@dogfood-lab/verify 1.8.0 → 1.10.0

package/validators/f-2a5ddafa-provenance-retry-warn.test.js

@@ -0,0 +1,226 @@
+/**
+ * f-2a5ddafa-provenance-retry-warn.test.js
+ *
+ * F-2a5ddafa (Stage C humanization) — both provenance adapters retried
+ * transient faults (429/5xx/timeout/network) with exponential backoff, but
+ * the retry loop itself was completely silent: `await sleep(...); continue;`
+ * fired with no logStage/log call anywhere inside either loop. A submission
+ * that succeeded only after 1-2 retries against a degrading GitHub/GitLab API
+ * was byte-for-byte indistinguishable in the log from one that succeeded on
+ * the first try — an operator had zero early-warning signal of a degrading
+ * provider until the retry budget fully exhausted and threw.
+ *
+ * Fix: `onRetryWarn(fields)` fires at the point each loop decides to retry,
+ * defaulting to a structured NDJSON stderr line (`component:'verify'`,
+ * `stage:'warn'`) and injectable via `opts.onRetryWarn` for tests (mirrors
+ * the already-injectable `opts.fetchImpl` / `opts.sleepImpl` on this file).
+ *
+ * Why NOT `logStage` from `@dogfood-lab/dogfood-swarm/lib/log-stage.js`:
+ * packages/verify has no dependency on dogfood-swarm and taking one would
+ * close a SECOND, larger workspace cycle (verify -> dogfood-swarm ->
+ * findings -> ingest -> verify) — see provenance.js's `defaultOnRetryWarn`
+ * doc block for the full reasoning. This suite pins that the emitted shape
+ * is real and correct without that import.
+ *
+ * RED proof (reasoned, not re-executed as a hang risk): before this fix,
+ * `onRetryWarn` did not exist on the opts object at all — every assertion
+ * in the "onRetryWarn fires" describe blocks below would fail with "onRetryWarn
+ * was never called" (the array stays empty), since nothing invoked it. This is
+ * independently re-derived from reading the pre-fix source (confirmed: zero
+ * occurrences of any warn/log call inside either retry loop), not carried
+ * over from the finding's own prose.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { githubProvenance, gitlabProvenance } from './provenance.js';
+
+const RUN_HEAD = 'c5d6c4e0000000000000000000000000deadbeef';
+
+const GH_SOURCE = {
+  provider: 'github',
+  workflow: 'dogfood.yml',
+  provider_run_id: '9123456789',
+  run_url: 'https://github.com/acme/widget/actions/runs/9123456789'
+};
+
+const GL_SOURCE = {
+  provider: 'gitlab',
+  workflow: '.gitlab-ci.yml',
+  provider_run_id: '424242',
+  run_url: 'https://gitlab.com/acme/widget/-/pipelines/424242',
+  repo: 'acme/widget'
+};
+
+function abortError() {
+  const e = new Error('This operation was aborted');
+  e.name = 'AbortError';
+  return e;
+}
+
+const noSleep = async () => {};
+
+function okGithubResp() {
+  return {
+    ok: true,
+    status: 200,
+    json: async () => ({
+      id: 9123456789,
+      status: 'completed',
+      head_sha: RUN_HEAD,
+      repository: { full_name: 'acme/widget' }
+    })
+  };
+}
+
+function okGitlabResp() {
+  return { ok: true, status: 200, json: async () => ({ id: 424242, status: 'success', sha: RUN_HEAD }) };
+}
+
+/** @pins F-2a5ddafa */
+describe('F-2a5ddafa — githubProvenance emits onRetryWarn before each retry', () => {
+  it('a timeout then a 200: onRetryWarn fires once with status_or_reason="timeout"', async () => {
+    let calls = 0;
+    const warnings = [];
+    const adapter = githubProvenance('token', {
+      timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+      onRetryWarn: (f) => warnings.push(f),
+      fetchImpl: async () => {
+        calls++;
+        if (calls === 1) throw abortError();
+        return okGithubResp();
+      }
+    });
+    const ok = await adapter.confirm(GH_SOURCE, { refCommitSha: RUN_HEAD });
+    assert.equal(ok, true);
+    assert.equal(warnings.length, 1, `expected exactly one retry warning; got ${JSON.stringify(warnings)}`);
+    assert.equal(warnings[0].kind, 'provenance_retry');
+    assert.equal(warnings[0].provider, 'github');
