feat(plane): the improvement loop as a plane Run (harnessx-removal task 4)

`ousast plane workspaces --validation-set ... --loop` appends the loop to a Run:
per case `alerts` (plane/tasks/alerts.py: the quick-mode scan on the vulnerable
and the fixed pin, a fixed-pin Workspace per case, alerts attributed to their
enclosing function by the repo-facts patterns, `in_fix_range` from the fix's
old-side and new-side ranges, failing on an unread tree) feeding `remember`,
then `memory-snapshot` -> `loop-measure` -> `loop-propose` -> `loop-improve`
(plane/tasks/loop.py). Every new task binds no Model and has budget
{usd: 0, calls: 0}. The snapshot is the store's rows after the train-on-test
guard, written on the host by memory.seed (a sandboxed run of it fails loudly);
propose runs M1/M2 against this repository at the commit under test; improve
runs one unchanged evolve.run_round and delivers gate.json, journal.json, the
sidecar, rule_policy.json only when accepted, and proposal_outcome rows that
the host ingests. Adoption stays a maintainer commit.

`remember` is now a Run entry per case (the image contains it), with the facts
row keyed by the image the facts were computed on (repo-facts records it in
its summary; unknown -> the row is omitted, never guessed). Alert rows carry
their own pin; improve/memory.py counts a repeated alert once.

Runner image rebuilt (+0.39 MB: only the new modules; the quick scan needs no
extra and the rulesets were already in the package), pushed, plane/ re-pinned
and regenerated (validation-46: 105 entries). Fixture test runs the whole loop
graph through the fake ax, whose new `exec` mode runs the real task modules.
Live: one loop Run over three validation-46 cases on the local ax, recorded in
benchmarks/measurements/2026-09-30-harnessx-removal-loop/ (all done, $0 new
spend, 0 proposals, gate verdict no_proposals).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

benchmarks/measurements/2026-09-08-module-audit.json

@@ -1,7 +1,7 @@
 {
-  "modules": 135,
+  "modules": 137,
   "counts": {
-    "load_bearing": 126,
+    "load_bearing": 128,
     "standalone_capability": 9
   },
   "orphaned": [],
@@ -27,7 +27,8 @@
         "improve.evolve",
         "map_gate",
         "mcp",
-        "pairs"
+        "pairs",
+        "plane.tasks.loop"
       ]
     },
     {
@@ -232,6 +233,7 @@
         "model.ladder",
         "model.report",
         "pairs",
+        "plane.tasks.alerts",
         "rank",
         "regress.candidate",
         "reports",
@@ -258,7 +260,8 @@
       "classification": "load_bearing",
       "reason": "entry point",
       "importers": [
-        "cli"
+        "cli",
+        "plane.tasks.loop"
       ]
     },
     {
@@ -314,7 +317,8 @@
       "importers": [
         "cli",
         "improve.evolve",
-        "improve.memory"
+        "improve.memory",
+        "plane.tasks.loop"
       ]
     },
     {
@@ -322,7 +326,8 @@
       "classification": "load_bearing",
       "reason": "reachable from gate, map_gate, pair_gate or the CLI",
       "importers": [
-        "improve"
+        "improve",
+        "plane.tasks.loop"
       ]
     },
     {
@@ -332,7 +337,8 @@
       "importers": [
         "improve",
         "improve.evolve",
-        "improve.memory"
+        "improve.memory",
+        "plane.tasks.loop"
       ]
     },
     {
@@ -341,7 +347,8 @@
       "reason": "reachable from gate, map_gate, pair_gate or the CLI",
       "importers": [
         "cli",
-        "improve.evolve"
+        "improve.evolve",
+        "plane.tasks.loop"
       ]
     },
     {
@@ -351,7 +358,8 @@
       "importers": [
         "improve",
         "improve.evolve",
-        "improve.memory"
+        "improve.memory",
+        "plane.tasks.loop"
       ]
     },
     {
@@ -381,6 +389,7 @@
         "map_gate",
         "model.scan",
         "pairs",
+        "plane.tasks.alerts",
         "preprocess",
         "push.runner",
         "stage_processors"
@@ -666,7 +675,8 @@
         "improve.evolve",
         "improve.memory",
         "model.candidates",
-        "pair_gate"
+        "pair_gate",
+        "plane.tasks.loop"
       ]
     },
     {
@@ -682,6 +692,7 @@
         "plane.reconciler",
         "plane.router",
         "plane.runner",
+        "plane.tasks.loop",
         "plane.tasks.remember",
         "plane.tasks.verify",
         "plane.workspaces"
@@ -740,6 +751,7 @@
       "importers": [
         "improve.memory",
         "plane.generate",
+        "plane.tasks.loop",
         "plane.tasks.remember"
       ]
     },
@@ -775,7 +787,9 @@
       "importers": [
         "cli",
         "plane.generate",
+        "plane.memory",
         "plane.tasks.agree",
+        "plane.tasks.alerts",
         "plane.tasks.remember"
       ]
     },
@@ -785,6 +799,20 @@
       "reason": "ai-service-plane Req 5.3/2.1: agreement across two verify passes with per-candidate cost, turns and site match",
       "importers": []
     },
+    {
+      "module": "plane.tasks.alerts",
+      "classification": "load_bearing",
+      "reason": "harnessx-removal Req 6.3: quick-mode alerts on a case's vulnerable and fixed pins, model-free",
+      "importers": []
+    },
+    {
+      "module": "plane.tasks.loop",
+      "classification": "load_bearing",
+      "reason": "harnessx-removal Req 6.3: the improvement loop's snapshot, measure, propose and improve steps",
+      "importers": [
+        "plane.memory"
+      ]
+    },
     {
       "module": "plane.tasks.remember",
       "classification": "load_bearing",
@@ -799,6 +827,7 @@
       "reason": "ai-service-plane Req 5.1/5.2: source-only functions and callers per file; runner integration pending",
       "importers": [
         "plane.generate",
+        "plane.tasks.alerts",
         "plane.tasks.remember"
       ]
     },
@@ -830,6 +859,7 @@
         "hunter_harness",
         "improve.evolve",
         "improve.validator",
+        "plane.tasks.loop",
         "scoring.project_score",
         "semantic.overlay",
         "stage_processors"
@@ -865,6 +895,7 @@
         "model.partitions",
         "model.scan",
         "pairs",
+        "plane.tasks.alerts",
         "plane.tasks.repo_facts",
         "push.runner",
         "rank",
@@ -1045,6 +1076,7 @@
         "improve.evolve",
         "map_gate",
         "pairs",
+        "plane.tasks.alerts",
         "stage_processors"
       ]
     },
@@ -1136,6 +1168,7 @@
         "improve.memory",
         "improve.validator",
         "pairs",
+        "plane.tasks.loop",
         "stage_processors"
       ]
     },

