@dogfood-lab/verify 1.8.0 → 1.10.0

package/validators/lint-scenario.js

@@ -0,0 +1,141 @@
+/**
+ * Scenario lint (F-BACKEND-003)
+ *
+ * `lintScenario(scenarioDoc, { file })` is the author-time check behind the
+ * `dogfood-verify lint --scenario <file>` mode: it validates a whole scenario
+ * definition WITHOUT a submission, batch-reporting every fault. It is the
+ * scenario-side sibling of lint-policy.js (VERIFY-F3) and shares its shape,
+ * exit contract, and honest-coverage discipline.
+ *
+ * Three passes, mirroring lint-policy's layering:
+ *   1. Structural gate — `validatePayload('scenario', …)` against scenario.schema.json
+ *      (the same registered schema production ingest uses to fetch + validate a
+ *      committed scenario). Catches missing required fields, bad enums, pattern
+ *      violations, additionalProperties, the verifiable⇒expected conditional.
+ *   2. Author-time value checks the schema cannot express (errors, `scenario-config:`):
+ *      required_steps referencing an undeclared step id, and duplicate step ids.
+ *      The scenario schema literally says required_steps "Must reference valid step
+ *      IDs" but JSON Schema cannot enforce a cross-field id reference, and it
+ *      validates each step in isolation so it cannot see a repeated id.
+ *   3. `filename → scenario_id` advisory (a WARNING, never an error,
+ *      `scenario-footgun:`): the receiver fetches dogfood/scenarios/<scenario_id>.yaml,
+ *      so a basename that differs from scenario_id makes the committed definition
+ *      unreachable and required-steps enforcement silently fails open.
+ *
+ * Coverage boundary (the VERIFY-F2 over-claim lesson): a clean scenario lint is
+ * "no static fault," NOT "a real submission will satisfy this scenario." Static
+ * lint validates the definition in isolation; it cannot verify that a submission's
+ * step_results actually satisfy required_steps, nor that the receiver can reach the
+ * file at the attested commit. `coverageNote` says so.
+ */
+
+import { basename } from 'node:path';
+
+import { validatePayload } from '@dogfood-lab/schemas';
+
+/** Stated in every scenario lint result so a clean verdict is never read as full coverage. */
+export const SCENARIO_COVERAGE_NOTE =
+  'Static lint only — it validates the scenario DEFINITION in isolation. It cannot verify that a ' +
+  "real submission's `step_results` actually satisfy `required_steps`, nor that the receiver can " +
+  'fetch this file at the attested commit (the filename → scenario_id check is a heuristic, not a ' +
+  'guarantee). Run a real ingest of a submission for that.';
+
+/**
+ * Lint a parsed scenario document.
+ *
+ * @param {unknown} scenarioDoc - The parsed scenario YAML/JSON (any value; a non-object is
+ *   reported by the schema gate).
+ * @param {{ file?: string }} [opts] - The source file path (basename → scenario_id advisory).
+ *   When absent, the filename check is skipped (there is no basename to compare).
+ * @returns {{
+ *   ok: boolean, origin: 'scenario', coverageNote: string,
+ *   errors: { label: string, code: string, location: string, field?: string, message: string }[],
+ *   warnings: { label: string, code: string, location: string, field: string, suggestion: string, message: string }[]
+ * }} `ok` is true iff there are no errors; warnings never affect `ok`.
+ */
+export function lintScenario(scenarioDoc, { file } = {}) {
+  const errors = [];
+  const warnings = [];
+
+  // 1. Structural schema gate.
+  const schema = validatePayload('scenario', scenarioDoc);
+  for (const e of schema.errors) {
+    errors.push({
+      label: 'scenario-schema:',
+      code: e.keyword || 'schema',
+      location: e.path || '/',
+      message: e.message || 'schema violation',
+    });
+  }
+
+  // 2. Author-time value checks. Defensive: a schema-invalid doc may have a malformed or
+  // missing steps/success_criteria, so guard every access against non-arrays/non-objects
+  // (mirrors collectPredicates' defensiveness in lint-policy.js).
+  const doc = scenarioDoc && typeof scenarioDoc === 'object' ? scenarioDoc : {};
+  const steps = Array.isArray(doc.steps) ? doc.steps : [];
+
+  // Collect declared step ids, flagging duplicates as we go. A repeated id validates clean
+  // structurally (the schema checks each step in isolation) but is ambiguous at runtime: a
+  // step_result keyed by that id cannot say which step it satisfied.
+  const declaredIds = new Set();
+  const seenIds = new Set();
+  for (let i = 0; i < steps.length; i++) {
+    const step = steps[i];
+    if (!step || typeof step !== 'object') continue;
+    const id = step.id;
+    if (typeof id !== 'string' || id.length === 0) continue;
+    declaredIds.add(id);
+    if (seenIds.has(id)) {
+      errors.push({
+        label: 'scenario-config:',
+        code: 'duplicate_step_id',
+        location: `steps[${i}]`,
+        field: id,
+        message: `step id "${id}" is declared more than once — step ids must be unique so a step_result can name exactly one step`,
+      });
+    }
+    seenIds.add(id);
+  }
+
+  // required_steps must reference a declared step id. The scenario schema says so in prose but
+  // cannot enforce a cross-field id reference.
+  const sc = doc.success_criteria && typeof doc.success_criteria === 'object' ? doc.success_criteria : {};
+  const requiredSteps = Array.isArray(sc.required_steps) ? sc.required_steps : [];
+  for (let i = 0; i < requiredSteps.length; i++) {
+    const ref = requiredSteps[i];
+    if (typeof ref !== 'string') continue; // a non-string entry is a schema fault, already reported above
+    if (!declaredIds.has(ref)) {
+      errors.push({
+        label: 'scenario-config:',
+        code: 'required_step_undeclared',
+        location: `success_criteria.required_steps[${i}]`,
+        field: ref,
+        message: `required step "${ref}" is not declared by any steps[].id — the scenario can never pass because the receiver enforces a step the exercise never runs`,
+      });
+    }
+  }
+
+  // 3. filename → scenario_id advisory. The receiver fetches dogfood/scenarios/<scenario_id>.yaml,
+  // so a mismatch makes the committed definition unreachable and required-steps enforcement fails
+  // OPEN silently. Advisory only — a repo may legitimately hold a scenario under a different name
+  // during authoring (e.g. examples/scenario.example.yaml holds scenario_id "cli-smoke").
+  const scenarioId = doc.scenario_id;
+  if (file && typeof scenarioId === 'string' && scenarioId.length > 0) {
+    const base = basename(String(file)).replace(/\.ya?ml$/i, '');
+    if (base !== scenarioId) {
+      warnings.push({
+        label: 'scenario-footgun:',
+        code: 'filename_scenario_id_mismatch',
+        location: '/',
+        field: 'scenario_id',
+        suggestion: `rename the file to "${scenarioId}.yaml" (or change scenario_id to "${base}")`,
+        message:
+          `the file basename "${base}" does not match scenario_id "${scenarioId}" — the receiver ` +
+          `fetches dogfood/scenarios/${scenarioId}.yaml, so this committed definition is unreachable ` +
+          `and required-steps enforcement silently fails OPEN`,
+      });
+    }
+  }
+
+  return { ok: errors.length === 0, origin: 'scenario', errors, warnings, coverageNote: SCENARIO_COVERAGE_NOTE };
+}