+    assert.equal(warnings[0].attempt, 1);
+    assert.equal(warnings[0].status_or_reason, 'timeout');
+    assert.equal(typeof warnings[0].next_backoff_ms, 'number');
+  });
+
+  it('a 503 then a 200: onRetryWarn fires with status_or_reason=503 (the numeric status)', async () => {
+    let calls = 0;
+    const warnings = [];
+    const adapter = githubProvenance('token', {
+      timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+      onRetryWarn: (f) => warnings.push(f),
+      fetchImpl: async () => {
+        calls++;
+        return calls === 1 ? { ok: false, status: 503 } : okGithubResp();
+      }
+    });
+    await adapter.confirm(GH_SOURCE, { refCommitSha: RUN_HEAD });
+    assert.equal(warnings.length, 1);
+    assert.equal(warnings[0].status_or_reason, 503);
+  });
+
+  it('a transport reject then a 200: onRetryWarn carries the underlying error message', async () => {
+    let calls = 0;
+    const warnings = [];
+    const adapter = githubProvenance('token', {
+      timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+      onRetryWarn: (f) => warnings.push(f),
+      fetchImpl: async () => {
+        calls++;
+        if (calls === 1) throw new Error('ECONNRESET');
+        return okGithubResp();
+      }
+    });
+    await adapter.confirm(GH_SOURCE, { refCommitSha: RUN_HEAD });
+    assert.equal(warnings.length, 1);
+    assert.match(warnings[0].status_or_reason, /ECONNRESET/);
+  });
+
+  it('exhausting the retry budget fires onRetryWarn exactly `retries` times, not on the final throw', async () => {
+    const warnings = [];
+    const adapter = githubProvenance('token', {
+      timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+      onRetryWarn: (f) => warnings.push(f),
+      fetchImpl: async () => { throw abortError(); }
+    });
+    await assert.rejects(() => adapter.confirm(GH_SOURCE), /provenance: GitHub API timeout/);
+    assert.equal(warnings.length, 2, 'retries=2 → 2 warn events before the 3rd attempt throws');
+    assert.deepEqual(warnings.map(w => w.attempt), [1, 2]);
+  });
+
+  it('DEFAULT onRetryWarn (no opts override): writes a structured NDJSON warn line to stderr', async () => {
+    let calls = 0;
+    const captured = [];
+    const origErr = process.stderr.write.bind(process.stderr);
+    process.stderr.write = (chunk) => { captured.push(chunk.toString()); return true; };
+    try {
+      const adapter = githubProvenance('token', {
+        timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+        fetchImpl: async () => {
+          calls++;
+          if (calls === 1) throw abortError();
+          return okGithubResp();
+        }
+      });
+      await adapter.confirm(GH_SOURCE, { refCommitSha: RUN_HEAD });
+    } finally {
+      process.stderr.write = origErr;
+    }
+    const jsonLine = captured.find((c) => c.trim().startsWith('{'));
+    assert.ok(jsonLine, `expected a JSON warn line on stderr; got ${JSON.stringify(captured)}`);
+    const parsed = JSON.parse(jsonLine.trim());
+    assert.equal(parsed.component, 'verify');
+    assert.equal(parsed.stage, 'warn');
+    assert.equal(parsed.kind, 'provenance_retry');
+    assert.equal(parsed.provider, 'github');
+  });
+});
+
+/** @pins F-2a5ddafa */
+describe('F-2a5ddafa — gitlabProvenance mirrors the onRetryWarn discipline', () => {
+  it('a timeout then a 200: onRetryWarn fires once with provider="gitlab"', async () => {
+    let calls = 0;
+    const warnings = [];
+    const adapter = gitlabProvenance('token', {
+      timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+      onRetryWarn: (f) => warnings.push(f),
+      fetchImpl: async () => {
+        calls++;
+        if (calls === 1) throw abortError();
+        return okGitlabResp();
+      }
+    });
+    const ok = await adapter.confirm(GL_SOURCE, { refCommitSha: RUN_HEAD });
+    assert.equal(ok, true);
+    assert.equal(warnings.length, 1);
+    assert.equal(warnings[0].kind, 'provenance_retry');
+    assert.equal(warnings[0].provider, 'gitlab');