benchmarks/measurements/2026-09-30-harnessx-removal-loop/gate.json

@@ -0,0 +1,29 @@
+{
+  "accepted": false,
+  "adoption": null,
+  "benchmark_edits": [],
+  "manifest": "benchmarks/manifests/java-spring-boot-vulnerable.toml",
+  "memory_edits": [],
+  "outcome": {
+    "accepted": false,
+    "degradations": [],
+    "edits": [],
+    "fp_after": 0.0,
+    "fp_before": 0.0,
+    "matched_after": 2,
+    "matched_before": 2,
+    "per_profile_after": {},
+    "per_profile_before": {},
+    "profile_regressions": [],
+    "profiles_under_minimum": [],
+    "reason": "no_proposals",
+    "recall_after": 1.0,
+    "recall_before": 1.0,
+    "round": 1,
+    "score_after": 73,
+    "score_before": 73
+  },
+  "proposals": 0,
+  "reason": "no_proposals",
+  "round": 1
+}

benchmarks/measurements/2026-09-30-harnessx-removal-loop/measure.json

@@ -0,0 +1,140 @@
+{
+  "inputs_bytes": {
+    "froxlor_admin_ip_second_order_sqli": 5943,
+    "lmdeploy_media_url_ssrf": 43730,
+    "wp_gopay_log_filter_sqli": 1947
+  },
+  "rows": {
+    "run": 87,
+    "snapshot": 119,
+    "union": 191
+  },
+  "run": "validation-46",
+  "run_metrics": {
+    "agreed": 4,
+    "alerts": {
+      "c-shell-exec": {
+        "fixed": 2,
+        "fixed_in_fix_range": 0,
+        "vulnerable": 2
+      },
+      "c-unsafe-memory-copy": {
+        "fixed": 2,
+        "fixed_in_fix_range": 0,
+        "vulnerable": 2
+      },
+      "python-shell-true": {
+        "fixed": 1,
+        "fixed_in_fix_range": 0,
+        "vulnerable": 1
+      },
+      "python-unsafe-deserialization": {
+        "fixed": 8,
+        "fixed_in_fix_range": 0,
+        "vulnerable": 8
+      },
+      "python-unsafe-eval": {
+        "fixed": 23,
+        "fixed_in_fix_range": 0,
+        "vulnerable": 23
+      }
+    },
+    "candidates": 5,
+    "cases": 3,
+    "declared_sites_agreed": 4,
+    "declared_sites_matched": 5,
+    "dispute_rate": {
+      "injection": {
+        "candidates": 4,
+        "disputed": 1,
+        "rate": 0.25
+      },
+      "untrusted_destination": {
+        "candidates": 1,
+        "disputed": 0,
+        "rate": 0.0
+      }
+    },
+    "disputed": 1,
+    "rejected": 0,
+    "tiebreaks": 3,
+    "usd": 0.130134,
+    "usd_per_candidate": 0.026027
+  },
+  "store_metrics": {
+    "agreed": 28,
+    "alerts": {},
+    "candidates": 43,
+    "cases": 14,
+    "declared_sites_agreed": 16,
+    "declared_sites_matched": 19,
+    "dispute_rate": {
+      "injection": {
+        "candidates": 38,
+        "disputed": 5,
+        "rate": 0.1316
+      },
+      "untrusted_destination": {
+        "candidates": 5,
+        "disputed": 0,
+        "rate": 0.0
+      }
+    },
+    "disputed": 5,
+    "rejected": 10,
+    "tiebreaks": 10,
+    "usd": 0.856679,
+    "usd_per_candidate": 0.019923
+  },
+  "union_metrics": {
+    "agreed": 28,
+    "alerts": {
+      "c-shell-exec": {
+        "fixed": 2,
+        "fixed_in_fix_range": 0,
+        "vulnerable": 2
+      },
+      "c-unsafe-memory-copy": {
+        "fixed": 2,
+        "fixed_in_fix_range": 0,
+        "vulnerable": 2
+      },
+      "python-shell-true": {
+        "fixed": 1,
+        "fixed_in_fix_range": 0,
+        "vulnerable": 1
+      },
+      "python-unsafe-deserialization": {
+        "fixed": 8,
+        "fixed_in_fix_range": 0,
+        "vulnerable": 8
+      },
+      "python-unsafe-eval": {
+        "fixed": 23,
+        "fixed_in_fix_range": 0,
+        "vulnerable": 23
+      }
+    },
+    "candidates": 43,
+    "cases": 14,
+    "declared_sites_agreed": 16,
+    "declared_sites_matched": 19,
+    "dispute_rate": {
+      "injection": {
+        "candidates": 38,
+        "disputed": 5,
+        "rate": 0.1316
+      },
+      "untrusted_destination": {
+        "candidates": 5,
+        "disputed": 0,
+        "rate": 0.0
+      }
+    },
+    "disputed": 5,
+    "rejected": 10,
+    "tiebreaks": 10,
+    "usd": 0.856679,
+    "usd_per_candidate": 0.019923
+  }
+}

