argus-reviewer-e2e 0.3.0 → 0.4.0

package/README.md

@@ -1,7 +1,8 @@
-# Argus
-
 <p align="center">
-  <img src="docs/assets/social.png" alt="Argus — vision-model E2E testing" width="640" />
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="assets/brand/export/lockup-dark.svg" />
+    <img src="assets/brand/export/lockup-light.svg" alt="Argus" width="240" />
+  </picture>
 </p>
 
 <p align="center">
@@ -11,108 +12,120 @@
   <a href="https://github.com/duketopceo/Argus/security/policy"><img src="https://img.shields.io/badge/security-policy-orange" alt="security policy" /></a>
 </p>
 
-**The hundred-eyed watcher for your pull requests.** Argus reviews your diff, then goes further: it starts your real app, clicks through it like a user, and executes probes against suspected bugs — then posts a verdict on the PR with the exact dollar cost. Self-hosted, MIT-licensed, bring-your-own OpenRouter key. No SaaS middleman, no telemetry, no per-seat pricing.
+**Argus reviews your pull request, runs your real app in a browser, and posts a verdict with its exact cost.**
+
+It is a GitHub Action and a CLI. It runs on your infrastructure with your own OpenRouter key: no hosted service, no telemetry, no per-seat pricing. MIT licensed.
 
-## Get started in 60 seconds
+## Install in 60 seconds
 
 ```bash
-npm i -D argus-reviewer-e2e      # the npm package; the command it installs is `argus-reviewer`
-npx argus-reviewer init          # writes config + smoke test + GitHub workflow
+npm i -D argus-reviewer-e2e      # the package; the command is argus-reviewer
+npx argus-reviewer init          # config, a smoke test, and the PR workflow
 ```
 
-Add `OPENROUTER_API_KEY` to your environment (and repo secrets for CI). Then:
+<img src="docs/assets/demo/init.gif" width="1100" alt="Terminal: argus-reviewer init writes the config, a smoke test and two workflow files, then checks the environment. The OpenRouter key is reported as not set, Playwright chromium is found, and the default lane is code review." />
+
+`init` checks your environment and tells you what is missing. Add `OPENROUTER_API_KEY` to your shell and to the repository secrets, and every pull request gets a review.
+
+Record a browser flow once, then replay it on every run:
 
 ```bash
-npx argus-reviewer record "sign in and open the dashboard" --url http://localhost:3000
-npx argus-reviewer run           # replays + asserts — free on cache hit
+npx argus-reviewer record "add an item and check out" --url http://localhost:3000
+npx argus-reviewer run
 ```
 
-That's it. `init` drops a ready-to-run GitHub workflow; every PR from then on gets a review comment with findings, flow results, video evidence, and spend.
+A replay that matches the recorded page makes no model call and costs $0. This cast replays a recorded checkout flow with no API key set at all:
+
+<img src="docs/assets/demo/run-cache-hit.gif" width="1100" alt="Terminal: cat shows a test that clicks Place order and asserts the order is confirmed. argus-reviewer run passes it from the cache: passed, 1 of 1 tests, total $0.000000 of a $1.00 budget." />
 
 ## What lands on your PR
 
-A sticky comment that updates on every push:
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/assets/hero-dark.png" />
+  <img src="docs/assets/hero-light.png" alt="The Argus sticky comment from a real review run: verdict needs changes, 3 findings with suspected proof and none reproduced, review lane failed, flow lane skipped, metered spend $0.000739." />
+</picture>
 
-- **Verdict** — `APPROVE` / `NEEDS_CHANGES` with findings linked to concrete source lines
-- **Inline comments on every severity** — one batched PR review, severity-sorted; each finding can carry a committable `suggestion` block you apply in one click
-- **Blocks only on proof** — the review escalates to `REQUEST_CHANGES` only for reproduced or adjudicated blockers; everything else stays advisory. Stale request-changes reviews are dismissed automatically, and `requestChanges: false` keeps it advisory forever
-- **Flow results** — which recorded user-journeys passed, healed, or broke
-- **Reproduced, not suspected** — opt-in sandbox lane runs authored regression probes; a probe that fails on head and passes on base stamps the finding as *proven*
-- **Cost** — every model call metered from OpenRouter's per-call pricing, totaled in dollars
+One sticky comment that updates on every push:
 
