@dogfood-lab/verify 1.9.0 → 1.11.0

package/validators/f-f50e779b-retry-warn-fallback-guard.test.js

@@ -0,0 +1,153 @@
+/**
+ * f-f50e779b-retry-warn-fallback-guard.test.js
+ *
+ * F-f50e779b (wave 31, backend amend) — a defect INSIDE the wave-29 fix for
+ * F-2a5ddafa, found by this same lane's own wave-30 audit of its own prior
+ * work. defaultOnRetryWarn's doc comment states the invariant "the logger
+ * must never throw and mask a real retry" and wraps its primary
+ * `console.error(JSON.stringify(line))` call in try/catch — but the catch
+ * block's OWN recovery action, a second `console.error(...)` call, was not
+ * itself guarded. If console.error throws on BOTH calls (a broken stderr fd
+ * — EPIPE/ENOSPC, realistic on a CI runner), the second throw escaped
+ * defaultOnRetryWarn uncaught, out of the retry loop, out of confirm() —
+ * turning a retry that was about to SUCCEED into a rejected promise. Blast
+ * radius is bounded by an unrelated, pre-existing mechanism (verify/index.js
+ * reclassifies any confirm() throw as a structured PROVENANCE_FAULT, exit 2,
+ * nothing persisted) — so this was never a crash, but a submission whose
+ * provenance check would have succeeded after a retry was discarded solely
+ * because the NEW observability line could not be written: the opposite of
+ * what an observability feature should do to reliability.
+ *
+ * Fix: give the fallback console.error (provenance.js ~line 153-162) its own
+ * try/catch, mirroring the two-level guard `dogfood-swarm/lib/log-stage.js`
+ * already uses for the identical shape (`catch { try { ... } catch {} }`) —
+ * that file was independently swept and confirmed already-hardened; nothing
+ * else in this domain shares defaultOnRetryWarn (grepped for
+ * onRetryWarn/defaultOnRetryWarn/onWarn/onLog across every owned package —
+ * only provenance.js and its two test files match).
+ *
+ * RED proof — ACTUALLY EXECUTED, not just reasoned (per this wave's brief:
+ * "a verification that cannot fail is not a verification"). This exact
+ * fixture was run via `node --test` against a byte-identical scratch copy of
+ * the PRE-FIX provenance.js in an isolated temp dir (this file has zero
+ * imports, so a bare copy is fully self-contained — no workspace needed).
+ * Both cases below FAILED against the pre-fix copy, each stack trace pinned
+ * to `defaultOnRetryWarn (provenance.js:153)`:
+ *   - the "resolves true" case rejected with the raw 'EPIPE: simulated
+ *     broken stderr' error instead of resolving `true`.
+ *   - the "scope" case rejected with that SAME raw EPIPE error instead of
+ *     the expected 'provenance: GitHub API timeout' operational error —
+ *     proving the pre-fix bug also clobbers a genuine exhausted-retry error
+ *     with the logger's own unrelated failure.
+ * The identical fixture was then re-run against a fixed copy (the nested
+ * try/catch added, nothing else changed) and both cases passed. Only that
+ * one nested try/catch differed between the RED run and the GREEN run.
+ *
+ * Care taken against the "vacuous test" shape (this wave's own named lesson,
+ * re: F-2a5ddafa's original test asserting a fix fired without ever proving
+ * it fired ONLY where it should): `opts.onRetryWarn` is deliberately NEVER
+ * overridden below — overriding it would bypass defaultOnRetryWarn entirely
+ * and the test would pass whether or not this fix exists, regardless of the
+ * production code. The global `console.error` (not `process.stderr.write`,
+ * which the F-2a5ddafa suite already uses for a *different* assertion) is
+ * the monkey-patch target because that is exactly what defaultOnRetryWarn
+ * calls. The second test below additionally proves the guard is scoped
+ * correctly: it swallows ONLY the logger's own failure and does not mask a
+ * real, unrelated operational error the caller is entitled to see.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { githubProvenance } from './provenance.js';
+
+const RUN_HEAD = 'c5d6c4e0000000000000000000000000deadbeef';
+
+const GH_SOURCE = {
+  provider: 'github',
+  workflow: 'dogfood.yml',
+  provider_run_id: '9123456789',
+  run_url: 'https://github.com/acme/widget/actions/runs/9123456789'
+};
+
+function abortError() {
+  const e = new Error('This operation was aborted');
+  e.name = 'AbortError';
+  return e;
+}
+
+const noSleep = async () => {};
+
+function okGithubResp() {
+  return {
+    ok: true,
+    status: 200,
+    json: async () => ({
+      id: 9123456789,
+      status: 'completed',
+      head_sha: RUN_HEAD,
+      repository: { full_name: 'acme/widget' }
+    })
+  };
+}
+
+/**
+ * Monkey-patch the GLOBAL console.error for the duration of `fn` so every
+ * call throws, simulating a broken stderr fd (EPIPE/ENOSPC) — the exact
+ * mechanism the finding proved live. Always restores the original in
+ * `finally` so a failing assertion cannot leak the patch into a sibling
+ * test (node:test runs this file's cases sequentially, but a leaked patch
+ * would still poison any later suite in the same process).
+ *
+ * @param {(getCallCount: () => number) => Promise<void>} fn
+ */
+async function withThrowingConsoleError(fn) {
+  const orig = console.error;
+  let calls = 0;
+  console.error = () => {
+    calls++;
+    throw new Error('EPIPE: simulated broken stderr');
+  };
+  try {
+    await fn(() => calls);
+  } finally {
+    console.error = orig;
+  }
+}
+
+/** @pins F-f50e779b */
+describe('F-f50e779b — defaultOnRetryWarn fallback is itself guarded', () => {
+  it('a retry that would succeed still resolves true when console.error throws on every call', async () => {
+    await withThrowingConsoleError(async (getCalls) => {
+      let fetchCalls = 0;
+      const adapter = githubProvenance('token', {
+        timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+        // Deliberately NOT overriding onRetryWarn — must exercise the real
+        // defaultOnRetryWarn, or this test never reaches the guarded code
+        // (the exact vacuous-test shape this suite's header warns against).
+        fetchImpl: async () => {
+          fetchCalls++;
+          if (fetchCalls === 1) throw abortError();
+          return okGithubResp();
+        }
+      });
+      const ok = await adapter.confirm(GH_SOURCE, { refCommitSha: RUN_HEAD });
+      assert.equal(ok, true, 'a retry that succeeds must resolve true, not reject');
+      assert.equal(getCalls(), 2, 'expected exactly 2 console.error attempts: primary (line ~149) + fallback (line ~153)');
+    });
+  });
+
+  it('scope: a genuinely exhausted retry budget still throws the real operational error, not the logger error', async () => {
+    await withThrowingConsoleError(async () => {
+      const adapter = githubProvenance('token', {
+        timeoutMs: 1000, retries: 2, sleepImpl: noSleep,
+        fetchImpl: async () => { throw abortError(); } // never succeeds — budget exhausts
+      });
+      await assert.rejects(
+        () => adapter.confirm(GH_SOURCE, { refCommitSha: RUN_HEAD }),
+        /provenance: GitHub API timeout/,
+        'the fallback guard must swallow ONLY the logger failure — it must never mask the real exhausted-retry error behind it'
+      );
+    });
+  });
+});

