87503f60ef
bench backfill: 20 benches close custom/sibling/empty buckets
...
Closes the three tractable pending buckets (all non-no_dir work):
+ lean4-0004..0007: 4 correctness/race benches (ir_interp DCL, jobreg
IO.Ref race, g_opts thread-local leakage, process envvar hash).
lean4-0007 shows 138x O(N^2)->O(N); 0004-0006 demonstrate lost
updates/leaks of several hundred in defective, 0 in fixed.
+ 0ad-0001..0004: 3 CWE-407 list.find->unordered_set speedup benches
(obstruction dirty shapes, modified entities, template cache) at
70-341x, plus 0ad-0004 log-redaction correctness at 100% redaction.
+ activemq-0001..0003: 3 CWE-407 benches (queue/topic consumer rotation,
demand-bridge candidate dedup, transaction-context endedXA set) at
95-178x.
+ linux-0001..0008: 8 Python complexity-class models for the kernel
patches. Coexist with the existing build-and-bench.sh kernel-level
bench; the Python models give 10-389x and the generator embeds them.
+ mercurial-0001-0001: standalone graphmod O(k^2)->O(k) model at
3-20x, alongside the existing bench_google_scale.py (which imports
the real mercurial graphmod).
Progress: 13 -> 33 full coverage. Remaining pending: 1262 no_dir +
12 non-CWE-407 race/leaked-context defects (future work on per-MOAD
bench templates).
2026-04-23 11:48:03 -04:00
d67ec93a5d
test-frameworks wave 3: vitest + testng + jasmine + libcheck (4 patches)
...
vitest-0001: coverage-v8 coverage.result.find inside merged.result.forEach
-> Map<url, result> lookup. Bench: 824x at N=M=10000 coverage entries.
testng-0001: DynamicGraph.toDot freeNodes.contains inside two for-each
loops -> Map<T, String> color lookup via getOrDefault. Bench: 64x at N=2000.
jasmine-0001: SpyRegistry.spyOnAllFunctions propertiesToSkip.indexOf inside
Array.filter + .concat growth across D prototype levels -> Set.has + O(1)
growth. Bench: 61x at D=10, P=300.
check-0001: libcheck suite_tcase linear strcmp scan over tclst List
-> parallel hashtable for O(1) lookup amortized. Bench: 117x at N=1000.
Shipped as design sketch; full integration requires companion hashtable.
Also ships whitepaper/outreach/test-harness-survey.md documenting 14
clean-scan frameworks across Clojure, OCaml, Haskell, Erlang, Go, F#,
Julia, Shell, Lua, JS. Scope covered 61 targets across 30+ languages.
UNDF IDs: 1292 (check), 1293 (jasmine), 1294 (testng), 1295 (vitest).
All 12 tests pass.
2026-04-23 08:54:44 -04:00
b79fddfb51
browser-automation wave 2: testcafe-0001 + webdriverio-0002
...
testcafe-0001: Selector filterNodes (string-filter branch) and
expandSelectorResults both dedup via Array.indexOf on growing result
arrays. filterNodes: O(N*M) per selector filter. expandSelectorResults:
O(N^2 * K^2) worst case when derivatives unique. Fix: Set<Node> keyed
by object identity. Bench: 398x at N=2000 filter, 1966x at N=K=150
expand.
webdriverio-0002: MSPO aggregator dedups per-test entries via Array.find
on growing bucket array. O(N^2) per test bucket, same pattern repeats
in unknown-suite merger. Fix: companion Map<bucketKey, Set<selector>>
for O(1) dedup. Bench: 493x at N=2000.
UNDF IDs: 1290 (testcafe), 1291 (webdriverio-0002). All 17 tests pass.
2026-04-22 18:31:53 -04:00
9a0253e724
browser-automation: 4 CWE-407 patches (selenium x2, playwright, webdriverio)
...
selenium-0001: SessionCapabilitiesMutator list.contains O(NxM) -> LinkedHashSet
O(N+M). Grid Node session mutation hot path. Bench: 192x at N=M=1000.
selenium-0002: ChromiumOptions merge helpers consolidate four list.contains
loops behind addArgumentsUnique/addEncodedExtensionsUnique. Bench: 254x
at N=M=1000.
playwright-0001: roleUtils validRoles / allowsNameFromContent Array.includes
on 20-70 element constant arrays per element. Converted to Set<string>
at module load. Bench: 11x at N=10000 elements.
webdriverio-0001: xpath-conditions extractOrConditions orMatches.find +
values.includes per regex match -> Map<attr, Set<values>>. Bench: 6x at
K=V=60 in the 'mobileSelectorPerformanceOptimizer'.
