Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/corroborate/classify.go`:
- Around line 56-64: The Allowlist schemaVersion is parsed in classify.go but
not enforced, so unsupported or mistyped schema versions are accepted and
classified with the current rules. Update the Allowlist loading/classification
path (including the code around Allowlist and its parser/classifier functions)
to validate SchemaVersion against the supported version(s) and return an error
for anything else before any classification happens. Keep the check centralized
so all consumers fail closed on future GP1 schema bumps.

In `@pkg/corroborate/coordinate.go`:
- Around line 54-58: The error handling in `Coordinate` is overwriting the
structured code returned by `recipe.CoordinateFor`. Update the `err != nil` path
to use `errors.PropagateOrWrap(...)` instead of `errors.Wrap(...)`, so the
original `ErrCodeInvalidRequest` from `CoordinateFor` is preserved while still
adding the context about `co.Path()` not round-tripping.
- Around line 123-144: The labelFor helper is extracting <org>/<repo> from any
identity with 3+ path segments, which can mislabel non-code-host OIDC subjects.
Update labelFor in coordinate.go to only use the org/repo path form for
recognized code-host identities, and otherwise keep the existing host-based
fallback or IDHash fallback; use the existing m.Signer.Identity parsing logic
and preserve ClassFirstParty behavior.

In `@pkg/corroborate/generate_test.go`:
- Around line 165-166: The assertions in generate_test.go are only checking map
values, so they won’t fail if the expected key disappears entirely. Update the
checks around findTab(...) for recipeB and the c3rogue source to first read the
map entry with the ok result, then assert the key exists before verifying it is
empty/zero-valued. This keeps the regression coverage tied to the generator
contract in the relevant test cases.

In `@pkg/corroborate/generate.go`:
- Around line 203-213: The distinct-signer key is still being taken from
meta.json even when the allowlist is enabled, which lets a reused IDHash collide
with another signer. Update the signer-key derivation in generate.go so
aggregation and source registration use a locally derived key from the verified
issuer+identity pair, and make the same change in the reduction/registration
paths referenced by the affected blocks rather than relying on
meta.Signer.IDHash.
- Around line 217-224: The phase file check in generate should only skip truly
missing reports, not all os.Stat failures. In the phase loop inside generate,
keep the existing readCTRF flow but change the os.Stat handling for phasePath so
it continues only when os.IsNotExist(statErr) is true; for any other stat error,
return a wrapped error instead of silently ignoring it. Use the generate
function’s phaseNames loop and readCTRF call as the key locations to update.
- Around line 233-242: The attestedAt parsing in the signer run construction
currently ignores parse failures and falls back to the zero time, which can
incorrectly make malformed runs sort as the oldest. Update the logic in the
signerRun creation path to stop treating a bad RFC3339 timestamp as a valid zero
value: either return an error from the function that builds the signerRun or
explicitly skip the run when time.Parse fails, and keep the rest of the
signerRun fields unchanged for valid timestamps.
- Around line 63-80: Thread a cancellable context through Generate by adding a
context parameter to the Generate entry point and propagating it into the
long-running directory walk, file reads, and writes; update the loops in the
Generate pipeline to check ctx.Done() so they can exit early on cancellation.
Use the existing Generate function and related helpers in
pkg/corroborate/generate.go as the main touchpoints, and make sure all I/O in
the 123-145, 160-189, and 695-729 regions is context-aware with
timeout/cancellation support.

In `@pkg/corroborate/meta.go`:
- Around line 73-87: The readBoundedFile helper is following symlinks/special
files and also mapping every os.Open failure to ErrCodeNotFound. Update
readBoundedFile to inspect the path with a non-following stat/lstat-style check
before opening, reject symlinks/FIFOs/devices, and preserve the original open
error classification instead of always wrapping it as not found. Keep the
existing size-limit and read handling, but make the open/error path in
readBoundedFile reflect the actual failure so callers can distinguish missing
files from permission or other I/O errors.

In `@pkg/corroborate/renderer/index.html`:
- Around line 1438-1471: The openTimeSeries renderer is inserting
contributor-controlled values into the DOM without escaping, creating a stored
XSS gap. Update the loading title and the health summary in openTimeSeries so
that meta.label/src and health.lastPassBuild are passed through esc() before
being interpolated into innerHTML, matching the existing escaping pattern used
elsewhere in the same function.

