Marius CiepluchandClaude Opus 5 6089c67bf6 fix(cpg): report the line that names an engine failure, not its frames ...

Every PHP failure logged `cpg batch taint failed: dure1.java:10)`, which is the
middle of a stack frame and says nothing. A trace puts its exception on the FIRST
line and frames after it, and the backend logged the last 400 characters, so the
cause was discarded and the noise kept. Four investigations were spent on that.

Failures now report the leading non-frame lines, which is where the exception and
its message are, with the frames dropped. A control asserts an OutOfMemoryError
survives while a frame does not, and that a timeout and an empty exit stay
distinguishable.

1,411 tests passed, nine skipped.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

2026-09-18 17:58:42 +02:00

..

golden

feat(gate): Phase 4 task 8 — lock the detection gate into CI

2026-06-22 17:13:02 +02:00

conftest.py

fix(cpg): the real-request cost, attributed and removed -- overlays once, seeds scoped, data tables out

2026-09-11 01:16:00 +02:00

test_benchmark.py

feat(three-stage-scan): add aliased-sink mutation the regex scan misses

2026-09-04 11:50:44 +02:00

test_calibration.py

ci: add quality gates and release workflows

2026-06-18 10:06:21 +02:00

test_candidate_enumeration.py

feat(model-grounded-detection): group 1, subtract the noise architecture

2026-09-08 12:15:54 +02:00

test_cli_hx_dispatch.py

feat(contributor-scan): 1.3 the model layer reaches a user

2026-09-09 07:42:44 +02:00

test_cli_improve.py

feat(pair-corpus-honesty): reject improve rounds that regress any provenance profile on holdout

2026-09-05 10:45:43 +02:00

test_complexity_hints.py

feat(three-stage-scan): attach test-gap hints to hotspots

2026-09-03 20:33:48 +02:00

test_complexity_ledger.py

feat(three-stage-scan): report map and honor fail-on worth-fixing

2026-09-04 00:18:33 +02:00

test_complexity_map.py

feat(three-stage-scan): attach test-gap hints to hotspots

2026-09-03 20:33:48 +02:00

test_complexity_signals.py

feat(three-stage-scan): compute complexity signals for hotspot ranking

2026-09-03 20:05:13 +02:00

test_config.py

feat: load OpenRouter settings from a local .env

2026-09-04 14:06:18 +02:00

test_cpg_backend.py

fix(cpg): report the line that names an engine failure, not its frames

2026-09-18 17:58:42 +02:00

test_cpg_budget.py

feat(pre-push-safety-net): exclude vendor inputs and partition frontend coverage

2026-09-13 11:53:29 +02:00

test_cpg_queries_compile.py

fix(cpg): the census overlay list is layer names, not characters

2026-09-11 10:49:10 +02:00

test_cpg_session.py

fix(cpg): stop a failed session start from consuming the transaction budget

2026-09-17 08:35:57 +02:00

test_degradation_matrix.py

feat(model-grounded-detection): group 1, subtract the noise architecture

2026-09-08 12:15:54 +02:00

test_detection_benchmarks.py

feat(gate): Phase 4 task 8 — lock the detection gate into CI

2026-06-22 17:13:02 +02:00

test_findings.py

feat(ruleset): Phase 2 (task 3) — rules as governed data, severity from policy

2026-06-22 15:27:16 +02:00

test_frontend_retention.py

fix(contributor-scan): retain declared Gruntfile and report census gaps honestly

2026-09-14 08:07:06 +02:00

test_fusion.py

feat(fusion): Phase 13 — two-panel fusion adjudication

2026-06-22 18:57:03 +02:00

test_gate.py

feat(hardening): Phase 15 — redaction, retry/backoff, budgets, threat-model docs

2026-06-22 20:02:34 +02:00

test_graph_reuse.py

feat(pre-push-safety-net): reuse compatible artifacts throughout replay

2026-09-13 17:08:49 +02:00

test_hardening_pipeline.py

feat(hardening): Phase 15 — redaction, retry/backoff, budgets, threat-model docs

2026-06-22 20:02:34 +02:00

test_harness_ext.py

feat(harnessx): configurable provider + per-task budget caps

2026-06-22 17:59:44 +02:00

test_harness.py

ci: add quality gates and release workflows

2026-06-18 10:06:21 +02:00

test_hunter_curated_tools.py

fix(learning-harness): a hunt that ends in prose is asked to format it

2026-09-06 14:18:09 +02:00

test_hunter_harness.py

feat(harnessx): configurable provider + per-task budget caps

2026-06-22 17:59:44 +02:00

test_hunter_tools.py

feat(three-stage-scan): add path-clamped hunter read grep and refs

2026-09-03 21:01:57 +02:00

test_hunter.py

feat(hunter): add standard-mode scheduling

2026-06-18 10:59:25 +02:00

test_improve.py

feat(pair-corpus-honesty): score non-vendored pointer pairs through a local cache

