hq-jr 0.1.2 → 0.1.4

package/README.md

@@ -15,7 +15,7 @@
 
 ### Why hq-jr
 
-- **Sandbox proof.** Suspicious findings can be reproduced in an isolated container before the bot files a strong claim. Tier 3 / Antigravity is experimental.
+- **Sandbox proof.** Suspicious findings can be dispatched to an isolated Antigravity container; hq-jr polls for a real verdict (not success-on-dispatch). Tier 3 remains experimental until validated in your environment.
 - **Mention manners.** Peer-to-peer PR chat is ignored until someone addresses `@hq-jr`.
 - **Self-hosted on Vertex.** Runs in your account. Diffs go to your GCP project via Vertex AI, not a third-party review SaaS.
 
@@ -31,14 +31,14 @@
 
 Junior sits on your webhook path. Humans skim diffs and type LGTM. Junior does not skim.
 
-It filters noise, scrubs credentials, then runs a two-step Gemini Flash path: triage (narrow schema) then deep review. Both steps use High Thinking; triage is cheaper because the prompt and JSON schema are smaller. SQLite WAL memory tracks prior findings across pushes. When a break looks real, it can ask the experimental sandbox path to reproduce before speaking loudly. Tag `@hq-jr fix` if you want a remediation branch.
+It filters noise, scrubs credentials, then runs a two-step Gemini Flash path: triage (narrow schema) then deep review. Both steps use High Thinking; triage is cheaper because the prompt and JSON schema are smaller. SQLite WAL stores prior findings across pushes (GitHub hq-jr reviews still supplement). When a break looks real, experimental Tier 3 dispatches Antigravity and polls for a reproduction verdict. Tag `@hq-jr fix` (explicit command only) if you want a remediation branch.
 
 ### Generic AI review bots vs hq-jr
 
 | Dimension | Generic AI review bots | hq-jr |
 | :--- | :--- | :--- |
-| **Verification** | Guesses from completions. | Can reproduce in a sandbox before strong claims (Tier 3 experimental). |
-| **Memory** | Stateless; repeats nags after force-push. | SQLite WAL remembers prior findings. |
+| **Verification** | Guesses from completions. | Polls Tier 3 sandbox for a real verdict before concluding the check (experimental). |
+| **Memory** | Stateless; repeats nags after force-push. | SQLite WAL stores findings; GitHub reviews used as supplement. |
 | **Noise** | Reviews lockfiles and vendor junk. | Heuristic filter + Tier 1 triage skip low-risk diffs. |
 | **Etiquette** | Hijacks human threads. | Speaks when `@hq-jr` is mentioned (or already in-thread). |
 | **Hosting** | Third-party SaaS sees your diffs. | Self-hosted; Vertex AI in *your* GCP project. |
@@ -93,7 +93,8 @@ Defaults match [`src/config.ts`](src/config.ts): Tier 1 and Tier 2 use `gemini-3
    - Line-anchored comments with suggestion blocks; HTTP 422 fallback if lines drift.
 4. **Tier 3: Sandbox Verification (experimental)** (CLI & runner):
    - Antigravity agent (`HQ_JR_AGENT_TIER3`, default `antigravity-preview-05-2026`) for empirical reproduction in isolated containers via `src/cli.ts` / [`src/services/sandbox-runner.ts`](src/services/sandbox-runner.ts).
-   - Treat as experimental until you validate it in your environment.
+   - After dispatch the Check Run stays `in_progress` while `pollSandboxInteraction` waits for a verdict; conclusion is success/failure/neutral from that result (not success-on-dispatch).
+   - Treat as experimental until you validate live Antigravity in your environment.
 
