33cc466b3a
wave5: vagrant-0001 flagship + 32-target CI/CD/IaC scan survey
...
vagrant-0001: bundler.rb plugin loader runs Array#include? against
plugins.keys / system_plugins inside per-spec loops. O(S*P) per
vagrant command. Fix: hoist Set.new outside the loop, O(1) per
spec lookup. Bench: 127x at S=2000 P=1000.
wave5-cicd-iac-survey.md: documents 32 projects scanned across
deployment (Spinnaker, fluxcd, Argo Rollouts/Events), modern CI/CD
(Earthly, Dagger, Buck2), container runtime (containerd, crun,
skopeo, ko, kaniko, buildah), local k8s (kind, minikube, k3s),
IaC + testing (Packer, Vagrant, ansible-lint, Molecule, InSpec,
Terratest), contract/mutation testing (Pact, Stryker, mutmut,
PIT), security (Semgrep, Bandit, gosec), Java quality (Spotbugs,
Checkstyle, chart-testing).
Clean-scan honor roll +4: chart-testing, kind, ko, pact-ruby.
2026-04-25 10:01:56 -04:00
b9c6ea007d
wave4: document PHP_CodeSniffer ReDoS + aws-cdk triage outcomes
...
Investigated the top 2 triage-backlog items from the Wave 4 survey:
- PHP_CodeSniffer Tokenizers/PHP.php ReDoS: scanner flagged
((?<!\.)_[0-9A-F][0-9A-F.]*)+$ as catastrophic-backtracking shape.
Empirical test shows the underscore-anchored inner group prevents
overlap between outer iterations; Python re matches N=50 pathological
input in sub-millisecond time. False positive. Scanner could be taught
to recognize anchor-prefix inner groups as safe.
- aws-cdk region-info.ts limitedRegionMap: partitions.includes inside
per-region loop is a real O(R*P) shape. At realistic scale (R=35
regions, P=2-4 partitions) the wall-clock improvement is constant-
factor only; bench shows 2.9x at R=2000 P=100 but collapses to 1.0x
at production scale. Cleanup-grade, not CWE-407 complexity-class
emergency; no patch shipped.
Both findings documented in the Wave 4 triage section as investigated-
and-resolved. The remaining 5 items stay on the list for future waves.
2026-04-24 17:28:14 -04:00
bb81a1a3a0
wave4: psalm-0001 flagship patch + linter/CI/config scan survey
...
psalm-0001: FileFilter.allowsClass runs in_array() on every class the
analyzer visits. For C classes and F filter entries, per-run cost is
O(C*F). Fix: lazy array_fill_keys hash set; O(1) probe per class.
Bench: 336x at C=F=5000. Patch + ticket + bench + intel brief ship.
wave4-linter-ci-survey.md: consolidated report on 40 projects scanned
across linters (eslint, biome, prettier, pylint, ruff, black, rubocop,
shellcheck, stylelint, sqlfluff, phpstan, PHP_CodeSniffer, psalm,
rustfmt, golangci-lint, scalafmt, hadolint, yamllint, markdownlint,
ktlint, detekt), CI runners (act, buildkite-agent, tektoncd/pipeline,
concourse, woodpecker), config management (aws-cdk, cdk8s, kustomize),
and build tools (rollup, parcel, vite, turborepo, nx, lerna, swc,
babel, gulp).
Clean scans (zero HIGH+ findings): hadolint, shellcheck, gulp.
Document includes per-target finding counts and 7 triage follow-ups for
future waves (PHP_CodeSniffer ReDoS, ktlint spacing rule, pylint
MSG_ORDER.index, black pgen2 dfa, golangci-lint migrate, tektoncd
forbidden-env scan, aws-cdk region-info).
2026-04-24 17:21:51 -04:00
788514bcf7
outreach: refresh 13 stale Speedup lines to show measured + per-defect scenario
...
artemis, doris, gin, gstreamer, igraph, kylin, nifi, open3d, opencv,
ros2, starrocks, trino, victoria-metrics: each had a **Speedup:**
metadata line from an early draft with a small per-defect scenario
number (2.5x, 5x worst case, etc.) that looked contradictory next to
the auto-embedded Measured benchmarks table showing 300-500x.
