@dogfood-lab/verify 1.9.0 → 1.10.0

package/validators/f-2a5ddafa-provenance-retry-warn.test.js

@@ -0,0 +1,226 @@
+/**
+ * f-2a5ddafa-provenance-retry-warn.test.js
+ *
+ * F-2a5ddafa (Stage C humanization) — both provenance adapters retried
+ * transient faults (429/5xx/timeout/network) with exponential backoff, but
+ * the retry loop itself was completely silent: `await sleep(...); continue;`
+ * fired with no logStage/log call anywhere inside either loop. A submission
+ * that succeeded only after 1-2 retries against a degrading GitHub/GitLab API
+ * was byte-for-byte indistinguishable in the log from one that succeeded on
+ * the first try — an operator had zero early-warning signal of a degrading
+ * provider until the retry budget fully exhausted and threw.
+ *
+ * Fix: `onRetryWarn(fields)` fires at the point each loop decides to retry,
+ * defaulting to a structured NDJSON stderr line (`component:'verify'`,
+ * `stage:'warn'`) and injectable via `opts.onRetryWarn` for tests (mirrors
+ * the already-injectable `opts.fetchImpl` / `opts.sleepImpl` on this file).
+ *
+ * Why NOT `logStage` from `@dogfood-lab/dogfood-swarm/lib/log-stage.js`:
+ * packages/verify has no dependency on dogfood-swarm and taking one would
+ * close a SECOND, larger workspace cycle (verify -> dogfood-swarm ->
+ * findings -> ingest -> verify) — see provenance.js's `defaultOnRetryWarn`
+ * doc block for the full reasoning. This suite pins that the emitted shape
+ * is real and correct without that import.
+ *
+ * RED proof (reasoned, not re-executed as a hang risk): before this fix,
+ * `onRetryWarn` did not exist on the opts object at all — every assertion
+ * in the "onRetryWarn fires" describe blocks below would fail with "onRetryWarn
+ * was never called" (the array stays empty), since nothing invoked it. This is
+ * independently re-derived from reading the pre-fix source (confirmed: zero
+ * occurrences of any warn/log call inside either retry loop), not carried
+ * over from the finding's own prose.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { githubProvenance, gitlabProvenance } from './provenance.js';
+
+const RUN_HEAD = 'c5d6c4e0000000000000000000000000deadbeef';
+
+const GH_SOURCE = {
+  provider: 'github',
+  workflow: 'dogfood.yml',
+  provider_run_id: '9123456789',
+  run_url: 'https://github.com/acme/widget/actions/runs/9123456789'
+};
+
+const GL_SOURCE = {
+  provider: 'gitlab',
+  workflow: '.gitlab-ci.yml',
+  provider_run_id: '424242',
+  run_url: 'https://gitlab.com/acme/widget/-/pipelines/424242',
+  repo: 'acme/widget'
+};
+
+function abortError() {
+  const e = new Error('This operation was aborted');
+  e.name = 'AbortError';
+  return e;
+}
+
+const noSleep = async () => {};
+
+function okGithubResp() {
+  return {
+    ok: true,
+    status: 200,
+    json: async () => ({
+      id: 9123456789,
+      status: 'completed',
+      head_sha: RUN_HEAD,
+      repository: { full_name: 'acme/widget' }
+    })
+  };
+}
+
+function okGitlabResp() {
+  return { ok: true, status: 200, json: async () => ({ id: 424242, status: 'success', sha: RUN_HEAD }) };
+}
+
+/** @pins F-2a5ddafa */
+describe('F-2a5ddafa — githubProvenance emits onRetryWarn before each retry', () => {
+  it('a timeout then a 200: onRetryWarn fires once with status_or_reason="timeout"', async () => {
+    let calls = 0;
+    const warnings = [];
+    const adapter = githubProvenance('token', {
+      timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+      onRetryWarn: (f) => warnings.push(f),
+      fetchImpl: async () => {
+        calls++;
+        if (calls === 1) throw abortError();
+        return okGithubResp();
+      }
+    });
+    const ok = await adapter.confirm(GH_SOURCE, { refCommitSha: RUN_HEAD });
+    assert.equal(ok, true);
+    assert.equal(warnings.length, 1, `expected exactly one retry warning; got ${JSON.stringify(warnings)}`);
+    assert.equal(warnings[0].kind, 'provenance_retry');
+    assert.equal(warnings[0].provider, 'github');
+    assert.equal(warnings[0].attempt, 1);
+    assert.equal(warnings[0].status_or_reason, 'timeout');
+    assert.equal(typeof warnings[0].next_backoff_ms, 'number');
+  });
+
+  it('a 503 then a 200: onRetryWarn fires with status_or_reason=503 (the numeric status)', async () => {
+    let calls = 0;
+    const warnings = [];
+    const adapter = githubProvenance('token', {
+      timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+      onRetryWarn: (f) => warnings.push(f),
+      fetchImpl: async () => {
+        calls++;
+        return calls === 1 ? { ok: false, status: 503 } : okGithubResp();