package/validators/policy.js

@@ -50,6 +50,11 @@ const KNOWN_REJECT_RULE_IDS = new Set([
   // enforced by other validators or by verify() itself (default-arm no-op is correct)
   'schema-valid',
   'provenance-confirmed',
+  // F-3bfc2885: enforced by validateRequiredSteps (validators/steps.js), which
+  // verify() runs per scenario_result when the ingest layer supplies loaded
+  // scenario definitions (options.scenarios). The structural half (non-empty
+  // step_results, dup ids, pass-vs-fail over REPORTED steps) is
+  // validateStepResults.
   'step-results-present',
   'step-verdict-consistent',
   'no-verdict-upgrade',
@@ -113,6 +118,15 @@ function resolveSurfacePolicy(surface, globalPolicy, repoPolicy) {
  *   `configErrors` (VERIFY-F1) are eval-time repo custom-rule predicate faults; the
  *   caller emits them with a `policy-config:` prefix (submission-bad). A non-empty
  *   `configErrors` makes `valid` false.
+ * @throws {Error} F-3ef6b03e: a global rule declared `severity: reject` whose id
+ *   is outside {@link KNOWN_REJECT_RULE_IDS} — a maintainer-authored
+ *   global-policy.yaml gap, not a submission fault. Mirrors the GLOBAL-rule
+ *   predicate-fault throw above: `runValidator('policy', ...)` in index.js
+ *   wraps this as `VALIDATOR_FAULT_POLICY:`, which parseRejectionReason
+ *   classifies 'operational' by family match. Pre-fix this pushed into
+ *   `errors` under the `policy:` prefix, which parseRejectionReason
+ *   classifies 'submission-bad' — telling every consumer in the fleet to fix
+ *   a payload that was never the problem.
  */
 export function validatePolicy(submission, { globalPolicy, repoPolicy }) {
   const errors = [];
@@ -155,7 +169,10 @@ export function validatePolicy(submission, { globalPolicy, repoPolicy }) {
     // dropping operator-authored rules on the floor: a declared rule that the
     // build does nothing with is invisible to the operator who wrote it.
     if (rule.severity === 'warn') {
-      warnings.push(`${rule.id}: ${rule.description || 'policy warning'}`);
+      // F-57a0c0ad: bracketed `[id]` form — the same shape buildReason gives
+      // declarative rules — so one grep pattern finds every rule-attributed
+      // message regardless of how the rule is enforced.
+      warnings.push(`[${rule.id}] ${rule.description || 'policy warning'}`);
       continue;
     }
     if (rule.severity === 'info') {
@@ -188,15 +205,21 @@ export function validatePolicy(submission, { globalPolicy, repoPolicy }) {
 
