@dogfood-lab/verify 1.5.0 → 1.7.0

package/README.md

@@ -83,7 +83,7 @@ Provenance fields (`github_run_id`, `github_workflow_ref`) are required when `pr
 
 ### Prefix taxonomy
 
-The verifier emits two prefix classes:
+The verifier emits rejection-reason strings under stable prefixes, each mapping to one of four routing classes:
 
 Discrimination happens by **class**, surfaced by `parseRejectionReason` (below). Every prefix maps to one of four classes: **submission-bad** (the submitter fixes the payload), **operational** (the verifier/tooling faulted), **ingest** (an ingest-side load fault), or **unknown** (unrecognized prefix).
 
@@ -92,9 +92,10 @@ Discrimination happens by **class**, surfaced by `parseRejectionReason` (below).
 | Prefix | Source | Meaning |
 |---|---|---|
 | `schema:` | `validators/schema.js` | JSON Schema check on the submission/record envelope failed. The rest of the string carries the AJV path + message. |
-| `policy:` | `validators/policy.js` | Per-repo policy gate failed (forbidden tags, missing required fields, surface evidence/CI requirements, etc.). |
+| `policy:` | `validators/policy.js` | Per-repo policy gate failed (forbidden tags, missing required fields, surface evidence/CI requirements, or a declarative `when`/`custom_rules` predicate matched — see the [policy DSL](https://dogfood-lab.github.io/testing-os/handbook/policy-dsl/)). |
+| `policy-config:` | `validators/policy.js` | **VERIFY-F1.** A REPO custom-rule predicate hit an eval-time semantic fault the schema could not catch — an unknown leading field, a numeric operator against a non-number, or a depth/width/fan-out budget. The repo authored the bad rule, so the fix is the submitter's. (A malformed GLOBAL predicate is `VALIDATOR_FAULT_POLICY:` operational instead — see below.) |
 | `steps[<id>]:` | `validators/steps.js` | Step-level contract check failed on a specific step id (gate accumulation, ordering, evidence shape). |
-| `provenance:` | `validators/provenance.js` | The GitHub run-id confirmation could not match the submitted commit/repo at the GitHub API. |
+| `provenance:` | `validators/provenance.js` | The run was genuinely **absent / not confirmable** — a 404 from the provider API, or the run head did not match the submitted commit/repo. The submitter's payload points at a run that does not exist or does not bind. (Operational provider faults — 429/5xx/401/403 — are NOT this class; see `provenance-fault:` below.) |
 | `repo:` | `index.js` cross-field guard | `submission.repo` does not match the owner/repo encoded in `source.run_url` (anti-forgery guard). Emitted as `repo:mismatch: …`. |
 | `submission-contains-verifier-field:` | `index.js` | The submission carried a verifier-owned field (`policy_version`, `verification`, or an object `overall_verdict`) it must not author. |
 | `CONTRACT_SCHEMA_TOO_NEW:` | `validators/schema-version.js` | The submission's `schema_version` declares a MAJOR **above** what this build supports (see `SUPPORTED_SCHEMA_VERSIONS` in `@dogfood-lab/schemas`). This build cannot understand a future contract — **the operator must upgrade testing-os**, but the routing class stays submission-bad (the payload as-shipped cannot be accepted by THIS build). |
@@ -105,10 +106,11 @@ Discrimination happens by **class**, surfaced by `parseRejectionReason` (below).
 | Prefix | Source | Meaning |
 |---|---|---|
 | `VALIDATOR_FAULT_SCHEMA:` | `runValidator('schema', …)` catch | Internal exception inside the schema validator. The rest of the string carries the thrown `.message`. |
-| `VALIDATOR_FAULT_POLICY:` | `runValidator('policy', …)` catch | Internal exception inside the policy validator. |
+| `VALIDATOR_FAULT_POLICY:` | `runValidator('policy', …)` catch | Internal exception inside the policy validator — including a **GLOBAL** declarative-rule predicate fault (VERIFY-F1): a broken `policies/global-policy.yaml` is an ops incident (the studio's own config), so its predicate fault throws here rather than bouncing to the submitter. The repo-authored counterpart is `policy-config:` submission-bad. |
 | `VALIDATOR_FAULT_STEPS:` | `runValidator('steps', …)` catch | Internal exception inside the steps validator. |
 | `VALIDATOR_FAULT_CONTRACT_SCHEMA_VERSION:` | `runValidator('contract_schema_version', …)` catch | The version gate was called with an unknown contract key (a programmer error at the call site, not a submission fault). |
 | `submission-malformed:` | `index.js` null/non-object early-return | The submission itself was `null` or not an object — a malfunctioning **dispatcher** sent garbage, not a submitter who authored a bad-but-shaped payload. Page ops / inspect the dispatch pipeline; do NOT bounce it to a submitter. |
+| `provenance-fault:` | `index.js` provenance catch | The provenance adapter THREW an operational error confirming the run — a provider **429 rate-limit, 5xx outage, or 401/403 token** fault (`validators/provenance.js` throws these on purpose for non-404 responses). The submitter's payload is fine; the verifier could not reach a verdict. Page ops / retry; do NOT bounce it to a submitter. Distinct from the submission-bad `provenance:` (genuine absence/404). |
 
 Any future `VALIDATOR_FAULT_<NEW>:` prefix is classified `operational` by family — `parseRejectionReason` matches the `VALIDATOR_FAULT_` head, so a new validator class needs no parser edit. The `submission-malformed:` prefix is matched literally (it is not part of the `VALIDATOR_FAULT_` family).
 
@@ -153,6 +155,10 @@ for (const r of result.rejection_reasons) {
 
 Persistence note: every entry above is round-tripped verbatim through `verification.rejection_reasons` in the persisted-record JSON; the schema enforces `array of string` so any consumer of the audit-DB ground truth sees the same prefix vocabulary.
 