+    assert.equal(warnings[0].status_or_reason, 'timeout');
+  });
+
+  it('a 429 then a 200: onRetryWarn carries the numeric status', async () => {
+    let calls = 0;
+    const warnings = [];
+    const adapter = gitlabProvenance('token', {
+      timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+      onRetryWarn: (f) => warnings.push(f),
+      fetchImpl: async () => {
+        calls++;
+        return calls === 1 ? { ok: false, status: 429 } : okGitlabResp();
+      }
+    });
+    await adapter.confirm(GL_SOURCE, { refCommitSha: RUN_HEAD });
+    assert.equal(warnings.length, 1);
+    assert.equal(warnings[0].status_or_reason, 429);
+  });
+
+  it('exhausting the retry budget fires onRetryWarn exactly `retries` times', async () => {
+    const warnings = [];
+    const adapter = gitlabProvenance('token', {
+      timeoutMs: 1000, retries: 1, sleepImpl: noSleep,
+      onRetryWarn: (f) => warnings.push(f),
+      fetchImpl: async () => { throw abortError(); }
+    });
+    await assert.rejects(() => adapter.confirm(GL_SOURCE), /provenance: GitLab API timeout/);
+    assert.equal(warnings.length, 1, 'retries=1 → 1 warn event before the 2nd attempt throws');
+  });
+});

package/validators/f-5fd3f832-retry-after-clamp.test.js

@@ -0,0 +1,96 @@
+/**
+ * F-5fd3f832: a provider-sent Retry-After header was honored with NO upper
+ * bound — `Retry-After: 86400` (or an HTTP-date hours ahead) made the adapter
+ * sleep that long between attempts. The per-request AbortController timeout
+ * bounds each REQUEST but not the inter-attempt sleep, so one hostile/broken
+ * 429 (plausible via gitlabProvenance's self-hosted apiBase) could wedge the
+ * concurrency-serialized ingest.yml queue for hours.
+ *
+ * Contract: the Retry-After-derived wait is clamped to MAX_RETRY_AFTER_MS
+ * (30s) in both the delta-seconds and HTTP-date branches; the exponential
+ * fallback was already bounded by the retry budget.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { githubProvenance, gitlabProvenance, MAX_RETRY_AFTER_MS } from './provenance.js';
+
+const GH_SOURCE = {
+  provider: 'github',
+  workflow: 'dogfood.yml',
+  provider_run_id: '9123456789',
+  run_url: 'https://github.com/acme/widget/actions/runs/9123456789'
+};
+
+const GL_SOURCE = {
+  provider: 'gitlab',
+  workflow: '.gitlab-ci.yml',
+  provider_run_id: '424242',
+  run_url: 'https://gitlab.com/acme/widget/-/pipelines/424242',
+  repo: 'acme/widget'
+};
+
+function throttled429(retryAfterValue) {
+  return async () => ({
+    ok: false,
+    status: 429,
+    headers: { get: h => (h === 'retry-after' ? retryAfterValue : null) },
+    json: async () => ({})
+  });
+}
+
+function collectSleeps() {
+  const waited = [];
+  return { waited, sleepImpl: async (ms) => { waited.push(ms); } };
+}
+
+describe('F-5fd3f832: Retry-After waits are clamped (github adapter)', () => {
+  it('clamps a huge delta-seconds Retry-After to MAX_RETRY_AFTER_MS', async () => {
+    const { waited, sleepImpl } = collectSleeps();
+    const adapter = githubProvenance('token', {
+      timeoutMs: 1000, retries: 2, fetchImpl: throttled429('86400'), sleepImpl
+    });
+    await assert.rejects(() => adapter.confirm(GH_SOURCE), /provenance: GitHub API returned 429/);
+    assert.equal(waited.length, 2);
+    for (const ms of waited) {
+      assert.ok(ms <= MAX_RETRY_AFTER_MS,
+        `wait ${ms}ms must be clamped to ${MAX_RETRY_AFTER_MS}ms`);
+    }
+  });
+
+  it('clamps a far-future HTTP-date Retry-After to MAX_RETRY_AFTER_MS', async () => {
+    const { waited, sleepImpl } = collectSleeps();
+    const farFuture = new Date(Date.now() + 6 * 3600_000).toUTCString();
+    const adapter = githubProvenance('token', {
+      timeoutMs: 1000, retries: 1, fetchImpl: throttled429(farFuture), sleepImpl
+    });
+    await assert.rejects(() => adapter.confirm(GH_SOURCE));
+    assert.equal(waited.length, 1);
+    assert.ok(waited[0] <= MAX_RETRY_AFTER_MS,
