = reviewDiffFetch.reason
+        ? { status: 'unverifiable', headSha: null, step: null, reason: reviewDiffFetch.reason, file: null }
+        : checkReviewDiff({ stored: reviewDiffFetch.stored, appliedHead: headSha, repoRoot: process.cwd() });
+      reviewDiffCheck = toWireCheck(r, verifiedAttempt);
+      if (reviewDiffCheck.status === 'mismatch' && opts.format !== 'json') {
+        console.log(`  NEEDS YOU: the base diff stored for the reviewers does not match HEAD ${headSha || 'unknown'} `
+          + `(${reviewDiffCheck.step || 'unknown step'}${reviewDiffCheck.file ? `, ${JSON.stringify(require('./lib/operator-question').scrub(reviewDiffCheck.file))}` : ''}); `
+          + 'the reviewers will not be shown it.');
+      }
+    }
     try {
       execFileSync('git', ['worktree', 'add', '--detach', wt, 'HEAD'],
         { cwd: process.cwd(), env: gitEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
@@ -8308,7 +8441,9 @@ program
 
         emit(
           { ok: v.verdict === 'pass', verdict: v.verdict, command, detail: v.detail,
-            failureCount: v.failure ? v.failure.count : undefined, logPath: logPath || undefined },
+            failureCount: v.failure ? v.failure.count : undefined, logPath: logPath || undefined,
+            // HC-GF-390-followup-2: null, not absent, when no check ran, so the JSON shape does not depend on --report.
+            reviewDiffCheck: reviewDiffCheck ?? null },
           pretty);
         exitCode = v.exitCode;
         reportVerdict = v.verdict; reportDetail = v.detail;
@@ -8395,6 +8530,7 @@ program
           attempt: opts.attempt ? Number(opts.attempt) : verifiedAttempt,
           headSha,
           gates: reportGates.length ? reportGates : undefined,
+          reviewDiffCheck,
         }, require('./lib/fresh-connection').freshConnection());
         if (opts.format !== 'json') {
           // HC-GF-070: name the gate that is actually configured. This said "(advisory)"

package/lib/admin-request.js

@@ -0,0 +1,49 @@
+'use strict';
+/**
+ * admin-request.js — HC-GF-406. Request options for calls that carry the admin key.
+ *
+ * axios follows redirects through follow-redirects, which drops `Authorization`
+ * on a cross-host hop but forwards every custom header. `x-admin-key` is a
+ * custom header, so a host that answers 302/307 to another origin received the
+ * key (measured on b8c8008d, axios 1.20.0: GET and POST, both statuses).
+ *
+ * The admin routes never redirect, so following one is never needed: refuse
+ * every redirect, same-origin included, and tell the operator where it pointed
+ * so they can configure the final host. `server/src/workers/derive-worker.js`
+ * does the same for its authenticated fetch.
+ */
+
+const ADMIN_TIMEOUT_MS = 15000;
+
+function adminRequestOptions(adminKey, userAgent) {
+  return {
+    headers: { 'x-admin-key': adminKey, 'User-Agent': userAgent },
+    timeout: ADMIN_TIMEOUT_MS,
+    maxRedirects: 0, // never forward x-admin-key to wherever a redirect points
+    // Pinned so a 3xx always rejects into the caller's catch, even if axios's default changes.
+    validateStatus: (s) => s >= 200 && s < 300,
+  };
+}
+
+/**
+ * For an axios error caused by a refused redirect, a message naming the status
+ * and the target ORIGIN only (a path or query could carry anything); else null.
+ */
+function describeAdminRedirect(err) {
+  const status = err?.response?.status;
+  if (!(status >= 300 && status < 400)) return null;
+  const location = err.response.headers?.location;
+  let target = 'an unnamed location';
+  if (location) {
+    try {
+      const base = err.config?.url || undefined;
+      target = new URL(location, base).origin;
+    } catch {
+      target = 'an unparseable location';
+    }
+  }
+  return `The server answered ${status}, redirecting to ${target}. The admin key was not sent there. ` +
+    'Point HONE_API (or `api` in ~/.honerc) at the final host and run the command again.';
+}
+
+module.exports = { adminRequestOptions, describeAdminRedirect, ADMIN_TIMEOUT_MS };