+### Warnings channel (accepted-with-warning)
+
+Not every policy signal is a rejection. A policy rule declared `severity: warn` produces a `policy: <id>: <message>` entry on `verification.warnings` (an optional `array of string` on the persisted record) **without** flipping the verdict to `rejected` — the submission is accepted and recorded, the warning rides alongside it. (`severity: info` rules are logged only and never persisted; `severity: reject` rules go to `rejection_reasons` as above.) Consumers that want advisory signals read `verification.warnings`; the routing decision (`parseRejectionReason`) only concerns `rejection_reasons`. A clean accepted submission carries no `warnings` key at all.
+
 ## Docs
 
 📖 Full handbook: **<https://dogfood-lab.github.io/testing-os/handbook/>**

package/cli.js

@@ -316,7 +316,10 @@ export function renderExplain(record) {
   const accepted = v.status === 'accepted';
   const lines = [];
 
-  lines.push(accepted ? 'VERDICT: accepted' : 'VERDICT: rejected');
+  // Uppercase the rendered state word to match the sibling verdict banners
+  // (findings-render.js). This is display-only; the underlying enum
+  // (v.status, --json output) stays lowercase.
+  lines.push(`VERDICT: ${(v.status || (accepted ? 'accepted' : 'rejected')).toUpperCase()}`);
   lines.push('');
   lines.push(`  schema_valid:         ${v.schema_valid}`);
   lines.push(`  policy_valid:         ${v.policy_valid}`);

package/index.js

@@ -209,9 +209,15 @@ export async function verify(submission, options) {
         refCommitSha: submission.ref?.commit_sha
       });
     } catch (err) {
-      reasons.push(`provenance: verification failed: ${err.message}`);
+      // verify-A-002: the adapter THROWS on operational provider faults
+      // (429 rate-limit, 5xx outage, 401/403 token) and returns false only for
+      // a genuinely-absent run (404/transport). Emit a DISTINCT `provenance-fault:`
+      // prefix here so parseRejectionReason routes the incident to ops instead of
+      // bouncing an outage back to the submitter as submission-bad. The not-confirmed
+      // case below keeps the bare `provenance:` prefix (still submission-bad).
+      reasons.push(`provenance-fault: verification failed: ${err.message}`);
     }
-    if (!provenanceConfirmed && !reasons.some(r => r.startsWith('provenance:'))) {
+    if (!provenanceConfirmed && !reasons.some(r => r.startsWith('provenance'))) {
       reasons.push('provenance: source run could not be confirmed');
     }
   }
@@ -243,6 +249,12 @@ export async function verify(submission, options) {
   // BEFORE handing the (broken) policy to `validatePolicy`, so the
   // operator sees a real "policy:" rejection in `rejection_reasons`.
   let policyValid = false;
+  // VERIFY-F4: severity:warn / severity:info policy rules surface here as an
+  // accepted-with-warning channel. Warnings NEVER enter `reasons` (which become
+  // rejection_reasons and flip status to 'rejected') — they land on
+  // verification.warnings at assembly so an operator sees the advisory without
+  // the submission being bounced.
+  const warnings = [];
   if (schemaResult.valid) {
     if (repoPolicy && repoPolicy.__torn === true) {
       const detail = repoPolicy.reason || 'repo policy YAML failed to parse';
@@ -253,6 +265,12 @@ export async function verify(submission, options) {
       if (policyRun.ok) {
         policyValid = policyRun.result.valid;
         reasons.push(...policyRun.result.errors.map(e => `policy: ${e}`));
+        // VERIFY-F1: a malformed REPO custom-rule predicate is a distinct
+        // `policy-config:` rejection (submission-bad — the repo authored the bad
+        // rule). A malformed GLOBAL predicate never reaches here; it throws and
+        // surfaces as VALIDATOR_FAULT_POLICY (operational) via the else branch.
+        reasons.push(...(policyRun.result.configErrors || []).map(e => `policy-config: ${e}`));
+        warnings.push(...(policyRun.result.warnings || []).map(w => `policy: ${w}`));
       } else {
         reasons.push(policyRun.faultReason);
       }
@@ -300,7 +318,8 @@ export async function verify(submission, options) {
       provenance_confirmed: provenanceConfirmed,
       schema_valid: schemaResult.valid,
       policy_valid: policyValid,
-      rejection_reasons: reasons
+      rejection_reasons: reasons,
+      ...(warnings.length ? { warnings } : {})
     },
     ...(submission.notes ? { notes: submission.notes } : {})
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dogfood-lab/verify",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "type": "module",
   "description": "Central verifier for testing-os. Validates submissions against schema and policy, produces persisted records.",
   "main": "index.js",

package/parse-rejection.js

@@ -23,8 +23,12 @@
  *
  * The prefix vocabulary below is enumerated from the ACTUAL emitters — it is
  * NOT invented:
- *   - verify/index.js:                schema:, policy:, steps[<id>]:,
- *                                     provenance:, repo:,
+ *   - verify/index.js:                schema:, policy:, policy-config: (VERIFY-F1,
+ *                                     repo custom-rule predicate fault → submission-bad),
+ *                                     steps[<id>]:,
+ *                                     provenance: (run absent → submission-bad),
+ *                                     provenance-fault: (provider 429/5xx/401/403
+ *                                       → operational), repo:,
  *                                     submission-contains-verifier-field:,
  *                                     submission-malformed:,
  *                                     VALIDATOR_FAULT_<NAME>:
@@ -60,7 +64,22 @@
 const LITERAL_PREFIXES = [
   // submission-bad
   { match: 'schema:', prefix: 'schema:', class: 'submission-bad' },
+  // VERIFY-F1: a malformed REPO custom-rule predicate (eval-time semantic fault the
+  // schema could not catch). submission-bad — the repo authored the bad policy YAML,
+  // so the fix belongs to the submitter, not studio ops. Ordered BEFORE `policy:`
+  // to keep the most-specific-first invariant (the tokens don't overlap — `policy:`
+  // ends at the colon, `policy-config:` continues with `-config:` — but the order is
+  // explicit). A malformed GLOBAL predicate is operational (VALIDATOR_FAULT_POLICY).
+  { match: 'policy-config:', prefix: 'policy-config:', class: 'submission-bad' },
   { match: 'policy:', prefix: 'policy:', class: 'submission-bad' },
+  // operational — a provider-side provenance FAULT (429/5xx/401/403). The
+  // adapter THROWS these (verify-A-002); index.js catches the throw and emits
+  // this distinct `provenance-fault:` prefix so the incident pages ops. Ordered
+  // before the bare `provenance:` literal — it is a distinct token, but keeping
+  // the longer, more-specific match first preserves the most-specific-first
+  // invariant the array is sorted by. The genuine not-confirmed case
+  // (`provenance: source run could not be confirmed`) stays submission-bad below.
+  { match: 'provenance-fault:', prefix: 'provenance-fault:', class: 'operational' },
   { match: 'provenance:', prefix: 'provenance:', class: 'submission-bad' },
   { match: 'repo:', prefix: 'repo:', class: 'submission-bad' },
   {

package/validators/policy.js

@@ -5,6 +5,8 @@
  * Global rules are non-overridable. Repo policies add surface-specific requirements.
  */
 
+import { evaluatePredicate, buildReason, PredicateError } from './predicate.js';
+
 function deepMerge(target, source) {
   const result = { ...target };
   for (const key of Object.keys(source)) {
@@ -29,6 +31,58 @@ function deepMerge(target, source) {
   return result;
 }
 
