{
  "schema_version": 1,
  "generated_at": "2026-07-16T22:49:40.312Z",
  "receipt_id": "M-011",
  "receipt_result": "PASS — 1/1 declared command",
  "passed_commands": 1,
  "declared_commands": 1,
  "timestamps": {
    "started_at": "2026-07-12T20:03:40.048Z",
    "finished_at": "2026-07-12T20:04:34.428Z"
  },
  "commands": [
    {
      "cmd": "npm run test-unit",
      "exit_code": 0,
      "timed_out": false,
      "duration_ms": 5862
    }
  ],
  "environment": {
    "container_image_ref": "node:22-bookworm",
    "container_image_digest": "node@sha256:a25c9934ff6382cd4f08b6bc26c82bf4ea69b1e6f8dabfb2ead457374127c365",
    "container_image_id": null,
    "container_os": null,
    "container_architecture": null,
    "network_policy": "phaseA:bridge,phaseB:none",
    "source_commit": "c51c2cd36f6a14e32fa305a164ccded7c250612a",
    "install_commands": [
      "npm_config_cache=/workspace/.npmcache npm install --no-audit --no-fund --loglevel=error",
      "npm run test-unit"
    ]
  },
  "code": {
    "base_commit": "c51c2cd36f6a14e32fa305a164ccded7c250612a",
    "recorded_patch_commit": "e345d993c4d2e1ad54e7367e38e07bcc283ccbca",
    "patch_commit_binding": "declared metadata; not execution-bound",
    "patch_diff_hash": "sha256:a42626ab3db4f7f1e5ab68068b2818e3f4c522092c54b786c671a3e969c3ebbf",
    "patch_diff_binding": "bound to executed patch bytes"
  },
  "execution_summary": "1/1 declared command returned exit 0 in the recorded environment",
  "bundle": {
    "bundle_contents_digest": "sha256:553f6250fb4c7ced453ec2e9bba65dd6634be17e0608f8ab8480893b4e67bc72",
    "signed_asset_sha256": "sha256:5b5e4910280b590f9669865161086644cf9f04178229e4f7c25be20d331f7935",
    "attestation_uri": "https://github.com/northset-oss/verification-pilot/releases/download/run-record-M-011/run-record-M-011.tar.gz",
    "attestation_verified_at": "2026-07-14T14:21:48Z",
    "provenance": "Signed provenance recorded; the signer records artifact origin, not execution witnessing or maintainer approval."
  },
  "classification": "CONTRIBUTOR SELF-RUN — NOT MAINTAINER VERIFICATION",
  "links": {
    "canonical_url": "https://northset-oss.github.io/verification-pilot/receipts/M-011/",
    "target_repo": "https://github.com/prometheus/client_js",
    "issue_or_task": "https://github.com/prometheus/client_js/issues/539",
    "publication_pr": "https://github.com/prometheus/client_js/pull/771"
  },
  "issue_title": "Cluster should always aggregate metrics in a same order",
  "limitations": [
    "Does not prove code quality",
    "Does not prove security",
    "Contributor self-run record of Northset's own contribution; not the maintainer's verification.",
    "The declared network-off check runs the prom-client jest unit suite on node:22 after a disclosed online phase-A npm ci. It does not run lint, prettier, or the TypeScript type-check gates that upstream CI also runs."
  ],
  "correction": null,
  "scope_note": "The declared network-off check runs the prom-client jest unit suite on node:22 after a disclosed online phase-A npm ci. It does not run lint, prettier, or the TypeScript type-check gates that upstream CI also runs.",
  "upstream_outcome": {
    "status": "merged",
    "link": "https://github.com/prometheus/client_js/pull/771#pullrequestreview-4689926060",
    "attribution": "Linked maintainer review",
    "head_drift": true,
    "pr_head_oid": "b64dc651cb3a1a22ed5e51095bbea2296d2b57ad"
  }
}