Actions, Selectors & Value Sources Reference

Complete visual reference of all available step action types, selector engines, and value source providers.

Web UI & Browser Actions

Action	Type	Description & Parameters
LAUNCH	Browser	Opens the target URL in the browser.
CLICK	Mouse	Clicks the element.
DOUBLE_TAP	Mouse	Double-clicks the element.
RIGHT_CLICK	Mouse	Right-clicks the element (opens its context menu).
HOVER	Mouse	Moves the pointer over the element to open a flyout or tooltip.
DRAG_DROP	Mouse	Drags the element onto another. The value is the CSS selector of the drop target.
SCROLL	Window	Scrolls the page, or the element you name, to a position. The value is x,y in pixels, top or bottom. With an element and no value it scrolls the element into view.
ENTER_VALUE / INPUT_TEXT	Keyboard	Types a value into the field (fills it; works in rich-text editors too). A value can read from the Vault: use the Vault value source and the secret’s name.
CLEAR_INPUT_TEXT	Keyboard	Clears the field.
PRESS_KEY	Keyboard	Presses a key or shortcut on the page, for example Tab, ArrowDown or Control+k.
PRESS_ENTER_KEY / PRESS_ESCAPE_KEY	Keyboard	Presses Enter or Escape.
DROPDOWN / DROPDOWN_MULTISELECT	Form	Selects an option (or several) by value or text.
CHECK / UNCHECK	Form	Ticks or clears a checkbox or radio button.
UPLOAD_FILE	Form	Uploads a file to a file input. The value is the path on the runner, or sample:<name> for a built-in sample file.
SWITCH_FRAME	Frame	Moves into an iframe (the element is the iframe), or back to the page with the value main.
WAIT_FOR_ELEMENT / WAIT_FOR_LOAD_STATE	Sync	Waits for an element’s state, or for the page to finish loading.
ASSERTION / VERIFY_TEXT	Verification	Checks an element’s state or text: visible, contains text, equals a value.
STORE_VARIABLE	Data	Stores an element’s text or attribute in a variable for later steps.
SET_WINDOW_SIZE / CLOSE	Browser	Resizes the window; closes the browser.
EXECUTE_SCRIPT	Browser	Runs a JavaScript snippet in the page.
A11Y_SCAN	Accessibility	Scans the page for accessibility findings (reports toward WCAG; it does not certify conformance).

The Chrome and Edge recorder produces CLICK, DOUBLE_TAP, RIGHT_CLICK, HOVER, DRAG_DROP, SCROLL, ENTER_VALUE, PRESS_KEY, PRESS_ENTER_KEY, PRESS_ESCAPE_KEY, DROPDOWN, CHECK, UNCHECK, UPLOAD_FILE and SWITCH_FRAME steps from what you do.

