Marius CiepluchandClaude Opus 5 ca2c3a8b5f test(contributor-scan): record the group 12 end state (M1b 12.1-12.3) ...

Final verification of the three security capability fixes on the pinned revisions.

  head questions completed     205 -> 298 of 436
  base questions completed             436 of 436
  access control completed       0 -> 52
  context_projection_unavailable 116 -> 0
  context_scope_empty            138 -> 0

Every remaining unresolved question now reports context_function_unresolved and
names the function its file does not define, so nothing is unresolved for a reason
the tool could not explain. That is a region-attribution question for the ranker,
not a limit of what the engine can establish.

Detections are unchanged: the vulnerable revision is still new with
operation_absent_from_comparable_base and every verdict entry holds.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

2026-09-17 13:44:20 +02:00

..

2026-09-06-candidate-ceiling-all-slices.json

feat(constrained-detector): the ceiling, measured offline across every slice

2026-09-06 18:44:19 +02:00

2026-09-06-candidate-ceiling.json

measure: the candidate generator must be the IR, not the ruleset

2026-09-06 16:04:07 +02:00

2026-09-06-corpus-hygiene.json

feat(corpus): vendor 40 OWASP xss pairs as the owasp slice

2026-09-08 17:28:11 +02:00

2026-09-06-fixture-difficulty.json

feat(learning-harness): declared twins and a fixture-difficulty check

2026-09-06 13:09:56 +02:00

2026-09-06-gate-baseline.txt

test(learning-harness): the gate baseline and the degradation matrix

2026-09-06 13:20:23 +02:00

2026-09-06-learning-families.json

fix(learning-harness): the published table lost a whole slice

2026-09-06 20:44:56 +02:00

2026-09-06-mechanism-lever-split.json

feat(learning-harness): one teacher rule across every learning path

2026-09-06 10:15:44 +02:00

2026-09-06-trajectory-divergence.json

measure(detector-optimizer): the detector never runs the same investigation twice

2026-09-06 15:49:54 +02:00

2026-09-06-vibe-py-holdout-hunter-findings.json

docs(learning-harness): brief for a classified, self-improving detector set; fold closed-loop-integrity

2026-09-06 08:08:01 +02:00

2026-09-06-vibe-py-holdout-hunter-sonnet5.json

docs(learning-harness): brief for a classified, self-improving detector set; fold closed-loop-integrity

2026-09-06 08:08:01 +02:00

2026-09-07-evolve-rounds-injection.json

docs(learning-harness): round 5, and what it says about the experiment itself

2026-09-07 08:09:50 +02:00

2026-09-08-joern-go-no-go.json

measure(model-grounded-detection): task 2.3 reads GO on Joern

2026-09-08 13:26:59 +02:00

2026-09-08-model-entailment-ceiling-cpg.json

feat(model-grounded-detection): Java web sinks, and the post-closure-fix ceiling

2026-09-08 17:16:00 +02:00

2026-09-08-model-entailment-ceiling.json

measure(model-grounded-detection): the entailment ceiling is 2.2%, and it is depth not a wall

2026-09-08 11:10:47 +02:00

2026-09-08-module-audit.json

feat(cpg): add a transaction-owned engine session and route it opt-in (M2 11.1, 11.3)