 ---
 
@@ -103,7 +104,9 @@ Defaults match [`src/config.ts`](src/config.ts): Tier 1 and Tier 2 use `gemini-3
 - **GitHub Check Runs**: Status via `hq-jr AI Code Review`.
 - **Interactive PR Chat**: Mention `@hq-jr` to ask questions. Human-to-human threads stay quiet.
 - **On-Demand Review**: `@hq-jr review`, `@hq-jr audit`, or `@hq-jr scan`.
-- **Remediation with RBAC**: `@hq-jr fix` / `@hq-jr patch` synthesizes a fix branch `hq-jr/fix-pr-<id>`. `@hq-jr fix and merge` when permissions allow. Requires collaborator `admin` or `write`.
+- **Remediation with RBAC**: Explicit `@hq-jr fix` / `@hq-jr patch` / `@hq-jr remediate` (optional `and merge`) only; loose wording like "how to fix naming" does not trigger. Synthesizes branch `hq-jr/fix-pr-<id>`. Requires collaborator `admin` or `write`.
+- **Commit repro test**: Check action **Commit Repro Test** or `@hq-jr commit-repro` commits the synthesized test from the sandbox check summary.
+- **Re-run sandbox**: Check action **Re-run Sandbox** re-dispatches Tier 3 with prior probes when available.
 
 ---
 
@@ -175,12 +178,22 @@ npm run dev   # watch mode
 
 ### Docker
 
+Published image (App daemon):
+
+```bash
+docker pull ghcr.io/adi-il/hq-jr:0.1.2
+# or: docker pull ghcr.io/adi-il/hq-jr:latest
+docker run --rm -p 3000:3000 --env-file .env ghcr.io/adi-il/hq-jr:0.1.2
+```
+
+Build from source:
+
 ```bash
 docker build -t hq-jr:local .
 docker run --rm -p 3000:3000 --env-file .env hq-jr:local
 ```
 
-For Cloud Run and systemd options, see [docs/05-deployment-and-operations.md](docs/05-deployment-and-operations.md).
+Image runs Probot under `tini` (PID 1) with `probot` on `PATH`. For Cloud Run and systemd options, see [docs/05-deployment-and-operations.md](docs/05-deployment-and-operations.md).
 
 ---
 

package/dist/index.d.ts

@@ -1,4 +1,9 @@
 import { Probot } from "probot";
+/** Remediation only on explicit @hq-jr fix|patch|remediate (optional and merge). */
+/** True when path is a file under tests/ (not bare tests, not traversal). */
+export declare function isSafeReproTestPath(path: string | undefined | null): boolean;
+export declare const REMEDIATE_COMMAND_RE: RegExp;
+export declare const COMMIT_REPRO_COMMAND_RE: RegExp;
 declare const _default: (app: Probot, { getRouter }?: {
     getRouter?: (path?: string) => any;
 }) => void;

