NORTHSET

Proof-of-Pass Receipt

Receipt ID M-115

ISSUE / WORKIncorrect usage of CreateObject for component usage · PR #197

CONTRIBUTOR SELF-RUN — NOT MAINTAINER VERIFICATION

RUN

01 / TECHNICAL RESULT

Technical result

1/1

declared commands passed

Recorded on the named code in the named execution environment. The evidence annex carries the exact scope.

Upstream
OPENmutable external state
Attempts
2 totalcurrent M-115 · #2
Cost record
PARTIALunpriced

02 / RECORDED WORK SEQUENCE

Northset Proofline

Every task-bound attempt is shown in recorded order. Anatomy geometry follows each non-null elapsed duration’s share; labels retain exact recorded time.

  1. ATTEMPT 1M-111FAILED ORACLEverification
  2. ATTEMPT 2M-115READY

ATTEMPT 2 / EXECUTION ANATOMY

01Discoverynot captured
02Qualification2m15s23.2%
03Authoring6m04s62.5%
04Verification1m23s14.3%

03 / ECONOMIC NARRATIVE

Economic identity

Observed sponsorship, authorization, scope, transfer, and outcome. No estimates or inferred value.

  1. 01 / MANDATE

    Sponsored and authorized

    The recorded mandate names both its sponsor and initiative, with authorization tied to a named approver and approval time.

    SPONSORNorthset OSS Fund · OSS mission experimentation

    AUTHORIZEDinternal-user:aeziz ·

  2. 02 / WORK

    Demand became scoped work

    An external issue invitation became a stable task and a recorded code-and-test scope, without treating scope as a measure of value.

    TASKTASK-OSS-BFEDFC322D8563A2 · defect fix · attempt 2

    INVITATIONIssue #61 · label

    SCOPE2 files · 97 changed lines · 1 production files · 1 test files · 1 declared check

  3. 03 / EXTERNAL OUTCOME

    Transfer and upstream state

    The recorded maintainer transfer and its contingency are separate from upstream state, which remains a mutable external observation.

    MAINTAINER TRANSFERnone · not merge contingent

    UPSTREAMOPEN · mutable external observation

04 / COST COMPLETENESS

Known, unknown, and unpriced

Known: maintainer payment was none. A known zero external transfer is not a zero total cost.

Missing or unpriced components

  • model inference
  • actual host compute
  • human review
  • shared tooling
TOTAL COSTUNPRICED

No complete total is recorded; see the missing or unpriced component record above.

Evidence annexEconomic · technical · provenance · limitations
01

Economic evidence

Lineage, usage, caps, outcome, and cost provenance

Attempt lineage

  • M-111attempt 1 · FAILED ORACLE · verification
  • M-115attempt 2 · READY

Recorded usage

requested reviewer model
gpt-5.6-sol
actual reviewer model
not captured
requested author model
gpt-5.6-sol
actual author model
not captured
networked setup phase
54.5s
install-only duration
not captured
declared commands
6.7s
unclassified executor time
22.3s
CPU time
not captured
peak RSS
not captured

Configured resource envelope

CPU cap
2
memory cap
4096 MB
PID cap
512
command wall cap
1800s
output cap / stream
2000000 bytes

Configured limits are an envelope, not observed consumption.

Cost lines

  • maintainer paymentobserved quantity unpriced · 0 external transfer · amount unavailable

Cost status: partial. Values without source-backed quantities and rates remain null.

Outcome facts

technical checks passed
true
PR opened
true
CI
pending
merged
false
accepted as submitted
not established
external cycle time
not captured
released
not observed
deployed
not observed
business result
not observed
02

Technical evidence

Code, environment, exact commands, patch, and outputs

Project

rokucommunity/bslint

Work

Incorrect usage of CreateObject for component usage · PR #197

Verification execution

runtime: northset-oss executor v1
human operator: aeziz

Code

base
56b4e8e82d81b574a56f70d8e4708e4e44e8a318
recorded patch commit
4de9666cb9885e9fc9737a055c5bdd2b5ca1997c
declared metadata; not execution-bound
patch diff SHA-256
sha256:ec6eb86a39c0305609f34e98e9ba3ba9bedcc87fc607c442b489a1a81eadcf35
bound to executed patch bytes

Environment

image reference
node@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7
repository digest
node@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7
immutable image ID
sha256:6ed6ff875e9714bb845b850b08f3ad231ccbb5848812647bcf11acdd4bd1d2f8
platform
linux/arm64
network
phaseA:bridge,phaseB:none

Declared checks

Execution summary
1/1 declared command returned exit 0 in the recorded environment

  1. npx mocha --no-config --require ts-node/register --require source-map-support/register src/plugins/checkUsage/createObjectUsage.spec.ts

    exit 0 · 6.7s

run wall (derived from recorded timestamps) 1m23s

PASS — 1/1 declared command

Every command listed returned exit 0 in the declared environment. Only the listed commands are in scope. Unlisted test, lint, typecheck, build, coverage, compiler, full-suite, and CI gates are not implied or recorded.

