What does this PR do?

When the goal judge raises an API/transport error (e.g. BadRequestError, ConnectionError, 4xx), judge_goal deliberately fails OPEN to ("continue", "judge error: ...", False) so a broken judge doesn't wedge progress. That assumption breaks when the assistant has already emitted a terminal response on the same turn — evaluate_after_turn re-queues a continuation prompt, the agent re-emits a near-identical terminal message, the judge keeps erroring, and the gateway channel (Discord/Telegram/etc.) gets spammed with the same completion message every few seconds until the turn budget runs out (16 of 20 turns in the reporter's case). This PR adds a safe-stop fallback: when the verdict is continue AND the reason starts with _JUDGE_ERROR_REASON_PREFIX ("judge error:") AND the assistant's response matches a small set of terminal-phrasing patterns ("goal is complete", "i'm/i am stopping", "nothing left to do"), pause the loop instead of queueing another turn. Fail-open is preserved for in-flight goals (non-terminal response → still continue), so a transient judge outage mid-task does not wedge legitimate progress.

Related Issue

Fixes #27585

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• hermes_cli/goals.py — judge_goal's error path now emits the _JUDGE_ERROR_REASON_PREFIX shared constant so the producer/consumer contract is explicit. GoalManager.evaluate_after_turn adds the safe-stop fallback: terminal-phrase regex match + judge-error prefix → pause with paused_reason="goal judge unreachable; assistant response appears terminal — pausing to avoid spam".
• tests/hermes_cli/test_goals.py — new TestJudgeErrorSafeStop class (judge API error + terminal response → paused; judge API error + non-terminal → still continues; judge OK + terminal phrasing → still continues; judge done + terminal phrasing → status=done) and TestResponseLooksTerminal parametrized helper coverage.

How to Test

1. uv run --with pytest --with pytest-xdist --with pytest-asyncio python3 -m pytest tests/hermes_cli/test_goals.py -v — 65 passed.
2. Regression guard: with the production change stashed, test_judge_api_error_with_terminal_response_auto_pauses fails with assert True is False on the should_continue assertion — exactly matching the issue's reproduction. With the fix applied, it passes alongside the existing 61 tests.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run focused tests for the touched code and all pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 15.x

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Sibling Audit

The parse-failure auto-pause already guards the bad-judge-output case (weak models emitting non-JSON for N turns). This PR is the orthogonal guard for the unreachable-judge case — different failure mode, complementary backstop. Audited siblings: no other call sites consume the judge-error prefix. No widening needed.

Related

• Different failure mode from fix(goals): salvage PR #19160 + auto-pause on consecutive judge parse failures #21576 (auto-pause on consecutive parse failures); this guards the unreachable-judge case where the judge call itself errors out.
• Different failure mode from /goal judge produces false positive when agent claims file created but write silently fails #18421 (judge false positive — claims done when not); this guards the inverse where the judge cannot evaluate and the assistant has explicitly stopped.