@dogfood-lab/verify 1.8.0 → 1.9.0

package/validators/lint-scenario.js

@@ -0,0 +1,141 @@
+/**
+ * Scenario lint (F-BACKEND-003)
+ *
+ * `lintScenario(scenarioDoc, { file })` is the author-time check behind the
+ * `dogfood-verify lint --scenario <file>` mode: it validates a whole scenario
+ * definition WITHOUT a submission, batch-reporting every fault. It is the
+ * scenario-side sibling of lint-policy.js (VERIFY-F3) and shares its shape,
+ * exit contract, and honest-coverage discipline.
+ *
+ * Three passes, mirroring lint-policy's layering:
+ *   1. Structural gate — `validatePayload('scenario', …)` against scenario.schema.json
+ *      (the same registered schema production ingest uses to fetch + validate a
+ *      committed scenario). Catches missing required fields, bad enums, pattern
+ *      violations, additionalProperties, the verifiable⇒expected conditional.
+ *   2. Author-time value checks the schema cannot express (errors, `scenario-config:`):
+ *      required_steps referencing an undeclared step id, and duplicate step ids.
+ *      The scenario schema literally says required_steps "Must reference valid step
+ *      IDs" but JSON Schema cannot enforce a cross-field id reference, and it
+ *      validates each step in isolation so it cannot see a repeated id.
+ *   3. `filename → scenario_id` advisory (a WARNING, never an error,
+ *      `scenario-footgun:`): the receiver fetches dogfood/scenarios/<scenario_id>.yaml,
+ *      so a basename that differs from scenario_id makes the committed definition
+ *      unreachable and required-steps enforcement silently fails open.
+ *
+ * Coverage boundary (the VERIFY-F2 over-claim lesson): a clean scenario lint is
+ * "no static fault," NOT "a real submission will satisfy this scenario." Static
+ * lint validates the definition in isolation; it cannot verify that a submission's
+ * step_results actually satisfy required_steps, nor that the receiver can reach the
+ * file at the attested commit. `coverageNote` says so.
+ */
+
+import { basename } from 'node:path';
+
+import { validatePayload } from '@dogfood-lab/schemas';
+
+/** Stated in every scenario lint result so a clean verdict is never read as full coverage. */
+export const SCENARIO_COVERAGE_NOTE =
+  'Static lint only — it validates the scenario DEFINITION in isolation. It cannot verify that a ' +
+  "real submission's `step_results` actually satisfy `required_steps`, nor that the receiver can " +
+  'fetch this file at the attested commit (the filename → scenario_id check is a heuristic, not a ' +
+  'guarantee). Run a real ingest of a submission for that.';
+
+/**
+ * Lint a parsed scenario document.
+ *
+ * @param {unknown} scenarioDoc - The parsed scenario YAML/JSON (any value; a non-object is
+ *   reported by the schema gate).
+ * @param {{ file?: string }} [opts] - The source file path (basename → scenario_id advisory).
+ *   When absent, the filename check is skipped (there is no basename to compare).
+ * @returns {{
+ *   ok: boolean, origin: 'scenario', coverageNote: string,
+ *   errors: { label: string, code: string, location: string, field?: string, message: string }[],
+ *   warnings: { label: string, code: string, location: string, field: string, suggestion: string, message: string }[]
+ * }} `ok` is true iff there are no errors; warnings never affect `ok`.
+ */
+export function lintScenario(scenarioDoc, { file } = {}) {
+  const errors = [];
+  const warnings = [];
+
+  // 1. Structural schema gate.
+  const schema = validatePayload('scenario', scenarioDoc);
+  for (const e of schema.errors) {
+    errors.push({
+      label: 'scenario-schema:',
+      code: e.keyword || 'schema',
