NORTHSET
Proof-of-Pass Receipt
Receipt ID M-004
ISSUE / WORKNo issue or pull request recorded
REHEARSAL — NOT EXTERNAL VALIDATION
RUN8.8s
01 / TECHNICAL RESULT
Technical result
declared command passed
1/1 declared command returned exit 0 in the recorded environment
- Upstream
- PREPAREDmutable external state
- Environment
- node@sha256:8f693eaa7e0a8e71560c9a82b55fd54c2ae920a2ba5d2cde28bac7d1c01c9ba5network phaseA:bridge,phaseB:none
- Signature
- not attestedNo verified signing record is present.
02 / DECLARED CHECKS
Command evidence
Execution summary
1/1 declared command returned exit 0 in the recorded environment
node --test test/v-rehearsal-sample.test.mjsexit 0 · 0.4s
unclassified executor time (derived residual) 8.4s
run wall (derived from recorded timestamps) 8.8s
Every command listed returned exit 0 in the declared environment. Only the listed commands are in scope. Unlisted test, lint, typecheck, build, coverage, compiler, full-suite, and CI gates are not implied or recorded.
03 / RECORDED IDENTITIES
Compact hashes
- Patch diff SHA-256
sha256:7d5557…d4b69f4- Container image digest
node@sha256:8f693e…01c9ba5- Immutable image ID
sha256:197941…0bb1d4d- Bundle contents digest
sha256:49fe27…397695a
04 / PUBLIC SCOPE INTERPRETATION
Public scope interpretation
Self-authorized V-lane rehearsal on Northset's own repository, executed through the production Docker executor path; not a real external maintainer request. No pull request was opened and the receipt remains unpublished.
05 / CLAIMS BOUNDARY
NOT INCLUDED
- REHEARSAL — NOT EXTERNAL VALIDATION.
- Self-authorized on Northset's own repository; not a real external maintainer request or external maintainer verification.
- Executed through the production Docker executor path. This local rehearsal does not establish that the foreign-code deployment preconditions are satisfied on a production host.
- The recorded patch stands in for a small Northset-authored pull request change; no pull request was opened.
- Does not prove code quality
- Does not prove security
06 / Evidence annexTechnical · provenance · full recorded values
01Technical evidence
Code, full environment, patch, and redacted outputs
Technical evidence
Code, full environment, patch, and redacted outputsProject
northset-oss/verification-pilot
Work
No issue or pull request recorded
Verification execution
runtime: northset-oss production Docker executor v1
human operator: Northset
Code
- base
9b6c1f38b0cc63c4bd59520cd462030c8b917805- patch diff SHA-256
sha256:7d5557…d4b69f4
bound to executed patch bytes
Environment
- image reference
- node@sha256:8f693eaa7e0a8e71560c9a82b55fd54c2ae920a2ba5d2cde28bac7d1c01c9ba5
- repository digest
node@sha256:8f693e…01c9ba5- immutable image ID
sha256:197941…0bb1d4d- platform
- linux/arm64
- network
- phaseA:bridge,phaseB:none
Committed patch.diff
diff --git a/test/v-rehearsal-sample.test.mjs b/test/v-rehearsal-sample.test.mjs
new file mode 100644
--- /dev/null
+++ b/test/v-rehearsal-sample.test.mjs
@@ -0,0 +1,28 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { validatePublicConsent } from '../lib/bundle.mjs';
+
+const mission = {
+ mission_id: 'M-004',
+ variant: 'V',
+ consent_artifact: 'https://github.com/northset-oss/verification-pilot/blob/main/missions/M-004/consent.json',
+};
+
+const consent = {
+ schema_version: 1,
+ mission_id: mission.mission_id,
+ variant: mission.variant,
+ consent_artifact: mission.consent_artifact,
+ granted_at: '2026-07-21T12:00:00Z',
+ granted_by: 'northset-oss repository owner (self-authorization)',
+ publication_consent: true,
+ scope: [
+ 'run the declared node:test verification check',
+ 'prepare the unpublished sample receipt',
+ ],
+};
+
+test('self-authorized V rehearsal consent binds to its mission', () => {
+ assert.deepEqual(validatePublicConsent(consent, mission), { valid: true, errors: [] });
+});
Redacted stdout
=== cmd 1: node --test test/v-rehearsal-sample.test.mjs ===
TAP version 13
# Subtest: self-authorized V rehearsal consent binds to its mission
ok 1 - self-authorized V rehearsal consent binds to its mission
---
duration_ms: 1.455167
...
1..1
# tests 1
# suites 0
# pass 1
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 108.267667
Redacted stderr
=== cmd 1: node --test test/v-rehearsal-sample.test.mjs ===
02Provenance & record
Full hashes, bundle identity, attestation, and record details
Provenance & record
Full hashes, bundle identity, attestation, and record detailsRecord details
- payment
- none · not merge-contingent
- redactions
- none recorded
- Bundle contents digest
sha256:49fe27…397695a- Signed asset SHA-256
not recorded- Signed provenance recorded
- not verified
Full cryptographic values
Full recorded values. The compact receipt above shortens these for legibility only.
- Patch diff SHA-256
sha256:7d555727a0b7e0d3c8832b0392c767489f71282e73349fd700d386e73d4b69f4- Container image digest
node@sha256:8f693eaa7e0a8e71560c9a82b55fd54c2ae920a2ba5d2cde28bac7d1c01c9ba5- Immutable image ID
sha256:197941e0d0b6415af3939acdf594cf7af7dfe2f6ca5e014dddde1461f0bb1d4d- Bundle contents digest
sha256:49fe27d115dca83adab4188be47b81e7932353563174f56573e0dc35e397695a
Signed bundle
Attestation URL was not recorded.
QR → receipt page