package/validators/policy.js

@@ -118,6 +118,15 @@ function resolveSurfacePolicy(surface, globalPolicy, repoPolicy) {
  *   `configErrors` (VERIFY-F1) are eval-time repo custom-rule predicate faults; the
  *   caller emits them with a `policy-config:` prefix (submission-bad). A non-empty
  *   `configErrors` makes `valid` false.
+ * @throws {Error} F-3ef6b03e: a global rule declared `severity: reject` whose id
+ *   is outside {@link KNOWN_REJECT_RULE_IDS} — a maintainer-authored
+ *   global-policy.yaml gap, not a submission fault. Mirrors the GLOBAL-rule
+ *   predicate-fault throw above: `runValidator('policy', ...)` in index.js
+ *   wraps this as `VALIDATOR_FAULT_POLICY:`, which parseRejectionReason
+ *   classifies 'operational' by family match. Pre-fix this pushed into
+ *   `errors` under the `policy:` prefix, which parseRejectionReason
+ *   classifies 'submission-bad' — telling every consumer in the fleet to fix
+ *   a payload that was never the problem.
  */
 export function validatePolicy(submission, { globalPolicy, repoPolicy }) {
   const errors = [];
@@ -196,15 +205,21 @@ export function validatePolicy(submission, { globalPolicy, repoPolicy }) {
 