+/**
+ * Global reject-rule ids the build can account for. Two groups:
+ *   - HANDLED HERE — enforced by the switch below.
+ *   - ENFORCED ELSEWHERE — owned by another validator or by verify() itself
+ *     (the switch's `default` arm intentionally no-ops them).
+ *
+ * PROACT-VERIFY-002: any `severity: reject` rule whose id is OUTSIDE this set is
+ * an operator-added gate the build does not enforce. Silently no-op'ing it (the
+ * old `default: break`) meant the rule looked active in global-policy.yaml but
+ * never ran. We now surface an actionable diagnostic instead. Keep this set in
+ * sync when a new reject rule gains real enforcement.
+ */
+const KNOWN_REJECT_RULE_IDS = new Set([
+  // handled by the switch in validatePolicy
+  'scenario-minimum',
+  'blocked-needs-reason',
+  // enforced by other validators or by verify() itself (default-arm no-op is correct)
+  'schema-valid',
+  'provenance-confirmed',
+  'step-results-present',
+  'step-verdict-consistent',
+  'no-verdict-upgrade',
+]);
+
+// VERIFY-F1: `attested-if-human` is intentionally NOT in the set above. It used to
+// be a switch arm; it is now enforced DECLARATIVELY (it carries a `when` predicate
+// in policies/global-policy.yaml and flows through the engine). If it ever appears
+// WITHOUT a `when` — a misconfigured migration — it falls to the default arm and is
+// NOT in KNOWN_REJECT_RULE_IDS, so it surfaces the "no enforcement" diagnostic
+// (fail-closed) instead of silently doing nothing.
+
+/**
+ * VERIFY-F1: evaluate a declarative rule's `when` predicate against each root and
+ * return one reason string (`[id] body`) per match. Throws {@link PredicateError}
+ * on a semantic fault; the caller decides whether that is operational (global rule)
+ * or submission-bad (repo custom rule).
+ */
+function collectMatches(rule, roots, scope) {
+  const reasons = [];
+  for (const root of roots) {
+    if (evaluatePredicate(rule.when, root, scope)) reasons.push(buildReason(rule, root));
+  }
+  return reasons;
+}
+
+/** Route matched reasons by severity. reject -> errors, warn -> warnings, info -> logged-only. */
+function routeReasons(rule, reasons, errors, warnings) {
+  if (rule.severity === 'reject') errors.push(...reasons);
+  else if (rule.severity === 'warn') warnings.push(...reasons);
+  // info: intentionally non-surfacing
+}
+
 /**
  * Resolve the effective surface policy for a given product surface.
  * Repo policy overrides global defaults per surface.
@@ -55,16 +109,59 @@ function resolveSurfacePolicy(surface, globalPolicy, repoPolicy) {
  * @param {object} options
  * @param {object} options.globalPolicy
  * @param {object|null} options.repoPolicy
- * @returns {{ valid: boolean, errors: string[] }}
+ * @returns {{ valid: boolean, errors: string[], warnings: string[], configErrors: string[] }}
+ *   `configErrors` (VERIFY-F1) are eval-time repo custom-rule predicate faults; the
+ *   caller emits them with a `policy-config:` prefix (submission-bad). A non-empty
+ *   `configErrors` makes `valid` false.
  */
 export function validatePolicy(submission, { globalPolicy, repoPolicy }) {
   const errors = [];
+  // VERIFY-F4: warn-severity rules record an accepted-with-warning note here
+  // instead of being silently dropped. A populated warnings[] never affects
+  // `valid` — the caller (index.js) routes it to verification.warnings.
+  const warnings = [];
+  // VERIFY-F1: a malformed REPO custom-rule predicate (an eval-time semantic fault
+  // the schema could not catch — unknown leading field, numeric op vs non-number,
+  // over-depth) is a `policy-config:` submission-bad reason recorded here (the repo
+  // authored the bad rule; do NOT page studio ops). A non-empty configErrors flips
+  // `valid` false (fail-closed). The caller prefixes these `policy-config: `, not
+  // `policy: `. Global-rule predicate faults are NOT collected here — they throw
+  // (-> VALIDATOR_FAULT_POLICY, operational).
+  const configErrors = [];
 
   // --- Global rules (non-overridable) ---
 
   const globalRules = globalPolicy.global_rules || [];
 
   for (const rule of globalRules) {
+    // VERIFY-F1: a rule carrying a `when` predicate is enforced DECLARATIVELY by
+    // the engine; a rule WITHOUT `when` falls to the legacy severity handling +
+    // id switch below (the seven built-ins that stay code-enforced). A GLOBAL-rule
+    // predicate fault is allowed to THROW (-> VALIDATOR_FAULT_POLICY, operational):
+    // a broken global policy is an operator/ops incident, mirroring loadGlobalPolicy's
+    // fail-loud schema gate. scope 'scenario_result' evaluates per element in array
+    // order (one reason per offending element); 'submission' (default) evaluates once.
+    if (rule.when) {
+      const scope = rule.scope || 'submission';
+      const roots = scope === 'scenario_result'
+        ? (submission.scenario_results || [])
+        : [submission];
+      routeReasons(rule, collectMatches(rule, roots, scope), errors, warnings);
+      continue;
+    }
+
+    // VERIFY-F4: a global warn-rule is accepted-with-warning; an info-rule logs
+    // only. Neither may reject. Mirrors the PROACT-VERIFY-002 discipline of not
+    // dropping operator-authored rules on the floor: a declared rule that the
+    // build does nothing with is invisible to the operator who wrote it.
+    if (rule.severity === 'warn') {
+      warnings.push(`${rule.id}: ${rule.description || 'policy warning'}`);
+      continue;
+    }
+    if (rule.severity === 'info') {
+      // Logged only — info rules are intentionally non-surfacing in the record.
+      continue;
+    }
     if (rule.severity !== 'reject') continue;
 
     switch (rule.id) {
@@ -74,15 +171,10 @@ export function validatePolicy(submission, { globalPolicy, repoPolicy }) {
         }
         break;
 
-      case 'attested-if-human':
-        for (const sr of submission.scenario_results || []) {
-          if ((sr.execution_mode === 'human' || sr.execution_mode === 'mixed') && !sr.attested_by) {
-            errors.push(
-              `[${rule.id}] scenario "${sr.scenario_id}": execution_mode is "${sr.execution_mode}" but attested_by is missing`
-            );
-          }
-        }
-        break;
+      // VERIFY-F1: the `attested-if-human` switch arm was removed in v1.7.0. The rule
+      // is now enforced declaratively via a `when` predicate (see the `if (rule.when)`
+      // branch above and policies/global-policy.yaml). The differential-equivalence
+      // gate proves the declarative form is byte-identical to this removed arm.
 
