dunstan 0.1.16 → 0.1.18

package/dist/dunstan.mjs

@@ -101,7 +101,7 @@ var require_code = __commonJS({
     }
     exports._ = _;
     var plus = new _Code("+");
-    function str3(strs, ...args) {
+    function str4(strs, ...args) {
       const expr = [safeStringify(strs[0])];
       let i = 0;
       while (i < args.length) {
@@ -112,7 +112,7 @@ var require_code = __commonJS({
       optimize(expr);
       return new _Code(expr);
     }
-    exports.str = str3;
+    exports.str = str4;
     function addCodeArg(code, arg) {
       if (arg instanceof _Code)
         code.push(...arg._items);
@@ -155,7 +155,7 @@ var require_code = __commonJS({
       return;
     }
     function strConcat(c1, c2) {
-      return c2.emptyStr() ? c1 : c1.emptyStr() ? c2 : str3`${c1}${c2}`;
+      return c2.emptyStr() ? c1 : c1.emptyStr() ? c2 : str4`${c1}${c2}`;
     }
     exports.strConcat = strConcat;
     function interpolate(x) {
@@ -859,9 +859,9 @@ var require_codegen = __commonJS({
       forOf(nameOrPrefix, iterable, forBody, varKind = scope_1.varKinds.const) {
         const name = this._scope.toName(nameOrPrefix);
         if (this.opts.es5) {
-          const arr2 = iterable instanceof code_1.Name ? iterable : this.var("_arr", iterable);
-          return this.forRange("_i", 0, (0, code_1._)`${arr2}.length`, (i) => {
-            this.var(name, (0, code_1._)`${arr2}[${i}]`);
+          const arr3 = iterable instanceof code_1.Name ? iterable : this.var("_arr", iterable);
+          return this.forRange("_i", 0, (0, code_1._)`${arr3}.length`, (i) => {
+            this.var(name, (0, code_1._)`${arr3}[${i}]`);
             forBody(name);
           });
         }
@@ -869,12 +869,12 @@ var require_codegen = __commonJS({
       }
       // `for-in` statement.
       // With option `ownProperties` replaced with a `for-of` loop for object keys
-      forIn(nameOrPrefix, obj2, forBody, varKind = this.opts.es5 ? scope_1.varKinds.var : scope_1.varKinds.const) {
+      forIn(nameOrPrefix, obj3, forBody, varKind = this.opts.es5 ? scope_1.varKinds.var : scope_1.varKinds.const) {
         if (this.opts.ownProperties) {
-          return this.forOf(nameOrPrefix, (0, code_1._)`Object.keys(${obj2})`, forBody);
+          return this.forOf(nameOrPrefix, (0, code_1._)`Object.keys(${obj3})`, forBody);
         }
         const name = this._scope.toName(nameOrPrefix);
-        return this._for(new ForIter("in", varKind, name, obj2), () => forBody(name));
+        return this._for(new ForIter("in", varKind, name, obj3), () => forBody(name));
       }
       // end `for` loop
       endFor() {
@@ -1060,9 +1060,9 @@ var require_util = __commonJS({
     exports.checkStrictMode = exports.getErrorPath = exports.Type = exports.useFunc = exports.setEvaluated = exports.evaluatedPropsToName = exports.mergeEvaluated = exports.eachItem = exports.unescapeJsonPointer = exports.escapeJsonPointer = exports.escapeFragment = exports.unescapeFragment = exports.schemaRefOrVal = exports.schemaHasRulesButRef = exports.schemaHasRules = exports.checkUnknownRules = exports.alwaysValidSchema = exports.toHash = void 0;
     var codegen_1 = require_codegen();
     var code_1 = require_code();
-    function toHash(arr2) {
+    function toHash(arr3) {
       const hash2 = {};
-      for (const item of arr2)
+      for (const item of arr3)
         hash2[item] = true;
       return hash2;
     }
@@ -1117,22 +1117,22 @@ var require_util = __commonJS({
       return (0, codegen_1._)`${topSchemaRef}${schemaPath}${(0, codegen_1.getProperty)(keyword)}`;
     }
     exports.schemaRefOrVal = schemaRefOrVal;
-    function unescapeFragment(str3) {
-      return unescapeJsonPointer(decodeURIComponent(str3));
+    function unescapeFragment(str4) {
+      return unescapeJsonPointer(decodeURIComponent(str4));
     }
     exports.unescapeFragment = unescapeFragment;
-    function escapeFragment(str3) {
-      return encodeURIComponent(escapeJsonPointer(str3));
+    function escapeFragment(str4) {
+      return encodeURIComponent(escapeJsonPointer(str4));
     }
     exports.escapeFragment = escapeFragment;
-    function escapeJsonPointer(str3) {
-      if (typeof str3 == "number")
-        return `${str3}`;
-      return str3.replace(/~/g, "~0").replace(/\//g, "~1");
+    function escapeJsonPointer(str4) {
+      if (typeof str4 == "number")
+        return `${str4}`;
+      return str4.replace(/~/g, "~0").replace(/\//g, "~1");
     }
     exports.escapeJsonPointer = escapeJsonPointer;
-    function unescapeJsonPointer(str3) {
-      return str3.replace(/~1/g, "/").replace(/~0/g, "~");
+    function unescapeJsonPointer(str4) {
+      return str4.replace(/~1/g, "/").replace(/~0/g, "~");
     }
     exports.unescapeJsonPointer = unescapeJsonPointer;
     function eachItem(xs, f) {
@@ -2157,8 +2157,8 @@ var require_json_schema_traverse = __commonJS({
         post(schema, jsonPtr, rootSchema, parentJsonPtr, parentKeyword, parentSchema, keyIndex);
       }
     }
-    function escapeJsonPtr(str3) {
-      return str3.replace(/~/g, "~0").replace(/\//g, "~1");
+    function escapeJsonPtr(str4) {
+      return str4.replace(/~/g, "~0").replace(/\//g, "~1");
     }
   }
 });
@@ -2694,11 +2694,11 @@ var require_validate = __commonJS({
         if (!this.allErrors)
           this.gen.if(cond);
       }
-      setParams(obj2, assign) {
+      setParams(obj3, assign) {
         if (assign)
-          Object.assign(this.params, obj2);
+          Object.assign(this.params, obj3);
         else
-          this.params = obj2;
+          this.params = obj3;
       }
       block$data(valid, codeBlock, $dataValid = codegen_1.nil) {
         this.gen.block(() => {
@@ -3255,10 +3255,10 @@ var require_utils = __commonJS({
         isIPV6: true
       };
     }
-    function findToken(str3, token) {
+    function findToken(str4, token) {
       let ind = 0;
-      for (let i = 0; i < str3.length; i++) {
-        if (str3[i] === token) ind++;
+      for (let i = 0; i < str4.length; i++) {
+        if (str4[i] === token) ind++;
       }
       return ind;
     }
@@ -4272,7 +4272,7 @@ var require_core = __commonJS({
     var util_1 = require_util();
     var $dataRefSchema = require_data();
     var uri_1 = require_uri();
-    var defaultRegExp = (str3, flags) => new RegExp(str3, flags);
+    var defaultRegExp = (str4, flags) => new RegExp(str4, flags);
     defaultRegExp.code = "new RegExp";
     var META_IGNORE_OPTIONS = ["removeAdditional", "useDefaults", "coerceTypes"];
     var EXT_SCOPE_NAMES = /* @__PURE__ */ new Set([
@@ -5067,16 +5067,16 @@ var require_ucs2length = __commonJS({
   "node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/runtime/ucs2length.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    function ucs2length(str3) {
-      const len = str3.length;
+    function ucs2length(str4) {
+      const len = str4.length;
       let length = 0;
       let pos = 0;
       let value;
       while (pos < len) {
         length++;
-        value = str3.charCodeAt(pos++);
+        value = str4.charCodeAt(pos++);
         if (value >= 55296 && value <= 56319 && pos < len) {
-          value = str3.charCodeAt(pos);
+          value = str4.charCodeAt(pos);
           if ((value & 64512) === 56320)
             pos++;
         }
@@ -7534,8 +7534,8 @@ var require_formats = __commonJS({
     }
     var DATE = /^(\d\d\d\d)-(\d\d)-(\d\d)$/;
     var DAYS = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-    function date5(str3) {
-      const matches = DATE.exec(str3);
+    function date5(str4) {
+      const matches = DATE.exec(str4);
       if (!matches)
         return false;
       const year = +matches[1];
@@ -7554,8 +7554,8 @@ var require_formats = __commonJS({
     }
     var TIME = /^(\d\d):(\d\d):(\d\d(?:\.\d+)?)(z|([+-])(\d\d)(?::?(\d\d))?)?$/i;
     function getTime(strictTimeZone) {
-      return function time3(str3) {
-        const matches = TIME.exec(str3);
+      return function time3(str4) {
+        const matches = TIME.exec(str4);
         if (!matches)
           return false;
         const hr = +matches[1];
@@ -7601,8 +7601,8 @@ var require_formats = __commonJS({
     var DATE_TIME_SEPARATOR = /t|\s/i;
     function getDateTime(strictTimeZone) {
       const time3 = getTime(strictTimeZone);
-      return function date_time(str3) {
-        const dateTime = str3.split(DATE_TIME_SEPARATOR);
+      return function date_time(str4) {
+        const dateTime = str4.split(DATE_TIME_SEPARATOR);
         return dateTime.length === 2 && date5(dateTime[0]) && time3(dateTime[1]);
       };
     }
@@ -7627,13 +7627,13 @@ var require_formats = __commonJS({
     }
     var NOT_URI_FRAGMENT = /\/|:/;
     var URI = /^(?:[a-z][a-z0-9+\-.]*:)(?:\/?\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9a-f]{2})*@)?(?:\[(?:(?:(?:(?:[0-9a-f]{1,4}:){6}|::(?:[0-9a-f]{1,4}:){5}|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::)(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?))|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|[Vv][0-9a-f]+\.[a-z0-9\-._~!$&'()*+,;=:]+)\]|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9a-f]{2})*)(?::\d*)?(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*|\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)?|(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)(?:\?(?:[a-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9a-f]{2})*)?(?:#(?:[a-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9a-f]{2})*)?$/i;
-    function uri(str3) {
-      return NOT_URI_FRAGMENT.test(str3) && URI.test(str3);
+    function uri(str4) {
+      return NOT_URI_FRAGMENT.test(str4) && URI.test(str4);
     }
     var BYTE = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/gm;
-    function byte(str3) {
+    function byte(str4) {
       BYTE.lastIndex = 0;
-      return BYTE.test(str3);
+      return BYTE.test(str4);
     }
     var MIN_INT32 = -(2 ** 31);
     var MAX_INT32 = 2 ** 31 - 1;
@@ -7647,11 +7647,11 @@ var require_formats = __commonJS({
       return true;
     }
     var Z_ANCHOR = /[^\\]\\Z/;
-    function regex(str3) {
-      if (Z_ANCHOR.test(str3))
+    function regex(str4) {
+      if (Z_ANCHOR.test(str4))
         return false;
       try {
-        new RegExp(str3);
+        new RegExp(str4);
         return true;
       } catch (e) {
         return false;
@@ -8030,7 +8030,7 @@ import { readFileSync as readFileSync8 } from "node:fs";
 import { createHash } from "node:crypto";
 
 // src/spec/constants.ts
-var SPEC_VERSION = "0.1.9";
+var SPEC_VERSION = "0.1.11";
 var BLOCK_VERSION = "0.1";
 var SUPPORTED_BLOCK_VERSIONS = [BLOCK_VERSION];
 var BLOCK_INFO_STRING = "dunstan-handback";
@@ -8038,6 +8038,8 @@ var STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
 var PREDICATE_TYPE = "https://barglabs.ai/dunstan/record/v0.1";
 var DRAFT_SPEC_VERSION = "0.2.0-draft";
 var DRAFT_PREDICATE_TYPE = "https://barglabs.ai/dunstan/record/v0.2-draft";
+var GITLAB_DRAFT_SPEC_VERSION = `${SPEC_VERSION}-gitlab-0.1-draft`;
+var GITLAB_DRAFT_PREDICATE_TYPE = "https://barglabs.ai/dunstan/record/v0.1-gitlab-draft";
 var BLOCK_SUBJECT_NAME = "handback-block";
 var SIGNATURE_NAMESPACE = "dunstan-record";
 var MAX_BLOCK_DEPTH = 32;
@@ -8344,11 +8346,11 @@ function unreadReason(unread2) {
 function absentSection(section) {
   return `evidence_field_unpopulated:${section}`;
 }
-function toSecond(timestamp2) {
-  if (!/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]+)?Z$/.test(timestamp2)) {
-    throw new Error(`not an RFC 3339 UTC timestamp: ${timestamp2}`);
+function toSecond(timestamp3) {
+  if (!/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]+)?Z$/.test(timestamp3)) {
+    throw new Error(`not an RFC 3339 UTC timestamp: ${timestamp3}`);
   }
-  return timestamp2.slice(0, 19);
+  return timestamp3.slice(0, 19);
 }
 function compareCodeUnits(a, b) {
   return a < b ? -1 : a > b ? 1 : 0;
@@ -8533,9 +8535,6 @@ function checkReferences(block, evidence, repository) {
     }
     const observed = { exists: entry.exists, reachableFromHead: entry.reachableFromHead };
     if (!entry.exists) return fail("reference", field, reference, observed, "not_found");
-    if (!entry.reachableFromHead) {
-      return fail("reference", field, reference, observed, "not_reachable");
-    }
     return pass("reference", field, reference, observed);
   });
 }
@@ -8553,6 +8552,15 @@ function countRow(field, declared, evidence, pick2) {
   const observed = pick2(evidence.runs[0]);
   return observed === declared ? pass("count", field, declared, observed) : fail("count", field, declared, observed, "count_mismatch");
 }
+function producerReason(record2, evidence) {
+  const files = evidence.files;
+  if (files === void 0) return absentSection("files");
+  if (files.status !== "ok") return unreadReason(files);
+  if (files.entries.some((e) => e.path === record2.workflow || e.previousPath === record2.workflow)) {
+    return "record_producer_changed_by_pr";
+  }
+  return files.complete ? void 0 : "file_list_truncated";
+}
 function checkTests(block, evidence) {
   const rows = [];
   (block.tests ?? []).forEach((test, i) => {
@@ -8567,6 +8575,14 @@ function checkTests(block, evidence) {
       return;
     }
     const record2 = test.record;
+    const producer = producerReason(record2, evidence);
+    if (producer !== void 0) {
+      rows.push(unverifiable("count", countField, test.count, producer));
+      if (test.failures !== void 0) {
+        rows.push(unverifiable("count", failuresField, test.failures, producer));
+      }
+      return;
+    }
     const entry = evidence.testRecords?.find((r) => sameRecord(r.record, record2));
     rows.push(countRow(countField, test.count, entry, (run) => run.executed));
     if (test.failures !== void 0) {
@@ -9881,7 +9897,7 @@ async function reportFromComment(client, repository, number4, login) {
 // src/record/checker.ts
 import { readFileSync } from "node:fs";
 var CHECKER_NAME = "dunstan";
-var CHECKER_VERSION = "0.1.16";
+var CHECKER_VERSION = "0.1.18";
 function checkerIdentity(artifact) {
   return {
     name: CHECKER_NAME,
@@ -10077,7 +10093,7 @@ var FILES = { "handback-block-0.1.schema.json": `{
     }
   }
 }
-`, "record-0.1.schema.json": '{\n  "$schema": "https://json-schema.org/draft/2020-12/schema",\n  "$id": "https://barglabs.ai/dunstan/spec/schema/record-0.1.schema.json",\n  "title": "Dunstan record, v0.1",\n  "description": "An in-toto Statement v1 whose predicate records one check of a handback block against the record. See spec/claim-format.md.",\n  "type": "object",\n  "required": ["_type", "subject", "predicateType", "predicate"],\n  "additionalProperties": false,\n  "properties": {\n    "_type": { "const": "https://in-toto.io/Statement/v1" },\n    "subject": {\n      "type": "array",\n      "minItems": 1,\n      "maxItems": 2,\n      "prefixItems": [{ "$ref": "#/$defs/commitSubject" }, { "$ref": "#/$defs/blockSubject" }],\n      "items": false\n    },\n    "predicateType": { "const": "https://barglabs.ai/dunstan/record/v0.1" },\n    "predicate": { "$ref": "#/$defs/predicate" }\n  },\n  "allOf": [\n    {\n      "if": {\n        "properties": {\n          "predicate": {\n            "properties": { "block": { "properties": { "status": { "const": "found" } } } }\n          }\n        }\n      },\n      "then": { "properties": { "subject": { "minItems": 2 } } },\n      "else": { "properties": { "subject": { "maxItems": 1 } } }\n    }\n  ],\n  "$defs": {\n    "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },\n    "commitSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },\n    "repository": {\n      "description": "owner/repo",\n      "type": "string",\n      "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}$"\n    },\n    "issueRef": {\n      "description": "owner/repo#N, always fully qualified in evidence.",\n      "type": "string",\n      "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}#[1-9][0-9]{0,9}$"\n    },\n    "timestamp": {\n      "type": "string",\n      "format": "date-time",\n      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\\\.[0-9]+)?Z$"\n    },\n    "sourceKind": {\n      "enum": [\n        "pull_request",\n        "pull_request_files",\n        "pull_request_commits",\n        "closing_references",\n        "repository",\n        "issue",\n        "commit",\n        "compare",\n        "check_runs",\n        "workflow_runs",\n        "artifact",\n        "deployments"\n      ]\n    },\n    "commitSubject": {\n      "type": "object",\n      "required": ["name", "digest"],\n      "additionalProperties": false,\n      "properties": {\n        "name": {\n          "type": "string",\n          "pattern": "^git\\\\+https://github\\\\.com/[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}@[0-9a-f]{40}$"\n        },\n        "digest": {\n          "type": "object",\n          "required": ["gitCommit"],\n          "additionalProperties": false,\n          "properties": { "gitCommit": { "$ref": "#/$defs/commitSha" } }\n        }\n      }\n    },\n    "blockSubject": {\n      "type": "object",\n      "required": ["name", "digest"],\n      "additionalProperties": false,\n      "properties": {\n        "name": { "const": "handback-block" },\n        "digest": {\n          "type": "object",\n          "required": ["sha256"],\n          "additionalProperties": false,\n          "properties": { "sha256": { "$ref": "#/$defs/sha256" } }\n        }\n      }\n    },\n    "predicate": {\n      "type": "object",\n      "required": [\n        "spec",\n        "checker",\n        "report",\n        "block",\n        "subject",\n        "evidence",\n        "claims",\n        "verdict",\n        "digests",\n        "rerun",\n        "assurance"\n      ],\n      "additionalProperties": false,\n      "properties": {\n        "spec": {\n          "description": "The spec version the checker implements, semver.",\n          "type": "string",\n          "pattern": "^0\\\\.1\\\\.(?:0|[1-9][0-9]*)$"\n        },\n        "checker": {\n          "type": "object",\n          "required": ["name", "version", "digest"],\n          "additionalProperties": false,\n          "properties": {\n            "name": { "type": "string", "minLength": 1, "maxLength": 214 },\n            "version": { "type": "string", "minLength": 1, "maxLength": 100 },\n            "digest": {\n              "type": "object",\n              "required": ["sha256"],\n              "additionalProperties": false,\n              "properties": { "sha256": { "$ref": "#/$defs/sha256" } }\n            }\n          }\n        },\n        "report": {\n          "description": "The report\'s digest and where it was read. Never its text.",\n          "type": "object",\n          "required": ["sha256", "source"],\n          "additionalProperties": false,\n          "properties": {\n            "sha256": { "$ref": "#/$defs/sha256" },\n            "source": {\n              "type": "object",\n              "required": ["kind", "locator"],\n              "additionalProperties": false,\n              "properties": {\n                "kind": { "enum": ["pr-body", "pr-comment", "file", "stdin", "api"] },\n                "locator": { "type": "string", "minLength": 1, "maxLength": 2000 }\n              }\n            }\n          }\n        },\n        "block": { "$ref": "#/$defs/block" },\n        "subject": {\n          "type": "object",\n          "required": ["repository", "pullRequest", "headSha", "mergeSha"],\n          "additionalProperties": false,\n          "properties": {\n            "repository": { "$ref": "#/$defs/repository" },\n            "pullRequest": { "type": "integer", "minimum": 1 },\n            "headSha": { "$ref": "#/$defs/commitSha" },\n            "mergeSha": {\n              "oneOf": [{ "$ref": "#/$defs/commitSha" }, { "type": "null" }]\n            }\n          }\n        },\n        "evidence": { "$ref": "#/$defs/evidence" },\n        "claims": {\n          "type": "array",\n          "items": { "$ref": "#/$defs/claim" }\n        },\n        "verdict": { "$ref": "#/$defs/verdict" },\n        "digests": {\n          "type": "object",\n          "required": ["claims", "evidence"],\n          "additionalProperties": false,\n          "properties": {\n            "claims": { "$ref": "#/$defs/sha256" },\n            "evidence": { "$ref": "#/$defs/sha256" }\n          }\n        },\n        "rerun": {\n          "type": "object",\n          "required": ["offline", "online"],\n          "additionalProperties": false,\n          "properties": {\n            "offline": { "type": "string", "minLength": 1, "maxLength": 2000 },\n            "online": { "type": "string", "minLength": 1, "maxLength": 2000 }\n          }\n        },\n        "assurance": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "issuer"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "unsigned" },\n                "issuer": { "const": "self-generated" }\n              }\n            },\n            {\n              "type": "object",\n              "required": ["status", "issuer", "keyFingerprint"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "signed" },\n                "issuer": { "type": "string", "minLength": 1, "maxLength": 320 },\n                "keyFingerprint": { "type": "string", "pattern": "^SHA256:[A-Za-z0-9+/]{43}$" }\n              }\n            }\n          ]\n        }\n      }\n    },\n    "verdict": { "enum": ["pass", "fail", "unverifiable"] },\n    "blockError": {\n      "type": "object",\n      "required": ["code"],\n      "additionalProperties": false,\n      "properties": {\n        "code": {\n          "enum": [\n            "unterminated_fence",\n            "invalid_json",\n            "duplicate_member",\n            "unsupported_version",\n            "schema_violation"\n          ]\n        },\n        "pointer": { "type": "string", "pattern": "^(?:/.*)?$" },\n        "keyword": { "type": "string", "minLength": 1 }\n      }\n    },\n    "block": {\n      "oneOf": [\n        {\n          "type": "object",\n          "required": ["status", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "found" },\n            "sha256": { "$ref": "#/$defs/sha256" },\n            "value": { "$ref": "handback-block-0.1.schema.json" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "missing" },\n            "reason": { "const": "block_missing" },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "count", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "ambiguous" },\n            "reason": { "const": "block_ambiguous" },\n            "count": { "type": "integer", "minimum": 2 },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "errors", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "invalid" },\n            "reason": { "const": "block_invalid" },\n            "errors": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/blockError" } },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        }\n      ]\n    },\n    "claim": {\n      "type": "object",\n      "required": ["id", "check", "field", "declared", "observed", "verdict"],\n      "additionalProperties": false,\n      "properties": {\n        "id": { "type": "string", "minLength": 1 },\n        "check": { "enum": ["head", "scope", "reference", "count", "time"] },\n        "field": {\n          "description": "A JSON Pointer (RFC 6901) into the block.",\n          "type": "string",\n          "pattern": "^/.+$"\n        },\n        "declared": true,\n        "observed": true,\n        "verdict": { "$ref": "#/$defs/verdict" },\n        "reason": { "$ref": "#/$defs/claimReason" }\n      },\n      "if": { "properties": { "verdict": { "const": "pass" } } },\n      "then": { "not": { "required": ["reason"] } },\n      "else": { "required": ["reason"] }\n    },\n    "claimReason": {\n      "type": "string",\n      "pattern": "^(?:head_mismatch|declared_not_changed|undeclared_file|file_list_truncated|not_closing|closing_link_unsettled|closing_base_not_default|closing_event_unsettled|not_found|not_reachable|count_mismatch|all_succeeded_mismatch|none_failed_mismatch|checks_incomplete|no_check_runs|no_succeeded_check_runs|check_runs_not_at_head|no_comparable_record_field|local_run_not_in_record|record_not_found|record_ambiguous|not_merged|premature|no_deployment|evidence_field_unpopulated:[A-Za-z0-9_.]