       // schema-valid, provenance-confirmed, step-results-present, step-verdict-consistent,
       // no-verdict-upgrade are enforced by other validators or the main verify() function.
-      // PROACT-VERIFY-002: a reject rule the build neither handles here NOR enforces
-      // elsewhere would otherwise pass SILENTLY — the operator's new gate never runs.
-      // Reject the submission with a diagnostic naming the unenforced rule so the gap
-      // is visible instead of failing open.
+      // PROACT-VERIFY-002 / F-3ef6b03e: a reject rule the build neither handles here NOR
+      // enforces elsewhere would otherwise pass SILENTLY — the operator's new gate never
+      // runs. THROW rather than push to `errors`: this is a maintainer-authored
+      // global-policy.yaml gap (the same class of broken-policy-file fault
+      // loadGlobalPolicy's schema gate already fails loud on), not a submission fault.
+      // Pushing to `errors` would route through the `policy:` prefix — classified
+      // 'submission-bad' by parseRejectionReason — telling the submitter to fix a
+      // payload that was never the problem, fleet-wide, for every submission until a
+      // maintainer notices. Throwing here mirrors the GLOBAL-rule predicate-fault
+      // throw above: runValidator('policy', ...) in index.js wraps it as
+      // `VALIDATOR_FAULT_POLICY:`, classified 'operational' — exit 2, nothing
+      // persisted, no run_id poisoned via the duplicate guard (F-82429f90).
       default:
         if (!KNOWN_REJECT_RULE_IDS.has(rule.id)) {
-          // No `policy:` prefix here — index.js prepends it to every policy
-          // error (mirrors the `[rule.id]` / `surface[...]` messages above).
-          errors.push(
+          throw new Error(
             `rule "${rule.id}" is declared severity:reject but has no enforcement in this build — ` +
               `add an enforcement arm in validators/policy.js or register it in KNOWN_REJECT_RULE_IDS`
           );

package/validators/provenance-gitlab.test.js

@@ -261,14 +261,21 @@ describe('gitlabProvenance fetch timeout', () => {
     assert.ok(Date.now() - start < 5000, 'expected fast abort');
   });
 
-  it('returns false (not throws) on non-AbortError transport failures', async () => {
+  it('throws provenance: network error on persistent transport failures (F-dac7e08c)', async () => {
+    // Pre-F-dac7e08c this pinned `return false` — which classified a network
+    // outage as submission-bad and permanently persisted a rejected record.
+    // The contract is now: retry within budget, then THROW (operational).
     const failingFetch = async () => { throw new Error('connection refused'); };
     const adapter = gitlabProvenance('token', {
       timeoutMs: 1000,
+      retries: 1,
+      sleepImpl: async () => {},
       fetchImpl: failingFetch
     });
-    const ok = await adapter.confirm(pipelineSource(), { refCommitSha: RUN_HEAD });
-    assert.equal(ok, false);
+    await assert.rejects(
+      adapter.confirm(pipelineSource(), { refCommitSha: RUN_HEAD }),
+      /provenance: network error: connection refused/
+    );
   });
 });
 

package/validators/provenance-registry.test.js

@@ -25,6 +25,22 @@ const schemaPath = require.resolve(
 const submissionSchema = JSON.parse(readFileSync(schemaPath, 'utf-8'));
 const PROVIDER_ENUM = submissionSchema.properties.source.properties.provider.enum;
 