       case 'blocked-needs-reason':
         for (const sr of submission.scenario_results || []) {
@@ -95,8 +187,20 @@ export function validatePolicy(submission, { globalPolicy, repoPolicy }) {
         break;
 
       // schema-valid, provenance-confirmed, step-results-present, step-verdict-consistent,
-      // no-verdict-upgrade are enforced by other validators or the main verify() function
+      // no-verdict-upgrade are enforced by other validators or the main verify() function.
+      // PROACT-VERIFY-002: a reject rule the build neither handles here NOR enforces
+      // elsewhere would otherwise pass SILENTLY — the operator's new gate never runs.
+      // Reject the submission with a diagnostic naming the unenforced rule so the gap
+      // is visible instead of failing open.
       default:
+        if (!KNOWN_REJECT_RULE_IDS.has(rule.id)) {
+          // No `policy:` prefix here — index.js prepends it to every policy
+          // error (mirrors the `[rule.id]` / `surface[...]` messages above).
+          errors.push(
+            `rule "${rule.id}" is declared severity:reject but has no enforcement in this build — ` +
+              `add an enforcement arm in validators/policy.js or register it in KNOWN_REJECT_RULE_IDS`
+          );
+        }
         break;
     }
   }
@@ -134,6 +238,49 @@ export function validatePolicy(submission, { globalPolicy, repoPolicy }) {
           }
         }
       }
+
+      // VERIFY-F2: tag gating. forbidden_tags rejects a scenario_result carrying
+      // any listed tag; required_tags rejects one missing any listed tag (a
+      // tagless scenario fails every required_tags rule). Tags are optional on
+      // the scenario_result, so an absent `tags` array trips required_tags but
+      // never forbidden_tags.
+      const tags = new Set(sr.tags || []);
+
+      if (evidenceReqs.forbidden_tags) {
+        for (const tag of evidenceReqs.forbidden_tags) {
+          if (tags.has(tag)) {
+            errors.push(
+              `surface[${surface}]: scenario "${sr.scenario_id}" carries forbidden tag "${tag}"`
+            );
+          }
+        }
+      }
+
+      if (evidenceReqs.required_tags) {
+        for (const tag of evidenceReqs.required_tags) {
+          if (!tags.has(tag)) {
+            errors.push(
+              `surface[${surface}]: scenario "${sr.scenario_id}" is missing required tag "${tag}"`
+            );
+          }
+        }
+      }
+    }
+
+    // VERIFY-F1: declarative custom rules for this surface, evaluated per
+    // scenario_result. Additive-only (reject/warn/info, no accept verb) so a repo
+    // can never weaken a global gate. A predicate fault here is a `policy-config:`
+    // submission-bad reason (the repo authored the bad rule), NOT an ops page.
+    for (const customRule of surfacePolicy.custom_rules || []) {
+      try {
+        routeReasons(customRule, collectMatches(customRule, [sr], 'scenario_result'), errors, warnings);
+      } catch (err) {
+        if (err instanceof PredicateError) {
+          configErrors.push(`rule "${customRule.id}": ${err.message}`);
+          continue;
+        }
+        throw err;
+      }
     }
   }
 
@@ -176,5 +323,10 @@ export function validatePolicy(submission, { globalPolicy, repoPolicy }) {
     }
   }
 
-  return { valid: errors.length === 0, errors };
+  return {
+    valid: errors.length === 0 && configErrors.length === 0,
+    errors,
+    warnings,
+    configErrors,
+  };
 }

