Commit graph

12 commits

Author SHA1 Message Date
trvon
b33d3357b5
fix(rust): refine path join traversal provenance
Some checks failed
build / build-linux (push) Failing after 7m51s
build / build-macos (push) Has been cancelled
build / release (push) Has been cancelled
2026-09-02 05:58:14 -06:00
trvon
a016268e1f
bench: activate wall/RSS regression gates via performance baselines
Some checks failed
build / build-linux (push) Failing after 8m1s
build / build-macos (push) Has been cancelled
build / release (push) Has been cancelled
Round 3, iteration 2 of the fold optimization loop
(docs/research/optimization-loop-2026-07-30.md).

The foundation audit found both manifests declaring
wall_regression_pct/rss_regression_pct with no baseline artifacts —
the regression gates never engaged in the entire campaign.

New: tests/benchmarks/projects/baselines/{fold_source,yams_source}.json
(full prior-eval summaries with matching tu-set/config fingerprints
and exact finding fingerprints). Both manifests now reference their
baselines, activating the eval's baseline-compare path
(compare_performance_lanes + rss_regression).

Engage proof:
- fold: baseline_comparison engaged (paired-by-repetition, baseline
  103.65s vs candidate 82.7s, -20.2%), status ok
- yams: gate FIRED on a 113% concurrent-load swing (proving it
  discriminates), then passed quiet (7.181s vs 8.104s)

Also extends the schema-test prune to {runs, baselines} — third
instance of the same glob-sweep fragility the foundation audit
predicted. Full suite 137/137; fingerprints exactly preserved
(0fec78e5.../247523c5...); gold precision/recall 1.0 both.
2026-08-31 18:08:16 -06:00
trvon
27e1b23e7d
style: fold formatting normalization into campaign test files
Some checks failed
build / build-linux (push) Failing after 8m23s
build / build-macos (push) Has been cancelled
build / release (push) Has been cancelled
Iteration 9 of the fold optimization loop
(docs/research/optimization-loop-2026-07-30.md).

Iteration 9 targeted the control-walk condition-fact cost (35.1s of
the sql-injection profile). Measurement-first: a scratch patch (never
committed) counted duplicate feasibility queries in a live scan —
1314 total, 1268 distinct (3.5% duplicate) — so a memo cache caps out
at ~1.2s of 35.1s, far below the >=20% KPI. The checks are genuine,
distinct SMT solving; memoization is a measured dead end. Scratch
patch fully reverted; production byte-identical.

Viable future directions recorded for the next campaign: fast-path
widening beyond affine parameter comparisons, incremental solving over
the pushed path stack, dual-walk (CFG/AST fallback) elimination.

This commit folds the formatting normalization applied to two
campaign-authored files after their initial commit.
2026-08-31 07:13:25 -06:00
trvon
91fcef3d74
test(bench): scope benchmark schema test to checked-in documents
Iteration 4 of the fold optimization loop
(docs/research/optimization-loop-2026-07-30.md).

BenchmarkSchemaTest claimed to validate checked-in manifests but
globbed tests/benchmarks/**/*.json, sweeping the designated runtime
output directory tests/benchmarks/runs/ (optimization-loop harness
artifacts) and failing 32 assertions + 5 errors on every full-suite
run once run artifacts existed.

Fix: prune runs/ from the glob; add tests/benchmarks/runs/ to
.gitignore so run artifacts are never accidentally committed.

fold:benchmark_evaluation green; full suite 137/137 with zero
failures. No production code change.
2026-08-30 20:46:03 -06:00
trvon
fd4a68dfff
test: add coverage for project graph, pcode encoder, and detector behaviors
Unit + integration coverage for the session's work: incremental project
graph/index, pcode encoder, unreachable/dead-branch, equiv/cross-TU,
div-by-zero/sign-conversion/int-truncation, use-after-free, quality-precision,
scan-router profile, source TU runner, detector plan, and the eval fixtures.
2026-08-16 16:46:07 -06:00
trvon
86b2f14a43
feat(analysis): harden project-wide scans
- persist TU-owned graphs and guarded configuration evidence
- add closed-world production reachability classification
- calibrate detector precision and reviewed self-scan policy
- terminate poisoned workers instead of longjmp recovery
2026-07-30 18:18:04 -04:00
trvon
bd29aab697
test(quality): strengthen evaluation evidence 2026-07-29 20:47:04 -04:00
trvon
b0b51f1e71
feat: converge quality and scan interfaces
- fail closed on MCP input and compile database policy
- add shared scan catalogs, finding queries, and tiered gates
2026-07-29 00:57:33 -04:00
trvon
ab262b2220
feat(quality): enforce evaluator policies 2026-07-28 14:09:12 -04:00
trvon
f37222d4fb
fix(scan): harden frontend analysis 2026-07-28 11:57:38 -04:00
trvon
f0ece0794a
feat(eval): add manifest project runner 2026-07-27 23:18:03 -04:00
trvon
2dcbdbc75d
feat: harden Fold quality guard
Preserve source, binary, and runtime evidence boundaries while making precision and performance regressions reproducible.

- decompose analysis orchestration into bounded modules
- add differential, metamorphic, organic, and Yams change-time gates
- fix detector, P-Code, fuzz sanitizer, and report identity precision
2026-07-13 15:05:35 -04:00