Each defect ships: ticket, patch with complexity-gate header, Python
benchmark + correctness test, Makefile, outreach brief. All 16 tests
pass. UNDF IDs: 1276 (playwright), 1277 (selenium-0001), 1288
(selenium-0002), 1289 (webdriverio).
2026-04-22 18:14:39 -04:00
134f052457
test: add SQLite planet-scale multi-app projection
...
1B SQLite devices × 1 UPDATE/sec × 1% wide-trigger hot path:
k=100: 2,097 core-years/year saved (14x)
k=420: 7,773 core-years/year saved (13x)
k=4096: 91,480 core-years/year saved (12x)
Per-op speedup at k=10,000 sensor tables: 117x (210ms -> 1.8ms).
Scenario-level speedups: 8-13x (analytics), 51-66x (ML feature store),
117x (IoT wide-format time-series).
2026-04-16 18:19:30 -04:00
15e9a133b0
test: add SQLite CWE-407 benchmark (sqlite-0001 + sqlite-0003)
...
sqlite-0001 (checkColumnOverlap): 49x speedup at 200-col trigger, 50-col SET
sqlite-0003 (FK column resolution): 52x speedup at 500-col parent, 50-col FK
Scaling ratio 3.2x and 5.2x at 5x growth (linear, not quadratic).
2026-04-16 16:57:05 -04:00
b878442549
test: add Elasticsearch stacked + scale benchmarks
...
test_elasticsearch_scale.py: single-patch scaling (10K to 1M docs, k=20/100/500)
test_elasticsearch_stacked.py: all 3 patches combined with multi-node projections
Results: 42-node, 1B docs, k=500 SIEM: 940 days -> 18 days (53x, 922 days saved)
2026-04-16 11:17:18 -04:00
5d171bcba5
test: add elasticsearch-0002/0003 benchmarks (16 total tests)
...
es-0002 XContentHelper: 37× speedup at k=500, k-scaling 4.6× (limit 7×)
es-0003 SnapshotsService: S-scaling 4.8× (limit 7×)
2026-04-15 19:03:00 -04:00
77206edfa8
test: add Elasticsearch CWE-407 benchmark (7 tests)
...
IngestDocument.appendValues(): 41× speedup at k=500, N=500.
k-scaling ratio 1.4× (O(k), not O(k²) which would be 25×).
2026-04-15 18:07:55 -04:00
652608142a
feat: close outreach doc gap — 276 docs (batches 11-16)
...
All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.
Outreach gap: 276 -> 0.
2026-04-15 13:57:42 -04:00
aeb084c9ae
feat: add 30 outreach docs (batches 9-10)
...
Batch 9 (15): bun, bzflag (3), cake_wallet (4), calligra, caprice32 (2),
cataclysm (3), cemu
Batch 10 (15): cemu-0002, citra, clickhouse-java, cmake (3), cocos2d (3),
conduit, cura (2), curaengine, clamav, contiki
2026-04-14 19:51:36 -04:00
1bd5895929
registry: assign UNDF-2026-000001275 through 000001287 (13 CWE-1333 defects)
2026-04-14 19:48:37 -04:00
6784cdf1cf
feat: add 39 outreach docs (batches 6-8)
...
Batch 6 (9): dolibarr, jitsi-videobridge, zed, tryton, suricata,
strawberry, zulip, zesarux, zephyr
Batch 7 (15): xonotic (4), xash3d (3), xenia, xtuple, zabbix (2),
zathura, zebra, yabause, zephyr-0001
Batch 8 (15): woodpecker (2), wine (4), widelands (3), wesnoth (3),
wekan (3)
Mix of CWE-407 and CWE-312.
2026-04-14 17:06:28 -04:00
9a78d1afbe
feat: add 15 outreach docs (15 defects) for 1-patch projects
...
0ad (4), aranym, ardour, argo-cd, aria2, azahar, bcoin, bind9,
btcpayserver (3), bullet3. Mix of CWE-407 and CWE-312.
2026-04-14 14:33:17 -04:00
4f1965397a
feat: add 10 outreach docs (20 defects) for 2-patch batch 2
...
firefox, go-ethereum, imagemagick, influxdb, micronaut-core, openbsd,
proton, proxysql, sqlite, vim. All CWE-407.
2026-04-14 14:09:18 -04:00
589aa340d7
test: add MongoDB CWE-1333 benchmark (20 tests, 2 defects)
...
mongo-0001: 11 tests — split-validate approach, N=5000 tags <1s
mongo-0002: 9 tests — horizontal whitespace fix, N=5000 lines <1s
2026-04-14 14:04:42 -04:00
8a3868d583
test: add Cassandra/Hadoop CWE-1333 benchmarks (26 tests)
...
cassandra: 16 tests — PEMReader cert/key possessive fix, LogFile
adjacent .* unambiguous split. All under 1s on N=10000 pathological.
hadoop: 10 tests — RPC star-of-star fix. Under 2s on pathological input.
