@dogfood-lab/verify 1.7.0 → 1.9.0

package/validators/lint-policy.js

@@ -0,0 +1,120 @@
+/**
+ * Policy lint (VERIFY-F3)
+ *
+ * `lintPolicy(policyDoc, { origin })` is the author-time check behind the
+ * `dogfood-verify lint` verb: it validates a whole policy file WITHOUT a submission,
+ * batch-reporting every fault. It is the `opa check` analogue named (as a deferred
+ * companion) in docs/policy-dsl.md and specified in docs/policy-lint.md.
+ *
+ * Three passes, mirroring the runtime's own layering:
+ *   1. Structural gate — `validatePayload('policy', …)` against policy.schema.json (the same
+ *      gate loadGlobalPolicy / loadRepoPolicy run). Catches unknown op, malformed/banned field,
+ *      mixed node, value-arity, custom_rules-under-defaults, additionalProperties.
+ *   2. Static predicate walk — the data-independent semantic faults the schema cannot express:
+ *      unknown leading field, combinator over-depth, node budget (via predicate.js#lintPredicate).
+ *   3. `[]`-footgun advisory — a deterministic warning (never an error) on a negative op over a
+ *      `[]` path (via predicate.js#findEmptyArrayFootguns).
+ *
+ * Coverage boundary (the VERIFY-F2 over-claim lesson): `type_mismatch` and `fanout_budget` are
+ * DATA-DEPENDENT and cannot be caught statically. `coverageNote` says so — a clean lint is "no
+ * static fault and no footgun," NOT "this policy can never produce a policy-config: rejection."
+ */
+
+import { validatePayload } from '@dogfood-lab/schemas';
+import { lintPredicate, findEmptyArrayFootguns } from './predicate.js';
+
+/** Stated in every lint result so a clean verdict is never read as full coverage. */
+export const COVERAGE_NOTE =
+  'Static lint only — it cannot catch a `type_mismatch` (a numeric op over a non-number field) ' +
+  'or a `fanout_budget` overrun; both depend on submission data. Run ' +
+  '`dogfood-verify --file <submission> --explain` to exercise the data-dependent path.';
+
+/**
+ * Lint a parsed policy document.
+ *
+ * @param {unknown} policyDoc - The parsed policy YAML/JSON (any value; a non-object is reported
+ *   by the schema gate).
+ * @param {{ origin?: 'global'|'repo'|'unknown' }} [opts] - The policy's origin, used only for
+ *   reporting (the caller derives it from the file path).
+ * @returns {{
+ *   ok: boolean, origin: string, coverageNote: string,
+ *   errors: { label: string, code: string, location: string, field?: string, message: string }[],
+ *   warnings: { label: string, code: string, location: string, field: string, suggestion: string, message: string }[]
+ * }} `ok` is true iff there are no errors; warnings (footguns) never affect `ok`.
+ */
+export function lintPolicy(policyDoc, { origin = 'unknown' } = {}) {
+  const errors = [];
+  const warnings = [];
+
+  // 1. Structural schema gate.
+  const schema = validatePayload('policy', policyDoc);
+  for (const e of schema.errors) {
+    errors.push({
+      label: 'policy-schema:',
+      code: e.keyword || 'schema',
+      location: e.path || '/',
+      message: e.message || 'schema violation',
+    });
+  }
+
+  // 2 + 3. Static predicate walk + footgun advisory over every `when` location. Defensive: a
+  // schema-invalid doc may have malformed predicates; the walkers tolerate non-objects.
+  for (const { when, scope, location } of collectPredicates(policyDoc)) {
+    for (const f of lintPredicate(when, scope)) {
+      errors.push({ label: 'policy-config:', code: f.code, location, field: f.field, message: f.message });
+    }
+    for (const g of findEmptyArrayFootguns(when)) {
+      warnings.push({
+        label: 'policy-footgun:',
+        code: 'footgun-empty-array',
+        location,
+        field: g.field,
+        suggestion: g.suggestion,
+        message:
+          `negative operator "${g.op}" over the array path "${g.field}" fails OPEN on an empty or ` +
+          `absent array — the rule silently does not fire when there are no elements`,
+      });
+    }
+  }
+
+  return { ok: errors.length === 0, origin, errors, warnings, coverageNote: COVERAGE_NOTE };
+}
+
+/**
+ * Enumerate every `when` predicate in a policy with its evaluation scope and an operator-readable
+ * location. Walks the SAME two locations the runtime evaluates (validators/policy.js):
+ *   - `global_rules[].when` at scope `rule.scope || 'submission'`
+ *   - `surfaces.<surface>.custom_rules[].when` at scope `scenario_result`
+ * `custom_rules` under `defaults` is schema-forbidden, so it is not walked here — the structural
+ * gate already reports it if present (matching the runtime, which never evaluates it).
+ */
+function* collectPredicates(policyDoc) {
+  if (policyDoc === null || typeof policyDoc !== 'object') return;
+
+  const globalRules = Array.isArray(policyDoc.global_rules) ? policyDoc.global_rules : [];
+  for (let i = 0; i < globalRules.length; i++) {
+    const rule = globalRules[i];
+    if (rule && typeof rule === 'object' && rule.when != null) {
+      yield {
+        when: rule.when,
+        scope: rule.scope || 'submission',
+        location: `global_rules[${i}]${rule.id ? ` (${rule.id})` : ''}`,
+      };
+    }
+  }
+
+  const surfaces = policyDoc.surfaces && typeof policyDoc.surfaces === 'object' ? policyDoc.surfaces : {};
+  for (const [surface, sp] of Object.entries(surfaces)) {
+    const customRules = sp && Array.isArray(sp.custom_rules) ? sp.custom_rules : [];
+    for (let i = 0; i < customRules.length; i++) {
+      const rule = customRules[i];
+      if (rule && typeof rule === 'object' && rule.when != null) {
+        yield {
+          when: rule.when,
+          scope: 'scenario_result',
+          location: `surfaces.${surface}.custom_rules[${i}]${rule.id ? ` (${rule.id})` : ''}`,
+        };
+      }
+    }
+  }
+}