+/**
+ * F-a2fb624f: the pre-fix tripwire (`provenanceForProvider('bitbucket') ===
+ * null`) only probed a NON-prototype unknown key — green both before AND
+ * after F-2965699b's fix, so it gave zero coverage for the actual defect
+ * class. This table-driven set is the real regression guard: every
+ * Object.prototype own-property name, which is exactly the key space
+ * `PROVENANCE_ADAPTERS[provider]` resolved (as a truthy inherited method,
+ * defeating `?? null`) before the Object.hasOwn fix. Shared verbatim with
+ * repo-binding.test.js's sibling table so both prototype-safety sites are
+ * proven against the identical key set.
+ */
+const OBJECT_PROTOTYPE_KEYS = [
+  'constructor', 'toString', 'valueOf', '__proto__',
+  'hasOwnProperty', 'isPrototypeOf', 'propertyIsEnumerable', 'toLocaleString',
+];
+
 describe('provenance adapter coverage', () => {
   it('exposes the provider enum it is meant to cover (sanity)', () => {
     assert.ok(Array.isArray(PROVIDER_ENUM) && PROVIDER_ENUM.length > 0);
@@ -53,4 +69,23 @@ describe('provenance adapter coverage', () => {
   it('provenanceForProvider returns null for an unknown provider (no throw)', () => {
     assert.equal(provenanceForProvider('bitbucket'), null);
   });
+
+  describe('F-2965699b: provenanceForProvider never resolves an inherited Object.prototype key', () => {
+    for (const key of OBJECT_PROTOTYPE_KEYS) {
+      it(`returns null (not the inherited method) for provider="${key}"`, () => {
+        // Deletion/emptiness proof: revert provenanceForProvider to
+        // `PROVENANCE_ADAPTERS[provider] ?? null` and this goes red for
+        // every key here — each one currently resolves a truthy inherited
+        // Object.prototype value that `?? null` cannot catch.
+        assert.equal(provenanceForProvider(key), null,
+          `provider="${key}" must resolve to null, not an inherited Object.prototype member`);
+      });
+    }
+
+    it('a non-string provider (object, number, null, undefined) never throws and returns null', () => {
+      for (const bad of [{}, 42, null, undefined, ['github']]) {
+        assert.equal(provenanceForProvider(bad), null, `provider=${JSON.stringify(bad)} must resolve to null`);
+      }
+    });
+  });
 });

package/validators/provenance.js

@@ -14,6 +14,24 @@
  * `source.provider`, so the provider enum, the run_url parsers
  * (validators/repo-binding.js), and the adapters here stay in lockstep —
  * coverage tests fail CI if any of the three drifts.
+ *
+ * F-936c83f4 (wave 39, feature-pass integration finding): this module's
+ * `--provenance=stub|github` (the flag both packages/verify/cli.js and
+ * packages/ingest/run.js parse, both delegating to the adapters here) answers
+ * ONE of three structurally-similar-but-distinct 'how do we know this claim is
+ * true' questions living in this repo: (1) THIS module — does a submitted CI
+ * run really exist and match its claims; (2) dogfood-finding.schema.json's
+ * `evidence[].evidence_kind` enum — what evidence backs a distilled cross-repo
+ * lesson (see that property's own cross-reference note); (3) the swarm
+ * control-plane's incoming `verified_how`
+ * (independent|self_attested|operator_evidence,
+ * docs/trajectory-and-closure.dispatch.md's C2 `swarm close` verb) — how a
+ * finding CLOSURE was verified. This is NOT a request to unify the three
+ * enums — CI-run provenance, cross-repo-lesson evidence, and
+ * closure-verification-method are genuinely different axes, and forcing one
+ * shared enum would misrepresent that. The pointer exists only so the next
+ * reader of any of the three doesn't rediscover the pattern from scratch a
+ * fourth time.
  */
 
 /**
@@ -60,13 +78,27 @@ function isRetryableStatus(status) {
   return status === 429 || (status >= 500 && status <= 599);
 }
 