package/validators/predicate.js

@@ -0,0 +1,289 @@
+/**
+ * Predicate engine (VERIFY-F1)
+ *
+ * A bounded, NO-EVAL interpreter for the declarative policy DSL. Operators author
+ * rules as structured predicates in their YAML policy file (field-selector +
+ * operator + value, composed with all/any/not/implies); this module evaluates
+ * them. There is no `eval`, `Function`, `vm`, dynamic import, or template-string
+ * execution anywhere in the path — the evaluator is a pure tree-walk. That is the
+ * whole safety thesis (see docs/policy-dsl.md).
+ *
+ * The schema (`policy.schema.json`, recursive `predicate` $def) is the FIRST gate:
+ * unknown operators, malformed nodes, banned path segments, and arity errors are
+ * rejected at policy-LOAD time by `validatePayload('policy', …)` and inherit the
+ * existing origin-based classification (global policy → throws/operational; repo
+ * policy → `__torn`/submission-bad). This module is the SECOND gate: the residual
+ * SEMANTIC faults the schema cannot express — an unknown leading field, a numeric
+ * operator against a non-number, or a predicate nested past the depth cap — surface
+ * as a {@link PredicateError} that the caller (policy.js) turns into a
+ * `policy-config:` reason, classified by predicate origin. A predicate is never
+ * silently skipped and never throws uncaught (fail-closed; Saltzer & Schroeder 1975).
+ */
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+
+/** Combinator nesting cap. A predicate nested deeper is a `max_depth` fault. */
+export const PREDICATE_MAX_DEPTH = 5;
+
+/**
+ * Total-work budgets (VERIFY-F1 Phase 3 hardening — the depth cap bounds NESTING
+ * but not WIDTH or array fan-out). The engine runs synchronously inside the ingest
+ * pipeline, so an unbounded tree-walk would block the event loop. Both budgets are
+ * generous relative to any real policy (a hand-authored rule is a handful of nodes
+ * over a handful of elements) and exist only to refuse a pathological / hostile
+ * predicate as a classified `policy-config:` fault rather than letting it spin.
+ */
+export const PREDICATE_MAX_NODES = 10_000;       // visited predicate nodes per evaluation
+export const PREDICATE_MAX_FRONTIER = 500_000;   // selected values from a `[]` fan-out
+
+/** Field-path segments that must never be traversed (prototype-pollution guard). */
+const POISON_SEGMENTS = new Set(['__proto__', 'constructor', 'prototype']);
+
+/** The closed operator set. Mirrors the `op` enum in policy.schema.json. */
+const OPERATORS = new Set([
+  'equals', 'not_equals', 'in', 'not_in', 'contains', 'not_contains',
+  'exists', 'not_exists', 'gt', 'gte', 'lt', 'lte',
+]);
+
+/**
+ * A structured predicate fault (compile- or eval-time). The `code` is a stable
+ * machine token; the message is operator-actionable (names the rule + the exact
+ * problem). The caller maps this to a `policy-config:` rejection reason, classified
+ * by the predicate's origin (global → operational, repo → submission-bad).
+ */
+export class PredicateError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = 'PredicateError';
+    this.code = code;
+  }
+}
+
+/**
+ * Known leading-field sets per scope, derived from the submission schema so the
+ * allowlist never drifts from the contract (CLAUDE.md rule #5: schemas via
+ * createRequire). Only the LEADING path segment is validated — a deeper typo just
+ * resolves to `undefined` (no match), but a wrong leading field is an operator
+ * error worth a diagnostic.
+ */
+const KNOWN_FIELDS = (() => {
+  const require = createRequire(import.meta.url);
+  const schemaPath = require.resolve('@dogfood-lab/schemas/json/dogfood-record-submission.schema.json');
+  const schema = JSON.parse(readFileSync(schemaPath, 'utf-8'));
+  const submission = new Set(Object.keys(schema.properties || {}));
+  const srProps = schema.properties?.scenario_results?.items?.properties || {};
+  const scenario_result = new Set(Object.keys(srProps));
+  return { submission, scenario_result };
+})();
+
+/** Split a dotted field path into segments, normalizing the `[]` array marker. */
+function splitPath(field) {
+  // 'scenario_results[].tags' -> ['scenario_results', '[]', 'tags']
+  const segments = [];
+  for (const raw of String(field).split('.')) {
+    const m = raw.match(/^([A-Za-z_][A-Za-z0-9_]*)(\[\])?$/);
+    if (!m) throw new PredicateError('bad_field', `field path segment "${raw}" is malformed`);
+    segments.push(m[1]);
+    if (m[2]) segments.push('[]');
+  }
+  return segments;
+}
+
+/** Read one own-property segment without ever touching the prototype chain. */
+function safeGet(value, segment) {
+  if (POISON_SEGMENTS.has(segment)) {
+    // Defense in depth — the schema `pattern` already bans these, but the
+    // evaluator never trusts the schema alone for a security-critical read.
+    throw new PredicateError('banned_segment', `field path segment "${segment}" is forbidden`);
+  }
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return undefined;
+  return Object.hasOwn(value, segment) ? value[segment] : undefined;
+}
+
+/**
+ * Resolve a field path to the list of values it selects. A path with no `[]`
+ * yields exactly one value (possibly `undefined`, preserving "field absent" so
+ * `not_exists` works). Each `[]` segment expands the current frontier across the
+ * elements of the arrays at that position. The only iteration in the whole DSL.
+ */
+function resolvePath(root, segments) {
+  let frontier = [root];
+  for (const seg of segments) {
+    if (seg === '[]') {
+      const next = [];
+      for (const v of frontier) {
+        if (!Array.isArray(v)) continue;
+        // Explicit element loop, NOT `next.push(...v)` — the spread form blows the
+        // call stack on a large array (RangeError) before any budget check fires.
+        for (const el of v) {
+          if (next.length >= PREDICATE_MAX_FRONTIER) {
+            throw new PredicateError(
+              'fanout_budget',
+              `field path selection exceeds the limit of ${PREDICATE_MAX_FRONTIER} elements`
+            );
+          }
+          next.push(el);
+        }
+      }
+      frontier = next;
+    } else {
+      frontier = frontier.map(v => safeGet(v, seg));
+    }
+  }
+  return frontier;
+}
+
+/** Validate the leading field segment against the scope's known-field set. */
+function checkLeadingField(field, scope) {
+  const leading = String(field).split('.')[0].replace('[]', '');
+  const known = KNOWN_FIELDS[scope];
+  if (known && !known.has(leading)) {
+    throw new PredicateError(
+      'unknown_field',
+      `field "${field}" references unknown leading field "${leading}" (known ${scope} fields: ${[...known].join(', ')})`
+    );
+  }
+}
+
+/** Apply one operator to a single resolved value + comparand. */
+function applyOp(op, value, comparand) {
+  switch (op) {
+    case 'equals': return value === comparand;
+    case 'not_equals': return value !== comparand;
+    case 'in': return Array.isArray(comparand) && comparand.includes(value);
+    case 'not_in': return Array.isArray(comparand) && !comparand.includes(value);
+    case 'contains':
+      if (Array.isArray(value)) return value.includes(comparand);
+      if (typeof value === 'string') return value.includes(comparand);
+      return false;
+    case 'not_contains':
+      // not_contains is the negation of contains, so a missing/non-collection
+      // field genuinely "does not contain" the value (matches the v1.6.0
+      // required_tags semantics — a tagless scenario fails required_tags).
+      return !applyOp('contains', value, comparand);
+    case 'exists': return Boolean(value);
+    case 'not_exists': return !value;
+    case 'gt': case 'gte': case 'lt': case 'lte': {
+      if (typeof value !== 'number' || !Number.isFinite(value)) {
+        throw new PredicateError(
+          'type_mismatch',
+          `operator "${op}" requires a numeric field value but got ${describe(value)}`
+        );
+      }
+      if (op === 'gt') return value > comparand;
+      if (op === 'gte') return value >= comparand;
+      if (op === 'lt') return value < comparand;
+      return value <= comparand;
+    }
+    default:
+      // Unreachable when the schema gate ran (op is enum-constrained), but the
+      // evaluator fails closed rather than trusting the schema.
+      throw new PredicateError('unknown_op', `unknown operator "${op}"`);
+  }
+}
+
+function describe(value) {
+  if (value === undefined) return 'undefined (field absent)';
+  if (value === null) return 'null';
+  if (Array.isArray(value)) return 'an array';
+  return `${typeof value} (${JSON.stringify(value)})`;
+}
+
+function isCombinator(node) {
+  return node != null && typeof node === 'object' &&
+    (Array.isArray(node.all) || Array.isArray(node.any) || node.not != null || Array.isArray(node.implies));
+}
+
+/** Evaluate a leaf `{field, op, value?}` against a root, with "any element" semantics. */
+function evalLeaf(node, root, scope) {
+  if (!OPERATORS.has(node.op)) {
+    throw new PredicateError('unknown_op', `unknown operator "${node.op}"`);
+  }
+  checkLeadingField(node.field, scope);
+  const values = resolvePath(root, splitPath(node.field));
+  // The predicate is true when ANY selected value satisfies the operator. For a
+  // scalar (no `[]`) path this is just that single value; for an empty `[]`
+  // selection there is nothing to match, so the leaf is false.
+  for (const v of values) {
+    if (applyOp(node.op, v, node.value)) return true;
+  }
+  return false;
+}
+
+/**
+ * Evaluate a predicate node against a root object (the whole submission for
+ * `submission` scope, or a single scenario_result for `scenario_result` scope).
+ *
+ * @param {object} node - The predicate tree.
+ * @param {object} root - The data to evaluate against.
+ * @param {'submission'|'scenario_result'} scope - Field-resolution scope.
+ * @returns {boolean} True when the (violation) predicate matches.
+ * @throws {PredicateError} On a semantic fault (unknown field, type mismatch, depth, budget).
+ */
+export function evaluatePredicate(node, root, scope) {
+  // The budget is per-evaluation (one call over one root). It bounds the WIDTH a
+  // single predicate can consume, complementing the per-node depth cap.
+  return evalNode(node, root, scope, 1, { nodes: 0 });
+}
+
+function evalNode(node, root, scope, depth, budget) {
+  if (++budget.nodes > PREDICATE_MAX_NODES) {
+    throw new PredicateError(
+      'node_budget',
+      `predicate exceeds the evaluation budget of ${PREDICATE_MAX_NODES} nodes`
+    );
+  }
+  if (isCombinator(node)) {
+    if (depth > PREDICATE_MAX_DEPTH) {
+      throw new PredicateError(
+        'max_depth',
+        `predicate nests deeper than the limit of ${PREDICATE_MAX_DEPTH} combinator levels`
+      );
+    }
+    if (Array.isArray(node.all)) return node.all.every(c => evalNode(c, root, scope, depth + 1, budget));
+    if (Array.isArray(node.any)) return node.any.some(c => evalNode(c, root, scope, depth + 1, budget));
+    if (node.not != null) return !evalNode(node.not, root, scope, depth + 1, budget);
+    // implies: [antecedent, consequent] is the VIOLATION all(antecedent, not(consequent))
+    // — it matches the inputs that BREAK the implication antecedent => consequent.
+    const [antecedent, consequent] = node.implies;
+    return evalNode(antecedent, root, scope, depth + 1, budget)
+      && !evalNode(consequent, root, scope, depth + 1, budget);
+  }
+  return evalLeaf(node, root, scope);
+}
+
+/**
+ * Interpolate a `reason_template`'s `{slot}` placeholders from a root object.
+ * Slots are read via the same prototype-safe accessor as the field selector and
+ * interpolated RAW (no escaping) — the differential-equivalence oracle wraps
+ * values in literal quotes, and any escaping would diverge byte-for-byte. A slot
+ * that resolves to nothing renders empty.
+ */
+function renderTemplate(template, root) {
+  return String(template).replace(/\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, slot) => {
+    // A poison slot is rendered empty — never traversed, never thrown. The own-
+    // property read avoids the prototype chain entirely (no inherited values leak).
+    if (POISON_SEGMENTS.has(slot)) return '';
+    const present = root !== null && typeof root === 'object' && Object.hasOwn(root, slot);
+    const v = present ? root[slot] : undefined;
+    return v === undefined || v === null ? '' : String(v);
+  });
+}
+
+/**
+ * Build the full reason string for a matched rule: `[<id>] <body>`, where the
+ * body is the rendered `reason_template` or, absent that, the rule's
+ * `description`. The `policy:` prefix is NOT added here — verify/index.js prepends
+ * it to every policy error.
+ *
+ * @param {object} rule - The policy rule ({ id, description?, reason_template? }).
+ * @param {object} root - The matched element (scenario_result) or submission.
+ * @returns {string}
+ */
+export function buildReason(rule, root) {
+  const body = rule.reason_template != null
+    ? renderTemplate(rule.reason_template, root)
+    : (rule.description ?? '');
+  return `[${rule.id}] ${body}`;
+}

