{
  "schema_version": 1,
  "generated_at": "2026-07-16T22:49:40.312Z",
  "receipt_id": "M-016",
  "receipt_result": "PASS — 1/1 declared command",
  "passed_commands": 1,
  "declared_commands": 1,
  "timestamps": {
    "started_at": "2026-07-13T18:08:11.710Z",
    "finished_at": "2026-07-13T18:11:10.751Z"
  },
  "commands": [
    {
      "cmd": "node_modules/.bin/vitest lib/modules/manager/quadlet/digest-replacement.spec.ts",
      "exit_code": 0,
      "timed_out": false,
      "duration_ms": 4990
    }
  ],
  "environment": {
    "container_image_ref": "node@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7",
    "container_image_digest": "node@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7",
    "container_image_id": null,
    "container_os": null,
    "container_architecture": null,
    "network_policy": "phaseA:bridge,phaseB:none",
    "source_commit": "77da69117e70421ae034f2723f8007dd6829f142",
    "install_commands": [
      "corepack pnpm install --frozen-lockfile"
    ]
  },
  "code": {
    "base_commit": "77da69117e70421ae034f2723f8007dd6829f142",
    "recorded_patch_commit": "77ba52c5b58855836bb00545c37f81cb7d2d1747",
    "patch_commit_binding": "declared metadata; not execution-bound",
    "patch_diff_hash": "sha256:19902c75871d1443d6dd3040ad366857a13c16c9b43c568a73fc7a0e86a49cfb",
    "patch_diff_binding": "bound to executed patch bytes"
  },
  "execution_summary": "1/1 declared command returned exit 0 in the recorded environment",
  "bundle": {
    "bundle_contents_digest": "sha256:4a0512e8d6e6ed0dc578b9a8f13e8551592127d98ed6a0bd9a8b5bff0f759ef2",
    "signed_asset_sha256": "sha256:215c2a7f6a4fa32e3d4a6cf481c364f898e8fcd1b55fb136e256ae0956353287",
    "attestation_uri": "https://github.com/northset-oss/verification-pilot/releases/download/run-record-M-016-4a0512e8d6e6/run-record-M-016-4a0512e8d6e6.tar.gz",
    "attestation_verified_at": "2026-07-14T14:21:48Z",
    "provenance": "Signed provenance recorded; the signer records artifact origin, not execution witnessing or maintainer approval."
  },
  "classification": "CONTRIBUTOR SELF-RUN — NOT MAINTAINER VERIFICATION",
  "links": {
    "canonical_url": "https://northset-oss.github.io/verification-pilot/receipts/M-016/",
    "target_repo": "https://github.com/renovatebot/renovate",
    "issue_or_task": "https://github.com/renovatebot/renovate/issues/44500",
    "publication_pr": "https://github.com/renovatebot/renovate/pull/44538"
  },
  "issue_title": "fix(manager/quadlet): pass specifyReplaceString to getDep so docker:pinDigests can pin/update digests",
  "limitations": [
    "Does not prove code quality",
    "Does not prove security",
    "Contributor self-run record of Northset's own contribution; not the maintainer's verification."
  ],
  "correction": null,
  "scope_note": "The declared network-off check runs one focused Vitest spec for Quadlet digest replacement. It does not run Renovate’s full test, lint, typecheck, or coverage gates.",
  "upstream_outcome": {
    "status": "open",
    "link": "https://github.com/renovatebot/renovate/pull/44538",
    "attribution": "Live upstream pull request"
  }
}