2026-09-16 20:24:34 +02:00

2026-09-08-pipeline-vibe-py.json

fix(ci): run ruff format, and record run 5 at 90% pair-correct

2026-09-08 19:46:58 +02:00

2026-09-09-declared-public.json

feat(model): an endpoint its contract declares open carries no obligation

2026-09-09 15:39:58 +02:00

2026-09-09-php-facts.json

feat(facts): PHP semantic facts, validated against a real PHP CPG

2026-09-09 14:18:57 +02:00

2026-09-09-php-regions.json

fix(specs): the php2cpg "blocker" was the shim, not the frontend

2026-09-09 14:45:36 +02:00

2026-09-09-pmpro-cve-found.json

feat: the first real CVE, found in production plugin code

2026-09-09 17:24:37 +02:00

2026-09-09-repo-libpng-bounds.json

feat(model): a bound on the data lowers the rung, it does not clear it

2026-09-09 13:01:30 +02:00

2026-09-09-repo-libpng-envelope.json

feat(model): the envelope checkout, and no to Joern server mode

2026-09-09 11:30:02 +02:00

2026-09-09-repo-libpng-shipped-scope.json

feat(model): let the project say what it ships, and rank that first

2026-09-09 12:45:21 +02:00

2026-09-09-repo-pmpro.json

fix(cpg): a query that could not be asked is not an empty answer

2026-09-09 17:15:51 +02:00

2026-09-09-repo-vampi-authz-precision.json

fix(model): a guard discharges the obligation it is a guard of

2026-09-09 11:02:48 +02:00

2026-09-09-repo-vampi-crossfunction.json

feat(model): a region that spans the flow, not just a function

2026-09-09 09:27:19 +02:00

2026-09-09-repo-vampi-module-scope.json

feat(model): a region for the code that is in no function

2026-09-09 09:43:53 +02:00

2026-09-09-repo-vampi.json

feat(model): first repository measurement, and the four things it found

2026-09-09 08:46:21 +02:00

2026-09-09-report-proportionality-model-band.json

feat(reports): the model's own suspicion band is a proposal too

2026-09-09 15:23:57 +02:00

2026-09-09-report-proportionality.json

feat(reports): a report proportionate to what the engine can say

2026-09-09 13:29:26 +02:00

2026-09-12-engine-runtime-smoke.json

feat(pre-push-safety-net): reproduce evaluated Joern runtime

2026-09-12 18:32:18 +02:00

2026-09-12-packaged-snapshot-smoke.json

feat(pre-push-safety-net): retain bounded change and rename context

2026-09-12 21:12:45 +02:00

2026-09-12-snapshot-materialization.json

feat(pre-push-safety-net): materialize bounded isolated snapshots

2026-09-12 20:55:09 +02:00

2026-09-13-admission-policy-smoke.json

feat(pre-push-safety-net): admit only supported actionable changes

2026-09-13 12:56:55 +02:00

2026-09-13-change-context-smoke.json

feat(pre-push-safety-net): connect change context to ranked questions

2026-09-13 10:41:32 +02:00

2026-09-13-compact-report-smoke.json

feat(pre-push-safety-net): render bounded reports and preserve full evidence

2026-09-13 13:25:44 +02:00

2026-09-13-delta-comparison-smoke.json

feat(pre-push-safety-net): compare targeted base and head evidence

2026-09-13 12:42:15 +02:00

2026-09-13-engine-budget-smoke.json

feat(pre-push-safety-net): bound backend execution by one deadline

2026-09-13 10:03:03 +02:00

2026-09-13-first-replay-experiment.json

feat(pre-push-safety-net): measure frozen PMPro and Node replay feasibility

2026-09-13 15:24:06 +02:00

2026-09-13-first-replay-final-frozen-run.json.gz

feat(pre-push-safety-net): measure frozen PMPro and Node replay feasibility

2026-09-13 15:24:06 +02:00

2026-09-13-first-replay-initial-instrument-trial.json.gz

feat(pre-push-safety-net): measure frozen PMPro and Node replay feasibility

2026-09-13 15:24:06 +02:00

2026-09-13-frontend-retention-smoke.json

feat(contributor-scan): retain first-party JavaScript tests in graphs

2026-09-13 11:29:48 +02:00

2026-09-13-graph-lease-control.json

feat(pre-push-safety-net): validate graph identity and isolated leases

2026-09-13 16:05:51 +02:00

2026-09-13-nodegoat-feasibility.json

feat(pre-push-safety-net): measure frozen runtime feasibility and retain no-go

2026-09-13 19:06:02 +02:00

2026-09-13-nodegoat-feasibility.json.gz

feat(pre-push-safety-net): measure frozen runtime feasibility and retain no-go

2026-09-13 19:06:02 +02:00

2026-09-13-partition-retention-blocker.json

docs(pre-push-safety-net): record frontend retention prerequisite

2026-09-13 11:05:44 +02:00

2026-09-13-partition-scope-smoke.json

feat(pre-push-safety-net): exclude vendor inputs and partition frontend coverage

2026-09-13 11:53:29 +02:00

2026-09-13-push-packaged-validation.json

test(pre-push-safety-net): validate packaged outcome and retain rollout no-go

2026-09-13 19:39:19 +02:00

2026-09-13-push-packaged-validation.json.gz

test(pre-push-safety-net): validate packaged outcome and retain rollout no-go

2026-09-13 19:39:19 +02:00

2026-09-13-push-qualification.json

feat(pre-push-safety-net): enforce evidence eligibility and record blocked qualification

2026-09-13 19:32:43 +02:00

2026-09-13-push-qualification.json.gz

feat(pre-push-safety-net): enforce evidence eligibility and record blocked qualification

2026-09-13 19:32:43 +02:00

2026-09-13-ranker-scope-smoke.json

feat(pre-push-safety-net): preserve exact ranker scope and outcomes

2026-09-13 10:16:22 +02:00

2026-09-13-replay-deadline-repair.json

fix(pre-push-safety-net): stop semantic planning at the shared deadline

2026-09-13 15:11:42 +02:00

2026-09-13-replay-smoke.json

feat(pre-push-safety-net): replay immutable revisions through the full transaction