+      `HTTP-date wait ${waited[0]}ms must be clamped to ${MAX_RETRY_AFTER_MS}ms`);
+  });
+
+  it('still honors a small Retry-After exactly (no over-clamping)', async () => {
+    const { waited, sleepImpl } = collectSleeps();
+    const adapter = githubProvenance('token', {
+      timeoutMs: 1000, retries: 1, fetchImpl: throttled429('2'), sleepImpl
+    });
+    await assert.rejects(() => adapter.confirm(GH_SOURCE));
+    assert.deepEqual(waited, [2000]);
+  });
+});
+
+describe('F-5fd3f832: Retry-After waits are clamped (gitlab adapter)', () => {
+  it('clamps a huge delta-seconds Retry-After to MAX_RETRY_AFTER_MS', async () => {
+    const { waited, sleepImpl } = collectSleeps();
+    const adapter = gitlabProvenance('token', {
+      timeoutMs: 1000, retries: 2, fetchImpl: throttled429('86400'), sleepImpl
+    });
+    await assert.rejects(() => adapter.confirm(GL_SOURCE), /provenance: GitLab API returned 429/);
+    assert.equal(waited.length, 2);
+    for (const ms of waited) {
+      assert.ok(ms <= MAX_RETRY_AFTER_MS,
+        `wait ${ms}ms must be clamped to ${MAX_RETRY_AFTER_MS}ms`);
+    }
+  });
+});

package/validators/f-ad98b5ac-required-steps-map-guard.test.js

@@ -0,0 +1,85 @@
+/**
+ * F-ad98b5ac (defensive) — validateRequiredSteps' map build was unguarded.
+ *
+ * `new Map(step_results.map(s => [s.step_id, s]))` dereferences `s.step_id` on
+ * every element with no per-element guard. A null / non-object element throws a
+ * TypeError that `runValidator('steps', ...)` mislabels as an operational
+ * `VALIDATOR_FAULT_STEPS` — the submission-bad→ops inversion the F-efe4f893
+ * family fought: a MALFORMED SUBMISSION is a caller problem (reject the
+ * submission), not an operator fault (page the pipeline owner).
+ *
+ * The sibling `validateStepResults` already applies this floor (its verify-B-004
+ * comment guards `s != null`). Fix: build the map defensively, admitting only
+ * `{ ...typeof s === 'object', typeof s.step_id === 'string' }` elements. This
+ * only stops the map build from throwing; structural malformed-step *reporting*
+ * stays validateStepResults' job.
+ *
+ * Pin: RED = a `step_results: [null]` (or non-object element) input throws a
+ * TypeError before the fix; GREEN = it builds the map without throwing after.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { validateRequiredSteps } from './steps.js';
+
+describe('F-ad98b5ac: validateRequiredSteps map build tolerates malformed elements', () => {
+  it('POSITIVE: a null element in step_results does not throw a TypeError', () => {
+    const scenarioResult = {
+      scenario_id: 'sc-1',
+      verdict: 'pass',
+      step_results: [null],
+    };
+    // Before the fix: `s.step_id` on null throws
+    // `TypeError: Cannot read properties of null (reading 'step_id')`.
+    assert.doesNotThrow(
+      () => validateRequiredSteps(scenarioResult, ['step-a']),
+      'a null element must not throw — the map build must guard per element'
+    );
+  });
+
+  it('POSITIVE: a non-object element (string/number) does not throw', () => {
+    const scenarioResult = {
+      scenario_id: 'sc-2',
+      verdict: 'fail',
+      step_results: ['not-an-object', 42],
+    };
+    assert.doesNotThrow(
+      () => validateRequiredSteps(scenarioResult, ['step-a']),
+      'a non-object element must not throw'
+    );
+  });
+
+  it('POSITIVE: an object element missing a string step_id does not throw', () => {
+    const scenarioResult = {
+      scenario_id: 'sc-3',
+      verdict: 'pass',
+      step_results: [{ status: 'pass' }],
+    };
+    assert.doesNotThrow(
+      () => validateRequiredSteps(scenarioResult, ['step-a']),
+      'an object without a string step_id must not throw'
+    );
+  });
+
+  it('NEGATIVE: well-formed step_results still enforce required-step presence + verdict consistency', () => {
+    // A malformed element must not silently disable the real checks. A valid
+    // step keyed correctly still participates; a missing required step is still
+    // reported.
