@dogfood-lab/verify 1.2.2 → 1.3.0

package/README.md

@@ -30,9 +30,11 @@ const result = verify(submission, {
 });
 
 if (!result.ok) {
+  // rejection_reasons is an array of STRINGS with stable prefixes (see
+  // "Error shape" below). Operators discriminate failure class via the
+  // prefix; the rest of the string carries the human-readable detail.
   for (const reason of result.rejection_reasons) {
-    console.error(`[${reason.code}] ${reason.message}`);
-    if (reason.hint) console.error(`  hint: ${reason.hint}`);
+    console.error(reason);
   }
   process.exit(1);
 }
@@ -76,17 +78,60 @@ Provenance fields (`github_run_id`, `github_workflow_ref`) are required when `pr
 
 ## Error shape
 
-Each `rejection_reasons[]` entry follows the testing-os structured error shape:
+`rejection_reasons[]` is an array of **strings** — the persisted-record schema (`dogfood-record.schema.json` → `verification.rejection_reasons`) enforces `items: { type: 'string' }`. Machine-readable discrimination happens via **stable string prefixes**.
 
-```ts
-{
-  code: 'POLICY_GATE_FAILED' | 'SCHEMA_MISMATCH' | 'PROVENANCE_UNVERIFIED' | ...,
-  message: string,
-  path: string,        // JSON path to the offending field
-  hint?: string,       // operator-facing remediation hint
+### Prefix taxonomy
+
+The verifier emits two prefix classes:
+
+**Submission-bad** (the submitter's payload failed a validator gate — the operator should fix the submission and resubmit):
+
+| Prefix | Source | Meaning |
+|---|---|---|
+| `schema:` | `validators/schema.js` | JSON Schema check on the submission/record envelope failed. The rest of the string carries the AJV path + message. |
+| `policy:` | `validators/policy.js` | Per-repo policy gate failed (forbidden tags, missing required fields, version-floor violation, etc.). |
+| `steps[<id>]:` | `validators/steps.js` | Step-level contract check failed on a specific step id (gate accumulation, ordering, evidence shape). |
+| `provenance:` | `validators/provenance.js` | The GitHub run-id confirmation could not match the submitted commit/repo at the GitHub API. |
+| `scenario-load:` | `packages/ingest/load-context.js` | A scenario referenced by `scenario_results` could not be loaded from the source repo (typed-reason: `timeout` / `not_found` / `parse_error` / `invalid_id`). |
+
+**Validator-crashed** (the validator itself threw an internal error — this is an operational fault, NOT submission-bad; the operator should investigate the verifier itself):
+
+| Prefix | Source | Meaning |
+|---|---|---|
+| `VALIDATOR_FAULT_SCHEMA:` | `runValidator('schema', …)` catch | Internal exception inside the schema validator. The rest of the string carries the thrown `.message`. |
+| `VALIDATOR_FAULT_POLICY:` | `runValidator('policy', …)` catch | Internal exception inside the policy validator. |
+| `VALIDATOR_FAULT_STEPS:` | `runValidator('steps', …)` catch | Internal exception inside the steps validator. |
+
+### Operator hygiene
+
+```js
+// Discriminate by prefix
+for (const r of result.rejection_reasons) {
+  if (r.startsWith('VALIDATOR_FAULT_')) {
+    // Operational incident — verifier-side. Page someone; do NOT route
+    // back to the submitter as a "fix your payload" message.
+    notifyOps(r);
+  } else if (r.startsWith('schema:') || r.startsWith('policy:') || r.startsWith('steps[')) {
+    // Submission-bad — surface to the submitter.
+    surfaceToSubmitter(r);
+  } else if (r.startsWith('provenance:')) {
+    // May be either class — GitHub API timeouts are operational; a real
+    // commit/repo mismatch is submission-bad. The string detail carries
+    // the discriminator.
+    triageProvenance(r);
+  } else if (r.startsWith('scenario-load:')) {
+    // Ingest-side: scenario fetch reason determines class. timeout is
+    // operational; not_found / parse_error / invalid_id are submission-bad.
+    triageScenarioLoad(r);
+  } else {
+    // Unknown prefix — log and surface as raw text.
+    log.warn('unknown rejection_reason prefix', r);
+  }
 }
 ```
 
+Persistence note: every entry above is round-tripped verbatim through `verification.rejection_reasons` in the persisted-record JSON; the schema enforces `array of string` so any consumer of the audit-DB ground truth sees the same prefix vocabulary.
+
 ## Docs
 
 📖 Full handbook: **<https://dogfood-lab.github.io/testing-os/handbook/>**

package/index.js

@@ -1,176 +1,251 @@
-/**
- * dogfood-labs verifier
- *
- * Central law engine. Takes a submission payload and produces a persisted record.
- * Validates schema, policy, provenance. Sets verifier-owned fields.
- * Never upgrades a proposed verdict.
- */
-
-import { validateSubmissionSchema } from './validators/schema.js';
-import { validatePolicy } from './validators/policy.js';
-import { validateStepResults } from './validators/steps.js';
-import { computeVerdict } from './validators/verdict.js';
-
-/**
- * Verify a dogfood submission and produce a persisted record.
- *
- * @param {object} submission - Source-authored submission payload
- * @param {object} options
- * @param {object} options.globalPolicy - Parsed global policy
- * @param {object|null} options.repoPolicy - Parsed repo policy (null if none)
- * @param {object} options.provenance - Provenance adapter { confirm(source) => Promise<boolean> }
- * @param {string} options.policyVersion - Semver of the policy set being applied
- * @returns {Promise<object>} Persisted record (accepted or rejected)
- */
-export async function verify(submission, options) {
-  if (!submission || typeof submission !== 'object' || Array.isArray(submission)) {
-    const now = new Date().toISOString();
-    // Null/non-object input cannot drive computeRecordPath() (needs repo + run_id +
-    // timing.finished_at). Mark _skipPersist so the ingest layer surfaces the
-    // rejection without crashing the persist layer with `invalid repo format: undefined`.