package/validators/provenance-gitlab.test.js

@@ -212,6 +212,7 @@ describe('gitlabProvenance distinguishes ops failures from missing runs', () =>
     it(`throws an operational error on HTTP ${status} (not a submission-bad false)`, async () => {
       const adapter = gitlabProvenance('token', {
         timeoutMs: 1000,
+        retries: 0,
         fetchImpl: fetchWithStatus(status)
       });
       await assert.rejects(
@@ -298,3 +299,77 @@ describe('gitlabProvenance input guards', () => {
     assert.equal(ok, false);
   });
 });
+
+// ── Bounded retry over transient faults (PROACT-VERIFY-001, mirrors GitHub) ──
+//
+// MEDIUM/resilience: a single 429/5xx blip used to fail the submission as an
+// operational incident. The adapter now retries 429/5xx within a bounded budget
+// (opts.retries, default 2) with exponential backoff (honoring Retry-After), and
+// still THROWS on exhaustion so a genuinely-down provider surfaces as
+// operational — never a false 'confirmed'. 404 is NOT retried.
+
+describe('gitlabProvenance bounded retry (PROACT-VERIFY-001)', () => {
+  it('retries a 429 then confirms on the following 200 (retry worked)', async () => {
+    let calls = 0;
+    const fetchImpl = async () => {
+      calls++;
+      if (calls === 1) {
+        return { ok: false, status: 429, headers: { get: () => null }, json: async () => ({}) };
+      }
+      return { ok: true, status: 200, json: async () => mockPipeline() };
+    };
+    const adapter = gitlabProvenance('token', { timeoutMs: 1000, backoffMs: 1, fetchImpl });
+    const ok = await adapter.confirm(pipelineSource(), { refCommitSha: RUN_HEAD });
+    assert.equal(ok, true, '429-then-200 must confirm — the retry succeeded');
+    assert.equal(calls, 2, 'expected exactly one retry (2 total requests)');
+  });
+
+  it('honors Retry-After (numeric seconds) before the retry', async () => {
+    let calls = 0;
+    const waited = [];
+    const fetchImpl = async () => {
+      calls++;
+      if (calls === 1) {
+        return { ok: false, status: 503, headers: { get: h => (h === 'retry-after' ? '2' : null) }, json: async () => ({}) };
+      }
+      return { ok: true, status: 200, json: async () => mockPipeline() };
+    };
+    const adapter = gitlabProvenance('token', {
+      timeoutMs: 1000,
+      sleepImpl: ms => { waited.push(ms); return Promise.resolve(); },
+      fetchImpl
+    });
+    const ok = await adapter.confirm(pipelineSource(), { refCommitSha: RUN_HEAD });
+    assert.equal(ok, true);
+    assert.deepEqual(waited, [2000], 'Retry-After: 2 must drive a 2000ms wait');
+  });
+
+  it('THROWS on exhausted 5xx retries (a genuinely-down provider still surfaces)', async () => {
+    let calls = 0;
+    const fetchImpl = async () => {
+      calls++;
+      return { ok: false, status: 500, headers: { get: () => null }, json: async () => ({}) };
+    };
+    const adapter = gitlabProvenance('token', { timeoutMs: 1000, retries: 2, backoffMs: 1, fetchImpl });
+    await assert.rejects(
+      adapter.confirm(pipelineSource(), { refCommitSha: RUN_HEAD }),
+      err => {
+        assert.match(err.message, /provenance: GitLab API returned 500/);
+        return true;
+      }
+    );
+    assert.equal(calls, 3, 'expected 1 initial + 2 retries = 3 requests before throwing');
+  });
+
+  it('does NOT retry a 404 (run genuinely absent → single immediate false)', async () => {
+    let calls = 0;
+    const fetchImpl = async () => {
+      calls++;
+      return { ok: false, status: 404, headers: { get: () => null }, json: async () => ({}) };
+    };
+    const adapter = gitlabProvenance('token', { timeoutMs: 1000, retries: 2, backoffMs: 1, fetchImpl });
+    const ok = await adapter.confirm(pipelineSource(), { refCommitSha: RUN_HEAD });
+    assert.equal(ok, false);
+    assert.equal(calls, 1, '404 must not be retried');
+  });
+});

