code-mower 0.5.0b41__tar.gz → 0.5.0b43__tar.gz

{code_mower-0.5.0b41 → code_mower-0.5.0b43}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-mower
-Version: 0.5.0b41
+Version: 0.5.0b43
 Summary: Multi-reviewer AI code audit orchestration
 License-Expression: Apache-2.0
 Requires-Python: >=3.11
@@ -103,11 +103,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b41
+pipx install --python python3.12 code-mower==0.5.0b43
 code-mower --version
 ```
 
-`0.5.0b41` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b43` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -155,7 +155,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b41`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b43`.
 
 ## Optional: Plan Before Coding
 
@@ -310,9 +310,9 @@ builder provenance, start with
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.41` from
+The current public beta is `v0.5.0-beta.43` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b41` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b43` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b41 → code_mower-0.5.0b43}/README.md

@@ -88,11 +88,11 @@ Code Mower currently targets Python 3.11+; Python 3.12 is recommended.
 
 ```bash
 python3.12 --version
-pipx install --python python3.12 code-mower==0.5.0b41
+pipx install --python python3.12 code-mower==0.5.0b43
 code-mower --version
 ```
 
-`0.5.0b41` is a beta release. Until Code Mower publishes a stable `1.0`
+`0.5.0b43` is a beta release. Until Code Mower publishes a stable `1.0`
 line, use the explicit beta version above or allow prereleases with:
 
 ```bash
@@ -140,7 +140,7 @@ First-time command map: [docs/launch-command-surface.md](docs/launch-command-sur
 
 The current PyPI beta has been rehearsed end-to-end from a clean install:
 [First-User Install Rehearsal](docs/first-user-install-rehearsal.md) records
-the latest 10/10 public-package readiness proof for `code-mower==0.5.0b41`.
+the latest 10/10 public-package readiness proof for `code-mower==0.5.0b43`.
 
 ## Optional: Plan Before Coding
 
@@ -295,9 +295,9 @@ builder provenance, start with
 
 ## Installation Status
 
-The current public beta is `v0.5.0-beta.41` from
+The current public beta is `v0.5.0-beta.43` from
 [codemower-ai/code-mower](https://github.com/codemower-ai/code-mower), published
-as `code-mower==0.5.0b41` on [PyPI](https://pypi.org/project/code-mower/).
+as `code-mower==0.5.0b43` on [PyPI](https://pypi.org/project/code-mower/).
 GitHub releases remain the auditable source for tags, build artifacts, and
 release notes.
 

{code_mower-0.5.0b41 → code_mower-0.5.0b43}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-mower"
-version = "0.5.0b41"
+version = "0.5.0b43"
 description = "Multi-reviewer AI code audit orchestration"
 requires-python = ">=3.11"
 readme = "README.md"

{code_mower-0.5.0b41 → code_mower-0.5.0b43}/src/code_mower/__init__.py

@@ -1,3 +1,3 @@
 """Code Mower package."""
 
-__version__ = "0.5.0b41"
+__version__ = "0.5.0b43"

{code_mower-0.5.0b41 → code_mower-0.5.0b43}/src/code_mower/audit_labeler_lib.py

@@ -17,12 +17,16 @@ import urllib.error
 import urllib.request
 from dataclasses import dataclass
 from pathlib import Path
-from typing import Any, Dict, Mapping, Optional, Pattern, Sequence
+from typing import Any, Callable, Dict, Mapping, Optional, Pattern, Sequence
 from urllib.parse import quote
 import re
 
 MIN_ABBREVIATED_SHA_LENGTH = 7
 AUTHOR_EXCLUSION_ENV = "CODE_MOWER_AUTHOR_EXCLUSION_JSON"
+ACTIONS_RUN_MARKER_RE = re.compile(
+    r"<!--\s*CODE_MOWER_AUDIT_RUN:\s*run_id=([0-9]+)\s*-->"
+)
+TRUSTED_ACTIONS_AUDIT_EVENTS = frozenset({"pull_request_target"})
 
 
 @dataclass(frozen=True)
@@ -291,6 +295,130 @@ def github_request_with_fallback(
     raise RuntimeError(f"no GitHub tokens available for {method} {path}")
 