AI Agent Step Actions

Action	Type	Description & Parameters
SEND_USER_MESSAGE	Turn	Sends user prompt to agent with TTFT and latency SLA budgets.
EXPECT_TOOL_CALL	Tool Assertion	Asserts agent calls specific tool with EXACT, PARTIAL, or SCHEMA args.
EXPECT_NO_TOOL_CALL	Tool Assertion	Fails if the named tool was called at all during the case.
EXPECT_TOOL_SEQUENCE	Trajectory	Asserts tool-call order via STRICT / SUBSEQUENCE / SET matching, with optional allowUnexpected and ignoreRepeats.
EXPECT_TOOL_CALL_COUNT	Trajectory	Asserts a tool was called equals / atMost / atLeast / between N times, optionally narrowed by withArgs.
ASSERT_TRAJECTORY	Trajectory	Compares the observed tool-call trajectory against a recorded golden trajectory (STRICT or SUPERSET mode, optional compareArgs and maxExtraSteps). Record a golden with run --record-golden after a case passes.
ASSERT_WORLD_STATE	World	Asserts on the case’s World directly: one path + one matcher per entry (equals, notEquals, length, contains, absent, present, unchanged, greaterThan, lessThan). Reports every failed expectation, not just the first.
ASSERT_OUTPUT	Deterministic Assertion	Asserts on a resolved target – LAST_AGENT_MESSAGE (default), TOOL_ARGS:, or VARIABLE: – against one or more matchers (contains, notContains, regex, notRegex, jsonPath+equals, jsonSchema). No LLM judge involved; all matchers must pass and every failure is reported. See “Deterministic Output Assertions” below.
ASSERT_AGENT_TOPOLOGY	Multi-Agent	Validates delegation hop depth and cycle-freedom from an OTel GenAI spans file, or (via source: LIVE) from spans captured live during the run itself – see “Multi-Agent Delegation, Handoff & Budget Assertions” below.
EXPECT_DELEGATION_TO	Multi-Agent	Asserts that a named agent was delegated to at least once (minInvocations, default 1), optionally by a specific fromAgent and no more than maxInvocations times. Reads the DAG from the case’s most recent ASSERT_AGENT_TOPOLOGY step.
EXPECT_HANDOFF_CONTEXT	Multi-Agent	Judge-graded: checks the content actually carried across one agent-to-agent handoff (the receiving span’s captured prompt/input attributes) against a rubric, not just that the handoff happened.
EXPECT_AGENT_BUDGET	Multi-Agent	Fails a case whose named agent’s own DAG subtree (its turn plus every tool/LLM call under it) exceeds maxTokens, maxDurationMs, and/or maxToolCalls – catches a runaway sub-agent before it becomes a cost or latency incident.
ASSERT_BROWSER_STATE	Browser	Asserts on the live DOM of a browser session an agent is driving (VISIBLE, TEXT_CONTAINS, VALUE_EQUALS, and friends) rather than on what the agent said it did. Runs through the same self-healing locator resolution as browser tool calls – see “Self-Healing Browser Actions for AI Agents” below.
MOCK_TOOL_RESPONSE	Interceptor	Returns deterministic mock JSON payload with simulated latency. certiqa-agent-runner’s YAML DSL also supports a world: { read, write } block (T-2.2) so a YAML-authored stub can read/mutate the case’s stateful World – not yet available on a case authored through the visual canvas or REST API.
PASSTHROUGH_TOOL	Interceptor	Lets one tool’s calls reach a real endpoint instead of a mock, while every other tool stays mocked: tool, url ({{args.X}} and {{BASE_API_URL}} allowed), method, headers, and optional auth (BEARER, BASIC, API_KEY or OAUTH2_CLIENT_CREDENTIALS). A tool with neither a mock nor a route is never sent anywhere; a matching mock always wins. Secrets as ${SECRET:KEY}. See the guide on mocking some tools and letting others reach the real system.
API_REQUEST	Setup / Verification	The same API step used in API cases, inside an agent or hybrid case: seed the system before the agent runs, then read it back afterwards to check what the agent really did. Values it captures are available to later agent steps.
DB_QUERY	Setup / Verification	Reads the end state of a record from your own database by the NAME of an approved query, for systems with no API that shows it. Target is the query name; Value is JSON (params, expect, expectRowCount, requiredColumns, column rules, sensitiveColumns). Works in UI, API and agent cases. It does not take SQL, and it runs only on a self-hosted runner: a run that contains one is refused at dispatch if it would go to a hosted runner. See the guide on seam cases.
EXPECT_RESPONSE	LLM Judge	Evaluates natural language response with GROUNDEDNESS / GUARDRAIL rubrics.
ASSERT_GUARDRAIL	Safety	Zero-tolerance negative safety verification (e.g. no PII leaks).
RESET_SESSION	State	Resets conversational memory between test cases.

Stateful World Seed

A case may declare a case-level “world:” seed – collections of records plus flat globals (e.g. orders: [{ id: “4471”, status: “pending” }], globals: { currency: “USD” }) – addressed by a small path grammar (orders[id=4471].status; deliberately not a query language). A MOCK_TOOL_RESPONSE step’s stub can then declare world: { read, write } to bind names to values at that path and mutate the World when the agent actually calls the mocked tool, turning “did it call the tool” into “did the right thing happen to the data”. ASSERT_WORLD_STATE (see the table above) asserts on the resulting World directly.