       // schema-valid, provenance-confirmed, step-results-present, step-verdict-consistent,
       // no-verdict-upgrade are enforced by other validators or the main verify() function.
-      // PROACT-VERIFY-002: a reject rule the build neither handles here NOR enforces
-      // elsewhere would otherwise pass SILENTLY — the operator's new gate never runs.
-      // Reject the submission with a diagnostic naming the unenforced rule so the gap
-      // is visible instead of failing open.
+      // PROACT-VERIFY-002 / F-3ef6b03e: a reject rule the build neither handles here NOR
+      // enforces elsewhere would otherwise pass SILENTLY — the operator's new gate never
+      // runs. THROW rather than push to `errors`: this is a maintainer-authored
+      // global-policy.yaml gap (the same class of broken-policy-file fault
+      // loadGlobalPolicy's schema gate already fails loud on), not a submission fault.
+      // Pushing to `errors` would route through the `policy:` prefix — classified
+      // 'submission-bad' by parseRejectionReason — telling the submitter to fix a
+      // payload that was never the problem, fleet-wide, for every submission until a
+      // maintainer notices. Throwing here mirrors the GLOBAL-rule predicate-fault
+      // throw above: runValidator('policy', ...) in index.js wraps it as
+      // `VALIDATOR_FAULT_POLICY:`, classified 'operational' — exit 2, nothing
+      // persisted, no run_id poisoned via the duplicate guard (F-82429f90).
       default:
         if (!KNOWN_REJECT_RULE_IDS.has(rule.id)) {
-          // No `policy:` prefix here — index.js prepends it to every policy
-          // error (mirrors the `[rule.id]` / `surface[...]` messages above).
-          errors.push(
+          throw new Error(
             `rule "${rule.id}" is declared severity:reject but has no enforcement in this build — ` +
               `add an enforcement arm in validators/policy.js or register it in KNOWN_REJECT_RULE_IDS`
           );
@@ -299,13 +314,24 @@ export function validatePolicy(submission, { globalPolicy, repoPolicy }) {
     const ciReqs = surfacePolicy.ci_requirements;
     if (!ciReqs) continue;
 
-    if (ciReqs.tests_must_pass && submission.ci_checks) {
-      const failingTests = submission.ci_checks.filter(
-        c => c.kind === 'test' && c.status === 'fail'
-      );
-      if (failingTests.length > 0) {
-        const ids = failingTests.map(c => c.id).join(', ');
-        errors.push(`surface[${surface}]: CI tests must pass but [${ids}] failed`);
+    // F-3b34d51e: mirror coverage_min's missing-data contract. Pre-fix the
+    // gate was `if (tests_must_pass && submission.ci_checks)` — omitting the
+    // optional ci_checks field (or sending [] / no kind:'test' entries)
+    // skipped the branch entirely and policy-validated clean under a
+    // tests_must_pass:true surface. Require at least one kind:'test' check
+    // whose status is not 'fail'; reject absent/empty/no-test-kind evidence.
+    if (ciReqs.tests_must_pass) {
+      const testChecks = (submission.ci_checks || []).filter(c => c.kind === 'test');
+      if (testChecks.length === 0) {
+        errors.push(
+          `surface[${surface}]: tests_must_pass is true but no kind:test CI check provided`
+        );
+      } else {
+        const failingTests = testChecks.filter(c => c.status === 'fail');
+        if (failingTests.length > 0) {
+          const ids = failingTests.map(c => c.id).join(', ');
+          errors.push(`surface[${surface}]: CI tests must pass but [${ids}] failed`);
+        }
       }
     }
 

package/validators/provenance-registry.test.js

@@ -25,6 +25,22 @@ const schemaPath = require.resolve(
 const submissionSchema = JSON.parse(readFileSync(schemaPath, 'utf-8'));
 const PROVIDER_ENUM = submissionSchema.properties.source.properties.provider.enum;
 