-    return {
-      schema_version: '1.0.0',
-      _skipPersist: true,
-      verification: {
-        status: 'rejected',
-        verified_at: now,
-        provenance_confirmed: false,
-        schema_valid: false,
-        policy_valid: false,
-        rejection_reasons: ['submission is null or not an object']
-      }
-    };
-  }
-
-  const { globalPolicy, repoPolicy, provenance, policyVersion } = options;
-  const now = new Date().toISOString();
-  const reasons = [];
-
-  // 0. Cross-field guard: submission.repo MUST match the owner/repo encoded in
-  //    source.run_url. Without this, a submitter can claim
-  //    submission.repo='victim-org/victim-repo' while supplying source.run_url for a
-  //    real, legitimate run from their own repo. Provenance would confirm (the run
-  //    exists), and the persist layer would file the record under victim-org's path
-  //    — a forged "pass" verdict for a repo the submitter does not control.
-  //    Format: https://github.com/{owner}/{repo}/actions/runs/{id}
-  if (submission.repo && submission.source?.run_url) {
-    const m = submission.source.run_url.match(
-      /^https:\/\/github\.com\/([^/]+)\/([^/]+)\/actions\/runs\/\d+$/
-    );
-    if (m) {
-      const sourceRepo = `${m[1]}/${m[2]}`;
-      if (sourceRepo !== submission.repo) {
-        reasons.push(
-          `repo:mismatch: submission.repo (${submission.repo}) does not match source.run_url repo (${sourceRepo})`
-        );
-      }
-    }
-  }
-
-  // 1. Schema validation
-  let schemaResult = { valid: false, errors: [] };
-  try {
-    schemaResult = validateSubmissionSchema(submission);
-    if (!schemaResult.valid) {
-      reasons.push(...schemaResult.errors.map(e => `schema: ${e}`));
-    }
-  } catch (e) {
-    reasons.push('validator error: ' + e.message);
-  }
-
-  // 2. Reject if submission includes verifier-owned fields
-  const verifierFields = ['policy_version', 'verification'];
-  for (const field of verifierFields) {
-    if (field in submission) {
-      reasons.push(`submission-contains-verifier-field: ${field}`);
-    }
-  }
-  if (typeof submission.overall_verdict === 'object') {
-    reasons.push('submission-contains-verifier-field: overall_verdict must be a string in submissions');
-  }
-
-  // 3. Provenance check
-  let provenanceConfirmed = false;
-  if (schemaResult.valid && submission.source) {
-    try {
-      provenanceConfirmed = await provenance.confirm(submission.source);
-    } catch (err) {
-      reasons.push(`provenance: verification failed: ${err.message}`);
-    }
-    if (!provenanceConfirmed && !reasons.some(r => r.startsWith('provenance:'))) {
-      reasons.push('provenance: source run could not be confirmed');
-    }
-  }
-
-  // 4. Step results validation (only if schema passed)
-  if (schemaResult.valid && submission.scenario_results) {
-    for (const scenario of submission.scenario_results) {
-      try {
-        const stepErrors = validateStepResults(scenario);
-        reasons.push(...stepErrors.map(e => `steps[${scenario.scenario_id}]: ${e}`));
-      } catch (e) {
-        reasons.push('validator error: ' + e.message);
-      }
-    }
-  }
-
-  // 5. Policy evaluation (only if schema passed)
-  let policyValid = false;
-  if (schemaResult.valid) {
-    try {
-      const policyResult = validatePolicy(submission, { globalPolicy, repoPolicy });
-      policyValid = policyResult.valid;
-      reasons.push(...policyResult.errors.map(e => `policy: ${e}`));
-    } catch (e) {
-      reasons.push('validator error: ' + e.message);
-    }
-  }
-
-  // 6. Compute verdict
-  const proposedVerdict = typeof submission.overall_verdict === 'string'
-    ? submission.overall_verdict
-    : null;
-
-  const hasErrors = reasons.length > 0;
-  const status = hasErrors ? 'rejected' : 'accepted';
-
-  const verdictResult = computeVerdict(proposedVerdict, {
-    schemaValid: schemaResult.valid,
-    policyValid,
-    provenanceConfirmed,
-    scenarioResults: schemaResult.valid ? submission.scenario_results : [],
-    reasons
-  });
-
-  // 7. Assemble persisted record
-  const persisted = {
-    schema_version: '1.0.0',
-    policy_version: policyVersion,
-    run_id: submission.run_id,
-    repo: submission.repo,
-    ref: submission.ref,
-    source: submission.source,
-    timing: submission.timing,
-    ...(submission.ci_checks ? { ci_checks: submission.ci_checks } : {}),
-    scenario_results: submission.scenario_results || [],
-    overall_verdict: {
-      proposed: proposedVerdict,
-      verified: verdictResult.verified,
-      downgraded: verdictResult.downgraded,
-      ...(verdictResult.downgrade_reasons.length > 0
-        ? { downgrade_reasons: verdictResult.downgrade_reasons }
-        : {})
-    },
-    verification: {
-      status,
-      verified_at: now,
-      provenance_confirmed: provenanceConfirmed,
-      schema_valid: schemaResult.valid,
-      policy_valid: policyValid,
-      rejection_reasons: reasons
-    },
-    ...(submission.notes ? { notes: submission.notes } : {})
-  };
-
-  return persisted;
-}
+/**
+ * dogfood-labs verifier
+ *
+ * Central law engine. Takes a submission payload and produces a persisted record.
+ * Validates schema, policy, provenance. Sets verifier-owned fields.
+ * Never upgrades a proposed verdict.
+ */
+
+import { validateSubmissionSchema as _defaultValidateSubmissionSchema } from './validators/schema.js';
+import { validatePolicy as _defaultValidatePolicy } from './validators/policy.js';
+import { validateStepResults as _defaultValidateStepResults } from './validators/steps.js';
+import { computeVerdict } from './validators/verdict.js';
+
+/**
+ * D1B-003 (Stage C humanization): the SOLE catch wrapper for synchronous
+ * validator calls. Distinguishes operator-actionable signals:
+ *
+ *   - Validator returned a structured result → caller pushes the existing
+ *     `'<class>: <details>'` prefix into `rejection_reasons` (unchanged
+ *     submission-bad path; back-compat is preserved).
+ *   - Validator THREW (operational incident — ajv compile fault, policy
+ *     merge cycle, out-of-memory) → wrapper synthesizes a STABLE coded
+ *     prefix `'VALIDATOR_FAULT_<NAME>: <details>'` for the caller to push.