 
+def parse_csv_set(raw: str) -> frozenset[str]:
+    return frozenset(item.strip() for item in raw.split(",") if item.strip())
+
+
+def parse_audit_run_id(body: str) -> str:
+    match = ACTIONS_RUN_MARKER_RE.search(body)
+    return match.group(1) if match else ""
+
+
+def workflow_path_matches(path: str, trusted_workflows: Sequence[str]) -> bool:
+    if not path:
+        return False
+    return any(path == item or path.endswith("/" + item) for item in trusted_workflows)
+
+
+def _pr_item_matches_head(
+    item: Mapping[str, Any],
+    *,
+    issue_number: int,
+    head_sha: str,
+    fallback_head_sha: str = "",
+) -> bool:
+    if str(item.get("number") or "") != str(issue_number):
+        return False
+    pr_head = str(((item.get("head") or {}).get("sha")) or "")
+    if pr_head:
+        return sha_matches(pr_head, head_sha)
+    return bool(fallback_head_sha) and sha_matches(fallback_head_sha, head_sha)
+
+
+def fetch_actions_run(
+    repo: str,
+    run_id: str,
+    *,
+    tokens: Sequence[GitHubToken],
+) -> dict[str, Any]:
+    response = github_request_with_fallback(
+        "GET",
+        f"/repos/{repo}/actions/runs/{run_id}",
+        tokens=tokens,
+    )
+    return response if isinstance(response, dict) else {}
+
+
+def fetch_pull_requests_for_commit(
+    repo: str,
+    head_sha: str,
+    *,
+    tokens: Sequence[GitHubToken],
+) -> list[dict[str, Any]]:
+    response = github_request_with_fallback(
+        "GET",
+        f"/repos/{repo}/commits/{head_sha}/pulls?per_page=100",
+        tokens=tokens,
+    )
+    return response if isinstance(response, list) else []
+
+
+def github_actions_comment_attested(
+    *,
+    repo: str,
+    body: str,
+    issue_number: int,
+    head_sha: str,
+    workflow_paths: Sequence[str],
+    tokens: Sequence[GitHubToken],
+    actions_run_lookup: Optional[Callable[[str], Mapping[str, Any]]] = None,
+    commit_pull_requests_lookup: Optional[Callable[[str], Sequence[Mapping[str, Any]]]] = None,
+) -> bool:
+    """Return whether a github-actions[bot] audit comment is tied to this PR head."""
+    trusted_workflows = tuple(parse_csv_set(",".join(workflow_paths)))
+    token_list = tuple(token for token in tokens if token.value)
+    run_id = parse_audit_run_id(body)
+    if not trusted_workflows or not token_list or not run_id or not head_sha:
+        return False
+    try:
+        if actions_run_lookup is None:
+            run = fetch_actions_run(repo, run_id, tokens=token_list)
+        else:
+            run = dict(actions_run_lookup(run_id))
+    except Exception:
+        return False
+
+    path = str(run.get("path") or "")
+    if not workflow_path_matches(path, trusted_workflows):
+        return False
+    if str(run.get("event") or "") not in TRUSTED_ACTIONS_AUDIT_EVENTS:
+        return False
+
+    run_head_sha = str(run.get("head_sha") or "")
+    pull_requests = run.get("pull_requests")
+    if isinstance(pull_requests, list) and pull_requests:
+        return any(
+            isinstance(item, Mapping)
+            and _pr_item_matches_head(
+                item,
+                issue_number=issue_number,
+                head_sha=head_sha,
+                fallback_head_sha=run_head_sha,
+            )
+            for item in pull_requests
+        )
+    if not run_head_sha or not sha_matches(run_head_sha, head_sha):
+        return False
+
+    try:
+        if commit_pull_requests_lookup is None:
+            associated_prs = fetch_pull_requests_for_commit(repo, run_head_sha, tokens=token_list)
+        else:
+            associated_prs = commit_pull_requests_lookup(run_head_sha)
+    except Exception:
+        return False
+    return any(
+        isinstance(item, Mapping)
+        and _pr_item_matches_head(
+            item,
+            issue_number=issue_number,
+            head_sha=head_sha,
+            fallback_head_sha=run_head_sha,
+        )
+        for item in associated_prs
+    )
+
+
 def fetch_pull_request(
     repo: str,
     issue_number: int,

