Marius CiepluchandClaude Opus 5
3e71e9e88b
The catalog generator fills `fix_date` from the recipe at the precision the recipe has -- a full ISO day when one was recorded, otherwise the year. Every harvested recipe carries a year and almost none carries a day, and writing `-01-01` would turn a year into a claim about a month. A row counts as post-cutoff only when its earliest possible date is after the cutoff, so a coarse date can under-claim the clean slice but never over-claim it. Each family now reports the same numbers over the rows fixed after the cutoff, beside the whole number and never instead of it, with the undated count on its own line. Without a configured cutoff every scoreboard says so rather than inventing one: guessing a model's training cutoff and then publishing a contamination number from the guess would be worse than reporting none. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
agent-vfc slice
Security-fix commits carrying an AI coding agent co-author trailer or generation marker
(Claude Code, Codex, Cursor, Copilot, Devin), in JavaScript, TypeScript, or Python.
provenance = "agent". Only repositories with a stated license are vendored; fixes in
unlicensed repositories are vendored = false pointer rows (build_recipes.py --from ... --pointers,
function label derived from the cached excerpt) scored by ousast pairs --slice agent-vfc --pointers.
Review checklist (Req 5.3)
A recipe with reviewer = "pending" loads at review_tier = "title": scored and reported by pairs; the improve loop's
profile gate uses only seeded and reviewed pairs (Req 9.3, task 8.2). Setting reviewer to your name promotes it to reviewed. Before doing so:
- The parent excerpt really contains the vulnerability the title claims (not a refactor).
- One mechanism from
benchmarks/pairs/mechanisms.tomlexplains it; adjustmechanismandcwe. - The fixed excerpt removes it and the change is inside the vendored function.
- No secret, token, or personal data is in either excerpt (run the redaction check).
- The license header is present and matches the repository license.
Rebuild: python benchmarks/pairs/agent-vfc/build_recipes.py --search /tmp/agents.jsonl then
--from /tmp/agents.jsonl, harvest.py --slice agent-vfc --all --fetch, catalog_gen.py --slice agent-vfc.