-That comment is **not a review**. `require_approving_reviews` reads reviews only, so on a protected branch the verdict alone leaves the gate unsatisfied. Supply `approval-token` — a GitHub App installation token, or a PAT from an account that is not the PR author — and Argus also submits a real review whose event follows the verdict. `github.token` cannot do this; GitHub refuses it outright. A token alone is **not** enough: an `APPROVE` also needs `approval-evidence` naming the test command, and `approval-check` naming a check run that has completed green on the pull request's head commit, produced by the App named in `approval-check-app` (`github-actions` by default). Details, the measured refusals, and the review-discipline rules: [`docs/approval-token.md`](docs/approval-token.md).
+- **Verdict:** approve or needs changes, with each finding linked to a source line.
+- **Inline comments:** one batched review, sorted by severity. A finding can carry a `suggestion` block you apply in one click.
+- **Proof level:** each finding says whether it is suspected or reproduced. Argus requests changes only for reproduced or adjudicated blockers; everything else stays advisory. `requestChanges: false` keeps it advisory always.
+- **Lanes and cost:** what ran, what did not and why, and the dollar cost of the model calls.
 
-<p align="center">
-  <img src="docs/assets/demo.gif" alt="argus-reviewer run — live vision call, PASS, $0.0005 spend" width="900" />
-</p>
+The comment is not a GitHub review, so on its own it does not satisfy a required-approval rule. To have Argus submit a real review, supply `approval-token` (a GitHub App token, or a PAT from an account that is not the PR author). An approve also needs `approval-evidence` and a green `approval-check` on the head commit. Details: [`docs/approval-token.md`](docs/approval-token.md).
+
+## Four lanes
+
+`argus-reviewer verify` runs the lanes you select and writes one `run-manifest.json`, which the PR comment renders.
+
+Beside it, verify writes `report.html`: an offline evidence report with the verdict, each lane, findings with suggestions, the flow step timeline, heals and the spend ledger. It is one self-contained file (inline styles, fonts and icons, no network requests), follows your light or dark setting and prints cleanly. It lands at `argus-reviewer-report/report.html` (or your `report-dir`). The action does not upload it; add an upload step for the report directory, and the PR comment footer names the path inside that artifact:
+
+```yaml
+- uses: actions/upload-artifact@v4
+  if: always()
+  with:
+    name: argus-reviewer-report-${{ github.run_id }}-${{ github.run_attempt }}
+    path: argus-reviewer-report/
+```
+
+| Lane | Select with | What it does |
+|---|---|---|
+| review | default | Reviews the diff and posts findings and a verdict |
+| flow | `--flow` (action input `run`) | Replays recorded browser flows, cache first |
+| app | `--app --task "..."` plus `--expect-text`, `--expect-url` or `--expect-selector` | Runs one directed task against your live app and checks the expected state |
+| a0 | `--a0` (action input `a0`) | Hands the task to your own Agent Zero host in a sandboxed child environment. A finished delegation reports inconclusive, never passed, because the agent's answer is self-reported |
+
+A lane that cannot run says so. Here the review lane has no pull request to read, so it reports skipped with the reason, and the flow lane replays from the cache:
 
-## Why it's different
+<img src="docs/assets/demo/verify.gif" width="1100" alt="Terminal: argus-reviewer verify --flow. The review lane is skipped because there is no pull request in context; the flow lane passes; total $0.000000 of a $1.00 budget." />
 