2026-04-14 13:51:11 -04:00
7e7ec2c3d3
feat: add 10 outreach docs (20 defects) for 2-patch projects
...
amarok, arrow, audacity, cargo, clementine, composer, dask,
deluge, dosbox-x, dragonfly. All CWE-407.
2026-04-14 13:50:33 -04:00
cd2ca798a3
test: add meson CWE-1333 benchmark (27 tests, 4 defects)
...
Covers meson-0003 through meson-0006:
- Functional correctness: fixed regex matches original on representative inputs
- Adversarial performance gates per finding
- meson-0004 exponential-proof: original >50ms at n=20, fixed <1ms
2026-04-13 17:36:52 -04:00
283a490d6d
feat: add 5 outreach docs (15 defects) for batch 4
...
distlib (3, Python), redmine (3, Ruby), grape (3, Ruby),
solc (3, Solidity/C++), grpc-java (3, Java).
2026-04-13 16:55:04 -04:00
7c87dc590a
test: add ktor CWE-1333 benchmark (cookie parser + OAuth2 response)
...
Verifies fixed regex eliminates backtracking:
- ktor-0001: adversarial cookie header <1ms (was: seconds)
- ktor-0002: adversarial OAuth body <0.01ms via character scan
2026-04-13 16:54:08 -04:00
d1f82fd8e3
feat: add 8 outreach docs (26 defects) for batch 3
...
rpcs3 (4, C++), ppsspp (4, C++), spring-framework (3, Java),
nats-server (3, Go), minio (3, Go), gimp (3, C), cockroach (3, Go),
superset (3, Python). Note: rpcs3-0004 is CWE-312, rest are CWE-407.
2026-04-13 15:35:53 -04:00
ee04b13f01
feat: add 8 outreach docs (36 defects) for batch 2
...
gitlab-foss (5, Ruby), darktable (5, C), suitecrm (6, PHP),
inkscape (4, C++), calibre (4, Python), scribus (4, C++),
vscode (4, TypeScript), digikam (4, C++).
Note: darktable-0004 and digikam-0004 are CWE-312 (cleartext credential
logging), not CWE-407.
2026-04-13 14:46:34 -04:00
c24246e2e2
feat: add 5 outreach docs (33 defects) + mastodon CWE-1333 benchmark
...
Outreach docs (unblock intel page generation):
- kdenlive: 10 defects (8 CWE-407 + 1 CWE-362 + 1 keyframe), C++
- libreoffice: 5 defects (Writer, Calc, SFX, Impress), C++
- maven: 7 defects (graph, lifecycle, sort-by-indexOf), Java
- cpython: 7 defects (pkgutil, codegen, mock, pmerge MRO, pydoc), C/Python
- blender: 4 defects (node runtime, USD skel, shader, anim), C++
Mastodon CWE-1333 benchmark:
- test_mastodon_cwe1333.rb: validates (.+\.)? -> ([^@]+\.)? fix
eliminates O(2^N) backtracking in email validator
2026-04-13 14:03:16 -04:00
fd8ae3ba8b
test: add CWE-1333/407/362 benchmarks for bleach, salt, ansible, capistrano, puppet, katago, pachi
...
Every patch now ships with a runnable benchmark verifying complexity claims:
- bleach/unit/test_bleach_cwe1333.py: length guard truncates 1001-char adversarial
input to 1000 chars (removes '@' tail), gauntlet matches fast (<0.5s)
- salt/unit/test_salt_cwe1333.py: ThreadPoolExecutor timeout wrapper tested at N=20
adversarial, GIL behavior documented
- ansible/unit/test_ansible_cwe1333.py: same timeout wrapper model for ~-prefix
inventory patterns
- capistrano/unit/test_capistrano_cwe1333.rb: Regexp.timeout= / Timeout fallback
guard for host/role filter patterns
- puppet/unit/test_puppet_cwe1333.rb: RegexGuard.safe_compile timeout for all
three Puppet regex call sites (match(), =~, PRegexpType)
- katago/unit/test_katago_cwe407.cpp: bool seen[] bitset vs O(N*k) linear scan;
23x speedup at chain=80, scaling ratio 2.5x at 3x chain size (limit 4x)
- pachi/unit/test_pachi_cwe362.c: 8-thread hammer, 100k iterations, zero
double-expansion events with __atomic_store_n fix
2026-04-13 12:46:35 -04:00
a44f1d8656
feat: add KataGo CWE-407 + Pachi CWE-362 patch files
...