+/**
+ * F-a2fb624f: the pre-fix tripwire (`provenanceForProvider('bitbucket') ===
+ * null`) only probed a NON-prototype unknown key — green both before AND
+ * after F-2965699b's fix, so it gave zero coverage for the actual defect
+ * class. This table-driven set is the real regression guard: every
+ * Object.prototype own-property name, which is exactly the key space
+ * `PROVENANCE_ADAPTERS[provider]` resolved (as a truthy inherited method,
+ * defeating `?? null`) before the Object.hasOwn fix. Shared verbatim with
+ * repo-binding.test.js's sibling table so both prototype-safety sites are
+ * proven against the identical key set.
+ */
+const OBJECT_PROTOTYPE_KEYS = [
+  'constructor', 'toString', 'valueOf', '__proto__',
+  'hasOwnProperty', 'isPrototypeOf', 'propertyIsEnumerable', 'toLocaleString',
+];
+
 describe('provenance adapter coverage', () => {
   it('exposes the provider enum it is meant to cover (sanity)', () => {
     assert.ok(Array.isArray(PROVIDER_ENUM) && PROVIDER_ENUM.length > 0);
@@ -53,4 +69,23 @@ describe('provenance adapter coverage', () => {
   it('provenanceForProvider returns null for an unknown provider (no throw)', () => {
     assert.equal(provenanceForProvider('bitbucket'), null);
   });
+
+  describe('F-2965699b: provenanceForProvider never resolves an inherited Object.prototype key', () => {
+    for (const key of OBJECT_PROTOTYPE_KEYS) {
+      it(`returns null (not the inherited method) for provider="${key}"`, () => {
+        // Deletion/emptiness proof: revert provenanceForProvider to
+        // `PROVENANCE_ADAPTERS[provider] ?? null` and this goes red for
+        // every key here — each one currently resolves a truthy inherited
+        // Object.prototype value that `?? null` cannot catch.
+        assert.equal(provenanceForProvider(key), null,
+          `provider="${key}" must resolve to null, not an inherited Object.prototype member`);
+      });
+    }
+
+    it('a non-string provider (object, number, null, undefined) never throws and returns null', () => {
+      for (const bad of [{}, 42, null, undefined, ['github']]) {
+        assert.equal(provenanceForProvider(bad), null, `provider=${JSON.stringify(bad)} must resolve to null`);
+      }
+    });
+  });
 });

package/validators/provenance.js

@@ -14,6 +14,24 @@
  * `source.provider`, so the provider enum, the run_url parsers
  * (validators/repo-binding.js), and the adapters here stay in lockstep —
  * coverage tests fail CI if any of the three drifts.
+ *
+ * F-936c83f4 (wave 39, feature-pass integration finding): this module's
+ * `--provenance=stub|github` (the flag both packages/verify/cli.js and
+ * packages/ingest/run.js parse, both delegating to the adapters here) answers
+ * ONE of three structurally-similar-but-distinct 'how do we know this claim is
+ * true' questions living in this repo: (1) THIS module — does a submitted CI
+ * run really exist and match its claims; (2) dogfood-finding.schema.json's
+ * `evidence[].evidence_kind` enum — what evidence backs a distilled cross-repo
+ * lesson (see that property's own cross-reference note); (3) the swarm
+ * control-plane's incoming `verified_how`
+ * (independent|self_attested|operator_evidence,
+ * docs/trajectory-and-closure.dispatch.md's C2 `swarm close` verb) — how a
+ * finding CLOSURE was verified. This is NOT a request to unify the three
+ * enums — CI-run provenance, cross-repo-lesson evidence, and
+ * closure-verification-method are genuinely different axes, and forcing one
+ * shared enum would misrepresent that. The pointer exists only so the next
+ * reader of any of the three doesn't rediscover the pattern from scratch a
+ * fourth time.
  */
 