package/validators/lint-scenario.js

@@ -0,0 +1,141 @@
+/**
+ * Scenario lint (F-BACKEND-003)
+ *
+ * `lintScenario(scenarioDoc, { file })` is the author-time check behind the
+ * `dogfood-verify lint --scenario <file>` mode: it validates a whole scenario
+ * definition WITHOUT a submission, batch-reporting every fault. It is the
+ * scenario-side sibling of lint-policy.js (VERIFY-F3) and shares its shape,
+ * exit contract, and honest-coverage discipline.
+ *
+ * Three passes, mirroring lint-policy's layering:
+ *   1. Structural gate — `validatePayload('scenario', …)` against scenario.schema.json
+ *      (the same registered schema production ingest uses to fetch + validate a
+ *      committed scenario). Catches missing required fields, bad enums, pattern
+ *      violations, additionalProperties, the verifiable⇒expected conditional.
+ *   2. Author-time value checks the schema cannot express (errors, `scenario-config:`):
+ *      required_steps referencing an undeclared step id, and duplicate step ids.
+ *      The scenario schema literally says required_steps "Must reference valid step
+ *      IDs" but JSON Schema cannot enforce a cross-field id reference, and it
+ *      validates each step in isolation so it cannot see a repeated id.
+ *   3. `filename → scenario_id` advisory (a WARNING, never an error,
+ *      `scenario-footgun:`): the receiver fetches dogfood/scenarios/<scenario_id>.yaml,
+ *      so a basename that differs from scenario_id makes the committed definition
+ *      unreachable and required-steps enforcement silently fails open.
+ *
+ * Coverage boundary (the VERIFY-F2 over-claim lesson): a clean scenario lint is
+ * "no static fault," NOT "a real submission will satisfy this scenario." Static
+ * lint validates the definition in isolation; it cannot verify that a submission's
+ * step_results actually satisfy required_steps, nor that the receiver can reach the
+ * file at the attested commit. `coverageNote` says so.
+ */
+
+import { basename } from 'node:path';
+
+import { validatePayload } from '@dogfood-lab/schemas';
+
+/** Stated in every scenario lint result so a clean verdict is never read as full coverage. */
+export const SCENARIO_COVERAGE_NOTE =
+  'Static lint only — it validates the scenario DEFINITION in isolation. It cannot verify that a ' +
+  "real submission's `step_results` actually satisfy `required_steps`, nor that the receiver can " +
+  'fetch this file at the attested commit (the filename → scenario_id check is a heuristic, not a ' +
+  'guarantee). Run a real ingest of a submission for that.';
+
+/**
+ * Lint a parsed scenario document.
+ *
+ * @param {unknown} scenarioDoc - The parsed scenario YAML/JSON (any value; a non-object is
+ *   reported by the schema gate).
+ * @param {{ file?: string }} [opts] - The source file path (basename → scenario_id advisory).
+ *   When absent, the filename check is skipped (there is no basename to compare).
+ * @returns {{
+ *   ok: boolean, origin: 'scenario', coverageNote: string,
+ *   errors: { label: string, code: string, location: string, field?: string, message: string }[],
+ *   warnings: { label: string, code: string, location: string, field: string, suggestion: string, message: string }[]
+ * }} `ok` is true iff there are no errors; warnings never affect `ok`.
+ */
+export function lintScenario(scenarioDoc, { file } = {}) {
+  const errors = [];
+  const warnings = [];
+
+  // 1. Structural schema gate.
+  const schema = validatePayload('scenario', scenarioDoc);
+  for (const e of schema.errors) {
+    errors.push({
+      label: 'scenario-schema:',
+      code: e.keyword || 'schema',
+      location: e.path || '/',
+      message: e.message || 'schema violation',
+    });
+  }
+
+  // 2. Author-time value checks. Defensive: a schema-invalid doc may have a malformed or
+  // missing steps/success_criteria, so guard every access against non-arrays/non-objects
+  // (mirrors collectPredicates' defensiveness in lint-policy.js).
+  const doc = scenarioDoc && typeof scenarioDoc === 'object' ? scenarioDoc : {};
+  const steps = Array.isArray(doc.steps) ? doc.steps : [];
+
+  // Collect declared step ids, flagging duplicates as we go. A repeated id validates clean
+  // structurally (the schema checks each step in isolation) but is ambiguous at runtime: a
+  // step_result keyed by that id cannot say which step it satisfied.
+  const declaredIds = new Set();
+  const seenIds = new Set();
+  for (let i = 0; i < steps.length; i++) {
+    const step = steps[i];
+    if (!step || typeof step !== 'object') continue;
+    const id = step.id;
+    if (typeof id !== 'string' || id.length === 0) continue;
+    declaredIds.add(id);
+    if (seenIds.has(id)) {
+      errors.push({
+        label: 'scenario-config:',
+        code: 'duplicate_step_id',
+        location: `steps[${i}]`,
+        field: id,
+        message: `step id "${id}" is declared more than once — step ids must be unique so a step_result can name exactly one step`,
+      });
+    }
+    seenIds.add(id);
+  }
+
+  // required_steps must reference a declared step id. The scenario schema says so in prose but
+  // cannot enforce a cross-field id reference.
+  const sc = doc.success_criteria && typeof doc.success_criteria === 'object' ? doc.success_criteria : {};
+  const requiredSteps = Array.isArray(sc.required_steps) ? sc.required_steps : [];
+  for (let i = 0; i < requiredSteps.length; i++) {
+    const ref = requiredSteps[i];
+    if (typeof ref !== 'string') continue; // a non-string entry is a schema fault, already reported above
+    if (!declaredIds.has(ref)) {
+      errors.push({
+        label: 'scenario-config:',
+        code: 'required_step_undeclared',
+        location: `success_criteria.required_steps[${i}]`,
+        field: ref,
+        message: `required step "${ref}" is not declared by any steps[].id — the scenario can never pass because the receiver enforces a step the exercise never runs`,
+      });
+    }
+  }
+
+  // 3. filename → scenario_id advisory. The receiver fetches dogfood/scenarios/<scenario_id>.yaml,
+  // so a mismatch makes the committed definition unreachable and required-steps enforcement fails
+  // OPEN silently. Advisory only — a repo may legitimately hold a scenario under a different name
+  // during authoring (e.g. examples/scenario.example.yaml holds scenario_id "cli-smoke").
+  const scenarioId = doc.scenario_id;
+  if (file && typeof scenarioId === 'string' && scenarioId.length > 0) {
+    const base = basename(String(file)).replace(/\.ya?ml$/i, '');
+    if (base !== scenarioId) {
+      warnings.push({
+        label: 'scenario-footgun:',
+        code: 'filename_scenario_id_mismatch',
+        location: '/',
+        field: 'scenario_id',
+        suggestion: `rename the file to "${scenarioId}.yaml" (or change scenario_id to "${base}")`,
+        message:
+          `the file basename "${base}" does not match scenario_id "${scenarioId}" — the receiver ` +
+          `fetches dogfood/scenarios/${scenarioId}.yaml, so this committed definition is unreachable ` +
+          `and required-steps enforcement silently fails OPEN`,
+      });
+    }
+  }
+
+  return { ok: errors.length === 0, origin: 'scenario', errors, warnings, coverageNote: SCENARIO_COVERAGE_NOTE };
+}