+|source_unreadable:(?:pull_request|pull_request_files|pull_request_commits|closing_references|repository|issue|commit|compare|check_runs|workflow_runs|artifact|deployments))$"\n    },\n    "unread": {\n      "description": "A section the checker could not use: its source errored, or the source answered without the field.",\n      "oneOf": [\n        {\n          "type": "object",\n          "required": ["status", "source"],\n          "properties": {\n            "status": { "const": "unreadable" },\n            "source": { "$ref": "#/$defs/sourceKind" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "field"],\n          "properties": {\n            "status": { "const": "unpopulated" },\n            "field": { "type": "string", "pattern": "^[A-Za-z0-9_.]+$" }\n          }\n        }\n      ]\n    },\n    "evidence": {\n      "type": "object",\n      "required": ["pullRequest", "sources"],\n      "additionalProperties": false,\n      "properties": {\n        "pullRequest": {\n          "description": "Always read: a checker that cannot read the pull request writes no record.",\n          "type": "object",\n          "required": [\n            "status",\n            "number",\n            "state",\n            "merged",\n            "mergedAt",\n            "headSha",\n            "mergeSha",\n            "changedFiles"\n          ],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "ok" },\n            "number": { "type": "integer", "minimum": 1 },\n            "state": { "enum": ["open", "closed"] },\n            "merged": { "type": "boolean" },\n            "mergedAt": { "oneOf": [{ "$ref": "#/$defs/timestamp" }, { "type": "null" }] },\n            "headSha": { "$ref": "#/$defs/commitSha" },\n            "mergeSha": { "oneOf": [{ "$ref": "#/$defs/commitSha" }, { "type": "null" }] },\n            "changedFiles": { "type": "integer", "minimum": 0 }\n          }\n        },\n        "files": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "complete", "entries"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "complete": { "type": "boolean" },\n                "entries": {\n                  "type": "array",\n                  "items": {\n                    "type": "object",\n                    "required": ["path", "status"],\n                    "additionalProperties": false,\n                    "properties": {\n                      "path": { "type": "string", "minLength": 1 },\n                      "status": {\n                        "enum": [\n                          "added",\n                          "removed",\n                          "modified",\n                          "renamed",\n                          "copied",\n                          "changed",\n                          "unchanged"\n                        ]\n                      },\n                      "previousPath": { "type": "string", "minLength": 1 }\n                    }\n                  }\n                }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "closingReferences": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "issues"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "issues": { "type": "array", "items": { "$ref": "#/$defs/issueRef" } }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "references": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["kind", "ref", "status", "exists"],\n                "additionalProperties": false,\n                "properties": {\n                  "kind": { "const": "issue" },\n                  "ref": { "$ref": "#/$defs/issueRef" },\n                  "status": { "const": "ok" },\n                  "exists": { "type": "boolean" },\n                  "resolvedAs": {\n                    "description": "Spec 0.1.3: the owner/repo#N GitHub answered the read of ref with, when it is another issue (an issue transferred to another repository).",\n                    "$ref": "#/$defs/issueRef"\n                  }\n                },\n                "if": { "required": ["resolvedAs"] },\n                "then": { "properties": { "exists": { "const": true } } }\n              },\n              {\n                "type": "object",\n                "required": ["kind", "ref", "status", "exists", "reachableFromHead"],\n                "additionalProperties": false,\n                "properties": {\n                  "kind": { "const": "commit" },\n                  "ref": { "$ref": "#/$defs/commitSha" },\n                  "status": { "const": "ok" },\n                  "exists": { "type": "boolean" },\n                  "reachableFromHead": { "type": "boolean" }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["kind", "ref"],\n                "properties": {\n                  "kind": { "enum": ["issue", "commit"] },\n                  "ref": { "type": "string", "minLength": 1 }\n                },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "closeEvents": {\n          "description": "Spec 0.1.4: who closed each closes target that exists and is not among the closing references, read under the identity it resolves to; and the pull request\'s base, its repository\'s default branch and its commit ids.",\n          "type": "object",\n          "required": ["pullRequest", "targets"],\n          "additionalProperties": false,\n          "properties": {\n            "pullRequest": {\n              "oneOf": [\n                {\n                  "type": "object",\n                  "required": ["status", "baseRef", "defaultBranch", "commits"],\n                  "additionalProperties": false,\n                  "properties": {\n                    "status": { "const": "ok" },\n                    "baseRef": { "type": "string", "minLength": 1 },\n                    "defaultBranch": {\n                      "oneOf": [{ "type": "string", "minLength": 1 }, { "type": "null" }]\n                    },\n                    "commits": {\n                      "type": "array",\n                      "uniqueItems": true,\n                      "items": { "$ref": "#/$defs/commitSha" }\n                    }\n                  }\n                },\n                { "$ref": "#/$defs/unreadOnly" }\n              ]\n            },\n            "targets": {\n              "type": "array",\n              "items": {\n                "oneOf": [\n                  {\n                    "type": "object",\n                    "required": ["ref", "status", "type", "state", "events"],\n                    "additionalProperties": false,\n                    "properties": {\n                      "ref": { "$ref": "#/$defs/issueRef" },\n                      "status": { "const": "ok" },\n                      "type": { "enum": ["issue", "pull_request"] },\n                      "state": { "enum": ["open", "closed", "merged"] },\n                      "events": {\n                        "type": "array",\n                        "items": {\n                          "type": "object",\n                          "required": ["at", "closer"],\n                          "additionalProperties": false,\n                          "properties": {\n                            "at": { "$ref": "#/$defs/timestamp" },\n                            "closer": {\n                              "oneOf": [\n                                { "type": "null" },\n                                {\n                                  "type": "object",\n                                  "required": ["kind", "ref"],\n                                  "additionalProperties": false,\n                                  "properties": {\n                                    "kind": { "const": "pull_request" },\n                                    "ref": { "$ref": "#/$defs/issueRef" }\n                                  }\n                                },\n                                {\n                                  "type": "object",\n                                  "required": ["kind", "oid"],\n                                  "additionalProperties": false,\n                                  "properties": {\n                                    "kind": { "const": "commit" },\n                                    "oid": { "$ref": "#/$defs/commitSha" }\n                                  }\n                                },\n                                {\n                                  "type": "object",\n                                  "required": ["kind"],\n                                  "additionalProperties": false,\n                                  "properties": { "kind": { "const": "other" } }\n                                }\n                              ]\n                            }\n                          }\n                        }\n                      }\n                    },\n                    "if": { "properties": { "type": { "const": "issue" } } },\n                    "then": { "properties": { "state": { "enum": ["open", "closed"] } } }\n                  },\n                  {\n                    "type": "object",\n                    "required": ["ref"],\n                    "properties": { "ref": { "$ref": "#/$defs/issueRef" } },\n                    "allOf": [{ "$ref": "#/$defs/unread" }]\n                  }\n                ]\n              }\n            }\n          }\n        },\n        "checkRuns": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "commit", "excludedIds", "runs"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "commit": { "$ref": "#/$defs/commitSha" },\n                "excludedIds": {\n                  "description": "Check runs left out of the count: the run the checker itself executes in.",\n                  "type": "array",\n                  "items": { "type": "integer", "minimum": 1 }\n                },\n                "runs": {\n                  "type": "array",\n                  "items": {\n                    "type": "object",\n                    "required": ["id", "name", "status", "conclusion"],\n                    "additionalProperties": false,\n                    "dependentRequired": {\n                      "workflowPath": ["checkSuiteId", "workflowRunId", "runAttempt"],\n                      "workflowName": ["workflowPath"],\n                      "workflowRunId": ["workflowPath"],\n                      "runAttempt": ["workflowPath"]\n                    },\n                    "properties": {\n                      "id": { "type": "integer", "minimum": 1 },\n                      "name": { "type": "string" },\n                      "status": { "type": "string", "minLength": 1 },\n                      "conclusion": { "type": ["string", "null"] },\n                      "checkSuiteId": {\n                        "description": "The run\'s check suite (`check_suite.id`). A run without `workflowPath` is counted as the latest per check suite and name; a run without either is keyed by its name alone. Added in spec 0.1.4, amended 2026-10-12.",\n                        "type": "integer",\n                        "minimum": 1\n                      },\n                      "appSlug": {\n                        "description": "The slug of the app that created the run (`app.slug`). Recorded, not read by any check. Added in spec 0.1.4, amended 2026-10-12.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowPath": {\n                        "description": "The `path` of the workflow run whose `check_suite_id` is the run\'s check suite, less any `@<ref>`, from the workflow runs at the head. Runs that have it are counted as the latest per workflow path and name. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowName": {\n                        "description": "The `name` of that workflow run, as the listing gives it; absent where the listing gives none, null or the empty string. No 0.1 check reads it. Added in spec 0.1.5.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowRunId": {\n                        "description": "The `id` of that workflow run. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "integer",\n                        "minimum": 1\n                      },\n                      "runAttempt": {\n                        "description": "That workflow run\'s `run_attempt` as the listing gives it, its latest attempt at the read. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "integer",\n                        "minimum": 1\n                      }\n                    }\n                  }\n                }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "testRecords": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["record", "status", "runs"],\n                "additionalProperties": false,\n                "properties": {\n                  "record": { "$ref": "handback-block-0.1.schema.json#/$defs/junitRecord" },\n                  "status": { "const": "ok" },\n                  "runs": {\n                    "type": "array",\n                    "items": {\n                      "type": "object",\n                      "required": ["runId", "runAttempt", "executed", "failed"],\n                      "additionalProperties": false,\n                      "properties": {\n                        "runId": { "type": "integer", "minimum": 1 },\n                        "runAttempt": { "type": "integer", "minimum": 1 },\n                        "executed": { "type": "integer", "minimum": 0 },\n                        "failed": { "type": "integer", "minimum": 0 }\n                      }\n                    }\n                  }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["record"],\n                "properties": {\n                  "record": { "$ref": "handback-block-0.1.schema.json#/$defs/junitRecord" }\n                },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "deployments": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["environment", "status", "deployments"],\n                "additionalProperties": false,\n                "properties": {\n                  "environment": { "type": "string", "minLength": 1 },\n                  "status": { "const": "ok" },\n                  "deployments": {\n                    "type": "array",\n                    "items": {\n                      "type": "object",\n                      "required": ["id", "sha", "relation", "successAt"],\n                      "additionalProperties": false,\n                      "properties": {\n                        "id": { "type": "integer", "minimum": 1 },\n                        "sha": { "$ref": "#/$defs/commitSha" },\n                        "relation": {\n                          "enum": ["head", "merge", "descendant", "unrelated", "unknown"]\n                        },\n                        "successAt": {\n                          "oneOf": [{ "$ref": "#/$defs/timestamp" }, { "type": "null" }]\n                        }\n                      }\n                    }\n                  }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["environment"],\n                "properties": { "environment": { "type": "string", "minLength": 1 } },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "sources": {\n          "type": "array",\n          "items": {\n            "type": "object",\n            "required": ["kind", "locator", "sha256", "readAt"],\n            "additionalProperties": false,\n            "properties": {\n              "kind": { "$ref": "#/$defs/sourceKind" },\n              "locator": { "type": "string", "minLength": 1, "maxLength": 2000 },\n              "sha256": { "$ref": "#/$defs/sha256" },\n              "etag": { "type": "string", "minLength": 1 },\n              "readAt": { "$ref": "#/$defs/timestamp" },\n              "error": {\n                "description": "Present when the read failed: http_<status>, network, or parse.",\n                "type": "string",\n                "pattern": "^(?:http_[1-5][0-9]{2}|network|parse)$"\n              }\n            }\n          }\n        }\n      }\n    },\n    "unreadOnly": {\n      "allOf": [{ "$ref": "#/$defs/unread" }],\n      "unevaluatedProperties": false\n    }\n  }\n}\n', "record-0.2-draft.schema.json": `{
+`, "record-0.1.schema.json": '{\n  "$schema": "https://json-schema.org/draft/2020-12/schema",\n  "$id": "https://barglabs.ai/dunstan/spec/schema/record-0.1.schema.json",\n  "title": "Dunstan record, v0.1",\n  "description": "An in-toto Statement v1 whose predicate records one check of a handback block against the record. See spec/claim-format.md.",\n  "type": "object",\n  "required": ["_type", "subject", "predicateType", "predicate"],\n  "additionalProperties": false,\n  "properties": {\n    "_type": { "const": "https://in-toto.io/Statement/v1" },\n    "subject": {\n      "type": "array",\n      "minItems": 1,\n      "maxItems": 2,\n      "prefixItems": [{ "$ref": "#/$defs/commitSubject" }, { "$ref": "#/$defs/blockSubject" }],\n      "items": false\n    },\n    "predicateType": { "const": "https://barglabs.ai/dunstan/record/v0.1" },\n    "predicate": { "$ref": "#/$defs/predicate" }\n  },\n  "allOf": [\n    {\n      "if": {\n        "properties": {\n          "predicate": {\n            "properties": { "block": { "properties": { "status": { "const": "found" } } } }\n          }\n        }\n      },\n      "then": { "properties": { "subject": { "minItems": 2 } } },\n      "else": { "properties": { "subject": { "maxItems": 1 } } }\n    }\n  ],\n  "$defs": {\n    "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },\n    "commitSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },\n    "repository": {\n      "description": "owner/repo",\n      "type": "string",\n      "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}$"\n    },\n    "issueRef": {\n      "description": "owner/repo#N, always fully qualified in evidence.",\n      "type": "string",\n      "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}#[1-9][0-9]{0,9}$"\n    },\n    "timestamp": {\n      "type": "string",\n      "format": "date-time",\n      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\\\.[0-9]+)?Z$"\n    },\n    "sourceKind": {\n      "enum": [\n        "pull_request",\n        "pull_request_files",\n        "pull_request_commits",\n        "closing_references",\n        "repository",\n        "issue",\n        "commit",\n        "compare",\n        "check_runs",\n        "workflow_runs",\n        "artifact",\n        "deployments"\n      ]\n    },\n    "commitSubject": {\n      "type": "object",\n      "required": ["name", "digest"],\n      "additionalProperties": false,\n      "properties": {\n        "name": {\n          "type": "string",\n          "pattern": "^git\\\\+https://github\\\\.com/[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}@[0-9a-f]{40}$"\n        },\n        "digest": {\n          "type": "object",\n          "required": ["gitCommit"],\n          "additionalProperties": false,\n          "properties": { "gitCommit": { "$ref": "#/$defs/commitSha" } }\n        }\n      }\n    },\n    "blockSubject": {\n      "type": "object",\n      "required": ["name", "digest"],\n      "additionalProperties": false,\n      "properties": {\n        "name": { "const": "handback-block" },\n        "digest": {\n          "type": "object",\n          "required": ["sha256"],\n          "additionalProperties": false,\n          "properties": { "sha256": { "$ref": "#/$defs/sha256" } }\n        }\n      }\n    },\n    "predicate": {\n      "type": "object",\n      "required": [\n        "spec",\n        "checker",\n        "report",\n        "block",\n        "subject",\n        "evidence",\n        "claims",\n        "verdict",\n        "digests",\n        "rerun",\n        "assurance"\n      ],\n      "additionalProperties": false,\n      "properties": {\n        "spec": {\n          "description": "The spec version the checker implements, semver.",\n          "type": "string",\n          "pattern": "^0\\\\.1\\\\.(?:0|[1-9][0-9]*)$"\n        },\n        "checker": {\n          "type": "object",\n          "required": ["name", "version", "digest"],\n          "additionalProperties": false,\n          "properties": {\n            "name": { "type": "string", "minLength": 1, "maxLength": 214 },\n            "version": { "type": "string", "minLength": 1, "maxLength": 100 },\n            "digest": {\n              "type": "object",\n              "required": ["sha256"],\n              "additionalProperties": false,\n              "properties": { "sha256": { "$ref": "#/$defs/sha256" } }\n            }\n          }\n        },\n        "report": {\n          "description": "The report\'s digest and where it was read. Never its text.",\n          "type": "object",\n          "required": ["sha256", "source"],\n          "additionalProperties": false,\n          "properties": {\n            "sha256": { "$ref": "#/$defs/sha256" },\n            "source": {\n              "type": "object",\n              "required": ["kind", "locator"],\n              "additionalProperties": false,\n              "properties": {\n                "kind": { "enum": ["pr-body", "pr-comment", "file", "stdin", "api"] },\n                "locator": { "type": "string", "minLength": 1, "maxLength": 2000 }\n              }\n            }\n          }\n        },\n        "block": { "$ref": "#/$defs/block" },\n        "subject": {\n          "type": "object",\n          "required": ["repository", "pullRequest", "headSha", "mergeSha"],\n          "additionalProperties": false,\n          "properties": {\n            "repository": { "$ref": "#/$defs/repository" },\n            "pullRequest": { "type": "integer", "minimum": 1 },\n            "headSha": { "$ref": "#/$defs/commitSha" },\n            "mergeSha": {\n              "oneOf": [{ "$ref": "#/$defs/commitSha" }, { "type": "null" }]\n            }\n          }\n        },\n        "evidence": { "$ref": "#/$defs/evidence" },\n        "claims": {\n          "type": "array",\n          "items": { "$ref": "#/$defs/claim" }\n        },\n        "verdict": { "$ref": "#/$defs/verdict" },\n        "digests": {\n          "type": "object",\n          "required": ["claims", "evidence"],\n          "additionalProperties": false,\n          "properties": {\n            "claims": { "$ref": "#/$defs/sha256" },\n            "evidence": { "$ref": "#/$defs/sha256" }\n          }\n        },\n        "rerun": {\n          "type": "object",\n          "required": ["offline", "online"],\n          "additionalProperties": false,\n          "properties": {\n            "offline": { "type": "string", "minLength": 1, "maxLength": 2000 },\n            "online": { "type": "string", "minLength": 1, "maxLength": 2000 }\n          }\n        },\n        "assurance": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "issuer"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "unsigned" },\n                "issuer": { "const": "self-generated" }\n              }\n            },\n            {\n              "type": "object",\n              "required": ["status", "issuer", "keyFingerprint"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "signed" },\n                "issuer": { "type": "string", "minLength": 1, "maxLength": 320 },\n                "keyFingerprint": { "type": "string", "pattern": "^SHA256:[A-Za-z0-9+/]{43}$" }\n              }\n            }\n          ]\n        }\n      }\n    },\n    "verdict": { "enum": ["pass", "fail", "unverifiable"] },\n    "blockError": {\n      "type": "object",\n      "required": ["code"],\n      "additionalProperties": false,\n      "properties": {\n        "code": {\n          "enum": [\n            "unterminated_fence",\n            "invalid_json",\n            "duplicate_member",\n            "unsupported_version",\n            "schema_violation"\n          ]\n        },\n        "pointer": { "type": "string", "pattern": "^(?:/.*)?