 /**
@@ -105,6 +123,67 @@ function defaultSleep(ms) {
   return new Promise(resolve => setTimeout(resolve, ms));
 }
 
+/**
+ * F-2a5ddafa: emit ONE structured NDJSON warn line to stderr each time a
+ * retry is about to happen, so an operator tailing CI logs sees a degrading
+ * provider BEFORE the retry budget exhausts and throws. Pre-fix, every
+ * `await sleep(...); continue;` branch in both adapters below was completely
+ * silent — a submission that succeeded only after 1-2 retries against a
+ * degrading GitHub/GitLab API was byte-for-byte indistinguishable in the log
+ * from one that succeeded on the first try. The eventual exhausted-retry
+ * failure is already loud (an operational throw); this closes the gap on
+ * the way there, which is exactly the window an operator could act in
+ * (e.g. correlate a slow ingest with a known provider incident).
+ *
+ * Deliberately NOT named `logStage` and NOT importing
+ * `@dogfood-lab/dogfood-swarm/lib/log-stage.js`: packages/verify depends on
+ * nothing but `@dogfood-lab/schemas` + `js-yaml` today (see package.json),
+ * and the accepted workspace cycle (root CLAUDE.md, "Workspace dependency
+ * graph") is `findings -> ingest -> dogfood-swarm -> findings`. `ingest`
+ * ALSO depends on `verify`, so a NEW `verify -> dogfood-swarm` edge would
+ * not reuse that cycle — it would close a SECOND, larger one:
+ * `verify -> dogfood-swarm -> findings -> ingest -> verify`. This mirrors
+ * the repo's existing precedent for exactly this constraint —
+ * `packages/ingest/lib/sleep-sync.js` duplicates
+ * `packages/findings/lib/file-lock.js`'s private `sleepSync` verbatim,
+ * per that file's own header, rather than take a disallowed cross-edge —
+ * so this emits the same NDJSON stage-line SHAPE independently instead of
+ * importing the shared helper.
+ * `packages/ingest/wave22-log-stage-discipline.test.js` (Class #9 sweep)
+ * enforces that no file under `packages/**` defines its OWN `logStage`
+ * without delegating to the shared helper; this helper uses a distinct
+ * name for exactly that reason and is not a competing definition of that
+ * convention.
+ *
+ * Injectable via `opts.onRetryWarn` (mirrors the already-injectable
+ * `opts.fetchImpl` / `opts.sleepImpl` on this file) so tests assert the
+ * exact fields without scraping stderr.
+ *
+ * @param {{ kind: string, provider: string, attempt: number, status_or_reason: string|number, next_backoff_ms: number }} fields
+ */
+function defaultOnRetryWarn(fields) {
+  const line = { ts: new Date().toISOString(), component: 'verify', stage: 'warn', ...fields };
+  try {
+    console.error(JSON.stringify(line));
+  } catch {
+    // The logger must never throw and mask a real retry — same last-resort
+    // discipline as the shared dogfood-swarm helper (log-stage.js). F-f50e779b:
+    // this fallback itself must not throw either — a broken stderr fd
+    // (EPIPE/ENOSPC) fails BOTH console.error calls, and pre-fix this second
+    // call was unguarded, so its throw escaped defaultOnRetryWarn uncaught and
+    // turned a retry that was about to SUCCEED into a rejected confirm() (the
+    // observability feature converting a good outcome into a discarded
+    // submission — see log-stage.js's own two-level guard for the same shape,
+    // which this now mirrors exactly).
+    try {
+      console.error('{"stage":"warn","kind":"log_serialization_failed"}');
+    } catch {
+      // stderr itself is broken; nothing further to do, but must not crash
+      // the caller — there is no third fallback to hand the failure to.
+    }
+  }
+}
+
 /**
  * Stub provenance adapter. Always confirms.
  * Use in tests and local development.
