code-mower 0.5.0b38__tar.gz → 0.5.0b40__tar.gz

{code_mower-0.5.0b38 → code_mower-0.5.0b40}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 0.5.0b38
+Version: 0.5.0b40
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Requires-Python: >=3.11
@@ -103,11 +103,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b38
+pipx install --python python3.12 code-mower==0.5.0b40
 code-mower --version
 ```
 
-`0.5.0b38` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b40` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -150,7 +150,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b38`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b40`.
 
 ## Optional: Plan Before Coding
 
@@ -291,9 +291,9 @@ best?" to "which AI builder plus reviewer loop ships best on this product?" See
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.38` from
+The current public beta is `v0.5.0-beta.40` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b38` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b40` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b38 → code_mower-0.5.0b40}/README.md

@@ -88,11 +88,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b38
+pipx install --python python3.12 code-mower==0.5.0b40
 code-mower --version
 ```
 
-`0.5.0b38` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b40` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -135,7 +135,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b38`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b40`.
 
 ## Optional: Plan Before Coding
 
@@ -276,9 +276,9 @@ best?" to "which AI builder plus reviewer loop ships best on this product?" See
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.38` from
+The current public beta is `v0.5.0-beta.40` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b38` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b40` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b38 → code_mower-0.5.0b40}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-mower"
-version = "0.5.0b38"
+version = "0.5.0b40"
 description = "Multi-reviewer AI code audit orchestration"
 requires-python = ">=3.11"
 readme = "README.md"

{code_mower-0.5.0b38 → code_mower-0.5.0b40}/src/code_mower/__init__.py

@@ -1,3 +1,3 @@
 """Code Mower package."""
 
-__version__ = "0.5.0b38"
+__version__ = "0.5.0b40"

{code_mower-0.5.0b38 → code_mower-0.5.0b40}/src/code_mower/cli.py

@@ -14,7 +14,7 @@ from pathlib import Path
 if __package__ in {None, ""}:
     raise SystemExit(
         "code_mower.cli is a packaged entrypoint. Install Code Mower with "
-        "`pipx install code-mower==0.5.0b38`, or run source checkouts with "
+        "`pipx install code-mower==0.5.0b40`, or run source checkouts with "
         "`PYTHONPATH=src python -m code_mower.cli`."
     )
 

{code_mower-0.5.0b38 → code_mower-0.5.0b40}/src/code_mower/grok_build_audit_pr.py

@@ -39,6 +39,7 @@ DEFAULT_GROK_COMMAND = "grok"
 DEFAULT_GROK_MODE = "grok-build-audit"
 DEFAULT_GROK_OUTPUT_STEM = "grok-build"
 DEFAULT_GROK_DISPLAY_NAME = "Grok Build"
+DEFAULT_GROK_MAX_TURNS = 4
 DEFAULT_GROK_MODEL_ENV = "GROK_MODEL"
 CODE_MOWER_GROK_MODEL_ENV = "CODE_MOWER_GROK_MODEL"
 GROK_AMBIENT_HOME_ENV = "GROK_BUILD_USE_AMBIENT_HOME"
@@ -147,9 +148,34 @@ def _response_text_from_grok_payload(
             parsed_response = raw_payload
     if parsed_response is None:
         parsed_response = gemini_cli_audit_pr.parse_response_json(response_text)
+    if parsed_response is None:
+        parsed_response = _last_verdict_json_object(response_text)
     return response_text, parsed_response
 