benchmarks/measurements/2026-09-30-harnessx-removal-loop/record.json

@@ -0,0 +1,335 @@
+{
+  "attribution_loop_tasks": [
+    {
+      "cache_hit": null,
+      "calls": 0,
+      "model": null,
+      "output": null,
+      "prompt": null,
+      "status": "done",
+      "task": "memory-snapshot",
+      "usd": null
+    },
+    {
+      "cache_hit": null,
+      "calls": 0,
+      "model": null,
+      "output": null,
+      "prompt": null,
+      "status": "done",
+      "task": "froxlor-admin-ip-second-order-sqli-alerts",
+      "usd": 0
+    },
+    {
+      "cache_hit": null,
+      "calls": 0,
+      "model": null,
+      "output": null,
+      "prompt": null,
+      "status": "done",
+      "task": "froxlor-admin-ip-second-order-sqli-remember",
+      "usd": 0
+    },
+    {
+      "cache_hit": null,
+      "calls": 0,
+      "model": null,
+      "output": null,
+      "prompt": null,
+      "status": "done",
+      "task": "lmdeploy-media-url-ssrf-alerts",
+      "usd": 0
+    },
+    {
+      "cache_hit": null,
+      "calls": 0,
+      "model": null,
+      "output": null,
+      "prompt": null,
+      "status": "done",
+      "task": "lmdeploy-media-url-ssrf-remember",
+      "usd": 0
+    },
+    {
+      "cache_hit": null,
+      "calls": 0,
+      "model": null,
+      "output": null,
+      "prompt": null,
+      "status": "done",
+      "task": "wp-gopay-log-filter-sqli-alerts",
+      "usd": 0
+    },
+    {
+      "cache_hit": null,
+      "calls": 0,
+      "model": null,
+      "output": null,
+      "prompt": null,
+      "status": "done",
+      "task": "wp-gopay-log-filter-sqli-remember",
+      "usd": 0
+    },
+    {
+      "cache_hit": null,
+      "calls": 0,
+      "model": null,
+      "output": null,
+      "prompt": null,
+      "status": "done",
+      "task": "loop-measure",
+      "usd": 0
+    },
+    {
+      "cache_hit": null,
+      "calls": 0,
+      "model": null,
+      "output": null,
+      "prompt": null,
+      "status": "done",
+      "task": "loop-propose",
+      "usd": 0
+    },
+    {
+      "cache_hit": null,
+      "calls": 0,
+      "model": null,
+      "output": null,
+      "prompt": null,
+      "status": "done",
+      "task": "loop-improve",
+      "usd": 0
+    }
+  ],
+  "cases": [
+    "wp-gopay-log-filter-sqli",
+    "lmdeploy-media-url-ssrf",
+    "froxlor-admin-ip-second-order-sqli"
+  ],
+  "new_spend_usd": 0.0,
+  "note": "harnessx-removal task 4: one live loop Run on the local ax (kind), 2026-09-30. The Run is validation-46 restricted to three cases (set.json) plus the loop; the cases' chain tasks (facts, va, vb, agree, vc, final) were already done in ~/ousast-results/plane/validation-46 and were not rerun. Runner image localhost:5001/ousast-runner@sha256:7fbd523f127f1e15eddc48b06e73acf75fa70f741d36e0749e74ca883797f6c9; loop-propose/loop-improve bound github.com/norandom/OpenUltraSAST at 1ad472c (origin/main, whose benchmarks/ manifests, fixtures and pairs equal the commit under test); the code under test is the image's package.",
+  "tasks": {
+    "froxlor-admin-ip-second-order-sqli-alerts": {
+      "finished": "2026-09-30T09:51:22+00:00",
+      "started": "2026-09-30T09:50:49+00:00",
+      "status": "done",
+      "summary": {
+        "alerts": {
+          "fixed": 0,
+          "vulnerable": 0
+        },
+        "calls": 0,
+        "model": null,
+        "read": {
+          "fixed": {
+            "bytes": 4256572,
+            "files": 366
+          },
+          "vulnerable": {
+            "bytes": 4256094,
+            "files": 366
+          }
+        },
+        "status": "done",
+        "units_done": 2,
+        "units_total": 2,
+        "usage": {},
+        "usd": 0
+      }
+    },
+    "froxlor-admin-ip-second-order-sqli-remember": {
+      "finished": "2026-09-30T09:51:51+00:00",
+      "started": "2026-09-30T09:51:22+00:00",
+      "status": "done",
+      "summary": {
+        "calls": 0,
+        "facts_row": "omitted: the facts task's summary names no image, and a reuse key must not guess it",
+        "model": null,
+        "rows": 9,
+        "status": "done",
+        "units_done": 1,
+        "units_total": 1,
+        "usage": {},
+        "usd": 0
+      }
+    },
+    "lmdeploy-media-url-ssrf-alerts": {
+      "finished": "2026-09-30T09:52:27+00:00",
+      "started": "2026-09-30T09:51:22+00:00",
+      "status": "done",
+      "summary": {
+        "alerts": {
+          "fixed": 36,
+          "vulnerable": 36
+        },
