Marius CiepluchandClaude Opus 5
2dad25d312
Three defects, two of them the same shape as ones already rejected once: - The meta-agent proposer still could not propose. `MetaAgent(inner_model=)` takes a ModelConfig; it was handed a model name, a `# type: ignore` hid that from mypy, and a bare `except Exception` turned the resulting AttributeError into `meta_agent_failed` -- which reads exactly like the model declining. The composition is now a seam a test can pin, and a construction error is re-raised rather than reported as a quiet round. - `ousast pairs --hunter` crashed in its documented form: the K floor landed with `--k-runs` still defaulting to 1. The covering test always passed `--k-runs 4`, which is why nothing noticed. - 28 rows (12% of the corpus) resolved a span on the vulnerable side and none on the fixed side, so every fixed-side finding read as outside the labeled function and the pair scored as silence whatever the detector said. `fix_function` now reaches the catalog and the scorer, and the generator derives it from the fixed excerpt for the 25 trap rows that never declared one. Measured after: 0 rows. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
vibe-py slice
Isolated Python web functions from Real-Vuln-Benchmark (Apache-2.0 benchmark; each target repository keeps its own license).
-
Vuln side: the function enclosing a labeled vulnerable finding (
is_vulnerable = true). -
Fixed twin: a false-positive trap function (
is_vulnerable = false) from the same repository. The scanner must stay silent there, so silent-on-fix here measures precision on traps. -
Provenance:
humanfor the 26 human-authored apps,agentfor the 40 LLM-generated apps. The LLM-generated repositories (kolega-ai-dev/vc-*) carry no license file, so they are never vendored (Req 5.4):build_recipes.py --pointersappends them asvendored = falserows (80 pairs over the 40 repositories,agent,review_tier = "seeded") thatousast pairs --slice vibe-py --pointersharvests into the local cache and scores (Req 10). The default run skips them withpointer_pair_skipped. -
Caveat: the human corpus is educational and CTF style (DVPWA, VAmPI, vulpy, ...), not production code. Say so when reading numbers.
-
Matching: every row names the function; the upstream scorer tolerates ±10 lines, ours requires the detection inside the function.
-
Excerpt shape: line-range excerpts of methods keep their class indentation, so 27 of them fail stdlib
ast.parse("unexpected indent") while tree-sitter parses them with correct function ranges.parse_failed 0rests on tree-sitter; stdlib-ast parity would need dedenting.
Rebuild: see the docstring of build_recipes.py (add --pointers for the LLM repositories). Regenerate the catalog with
python benchmarks/pairs/catalog_gen.py --slice vibe-py. Maintainer only; CI never fetches.