+      location: e.path || '/',
+      message: e.message || 'schema violation',
+    });
+  }
+
+  // 2. Author-time value checks. Defensive: a schema-invalid doc may have a malformed or
+  // missing steps/success_criteria, so guard every access against non-arrays/non-objects
+  // (mirrors collectPredicates' defensiveness in lint-policy.js).
+  const doc = scenarioDoc && typeof scenarioDoc === 'object' ? scenarioDoc : {};
+  const steps = Array.isArray(doc.steps) ? doc.steps : [];
+
+  // Collect declared step ids, flagging duplicates as we go. A repeated id validates clean
+  // structurally (the schema checks each step in isolation) but is ambiguous at runtime: a
+  // step_result keyed by that id cannot say which step it satisfied.
+  const declaredIds = new Set();
+  const seenIds = new Set();
+  for (let i = 0; i < steps.length; i++) {
+    const step = steps[i];
+    if (!step || typeof step !== 'object') continue;
+    const id = step.id;
+    if (typeof id !== 'string' || id.length === 0) continue;
+    declaredIds.add(id);
+    if (seenIds.has(id)) {
+      errors.push({
+        label: 'scenario-config:',
+        code: 'duplicate_step_id',
+        location: `steps[${i}]`,
+        field: id,
+        message: `step id "${id}" is declared more than once — step ids must be unique so a step_result can name exactly one step`,
+      });
+    }
+    seenIds.add(id);
+  }
+
+  // required_steps must reference a declared step id. The scenario schema says so in prose but
+  // cannot enforce a cross-field id reference.
+  const sc = doc.success_criteria && typeof doc.success_criteria === 'object' ? doc.success_criteria : {};
+  const requiredSteps = Array.isArray(sc.required_steps) ? sc.required_steps : [];
+  for (let i = 0; i < requiredSteps.length; i++) {
+    const ref = requiredSteps[i];
+    if (typeof ref !== 'string') continue; // a non-string entry is a schema fault, already reported above
+    if (!declaredIds.has(ref)) {
+      errors.push({
+        label: 'scenario-config:',
+        code: 'required_step_undeclared',
+        location: `success_criteria.required_steps[${i}]`,
+        field: ref,
+        message: `required step "${ref}" is not declared by any steps[].id — the scenario can never pass because the receiver enforces a step the exercise never runs`,
+      });
+    }
+  }
+
+  // 3. filename → scenario_id advisory. The receiver fetches dogfood/scenarios/<scenario_id>.yaml,
+  // so a mismatch makes the committed definition unreachable and required-steps enforcement fails
+  // OPEN silently. Advisory only — a repo may legitimately hold a scenario under a different name
+  // during authoring (e.g. examples/scenario.example.yaml holds scenario_id "cli-smoke").
+  const scenarioId = doc.scenario_id;
+  if (file && typeof scenarioId === 'string' && scenarioId.length > 0) {
+    const base = basename(String(file)).replace(/\.ya?ml$/i, '');
+    if (base !== scenarioId) {
+      warnings.push({
+        label: 'scenario-footgun:',
+        code: 'filename_scenario_id_mismatch',
+        location: '/',
+        field: 'scenario_id',
+        suggestion: `rename the file to "${scenarioId}.yaml" (or change scenario_id to "${base}")`,
+        message:
+          `the file basename "${base}" does not match scenario_id "${scenarioId}" — the receiver ` +
+          `fetches dogfood/scenarios/${scenarioId}.yaml, so this committed definition is unreachable ` +
+          `and required-steps enforcement silently fails OPEN`,
+      });
+    }
+  }
+
+  return { ok: errors.length === 0, origin: 'scenario', errors, warnings, coverageNote: SCENARIO_COVERAGE_NOTE };
+}

