[ { "id": "FE-PASTE", "case": "ferricode-openai-codex-remote-auth", "bucket": "B", "title": "Optional stdin failure aborts viable HTTP authentication", "verdict": "Confirmed regression, bounded to login availability and retry UX. Blank/malformed paste and read errors propagate out of the optional select branch and drop the listener; HTTP malformed callbacks already recover. Group read-error and malformed-paste variants as one optional-input failure-isolation family.", "evidence": [ { "path": "crates/ferricode-openai-codex/src/lib.rs", "lines": "308-343" } ], "asserted_runs": [ "ferricode-openai-codex-remote-auth--claude-opus-5-5--r1", "ferricode-openai-codex-remote-auth--claude-opus-5-5--r2", "ferricode-openai-codex-remote-auth--claude-opus-5-5--r3", "ferricode-openai-codex-remote-auth--claude-opus-5-5--r4", "ferricode-openai-codex-remote-auth--gpt-5.6-sol--r1", "ferricode-openai-codex-remote-auth--gpt-6-astra--r1", "ferricode-openai-codex-remote-auth--gpt-6-astra--r2", "ferricode-openai-codex-remote-auth--gpt-6-astra--r3", "ferricode-openai-codex-remote-auth--gpt-6-astra--r4", "ferricode-openai-codex-remote-auth--gpt-6-sol--r2", "ferricode-openai-codex-remote-auth--gpt-6-sol--r3", "ferricode-openai-codex-remote-auth--gpt-6-sol--r4", "ferricode-openai-codex-remote-auth--gpt-6.1-sol--r1", "ferricode-openai-codex-remote-auth--gpt-6.1-sol--r2", "ferricode-openai-codex-remote-auth--gpt-6.1-sol--r3", "ferricode-openai-codex-remote-auth--gpt-6.1-sol--r4" ], "tentative_runs": [], "subtype": "runtime/UI/resource" }, { "id": "FE-JOB", "case": "ferricode-openai-codex-remote-auth", "bucket": "B", "title": "Eager terminal read suspends background authentication", "verdict": "Confirmed Unix job-control mechanism: a background process group reading its controlling TTY receives SIGTTIN. The new eager thread suspends the whole process, including the listener. Foregrounding recovers; classify as bounded workflow regression rather than security compromise.", "evidence": [ { "path": "crates/ferricode-openai-codex/src/lib.rs", "lines": "218-226,355-367" } ], "asserted_runs": [ "ferricode-openai-codex-remote-auth--claude-opus-5-5--r1", "ferricode-openai-codex-remote-auth--claude-opus-5-5--r3", "ferricode-openai-codex-remote-auth--gpt-6-astra--r3", "ferricode-openai-codex-remote-auth--gpt-6.1-sol--r1", "ferricode-openai-codex-remote-auth--gpt-6.1-sol--r2", "ferricode-openai-codex-remote-auth--gpt-6.1-sol--r3", "ferricode-openai-codex-remote-auth--gpt-6.1-sol--r4" ], "tentative_runs": [], "subtype": "runtime/UI/resource" }, { "id": "FE-BROWSER", "case": "ferricode-openai-codex-remote-auth", "bucket": "B", "title": "Paste reader consumes terminal-browser input", "verdict": "Confirmed input-ownership race. Reader starts before webbrowser::open; pinned webbrowser 1.2.1 src/common.rs:73-79 runs text browsers with inherited stdin. Navigation/form/quit input can reach the callback reader. Counts independently of generic bad-paste handling.", "evidence": [ { "path": "crates/ferricode-openai-codex/src/lib.rs", "lines": "218-226,294-295,355-367" } ], "asserted_runs": [ "ferricode-openai-codex-remote-auth--gpt-6-astra--r2", "ferricode-openai-codex-remote-auth--gpt-6-astra--r4" ], "tentative_runs": [], "subtype": "runtime/UI/resource" }, { "id": "FE-FALLBACK", "case": "ferricode-openai-codex-remote-auth", "bucket": "C", "title": "Paste-only fallback excludes non-conflict bind failures", "verdict": "Source confirms AddrInUse-only fallback. Actionability depends on whether broad SPEC wording about unavailable ports promises permission/sandbox/address failures too. Existing behavior already failed for those environments; this is incomplete promised coverage rather than a newly broken ordinary path.", "evidence": [ { "path": "crates/ferricode-openai-codex/src/lib.rs", "lines": "230-257" } ], "asserted_runs": [ "ferricode-openai-codex-remote-auth--claude-opus-5-5--r2", "ferricode-openai-codex-remote-auth--gpt-5.6-sol--r2", "ferricode-openai-codex-remote-auth--gpt-5.6-sol--r3", "ferricode-openai-codex-remote-auth--gpt-5.6-sol--r4", "ferricode-openai-codex-remote-auth--gpt-6-sol--r1" ], "tentative_runs": [ "ferricode-openai-codex-remote-auth--claude-opus-5-5--r3", "ferricode-openai-codex-remote-auth--claude-opus-5-5--r4" ], "subtype": "" }, { "id": "FE-ORPHAN", "case": "ferricode-openai-codex-remote-auth", "bucket": "C", "title": "Detached stdin reader can affect a later library call", "verdict": "Mechanism is real but requires a continuing host or repeated auth call. The supplied CLI exits after authentication, and the comment explicitly chooses detached input for that lifecycle. No affected long-lived in-tree caller is established.", "evidence": [ { "path": "crates/ferricode-openai-codex/src/lib.rs", "lines": "355-374" } ], "asserted_runs": [ "ferricode-openai-codex-remote-auth--gpt-5.6-sol--r3", "ferricode-openai-codex-remote-auth--gpt-5.6-sol--r4", "ferricode-openai-codex-remote-auth--gpt-6-sol--r2", "ferricode-openai-codex-remote-auth--gpt-6-sol--r3" ], "tentative_runs": [ "ferricode-openai-codex-remote-auth--claude-opus-5-5--r1", "ferricode-openai-codex-remote-auth--claude-opus-5-5--r4", "ferricode-openai-codex-remote-auth--gpt-5.6-sol--r1", "ferricode-openai-codex-remote-auth--gpt-5.6-sol--r2", "ferricode-openai-codex-remote-auth--gpt-6-astra--r1", "ferricode-openai-codex-remote-auth--gpt-6-astra--r2", "ferricode-openai-codex-remote-auth--gpt-6-astra--r3", "ferricode-openai-codex-remote-auth--gpt-6-astra--r4", "ferricode-openai-codex-remote-auth--gpt-6-sol--r1", "ferricode-openai-codex-remote-auth--gpt-6.1-sol--r1", "ferricode-openai-codex-remote-auth--gpt-6.1-sol--r2", "ferricode-openai-codex-remote-auth--gpt-6.1-sol--r3", "ferricode-openai-codex-remote-auth--gpt-6.1-sol--r4" ], "subtype": "" }, { "id": "FE-HTTP-DELAY", "case": "ferricode-openai-codex-remote-auth", "bucket": "B", "title": "Accepted HTTP connection temporarily blocks pasted callback polling", "verdict": "Confirmed the select branch awaits stream handling outside the selection loop. A local connection withholding headers delays the paste path up to the existing ten-second read limit. No proof of inevitable unbounded starvation.", "evidence": [ { "path": "crates/ferricode-openai-codex/src/lib.rs", "lines": "319-343,389-403" } ], "asserted_runs": [ "ferricode-openai-codex-remote-auth--gpt-5.6-sol--r2" ], "tentative_runs": [], "subtype": "runtime/UI/resource" }, { "id": "FE-INPUT-BOUND", "case": "ferricode-openai-codex-remote-auth", "bucket": "C", "title": "Pasted stdin line has no allocation bound", "verdict": "read_line is unbounded, but impact requires control of local stdin or an oversized user paste. No remote input route or trust boundary is demonstrated. Useful hardening proposal, not an established security blocker.", "evidence": [ { "path": "crates/ferricode-openai-codex/src/lib.rs", "lines": "355-365" } ], "asserted_runs": [ "ferricode-openai-codex-remote-auth--gpt-6-sol--r1" ], "tentative_runs": [], "subtype": "" }, { "id": "SA-KDF-COST", "case": "saltybox-v2-engine-initial", "bucket": "C", "title": "Accepted KDF parameters can exhaust caller resources", "verdict": "Confirmed allocation mechanism in argon2 0.5.3: vec allocates up to 4 GiB before AEAD authentication and may abort. However the exact caps are an explicit design choice, v2 CLI dispatch is deliberately unwired, and no operational resource guarantee is established. Resource budgets/fallible allocation are substantive design improvements; avoid presenting intended cap acceptance as an unconditional correctness bug.", "evidence": [ { "path": "src/format_v2.rs", "lines": "69-81,193-215,351-352" } ], "asserted_runs": [ "saltybox-v2-engine-initial--claude-opus-5-5--r3", "saltybox-v2-engine-initial--gpt-5.6-sol--r1", "saltybox-v2-engine-initial--gpt-5.6-sol--r2", "saltybox-v2-engine-initial--gpt-5.6-sol--r3", "saltybox-v2-engine-initial--gpt-5.6-sol--r4", "saltybox-v2-engine-initial--gpt-6-sol--r1", "saltybox-v2-engine-initial--gpt-6-sol--r2", "saltybox-v2-engine-initial--gpt-6-sol--r3", "saltybox-v2-engine-initial--gpt-6-sol--r4", "saltybox-v2-engine-initial--gpt-6-astra--r1", "saltybox-v2-engine-initial--gpt-6.1-sol--r1", "saltybox-v2-engine-initial--gpt-6.1-sol--r2", "saltybox-v2-engine-initial--gpt-6.1-sol--r3", "saltybox-v2-engine-initial--gpt-6.1-sol--r4" ], "tentative_runs": [ "saltybox-v2-engine-initial--claude-opus-5-5--r1", "saltybox-v2-engine-initial--claude-opus-5-5--r2", "saltybox-v2-engine-initial--claude-opus-5-5--r4" ], "subtype": "" }, { "id": "SA-RESIDUE", "case": "saltybox-v2-engine-initial", "bucket": "C", "title": "Argon2 workspace retains key-reconstructing material", "verdict": "Confirmed dependency-level mechanism: argon2 0.5.3 lib.rs:229-231 allocates ordinary blocks and finalize at 481-505 derives the key from lane-final blocks. Zeroizing the returned key does not clear that equivalent material. Exploitation requires a separate residual-memory disclosure; complete memory sanitization is not established as a contract, and v1 already leaves KDF intermediates. Important conditional security-hardening finding, not a demonstrated standalone exploit. Enabling the optional zeroize feature alone does not wipe the heap arena.", "evidence": [ { "path": "src/format_v2.rs", "lines": "193-215" } ], "asserted_runs": [ "saltybox-v2-engine-initial--claude-opus-5-5--r1", "saltybox-v2-engine-initial--claude-opus-5-5--r2", "saltybox-v2-engine-initial--gpt-5.6-sol--r2", "saltybox-v2-engine-initial--gpt-5.6-sol--r3", "saltybox-v2-engine-initial--gpt-6-astra--r2", "saltybox-v2-engine-initial--gpt-6-astra--r3", "saltybox-v2-engine-initial--gpt-6-astra--r4", "saltybox-v2-engine-initial--gpt-6.1-sol--r1", "saltybox-v2-engine-initial--gpt-6.1-sol--r2", "saltybox-v2-engine-initial--gpt-6.1-sol--r3", "saltybox-v2-engine-initial--gpt-6.1-sol--r4" ], "tentative_runs": [ "saltybox-v2-engine-initial--claude-opus-5-5--r3", "saltybox-v2-engine-initial--claude-opus-5-5--r4", "saltybox-v2-engine-initial--gpt-5.6-sol--r1", "saltybox-v2-engine-initial--gpt-6-sol--r4" ], "subtype": "" }, { "id": "SA-TEST-COST", "case": "saltybox-v2-engine-initial", "bucket": "B", "title": "Multiple tests repeat production-cost KDF despite one-test claim", "verdict": "Three tests invoke the 256 MiB defaults; two round trips plus two fresh-nonce encryptions total six derivations, up to three overlapping workspaces. Confirmed bounded test-cost/comment discrepancy. No CI OOM is proven. Some reports say five rather than six; this does not change the issue family.", "evidence": [ { "path": "src/format_v2.rs", "lines": "379-383,435-470" } ], "asserted_runs": [ "saltybox-v2-engine-initial--claude-opus-5-5--r1", "saltybox-v2-engine-initial--claude-opus-5-5--r2", "saltybox-v2-engine-initial--claude-opus-5-5--r3", "saltybox-v2-engine-initial--claude-opus-5-5--r4", "saltybox-v2-engine-initial--gpt-5.6-sol--r1" ], "tentative_runs": [ "saltybox-v2-engine-initial--gpt-6.1-sol--r2" ], "subtype": "test/tooling/docs" }, { "id": "SS-DOC", "case": "stark-parts-pr56-catalog-static-asset", "bucket": "B", "title": "README still describes an embedded catalog", "verdict": "Confirmed architecture contradiction: README says include_str while production now fetches the separately copied static asset. The implementation specification also retains an obsolete open decision. Bounded documentation defect, not a demonstrated deployment outage.", "evidence": [ { "path": "README.md", "lines": "44-45" }, { "path": "IMPL_SPEC.md", "lines": "62-66,273-274" } ], "asserted_runs": [ "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r2", "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r3", "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r4", "stark-parts-pr56-catalog-static-asset--gpt-5.6-sol--r1", "stark-parts-pr56-catalog-static-asset--gpt-5.6-sol--r2", "stark-parts-pr56-catalog-static-asset--gpt-6-astra--r1", "stark-parts-pr56-catalog-static-asset--gpt-6-sol--r3" ], "tentative_runs": [], "subtype": "test/tooling/docs" }, { "id": "SS-NOTICE", "case": "stark-parts-pr56-catalog-static-asset", "bucket": "B", "title": "Loading and error screens omit the required unofficial notice", "verdict": "SPEC requires a persistent notice visible on initial load. The notice is inside App and absent from both new startup branches, indefinitely on failure. Confirmed user-visible contract omission.", "evidence": [ { "path": "crates/stark-parts-web/src/main.rs", "lines": "18-54" }, { "path": "SPEC.md", "lines": "13-20" } ], "asserted_runs": [ "stark-parts-pr56-catalog-static-asset--gpt-5.6-sol--r3", "stark-parts-pr56-catalog-static-asset--gpt-6-sol--r1" ], "tentative_runs": [], "subtype": "runtime/UI/resource" }, { "id": "SS-GUARD", "case": "stark-parts-pr56-catalog-static-asset", "bucket": "B", "title": "Source guard loses protection against query-time gloo fetches", "verdict": "The test removes the gloo_net/fetch bans from lib.rs as well as the legitimate startup loader. A query-time gloo request to another catalog path would escape both this guard and the URL-specific smoke assertions. Other client bans remain; this is narrower loss of coverage, not removal of all protection or a present network leak.", "evidence": [ { "path": "crates/stark-parts-web/src/lib.rs", "lines": "1206-1234" }, { "path": "tests/static-smoke.spec.mjs", "lines": "18" } ], "asserted_runs": [ "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r4" ], "tentative_runs": [], "subtype": "test/tooling/docs" }, { "id": "SS-SKEW", "case": "stark-parts-pr56-catalog-static-asset", "bucket": "C", "title": "Separate app and catalog requests can cross a deploy", "verdict": "Fixed catalog URL permits an old app to encounter a newer schema; validation then rejects it. Actual deployment skew protection and schema-changing deploy frequency are unknown. Reload recovers. Conditional deployment concern.", "evidence": [ { "path": "crates/stark-parts-web/src/main.rs", "lines": "9,58-73" }, { "path": "index.html", "lines": "8" } ], "asserted_runs": [ "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r1" ], "tentative_runs": [ "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r2" ], "subtype": "" }, { "id": "SS-MEMORY", "case": "stark-parts-pr56-catalog-static-asset", "bucket": "C", "title": "Startup resource may retain an unnecessary parsed catalog", "verdict": "Deep-clone/cache mechanism is plausible from LocalResource