Each trial of a repeated case (repeatCount > 1, see “pass^k & Confidence Intervals” below) gets a fresh World rebuilt from the case’s seed before that trial runs – a write from repeat 1 never leaks into repeat 2. Without this, a stub-driven mutation in an earlier trial could make later trials pass or fail for the wrong reason, silently invalidating the pass^k statistics. unchanged (in ASSERT_WORLD_STATE) compares against that trial’s own initial snapshot, not the case’s original seed.

Fault Injection & Recovery

A case may declare a case-level “faults:” block to test how the agent recovers when a tool fails, instead of only how it behaves when tools succeed. It expands into one execution variant per mode in modes – named “ [fault: MODE]” – each registering that fault against tool before the case’s steps run.

faults:
  tool: issue_refund
  modes: [TIMEOUT, HTTP_500, HTTP_429, MALFORMED_JSON, EMPTY_RESULT]
  onCall: 1
  expectRecovery:
    rubricType: GUARDRAIL
    inlineRubric: >
      The agent must tell the user the refund could not be completed right now, must NOT
      claim the refund succeeded, and must not retry the refund more than twice.
    maxToolCalls: 3

Available modes: TIMEOUT, HTTP_500, HTTP_429, HTTP_403, MALFORMED_JSON, EMPTY_RESULT, PARTIAL_RESULT, SLOW. A variant’s pass/fail is decided solely by expectRecovery – a rubric graded against the agent’s last message, plus an optional maxToolCalls budget against the faulted tool – not by whether the case’s own steps passed; a step failing because the tool errored is expected under fault injection, not the signal being tested. The run report’s “Resilience” card shows each tool’s recoveryRate (passedVariants / totalVariants) and a per-mode pass/fail grid.

Deterministic Output Assertions

ASSERT_OUTPUT (see the table above) checks agent output without an LLM judge in the loop – useful when the expectation is exact and mechanical rather than a matter of judgment. It resolves a target string – LAST_AGENT_MESSAGE (the default), TOOL_ARGS: (the JSON args of that tool’s most recent call), or VARIABLE: (a runtime variable captured earlier in the case) – and checks it against one or more matchers.

- action: ASSERT_OUTPUT
  target: TOOL_ARGS:issue_refund
  matchers:
    - jsonPath: amount
      equals: 49.99
    - notContains: "SSN"

Matcher kinds: contains / notContains (with optional caseSensitive, default true), regex / notRegex, jsonPath + equals (dot-path only, e.g. order.status – deliberately the same lightweight grammar used elsewhere, not a full JSONPath library), and jsonSchema (validated with Ajv). Every matcher in the list must pass, and every failing matcher is reported together, not just the first. If the target is not valid JSON but a jsonPath or jsonSchema matcher is used against it, ASSERT_OUTPUT fails with a specific “target is not valid JSON” message rather than a raw parse error.

Selector Engines & Priority

Selector Type	Syntax Example	Resiliency	Best Used For
DATA_TESTID	[data-testid=“submit-btn”]	⭐⭐⭐⭐⭐ Highest	Dedicated automation test attributes.
ARIA_ROLE	role=button[name=“Submit”]	⭐⭐⭐⭐ High	Semantic, accessible component labels.
TEXT_MATCH	text=“Complete Order”	⭐⭐⭐⭐ High	Buttons/links with stable text.
ID	#order-submit	⭐⭐⭐ Medium	Unique DOM element IDs.
CSS / XPATH	div.cart > button	⭐⭐ Low-Medium	Hierarchical DOM path traversal.
AI_VISUAL_MATCHER	visual:checkout_icon	⭐⭐⭐⭐⭐ Highest	CertiHeal visual AI recovery anchor.