feat(renderer): --verify-model for a per-pass reflection model

codegoose-setup.yaml

@@ -57,6 +57,16 @@ parameters:
       gpt-4o for openai, anthropic/claude-sonnet-4 for openrouter,
       accounts/fireworks/models/deepseek-v4-flash-0731 for fireworks-ai)
 
+  - key: goose_verify_model
+    input_type: string
+    requirement: optional
+    default: ""
+    description: >
+      Optional model for the verification (reflection) pass only.
+      Leave empty to reuse goose_model for both passes (default).
+      Example for fireworks-ai:
+      accounts/fireworks/models/glm-5p3-flash
+
   - key: verification_gate
     input_type: select
     requirement: required
@@ -110,6 +120,7 @@ prompt: |
   - review_style: {{ review_style }}
   - ci_provider: {{ ci_provider }}
   - goose_model: {{ goose_model }}
+  - goose_verify_model: {{ goose_verify_model }} (empty = same as goose_model)
   - verification_gate: {{ verification_gate }}
   - verify_gate_profile: {{ verify_gate_profile }}
   (Provider -> secret name: ollama_cloud=OLLAMA_CLOUD_API_KEY,
@@ -153,6 +164,19 @@ prompt: |
   - Status (created/updated) + config file path, and that it was rendered by the
     deterministic pipeline (not authored by the LLM).
   - GOOSE_MODEL: {{ goose_model }} (hardcoded into the config by the renderer).
+  - Verification model: {{ goose_verify_model }} — the model the reflection
+    pass uses. GITHUB ONLY: the renderer rejects --verify-model on
+    gitlab/gitea/teamcity (exit 2), so if {{ ci_platform }} is not github
+    and the user set a value, report the constraint and RE-RUN WITHOUT the
+    flag instead of passing it. If the user left it empty, run the Step 2
+    command exactly as written (both passes then use GOOSE_MODEL; never
+    pass an empty --verify-model value — it would swallow the next flag).
+    If set AND the platform is github, ADD one line into the Step 2 command
+    right after --model:
+    --verify-model {{ goose_verify_model }} \\
+    (keep the trailing \\ continuation; must be a model from the SAME
+    provider {{ ci_provider }} — the rewritten config keeps the review
+    provider).
   - Provider secret that the user must add, e.g. for {{ ci_provider }} the
     required repo secret name from the mapping above.
   - How to trigger: open/update a pull request; CI posts the {{ review_style }}

scripts/render.py

@@ -16,7 +16,7 @@
 base URL that render.py used (release-only distribution model).
 
 Placeholders (all __UPPER__):
-  __PROVIDER__ __GOOSE_MODEL__ __LANGUAGE__ __API_KEY_NAME__
+  __PROVIDER__ __GOOSE_MODEL__ __GOOSE_VERIFY_MODEL__ __LANGUAGE__ __API_KEY_NAME__
   __VERIFY_PROFILE__ __VERIFY_MODE__ (verification gate, on/shadow only)
   __STYLE_ASSET__ (asset basename, e.g. instructions.graded.md; the
     rendered config downloads it at CI runtime and substitutes
@@ -28,7 +28,9 @@
   off    the #[verify:begin]/#[verify:end] marked region is REMOVED
   The reflection instructions (instructions.reflection.md asset) are
   downloaded at CI runtime with the same pattern as inline_threads.py,
-  so a single model/provider/config serves both passes.
+  so a single model/provider/config serves both passes unless
+  --verify-model overrides __GOOSE_VERIFY_MODEL__ (the reflection
+  pass rewrites the config before its first goose invocation).
 """
 import argparse
 import os
@@ -191,6 +193,11 @@ def main():
     ap.add_argument("platform", choices=list(SOURCES))
     ap.add_argument("--provider", required=True)
     ap.add_argument("--model", required=True)
+    ap.add_argument("--verify-model", default=None,
+                    help="model for the verification (reflection) pass; "
+                         "defaults to --model (single-model behavior). "
+                         "GitHub workflows only — rejected elsewhere. "
+                         "With --verification off the value is unused")
     ap.add_argument("--style", required=True, choices=["graded-review", "changes-summary"])
     ap.add_argument("--language", default="Korean")
     ap.add_argument("--local", action="store_true",
@@ -210,6 +217,36 @@ def main():
         print(f"FAIL: unknown provider {args.provider}")
         return 2
 