package/dist/index.js

@@ -5,9 +5,135 @@ import { replyToDiscussion } from "./services/discussion.js";
 import { getPreviousReviewContext, getReviewCommentThread } from "./services/review-memory.js";
 import { executeRemediation } from "./services/remediation.js";
 import { scrubSecrets } from "./services/scrubber.js";
-import { addRemediationCommit, hasRemediationCommit, acquireRunLock, releaseRunLock } from "./services/db.js";
+import { verifyReviewActionRefs } from "./services/action-ref-verifier.js";
+import { addRemediationCommit, hasRemediationCommit, acquireRunLock, releaseRunLock, saveReviewFindings, getSandboxJobByCheckRun } from "./services/db.js";
 import { executeSandboxCheckRun } from "./services/sandbox-runner.js";
+/** Remediation only on explicit @hq-jr fix|patch|remediate (optional and merge). */
+/** True when path is a file under tests/ (not bare tests, not traversal). */
+export function isSafeReproTestPath(path) {
+    const normalized = (path ?? "").replace(/^\/+/, "").replace(/\/+$/, "");
+    return (normalized.startsWith("tests/") &&
+        normalized.length > "tests/".length &&
+        !normalized.includes("..") &&
+        !normalized.endsWith("/"));
+}
+export const REMEDIATE_COMMAND_RE = /@hq-jr(?:\[bot\])?\s+(fix|patch|remediate)(\s+and\s+merge)?\b/i;
+export const COMMIT_REPRO_COMMAND_RE = /@hq-jr(?:\[bot\])?\s+commit-repro\b/i;
 export default (app, { getRouter } = {}) => {
+    async function resolveInstallationToken(octokit) {
+        try {
+            if (typeof octokit.auth !== "function")
+                return undefined;
+            const authResult = await octokit.auth({ type: "installation" });
+            const token = authResult?.token;
+            return typeof token === "string" && token.length > 0 ? token : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async function commitReproTestFromSummary(params) {
+        const { octokit, owner, repoName, pullNumber, sender, summaryText, headSha, targetBranch } = params;
+        // Fail closed on fork PRs: never updateRef into a head that is not this repo.
+        try {
+            const { data: prMeta } = await octokit.pulls.get({
+                owner,
+                repo: repoName,
+                pull_number: pullNumber,
+            });
+            const headFullName = prMeta?.head?.repo?.full_name;
+            const expected = `${owner}/${repoName}`;
+            if (!headFullName || headFullName !== expected) {
+                return {
+                    ok: false,
+                    message: `⚠️ **hq-jr** refuses to commit a reproduction test on fork PR heads ` +
+                        `(head repo: \`${headFullName || "unknown"}\`, expected \`${expected}\`). ` +
+                        `Open the PR from a branch in this repository or push the test manually.`,
+                };
+            }
+        }
+        catch (forkErr) {
+            const msg = forkErr instanceof Error ? forkErr.message : String(forkErr);
+            return {
+                ok: false,
+                message: `⚠️ **hq-jr** could not verify PR head repository before commit-repro: ${msg}`,
+            };
+        }
+        // Prefer the synthesized-test section (heading + optional path in parentheses + fence).
+        const sectionMatch = summaryText.match(/###\s*Synthesized Reproduction Test(?:\s*\(([^)]+)\))?[\s\S]*?```(?:rust|typescript|javascript|python|go)?\s*([\s\S]*?)```/i);
+        const extractedPath = sectionMatch?.[1]?.trim() || undefined;