-| | Argus |
-|---|---|
-| **Selectors** | None. A vision model looks at a screenshot and decides where to click. |
-| **Maintenance** | Fingerprint cache replays at zero model cost; when the UI drifts, self-healing re-grounds and the heal shows up as a reviewable diff. |
-| **Review depth** | Beyond the diff: full-source evidence linkage, CI evidence, executed probes, real browser runs. |
-| **Spend** | You pick the models per lane (`model`, `grounding_model`, `code_model`, `escalation_model`) and set `budgetUsd`. Cache hits cost nothing. |
-| **Data** | Yours. Keys, journals, videos, and reports stay on your infra. |
+## Status legend
+
+Every lane, in the comment and in the terminal, reports one of six statuses:
+
+| Glyph | Status | Meaning |
+|---|---|---|
+| `●` | passed | The lane ran and its checks held |
+| `⊘` | failed | The lane ran and found a problem |
+| `◐` | inconclusive | The lane ran, but its evidence cannot settle the answer |
+| `⊖` | blocked | A policy stopped the lane |
+| `◌` | unavailable | The lane could not run: a missing key, tool or host |
+| `–` | skipped | The lane was not selected, or had nothing to work on |
+
+## Cost
+
+Every OpenRouter call is metered from the provider's per-call price and totaled in the comment. The review in the image above cost **$0.000739**. A flow replay that matches its cache costs $0. `budgetUsd` caps each run (default $1.00), and you choose the model for each job (`model`, `code_model`, `escalation_model`).
+
+The action tags every call with `ARGUS_REVIEWER_TRACE` (repository, PR, commit, run), so spend can be attributed per review. See [`docs/quickstart.md`](docs/quickstart.md) for the `openrouter` config block.
+
+## Security
+
+Argus treats pull request content as hostile. Untrusted checkouts never execute config code, fork PRs are gated behind the `argus-probe` label, secrets are filtered from model input and comment output, and the probe sandbox runs with no network and a read-only filesystem. Threat model: [`SECURITY.md`](SECURITY.md).
 
 ## Configuration
 
-`argus-reviewer.config.ts`:
+`argus-reviewer.config.ts` (or `argus-reviewer.config.json`):
 
 ```ts
 import { defineConfig } from 'argus-reviewer-e2e'
 
 export default defineConfig({
-  model: 'google/gemini-2.5-flash-lite',          // vision grounding + actions
+  model: 'google/gemini-2.5-flash-lite',          // vision: grounding and actions
   code_model: 'deepseek/deepseek-v4.1-flash',     // diff review
-  escalation_model: 'anthropic/claude-sonnet-4',  // risky/complex findings
+  escalation_model: 'anthropic/claude-sonnet-4',  // risky or complex findings
   budgetUsd: 1.0,
   target: { url: 'https://your-app.example.com' },
   testsDir: 'e2e',
+  reportRetention: 20,                            // archived manifests to keep
 })
 ```
 
-Point `provider.order` at fast OpenRouter backends (`cerebras`, `groq`) for sub-second review calls — speed is a routing choice, not a pricing tier. Full shape: [`src/config.ts`](src/config.ts) (a legacy `vision-e2e.config.*` is still accepted). Setup walkthrough: [`docs/quickstart.md`](docs/quickstart.md).
+Code review skips generated, fixture and vendored paths by default (`dist/**`, `fixtures/**`, `tests/goldens/**`, lockfiles, `*.generated.*`, `assets/brand/export/**`). Set `review: { exclude: [...] }` to replace that list (`[]` excludes nothing). The sticky comment's Diagnostics fold says how many files were left out.
 
-## The execution ladder
+Full shape: [`src/config.ts`](src/config.ts). Setup walkthrough: [`docs/quickstart.md`](docs/quickstart.md).
 
-Argus does more as you grant it more access — each rung is opt-in:
+## Contributing
 