$" },\n        "keyword": { "type": "string", "minLength": 1 }\n      }\n    },\n    "block": {\n      "oneOf": [\n        {\n          "type": "object",\n          "required": ["status", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "found" },\n            "sha256": { "$ref": "#/$defs/sha256" },\n            "value": { "$ref": "handback-block-0.1.schema.json" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "missing" },\n            "reason": { "const": "block_missing" },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "count", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "ambiguous" },\n            "reason": { "const": "block_ambiguous" },\n            "count": { "type": "integer", "minimum": 2 },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "reason", "errors", "sha256", "value"],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "invalid" },\n            "reason": { "const": "block_invalid" },\n            "errors": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/blockError" } },\n            "sha256": { "type": "null" },\n            "value": { "type": "null" }\n          }\n        }\n      ]\n    },\n    "claim": {\n      "type": "object",\n      "required": ["id", "check", "field", "declared", "observed", "verdict"],\n      "additionalProperties": false,\n      "properties": {\n        "id": { "type": "string", "minLength": 1 },\n        "check": { "enum": ["head", "scope", "reference", "count", "time"] },\n        "field": {\n          "description": "A JSON Pointer (RFC 6901) into the block.",\n          "type": "string",\n          "pattern": "^/.+$"\n        },\n        "declared": true,\n        "observed": true,\n        "verdict": { "$ref": "#/$defs/verdict" },\n        "reason": { "$ref": "#/$defs/claimReason" }\n      },\n      "if": { "properties": { "verdict": { "const": "pass" } } },\n      "then": { "not": { "required": ["reason"] } },\n      "else": { "required": ["reason"] }\n    },\n    "claimReason": {\n      "type": "string",\n      "pattern": "^(?:head_mismatch|declared_not_changed|undeclared_file|file_list_truncated|not_closing|closing_link_unsettled|closing_base_not_default|closing_event_unsettled|not_found|not_reachable|count_mismatch|all_succeeded_mismatch|none_failed_mismatch|checks_incomplete|no_check_runs|no_succeeded_check_runs|check_runs_not_at_head|no_comparable_record_field|local_run_not_in_record|record_producer_changed_by_pr|record_not_found|record_ambiguous|not_merged|premature|no_deployment|evidence_field_unpopulated:[A-Za-z0-9_.]+|source_unreadable:(?:pull_request|pull_request_files|pull_request_commits|closing_references|repository|issue|commit|compare|check_runs|workflow_runs|artifact|deployments))$"\n    },\n    "unread": {\n      "description": "A section the checker could not use: its source errored, or the source answered without the field.",\n      "oneOf": [\n        {\n          "type": "object",\n          "required": ["status", "source"],\n          "properties": {\n            "status": { "const": "unreadable" },\n            "source": { "$ref": "#/$defs/sourceKind" }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["status", "field"],\n          "properties": {\n            "status": { "const": "unpopulated" },\n            "field": { "type": "string", "pattern": "^[A-Za-z0-9_.]+$" }\n          }\n        }\n      ]\n    },\n    "evidence": {\n      "type": "object",\n      "required": ["pullRequest", "sources"],\n      "additionalProperties": false,\n      "properties": {\n        "pullRequest": {\n          "description": "Always read: a checker that cannot read the pull request writes no record.",\n          "type": "object",\n          "required": [\n            "status",\n            "number",\n            "state",\n            "merged",\n            "mergedAt",\n            "headSha",\n            "mergeSha",\n            "changedFiles"\n          ],\n          "additionalProperties": false,\n          "properties": {\n            "status": { "const": "ok" },\n            "number": { "type": "integer", "minimum": 1 },\n            "state": { "enum": ["open", "closed"] },\n            "merged": { "type": "boolean" },\n            "mergedAt": { "oneOf": [{ "$ref": "#/$defs/timestamp" }, { "type": "null" }] },\n            "headSha": { "$ref": "#/$defs/commitSha" },\n            "mergeSha": { "oneOf": [{ "$ref": "#/$defs/commitSha" }, { "type": "null" }] },\n            "changedFiles": { "type": "integer", "minimum": 0 }\n          }\n        },\n        "files": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "complete", "entries"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "complete": { "type": "boolean" },\n                "entries": {\n                  "type": "array",\n                  "items": {\n                    "type": "object",\n                    "required": ["path", "status"],\n                    "additionalProperties": false,\n                    "properties": {\n                      "path": { "type": "string", "minLength": 1 },\n                      "status": {\n                        "enum": [\n                          "added",\n                          "removed",\n                          "modified",\n                          "renamed",\n                          "copied",\n                          "changed",\n                          "unchanged"\n                        ]\n                      },\n                      "previousPath": { "type": "string", "minLength": 1 }\n                    }\n                  }\n                }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "closingReferences": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "issues"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "issues": { "type": "array", "items": { "$ref": "#/$defs/issueRef" } }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "references": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["kind", "ref", "status", "exists"],\n                "additionalProperties": false,\n                "properties": {\n                  "kind": { "const": "issue" },\n                  "ref": { "$ref": "#/$defs/issueRef" },\n                  "status": { "const": "ok" },\n                  "exists": { "type": "boolean" },\n                  "resolvedAs": {\n                    "description": "Spec 0.1.3: the owner/repo#N GitHub answered the read of ref with, when it is another issue (an issue transferred to another repository).",\n                    "$ref": "#/$defs/issueRef"\n                  }\n                },\n                "if": { "required": ["resolvedAs"] },\n                "then": { "properties": { "exists": { "const": true } } }\n              },\n              {\n                "type": "object",\n                "required": ["kind", "ref", "status", "exists", "reachableFromHead"],\n                "additionalProperties": false,\n                "properties": {\n                  "kind": { "const": "commit" },\n                  "ref": { "$ref": "#/$defs/commitSha" },\n                  "status": { "const": "ok" },\n                  "exists": { "type": "boolean" },\n                  "reachableFromHead": { "type": "boolean" }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["kind", "ref"],\n                "properties": {\n                  "kind": { "enum": ["issue", "commit"] },\n                  "ref": { "type": "string", "minLength": 1 }\n                },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "closeEvents": {\n          "description": "Spec 0.1.4: who closed each closes target that exists and is not among the closing references, read under the identity it resolves to; and the pull request\'s base, its repository\'s default branch and its commit ids.",\n          "type": "object",\n          "required": ["pullRequest", "targets"],\n          "additionalProperties": false,\n          "properties": {\n            "pullRequest": {\n              "oneOf": [\n                {\n                  "type": "object",\n                  "required": ["status", "baseRef", "defaultBranch", "commits"],\n                  "additionalProperties": false,\n                  "properties": {\n                    "status": { "const": "ok" },\n                    "baseRef": { "type": "string", "minLength": 1 },\n                    "defaultBranch": {\n                      "oneOf": [{ "type": "string", "minLength": 1 }, { "type": "null" }]\n                    },\n                    "commits": {\n                      "type": "array",\n                      "uniqueItems": true,\n                      "items": { "$ref": "#/$defs/commitSha" }\n                    }\n                  }\n                },\n                { "$ref": "#/$defs/unreadOnly" }\n              ]\n            },\n            "targets": {\n              "type": "array",\n              "items": {\n                "oneOf": [\n                  {\n                    "type": "object",\n                    "required": ["ref", "status", "type", "state", "events"],\n                    "additionalProperties": false,\n                    "properties": {\n                      "ref": { "$ref": "#/$defs/issueRef" },\n                      "status": { "const": "ok" },\n                      "type": { "enum": ["issue", "pull_request"] },\n                      "state": { "enum": ["open", "closed", "merged"] },\n                      "events": {\n                        "type": "array",\n                        "items": {\n                          "type": "object",\n                          "required": ["at", "closer"],\n                          "additionalProperties": false,\n                          "properties": {\n                            "at": { "$ref": "#/$defs/timestamp" },\n                            "closer": {\n                              "oneOf": [\n                                { "type": "null" },\n                                {\n                                  "type": "object",\n                                  "required": ["kind", "ref"],\n                                  "additionalProperties": false,\n                                  "properties": {\n                                    "kind": { "const": "pull_request" },\n                                    "ref": { "$ref": "#/$defs/issueRef" }\n                                  }\n                                },\n                                {\n                                  "type": "object",\n                                  "required": ["kind", "oid"],\n                                  "additionalProperties": false,\n                                  "properties": {\n                                    "kind": { "const": "commit" },\n                                    "oid": { "$ref": "#/$defs/commitSha" }\n                                  }\n                                },\n                                {\n                                  "type": "object",\n                                  "required": ["kind"],\n                                  "additionalProperties": false,\n                                  "properties": { "kind": { "const": "other" } }\n                                }\n                              ]\n                            }\n                          }\n                        }\n                      }\n                    },\n                    "if": { "properties": { "type": { "const": "issue" } } },\n                    "then": { "properties": { "state": { "enum": ["open", "closed"] } } }\n                  },\n                  {\n                    "type": "object",\n                    "required": ["ref"],\n                    "properties": { "ref": { "$ref": "#/$defs/issueRef" } },\n                    "allOf": [{ "$ref": "#/$defs/unread" }]\n                  }\n                ]\n              }\n            }\n          }\n        },\n        "checkRuns": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["status", "commit", "excludedIds", "runs"],\n              "additionalProperties": false,\n              "properties": {\n                "status": { "const": "ok" },\n                "commit": { "$ref": "#/$defs/commitSha" },\n                "excludedIds": {\n                  "description": "Check runs left out of the count: the run the checker itself executes in.",\n                  "type": "array",\n                  "items": { "type": "integer", "minimum": 1 }\n                },\n                "runs": {\n                  "type": "array",\n                  "items": {\n                    "type": "object",\n                    "required": ["id", "name", "status", "conclusion"],\n                    "additionalProperties": false,\n                    "dependentRequired": {\n                      "workflowPath": ["checkSuiteId", "workflowRunId", "runAttempt"],\n                      "workflowName": ["workflowPath"],\n                      "workflowRunId": ["workflowPath"],\n                      "runAttempt": ["workflowPath"]\n                    },\n                    "properties": {\n                      "id": { "type": "integer", "minimum": 1 },\n                      "name": { "type": "string" },\n                      "status": { "type": "string", "minLength": 1 },\n                      "conclusion": { "type": ["string", "null"] },\n                      "checkSuiteId": {\n                        "description": "The run\'s check suite (`check_suite.id`). A run without `workflowPath` is counted as the latest per check suite and name; a run without either is keyed by its name alone. Added in spec 0.1.4, amended 2026-10-12.",\n                        "type": "integer",\n                        "minimum": 1\n                      },\n                      "appSlug": {\n                        "description": "The slug of the app that created the run (`app.slug`). Recorded, not read by any check. Added in spec 0.1.4, amended 2026-10-12.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowPath": {\n                        "description": "The `path` of the workflow run whose `check_suite_id` is the run\'s check suite, less any `@<ref>`, from the workflow runs at the head. Runs that have it are counted as the latest per workflow path and name. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowName": {\n                        "description": "The `name` of that workflow run, as the listing gives it; absent where the listing gives none, null or the empty string. No 0.1 check reads it. Added in spec 0.1.5.",\n                        "type": "string",\n                        "minLength": 1\n                      },\n                      "workflowRunId": {\n                        "description": "The `id` of that workflow run. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "integer",\n                        "minimum": 1\n                      },\n                      "runAttempt": {\n                        "description": "That workflow run\'s `run_attempt` as the listing gives it, its latest attempt at the read. Added in spec 0.1.4, amended 2026-10-13.",\n                        "type": "integer",\n                        "minimum": 1\n                      }\n                    }\n                  }\n                }\n              }\n            },\n            { "$ref": "#/$defs/unreadOnly" }\n          ]\n        },\n        "testRecords": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["record", "status", "runs"],\n                "additionalProperties": false,\n                "properties": {\n                  "record": { "$ref": "handback-block-0.1.schema.json#/$defs/junitRecord" },\n                  "status": { "const": "ok" },\n                  "runs": {\n                    "type": "array",\n                    "items": {\n                      "type": "object",\n                      "required": ["runId", "runAttempt", "executed", "failed"],\n                      "additionalProperties": false,\n                      "properties": {\n                        "runId": { "type": "integer", "minimum": 1 },\n                        "runAttempt": { "type": "integer", "minimum": 1 },\n                        "executed": { "type": "integer", "minimum": 0 },\n                        "failed": { "type": "integer", "minimum": 0 }\n                      }\n                    }\n                  }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["record"],\n                "properties": {\n                  "record": { "$ref": "handback-block-0.1.schema.json#/$defs/junitRecord" }\n                },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "deployments": {\n          "type": "array",\n          "items": {\n            "oneOf": [\n              {\n                "type": "object",\n                "required": ["environment", "status", "deployments"],\n                "additionalProperties": false,\n                "properties": {\n                  "environment": { "type": "string", "minLength": 1 },\n                  "status": { "const": "ok" },\n                  "deployments": {\n                    "type": "array",\n                    "items": {\n                      "type": "object",\n                      "required": ["id", "sha", "relation", "successAt"],\n                      "additionalProperties": false,\n                      "properties": {\n                        "id": { "type": "integer", "minimum": 1 },\n                        "sha": { "$ref": "#/$defs/commitSha" },\n                        "relation": {\n                          "enum": ["head", "merge", "descendant", "unrelated", "unknown"]\n                        },\n                        "successAt": {\n                          "oneOf": [{ "$ref": "#/$defs/timestamp" }, { "type": "null" }]\n                        }\n                      }\n                    }\n                  }\n                }\n              },\n              {\n                "type": "object",\n                "required": ["environment"],\n                "properties": { "environment": { "type": "string", "minLength": 1 } },\n                "allOf": [{ "$ref": "#/$defs/unread" }]\n              }\n            ]\n          }\n        },\n        "sources": {\n          "type": "array",\n          "items": {\n            "type": "object",\n            "required": ["kind", "locator", "sha256", "readAt"],\n            "additionalProperties": false,\n            "properties": {\n              "kind": { "$ref": "#/$defs/sourceKind" },\n              "locator": { "type": "string", "minLength": 1, "maxLength": 2000 },\n              "sha256": { "$ref": "#/$defs/sha256" },\n              "etag": { "type": "string", "minLength": 1 },\n              "readAt": { "$ref": "#/$defs/timestamp" },\n              "error": {\n                "description": "Present when the read failed: http_<status>, network, or parse.",\n                "type": "string",\n                "pattern": "^(?:http_[1-5][0-9]{2}|network|parse)$"\n              }\n            }\n          }\n        }\n      }\n    },\n    "unreadOnly": {\n      "allOf": [{ "$ref": "#/$defs/unread" }],\n      "unevaluatedProperties": false\n    }\n  }\n}\n', "record-0.2-draft.schema.json": `{
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://barglabs.ai/dunstan/spec/schema/record-0.2-draft.schema.json",
   "title": "Dunstan record, DRAFT 0.2.0",
@@ -10408,7 +10424,7 @@ var FILES = { "handback-block-0.1.schema.json": `{
       "additionalProperties": false,
       "properties": {
         "comparison": {
-          "description": "The version of the rules that turn a proposed claim and the evidence into its note, separate from the extractor's. 0.1.0 compared a file claim by exact path only; 0.2.0 also matches it by name; 0.3.0 also asks whether a path not among the changed files exists at the head (D.11.4); 0.4.0 compares a closes claim by who closed the target (spec 0.1.4).",
+          "description": "The version of the rules that turn a proposed claim and the evidence into its note, separate from the extractor's. 0.1.0 compared a file claim by exact path only; 0.2.0 also matches it by name; 0.3.0 also asks whether a path not among the changed files exists at the head (D.11.4); 0.4.0 compares a closes claim by who closed the target (spec 0.1.4); 0.5.0 compares a cited commit by whether it exists only (spec 0.1.11).",
           "type": "object",
           "required": ["version"],
           "additionalProperties": false,
@@ -10567,6 +10583,253 @@ var FILES = { "handback-block-0.1.schema.json": `{
     }
   }
 }
+`, "record-gitlab-0.1-draft.schema.json": `{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://barglabs.ai/dunstan/spec/schema/record-gitlab-0.1-draft.schema.json",
+  "title": "Dunstan record, DRAFT GitLab profile 0.1",
+  "description": "DRAFT, not normative, for the operator to check (spec/claim-format.md, \\"DRAFT GitLab profile 0.1\\"). A 0.1 record of a GitLab merge request: the predicate's subject carries forge {kind: gitlab, host}, and the head commit's subject entry names that host. A project and an issue reference are named by the project's full path, group/subgroup/.../project, which admits every path the 0.1 repository pattern admits; the evidence sections that hold issue references are restated here with that pattern. Every other member is a reference into record-0.1.schema.json, which this file does not change.",
+  "type": "object",
+  "required": ["_type", "subject", "predicateType", "predicate"],
+  "additionalProperties": false,
+  "properties": {
+    "_type": { "$ref": "record-0.1.schema.json#/properties/_type" },
+    "subject": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 2,
+      "prefixItems": [
+        { "$ref": "#/$defs/commitSubject" },
+        { "$ref": "record-0.1.schema.json#/$defs/blockSubject" }
+      ],
+      "items": false
+    },
+    "predicateType": { "const": "https://barglabs.ai/dunstan/record/v0.1-gitlab-draft" },
+    "predicate": { "$ref": "#/$defs/predicate" }
+  },
+  "allOf": [{ "$ref": "record-0.1.schema.json#/allOf/0" }],
+  "$defs": {
+    "repository": {
+      "description": "A GitLab project's full path: up to 20 levels of groups, then the project. Every path the 0.1 repository pattern admits is one.",
+      "type": "string",
+      "maxLength": 5375,
+      "pattern": "^[A-Za-z0-9_][A-Za-z0-9._-]{0,254}(?:/[A-Za-z0-9_][A-Za-z0-9._-]{0,254}){0,19}/[A-Za-z0-9._-]{1,255}$"
+    },
+    "issueRef": {
+      "description": "An issue of a GitLab project, <full path>#<iid>.",
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_][A-Za-z0-9._-]{0,254}(?:/[A-Za-z0-9_][A-Za-z0-9._-]{0,254}){0,19}/[A-Za-z0-9._-]{1,255}#[1-9][0-9]{0,9}$"
+    },
+    "evidence": {
+      "description": "0.1's evidence, with the sections that hold issue references (closingReferences, references, closeEvents) restated to name an issue by #/$defs/issueRef. Every other section is 0.1's.",
+      "type": "object",
+      "required": ["pullRequest", "sources"],
+      "additionalProperties": false,
+      "properties": {
+        "pullRequest": {
+          "$ref": "record-0.1.schema.json#/$defs/evidence/properties/pullRequest"
+        },
+        "files": { "$ref": "record-0.1.schema.json#/$defs/evidence/properties/files" },
+        "closingReferences": {
+          "oneOf": [
+            {
+              "type": "object",
+              "required": ["status", "issues"],
+              "additionalProperties": false,
+              "properties": {
+                "status": { "const": "ok" },
+                "issues": { "type": "array", "items": { "$ref": "#/$defs/issueRef" } }
+              }
+            },
+            { "$ref": "record-0.1.schema.json#/$defs/unreadOnly" }
+          ]
+        },
+        "references": {
+          "type": "array",
+          "items": {
+            "oneOf": [
+              {
+                "type": "object",
+                "required": ["kind", "ref", "status", "exists"],
+                "additionalProperties": false,
+                "properties": {
+                  "kind": { "const": "issue" },
+                  "ref": { "$ref": "#/$defs/issueRef" },