package/validators/policy.js

@@ -50,6 +50,11 @@ const KNOWN_REJECT_RULE_IDS = new Set([
   // enforced by other validators or by verify() itself (default-arm no-op is correct)
   'schema-valid',
   'provenance-confirmed',
+  // F-3bfc2885: enforced by validateRequiredSteps (validators/steps.js), which
+  // verify() runs per scenario_result when the ingest layer supplies loaded
+  // scenario definitions (options.scenarios). The structural half (non-empty
+  // step_results, dup ids, pass-vs-fail over REPORTED steps) is
+  // validateStepResults.
   'step-results-present',
   'step-verdict-consistent',
   'no-verdict-upgrade',
@@ -155,7 +160,10 @@ export function validatePolicy(submission, { globalPolicy, repoPolicy }) {
     // dropping operator-authored rules on the floor: a declared rule that the
     // build does nothing with is invisible to the operator who wrote it.
     if (rule.severity === 'warn') {
-      warnings.push(`${rule.id}: ${rule.description || 'policy warning'}`);
+      // F-57a0c0ad: bracketed `[id]` form — the same shape buildReason gives
+      // declarative rules — so one grep pattern finds every rule-attributed
+      // message regardless of how the rule is enforced.
+      warnings.push(`[${rule.id}] ${rule.description || 'policy warning'}`);
       continue;
     }
     if (rule.severity === 'info') {

package/validators/provenance-gitlab.test.js

@@ -261,14 +261,21 @@ describe('gitlabProvenance fetch timeout', () => {
     assert.ok(Date.now() - start < 5000, 'expected fast abort');
   });
 
-  it('returns false (not throws) on non-AbortError transport failures', async () => {
+  it('throws provenance: network error on persistent transport failures (F-dac7e08c)', async () => {
+    // Pre-F-dac7e08c this pinned `return false` — which classified a network
+    // outage as submission-bad and permanently persisted a rejected record.
+    // The contract is now: retry within budget, then THROW (operational).
     const failingFetch = async () => { throw new Error('connection refused'); };
     const adapter = gitlabProvenance('token', {
       timeoutMs: 1000,
+      retries: 1,
+      sleepImpl: async () => {},
       fetchImpl: failingFetch
     });
-    const ok = await adapter.confirm(pipelineSource(), { refCommitSha: RUN_HEAD });
-    assert.equal(ok, false);
+    await assert.rejects(
+      adapter.confirm(pipelineSource(), { refCommitSha: RUN_HEAD }),
+      /provenance: network error: connection refused/
+    );
   });
 });
 

package/validators/provenance.js

@@ -60,13 +60,27 @@ function isRetryableStatus(status) {
   return status === 429 || (status >= 500 && status <= 599);
 }
 