-1. **API review** — GitHub token only. Reviews the PR diff and posts the verdict.
-2. **Trusted checkout** — findings get verified against the full source tree.
-3. **Browser flows** — Playwright drives your real app through recorded journeys.
-4. **Sandbox probes** — suspected findings get authored regression tests, executed in a hardened container (no network, no secrets, read-only FS). Fork PRs stay behind an `argus-probe` label gate.
-5. **Agent Zero delegation** — `argus-reviewer delegate "find the checkout bug"` hands exploratory work to your own A0 instance.
-
-## Cost attribution
-
-Every OpenRouter call carries a trace tag. The action auto-sets `ARGUS_REVIEWER_TRACE` (repo, PR, commit, run id) so spend is attributable per review — or set it yourself for custom fields. See [`docs/quickstart.md`](docs/quickstart.md) for the `openrouter` config block.
-
-## Security model
-
-Reviews run against hostile input by design: untrusted checkouts never execute config code, fork PRs are label-gated, secrets are filtered from model context and comment output, and the sandbox probe lane runs network-less with a read-only filesystem. Threat model: [`SECURITY.md`](SECURITY.md).
-
-## File structure
-
-```text
-argus-reviewer/
-├── action/                  # GitHub Actions composite action + sticky PR comment
-├── runner/                  # Self-hosted runner registration docs + script
-├── electron/                # Local observability dashboard (`npm run app`)
-├── src/
-│   ├── api.ts               # Test-facing `test`/`td` API + generated test renderer
-│   ├── cli.ts               # record · run · code-review · delegate · cache · index · init
-│   ├── config.ts            # `argus-reviewer.config.*` loader
-│   ├── cache/               # Per-step fingerprint + flow store
-│   ├── driver/              # Playwright browser + dev-server target
-│   ├── engine/              # Vision record/replay + healing loop
-│   ├── evidence/            # PR/CI context, fork trust gate, finding linkage
-│   ├── executor/            # Agent Zero delegation + hardened probe sandbox
-│   ├── probe/               # Model-authored regression probes
-│   ├── report/              # PR comment, JUnit XML, run.json
-│   └── vision/              # OpenRouter client, cost parsing, budget ledger
-└── tests/                   # Unit tests + Playwright fixture page
-```
+The repository also has a terminal view (`npm run watch`) and a desktop dashboard (`npm run app`). They are contributor tools: they run only from a clone of this repository, and the npm package does not ship them. The casts above are recorded by `npm run demo:record` (see `scripts/demo-record.mjs`). Guidelines: [`CONTRIBUTING.md`](CONTRIBUTING.md).
 
 License: [MIT](LICENSE).