+    const scenarioResult = {
+      scenario_id: 'sc-ok',
+      verdict: 'pass',
+      step_results: [
+        null,                                   // tolerated, ignored
+        { step_id: 'step-a', status: 'pass' },  // valid, keyed into the map
+      ],
+    };
+    const errors = validateRequiredSteps(scenarioResult, ['step-a', 'step-missing']);
+    // step-a is present + passing → no error for it.
+    assert.ok(!errors.some(e => e.includes('"step-a"')),
+      `a present, passing required step must not error; got: ${JSON.stringify(errors)}`);
+    // step-missing has no result → the presence rule still fires.
+    assert.ok(errors.some(e => e.includes('step-missing')),
+      `a missing required step must still be reported; got: ${JSON.stringify(errors)}`);
+  });
+});

package/validators/f-dac7e08c-transport-error-operational.test.js

@@ -0,0 +1,121 @@
+/**
+ * F-dac7e08c: a genuine transport error (DNS failure, ECONNREFUSED — the
+ * provider or the runner's network is DOWN) was `return false`, which
+ * verify/index.js turned into `provenance: source run could not be confirmed`
+ * — classified submission-bad and bounced to the submitter, permanently
+ * persisting a REJECTED record whose run_id then trips the duplicate guard on
+ * a clean resubmission. That inverted the verify-A-002 taxonomy (429/5xx
+ * throw → operational).
+ *
+ * Contract: transport rejects are retried within the PROVENANCE_RETRIES
+ * budget (at least as transient as a 5xx) and on exhaustion THROW
+ * `provenance: network error: …` so the reason lands under the operational
+ * `provenance-fault:` prefix. `return false` is reserved for HTTP 404.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { githubProvenance, gitlabProvenance } from './provenance.js';
+import { parseRejectionReason } from '../parse-rejection.js';
+
+const RUN_HEAD = 'c5d6c4e0000000000000000000000000deadbeef';
+
+const GH_SOURCE = {
+  provider: 'github',
+  workflow: 'dogfood.yml',
+  provider_run_id: '9123456789',
+  run_url: 'https://github.com/acme/widget/actions/runs/9123456789'
+};
+
+const GL_SOURCE = {
+  provider: 'gitlab',
+  workflow: '.gitlab-ci.yml',
+  provider_run_id: '424242',
+  run_url: 'https://gitlab.com/acme/widget/-/pipelines/424242',
+  repo: 'acme/widget'
+};
+
+function transportError() {
+  const err = new TypeError('fetch failed');
+  err.cause = { code: 'ECONNREFUSED' };
+  return err;
+}
+
+const noSleep = async () => {};
+
+describe('F-dac7e08c: transport errors are operational, not submission-bad (github)', () => {
+  it('throws provenance: network error after exhausting retries', async () => {
+    let calls = 0;
+    const adapter = githubProvenance('token', {
+      timeoutMs: 1000,
+      retries: 2,
+      sleepImpl: noSleep,
+      fetchImpl: async () => { calls++; throw transportError(); }
+    });
+    await assert.rejects(() => adapter.confirm(GH_SOURCE), /provenance: network error: fetch failed/);
+    assert.equal(calls, 3, 'transport rejects must be retried within the budget (retries=2 → 3 attempts)');
+  });
+
+  it('the thrown reason classifies OPERATIONAL via the provenance-fault prefix', async () => {
+    const adapter = githubProvenance('token', {
+      timeoutMs: 1000, retries: 0, sleepImpl: noSleep,
+      fetchImpl: async () => { throw transportError(); }
+    });
+    let message;
+    try {
+      await adapter.confirm(GH_SOURCE);
+      assert.fail('expected a throw');
+    } catch (e) {
+      message = e.message;
+    }
+    // verify/index.js wraps a provenance throw as `provenance-fault: verification failed: <msg>`.