Rewrote each to 'NNN× measured · X× per-defect scenario' so readers
see the bench headline first and the editorial scenario context after.
Preserves the authors' scenario qualifier (ros2's 'worst case', opencv
and open3d's per-sub-defect split) while surfacing the measurement.
Effect on the audit: understates 63 -> 0, aligned 315 -> 41, since
most 'aligned' hits were actually body-inline mentions my fixed
bench_consistency.py no longer considers as headline claims.
2026-04-24 16:53:56 -04:00
82c6916fe2
outreach: reconcile 3 overstate claims with measured wall-clock benches
...
Each of the 3 briefs flagged by bench_consistency.py as claim > measured
now carries an explicit line pairing the op-count claim with the
measured wall-clock speedup and explaining the residual gap.
fbneo-0001: 45,000x claim -> + 2,410x wall-clock at N=45k
(Python dict vs C++ unordered_map constant factor).
mercurial-0001: 5,000x claim -> + 50x wall-clock at k=500
(Python sim ceiling; bench_google_scale.py projects
to Google-scale via ops ratio).
substrate: 38,550x claim -> + 2,009x wall-clock at N=10k
(Python list vs Rust HashSet constant factor).
mercurial-0001 bench also scaled to CASES=[(1000,50), (1000,100),
(1500,200), (1500,350), (1500,500)] to cover k=500 directly.
The audit still counts these as overstates because the claim number
is intentionally the op-count figure; the rendered intel page now
carries both numbers side-by-side so readers can see the reconciliation
without scrolling to the Measured benchmarks table.
2026-04-24 16:11:22 -04:00
d67ec93a5d
test-frameworks wave 3: vitest + testng + jasmine + libcheck (4 patches)
...
vitest-0001: coverage-v8 coverage.result.find inside merged.result.forEach
-> Map<url, result> lookup. Bench: 824x at N=M=10000 coverage entries.
testng-0001: DynamicGraph.toDot freeNodes.contains inside two for-each
loops -> Map<T, String> color lookup via getOrDefault. Bench: 64x at N=2000.
jasmine-0001: SpyRegistry.spyOnAllFunctions propertiesToSkip.indexOf inside
Array.filter + .concat growth across D prototype levels -> Set.has + O(1)
growth. Bench: 61x at D=10, P=300.
check-0001: libcheck suite_tcase linear strcmp scan over tclst List
-> parallel hashtable for O(1) lookup amortized. Bench: 117x at N=1000.
Shipped as design sketch; full integration requires companion hashtable.
Also ships whitepaper/outreach/test-harness-survey.md documenting 14
clean-scan frameworks across Clojure, OCaml, Haskell, Erlang, Go, F#,
Julia, Shell, Lua, JS. Scope covered 61 targets across 30+ languages.
UNDF IDs: 1292 (check), 1293 (jasmine), 1294 (testng), 1295 (vitest).
All 12 tests pass.
2026-04-23 08:54:44 -04:00
b79fddfb51
browser-automation wave 2: testcafe-0001 + webdriverio-0002
...
testcafe-0001: Selector filterNodes (string-filter branch) and
expandSelectorResults both dedup via Array.indexOf on growing result
arrays. filterNodes: O(N*M) per selector filter. expandSelectorResults:
O(N^2 * K^2) worst case when derivatives unique. Fix: Set<Node> keyed
by object identity. Bench: 398x at N=2000 filter, 1966x at N=K=150
expand.
webdriverio-0002: MSPO aggregator dedups per-test entries via Array.find
on growing bucket array. O(N^2) per test bucket, same pattern repeats
in unknown-suite merger. Fix: companion Map<bucketKey, Set<selector>>
for O(1) dedup. Bench: 493x at N=2000.
UNDF IDs: 1290 (testcafe), 1291 (webdriverio-0002). All 17 tests pass.
2026-04-22 18:31:53 -04:00
9a0253e724
browser-automation: 4 CWE-407 patches (selenium x2, playwright, webdriverio)
...
selenium-0001: SessionCapabilitiesMutator list.contains O(NxM) -> LinkedHashSet
O(N+M). Grid Node session mutation hot path. Bench: 192x at N=M=1000.
selenium-0002: ChromiumOptions merge helpers consolidate four list.contains
loops behind addArgumentsUnique/addEncodedExtensionsUnique. Bench: 254x
at N=M=1000.
playwright-0001: roleUtils validRoles / allowsNameFromContent Array.includes
on 20-70 element constant arrays per element. Converted to Set<string>
at module load. Bench: 11x at N=10000 elements.
webdriverio-0001: xpath-conditions extractOrConditions orMatches.find +
values.includes per regex match -> Map<attr, Set<values>>. Bench: 6x at
K=V=60 in the 'mobileSelectorPerformanceOptimizer'.