+        const testCode = sectionMatch?.[2]?.trim()
+            || summaryText.match(/```(?:rust|typescript|javascript|python|go)?\s*([\s\S]*?)```/)?.[1]?.trim()
+            || null;
+        if (!testCode) {
+            return {
+                ok: false,
+                message: `⚠️ **hq-jr** could not extract a synthesized reproduction test from this check run output.`,
+            };
+        }
+        let testFileName;
+        const normalizedExtracted = extractedPath?.replace(/^\/+/, "").replace(/\/+$/, "") ?? "";
+        const safeExtractedPath = isSafeReproTestPath(normalizedExtracted)
+            ? normalizedExtracted
+            : null;
+        if (safeExtractedPath) {
+            testFileName = safeExtractedPath;
+        }
+        else {
+            const isRust = summaryText.includes("cargo") || summaryText.includes(".rs") || /\brust\b/i.test(summaryText);
+            const isPython = summaryText.includes("pytest") || summaryText.includes(".py");
+            const isGo = summaryText.includes("go test") || summaryText.includes(".go");
+            testFileName = isRust
+                ? `tests/repro_issue_${pullNumber}.rs`
+                : isPython
+                    ? `tests/test_repro_issue_${pullNumber}.py`
+                    : isGo
+                        ? `tests/repro_issue_${pullNumber}_test.go`
+                        : `tests/repro_issue_${pullNumber}.test.ts`;
+        }
+        const { data: blob } = await octokit.git.createBlob({
+            owner,
+            repo: repoName,
+            content: Buffer.from(testCode).toString("base64"),
+            encoding: "base64",
+        });
+        const { data: baseCommit } = await octokit.git.getCommit({
+            owner,
+            repo: repoName,
+            commit_sha: headSha,
+        });
+        const { data: newTree } = await octokit.git.createTree({
+            owner,
+            repo: repoName,
+            base_tree: baseCommit.tree.sha,
+            tree: [
+                {
+                    path: testFileName,
+                    mode: "100644",
+                    type: "blob",
+                    sha: blob.sha,
+                },
+            ],
+        });
+        const { data: newCommit } = await octokit.git.createCommit({
+            owner,
+            repo: repoName,
+            message: `test: add synthesized adversarial reproduction test for PR #${pullNumber} [skip ci]`,
+            tree: newTree.sha,
+            parents: [headSha],
+        });
+        addRemediationCommit(newCommit.sha);
+        await octokit.git.updateRef({
+            owner,
+            repo: repoName,
+            ref: `heads/${targetBranch}`,
+            sha: newCommit.sha,
+        });
+        return {
+            ok: true,
+            message: `✅ **Reproduction Test Committed:** \`${testFileName}\` has been committed directly to branch \`${targetBranch}\` (Commit: \`${newCommit.sha.slice(0, 7)}\`) by @${sender}.`,
+        };
+    }
     process.on("unhandledRejection", (reason) => {
         app.log.warn({ reason }, "Handled unhandledRejection to ensure daemon stability");
     });
@@ -149,6 +275,7 @@ export default (app, { getRouter } = {}) => {
                 owner,
                 repo: repoName,
                 pullNumber,
+                currentHeadSha: pr.head.sha,
             });
             if (previousReview) {
                 app.log.info({
@@ -168,7 +295,8 @@ ${filesToReview.map((f) => `- ${f.path} (Risk: ${f.risk}, Reason: ${f.reason})`)
 