package/validators/provenance.js

@@ -31,6 +31,66 @@ export const GITHUB_PROVENANCE_TIMEOUT_MS = 30000;
  */
 export const GITLAB_PROVENANCE_TIMEOUT_MS = 30000;
 
+/**
+ * Default RETRY budget for a transient provider fault (HTTP 429 rate-limit or a
+ * 5xx provider outage). PROACT-VERIFY-001: a single 429/5xx during a momentary
+ * blip used to fail the whole submission as an operational incident even though
+ * one retry would have confirmed the run. We retry a BOUNDED number of times
+ * with exponential backoff (honoring `Retry-After` when the provider sends it),
+ * then THROW on exhaustion so a genuinely-down provider still surfaces as an
+ * operational signal — never a false 'confirmed'. 404 is NOT retried (the run is
+ * genuinely absent, a single immediate rejection).
+ *
+ * `retries` is the number of ADDITIONAL attempts after the first, so the default
+ * 2 means up to 3 total requests. It is an opts field (like `timeoutMs`) so it
+ * stays test-injectable and the offline stub path is unaffected.
+ */
+export const PROVENANCE_RETRIES = 2;
+
+/**
+ * Base backoff between retry attempts, in ms. Attempt N waits
+ * `PROVENANCE_BACKOFF_MS * 2^(N-1)` (250 → 500 → …), unless the provider sent a
+ * `Retry-After` header, which takes precedence. Injectable via opts so tests run
+ * without real delay.
+ */
+export const PROVENANCE_BACKOFF_MS = 250;
+
+/** HTTP statuses worth retrying: 429 rate-limit + the 5xx provider-outage band. */
+function isRetryableStatus(status) {
+  return status === 429 || (status >= 500 && status <= 599);
+}
+
+/**
+ * Resolve the wait before the next attempt. A `Retry-After` header (delay in
+ * seconds, or an HTTP-date) is honored when present and parseable; otherwise
+ * fall back to exponential backoff. `attempt` is 1-based (1 = wait before the
+ * 2nd request).
+ *
+ * @param {Response} resp - The non-ok response carrying a possible Retry-After.
+ * @param {number} attempt - 1-based retry index.
+ * @param {number} backoffMs - Base backoff.
+ * @returns {number} Milliseconds to wait (never negative).
+ */
+function nextBackoffMs(resp, attempt, backoffMs) {
+  const header = resp?.headers?.get?.('retry-after');
+  if (header != null && header !== '') {
+    const asSeconds = Number(header);
+    if (Number.isFinite(asSeconds) && asSeconds >= 0) {
+      return Math.round(asSeconds * 1000);
+    }
+    const asDate = Date.parse(header);
+    if (!Number.isNaN(asDate)) {
+      return Math.max(0, asDate - Date.now());
+    }
+  }
+  return backoffMs * 2 ** (attempt - 1);
+}
+
+/** Default sleep: a real timer. Injectable via `opts.sleepImpl` for tests. */
+function defaultSleep(ms) {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+
 /**
  * Stub provenance adapter. Always confirms.
  * Use in tests and local development.
@@ -62,6 +122,9 @@ export const rejectingProvenance = {
 export function githubProvenance(token, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? GITHUB_PROVENANCE_TIMEOUT_MS;
   const fetchImpl = opts.fetchImpl ?? fetch;
+  const retries = opts.retries ?? PROVENANCE_RETRIES;
+  const backoffMs = opts.backoffMs ?? PROVENANCE_BACKOFF_MS;
+  const sleep = opts.sleepImpl ?? defaultSleep;
   return {
     /**
      * @param {object} source - submission.source (provider-scoped run claim)
@@ -96,54 +159,57 @@ export function githubProvenance(token, opts = {}) {
 
       const apiUrl = `https://api.github.com/repos/${owner}/${repo}/actions/runs/${provider_run_id}`;
 
-      // Per-request timeout. Without this, a hung GitHub API call (rate-limit
-      // throttle, regional outage, slow connection) blocks ingest indefinitely.
-      // AbortController fires AbortError on timeout — we re-throw with a clear
-      // message so the verifier records it in rejection_reasons instead of
-      // silently treating it as 'provenance returned false.'
-      const controller = new AbortController();
-      const timer = setTimeout(() => controller.abort(), timeoutMs);
-
+      // PROACT-VERIFY-001: bounded retry over transient provider faults (429
+      // rate-limit, 5xx outage). Each attempt carries its own per-request
+      // AbortController timeout — without it a hung GitHub API call blocks ingest
+      // indefinitely. We retry up to `retries` extra times with exponential
+      // backoff (honoring Retry-After), then THROW on exhaustion so a
+      // genuinely-down provider surfaces as an operational signal — never a
+      // false 'confirmed'. 404 is NOT retried (run genuinely absent). The
+      // earlier non-retry behavior (single 429/5xx → immediate throw) failed a
+      // submission on a momentary blip that one retry would have confirmed.
       let run;
-      try {
-        const resp = await fetchImpl(apiUrl, {
-          headers: {
-            Authorization: `Bearer ${token}`,
-            Accept: 'application/vnd.github+json',
-            'X-GitHub-Api-Version': '2022-11-28'
-          },
-          signal: controller.signal
-        });
-
-        if (!resp.ok) {
-          // verify-A-002: only 404 means the run is genuinely absent — a real
-          // submission-bad rejection. Every other non-2xx is an OPERATIONAL
-          // signal (401/403 expired/insufficient token, 429 rate limit, 5xx
-          // GitHub outage). Collapsing those into `return false` made the
-          // verifier record 'source run could not be confirmed' and routing
-          // bounced an ops incident to submitters. Throw so the existing catch
-          // in index.js records it as a provenance verification failure
-          // (operational), mirroring the timeout fix above.
-          if (resp.status === 404) return false;
-          throw new Error(`provenance: GitHub API returned ${resp.status}`);
+      for (let attempt = 0; ; attempt++) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+
+        let resp;
+        try {
+          resp = await fetchImpl(apiUrl, {
+            headers: {
+              Authorization: `Bearer ${token}`,
+              Accept: 'application/vnd.github+json',
+              'X-GitHub-Api-Version': '2022-11-28'
+            },
+            signal: controller.signal
+          });
+        } catch (err) {
+          if (err && (err.name === 'AbortError' || err.code === 'ABORT_ERR')) {
+            throw new Error(`provenance: GitHub API timeout after ${timeoutMs}ms`);
+          }
+          // Genuine transport error (DNS, connection refused) — no run to
+          // confirm. Reserve `return false` for this case (mirrors GitLab).
+          return false;
+        } finally {
+          clearTimeout(timer);
         }
 