Each defect ships: ticket, patch with complexity-gate header, Python
benchmark + correctness test, Makefile, outreach brief. All 16 tests
pass. UNDF IDs: 1276 (playwright), 1277 (selenium-0001), 1288
(selenium-0002), 1289 (webdriverio).
2026-04-22 18:14:39 -04:00
652608142a
feat: close outreach doc gap — 276 docs (batches 11-16)
...
All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.
Outreach gap: 276 -> 0.
2026-04-15 13:57:42 -04:00
aeb084c9ae
feat: add 30 outreach docs (batches 9-10)
...
Batch 9 (15): bun, bzflag (3), cake_wallet (4), calligra, caprice32 (2),
cataclysm (3), cemu
Batch 10 (15): cemu-0002, citra, clickhouse-java, cmake (3), cocos2d (3),
conduit, cura (2), curaengine, clamav, contiki
2026-04-14 19:51:36 -04:00
6784cdf1cf
feat: add 39 outreach docs (batches 6-8)
...
Batch 6 (9): dolibarr, jitsi-videobridge, zed, tryton, suricata,
strawberry, zulip, zesarux, zephyr
Batch 7 (15): xonotic (4), xash3d (3), xenia, xtuple, zabbix (2),
zathura, zebra, yabause, zephyr-0001
Batch 8 (15): woodpecker (2), wine (4), widelands (3), wesnoth (3),
wekan (3)
Mix of CWE-407 and CWE-312.
2026-04-14 17:06:28 -04:00
9a78d1afbe
feat: add 15 outreach docs (15 defects) for 1-patch projects
...
0ad (4), aranym, ardour, argo-cd, aria2, azahar, bcoin, bind9,
btcpayserver (3), bullet3. Mix of CWE-407 and CWE-312.
2026-04-14 14:33:17 -04:00
4f1965397a
feat: add 10 outreach docs (20 defects) for 2-patch batch 2
...
firefox, go-ethereum, imagemagick, influxdb, micronaut-core, openbsd,
proton, proxysql, sqlite, vim. All CWE-407.
2026-04-14 14:09:18 -04:00
7e7ec2c3d3
feat: add 10 outreach docs (20 defects) for 2-patch projects
...
amarok, arrow, audacity, cargo, clementine, composer, dask,
deluge, dosbox-x, dragonfly. All CWE-407.
2026-04-14 13:50:33 -04:00
283a490d6d
feat: add 5 outreach docs (15 defects) for batch 4
...
distlib (3, Python), redmine (3, Ruby), grape (3, Ruby),
solc (3, Solidity/C++), grpc-java (3, Java).
2026-04-13 16:55:04 -04:00
d1f82fd8e3
feat: add 8 outreach docs (26 defects) for batch 3
...
rpcs3 (4, C++), ppsspp (4, C++), spring-framework (3, Java),
nats-server (3, Go), minio (3, Go), gimp (3, C), cockroach (3, Go),
superset (3, Python). Note: rpcs3-0004 is CWE-312, rest are CWE-407.
2026-04-13 15:35:53 -04:00
ee04b13f01
feat: add 8 outreach docs (36 defects) for batch 2
...
gitlab-foss (5, Ruby), darktable (5, C), suitecrm (6, PHP),
inkscape (4, C++), calibre (4, Python), scribus (4, C++),
vscode (4, TypeScript), digikam (4, C++).
Note: darktable-0004 and digikam-0004 are CWE-312 (cleartext credential
logging), not CWE-407.
2026-04-13 14:46:34 -04:00
c24246e2e2
feat: add 5 outreach docs (33 defects) + mastodon CWE-1333 benchmark
...