+ *     The prefix is greppable across runner logs:
+ *       `grep -E '"VALIDATOR_FAULT_' …`  → every operational incident
+ *       `grep -E '^(schema|policy|steps): ' …` → every submission-bad signal
+ *
+ * `name` is upper-cased to match the prefix vocabulary documented in
+ * verify/README.md (SCHEMA / POLICY / STEPS). Returns:
+ *   { ok: true, result }   when fn() returned cleanly
+ *   { ok: false, faultReason } when fn() threw
+ *
+ * The helper is the canonical seam for any new synchronous validator
+ * — adding a 4th validator class becomes a one-call site, not a
+ * five-line try/catch boilerplate.
+ *
+ * @param {string} name - Validator class name (will be upper-cased).
+ * @param {() => T} fn - The validator call.
+ * @returns {{ ok: true, result: T } | { ok: false, faultReason: string }}
+ * @template T
+ */
+function runValidator(name, fn) {
+  try {
+    return { ok: true, result: fn() };
+  } catch (e) {
+    const cls = name.toUpperCase();
+    const detail = e && e.message ? e.message : String(e);
+    return { ok: false, faultReason: `VALIDATOR_FAULT_${cls}: ${detail}` };
+  }
+}
+
+/**
+ * Verify a dogfood submission and produce a persisted record.
+ *
+ * @param {object} submission - Source-authored submission payload
+ * @param {object} options
+ * @param {object} options.globalPolicy - Parsed global policy
+ * @param {object|null} options.repoPolicy - Parsed repo policy (null if none)
+ * @param {object} options.provenance - Provenance adapter { confirm(source) => Promise<boolean> }
+ * @param {string} options.policyVersion - Semver of the policy set being applied
+ * @param {object} [options.validators] - Test-only override hook (D1B-003).
+ *   Pass `{ validateSubmissionSchema, validateStepResults, validatePolicy }`
+ *   to swap in fault-injecting stubs. Production callers leave this unset
+ *   and the helper falls back to the module-level imports. The override
+ *   exists so the wrapper's catch behaviour can be tested deterministically
+ *   without monkey-patching ESM modules (which is a no-op for live bindings).
+ *   Documented but not part of the public stability contract — the parameter
+ *   may shift shape in future minors.
+ * @returns {Promise<object>} Persisted record (accepted or rejected)
+ */
+export async function verify(submission, options) {
+  if (!submission || typeof submission !== 'object' || Array.isArray(submission)) {
+    const now = new Date().toISOString();
+    // Null/non-object input cannot drive computeRecordPath() (needs repo + run_id +
+    // timing.finished_at). Mark _skipPersist so the ingest layer surfaces the
+    // rejection without crashing the persist layer with `invalid repo format: undefined`.
+    return {
+      schema_version: '1.0.0',
+      _skipPersist: true,
+      verification: {
+        status: 'rejected',
+        verified_at: now,
+        provenance_confirmed: false,
+        schema_valid: false,
+        policy_valid: false,
+        rejection_reasons: ['submission is null or not an object']
+      }
+    };
+  }
+
+  const { globalPolicy, repoPolicy, provenance, policyVersion, validators: validatorOverrides = {} } = options;
+  // Resolve the three validators per-call so tests can inject fault-
+  // injecting stubs. Production callers leave `validators` unset and the
+  // module-level imports flow through unchanged.
+  const validateSubmissionSchema = validatorOverrides.validateSubmissionSchema || _defaultValidateSubmissionSchema;
+  const validateStepResults = validatorOverrides.validateStepResults || _defaultValidateStepResults;
+  const validatePolicy = validatorOverrides.validatePolicy || _defaultValidatePolicy;
+  const now = new Date().toISOString();
+  const reasons = [];
+
+  // 0. Cross-field guard: submission.repo MUST match the owner/repo encoded in
+  //    source.run_url. Without this, a submitter can claim
+  //    submission.repo='victim-org/victim-repo' while supplying source.run_url for a
+  //    real, legitimate run from their own repo. Provenance would confirm (the run
+  //    exists), and the persist layer would file the record under victim-org's path
+  //    — a forged "pass" verdict for a repo the submitter does not control.
+  //    Format: https://github.com/{owner}/{repo}/actions/runs/{id}
+  if (submission.repo && submission.source?.run_url) {
+    const m = submission.source.run_url.match(
+      /^https:\/\/github\.com\/([^/]+)\/([^/]+)\/actions\/runs\/\d+$/
+    );
+    if (m) {
+      const sourceRepo = `${m[1]}/${m[2]}`;
+      if (sourceRepo !== submission.repo) {
+        reasons.push(
+          `repo:mismatch: submission.repo (${submission.repo}) does not match source.run_url repo (${sourceRepo})`
+        );
+      }
+    }
+  }
+
+  // 1. Schema validation
+  // D1B-003: route both happy + fault paths through `runValidator` so
+  // submission-bad (`'schema: …'`) and operational incidents
+  // (`'VALIDATOR_FAULT_SCHEMA: …'`) emit DISTINCT, greppable prefixes.
+  let schemaResult = { valid: false, errors: [] };
+  const schemaRun = runValidator('schema', () => validateSubmissionSchema(submission));
+  if (schemaRun.ok) {
+    schemaResult = schemaRun.result;
+    if (!schemaResult.valid) {
+      reasons.push(...schemaResult.errors.map(e => `schema: ${e}`));
+    }
+  } else {
+    reasons.push(schemaRun.faultReason);
+  }
+
+  // 2. Reject if submission includes verifier-owned fields
+  const verifierFields = ['policy_version', 'verification'];
+  for (const field of verifierFields) {
+    if (field in submission) {
+      reasons.push(`submission-contains-verifier-field: ${field}`);
+    }
+  }
+  if (typeof submission.overall_verdict === 'object') {
+    reasons.push('submission-contains-verifier-field: overall_verdict must be a string in submissions');
+  }
+
+  // 3. Provenance check
+  let provenanceConfirmed = false;
+  if (schemaResult.valid && submission.source) {
+    try {
+      provenanceConfirmed = await provenance.confirm(submission.source);
+    } catch (err) {
+      reasons.push(`provenance: verification failed: ${err.message}`);
+    }
+    if (!provenanceConfirmed && !reasons.some(r => r.startsWith('provenance:'))) {
+      reasons.push('provenance: source run could not be confirmed');
+    }
+  }
+
+  // 4. Step results validation (only if schema passed)
+  // D1B-003: same submission-bad-vs-operational-fault split as schema.