 
+def _last_verdict_json_object(text: str) -> Mapping[str, Any] | None:
+    """Recover the final verdict object from chatty multi-turn Grok output."""
+
+    decoder = json.JSONDecoder()
+    candidates: list[Mapping[str, Any]] = []
+    index = 0
+    while index < len(text):
+        if text[index] != "{":
+            index += 1
+            continue
+        try:
+            payload, end = decoder.raw_decode(text[index:])
+        except json.JSONDecodeError:
+            index += 1
+            continue
+        if isinstance(payload, Mapping) and "verdict" in payload and (
+            "findings" in payload or "summary" in payload
+        ):
+            candidates.append(payload)
+        index += max(end, 1)
+    return candidates[-1] if candidates else None
+
+
 def run_grok_build_audit(
     *,
     repo: str,
@@ -161,6 +187,7 @@ def run_grok_build_audit(
     prompt_dir: Path | None = None,
     max_diff_bytes: int = gemini_cli_audit_pr.DEFAULT_MAX_DIFF_BYTES,
     timeout_seconds: int = gemini_cli_audit_pr.DEFAULT_TIMEOUT_SECONDS,
+    grok_max_turns: int = DEFAULT_GROK_MAX_TURNS,
     output_dir: Path | None = None,
     grok_api_key: str | None = None,
     repo_path: Path | None = None,
@@ -234,6 +261,7 @@ def run_grok_build_audit(
     diagnostics["base_ref"] = base_ref if repo_path is not None else None
     diagnostics["cli_transport"] = "prompt_file"
     diagnostics["preserve_ambient_home"] = allow_ambient_home
+    diagnostics["grok_max_turns"] = max(1, grok_max_turns)
 
     started = time.monotonic()
     grok_model = resolve_grok_model()
@@ -263,7 +291,7 @@ def run_grok_build_audit(
             "--disable-web-search",
             "--no-memory",
             "--max-turns",
-            "1",
+            str(max(1, grok_max_turns)),
         ]
         if grok_model:
             grok_args.extend(["--model", grok_model])
@@ -291,6 +319,11 @@ def run_grok_build_audit(
         completed.stdout,
     )
     verdict = gemini_cli_audit_pr._validate_verdict(parsed_response)
+    if verdict.get("parse_failed"):
+        verdict = {
+            **verdict,
+            "summary": "Grok Build response did not contain parseable verdict JSON.",
+        }
     if repo_path is None:
         head_after_meta = gemini_cli_audit_pr.fetch_pull_request(
             repo,
@@ -381,6 +414,15 @@ def main(argv: list[str] | None = None) -> int:
         default=gemini_cli_audit_pr.DEFAULT_MAX_DIFF_BYTES,
     )
     parser.add_argument("--timeout", type=int, default=gemini_cli_audit_pr.DEFAULT_TIMEOUT_SECONDS)
+    parser.add_argument(
+        "--grok-max-turns",
+        type=int,
+        default=DEFAULT_GROK_MAX_TURNS,
+        help=(
+            "Maximum Grok Build agent turns for a PR audit. The smoke probe can "
+            "use one turn, but real audits need enough room to return verdict JSON."
+        ),
+    )
     parser.add_argument("--output-dir", type=Path, default=None)
     parser.add_argument("--json", action="store_true")
     parser.add_argument(
@@ -416,6 +458,7 @@ def main(argv: list[str] | None = None) -> int:
             prompt_dir=args.prompt_dir,
             max_diff_bytes=args.max_diff_bytes,
             timeout_seconds=args.timeout,
+            grok_max_turns=args.grok_max_turns,
             output_dir=args.output_dir,
             grok_api_key=grok_api_key,
             repo_path=args.repo_path,

{code_mower-0.5.0b38 → code_mower-0.5.0b40}/src/code_mower/init.py

@@ -192,7 +192,24 @@ def _audit_token_env(lane: Mapping[str, Any]) -> str:
     return "CODE_MOWER_AUDIT_LABEL_TOKEN"
 
 
+def _token_env_names(lane: Mapping[str, Any]) -> tuple[str, ...]:
+    token_env = lane.get("token_env", [])
+    if isinstance(token_env, str):
+        return (token_env,)
+    if isinstance(token_env, list):
+        return tuple(str(name) for name in token_env)
+    return ()
+
+
+def _bot_author_csv(authors: str, lane: Mapping[str, Any]) -> str:
+    values = [author.strip() for author in authors.split(",") if author.strip()]
+    return ",".join(dict.fromkeys(values))
+
+
 def _authors_env_for_trailer_lane(trailer_lane: str) -> str:
+    lane_config = _load_trailer_lane_config(trailer_lane)
+    if lane_config is not None:
+        return lane_config.authors_env_var
     normalized = trailer_lane.replace("-", "_").upper()
     explicit = {
         "CLAUDE": "CLAUDE_AUDIT_BOT_AUTHORS",
@@ -202,6 +219,36 @@ def _authors_env_for_trailer_lane(trailer_lane: str) -> str:
     return explicit.get(normalized, f"{normalized}_BOT_AUTHORS")
 