package/action/action.yml

@@ -1,6 +1,9 @@
 name: argus-reviewer
 description: Run the argus-reviewer harness and post a sticky PR comment with cost and evidence.
 author: duketopceo
+branding:
+  icon: eye
+  color: blue
 inputs:
   openrouter-api-key:
     description: OpenRouter API key (BYOK). All vision calls are billed through this key.
@@ -44,13 +47,21 @@ inputs:
     default: argus-reviewer-report
     required: false
   sandbox:
-    description: Enable the B.2 probe lane — authored test probes for unexercised findings run in a hardened Docker container (no network, no secrets, read-only fs). Enable-only — 'false' does not override a config-enabled lane. Requires Docker on the runner; forced off on pull_request_target.
+    description: Enable the B.2 probe lane: authored test probes for unexercised findings run in a hardened Docker container (no network, no secrets, read-only fs). Enable-only: 'false' does not override a config-enabled lane. Requires Docker on the runner; forced off on pull_request_target.
     default: 'false'
     required: false
   max-comments:
     description: Cap on inline review comments posted per run; overflow is summarized in the sticky. Overrides review.maxComments when set.
     default: ''
     required: false
+  code-model:
+    description: Optional OpenRouter model slug for code review (e.g. openai/gpt-5-mini). Wins over the checkout's config code_model, including on pull_request events, where PR config never executes.
+    default: ''
+    required: false
+  review-profiles:
+    description: Optional comma-separated review lenses appended to the review prompt: security, perf, debloat (e.g. 'security,perf'). Wins over the checkout's config review.profiles.
+    default: ''
+    required: false
   install-consumer-dependencies:
     description: Explicitly install the consumer project's dependencies for a trusted runtime lane. Disabled by default so code review never runs PR-controlled lifecycle scripts beside secrets.
     default: 'false'
@@ -59,6 +70,45 @@ inputs:
     description: Run the browser-flow lane (`argus-reviewer run`). Disabled by default for public code-review-only repositories. Requires an explicit target and a trusted runtime path.
     default: 'false'
     required: false
+  app:
+    description: >-
+      Enable the application task lane (`verify --app`): a directed task
+      plus an expected-state check against your running app, never free
+      exploration. Requires `app-task`; `app-url` wins over the config's
+      target.url. Executable lane: refused on fork PRs and
+      pull_request_target by the runtime-lane gate.
+    default: 'false'
+    required: false
+  app-task:
+    description: Directed task for the app lane (and the a0 lane), e.g. 'submit the signup form and land on /welcome'. Required when app is true.
+    default: ''
+    required: false
+  app-url:
+    description: URL the flow/app/a0 lanes target; wins over the config's target.url. Passed as --url.
+    default: ''
+    required: false
+  app-expect-text:
+    description: Text that must appear for the app task to pass (maps to --expect-text).
+    default: ''
+    required: false
+  app-expect-url:
+    description: Regular expression the page URL must match after the task (maps to --expect-url).
+    default: ''
+    required: false
+  app-expect-selector:
+    description: CSS selector that must be present after the task (maps to --expect-selector).
+    default: ''
+    required: false
+  a0:
+    description: >-
+      Opt-in Agent Zero escalation lane (`verify --a0`): delegates the
+      configured task to your self-hosted A0 host inside a sanitized,
+      allowlisted child environment. The lane reports `inconclusive` even
+      on agent-reported success (live verification is not proven, #53),
+      and `unavailable` when the host/CLI is missing. Bounded to 1 task
+      and the configured timeout.
+    default: 'false'
+    required: false
   approval-token:
     description: >-
       Optional token that lets Argus submit a *formal* pull request review, which
@@ -73,7 +123,7 @@ inputs:
   approval-evidence:
     description: >-
       The test command(s) an approval stands on, cited verbatim in the review
-      body — e.g. 'python -m unittest discover -s tests && ruff check .'.
+      body, e.g. 'python -m unittest discover -s tests && ruff check .'.
       Required whenever approval-token is supplied: the lane refuses to submit
       an approval that cites no command, so an approver is always re-runnable.
       Ignored when approval-token is empty.
@@ -138,26 +188,60 @@ runs:
         ARGUS_BROWSER: ${{ inputs.browser }}
         ARGUS_BUDGET_USD: ${{ inputs.budget-usd }}
         ARGUS_MAX_COMMENTS: ${{ inputs.max-comments }}
+        ARGUS_CODE_MODEL: ${{ inputs.code-model }}
+        ARGUS_REVIEW_PROFILES: ${{ inputs.review-profiles }}
       run: node "$ARGUS_ACTION_PATH/bootstrap.mjs"
 
