Open_Ultra_SAST/benchmarks/measurements/2026-09-23-measured-portioning.json

{
  "schema_version": 1,
  "experiment": "measured-portioning-v1",
  "date": "2026-09-23",
  "task": "contributor-scan 7.9",
  "frozen_commit": "1b28465",
  "claim_scope": "Portions sized from engine-reported per-answer cost, per family, with a measured fixed start and kill-culprit isolation; one PHP subject (Paid Memberships Pro) at 500 regions, 3600 s, 3 GB container. Same command as the 7.7 and 7.8 runs.",
  "hard_cap_7_7": {"completed": 153, "of": 406, "findings": 125, "seconds": 2338.2},
  "portioned_7_8": {"completed": 131, "of": 406, "findings": 125, "seconds": 2982.0},
  "measured_7_9": {"completed": 281, "of": 406, "findings": 224, "seconds": 2987.2},
  "per_family_7_9_vs_7_7": {
    "injection": {"done": [49, 93], "found": [24, 33]},
    "output_encoding": {"done": [32, 65], "found": [70, 125]},
    "path": {"done": [64, 96], "found": [15, 35]},
    "untrusted_destination": {"done": [8, 27], "found": [16, 31]},
    "access_control": {"done": [0, 0], "found": [0, 0]},
    "config_secrets": {"done": [0, 0], "found": [0, 0]},
    "prototype": {"done": [0, 0], "found": [0, 0]}
  },
  "declared_target": {"site": "classes/class.memberorder.php:936:getMemberOrderByCode", "rung": "model_entailed", "found": true},
  "instrument_check": "The first portion logged 21 answered in 187 s with a measured fixed start of 23 s; the fixed start stayed at 22-24 s for all 25 portions. The 7.8 constant assumed 70 s.",
  "kills": 0,
  "reading": "Completion rose from 131-153 to 281 of 406 at the same budget. The 7.8 loss was a sizer death spiral (budget stuck at 3 sink visits because portions under an assumed 70 s start read as uninformative), and measuring the fixed start and per-family rates removed it. No portion was killed, so the gain is attributable to sizing; the culprit-isolation path is unit-tested only.",
  "limits": [
    "One subject, one language, one budget.",
    "The census keeps ten examples per family: per-family finding counts did not fall, but strict containment of the earlier findings is not shown.",
    "Findings are unadjudicated; 224 is a count, not a precision. PHP output encoding is the likeliest false-positive source.",
    "99 taint questions were held for arbitration and access_control/config_secrets/prototype (39 questions) were never reached.",
    "69% completion against a 95% M4 gate; development data that qualifies nothing."
  ]
}