 
+def _load_trailer_lane_config(trailer_lane: str) -> Any | None:
+    try:
+        if __package__ in {None, "", "tools"}:
+            from tools.lane_configs import load_lane_config
+        else:  # pragma: no cover - package import path covered by CLI tests.
+            from .lane_configs import load_lane_config
+
+        return load_lane_config(trailer_lane)
+    except (ImportError, ModuleNotFoundError, ValueError):
+        return None
+
+
+def _default_trailer_bot_authors(trailer_lane: str) -> str:
+    lane_config = _load_trailer_lane_config(trailer_lane)
+    if lane_config is not None:
+        return ",".join(lane_config.default_authors)
+    stem = trailer_lane.replace("_", "-")
+    return f"{stem}-audit-bot,{stem}-audit-bot[bot]"
+
+
+def _configured_bot_authors(lane: Mapping[str, Any]) -> str:
+    provider_config = lane.get("provider_config")
+    if not isinstance(provider_config, Mapping):
+        return ""
+    authors = provider_config.get("bot_authors", [])
+    if not isinstance(authors, list):
+        return ""
+    return ",".join(str(author).strip() for author in authors if str(author).strip())
+
+
 def _trailer_prefix_for_lane(trailer_lane: str) -> str:
     return f"{trailer_lane.replace('-', '_').upper()}_AUDIT_STATE"
 
@@ -240,6 +287,7 @@ def _workflow_entry_for_target(
             "package_copy_from": "templates/workflows/saas-reviewer-labeler.yml.j2",
             "adapter": adapter,
             "authors_env": f"{adapter.replace('-', '_').upper()}_BOT_AUTHORS",
+            "bot_authors": _bot_author_csv(_configured_bot_authors(lane), lane),
         }
     return {
         **common,
@@ -249,6 +297,7 @@ def _workflow_entry_for_target(
         "trailer_lane": trailer_lane,
         "trailer_prefix": _trailer_prefix_for_lane(trailer_lane),
         "authors_env": _authors_env_for_trailer_lane(trailer_lane),
+        "bot_authors": _bot_author_csv(_default_trailer_bot_authors(trailer_lane), lane),
     }
 
 
@@ -335,6 +384,11 @@ def _lane_warnings(
         warnings.append(f"{lane_id}: opt-in lane selected by profile")
     if lane.get("trigger_policy") == "manual":
         warnings.append(f"{lane_id}: manual trigger policy; installer must not auto-dispatch")
+    if "GITHUB_TOKEN" in _token_env_names(lane):
+        warnings.append(
+            f"{lane_id}: GITHUB_TOKEN posting comments as github-actions[bot] requires "
+            "an explicit *_BOT_AUTHORS repository variable"
+        )
     if package_mode:
         driver = lane.get("driver")
         if driver in {"local_cli", "hosted_bridge", "api_model"}:
@@ -566,6 +620,7 @@ def _render_workflow_template(text: str, entry: Mapping[str, Any]) -> str:
         "__ADAPTER__": str(entry.get("adapter") or ""),
         "__AUTHORS_ENV__": str(entry.get("authors_env") or ""),
         "__BLOCKED_LABEL__": str(entry.get("blocked_label") or ""),
+        "__BOT_AUTHORS__": str(entry.get("bot_authors") or ""),
         "__DISPLAY_NAME__": str(entry.get("display_name") or ""),
         "__DONE_LABEL__": str(entry.get("done_label") or ""),
         "__LABEL_TOKEN_ENV__": str(entry.get("label_token_env") or ""),

{code_mower-0.5.0b38 → code_mower-0.5.0b40}/src/code_mower/templates/code-mower.example.yml

