Marius CiepluchandClaude Opus 5.5 c64e37edbd spec(pre-push-safety-net): reserve the independent population v2 (17 cases, unscanned) ...

v1 was evaluated and then used to retune the analyzer. A retune can only be
qualified on a population that did not inform it.

The candidates came from web research alone (research-2026-09-26.md):
- advisories were taken newest-first per language under fixed criteria, never by
  how easy they look;
- 261 advisories were examined and 224 rejected, each with a reason;
- every SHA pair was verified through the GitHub API;
- no clone and no scan.
The maintainer selected the rule-based "balanced" set: 5 Python, 6 JS/TS, and 6 PHP
of which 4 are WordPress plugins; 10 injection, 6 destination and 1 config.
Each case declares the advisory's sink sites before any scan, for protocol v2.

freeze.py takes --population and writes freeze-vN.json. The reservation tests now
cover every population-v*.toml.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

2026-09-26 17:53:51 +02:00

..

fixtures

feat(three-stage-scan): gate stage-2 maps against split-sink ranking

2026-09-04 11:53:06 +02:00

independent

spec(pre-push-safety-net): reserve the independent population v2 (17 cases, unscanned)

2026-09-26 17:53:51 +02:00

manifests

feat(three-stage-scan): add aliased-sink mutation the regex scan misses

2026-09-04 11:50:44 +02:00

measurements

measure(sqli): PMPro 1-in-5 sample after the fifth fix -- 1/5, recall pins intact

2026-09-24 13:36:36 +02:00

pairs

feat(corpus): vendor 40 OWASP xss pairs as the owasp slice

2026-09-08 17:28:11 +02:00

push

perf(taint): ask the caller check only of a parameter that starts a flow into the field

2026-09-23 22:49:44 +02:00

ranking

feat(pre-push-safety-net): preserve uncertainty in benchmark scoring

2026-09-12 19:04:20 +02:00

repos

feat(pre-push-safety-net): pin labeled evaluation inputs

2026-09-12 18:45:54 +02:00