+                  "status": { "const": "ok" },
+                  "exists": { "type": "boolean" },
+                  "resolvedAs": { "$ref": "#/$defs/issueRef" }
+                },
+                "if": { "required": ["resolvedAs"] },
+                "then": { "properties": { "exists": { "const": true } } }
+              },
+              {
+                "$ref": "record-0.1.schema.json#/$defs/evidence/properties/references/items/oneOf/1"
+              },
+              {
+                "$ref": "record-0.1.schema.json#/$defs/evidence/properties/references/items/oneOf/2"
+              }
+            ]
+          }
+        },
+        "closeEvents": {
+          "type": "object",
+          "required": ["pullRequest", "targets"],
+          "additionalProperties": false,
+          "properties": {
+            "pullRequest": {
+              "$ref": "record-0.1.schema.json#/$defs/evidence/properties/closeEvents/properties/pullRequest"
+            },
+            "targets": {
+              "type": "array",
+              "items": {
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "required": ["ref", "status", "type", "state", "events"],
+                    "additionalProperties": false,
+                    "properties": {
+                      "ref": { "$ref": "#/$defs/issueRef" },
+                      "status": { "const": "ok" },
+                      "type": { "enum": ["issue", "pull_request"] },
+                      "state": { "enum": ["open", "closed", "merged"] },
+                      "events": {
+                        "type": "array",
+                        "items": {
+                          "type": "object",
+                          "required": ["at", "closer"],
+                          "additionalProperties": false,
+                          "properties": {
+                            "at": { "$ref": "record-0.1.schema.json#/$defs/timestamp" },
+                            "closer": {
+                              "oneOf": [
+                                { "type": "null" },
+                                {
+                                  "type": "object",
+                                  "required": ["kind", "ref"],
+                                  "additionalProperties": false,
+                                  "properties": {
+                                    "kind": { "const": "pull_request" },
+                                    "ref": { "$ref": "#/$defs/issueRef" }
+                                  }
+                                },
+                                {
+                                  "$ref": "record-0.1.schema.json#/$defs/evidence/properties/closeEvents/properties/targets/items/oneOf/0/properties/events/items/properties/closer/oneOf/2"
+                                },
+                                {
+                                  "$ref": "record-0.1.schema.json#/$defs/evidence/properties/closeEvents/properties/targets/items/oneOf/0/properties/events/items/properties/closer/oneOf/3"
+                                }
+                              ]
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "if": { "properties": { "type": { "const": "issue" } } },
+                    "then": { "properties": { "state": { "enum": ["open", "closed"] } } }
+                  },
+                  {
+                    "type": "object",
+                    "required": ["ref"],
+                    "properties": { "ref": { "$ref": "#/$defs/issueRef" } },
+                    "allOf": [{ "$ref": "record-0.1.schema.json#/$defs/unread" }]
+                  }
+                ]
+              }
+            }
+          }
+        },
+        "checkRuns": { "$ref": "record-0.1.schema.json#/$defs/evidence/properties/checkRuns" },
+        "testRecords": {
+          "$ref": "record-0.1.schema.json#/$defs/evidence/properties/testRecords"
+        },
+        "deployments": {
+          "$ref": "record-0.1.schema.json#/$defs/evidence/properties/deployments"
+        },
+        "sources": { "$ref": "record-0.1.schema.json#/$defs/evidence/properties/sources" }
+      }
+    },
+    "host": {
+      "description": "The GitLab instance's lowercase DNS name: gitlab.com, or a self-managed host.",
+      "type": "string",
+      "maxLength": 253,
+      "pattern": "^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"
+    },
+    "commitSubject": {
+      "type": "object",
+      "required": ["name", "digest"],
+      "additionalProperties": false,
+      "properties": {
+        "name": {
+          "type": "string",
+          "pattern": "^git\\\\+https://[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*/[A-Za-z0-9_][A-Za-z0-9._-]{0,254}(?:/[A-Za-z0-9_][A-Za-z0-9._-]{0,254}){0,19}/[A-Za-z0-9._-]{1,255}@[0-9a-f]{40}$"
+        },
+        "digest": { "$ref": "record-0.1.schema.json#/$defs/commitSubject/properties/digest" }
+      }
+    },
+    "predicate": {
+      "type": "object",
+      "required": [
+        "spec",
+        "checker",
+        "report",
+        "block",
+        "subject",
+        "evidence",
+        "claims",
+        "verdict",
+        "digests",
+        "rerun",
+        "assurance"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "spec": {
+          "description": "The 0.1 version the checker implements, with the profile: 0.1.11-gitlab-0.1-draft.",
+          "type": "string",
+          "pattern": "^0\\\\.1\\\\.(?:0|[1-9][0-9]*)-gitlab-0\\\\.1-draft$"
+        },
+        "checker": { "$ref": "record-0.1.schema.json#/$defs/predicate/properties/checker" },
+        "report": { "$ref": "record-0.1.schema.json#/$defs/predicate/properties/report" },
+        "block": { "$ref": "record-0.1.schema.json#/$defs/block" },
+        "subject": {
+          "type": "object",
+          "required": ["repository", "pullRequest", "headSha", "mergeSha", "forge"],
+          "additionalProperties": false,
+          "properties": {
+            "repository": {
+              "description": "The project's full path, group/subgroup/.../project, as the merge request read names it.",
+              "$ref": "#/$defs/repository"
+            },
+            "pullRequest": {
+              "description": "The merge request's iid.",
+              "type": "integer",
+              "minimum": 1
+            },
+            "headSha": { "$ref": "record-0.1.schema.json#/$defs/commitSha" },
+            "mergeSha": {
+              "oneOf": [{ "$ref": "record-0.1.schema.json#/$defs/commitSha" }, { "type": "null" }]
+            },
+            "forge": {
+              "description": "The forge the evidence was read from. A record without it is a GitHub record.",
+              "type": "object",
+              "required": ["kind", "host"],
+              "additionalProperties": false,
+              "properties": {
+                "kind": { "const": "gitlab" },
+                "host": { "$ref": "#/$defs/host" }
+              }
+            }
+          }
+        },
+        "evidence": { "$ref": "#/$defs/evidence" },
+        "claims": { "$ref": "record-0.1.schema.json#/$defs/predicate/properties/claims" },
+        "verdict": { "$ref": "record-0.1.schema.json#/$defs/verdict" },
+        "digests": { "$ref": "record-0.1.schema.json#/$defs/predicate/properties/digests" },
+        "rerun": { "$ref": "record-0.1.schema.json#/$defs/predicate/properties/rerun" },
+        "assurance": { "$ref": "record-0.1.schema.json#/$defs/predicate/properties/assurance" }
+      }
+    }
+  }
+}
 `, "survey-0.1-draft.schema.json": '{\n  "$schema": "https://json-schema.org/draft/2020-12/schema",\n  "$id": "https://barglabs.ai/dunstan/spec/schema/survey-0.1-draft.schema.json",\n  "title": "Dunstan survey record, DRAFT 0.1",\n  "description": "DRAFT, informative, for the operator to check (spec/claim-format.md, \\"DRAFT survey 0.1\\"). A read-only survey of a repository\'s recent pull requests: the selection, one entry per selected pull request with the record a check wrote for it or the reason there is none, and an aggregate that is a pure function of the entries. Each embedded record is a 0.1 or DRAFT 0.2.0 record and is validated against its own schema when the survey is verified. It changes neither record schema.",\n  "type": "object",\n  "required": ["format", "checker", "selection", "entries", "aggregate", "rerun", "digest"],\n  "additionalProperties": false,\n  "properties": {\n    "format": { "const": "dunstan-survey-0.1-draft" },\n    "checker": { "$ref": "record-0.1.schema.json#/$defs/predicate/properties/checker" },\n    "selection": {\n      "type": "object",\n      "required": ["parameters", "reader", "listing", "selected"],\n      "additionalProperties": false,\n      "properties": {\n        "parameters": { "$ref": "#/$defs/parameters" },\n        "reader": {\n          "description": "Whether the survey read GitHub with a token (GITHUB_TOKEN was set). The aggregate\'s remedy lines are worded for it. The token is never recorded.",\n          "type": "object",\n          "required": ["authenticated"],\n          "additionalProperties": false,\n          "properties": { "authenticated": { "type": "boolean" } }\n        },\n        "listing": { "$ref": "#/$defs/listing" },\n        "selected": {\n          "type": "array",\n          "uniqueItems": true,\n          "items": { "$ref": "#/$defs/number" }\n        }\n      }\n    },\n    "entries": {\n      "description": "One per selected pull request, in selection order. Verify checks that their pull request numbers are exactly `selection.selected`, which holds no number twice.",\n      "type": "array",\n      "uniqueItems": true,\n      "items": { "$ref": "#/$defs/entry" }\n    },\n    "aggregate": { "$ref": "#/$defs/aggregate" },\n    "rerun": {\n      "type": "object",\n      "required": ["offline", "online"],\n      "additionalProperties": false,\n      "properties": {\n        "offline": { "type": "string", "minLength": 1 },\n        "online": { "type": "string", "minLength": 1 }\n      }\n    },\n    "digest": {\n      "description": "SHA-256 of the JCS bytes of the survey record without this member.",\n      "type": "object",\n      "required": ["sha256"],\n      "additionalProperties": false,\n      "properties": { "sha256": { "$ref": "record-0.1.schema.json#/$defs/sha256" } }\n    }\n  },\n  "$defs": {\n    "number": { "type": "integer", "minimum": 1 },\n    "count": { "type": "integer", "minimum": 0 },\n    "login": { "type": "string", "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})(?:\\\\[bot\\\\])?$" },\n    "parameters": {\n      "type": "object",\n      "required": ["repository", "last", "since", "authors", "report", "advisory"],\n      "additionalProperties": false,\n      "properties": {\n        "repository": { "$ref": "record-0.1.schema.json#/$defs/repository" },\n        "last": { "type": "integer", "minimum": 1, "maximum": 200 },\n        "since": {\n          "oneOf": [\n            { "type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}$" },\n            { "type": "null" }\n          ]\n        },\n        "authors": { "type": "array", "items": { "$ref": "#/$defs/login" } },\n        "report": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["kind"],\n              "additionalProperties": false,\n              "properties": { "kind": { "const": "pr-body" } }\n            },\n            {\n              "type": "object",\n              "required": ["kind", "author"],\n              "additionalProperties": false,\n              "properties": {\n                "kind": { "const": "pr-comment" },\n                "author": { "$ref": "#/$defs/login" }\n              }\n            }\n          ]\n        },\n        "advisory": { "type": "boolean" }\n      }\n    },\n    "listingPage": {\n      "type": "object",\n      "required": ["page", "locator", "sha256", "readAt", "items", "duplicates"],\n      "additionalProperties": false,\n      "properties": {\n        "page": { "$ref": "#/$defs/number" },\n        "locator": { "type": "string", "minLength": 1 },\n        "sha256": { "$ref": "record-0.1.schema.json#/$defs/sha256" },\n        "readAt": { "$ref": "record-0.1.schema.json#/$defs/timestamp" },\n        "items": { "$ref": "#/$defs/count" },\n        "duplicates": {\n          "description": "How many of this page\'s items repeat a pull request number an earlier item of the same read already held. In the read used, they are not in `pullRequests`.",\n          "$ref": "#/$defs/count"\n        },\n        "error": { "type": "string", "pattern": "^(?:http_[1-5][0-9]{2}|network|parse)$" }\n      }\n    },\n    "listing": {\n      "description": "The read of the listing the selection is from, the last one, and the reads abandoned before it. A read is abandoned at its first page that repeats an earlier item, unless it is the third read, which is never abandoned.",\n      "type": "object",\n      "required": ["pageBound", "pages", "abandoned", "pullRequests", "duplicates", "end"],\n      "additionalProperties": false,\n      "properties": {\n        "pageBound": { "type": "integer", "minimum": 1 },\n        "pages": {\n          "type": "array",\n          "minItems": 1,\n          "items": { "$ref": "#/$defs/listingPage" }\n        },\n        "abandoned": {\n          "description": "One item per abandoned read, in order: its pages, the last of them the page that repeated an earlier item. No pull request list; abandoned reads contribute nothing to the selection. Empty when the first read was used.",\n          "type": "array",\n          "maxItems": 2,\n          "items": {\n            "type": "object",\n            "required": ["pages"],\n            "additionalProperties": false,\n            "properties": {\n              "pages": {\n                "type": "array",\n                "minItems": 1,\n                "items": { "$ref": "#/$defs/listingPage" }\n              }\n            }\n          }\n        },\n        "duplicates": {\n          "description": "How many listed items repeated an earlier one: the sum of the pages\' duplicates. The pages\' items are the length of `pullRequests` plus this.",\n          "$ref": "#/$defs/count"\n        },\n        "pullRequests": {\n          "description": "Each listed pull request once, at its first occurrence, in listing order. Verify refuses a number listed twice.",\n          "type": "array",\n          "uniqueItems": true,\n          "items": {\n            "type": "object",\n            "required": ["number", "createdAt", "author", "merged"],\n            "additionalProperties": false,\n            "properties": {\n              "number": { "$ref": "#/$defs/number" },\n              "createdAt": { "$ref": "record-0.1.schema.json#/$defs/timestamp" },\n              "author": { "oneOf": [{ "type": "string", "minLength": 1 }, { "type": "null" }] },\n              "merged": { "type": "boolean" }\n            }\n          }\n        },\n        "end": {\n          "enum": [\n            "selection_full",\n            "since_reached",\n            "listing_ended",\n            "listing_unreadable",\n            "page_bound"\n          ]\n        }\n      }\n    },\n    "noRecordReason": {\n      "enum": [\n        "pull_request_unreadable",\n        "pull_request_moved",\n        "rate_limited",\n        "report_unavailable"\n      ]\n    },\n    "entry": {\n      "oneOf": [\n        {\n          "type": "object",\n          "required": ["pullRequest", "record"],\n          "additionalProperties": false,\n          "properties": {\n            "pullRequest": { "$ref": "#/$defs/number" },\n            "record": {\n              "description": "The record `dunstan check` writes for this pull request, as written: a 0.1 record, or a DRAFT 0.2.0 record when the survey ran the advisory reader. Verify validates it against its own schema.",\n              "type": "object"\n            }\n          }\n        },\n        {\n          "type": "object",\n          "required": ["pullRequest", "record", "reason"],\n          "additionalProperties": false,\n          "properties": {\n            "pullRequest": { "$ref": "#/$defs/number" },\n            "record": { "type": "null" },\n            "reason": { "$ref": "#/$defs/noRecordReason" }\n          }\n        }\n      ]\n    },\n    "columns": {\n      "type": "object",\n      "required": ["supported", "unverifiable", "notRecordCheckable", "contradicted"],\n      "properties": {\n        "supported": { "$ref": "#/$defs/count" },\n        "unverifiable": { "$ref": "#/$defs/count" },\n        "notRecordCheckable": { "$ref": "#/$defs/count" },\n        "contradicted": { "$ref": "#/$defs/count" }\n      }\n    },\n    "fixed": { "type": "string", "pattern": "^[01]\\\\.[0-9]{4}$" },\n    "rate": {\n      "type": "object",\n      "required": ["numerator", "denominator", "value", "wilson95"],\n      "additionalProperties": false,\n      "properties": {\n        "numerator": { "$ref": "#/$defs/count" },\n        "denominator": { "$ref": "#/$defs/count" },\n        "value": { "oneOf": [{ "$ref": "#/$defs/fixed" }, { "type": "null" }] },\n        "wilson95": {\n          "oneOf": [\n            {\n              "type": "object",\n              "required": ["low", "high"],\n              "additionalProperties": false,\n              "properties": {\n                "low": { "$ref": "#/$defs/fixed" },\n                "high": { "$ref": "#/$defs/fixed" }\n              }\n            },\n            { "type": "null" }\n          ]\n        }\n      }\n    },\n    "aggregate": {\n      "type": "object",\n      "required": [\n        "mapping",\n        "pullRequests",\n        "claims",\n        "byType",\n        "cannotSettle",\n        "contradictedOfSettled",\n        "unsettled"\n      ],\n      "additionalProperties": false,\n      "properties": {\n        "mapping": {\n          "type": "object",\n          "required": ["version"],\n          "additionalProperties": false,\n          "properties": { "version": { "type": "string", "minLength": 1 } }\n        },\n        "pullRequests": {\n          "type": "object",\n          "required": [\n            "listed",\n            "selected",\n            "withRecord",\n            "blockFound",\n            "blockMissing",\n            "blockInvalid",\n            "blockAmbiguous",\n            "noRecord"\n          ],\n          "additionalProperties": false,\n          "properties": {\n            "listed": { "$ref": "#/$defs/count" },\n            "selected": { "$ref": "#/$defs/count" },\n            "withRecord": { "$ref": "#/$defs/count" },\n            "blockFound": { "$ref": "#/$defs/count" },\n            "blockMissing": { "$ref": "#/$defs/count" },\n            "blockInvalid": { "$ref": "#/$defs/count" },\n            "blockAmbiguous": { "$ref": "#/$defs/count" },\n            "noRecord": {\n              "type": "array",\n              "items": {\n                "type": "object",\n                "required": ["reason", "count"],\n                "additionalProperties": false,\n                "properties": {\n                  "reason": { "$ref": "#/$defs/noRecordReason" },\n                  "count": { "$ref": "#/$defs/count" }\n                }\n              }\n            }\n          }\n        },\n        "claims": {\n          "allOf": [{ "$ref": "#/$defs/columns" }],\n          "required": ["total"],\n          "properties": { "total": { "$ref": "#/$defs/count" } },\n          "unevaluatedProperties": false\n        },\n        "byType": {\n          "type": "array",\n          "items": {\n            "allOf": [{ "$ref": "#/$defs/columns" }],\n            "required": ["type"],\n            "properties": {\n              "type": { "enum": ["T1", "T2", "T3", "T4", "T5", "T6", "T7", "T8", "R"] }\n            },\n            "unevaluatedProperties": false\n          }\n        },\n        "cannotSettle": { "$ref": "#/$defs/rate" },\n        "contradictedOfSettled": { "$ref": "#/$defs/rate" },\n        "unsettled": {\n          "type": "array",\n          "items": {\n            "type": "object",\n            "required": ["reason", "column", "count", "remedy"],\n            "additionalProperties": false,\n            "properties": {\n              "reason": { "$ref": "record-0.1.schema.json#/$defs/claimReason" },\n              "column": { "enum": ["unverifiable", "notRecordCheckable"] },\n              "count": { "type": "integer", "minimum": 1 },\n              "remedy": { "oneOf": [{ "type": "string", "minLength": 1 }, { "type": "null" }] }\n            }\n          }\n        },\n        "advisory": {\n          "type": "object",\n          "required": ["pullRequests", "notes"],\n          "additionalProperties": false,\n          "properties": {\n            "pullRequests": { "$ref": "#/$defs/count" },\n            "notes": {\n              "type": "array",\n              "items": {\n                "type": "object",\n                "required": ["note", "count"],\n                "additionalProperties": false,\n                "properties": {\n                  "note": { "type": "string", "minLength": 1 },\n                  "count": { "type": "integer", "minimum": 1 }\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n  }\n}\n' };
 function schemaText(file2) {
   const text2 = FILES[file2];
@@ -10640,6 +10903,16 @@ function validateDraftRecord(value) {
   }
   return draftRecord(value) ? [] : toSchemaErrors(draftRecord.errors);
 }
+var GITLAB_DRAFT_RECORD_SCHEMA_FILE = "record-gitlab-0.1-draft.schema.json";
+var gitlabDraftRecord;
+function validateGitlabDraftRecord(value) {
+  if (gitlabDraftRecord === void 0) {
+    const ajv = createAjv();
+    ajv.addSchema(readSchema(GITLAB_DRAFT_RECORD_SCHEMA_FILE));
+    gitlabDraftRecord = ajv.getSchema(schemaId(GITLAB_DRAFT_RECORD_SCHEMA_FILE));
+  }
+  return gitlabDraftRecord(value) ? [] : toSchemaErrors(gitlabDraftRecord.errors);
+}
 var SURVEY_SCHEMA_FILE = "survey-0.1-draft.schema.json";
 var surveyRecord;
 function validateSurveyRecord(value) {
@@ -10743,6 +11016,64 @@ function extractHandbackBlock(reportText) {
   return readBlockContent(block.content);
 }
 
+// src/template/wording.ts
+var PHRASES = {
+  // The notes of a template.
+  again: {
+    cli: "run dunstan template again",
+    mcp: "call dunstan_template_handback again"
+  },
+  againCi: {
+    cli: "run dunstan template --tests-ci again",
+    mcp: 'call dunstan_template_handback again with tests.from "ci"'
+  },
+  againCiSentence: {
+    cli: "Run dunstan template --tests-ci again",
+    mcp: 'Call dunstan_template_handback again with tests.from "ci"'
+  },
+  ciOnceFinished: {
+    cli: "run dunstan template --tests-ci once CI has finished",
+    mcp: 'call dunstan_template_handback with tests.from "ci" once CI has finished'
+  },
+  noTests: {
+    cli: "tests are not declared. To declare CI's counts, run dunstan template again with --tests-ci --tests-command <cmd> --tests-workflow <path> --tests-job <name> once CI has finished on your last push; it reads the JUnit record CI published (docs/ci-test-records.md). For a run made only locally, --tests-local <JUnit XML file> --tests-command <cmd> declares it as one. --tests-junit <file> with --tests-command, --tests-workflow, --tests-job, --tests-artifact and --tests-artifact-path declares a local file's counts against a CI record.",
+    mcp: `tests are not declared. To declare CI's counts, call dunstan_template_handback again with tests { from: "ci", command, workflow, job } once CI has finished on your last push; it reads the JUnit record CI published (docs/ci-test-records.md). For a run made only locally, tests { from: "local", junit, command } declares it as one.`
+  },
+  // The errors of a template.
+  base: {
+    cli: "pass --base <ref>",
+    mcp: "give base"
+  },
+  baseName: {
+    cli: "--base",
+    mcp: "base"
+  },
+  repo: {
+    cli: "pass --repo <owner/name>",
+    mcp: "give tests.repository (owner/name)"
+  },
+  localFile: {
+    cli: "--tests-local",
+    mcp: "tests.junit"
+  },
+  // The remedy lines (src/remedy/remedies.ts).