+/**
+ * F-5fd3f832: ceiling on a provider-sent Retry-After wait. The per-request
+ * AbortController timeout bounds each REQUEST but not the inter-attempt sleep
+ * — without this clamp, one hostile or misconfigured `Retry-After: 86400`
+ * (plausible via gitlabProvenance's self-hosted `apiBase` override) would
+ * stall the concurrency-serialized ingest.yml queue for a day. 30s matches
+ * the per-request timeout: an honest throttle rarely asks for more, and a
+ * provider that does is better surfaced as an exhausted-retries operational
+ * throw than silently obeyed.
+ */
+export const MAX_RETRY_AFTER_MS = 30_000;
+
 /**
  * Resolve the wait before the next attempt. A `Retry-After` header (delay in
- * seconds, or an HTTP-date) is honored when present and parseable; otherwise
- * fall back to exponential backoff. `attempt` is 1-based (1 = wait before the
- * 2nd request).
+ * seconds, or an HTTP-date) is honored when present and parseable — clamped
+ * to {@link MAX_RETRY_AFTER_MS} in both branches (F-5fd3f832); otherwise
+ * fall back to exponential backoff (already bounded by the retry budget).
+ * `attempt` is 1-based (1 = wait before the 2nd request).
  *
- * @param {Response} resp - The non-ok response carrying a possible Retry-After.
+ * @param {Response|null} resp - The non-ok response carrying a possible
+ *   Retry-After, or null for a transport reject (no response → exponential).
  * @param {number} attempt - 1-based retry index.
  * @param {number} backoffMs - Base backoff.
  * @returns {number} Milliseconds to wait (never negative).
@@ -76,11 +108,11 @@ function nextBackoffMs(resp, attempt, backoffMs) {
   if (header != null && header !== '') {
     const asSeconds = Number(header);
     if (Number.isFinite(asSeconds) && asSeconds >= 0) {
-      return Math.round(asSeconds * 1000);
+      return Math.min(Math.round(asSeconds * 1000), MAX_RETRY_AFTER_MS);
     }
     const asDate = Date.parse(header);
     if (!Number.isNaN(asDate)) {
-      return Math.max(0, asDate - Date.now());
+      return Math.min(Math.max(0, asDate - Date.now()), MAX_RETRY_AFTER_MS);
     }
   }
   return backoffMs * 2 ** (attempt - 1);
@@ -91,6 +123,67 @@ function defaultSleep(ms) {
   return new Promise(resolve => setTimeout(resolve, ms));
 }
 