package/validators/policy.js

@@ -50,6 +50,11 @@ const KNOWN_REJECT_RULE_IDS = new Set([
   // enforced by other validators or by verify() itself (default-arm no-op is correct)
   'schema-valid',
   'provenance-confirmed',
+  // F-3bfc2885: enforced by validateRequiredSteps (validators/steps.js), which
+  // verify() runs per scenario_result when the ingest layer supplies loaded
+  // scenario definitions (options.scenarios). The structural half (non-empty
+  // step_results, dup ids, pass-vs-fail over REPORTED steps) is
+  // validateStepResults.
   'step-results-present',
   'step-verdict-consistent',
   'no-verdict-upgrade',
@@ -155,7 +160,10 @@ export function validatePolicy(submission, { globalPolicy, repoPolicy }) {
     // dropping operator-authored rules on the floor: a declared rule that the
     // build does nothing with is invisible to the operator who wrote it.
     if (rule.severity === 'warn') {
-      warnings.push(`${rule.id}: ${rule.description || 'policy warning'}`);
+      // F-57a0c0ad: bracketed `[id]` form — the same shape buildReason gives
+      // declarative rules — so one grep pattern finds every rule-attributed
+      // message regardless of how the rule is enforced.
+      warnings.push(`[${rule.id}] ${rule.description || 'policy warning'}`);
       continue;
     }
     if (rule.severity === 'info') {

package/validators/predicate.js

@@ -134,16 +134,30 @@ function resolvePath(root, segments) {
   return frontier;
 }
 
-/** Validate the leading field segment against the scope's known-field set. */
-function checkLeadingField(field, scope) {
+/**
+ * Decide whether a field's LEADING segment is unknown for a scope, returning the
+ * fault rather than throwing it. Factored out so the eval path ({@link checkLeadingField},
+ * fail-on-first) and the lint path ({@link lintPredicate}, batch-collect) share one
+ * source of truth — a divergence between author-time and runtime diagnostics is
+ * impossible by construction. Data-INDEPENDENT (the known-field set is derived from
+ * the schema), so it is exactly the kind of check the lint can run without a submission.
+ */
+function leadingFieldFault(field, scope) {
   const leading = String(field).split('.')[0].replace('[]', '');
   const known = KNOWN_FIELDS[scope];
   if (known && !known.has(leading)) {
-    throw new PredicateError(
+    return new PredicateError(
       'unknown_field',
       `field "${field}" references unknown leading field "${leading}" (known ${scope} fields: ${[...known].join(', ')})`
     );
   }
+  return null;
+}
+
+/** Validate the leading field segment against the scope's known-field set (eval path: throws). */
+function checkLeadingField(field, scope) {
+  const fault = leadingFieldFault(field, scope);
+  if (fault) throw fault;
 }
 