Outreach docs (unblock intel page generation):
- kdenlive: 10 defects (8 CWE-407 + 1 CWE-362 + 1 keyframe), C++
- libreoffice: 5 defects (Writer, Calc, SFX, Impress), C++
- maven: 7 defects (graph, lifecycle, sort-by-indexOf), Java
- cpython: 7 defects (pkgutil, codegen, mock, pmerge MRO, pydoc), C/Python
- blender: 4 defects (node runtime, USD skel, shader, anim), C++
Mastodon CWE-1333 benchmark:
- test_mastodon_cwe1333.rb: validates (.+\.)? -> ([^@]+\.)? fix
eliminates O(2^N) backtracking in email validator
2026-04-13 14:03:16 -04:00
9134c083c3
feat: update lean4 outreach doc with confirmed benchmark speedups
...
Replace "up to 1000x" with measured results: 34x/678x/210x.
Status: patch-ready on unlean4 branch, 7 patches complete.
2026-04-13 10:30:36 -04:00
5451e1748b
outreach: add lean4 disclosure brief — 7 defects, MOAD references
2026-04-13 09:27:50 -04:00
bace89cebc
fix: remove 'The' from fixed system harmony sentence
2026-04-10 12:40:37 -04:00
5b06ab06c9
fix: source Truth & Light attribution to timehexon.com/theology
2026-04-10 12:33:52 -04:00
716ef7cb2d
undf: register UNDF-1250..1258 (DragonFly BSD + NetBSD CWE-407)
2026-04-05 19:46:54 -04:00
6050e1b741
hurd: all 5 defects patched, hurd-0004 closed as clean scan, add hurd-0005 patch
2026-04-05 15:57:48 -04:00
e94a4b17b3
hurd: 6 CWE-407 defects confirmed — auth, libports, proc, idvec
2026-04-04 16:19:59 -04:00
d01d210351
hurd: queue CWE-407 scan — libports, dispatch loops, translator tables
2026-04-04 16:14:54 -04:00
9cc2a89d0f
linux: add complexity gate headers to all 8 patches; fix 0003/0007/0008 code issues
...
- All 8 patches now carry required # CWE-407 / # Defect / # Fix / # Complexity gate
header blocks per patch file format spec
- linux-0001 (headerdep.pl): header only — code was correct
- linux-0002 (auditsc.c): header + explicit break to prevent ctx->names_list fall-through
- linux-0003 (dev.c): rewrote fix — skip altname loop when format has no percent-d
placeholder; removes duplicate bounds check from prior draft
- linux-0004 (neighbour.c): header + cleaned up ifdef guards; xarray with fallback
- linux-0005 (component.c): header + existing hash fast-path retained
- linux-0006 (btf.c): header + fixed cache hit path — no longer re-runs
btf_find_by_name_kind on hit; uses stored btf_id directly
- linux-0007 (pktgen.c): rewrote fix — replaced xa_for_each (O(N)) with dual
DECLARE_HASHTABLE: dev_ht (by dev*) and name_ht (by jhash(ifname))
- linux-0008 (taskstats.c): fixed mixed list_for_each_entry/hash_for_each_possible
syntax; clean replacement of duplicate-pid list scan with hash_for_each_possible
- Combined patch: linux-0001..0008-hashstruct.patch (8 defects, was missing 0004)
- outreach/linux.md: updated to 8 defects, corrected numbering (0001=headerdep,
0002=auditsc, 0003=dev, 0004=neighbour, 0005-0008 as before)
2026-04-04 11:33:15 -04:00
fdbb9a1aa9
redot: 12 CWE-407 defects, patches, outreach brief, UNDF-2026-000001231..1242
...
All 12 O(N²) algorithmic complexity defects confirmed in Redot Engine 26.2-alpha
(commit 360a8d3). Inherited verbatim from Godot Engine upstream. All patched.
Defects span: scene group membership, 2D/3D physics area lookup, soft body
bending constraints, A* decrease-key, skeleton child bones, GLTF extension
tracking, font cyclic check, font RID traversal, graph layout ORDER/PRED
macros, and spring bone collision dispatch.
Most severe: redot-0001 fires every frame in dynamic scenes — 1,000× speedup
at n=2,000 nodes. redot-0002/0003 fire 60Hz in physics-heavy games — 50×.
Strategy: patch Redot first, Godot follows our lead.