+    const parsed = parseRejectionReason(`provenance-fault: verification failed: ${message}`);
+    assert.equal(parsed.class, 'operational',
+      'a network outage must page ops, not bounce to the submitter');
+  });
+
+  it('recovers when the transport blip clears on a retry', async () => {
+    let calls = 0;
+    const adapter = githubProvenance('token', {
+      timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+      fetchImpl: async () => {
+        calls++;
+        if (calls === 1) throw transportError();
+        return {
+          ok: true,
+          status: 200,
+          json: async () => ({
+            id: 9123456789,
+            status: 'completed',
+            head_sha: RUN_HEAD,
+            repository: { full_name: 'acme/widget' }
+          })
+        };
+      }
+    });
+    const ok = await adapter.confirm(GH_SOURCE, { refCommitSha: RUN_HEAD });
+    assert.equal(ok, true, 'a momentary transport blip must not fail the submission');
+    assert.equal(calls, 2);
+  });
+});
+
+describe('F-dac7e08c: transport errors are operational (gitlab mirror)', () => {
+  it('throws provenance: network error after exhausting retries', async () => {
+    let calls = 0;
+    const adapter = gitlabProvenance('token', {
+      timeoutMs: 1000, retries: 1, sleepImpl: noSleep,
+      fetchImpl: async () => { calls++; throw transportError(); }
+    });
+    await assert.rejects(() => adapter.confirm(GL_SOURCE), /provenance: network error: fetch failed/);
+    assert.equal(calls, 2);
+  });
+
+  it('still returns false on HTTP 404 (run genuinely absent — submission-bad)', async () => {
+    const adapter = gitlabProvenance('token', {
+      timeoutMs: 1000, retries: 1, sleepImpl: noSleep,
+      fetchImpl: async () => ({ ok: false, status: 404, json: async () => ({}) })
+    });
+    const ok = await adapter.confirm(GL_SOURCE);
+    assert.equal(ok, false);
+  });
+});

package/validators/f-f50e779b-retry-warn-fallback-guard.test.js

@@ -0,0 +1,153 @@
+/**
+ * f-f50e779b-retry-warn-fallback-guard.test.js
+ *
+ * F-f50e779b (wave 31, backend amend) — a defect INSIDE the wave-29 fix for
+ * F-2a5ddafa, found by this same lane's own wave-30 audit of its own prior
+ * work. defaultOnRetryWarn's doc comment states the invariant "the logger
+ * must never throw and mask a real retry" and wraps its primary
+ * `console.error(JSON.stringify(line))` call in try/catch — but the catch
+ * block's OWN recovery action, a second `console.error(...)` call, was not
+ * itself guarded. If console.error throws on BOTH calls (a broken stderr fd
+ * — EPIPE/ENOSPC, realistic on a CI runner), the second throw escaped
+ * defaultOnRetryWarn uncaught, out of the retry loop, out of confirm() —
+ * turning a retry that was about to SUCCEED into a rejected promise. Blast
+ * radius is bounded by an unrelated, pre-existing mechanism (verify/index.js
+ * reclassifies any confirm() throw as a structured PROVENANCE_FAULT, exit 2,
+ * nothing persisted) — so this was never a crash, but a submission whose
+ * provenance check would have succeeded after a retry was discarded solely
+ * because the NEW observability line could not be written: the opposite of
+ * what an observability feature should do to reliability.
+ *
+ * Fix: give the fallback console.error (provenance.js ~line 153-162) its own
+ * try/catch, mirroring the two-level guard `dogfood-swarm/lib/log-stage.js`
+ * already uses for the identical shape (`catch { try { ... } catch {} }`) —
+ * that file was independently swept and confirmed already-hardened; nothing
+ * else in this domain shares defaultOnRetryWarn (grepped for
+ * onRetryWarn/defaultOnRetryWarn/onWarn/onLog across every owned package —
+ * only provenance.js and its two test files match).
+ *
+ * RED proof — ACTUALLY EXECUTED, not just reasoned (per this wave's brief:
+ * "a verification that cannot fail is not a verification"). This exact
+ * fixture was run via `node --test` against a byte-identical scratch copy of
+ * the PRE-FIX provenance.js in an isolated temp dir (this file has zero
+ * imports, so a bare copy is fully self-contained — no workspace needed).
+ * Both cases below FAILED against the pre-fix copy, each stack trace pinned
+ * to `defaultOnRetryWarn (provenance.js:153)`:
+ *   - the "resolves true" case rejected with the raw 'EPIPE: simulated
+ *     broken stderr' error instead of resolving `true`.
+ *   - the "scope" case rejected with that SAME raw EPIPE error instead of
+ *     the expected 'provenance: GitHub API timeout' operational error —
+ *     proving the pre-fix bug also clobbers a genuine exhausted-retry error
+ *     with the logger's own unrelated failure.