usage, but pinned dependency semantics and net memory impact were not measured. Base retained the embedded source bytes; this change trades representations. No established browser failure or resource budget.", "evidence": [ { "path": "crates/stark-parts-web/src/main.rs", "lines": "18-29" }, { "path": "crates/stark-parts-web/src/lib.rs", "lines": "26-33" } ], "asserted_runs": [ "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r1", "stark-parts-pr56-catalog-static-asset--gpt-5.6-sol--r2" ], "tentative_runs": [ "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r2", "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r3", "stark-parts-pr56-catalog-static-asset--gpt-6-sol--r4" ], "subtype": "" }, { "id": "SS-COMPRESSION", "case": "stark-parts-pr56-catalog-static-asset", "bucket": "C", "title": "JSON5 delivery may lose CDN compression", "verdict": "Actual Vercel response headers/compression policy are absent. A local mime-db entry without compressible:true does not prove CDN behavior. Worth a deployment measurement, not a confirmed transfer regression.", "evidence": [ { "path": "index.html", "lines": "8" }, { "path": "vercel.json", "lines": "1-7" } ], "asserted_runs": [ "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r2" ], "tentative_runs": [ "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r1", "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r3" ], "subtype": "" }, { "id": "SS-SEQUENTIAL", "case": "stark-parts-pr56-catalog-static-asset", "bucket": "C", "title": "Separate fetch introduces sequential startup work", "verdict": "Catalog fetch starts after WASM initialization, but WASM is smaller after removing the embedded catalog. Net latency needs measurement; no latency target or preload contract establishes a defect. An optimization question.", "evidence": [ { "path": "crates/stark-parts-web/src/main.rs", "lines": "18,60-64" }, { "path": "index.html", "lines": "8" } ], "asserted_runs": [ "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r2", "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r4" ], "tentative_runs": [ "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r3" ], "subtype": "" }, { "id": "SS-DEADLINE", "case": "stark-parts-pr56-catalog-static-asset", "bucket": "C", "title": "Stalled fetch has no application deadline", "verdict": "Request/body awaits lack an abort deadline. A permanently pending response stays loading, but the spec defines no time budget and normal browser/network behavior was not reproduced. Whether an application deadline is required is a product/reliability decision.", "evidence": [ { "path": "crates/stark-parts-web/src/main.rs", "lines": "59-72" }, { "path": "SPEC.md", "lines": "62-65" } ], "asserted_runs": [ "stark-parts-pr56-catalog-static-asset--gpt-5.6-sol--r2", "stark-parts-pr56-catalog-static-asset--gpt-6-astra--r1" ], "tentative_runs": [ "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r2" ], "subtype": "" }, { "id": "SS-EMPTY", "case": "stark-parts-pr56-catalog-static-asset", "bucket": "C", "title": "Schema-valid empty catalog appears as empty search", "verdict": "Validator permits emptiness, as it did in base. Runtime separation changes deployment risks, but no contract says every schema-valid empty document is a load/parse failure. The desired semantic completeness rule needs clarification.", "evidence": [ { "path": "crates/stark-parts-catalog/src/lib.rs", "lines": "1260-1314" }, { "path": "crates/stark-parts-web/src/main.rs", "lines": "57-72" } ], "asserted_runs": [ "stark-parts-pr56-catalog-static-asset--gpt-5.6-sol--r4" ], "tentative_runs": [], "subtype": "" }, { "id": "SS-CSS", "case": "stark-parts-pr56-catalog-static-asset", "bucket": "D", "title": "Unstyled startup states are cosmetic advice", "verdict": "Confirmed missing startup classes and style injection only after App mounts. Both states remain readable and satisfy the functional loading/error requirement. The reviewer prompt explicitly excludes cosmetic nits; no consequential behavior was established.", "evidence": [ { "path": "crates/stark-parts-web/src/main.rs", "lines": "33-54" }, { "path": "crates/stark-parts-web/src/lib.rs", "lines": "74" } ], "asserted_runs": [ "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r2", "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r3" ], "tentative_runs": [ "stark-parts-pr56-catalog-static-asset--claude-opus-5-5--r1" ], "subtype": "out of scope / cosmetic" }, { "id": "SS-PREMOUNT", "case": "stark-parts-pr56-catalog-static-asset", "bucket": "D", "title": "Blank pre-WASM interval already existed", "verdict": "Base also had no static loading placeholder. The new catalog loading state begins at app initialization, which the spec explicitly permits. This does not establish a change-introduced failure.", "evidence": [ { "path": "index.html", "lines": "19" }, { "path": "SPEC.md", "lines": "62-65" } ], "asserted_runs": [ "stark-parts-pr56-catalog-static-asset--gpt-6-astra--r1" ], "tentative_runs": [], "subtype": "pre-existing" }, { "id": "SC-FLAGS", "case": "stark-parts-pr58-catalog-vercel-cache", "bucket": "B", "title": "Turbo drops the CI warnings-as-errors setting", "verdict": "Pinned Turbo 2.10.4 probe with original task configuration and a harmless task body runs successfully but receives no injected RUSTFLAGS. The setup-rust-toolchain v1 action defaults to -D warnings; the checked-in workflow does not override it. Thus wasm-only warnings lose this CI gate. Parent downloaded and checksum-verified Turbo; reviewers did not run it. Action v1 is mutable, so the saved current action source is corroboration rather than a pinned historical runner image.", "evidence": [ { "path": "turbo.json", "lines": "3-11" }, { "path": ".github/workflows/ci.yml", "lines": "106-113" }, { "path": "scripts/build-app.sh", "lines": "21" } ], "asserted_runs": [ "stark-parts-pr58-catalog-vercel-cache--claude-opus-5-5--r1", "stark-parts-pr58-catalog-vercel-cache--claude-opus-5-5--r2", "stark-parts-pr58-catalog-vercel-cache--claude-opus-5-5--r3", "stark-parts-pr58-catalog-vercel-cache--claude-opus-5-5--r4" ], "tentative_runs": [], "subtype": "test/tooling/docs" }, { "id": "SC-CACHE-TRUST", "case": "stark-parts-pr58-catalog-vercel-cache", "bucket": "C", "title": "Preview cache writes could cross into production", "verdict": "Threat scenario is coherent if untrusted preview code receives credentials that can overwrite the production cache namespace. Repository configuration alone establishes neither token exposure nor authorization boundaries. Cache hashes are not authenticity guarantees, but absence of signature alone is not proof of an exploitable deployment.", "evidence": [ { "path": "turbo.json", "lines": "1-13" }, { "path": "vercel.json", "lines": "4-5" } ], "asserted_runs": [ "stark-parts-pr58-catalog-vercel-cache--claude-opus-5-5--r1", "stark-parts-pr58-catalog-vercel-cache--claude-opus-5-5--r4" ], "tentative_runs": [ "stark-parts-pr58-catalog-vercel-cache--claude-opus-5-5--r2", "stark-parts-pr58-catalog-vercel-cache--claude-opus-5-5--r3" ], "subtype": "" }, { "id": "SC-BOOTSTRAP", "case": "stark-parts-pr58-catalog-vercel-cache", "bucket": "C", "title": "Local builds can install or replace