NORTHSET

Proof-of-Pass Receipt — M-015

CONTRIBUTOR SELF-RUN — NOT MAINTAINER VERIFICATION

Receipt ID
M-015
Run start
2026-07-13T01:03:28.905Z
Run finish
2026-07-13T01:04:13.457Z

Project

prometheus/client_js

Work

Issue #582 · PR #774

Verification execution

runtime: northset-oss executor v0
human operator: aeziz

Code

base
7c54cc43cc5443e79d92ff4b9b732c2b091b6517
recorded patch commit
266b86e8d077e05732e8339fcdfe6bdfdcde6707
declared metadata; not execution-bound
patch diff SHA-256
sha256:7d53dca4cdd37882f4a7765881f300c5554a3e6159e778cbdb0d9f59a1c310e6
bound to executed patch bytes

Environment

image reference
node:22-bookworm
repository digest
node@sha256:a25c9934ff6382cd4f08b6bc26c82bf4ea69b1e6f8dabfb2ead457374127c365
network
phaseA:bridge,phaseB:none

Declared checks

Execution summary
1/1 declared command returned exit 0 in the recorded environment

  1. npm run compile-typescript && npm run test-unit

    exit 0 · 7.5s

unclassified executor time (derived residual) 37s

run wall (derived from recorded timestamps) 44.6s

PASS — 1/1 declared command

Every command listed returned exit 0 in the declared environment. Only the listed commands are in scope. Unlisted test, lint, typecheck, build, coverage, compiler, full-suite, and CI gates are not implied or recorded.

Public scope interpretation

Contributor self-run record of Northset’s own contribution; not the maintainer’s verification. The declared network-off check runs `npm run compile-typescript && npm run test-unit` on node:22-bookworm after a disclosed online install. It does not run lint, type-check, or the full upstream CI gates.

Record details

payment
none · not merge-contingent
redactions
2 email
Bundle contents digest
sha256:51214f33c28fa66ef2ddf5e2b4ac3598c3a956f1f78466764b7918805ee5f59d
Signed asset SHA-256
sha256:1653238a0a10554d744aeb91c17ae6f8445b47eb38fc6debbf6b7fcae981c0bc
Signed provenance recorded
verified 2026-07-14T14:21:48Z

NOT INCLUDED

  • Does not prove code quality
  • Does not prove security
  • Contributor self-run record of Northset’s own contribution; not the maintainer’s verification.
  • The declared network-off check runs `npm run compile-typescript && npm run test-unit` on node:22-bookworm after a disclosed online install. It does not run lint, type-check, or the full upstream CI gates.

Correction

Correction: compile-typescript was run; the immutable record limitation incorrectly says type-check was not run. The PR later closed without merge.

Signed bundle

Download signed bundle

Verify this receipt

gh attestation verify run-record-M-015.tar.gz --repo northset-oss/verification-pilot --signer-workflow northset-oss/verification-pilot/.github/workflows/attest-bundle.yml

Attestation confirms that Northset's signing workflow produced this exact bundle. The signer does not witness the recorded run, and verification does not turn it into maintainer verification.

QR → receipt page
Northset contributed this fix and ran its declared checks. Contributor self-run. Not maintainer verification.

Evidence of what ran — not a verdict that the code is good.

SELF-FUNDED FIELD-TESTING.

Committed patch.diff
diff --git a/index.d.ts b/index.d.ts
index 8c0ebb2..ad40e62 100644
--- a/index.d.ts
+++ b/index.d.ts
@@ -304,7 +304,7 @@ type MetricValueWithName<T extends string> = MetricValue<T> & {
 
 type LabelValues<T extends string> = T extends NoLabelNameType
 	? Partial<Record<string, never>>
-	: Partial<Record<T, string | number>>;
+	: Partial<Record<T, string | number | string[]>>;
 
 interface MetricConfiguration<T extends string> {
 	name: string;
diff --git a/test/typescript.ts b/test/typescript.ts
index 80d899c..2a0ff38 100644
--- a/test/typescript.ts
+++ b/test/typescript.ts
@@ -18,8 +18,10 @@ const registry = new Registry();
 const counter = new Counter({
 	name: 'typescript_test_counter',
 	help: 'TypeScript test counter',
+	labelNames: ['handler'],
 	registers: [registry],
 });
+counter.inc({ handler: ['/a', '/b'] });
 
 const metricsText: Promise<string> = registry.getMetricsAsString(counter);
 const gatewayWithRegistry = new Pushgateway('http://127.0.0.1:9091', registry);
Redacted stdout
=== cmd 1: npm run compile-typescript && npm run test-unit ===

> @[REDACTED:email] compile-typescript
> tsc --project .


> @[REDACTED:email] test-unit
> jest

Redacted stderr
=== cmd 1: npm run compile-typescript && npm run test-unit ===
PASS test/histogramTest.js
PASS test/summaryTest.js
PASS test/registerTest.js
PASS test/utilTest.js
PASS test/gaugeTest.js
PASS test/exemplarsTest.js
PASS test/counterTest.js
PASS test/pushgatewayWithPathTest.js
PASS test/defaultMetricsTest.js
PASS test/pushgatewayTest.js
PASS test/aggregatorsTest.js
PASS test/metrics/heapSpacesSizeAndUsedTest.js
PASS test/metrics/eventLoopLagTest.js
PASS test/timeWindowQuantilesTest.js
PASS test/clusterTest.js
PASS test/metrics/maxFileDescriptorsTest.js
PASS test/bucketGeneratorsTest.js
PASS test/metrics/versionTest.js
PASS test/metrics/heapSizeAndUsedTest.js
PASS test/workerTest.js
PASS test/metrics/processRequestsTest.js
PASS test/metrics/gcTest.js
PASS test/metrics/processHandlesTest.js
PASS test/browserCompatibilityTest.js
PASS test/metrics/processStartTimeTest.js
PASS test/metrics/processOpenFileDescriptorsTest.js
PASS test/validationTest.js
PASS test/metrics/processResourcesTest.js
A worker process has failed to exit gracefully and has been force exited. This is likely caused by tests leaking due to improper teardown. Try running with --detectOpenHandles to find leaks. Active timers can also cause this, ensure that .unref() was called on them.

Test Suites: 28 passed, 28 total
Tests:       542 passed, 542 total
Snapshots:   34 passed, 34 total
Time:        3.89 s
Ran all test suites.

- - - detach here - - -

External status

Mutable upstream observation; unattested and separate from the signed run record.

PR state
CLOSED UNMERGED
Review signal
REVIEW REQUIRED
CI state
SUCCESS
Upstream updated at
2026-07-13T01:27:05Z
Observed at
2026-07-14T23:05:50.349Z
CLOSED UNMERGED

Recorded upstream outcome · open linked record

FOR MAINTAINERS

Request a private run

Maintain an open-source project? Send Northset a PR already in your queue. We run its repository-declared checks in an isolated container and return the run record privately. We do not modify the PR. Nothing is published without your approval. Free during the pilot.

The issue form is public. Do not include secrets or private repository details there; use email instead.

Already onboarded? Add northset-verify to a PR to request a run on that PR.

Claims boundary

This page reports scoped proof-of-pass receipt evidence. It does not prove code quality, security, full CI coverage, production readiness, or maintainer approval. An attestation confirms bundle provenance; it does not broaden the receipt's claim.

Read the full Claims Boundary policy.