+ * The identical fixture was then re-run against a fixed copy (the nested
+ * try/catch added, nothing else changed) and both cases passed. Only that
+ * one nested try/catch differed between the RED run and the GREEN run.
+ *
+ * Care taken against the "vacuous test" shape (this wave's own named lesson,
+ * re: F-2a5ddafa's original test asserting a fix fired without ever proving
+ * it fired ONLY where it should): `opts.onRetryWarn` is deliberately NEVER
+ * overridden below — overriding it would bypass defaultOnRetryWarn entirely
+ * and the test would pass whether or not this fix exists, regardless of the
+ * production code. The global `console.error` (not `process.stderr.write`,
+ * which the F-2a5ddafa suite already uses for a *different* assertion) is
+ * the monkey-patch target because that is exactly what defaultOnRetryWarn
+ * calls. The second test below additionally proves the guard is scoped
+ * correctly: it swallows ONLY the logger's own failure and does not mask a
+ * real, unrelated operational error the caller is entitled to see.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { githubProvenance } from './provenance.js';
+
+const RUN_HEAD = 'c5d6c4e0000000000000000000000000deadbeef';
+
+const GH_SOURCE = {
+  provider: 'github',
+  workflow: 'dogfood.yml',
+  provider_run_id: '9123456789',
+  run_url: 'https://github.com/acme/widget/actions/runs/9123456789'
+};
+
+function abortError() {
+  const e = new Error('This operation was aborted');
+  e.name = 'AbortError';
+  return e;
+}
+
+const noSleep = async () => {};
+
+function okGithubResp() {
+  return {
+    ok: true,
+    status: 200,
+    json: async () => ({
+      id: 9123456789,
+      status: 'completed',
+      head_sha: RUN_HEAD,
+      repository: { full_name: 'acme/widget' }
+    })
+  };
+}
+
+/**
+ * Monkey-patch the GLOBAL console.error for the duration of `fn` so every
+ * call throws, simulating a broken stderr fd (EPIPE/ENOSPC) — the exact
+ * mechanism the finding proved live. Always restores the original in
+ * `finally` so a failing assertion cannot leak the patch into a sibling
+ * test (node:test runs this file's cases sequentially, but a leaked patch
+ * would still poison any later suite in the same process).
+ *
+ * @param {(getCallCount: () => number) => Promise<void>} fn
+ */
+async function withThrowingConsoleError(fn) {
+  const orig = console.error;
+  let calls = 0;
+  console.error = () => {
+    calls++;
+    throw new Error('EPIPE: simulated broken stderr');
+  };
+  try {
+    await fn(() => calls);
+  } finally {
+    console.error = orig;
+  }
+}
+
+/** @pins F-f50e779b */
+describe('F-f50e779b — defaultOnRetryWarn fallback is itself guarded', () => {
+  it('a retry that would succeed still resolves true when console.error throws on every call', async () => {
+    await withThrowingConsoleError(async (getCalls) => {
+      let fetchCalls = 0;
+      const adapter = githubProvenance('token', {
+        timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+        // Deliberately NOT overriding onRetryWarn — must exercise the real
+        // defaultOnRetryWarn, or this test never reaches the guarded code
+        // (the exact vacuous-test shape this suite's header warns against).
+        fetchImpl: async () => {
+          fetchCalls++;
+          if (fetchCalls === 1) throw abortError();
+          return okGithubResp();
+        }
+      });
+      const ok = await adapter.confirm(GH_SOURCE, { refCommitSha: RUN_HEAD });
+      assert.equal(ok, true, 'a retry that succeeds must resolve true, not reject');
+      assert.equal(getCalls(), 2, 'expected exactly 2 console.error attempts: primary (line ~149) + fallback (line ~153)');
+    });
+  });
+
+  it('scope: a genuinely exhausted retry budget still throws the real operational error, not the logger error', async () => {
+    await withThrowingConsoleError(async () => {
+      const adapter = githubProvenance('token', {
+        timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+        fetchImpl: async () => { throw abortError(); } // never succeeds — budget exhausts
+      });
+      await assert.rejects(
+        () => adapter.confirm(GH_SOURCE, { refCommitSha: RUN_HEAD }),
+        /provenance: GitHub API timeout/,
+        'the fallback guard must swallow ONLY the logger failure — it must never mask the real exhausted-retry error behind it'
+      );
+    });
+  });
+});