@@ -112,6 +112,8 @@ lanes:
       - GREPTILE_AUDIT_LABEL_TOKEN
       - GITHUB_TOKEN
     provider_config:
+      # Required by generated issue-comment labeler prefilters. Keep SaaS
+      # reviewer bot authors explicit so unrelated bots cannot spoof labels.
       bot_authors:
         - greptile-apps[bot]
         - greptile-apps

{code_mower-0.5.0b38 → code_mower-0.5.0b40}/src/code_mower/templates/workflows/saas-reviewer-labeler.yml.j2

@@ -10,12 +10,6 @@ on:
     types: [submitted, edited]
   check_run:
     types: [completed]
-  workflow_dispatch:
-    inputs:
-      adapter:
-        description: "SaaS reviewer adapter to classify"
-        required: false
-        default: "__ADAPTER__"
 
 permissions:
   contents: read
@@ -29,10 +23,10 @@ env:
 jobs:
   label:
     if: >-
-      github.event_name == 'workflow_dispatch' ||
       (
         github.event_name == 'issue_comment' &&
-        github.event.issue.pull_request
+        github.event.issue.pull_request &&
+        contains(format(',__BOT_AUTHORS__,{0},', vars.__AUTHORS_ENV__), format(',{0},', github.event.comment.user.login))
       ) ||
       (
         github.event_name == 'issues' &&
@@ -54,5 +48,5 @@ jobs:
           GITHUB_TOKEN: {% raw %}${{ github.token }}{% endraw %}
           __LABEL_TOKEN_ENV__: {% raw %}${{ secrets.__LABEL_TOKEN_ENV__ }}{% endraw %}
           __AUTHORS_ENV__: {% raw %}${{ vars.__AUTHORS_ENV__ }}{% endraw %}
-          REVIEWER_ADAPTER: {% raw %}${{ github.event.inputs.adapter || '__ADAPTER__' }}{% endraw %}
+          REVIEWER_ADAPTER: __ADAPTER__
         run: tools/code_mower saas-reviewer-labeler --adapter "${REVIEWER_ADAPTER}"

{code_mower-0.5.0b38 → code_mower-0.5.0b40}/src/code_mower/templates/workflows/trailer-comment-labeler.yml.j2

@@ -4,12 +4,6 @@ name: __WORKFLOW_NAME__
 on:
   issue_comment:
     types: [created]
-  workflow_dispatch:
-    inputs:
-      lane:
-        description: "Trailer-comment lane to classify"
-        required: false
-        default: "__TRAILER_LANE__"
 
 permissions:
   contents: read
@@ -22,10 +16,10 @@ env:
 jobs:
   label:
     if: >-
-      github.event_name == 'workflow_dispatch' ||
       (
         github.event_name == 'issue_comment' &&
         github.event.issue.pull_request &&
+        contains(format(',__BOT_AUTHORS__,{0},', vars.__AUTHORS_ENV__), format(',{0},', github.event.comment.user.login)) &&
         (
           contains(github.event.comment.body, '__TRAILER_PREFIX__') ||
           contains(github.event.comment.body, '__DISPLAY_NAME__ Audit') ||
@@ -53,5 +47,5 @@ jobs:
           GITHUB_TOKEN: {% raw %}${{ github.token }}{% endraw %}
           __LABEL_TOKEN_ENV__: {% raw %}${{ secrets.__LABEL_TOKEN_ENV__ }}{% endraw %}
           __AUTHORS_ENV__: {% raw %}${{ vars.__AUTHORS_ENV__ }}{% endraw %}
-          TRAILER_LANE: {% raw %}${{ github.event.inputs.lane || '__TRAILER_LANE__' }}{% endraw %}
+          TRAILER_LANE: __TRAILER_LANE__
         run: tools/code_mower trailer-comment-labeler --lane "${TRAILER_LANE}"