Public scope interpretation

The receipt proves the declared automated checks only; maintainer review and merge remain independent human decisions.

Committed patch.diff
diff --git a/src/plugins/checkUsage/createObjectUsage.spec.ts b/src/plugins/checkUsage/createObjectUsage.spec.ts
new file mode 100644
index 0000000000000000000000000000000000000000..7b5633ce5819e68b94e49ee34ca77678230b14d9
--- /dev/null
+++ b/src/plugins/checkUsage/createObjectUsage.spec.ts
@@ -0,0 +1,61 @@
+import { Program } from 'brighterscript';
+import * as path from 'path';
+import Linter from '../../Linter';
+import { expectDiagnostics } from '../../testHelpers.spec';
+import { createContext } from '../../util';
+import CheckUsage, { UnusedCode } from './index';
+
+describe('checkUsage CreateObject usage', () => {
+    it('counts only roSGNode CreateObject component usage', async () => {
+        const linter = new Linter();
+        linter.builder.plugins.add({
+            name: 'test',
+            afterProgramCreate: (program: Program) => {
+                program.setFile('source/main.brs', `
+                    sub main()
+                        invalidNode = CreateObject("Parent")
+                        validNode = CreateObject("roSGNode", "Used")
+                        print "Unrelated"
+                    end sub
+                `);
+
+                for (const name of ['Parent', 'Used', 'Unrelated']) {
+                    program.setFile(`components/${name.toLowerCase()}.brs`, 'sub init()\nend sub');
+                    program.setFile(`components/${name.toLowerCase()}.xml`, `
+                        <component name="${name}" extends="Group">
+                            <script uri="pkg:/components/${name.toLowerCase()}.brs" />
+                        </component>
+                    `);
+                }
+
+                program.plugins.add(new CheckUsage(createContext(program)));
+            }
+        });
+
+        const diagnostics = await linter.run({
+            rootDir: 'test/project1',
+            files: [],
+            rules: {},
+            diagnosticFilters: [1129]
+        } as any);
+
+        expectDiagnostics(diagnostics, [
+            {
+                code: UnusedCode.UnusedComponent,
+                message: `Component 'components${path.sep}parent.xml' does not seem to be used`
+            },
+            {
+                code: UnusedCode.UnusedComponent,
+                message: `Component 'components${path.sep}unrelated.xml' does not seem to be used`
+            },
+            {
+                code: UnusedCode.UnusedScript,
+                message: `Script 'components${path.sep}parent.brs' does not seem to be used`
+            },
+            {
+                code: UnusedCode.UnusedScript,
+                message: `Script 'components${path.sep}unrelated.brs' does not seem to be used`
+            }
+        ]);
+    });
+});
diff --git a/src/plugins/checkUsage/index.ts b/src/plugins/checkUsage/index.ts
index 23b5166b3871b041ed1fec9315222e65fca86f6d..263e1e389eac57afba3dbdc9a988d53548a6b417 100644
--- a/src/plugins/checkUsage/index.ts
+++ b/src/plugins/checkUsage/index.ts
@@ -1,4 +1,4 @@
-import { BscFile, CallableContainerMap, createVisitor, DiagnosticSeverity, isBrsFile, isXmlFile, Program, Range, Scope, TokenKind, WalkMode, XmlFile } from 'brighterscript';
+import { BscFile, CallableContainerMap, createVisitor, DiagnosticSeverity, isBrsFile, isLiteralExpression, isVariableExpression, isXmlFile, Program, Range, Scope, TokenKind, WalkMode, XmlFile } from 'brighterscript';
 import { SGNode } from 'brighterscript/dist/parser/SGTypes';
 import { PluginContext } from '../../util';
 