+        "calls": 0,
+        "model": null,
+        "read": {
+          "fixed": {
+            "bytes": 8353172,
+            "files": 1084
+          },
+          "vulnerable": {
+            "bytes": 8340364,
+            "files": 1084
+          }
+        },
+        "status": "done",
+        "units_done": 2,
+        "units_total": 2,
+        "usage": {},
+        "usd": 0
+      }
+    },
+    "lmdeploy-media-url-ssrf-remember": {
+      "finished": "2026-09-30T09:52:56+00:00",
+      "started": "2026-09-30T09:52:27+00:00",
+      "status": "done",
+      "summary": {
+        "calls": 0,
+        "facts_row": "omitted: the facts task's summary names no image, and a reuse key must not guess it",
+        "model": null,
+        "rows": 75,
+        "status": "done",
+        "units_done": 1,
+        "units_total": 1,
+        "usage": {},
+        "usd": 0
+      }
+    },
+    "loop-improve": {
+      "finished": "2026-09-30T09:54:44+00:00",
+      "started": "2026-09-30T09:54:17+00:00",
+      "status": "done",
+      "summary": {
+        "accepted": false,
+        "calls": 0,
+        "edits": 0,
+        "memory_edits": 0,
+        "model": null,
+        "reason": "no_proposals",
+        "status": "done",
+        "step": "improve",
+        "units_done": 1,
+        "units_total": 1,
+        "usage": {},
+        "usd": 0
+      }
+    },
+    "loop-measure": {
+      "finished": "2026-09-30T09:53:50+00:00",
+      "started": "2026-09-30T09:53:27+00:00",
+      "status": "done",
+      "summary": {
+        "calls": 0,
+        "model": null,
+        "rows": {
+          "run": 87,
+          "snapshot": 119,
+          "union": 191
+        },
+        "status": "done",
+        "step": "measure",
+        "units_done": 1,
+        "units_total": 1,
+        "usage": {},
+        "usd": 0
+      }
+    },
+    "loop-propose": {
+      "finished": "2026-09-30T09:54:17+00:00",
+      "started": "2026-09-30T09:53:50+00:00",
+      "status": "done",
+      "summary": {
+        "calls": 0,
+        "excluded": 0,
+        "kept": 191,
+        "model": null,
+        "proposals": 0,
+        "rows": 191,
+        "status": "done",
+        "step": "propose",
+        "units_done": 1,
+        "units_total": 1,
+        "usage": {},
+        "usd": 0
+      }
+    },
+    "memory-snapshot": {
+      "finished": "2026-09-30T09:50:48+00:00",
+      "started": null,
+      "status": "done",
+      "summary": {
+        "calls": 0,
+        "model": null,
+        "reused": {
+          "excluded": {
+            "gated_case": {},
+            "holdout_pair": {},
+            "population": {},
+            "rows": 0
+          },
+          "guard": {
+            "catalog": "benchmarks/pairs/catalog.toml",
+            "manifest": "benchmarks/manifests/java-spring-boot-vulnerable.toml",
+            "populations": []
+          },
+          "index_digest": "6fa3c76576e6706a8b5b439611c15f1337754a2243ab95d6d9b45899b06c5215",
+          "index_entries": 15,
+          "kept": 119,
+          "rows": 119,
+          "store": "file:///tmp/claude-1000/-home-mc-Source-OpenUltraSAST/c09e30b2-39a4-4564-bc31-6ea71ffaa198/scratchpad/hxr2/memory"
+        },
+        "status": "done",
+        "units_done": 1,
+        "units_total": 1,
+        "usage": {},
+        "usd": null
+      }
+    },
+    "wp-gopay-log-filter-sqli-alerts": {
+      "finished": "2026-09-30T09:52:59+00:00",
+      "started": "2026-09-30T09:52:27+00:00",
+      "status": "done",
+      "summary": {
+        "alerts": {
+          "fixed": 0,
+          "vulnerable": 0
+        },
+        "calls": 0,
+        "model": null,
+        "read": {
+          "fixed": {
+            "bytes": 150539,
+            "files": 19
+          },
+          "vulnerable": {
+            "bytes": 150528,
+            "files": 19
+          }
+        },
+        "status": "done",
+        "units_done": 2,
+        "units_total": 2,
+        "usage": {},
+        "usd": 0
+      }
+    },
+    "wp-gopay-log-filter-sqli-remember": {
+      "finished": "2026-09-30T09:53:27+00:00",
+      "started": "2026-09-30T09:52:59+00:00",
+      "status": "done",
+      "summary": {
+        "calls": 0,
+        "facts_row": "omitted: the facts task's summary names no image, and a reuse key must not guess it",
+        "model": null,
+        "rows": 3,
+        "status": "done",
+        "units_done": 1,
+        "units_total": 1,
+        "usage": {},
+        "usd": 0
+      }
+    }
+  }
+}