+  if (schemaResult.valid && submission.scenario_results) {
+    for (const scenario of submission.scenario_results) {
+      const stepsRun = runValidator('steps', () => validateStepResults(scenario));
+      if (stepsRun.ok) {
+        reasons.push(...stepsRun.result.map(e => `steps[${scenario.scenario_id}]: ${e}`));
+      } else {
+        reasons.push(stepsRun.faultReason);
+      }
+    }
+  }
+
+  // 5. Policy evaluation (only if schema passed)
+  // D1B-003: see runValidator JSDoc for the split. Policy-fault on
+  // `globalPolicy` corruption surfaces as `VALIDATOR_FAULT_POLICY:` and
+  // is the operator's signal that the POLICY FILE (not the submission)
+  // is broken.
+  //
+  // D1B-006: a torn repo-policy file (sentinel `{ __torn: true, reason }`
+  // returned by `loadRepoPolicy`) MUST reject the submission with
+  // `policy_valid=false` + a `policy: repo policy unreadable` rejection
+  // reason. Pre-fix the sentinel was a silent `null` — the verifier
+  // happily ran defaults against a corrupt policy. Catch the sentinel
+  // BEFORE handing the (broken) policy to `validatePolicy`, so the
+  // operator sees a real "policy:" rejection in `rejection_reasons`.
+  let policyValid = false;
+  if (schemaResult.valid) {
+    if (repoPolicy && repoPolicy.__torn === true) {
+      const detail = repoPolicy.reason || 'repo policy YAML failed to parse';
+      reasons.push(`policy: repo policy unreadable — ${detail}`);
+      // policyValid stays false.
+    } else {
+      const policyRun = runValidator('policy', () => validatePolicy(submission, { globalPolicy, repoPolicy }));
+      if (policyRun.ok) {
+        policyValid = policyRun.result.valid;
+        reasons.push(...policyRun.result.errors.map(e => `policy: ${e}`));
+      } else {
+        reasons.push(policyRun.faultReason);
+      }
+    }
+  }
+
+  // 6. Compute verdict
+  const proposedVerdict = typeof submission.overall_verdict === 'string'
+    ? submission.overall_verdict
+    : null;
+
+  const hasErrors = reasons.length > 0;
+  const status = hasErrors ? 'rejected' : 'accepted';
+
+  const verdictResult = computeVerdict(proposedVerdict, {
+    schemaValid: schemaResult.valid,
+    policyValid,
+    provenanceConfirmed,
+    scenarioResults: schemaResult.valid ? submission.scenario_results : [],
+    reasons
+  });
+
+  // 7. Assemble persisted record
+  const persisted = {
+    schema_version: '1.0.0',
+    policy_version: policyVersion,
+    run_id: submission.run_id,
+    repo: submission.repo,
+    ref: submission.ref,
+    source: submission.source,
+    timing: submission.timing,
+    ...(submission.ci_checks ? { ci_checks: submission.ci_checks } : {}),
+    scenario_results: submission.scenario_results || [],
+    overall_verdict: {
+      proposed: proposedVerdict,
+      verified: verdictResult.verified,
+      downgraded: verdictResult.downgraded,
+      ...(verdictResult.downgrade_reasons.length > 0
+        ? { downgrade_reasons: verdictResult.downgrade_reasons }
+        : {})
+    },
+    verification: {
+      status,
+      verified_at: now,
+      provenance_confirmed: provenanceConfirmed,
+      schema_valid: schemaResult.valid,
+      policy_valid: policyValid,
+      rejection_reasons: reasons
+    },
+    ...(submission.notes ? { notes: submission.notes } : {})
+  };
+
+  return persisted;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dogfood-lab/verify",
-  "version": "1.2.2",
+  "version": "1.3.0",
   "type": "module",
   "description": "Central verifier for testing-os. Validates submissions against schema and policy, produces persisted records.",
   "main": "index.js",
@@ -24,12 +24,10 @@
   },
   "dependencies": {
     "@dogfood-lab/schemas": "^1.2.0",
-    "ajv": "^8.18.0",
-    "ajv-formats": "^3.0.1",
     "js-yaml": "^4.1.0"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "author": "mcp-tool-shop",
   "license": "MIT",

package/validators/provenance.js

@@ -1,121 +1,121 @@
-/**
- * Provenance adapters
- *
- * The verifier checks that a source run actually exists and matches claims.
- * Two adapters:
- * - stub: always confirms (for tests and local development)
- * - github: confirms via GitHub Actions API (for production)
- */
-
-/**
- * Default per-request timeout for the GitHub provenance fetch.
- * A hung GitHub API call would otherwise stall every consumer's ingest until
- * the surrounding GitHub Actions runner timeout fires (default 6h). Fail fast
- * with a clear AbortError so the verifier records 'provenance: timeout' in
- * rejection_reasons.
- */
-export const GITHUB_PROVENANCE_TIMEOUT_MS = 30000;
-
-/**
- * Stub provenance adapter. Always confirms.
- * Use in tests and local development.
- */
-export const stubProvenance = {
-  async confirm(_source) {
-    return true;
-  }
-};
-
-/**
- * Stub provenance adapter that always rejects.
- * Use in tests to verify rejection paths.
- */
-export const rejectingProvenance = {
-  async confirm(_source) {
-    return false;
-  }
-};
-
-/**
- * GitHub provenance adapter.
- * Confirms a workflow run exists and matches the claimed repo, SHA, and workflow.
- *
- * @param {string} token - GitHub PAT with actions:read scope
- * @param {{ timeoutMs?: number, fetchImpl?: typeof fetch }} [opts]
- * @returns {object} Provenance adapter
- */
-export function githubProvenance(token, opts = {}) {
-  const timeoutMs = opts.timeoutMs ?? GITHUB_PROVENANCE_TIMEOUT_MS;
-  const fetchImpl = opts.fetchImpl ?? fetch;
-  return {
-    async confirm(source) {
-      if (source.provider !== 'github') {
-        throw new Error(`unsupported provider: ${source.provider}`);
-      }
-
-      const { provider_run_id, run_url } = source;
-      if (!provider_run_id || !run_url) {
-        return false;
-      }
-
-      // Extract owner/repo from run_url
-      // Format: https://github.com/{owner}/{repo}/actions/runs/{id}
-      const match = run_url.match(
-        /^https:\/\/github\.com\/([^/]+)\/([^/]+)\/actions\/runs\/(\d+)$/
-      );
-      if (!match) return false;
-
-      const [, owner, repo, urlRunId] = match;
-
-      // run_id in URL must match claimed provider_run_id
-      if (urlRunId !== String(provider_run_id)) return false;
-
-      const apiUrl = `https://api.github.com/repos/${owner}/${repo}/actions/runs/${provider_run_id}`;
-
-      // Per-request timeout. Without this, a hung GitHub API call (rate-limit
-      // throttle, regional outage, slow connection) blocks ingest indefinitely.
