NORTHSET
Proof-of-Pass Receipt
Receipt ID M-115
ISSUE / WORKIncorrect usage of CreateObject for component usage · PR #197
CONTRIBUTOR SELF-RUN — NOT MAINTAINER VERIFICATION
RUN→
01 / TECHNICAL RESULT
Technical result
declared commands passed
Recorded on the named code in the named execution environment. The evidence annex carries the exact scope.
- Upstream
- OPENmutable external state
- Attempts
- 2 totalcurrent
M-115· #2 - Cost record
- PARTIALunpriced
02 / RECORDED WORK SEQUENCE
Northset Proofline
Every task-bound attempt is shown in recorded order. Anatomy geometry follows each non-null elapsed duration’s share; labels retain exact recorded time.
- ATTEMPT 1
M-111FAILED ORACLEverification - ATTEMPT 2
M-115READY
ATTEMPT 2 / EXECUTION ANATOMY
03 / ECONOMIC NARRATIVE
Economic identity
Observed sponsorship, authorization, scope, transfer, and outcome. No estimates or inferred value.
01 / MANDATE
Sponsored and authorized
The recorded mandate names both its sponsor and initiative, with authorization tied to a named approver and approval time.
02 / WORK
Demand became scoped work
An external issue invitation became a stable task and a recorded code-and-test scope, without treating scope as a measure of value.
03 / EXTERNAL OUTCOME
Transfer and upstream state
The recorded maintainer transfer and its contingency are separate from upstream state, which remains a mutable external observation.
04 / COST COMPLETENESS
Known, unknown, and unpriced
Known: maintainer payment was none. A known zero external transfer is not a zero total cost.
Missing or unpriced components
- model inference
- actual host compute
- human review
- shared tooling
No complete total is recorded; see the missing or unpriced component record above.
Evidence annexEconomic · technical · provenance · limitations
01Economic evidence
Lineage, usage, caps, outcome, and cost provenance
Economic evidence
Lineage, usage, caps, outcome, and cost provenanceAttempt lineage
M-111attempt 1 · FAILED ORACLE · verificationM-115attempt 2 · READY
Recorded usage
- requested reviewer model
- gpt-5.6-sol
- actual reviewer model
- not captured
- requested author model
- gpt-5.6-sol
- actual author model
- not captured
- networked setup phase
- 54.5s
- install-only duration
- not captured
- declared commands
- 6.7s
- unclassified executor time
- 22.3s
- CPU time
- not captured
- peak RSS
- not captured
Configured resource envelope
- CPU cap
- 2
- memory cap
- 4096 MB
- PID cap
- 512
- command wall cap
- 1800s
- output cap / stream
- 2000000 bytes
Configured limits are an envelope, not observed consumption.
Cost lines
- maintainer paymentobserved quantity unpriced · 0 external transfer · amount unavailable
Cost status: partial. Values without source-backed quantities and rates remain null.
Outcome facts
- technical checks passed
- true
- PR opened
- true
- CI
- pending
- merged
- false
- accepted as submitted
- not established
- external cycle time
- not captured
- released
- not observed
- deployed
- not observed
- business result
- not observed
02Technical evidence
Code, environment, exact commands, patch, and outputs
Technical evidence
Code, environment, exact commands, patch, and outputsProject
Work
Incorrect usage of CreateObject for component usage · PR #197
Verification execution
runtime: northset-oss executor v1
human operator: aeziz
Code
- base
56b4e8e82d81b574a56f70d8e4708e4e44e8a318- recorded patch commit
4de9666cb9885e9fc9737a055c5bdd2b5ca1997c
declared metadata; not execution-bound- patch diff SHA-256
sha256:ec6eb86a39c0305609f34e98e9ba3ba9bedcc87fc607c442b489a1a81eadcf35
bound to executed patch bytes
Environment
- image reference
- node@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7
- repository digest
node@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7- immutable image ID
sha256:6ed6ff875e9714bb845b850b08f3ad231ccbb5848812647bcf11acdd4bd1d2f8- platform
- linux/arm64
- network
- phaseA:bridge,phaseB:none
Declared checks
Execution summary
1/1 declared command returned exit 0 in the recorded environment
npx mocha --no-config --require ts-node/register --require source-map-support/register src/plugins/checkUsage/createObjectUsage.spec.tsexit 0 · 6.7s
run wall (derived from recorded timestamps) 1m23s
PASS — 1/1 declared command
Every command listed returned exit 0 in the declared environment. Only the listed commands are in scope. Unlisted test, lint, typecheck, build, coverage, compiler, full-suite, and CI gates are not implied or recorded.