     - name: Reject executable lanes on untrusted pull requests
-      if: inputs.run != 'false' || inputs.install-consumer-dependencies == 'true'
+      if: >-
+        inputs.run != 'false' || inputs.app == 'true' || inputs.a0 == 'true'
+        || inputs.install-consumer-dependencies == 'true'
       shell: bash
       env:
         EVENT_NAME: ${{ github.event_name }}
         HEAD_FORK: ${{ github.event.pull_request.head.repo.fork }}
       run: |
-        if [ "$EVENT_NAME" = "pull_request_target" ]; then
-          echo "Argus runtime lanes are disabled for pull_request_target." >&2
+        # Each refusal says what happened and what to do, in the log and in
+        # the job summary, because no PR comment is posted on this path.
+        refuse() {
+          echo "$1" >&2
+          {
+            echo '### Argus: ⊖ blocked'
+            echo
+            echo "**Runtime lanes refused:** $1"
+            echo
+            echo "Fix: $2"
+            echo
+          } >> "$GITHUB_STEP_SUMMARY"
           exit 1
+        }
+        REVIEW_ONLY="set run: 'false' and leave app, a0 and install-consumer-dependencies off; the code review lane still runs."
+        if [ "$EVENT_NAME" = "pull_request_target" ]; then
+          refuse "Argus runtime lanes do not run on pull_request_target, which carries write credentials beside PR code." \
+            "use the pull_request event for runtime lanes, or $REVIEW_ONLY"
         fi
         if [ "$EVENT_NAME" = "pull_request" ] && [ "$HEAD_FORK" != "false" ]; then
-          echo "Argus runtime lanes require a same-repository PR or an explicitly trusted workflow." >&2
-          exit 1
+          refuse "this pull request comes from a fork, and runtime lanes execute PR code, so they need a same-repository PR or an explicitly trusted workflow." \
+            "for fork pull requests, $REVIEW_ONLY"
+        fi
+        if [ "$EVENT_NAME" = "issue_comment" ]; then
+          # issue_comment checks out the BASE ref, never the PR head;
+          # consumer deps on the base tree are trusted. The replay `run`
+          # lane is still meaningless here (it would test the base app
+          # against a head diff); @argus record covers that case.
+          if [ "${{ inputs.run }}" != "false" ]; then
+            refuse "the run lane is disabled on issue_comment, which checks out the base branch, not the PR head." \
+              "comment '@argus record' on the pull request instead."
+          fi
+          if [ "${{ inputs.app }}" = "true" ] || [ "${{ inputs.a0 }}" = "true" ]; then
+            refuse "the app and a0 lanes are disabled on issue_comment; they verify a checkout of the PR head." \
+              "run those lanes from a pull_request workflow."
+          fi
+          exit 0
         fi
         if [ "$EVENT_NAME" != "pull_request" ] && [ "$EVENT_NAME" != "" ]; then
-          echo "Argus runtime lanes are disabled for unlisted CI events: $EVENT_NAME" >&2
-          exit 1
+          refuse "runtime lanes do not run on the $EVENT_NAME event, which is not on the trusted list." \
+            "run them from a pull_request workflow, or $REVIEW_ONLY"
         fi
 
     - name: Install consumer dependencies for explicit runtime lanes
@@ -167,7 +251,7 @@ runs:
       run: npm ci
 
     - name: Install Playwright browser for explicit runtime lanes
-      if: inputs.run != 'false'
+      if: inputs.run != 'false' || inputs.app == 'true' || (github.event_name == 'issue_comment' && contains(github.event.comment.body, 'record'))
       shell: bash
       working-directory: ${{ inputs.working-directory || '.' }}
       env:
@@ -186,7 +270,38 @@ runs:
         ARGUS_WORKING_DIRECTORY: ${{ steps.bootstrap.outputs.working-directory }}
       run: node "$ARGUS_ACTION_PATH/cli.mjs" index
 