-      // AbortController fires AbortError on timeout — we re-throw with a clear
-      // message so the verifier records it in rejection_reasons instead of
-      // silently treating it as 'provenance returned false.'
-      const controller = new AbortController();
-      const timer = setTimeout(() => controller.abort(), timeoutMs);
-
-      let run;
-      try {
-        const resp = await fetchImpl(apiUrl, {
-          headers: {
-            Authorization: `Bearer ${token}`,
-            Accept: 'application/vnd.github+json',
-            'X-GitHub-Api-Version': '2022-11-28'
-          },
-          signal: controller.signal
-        });
-
-        if (!resp.ok) return false;
-
-        run = await resp.json();
-      } catch (err) {
-        if (err && (err.name === 'AbortError' || err.code === 'ABORT_ERR')) {
-          throw new Error(`provenance: GitHub API timeout after ${timeoutMs}ms`);
-        }
-        return false;
-      } finally {
-        clearTimeout(timer);
-      }
-
-      if (run.id !== Number(provider_run_id)) return false;
-
-      // Contract: provenance confirms the workflow run actually EXECUTED
-      // (status === 'completed'). Pass/fail is a separate signal carried
-      // by submission.ci_checks and scenario verdicts — the verifier still
-      // persists failed runs, it just refuses to accept a record before the
-      // underlying CI evidence exists. Rejects 'queued' / 'in_progress' / 'waiting'.
-      if (run.status !== 'completed') return false;
-
-      if (source.commit_sha && run.head_sha !== source.commit_sha) return false;
-      if (source.repo && run.repository?.full_name !== source.repo) return false;
-
-      return true;
-    }
-  };
-}
+/**
+ * Provenance adapters
+ *
+ * The verifier checks that a source run actually exists and matches claims.
+ * Two adapters:
+ * - stub: always confirms (for tests and local development)
+ * - github: confirms via GitHub Actions API (for production)
+ */
+
+/**
+ * Default per-request timeout for the GitHub provenance fetch.
+ * A hung GitHub API call would otherwise stall every consumer's ingest until
+ * the surrounding GitHub Actions runner timeout fires (default 6h). Fail fast
+ * with a clear AbortError so the verifier records 'provenance: timeout' in
+ * rejection_reasons.
+ */
+export const GITHUB_PROVENANCE_TIMEOUT_MS = 30000;
+
+/**
+ * Stub provenance adapter. Always confirms.
+ * Use in tests and local development.
+ */
+export const stubProvenance = {
+  async confirm(_source) {
+    return true;
+  }
+};
+
+/**
+ * Stub provenance adapter that always rejects.
+ * Use in tests to verify rejection paths.
+ */
+export const rejectingProvenance = {
+  async confirm(_source) {
+    return false;
+  }
+};
+
+/**
+ * GitHub provenance adapter.
+ * Confirms a workflow run exists and matches the claimed repo, SHA, and workflow.
+ *
+ * @param {string} token - GitHub PAT with actions:read scope
+ * @param {{ timeoutMs?: number, fetchImpl?: typeof fetch }} [opts]
+ * @returns {object} Provenance adapter
+ */
+export function githubProvenance(token, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? GITHUB_PROVENANCE_TIMEOUT_MS;
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  return {
+    async confirm(source) {
+      if (source.provider !== 'github') {
+        throw new Error(`unsupported provider: ${source.provider}`);
+      }
+
+      const { provider_run_id, run_url } = source;
+      if (!provider_run_id || !run_url) {
+        return false;
+      }
+
+      // Extract owner/repo from run_url
+      // Format: https://github.com/{owner}/{repo}/actions/runs/{id}
+      const match = run_url.match(
+        /^https:\/\/github\.com\/([^/]+)\/([^/]+)\/actions\/runs\/(\d+)$/
+      );
+      if (!match) return false;
+
+      const [, owner, repo, urlRunId] = match;
+
+      // run_id in URL must match claimed provider_run_id
+      if (urlRunId !== String(provider_run_id)) return false;
+
+      const apiUrl = `https://api.github.com/repos/${owner}/${repo}/actions/runs/${provider_run_id}`;
+
+      // Per-request timeout. Without this, a hung GitHub API call (rate-limit
+      // throttle, regional outage, slow connection) blocks ingest indefinitely.
+      // AbortController fires AbortError on timeout — we re-throw with a clear
+      // message so the verifier records it in rejection_reasons instead of
+      // silently treating it as 'provenance returned false.'
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), timeoutMs);
+
+      let run;
+      try {
+        const resp = await fetchImpl(apiUrl, {
+          headers: {
+            Authorization: `Bearer ${token}`,
+            Accept: 'application/vnd.github+json',
+            'X-GitHub-Api-Version': '2022-11-28'
+          },
+          signal: controller.signal
+        });
+
+        if (!resp.ok) return false;
+
+        run = await resp.json();
+      } catch (err) {
+        if (err && (err.name === 'AbortError' || err.code === 'ABORT_ERR')) {
+          throw new Error(`provenance: GitHub API timeout after ${timeoutMs}ms`);
+        }
+        return false;
+      } finally {
+        clearTimeout(timer);
+      }
+
+      if (run.id !== Number(provider_run_id)) return false;
+
+      // Contract: provenance confirms the workflow run actually EXECUTED
+      // (status === 'completed'). Pass/fail is a separate signal carried
+      // by submission.ci_checks and scenario verdicts — the verifier still
+      // persists failed runs, it just refuses to accept a record before the
+      // underlying CI evidence exists. Rejects 'queued' / 'in_progress' / 'waiting'.
