← ReceiptsJSON

Check this receipt without trusting this site

gh attestation verify run-record-M-015.tar.gz --repo northset-oss/verification-pilot --signer-workflow northset-oss/verification-pilot/.github/workflows/attest-bundle.yml

Expected output includes Verification succeeded!

NORTHSET

Proof-of-Pass Receipt

Receipt ID M-015

ISSUE / WORKIssue #582 · PR #774

CONTRIBUTOR SELF-RUN — NOT MAINTAINER VERIFICATION

RUN44.6s

01 / TECHNICAL RESULT

1/1

declared command passed

1/1 declared command returned exit 0 in the recorded environment

Upstream
CLOSED UNMERGEDREVIEW REQUIRED GitHub review decision
Environment
node:22-bookwormnetwork phaseA:bridge,phaseB:none
Signature
verified Northset signing workflow provenance

02 / DECLARED CHECKS

Command evidence

Execution summary
1/1 declared command returned exit 0 in the recorded environment

  1. npm run compile-typescript && npm run test-unit

    exit 0 · 7.5s

unclassified executor time (derived residual) 37s

run wall (derived from recorded timestamps) 44.6s

Every command listed returned exit 0 in the declared environment. Only the listed commands are in scope. Unlisted test, lint, typecheck, build, coverage, compiler, full-suite, and CI gates are not implied or recorded.

03 / RECORDED IDENTITIES

Compact hashes

Patch diff SHA-256
sha256:7d53dc…1c310e6
Container image digest
node@sha256:a25c99…127c365
Bundle contents digest
sha256:51214f…ee5f59d
Signed asset SHA-256
sha256:165323…981c0bc

04 / PUBLIC SCOPE INTERPRETATION

Public scope interpretation

Contributor self-run record of Northset’s own contribution; not the maintainer’s verification. The declared network-off check runs `npm run compile-typescript && npm run test-unit` on node:22-bookworm after a disclosed online install. It does not run lint, type-check, or the full upstream CI gates.

05 / CLAIMS BOUNDARY

NOT INCLUDED

  • Does not prove code quality
  • Does not prove security
  • Contributor self-run record of Northset’s own contribution; not the maintainer’s verification.
  • The declared network-off check runs `npm run compile-typescript && npm run test-unit` on node:22-bookworm after a disclosed online install. It does not run lint, type-check, or the full upstream CI gates.

06 / CORRECTION

Correction

Correction: compile-typescript was run; the immutable record limitation incorrectly says type-check was not run. The PR later closed without merge.

07 / Evidence annexTechnical · provenance · full recorded values
01

Technical evidence

Code, full environment, patch, and redacted outputs

Project

prometheus/client_js

Work

Issue #582 · PR #774

Verification execution

runtime: northset-oss executor v0
human operator: aeziz

Code

base
7c54cc43cc5443e79d92ff4b9b732c2b091b6517
recorded patch commit
266b86e8d077e05732e8339fcdfe6bdfdcde6707
declared metadata; not execution-bound
patch diff SHA-256
sha256:7d53dc…1c310e6
bound to executed patch bytes

Environment

image reference
node:22-bookworm
repository digest
node@sha256:a25c99…127c365
network
phaseA:bridge,phaseB:none
Committed patch.diff
diff --git a/index.d.ts b/index.d.ts
index 8c0ebb2..ad40e62 100644
--- a/index.d.ts
+++ b/index.d.ts
@@ -304,7 +304,7 @@ type MetricValueWithName<T extends string> = MetricValue<T> & {
 
 type LabelValues<T extends string> = T extends NoLabelNameType
 	? Partial<Record<string, never>>
-	: Partial<Record<T, string | number>>;
+	: Partial<Record<T, string | number | string[]>>;
 
 interface MetricConfiguration<T extends string> {
 	name: string;
diff --git a/test/typescript.ts b/test/typescript.ts
index 80d899c..2a0ff38 100644
--- a/test/typescript.ts
+++ b/test/typescript.ts
@@ -18,8 +18,10 @@ const registry = new Registry();
 const counter = new Counter({
 	name: 'typescript_test_counter',
 	help: 'TypeScript test counter',
+	labelNames: ['handler'],
 	registers: [registry],
 });
+counter.inc({ handler: ['/a', '/b'] });
 
 const metricsText: Promise<string> = registry.getMetricsAsString(counter);
 const gatewayWithRegistry = new Pushgateway('http://127.0.0.1:9091', registry);
Redacted stdout
=== cmd 1: npm run compile-typescript && npm run test-unit ===

> @[REDACTED:email] compile-typescript
> tsc --project .