+    if args.verify_model and args.platform != "github":
+        # The __GOOSE_VERIFY_MODEL__ switch only exists in the GitHub workflow
+        # template; on other platforms the flag would silently no-op and the
+        # reflection pass would keep the review model. Fail loud instead.
+        print("FAIL: --verify-model is only supported on the github platform")
+        return 2
+    if args.verify_model and args.verification == "off":
+        # --verification off strips the whole verify region including the
+        # model switch, so --verify-model would be dead input. Warn (not
+        # fail): the render is still valid, the user just gave a no-op value.
+        print("WARN: --verify-model has no effect with --verification off")
+    # Cheap prefix heuristic: warn when the verify model id looks like it
+    # belongs to a different provider than the one configured. The rewritten
+    # config keeps the REVIEW provider, so a mismatched model id fails at
+    # runtime — and the reflection gate fails open (review still posts).
+    # This is a heuristic, not a catalog check: unknown prefixes pass.
+    if args.verify_model and args.verify_model != args.model:
+        _pfx = {"fireworks-ai": "accounts/fireworks/models/",
+                "openai": ["gpt-", "o1", "o3", "chatgpt"],
+                "anthropic": ["claude-"],
+                "openrouter": [],
+                "ollama_cloud": []}
+        _own = _pfx.get(provider, [])
+        _own_list = _own if isinstance(_own, list) else [_own]
+        if _own_list and not any(args.verify_model.startswith(p) for p in _own_list):
+            _foreign = [name for name, pfx in _pfx.items()
+                        if name != provider and any(args.verify_model.startswith(p) for p in (pfx if isinstance(pfx, list) else [pfx]))]
+            if _foreign:
+                print(f"WARN: --verify-model looks like a {_foreign[0]} model but the config keeps provider {provider} — the reflection pass will fail auth if the provider does not serve it")
+
     spec = SOURCES[args.platform]
     if args.local:
         # Development mode: render straight from the working-tree templates
@@ -239,6 +276,7 @@ def main():
         ("__RECIPES_BASE__", release_base()),
         ("__PROVIDER__", provider),
         ("__GOOSE_MODEL__", args.model),
+        ("__GOOSE_VERIFY_MODEL__", args.verify_model or args.model),
         ("__API_KEY_NAME__", API_KEY_NAMES[provider]),
         ("__VERIFY_PROFILE__", args.verify_profile),
         ("__VERIFY_MODE__", verify_mode),

templates/github.workflow.yml

@@ -169,6 +169,15 @@ jobs:
               python3 verify_findings.py hunks --diff pr.diff --findings findings.json --out hunks.txt
               cat hunks.txt
             } >> reflection_input.txt
+            # Verify-model switch (render.py --verify-model): swap ONLY the
+            # GOOSE_MODEL line for the reflection + retry invocations. Runs
+            # only here — findings exist. (A head-move after this point is
+            # tolerated: the post step's live guard skips a stale review.)
+            # When --verify-model is unset the substituted value equals the
+            # review model and this sed is a value no-op. sed (not a full
+            # rewrite) so keys added to Configure goose by future releases
+            # survive into the reflection pass.
+            sed -i.bak 's|^GOOSE_MODEL: .*|GOOSE_MODEL: __GOOSE_VERIFY_MODEL__|' ~/.config/goose/config.yaml && rm -f ~/.config/goose/config.yaml.bak
             goose run --instructions reflection_input.txt > reflect_raw.txt
             if python3 verify_findings.py reflect-parse --raw reflect_raw.txt --out scores.json; then
               python3 verify_findings.py merge --body body.md --scores scores.json \