benchmarks/measurements/2026-09-30-harnessx-removal-loop/run.yaml

@@ -0,0 +1,320 @@
+# generated by `ousast plane workspaces benchmarks/independent/population-v2.toml --validation-set /tmp/claude-1000/-home-mc-Source-OpenUltraSAST/c09e30b2-39a4-4564-bc31-6ea71ffaa198/scratchpad/hxr4/set/validation.json --candidates ~/ousast-results/independent-v2-modelsinks --triage ~/ousast-results/independent-v2-batched-check/scans --repos ~/.cache/openultrasast/independent --run validation-46 --loop --loop-commit 1ad472c68d759e4ef010bd7a2e23532b1de538a9 --loop-repo https://github.com/norandom/OpenUltraSAST.git --loop-manifest benchmarks/manifests/java-spring-boot-vulnerable.toml`; do not edit, regenerate.
+# 3 cases, 5 candidates (5 kept by the recorded triage); usd ceiling 0.33.
+apiVersion: openultrasast.io/v1alpha1
+kind: Run
+metadata:
+  name: validation-46
+  annotations:
+    openultrasast.io/population: population-v2
+    openultrasast.io/split: validation
+spec:
+  tasks:
+  - name: froxlor-admin-ip-second-order-sqli-facts
+    task: repo-facts-froxlor-admin-ip-second-order-sqli
+    outputs:
+    - facts.json
+    budget: &id001
+      usd: 0
+      calls: 0
+    serialize: repo-facts
+  - name: froxlor-admin-ip-second-order-sqli-va
+    task: verify-a-froxlor-admin-ip-second-order-sqli
+    inputs:
+      facts: froxlor-admin-ip-second-order-sqli-facts/facts.json
+    outputs:
+    - units.jsonl
+    - summary.json
+    budget:
+      usd: 0.07
+      calls: 16
+  - name: froxlor-admin-ip-second-order-sqli-vb
+    task: verify-b-froxlor-admin-ip-second-order-sqli
+    inputs:
+      facts: froxlor-admin-ip-second-order-sqli-facts/facts.json
+    outputs:
+    - units.jsonl
+    - summary.json
+    budget:
+      usd: 0.07
+      calls: 16
+  - name: froxlor-admin-ip-second-order-sqli-agree
+    task: agree-froxlor-admin-ip-second-order-sqli
+    inputs:
+      pass_a: froxlor-admin-ip-second-order-sqli-va/units.jsonl
+      pass_b: froxlor-admin-ip-second-order-sqli-vb/units.jsonl
+    outputs:
+    - agreed.json
+    - disputed.json
+    budget: *id001
+  - name: lmdeploy-media-url-ssrf-facts
+    task: repo-facts-lmdeploy-media-url-ssrf
+    outputs:
+    - facts.json
+    budget: &id002
+      usd: 0
+      calls: 0
+    serialize: repo-facts
+  - name: lmdeploy-media-url-ssrf-va
+    task: verify-a-lmdeploy-media-url-ssrf
+    inputs:
+      facts: lmdeploy-media-url-ssrf-facts/facts.json
+    outputs:
+    - units.jsonl
+    - summary.json
+    budget:
+      usd: 0.02
+      calls: 8
+  - name: lmdeploy-media-url-ssrf-vb
+    task: verify-b-lmdeploy-media-url-ssrf
+    inputs:
+      facts: lmdeploy-media-url-ssrf-facts/facts.json
+    outputs:
+    - units.jsonl
+    - summary.json
+    budget:
+      usd: 0.02
+      calls: 8
+  - name: lmdeploy-media-url-ssrf-agree
+    task: agree-lmdeploy-media-url-ssrf
+    inputs:
+      pass_a: lmdeploy-media-url-ssrf-va/units.jsonl
+      pass_b: lmdeploy-media-url-ssrf-vb/units.jsonl
+    outputs:
+    - agreed.json
+    - disputed.json
+    budget: *id002
+  - name: wp-gopay-log-filter-sqli-facts
+    task: repo-facts-wp-gopay-log-filter-sqli
+    outputs:
+    - facts.json
+    budget: &id003
+      usd: 0
+      calls: 0
+    serialize: repo-facts
+  - name: wp-gopay-log-filter-sqli-va
+    task: verify-a-wp-gopay-log-filter-sqli
+    inputs:
+      facts: wp-gopay-log-filter-sqli-facts/facts.json
+    outputs:
+    - units.jsonl
+    - summary.json
+    budget:
+      usd: 0.02
+      calls: 8
+  - name: wp-gopay-log-filter-sqli-vb
+    task: verify-b-wp-gopay-log-filter-sqli
+    inputs:
+      facts: wp-gopay-log-filter-sqli-facts/facts.json
+    outputs:
+    - units.jsonl
+    - summary.json
+    budget:
+      usd: 0.02
+      calls: 8
+  - name: wp-gopay-log-filter-sqli-agree
+    task: agree-wp-gopay-log-filter-sqli
+    inputs:
+      pass_a: wp-gopay-log-filter-sqli-va/units.jsonl
+      pass_b: wp-gopay-log-filter-sqli-vb/units.jsonl
+    outputs:
+    - agreed.json
+    - disputed.json
+    budget: *id003
+  - name: froxlor-admin-ip-second-order-sqli-vc
+    task: verify-c-froxlor-admin-ip-second-order-sqli
+    dependsOn:
+    - froxlor-admin-ip-second-order-sqli-agree
+    inputs:
+      facts: froxlor-admin-ip-second-order-sqli-facts/facts.json
+      only: froxlor-admin-ip-second-order-sqli-agree/disputed.json
+    outputs:
+    - units.jsonl
+    - summary.json
+    budget:
+      usd: 0.07
+      calls: 16
+  - name: froxlor-admin-ip-second-order-sqli-final
+    task: agree-froxlor-admin-ip-second-order-sqli
+    inputs:
+      pass_a: froxlor-admin-ip-second-order-sqli-va/units.jsonl
+      pass_b: froxlor-admin-ip-second-order-sqli-vb/units.jsonl
+      pass_c: froxlor-admin-ip-second-order-sqli-vc/units.jsonl
+    outputs:
+    - agreed.json
+    - disputed.json
+    budget:
+      usd: 0
+      calls: 0
+  - name: lmdeploy-media-url-ssrf-vc
+    task: verify-c-lmdeploy-media-url-ssrf
+    dependsOn:
+    - lmdeploy-media-url-ssrf-agree
+    inputs:
+      facts: lmdeploy-media-url-ssrf-facts/facts.json
+      only: lmdeploy-media-url-ssrf-agree/disputed.json
+    outputs:
+    - units.jsonl
+    - summary.json
+    budget:
+      usd: 0.02
+      calls: 8
+  - name: lmdeploy-media-url-ssrf-final
+    task: agree-lmdeploy-media-url-ssrf
+    inputs:
+      pass_a: lmdeploy-media-url-ssrf-va/units.jsonl
+      pass_b: lmdeploy-media-url-ssrf-vb/units.jsonl
+      pass_c: lmdeploy-media-url-ssrf-vc/units.jsonl
+    outputs:
+    - agreed.json
+    - disputed.json
+    budget:
+      usd: 0
+      calls: 0
+  - name: wp-gopay-log-filter-sqli-vc
+    task: verify-c-wp-gopay-log-filter-sqli
+    dependsOn:
+    - wp-gopay-log-filter-sqli-agree
+    inputs:
+      facts: wp-gopay-log-filter-sqli-facts/facts.json
+      only: wp-gopay-log-filter-sqli-agree/disputed.json
+    outputs:
+    - units.jsonl
+    - summary.json
+    budget:
+      usd: 0.02
+      calls: 8
+  - name: wp-gopay-log-filter-sqli-final
+    task: agree-wp-gopay-log-filter-sqli
+    inputs:
+      pass_a: wp-gopay-log-filter-sqli-va/units.jsonl
+      pass_b: wp-gopay-log-filter-sqli-vb/units.jsonl
+      pass_c: wp-gopay-log-filter-sqli-vc/units.jsonl
+    outputs:
+    - agreed.json
+    - disputed.json
+    budget:
+      usd: 0
+      calls: 0
+  - name: froxlor-admin-ip-second-order-sqli-alerts
+    task: alerts-froxlor-admin-ip-second-order-sqli
+    outputs:
+    - alerts.jsonl
+    budget:
+      usd: 0
+      calls: 0
+    serialize: engine
+  - name: froxlor-admin-ip-second-order-sqli-remember
+    task: remember-froxlor-admin-ip-second-order-sqli
+    inputs:
+      facts: froxlor-admin-ip-second-order-sqli-facts/facts.json
+      facts_summary: froxlor-admin-ip-second-order-sqli-facts/summary.json
+      pass_a: froxlor-admin-ip-second-order-sqli-va/units.jsonl
+      summary_a: froxlor-admin-ip-second-order-sqli-va/summary.json
+      pass_b: froxlor-admin-ip-second-order-sqli-vb/units.jsonl