 ${contextPackage.promptPayload}
 `;
-            const review = await runDeepReview(reviewPrompt, { previousReview });
+            const rawReview = await runDeepReview(reviewPrompt, { previousReview });
+            const review = await verifyReviewActionRefs(octokit, rawReview);
             // 6. Post inline review comments via Octokit REST (with line anchor validation)
             const normalizePath = (p) => p.replace(/^[./]+/, "").replace(/\\/g, "/");
             const fileMap = new Map();
@@ -250,6 +378,27 @@ ${contextPackage.promptPayload}
                     }
                 }
             }
+            // Persist review findings to SQLite for cross-push memory
+            try {
+                const findingRows = review.comments.map((c) => ({
+                    owner,
+                    repo: repoName,
+                    pullNumber,
+                    headSha: pr.head.sha,
+                    path: c.path,
+                    line: c.line,
+                    side: c.side,
+                    severity: c.severity,
+                    title: c.title,
+                    body: c.body,
+                }));
+                if (findingRows.length > 0) {
+                    saveReviewFindings(findingRows);
+                }
+            }
+            catch (persistErr) {
+                app.log.warn({ persistErr, pullNumber }, "Failed to persist review findings to SQLite");
+            }
             // 7. Complete Check Run
             if (checkRun?.data?.id) {
                 const conclusion = review.verdict === "REQUEST_CHANGES"
@@ -273,6 +422,7 @@ ${contextPackage.promptPayload}
             if (review.requiresSandboxVerification) {
                 const goal = review.verificationGoal || "Verify flagged critical issues in isolated container sandbox";
                 app.log.info({ pullNumber, goal }, "Triggering Tier 3 asynchronous sandbox check run");
+                const authToken = await resolveInstallationToken(octokit);
                 executeSandboxCheckRun({
                     octokit,
                     owner,
@@ -283,6 +433,7 @@ ${contextPackage.promptPayload}
                     verificationGoal: goal,
                     modifiedFiles: parsedDiff.files.map((f) => f.newPath || f.oldPath),
                     probes: review.sandboxProbes,
+                    authToken,
                 }).catch((sandboxErr) => {
                     app.log.warn({ sandboxErr, pullNumber }, "Async sandbox verification check run encountered error");
                 });
@@ -437,10 +588,8 @@ ${contextPackage.promptPayload}
         app.log.info({ pullNumber, user: user.login }, "Responding to main PR thread comment mentioning @hq-jr");
         try {
             const lower = body.toLowerCase();
-            const isRemediateCommand = lower.includes("fix") ||
-                lower.includes("patch") ||
-                lower.includes("remediate") ||
-                lower.includes("resolve");
+            const remediateMatch = body.match(REMEDIATE_COMMAND_RE);
+            const isRemediateCommand = Boolean(remediateMatch);
             if (isRemediateCommand) {
                 // Enforce RBAC: Verify commenter has write or admin permissions to repo
                 let hasWrite = false;
@@ -481,6 +630,7 @@ ${contextPackage.promptPayload}
                     owner,
                     repo: repoName,
                     pullNumber,
+                    currentHeadSha: prResponse.data.head.sha,
                 });
                 if (!prevReview || prevReview.openIssues.length === 0) {
                     await context.octokit.issues.createComment({
@@ -492,7 +642,7 @@ ${contextPackage.promptPayload}
                     return;
                 }
                 const hasNegativeMerge = /\b(?:do not|don't|no|never)\s+merge\b/i.test(body);
-                const hasExplicitMergeCommand = /\b(?:and\s+merge|auto-?merge)\b/i.test(body);
+                const hasExplicitMergeCommand = Boolean(remediateMatch?.[2]) || /\b(?:and\s+merge|auto-?merge)\b/i.test(body);
                 const autoMerge = hasExplicitMergeCommand && !hasNegativeMerge;
                 const result = await executeRemediation({
                     octokit: context.octokit,
@@ -522,6 +672,67 @@ ${contextPackage.promptPayload}
                 });
                 return;
             }
+            if (COMMIT_REPRO_COMMAND_RE.test(body)) {
+                let hasWrite = false;
+                try {
+                    const { data: perm } = await context.octokit.repos.getCollaboratorPermissionLevel({
+                        owner,
+                        repo: repoName,
+                        username: user.login,
+                    });
+                    hasWrite = perm.permission === "admin" || perm.permission === "write";
+                }
+                catch (permErr) {
+                    app.log.warn({ permErr, user: user.login }, "Failed to verify collaborator permissions for commit-repro; failing closed");
+                }
+                if (!hasWrite) {
+                    await context.octokit.issues.createComment({
+                        owner,
+                        repo: repoName,
+                        issue_number: pullNumber,
+                        body: `⛔ **Access Denied:** Only repository collaborators with write or admin permissions can commit reproduction tests.`,
+                    });
+                    return;
+                }
+                const prResponse = await context.octokit.pulls.get({
+                    owner,
+                    repo: repoName,
+                    pull_number: pullNumber,