+      if (run.status !== 'completed') return false;
+
+      if (source.commit_sha && run.head_sha !== source.commit_sha) return false;
+      if (source.repo && run.repository?.full_name !== source.repo) return false;
+
+      return true;
+    }
+  };
+}

package/validators/schema.js

@@ -1,59 +1,58 @@
-/**
- * Schema validator — validates submissions against dogfood-record-submission.schema.json
- */
-
-import Ajv2020 from 'ajv/dist/2020.js';
-import addFormats from 'ajv-formats';
-import { readFileSync } from 'node:fs';
-import { dirname } from 'node:path';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-// Resolve the schemas package's json directory via its subpath export.
-const SCHEMA_DIR = dirname(
-  require.resolve('@dogfood-lab/schemas/json/dogfood-record-submission.schema.json')
-);
-
-let _validator = null;
-
-function getValidator() {
-  if (_validator) return _validator;
-
-  try {
-    const ajv = new Ajv2020({ allErrors: true, strict: false });
-    addFormats(ajv);
-
-    const schemaPath = `${SCHEMA_DIR}/dogfood-record-submission.schema.json`;
-    const schema = JSON.parse(readFileSync(schemaPath, 'utf-8'));
-
-    _validator = ajv.compile(schema);
-    return _validator;
-  } catch (e) {
-    return { __loadError: 'Schema loading failed: ' + e.message };
-  }
-}
-
-/**
- * Validate a submission payload against the submission JSON Schema.
- *
- * @param {object} submission
- * @returns {{ valid: boolean, errors: string[] }}
- */
-export function validateSubmissionSchema(submission) {
-  const validate = getValidator();
-  if (validate.__loadError) {
-    return { valid: false, errors: [validate.__loadError] };
-  }
-  const valid = validate(submission);
-
-  if (valid) {
-    return { valid: true, errors: [] };
-  }
-
-  const errors = (validate.errors || []).map(err => {
-    const path = err.instancePath || '/';
-    return `${path} ${err.message}`;
-  });
-
-  return { valid: false, errors };
-}
+/**
+ * Schema validator — validates submissions against dogfood-record-submission.schema.json.
+ *
+ * H3 hop 3: delegates to the canonical {@link validatePayload} from
+ * `@dogfood-lab/schemas`. Pre-H3 this module compiled its own
+ * Ajv2020 + ajv-formats instance for the submission schema; that
+ * duplicated the verifier's compile path against the inbound payload
+ * AND was the third of four sites contributing to the C1 two-Ajv
+ * structural gap. The migration collapses submission-validation to
+ * the single cached validator the canonical seam shares with the
+ * rest of the workspace.
+ *
+ * Return contract preserved: `{ valid, errors: string[] }`. The
+ * string-prefix shape is consumed by verify/index.js, which prepends
+ * `schema: ` / `policy: ` / `VALIDATOR_FAULT_SCHEMA: ` per the
+ * Stage C D1B-003 operator-legibility cluster. The migration keeps
+ * the `${path} ${message}` projection so downstream prefixes stay
+ * exact.
+ */
+
+import { validatePayload } from '@dogfood-lab/schemas';
+
+/**
+ * Validate a submission payload against the submission JSON Schema.
+ *
+ * @param {object} submission
+ * @returns {{ valid: boolean, errors: string[] }}
+ */
+export function validateSubmissionSchema(submission) {
+  let result;
+  try {
+    result = validatePayload('recordSubmission', submission);
+  } catch (e) {
+    // The canonical compile path can throw at compileSchema time if the
+    // schema file is unreadable or malformed (Ajv compile fault). Pre-H3
+    // the corresponding fault was surfaced via a `{ __loadError }` sentinel
+    // that the runValidator helper in verify/index.js never actually
+    // routed through `VALIDATOR_FAULT_*` — `getValidator` returned a plain
+    // object and the call site special-cased its `__loadError` key. The
+    // post-H3 path is cleaner: a thrown error here propagates up to
+    // runValidator which already wraps thrown validators in
+    // `VALIDATOR_FAULT_SCHEMA` (D1B-003 humanization). Same operator-
+    // facing prefix, just routed through the lawful seam instead of a
+    // sentinel. No catch — propagate.
+    throw e;
+  }
+
+  if (result.valid) {
+    return { valid: true, errors: [] };
+  }
+
+  // String-prefix projection: pre-H3 wrote `${path} ${message}` directly
+  // from Ajv.errors. The canonical ValidationError has the same
+  // `{ path, message }` shape, so the formatting is verbatim.
+  const errors = result.errors.map(err => `${err.path} ${err.message}`);
+
+  return { valid: false, errors };
+}

package/validators/steps.js

@@ -1,102 +1,102 @@
-/**
- * Step results validator
- *
- * Enforces the bridge between scenario definitions and record evidence:
- * - Every required step must have a matching step_result
- * - A scenario cannot be "pass" if any required step is "fail" or "blocked"
- */
-
-/**
- * Validate step results for a single scenario result.
- *
- * Note: Without access to the source repo's scenario definition, we validate
- * structural integrity. The full required_steps check is done by policy
- * evaluation when scenario definitions are available.
- *
- * @param {object} scenarioResult - A single scenario_results[] item
- * @returns {string[]} Array of error messages (empty if valid)
- */
-export function validateStepResults(scenarioResult) {
-  const errors = [];
-  const { step_results, verdict, scenario_id } = scenarioResult;
-
-  if (!step_results || step_results.length === 0) {
-    errors.push('step_results is required and must have at least one entry');
-    return errors;
-  }
-
-  const VALID_STATUSES = new Set(['pass', 'fail', 'blocked', 'skip']);
-
-  for (let i = 0; i < step_results.length; i++) {
-    const step = step_results[i];
-    if (step == null || typeof step !== 'object' || typeof step.step_id !== 'string') {
-      errors.push(`step_results[${i}] is malformed: must be a non-null object with a string step_id`);
-    }
-  }
-
-  const seenIds = new Set();
-  for (const step of step_results) {
-    if (step == null || typeof step !== 'object') continue;
-    if (seenIds.has(step.step_id)) {
-      errors.push(`duplicate step_id: ${step.step_id}`);
-    }
-    seenIds.add(step.step_id);
-    if (step.status != null && !VALID_STATUSES.has(step.status)) {
-      errors.push(`step "${step.step_id}" has unknown status: "${step.status}"`);
-    }
-  }
-
-  // A scenario cannot be "pass" if any step is "fail" or "blocked"
-  if (verdict === 'pass') {
-    const failingSteps = step_results.filter(
-      s => s.status === 'fail' || s.status === 'blocked'
-    );
-    if (failingSteps.length > 0) {
-      const ids = failingSteps.map(s => s.step_id).join(', ');
-      errors.push(
-        `scenario verdict is "pass" but steps [${ids}] have status fail/blocked`
-      );
-    }
-  }
-
-  return errors;
-}
-
-/**
- * Validate step results against a scenario definition's required_steps.