package/lib/architect-config.js

@@ -20,6 +20,11 @@
  *
  * Pure helper — caller wraps fs.readFileSync + path resolution so the
  * helper is unit-testable with stubs.
+ *
+ * HC-GF-030: NO PRODUCTION CODE CALLS THIS ANY MORE. `architect_consulted` and `checklist_b_completed`
+ * are server-owned (workflow-store.js SERVER_OWNED_CONFIG_KEYS; run-context.js SERVER_OWNED_KEYS): the
+ * server writes them when its step_0b consult is approved, and a plan file's claim is not evidence that
+ * a consult ran on THIS story. The module stays as the documented reader of the plan's shape.
  */
 
 const path = require('node:path');

package/lib/batch-follow.js

@@ -59,9 +59,11 @@ const FORBIDDEN_FLAGS = Object.freeze(['--trust-source', '--skip-verify', '--rea
  * Pause reasons that mean a child is NOT at a gate waiting for its step_4 output to be judged. `GET /:runId`
  * sets `awaitingApproval` on ANY paused run with a current step, so without this a child paused by a breaker,
  * a budget, an agent's hard pause or a guardrail would look like a gate, and the loop would run its patch.
- * Sources: orchestrator.js (BATCH_*), orchestrator-guardrails.js GUARDRAIL_REFUSAL_CODES, the hard-pause scan.
+ * Sources: orchestrator.js (BATCH_*), orchestrator-guardrails.js GUARDRAIL_REFUSAL_CODES, the hard-pause scan, and
+ * architect-consult.js CONSULT_REQUIRED_CODE (HC-GF-030): a run the consult guard refused at a step it had no
+ * consult for. Its attempt is `pending` and has no output, and approving it is refused by the server.
  */
-const NOT_A_GATE = /^(BATCH_FAILURE_THRESHOLD_EXCEEDED:|BATCH_BUDGET_EXCEEDED:|MAX_RETRIES_EXCEEDED:|MAX_TOTAL_STEPS_EXCEEDED:|hard_pause at )/;
+const NOT_A_GATE = /^(BATCH_FAILURE_THRESHOLD_EXCEEDED:|BATCH_BUDGET_EXCEEDED:|MAX_RETRIES_EXCEEDED:|MAX_TOTAL_STEPS_EXCEEDED:|ARCHITECT_CONSULT_REQUIRED:|hard_pause at )/;
 
