feat(pair-corpus-honesty): LLM-generated Real-Vuln repos and unlicensed agent fixes as pointer pairs

Task 8.4 (Req 10.6, 5.1).

- harvest.merge_recipes appends recipes by name and never rewrites
  existing rows.
- vibe-py/build_recipes.py --pointers: the 40 LLM-generated repositories
  without a license become vendored = false rows (80 pairs, agent,
  seeded) appended to recipes.toml; unlicensed human repos stay skipped.
- agent-vfc/build_recipes.py --from ... --pointers [--cache]: unlicensed
  agent-authored fixes become title-tier pointer rows whose function
  label is derived from the cached excerpt (30 added from a fresh
  662-candidate search); TOML booleans rendered correctly.
- catalogs regenerated: vibe-py 115 rows (35 vendored + 80 pointer),
  agent-vfc 59 (29 + 30); no excerpt is vendored for any pointer row.
- `pairs --slice vibe-py --pointers` scores both provenances (human 35,
  agent 80); the default run skips 80 pairs with pointer_pair_skipped;
  suite and gates unchanged. README/docs name the nightly command.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

tests/test_pair_corpus.py

@@ -464,9 +464,10 @@ def test_new_slices_load_offline_and_score_with_profiles() -> None:
         assert all(case.license for case in select_vendored(cases)), slice_name  # pointer rows may be unlicensed (Req 10)
         assert all(case.provenance == expected_provenance for case in select_vendored(cases)), slice_name
         assert {case.split for case in cases} <= {"train", "holdout"}
-        header = cases[0].vuln_file.read_text()[:600]
+        vendored = select_vendored(cases)  # pointer rows have no excerpt in the repository (Req 10)
+        header = vendored[0].vuln_file.read_text()[:600]
         assert "Provenance:" in header and "license:" in header
-        result = evaluate_catalog(cases[:2])
+        result = evaluate_catalog(vendored[:2])
         assert result.per_slice[slice_name].pairs == 2
         assert set(result.per_profile) <= PROVENANCES and expected_provenance in result.per_profile
         assert result.per_mechanism and slice_name in result.loss
@@ -963,3 +964,24 @@ def test_warm_cache_never_scores_pointer_pairs_when_network_is_off(tmp_path: Pat
     assert result.outcomes == ()
     assert {"stage": "pairs", "reason": "pointer_pair_skipped", "pair": "ptr"} in result.degradations
     assert evaluate_catalog([case], pointers=True).outcomes[0].pair_correct  # warm cache, network on: no fetch, scored
+
+
+def test_vibe_py_and_agent_vfc_carry_pointer_rows_and_the_default_run_skips_them() -> None:
+    """Req 10.6: LLM-generated Real-Vuln repos are agent/seeded pointer rows; unlicensed agent fixes are title pointer rows."""
+    import io
+    from contextlib import redirect_stdout
+
+    catalog = load_pair_catalog()
+    vibe = select_slice(catalog, "vibe-py")
+    pointers = [case for case in vibe if not case.vendored]
+    assert len(pointers) >= 40 and len({case.repo for case in pointers}) >= 40
+    assert all(case.provenance == "agent" and case.review_tier == "seeded" and not case.vuln_file.exists() for case in pointers)
+    assert len(select_vendored(vibe)) == 35 and all(case.provenance == "human" for case in select_vendored(vibe))
+    agent_pointers = [case for case in select_slice(catalog, "agent-vfc") if not case.vendored]
+    assert len(agent_pointers) >= 20 and all(case.review_tier == "title" and case.license == "unlicensed" for case in agent_pointers)
+    buf = io.StringIO()
+    with redirect_stdout(buf):
+        assert main(["pairs", "--slice", "vibe-py", "--json"]) == 0
+    payload = json.loads(buf.getvalue())
+    skipped = [item for item in payload["degradations"] if item["reason"] == "pointer_pair_skipped"]
+    assert len(skipped) == len(pointers) and payload["overall"]["pairs"] == 35