+/**
+ * F-5fd3f832: ceiling on a provider-sent Retry-After wait. The per-request
+ * AbortController timeout bounds each REQUEST but not the inter-attempt sleep
+ * — without this clamp, one hostile or misconfigured `Retry-After: 86400`
+ * (plausible via gitlabProvenance's self-hosted `apiBase` override) would
+ * stall the concurrency-serialized ingest.yml queue for a day. 30s matches
+ * the per-request timeout: an honest throttle rarely asks for more, and a
+ * provider that does is better surfaced as an exhausted-retries operational
+ * throw than silently obeyed.
+ */
+export const MAX_RETRY_AFTER_MS = 30_000;
+
 /**
  * Resolve the wait before the next attempt. A `Retry-After` header (delay in
- * seconds, or an HTTP-date) is honored when present and parseable; otherwise
- * fall back to exponential backoff. `attempt` is 1-based (1 = wait before the
- * 2nd request).
+ * seconds, or an HTTP-date) is honored when present and parseable — clamped
+ * to {@link MAX_RETRY_AFTER_MS} in both branches (F-5fd3f832); otherwise
+ * fall back to exponential backoff (already bounded by the retry budget).
+ * `attempt` is 1-based (1 = wait before the 2nd request).
  *
- * @param {Response} resp - The non-ok response carrying a possible Retry-After.
+ * @param {Response|null} resp - The non-ok response carrying a possible
+ *   Retry-After, or null for a transport reject (no response → exponential).
  * @param {number} attempt - 1-based retry index.
  * @param {number} backoffMs - Base backoff.
  * @returns {number} Milliseconds to wait (never negative).
@@ -76,11 +90,11 @@ function nextBackoffMs(resp, attempt, backoffMs) {
   if (header != null && header !== '') {
     const asSeconds = Number(header);
     if (Number.isFinite(asSeconds) && asSeconds >= 0) {
-      return Math.round(asSeconds * 1000);
+      return Math.min(Math.round(asSeconds * 1000), MAX_RETRY_AFTER_MS);
     }
     const asDate = Date.parse(header);
     if (!Number.isNaN(asDate)) {
-      return Math.max(0, asDate - Date.now());
+      return Math.min(Math.max(0, asDate - Date.now()), MAX_RETRY_AFTER_MS);
     }
   }
   return backoffMs * 2 ** (attempt - 1);
@@ -185,11 +199,29 @@ export function githubProvenance(token, opts = {}) {
           });
         } catch (err) {
           if (err && (err.name === 'AbortError' || err.code === 'ABORT_ERR')) {
+            // F-8e72d0de: a per-request timeout is at least as transient as a
+            // connection refusal — retry within the same budget as the
+            // transport-reject branch below (mirrors the scenario fetcher's
+            // retryable-timeout discipline), then throw on exhaustion.
+            if (attempt < retries) {
+              await sleep(nextBackoffMs(null, attempt + 1, backoffMs));
+              continue;
+            }
             throw new Error(`provenance: GitHub API timeout after ${timeoutMs}ms`);
           }
-          // Genuine transport error (DNS, connection refused) — no run to
-          // confirm. Reserve `return false` for this case (mirrors GitLab).
-          return false;
+          // F-dac7e08c: a transport reject (DNS failure, ECONNREFUSED) means the
+          // provider or the runner's NETWORK is down — an operational incident,
+          // not evidence the run is absent. Retry within the same budget as a
+          // 5xx (at least as transient), then THROW so the reason lands under
+          // the operational `provenance-fault:` prefix. The old `return false`
+          // persisted a REJECTED submission-bad record during a network blip,
+          // and the duplicate guard then blocked a clean resubmission under the
+          // same run_id. `return false` is reserved for HTTP 404 (mirrors GitLab).
+          if (attempt < retries) {
+            await sleep(nextBackoffMs(null, attempt + 1, backoffMs));
+            continue;
+          }
+          throw new Error(`provenance: network error: ${err.message}`);
         } finally {
           clearTimeout(timer);
         }
@@ -312,8 +344,12 @@ export function gitlabProvenance(token, opts = {}) {
       if (urlRunId !== String(provider_run_id)) return false;
 
       // Bind the project path to source.repo BEFORE the network call — a forged
-      // project claim is a cheap, offline rejection. For GitLab, submission.repo
-      // is the full project path (which may contain nested-subgroup slashes).
+      // project claim is a cheap, offline rejection. V2-CROSS-BO-005
+      // (F-54e5fde7 contract): submission.repo is strictly two-segment — the
+      // submission schema's `repo` pattern forbids a second slash, so nested
+      // GitLab subgroups are UNSUPPORTED end-to-end. A nested project path
+      // decoded from the run_url (group/subgroup/project) can therefore never
+      // equal a schema-valid source.repo and fails closed right here.
       if (source.repo && projectPath !== source.repo) return false;
 
       const projectId = encodeURIComponent(projectPath);
@@ -343,10 +379,21 @@ export function gitlabProvenance(token, opts = {}) {
           });
         } catch (err) {
           if (err && (err.name === 'AbortError' || err.code === 'ABORT_ERR')) {
+            // F-8e72d0de: retry timeouts within the shared budget — peer
+            // discipline with githubProvenance (see that adapter's note).
+            if (attempt < retries) {
+              await sleep(nextBackoffMs(null, attempt + 1, backoffMs));
+              continue;
+            }
             throw new Error(`provenance: GitLab API timeout after ${timeoutMs}ms`);
           }
-          // Genuine transport error (DNS, connection refused) — no run to confirm.
-          return false;
+          // F-dac7e08c: transport reject = operational, retried then thrown —
+          // mirrors githubProvenance exactly. `return false` is 404-only.
+          if (attempt < retries) {
+            await sleep(nextBackoffMs(null, attempt + 1, backoffMs));
+            continue;
+          }
+          throw new Error(`provenance: network error: ${err.message}`);
         } finally {
           clearTimeout(timer);
         }