2026-04-03 21:00:29 -04:00
e52caba572
outreach: update scala.md with scala-0002 (intersectionIsEmpty 100x)
2026-03-29 22:12:55 -04:00
b680523c79
sync: UNDF stamps, unit classes, 146 outreach briefs, CLAUDE.md #1 priority MOAD-1
2026-03-29 15:56:35 -04:00
0ee2c5acaf
whitepaper: onos-0004 entry, count 615→616, rebuild PDF
2026-03-28 10:56:56 -04:00
a5f1dd1d77
godot-0005..0008 whitepaper entries + UNDF stamps; A* open_list.find O(N) 800x, skeleton child_bones 24x, RestFixer 188x, GLTF extensions 11x; count 611→615
2026-03-27 23:18:59 -04:00
47a312b0c7
libvirt-0001/0002 + xen-0001: cpu_x86 g_strv_contains O(F×A) + x86FeatureFind O(C×F) + credit2 balance_load O(V²); 21+11 PASS; count 608→611
2026-03-27 23:02:58 -04:00
87099aaaac
v8-0004 + jsc-0003: Maglev KnownMapsMerger O(P×R) std::find, IntegerRangeOpt liveAtHead O(50×B×R×L); 2+2 PASS; count 606→608
2026-03-27 23:00:07 -04:00
ae91f05bf3
curl-0002/0003 + libevent-0001: header lookup O(K×H), HSTS O(N²), route dispatch O(C); libuv CLEAN; count 603→606
2026-03-27 22:46:05 -04:00
212d313185
bazel-0003 + kicad-0002: build toolchain feature check + PCB zone filler O(Z²×L²); count 601→603
2026-03-27 22:38:32 -04:00
1d6a8b8ccd
redis-0004 + dragonfly-0001: ACL channel O(C×P) + cluster migration O(M²); memcached CLEAN; count 599→601
2026-03-27 22:34:04 -04:00
ff7bd27654
bird-0003/0004 + frrouting-0003/0004: BGP community set ops O(N×M)/O(N²); OpenBGPD CLEAN; count 595→599
2026-03-27 22:30:39 -04:00
3f8c5e6d3e
httpd-0003/0004 + varnish-0003: 3 new defects (12x/50x/25x); count 592→595
2026-03-27 22:26:26 -04:00
34e8d9212f
openssl-0004 + uwsgi-0001: 2 new defects (500x/249x); all 10 missing whitepaper entries restored; count 590→592
2026-03-27 22:20:52 -04:00
2e4f7807d5
whitepaper: re-add 10 missing entries + 11 new defects this session, count 578→590; rebuild PDF
2026-03-27 22:18:31 -04:00
e4ee168b1e
578/240 — rustc-0004/vertx-0001/asterisk-0003/bitcoin-0001/actix-web-0003/hazelcast-0001+0002/rabbitmq-0005/nginx-0003/haproxy-0003/envoy-0003/istio-0003
2026-03-27 21:25:37 -04:00
dde5ec97fb
wave17: 562/240 — vim/qemu/tcl/nodejs/bun/httpd-0002/systemd/emacs
2026-03-27 20:28:18 -04:00
cce7ec653a
wave17 complete: systemd/emacs/vim/qemu/tcl/kafka-0007/spark-0004 + 559/240
2026-03-27 20:15:47 -04:00
4221966e66
wave17: openssh-0001/2, strongswan-0001, gradle-0002, groovy-0001/2, make-0001, clojure-CLEAN + whitepaper 549/240
2026-03-27 19:55:52 -04:00
0f275c44af
whitepaper: add html-cwe407 and html-minecraft targets; update clean
2026-03-27 19:52:27 -04:00
d816d3c74c
wave16: dart-0001/2/3 + octave-0002 + php-0003/4 + cassandra-0005 + erlang-0003 + chef-0001 — 542/240
2026-03-27 19:36:35 -04:00
31850d5ef6
wave15: sm-0003/0004 + threejs-0006 + varnish-0002 + mongodb-0008 — 533/240
2026-03-27 19:22:37 -04:00
7146714143
wave15: v8-0002/0003 Intl+revectorizer (125x/25x) + bullet/box2d ticket files — 528/240
2026-03-27 19:16:28 -04:00
c4026333ba
wave14b: openbsd-0001/2 + 526/240 PDF
2026-03-27 18:14:55 -04:00