{code_mower-0.5.0b38 → code_mower-0.5.0b40}/src/code_mower.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 0.5.0b38
+Version: 0.5.0b40
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Requires-Python: >=3.11
@@ -103,11 +103,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b38
+pipx install --python python3.12 code-mower==0.5.0b40
 code-mower --version
 ```
 
-`0.5.0b38` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b40` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -150,7 +150,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b38`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b40`.
 
 ## Optional: Plan Before Coding
 
@@ -291,9 +291,9 @@ best?" to "which AI builder plus reviewer loop ships best on this product?" See
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.38` from
+The current public beta is `v0.5.0-beta.40` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b38` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b40` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b38 → code_mower-0.5.0b40}/templates/workflows/saas-reviewer-labeler.yml.j2

@@ -10,12 +10,6 @@ on:
     types: [submitted, edited]
   check_run:
     types: [completed]
-  workflow_dispatch:
-    inputs:
-      adapter:
-        description: "SaaS reviewer adapter to classify"
-        required: false
-        default: "__ADAPTER__"
 
 permissions:
   contents: read
@@ -29,10 +23,10 @@ env:
 jobs:
   label:
     if: >-
-      github.event_name == 'workflow_dispatch' ||
       (
         github.event_name == 'issue_comment' &&
-        github.event.issue.pull_request
+        github.event.issue.pull_request &&
+        contains(format(',__BOT_AUTHORS__,{0},', vars.__AUTHORS_ENV__), format(',{0},', github.event.comment.user.login))
       ) ||
       (
         github.event_name == 'issues' &&
@@ -54,5 +48,5 @@ jobs:
           GITHUB_TOKEN: {% raw %}${{ github.token }}{% endraw %}
           __LABEL_TOKEN_ENV__: {% raw %}${{ secrets.__LABEL_TOKEN_ENV__ }}{% endraw %}
           __AUTHORS_ENV__: {% raw %}${{ vars.__AUTHORS_ENV__ }}{% endraw %}
-          REVIEWER_ADAPTER: {% raw %}${{ github.event.inputs.adapter || '__ADAPTER__' }}{% endraw %}
+          REVIEWER_ADAPTER: __ADAPTER__
         run: tools/code_mower saas-reviewer-labeler --adapter "${REVIEWER_ADAPTER}"

{code_mower-0.5.0b38 → code_mower-0.5.0b40}/templates/workflows/trailer-comment-labeler.yml.j2

@@ -4,12 +4,6 @@ name: __WORKFLOW_NAME__
 on:
   issue_comment:
     types: [created]
-  workflow_dispatch:
-    inputs:
-      lane:
-        description: "Trailer-comment lane to classify"
-        required: false
-        default: "__TRAILER_LANE__"
 
 permissions:
   contents: read
@@ -22,10 +16,10 @@ env:
 jobs:
   label:
     if: >-
-      github.event_name == 'workflow_dispatch' ||
       (
         github.event_name == 'issue_comment' &&
         github.event.issue.pull_request &&
+        contains(format(',__BOT_AUTHORS__,{0},', vars.__AUTHORS_ENV__), format(',{0},', github.event.comment.user.login)) &&
         (
           contains(github.event.comment.body, '__TRAILER_PREFIX__') ||
           contains(github.event.comment.body, '__DISPLAY_NAME__ Audit') ||
@@ -53,5 +47,5 @@ jobs:
           GITHUB_TOKEN: {% raw %}${{ github.token }}{% endraw %}
           __LABEL_TOKEN_ENV__: {% raw %}${{ secrets.__LABEL_TOKEN_ENV__ }}{% endraw %}
           __AUTHORS_ENV__: {% raw %}${{ vars.__AUTHORS_ENV__ }}{% endraw %}
-          TRAILER_LANE: {% raw %}${{ github.event.inputs.lane || '__TRAILER_LANE__' }}{% endraw %}
+          TRAILER_LANE: __TRAILER_LANE__
         run: tools/code_mower trailer-comment-labeler --lane "${TRAILER_LANE}"

{code_mower-0.5.0b38 → code_mower-0.5.0b40}/tests/test_provider_local_cli.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
+import json
 import os
+import subprocess