2026-09-13 14:50:25 +02:00

2026-09-13-reuse-control.json

feat(pre-push-safety-net): reuse compatible artifacts throughout replay

2026-09-13 17:08:49 +02:00

2026-09-13-reuse-final-control.json.gz

feat(pre-push-safety-net): reuse compatible artifacts throughout replay

2026-09-13 17:08:49 +02:00

2026-09-13-reuse-initial-control.json.gz

feat(pre-push-safety-net): reuse compatible artifacts throughout replay

2026-09-13 17:08:49 +02:00

2026-09-14-joern-session-lifecycle.json

test(release): measure repaired reuse and local Joern lifecycle

2026-09-14 13:18:51 +02:00

2026-09-14-node-census-repair.json

fix(contributor-scan): retain declared Gruntfile and report census gaps honestly

2026-09-14 08:07:06 +02:00

2026-09-14-nodegoat-post-census-feasibility.json

test(release): measure repaired reuse and local Joern lifecycle

2026-09-14 13:18:51 +02:00

2026-09-14-nodegoat-post-census-feasibility.json.gz

test(release): measure repaired reuse and local Joern lifecycle

2026-09-14 13:18:51 +02:00

2026-09-16-nodegoat-m1a-recorded-vetoes.json

feat(pre-push-safety-net): record admission vetoes and meet M1a on NodeGoat

2026-09-16 15:31:34 +02:00

2026-09-16-nodegoat-m1a-recorded-vetoes.json.gz

feat(pre-push-safety-net): record admission vetoes and meet M1a on NodeGoat

2026-09-16 15:31:34 +02:00

2026-09-16-nodegoat-m1b-exit.json

test(pre-push-safety-net): record the M1b exit run (task 10.9)

2026-09-16 19:11:03 +02:00

2026-09-16-nodegoat-m1b-exit.json.gz

test(pre-push-safety-net): record the M1b exit run (task 10.9)

2026-09-16 19:11:03 +02:00

2026-09-16-nodegoat-m1b-explained.json

feat(cpg): add a transaction-owned engine session and route it opt-in (M2 11.1, 11.3)

2026-09-16 20:24:34 +02:00

2026-09-16-nodegoat-m1b-explained.json.gz

feat(cpg): add a transaction-owned engine session and route it opt-in (M2 11.1, 11.3)

2026-09-16 20:24:34 +02:00

2026-09-16-nodegoat-m1b-production.json

test(pre-push-safety-net): record the M1b production comparison on NodeGoat

2026-09-16 18:06:39 +02:00

2026-09-16-nodegoat-m1b-production.json.gz

test(pre-push-safety-net): record the M1b production comparison on NodeGoat

2026-09-16 18:06:39 +02:00

2026-09-16-nodegoat-m1b-step1.json

feat(pre-push-safety-net): measure M1b step 1 and record the inventory prerequisite

2026-09-16 16:03:16 +02:00

2026-09-16-nodegoat-m1b-step1.json.gz

feat(pre-push-safety-net): measure M1b step 1 and record the inventory prerequisite

2026-09-16 16:03:16 +02:00

2026-09-16-operation-inventory-smoke.json

feat(pre-push-safety-net): stop declared exclusion vetoing first-party answers (M1b 10.6)

2026-09-16 17:35:00 +02:00

2026-09-16-session-script-execution.json

feat(cpg): add a transaction-owned engine session and route it opt-in (M2 11.1, 11.3)

2026-09-16 20:24:34 +02:00

2026-09-16-session-transport-equivalence.json

test(cpg): prove transport equivalence for every shipped query kind (M2 11.2)

2026-09-16 20:37:47 +02:00

2026-09-17-group-12-final.json

test(contributor-scan): record the group 12 end state (M1b 12.1-12.3)

2026-09-17 13:44:20 +02:00

2026-09-17-group-12-final.json.gz

test(contributor-scan): record the group 12 end state (M1b 12.1-12.3)

2026-09-17 13:44:20 +02:00

2026-09-17-javascript-build-path.json

revert: JavaScript one-start build did not deliver in the push path (M2 11.6)

2026-09-17 09:04:44 +02:00

2026-09-17-nodegoat-session-transport.json

test(cpg): confirm the session stays alive and halves query time (M2 11.4)

2026-09-17 07:50:04 +02:00

2026-09-17-nodegoat-session-transport.json.gz

test(cpg): confirm the session stays alive and halves query time (M2 11.4)

2026-09-17 07:50:04 +02:00

2026-09-17-per-family-context-effect.json

test(contributor-scan): measure the per-family context effect (M1b 12.2)

2026-09-17 11:36:51 +02:00

2026-09-17-per-family-context-effect.json.gz

test(contributor-scan): measure the per-family context effect (M1b 12.2)

2026-09-17 11:36:51 +02:00

2026-09-17-per-family-context.json

feat(contributor-scan): give each family its own change context (M1b 12.2)

2026-09-17 11:19:30 +02:00

2026-09-17-session-runtime-profile-after-build-change.json

revert: JavaScript one-start build did not deliver in the push path (M2 11.6)

2026-09-17 09:04:44 +02:00

2026-09-17-session-runtime-profile-after-build-change.json.gz

revert: JavaScript one-start build did not deliver in the push path (M2 11.6)

2026-09-17 09:04:44 +02:00

2026-09-17-session-runtime-profile.json

test(runtime): measure the seven-class profile with the session; NO-GO (M2 11.5)

2026-09-17 08:12:37 +02:00

2026-09-17-session-runtime-profile.json.gz

test(runtime): measure the seven-class profile with the session; NO-GO (M2 11.5)

2026-09-17 08:12:37 +02:00