+      }
+    });
+    await adapter.confirm(GH_SOURCE, { refCommitSha: RUN_HEAD });
+    assert.equal(warnings.length, 1);
+    assert.equal(warnings[0].status_or_reason, 503);
+  });
+
+  it('a transport reject then a 200: onRetryWarn carries the underlying error message', async () => {
+    let calls = 0;
+    const warnings = [];
+    const adapter = githubProvenance('token', {
+      timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+      onRetryWarn: (f) => warnings.push(f),
+      fetchImpl: async () => {
+        calls++;
+        if (calls === 1) throw new Error('ECONNRESET');
+        return okGithubResp();
+      }
+    });
+    await adapter.confirm(GH_SOURCE, { refCommitSha: RUN_HEAD });
+    assert.equal(warnings.length, 1);
+    assert.match(warnings[0].status_or_reason, /ECONNRESET/);
+  });
+
+  it('exhausting the retry budget fires onRetryWarn exactly `retries` times, not on the final throw', async () => {
+    const warnings = [];
+    const adapter = githubProvenance('token', {
+      timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+      onRetryWarn: (f) => warnings.push(f),
+      fetchImpl: async () => { throw abortError(); }
+    });
+    await assert.rejects(() => adapter.confirm(GH_SOURCE), /provenance: GitHub API timeout/);
+    assert.equal(warnings.length, 2, 'retries=2 → 2 warn events before the 3rd attempt throws');
+    assert.deepEqual(warnings.map(w => w.attempt), [1, 2]);
+  });
+
+  it('DEFAULT onRetryWarn (no opts override): writes a structured NDJSON warn line to stderr', async () => {
+    let calls = 0;
+    const captured = [];
+    const origErr = process.stderr.write.bind(process.stderr);
+    process.stderr.write = (chunk) => { captured.push(chunk.toString()); return true; };
+    try {
+      const adapter = githubProvenance('token', {
+        timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+        fetchImpl: async () => {
+          calls++;
+          if (calls === 1) throw abortError();
+          return okGithubResp();
+        }
+      });
+      await adapter.confirm(GH_SOURCE, { refCommitSha: RUN_HEAD });
+    } finally {
+      process.stderr.write = origErr;
+    }
+    const jsonLine = captured.find((c) => c.trim().startsWith('{'));
+    assert.ok(jsonLine, `expected a JSON warn line on stderr; got ${JSON.stringify(captured)}`);
+    const parsed = JSON.parse(jsonLine.trim());
+    assert.equal(parsed.component, 'verify');
+    assert.equal(parsed.stage, 'warn');
+    assert.equal(parsed.kind, 'provenance_retry');
+    assert.equal(parsed.provider, 'github');
+  });
+});
+
+/** @pins F-2a5ddafa */
+describe('F-2a5ddafa — gitlabProvenance mirrors the onRetryWarn discipline', () => {
+  it('a timeout then a 200: onRetryWarn fires once with provider="gitlab"', async () => {
+    let calls = 0;
+    const warnings = [];
+    const adapter = gitlabProvenance('token', {
+      timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+      onRetryWarn: (f) => warnings.push(f),
+      fetchImpl: async () => {
+        calls++;
+        if (calls === 1) throw abortError();
+        return okGitlabResp();
+      }
+    });
+    const ok = await adapter.confirm(GL_SOURCE, { refCommitSha: RUN_HEAD });
+    assert.equal(ok, true);
+    assert.equal(warnings.length, 1);
+    assert.equal(warnings[0].kind, 'provenance_retry');
+    assert.equal(warnings[0].provider, 'gitlab');
+    assert.equal(warnings[0].status_or_reason, 'timeout');
+  });
+
+  it('a 429 then a 200: onRetryWarn carries the numeric status', async () => {
+    let calls = 0;
+    const warnings = [];
+    const adapter = gitlabProvenance('token', {
+      timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+      onRetryWarn: (f) => warnings.push(f),
+      fetchImpl: async () => {
+        calls++;
+        return calls === 1 ? { ok: false, status: 429 } : okGitlabResp();
+      }
+    });
+    await adapter.confirm(GL_SOURCE, { refCommitSha: RUN_HEAD });
+    assert.equal(warnings.length, 1);
+    assert.equal(warnings[0].status_or_reason, 429);
+  });
+
+  it('exhausting the retry budget fires onRetryWarn exactly `retries` times', async () => {
+    const warnings = [];
+    const adapter = gitlabProvenance('token', {
+      timeoutMs: 1000, retries: 1, sleepImpl: noSleep,
+      onRetryWarn: (f) => warnings.push(f),
+      fetchImpl: async () => { throw abortError(); }
+    });
+    await assert.rejects(() => adapter.confirm(GL_SOURCE), /provenance: GitLab API timeout/);
+    assert.equal(warnings.length, 1, 'retries=1 → 1 warn event before the 2nd attempt throws');
+  });
+});