+  templateWrites: {
+    cli: "dunstan template writes it",
+    mcp: "dunstan_template_handback writes it"
+  },
+  templateCiFills: {
+    cli: "dunstan template --tests-ci fills them",
+    mcp: 'dunstan_template_handback with tests.from "ci" fills them'
+  },
+  templateCiAfter: {
+    cli: "run dunstan template --tests-ci after CI has finished on your last push",
+    mcp: 'call dunstan_template_handback with tests.from "ci" after CI has finished on your last push'
+  }
+};
+function phrase(caller, key) {
+  return PHRASES[key][caller];
+}
+
 // src/template/template.ts
 var TemplateError = class extends Error {
   constructor(message) {
@@ -10772,12 +11103,12 @@ function commitOf(cwd, ref) {
   const sha = r.stdout.trim();
   return r.ok && SHA.test(sha) ? sha : void 0;
 }
-function defaultBase(cwd) {
+function defaultBase(cwd, caller) {
   const r = git(cwd, ["symbolic-ref", "--quiet", "refs/remotes/origin/HEAD"]);
   const ref = r.stdout.trim();
   if (!r.ok || !ref.startsWith("refs/remotes/")) {
     throw new TemplateError(
-      "the remote's default branch cannot be resolved (refs/remotes/origin/HEAD is not set): pass --base <ref>, or run git remote set-head origin --auto"
+      `the remote's default branch cannot be resolved (refs/remotes/origin/HEAD is not set): ${phrase(caller, "base")}, or run git remote set-head origin --auto`
     );
   }
   return ref.slice("refs/remotes/".length);
@@ -10789,12 +11120,12 @@ function localCounts(cwd, flag, file2) {
     throw new TemplateError(`${flag} ${file2}: ${e.message}`);
   }
 }
-function testsFrom(cwd, tests) {
+function testsFrom(cwd, tests, caller) {
   if (tests.kind === "ci") {
     return tests.read.status === "settled" ? { run: tests.read.run, notes: tests.read.notes } : { notes: tests.read.notes };
   }
   if (tests.kind === "local") {
-    const counts2 = localCounts(cwd, "--tests-local", tests.junit);
+    const counts2 = localCounts(cwd, phrase(caller, "localFile"), tests.junit);
     return {
       run: {
         command: tests.command,
@@ -10803,7 +11134,7 @@ function testsFrom(cwd, tests) {
         record: { kind: "local" }
       },
       notes: [
-        `tests: ${counts2.executed} executed and ${counts2.failed} failed in ${tests.junit}, declared as a local run (record {"kind": "local"}). The gate reports them unverifiable (local_run_not_in_record) until CI publishes a record: publish one (docs/ci-test-records.md), then run dunstan template --tests-ci once CI has finished. Until then, say in the report that CI publishes no test record, and state no count in prose that the block does not declare.`
+        `tests: ${counts2.executed} executed and ${counts2.failed} failed in ${tests.junit}, declared as a local run (record {"kind": "local"}). The gate reports them unverifiable (local_run_not_in_record) until CI publishes a record: publish one (docs/ci-test-records.md), then ${phrase(caller, "ciOnceFinished")}. Until then, say in the report that CI publishes no test record, and state no count in prose that the block does not declare.`
       ]
     };
   }
@@ -10821,18 +11152,18 @@ function testsFrom(cwd, tests) {
     ]
   };
 }
-function originRepository(cwd) {
+function originRepository(cwd, caller) {
   const r = git(cwd, ["remote", "get-url", "origin"]);
   const url2 = r.stdout.trim();
   if (!r.ok || url2 === "") {
-    throw new TemplateError("there is no origin remote: pass --repo <owner/name>");
+    throw new TemplateError(`there is no origin remote: ${phrase(caller, "repo")}`);
   }
   const m = /^(?:https:\/\/(?:[^@/]+@)?|ssh:\/\/git@|git@)github\.com[:/]([A-Za-z0-9-]+)\/([A-Za-z0-9._-]+?)(?:\.git)?\/?$/.exec(
     url2
   );
   if (m === null) {
     throw new TemplateError(
-      `origin ${url2} is not a github.com repository: pass --repo <owner/name>`
+      `origin ${url2} is not a github.com repository: ${phrase(caller, "repo")}`
     );
   }
   return `${m[1]}/${m[2]}`;
@@ -10857,7 +11188,7 @@ function headCommit(cwd) {
   return head;
 }
 function templateBlock(options) {
-  const { cwd } = options;
+  const { cwd, caller } = options;
   const head = headCommit(cwd);
   const symbolic = git(cwd, ["symbolic-ref", "--quiet", "HEAD"]);
   if (!symbolic.ok) {
@@ -10866,8 +11197,10 @@ function templateBlock(options) {
     );
   }
   const branch = symbolic.stdout.trim().replace(/^refs\/heads\//, "");
-  if (options.base?.startsWith("-")) throw new TemplateError(`--base ${options.base} is not a ref`);
-  const base = options.base ?? defaultBase(cwd);
+  if (options.base?.startsWith("-")) {
+    throw new TemplateError(`${phrase(caller, "baseName")} ${options.base} is not a ref`);
+  }
+  const base = options.base ?? defaultBase(cwd, caller);
   const baseCommit = commitOf(cwd, base);
   if (baseCommit === void 0) throw new TemplateError(`the base ${base} cannot be resolved`);
   const mb = git(cwd, ["merge-base", baseCommit, head]);
@@ -10890,7 +11223,7 @@ function templateBlock(options) {
     compareCodeUnits
   );
   const block = { dunstan: BLOCK_VERSION, headCommit: head, filesChanged };
-  const tests = options.tests === void 0 ? void 0 : testsFrom(cwd, options.tests);
+  const tests = options.tests === void 0 ? void 0 : testsFrom(cwd, options.tests, caller);
   if (tests?.run !== void 0) block.tests = [tests.run];
   const read = readBlockContent(JSON.stringify(block));
   if (read.status !== "found") {
@@ -10900,7 +11233,7 @@ function templateBlock(options) {
     );
   }
   const notes = [
-    `this block describes the local HEAD ${head} on ${branch}, against ${base} (merge base ${mergeBase}). Pushing more commits makes it stale, and the gate then reports head_mismatch: run dunstan template again after your last push.`
+    `this block describes the local HEAD ${head} on ${branch}, against ${base} (merge base ${mergeBase}). Pushing more commits makes it stale, and the gate then reports head_mismatch: ${phrase(caller, "again")} after your last push.`
   ];
   if (filesChanged.length === 0) notes.push("HEAD changes no file against the merge base.");
   const dirty = git(cwd, ["status", "--porcelain", "-z"]);
@@ -10908,9 +11241,7 @@ function templateBlock(options) {
     notes.push("the working tree has changes that are not committed; they are not in this block.");
   }
   if (tests === void 0) {
-    notes.push(
-      "tests are not declared. To declare CI's counts, run dunstan template again with --tests-ci --tests-command <cmd> --tests-workflow <path> --tests-job <name> once CI has finished on your last push; it reads the JUnit record CI published (docs/ci-test-records.md). For a run made only locally, --tests-local <JUnit XML file> --tests-command <cmd> declares it as one. --tests-junit <file> with --tests-command, --tests-workflow, --tests-job, --tests-artifact and --tests-artifact-path declares a local file's counts against a CI record."
-    );
+    notes.push(phrase(caller, "noTests"));
   } else {
     notes.push(...tests.notes);
   }
@@ -10932,27 +11263,642 @@ import { readFileSync as readFileSync3, writeFileSync } from "node:fs";
 import { basename } from "node:path";
 import { parseArgs } from "node:util";
 
+// src/evidence/gitlab.ts
+var NO_HEAD_PIPELINE = "head_pipeline";
+var HEAD_PIPELINE_ELSEWHERE = "head_pipeline_not_at_head_commit";
+var CLOSE_EVENT_PAGES2 = 10;
+var SEGMENT = "[A-Za-z0-9_][A-Za-z0-9._-]{0,254}";
+var FULL_PATH = `${SEGMENT}(?:/${SEGMENT}){0,19}/[A-Za-z0-9._-]{1,255}`;
+var GITLAB_PROJECT = new RegExp(`^${FULL_PATH}$`);
+var ISSUE_REF2 = new RegExp(`^${FULL_PATH}#[1-9][0-9]{0,9}$`);
+var COMMIT = /^[0-9a-f]{40}$/;
+var TIMESTAMP = /^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]+)?Z$/;
+var MERGE_REQUEST_URL = /^https?:\/\/[^/]+\/(.+)\/-\/merge_requests\/([1-9][0-9]{0,9})$/;
+var ShapeError2 = class extends Error {
+};
+function obj2(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) throw new ShapeError2();
+  return value;
+}
+function arr2(value) {
+  if (!Array.isArray(value)) throw new ShapeError2();
+  return value;
+}
+function str2(value) {
+  if (typeof value !== "string") throw new ShapeError2();
+  return value;
+}
+function int2(value) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value)) throw new ShapeError2();
+  return value;
+}
+function bool(value) {
+  if (typeof value !== "boolean") throw new ShapeError2();
+  return value;
+}
+function strOrNull2(value) {
+  return value === null || value === void 0 ? null : str2(value);
+}
+function timestamp2(value) {
+  const text2 = str2(value);
+  if (!TIMESTAMP.test(text2)) throw new ShapeError2();
+  return text2;
+}
+function commitOid2(value) {
+  const text2 = str2(value);
+  if (!COMMIT.test(text2)) throw new ShapeError2();
+  return text2;
+}
+function unreadable2(source) {
+  return { status: "unreadable", source };
+}
+function byCodeUnits(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function projectPath(project) {
+  return `/api/v4/projects/${encodeURIComponent(project)}`;
+}
+function mergeRequestPath(project, iid) {
+  return `${projectPath(project)}/merge_requests/${iid}`;
+}
+async function readPages(client, kind, pathFor, map2, options = {}) {
+  const out = [];
+  for (let page = 1; page <= (options.maxPages ?? MAX_PAGES); page++) {
+    const path = pathFor(page);
+    const read = await client.read(kind, path, options.record === false ? { record: false } : {});
+    if (!read.ok) return null;
+    let items;
+    try {
+      items = arr2(read.json);
+      out.push(...items.map((item) => map2(item, `GET ${path}`)));
+    } catch (e) {
+      if (!(e instanceof ShapeError2)) throw e;
+      client.markParseError(`GET ${path}`);
+      return null;
+    }
+    if (items.length < PER_PAGE) return out;
+  }
+  return null;
+}
+var pages = (path) => (page) => `${path}?per_page=${PER_PAGE}&page=${page}`;
+function headPipeline(value) {
+  if (value === null || value === void 0) return null;
+  const p = obj2(value);
+  const id = int2(p.id);
+  if (id < 1) throw new ShapeError2();
+  return { id, sha: commitOid2(p.sha) };
+}
+function diffEntry(item) {
+  const f = obj2(item);
+  const path = str2(f.new_path);
+  const previous = str2(f.old_path);
+  const added = bool(f.new_file);
+  const removed = bool(f.deleted_file);
+  const renamed = bool(f.renamed_file);
+  if ([added, removed, renamed].filter(Boolean).length > 1) throw new ShapeError2();
+  if (added) return { path, status: "added" };
+  if (removed) return { path, status: "removed" };
+  if (renamed) return { path, status: "renamed", previousPath: previous };
+  return { path, status: "modified" };
+}
+function mergeCommit(mr) {
+  if (mr.merge_commit_sha !== null && mr.merge_commit_sha !== void 0) {
+    return commitOid2(mr.merge_commit_sha);
+  }
+  if (mr.squash_commit_sha !== null && mr.squash_commit_sha !== void 0) {
+    return commitOid2(mr.squash_commit_sha);
+  }
+  return null;
+}
+var STATES = {
+  opened: { state: "open", merged: false },
+  closed: { state: "closed", merged: false },
+  merged: { state: "closed", merged: true }
+};
+async function readMergeRequest(client, project, iid, options = {}) {
+  const path = mergeRequestPath(project, iid);
+  const name = `merge request ${project}!${iid}`;
+  const record2 = options.record === false ? { record: false } : {};
+  const read = await client.read("pull_request", path, record2);
+  if (!read.ok) {
+    throw new PullRequestUnreadable(`cannot read ${name} (${read.error}); no record is written`);
+  }
+  let head;
+  try {
+    const mr = obj2(read.json);
+    const mapped = STATES[str2(mr.state)];
+    if (mapped === void 0) throw new ShapeError2();
+    const number4 = int2(mr.iid);
+    const full = str2(obj2(mr.references).full);
+    const suffix = `!${number4}`;
+    if (!full.endsWith(suffix)) throw new ShapeError2();
+    const repository = full.slice(0, -suffix.length);
+    if (!GITLAB_PROJECT.test(repository)) throw new ShapeError2();
+    if (repository.toLowerCase() !== project.toLowerCase()) throw new ShapeError2();
+    const changesCount = mr.changes_count;
+    head = {
+      evidence: {
+        status: "ok",
+        number: number4,
+        state: mapped.state,
+        merged: mapped.merged,
+        mergedAt: mr.merged_at === null || mr.merged_at === void 0 ? null : timestamp2(mr.merged_at),
+        headSha: commitOid2(mr.sha),
+        mergeSha: mapped.merged ? mergeCommit(mr) : null
+      },
+      repository,
+      baseRef: str2(mr.target_branch),
+      body: strOrNull2(mr.description),
+      changesCount: strOrNull2(changesCount),
+      headPipeline: headPipeline(mr.head_pipeline)
+    };
+  } catch (e) {
+    if (e instanceof ShapeError2) {
+      throw new PullRequestUnreadable(
+        `${name} answered in an unexpected shape; no record is written`
+      );
+    }
+    throw e;
+  }
+  const listed2 = await readPages(client, "pull_request_files", pages(`${path}/diffs`), diffEntry, {
+    record: options.record !== false
+  });
+  if (listed2 === null) {
+    throw new PullRequestUnreadable(`cannot read the diffs of ${name}; no record is written`);
+  }
+  const unique = new Map(listed2.map((e) => [e.path, e]));
+  const entries = [...unique.values()].sort((a, b) => byCodeUnits(a.path, b.path));
+  const count = head.changesCount;
+  const complete = count !== null && /^[0-9]+$/.test(count) && Number(count) === entries.length;
+  return {
+    evidence: { ...head.evidence, changedFiles: entries.length },
+    repository: head.repository,
+    baseRef: head.baseRef,
+    body: head.body,
+    files: { status: "ok", complete, entries },
+    headPipeline: head.headPipeline
+  };
+}
+function reportFromMergeRequestDescription(pr) {
+  return {
+    bytes: new TextEncoder().encode(pr.body ?? ""),
+    source: {
+      kind: "pr-body",
+      locator: `GET ${mergeRequestPath(pr.repository, pr.evidence.number)}#description`
+    }
+  };
+}
+async function readClosingReferences2(client, project, iid) {
+  const issues = await readPages(
+    client,
+    "closing_references",
+    pages(`${mergeRequestPath(project, iid)}/closes_issues`),
+    (item) => {
+      const ref = str2(obj2(obj2(item).references).full);
+      if (!ISSUE_REF2.test(ref)) throw new ShapeError2();
+      return ref;
+    }
+  );
+  if (issues === null) return unreadable2("closing_references");
+  return { status: "ok", issues: [...new Set(issues)].sort(byCodeUnits) };
+}
+function answeredIssue2(json2, ref) {
+  const full = str2(obj2(obj2(json2).references).full);
+  if (!sameIssue(full, ref)) throw new ShapeError2();
+}
+function issueState(json2) {
+  const state = str2(obj2(json2).state);
+  if (state === "opened") return "open";
+  if (state === "closed") return "closed";
+  throw new ShapeError2();
+}
+async function isAncestor2(client, project, commit, head) {
+  const path = `${projectPath(project)}/repository/merge_base?refs[]=${commit}&refs[]=${head}`;
+  const read = await client.read("compare", path);
+  if (!read.ok) return null;
+  try {
+    return commitOid2(obj2(read.json).id) === commit;
+  } catch (e) {
+    if (!(e instanceof ShapeError2)) throw e;
+    client.markParseError(`GET ${path}`);
+    return null;
+  }
+}
+async function readIssue(client, ref) {
+  const [repo, num] = ref.split("#");
+  const path = `${projectPath(repo)}/issues/${num}`;
+  return { read: await client.read("issue", path), path };
+}
+async function readReferences2(client, block, project, headSha, closing) {
+  const toRead = (block.references ?? []).filter((r) => {
+    if (r.relation === "cites") return true;
+    if (!("issue" in r) || closing?.status !== "ok") return false;
+    const target = qualifyIssue(r.issue, project);
+    return !closing.issues.some((issue2) => sameIssue(issue2, target));
+  });
+  if (toRead.length === 0) return void 0;
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const projectReadable = /* @__PURE__ */ new Map([[project.toLowerCase(), true]]);
+  for (const reference of toRead) {
+    if ("issue" in reference) {
+      const ref2 = qualifyIssue(reference.issue, project);
+      const key2 = `issue:${ref2.toLowerCase()}`;
+      if (seen.has(key2)) continue;
+      seen.add(key2);
+      const repo = ref2.split("#")[0];
+      let readable = projectReadable.get(repo.toLowerCase());
+      if (readable === void 0) {
+        readable = (await client.read("repository", projectPath(repo))).ok;
+        projectReadable.set(repo.toLowerCase(), readable);
+      }
+      if (!readable) {
+        out.push({ kind: "issue", ref: ref2, ...unreadable2("repository") });
+        continue;
+      }
+      const { read: read2, path } = await readIssue(client, ref2);
+      if (!read2.ok) {
+        out.push({ kind: "issue", ref: ref2, ...unreadable2("issue") });
+        continue;
+      }
+      try {
+        answeredIssue2(read2.json, ref2);
+      } catch (e) {
+        if (!(e instanceof ShapeError2)) throw e;
+        client.markParseError(`GET ${path}`);
+        out.push({ kind: "issue", ref: ref2, ...unreadable2("issue") });
+        continue;
+      }
+      out.push({ kind: "issue", ref: ref2, status: "ok", exists: true });
+      continue;
+    }
+    const ref = reference.commit;
+    const key = `commit:${ref}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const read = await client.read("commit", `${projectPath(project)}/repository/commits/${ref}`);
+    if (!read.ok && (read.status === 404 || read.status === 410)) {
+      out.push({ kind: "commit", ref, status: "ok", exists: false, reachableFromHead: false });
+      continue;
+    }
+    if (!read.ok) {
+      out.push({ kind: "commit", ref, ...unreadable2("commit") });
+      continue;
+    }
+    const reachable = ref === headSha ? true : await isAncestor2(client, project, ref, headSha);
+    if (reachable === null) out.push({ kind: "commit", ref, ...unreadable2("compare") });
+    else
+      out.push({ kind: "commit", ref, status: "ok", exists: true, reachableFromHead: reachable });
+  }
+  return out;
+}
+async function readCloseBase2(client, project, mr) {
+  const path = projectPath(project);
+  const read = await client.read("repository", path);
+  if (!read.ok) return unreadable2("repository");
+  let defaultBranch;
+  try {
+    defaultBranch = strOrNull2(obj2(read.json).default_branch);
+  } catch (e) {
+    if (!(e instanceof ShapeError2)) throw e;
+    client.markParseError(`GET ${path}`);
+    return unreadable2("repository");
+  }
+  const commits = await readPages(
+    client,
+    "pull_request_commits",
+    pages(`${mergeRequestPath(project, mr.evidence.number)}/commits`),
+    (item) => commitOid2(obj2(item).id)
+  );
+  if (commits === null) return unreadable2("pull_request_commits");
+  return {
+    status: "ok",
+    baseRef: mr.baseRef,
+    defaultBranch,
+    commits: [...new Set(commits)].sort(byCodeUnits)
+  };
+}
+function closeEvent2(item) {
+  const e = obj2(item);
+  if (str2(e.state) !== "closed") return null;
+  const at2 = timestamp2(e.created_at);
+  const source = e.source_merge_request;
+  if (source !== null && source !== void 0) {
+    const m = obj2(source);
+    const iid = int2(m.iid);
+    const url2 = MERGE_REQUEST_URL.exec(str2(m.web_url));
+    if (url2 === null || Number(url2[2]) !== iid) throw new ShapeError2();
+    const ref = `${url2[1]}#${iid}`;
+    if (!ISSUE_REF2.test(ref)) throw new ShapeError2();
+    return { at: at2, closer: { kind: "pull_request", ref } };
+  }
+  if (e.source_commit !== null && e.source_commit !== void 0) {
+    return { at: at2, closer: { kind: "commit", oid: commitOid2(e.source_commit) } };
+  }
+  return { at: at2, closer: null };
+}
+async function readCloseTarget2(client, ref) {
+  const { read, path } = await readIssue(client, ref);
+  if (!read.ok) return { ref, ...unreadable2("issue") };
+  let state;
+  try {
+    answeredIssue2(read.json, ref);
+    state = issueState(read.json);
+  } catch (e) {
+    if (!(e instanceof ShapeError2)) throw e;
+    client.markParseError(`GET ${path}`);
+    return { ref, ...unreadable2("issue") };
+  }
+  const events = await readPages(
+    client,
+    "issue",
+    pages(`${path}/resource_state_events`),
+    closeEvent2,
+    {
+      maxPages: CLOSE_EVENT_PAGES2
+    }
+  );
+  if (events === null) return { ref, ...unreadable2("issue") };
+  return {
+    ref,
+    status: "ok",
+    type: "issue",
+    state,
+    events: events.filter((e) => e !== null)
+  };
+}
+async function readCloseEvents2(client, project, mr, targets) {
+  const pullRequest = await readCloseBase2(client, project, mr);
+  const read = [];
+  for (const target of targets) read.push(await readCloseTarget2(client, target));
+  return { pullRequest, targets: read };
+}
+function pipelineAt(mr, headCommit2) {
+  if (mr.headPipeline === null) return { status: "unpopulated", field: NO_HEAD_PIPELINE };
+  if (mr.headPipeline.sha !== headCommit2) {
+    return { status: "unpopulated", field: HEAD_PIPELINE_ELSEWHERE };
+  }