 /** Apply one operator to a single resolved value + comparand. */
@@ -287,3 +301,149 @@ export function buildReason(rule, root) {
     : (rule.description ?? '');
   return `[${rule.id}] ${body}`;
 }
+
+/* ───────────────────────── Static analysis (VERIFY-F3 policy-lint) ─────────────────────────
+ *
+ * The two functions below analyze a predicate AST WITHOUT a submission. They are the reusable
+ * leaf the `policy-lint` verb (and any future eager-validation path) builds on. Co-located here,
+ * not in a separate module, so they reuse this file's private engine internals (KNOWN_FIELDS via
+ * leadingFieldFault, isCombinator, the depth/node-budget constants) without exporting the guts —
+ * predicate.js owns *everything about a predicate node*: eval AND static analysis.
+ *
+ * Coverage boundary (the VERIFY-F2 over-claim lesson — see docs/policy-lint.md):
+ *   - DATA-INDEPENDENT, caught here: unknown leading field, combinator over-depth, node budget.
+ *   - STRUCTURAL (unknown op, banned/malformed segment, arity): caught earlier by the schema gate
+ *     (`validatePayload('policy', …)`), so lintPredicate does not re-report them.
+ *   - DATA-DEPENDENT, NOT catchable statically: `type_mismatch` (a numeric op over a non-number)
+ *     and `fanout_budget` (a `[]` selection size) — both need a real submission. The lint says so.
+ */
+
+/** A static lint finding: a machine `code` (mirrors {@link PredicateError} codes) + an operator message. */
+
+/**
+ * Statically lint a predicate tree against one scope, batch-collecting the data-independent
+ * semantic faults the schema cannot express. Unlike {@link evaluatePredicate} this NEVER throws —
+ * a lint reports every fault rather than failing on the first — and it is DEFENSIVE: a malformed
+ * node (already flagged by the schema gate) is skipped, not crashed on. The walk mirrors the
+ * evaluator's own depth + node accounting (same constants), so a lint verdict agrees with what the
+ * engine would do at eval time, and the walk is itself bounded (it cannot become a DoS on a
+ * pathological policy file).
+ *
+ * @param {unknown} node - The predicate tree (any value; non-objects are skipped).
+ * @param {'submission'|'scenario_result'} scope - Field-resolution scope.
+ * @returns {{ code: string, field?: string, message: string }[]}
+ */
+export function lintPredicate(node, scope) {
+  const findings = [];
+  walkLint(node, scope, 1, { nodes: 0, depthReported: false, budgetReported: false }, findings);
+  return findings;
+}
+
+function walkLint(node, scope, depth, state, findings) {
+  if (state.budgetReported) return;
+  if (++state.nodes > PREDICATE_MAX_NODES) {
+    if (!state.budgetReported) {
+      state.budgetReported = true;
+      findings.push({
+        code: 'node_budget',
+        message: `predicate exceeds the evaluation budget of ${PREDICATE_MAX_NODES} nodes`,
+      });
+    }
+    return;
+  }
+  if (node === null || typeof node !== 'object') return;
+
+  if (isCombinator(node)) {
+    if (depth > PREDICATE_MAX_DEPTH) {
+      // Mirror the evaluator, which throws when a combinator is reached past the cap; report once
+      // and stop descending this branch (siblings are still walked — batch reporting).
+      if (!state.depthReported) {
+        state.depthReported = true;
+        findings.push({
+          code: 'max_depth',
+          message: `predicate nests deeper than the limit of ${PREDICATE_MAX_DEPTH} combinator levels`,
+        });
+      }
+      return;
+    }
+    const children =
+      Array.isArray(node.all) ? node.all :
+      Array.isArray(node.any) ? node.any :
+      node.not != null ? [node.not] :
+      Array.isArray(node.implies) ? node.implies : [];
+    for (const child of children) walkLint(child, scope, depth + 1, state, findings);
+    return;
+  }
+
+  // Leaf: the only data-independent semantic check is the unknown leading field. The op set and
+  // path shape are schema-gated; a numeric-op type mismatch is data-dependent (not checkable here).