2026-09-05 10:45:43 +02:00

test_index.py

fix(ci): run ruff format, and record run 5 at 90% pair-correct

2026-09-08 19:46:58 +02:00

test_layout_facts.py

feat(pre-push-safety-net): exclude vendor inputs and partition frontend coverage

2026-09-13 11:53:29 +02:00

test_map_gate.py

feat(three-stage-scan): gate stage-2 maps against split-sink ranking

2026-09-04 11:53:06 +02:00

test_mapping.py

fix(mapping): a PHP method with a visibility modifier is a region

2026-09-09 17:33:36 +02:00

test_mcp.py

feat(mcp): the findings list carries the rung, and leads with what was decided

2026-09-09 13:15:54 +02:00

test_model_calibrate.py

fix(ci): run ruff format, and record run 5 at 90% pair-correct

2026-09-08 19:46:58 +02:00

test_model_change_context.py

feat(contributor-scan): name the function a question cannot locate (M1b 12.3)

2026-09-17 13:28:40 +02:00

test_model_config_value.py

fix(ci): run ruff format, and record run 5 at 90% pair-correct

2026-09-08 19:46:58 +02:00

test_model_dominance.py

feat(model): an access-control finding names a line, and what the PDG does not give us

2026-09-09 13:09:47 +02:00

test_model_endpoint.py

docs(contributor-scan): the ranker is 84% one tier, and the loop is closed

2026-09-10 15:49:57 +02:00

test_model_evidence.py

feat(model): shipped joins the evidence vector as a within-tier weight; v5 baseline

2026-09-11 13:45:00 +02:00

test_model_execution.py

feat(model-grounded-detection): group 6, the execution tier as a seam not a build

2026-09-08 16:58:03 +02:00

test_model_judge.py

fix(ci): run ruff format, and record run 5 at 90% pair-correct

2026-09-08 19:46:58 +02:00

test_model_ladder.py

fix(ci): run ruff format, and record run 5 at 90% pair-correct

2026-09-08 19:46:58 +02:00

test_model_partitions.py

fix(contributor-scan): retain declared Gruntfile and report census gaps honestly

2026-09-14 08:07:06 +02:00

test_model_pipeline.py

feat(model): a region that spans the flow, not just a function

2026-09-09 09:27:19 +02:00

test_model_regions.py

fix(ranker): scope a region to the file that defines its handler (M1b 12.4)

2026-09-17 14:04:39 +02:00

test_model_report.py

fix(ci): run ruff format, and record run 5 at 90% pair-correct

2026-09-08 19:46:58 +02:00

test_model_scan_stage.py

feat(contributor-scan): 1.3 the model layer reaches a user

2026-09-09 07:42:44 +02:00

test_model_scan.py

fix(contributor-scan): retain declared Gruntfile and report census gaps honestly

2026-09-14 08:07:06 +02:00

test_model_scope.py

fix(contributor-scan): retain declared Gruntfile and report census gaps honestly

2026-09-14 08:07:06 +02:00

test_model_shipped.py

feat(model): let the project say what it ships, and rank that first

2026-09-09 12:45:21 +02:00

test_model_specs.py

feat(repos): a WordPress plugin with a verified CVE, and the WordPress DB API

2026-09-09 16:13:17 +02:00

test_model_taint.py

feat(model): one finding per sink site, and WordPress's registration model

2026-09-09 14:30:48 +02:00

test_model_taxonomy.py

feat(reports): say what was looked for, and what cannot be decided

2026-09-09 15:08:01 +02:00

test_module_audit.py

feat(model-grounded-detection): group 1, subtract the noise architecture

2026-09-08 12:15:54 +02:00

test_mutation_fixtures.py

feat(three-stage-scan): add aliased-sink mutation the regex scan misses

2026-09-04 11:50:44 +02:00

test_obligation_check.py

feat(model-grounded-detection): group 1, subtract the noise architecture

2026-09-08 12:15:54 +02:00

test_obligation_dominance.py

feat(authorization-obligations): Dominance protocol with an order-based default

2026-09-05 19:38:04 +02:00

test_obligation_facts.py

feat(authorization-obligations): group sibling handlers and find consistency anomalies

2026-09-06 07:24:13 +02:00

test_obligation_intent.py

feat(authorization-obligations): hunter adjudicates intent without raising evidence