global tools", "verdict": "Bootstrap now runs on local cache misses too. Missing rustup or a different Trunk version triggers installation. The implementation spec deliberately moves setup into the cacheable task; whether local side effects are acceptable is an interface/policy question. Not an independent security vulnerability.", "evidence": [ { "path": "scripts/build-app.sh", "lines": "6-19" }, { "path": "package.json", "lines": "5-6" } ], "asserted_runs": [ "stark-parts-pr58-catalog-vercel-cache--claude-opus-5-5--r1", "stark-parts-pr58-catalog-vercel-cache--claude-opus-5-5--r2" ], "tentative_runs": [], "subtype": "" }, { "id": "SC-OMITDEV", "case": "stark-parts-pr58-catalog-vercel-cache", "bucket": "C", "title": "Production-only npm install would omit Turbo", "verdict": "Mechanism is valid when devDependencies are explicitly omitted, but the configured npm ci does not do so and actual Vercel project environment was not supplied. Conditional deployment compatibility concern.", "evidence": [ { "path": "package.json", "lines": "5-14" }, { "path": "vercel.json", "lines": "4" } ], "asserted_runs": [ "stark-parts-pr58-catalog-vercel-cache--gpt-6-sol--r4" ], "tentative_runs": [], "subtype": "" }, { "id": "SC-ROOT", "case": "stark-parts-pr58-catalog-vercel-cache", "bucket": "D", "title": "Claim that the root build task cannot run is false", "verdict": "Isolated pinned Turbo 2.10.4 probe successfully runs build:app using the original single-package configuration. Turbo recognizes it as //#build:app without that spelling in turbo.json. The report confuses multi-package root-task registration with single-package behavior; the claimed app-less deployment does not follow.", "evidence": [ { "path": "turbo.json", "lines": "4-10" }, { "path": "package.json", "lines": "5-6" } ], "asserted_runs": [ "stark-parts-pr58-catalog-vercel-cache--gpt-6-sol--r3" ], "tentative_runs": [], "subtype": "incorrect mechanism" }, { "id": "RA-BOUNDS", "case": "rust-analyzer-pr22519-trait-sig-generics", "bucket": "A", "title": "Generic filtering leaves undeclared names in copied bounds", "verdict": "Confirmed consequential correctness regression. The new filter considers associated-item ranges, but copies the where clause and retained parameter bounds unchanged. Valid input yields uncompilable generated code. Where-clause and inline-bound variants count as one dependency-closure issue family.", "evidence": [ { "path": "crates/ide-assists/src/handlers/generate_trait_from_impl.rs", "lines": "117-123,171-205" } ], "asserted_runs": [ "rust-analyzer-pr22519-trait-sig-generics--claude-opus-5-5--r1", "rust-analyzer-pr22519-trait-sig-generics--claude-opus-5-5--r2", "rust-analyzer-pr22519-trait-sig-generics--claude-opus-5-5--r3", "rust-analyzer-pr22519-trait-sig-generics--claude-opus-5-5--r4", "rust-analyzer-pr22519-trait-sig-generics--gpt-5.6-sol--r1", "rust-analyzer-pr22519-trait-sig-generics--gpt-5.6-sol--r2", "rust-analyzer-pr22519-trait-sig-generics--gpt-5.6-sol--r3", "rust-analyzer-pr22519-trait-sig-generics--gpt-5.6-sol--r4", "rust-analyzer-pr22519-trait-sig-generics--gpt-6-astra--r1", "rust-analyzer-pr22519-trait-sig-generics--gpt-6-astra--r2", "rust-analyzer-pr22519-trait-sig-generics--gpt-6-astra--r3", "rust-analyzer-pr22519-trait-sig-generics--gpt-6-astra--r4", "rust-analyzer-pr22519-trait-sig-generics--gpt-6-sol--r1", "rust-analyzer-pr22519-trait-sig-generics--gpt-6-sol--r2", "rust-analyzer-pr22519-trait-sig-generics--gpt-6-sol--r3", "rust-analyzer-pr22519-trait-sig-generics--gpt-6-sol--r4", "rust-analyzer-pr22519-trait-sig-generics--gpt-6.1-sol--r1", "rust-analyzer-pr22519-trait-sig-generics--gpt-6.1-sol--r2", "rust-analyzer-pr22519-trait-sig-generics--gpt-6.1-sol--r3", "rust-analyzer-pr22519-trait-sig-generics--gpt-6.1-sol--r4" ], "tentative_runs": [], "subtype": "" }, { "id": "RA-MACRO", "case": "rust-analyzer-pr22519-trait-sig-generics", "bucket": "A", "title": "Generic references introduced by macros are pruned", "verdict": "Confirmed by source trace: FindUsages searches written parameter tokens; find_nodes descends from tokens in macro calls, but the parameter in a macro definition is a token-tree token, not a NameLike reference. A zero-argument macro invocation has no matching token. The assist copies the invocation into a trait while removing the needed generic. Distinct from dependencies in the trait header. The saved rustc probe confirms the macro invocation resolves T and that the predicted pruned trait fails; it is not an end-to-end assist run.", "evidence": [ { "path": "crates/ide-assists/src/handlers/generate_trait_from_impl.rs", "lines": "176-204" }, { "path": "crates/ide-db/src/search.rs", "lines": "552-603,1011-1049" } ], "asserted_runs": [ "rust-analyzer-pr22519-trait-sig-generics--gpt-6-astra--r2", "rust-analyzer-pr22519-trait-sig-generics--gpt-6-astra--r4", "rust-analyzer-pr22519-trait-sig-generics--gpt-6-sol--r2", "rust-analyzer-pr22519-trait-sig-generics--gpt-6.1-sol--r1", "rust-analyzer-pr22519-trait-sig-generics--gpt-6.1-sol--r2", "rust-analyzer-pr22519-trait-sig-generics--gpt-6.1-sol--r3" ], "tentative_runs": [ "rust-analyzer-pr22519-trait-sig-generics--claude-opus-5-5--r1", "rust-analyzer-pr22519-trait-sig-generics--claude-opus-5-5--r3", "rust-analyzer-pr22519-trait-sig-generics--claude-opus-5-5--r4" ], "subtype": "" }, { "id": "DA-PREFETCH", "case": "duckdb-pr23419-multifile-async-scan", "bucket": "B", "title": "Consumed row groups retain prefetch buffers longer", "verdict": "Base Schedule cleared transport read heads before returning FINISHED. Subject FinishRowGroup only logs and finalizes metrics; the transport remains until InitializeScan replaces it or local state is destroyed. This retains one row group per worker while opening/waiting for the next file and through final source-state lifetime. Confirmed resource-lifetime regression; no measured OOM or query-result error.", "evidence": [ { "path": "extension/parquet/parquet_reader.cpp", "lines": "1478-1479,1734-1736,1840-1845,1970-1983" } ], "asserted_runs": [ "duckdb-pr23419-multifile-async-scan--claude-opus-5-5--r2", "duckdb-pr23419-multifile-async-scan--gpt-6-astra--r1", "duckdb-pr23419-multifile-async-scan--gpt-6-astra--r2", "duckdb-pr23419-multifile-async-scan--gpt-6-astra--r4", "duckdb-pr23419-multifile-async-scan--gpt-6.1-sol--r2" ], "tentative_runs": [], "subtype": "runtime/UI/resource" }, { "id": "DA-DIRECT", "case": "duckdb-pr23419-multifile-async-scan", "bucket": "C", "title": "Standalone Parquet reader API loses required preparation", "verdict": "InitializeScan now selects PROCESS, while column InitializeRead/group-offset setup is reached through private RegisterRowGroupReads from the multi-file ScheduleIO override. The direct public API pair is no longer self-sufficient. All in-tree callers use the correct driver; external users and a compatibility guarantee are not established, and the changed signature already requires adaptation. A concrete contract concern, not an observed SQL failure.", "evidence": [ { "path": "extension/parquet/parquet_reader.cpp", "lines": "1447-1452,1710-1750" }, { "path": "extension/parquet/include/parquet_reader.hpp", "lines": "348-349,419-421" } ], "asserted_runs": [ "duckdb-pr23419-multifile-async-scan--claude-opus-5-5--r1", "duckdb-pr23419-multifile-async-scan--claude-opus-5-5--r2", "duckdb-pr23419-multifile-async-scan--claude-opus-5-5--r4" ], "tentative_runs": [ "duckdb-pr23419-multifile-async-scan--claude-opus-5-5--r3" ], "subtype": "" }, { "id": "DA-BLOCKED", "case": "duckdb-pr23419-multifile-async-scan", "bucket": "C", "title": "External async readers may lose partial chunks on resume", "verdict": "DecodePhase now resets by default before every Scan; base skipped reset after BLOCKED. Parquet opts into OwnsChunkReset and preserves RESUME_PAYLOAD. No affected in-tree reader was found. Confirmed interface change, conditional downstream regression.", "evidence": [ { "path": "src/include/duckdb/common/multi_file/multi_file_function.hpp", "lines": "704-714" }, { "path": "src/include/duckdb/common/multi_file/base_file_reader.hpp", "lines": "104-107" } ], "asserted_runs": [ "duckdb-pr23419-multifile-async-scan--claude-opus-5-5--r1", "duckdb-pr23419-multifile-async-scan--gpt-5.6-sol--r2", "duckdb-pr23419-multifile-async-scan--gpt-5.6-sol--r3" ], "tentative_runs": [ "duckdb-pr23419-multifile-async-scan--claude-opus-5-5--r2", "duckdb-pr23419-multifile-async-scan--claude-opus-5-5--r3", "duckdb-pr23419-multifile-async-scan--gpt-5.6-sol--r4" ], "subtype": "" }, { "id": "DJ-PARTITION", "case": "duckdb-pr23329-json-copy-formats", "bucket": "A", "title": "Partition keys disagree with serialized JSON values", "verdict": "Confirmed by both formatter paths and typed-macro binding. MacroFunction::BindMacroFunction inserts casts at lines 222-231. TIMESTAMP_NS is coerced to microsecond TIMESTAMP for partition formatting; the new JSON formatter preserves nanoseconds. DATE with only timestampformat is another manifestation: formatted in the partition, default ISO in the payload. Base projected once for both. Group both mismatches as one split-formatting family. Precision loss in the old partition path alone is pre-existing; the new disagreement with payload is the regression. No full DuckDB build was run. Opus r2 incorrectly says substitution adds no cast, but correctly identifies the DATE mismatch.", "evidence": [ { "path": "extension/json/json_functions/copy_json.cpp", "lines": "72-84,204-220" }, { "path": "extension/json/json_functions/json_create.cpp", "lines": "702-739,829-848" }, { "path": "src/function/macro_function.cpp", "lines": "222-231" } ], "asserted_runs": [ "duckdb-pr23329-json-copy-formats--gpt-5.6-sol--r1", "duckdb-pr23329-json-copy-formats--gpt-5.6-sol--r2", "duckdb-pr23329-json-copy-formats--gpt-5.6-sol--r3", "duckdb-pr23329-json-copy-formats--gpt-5.6-sol--r4", "duckdb-pr23329-json-copy-formats--gpt-6-sol--r1", "duckdb-pr23329-json-copy-formats--gpt-6-sol--r2", "duckdb-pr23329-json-copy-formats--gpt-6-sol--r3", "duckdb-pr23329-json-copy-formats--gpt-6-sol--r4", "duckdb-pr23329-json-copy-formats--gpt-6-astra--r1", "duckdb-pr23329-json-copy-formats--gpt-6-astra--r2", "duckdb-pr23329-json-copy-formats--gpt-6-astra--r3", "duckdb-pr23329-json-copy-formats--gpt-6-astra--r4", "duckdb-pr23329-json-copy-formats--gpt-6.1-sol--r2", "duckdb-pr23329-json-copy-formats--gpt-6.1-sol--r3", "duckdb-pr23329-json-copy-formats--gpt-6.1-sol--r4", "duckdb-pr23329-json-copy-formats--claude-opus-5-5--r1", "duckdb-pr23329-json-copy-formats--claude-opus-5-5--r2", "duckdb-pr23329-json-copy-formats--claude-opus-5-5--r3", "duckdb-pr23329-json-copy-formats--claude-opus-5-5--r4" ], "tentative_runs": [], "subtype": "" }, { "id": "DJ-DATE-COMPAT", "case": "duckdb-pr23329-json-copy-formats", "bucket": "C", "title": "DATE no longer uses timestampformat in JSON output", "verdict": "Behavior changes, but the new per-type rule matches dateformat/timestampformat separation in CSV. No promise to preserve the old implicit DATE widening was established. Count the standalone compatibility objection separately from the definite partition/payload inconsistency; this is not a second confirmed data bug.", "evidence": [ { "path": "extension/json/json_functions/json_create.cpp", "lines": "704-713" } ], "asserted_runs": [ "duckdb-pr23329-json-copy-formats--gpt-6.1-sol--r4" ], "tentative_runs": [ "duckdb-pr23329-json-copy-formats--claude-opus-5-5--r4" ], "subtype": "" }, { "id": "CA-SENTINEL", "case": "catch2-pr2849-ansi-column-wrap", "bucket": "A", "title": "Literal 0xff causes corruption and invalid reverse traversal", "verdict": "Confirmed regression with unchanged base/subject TextFlow compiled in isolation. A literal byte is rewritten to m; A + 0xff + B at width 2 triggers the new backward-scan assertion, whereas base completes. With assertions disabled the scan has no lower bound. Arbitrary std::string bytes are accepted; no UTF-8 validation contract protects the sentinel. Memory-safety defect, without a demonstrated remote exploit. Corruption and out-of-bounds traversal are one marker-collision family.", "evidence": [ { "path": "src/catch2/internal/catch_textflow.cpp", "lines": "81-85,117-131" } ], "asserted_runs": [ "catch2-pr2849-ansi-column-wrap--gpt-5.6-sol--r1", "catch2-pr2849-ansi-column-wrap--gpt-5.6-sol--r2", "catch2-pr2849-ansi-column-wrap--gpt-5.6-sol--r3", "catch2-pr2849-ansi-column-wrap--gpt-5.6-sol--r4", "catch2-pr2849-ansi-column-wrap--gpt-6-sol--r1", "catch2-pr2849-ansi-column-wrap--gpt-6-sol--r2", "catch2-pr2849-ansi-column-wrap--gpt-6-sol--r3", "catch2-pr2849-ansi-column-wrap--gpt-6-sol--r4", "catch2-pr2849-ansi-column-wrap--gpt-6-astra--r1", "catch2-pr2849-ansi-column-wrap--gpt-6-astra--r2", "catch2-pr2849-ansi-column-wrap--gpt-6-astra--r3", "catch2-pr2849-ansi-column-wrap--gpt-6-astra--r4", "catch2-pr2849-ansi-column-wrap--gpt-6.1-sol--r1", "catch2-pr2849-ansi-column-wrap--gpt-6.1-sol--r2", "catch2-pr2849-ansi-column-wrap--gpt-6.1-sol--r3", "catch2-pr2849-ansi-column-wrap--gpt-6.1-sol--r4", "catch2-pr2849-ansi-column-wrap--claude-opus-5-5--r1", "catch2-pr2849-ansi-column-wrap--claude-opus-5-5--r2", "catch2-pr2849-ansi-column-wrap--claude-opus-5-5--r3", "catch2-pr2849-ansi-column-wrap--claude-opus-5-5--r4" ], "tentative_runs": [], "subtype": "" }, { "id": "CA-ESCAPE", "case": "catch2-pr2849-ansi-column-wrap", "bucket": "B", "title": "Line transitions discard ANSI state changes", "verdict": "Confirmed base/subject probe: a newline followed by ESC[31m loses the escape only in subject. Whitespace advancement skips bytes that neither output substring includes. This changes terminal styling, including dropping resets, but does not establish application data loss or an exploit.", "evidence": [ { "path": "src/catch2/internal/catch_textflow.cpp", "lines": "235-247" } ], "asserted_runs": [ "catch2-pr2849-ansi-column-wrap--gpt-5.6-sol--r1", "catch2-pr2849-ansi-column-wrap--gpt-5.6-sol--r2", "catch2-pr2849-ansi-column-wrap--gpt-5.6-sol--r3", "catch2-pr2849-ansi-column-wrap--gpt-5.6-sol--r4", "catch2-pr2849-ansi-column-wrap--gpt-6-sol--r1", "catch2-pr2849-ansi-column-wrap--gpt-6-sol--r2", "catch2-pr2849-ansi-column-wrap--gpt-6-sol--r4", "catch2-pr2849-ansi-column-wrap--gpt-6-astra--r1", "catch2-pr2849-ansi-column-wrap--gpt-6-astra--r2", "catch2-pr2849-ansi-column-wrap--gpt-6-astra--r3", "catch2-pr2849-ansi-column-wrap--gpt-6.1-sol--r1", "catch2-pr2849-ansi-column-wrap--gpt-6.1-sol--r2", "catch2-pr2849-ansi-column-wrap--gpt-6.1-sol--r3", "catch2-pr2849-ansi-column-wrap--gpt-6.1-sol--r4", "catch2-pr2849-ansi-column-wrap--claude-opus-5-5--r1", "catch2-pr2849-ansi-column-wrap--claude-opus-5-5--r2", "catch2-pr2849-ansi-column-wrap--claude-opus-5-5--r3", "catch2-pr2849-ansi-column-wrap--claude-opus-5-5--r4" ], "tentative_runs": [], "subtype": "runtime/UI/resource" }, { "id": "CA-CTYPE", "case": "catch2-pr2849-ansi-column-wrap", "bucket": "B", "title": "Malformed