 from pathlib import Path
 
 from code_mower.provider_registry import REFERENCE_PROVIDERS
@@ -403,6 +405,127 @@ def test_grok_build_runner_prefers_code_mower_model_env(monkeypatch) -> None:
     assert grok_build_audit_pr.resolve_grok_model() == "grok-4.6-build"
 
 
+def test_grok_build_runner_uses_configurable_audit_turn_budget(
+    monkeypatch,
+    tmp_path: Path,
+) -> None:
+    calls: list[list[str]] = []
+
+    monkeypatch.setattr(
+        grok_build_audit_pr.gemini_cli_audit_pr,
+        "fetch_pull_request",
+        lambda repo, pr_number, *, token: {"head": {"sha": "abc123"}},
+    )
+    monkeypatch.setattr(
+        grok_build_audit_pr.gemini_cli_audit_pr,
+        "fetch_local_checkout_diff",
+        lambda repo_path, *, base_ref: ("abc123", "diff --git a/a b/a\n"),
+    )
+    monkeypatch.setattr(
+        grok_build_audit_pr.gemini_cli_audit_pr,
+        "_local_head_sha",
+        lambda repo_path: "abc123",
+    )
+    monkeypatch.setattr(
+        grok_build_audit_pr.gemini_cli_audit_pr,
+        "build_prompt",
+        lambda **kwargs: ("review prompt", {}),
+    )
+
+    def fake_run(args, **kwargs):
+        calls.append(list(args))
+        return subprocess.CompletedProcess(
+            args,
+            0,
+            stdout=json.dumps(
+                {
+                    "text": json.dumps(
+                        {
+                            "verdict": "pass",
+                            "summary": "No findings.",
+                            "findings": [],
+                        }
+                    )
+                }
+            ),
+            stderr="",
+        )
+
+    monkeypatch.setattr(grok_build_audit_pr.subprocess, "run", fake_run)
+
+    default_payload = grok_build_audit_pr.run_grok_build_audit(
+        repo="owner/repo",
+        pr_number=7,
+        github_token="token",
+        command="grok",
+        repo_path=tmp_path,
+        allow_ambient_home=True,
+    )
+    custom_payload = grok_build_audit_pr.run_grok_build_audit(
+        repo="owner/repo",
+        pr_number=7,
+        github_token="token",
+        command="grok",
+        repo_path=tmp_path,
+        allow_ambient_home=True,
+        grok_max_turns=8,
+    )
+
+    assert default_payload["diagnostics"]["grok_max_turns"] == 4
+    assert custom_payload["diagnostics"]["grok_max_turns"] == 8
+    assert calls[0][calls[0].index("--max-turns") + 1] == "4"
+    assert calls[1][calls[1].index("--max-turns") + 1] == "8"
+
+
+def test_grok_build_parser_prefers_last_verdict_json() -> None:
+    response_text = """
+    I found a possible issue first.
+    {
+      "verdict": "blocked",
+      "summary": "Intermediate thought.",
+      "findings": [{"severity": "P1", "title": "old", "file": "a", "line": 1, "detail": "old"}]
+    }
+
+    After reading the rest of the diff:
+    {
+      "verdict": "pass",
+      "summary": "Final answer.",
+      "findings": []
+    }
+    """
+
+    _, parsed = grok_build_audit_pr._response_text_from_grok_payload(
+        {"text": response_text},
+        "",
+    )
+
+    assert parsed is not None
+    assert parsed["verdict"] == "pass"
+    assert parsed["findings"] == []
+
+
+def test_grok_build_parser_ignores_nested_verdict_json() -> None:
+    response_text = """
+    {
+      "verdict": "pass",
+      "summary": {
+        "verdict": "blocked",
+        "summary": "Nested diagnostic text should not win."
+      },
+      "findings": []
+    }
+    """
+
+    _, parsed = grok_build_audit_pr._response_text_from_grok_payload(
+        {"text": response_text},
+        "",
+    )
+
+    assert parsed is not None
+    assert parsed["verdict"] == "pass"
+    assert parsed["findings"] == []
+
+
 def test_provider_lane_tool_provenance_marks_hosted_model_as_vendor_hidden() -> None:
     lane = {
         "driver": "saas_event",