+    - name: Dispatch @argus mention
+      # issue_comment runs never check out the PR head; the workflow
+      # checks out the base ref and `mention` dispatches whitelisted
+      # commands (review/record/persist/help). Results still land in the
+      # report dir for the sticky post step below.
+      if: github.event_name == 'issue_comment'
+      id: mention
+      shell: bash
+      working-directory: ${{ inputs.working-directory || '.' }}
+      env:
+        ARGUS_ACTION_PATH: ${{ github.action_path }}
+        OPENROUTER_API_KEY: ${{ inputs.openrouter-api-key }}
+        GITHUB_TOKEN: ${{ github.token }}
+        ARGUS_CLI_JSON: ${{ steps.bootstrap.outputs.cli-json }}
+        ARGUS_WORKING_DIRECTORY: ${{ steps.bootstrap.outputs.working-directory }}
+        ARGUS_REPORT_DIR: ${{ inputs.report-dir }}
+        ARGUS_BUDGET_USD: ${{ inputs.budget-usd }}
+        ARGUS_MAX_COMMENTS: ${{ inputs.max-comments }}
+        ARGUS_CODE_MODEL: ${{ inputs.code-model }}
+        ARGUS_REVIEW_PROFILES: ${{ inputs.review-profiles }}
+        ARGUS_DEBUG: '1'
+        ARGUS_REVIEWER_TRACE: >-
+          {"repo":"${{ github.repository }}",
+          "pr":"${{ github.event.issue.number }}",
+          "commit":"${{ github.sha }}",
+          "run_id":"${{ github.run_id }}",
+          "run_attempt":"${{ github.run_attempt }}",
+          "workflow":"${{ github.workflow }}"}
+      run: node "$ARGUS_ACTION_PATH/cli.mjs" mention --report-dir "$ARGUS_REPORT_DIR"
+
     - name: Run selected Argus lanes
+      if: github.event_name != 'issue_comment'
       id: verify
       shell: bash
       working-directory: ${{ inputs.working-directory || '.' }}
@@ -199,11 +314,20 @@ runs:
         ARGUS_WORKING_DIRECTORY: ${{ steps.bootstrap.outputs.working-directory }}
         ARGUS_REPORT_DIR: ${{ inputs.report-dir }}
         ARGUS_VERIFY_FLOW: ${{ inputs.run != 'false' && '1' || '' }}
+        ARGUS_VERIFY_APP: ${{ inputs.app == 'true' && '1' || '' }}
+        ARGUS_VERIFY_A0: ${{ inputs.a0 == 'true' && '1' || '' }}
+        ARGUS_VERIFY_URL: ${{ inputs.app-url }}
+        ARGUS_VERIFY_TASK: ${{ inputs.app-task }}
+        ARGUS_VERIFY_EXPECT_TEXT: ${{ inputs.app-expect-text }}
+        ARGUS_VERIFY_EXPECT_URL: ${{ inputs.app-expect-url }}
+        ARGUS_VERIFY_EXPECT_SELECTOR: ${{ inputs.app-expect-selector }}
         ARGUS_SANDBOX: ${{ inputs.sandbox == 'true' && '1' || '' }}
         ARGUS_MAX_COMMENTS: ${{ inputs.max-comments }}
         ARGUS_DEBUG: '1'
         ARGUS_DIFF_BASE: ${{ inputs.diff-base }}
         ARGUS_BUDGET_USD: ${{ inputs.budget-usd }}
+        ARGUS_CODE_MODEL: ${{ inputs.code-model }}
+        ARGUS_REVIEW_PROFILES: ${{ inputs.review-profiles }}
         ARGUS_REVIEWER_TRACE: >-
           {"repo":"${{ github.repository }}",
           "pr":"${{ github.event.pull_request.number }}",

package/action/approval-review.mjs

@@ -20,6 +20,12 @@ import { execFile } from 'node:child_process'
 import { readFile } from 'node:fs/promises'
 import { join } from 'node:path'
 
+// The Ocellus verdict vocabulary has one action-side copy (KTD2), in the
+// sticky-comment module; this lane reuses it rather than keeping a third.
+import sticky from './sticky-comment.cjs'
+
+const { STATUS_GLYPH, VERDICT_STATUS, VERDICT_LABEL } = sticky
+
 const GH_API = 'https://api.github.com'
 
 /** Verdicts that mean "ship it". Everything else blocks. */
@@ -85,12 +91,16 @@ export function classifyApprovalFailure(status, message) {
 export function reviewBody(codeReview, runUrl, evidence, evidenceCheck) {
   const lines = []
   const verdict = String(codeReview?.verdict ?? 'unknown')
-  lines.push(`**Argus verdict:** \`${verdict}\``)
+  lines.push(
+    Object.hasOwn(VERDICT_LABEL, verdict)
+      ? `**Argus: ${STATUS_GLYPH[VERDICT_STATUS[verdict]]} ${VERDICT_LABEL[verdict]}**`
+      : `**Argus:** verdict \`${oneLine(verdict).replace(/`/g, '')}\``,
+  )
   if (codeReview?.summary) lines.push('', codeReview.summary)
   if (evidence !== undefined && evidence !== '') {
     lines.push('', `**Verified by:** \`${oneLine(evidence)}\``)
   } else {
-    lines.push('', '**Verified by:** none — this approval cites no test command.')
+    lines.push('', '**Verified by:** none. This approval cites no test command.')
   }
   if (evidenceCheck) {
     // The command above is the caller's claim; this line is the receipt. A
@@ -113,7 +123,7 @@ export function reviewBody(codeReview, runUrl, evidence, evidenceCheck) {
     )
     for (const f of blocking.slice(0, 5)) {
       const where = f.file ? ` \`${f.file}${f.line ? `:${f.line}` : ''}\`` : ''
-      lines.push(`- **${f.severity}**${where} — ${oneLine(f.message)}`)
+      lines.push(`- **${f.severity}**${where}: ${oneLine(f.message)}`)
     }
   }
   if (runUrl) lines.push('', `[argus-reviewer run](${runUrl})`)