@@ -139,6 +218,7 @@ export function githubProvenance(token, opts = {}) {
   const retries = opts.retries ?? PROVENANCE_RETRIES;
   const backoffMs = opts.backoffMs ?? PROVENANCE_BACKOFF_MS;
   const sleep = opts.sleepImpl ?? defaultSleep;
+  const onRetryWarn = opts.onRetryWarn ?? defaultOnRetryWarn;
   return {
     /**
      * @param {object} source - submission.source (provider-scoped run claim)
@@ -204,7 +284,11 @@ export function githubProvenance(token, opts = {}) {
             // transport-reject branch below (mirrors the scenario fetcher's
             // retryable-timeout discipline), then throw on exhaustion.
             if (attempt < retries) {
-              await sleep(nextBackoffMs(null, attempt + 1, backoffMs));
+              const waitMs = nextBackoffMs(null, attempt + 1, backoffMs);
+              // F-2a5ddafa: visibility BEFORE the budget exhausts (see
+              // defaultOnRetryWarn's doc above for why this is 'warn').
+              onRetryWarn({ kind: 'provenance_retry', provider: 'github', attempt: attempt + 1, status_or_reason: 'timeout', next_backoff_ms: waitMs });
+              await sleep(waitMs);
               continue;
             }
             throw new Error(`provenance: GitHub API timeout after ${timeoutMs}ms`);
@@ -218,7 +302,9 @@ export function githubProvenance(token, opts = {}) {
           // and the duplicate guard then blocked a clean resubmission under the
           // same run_id. `return false` is reserved for HTTP 404 (mirrors GitLab).
           if (attempt < retries) {
-            await sleep(nextBackoffMs(null, attempt + 1, backoffMs));
+            const waitMs = nextBackoffMs(null, attempt + 1, backoffMs);
+            onRetryWarn({ kind: 'provenance_retry', provider: 'github', attempt: attempt + 1, status_or_reason: err && err.message ? err.message : 'network_error', next_backoff_ms: waitMs });
+            await sleep(waitMs);
             continue;
           }
           throw new Error(`provenance: network error: ${err.message}`);
@@ -238,7 +324,9 @@ export function githubProvenance(token, opts = {}) {
         // last 429/5xx throws so a real outage still surfaces (operational).
         if (resp.status === 404) return false;
         if (isRetryableStatus(resp.status) && attempt < retries) {
-          await sleep(nextBackoffMs(resp, attempt + 1, backoffMs));
+          const waitMs = nextBackoffMs(resp, attempt + 1, backoffMs);
+          onRetryWarn({ kind: 'provenance_retry', provider: 'github', attempt: attempt + 1, status_or_reason: resp.status, next_backoff_ms: waitMs });
+          await sleep(waitMs);
           continue;
         }
         throw new Error(`provenance: GitHub API returned ${resp.status}`);
@@ -312,6 +400,7 @@ export function gitlabProvenance(token, opts = {}) {
   const retries = opts.retries ?? PROVENANCE_RETRIES;
   const backoffMs = opts.backoffMs ?? PROVENANCE_BACKOFF_MS;
   const sleep = opts.sleepImpl ?? defaultSleep;
+  const onRetryWarn = opts.onRetryWarn ?? defaultOnRetryWarn;
   return {
     /**
      * @param {object} source - submission.source (provider-scoped run claim)
@@ -382,7 +471,9 @@ export function gitlabProvenance(token, opts = {}) {
             // F-8e72d0de: retry timeouts within the shared budget — peer
             // discipline with githubProvenance (see that adapter's note).
             if (attempt < retries) {
-              await sleep(nextBackoffMs(null, attempt + 1, backoffMs));
+              const waitMs = nextBackoffMs(null, attempt + 1, backoffMs);
+              onRetryWarn({ kind: 'provenance_retry', provider: 'gitlab', attempt: attempt + 1, status_or_reason: 'timeout', next_backoff_ms: waitMs });