Public scope interpretation
The receipt proves the declared automated checks only; maintainer review and merge remain independent human decisions.
Committed patch.diff
diff --git a/src/plugins/checkUsage/createObjectUsage.spec.ts b/src/plugins/checkUsage/createObjectUsage.spec.ts
new file mode 100644
index 0000000000000000000000000000000000000000..7b5633ce5819e68b94e49ee34ca77678230b14d9
--- /dev/null
+++ b/src/plugins/checkUsage/createObjectUsage.spec.ts
@@ -0,0 +1,61 @@
+import { Program } from 'brighterscript';
+import * as path from 'path';
+import Linter from '../../Linter';
+import { expectDiagnostics } from '../../testHelpers.spec';
+import { createContext } from '../../util';
+import CheckUsage, { UnusedCode } from './index';
+
+describe('checkUsage CreateObject usage', () => {
+ it('counts only roSGNode CreateObject component usage', async () => {
+ const linter = new Linter();
+ linter.builder.plugins.add({
+ name: 'test',
+ afterProgramCreate: (program: Program) => {
+ program.setFile('source/main.brs', `
+ sub main()
+ invalidNode = CreateObject("Parent")
+ validNode = CreateObject("roSGNode", "Used")
+ print "Unrelated"
+ end sub
+ `);
+
+ for (const name of ['Parent', 'Used', 'Unrelated']) {
+ program.setFile(`components/${name.toLowerCase()}.brs`, 'sub init()\nend sub');
+ program.setFile(`components/${name.toLowerCase()}.xml`, `
+ <component name="${name}" extends="Group">
+ <script uri="pkg:/components/${name.toLowerCase()}.brs" />
+ </component>
+ `);
+ }
+
+ program.plugins.add(new CheckUsage(createContext(program)));
+ }
+ });
+
+ const diagnostics = await linter.run({
+ rootDir: 'test/project1',
+ files: [],
+ rules: {},
+ diagnosticFilters: [1129]
+ } as any);
+
+ expectDiagnostics(diagnostics, [
+ {
+ code: UnusedCode.UnusedComponent,
+ message: `Component 'components${path.sep}parent.xml' does not seem to be used`
+ },
+ {
+ code: UnusedCode.UnusedComponent,
+ message: `Component 'components${path.sep}unrelated.xml' does not seem to be used`
+ },
+ {
+ code: UnusedCode.UnusedScript,
+ message: `Script 'components${path.sep}parent.brs' does not seem to be used`
+ },
+ {
+ code: UnusedCode.UnusedScript,
+ message: `Script 'components${path.sep}unrelated.brs' does not seem to be used`
+ }
+ ]);
+ });
+});
diff --git a/src/plugins/checkUsage/index.ts b/src/plugins/checkUsage/index.ts
index 23b5166b3871b041ed1fec9315222e65fca86f6d..263e1e389eac57afba3dbdc9a988d53548a6b417 100644
--- a/src/plugins/checkUsage/index.ts
+++ b/src/plugins/checkUsage/index.ts
@@ -1,4 +1,4 @@
-import { BscFile, CallableContainerMap, createVisitor, DiagnosticSeverity, isBrsFile, isXmlFile, Program, Range, Scope, TokenKind, WalkMode, XmlFile } from 'brighterscript';
+import { BscFile, CallableContainerMap, createVisitor, DiagnosticSeverity, isBrsFile, isLiteralExpression, isVariableExpression, isXmlFile, Program, Range, Scope, TokenKind, WalkMode, XmlFile } from 'brighterscript';
import { SGNode } from 'brighterscript/dist/parser/SGTypes';
import { PluginContext } from '../../util';
@@ -156,22 +156,28 @@ export default class CheckUsage {
if (pkgPath === 'source/main.brs' || pkgPath === 'source/main.bs') {
this.main = fv;
}
- // find strings that look like referring to component names
+ // find component names passed to CreateObject("roSGNode", componentName)
file.parser.references.functionExpressions.forEach(fun => {
fun.body.walk(createVisitor({
- LiteralExpression: (e) => {
- const { kind } = e.token;
- if (kind === TokenKind.StringLiteral) {
- const { text } = e.token;
- if (text !== '""') {
- const name = text.toLowerCase();
- if (map.has(name)) {
- fv.edges.push({
- name,
- range: e.token.range,
- file
- });
- }
+ CallExpression: (e) => {