> @[REDACTED:email] test-unit
> jest
Redacted stderr
=== cmd 1: npm run compile-typescript && npm run test-unit ===
PASS test/histogramTest.js
PASS test/summaryTest.js
PASS test/registerTest.js
PASS test/utilTest.js
PASS test/gaugeTest.js
PASS test/exemplarsTest.js
PASS test/counterTest.js
PASS test/pushgatewayWithPathTest.js
PASS test/defaultMetricsTest.js
PASS test/pushgatewayTest.js
PASS test/aggregatorsTest.js
PASS test/metrics/heapSpacesSizeAndUsedTest.js
PASS test/metrics/eventLoopLagTest.js
PASS test/timeWindowQuantilesTest.js
PASS test/clusterTest.js
PASS test/metrics/maxFileDescriptorsTest.js
PASS test/bucketGeneratorsTest.js
PASS test/metrics/versionTest.js
PASS test/metrics/heapSizeAndUsedTest.js
PASS test/workerTest.js
PASS test/metrics/processRequestsTest.js
PASS test/metrics/gcTest.js
PASS test/metrics/processHandlesTest.js
PASS test/browserCompatibilityTest.js
PASS test/metrics/processStartTimeTest.js
PASS test/metrics/processOpenFileDescriptorsTest.js
PASS test/validationTest.js
PASS test/metrics/processResourcesTest.js
A worker process has failed to exit gracefully and has been force exited. This is likely caused by tests leaking due to improper teardown. Try running with --detectOpenHandles to find leaks. Active timers can also cause this, ensure that .unref() was called on them.

Test Suites: 28 passed, 28 total
Tests:       542 passed, 542 total
Snapshots:   34 passed, 34 total
Time:        3.89 s
Ran all test suites.
02

Provenance & record

Full hashes, bundle identity, attestation, and record details

Record details

payment
none · not merge-contingent
redactions
2 email
Bundle contents digest
sha256:51214f…ee5f59d
Signed asset SHA-256
sha256:165323…981c0bc
Signed provenance recorded
verified

Full cryptographic values

Full recorded values. The compact receipt above shortens these for legibility only.

Patch diff SHA-256
sha256:7d53dca4cdd37882f4a7765881f300c5554a3e6159e778cbdb0d9f59a1c310e6
Container image digest
node@sha256:a25c9934ff6382cd4f08b6bc26c82bf4ea69b1e6f8dabfb2ead457374127c365
Bundle contents digest
sha256:51214f33c28fa66ef2ddf5e2b4ac3598c3a956f1f78466764b7918805ee5f59d
Signed asset SHA-256
sha256:1653238a0a10554d744aeb91c17ae6f8445b47eb38fc6debbf6b7fcae981c0bc

Signed bundle

Download signed bundle

Verify this receipt

gh attestation verify run-record-M-015.tar.gz --repo northset-oss/verification-pilot --signer-workflow northset-oss/verification-pilot/.github/workflows/attest-bundle.yml

Attestation confirms that Northset's signing workflow produced this exact bundle. The signer does not witness the recorded run, and verification does not turn it into maintainer verification.

QR → receipt page
Northset contributed this fix and ran its declared checks. Contributor self-run. Not maintainer verification.

Evidence of what ran — not a verdict that the code is good.

SELF-FUNDED FIELD-TESTING.

- - - detach here - - -

External status

Mutable upstream observation; unattested and separate from the signed run record.

PR state
CLOSED UNMERGED
GitHub review decision
REVIEW REQUIRED
Upstream updated
Observed
CLOSED UNMERGED

Recorded upstream outcome · open linked record

All Northset work in prometheus/client_js →

FOR MAINTAINERS

Maintain prometheus/client_js?

Get this same run for any PR in your queue — private, free during the pilot, nothing published without your approval.

Open a public requestEmail a private requestSee a sample private check receipt

The issue form is public. Do not include secrets or private repository details there; use email instead.

Already onboarded? Add northset-verify to a PR to request a run on that PR.

Claims boundary

This page reports scoped proof-of-pass receipt evidence. It does not prove code quality, security, full CI coverage, production readiness, or maintainer approval. An attestation confirms bundle provenance; it does not broaden the receipt's claim.

Read the full Claims Boundary policy.