- * Used when the scenario definition is available (policy evaluation phase).
- *
- * @param {object} scenarioResult - A single scenario_results[] item
- * @param {string[]} requiredSteps - Step IDs from scenario definition's success_criteria.required_steps
- * @returns {string[]} Array of error messages (empty if valid)
- */
-export function validateRequiredSteps(scenarioResult, requiredSteps) {
-  const errors = [];
-  const { step_results, verdict } = scenarioResult;
-
-  if (!step_results) return ['step_results missing'];
-
-  const resultMap = new Map(step_results.map(s => [s.step_id, s]));
-
-  // Every required step must have a matching step_result
-  for (const stepId of requiredSteps) {
-    const result = resultMap.get(stepId);
-    if (!result) {
-      errors.push(`required step "${stepId}" has no matching step_result`);
-    }
-  }
-
-  // A scenario cannot be "pass" if any required step is fail/blocked
-  if (verdict === 'pass') {
-    for (const stepId of requiredSteps) {
-      const result = resultMap.get(stepId);
-      if (result && (result.status === 'fail' || result.status === 'blocked')) {
-        errors.push(
-          `scenario verdict is "pass" but required step "${stepId}" has status "${result.status}"`
-        );
-      }
-    }
-  }
-
-  return errors;
-}
+/**
+ * Step results validator
+ *
+ * Enforces the bridge between scenario definitions and record evidence:
+ * - Every required step must have a matching step_result
+ * - A scenario cannot be "pass" if any required step is "fail" or "blocked"
+ */
+
+/**
+ * Validate step results for a single scenario result.
+ *
+ * Note: Without access to the source repo's scenario definition, we validate
+ * structural integrity. The full required_steps check is done by policy
+ * evaluation when scenario definitions are available.
+ *
+ * @param {object} scenarioResult - A single scenario_results[] item
+ * @returns {string[]} Array of error messages (empty if valid)
+ */
+export function validateStepResults(scenarioResult) {
+  const errors = [];
+  const { step_results, verdict, scenario_id } = scenarioResult;
+
+  if (!step_results || step_results.length === 0) {
+    errors.push('step_results is required and must have at least one entry');
+    return errors;
+  }
+
+  const VALID_STATUSES = new Set(['pass', 'fail', 'blocked', 'skip']);
+
+  for (let i = 0; i < step_results.length; i++) {
+    const step = step_results[i];
+    if (step == null || typeof step !== 'object' || typeof step.step_id !== 'string') {
+      errors.push(`step_results[${i}] is malformed: must be a non-null object with a string step_id`);
+    }
+  }
+
+  const seenIds = new Set();
+  for (const step of step_results) {
+    if (step == null || typeof step !== 'object') continue;
+    if (seenIds.has(step.step_id)) {
+      errors.push(`duplicate step_id: ${step.step_id}`);
+    }
+    seenIds.add(step.step_id);
+    if (step.status != null && !VALID_STATUSES.has(step.status)) {
+      errors.push(`step "${step.step_id}" has unknown status: "${step.status}"`);
+    }
+  }
+
+  // A scenario cannot be "pass" if any step is "fail" or "blocked"
+  if (verdict === 'pass') {
+    const failingSteps = step_results.filter(
+      s => s.status === 'fail' || s.status === 'blocked'
+    );
+    if (failingSteps.length > 0) {
+      const ids = failingSteps.map(s => s.step_id).join(', ');
+      errors.push(
+        `scenario verdict is "pass" but steps [${ids}] have status fail/blocked`
+      );
+    }
+  }
+
+  return errors;
+}
+
+/**
+ * Validate step results against a scenario definition's required_steps.
+ * Used when the scenario definition is available (policy evaluation phase).
+ *
+ * @param {object} scenarioResult - A single scenario_results[] item
+ * @param {string[]} requiredSteps - Step IDs from scenario definition's success_criteria.required_steps
+ * @returns {string[]} Array of error messages (empty if valid)
+ */
+export function validateRequiredSteps(scenarioResult, requiredSteps) {
+  const errors = [];
+  const { step_results, verdict } = scenarioResult;
+
+  if (!step_results) return ['step_results missing'];
+
+  const resultMap = new Map(step_results.map(s => [s.step_id, s]));
+
+  // Every required step must have a matching step_result
+  for (const stepId of requiredSteps) {
+    const result = resultMap.get(stepId);
+    if (!result) {
+      errors.push(`required step "${stepId}" has no matching step_result`);
+    }
+  }
+
+  // A scenario cannot be "pass" if any required step is fail/blocked
+  if (verdict === 'pass') {
+    for (const stepId of requiredSteps) {
+      const result = resultMap.get(stepId);
+      if (result && (result.status === 'fail' || result.status === 'blocked')) {
+        errors.push(
+          `scenario verdict is "pass" but required step "${stepId}" has status "${result.status}"`
+        );
+      }
+    }
+  }
+
+  return errors;
+}

package/validators/verdict.js

@@ -1,93 +1,93 @@
-/**
- * Verdict computation
- *
- * Core rule: verifier may confirm or downgrade the proposed verdict, never upgrade.
- *
- * Verdict severity (highest to lowest): fail > blocked > partial > pass
- */
-
-const VERDICT_RANK = { fail: 0, blocked: 1, partial: 2, pass: 3 };
-
-/**
- * Compute the verified verdict.