package/validators/f-f50e779b-retry-warn-fallback-guard.test.js

@@ -0,0 +1,153 @@
+/**
+ * f-f50e779b-retry-warn-fallback-guard.test.js
+ *
+ * F-f50e779b (wave 31, backend amend) — a defect INSIDE the wave-29 fix for
+ * F-2a5ddafa, found by this same lane's own wave-30 audit of its own prior
+ * work. defaultOnRetryWarn's doc comment states the invariant "the logger
+ * must never throw and mask a real retry" and wraps its primary
+ * `console.error(JSON.stringify(line))` call in try/catch — but the catch
+ * block's OWN recovery action, a second `console.error(...)` call, was not
+ * itself guarded. If console.error throws on BOTH calls (a broken stderr fd
+ * — EPIPE/ENOSPC, realistic on a CI runner), the second throw escaped
+ * defaultOnRetryWarn uncaught, out of the retry loop, out of confirm() —
+ * turning a retry that was about to SUCCEED into a rejected promise. Blast
+ * radius is bounded by an unrelated, pre-existing mechanism (verify/index.js
+ * reclassifies any confirm() throw as a structured PROVENANCE_FAULT, exit 2,
+ * nothing persisted) — so this was never a crash, but a submission whose
+ * provenance check would have succeeded after a retry was discarded solely
+ * because the NEW observability line could not be written: the opposite of
+ * what an observability feature should do to reliability.
+ *
+ * Fix: give the fallback console.error (provenance.js ~line 153-162) its own
+ * try/catch, mirroring the two-level guard `dogfood-swarm/lib/log-stage.js`
+ * already uses for the identical shape (`catch { try { ... } catch {} }`) —
+ * that file was independently swept and confirmed already-hardened; nothing
+ * else in this domain shares defaultOnRetryWarn (grepped for
+ * onRetryWarn/defaultOnRetryWarn/onWarn/onLog across every owned package —
+ * only provenance.js and its two test files match).
+ *
+ * RED proof — ACTUALLY EXECUTED, not just reasoned (per this wave's brief:
+ * "a verification that cannot fail is not a verification"). This exact
+ * fixture was run via `node --test` against a byte-identical scratch copy of
+ * the PRE-FIX provenance.js in an isolated temp dir (this file has zero
+ * imports, so a bare copy is fully self-contained — no workspace needed).
+ * Both cases below FAILED against the pre-fix copy, each stack trace pinned
+ * to `defaultOnRetryWarn (provenance.js:153)`:
+ *   - the "resolves true" case rejected with the raw 'EPIPE: simulated
+ *     broken stderr' error instead of resolving `true`.
+ *   - the "scope" case rejected with that SAME raw EPIPE error instead of
+ *     the expected 'provenance: GitHub API timeout' operational error —
+ *     proving the pre-fix bug also clobbers a genuine exhausted-retry error
+ *     with the logger's own unrelated failure.
+ * The identical fixture was then re-run against a fixed copy (the nested
+ * try/catch added, nothing else changed) and both cases passed. Only that
+ * one nested try/catch differed between the RED run and the GREEN run.
+ *
+ * Care taken against the "vacuous test" shape (this wave's own named lesson,
+ * re: F-2a5ddafa's original test asserting a fix fired without ever proving
+ * it fired ONLY where it should): `opts.onRetryWarn` is deliberately NEVER
+ * overridden below — overriding it would bypass defaultOnRetryWarn entirely
+ * and the test would pass whether or not this fix exists, regardless of the
+ * production code. The global `console.error` (not `process.stderr.write`,
+ * which the F-2a5ddafa suite already uses for a *different* assertion) is
+ * the monkey-patch target because that is exactly what defaultOnRetryWarn
+ * calls. The second test below additionally proves the guard is scoped
+ * correctly: it swallows ONLY the logger's own failure and does not mask a
+ * real, unrelated operational error the caller is entitled to see.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { githubProvenance } from './provenance.js';
+
+const RUN_HEAD = 'c5d6c4e0000000000000000000000000deadbeef';
+
+const GH_SOURCE = {
+  provider: 'github',
+  workflow: 'dogfood.yml',
+  provider_run_id: '9123456789',
+  run_url: 'https://github.com/acme/widget/actions/runs/9123456789'
+};
+
+function abortError() {
+  const e = new Error('This operation was aborted');
+  e.name = 'AbortError';
+  return e;
+}
+
+const noSleep = async () => {};
+
+function okGithubResp() {
+  return {
+    ok: true,
+    status: 200,
+    json: async () => ({
+      id: 9123456789,
+      status: 'completed',
+      head_sha: RUN_HEAD,
+      repository: { full_name: 'acme/widget' }
+    })
+  };
+}
+
+/**
+ * Monkey-patch the GLOBAL console.error for the duration of `fn` so every
+ * call throws, simulating a broken stderr fd (EPIPE/ENOSPC) — the exact
+ * mechanism the finding proved live. Always restores the original in
+ * `finally` so a failing assertion cannot leak the patch into a sibling
+ * test (node:test runs this file's cases sequentially, but a leaked patch
+ * would still poison any later suite in the same process).
+ *
+ * @param {(getCallCount: () => number) => Promise<void>} fn
+ */
+async function withThrowingConsoleError(fn) {
+  const orig = console.error;
+  let calls = 0;
+  console.error = () => {
+    calls++;
+    throw new Error('EPIPE: simulated broken stderr');
+  };
+  try {
+    await fn(() => calls);
+  } finally {
+    console.error = orig;
+  }
+}
+
+/** @pins F-f50e779b */
+describe('F-f50e779b — defaultOnRetryWarn fallback is itself guarded', () => {
+  it('a retry that would succeed still resolves true when console.error throws on every call', async () => {
+    await withThrowingConsoleError(async (getCalls) => {
+      let fetchCalls = 0;
+      const adapter = githubProvenance('token', {
+        timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+        // Deliberately NOT overriding onRetryWarn — must exercise the real
+        // defaultOnRetryWarn, or this test never reaches the guarded code
+        // (the exact vacuous-test shape this suite's header warns against).
+        fetchImpl: async () => {
+          fetchCalls++;
+          if (fetchCalls === 1) throw abortError();
+          return okGithubResp();
+        }
+      });
+      const ok = await adapter.confirm(GH_SOURCE, { refCommitSha: RUN_HEAD });
+      assert.equal(ok, true, 'a retry that succeeds must resolve true, not reject');
+      assert.equal(getCalls(), 2, 'expected exactly 2 console.error attempts: primary (line ~149) + fallback (line ~153)');
+    });
+  });
+
+  it('scope: a genuinely exhausted retry budget still throws the real operational error, not the logger error', async () => {
+    await withThrowingConsoleError(async () => {
+      const adapter = githubProvenance('token', {
+        timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+        fetchImpl: async () => { throw abortError(); } // never succeeds — budget exhausts
+      });
+      await assert.rejects(
+        () => adapter.confirm(GH_SOURCE, { refCommitSha: RUN_HEAD }),
+        /provenance: GitHub API timeout/,
+        'the fallback guard must swallow ONLY the logger failure — it must never mask the real exhausted-retry error behind it'
+      );
+    });
+  });
+});