package/validators/repo-binding.js

@@ -50,16 +50,24 @@ export const RUN_URL_PARSERS = {
   //   PIPELINE: https://<host>/<namespace>/<project>/-/pipelines/<id>
   // The project path is everything between the host and the `/-/` run segment.
   //
-  // NESTED-SUBGROUP MAPPING (load-bearing decision, kept consistent with how
-  // submission.repo is expressed for GitLab): GitLab namespaces can nest —
-  // `group/subgroup/project`. We map owner = the FULL namespace (everything
-  // before the last path segment, slashes preserved) and repo = the LAST segment
-  // (the project). So `${owner}/${repo}` reconstructs the full project path. For
-  // a flat `group/project` this degenerates to owner='group', repo='project'
-  // (same shape as GitHub). The repo-binding guard then compares
-  // `${owner}/${repo}` against submission.repo, so for GitLab submission.repo is
-  // the FULL project path — which may contain more than one slash for nested
-  // subgroups, unlike GitHub's strict two-segment org/repo.
+  // TWO-SEGMENT CONTRACT (F-54e5fde7, load-bearing decision): nested GitLab
+  // subgroups (`group/subgroup/project`) are UNSUPPORTED end-to-end. The
+  // submission schema's `repo` pattern (^[a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+$)
+  // forbids a second slash, so a nested project path can never be a valid
+  // submission.repo, and the policy loaders (ingest load-context.js, verify
+  // cli.js) fail closed on 3+-segment slugs. A GitLab consumer with nested
+  // subgroups must submit from a top-level group/project (or mirror the repo)
+  // until the contract is widened deliberately — schema pattern, both policy
+  // loaders, and the records/ path layout together, never piecemeal.
+  //
+  // The parser still maps owner = full namespace (slashes preserved) and
+  // repo = last segment. That is DELIBERATE fail-closed behavior, not nested
+  // support: for a nested run_url the reconstructed `${owner}/${repo}` carries
+  // 2+ slashes and can never equal a schema-valid submission.repo, so the
+  // binding guard rejects with repo:mismatch instead of silently skipping the
+  // anti-forgery check (returning null here would fail OPEN). For a flat
+  // `group/project` this degenerates to owner='group', repo='project' — the
+  // same shape as GitHub, and the only shape the contract supports.
   //
   // A single-segment path (no namespace + project, just `<project>/-/jobs/<id>`)
   // returns null — it cannot be split into owner + repo and is not a valid

package/validators/steps.js

@@ -10,8 +10,9 @@
  * Validate step results for a single scenario result.
  *
  * Note: Without access to the source repo's scenario definition, we validate
- * structural integrity. The full required_steps check is done by policy
- * evaluation when scenario definitions are available.
+ * structural integrity. The full required_steps check is done by
+ * validateRequiredSteps below, which verify() runs per scenario_result when
+ * the caller supplies loaded scenario definitions (options.scenarios).
  *
  * @param {object} scenarioResult - A single scenario_results[] item
  * @returns {string[]} Array of error messages (empty if valid)
@@ -41,6 +42,10 @@ export function validateStepResults(scenarioResult) {
   const seenIds = new Set();
   for (const step of step_results) {
     if (step == null || typeof step !== 'object') continue;
+    // F-70338558: a step without a string step_id is already reported as
+    // malformed above; letting `undefined` into the dedupe Set made two
+    // malformed steps emit a spurious `duplicate step_id: undefined`.
+    if (typeof step.step_id !== 'string') continue;
     if (seenIds.has(step.step_id)) {
       errors.push(`duplicate step_id: ${step.step_id}`);
     }
@@ -72,7 +77,13 @@ export function validateStepResults(scenarioResult) {
 