+  return mr.headPipeline;
+}
+function listedJob(item, locator) {
+  const j = obj2(item);
+  const id = int2(j.id);
+  if (id < 1) throw new ShapeError2();
+  const files = j.artifacts === null || j.artifacts === void 0 ? [] : arr2(j.artifacts);
+  const archive = files.some((f) => str2(obj2(f).file_type) === "archive");
+  const expires = j.artifacts_expire_at;
+  return {
+    id,
+    name: str2(j.name),
+    status: str2(j.status),
+    archive,
+    expireAt: expires === null || expires === void 0 ? null : timestamp2(expires),
+    locator
+  };
+}
+var GITLAB_JOB_STATUSES = {
+  success: { status: "completed", conclusion: "success" },
+  failed: { status: "completed", conclusion: "failure" },
+  canceled: { status: "completed", conclusion: "cancelled" },
+  skipped: { status: "completed", conclusion: "skipped" },
+  manual: { status: "completed", conclusion: "skipped" },
+  created: { status: "queued", conclusion: null },
+  pending: { status: "queued", conclusion: null },
+  preparing: { status: "queued", conclusion: null },
+  waiting_for_resource: { status: "queued", conclusion: null },
+  scheduled: { status: "queued", conclusion: null },
+  running: { status: "in_progress", conclusion: null }
+};
+function checkRunOf(job) {
+  if (!Object.hasOwn(GITLAB_JOB_STATUSES, job.status)) return null;
+  const mapped = GITLAB_JOB_STATUSES[job.status];
+  return { id: job.id, name: job.name, ...mapped };
+}
+function jobsReader(client, project, pipeline) {
+  let read;
+  return () => {
+    read ??= readPages(
+      client,
+      "check_runs",
+      (page) => `${projectPath(project)}/pipelines/${pipeline}/jobs?include_retried=false&per_page=${PER_PAGE}&page=${page}`,
+      listedJob
+    );
+    return read;
+  };
+}
+async function readCheckRuns2(client, project, pipeline, jobs, excludedIds) {
+  const listed2 = await jobs();
+  if (listed2 === null) return unreadable2("check_runs");
+  const bridgesPath = `${projectPath(project)}/pipelines/${pipeline.id}/bridges`;
+  const bridges = await readPages(client, "check_runs", pages(bridgesPath), listedJob);
+  if (bridges === null) return unreadable2("check_runs");
+  const runs = [];
+  for (const job of [...listed2, ...bridges]) {
+    const run = checkRunOf(job);
+    if (run === null) {
+      client.markParseError(job.locator);
+      return unreadable2("check_runs");
+    }
+    runs.push(run);
+  }
+  return {
+    status: "ok",
+    commit: pipeline.sha,
+    excludedIds: [...new Set(excludedIds)].sort((a, b) => a - b),
+    runs: [...new Map(runs.map((r) => [r.id, r])).values()].sort((a, b) => a.id - b.id)
+  };
+}
+async function readCiConfigPath(client, project) {
+  const path = projectPath(project);
+  const read = await client.read("repository", path);
+  if (!read.ok) return null;
+  try {
+    const p = obj2(read.json);
+    if (!("ci_config_path" in p)) throw new ShapeError2();
+    const config2 = strOrNull2(p.ci_config_path);
+    return config2 === null || config2 === "" ? ".gitlab-ci.yml" : config2;
+  } catch (e) {
+    if (!(e instanceof ShapeError2)) throw e;
+    client.markParseError(`GET ${path}`);
+    return null;
+  }
+}
+async function readTestRecord2(client, project, record2, jobs, ciConfig) {
+  const config2 = await ciConfig();
+  if (config2 === null) return { record: record2, ...unreadable2("repository") };
+  if (config2 !== record2.workflow) return { record: record2, status: "ok", runs: [] };
+  const listed2 = await jobs();
+  if (listed2 === null) return { record: record2, ...unreadable2("check_runs") };
+  const runs = [];
+  const named = listed2.filter((j) => j.name === record2.job).sort((a, b) => a.id - b.id);
+  for (const job of named) {
+    if (record2.artifact !== "archive") continue;
+    if (!job.archive) {
+      if (job.expireAt !== null) return { record: record2, ...unreadable2("artifact") };
+      continue;
+    }
+    const zipPath = `${projectPath(project)}/jobs/${job.id}/artifacts`;
+    const download = await client.read("artifact", zipPath, {
+      json: false,
+      locatorSuffix: `#${record2.path}`
+    });
+    if (!download.ok) return { record: record2, ...unreadable2("artifact") };
+    try {
+      const file2 = readZipEntry(download.body, record2.path, client.maxEntryBytes);
+      if (file2 === null) continue;
+      const counts = countJunit(new TextDecoder("utf-8").decode(file2));
+      runs.push({ runId: job.id, runAttempt: 1, ...counts });
+    } catch (e) {
+      if (!(e instanceof ZipError || e instanceof JunitError)) throw e;
+      client.markParseError(`GET ${zipPath}#${record2.path}`);
+      return { record: record2, ...unreadable2("artifact") };
+    }
+  }
+  return { record: record2, status: "ok", runs };
+}
+var GITLAB_DEPLOYMENT_STATUSES = {
+  success: true,
+  created: false,
+  running: false,
+  failed: false,
+  canceled: false,
+  skipped: false,
+  blocked: false
+};
+function second2(t) {
+  return t.slice(0, 19);
+}
+function listedDeployment(environment) {
+  return (item) => {
+    const d = obj2(item);
+    const id = int2(d.id);
+    if (id < 1) throw new ShapeError2();
+    if (str2(obj2(d.environment).name) !== environment) throw new ShapeError2();
+    const status = str2(d.status);
+    if (!Object.hasOwn(GITLAB_DEPLOYMENT_STATUSES, status)) throw new ShapeError2();
+    const updatedAt = timestamp2(d.updated_at);
+    return {
+      id,
+      sha: commitOid2(d.sha),
+      createdAt: timestamp2(d.created_at),
+      successAt: GITLAB_DEPLOYMENT_STATUSES[status] === true ? updatedAt : null
+    };
+  };
+}
+async function readDeployments2(client, project, pr, deployedAt) {
+  const environment = deployedAt.environment;
+  const listed2 = await readPages(
+    client,
+    "deployments",
+    (page) => `${projectPath(project)}/deployments?environment=${encodeURIComponent(environment)}&order_by=id&sort=desc&per_page=${PER_PAGE}&page=${page}`,
+    listedDeployment(environment)
+  );
+  if (listed2 === null) return { environment, ...unreadable2("deployments") };
+  const window = pr.merged && pr.mergedAt !== null && pr.mergeSha !== null ? { from: second2(pr.mergedAt), to: second2(deployedAt.at) } : null;
+  const candidates = /* @__PURE__ */ new Map();
+  for (const d of listed2) {
+    const created = second2(d.createdAt);
+    const inWindow = window !== null && created >= window.from && created <= window.to;
+    if (d.sha === pr.headSha || inWindow) candidates.set(d.id, d);
+  }
+  const deployments = [];
+  const related = /* @__PURE__ */ new Map();
+  for (const d of [...candidates.values()].sort((a, b) => a.id - b.id)) {
+    let relation;
+    if (d.sha === pr.headSha) relation = "head";
+    else if (d.sha === pr.mergeSha) relation = "merge";
+    else if (!pr.merged || pr.mergeSha === null) relation = "unrelated";
+    else {
+      let known = related.get(d.sha);
+      if (known === void 0) {
+        const ancestor = await isAncestor2(client, project, pr.mergeSha, d.sha);
+        known = ancestor === null ? "unknown" : ancestor ? "descendant" : "unrelated";
+        related.set(d.sha, known);
+      }
+      relation = known;
+    }
+    deployments.push({ id: d.id, sha: d.sha, relation, successAt: d.successAt });
+  }
+  return { environment, status: "ok", deployments };
+}
+async function readGitLabEvidence(client, input2) {
+  const { block, repository } = input2;
+  const mr = input2.pullRequest;
+  if (mr.files === void 0) throw new Error("the GitLab reader reads a merge request it read");
+  const pr = mr.evidence;
+  const evidence = { pullRequest: pr, sources: [] };
+  if (block !== null) {
+    evidence.files = mr.files;
+    if ((block.references ?? []).some((r) => r.relation === "closes")) {
+      evidence.closingReferences = await readClosingReferences2(client, repository, pr.number);
+    }
+    const references = await readReferences2(
+      client,
+      block,
+      repository,
+      pr.headSha,
+      evidence.closingReferences
+    );
+    if (references !== void 0) evidence.references = references;
+    const targets = closeTargets(block, repository, evidence.closingReferences, references);
+    if (targets.length > 0) {
+      evidence.closeEvents = await readCloseEvents2(client, repository, mr, targets);
+    }
+    const pipeline = pipelineAt(mr, block.headCommit);
+    const jobs = "id" in pipeline ? jobsReader(client, repository, pipeline.id) : null;
+    if (block.checks !== void 0) {
+      evidence.checkRuns = "id" in pipeline && jobs !== null ? await readCheckRuns2(client, repository, pipeline, jobs, input2.excludedCheckRunIds ?? []) : pipeline;
+    }
+    const records = /* @__PURE__ */ new Map();
+    for (const test of block.tests ?? []) {
+      if (test.record.kind !== "junit") continue;
+      const record2 = test.record;
+      records.set(canonicalize(record2), record2);
+    }
+    if (records.size > 0) {
+      evidence.testRecords = [];
+      let config2;
+      const ciConfig = () => {
+        config2 ??= readCiConfigPath(client, repository);
+        return config2;
+      };
+      for (const record2 of records.values()) {
+        evidence.testRecords.push(
+          "id" in pipeline && jobs !== null ? await readTestRecord2(client, repository, record2, jobs, ciConfig) : { record: record2, ...pipeline }
+        );
+      }
+    }
+    if (block.deployedAt !== void 0) {
+      evidence.deployments = [await readDeployments2(client, repository, pr, block.deployedAt)];
+    }
+  }
+  evidence.sources = client.sortedSources();
+  return evidence;
+}
+
 // src/evidence/http.ts
 var DEFAULT_API = "https://api.github.com";
 var MAX_ARCHIVE_BYTES = MAX_ENTRY_BYTES + 8 * 1024 * 1024;
 var MAX_BODY_BYTES = 48 * 1024 * 1024;
 var EMPTY = new Uint8Array();
-var GitHubClient = class {
+var ForgeClient = class {
   sources = /* @__PURE__ */ new Map();
   maxArchiveBytes;
   maxEntryBytes;
   #allocate;
   #token;
   #baseUrl;
+  #profileHeaders;
   #fetch;
   #now;
   #sleep;
   #warn;
   #maxAttempts;
   #maxWaitMs;
-  constructor(options = {}) {
+  constructor(options, profile) {
     this.#token = options.token;
-    this.#baseUrl = options.baseUrl ?? DEFAULT_API;
+    this.#baseUrl = options.baseUrl ?? profile.baseUrl;
+    this.#profileHeaders = profile.headers;
     this.#fetch = options.fetch ?? fetch;
     this.#now = options.now ?? (() => /* @__PURE__ */ new Date());
     this.#sleep = options.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
@@ -11029,8 +11975,7 @@ var GitHubClient = class {
   }
   async #fetchWithRetry(method, path, body, locator, budget) {
     const headers = {
-      accept: "application/vnd.github+json",
-      "x-github-api-version": "2022-11-28",
+      ...this.#profileHeaders,
       "user-agent": `dunstan/${CHECKER_VERSION}`
     };
     if (this.hasToken) headers.authorization = `Bearer ${this.#token}`;
@@ -11073,6 +12018,25 @@ var GitHubClient = class {
     }
   }
 };
+var GitHubClient = class extends ForgeClient {
+  constructor(options = {}) {
+    super(options, {
+      baseUrl: DEFAULT_API,
+      headers: { accept: "application/vnd.github+json", "x-github-api-version": "2022-11-28" }
+    });
+  }
+};
+var DEFAULT_GITLAB_HOST = "gitlab.com";
+var GITLAB_HOST = /^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/;
+var GitLabClient = class extends ForgeClient {
+  host;
+  constructor(options = {}) {
+    const host = options.host ?? DEFAULT_GITLAB_HOST;
+    if (!GITLAB_HOST.test(host)) throw new Error("a GitLab host is a lowercase DNS name");
+    super(options, { baseUrl: `https://${host}`, headers: { accept: "application/json" } });
+    this.host = host;
+  }
+};
 async function cancel(body) {
   await body?.cancel().catch(() => {
   });
@@ -11684,7 +12648,7 @@ function precisionText(precision) {
 }
 
 // src/advisory/advise.ts
-var COMPARISON_VERSION = "0.4.0";
+var COMPARISON_VERSION = "0.5.0";
 var COMPARISON = { version: COMPARISON_VERSION };
 var HEX = /^[0-9a-f]{7,40}$/;
 function blockFor(kind, value, headSha) {
@@ -11845,7 +12809,7 @@ function advisoryDigest(section) {
 
 // src/advisory/extract.ts
 var words = (list) => new Set(list);
-var phrases = (list) => list.map((phrase) => phrase.split(" "));
+var phrases = (list) => list.map((phrase2) => phrase2.split(" "));
 var V = GRAMMAR.verbs;
 var FILE_VERBS = words(V.file);
 var CLOSE_VERBS = words(V.close);
@@ -12100,7 +13064,7 @@ function clausesOf(prep) {
 }
 var ISSUE = /^(?:[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9._-]{1,100})?#[1-9][0-9]{0,9}$/;
 var ISSUE_URL = /^https?:\/\/github\.com\/([A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9._-]{1,100})\/(?:issues|pull)\/([1-9][0-9]{0,9})\/?$/;
-var TIMESTAMP = /^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]+)?Z$/;
+var TIMESTAMP2 = /^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]+)?Z$/;
 function repoPath(token, inCode) {
   const path = token.replace(/^\.\//, "").replace(/(?::[0-9]+){1,2}$/, "").replace(/\([0-9]+(?:,[0-9]+)?\)?$/, "");
   if (!/^\.?[A-Za-z0-9_][A-Za-z0-9_.+/-]*$/.test(path)) return void 0;
@@ -12128,7 +13092,7 @@ function classify(word) {
   if (word.atom === "code" && /\s/.test(word.text)) return { cls: "word" };
   const t = word.text;
   if (ISSUE.test(t)) return { cls: "issue", value: t };
-  if (TIMESTAMP.test(t)) return { cls: "timestamp", value: t };
+  if (TIMESTAMP2.test(t)) return { cls: "timestamp", value: t };
   if (/^[0-9a-fA-F]{7,40}$/.test(t) && /[0-9]/.test(t) && /[a-fA-F]/.test(t)) {
     return { cls: "sha", value: t.toLowerCase() };
   }
@@ -12156,7 +13120,7 @@ var Clause = class {
   }
   // One of the phrases starts at k.
   phraseAt(k, list) {
-    return list.some((phrase) => phrase.every((w, n) => this.lower(k + n) === w));
+    return list.some((phrase2) => phrase2.every((w, n) => this.lower(k + n) === w));
   }
   // One of the phrases starts at or after `from` and before `to`.
   holds(list, from = 0, to = this.words.length) {
@@ -12193,7 +13157,7 @@ var Clause = class {
   // An analogue phrase starts at k and ends before j.
   analogue(k, j) {
     return ANALOGUES.some(
-      (phrase) => k + phrase.length <= j && phrase.every((w, n) => this.lower(k + n) === w)
+      (phrase2) => k + phrase2.length <= j && phrase2.every((w, n) => this.lower(k + n) === w)
     );
   }
   // The nearest verb to the left of j, if no negation, modal or infinitive stands between, and it
@@ -13071,7 +14035,7 @@ function lookup(type, evidence) {
   }
   return { entries, duplicates };
 }
-var ISSUE_REF2 = /^(?:[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9._-]{1,100})?#[1-9][0-9]{0,9}$/;
+var ISSUE_REF3 = /^(?:[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9._-]{1,100})?#[1-9][0-9]{0,9}$/;
 function combinedCandidates(typed, floor) {
   const exact = typed.filter((c) => c.score === null);
   return exact.length > 0 ? exact : typed.filter((c) => c.score !== null && c.score >= floor);
@@ -13145,7 +14109,7 @@ function checkReaderClaim(claim2, evidence, repository) {
     return unverifiable2("no_comparable_record_field");
   }
   if (claim2.kind === "reference_closes") {
-    if (!ISSUE_REF2.test(declared)) return unverifiable2("no_comparable_record_field");
+    if (!ISSUE_REF3.test(declared)) return unverifiable2("no_comparable_record_field");
     const head = evidence.pullRequest.headSha;
     const row2 = checkReferences(closesBlock(declared, head), evidence, repository)[0];
     if (row2 === void 0) return unverifiable2("no_comparable_record_field");
@@ -13188,7 +14152,7 @@ function checkReaderClaim(claim2, evidence, repository) {
     case "timeline_event": {
       const ref = declared;
       const events = observed;
-      const match = ISSUE_REF2.test(ref) ? events.find((e) => e.ref !== void 0 && sameIssue(qualifyIssue(ref, repository), e.ref)) : void 0;
+      const match = ISSUE_REF3.test(ref) ? events.find((e) => e.ref !== void 0 && sameIssue(qualifyIssue(ref, repository), e.ref)) : void 0;
       return match === void 0 ? unverifiable2("declared_item_not_among_candidates") : verdictOf("pass", { event: match.event, ref: match.ref ?? null });
     }
     case "check_run": {
@@ -13277,7 +14241,7 @@ function claimsFor(block, evidence, repository) {
 function statementSubjects(block, subject) {
   const subjects = [
     {
-      name: `git+https://github.com/${subject.repository}@${subject.headSha}`,
+      name: `git+https://${subject.forge?.host ?? "github.com"}/${subject.repository}@${subject.headSha}`,
       digest: { gitCommit: subject.headSha }
     }
   ];
@@ -13301,6 +14265,7 @@ function buildRecord(input2) {
     headSha: pr.headSha,
     mergeSha: pr.mergeSha
   };
+  if (input2.forge !== void 0) subject.forge = { kind: input2.forge.kind, host: input2.forge.host };
   const claims = claimsFor(block, evidence, repository);
   const readerClaims = input2.readerClaims?.map((c) => readReaderClaim(c, evidence, repository));
   const advisory = input2.advisory === void 0 ? void 0 : advisorySection(input2.advisory, evidence, repository, input2.pathsAtHead ?? []);
@@ -13325,6 +14290,13 @@ function buildRecord(input2) {
       assurance: input2.assurance ?? { status: "unsigned", issuer: "self-generated" }
     }
   };
+  if (input2.forge !== void 0) {
+    if (readerClaims !== void 0 || advisory !== void 0) {
+      throw new Error("a GitLab record carries no reader claims or advisories in this draft");
+    }
+    record2.predicateType = GITLAB_DRAFT_PREDICATE_TYPE;
+    record2.predicate.spec = GITLAB_DRAFT_SPEC_VERSION;
+  }
   if (readerClaims !== void 0 || advisory !== void 0) {
     record2.predicateType = DRAFT_PREDICATE_TYPE;
     record2.predicate.spec = DRAFT_SPEC_VERSION;
@@ -13353,6 +14325,16 @@ function githubReaders(client) {
     restart: () => client.sources.clear()
   };
 }
+function gitlabReaders(client) {
+  return {
+    pullRequest: (project, iid, options) => readMergeRequest(client, project, iid, options),
+    evidence: (input2) => readGitLabEvidence(client, input2),
+    pathObjects: async () => {
+      throw new Error("the advisory is not read from GitLab in this draft");
+    },
+    restart: () => client.sources.clear()
+  };
+}
 async function atOnePullRequest(readers, repository, number4, first, collect) {
   let pr = first ?? await readers.pullRequest(repository, number4);
   for (let run = 1; ; run++) {
@@ -13398,7 +14380,8 @@ async function checkAt(input2, pr) {
     evidence,
     rerun: rerunCommands(input2.recordFile),
     ...input2.assurance === void 0 ? {} : { assurance: input2.assurance },
-    ...proposed === void 0 ? {} : { advisory: proposed, pathsAtHead }
+    ...proposed === void 0 ? {} : { advisory: proposed, pathsAtHead },
+    ...input2.forge === void 0 ? {} : { forge: input2.forge }
   });
 }
 
@@ -13484,10 +14467,14 @@ function line(text2) {
   return () => text2;
 }
 var decided = line(NO_REMEDY);
+function worded(key, text2) {
+  return ({ caller }) => text2(phrase(caller, key));
+}
 var REMEDIES = {
   // The block (spec section 5). No claim row carries these; the survey counts them per pull request.
-  block_missing: line(
-    "The report has no dunstan-handback block: declare the claims in one (dunstan template writes it)."
+  block_missing: worded(
+    "templateWrites",
+    (writes) => `The report has no dunstan-handback block: declare the claims in one (${writes}).`
   ),
   block_ambiguous: line("The report has more than one dunstan-handback block: keep exactly one."),
   block_invalid: line(
@@ -13495,14 +14482,20 @@ var REMEDIES = {
   ),
   // Unverifiable, a tests row: the record holds no count to compare, or could not read it. These are
   // TESTS_REMEDY_REASONS, the lines the claims table prints under a tests row.
-  record_not_found: line(
-    `no run of the named workflow at the head uploaded that artifact from that job. Publish the JUnit record from CI (${RECIPE}), then check that the record's workflow, job, artifact and path are the ones the run used: dunstan template --tests-ci fills them.`
+  record_not_found: worded(
+    "templateCiFills",
+    (fills) => `no run of the named workflow at the head uploaded that artifact from that job. Publish the JUnit record from CI (${RECIPE}), then check that the record's workflow, job, artifact and path are the ones the run used: ${fills}.`
   ),
   no_comparable_record_field: line(
     `this record's kind has nothing Dunstan can compare. Name a junit record a CI run uploaded (${RECIPE}); for a run that left no record in CI, declare {"kind": "local"}.`
   ),
-  local_run_not_in_record: line(
-    `these counts are from a local run. Publish the JUnit record from CI (${RECIPE}), and run dunstan template --tests-ci after CI has finished on your last push.`
+  local_run_not_in_record: worded(
+    "templateCiAfter",
+    (after) => `these counts are from a local run. Publish the JUnit record from CI (${RECIPE}), and ${after}.`
+  ),
+  // Spec 0.1.10: the pull request changed the workflow that wrote the record.