@@ -156,22 +156,28 @@ export default class CheckUsage {
             if (pkgPath === 'source/main.brs' || pkgPath === 'source/main.bs') {
                 this.main = fv;
             }
-            // find strings that look like referring to component names
+            // find component names passed to CreateObject("roSGNode", componentName)
             file.parser.references.functionExpressions.forEach(fun => {
                 fun.body.walk(createVisitor({
-                    LiteralExpression: (e) => {
-                        const { kind } = e.token;
-                        if (kind === TokenKind.StringLiteral) {
-                            const { text } = e.token;
-                            if (text !== '""') {
-                                const name = text.toLowerCase();
-                                if (map.has(name)) {
-                                    fv.edges.push({
-                                        name,
-                                        range: e.token.range,
-                                        file
-                                    });
-                                }
+                    CallExpression: (e) => {
+                        const componentType = e.args[0];
+                        const componentName = e.args[1];
+                        if (
+                            isVariableExpression(e.callee) &&
+                            e.callee.name.text.toLowerCase() === 'createobject' &&
+                            isLiteralExpression(componentType) &&
+                            componentType.token.kind === TokenKind.StringLiteral &&
+                            componentType.token.text.toLowerCase() === '"rosgnode"' &&
+                            isLiteralExpression(componentName) &&
+                            componentName.token.kind === TokenKind.StringLiteral
+                        ) {
+                            const name = componentName.token.text.toLowerCase();
+                            if (map.has(name)) {
+                                fv.edges.push({
+                                    name,
+                                    range: componentName.token.range,
+                                    file
+                                });
                             }
                         }
                     }
Redacted stdout
=== cmd 1: npx mocha --no-config --require ts-node/register --require source-map-support/register src/plugins/checkUsage/createObjectUsage.spec.ts ===


  checkUsage CreateObject usage
[06:39:29:152 PM] No bsconfig.json file found, using default options
[06:39:29:154 PM] Loading 0 plugins for cwd "/workspace" []
[06:39:29:187 PM] Parsing files
[06:39:29:195 PM] Parsing files finished. (7.726ms)
[06:39:29:196 PM] Validating project
[06:39:29:201 PM] Validating project finished. (5.103ms)

test/project1/components/parent.brs:1:1 - warning BSLINT4002: Script 'components/parent.brs' does not seem to be used

 1  sub init()
    ~~~~~~~~~~


test/project1/components/parent.xml:2:42 - warning BSLINT4001: Component 'components/parent.xml' does not seem to be used

 2                          <component name="Parent" extends="Group">
                                             ~~~~~~                  


test/project1/components/unrelated.brs:1:1 - warning BSLINT4002: Script 'components/unrelated.brs' does not seem to be used

 1  sub init()
    ~~~~~~~~~~


test/project1/components/unrelated.xml:2:42 - warning BSLINT4001: Component 'components/unrelated.xml' does not seem to be used

 2                          <component name="Unrelated" extends="Group">
                                             ~~~~~~~~~                  

    ✔ counts only roSGNode CreateObject component usage (57ms)


  1 passing (73ms)

Redacted stderr
=== cmd 1: npx mocha --no-config --require ts-node/register --require source-map-support/register src/plugins/checkUsage/createObjectUsage.spec.ts ===
(node:23) [MODULE_TYPELESS_PACKAGE_JSON] Warning: Module type of file:///workspace/src/plugins/checkUsage/createObjectUsage.spec.ts is not specified and it doesn't parse as CommonJS.
Reparsing as ES module because module syntax was detected. This incurs a performance overhead.
To eliminate this warning, add "type": "module" to /workspace/package.json.
(Use `node --trace-warnings ...` to show where the warning was created)
03

Provenance & limitations

Bundle identity, attestation, verification, and claims boundary

Record details

payment
none · not merge-contingent
redactions
none recorded
Bundle contents digest
sha256:5e882b21653755cc4b05e400fa521d36821123f53ae3157f24274a54f1ceed7a
Signed asset SHA-256
sha256:98769378fb071e26f3b80c22fcd182da2494df155597e6ac2273fc48107674fa
Signed provenance recorded
verified 2026-07-16T19:32:25.549Z

NOT INCLUDED

  • Does not prove code quality
  • Does not prove security
  • Contributor self-run record of Northset's own contribution; not the maintainer's verification.
  • The receipt proves the declared automated checks only; maintainer review and merge remain independent human decisions.

Signed bundle

Download signed bundle

Verify this receipt

gh attestation verify run-record-M-115-5e882b216537.tar.gz --repo northset-oss/verification-pilot --signer-workflow northset-oss/verification-pilot/.github/workflows/attest-bundle.yml

Attestation confirms that Northset's signing workflow produced this exact bundle. The signer does not witness the recorded run, and verification does not turn it into maintainer verification.

QR → receipt page
Northset contributed this fix and ran its declared checks. Contributor self-run. Not maintainer verification.

Evidence of what ran — not a verdict that the code is good.

SELF-FUNDED FIELD-TESTING.

FOR MAINTAINERS

Request a private run

Maintain an open-source project? Send Northset a PR already in your queue. We run its repository-declared checks in an isolated container and return the run record privately. We do not modify the PR. Nothing is published without your approval. Free during the pilot.

The issue form is public. Do not include secrets or private repository details there; use email instead.

Already onboarded? Add northset-verify to a PR to request a run on that PR.

Claims boundary

This page reports scoped proof-of-pass receipt evidence. It does not prove code quality, security, full CI coverage, production readiness, or maintainer approval. An attestation confirms bundle provenance; it does not broaden the receipt's claim.

Read the full Claims Boundary policy.