{code_mower-0.5.0b41 → code_mower-0.5.0b43}/src/code_mower/claude_audit_pr.py

@@ -36,6 +36,7 @@ if __package__ in {None, "", "tools"}:
             fetch_pull_request,
             fetch_base_ref_sha as _shared_fetch_base_ref_sha,
             fetch_pr_head_sha as _shared_fetch_pr_head_sha,
+            fetch_pr_head_sha_unless_local_matches as _shared_fetch_pr_head_sha_unless_local_matches,
             limit_comment_body,
             one_line as _one_line,
             parse_repo_paths as _parse_repo_paths,
@@ -61,6 +62,7 @@ if __package__ in {None, "", "tools"}:
             fetch_pull_request,
             fetch_base_ref_sha as _shared_fetch_base_ref_sha,
             fetch_pr_head_sha as _shared_fetch_pr_head_sha,
+            fetch_pr_head_sha_unless_local_matches as _shared_fetch_pr_head_sha_unless_local_matches,
             limit_comment_body,
             one_line as _one_line,
             parse_repo_paths as _parse_repo_paths,
@@ -84,6 +86,7 @@ else:  # pragma: no cover - exercised after package extraction.
         fetch_base_ref_sha as _shared_fetch_base_ref_sha,
         fetch_pull_request,
         fetch_pr_head_sha as _shared_fetch_pr_head_sha,
+        fetch_pr_head_sha_unless_local_matches as _shared_fetch_pr_head_sha_unless_local_matches,
         limit_comment_body,
         one_line as _one_line,
         parse_repo_paths as _parse_repo_paths,
@@ -109,10 +112,16 @@ MAX_SUMMARY_CHARS = 4_000
 MAX_FINDING_TITLE_CHARS = 300
 MAX_FINDING_FILE_CHARS = 500
 MAX_FINDING_DETAIL_CHARS = 4_000
+MAX_CLAUDE_AUDIT_ATTEMPTS = 2
+MIN_BLOCKED_VERDICT_PROSE_CHARS = 80
+SCHEMA_PLACEHOLDER_TEXT = frozenset({"test", "example", "placeholder"})
+CLAUDE_RAW_OUTPUT_SCHEMA = "code_mower.claudeAuditRawOutput.v1"
+BLOCKER_SEVERITIES = frozenset({"P0", "P1", "P2"})
 
 STALE_TRAILER = "<!-- CLAUDE_AUDIT_STATE: needs-claude-audit -->"
 DONE_TRAILER = "<!-- CLAUDE_AUDIT_STATE: claude-audit-done -->"
 BLOCKED_TRAILER = "<!-- CLAUDE_AUDIT_STATE: claude-audit-blocked -->"
+AUDIT_RUN_TRAILER_PREFIX = "<!-- CODE_MOWER_AUDIT_RUN:"
 
 
 CLAUDE_VERDICT_SCHEMA: Dict[str, Any] = {
@@ -177,6 +186,8 @@ class ClaudeVerdict:
     p2_count: int = 0
     p3_count: int = 0
     mismatch_note: str = ""
+    summary: str = ""
+    findings: Tuple[Dict[str, Any], ...] = field(default_factory=tuple)
 
     @property
     def blocker_count(self) -> int:
@@ -203,6 +214,7 @@ class ClaudeAuditResult:
 class DiffContext:
     stat: str
     diff: str
+    changed_files: Tuple[str, ...]
     was_truncated: bool
     requested_max_bytes: int
     hard_limit_bytes: int
@@ -333,7 +345,7 @@ def parse_structured_claude_verdict(data: Any) -> ClaudeVerdict:
 
         p_counts[int(severity[1])] += 1
         if len(rendered_findings) < MAX_RENDERED_FINDINGS:
-            rendered_findings.append(raw_finding)
+            rendered_findings.append(dict(raw_finding))
 
     blocker_count = p_counts[0] + p_counts[1] + p_counts[2]
     if blocker_count > 0:
@@ -358,9 +370,139 @@ def parse_structured_claude_verdict(data: Any) -> ClaudeVerdict:
         p2_count=p_counts[2],
         p3_count=p_counts[3],
         mismatch_note=mismatch_note,
+        summary=summary,
+        findings=tuple(dict(finding) for finding in raw_findings),
     )
 