2026-09-06 07:24:13 +02:00

test_obligation_operations.py

feat(learning-harness): declared twins and a fixture-difficulty check

2026-09-06 13:09:56 +02:00

test_obligation_policy.py

feat(authorization-obligations): group sibling handlers and find consistency anomalies

2026-09-06 07:24:13 +02:00

test_obligation_reports.py

feat(authorization-obligations): reports and ranking name the obligation

2026-09-06 07:24:13 +02:00

test_obligation_scan.py

feat(authorization-obligations): run the checker in MAP with config and manifest counters

2026-09-06 07:24:13 +02:00

test_obligation_shapes.py

feat(authorization-obligations): obligation shapes derived from trusted pairs

2026-09-05 19:38:04 +02:00

test_obligation_siblings.py

feat(authorization-obligations): group sibling handlers and find consistency anomalies

2026-09-06 07:24:13 +02:00

test_opencode_skills.py

chore: add kiro spec-driven tooling and steering docs

2026-06-21 14:28:19 +02:00

test_pair_corpus.py

feat(model-grounded-detection): group 1, subtract the noise architecture

2026-09-08 12:15:54 +02:00

test_pair_harvest.py

feat(authorization-obligations): harvest mode handler_context and the obligation label

2026-09-06 07:24:13 +02:00

test_pair_hygiene.py

fix(ci): run ruff format, and record run 5 at 90% pair-correct

2026-09-08 19:46:58 +02:00

test_pair_registration_context.py

fix(ci): run ruff format, and record run 5 at 90% pair-correct

2026-09-08 19:46:58 +02:00

test_pipeline_calibration.py

feat(calibration): automatic in-pipeline false-positive feedback

2026-06-21 20:44:08 +02:00

test_policy.py

feat(governance): Phase 1 — CWE policy store + project score (zero-dep)

2026-06-22 12:31:35 +02:00

test_preprocess.py

feat(scan): add initial SAST pipeline

2026-06-17 21:13:51 +02:00

test_provenance.py

feat(pair-corpus-honesty): deterministic provenance fingerprint at scan time

2026-09-05 10:45:43 +02:00

test_provider_retry.py

fix: a body that stops mid-read is transient, and a round that dies still says so

2026-09-07 07:37:41 +02:00

test_push_admission.py

fix(pre-push-safety-net): take the operation symbol from the call (M1b 12.1)

2026-09-17 09:56:59 +02:00

test_push_assistance.py

feat(pre-push-safety-net): bound optional assistance to admitted witnesses

2026-09-13 18:03:31 +02:00

test_push_cache_semantics.py

feat(pre-push-safety-net): key evidence reuse by compatible semantics

2026-09-13 16:16:19 +02:00

test_push_cache.py

feat(pre-push-safety-net): publish and evict complete local artifacts safely

2026-09-13 16:11:19 +02:00

test_push_contracts.py

feat(pre-push-safety-net): retain bounded change and rename context

2026-09-12 21:12:45 +02:00

test_push_eligibility.py

feat(pre-push-safety-net): enforce evidence eligibility and record blocked qualification

2026-09-13 19:32:43 +02:00

test_push_experiment.py

feat(pre-push-safety-net): measure frozen PMPro and Node replay feasibility

2026-09-13 15:24:06 +02:00

test_push_feasibility.py

feat(pre-push-safety-net): measure frozen runtime feasibility and retain no-go

2026-09-13 19:06:02 +02:00

test_push_hook.py

feat(pre-push-safety-net): preserve existing hooks during explicit integration

2026-09-13 17:51:28 +02:00

test_push_inputs.py

feat(pre-push-safety-net): pin labeled evaluation inputs

2026-09-12 18:45:54 +02:00

test_push_interface.py

feat(pre-push-safety-net): execute full Git push transactions

2026-09-13 17:45:16 +02:00

test_push_policy.py

fix(pre-push-safety-net): bind dependency gaps to the candidate (M1b 10.7)

2026-09-16 18:52:04 +02:00

test_push_regression_integration.py

feat(pre-push-safety-net): cover combined push failure paths

2026-09-13 18:43:13 +02:00

test_push_report.py

feat(pre-push-safety-net): render bounded reports and preserve full evidence

2026-09-13 13:25:44 +02:00

test_push_reuse.py

feat(pre-push-safety-net): reuse compatible artifacts throughout replay

2026-09-13 17:08:49 +02:00

test_push_runner.py

feat(pre-push-safety-net): reuse compatible artifacts throughout replay

2026-09-13 17:08:49 +02:00

test_push_scoring.py

feat(pre-push-safety-net): preserve uncertainty in benchmark scoring

2026-09-12 19:04:20 +02:00

test_push_snapshot.py

feat(pre-push-safety-net): retain bounded change and rename context

2026-09-12 21:12:45 +02:00

test_push_vetoes.py

feat(pre-push-safety-net): render the experimental evaluation explanation (M1b 10.10)