escapes pass negative char to isdigit", "verdict": "The new parser passes plain char to isdigit. On signed-char implementations, high-bit bytes other than EOF violate the C classification precondition. A definite portability defect; no crash was demonstrated on this host. Missing direct cctype include is supporting portability advice, not an independently counted bug.", "evidence": [ { "path": "src/catch2/internal/catch_textflow.cpp", "lines": "36-40,93-98" } ], "asserted_runs": [ "catch2-pr2849-ansi-column-wrap--gpt-5.6-sol--r1", "catch2-pr2849-ansi-column-wrap--gpt-5.6-sol--r2", "catch2-pr2849-ansi-column-wrap--gpt-5.6-sol--r3", "catch2-pr2849-ansi-column-wrap--gpt-5.6-sol--r4", "catch2-pr2849-ansi-column-wrap--gpt-6-sol--r1", "catch2-pr2849-ansi-column-wrap--gpt-6-sol--r2", "catch2-pr2849-ansi-column-wrap--gpt-6-sol--r3", "catch2-pr2849-ansi-column-wrap--gpt-6-sol--r4", "catch2-pr2849-ansi-column-wrap--gpt-6-astra--r1", "catch2-pr2849-ansi-column-wrap--gpt-6-astra--r3", "catch2-pr2849-ansi-column-wrap--gpt-6-astra--r4", "catch2-pr2849-ansi-column-wrap--gpt-6.1-sol--r2", "catch2-pr2849-ansi-column-wrap--gpt-6.1-sol--r3", "catch2-pr2849-ansi-column-wrap--gpt-6.1-sol--r4", "catch2-pr2849-ansi-column-wrap--claude-opus-5-5--r1", "catch2-pr2849-ansi-column-wrap--claude-opus-5-5--r2", "catch2-pr2849-ansi-column-wrap--claude-opus-5-5--r3", "catch2-pr2849-ansi-column-wrap--claude-opus-5-5--r4" ], "tentative_runs": [ "catch2-pr2849-ansi-column-wrap--gpt-6-astra--r2" ], "subtype": "runtime/UI/resource" }, { "id": "CA-ANSI-ONLY", "case": "catch2-pr2849-ansi-column-wrap", "bucket": "B", "title": "Columns containing only ANSI controls disappear", "verdict": "Confirmed base/subject probe: ESC[0m was emitted by base; subject begins at end and emits nothing. Distinct from separator handling because no visible character exists. Bounded output/terminal-state defect. Publication audit: all four Opus reports explicitly describe this case inside their broader ANSI-loss finding; the initial attribution missed those mentions.", "evidence": [ { "path": "src/catch2/internal/catch_textflow.cpp", "lines": "216-227" } ], "asserted_runs": [ "catch2-pr2849-ansi-column-wrap--gpt-6-sol--r2", "catch2-pr2849-ansi-column-wrap--gpt-6-sol--r3", "catch2-pr2849-ansi-column-wrap--gpt-6-sol--r4", "catch2-pr2849-ansi-column-wrap--claude-opus-5-5--r1", "catch2-pr2849-ansi-column-wrap--claude-opus-5-5--r2", "catch2-pr2849-ansi-column-wrap--claude-opus-5-5--r3", "catch2-pr2849-ansi-column-wrap--claude-opus-5-5--r4" ], "tentative_runs": [], "subtype": "runtime/UI/resource" }, { "id": "CA-QUADRATIC", "case": "catch2-pr2849-ansi-column-wrap", "bucket": "B", "title": "Leading ANSI prefixes are rescanned for every line", "verdict": "Source establishes O(prefix_bytes * output_lines): indentSize and substring construct begin(), whose constructor reparses the full leading prefix. Base used constant-time offsets. A confirmed complexity regression on long escape-prefixed text; no production stall or remote attack established.", "evidence": [ { "path": "src/catch2/internal/catch_textflow.cpp", "lines": "65-66,81-83,195-199" }, { "path": "src/catch2/internal/catch_textflow.hpp", "lines": "81-84" } ], "asserted_runs": [ "catch2-pr2849-ansi-column-wrap--gpt-6-astra--r2", "catch2-pr2849-ansi-column-wrap--gpt-6.1-sol--r2", "catch2-pr2849-ansi-column-wrap--gpt-6.1-sol--r3" ], "tentative_runs": [], "subtype": "runtime/UI/resource" }, { "id": "CA-PADDING", "case": "catch2-pr2849-ansi-column-wrap", "bucket": "D", "title": "Byte-based multi-column padding is pre-existing", "verdict": "The byte-length padding code is unchanged. A width-20 colored single-character column produces the same underpadding on base and subject in the isolated probe. ANSI support remains incomplete, but the reports do not establish a new regression or current newly affected caller. Rejected as a change finding, not as an inaccurate description of the limitation.", "evidence": [ { "path": "src/catch2/internal/catch_textflow.cpp", "lines": "295-308" } ], "asserted_runs": [ "catch2-pr2849-ansi-column-wrap--gpt-5.6-sol--r1", "catch2-pr2849-ansi-column-wrap--gpt-5.6-sol--r2", "catch2-pr2849-ansi-column-wrap--gpt-5.6-sol--r4", "catch2-pr2849-ansi-column-wrap--gpt-6-sol--r1", "catch2-pr2849-ansi-column-wrap--gpt-6-astra--r4" ], "tentative_runs": [], "subtype": "pre-existing" }, { "id": "CA-WIDTH", "case": "catch2-pr2849-ansi-column-wrap", "bucket": "D", "title": "One-character nontermination is not introduced here", "verdict": "Bounded base/subject iteration proves both revisions stop immediately for abc at width 1, and both fail to advance after the first line for a bc at width 1. 5.6 r3 supplies a non-hanging example and falsely says base terminates; Astra r4 supplies a hanging example, but it already hangs in base. No credit for a new bug.", "evidence": [ { "path": "src/catch2/internal/catch_textflow.cpp", "lines": "174-191,216-227,235-247" } ], "asserted_runs": [ "catch2-pr2849-ansi-column-wrap--gpt-5.6-sol--r3", "catch2-pr2849-ansi-column-wrap--gpt-6-astra--r4" ], "tentative_runs": [], "subtype": "pre-existing / incorrect example" }, { "id": "SH-BSD", "case": "cpython-pr118065-shelve-serializers", "bucket": "A", "title": "BSD shelf ignores custom codecs", "verdict": "Confirmed advertised functionality is broken: base initialization overwrites both supplied callbacks with pickle; cursor access also bypasses the custom decoder. Group constructor and navigation omissions as one end-to-end codec integration family. The security consequence requires attacker-controlled records and a caller relying on its custom decoder. Narrow probe confirms callbacks are ignored.", "evidence": [ { "path": "Lib/shelve.py", "lines": "199-234" } ], "asserted_runs": [ "cpython-pr118065-shelve-serializers--claude-opus-5-5--r1", "cpython-pr118065-shelve-serializers--claude-opus-5-5--r2", "cpython-pr118065-shelve-serializers--claude-opus-5-5--r3", "cpython-pr118065-shelve-serializers--claude-opus-5-5--r4", "cpython-pr118065-shelve-serializers--gpt-5.6-sol--r1", "cpython-pr118065-shelve-serializers--gpt-5.6-sol--r2", "cpython-pr118065-shelve-serializers--gpt-5.6-sol--r3", "cpython-pr118065-shelve-serializers--gpt-5.6-sol--r4", "cpython-pr118065-shelve-serializers--gpt-6-astra--r1", "cpython-pr118065-shelve-serializers--gpt-6-astra--r2", "cpython-pr118065-shelve-serializers--gpt-6-astra--r3", "cpython-pr118065-shelve-serializers--gpt-6-astra--r4", "cpython-pr118065-shelve-serializers--gpt-6-sol--r1", "cpython-pr118065-shelve-serializers--gpt-6-sol--r2", "cpython-pr118065-shelve-serializers--gpt-6-sol--r3", "cpython-pr118065-shelve-serializers--gpt-6-sol--r4", "cpython-pr118065-shelve-serializers--gpt-6.1-sol--r1", "cpython-pr118065-shelve-serializers--gpt-6.1-sol--r2", "cpython-pr118065-shelve-serializers--gpt-6.1-sol--r3", "cpython-pr118065-shelve-serializers--gpt-6.1-sol--r4" ], "tentative_runs": [], "subtype": "" }, { "id": "SH-DOC", "case": "cpython-pr118065-shelve-serializers", "bucket": "B", "title": "Published