+  if (typeof node.field === 'string') {
+    const fault = leadingFieldFault(node.field, scope);
+    if (fault) findings.push({ code: fault.code, field: node.field, message: fault.message });
+  }
+}
+
+/** Negative operators that fail OPEN over an empty/absent `[]` selection (the footgun). */
+const NEGATIVE_OPS = new Set(['not_equals', 'not_in', 'not_contains', 'not_exists']);
+
+/** The positive counterpart used in the fail-closed `not(any(...))` rewrite suggestion. */
+const POSITIVE_OF = { not_equals: 'equals', not_in: 'in', not_contains: 'contains', not_exists: 'exists' };
+
+/** Build the deterministic, AST-derived fail-closed rewrite suggestion for a footgun leaf. */
+function footgunSuggestion(field, op) {
+  const pos = POSITIVE_OF[op] || 'contains';
+  const valuePart = pos === 'exists' ? ' ' : ', value: … ';
+  return `if you meant "reject when no element satisfies it", use the fail-closed idiom ` +
+    `{ not: { any: [ { field: "${field}", op: ${pos}${valuePart}} ] } }`;
+}
+
+/**
+ * Find `[]`-footgun leaves: a NEGATIVE operator over a `[]` field path, which fails OPEN on an
+ * empty/absent array (existential vacuous truth — see docs/policy-lint.md). ADVISORY only: there
+ * are legitimate existential-negatives, so the caller surfaces these as warnings the author
+ * confirms, never as hard errors, and never auto-applies the rewrite.
+ *
+ * Suppression by negation PARITY, not a bare "is there a `not` above me" flag. A leaf inverted an
+ * EVEN number of times (0, 2, …) still fails open and is flagged; an ODD number of inversions makes
+ * it fail CLOSED, so it is suppressed. Two sources of inversion are counted: a `not` combinator,
+ * and the CONSEQUENT (second element) of an `implies` (since `implies:[A,C]` desugars to the
+ * violation `all(A, not(C))`). This refinement came from the VERIFY-F3 cross-family adversarial
+ * jury (deepseek-v4-pro / glm-5.2 / minimax-m3, 2026-06-30), which converged on two real defects in
+ * the original boolean rule: `not(not(X))` over `[]` fails open but was suppressed (false negative),
+ * and a negative-op consequent of `implies` fails closed but was flagged (false positive). Parity
+ * fixes both. Scope stays NEGATIVE-ops-only and ADVISORY (the jury's "flag every op" and "make it a
+ * hard error" suggestions were rejected — the former floods noise on the normal `contains` idiom,
+ * the latter blocks legitimate existential-negatives). False positives remain acceptable by design;
+ * a false negative (a silent production fail-open) is the expensive failure, so it errs toward warning.
+ *
+ * @param {unknown} node - The predicate tree.
+ * @returns {{ field: string, op: string, suggestion: string }[]}
+ */
+export function findEmptyArrayFootguns(node) {
+  const guns = [];
+  walkFootgun(node, false, { nodes: 0 }, guns);
+  return guns;
+}
+
+function walkFootgun(node, inverted, state, guns) {
+  if (node === null || typeof node !== 'object') return;
+  if (++state.nodes > PREDICATE_MAX_NODES) return; // bounded; lintPredicate reports node_budget
+
+  if (isCombinator(node)) {
+    if (Array.isArray(node.all)) { for (const c of node.all) walkFootgun(c, inverted, state, guns); return; }
+    if (Array.isArray(node.any)) { for (const c of node.any) walkFootgun(c, inverted, state, guns); return; }
+    if (node.not != null) { walkFootgun(node.not, !inverted, state, guns); return; }
+    if (Array.isArray(node.implies)) {
+      // implies:[A, C] === all(A, not(C)) — only the consequent (index 1) flips parity.
+      node.implies.forEach((c, i) => walkFootgun(c, i === 1 ? !inverted : inverted, state, guns));
+      return;
+    }
+    return;
+  }
+
+  if (!inverted &&
+      typeof node.op === 'string' && NEGATIVE_OPS.has(node.op) &&
+      typeof node.field === 'string' && node.field.includes('[]')) {
+    guns.push({ field: node.field, op: node.op, suggestion: footgunSuggestion(node.field, node.op) });
+  }
+}