In `@pkg/corroborate/testdata/bigdemo/gen.py`:
- Around line 35-54: The NVIDIA entry in SIGNERS is out of sync with the
allowlist, so the generated identity must match the shipped NVIDIA workflow
names. Update the nvidia signer definition in gen.py so its identity aligns with
the allowlist entries used by corroborate (the UAT workflow filenames), keeping
the SIGNERS mapping consistent with pkg/corroborate/testdata/allowlist.yaml and
the generated demo rows.

In `@tools/corroborate/main_test.go`:
- Around line 39-49: The happy-path coverage in TestRunHappyPath only verifies
index.html and data/index.json, so add an assertion that run also emits at least
one data/series/*.json artifact. Update the test to check the output directory
for the per-recipe drilldown JSON files produced by run, using the existing
fixtureGCS and run helpers so a regression in the series artifact generation is
caught.

In `@tools/corroborate/main.go`:
- Around line 72-80: The run function currently validates only inDir, so an
empty outDir can still fall through to corroborate.Generate and write index.html
and data/ into the current working directory. Add a required-empty check for
outDir in run alongside the existing -in validation, returning the same
invalid-request style error before calling corroborate.Generate. Keep the fix
localized to run and use the existing option names InputDir and OutputDir to
make the validation easy to follow.

In `@tools/corroborate/README.md`:
- Around line 28-34: The fenced block in the README is missing a language tag,
which is causing markdown lint noise. Update that code block to use an explicit
language (for example, text) while keeping the existing content unchanged.
Locate the snippet that describes out/, index.html, and data/ in the README and
tag that fence appropriately.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/corroborate/meta.go`:
- Around line 80-99: The current pathname check in readBoundedFile still allows
a symlink-swap race between os.Lstat and os.Open, so fix the helper to open the
file atomically without following symlinks and then validate the opened
descriptor rather than re-checking the path. Update readBoundedFile to use a
safe open path for the file descriptor, keep the existing not-found/internal
error wrapping, and preserve the regular-file/symlink rejection behavior for
callers like LoadAllowlist, readRunMeta, and readCTRF.

---

Outside diff comments:
In `@pkg/corroborate/generate.go`:
- Around line 167-170: The input directory validation in collectRuns is
collapsing every os.Stat failure into “input dir not found,” which masks
permission and filesystem errors. Update the os.Stat check to treat only
os.IsNotExist(err) and the !info.IsDir() case as ErrCodeInvalidRequest, and have
all other errors returned as wrapped operational failures with their original
error details preserved.
- Around line 377-415: The drilldown is still grouped by source ID in
buildRecipe, so the same verified signer can appear multiple times even though
ComputeConsensus collapses it correctly. Pre-reduce the data in buildRecipe by
signerIdentityKey(run.meta.Signer) before building latest, signerIDs,
gridSigners, and downstream series, then select a canonical display source (or
explicit source list) for each verified signer so the UI shows one latest result
per signer.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/corroborate/generate.go`:
- Around line 405-409: The runsByID map is still keyed by the
metadata-controlled meta.Signer.IDHash, which can let a claimed hash overwrite
another signer’s series. Update the loop in generate.go to derive the source key
from locally verified issuer+identity data instead of trusting
meta.Signer.IDHash, and use that canonical ID when storing runs and when
registering/rendering sources so each signer remains distinct.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/corroborate/coordinate.go`:
- Around line 178-190: The canonical source key in canonicalSourceID is using
only a 12-hex SHA-256 prefix, which can collide and cause verified signers to
overwrite each other in the dashboard. Update canonicalSourceID in coordinate.go
to return a full stable key using the complete hash or the full
signerIdentityKey-derived value for storage and map indexing, and keep any
shortened 12-hex form only as a separate display label.

In `@tools/corroborate/main.go`:
- Around line 81-84: `parseAndRun` is collapsing all `run` failures into exit
code 1, which breaks the shared `pkg/errors` exit-code contract. Update the
`run(ctx, inDir, outDir, allowlist)` error path to preserve the coded
`pkg/errors` value by routing `err` through the existing exit-code helper
instead of hardcoding 1, so `INVALID_REQUEST` and `TIMEOUT` remain
distinguishable. Use the `parseAndRun` and `run` symbols to locate the fix, and
adjust the missing `-in` test to expect the preserved exit code.

---

Outside diff comments:
In `@pkg/corroborate/generate.go`:
- Around line 783-805: The emit function currently writes directly into the live
output directory and only checks cancellation inside the series loop, which can
leave a partial or stale dashboard behind. Update emit to build the full
dashboard in a clean temporary sibling directory, use canceledErr before each
write phase and in the loop, and only replace outputDir after all files are
written successfully. Keep the fix centered around emit, writeJSON, and the
outputDir/data/series flow so stale series files are not retained on reruns.