tests/test_pair_harvest.py

@@ -424,3 +424,101 @@ def test_catalog_gen_emits_pointer_rows_without_excerpts(tmp_path: Path, monkeyp
     (case,) = _load_catalog_file(catalog)
     assert case.vendored is False and case.provenance == "agent"
     assert not (slice_root / "training" / "manifest.jsonl").read_text().strip()  # pointer rows have no vendored files to train on
+
+
+# --- task 8.4: pointer recipes from the builders (Req 10.6) ---------------------
+
+
+def _ground_truth(tmp_path: Path) -> Path:
+    import json
+
+    gt = tmp_path / "gt"
+    gt.mkdir()
+    repos = {
+        "realvuln-vc-llm-app": {
+            "repo_url": "https://github.com/k/vc-llm-app",
+            "commit_sha": "c1",
+            "authorship": "llm_generated",
+            "framework": "flask",
+        },
+        "realvuln-human-nolic": {
+            "repo_url": "https://github.com/h/nolic",
+            "commit_sha": "c2",
+            "authorship": "human_authored",
+            "framework": "flask",
+        },
+        "realvuln-human-mit": {
+            "repo_url": "https://github.com/h/mit",
+            "commit_sha": "c3",
+            "authorship": "human_authored",
+            "framework": "flask",
+        },
+    }
+    (gt / "manifest.json").write_text(json.dumps({"repos": repos}))
+    findings = [
+        {
+            "id": "v1",
+            "is_vulnerable": True,
+            "file": "app.py",
+            "location": {"function": "run", "start_line": 3},
+            "vulnerability_class": "command_injection",
+            "primary_cwe": "CWE-78",
+            "evidence": {"description": "x"},
+        },
+        {
+            "id": "t1",
+            "is_vulnerable": False,
+            "file": "app.py",
+            "location": {"function": "safe", "start_line": 9},
+            "vulnerability_class": "command_injection",
+            "primary_cwe": "CWE-78",
+        },
+    ]
+    for repo_id in repos:
+        (gt / f"{repo_id}.json").write_text(json.dumps({"findings": findings}))
+    (gt / "licenses.json").write_text(
+        json.dumps(
+            {
+                "realvuln-vc-llm-app": {"full": "k/vc-llm-app", "license": ""},
+                "realvuln-human-nolic": {"full": "h/nolic", "license": ""},
+                "realvuln-human-mit": {"full": "h/mit", "license": "MIT"},
+            }
+        )
+    )
+    return gt
+
+
+def test_vibe_py_builder_pointers_mode_emits_llm_repos_as_unvendored_agent_rows(tmp_path: Path) -> None:
+    b = runpy.run_path(str(Path("benchmarks/pairs/vibe-py/build_recipes.py")), run_name="vibe_builder")
+    gt = _ground_truth(tmp_path)
+    recipes, skipped = b["build"](
+        gt, gt / "licenses.json", per_repo=2, classes={"command_injection"}, allow_unlicensed=False, pointers=True
+    )
+    by_repo = {r["repo"]: r for r in recipes}
+    assert set(by_repo) == {"k/vc-llm-app", "h/mit"}  # unlicensed human repos are neither vendored nor pointed at
+    llm = by_repo["k/vc-llm-app"]
+    assert llm["vendored"] is False and llm["provenance"] == "agent" and llm["review_tier"] == "seeded" and llm["license"] == "unlicensed"
+    assert llm["function"] == "run" and llm["fix_path"] == "app.py" and llm["fix_line"] == 9
+    assert "vendored" not in by_repo["h/mit"] and by_repo["h/mit"]["provenance"] == "human"
+    assert skipped["unlicensed"] == 1
+    text = b["to_toml"](recipes)
+    import tomllib
+
+    rows = tomllib.loads(text)["recipe"]
+    assert any(row.get("vendored") is False for row in rows)
+
+
+def test_merge_recipes_keeps_existing_rows_and_appends_new_by_name() -> None:
+    lib = _lib()
+    existing = [{"name": "a", "repo": "x", "license": "MIT"}, {"name": "b", "repo": "y", "license": "MIT"}]
+    new = [{"name": "b", "repo": "changed"}, {"name": "c", "repo": "z", "vendored": False}]
+    merged, added = lib["merge_recipes"](existing, new)
+    assert [r["name"] for r in merged] == ["a", "b", "c"] and merged[1]["repo"] == "y" and added == ["c"]
+
+
+def test_agent_vfc_builder_writes_toml_booleans() -> None:
+    import tomllib
+
+    b = runpy.run_path(str(Path("benchmarks/pairs/agent-vfc/build_recipes.py")), run_name="agent_builder")
+    (row,) = tomllib.loads(b["to_toml"]([{"name": "p", "vendored": False, "line": 3, "reviewer": "pending"}]))["recipe"]
+    assert row["vendored"] is False and row["line"] == 3