+                });
+                const pr = prResponse.data;
+                let summaryText = "";
+                try {
+                    const checks = await context.octokit.checks.listForRef({
+                        owner,
+                        repo: repoName,
+                        ref: pr.head.sha,
+                        check_name: "hq-jr AI Sandbox Verification",
+                        per_page: 10,
+                    });
+                    const latest = (checks.data.check_runs || [])[0];
+                    summaryText = latest?.output?.summary || "";
+                }
+                catch (checkErr) {
+                    app.log.warn({ checkErr }, "Could not list sandbox check runs for commit-repro");
+                }
+                const result = await commitReproTestFromSummary({
+                    octokit: context.octokit,
+                    owner,
+                    repoName,
+                    pullNumber,
+                    sender: user.login,
+                    summaryText,
+                    headSha: pr.head.sha,
+                    targetBranch: pr.head.ref,
+                });
+                await context.octokit.issues.createComment({
+                    owner,
+                    repo: repoName,
+                    issue_number: pullNumber,
+                    body: result.message,
+                });
+                return;
+            }
             const isReviewCommand = lower.includes("review") ||
                 lower.includes("audit") ||
                 lower.includes("scan") ||
@@ -716,110 +927,134 @@ ${contextPackage.promptPayload}
             pr: prResponse.data,
         });
     });
-    // Handle Check Run action buttons (e.g. Commit Repro Test)
+    // Handle Check Run action buttons (e.g. Commit Repro Test / Re-run Sandbox)
     app.on("check_run.requested_action", async (context) => {
         const { check_run: checkRun, requested_action: requestedAction } = context.payload;
         const identifier = requestedAction.identifier;
         const owner = context.payload.repository.owner.login;
         const repoName = context.payload.repository.name;
         const sender = context.payload.sender.login;
-        if (identifier === "commit_repro_test") {
-            let hasWrite = false;
-            try {
-                const { data: perm } = await context.octokit.repos.getCollaboratorPermissionLevel({
-                    owner,
-                    repo: repoName,
-                    username: sender,
-                });
-                hasWrite = perm.permission === "admin" || perm.permission === "write";
-            }
-            catch (permErr) {
-                app.log.warn({ permErr, sender }, "Failed to verify collaborator permissions for check action; failing closed");
-            }
-            const pullRequests = checkRun.pull_requests;
-            if (!pullRequests || pullRequests.length === 0) {
-                app.log.warn({ checkRunId: checkRun.id }, "No pull request attached to check run action");
-                return;
-            }
-            const pullNumber = pullRequests[0].number;
-            if (!hasWrite) {
-                await context.octokit.issues.createComment({
-                    owner,
-                    repo: repoName,
-                    issue_number: pullNumber,
-                    body: `⛔ **Access Denied:** Only repository collaborators with write or admin permissions can commit reproduction tests.`,
-                });
-                return;
-            }
-            const prResponse = await context.octokit.pulls.get({
+        const pullRequests = checkRun.pull_requests;
+        if (!pullRequests || pullRequests.length === 0) {
+            app.log.warn({ checkRunId: checkRun.id }, "No pull request attached to check run action");
+            return;
+        }
+        const pullNumber = pullRequests[0].number;
+        let hasWrite = false;
+        try {
+            const { data: perm } = await context.octokit.repos.getCollaboratorPermissionLevel({
                 owner,
                 repo: repoName,
-                pull_number: pullNumber,
+                username: sender,
             });
-            const pr = prResponse.data;
-            const targetBranch = pr.head.ref;
-            const outputText = checkRun.output?.summary || "";
-            const testCodeMatch = outputText.match(/```(?:rust|typescript|javascript|python)?\s*([\s\S]*?)```/);
-            const testCode = testCodeMatch ? testCodeMatch[1].trim() : null;
-            if (!testCode) {
-                await context.octokit.issues.createComment({
-                    owner,
-                    repo: repoName,
-                    issue_number: pullNumber,
-                    body: `⚠️ **hq-jr** could not extract a synthesized reproduction test from this check run output.`,
-                });
-                return;
-            }
-            const isRust = outputText.includes("cargo") || outputText.includes(".rs");
-            const isPython = outputText.includes("pytest") || outputText.includes(".py");
-            const testFileName = isRust
-                ? `tests/repro_issue_${pullNumber}.rs`
-                : isPython
-                    ? `tests/test_repro_issue_${pullNumber}.py`
-                    : `tests/repro_issue_${pullNumber}.test.ts`;
-            const { data: blob } = await context.octokit.git.createBlob({
+            hasWrite = perm.permission === "admin" || perm.permission === "write";
+        }
+        catch (permErr) {
+            app.log.warn({ permErr, sender }, "Failed to verify collaborator permissions for check action; failing closed");