+/**
+ * F-2a5ddafa: emit ONE structured NDJSON warn line to stderr each time a
+ * retry is about to happen, so an operator tailing CI logs sees a degrading
+ * provider BEFORE the retry budget exhausts and throws. Pre-fix, every
+ * `await sleep(...); continue;` branch in both adapters below was completely
+ * silent — a submission that succeeded only after 1-2 retries against a
+ * degrading GitHub/GitLab API was byte-for-byte indistinguishable in the log
+ * from one that succeeded on the first try. The eventual exhausted-retry
+ * failure is already loud (an operational throw); this closes the gap on
+ * the way there, which is exactly the window an operator could act in
+ * (e.g. correlate a slow ingest with a known provider incident).
+ *
+ * Deliberately NOT named `logStage` and NOT importing
+ * `@dogfood-lab/dogfood-swarm/lib/log-stage.js`: packages/verify depends on
+ * nothing but `@dogfood-lab/schemas` + `js-yaml` today (see package.json),
+ * and the accepted workspace cycle (root CLAUDE.md, "Workspace dependency
+ * graph") is `findings -> ingest -> dogfood-swarm -> findings`. `ingest`
+ * ALSO depends on `verify`, so a NEW `verify -> dogfood-swarm` edge would
+ * not reuse that cycle — it would close a SECOND, larger one:
+ * `verify -> dogfood-swarm -> findings -> ingest -> verify`. This mirrors
+ * the repo's existing precedent for exactly this constraint —
+ * `packages/ingest/lib/sleep-sync.js` duplicates
+ * `packages/findings/lib/file-lock.js`'s private `sleepSync` verbatim,
+ * per that file's own header, rather than take a disallowed cross-edge —
+ * so this emits the same NDJSON stage-line SHAPE independently instead of
+ * importing the shared helper.
+ * `packages/ingest/wave22-log-stage-discipline.test.js` (Class #9 sweep)
+ * enforces that no file under `packages/**` defines its OWN `logStage`
+ * without delegating to the shared helper; this helper uses a distinct
+ * name for exactly that reason and is not a competing definition of that
+ * convention.
+ *
+ * Injectable via `opts.onRetryWarn` (mirrors the already-injectable
+ * `opts.fetchImpl` / `opts.sleepImpl` on this file) so tests assert the
+ * exact fields without scraping stderr.
+ *
+ * @param {{ kind: string, provider: string, attempt: number, status_or_reason: string|number, next_backoff_ms: number }} fields
+ */
+function defaultOnRetryWarn(fields) {
+  const line = { ts: new Date().toISOString(), component: 'verify', stage: 'warn', ...fields };
+  try {
+    console.error(JSON.stringify(line));
+  } catch {
+    // The logger must never throw and mask a real retry — same last-resort
+    // discipline as the shared dogfood-swarm helper (log-stage.js). F-f50e779b:
+    // this fallback itself must not throw either — a broken stderr fd
+    // (EPIPE/ENOSPC) fails BOTH console.error calls, and pre-fix this second
+    // call was unguarded, so its throw escaped defaultOnRetryWarn uncaught and
+    // turned a retry that was about to SUCCEED into a rejected confirm() (the
+    // observability feature converting a good outcome into a discarded
+    // submission — see log-stage.js's own two-level guard for the same shape,
+    // which this now mirrors exactly).
+    try {
+      console.error('{"stage":"warn","kind":"log_serialization_failed"}');
+    } catch {
+      // stderr itself is broken; nothing further to do, but must not crash
+      // the caller — there is no third fallback to hand the failure to.
+    }
+  }
+}
+
 /**
  * Stub provenance adapter. Always confirms.
  * Use in tests and local development.
@@ -125,6 +218,7 @@ export function githubProvenance(token, opts = {}) {
   const retries = opts.retries ?? PROVENANCE_RETRIES;
   const backoffMs = opts.backoffMs ?? PROVENANCE_BACKOFF_MS;
   const sleep = opts.sleepImpl ?? defaultSleep;
+  const onRetryWarn = opts.onRetryWarn ?? defaultOnRetryWarn;
   return {
     /**
      * @param {object} source - submission.source (provider-scoped run claim)
@@ -185,11 +279,35 @@ export function githubProvenance(token, opts = {}) {
           });
         } catch (err) {
           if (err && (err.name === 'AbortError' || err.code === 'ABORT_ERR')) {
+            // F-8e72d0de: a per-request timeout is at least as transient as a
+            // connection refusal — retry within the same budget as the
+            // transport-reject branch below (mirrors the scenario fetcher's
+            // retryable-timeout discipline), then throw on exhaustion.
+            if (attempt < retries) {
+              const waitMs = nextBackoffMs(null, attempt + 1, backoffMs);
+              // F-2a5ddafa: visibility BEFORE the budget exhausts (see
+              // defaultOnRetryWarn's doc above for why this is 'warn').
+              onRetryWarn({ kind: 'provenance_retry', provider: 'github', attempt: attempt + 1, status_or_reason: 'timeout', next_backoff_ms: waitMs });
+              await sleep(waitMs);
+              continue;
+            }
             throw new Error(`provenance: GitHub API timeout after ${timeoutMs}ms`);
           }
-          // Genuine transport error (DNS, connection refused) — no run to
-          // confirm. Reserve `return false` for this case (mirrors GitLab).
-          return false;
+          // F-dac7e08c: a transport reject (DNS failure, ECONNREFUSED) means the
+          // provider or the runner's NETWORK is down — an operational incident,
+          // not evidence the run is absent. Retry within the same budget as a
+          // 5xx (at least as transient), then THROW so the reason lands under
+          // the operational `provenance-fault:` prefix. The old `return false`
+          // persisted a REJECTED submission-bad record during a network blip,
+          // and the duplicate guard then blocked a clean resubmission under the
+          // same run_id. `return false` is reserved for HTTP 404 (mirrors GitLab).
+          if (attempt < retries) {
+            const waitMs = nextBackoffMs(null, attempt + 1, backoffMs);
+            onRetryWarn({ kind: 'provenance_retry', provider: 'github', attempt: attempt + 1, status_or_reason: err && err.message ? err.message : 'network_error', next_backoff_ms: waitMs });
+            await sleep(waitMs);
+            continue;
+          }
+          throw new Error(`provenance: network error: ${err.message}`);
         } finally {
           clearTimeout(timer);
         }
@@ -206,7 +324,9 @@ export function githubProvenance(token, opts = {}) {
         // last 429/5xx throws so a real outage still surfaces (operational).
         if (resp.status === 404) return false;
         if (isRetryableStatus(resp.status) && attempt < retries) {
-          await sleep(nextBackoffMs(resp, attempt + 1, backoffMs));
+          const waitMs = nextBackoffMs(resp, attempt + 1, backoffMs);
+          onRetryWarn({ kind: 'provenance_retry', provider: 'github', attempt: attempt + 1, status_or_reason: resp.status, next_backoff_ms: waitMs });
+          await sleep(waitMs);
           continue;
         }
         throw new Error(`provenance: GitHub API returned ${resp.status}`);
@@ -280,6 +400,7 @@ export function gitlabProvenance(token, opts = {}) {
   const retries = opts.retries ?? PROVENANCE_RETRIES;
   const backoffMs = opts.backoffMs ?? PROVENANCE_BACKOFF_MS;
   const sleep = opts.sleepImpl ?? defaultSleep;
+  const onRetryWarn = opts.onRetryWarn ?? defaultOnRetryWarn;
   return {
     /**
      * @param {object} source - submission.source (provider-scoped run claim)
@@ -312,8 +433,12 @@ export function gitlabProvenance(token, opts = {}) {
       if (urlRunId !== String(provider_run_id)) return false;
 