 /**
  * Validate step results against a scenario definition's required_steps.
- * Used when the scenario definition is available (policy evaluation phase).
+ *
+ * F-3bfc2885: this is the REAL enforcement behind the `step-results-present`
+ * and `step-verdict-consistent` global reject rules (policies/global-policy.yaml,
+ * allowlisted in KNOWN_REJECT_RULE_IDS). verify() calls it per scenario_result
+ * when the caller supplies loaded scenario definitions (options.scenarios).
+ * Each error is tagged with the `[rule-id]` it enforces so operators can pivot
+ * from a rejection reason straight to the policy rule.
  *
  * @param {object} scenarioResult - A single scenario_results[] item
  * @param {string[]} requiredSteps - Step IDs from scenario definition's success_criteria.required_steps
@@ -82,25 +93,44 @@ export function validateRequiredSteps(scenarioResult, requiredSteps) {
   const errors = [];
   const { step_results, verdict } = scenarioResult;
 
-  if (!step_results) return ['step_results missing'];
+  if (!step_results) return ['[step-results-present] step_results missing'];
 
-  const resultMap = new Map(step_results.map(s => [s.step_id, s]));
+  // F-ad98b5ac: build the map defensively — the same floor the sibling
+  // validateStepResults applies (its verify-B-004 guard). A null / non-object /
+  // string-step_id-less element must not throw a TypeError here: that TypeError
+  // escapes to runValidator('steps', ...) which mislabels it as an operational
+  // VALIDATOR_FAULT_STEPS, inverting a submission-bad signal into an ops fault
+  // (the F-efe4f893 family inversion). Structural malformed-step *reporting*
+  // stays validateStepResults' job; this only stops the map build from throwing.
+  const resultMap = new Map();
+  for (const s of step_results) {
+    if (s != null && typeof s === 'object' && typeof s.step_id === 'string') {
+      resultMap.set(s.step_id, s);
+    }
+  }
 
   // Every required step must have a matching step_result
   for (const stepId of requiredSteps) {
     const result = resultMap.get(stepId);
     if (!result) {
-      errors.push(`required step "${stepId}" has no matching step_result`);
+      errors.push(`[step-results-present] required step "${stepId}" has no matching step_result`);
     }
   }
 
-  // A scenario cannot be "pass" if any required step is fail/blocked
+  // A scenario cannot be "pass" if any required step is fail/blocked — or
+  // absent entirely: validateStepResults' structural check only sees REPORTED
+  // steps, so a submitter who silently omits a failing required step would
+  // otherwise keep a "pass" verdict consistent (F-3bfc2885 sibling case).
   if (verdict === 'pass') {
     for (const stepId of requiredSteps) {
       const result = resultMap.get(stepId);
-      if (result && (result.status === 'fail' || result.status === 'blocked')) {
+      if (!result) {
+        errors.push(
+          `[step-verdict-consistent] scenario verdict is "pass" but required step "${stepId}" has no step_result`
+        );
+      } else if (result.status === 'fail' || result.status === 'blocked') {
         errors.push(
-          `scenario verdict is "pass" but required step "${stepId}" has status "${result.status}"`
+          `[step-verdict-consistent] scenario verdict is "pass" but required step "${stepId}" has status "${result.status}"`
         );
       }
     }