- *
- * @param {string|null} proposed - Source-proposed verdict
- * @param {object} context
- * @param {boolean} context.schemaValid
- * @param {boolean} context.policyValid
- * @param {boolean} context.provenanceConfirmed
- * @param {object[]} context.scenarioResults - scenario_results from submission
- * @param {string[]} context.reasons - accumulated rejection reasons
- * @returns {{ verified: string, downgraded: boolean, downgrade_reasons: string[] }}
- */
-export function computeVerdict(proposed, context) {
-  const { schemaValid, policyValid, provenanceConfirmed, scenarioResults, reasons } = context;
-  const downgrade_reasons = [];
-
-  // If fundamentals fail, verdict is "fail" regardless
-  if (!schemaValid || !provenanceConfirmed) {
-    const verified = 'fail';
-    if (proposed && proposed !== 'fail') {
-      downgrade_reasons.push('schema or provenance validation failed');
-    }
-    return {
-      verified,
-      downgraded: proposed != null && VERDICT_RANK[verified] < VERDICT_RANK[proposed],
-      downgrade_reasons
-    };
-  }
-
-  // Compute the worst scenario verdict
-  let worstScenarioRank = VERDICT_RANK.pass;
-  for (const sr of scenarioResults || []) {
-    let rank = VERDICT_RANK[sr.verdict];
-    if (rank == null) {
-      rank = VERDICT_RANK.fail;
-      downgrade_reasons.push('verdict: unrecognized scenario verdict "' + sr.verdict + '", treating as fail');
-    }
-    if (rank < worstScenarioRank) {
-      worstScenarioRank = rank;
-    }
-  }
-
-  // Determine the floor verdict from evidence
-  let floorVerdict = Object.entries(VERDICT_RANK)
-    .find(([, rank]) => rank === worstScenarioRank)?.[0] || 'pass';
-
-  // Policy failure forces at least "fail"
-  if (!policyValid) {
-    floorVerdict = 'fail';
-    downgrade_reasons.push('policy validation failed');
-  }
-
-  // The verified verdict is the worse of proposed and floor
-  // (we never upgrade, so if proposed is worse than floor, keep proposed)
-  if (proposed && VERDICT_RANK[proposed] == null) {
-    downgrade_reasons.push('verdict: unrecognized proposed verdict "' + proposed + '", treating as fail');
-  }
-  if (!proposed) {
-    downgrade_reasons.push('verdict: no proposed verdict provided, defaulting to fail');
-  }
-  const proposedRank = proposed ? (VERDICT_RANK[proposed] ?? VERDICT_RANK.fail) : VERDICT_RANK.fail;
-  const floorRank = VERDICT_RANK[floorVerdict];
-
-  let verified;
-  if (floorRank < proposedRank) {
-    // Floor is worse (lower rank = more severe) — downgrade
-    verified = floorVerdict;
-    if (proposed && proposed !== floorVerdict) {
-      downgrade_reasons.push(
-        `scenario/policy evidence requires "${floorVerdict}" but source proposed "${proposed}"`
-      );
-    }
-  } else {
-    // Proposed is same or worse — keep proposed (never upgrade)
-    verified = proposed || 'fail';
-  }
-
-  return {
-    verified,
-    downgraded: proposed != null && VERDICT_RANK[verified] < VERDICT_RANK[proposed],
-    downgrade_reasons
-  };
-}
+/**
+ * Verdict computation
+ *
+ * Core rule: verifier may confirm or downgrade the proposed verdict, never upgrade.
+ *
+ * Verdict severity (highest to lowest): fail > blocked > partial > pass
+ */
+
+const VERDICT_RANK = { fail: 0, blocked: 1, partial: 2, pass: 3 };
+
+/**
+ * Compute the verified verdict.
+ *
+ * @param {string|null} proposed - Source-proposed verdict
+ * @param {object} context
+ * @param {boolean} context.schemaValid
+ * @param {boolean} context.policyValid
+ * @param {boolean} context.provenanceConfirmed
+ * @param {object[]} context.scenarioResults - scenario_results from submission
+ * @param {string[]} context.reasons - accumulated rejection reasons
+ * @returns {{ verified: string, downgraded: boolean, downgrade_reasons: string[] }}
+ */
+export function computeVerdict(proposed, context) {
+  const { schemaValid, policyValid, provenanceConfirmed, scenarioResults, reasons } = context;
+  const downgrade_reasons = [];
+
+  // If fundamentals fail, verdict is "fail" regardless
+  if (!schemaValid || !provenanceConfirmed) {
+    const verified = 'fail';
+    if (proposed && proposed !== 'fail') {
+      downgrade_reasons.push('schema or provenance validation failed');
+    }
+    return {
+      verified,
+      downgraded: proposed != null && VERDICT_RANK[verified] < VERDICT_RANK[proposed],
+      downgrade_reasons
+    };
+  }
+
+  // Compute the worst scenario verdict
+  let worstScenarioRank = VERDICT_RANK.pass;
+  for (const sr of scenarioResults || []) {
+    let rank = VERDICT_RANK[sr.verdict];
+    if (rank == null) {
+      rank = VERDICT_RANK.fail;
+      downgrade_reasons.push('verdict: unrecognized scenario verdict "' + sr.verdict + '", treating as fail');
+    }
+    if (rank < worstScenarioRank) {
+      worstScenarioRank = rank;
+    }
+  }
+
+  // Determine the floor verdict from evidence
+  let floorVerdict = Object.entries(VERDICT_RANK)
+    .find(([, rank]) => rank === worstScenarioRank)?.[0] || 'pass';
+
+  // Policy failure forces at least "fail"
+  if (!policyValid) {
+    floorVerdict = 'fail';
+    downgrade_reasons.push('policy validation failed');
+  }
+
+  // The verified verdict is the worse of proposed and floor
+  // (we never upgrade, so if proposed is worse than floor, keep proposed)
+  if (proposed && VERDICT_RANK[proposed] == null) {
+    downgrade_reasons.push('verdict: unrecognized proposed verdict "' + proposed + '", treating as fail');
+  }
+  if (!proposed) {
+    downgrade_reasons.push('verdict: no proposed verdict provided, defaulting to fail');
+  }
+  const proposedRank = proposed ? (VERDICT_RANK[proposed] ?? VERDICT_RANK.fail) : VERDICT_RANK.fail;
+  const floorRank = VERDICT_RANK[floorVerdict];
+
+  let verified;
+  if (floorRank < proposedRank) {
+    // Floor is worse (lower rank = more severe) — downgrade
+    verified = floorVerdict;
+    if (proposed && proposed !== floorVerdict) {
+      downgrade_reasons.push(
+        `scenario/policy evidence requires "${floorVerdict}" but source proposed "${proposed}"`
+      );
+    }
+  } else {
+    // Proposed is same or worse — keep proposed (never upgrade)
+    verified = proposed || 'fail';
+  }
+
+  return {
+    verified,
+    downgraded: proposed != null && VERDICT_RANK[verified] < VERDICT_RANK[proposed],
+    downgrade_reasons
+  };
+}