package/action/bootstrap.mjs

@@ -13,8 +13,10 @@ import {
   setActionOutput,
   validateBrowser,
   validateBudget,
+  validateCodeModel,
   validateMaxComments,
   validatePathInput,
+  validateReviewProfiles,
   validateVersion,
 } from './runtime.mjs'
 
@@ -29,6 +31,8 @@ const reportDir = validatePathInput(
 validateBrowser(process.env.ARGUS_BROWSER || 'chromium')
 validateBudget(process.env.ARGUS_BUDGET_USD)
 validateMaxComments(process.env.ARGUS_MAX_COMMENTS)
+validateCodeModel(process.env.ARGUS_CODE_MODEL)
+validateReviewProfiles(process.env.ARGUS_REVIEW_PROFILES)
 
 async function stageConfig() {
   if (configInput === '' || configInput === 'argus-reviewer.config.ts') return

package/action/emit-review.mjs

@@ -219,6 +219,22 @@ export async function emitApprovalReview(env, deps = {}) {
     return { ok: false, reviewEvent: 'none', reviewState: 'no-report', message }
   }
 
+  // The report must be this run's own before it can drive any review event.
+  // Head sha alone is forgeable (a commit author knows it); GITHUB_RUN_ID is
+  // not knowable when a commit or planted file is authored, so a report that
+  // cannot present it is residue or plant. Local runs have no run id — the
+  // gate is off by design there, same as the sticky post step.
+  const expectedNonce = (env.GITHUB_RUN_ID ?? '').trim()
+  if (expectedNonce !== '' && codeReview?.runNonce !== expectedNonce) {
+    const message =
+      'argus-reviewer: code-review.json does not carry this workflow run\'s id — ' +
+      'it is stale or was not produced by this run. No review was submitted.'
+    fail(message)
+    setActionOutput('review-event', 'none')
+    setActionOutput('review-state', 'stale-report')
+    return { ok: false, reviewEvent: 'none', reviewState: 'stale-report', message }
+  }
+
   const event = reviewEventFor(codeReview.verdict)
 
   // The run reviewed the code at the head SHA its event carried. If the head has

package/action/runtime.mjs

@@ -93,6 +93,38 @@ export function validateMaxComments(raw) {
   return Number(raw)
 }
 
+const KNOWN_REVIEW_PROFILES = new Set(['security', 'perf', 'debloat'])
+
+export function validateReviewProfiles(raw) {
+  if (raw === undefined || raw === '') return undefined
+  const names = String(raw)
+    .split(',')
+    .map((s) => s.trim())
+    .filter((s) => s !== '')
+  // Env-only value — no shell — but reject unknown names so a typo fails
+  // here instead of silently dropping the intended lens at config load.
+  for (const name of names) {
+    if (!KNOWN_REVIEW_PROFILES.has(name)) {
+      throw new Error(
+        `review-profiles must be a comma-separated list of: ${[...KNOWN_REVIEW_PROFILES].join(', ')} — got '${name}'`,
+      )
+    }
+  }
+  return names.join(',')
+}
+
+export function validateCodeModel(raw) {
+  if (raw === undefined || raw === '') return undefined
+  const value = String(raw).trim()
+  // OpenRouter slugs are `vendor/model` with an optional `:variant`
+  // (`deepseek/deepseek-r1:free`). Env-only value — no shell — but keep it
+  // to slug-shaped input so typos surface here instead of at the API.
+  if (!/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,199}$/.test(value)) {
+    throw new Error('code-model must be an OpenRouter model slug (e.g. openai/gpt-5-mini)')
+  }
+  return value
+}
+
 export function resolveWorkingDirectory(workspace, input) {
   const root = realpathSync(resolve(workspace))
   const requested = String(input ?? '').trim()