+  record_producer_changed_by_pr: line(
+    "This pull request changes the workflow that produced the test record, so the record is its own evidence. Land the workflow change separately, then declare the counts."
   ),
   "source_unreadable:artifact": ({ hasToken }) => hasToken ? "the run uploaded the record, but it could not be read: it expired, was uploaded outside the latest attempt of the named job, the job had not completed, or the file is not well-formed JUnit. Re-run the job to upload it again, or check again once the job completes." : "GitHub answers an artifact download only with a token (401 without one, even on a public repository). Check again with GITHUB_TOKEN set to a token that can read the repository, with actions: read.",
   // Unverifiable, any other row: the record could not settle the claim.
@@ -13558,6 +14551,7 @@ var TESTS_REMEDY_REASONS = [
   "record_not_found",
   "no_comparable_record_field",
   "local_run_not_in_record",
+  "record_producer_changed_by_pr",
   "source_unreadable:artifact"
 ];
 function remedyForReason(reason, context) {
@@ -13674,7 +14668,7 @@ async function signingAssurance(signKey, signer) {
   return { status: "signed", issuer: signer, keyFingerprint: keyFingerprint(signKey) };
 }
 function defaultRecordFile(repository, number4) {
-  return `dunstan-${repository.replace("/", "-")}-${number4}.json`;
+  return `dunstan-${repository.replaceAll("/", "-")}-${number4}.json`;
 }
 async function check(args, io) {
   const { values } = parseArgs({
@@ -13691,9 +14685,17 @@ async function check(args, io) {
       "sign-key": { type: "string" },
       signer: { type: "string" },
       "exclude-check-run": { type: "string", multiple: true },
-      advisory: { type: "boolean" }
+      "exclude-gitlab-job": { type: "string", multiple: true },
+      advisory: { type: "boolean" },
+      "gitlab-project": { type: "string" },
+      mr: { type: "string" },
+      "gitlab-host": { type: "string" },
+      "report-mr-description": { type: "boolean" }
     }
   });
+  if (values["gitlab-project"] !== void 0 || values.mr !== void 0 || values["gitlab-host"] !== void 0 || values["report-mr-description"] === true || values["exclude-gitlab-job"] !== void 0) {
+    return checkGitLab(values, io);
+  }
   if (values.repo === void 0 || !REPOSITORY.test(values.repo)) {
     throw new UsageError("--repo <owner/name> is required");
   }
@@ -13739,7 +14741,75 @@ async function check(args, io) {
     advisory: values.advisory === true
   });
   writeFileSync(out, serializeRecord(record2));
-  io.out(renderRecord(record2, { hasToken: client.hasToken }));
+  io.out(renderRecord(record2, { hasToken: client.hasToken, caller: "cli" }));
+  io.out(`record: ${out}
+`);
+  if (assurance !== void 0) {
+    io.out(`signature: ${signRecordFile(out, values["sign-key"])}
+`);
+  }
+  return exitFor(record2.predicate.verdict);
+}
+async function checkGitLab(values, io) {
+  const refused = [
+    ["--repo", values.repo !== void 0],
+    ["--pr", values.pr !== void 0],
+    ["--report-pr-body (use --report-mr-description)", values["report-pr-body"] === true],
+    ["--report-comment-author", values["report-comment-author"] !== void 0],
+    ["--exclude-check-run", values["exclude-check-run"] !== void 0],
+    ["--advisory", values.advisory === true]
+  ];
+  const named = refused.filter(([, given]) => given).map(([flag]) => flag);
+  if (named.length > 0) {
+    throw new UsageError(`a GitLab merge request is checked without ${named.join(", ")}`);
+  }
+  const project = values["gitlab-project"];
+  if (project === void 0 || !GITLAB_PROJECT.test(project)) {
+    throw new UsageError(
+      "--gitlab-project <namespace/project> is required: the project's full path, group/subgroup/.../project"
+    );
+  }
+  if (values.mr === void 0) throw new UsageError("--mr <iid> is required");
+  const iid = parsePositiveInt(values.mr, "--mr");
+  const host = values["gitlab-host"] ?? DEFAULT_GITLAB_HOST;
+  if (!GITLAB_HOST.test(host)) {
+    throw new UsageError("--gitlab-host is a lowercase host name, such as gitlab.example.com");
+  }
+  const file2 = values["report-file"];
+  if (file2 !== void 0 === (values["report-mr-description"] === true)) {
+    throw new UsageError(
+      "name exactly one report: --report-file <path|-> or --report-mr-description"
+    );
+  }
+  const excluded = (values["exclude-gitlab-job"] ?? []).map(
+    (v) => parsePositiveInt(v, "--exclude-gitlab-job")
+  );
+  const assurance = await signingAssurance(values["sign-key"], values.signer);
+  const client = new GitLabClient({
+    host,
+    token: io.env.GITLAB_TOKEN,
+    ...io.fetch === void 0 ? {} : { fetch: io.fetch },
+    warn: (message) => io.err(`dunstan: ${message}
+`)
+  });
+  if (!client.hasToken) io.err("dunstan: GITLAB_TOKEN is not set; reading anonymously\n");
+  const out = values.out ?? defaultRecordFile(project, iid);
+  const record2 = await checkPullRequest({
+    readers: gitlabReaders(client),
+    repository: project,
+    number: iid,
+    report: async (pr) => {
+      if (file2 === void 0) return reportFromMergeRequestDescription(pr);
+      return file2 === "-" ? { bytes: io.readStdin(), source: { kind: "stdin", locator: "stdin" } } : { bytes: readFileSync3(file2), source: { kind: "file", locator: file2 } };
+    },
+    excludedCheckRunIds: excluded,
+    checker: checkerIdentity(io.artifact),
+    recordFile: basename(out),
+    ...assurance === void 0 ? {} : { assurance },
+    forge: { kind: "gitlab", host }
+  });
+  writeFileSync(out, serializeRecord(record2));
+  io.out(renderRecord(record2, { hasToken: client.hasToken, caller: "cli" }));
   io.out(`record: ${out}
 `);
   if (assurance !== void 0) {
@@ -13991,7 +15061,7 @@ __export(external_exports, {
   includes: () => _includes,
   input: () => input,
   instanceof: () => _instanceof,
-  int: () => int2,
+  int: () => int3,
   int32: () => int32,
   int64: () => int64,
   intersection: () => intersection,
@@ -14585,8 +15655,8 @@ function defineLazy(object3, key, getter) {
     configurable: true
   });
 }
-function objectClone(obj2) {
-  return Object.create(Object.getPrototypeOf(obj2), Object.getOwnPropertyDescriptors(obj2));
+function objectClone(obj3) {
+  return Object.create(Object.getPrototypeOf(obj3), Object.getOwnPropertyDescriptors(obj3));
 }
 function assignProp(target, prop, value) {
   Object.defineProperty(target, prop, {
@@ -14657,10 +15727,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj2, path) {
+function getElementAtPath(obj3, path) {
   if (!path)
-    return obj2;
-  return path.reduce((acc, key) => acc?.[key], obj2);
+    return obj3;
+  return path.reduce((acc, key) => acc?.[key], obj3);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -14675,14 +15745,14 @@ function promiseAllObject(promisesObj) {
 }
 function randomString(length = 10) {
   const chars = "abcdefghijklmnopqrstuvwxyz";
-  let str3 = "";
+  let str4 = "";
   for (let i = 0; i < length; i++) {
-    str3 += chars[Math.floor(Math.random() * chars.length)];
+    str4 += chars[Math.floor(Math.random() * chars.length)];
   }
-  return str3;
+  return str4;
 }
-function esc(str3) {
-  return JSON.stringify(str3);
+function esc(str4) {
+  return JSON.stringify(str4);
 }
 function slugify(input2) {
   return input2.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
@@ -14796,8 +15866,8 @@ var primitiveTypes = /* @__PURE__ */ new Set([
   "symbol",
   "undefined"
 ]);
-function escapeRegex(str3) {
-  return str3.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function escapeRegex(str4) {
+  return str4.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function clone(inst, def, params) {
   const cl = new inst._zod.constr(def ?? inst._zod.def);
@@ -15051,13 +16121,13 @@ function getSizableOrigin(input2) {
   return "unknown";
 }
 var highSurrogate = /[\uD800-\uDBFF]/;
-function codePointLength(str3) {
-  const units = str3.length;
-  if (!highSurrogate.test(str3))
+function codePointLength(str4) {
+  const units = str4.length;
+  if (!highSurrogate.test(str4))
     return units;
   let count = units;
   for (let i = 0; i < units - 1; i++) {
-    if ((str3.charCodeAt(i) & 64512) === 55296 && (str3.charCodeAt(i + 1) & 64512) === 56320) {
+    if ((str4.charCodeAt(i) & 64512) === 55296 && (str4.charCodeAt(i + 1) & 64512) === 56320) {
       count--;
       i++;
     }
@@ -15084,9 +16154,9 @@ function parsedType(data) {
       if (Array.isArray(data)) {
         return "array";
       }
-      const obj2 = data;
-      if (obj2 && Object.getPrototypeOf(obj2) !== Object.prototype && "constructor" in obj2 && obj2.constructor) {
-        return obj2.constructor.name;
+      const obj3 = data;
+      if (obj3 && Object.getPrototypeOf(obj3) !== Object.prototype && "constructor" in obj3 && obj3.constructor) {
+        return obj3.constructor.name;
       }
     }
   }
@@ -15104,8 +16174,8 @@ function issue(...args) {
   }
   return { ...iss };
 }
-function cleanEnum(obj2) {
-  return Object.entries(obj2).filter(([k, _]) => {
+function cleanEnum(obj3) {
+  return Object.entries(obj3).filter(([k, _]) => {
     return Number.isNaN(Number.parseInt(k, 10));
   }).map((el) => el[1]);
 }
@@ -15430,15 +16500,15 @@ var $ZodError = $constructor("$ZodError", initializer);
 var $ZodRealError = $constructor("$ZodError", initializer, void 0, {
   Parent: Error
 });
-function node(obj2, key, make) {
-  if (!Object.prototype.hasOwnProperty.call(obj2, key)) {
+function node(obj3, key, make) {
+  if (!Object.prototype.hasOwnProperty.call(obj3, key)) {
     if (key === "__proto__") {
-      Object.defineProperty(obj2, key, { value: make(), writable: true, enumerable: true, configurable: true });
+      Object.defineProperty(obj3, key, { value: make(), writable: true, enumerable: true, configurable: true });
     } else {
-      obj2[key] = make();
+      obj3[key] = make();
     }
   }
-  return obj2[key];
+  return obj3[key];
 }
 function flattenError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = {};
@@ -30879,7 +31949,7 @@ __export(schemas_exports2, {
   httpUrl: () => httpUrl,
   iban: () => iban2,
   instanceof: () => _instanceof,
-  int: () => int2,
+  int: () => int3,
   int32: () => int32,
   int64: () => int64,
   intersection: () => intersection,
@@ -31623,10 +32693,10 @@ var ZodNumber = /* @__PURE__ */ $constructor(
       return this.check(_lte(value, params));
     },
     int(params) {
-      return this.check(int2(params));
+      return this.check(int3(params));
     },
     safe(params) {
-      return this.check(int2(params));
+      return this.check(int3(params));
     },
     positive(params) {
       return this.check(_gt(0, params));
@@ -31658,7 +32728,7 @@ var ZodNumberFormat = /* @__PURE__ */ $constructor("ZodNumberFormat", (inst, def
   $ZodNumberFormat.init(inst, def);
   ZodNumber.init(inst, def);
 });
-function int2(params) {
+function int3(params) {
   return _int(ZodNumberFormat, params);
 }
 function float32(params) {
@@ -35161,26 +36231,26 @@ var util;
   }
   util2.assertNever = assertNever2;
   util2.arrayToEnum = (items) => {
-    const obj2 = {};
+    const obj3 = {};
     for (const item of items) {
-      obj2[item] = item;
+      obj3[item] = item;
     }
-    return obj2;
+    return obj3;
   };
-  util2.getValidEnumValues = (obj2) => {
-    const validKeys = util2.objectKeys(obj2).filter((k) => typeof obj2[obj2[k]] !== "number");
+  util2.getValidEnumValues = (obj3) => {
+    const validKeys = util2.objectKeys(obj3).filter((k) => typeof obj3[obj3[k]] !== "number");
     const filtered = {};
     for (const k of validKeys) {
-      filtered[k] = obj2[k];
+      filtered[k] = obj3[k];
     }
     return util2.objectValues(filtered);
   };
-  util2.objectValues = (obj2) => {
-    return util2.objectKeys(obj2).map(function(e) {
-      return obj2[e];
+  util2.objectValues = (obj3) => {
+    return util2.objectKeys(obj3).map(function(e) {
+      return obj3[e];
     });
   };
-  util2.objectKeys = typeof Object.keys === "function" ? (obj2) => Object.keys(obj2) : (object3) => {
+  util2.objectKeys = typeof Object.keys === "function" ? (obj3) => Object.keys(obj3) : (object3) => {
     const keys = [];
     for (const key in object3) {
       if (Object.prototype.hasOwnProperty.call(object3, key)) {
@@ -35189,8 +36259,8 @@ var util;
     }
     return keys;
   };
-  util2.find = (arr2, checker) => {
-    for (const item of arr2) {
+  util2.find = (arr3, checker) => {
+    for (const item of arr3) {
       if (checker(item))
         return item;
     }
@@ -35210,10 +36280,10 @@ var util;
 })(util || (util = {}));
 var objectUtil;
 (function(objectUtil2) {
-  objectUtil2.mergeShapes = (first, second2) => {
+  objectUtil2.mergeShapes = (first, second3) => {
     return {
       ...first,
-      ...second2
+      ...second3
       // second overwrites first
     };
   };
@@ -38145,11 +39215,11 @@ var ZodRecord2 = class _ZodRecord extends ZodType2 {
   get element() {
     return this._def.valueType;
   }
-  static create(first, second2, third) {
-    if (second2 instanceof ZodType2) {
+  static create(first, second3, third) {
+    if (second3 instanceof ZodType2) {
       return new _ZodRecord({
         keyType: first,
-        valueType: second2,
+        valueType: second3,
         typeName: ZodFirstPartyTypeKind2.ZodRecord,
         ...processCreateParams(third)
       });
@@ -38158,7 +39228,7 @@ var ZodRecord2 = class _ZodRecord extends ZodType2 {
       keyType: ZodString2.create(),
       valueType: first,
       typeName: ZodFirstPartyTypeKind2.ZodRecord,
-      ...processCreateParams(second2)
+      ...processCreateParams(second3)
     });
   }
 };
@@ -42307,7 +43377,7 @@ function validateToolName(name) {
     warnings.push("Tool name starts or ends with a dot, which may cause parsing issues in some contexts");
   }
   if (!TOOL_NAME_REGEX.test(name)) {
-    const invalidChars = name.split("").filter((char) => !/[A-Za-z0-9._-]/.test(char)).filter((char, index, arr2) => arr2.indexOf(char) === index);
+    const invalidChars = name.split("").filter((char) => !/[A-Za-z0-9._-]/.test(char)).filter((char, index, arr3) => arr3.indexOf(char) === index);
     warnings.push(`Tool name contains invalid characters: ${invalidChars.map((c) => `"${c}"`).join(", ")}`, "Allowed characters are: A-Z, a-z, 0-9, underscore (_), dash (-), and dot (.)");
     return {
       isValid: false,
@@ -42448,8 +43518,8 @@ var McpServer = class {
           title: tool.title,
           description: tool.description,
           inputSchema: (() => {
-            const obj2 = normalizeObjectSchema(tool.inputSchema);
-            return obj2 ? toJsonSchemaCompat(obj2, {
+            const obj3 = normalizeObjectSchema(tool.inputSchema);
+            return obj3 ? toJsonSchemaCompat(obj3, {
               strictUnions: true,
               pipeStrategy: "input"
             }) : EMPTY_OBJECT_JSON_SCHEMA;
@@ -42459,9 +43529,9 @@ var McpServer = class {
           _meta: tool._meta
         };
         if (tool.outputSchema) {
-          const obj2 = normalizeObjectSchema(tool.outputSchema);
-          if (obj2) {
-            toolDefinition.outputSchema = toJsonSchemaCompat(obj2, {
+          const obj3 = normalizeObjectSchema(tool.outputSchema);
+          if (obj3) {
+            toolDefinition.outputSchema = toJsonSchemaCompat(obj3, {
               strictUnions: true,
               pipeStrategy: "output"
             });
@@ -43114,20 +44184,20 @@ var EMPTY_OBJECT_JSON_SCHEMA = {
 function isZodTypeLike(value) {
   return value !== null && typeof value === "object" && "parse" in value && typeof value.parse === "function" && "safeParse" in value && typeof value.safeParse === "function";
 }
-function isZodSchemaInstance(obj2) {
-  return "_def" in obj2 || "_zod" in obj2 || isZodTypeLike(obj2);
+function isZodSchemaInstance(obj3) {
+  return "_def" in obj3 || "_zod" in obj3 || isZodTypeLike(obj3);
 }
-function isZodRawShapeCompat(obj2) {
-  if (typeof obj2 !== "object" || obj2 === null) {
+function isZodRawShapeCompat(obj3) {
+  if (typeof obj3 !== "object" || obj3 === null) {
     return false;
   }
-  if (isZodSchemaInstance(obj2)) {
+  if (isZodSchemaInstance(obj3)) {
     return false;
   }
-  if (Object.keys(obj2).length === 0) {
+  if (Object.keys(obj3).length === 0) {
     return true;
   }
-  return Object.values(obj2).some(isZodTypeLike);
+  return Object.values(obj3).some(isZodTypeLike);
 }
 function getZodSchemaObject(schema) {
   if (!schema) {
@@ -43343,26 +44413,27 @@ function unsettled(reason, why, remedy) {
   return { status: "unsettled", reason, notes };
 }
 async function testsFromCi(client, input2) {
-  const { repository, headCommit: head, record: record2 } = input2;
+  const { repository, headCommit: head, record: record2, caller } = input2;
+  const againCi = phrase(caller, "againCi");
   if (!client.hasToken) {
     return unsettled(
       "no_token",
       "GITHUB_TOKEN is not set, and GitHub answers an artifact download only with a token, even on a public repository",
-      "set GITHUB_TOKEN to a token that can read the repository, with actions: read, and run dunstan template --tests-ci again."
+      `set GITHUB_TOKEN to a token that can read the repository, with actions: read, and ${againCi}.`
     );
   }
   if (!input2.pushed) {
     return unsettled(
       "not_pushed",
       `HEAD ${head} is not on any remote-tracking branch, so no CI run can have tested it`,
-      "push it, wait for CI to finish, and run dunstan template --tests-ci again (run git fetch first if it was pushed from elsewhere)."
+      `push it, wait for CI to finish, and ${againCi} (run git fetch first if it was pushed from elsewhere).`
     );
   }
   const observed = { runsNotCompleted: 0 };
   const evidence = await readTestRecord(client, repository, record2, head, observed);
   const named = `the artifact ${record2.artifact} holding ${record2.path} from job ${record2.job}`;
   const pending = observed.runsNotCompleted > 0 ? `CI has not finished: ${plural2(observed.runsNotCompleted, "run", "runs")} of ${record2.workflow} at ${head} ${observed.runsNotCompleted === 1 ? "is" : "are"} not completed` : void 0;
-  const again = "run dunstan template --tests-ci again once CI has finished on this commit.";
+  const again = `${againCi} once CI has finished on this commit.`;
   if (evidence.status !== "ok") {
     const reason = evidence.status === "unreadable" ? `source_unreadable:${evidence.source}` : `evidence_field_unpopulated:${evidence.field}`;
     if (pending !== void 0) return unsettled(reason, pending, again);
@@ -43370,7 +44441,7 @@ async function testsFromCi(client, input2) {
     return unsettled(
       reason,
       why,
-      remedyForReason(reason, { hasToken: true }) ?? "run dunstan template --tests-ci again."