       // Bind the project path to source.repo BEFORE the network call — a forged
-      // project claim is a cheap, offline rejection. For GitLab, submission.repo
-      // is the full project path (which may contain nested-subgroup slashes).
+      // project claim is a cheap, offline rejection. V2-CROSS-BO-005
+      // (F-54e5fde7 contract): submission.repo is strictly two-segment — the
+      // submission schema's `repo` pattern forbids a second slash, so nested
+      // GitLab subgroups are UNSUPPORTED end-to-end. A nested project path
+      // decoded from the run_url (group/subgroup/project) can therefore never
+      // equal a schema-valid source.repo and fails closed right here.
       if (source.repo && projectPath !== source.repo) return false;
 
       const projectId = encodeURIComponent(projectPath);
@@ -343,10 +468,25 @@ export function gitlabProvenance(token, opts = {}) {
           });
         } catch (err) {
           if (err && (err.name === 'AbortError' || err.code === 'ABORT_ERR')) {
+            // F-8e72d0de: retry timeouts within the shared budget — peer
+            // discipline with githubProvenance (see that adapter's note).
+            if (attempt < retries) {
+              const waitMs = nextBackoffMs(null, attempt + 1, backoffMs);
+              onRetryWarn({ kind: 'provenance_retry', provider: 'gitlab', attempt: attempt + 1, status_or_reason: 'timeout', next_backoff_ms: waitMs });
+              await sleep(waitMs);
+              continue;
+            }
             throw new Error(`provenance: GitLab API timeout after ${timeoutMs}ms`);
           }
-          // Genuine transport error (DNS, connection refused) — no run to confirm.
-          return false;
+          // F-dac7e08c: transport reject = operational, retried then thrown —
+          // mirrors githubProvenance exactly. `return false` is 404-only.
+          if (attempt < retries) {
+            const waitMs = nextBackoffMs(null, attempt + 1, backoffMs);
+            onRetryWarn({ kind: 'provenance_retry', provider: 'gitlab', attempt: attempt + 1, status_or_reason: err && err.message ? err.message : 'network_error', next_backoff_ms: waitMs });
+            await sleep(waitMs);
+            continue;
+          }
+          throw new Error(`provenance: network error: ${err.message}`);
         } finally {
           clearTimeout(timer);
         }
@@ -361,7 +501,9 @@ export function gitlabProvenance(token, opts = {}) {
         // budget. 401/403 = non-transient operational, throw immediately.
         if (resp.status === 404) return false;
         if (isRetryableStatus(resp.status) && attempt < retries) {
-          await sleep(nextBackoffMs(resp, attempt + 1, backoffMs));
+          const waitMs = nextBackoffMs(resp, attempt + 1, backoffMs);
+          onRetryWarn({ kind: 'provenance_retry', provider: 'gitlab', attempt: attempt + 1, status_or_reason: resp.status, next_backoff_ms: waitMs });
+          await sleep(waitMs);
           continue;
         }
         throw new Error(`provenance: GitLab API returned ${resp.status}`);
@@ -412,10 +554,34 @@ export const PROVENANCE_ADAPTERS = {
 /**
  * Resolve the provenance-adapter factory for a `source.provider`.
  *
+ * F-2965699b: `PROVENANCE_ADAPTERS[provider]` alone resolves inherited
+ * `Object.prototype` keys (`provider: 'valueOf'` returns
+ * `Object.prototype.valueOf`, a truthy function) — the `??` operator only
+ * catches `null`/`undefined`, so the `if (!factory)` unknown-provider gate at
+ * this function's ONE caller (`resolveProviderProvenance`, packages/ingest/
+ * run.js) never fires for the whole Object.prototype key space, and
+ * `factory(token)` goes on to call an unrelated Object.prototype method with
+ * an unbound `this`, producing an uncaught TypeError (`valueOf`/`__proto__`)
+ * or a misleading downstream error (`constructor`/`toString`/
+ * `isPrototypeOf`) instead of the correct "unknown provenance provider"
+ * message. This site is reached on FULLY UNTRUSTED input — `submission.
+ * source.provider` — BEFORE verify()'s schema gate constrains it to the
+ * [github, gitlab] enum.
+ *
+ * `Object.hasOwn` restricts the lookup to the registry's own properties,
+ * matching the idiom `safeGet()` already uses in validators/predicate.js —
+ * the two prototype-safety sites now read the same.
+ *
  * @param {string} provider The `source.provider` token (e.g. 'github', 'gitlab').
  * @returns {((token: string, opts?: object) => { confirm: Function }) | null}
- *   The adapter factory, or `null` when the provider has no registered adapter.
+ *   The adapter factory, or `null` when the provider has no registered adapter
+ *   (including every Object.prototype key — `constructor`, `toString`,
+ *   `valueOf`, `__proto__`, `hasOwnProperty`, `isPrototypeOf`,
+ *   `propertyIsEnumerable`, `toLocaleString` — none of which are OWN
+ *   properties of PROVENANCE_ADAPTERS).
  */
 export function provenanceForProvider(provider) {
-  return PROVENANCE_ADAPTERS[provider] ?? null;
+  return typeof provider === 'string' && Object.hasOwn(PROVENANCE_ADAPTERS, provider)
+    ? PROVENANCE_ADAPTERS[provider]
+    : null;
 }