+      summary_b: froxlor-admin-ip-second-order-sqli-vb/summary.json
+      pass_c: froxlor-admin-ip-second-order-sqli-vc/units.jsonl
+      summary_c: froxlor-admin-ip-second-order-sqli-vc/summary.json
+      agreed: froxlor-admin-ip-second-order-sqli-final/agreed.json
+      alerts: froxlor-admin-ip-second-order-sqli-alerts/alerts.jsonl
+    outputs:
+    - memory.jsonl
+    budget:
+      usd: 0
+      calls: 0
+  - name: lmdeploy-media-url-ssrf-alerts
+    task: alerts-lmdeploy-media-url-ssrf
+    outputs:
+    - alerts.jsonl
+    budget:
+      usd: 0
+      calls: 0
+    serialize: engine
+  - name: lmdeploy-media-url-ssrf-remember
+    task: remember-lmdeploy-media-url-ssrf
+    inputs:
+      facts: lmdeploy-media-url-ssrf-facts/facts.json
+      facts_summary: lmdeploy-media-url-ssrf-facts/summary.json
+      pass_a: lmdeploy-media-url-ssrf-va/units.jsonl
+      summary_a: lmdeploy-media-url-ssrf-va/summary.json
+      pass_b: lmdeploy-media-url-ssrf-vb/units.jsonl
+      summary_b: lmdeploy-media-url-ssrf-vb/summary.json
+      pass_c: lmdeploy-media-url-ssrf-vc/units.jsonl
+      summary_c: lmdeploy-media-url-ssrf-vc/summary.json
+      agreed: lmdeploy-media-url-ssrf-final/agreed.json
+      alerts: lmdeploy-media-url-ssrf-alerts/alerts.jsonl
+    outputs:
+    - memory.jsonl
+    budget:
+      usd: 0
+      calls: 0
+  - name: wp-gopay-log-filter-sqli-alerts
+    task: alerts-wp-gopay-log-filter-sqli
+    outputs:
+    - alerts.jsonl
+    budget:
+      usd: 0
+      calls: 0
+    serialize: engine
+  - name: wp-gopay-log-filter-sqli-remember
+    task: remember-wp-gopay-log-filter-sqli
+    inputs:
+      facts: wp-gopay-log-filter-sqli-facts/facts.json
+      facts_summary: wp-gopay-log-filter-sqli-facts/summary.json
+      pass_a: wp-gopay-log-filter-sqli-va/units.jsonl
+      summary_a: wp-gopay-log-filter-sqli-va/summary.json
+      pass_b: wp-gopay-log-filter-sqli-vb/units.jsonl
+      summary_b: wp-gopay-log-filter-sqli-vb/summary.json
+      pass_c: wp-gopay-log-filter-sqli-vc/units.jsonl
+      summary_c: wp-gopay-log-filter-sqli-vc/summary.json
+      agreed: wp-gopay-log-filter-sqli-final/agreed.json
+      alerts: wp-gopay-log-filter-sqli-alerts/alerts.jsonl
+    outputs:
+    - memory.jsonl
+    budget:
+      usd: 0
+      calls: 0
+  - name: memory-snapshot
+    task: memory-snapshot
+    outputs:
+    - rows.jsonl
+    - index.json
+    budget:
+      usd: 0
+      calls: 0
+  - name: loop-measure
+    task: loop-measure
+    inputs:
+      remember_froxlor-admin-ip-second-order-sqli: froxlor-admin-ip-second-order-sqli-remember/memory.jsonl
+      remember_lmdeploy-media-url-ssrf: lmdeploy-media-url-ssrf-remember/memory.jsonl
+      remember_wp-gopay-log-filter-sqli: wp-gopay-log-filter-sqli-remember/memory.jsonl
+      snapshot: memory-snapshot/rows.jsonl
+    outputs:
+    - measure.json
+    - rows.jsonl
+    budget:
+      usd: 0
+      calls: 0
+  - name: loop-propose
+    task: loop-propose
+    inputs:
+      measure: loop-measure/measure.json
+      rows: loop-measure/rows.jsonl
+      index: memory-snapshot/index.json
+    outputs:
+    - proposals.jsonl
+    - memory_proposals.jsonl
+    - signals.json
+    budget:
+      usd: 0
+      calls: 0
+  - name: loop-improve
+    task: loop-improve
+    inputs:
+      proposals: loop-propose/proposals.jsonl
+    outputs:
+    - gate.json
+    - journal.json
+    budget:
+      usd: 0
+      calls: 0
+    serialize: engine

