Marius CiepluchandClaude Opus 5
309faad266
A candidate-driven detector can only judge sites something else enumerates,
so the enumerator caps recall. Measured over the 58 scorable web pairs before
building anything:
pattern ruleset: 12.1% ceiling -- and the misses are not near-misses, the
ruleset finds nothing at all in most of these files
semantic IR: 96.6% ceiling, a median of ten call sites and bindings
inside the labeled function
The ruleset would have capped us at 12.1% against the 64.9% the unconstrained
loop already reaches. That design was one commit from being built.
Two corpus defects found on the way, both mine from task 4.1. The overleaf
excerpt started mid-import, because `_declarator_start` walks back to the
nearest `}` and Overleaf writes JavaScript without semicolons, so the nearest
one was inside `import { expressify }`. It then ended mid-object-literal,
because registration mentions were appended as bare lines. Neither parsed,
and a pair that cannot be parsed cannot be scored. Registration mentions now
expand to the statement that contains them; the ceiling moved 94.8% -> 96.6%.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
agent-vfc slice
Security-fix commits carrying an AI coding agent co-author trailer or generation marker
(Claude Code, Codex, Cursor, Copilot, Devin), in JavaScript, TypeScript, or Python.
provenance = "agent". Only repositories with a stated license are vendored; fixes in
unlicensed repositories are vendored = false pointer rows (build_recipes.py --from ... --pointers,
function label derived from the cached excerpt) scored by ousast pairs --slice agent-vfc --pointers.
Review checklist (Req 5.3)
A recipe with reviewer = "pending" loads at review_tier = "title": scored and reported by pairs; the improve loop's
profile gate uses only seeded and reviewed pairs (Req 9.3, task 8.2). Setting reviewer to your name promotes it to reviewed. Before doing so:
- The parent excerpt really contains the vulnerability the title claims (not a refactor).
- One mechanism from
benchmarks/pairs/mechanisms.tomlexplains it; adjustmechanismandcwe. - The fixed excerpt removes it and the change is inside the vendored function.
- No secret, token, or personal data is in either excerpt (run the redaction check).
- The license header is present and matches the repository license.
Rebuild: python benchmarks/pairs/agent-vfc/build_recipes.py --search /tmp/agents.jsonl then
--from /tmp/agents.jsonl, harvest.py --slice agent-vfc --all --fetch, catalog_gen.py --slice agent-vfc.