package/validators/repo-binding.js

@@ -50,16 +50,24 @@ export const RUN_URL_PARSERS = {
   //   PIPELINE: https://<host>/<namespace>/<project>/-/pipelines/<id>
   // The project path is everything between the host and the `/-/` run segment.
   //
-  // NESTED-SUBGROUP MAPPING (load-bearing decision, kept consistent with how
-  // submission.repo is expressed for GitLab): GitLab namespaces can nest —
-  // `group/subgroup/project`. We map owner = the FULL namespace (everything
-  // before the last path segment, slashes preserved) and repo = the LAST segment
-  // (the project). So `${owner}/${repo}` reconstructs the full project path. For
-  // a flat `group/project` this degenerates to owner='group', repo='project'
-  // (same shape as GitHub). The repo-binding guard then compares
-  // `${owner}/${repo}` against submission.repo, so for GitLab submission.repo is
-  // the FULL project path — which may contain more than one slash for nested
-  // subgroups, unlike GitHub's strict two-segment org/repo.
+  // TWO-SEGMENT CONTRACT (F-54e5fde7, load-bearing decision): nested GitLab
+  // subgroups (`group/subgroup/project`) are UNSUPPORTED end-to-end. The
+  // submission schema's `repo` pattern (^[a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+$)
+  // forbids a second slash, so a nested project path can never be a valid
+  // submission.repo, and the policy loaders (ingest load-context.js, verify
+  // cli.js) fail closed on 3+-segment slugs. A GitLab consumer with nested
+  // subgroups must submit from a top-level group/project (or mirror the repo)
+  // until the contract is widened deliberately — schema pattern, both policy
+  // loaders, and the records/ path layout together, never piecemeal.
+  //
+  // The parser still maps owner = full namespace (slashes preserved) and
+  // repo = last segment. That is DELIBERATE fail-closed behavior, not nested
+  // support: for a nested run_url the reconstructed `${owner}/${repo}` carries
+  // 2+ slashes and can never equal a schema-valid submission.repo, so the
+  // binding guard rejects with repo:mismatch instead of silently skipping the
+  // anti-forgery check (returning null here would fail OPEN). For a flat
+  // `group/project` this degenerates to owner='group', repo='project' — the
+  // same shape as GitHub, and the only shape the contract supports.
   //
   // A single-segment path (no namespace + project, just `<project>/-/jobs/<id>`)
   // returns null — it cannot be split into owner + repo and is not a valid
@@ -80,13 +88,28 @@ export const RUN_URL_PARSERS = {
 /**
  * Decode the owner/repo a run_url attests to, for the given provider.
  *
+ * F-7ce07baa: family sibling of F-2965699b (validators/provenance.js). Plain
+ * bracket access resolves inherited Object.prototype keys, so
+ * `RUN_URL_PARSERS[provider]` for `provider: '__proto__'` (etc.) returns a
+ * truthy Object.prototype method instead of `undefined` — the `if (!parser)`
+ * unknown-provider gate cannot fire for that key space, and `parser(runUrl)`
+ * goes on to call an unrelated Object.prototype method. This site is reached
+ * even EARLIER in the trust chain than provenanceForProvider: verify/
+ * index.js's repo-binding guard runs at step 0, before the schema gate, so
+ * `submission.source.provider` is raw untrusted input here too.
+ * `Object.hasOwn` matches the safeGet()/provenanceForProvider idiom so every
+ * prototype-safety site in this codebase reads the same.
+ *
  * @param {string} provider The `source.provider` token (e.g. 'github').
  * @param {string} runUrl   The `source.run_url`.
  * @returns {RunUrlRepo | null} `{ owner, repo }`, or `null` when the provider
- *   has no parser or the URL does not match the provider's shape.
+ *   has no parser (including every Object.prototype key) or the URL does not
+ *   match the provider's shape.
  */
 export function parseRunUrlRepo(provider, runUrl) {
-  const parser = RUN_URL_PARSERS[provider];
+  const parser = typeof provider === 'string' && Object.hasOwn(RUN_URL_PARSERS, provider)
+    ? RUN_URL_PARSERS[provider]
+    : null;
   if (!parser) return null;
   return parser(runUrl);
 }