package/validators/policy.js

@@ -118,6 +118,15 @@ function resolveSurfacePolicy(surface, globalPolicy, repoPolicy) {
  *   `configErrors` (VERIFY-F1) are eval-time repo custom-rule predicate faults; the
  *   caller emits them with a `policy-config:` prefix (submission-bad). A non-empty
  *   `configErrors` makes `valid` false.
+ * @throws {Error} F-3ef6b03e: a global rule declared `severity: reject` whose id
+ *   is outside {@link KNOWN_REJECT_RULE_IDS} — a maintainer-authored
+ *   global-policy.yaml gap, not a submission fault. Mirrors the GLOBAL-rule
+ *   predicate-fault throw above: `runValidator('policy', ...)` in index.js
+ *   wraps this as `VALIDATOR_FAULT_POLICY:`, which parseRejectionReason
+ *   classifies 'operational' by family match. Pre-fix this pushed into
+ *   `errors` under the `policy:` prefix, which parseRejectionReason
+ *   classifies 'submission-bad' — telling every consumer in the fleet to fix
+ *   a payload that was never the problem.
  */
 export function validatePolicy(submission, { globalPolicy, repoPolicy }) {
   const errors = [];
@@ -196,15 +205,21 @@ export function validatePolicy(submission, { globalPolicy, repoPolicy }) {
 