-        run = await resp.json();
-      } catch (err) {
-        if (err && (err.name === 'AbortError' || err.code === 'ABORT_ERR')) {
-          throw new Error(`provenance: GitHub API timeout after ${timeoutMs}ms`);
+        if (resp.ok) {
+          run = await resp.json();
+          break;
         }
-        // verify-A-002: operational signals we raised ourselves (non-2xx HTTP)
-        // already carry the 'provenance:' prefix — re-throw them so they reach
-        // index.js as a verification failure rather than being swallowed into
-        // 'return false'. Reserve `return false` for genuine transport errors
-        // (DNS, connection refused) where there is no run to confirm.
-        if (err && typeof err.message === 'string' && err.message.startsWith('provenance:')) {
-          throw err;
+
+        // verify-A-002: only 404 means the run is genuinely absent — a real
+        // submission-bad rejection, never retried. 429/5xx are transient
+        // OPERATIONAL signals: retry within budget. 401/403 (expired/insufficient
+        // token) are NOT transient — throw immediately. On exhausted retries the
+        // last 429/5xx throws so a real outage still surfaces (operational).
+        if (resp.status === 404) return false;
+        if (isRetryableStatus(resp.status) && attempt < retries) {
+          await sleep(nextBackoffMs(resp, attempt + 1, backoffMs));
+          continue;
         }
-        return false;
-      } finally {
-        clearTimeout(timer);
+        throw new Error(`provenance: GitHub API returned ${resp.status}`);
       }
 
       if (run.id !== Number(provider_run_id)) return false;
@@ -211,6 +277,9 @@ export function gitlabProvenance(token, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? GITLAB_PROVENANCE_TIMEOUT_MS;
   const fetchImpl = opts.fetchImpl ?? fetch;
   const apiBase = (opts.apiBase ?? 'https://gitlab.com').replace(/\/+$/, '');
+  const retries = opts.retries ?? PROVENANCE_RETRIES;
+  const backoffMs = opts.backoffMs ?? PROVENANCE_BACKOFF_MS;
+  const sleep = opts.sleepImpl ?? defaultSleep;
   return {
     /**
      * @param {object} source - submission.source (provider-scoped run claim)
@@ -252,46 +321,50 @@ export function gitlabProvenance(token, opts = {}) {
         ? `${apiBase}/api/v4/projects/${projectId}/jobs/${provider_run_id}`
         : `${apiBase}/api/v4/projects/${projectId}/pipelines/${provider_run_id}`;
 
-      // Per-request timeout — identical discipline to githubProvenance. Without
-      // it a hung gitlab.com/api call blocks ingest until the surrounding runner
-      // times out. AbortError → re-thrown with a clear 'provenance:' message so
-      // the verifier records it instead of silently returning false.
-      const controller = new AbortController();
-      const timer = setTimeout(() => controller.abort(), timeoutMs);
-
+      // PROACT-VERIFY-001: bounded retry over transient provider faults — same
+      // discipline as githubProvenance. Each attempt carries its own per-request
+      // AbortController timeout. 429/5xx retry within budget (exponential backoff,
+      // honoring Retry-After), then THROW on exhaustion so a real outage still
+      // surfaces as operational — never a false 'confirmed'. 404 is a single
+      // immediate rejection; 401/403 throw immediately (not transient).
       let run;
-      try {
-        const resp = await fetchImpl(endpoint, {
-          headers: {
-            'PRIVATE-TOKEN': token,
-            Accept: 'application/json'
-          },
-          signal: controller.signal
-        });
-
-        if (!resp.ok) {
-          // Mirror verify-A-002: only 404 means the pipeline/job is genuinely
-          // absent (submission-bad). 401/403/429/5xx are OPERATIONAL — throw so
-          // the catch in index.js records a 'provenance:' verification failure
-          // (paged to ops) instead of bouncing an outage to the submitter.
-          if (resp.status === 404) return false;
-          throw new Error(`provenance: GitLab API returned ${resp.status}`);
+      for (let attempt = 0; ; attempt++) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+
+        let resp;
+        try {
+          resp = await fetchImpl(endpoint, {
+            headers: {
+              'PRIVATE-TOKEN': token,
+              Accept: 'application/json'
+            },
+            signal: controller.signal
+          });
+        } catch (err) {
+          if (err && (err.name === 'AbortError' || err.code === 'ABORT_ERR')) {
+            throw new Error(`provenance: GitLab API timeout after ${timeoutMs}ms`);
+          }
+          // Genuine transport error (DNS, connection refused) — no run to confirm.
+          return false;
+        } finally {
+          clearTimeout(timer);
         }
 
-        run = await resp.json();
-      } catch (err) {
-        if (err && (err.name === 'AbortError' || err.code === 'ABORT_ERR')) {
-          throw new Error(`provenance: GitLab API timeout after ${timeoutMs}ms`);
+        if (resp.ok) {
+          run = await resp.json();
+          break;
         }
-        // Operational signals we raised ourselves already carry the
-        // 'provenance:' prefix — re-throw. Reserve `return false` for genuine
-        // transport errors (DNS, connection refused) where there is no run.
-        if (err && typeof err.message === 'string' && err.message.startsWith('provenance:')) {
-          throw err;
+
+        // Mirror verify-A-002: 404 = pipeline/job genuinely absent (submission-bad,
+        // never retried). 429/5xx = transient operational fault, retry within
+        // budget. 401/403 = non-transient operational, throw immediately.
+        if (resp.status === 404) return false;
+        if (isRetryableStatus(resp.status) && attempt < retries) {
+          await sleep(nextBackoffMs(resp, attempt + 1, backoffMs));
+          continue;
         }
-        return false;
-      } finally {
-        clearTimeout(timer);
+        throw new Error(`provenance: GitLab API returned ${resp.status}`);
       }
 
       // id in the response must match the claimed run id.