package/validators/provenance-gitlab.test.js

@@ -261,14 +261,21 @@ describe('gitlabProvenance fetch timeout', () => {
     assert.ok(Date.now() - start < 5000, 'expected fast abort');
   });
 
-  it('returns false (not throws) on non-AbortError transport failures', async () => {
+  it('throws provenance: network error on persistent transport failures (F-dac7e08c)', async () => {
+    // Pre-F-dac7e08c this pinned `return false` — which classified a network
+    // outage as submission-bad and permanently persisted a rejected record.
+    // The contract is now: retry within budget, then THROW (operational).
     const failingFetch = async () => { throw new Error('connection refused'); };
     const adapter = gitlabProvenance('token', {
       timeoutMs: 1000,
+      retries: 1,
+      sleepImpl: async () => {},
       fetchImpl: failingFetch
     });
-    const ok = await adapter.confirm(pipelineSource(), { refCommitSha: RUN_HEAD });
-    assert.equal(ok, false);
+    await assert.rejects(
+      adapter.confirm(pipelineSource(), { refCommitSha: RUN_HEAD }),
+      /provenance: network error: connection refused/
+    );
   });
 });
 

package/validators/provenance.js

@@ -60,13 +60,27 @@ function isRetryableStatus(status) {
   return status === 429 || (status >= 500 && status <= 599);
 }
 