benchmarks/measurements/2026-09-30-harnessx-removal-loop/set.json

@@ -0,0 +1,28 @@
+{
+ "wp-gopay-log-filter-sqli": [
+  [
+   "admin/views/log.php",
+   "<global>"
+  ]
+ ],
+ "lmdeploy-media-url-ssrf": [
+  [
+   "lmdeploy/vl/media/connection.py",
+   "_load_http_url"
+  ]
+ ],
+ "froxlor-admin-ip-second-order-sqli": [
+  [
+   "lib/Froxlor/Api/Commands/Domains.php",
+   "validateIpAddresses"
+  ],
+  [
+   "lib/Froxlor/Api/Commands/IpsAndPorts.php",
+   "listing"
+  ],
+  [
+   "lib/Froxlor/Api/Commands/IpsAndPorts.php",
+   "listingCount"
+  ]
+ ]
+}

benchmarks/measurements/2026-09-30-harnessx-removal-loop/signals.json

@@ -0,0 +1,8 @@
+{
+  "advisory": true,
+  "disputed_families": [],
+  "thresholds": {
+    "min_candidates": 5,
+    "min_dispute_rate": 0.3
+  }
+}

benchmarks/measurements/2026-09-30-harnessx-removal-loop/snapshot-index.json

@@ -0,0 +1,18 @@
+{
+  "excluded": {
+    "gated_case": {},
+    "holdout_pair": {},
+    "population": {},
+    "rows": 0
+  },
+  "guard": {
+    "catalog": "benchmarks/pairs/catalog.toml",
+    "manifest": "benchmarks/manifests/java-spring-boot-vulnerable.toml",
+    "populations": []
+  },
+  "index_digest": "6fa3c76576e6706a8b5b439611c15f1337754a2243ab95d6d9b45899b06c5215",
+  "index_entries": 15,
+  "kept": 119,
+  "rows": 119,
+  "store": "file:///tmp/claude-1000/-home-mc-Source-OpenUltraSAST/c09e30b2-39a4-4564-bc31-6ea71ffaa198/scratchpad/hxr2/memory"
+}