 
+def _placeholder_equal(value: object) -> bool:
+    return str(value or "").strip().lower() in SCHEMA_PLACEHOLDER_TEXT
+
+
+def _normalize_diff_path(value: object) -> str:
+    path = str(value or "").strip().replace("\\", "/")
+    while path.startswith("./"):
+        path = path[2:]
+    if path.startswith(("a/", "b/")):
+        path = path[2:]
+    return path
+
+
+def _diff_file_matches(file_path: str, allowed_files: set[str]) -> bool:
+    if file_path in allowed_files:
+        return True
+    suffix_matches = [
+        path
+        for path in allowed_files
+        if path.endswith(f"/{file_path}") or file_path.endswith(f"/{path}")
+    ]
+    return len(suffix_matches) == 1
+
+
+def _claude_verdict_guardrail_reason(
+    parsed: ClaudeVerdict,
+    changed_files: Tuple[str, ...],
+) -> Optional[str]:
+    if parsed.verdict == "UNKNOWN":
+        return None
+
+    if _placeholder_equal(parsed.summary):
+        return "structured verdict summary matched a schema placeholder value"
+
+    allowed_files = {_normalize_diff_path(path) for path in changed_files}
+    allowed_files.discard("")
+    for idx, finding in enumerate(parsed.findings):
+        where = f"findings[{idx}]"
+        if _placeholder_equal(finding.get("title")):
+            return f"{where}.title matched a schema placeholder value"
+        if _placeholder_equal(finding.get("detail")):
+            return f"{where}.detail matched a schema placeholder value"
+
+        file_path = _normalize_diff_path(finding.get("file"))
+        severity = str(finding.get("severity") or "")
+        if (
+            severity in BLOCKER_SEVERITIES
+            and (not file_path or not _diff_file_matches(file_path, allowed_files))
+        ):
+            return f"{where}.file {file_path!r} is not present in the PR diff"
+
+    if (
+        parsed.verdict == "BLOCKED"
+        and len(parsed.prose.strip()) < MIN_BLOCKED_VERDICT_PROSE_CHARS
+    ):
+        return "structured blocked verdict body is too short to be credible"
+
+    return None
+
+
+def _apply_claude_verdict_guardrails(
+    parsed: ClaudeVerdict,
+    changed_files: Tuple[str, ...],
+) -> Tuple[ClaudeVerdict, Optional[str]]:
+    reason = _claude_verdict_guardrail_reason(parsed, changed_files)
+    if reason is None:
+        return parsed, None
+    return _unknown_structured_verdict(reason), reason
+
+
+def _write_claude_raw_output_sidecar(
+    artifact_path: Optional[Path],
+    attempts: List[Dict[str, Any]],
+) -> None:
+    if artifact_path is None:
+        return
+    sidecar_path = artifact_path.with_suffix(".claude-raw-output.json")
+    payload = {"schema": CLAUDE_RAW_OUTPUT_SCHEMA, "attempts": attempts}
+    try:
+        text = json.dumps(payload, indent=2, sort_keys=True) + "\n"
+        sidecar_path.write_text(text, encoding="utf-8")
+    except OSError as exc:
+        print(
+            f"warning: failed to write Claude raw output sidecar {sidecar_path}: {exc}",
+            file=sys.stderr,
+        )
+
+
+def _guardrail_retry_prompt(
+    prompt: str,
+    reason: str,
+    changed_files: Tuple[str, ...],
+) -> str:
+    files = "\n".join(f"- {path}" for path in changed_files[:50])
+    if len(changed_files) > 50:
+        files += f"\n- ... {len(changed_files) - 50} additional file(s) omitted"
+    return (
+        f"{prompt.rstrip()}\n\n"
+        "Trusted wrapper retry instruction:\n"
+        f"The previous structured verdict was rejected: {reason}. "
+        "Return a fresh JSON verdict only. Do not use placeholder values such "
+        "as 'test', 'example', or 'placeholder'. P0/P1/P2 findings must cite a "
+        "file from the PR diff, using the repository-relative path or a unique "
+        "suffix. PR diff files:\n"
+        f"{files}\n"
+    )
+
+
+def _record_posted_comment_url(
+    artifact_path: Optional[Path],
+    posted_comment_url: Optional[str],
+) -> None:
+    if artifact_path is None or not posted_comment_url:
+        return
+    try:
+        payload = json.loads(artifact_path.read_text(encoding="utf-8"))
+        if not isinstance(payload, dict):
+            return
+        payload["posted_comment_url"] = posted_comment_url
+        text = json.dumps(payload, indent=2, sort_keys=True) + "\n"
+        artifact_path.write_text(text, encoding="utf-8")
+    except (OSError, json.JSONDecodeError) as exc:
+        print(
+            f"warning: failed to update audit verdict artifact {artifact_path}: {exc}",
+            file=sys.stderr,
+        )
+
+
 def _claude_env() -> Dict[str, str]:
     preserve_auth_overrides = env_flag(os.environ.get("CODE_MOWER_CLAUDE_KEEP_AUTH_ENV"))
     env, _removed = clean_claude_cli_env(
@@ -387,7 +529,17 @@ def _fetch_base_sha_for_diff(local_repo: Path, base_ref: str) -> str:
     return _shared_fetch_base_ref_sha(local_repo, base_ref)
 