+/**
+ * F-5fd3f832: ceiling on a provider-sent Retry-After wait. The per-request
+ * AbortController timeout bounds each REQUEST but not the inter-attempt sleep
+ * — without this clamp, one hostile or misconfigured `Retry-After: 86400`
+ * (plausible via gitlabProvenance's self-hosted `apiBase` override) would
+ * stall the concurrency-serialized ingest.yml queue for a day. 30s matches
+ * the per-request timeout: an honest throttle rarely asks for more, and a
+ * provider that does is better surfaced as an exhausted-retries operational
+ * throw than silently obeyed.
+ */
+export const MAX_RETRY_AFTER_MS = 30_000;
+
 /**
  * Resolve the wait before the next attempt. A `Retry-After` header (delay in
- * seconds, or an HTTP-date) is honored when present and parseable; otherwise
- * fall back to exponential backoff. `attempt` is 1-based (1 = wait before the
- * 2nd request).
+ * seconds, or an HTTP-date) is honored when present and parseable — clamped
+ * to {@link MAX_RETRY_AFTER_MS} in both branches (F-5fd3f832); otherwise
+ * fall back to exponential backoff (already bounded by the retry budget).
+ * `attempt` is 1-based (1 = wait before the 2nd request).
  *
- * @param {Response} resp - The non-ok response carrying a possible Retry-After.
+ * @param {Response|null} resp - The non-ok response carrying a possible
+ *   Retry-After, or null for a transport reject (no response → exponential).
  * @param {number} attempt - 1-based retry index.
  * @param {number} backoffMs - Base backoff.
  * @returns {number} Milliseconds to wait (never negative).
@@ -76,11 +90,11 @@ function nextBackoffMs(resp, attempt, backoffMs) {
   if (header != null && header !== '') {
     const asSeconds = Number(header);
     if (Number.isFinite(asSeconds) && asSeconds >= 0) {
-      return Math.round(asSeconds * 1000);
+      return Math.min(Math.round(asSeconds * 1000), MAX_RETRY_AFTER_MS);
     }
     const asDate = Date.parse(header);
     if (!Number.isNaN(asDate)) {
-      return Math.max(0, asDate - Date.now());
+      return Math.min(Math.max(0, asDate - Date.now()), MAX_RETRY_AFTER_MS);
     }
   }
   return backoffMs * 2 ** (attempt - 1);
@@ -185,11 +199,29 @@ export function githubProvenance(token, opts = {}) {
           });
         } catch (err) {
           if (err && (err.name === 'AbortError' || err.code === 'ABORT_ERR')) {
+            // F-8e72d0de: a per-request timeout is at least as transient as a
+            // connection refusal — retry within the same budget as the
+            // transport-reject branch below (mirrors the scenario fetcher's
+            // retryable-timeout discipline), then throw on exhaustion.
+            if (attempt < retries) {
+              await sleep(nextBackoffMs(null, attempt + 1, backoffMs));
+              continue;
+            }
             throw new Error(`provenance: GitHub API timeout after ${timeoutMs}ms`);
           }
-          // Genuine transport error (DNS, connection refused) — no run to
-          // confirm. Reserve `return false` for this case (mirrors GitLab).
-          return false;
+          // F-dac7e08c: a transport reject (DNS failure, ECONNREFUSED) means the
+          // provider or the runner's NETWORK is down — an operational incident,
+          // not evidence the run is absent. Retry within the same budget as a
+          // 5xx (at least as transient), then THROW so the reason lands under
+          // the operational `provenance-fault:` prefix. The old `return false`
+          // persisted a REJECTED submission-bad record during a network blip,
+          // and the duplicate guard then blocked a clean resubmission under the
+          // same run_id. `return false` is reserved for HTTP 404 (mirrors GitLab).
+          if (attempt < retries) {
+            await sleep(nextBackoffMs(null, attempt + 1, backoffMs));
+            continue;
+          }
+          throw new Error(`provenance: network error: ${err.message}`);
         } finally {
           clearTimeout(timer);
         }
@@ -312,8 +344,12 @@ export function gitlabProvenance(token, opts = {}) {
       if (urlRunId !== String(provider_run_id)) return false;
 