+        }
+        if (!hasWrite) {
+            await context.octokit.issues.createComment({
                 owner,
                 repo: repoName,
-                content: Buffer.from(testCode).toString("base64"),
-                encoding: "base64",
+                issue_number: pullNumber,
+                body: `⛔ **Access Denied:** Only repository collaborators with write or admin permissions can trigger sandbox check actions.`,
             });
-            const { data: baseCommit } = await context.octokit.git.getCommit({
+            return;
+        }
+        if (identifier === "commit_repro_test") {
+            const prResponse = await context.octokit.pulls.get({
                 owner,
                 repo: repoName,
-                commit_sha: pr.head.sha,
+                pull_number: pullNumber,
             });
-            const { data: newTree } = await context.octokit.git.createTree({
+            const pr = prResponse.data;
+            const outputText = checkRun.output?.summary || "";
+            const result = await commitReproTestFromSummary({
+                octokit: context.octokit,
                 owner,
-                repo: repoName,
-                base_tree: baseCommit.tree.sha,
-                tree: [
-                    {
-                        path: testFileName,
-                        mode: "100644",
-                        type: "blob",
-                        sha: blob.sha,
-                    },
-                ],
+                repoName,
+                pullNumber,
+                sender,
+                summaryText: outputText,
+                headSha: pr.head.sha,
+                targetBranch: pr.head.ref,
             });
-            const { data: newCommit } = await context.octokit.git.createCommit({
+            await context.octokit.issues.createComment({
                 owner,
                 repo: repoName,
-                message: `test: add synthesized adversarial reproduction test for PR #${pullNumber} [skip ci]`,
-                tree: newTree.sha,
-                parents: [pr.head.sha],
+                issue_number: pullNumber,
+                body: result.message,
             });
-            addRemediationCommit(newCommit.sha);
-            await context.octokit.git.updateRef({
+            return;
+        }
+        if (identifier === "rerun_sandbox") {
+            const prResponse = await context.octokit.pulls.get({
                 owner,
                 repo: repoName,
-                ref: `heads/${targetBranch}`,
-                sha: newCommit.sha,
+                pull_number: pullNumber,
             });
+            const pr = prResponse.data;
+            let probes;
+            let verificationGoal = "Re-run autonomous sandbox verification with a fresh container";
+            let testCommand;
+            let branch = pr.head.ref || "main";
+            try {
+                const job = getSandboxJobByCheckRun({
+                    owner,
+                    repo: repoName,
+                    checkRunId: checkRun.id,
+                });
+                if (job) {
+                    if (job.probesJson) {
+                        try {
+                            probes = JSON.parse(job.probesJson);
+                        }
+                        catch {
+                            // ignore bad json
+                        }
+                    }
+                    if (job.verificationGoal)
+                        verificationGoal = job.verificationGoal;
+                    if (job.testCommand)
+                        testCommand = job.testCommand;
+                    if (job.branch)
+                        branch = job.branch;
+                }
+            }
+            catch (jobErr) {
+                app.log.warn({ jobErr }, "Could not load prior sandbox job for rerun");
+            }
+            // Best-effort recovery of objective/test command from prior check summary
+            // (probe matrix rows are not reconstructed here; probes come from sandbox_jobs).
+            if ((!probes || probes.length === 0) && checkRun.output?.summary) {
+                const summary = checkRun.output.summary;
+                const goalMatch = summary.match(/\*\*Objective:\*\*\s*(.+)/);
+                if (goalMatch)
+                    verificationGoal = goalMatch[1].trim();
+                const cmdMatch = summary.match(/\*\*Baseline Command:\*\*\s*`([^`]+)`/);
+                if (cmdMatch)
+                    testCommand = cmdMatch[1];
+            }
             await context.octokit.issues.createComment({
                 owner,
                 repo: repoName,
                 issue_number: pullNumber,
-                body: `✅ **Reproduction Test Committed:** \`${testFileName}\` has been committed directly to branch \`${targetBranch}\` (Commit: \`${newCommit.sha.slice(0, 7)}\`) by @${sender}.`,
+                body: `🔄 **hq-jr** re-dispatching Tier 3 sandbox verification for PR #${pullNumber} (requested by @${sender}).`,
+            });
+            const authToken = await resolveInstallationToken(context.octokit);
+            executeSandboxCheckRun({
+                octokit: context.octokit,
+                owner,
+                repo: repoName,
+                pullNumber,
+                headSha: pr.head.sha,
+                branch,
+                verificationGoal,
+                testCommand,
+                probes,
+                authToken,
+            }).catch((sandboxErr) => {
+                app.log.warn({ sandboxErr, pullNumber }, "Rerun sandbox verification failed");
             });
         }
     });