2026-09-16 19:59:12 +02:00

test_rank.py

feat(harness): add runtime and reachability mapping

2026-06-18 07:57:06 +02:00

test_redaction.py

feat(hardening): Phase 15 — redaction, retry/backoff, budgets, threat-model docs

2026-06-22 20:02:34 +02:00

test_regress_candidates.py

feat(three-stage-scan): select bounded regress candidates with sev-5 extras

2026-09-03 22:36:02 +02:00

test_regress_recipes.py

feat(three-stage-scan): add language recipes with inconclusive fallback

2026-09-03 22:48:10 +02:00

test_regress_safety.py

feat(three-stage-scan): reject unsafe regression snippets before execution

2026-09-03 22:12:45 +02:00

test_regress_verdicts.py

feat(three-stage-scan): map sandbox outcomes to worth-fixing verdicts

2026-09-03 22:59:01 +02:00

test_reports.py

feat(cpg): give the files a frontend refuses a CPG of their own

2026-09-10 07:32:20 +02:00

test_repos.py

feat(repos): pinned known-vulnerable checkouts, offline by default

2026-09-09 08:10:59 +02:00

test_ruleset.py

feat(benchmark): Phase 2 (task 4) — actionable per-rule signals, ledger, FP knob

2026-06-22 15:41:17 +02:00

test_run.py

feat(scan): add initial SAST pipeline

2026-06-17 21:13:51 +02:00

test_sandbox_probe.py

feat(three-stage-scan): run or skip deep regression with visible degradation

2026-09-03 23:43:15 +02:00

test_sandbox_runner.py

feat(three-stage-scan): run or skip deep regression with visible degradation

2026-09-03 23:43:15 +02:00

test_scan_deep.py

feat(propose-adjudicate-prove): overlay adjudicates inventory before prove

2026-09-04 13:57:33 +02:00

test_scan_pipeline_integrity.py

feat(contributor-scan): 1.3 the model layer reaches a user

2026-09-09 07:42:44 +02:00

test_score_pipeline.py

feat(ruleset): Phase 2 (task 3) — rules as governed data, severity from policy

2026-06-22 15:27:16 +02:00

test_scoring.py

feat(benchmark): Phase 2 (task 4) — actionable per-rule signals, ledger, FP knob

2026-06-22 15:41:17 +02:00

test_semantic_cst.py

feat(tree-sitter-overlay-extra): parse JS/C/Java overlay via optional extra

2026-09-04 15:07:35 +02:00

test_semantic_extra.py

feat(tree-sitter-overlay-extra): parse JS/C/Java overlay via optional extra

2026-09-04 15:07:35 +02:00

test_semantic_overlay.py

feat(tree-sitter-overlay-extra): parse JS/C/Java overlay via optional extra

2026-09-04 15:07:35 +02:00

test_semantic_pipeline.py

fix(ci): run ruff format, and record run 5 at 90% pair-correct

2026-09-08 19:46:58 +02:00

test_skills.py

feat(skills): Phase 14 — Trail of Bits skill index + router

2026-06-22 19:51:04 +02:00

test_slot_contract.py

feat(slots): Phase 3 task 6.3 — model-disabled, slot-contracted deterministic stages

2026-06-22 18:39:09 +02:00

test_split_sink_fixtures.py

feat(three-stage-scan): add split-sink fixtures the regex scan misses

2026-09-04 11:49:44 +02:00

test_split_sink_regress.py

feat(three-stage-scan): prove split-sink triggerable in sandbox

2026-09-04 11:54:01 +02:00

test_stages.py

feat(three-stage-scan): keep quick as stage-1 inventory

2026-09-03 23:14:00 +02:00

test_subtraction_complete.py

fix(ci): run ruff format, and record run 5 at 90% pair-correct

2026-09-08 19:46:58 +02:00

test_tool_hunter.py

fix(learning-harness): a hunt that ends in prose is asked to format it

2026-09-06 14:18:09 +02:00

test_typescript_grammar.py

feat(learning-harness): absence rows travel with their registration

2026-09-06 12:39:55 +02:00

test_verification.py

ci: add quality gates and release workflows

2026-06-18 10:06:21 +02:00

test_verify_judge.py

feat(harnessx): configurable provider + per-task budget caps

2026-06-22 17:59:44 +02:00