+              await sleep(waitMs);
               continue;
             }
             throw new Error(`provenance: GitLab API timeout after ${timeoutMs}ms`);
@@ -390,7 +481,9 @@ export function gitlabProvenance(token, opts = {}) {
           // F-dac7e08c: transport reject = operational, retried then thrown —
           // mirrors githubProvenance exactly. `return false` is 404-only.
           if (attempt < retries) {
-            await sleep(nextBackoffMs(null, attempt + 1, backoffMs));
+            const waitMs = nextBackoffMs(null, attempt + 1, backoffMs);
+            onRetryWarn({ kind: 'provenance_retry', provider: 'gitlab', attempt: attempt + 1, status_or_reason: err && err.message ? err.message : 'network_error', next_backoff_ms: waitMs });
+            await sleep(waitMs);
             continue;
           }
           throw new Error(`provenance: network error: ${err.message}`);
@@ -408,7 +501,9 @@ export function gitlabProvenance(token, opts = {}) {
         // budget. 401/403 = non-transient operational, throw immediately.
         if (resp.status === 404) return false;
         if (isRetryableStatus(resp.status) && attempt < retries) {
-          await sleep(nextBackoffMs(resp, attempt + 1, backoffMs));
+          const waitMs = nextBackoffMs(resp, attempt + 1, backoffMs);
+          onRetryWarn({ kind: 'provenance_retry', provider: 'gitlab', attempt: attempt + 1, status_or_reason: resp.status, next_backoff_ms: waitMs });
+          await sleep(waitMs);
           continue;
         }
         throw new Error(`provenance: GitLab API returned ${resp.status}`);
@@ -459,10 +554,34 @@ export const PROVENANCE_ADAPTERS = {
 /**
  * Resolve the provenance-adapter factory for a `source.provider`.
  *
+ * F-2965699b: `PROVENANCE_ADAPTERS[provider]` alone resolves inherited
+ * `Object.prototype` keys (`provider: 'valueOf'` returns
+ * `Object.prototype.valueOf`, a truthy function) — the `??` operator only
+ * catches `null`/`undefined`, so the `if (!factory)` unknown-provider gate at
+ * this function's ONE caller (`resolveProviderProvenance`, packages/ingest/
+ * run.js) never fires for the whole Object.prototype key space, and
+ * `factory(token)` goes on to call an unrelated Object.prototype method with
+ * an unbound `this`, producing an uncaught TypeError (`valueOf`/`__proto__`)
+ * or a misleading downstream error (`constructor`/`toString`/
+ * `isPrototypeOf`) instead of the correct "unknown provenance provider"
+ * message. This site is reached on FULLY UNTRUSTED input — `submission.
+ * source.provider` — BEFORE verify()'s schema gate constrains it to the
+ * [github, gitlab] enum.
+ *
+ * `Object.hasOwn` restricts the lookup to the registry's own properties,
+ * matching the idiom `safeGet()` already uses in validators/predicate.js —
+ * the two prototype-safety sites now read the same.
+ *
  * @param {string} provider The `source.provider` token (e.g. 'github', 'gitlab').
  * @returns {((token: string, opts?: object) => { confirm: Function }) | null}
- *   The adapter factory, or `null` when the provider has no registered adapter.
+ *   The adapter factory, or `null` when the provider has no registered adapter
+ *   (including every Object.prototype key — `constructor`, `toString`,
+ *   `valueOf`, `__proto__`, `hasOwnProperty`, `isPrototypeOf`,
+ *   `propertyIsEnumerable`, `toLocaleString` — none of which are OWN
+ *   properties of PROVENANCE_ADAPTERS).
  */
 export function provenanceForProvider(provider) {
-  return PROVENANCE_ADAPTERS[provider] ?? null;
+  return typeof provider === 'string' && Object.hasOwn(PROVENANCE_ADAPTERS, provider)
+    ? PROVENANCE_ADAPTERS[provider]
+    : null;
 }