 /** What each child exit code means, for the action line. verify-patch.js and emit-pr.js EXIT maps. */
 const CHECK_EXIT = { 0: 'applies', 1: 'no diff', 2: 'does not apply' };
@@ -393,6 +395,9 @@ function priorWhy(prior, runId) {
   if (prior.state === 'adopted') {
     return `a newer run of this story already exists${b ? ` (batch ${b})` : ''}, queued by an earlier re-serve or by you, so it is not re-served again`;
   }
+  if (prior.state === 'inherited') {
+    return `this run is already the re-serve of ${prior.fromRunId ? `run ${prior.fromRunId}` : 'an earlier run'}${b ? ` (it is in batch ${b})` : ''}, so it is not re-served a second time`;
+  }
   if (prior.state === 'queue-failed') return 're-serving it failed earlier in this run; nothing more is tried';
   return `it names files again after being re-served as batch ${b}; a second re-serve is not tried`;
 }
@@ -450,7 +455,7 @@ function stuckReason(waiting) {
  * @param {Record<string, object>} details  runId → `GET /orchestrate/:runId`, for paused runs and runs to emit
  * @param {{emitted: Set<string>, reserved?: Map<string, {batchId: string|null, state: string}>}} memory  `emitted`: runs
  *   whose emit-pr already ran in this process; `reserved`: story → what became of its re-serve (`state`: served,
- *   kill-failed, queue-failed or adopted)
+ *   kill-failed, queue-failed, adopted or inherited)
  * @param {{repoName?: string|null, openPr?: boolean, tracked?: Set<string>|null, trackedRetry?: string|null,
  *          realPath?: ((file: string) => string|null)|null}} [ctx]  this checkout, so a run for another repository is
  *   not touched; `tracked`: the regular files git tracks here, which a request is checked against (`trackedRetry`:
@@ -594,7 +599,7 @@ function planTick(batch, details, memory, ctx = {}) {
  * crash between the queue and the kill, leaves no marker, and only a newer run of the same story shows it happened.
  * @returns {Promise<{lines: string[], needsYou: boolean, batchId: string|null, state: string|null, retry?: boolean}>}
  *   `batchId`: the batch the story was queued as, set whenever it was, even when the kill then failed; `state`: what
- *   became of the re-serve (served, kill-failed, queue-failed, adopted); `retry`: nothing was decided, ask again
+ *   became of the re-serve (served, kill-failed, queue-failed, adopted = a newer run exists, inherited = this run is itself the re-serve); `retry`: nothing was decided, ask again
  */
 async function reserve(action, io, tag) {
   if (io.priorServe) {
@@ -606,12 +611,16 @@ async function reserve(action, io, tag) {
         needsYou: false, batchId: null, state: null, retry: true };
     }
     if (prior && prior.kind === 'unknown') {
-      return { lines: [`${tag} not re-served: could not tell whether the story was served already; the paused run was left alone`],
+      return { lines: [`${tag} not re-served: could not tell whether the story was served already${prior.why ? ` (${prior.why})` : ''}; the paused run was left alone`],
         needsYou: true, batchId: null, state: 'queue-failed' };
     }
+    if (prior && prior.kind === 'earlier') {
+      return { lines: [`${tag} not re-served: this run is already the re-serve of run ${prior.runId} (it is in batch ${prior.batchId}), so it is not re-served a second time`],
+        needsYou: true, batchId: prior.batchId || null, state: 'inherited', fromRunId: prior.runId };
+    }
     if (prior) {
       const where = prior.batchId ? ` in batch ${prior.batchId}` : '';
-      return { lines: [`${tag} not re-served: run ${prior.runId}${where} is this story's ${prior.kind === 'later' ? 'newer' : 'earlier, re-served'} run; following it`],
+      return { lines: [`${tag} not re-served: a newer run of this story exists (run ${prior.runId}${where})${prior.batchId ? '; following it' : '; its batch was not found, so it is not followed'}`],
         needsYou: true, batchId: prior.batchId || null, state: 'adopted' };
     }
   }
@@ -695,6 +704,13 @@ async function autoReject(action, io, tag) {
     const status = statusOf(e);
     const f = fatal(e, `rejecting ${where}`);
     if (f) return { lines: [], needsYou: false, state: 'retry', fatal: f };
+    // HC-GF-323-followup-2: the server caps rejects at step_4's max_retries_per_step, counting a person's rejects too, so
+    // its refusal can come before this client's own bound. That 409 is not "the run moved on": the run is still paused
+    // at the failed attempt, and only a person can approve, kill or raise the guardrail.
+    if (status === 409 && e.response.data && e.response.data.code === 'REJECT_RETRIES_EXHAUSTED') {
+      const note = `${where} failed verification and the server refused the reject: ${oneLine(e.response.data.error, 160)}`;
+      return { lines: [`${tag} ${note}`], needsYou: true, state: 'stuck', note };
+    }
     if (status === 409) return { lines: [`${tag} ${where} was not rejected: the run moved on (409); this does not count`], needsYou: false, state: 'moved' };
     if (status === 400) {
       const note = `${where} failed verification and the server refused the reject (400: ${oneLine(e.response.data && e.response.data.error, 120)})`;
@@ -889,7 +905,7 @@ async function followBatch(batchId, io, opts = {}) {
         }
         if (action.kind === 'reserve') {
           if (!out.retry) {
-            memory.reserved.set(action.storyId, { batchId: out.batchId, state: out.state });
+            memory.reserved.set(action.storyId, { batchId: out.batchId, state: out.state, fromRunId: out.fromRunId });
             if (out.batchId && !followed.includes(out.batchId)) { followed.push(out.batchId); grew = true; }
           }
         } else if (action.kind === 'emit' || action.kind === 'draft') {