+ const componentType = e.args[0];
+ const componentName = e.args[1];
+ if (
+ isVariableExpression(e.callee) &&
+ e.callee.name.text.toLowerCase() === 'createobject' &&
+ isLiteralExpression(componentType) &&
+ componentType.token.kind === TokenKind.StringLiteral &&
+ componentType.token.text.toLowerCase() === '"rosgnode"' &&
+ isLiteralExpression(componentName) &&
+ componentName.token.kind === TokenKind.StringLiteral
+ ) {
+ const name = componentName.token.text.toLowerCase();
+ if (map.has(name)) {
+ fv.edges.push({
+ name,
+ range: componentName.token.range,
+ file
+ });
}
}
}
Redacted stdout
=== cmd 1: npx mocha --no-config --require ts-node/register --require source-map-support/register src/plugins/checkUsage/createObjectUsage.spec.ts ===
checkUsage CreateObject usage
[[90m06:39:29:152 PM[39m] No bsconfig.json file found, using default options
[[90m06:39:29:154 PM[39m] Loading 0 plugins for cwd "/workspace" []
[[90m06:39:29:187 PM[39m] Parsing files
[[90m06:39:29:195 PM[39m] Parsing files finished. ([34m7.726ms[39m)
[[90m06:39:29:196 PM[39m] Validating project
[[90m06:39:29:201 PM[39m] Validating project finished. ([34m5.103ms[39m)
test/project1/components/parent.brs:1:1 - warning BSLINT4002: Script 'components/parent.brs' does not seem to be used
1 sub init()
~~~~~~~~~~
test/project1/components/parent.xml:2:42 - warning BSLINT4001: Component 'components/parent.xml' does not seem to be used
2 <component name="Parent" extends="Group">
~~~~~~
test/project1/components/unrelated.brs:1:1 - warning BSLINT4002: Script 'components/unrelated.brs' does not seem to be used
1 sub init()
~~~~~~~~~~
test/project1/components/unrelated.xml:2:42 - warning BSLINT4001: Component 'components/unrelated.xml' does not seem to be used
2 <component name="Unrelated" extends="Group">
~~~~~~~~~
✔ counts only roSGNode CreateObject component usage (57ms)
1 passing (73ms)
Redacted stderr
=== cmd 1: npx mocha --no-config --require ts-node/register --require source-map-support/register src/plugins/checkUsage/createObjectUsage.spec.ts ===
(node:23) [MODULE_TYPELESS_PACKAGE_JSON] Warning: Module type of file:///workspace/src/plugins/checkUsage/createObjectUsage.spec.ts is not specified and it doesn't parse as CommonJS.
Reparsing as ES module because module syntax was detected. This incurs a performance overhead.
To eliminate this warning, add "type": "module" to /workspace/package.json.
(Use `node --trace-warnings ...` to show where the warning was created)
03Provenance & limitations
Bundle identity, attestation, verification, and claims boundary
Provenance & limitations
Bundle identity, attestation, verification, and claims boundaryRecord details
- payment
- none · not merge-contingent
- redactions
- none recorded
- Bundle contents digest
sha256:5e882b21653755cc4b05e400fa521d36821123f53ae3157f24274a54f1ceed7a- Signed asset SHA-256
sha256:98769378fb071e26f3b80c22fcd182da2494df155597e6ac2273fc48107674fa- Signed provenance recorded
- verified 2026-07-16T19:32:25.549Z
NOT INCLUDED
- Does not prove code quality
- Does not prove security
- Contributor self-run record of Northset's own contribution; not the maintainer's verification.
- The receipt proves the declared automated checks only; maintainer review and merge remain independent human decisions.
Signed bundle
Verify this receipt
gh attestation verify run-record-M-115-5e882b216537.tar.gz --repo northset-oss/verification-pilot --signer-workflow northset-oss/verification-pilot/.github/workflows/attest-bundle.ymlAttestation confirms that Northset's signing workflow produced this exact bundle. The signer does not witness the recorded run, and verification does not turn it into maintainer verification.
QR → receipt page