package/validators/repo-binding.js

@@ -88,13 +88,28 @@ export const RUN_URL_PARSERS = {
 /**
  * Decode the owner/repo a run_url attests to, for the given provider.
  *
+ * F-7ce07baa: family sibling of F-2965699b (validators/provenance.js). Plain
+ * bracket access resolves inherited Object.prototype keys, so
+ * `RUN_URL_PARSERS[provider]` for `provider: '__proto__'` (etc.) returns a
+ * truthy Object.prototype method instead of `undefined` — the `if (!parser)`
+ * unknown-provider gate cannot fire for that key space, and `parser(runUrl)`
+ * goes on to call an unrelated Object.prototype method. This site is reached
+ * even EARLIER in the trust chain than provenanceForProvider: verify/
+ * index.js's repo-binding guard runs at step 0, before the schema gate, so
+ * `submission.source.provider` is raw untrusted input here too.
+ * `Object.hasOwn` matches the safeGet()/provenanceForProvider idiom so every
+ * prototype-safety site in this codebase reads the same.
+ *
  * @param {string} provider The `source.provider` token (e.g. 'github').
  * @param {string} runUrl   The `source.run_url`.
  * @returns {RunUrlRepo | null} `{ owner, repo }`, or `null` when the provider
- *   has no parser or the URL does not match the provider's shape.
+ *   has no parser (including every Object.prototype key) or the URL does not
+ *   match the provider's shape.
  */
 export function parseRunUrlRepo(provider, runUrl) {
-  const parser = RUN_URL_PARSERS[provider];
+  const parser = typeof provider === 'string' && Object.hasOwn(RUN_URL_PARSERS, provider)
+    ? RUN_URL_PARSERS[provider]
+    : null;
   if (!parser) return null;
   return parser(runUrl);
 }

package/validators/repo-binding.test.js

@@ -29,6 +29,19 @@ const schemaPath = require.resolve(
 const submissionSchema = JSON.parse(readFileSync(schemaPath, 'utf-8'));
 const PROVIDER_ENUM = submissionSchema.properties.source.properties.provider.enum;
 
+/**
+ * F-a2fb624f: sibling table to provenance-registry.test.js's — the pre-fix
+ * tripwire here ('returns null for a provider with no parser') only probed
+ * 'bitbucket', a NON-prototype key, so it gave zero coverage for the actual
+ * F-7ce07baa defect class (every Object.prototype own-property name, which
+ * `RUN_URL_PARSERS[provider]` resolved as a truthy inherited method before
+ * the Object.hasOwn fix).
+ */
+const OBJECT_PROTOTYPE_KEYS = [
+  'constructor', 'toString', 'valueOf', '__proto__',
+  'hasOwnProperty', 'isPrototypeOf', 'propertyIsEnumerable', 'toLocaleString',
+];
+
 describe('repo-binding guard coverage (verify-B-001)', () => {
   it('exposes the provider enum it is meant to cover (sanity)', () => {
     assert.ok(Array.isArray(PROVIDER_ENUM) && PROVIDER_ENUM.length > 0);
@@ -115,4 +128,31 @@ describe('repo-binding guard coverage (verify-B-001)', () => {
   it('returns null for a provider with no parser (no throw)', () => {
     assert.equal(parseRunUrlRepo('bitbucket', 'https://bitbucket.org/a/b/pipelines/1'), null);
   });
+
+  describe('F-7ce07baa: parseRunUrlRepo never resolves an inherited Object.prototype key', () => {
+    for (const key of OBJECT_PROTOTYPE_KEYS) {
+      it(`returns null (not the inherited method) for provider="${key}"`, () => {
+        // Deletion/emptiness proof: revert parseRunUrlRepo to a bare
+        // `RUN_URL_PARSERS[provider]` lookup and this goes red for every key
+        // here — each currently resolves a truthy inherited Object.prototype
+        // value the `if (!parser)` guard cannot catch, and `parser(runUrl)`
+        // then calls an unrelated built-in method.
+        assert.equal(
+          parseRunUrlRepo(key, 'https://github.com/acme/widget/actions/runs/1'),
+          null,
+          `provider="${key}" must resolve to null, not an inherited Object.prototype member`
+        );
+      });
+    }
+
+    it('a non-string provider (object, number, null, undefined) never throws and returns null', () => {
+      for (const bad of [{}, 42, null, undefined, ['github']]) {
+        assert.equal(
+          parseRunUrlRepo(bad, 'https://github.com/acme/widget/actions/runs/1'),
+          null,
+          `provider=${JSON.stringify(bad)} must resolve to null`
+        );
+      }
+    });
+  });
 });