codec contract has wrong directions and incomplete signatures", "verdict": "Confirmed documentation gives backwards callback directions and omits the serializer protocol argument. Group one-argument failures and keyword-only signature omissions here, rather than rewarding multiple reports of the same public-contract documentation problem. The two-argument implementation convention itself is supported by the added tests.", "evidence": [ { "path": "Doc/library/shelve.rst", "lines": "44-50,131,164,178" } ], "asserted_runs": [ "cpython-pr118065-shelve-serializers--claude-opus-5-5--r1", "cpython-pr118065-shelve-serializers--claude-opus-5-5--r2", "cpython-pr118065-shelve-serializers--claude-opus-5-5--r3", "cpython-pr118065-shelve-serializers--claude-opus-5-5--r4", "cpython-pr118065-shelve-serializers--gpt-5.6-sol--r1", "cpython-pr118065-shelve-serializers--gpt-5.6-sol--r2", "cpython-pr118065-shelve-serializers--gpt-5.6-sol--r3", "cpython-pr118065-shelve-serializers--gpt-5.6-sol--r4", "cpython-pr118065-shelve-serializers--gpt-6-astra--r1", "cpython-pr118065-shelve-serializers--gpt-6-astra--r2", "cpython-pr118065-shelve-serializers--gpt-6-astra--r3", "cpython-pr118065-shelve-serializers--gpt-6-astra--r4", "cpython-pr118065-shelve-serializers--gpt-6-sol--r1", "cpython-pr118065-shelve-serializers--gpt-6-sol--r2", "cpython-pr118065-shelve-serializers--gpt-6-sol--r3", "cpython-pr118065-shelve-serializers--gpt-6-sol--r4", "cpython-pr118065-shelve-serializers--gpt-6.1-sol--r1", "cpython-pr118065-shelve-serializers--gpt-6.1-sol--r2", "cpython-pr118065-shelve-serializers--gpt-6.1-sol--r3", "cpython-pr118065-shelve-serializers--gpt-6.1-sol--r4" ], "tentative_runs": [], "subtype": "test/tooling/docs" }, { "id": "SH-TEST", "case": "cpython-pr118065-shelve-serializers", "bucket": "B", "title": "New test assumes optional SQLite backend", "verdict": "Confirmed test portability defect: dbm tries several backends and SQLite is optional, but the test dereferences dbm.sqlite3.error unconditionally. No product failure is required.", "evidence": [ { "path": "Lib/test/test_shelve.py", "lines": "197-206" } ], "asserted_runs": [ "cpython-pr118065-shelve-serializers--claude-opus-5-5--r1", "cpython-pr118065-shelve-serializers--claude-opus-5-5--r2", "cpython-pr118065-shelve-serializers--claude-opus-5-5--r3", "cpython-pr118065-shelve-serializers--claude-opus-5-5--r4", "cpython-pr118065-shelve-serializers--gpt-5.6-sol--r1", "cpython-pr118065-shelve-serializers--gpt-5.6-sol--r2", "cpython-pr118065-shelve-serializers--gpt-5.6-sol--r3", "cpython-pr118065-shelve-serializers--gpt-5.6-sol--r4", "cpython-pr118065-shelve-serializers--gpt-6-astra--r1", "cpython-pr118065-shelve-serializers--gpt-6-astra--r2", "cpython-pr118065-shelve-serializers--gpt-6-astra--r3", "cpython-pr118065-shelve-serializers--gpt-6-astra--r4", "cpython-pr118065-shelve-serializers--gpt-6-sol--r1", "cpython-pr118065-shelve-serializers--gpt-6-sol--r2", "cpython-pr118065-shelve-serializers--gpt-6-sol--r3", "cpython-pr118065-shelve-serializers--gpt-6-sol--r4", "cpython-pr118065-shelve-serializers--gpt-6.1-sol--r1", "cpython-pr118065-shelve-serializers--gpt-6.1-sol--r2", "cpython-pr118065-shelve-serializers--gpt-6.1-sol--r3", "cpython-pr118065-shelve-serializers--gpt-6.1-sol--r4" ], "tentative_runs": [], "subtype": "test/tooling/docs" }, { "id": "SH-INIT", "case": "cpython-pr118065-shelve-serializers", "bucket": "C", "title": "Callback validation follows database acquisition or replacement", "verdict": "Mechanism confirmed by a narrow probe: incomplete hooks can close caller storage and flag=n replaces an existing database before raising. Conservatively conditional/actionability bucket: destructive case explicitly requests replacement and passes invalid arguments; the error-side-effect contract is not specified. Worth fixing, but not counted as an unambiguous valid-use landing blocker. Reports describing only resource retention get credit for the same validation-order family.", "evidence": [ { "path": "Lib/shelve.py", "lines": "89-103,151-173,244-246" } ], "asserted_runs": [ "cpython-pr118065-shelve-serializers--gpt-5.6-sol--r1", "cpython-pr118065-shelve-serializers--gpt-5.6-sol--r2", "cpython-pr118065-shelve-serializers--gpt-5.6-sol--r3", "cpython-pr118065-shelve-serializers--gpt-5.6-sol--r4", "cpython-pr118065-shelve-serializers--gpt-6-sol--r1", "cpython-pr118065-shelve-serializers--gpt-6-sol--r2", "cpython-pr118065-shelve-serializers--gpt-6-sol--r3", "cpython-pr118065-shelve-serializers--gpt-6.1-sol--r2", "cpython-pr118065-shelve-serializers--gpt-6.1-sol--r3", "cpython-pr118065-shelve-serializers--gpt-6.1-sol--r4" ], "tentative_runs": [ "cpython-pr118065-shelve-serializers--claude-opus-5-5--r3" ], "subtype": "" }, { "id": "ST-ANNOTATION-WRONG", "case": "cpython-pr121143-strace-helper", "bucket": "D", "title": "Annotation typo falsely described as import-breaking", "verdict": "The typo is real but the asserted import failure is false for this pinned Python 3.14 tree. Python/compile.c:1908-1947 emits a separate annotation scope; annotations are deferred. A host Python 3.14 probe of the pinned helper definitions imports successfully and fails only on get_type_hints. No credit as a consequential import bug; a correct edit alone does not validate the reported mechanism.", "evidence": [ { "path": "Lib/test/support/strace_helper.py", "lines": "47" } ], "asserted_runs": [ "cpython-pr121143-strace-helper--gpt-5.6-sol--r3", "cpython-pr121143-strace-helper--gpt-5.6-sol--r4", "cpython-pr121143-strace-helper--gpt-6-astra--r1", "cpython-pr121143-strace-helper--gpt-6-astra--r2", "cpython-pr121143-strace-helper--gpt-6-astra--r4", "cpython-pr121143-strace-helper--gpt-6-sol--r1", "cpython-pr121143-strace-helper--gpt-6-sol--r2", "cpython-pr121143-strace-helper--gpt-6-sol--r3", "cpython-pr121143-strace-helper--gpt-6.1-sol--r1", "cpython-pr121143-strace-helper--gpt-6.1-sol--r3", "cpython-pr121143-strace-helper--gpt-6.1-sol--r4" ], "tentative_runs": [], "subtype": "incorrect impact (real typo)" }, { "id": "ST-ANNOTATION", "case": "cpython-pr121143-strace-helper", "bucket": "B", "title": "Malformed annotation breaks introspection", "verdict": "Confirmed narrow defect: Dict receives a slice instead of two parameters when deferred annotations are evaluated. Correctly limited to introspection in these reports.", "evidence": [ { "path": "Lib/test/support/strace_helper.py", "lines": "47" } ], "asserted_runs": [ "cpython-pr121143-strace-helper--claude-opus-5-5--r1", "cpython-pr121143-strace-helper--claude-opus-5-5--r2", "cpython-pr121143-strace-helper--claude-opus-5-5--r3", "cpython-pr121143-strace-helper--claude-opus-5-5--r4", "cpython-pr121143-strace-helper--gpt-5.6-sol--r1", "cpython-pr121143-strace-helper--gpt-5.6-sol--r2" ], "tentative_runs": [], "subtype": "test/tooling/docs" }, { "id": "ST-PROBE", "case": "cpython-pr121143-strace-helper", "bucket": "A", "title": "Unavailable