       // schema-valid, provenance-confirmed, step-results-present, step-verdict-consistent,
       // no-verdict-upgrade are enforced by other validators or the main verify() function.
-      // PROACT-VERIFY-002: a reject rule the build neither handles here NOR enforces
-      // elsewhere would otherwise pass SILENTLY — the operator's new gate never runs.
-      // Reject the submission with a diagnostic naming the unenforced rule so the gap
-      // is visible instead of failing open.
+      // PROACT-VERIFY-002 / F-3ef6b03e: a reject rule the build neither handles here NOR
+      // enforces elsewhere would otherwise pass SILENTLY — the operator's new gate never
+      // runs. THROW rather than push to `errors`: this is a maintainer-authored
+      // global-policy.yaml gap (the same class of broken-policy-file fault
+      // loadGlobalPolicy's schema gate already fails loud on), not a submission fault.
+      // Pushing to `errors` would route through the `policy:` prefix — classified
+      // 'submission-bad' by parseRejectionReason — telling the submitter to fix a
+      // payload that was never the problem, fleet-wide, for every submission until a
+      // maintainer notices. Throwing here mirrors the GLOBAL-rule predicate-fault
+      // throw above: runValidator('policy', ...) in index.js wraps it as
+      // `VALIDATOR_FAULT_POLICY:`, classified 'operational' — exit 2, nothing
+      // persisted, no run_id poisoned via the duplicate guard (F-82429f90).
       default:
         if (!KNOWN_REJECT_RULE_IDS.has(rule.id)) {
-          // No `policy:` prefix here — index.js prepends it to every policy
-          // error (mirrors the `[rule.id]` / `surface[...]` messages above).
-          errors.push(
+          throw new Error(
             `rule "${rule.id}" is declared severity:reject but has no enforcement in this build — ` +
               `add an enforcement arm in validators/policy.js or register it in KNOWN_REJECT_RULE_IDS`
           );

package/validators/provenance-registry.test.js

@@ -25,6 +25,22 @@ const schemaPath = require.resolve(
 const submissionSchema = JSON.parse(readFileSync(schemaPath, 'utf-8'));
 const PROVIDER_ENUM = submissionSchema.properties.source.properties.provider.enum;
 
+/**
+ * F-a2fb624f: the pre-fix tripwire (`provenanceForProvider('bitbucket') ===
+ * null`) only probed a NON-prototype unknown key — green both before AND
+ * after F-2965699b's fix, so it gave zero coverage for the actual defect
+ * class. This table-driven set is the real regression guard: every
+ * Object.prototype own-property name, which is exactly the key space
+ * `PROVENANCE_ADAPTERS[provider]` resolved (as a truthy inherited method,
+ * defeating `?? null`) before the Object.hasOwn fix. Shared verbatim with
+ * repo-binding.test.js's sibling table so both prototype-safety sites are
+ * proven against the identical key set.
+ */
+const OBJECT_PROTOTYPE_KEYS = [
+  'constructor', 'toString', 'valueOf', '__proto__',
+  'hasOwnProperty', 'isPrototypeOf', 'propertyIsEnumerable', 'toLocaleString',
+];
+
 describe('provenance adapter coverage', () => {
   it('exposes the provider enum it is meant to cover (sanity)', () => {
     assert.ok(Array.isArray(PROVIDER_ENUM) && PROVIDER_ENUM.length > 0);
@@ -53,4 +69,23 @@ describe('provenance adapter coverage', () => {
   it('provenanceForProvider returns null for an unknown provider (no throw)', () => {
     assert.equal(provenanceForProvider('bitbucket'), null);
   });
+
+  describe('F-2965699b: provenanceForProvider never resolves an inherited Object.prototype key', () => {
+    for (const key of OBJECT_PROTOTYPE_KEYS) {
+      it(`returns null (not the inherited method) for provider="${key}"`, () => {
+        // Deletion/emptiness proof: revert provenanceForProvider to
+        // `PROVENANCE_ADAPTERS[provider] ?? null` and this goes red for
+        // every key here — each one currently resolves a truthy inherited
+        // Object.prototype value that `?? null` cannot catch.
+        assert.equal(provenanceForProvider(key), null,
+          `provider="${key}" must resolve to null, not an inherited Object.prototype member`);
+      });
+    }
+
+    it('a non-string provider (object, number, null, undefined) never throws and returns null', () => {
+      for (const bad of [{}, 42, null, undefined, ['github']]) {
+        assert.equal(provenanceForProvider(bad), null, `provider=${JSON.stringify(bad)} must resolve to null`);
+      }
+    });
+  });
 });