 
-def _fetch_pr_head_sha_for_diff(local_repo: Path, pr_number: int) -> str:
+def _fetch_pr_head_sha_for_diff(
+    local_repo: Path,
+    pr_number: int,
+    expected_head_sha: str | None = None,
+) -> str:
+    if expected_head_sha:
+        return _shared_fetch_pr_head_sha_unless_local_matches(
+            local_repo,
+            pr_number,
+            expected_head_sha=expected_head_sha,
+        )
     return _shared_fetch_pr_head_sha(local_repo, pr_number)
 
 
@@ -482,11 +634,22 @@ def _build_diff_context(
         )
 
     fetched_base_ref = _fetch_base_sha_for_diff(local_repo, base_ref)
-    fetched_head_ref = _fetch_pr_head_sha_for_diff(local_repo, pr_number)
+    fetched_head_ref = _fetch_pr_head_sha_for_diff(
+        local_repo,
+        pr_number,
+        expected_head_sha=expected_head_sha,
+    )
     if fetched_head_ref.lower() != expected_head_sha.lower():
         raise FetchedHeadMismatch(expected_head_sha, fetched_head_ref)
     diff_range = f"{fetched_base_ref}...{fetched_head_ref}"
     stat = _run_git(local_repo, ["diff", "--stat", "--find-renames", diff_range])
+    changed_files_text = _run_git(
+        local_repo,
+        ["-c", "core.quotePath=false", "diff", "--name-only", "--find-renames", diff_range],
+    )
+    changed_files = tuple(
+        line.strip() for line in changed_files_text.splitlines() if line.strip()
+    )
     included_diff, full_diff_bytes, was_truncated = _run_git_limited(
         local_repo,
         ["diff", "--find-renames", "--unified=80", diff_range],
@@ -500,6 +663,7 @@ def _build_diff_context(
     return DiffContext(
         stat=stat,
         diff=included_diff,
+        changed_files=changed_files,
         was_truncated=was_truncated,
         requested_max_bytes=max_diff_bytes,
         hard_limit_bytes=hard_limit,
@@ -705,10 +869,13 @@ def format_comment(
     stale_end_sha: Optional[str] = None,
     is_unknown: bool = False,
     merge_authority: bool = True,
+    actions_run_id: Optional[str] = None,
 ) -> str:
     posture = "merge-authority lane" if merge_authority else "informational only"
     header = f"## Claude audit ({posture})\n\n"
     header += f"Head SHA: `{head_sha}`\n"
+    if actions_run_id:
+        header += f"{AUDIT_RUN_TRAILER_PREFIX} run_id={actions_run_id} -->\n"
     if is_stale:
         body = (
             header
@@ -848,6 +1015,10 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
                 )
             posted = post_pr_comment(repo, pr_number, comment_body, token=config.github_token)
             result.posted_comment_url = posted.get("html_url")
+            _record_posted_comment_url(
+                result.verdict_artifact_path,
+                result.posted_comment_url,
+            )
             print(
                 f"posted {repo}#{pr_number} verdict=STALE "
                 f"url={result.posted_comment_url}",
@@ -906,8 +1077,46 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
         ),
     )
 