tracing can abort whole test-module imports", "verdict": "Confirmed with injected ptrace-denied diagnostic. _can_strace asserts that events parsed before checking failure status. Parentheses in a real-shaped ptrace error defeat the parser, causing the skip decorator to raise and abort module import.", "evidence": [ { "path": "Lib/test/support/strace_helper.py", "lines": "11-12,80-86,154-170" } ], "asserted_runs": [ "cpython-pr121143-strace-helper--claude-opus-5-5--r1", "cpython-pr121143-strace-helper--claude-opus-5-5--r2", "cpython-pr121143-strace-helper--claude-opus-5-5--r3" ], "tentative_runs": [], "subtype": "" }, { "id": "ST-PARSER", "case": "cpython-pr121143-strace-helper", "bucket": "B", "title": "Trace parser drops calls containing quoted parentheses", "verdict": "Confirmed by pinned-code probe: write(1, \")\", 1) disappears; commas split quoted strings. The general helper can undercount syscalls. Current fixed payload does not establish a production runtime regression.", "evidence": [ { "path": "Lib/test/support/strace_helper.py", "lines": "11-12,35-44" } ], "asserted_runs": [ "cpython-pr121143-strace-helper--claude-opus-5-5--r3", "cpython-pr121143-strace-helper--gpt-6-astra--r1", "cpython-pr121143-strace-helper--gpt-6-astra--r2", "cpython-pr121143-strace-helper--gpt-6-astra--r3", "cpython-pr121143-strace-helper--gpt-6.1-sol--r1", "cpython-pr121143-strace-helper--gpt-6.1-sol--r2", "cpython-pr121143-strace-helper--gpt-6.1-sol--r3", "cpython-pr121143-strace-helper--gpt-6.1-sol--r4" ], "tentative_runs": [], "subtype": "test/tooling/docs" }, { "id": "ST-BINARY", "case": "cpython-pr121143-strace-helper", "bucket": "B", "title": "Binary stderr raises UnicodeDecodeError", "verdict": "Confirmed with injected successful process result containing non-UTF8 stderr. New helper unconditionally decodes the combined stderr/trace; current added test scripts do not exercise arbitrary binary stderr.", "evidence": [ { "path": "Lib/test/support/strace_helper.py", "lines": "89-101" } ], "asserted_runs": [ "cpython-pr121143-strace-helper--gpt-6-astra--r3", "cpython-pr121143-strace-helper--gpt-6.1-sol--r2" ], "tentative_runs": [], "subtype": "test/tooling/docs" }, { "id": "ST-ABI", "case": "cpython-pr121143-strace-helper", "bucket": "C", "title": "Exact syscall list depends on Linux ABI/libc", "verdict": "Credible platform concern: literal openat/lseek and a substring fstat heuristic are stricter than Linux-only gating. No matching architecture/libc runtime or pinned external implementation was verified here, so conservatively unresolved rather than a proven cross-platform failure.", "evidence": [ { "path": "Lib/test/test_fileio.py", "lines": "387-395" } ], "asserted_runs": [ "cpython-pr121143-strace-helper--claude-opus-5-5--r1", "cpython-pr121143-strace-helper--claude-opus-5-5--r2", "cpython-pr121143-strace-helper--claude-opus-5-5--r3", "cpython-pr121143-strace-helper--claude-opus-5-5--r4", "cpython-pr121143-strace-helper--gpt-5.6-sol--r2", "cpython-pr121143-strace-helper--gpt-6-astra--r3" ], "tentative_runs": [], "subtype": "" }, { "id": "ST-FLAGS", "case": "cpython-pr121143-strace-helper", "bucket": "C", "title": "Availability probe omits required strace flags", "verdict": "Correct difference between probe and actual command; a failing supported-version example is not established. Missing strace compatibility baseline makes this conditional.", "evidence": [ { "path": "Lib/test/support/strace_helper.py", "lines": "154-170" } ], "asserted_runs": [ "cpython-pr121143-strace-helper--claude-opus-5-5--r3", "cpython-pr121143-strace-helper--gpt-5.6-sol--r2" ], "tentative_runs": [], "subtype": "" }, { "id": "ST-VFORK-COVERAGE", "case": "cpython-pr121143-strace-helper", "bucket": "B", "title": "Explicit vfork-disable integration case removed", "verdict": "Diff removes the only traced _USE_VFORK=False case, while mock-based flag forwarding remains. Confirmed bounded coverage regression, not a runtime vfork defect. Reports speculating about author intent receive no credit for that speculation.", "evidence": [ { "path": "Lib/test/test_subprocess.py", "lines": "3468-3475" } ], "asserted_runs": [ "cpython-pr121143-strace-helper--claude-opus-5-5--r1", "cpython-pr121143-strace-helper--claude-opus-5-5--r2", "cpython-pr121143-strace-helper--claude-opus-5-5--r3", "cpython-pr121143-strace-helper--claude-opus-5-5--r4", "cpython-pr121143-strace-helper--gpt-6-sol--r1", "cpython-pr121143-strace-helper--gpt-6-sol--r2", "cpython-pr121143-strace-helper--gpt-6-sol--r4" ], "tentative_runs": [], "subtype": "test/tooling/docs" }, { "id": "ST-POSIXSPAWN", "case": "cpython-pr121143-strace-helper", "bucket": "C", "title": "Newly enabled positive vfork check may test libc instead", "verdict": "Parent-only mock does not affect the child, but that was also true in base. Claim of newly exposed behavior depends on the old strace filter always skipping on the relevant platforms. Keep conditional/pre-existing interaction separate from the confirmed removal of the negative case.", "evidence": [ { "path": "Lib/test/test_subprocess.py", "lines": "3439-3463" } ], "asserted_runs": [ "cpython-pr121143-strace-helper--claude-opus-5-5--r1", "cpython-pr121143-strace-helper--claude-opus-5-5--r2", "cpython-pr121143-strace-helper--claude-opus-5-5--r4" ], "tentative_runs": [], "subtype": "" }, { "id": "ST-PYIO", "case": "cpython-pr121143-strace-helper", "bucket": "B", "title": "Python I/O subclass repeats the C I/O trace", "verdict": "Confirmed: shared mixin child script uses built-in open rather than self.FileIO/modulename. Duplicates C coverage without exercising _pyio.", "evidence": [ { "path": "Lib/test/test_fileio.py", "lines": "365-450" } ], "asserted_runs": [ "cpython-pr121143-strace-helper--claude-opus-5-5--r2", "cpython-pr121143-strace-helper--claude-opus-5-5--r3", "cpython-pr121143-strace-helper--gpt-6-sol--r4" ], "tentative_runs": [], "subtype": "test/tooling/docs" }, { "id": "ST-PATH", "case": "cpython-pr121143-strace-helper", "bucket": "B", "title": "Executable paths can satisfy vfork regex", "verdict": "New %process tracing includes execve paths, and assertions scan raw trace for vfork anywhere. A path containing vfork can cause spurious failure or a false positive. A concrete environmental name dependency; bounded test defect.", "evidence": [ { "path": "Lib/test/test_subprocess.py", "lines": "3454-3490" } ], "asserted_runs": [ "cpython-pr121143-strace-helper--gpt-6-sol--r4", "cpython-pr121143-strace-helper--gpt-6.1-sol--r1" ], "tentative_runs": [], "subtype": "test/tooling/docs" }, { "id": "ST-SENTINEL", "case": "cpython-pr121143-strace-helper", "bucket": "C", "title": "Parse-error sentinel may make negative assertion vacuous", "verdict": "Code can return synthetic error text even with check=True. Claimed silent pass depends on an unsupported/future flag or trailing diagnostic, not a demonstrated current caller execution.", "evidence": [ { "path": "Lib/test/support/strace_helper.py", "lines": "103-111" } ], "asserted_runs": [ "cpython-pr121143-strace-helper--claude-opus-5-5--r4" ], "tentative_runs": [], "subtype": "" } ]