package/validators/w4-f-8e72d0de-timeout-retry.test.js

@@ -0,0 +1,118 @@
+/**
+ * w4-f-8e72d0de-timeout-retry.test.js
+ *
+ * F-8e72d0de (wave 4): both provenance adapters threw IMMEDIATELY on an
+ * AbortError (per-request timeout) while retrying transport rejects and
+ * 429/5xx within the PROVENANCE_RETRIES budget. A timeout is at least as
+ * transient as a connection refusal — a single slow response failed the
+ * whole confirmation when one retry might have confirmed the run. Contrast:
+ * the scenario fetcher in ingest/load-context.js already retried timeouts.
+ *
+ * Contract (both adapters — the documented peer discipline):
+ *   - an AbortError is retried within the same budget as a transport reject;
+ *   - on exhaustion the timeout error still throws (operational,
+ *     `provenance-fault:` at the verify() boundary).
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { githubProvenance, gitlabProvenance } from './provenance.js';
+
+const RUN_HEAD = 'c5d6c4e0000000000000000000000000deadbeef';
+
+const GH_SOURCE = {
+  provider: 'github',
+  workflow: 'dogfood.yml',
+  provider_run_id: '9123456789',
+  run_url: 'https://github.com/acme/widget/actions/runs/9123456789'
+};
+
+const GL_SOURCE = {
+  provider: 'gitlab',
+  workflow: '.gitlab-ci.yml',
+  provider_run_id: '424242',
+  run_url: 'https://gitlab.com/acme/widget/-/pipelines/424242',
+  repo: 'acme/widget'
+};
+
+function abortError() {
+  const e = new Error('This operation was aborted');
+  e.name = 'AbortError';
+  return e;
+}
+
+const noSleep = async () => {};
+
+describe('F-8e72d0de — githubProvenance retries per-request timeouts', () => {
+  it('a single timeout followed by a 200 confirms the run', async () => {
+    let calls = 0;
+    const adapter = githubProvenance('token', {
+      timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+      fetchImpl: async () => {
+        calls++;
+        if (calls === 1) throw abortError();
+        return {
+          ok: true,
+          status: 200,
+          json: async () => ({
+            id: 9123456789,
+            status: 'completed',
+            head_sha: RUN_HEAD,
+            repository: { full_name: 'acme/widget' }
+          })
+        };
+      }
+    });
+    const ok = await adapter.confirm(GH_SOURCE, { refCommitSha: RUN_HEAD });
+    assert.equal(ok, true, 'one slow response must not fail the confirmation');
+    assert.equal(calls, 2);
+  });
+
+  it('exhausting every attempt on timeouts still throws the timeout error', async () => {
+    let calls = 0;
+    const adapter = githubProvenance('token', {
+      timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+      fetchImpl: async () => { calls++; throw abortError(); }
+    });
+    await assert.rejects(
+      () => adapter.confirm(GH_SOURCE),
+      /provenance: GitHub API timeout after 1000ms/
+    );
+    assert.equal(calls, 3, 'retries=2 → 3 total attempts before the operational throw');
+  });
+});
+
+describe('F-8e72d0de — gitlabProvenance mirrors the timeout-retry discipline', () => {
+  it('a single timeout followed by a 200 confirms the pipeline', async () => {
+    let calls = 0;
+    const adapter = gitlabProvenance('token', {
+      timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+      fetchImpl: async () => {
+        calls++;
+        if (calls === 1) throw abortError();
+        return {
+          ok: true,
+          status: 200,
+          json: async () => ({ id: 424242, status: 'success', sha: RUN_HEAD })
+        };
+      }
+    });
+    const ok = await adapter.confirm(GL_SOURCE, { refCommitSha: RUN_HEAD });
+    assert.equal(ok, true);
+    assert.equal(calls, 2);
+  });
+
+  it('exhausting every attempt on timeouts still throws the timeout error', async () => {
+    let calls = 0;
+    const adapter = gitlabProvenance('token', {
+      timeoutMs: 1000, retries: 1, sleepImpl: noSleep,
+      fetchImpl: async () => { calls++; throw abortError(); }
+    });
+    await assert.rejects(
+      () => adapter.confirm(GL_SOURCE),
+      /provenance: GitLab API timeout after 1000ms/
+    );
+    assert.equal(calls, 2);
+  });
+});