+    raw_output_attempts: List[Dict[str, Any]] = []
+    parsed = _unknown_structured_verdict("Claude audit did not run")
+    claude_stdout = ""
+    claude_stderr = ""
+    attempt_prompt = prompt
     t0 = time.time()
-    parsed, claude_stdout, claude_stderr = run_claude_audit(config, prompt)
+    for attempt in range(1, MAX_CLAUDE_AUDIT_ATTEMPTS + 1):
+        parsed_candidate, attempt_stdout, attempt_stderr = run_claude_audit(
+            config,
+            attempt_prompt,
+        )
+        claude_stdout = attempt_stdout
+        claude_stderr = attempt_stderr
+        parsed, guardrail_reason = _apply_claude_verdict_guardrails(
+            parsed_candidate,
+            diff_context.changed_files,
+        )
+        raw_output_attempts.append(
+            {
+                "attempt": attempt,
+                "stdout": attempt_stdout,
+                "stderr": attempt_stderr,
+                "verdict": parsed_candidate.verdict,
+                "guardrail_rejection": guardrail_reason,
+            }
+        )
+        if guardrail_reason and attempt < MAX_CLAUDE_AUDIT_ATTEMPTS:
+            print(
+                "  structured-verdict guardrail rejected Claude output: "
+                f"{guardrail_reason}; retrying once",
+                file=sys.stderr,
+                flush=True,
+            )
+            attempt_prompt = _guardrail_retry_prompt(
+                prompt,
+                guardrail_reason,
+                diff_context.changed_files,
+            )
+            continue
+        break
     dt = time.time() - t0
     print(f"  claude audit completed in {dt:.0f}s", file=sys.stderr, flush=True)
     if parsed.mismatch_note:
@@ -916,6 +1125,7 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
     pr_meta_after = fetch_pull_request(repo, pr_number, token=config.github_token)
     head_sha_end = pr_meta_after["head"]["sha"]
     is_stale = head_sha_start != head_sha_end
+    actions_run_id = os.environ.get("GITHUB_RUN_ID") or None
 
     if is_stale:
         comment_body = format_comment(
@@ -924,6 +1134,7 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
             is_stale=True,
             stale_end_sha=head_sha_end,
             merge_authority=config.merge_authority,
+            actions_run_id=actions_run_id,
         )
         result_verdict = "STALE"
         trailer = STALE_TRAILER
@@ -933,6 +1144,7 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
             head_sha_start,
             is_unknown=True,
             merge_authority=config.merge_authority,
+            actions_run_id=actions_run_id,
         )
         result_verdict = "UNKNOWN"
         trailer = STALE_TRAILER
@@ -941,6 +1153,7 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
             parsed,
             head_sha_start,
             merge_authority=config.merge_authority,
+            actions_run_id=actions_run_id,
         )
         result_verdict = parsed.verdict
         trailer = BLOCKED_TRAILER if parsed.verdict == "BLOCKED" else DONE_TRAILER
@@ -976,8 +1189,13 @@ def audit_pr(config: ClaudeAuditConfig, repo: str, pr_number: int) -> ClaudeAudi
                 file=sys.stderr,
                 flush=True,
             )
+            _write_claude_raw_output_sidecar(artifact_path, raw_output_attempts)
         posted = post_pr_comment(repo, pr_number, comment_body, token=config.github_token)
         result.posted_comment_url = posted.get("html_url")
+        _record_posted_comment_url(
+            result.verdict_artifact_path,
+            result.posted_comment_url,
+        )
         print(
             f"posted {repo}#{pr_number} verdict={result_verdict} "
             f"url={result.posted_comment_url}",

{code_mower-0.5.0b41 → code_mower-0.5.0b43}/src/code_mower/cli.py

@@ -14,7 +14,7 @@ from pathlib import Path
 if __package__ in {None, ""}:
     raise SystemExit(
         "code_mower.cli is a packaged entrypoint. Install Code Mower with "
-        "`pipx install code-mower==0.5.0b41`, or run source checkouts with "
+        "`pipx install code-mower==0.5.0b43`, or run source checkouts with "
         "`PYTHONPATH=src python -m code_mower.cli`."
     )
 

{code_mower-0.5.0b41 → code_mower-0.5.0b43}/src/code_mower/cloud.py

@@ -418,6 +418,12 @@ def main(argv: list[str] | None = None) -> int:
         default=MAX_EVENT_COUNT,
         help=f"number of verdict artifacts to include; max {MAX_EVENT_COUNT}",
     )
+    reviewer_runs.add_argument(
+        "--offset",
+        type=int,
+        default=0,
+        help="skip this many newest matching verdict artifacts before applying --limit",
+    )
     reviewer_runs.add_argument(
         "--include-git-ref",
         action="store_true",
@@ -674,6 +680,7 @@ def main(argv: list[str] | None = None) -> int:
                 team_id=args.team_id,
                 install_id=args.install_id,
                 limit=args.limit,
+                offset=args.offset,
                 endpoint=args.endpoint,
                 token_env=args.token_env,
                 yes=args.yes,