       // Bind the project path to source.repo BEFORE the network call — a forged
-      // project claim is a cheap, offline rejection. For GitLab, submission.repo
-      // is the full project path (which may contain nested-subgroup slashes).
+      // project claim is a cheap, offline rejection. V2-CROSS-BO-005
+      // (F-54e5fde7 contract): submission.repo is strictly two-segment — the
+      // submission schema's `repo` pattern forbids a second slash, so nested
+      // GitLab subgroups are UNSUPPORTED end-to-end. A nested project path
+      // decoded from the run_url (group/subgroup/project) can therefore never
+      // equal a schema-valid source.repo and fails closed right here.
       if (source.repo && projectPath !== source.repo) return false;
 
       const projectId = encodeURIComponent(projectPath);
@@ -343,10 +379,21 @@ export function gitlabProvenance(token, opts = {}) {
           });
         } catch (err) {
           if (err && (err.name === 'AbortError' || err.code === 'ABORT_ERR')) {
+            // F-8e72d0de: retry timeouts within the shared budget — peer
+            // discipline with githubProvenance (see that adapter's note).
+            if (attempt < retries) {
+              await sleep(nextBackoffMs(null, attempt + 1, backoffMs));
+              continue;
+            }
             throw new Error(`provenance: GitLab API timeout after ${timeoutMs}ms`);
           }
-          // Genuine transport error (DNS, connection refused) — no run to confirm.
-          return false;
+          // F-dac7e08c: transport reject = operational, retried then thrown —
+          // mirrors githubProvenance exactly. `return false` is 404-only.
+          if (attempt < retries) {
+            await sleep(nextBackoffMs(null, attempt + 1, backoffMs));
+            continue;
+          }
+          throw new Error(`provenance: network error: ${err.message}`);
         } finally {
           clearTimeout(timer);
         }

package/validators/repo-binding.js

@@ -50,16 +50,24 @@ export const RUN_URL_PARSERS = {
   //   PIPELINE: https://<host>/<namespace>/<project>/-/pipelines/<id>
   // The project path is everything between the host and the `/-/` run segment.
   //
-  // NESTED-SUBGROUP MAPPING (load-bearing decision, kept consistent with how
-  // submission.repo is expressed for GitLab): GitLab namespaces can nest —
-  // `group/subgroup/project`. We map owner = the FULL namespace (everything
-  // before the last path segment, slashes preserved) and repo = the LAST segment
-  // (the project). So `${owner}/${repo}` reconstructs the full project path. For
-  // a flat `group/project` this degenerates to owner='group', repo='project'
-  // (same shape as GitHub). The repo-binding guard then compares
-  // `${owner}/${repo}` against submission.repo, so for GitLab submission.repo is
-  // the FULL project path — which may contain more than one slash for nested
-  // subgroups, unlike GitHub's strict two-segment org/repo.
+  // TWO-SEGMENT CONTRACT (F-54e5fde7, load-bearing decision): nested GitLab
+  // subgroups (`group/subgroup/project`) are UNSUPPORTED end-to-end. The
+  // submission schema's `repo` pattern (^[a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+$)
+  // forbids a second slash, so a nested project path can never be a valid
+  // submission.repo, and the policy loaders (ingest load-context.js, verify
+  // cli.js) fail closed on 3+-segment slugs. A GitLab consumer with nested
+  // subgroups must submit from a top-level group/project (or mirror the repo)
+  // until the contract is widened deliberately — schema pattern, both policy
+  // loaders, and the records/ path layout together, never piecemeal.
+  //
+  // The parser still maps owner = full namespace (slashes preserved) and
+  // repo = last segment. That is DELIBERATE fail-closed behavior, not nested
+  // support: for a nested run_url the reconstructed `${owner}/${repo}` carries
+  // 2+ slashes and can never equal a schema-valid submission.repo, so the
+  // binding guard rejects with repo:mismatch instead of silently skipping the
+  // anti-forgery check (returning null here would fail OPEN). For a flat
+  // `group/project` this degenerates to owner='group', repo='project' — the
+  // same shape as GitHub, and the only shape the contract supports.
   //
   // A single-segment path (no namespace + project, just `<project>/-/jobs/<id>`)
   // returns null — it cannot be split into owner + repo and is not a valid