+      remedyForReason(reason, { hasToken: true, caller }) ?? `${againCi}.`
     );
   }
   if (evidence.runs.length === 0) {
@@ -43384,7 +44455,7 @@ async function testsFromCi(client, input2) {
     return unsettled(
       "record_not_found",
       `no run of ${record2.workflow} at ${head} uploaded ${named}`,
-      remedyForReason("record_not_found", { hasToken: true })
+      remedyForReason("record_not_found", { hasToken: true, caller })
     );
   }
   const executed = new Set(evidence.runs.map((r) => r.executed));
@@ -43404,7 +44475,7 @@ async function testsFromCi(client, input2) {
   ];
   if (pending !== void 0) {
     notes.push(
-      `${pending}; a run that finishes later with other counts makes the gate's read ambiguous. Run dunstan template --tests-ci again once CI has finished.`
+      `${pending}; a run that finishes later with other counts makes the gate's read ambiguous. ${phrase(caller, "againCiSentence")} once CI has finished.`
     );
   }
   return {
@@ -43435,7 +44506,7 @@ async function testsSource(request, context) {
     };
   }
   const head = headCommit(cwd);
-  const repository = tests.repository ?? originRepository(cwd);
+  const repository = tests.repository ?? originRepository(cwd, request.caller);
   const client = new GitHubClient({
     token: context.env.GITHUB_TOKEN,
     ...context.fetch === void 0 ? {} : { fetch: context.fetch },
@@ -43446,6 +44517,7 @@ async function testsSource(request, context) {
     headCommit: head,
     command: tests.command,
     pushed: isPushed(cwd, head),
+    caller: request.caller,
     record: {
       kind: "junit",
       workflow: tests.workflow,
@@ -43458,7 +44530,7 @@ async function testsSource(request, context) {
 }
 async function runTemplate(request, context) {
   const tests = await testsSource(request, context);
-  const t = templateBlock({ cwd: request.cwd, base: request.base, tests });
+  const t = templateBlock({ cwd: request.cwd, base: request.base, tests, caller: request.caller });
   return {
     fence: renderBlock(t.block),
     notes: t.notes,
@@ -43549,7 +44621,7 @@ function handbackResult(record2, outPath, notes, context) {
     content: [
       { type: "text", text: `${head.join("\n")}
 ` },
-      { type: "text", text: renderRecord(record2, context) },
+      { type: "text", text: renderRecord(record2, { ...context, caller: "mcp" }) },
       { type: "text", text: serializeRecord(record2) }
     ]
   };
@@ -43565,7 +44637,7 @@ async function templateHandback(input2, options) {
   }
   const warnings = [];
   const run = await runTemplate(
-    { cwd: input2.directory, base: input2.base, tests: input2.tests },
+    { cwd: input2.directory, base: input2.base, tests: input2.tests, caller: "mcp" },
     {
       env: options.env,
       fetch: options.fetch,
@@ -43743,6 +44815,132 @@ async function mcp(args, io) {
 import { existsSync as existsSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
 import { basename as basename3, resolve as resolve4 } from "node:path";
 import { parseArgs as parseArgs3 } from "node:util";
+
+// src/record/verify.ts
+function same(a, b) {
+  return canonicalize(a) === canonicalize(b);
+}
+function predicateTypeOf(value) {
+  return value !== null && typeof value === "object" ? value.predicateType : void 0;
+}
+function isDraft(value) {
+  return predicateTypeOf(value) === DRAFT_PREDICATE_TYPE;
+}
+function isGitlabRecord(value) {
+  return predicateTypeOf(value) === GITLAB_DRAFT_PREDICATE_TYPE;
+}
+function validateAnyRecord(value) {
+  if (isDraft(value)) return validateDraftRecord(value);
+  if (isGitlabRecord(value)) return validateGitlabDraftRecord(value);
+  return validateRecord(value);
+}
+function verifyRecord(value) {
+  const draft = isDraft(value);
+  const schemaErrors = validateAnyRecord(value);
+  if (schemaErrors.length > 0) {
+    return {
+      ok: false,
+      problems: schemaErrors.map((e) => ({
+        member: e.pointer,
+        message: `schema_violation (${e.keyword}): ${e.message}`
+      }))
+    };
+  }
+  const record2 = value;
+  const p = record2.predicate;
+  const problems = [];
+  const differ = (member, recorded, recomputed) => {
+    if (!same(recorded, recomputed)) {
+      problems.push({
+        member,
+        message: `recorded ${canonicalize(recorded)}, recomputed ${canonicalize(recomputed)}`
+      });
+    }
+  };
+  if (p.checker.name !== CHECKER_NAME || p.checker.version !== CHECKER_VERSION) {
+    problems.push({
+      member: "/predicate/checker",
+      message: `record was written by ${p.checker.name} ${p.checker.version}; this is ${CHECKER_NAME} ${CHECKER_VERSION}`
+    });
+    return { ok: false, problems, record: record2 };
+  }
+  if (p.block.status === "found") {
+    differ(
+      "/predicate/block/sha256",
+      p.block.sha256,
+      sha256Canonical(p.block.value)
+    );
+  }
+  const evidence = p.evidence;
+  const pr = evidence.pullRequest;
+  differ("/predicate/subject/pullRequest", p.subject.pullRequest, pr.number);
+  differ("/predicate/subject/headSha", p.subject.headSha, pr.headSha);
+  differ("/predicate/subject/mergeSha", p.subject.mergeSha, pr.mergeSha);
+  differ("/subject", record2.subject, statementSubjects(p.block, p.subject));
+  const claims = claimsFor(p.block, evidence, p.subject.repository);
+  if (!same(p.claims, claims)) {
+    const index = claims.findIndex((c, i) => !same(c, p.claims[i]));
+    const at2 = index === -1 ? claims.length : index;
+    problems.push({
+      member: `/predicate/claims/${at2}`,
+      message: `recorded ${canonicalize(p.claims[at2] ?? null)}, recomputed ${canonicalize(claims[at2] ?? null)}`
+    });
+  }
+  differ("/predicate/verdict", p.verdict, overallVerdict(p.block.status, claims));
+  differ(
+    "/predicate/digests/claims",
+    p.digests.claims,
+    claimsDigest(claims)
+  );
+  differ(
+    "/predicate/digests/evidence",
+    p.digests.evidence,
+    evidenceDigest(evidence)
+  );
+  if (draft && p.readerClaims !== void 0) {
+    p.readerClaims.forEach((claim2, i) => {
+      const { observed, verdict, reason } = claim2;
+      differ(
+        `/predicate/readerClaims/${i}`,
+        reason === void 0 ? { observed, verdict } : { observed, verdict, reason },
+        checkReaderClaim(claim2, evidence, p.subject.repository)
+      );
+    });
+    differ(
+      "/predicate/digests/readerClaims",
+      p.digests.readerClaims,
+      readerClaimsDigest(p.readerClaims)
+    );
+  }
+  if (draft && p.advisory !== void 0) {
+    const a = p.advisory;
+    const pathsAtHead = a.pathsAtHead;
+    differ("/predicate/advisory/extractor", a.extractor, EXTRACTOR);
+    differ("/predicate/advisory/comparison", a.comparison, COMPARISON);
+    differ("/predicate/advisory/precision", a.precision, precisionFor(EXTRACTOR.digest.sha256));
+    differ(
+      "/predicate/advisory/differsAccuracy",
+      a.differsAccuracy,
+      differsAccuracyFor(EXTRACTOR.digest.sha256, COMPARISON.version)
+    );
+    differ(
+      "/predicate/advisory/pathsAtHead",
+      pathsAtHead.map((answer) => answer.path),
+      pathsToRead(a.advisories, evidence, p.subject.repository)
+    );
+    a.advisories.forEach((advisory, i) => {
+      differ(
+        `/predicate/advisory/advisories/${i}`,
+        { observed: advisory.observed, note: advisory.note },
+        compareAdvisory(advisory, evidence, p.subject.repository, pathsAtHead)
+      );
+    });
+    differ("/predicate/digests/advisory", p.digests.advisory, advisoryDigest(a));
+  }
+  return { ok: problems.length === 0, problems, record: record2 };
+}
+
+// src/cli/rerun.ts
 function diffPointers(a, b, pointer = "") {
   const isObject2 = (v) => v !== null && typeof v === "object";
   if (Array.isArray(a) && Array.isArray(b)) {
@@ -43776,27 +44974,45 @@ async function rerun(args, io) {
   if (resolve4(out) === resolve4(path))
     throw new UsageError("rerun never overwrites the record it re-runs");
   const value = parseStrictJson(readFileSync5(path, "utf8"));
-  const errors = validateRecord(value);
+  const gitlab = isGitlabRecord(value);
+  const errors = gitlab ? validateGitlabDraftRecord(value) : validateRecord(value);
   if (errors.length > 0) {
     throw new UsageError(
       `${path} is not a valid record: ${errors[0]?.pointer} ${errors[0]?.message}`
     );
   }
   const old = value.predicate;
-  const client = new GitHubClient({
-    token: io.env.GITHUB_TOKEN,
-    ...io.fetch === void 0 ? {} : { fetch: io.fetch },
-    warn: (message) => io.err(`dunstan: ${message}
-`)
-  });
+  const forge = old.subject.forge;
+  if (gitlab && values["exclude-check-run"] !== void 0) {
+    throw new UsageError("a GitLab record is re-run without --exclude-check-run");
+  }
+  const warn = (message) => io.err(`dunstan: ${message}
+`);
+  const fetchOption = io.fetch === void 0 ? {} : { fetch: io.fetch };
+  let client;
+  let readers;
+  if (forge === void 0) {
+    const github = new GitHubClient({ token: io.env.GITHUB_TOKEN, ...fetchOption, warn });
+    client = github;
+    readers = githubReaders(github);
+  } else {
+    const gitlabClient = new GitLabClient({
+      host: forge.host,
+      token: io.env.GITLAB_TOKEN,
+      ...fetchOption,
+      warn
+    });
+    client = gitlabClient;
+    readers = gitlabReaders(gitlabClient);
+  }
   const oldExcluded = old.evidence.checkRuns?.status === "ok" ? old.evidence.checkRuns.excludedIds : [];
   const excluded = [...oldExcluded, ...parseCheckRunIds(values["exclude-check-run"])];
   const evidence = await atOnePullRequest(
-    githubReaders(client),
+    readers,
     old.subject.repository,
     old.subject.pullRequest,
     void 0,
-    (pr) => readEvidence(client, {
+    (pr) => readers.evidence({
       repository: old.subject.repository,
       pullRequest: pr,
       block: old.block.status === "found" ? old.block.value : null,
@@ -43809,7 +45025,8 @@ async function rerun(args, io) {
     block: old.block,
     repository: old.subject.repository,
     evidence,
-    rerun: rerunCommands(basename3(out))
+    rerun: rerunCommands(basename3(out)),
+    ...forge === void 0 ? {} : { forge }
   });
   if (existsSync2(out)) io.err(`dunstan: replacing ${out}
 `);
@@ -43832,7 +45049,7 @@ async function rerun(args, io) {
 
 `);
   }
-  io.out(renderRecord(record2, { hasToken: client.hasToken }));
+  io.out(renderRecord(record2, { hasToken: client.hasToken, caller: "cli" }));
   io.out(`record: ${out} (the original ${path} is unchanged)
 `);
   return exitFor(p.verdict);
@@ -43867,7 +45084,7 @@ import { basename as basename4 } from "node:path";
 import { parseArgs as parseArgs5 } from "node:util";
 
 // src/survey/mapping.ts
-var SURVEY_MAPPING_VERSION = "0.2";
+var SURVEY_MAPPING_VERSION = "0.3";
 var CLAIM_TYPES = [
   { type: "T1", label: "head commit" },
   { type: "T2", label: "files changed" },
@@ -43938,7 +45155,7 @@ var zero = () => ({
 });
 var byCodeUnit = (a, b) => a < b ? -1 : a > b ? 1 : 0;
 function aggregate(entries, listed2, advisory, reader) {
-  const context = { hasToken: reader.authenticated };
+  const context = { hasToken: reader.authenticated, caller: "cli" };
   const totals = zero();
   const types = new Map(CLAIM_TYPES.map((t) => [t.type, zero()]));
   const unsettled2 = /* @__PURE__ */ new Map();
@@ -44033,8 +45250,8 @@ function selectPullRequests(parameters, listed2) {
     (pr) => authors.size === 0 || pr.author !== null && authors.has(pr.author.toLowerCase())
   ).slice(0, parameters.last).map((pr) => pr.number);
 }
-function listingStop(parameters, pages, listed2) {
-  const last = pages.at(-1);
+function listingStop(parameters, pages2, listed2) {
+  const last = pages2.at(-1);
   if (last === void 0) return null;
   if (last.error !== void 0) return "listing_unreadable";
   if (selectPullRequests(parameters, listed2).length >= parameters.last) return "selection_full";
@@ -44105,18 +45322,18 @@ function rateLimited(response) {
   const s = response.status;
   return s === 429 || s === 403 && (response.headers.get("x-ratelimit-remaining") === "0" || response.headers.get("retry-after") !== null);
 }
-function str2(value) {
+function str3(value) {
   return typeof value === "string" ? value : null;
 }
 function listedOf(item) {
   if (item === null || typeof item !== "object") return null;
   const pr = item;
-  const createdAt = str2(pr.created_at);
+  const createdAt = str3(pr.created_at);
   if (typeof pr.number !== "number" || !Number.isSafeInteger(pr.number) || pr.number < 1 || createdAt === null || !/^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]+)?Z$/.test(createdAt)) {
     return null;
   }
   const user = pr.user;
-  const login = str2(user?.login);
+  const login = str3(user?.login);
   return {
     number: pr.number,
     createdAt,
@@ -44134,14 +45351,14 @@ async function readListing(client, parameters, now, pageBound) {
   }
 }
 async function readOnce(client, parameters, now, pageBound, abandonOnRepeat) {
-  const pages = [];
+  const pages2 = [];
   const pullRequests = [];
   const seen = /* @__PURE__ */ new Set();
   const done = (end) => ({
     pageBound,
-    pages,
+    pages: pages2,
     pullRequests,
-    duplicates: pages.reduce((sum, p) => sum + p.duplicates, 0),
+    duplicates: pages2.reduce((sum, p) => sum + p.duplicates, 0),
     end
   });
   for (let page = 1; page <= pageBound; page++) {
@@ -44165,9 +45382,9 @@ async function readOnce(client, parameters, now, pageBound, abandonOnRepeat) {
         entry.duplicates = appendListed(pullRequests, seen, items);
       }
     }
-    pages.push(entry);
-    if (abandonOnRepeat && entry.duplicates > 0) return { pages };
-    const end = listingStop(parameters, pages, pullRequests);
+    pages2.push(entry);
+    if (abandonOnRepeat && entry.duplicates > 0) return { pages: pages2 };
+    const end = listingStop(parameters, pages2, pullRequests);
     if (end !== null) return done(end);
   }
   return done("page_bound");
@@ -44371,7 +45588,7 @@ function renderSurveySummary(record2) {
     }
   }
   const p = a.pullRequests;
-  const context = { hasToken: record2.selection.reader.authenticated };
+  const context = { hasToken: record2.selection.reader.authenticated, caller: "cli" };
   const remedy = (reason) => remedyForReason(reason, context) ?? "";
   lines.push(
     "",
@@ -44580,7 +45797,7 @@ async function template(args, io) {
     throw new UsageError(`--${given[0]} goes with --tests-ci, --tests-local or --tests-junit`);
   }
   const run = await runTemplate(
-    { cwd: io.cwd ?? process.cwd(), base: flag("base"), tests },
+    { cwd: io.cwd ?? process.cwd(), base: flag("base"), tests, caller: "cli" },
     { env: io.env, fetch: io.fetch, warn: (message) => io.err(`dunstan: ${message}
 `) }
   );
@@ -44594,119 +45811,6 @@ async function template(args, io) {
 import { readFileSync as readFileSync7 } from "node:fs";
 import { parseArgs as parseArgs7 } from "node:util";
 
-// src/record/verify.ts
-function same(a, b) {
-  return canonicalize(a) === canonicalize(b);
-}
-function isDraft(value) {
-  return value !== null && typeof value === "object" && value.predicateType === DRAFT_PREDICATE_TYPE;
-}
-function verifyRecord(value) {
-  const draft = isDraft(value);
-  const schemaErrors = draft ? validateDraftRecord(value) : validateRecord(value);
-  if (schemaErrors.length > 0) {
-    return {
-      ok: false,
-      problems: schemaErrors.map((e) => ({
-        member: e.pointer,
-        message: `schema_violation (${e.keyword}): ${e.message}`
-      }))
-    };
-  }
-  const record2 = value;
-  const p = record2.predicate;
-  const problems = [];
-  const differ = (member, recorded, recomputed) => {
-    if (!same(recorded, recomputed)) {
-      problems.push({
-        member,
-        message: `recorded ${canonicalize(recorded)}, recomputed ${canonicalize(recomputed)}`
-      });
-    }
-  };
-  if (p.checker.name !== CHECKER_NAME || p.checker.version !== CHECKER_VERSION) {
-    problems.push({
-      member: "/predicate/checker",
-      message: `record was written by ${p.checker.name} ${p.checker.version}; this is ${CHECKER_NAME} ${CHECKER_VERSION}`
-    });
-    return { ok: false, problems, record: record2 };
-  }
-  if (p.block.status === "found") {
-    differ(
-      "/predicate/block/sha256",
-      p.block.sha256,
-      sha256Canonical(p.block.value)
-    );
-  }
-  const evidence = p.evidence;
-  const pr = evidence.pullRequest;
-  differ("/predicate/subject/pullRequest", p.subject.pullRequest, pr.number);
-  differ("/predicate/subject/headSha", p.subject.headSha, pr.headSha);
-  differ("/predicate/subject/mergeSha", p.subject.mergeSha, pr.mergeSha);
-  differ("/subject", record2.subject, statementSubjects(p.block, p.subject));
-  const claims = claimsFor(p.block, evidence, p.subject.repository);
-  if (!same(p.claims, claims)) {
-    const index = claims.findIndex((c, i) => !same(c, p.claims[i]));
-    const at2 = index === -1 ? claims.length : index;
-    problems.push({
-      member: `/predicate/claims/${at2}`,
-      message: `recorded ${canonicalize(p.claims[at2] ?? null)}, recomputed ${canonicalize(claims[at2] ?? null)}`
-    });
-  }
-  differ("/predicate/verdict", p.verdict, overallVerdict(p.block.status, claims));
-  differ(
-    "/predicate/digests/claims",
-    p.digests.claims,
-    claimsDigest(claims)
-  );
-  differ(
-    "/predicate/digests/evidence",
-    p.digests.evidence,
-    evidenceDigest(evidence)
-  );
-  if (draft && p.readerClaims !== void 0) {
-    p.readerClaims.forEach((claim2, i) => {
-      const { observed, verdict, reason } = claim2;
-      differ(
-        `/predicate/readerClaims/${i}`,
-        reason === void 0 ? { observed, verdict } : { observed, verdict, reason },
-        checkReaderClaim(claim2, evidence, p.subject.repository)
-      );
-    });
-    differ(
-      "/predicate/digests/readerClaims",
-      p.digests.readerClaims,
-      readerClaimsDigest(p.readerClaims)
-    );
-  }
-  if (draft && p.advisory !== void 0) {
-    const a = p.advisory;
-    const pathsAtHead = a.pathsAtHead;
-    differ("/predicate/advisory/extractor", a.extractor, EXTRACTOR);
-    differ("/predicate/advisory/comparison", a.comparison, COMPARISON);
-    differ("/predicate/advisory/precision", a.precision, precisionFor(EXTRACTOR.digest.sha256));
-    differ(
-      "/predicate/advisory/differsAccuracy",
-      a.differsAccuracy,
-      differsAccuracyFor(EXTRACTOR.digest.sha256, COMPARISON.version)
-    );
-    differ(
-      "/predicate/advisory/pathsAtHead",
-      pathsAtHead.map((answer) => answer.path),
-      pathsToRead(a.advisories, evidence, p.subject.repository)
-    );
-    a.advisories.forEach((advisory, i) => {
-      differ(
-        `/predicate/advisory/advisories/${i}`,
-        { observed: advisory.observed, note: advisory.note },
-        compareAdvisory(advisory, evidence, p.subject.repository, pathsAtHead)
-      );
-    });
-    differ("/predicate/digests/advisory", p.digests.advisory, advisoryDigest(a));
-  }
-  return { ok: problems.length === 0, problems, record: record2 };
-}
-
 // src/survey/verify.ts
 var text = (value) => canonicalize(value ?? null);
 function differences(a, b, pointer) {
@@ -45017,6 +46121,10 @@ usage:
                 (--report-file <path|-> | --report-pr-body | --report-comment-author <login>)
                 [--out <record.json>] [--sign-key <path> --signer <principal>]
                 [--exclude-check-run <id>]... [--advisory]
+  dunstan check --gitlab-project <namespace/project> --mr <iid> [--gitlab-host <host>]
+                (--report-file <path|-> | --report-mr-description)
+                [--out <record.json>] [--sign-key <path> --signer <principal>]
+                [--exclude-gitlab-job <id>]...
   dunstan verify <record.json> [--sig <file> --allowed-signers <file>]
   dunstan rerun <record.json> [--out <record.json>] [--exclude-check-run <id>]...
   dunstan template [--base <ref>]
@@ -45036,8 +46144,13 @@ check     reads the pull request, the named report and the evidence its block ne
           record and prints the claims table. GITHUB_TOKEN is read from the environment.
           --advisory also reads the report's prose for asserted claims and records them as
           advisories (DRAFT 0.2.0, docs/advisory.md). They never change the verdict.
-verify    offline: recomputes claims, verdict and digests from the record and compares them.
+          GitLab (DRAFT GitLab profile 0.1): --gitlab-project and --mr check a merge request on
+          gitlab.com, or on --gitlab-host; --report-mr-description reads its description.
+          GITLAB_TOKEN is optional. Checks are the head pipeline's jobs and bridges, less each
+          --exclude-gitlab-job (the checker's own job, CI_JOB_ID).
+verify   offline: recomputes claims, verdict and digests from the record and compares them.
 rerun     online: re-reads the sources for the recorded subject and block; writes a new record.
+          A GitLab record is re-read from the host it names.
 template  local git: prints a dunstan-handback block for HEAD, its files against the merge base
           with --base (default: the remote's default branch). Tests: --tests-ci reads the counts
           at HEAD from the CI record check reads (artifact dunstan-junit, file junit.xml unless