katago-0001-findliberties-bitset.patch (UNDF-2026-000000226)
CWE-407: O(N*k) liberty dup scan → O(N) bool seen[] bitset
Peak speedup: 25× on scattered chains
pachi-0001-atomic-is-expanded.patch (UNDF-2026-000001274)
CWE-362: is_expanded flag set before atom fully populated → races
2026-04-13 12:25:30 -04:00
2e70c9ba26
feat: add RE2 patch UNDF IDs (1270-1273), fix puppet-0001 UNDF ref
...
salt-0005: UNDF-2026-000001270 (RE2 correct fix)
ansible-0005: UNDF-2026-000001271 (RE2 correct fix)
capistrano-0002: UNDF-2026-000001272 (RE2 correct fix)
puppet-0002: UNDF-2026-000001273 (RE2 correct fix)
puppet-0001 patch header: corrected UNDF ref from placeholder 226 to 1269
Total: 1272 entries
2026-04-13 12:00:31 -04:00
c9314c264b
test: add lean4 test suite — 88 tests across 7 patches (CWE-407 + CWE-362)
...
Unit, integration, and functional complexity gates for lean4-0001..0007.
All 88 tests pass. Complexity gates enforce measured speedups:
lean4-0001: N=2000 fixed <20ms (vs 38ms defective, 34x)
lean4-0002: K=N=1000 fixed <5ms (vs 14ms defective, 678x)
lean4-0003: N=1000 fixed <5ms (vs 20ms defective, 210x)
lean4-0005/0006: concurrent correctness (zero lost jobs/leaked context)
lean4-0007: N=M=500 fixed <1ms (vs O(N*M) defective)
2026-04-13 11:03:16 -04:00
9134c083c3
feat: update lean4 outreach doc with confirmed benchmark speedups
...
Replace "up to 1000x" with measured results: 34x/678x/210x.
Status: patch-ready on unlean4 branch, 7 patches complete.
2026-04-13 10:30:36 -04:00
ae6e04c5bd
feat: add lean4-0004 through lean4-0007 patches
...
lean4-0004: collapse 3-phase lock in ir_interpreter lookup_symbol to single unique_lock
lean4-0005: replace IO.Ref JobQueue with Std.Mutex in Lake job registry
lean4-0006: register thread-local reset for g_opts in kernel/trace.cpp
lean4-0007: build unordered_set of override keys outside env-var loop (Windows)
2026-04-13 10:24:23 -04:00
98c6e28978
bench: lean4-0001/0002/0003 benchmarks — 34x/678x/210x speedups confirmed
2026-04-13 10:22:05 -04:00
c63e93b9bb
patches: lean4-0001 — refine Cycle.lean patch, standalone MonadCallStackFast, low-priority fallback instance
2026-04-13 10:03:58 -04:00
77ab58c2db
patches: lean4-0001..0003 — MOAD-0001 Cycle.lean HashSet fix + kernel inductive + util.cpp
2026-04-13 10:03:29 -04:00
f74250d8a3
feat: add UNDF-2026-000001266 (salt-0004) and UNDF-2026-000001267 (ansible-0004) CWE-1333
...
Salt pcre/grain_pcre targeting passes user-controlled regex to re.match/re.compile
without timeout. Ansible inventory manager passes tilde-prefixed host patterns
directly to re.compile. Both fixed with ThreadPoolExecutor 1s timeout wrapper.
2026-04-13 09:56:20 -04:00
7f280e8187
registry: assign UNDF IDs 1259-1265 for lean4-0001..0007
2026-04-13 09:30:06 -04:00
5451e1748b
outreach: add lean4 disclosure brief — 7 defects, MOAD references
2026-04-13 09:27:50 -04:00
f6ac255a41
scan-todo: add lean4 wave 35, add Priority 4c formal methods section
2026-04-13 09:08:56 -04:00
67012b350c
scan: lean4 — 7 defect tickets (4x MOAD-0001, 2x MOAD-0005, 1x MOAD-0003)
2026-04-13 08:34:02 -04:00
89f094d242
docs: document scanner improvement loop in CLAUDE.md
2026-04-12 17:43:44 -04:00
0ac47a5b75
feat: add scan_verify.py + check_coverage.py for all 1258 UNDF indicators
...
scan_verify.py: structural patch verification for all UNDF registry entries.
- Reads UNDF-REGISTRY.json, walks defects/*/patch/*.patch
- Checks: UNDF header comment, defective pattern in removed lines,
fix signature in added lines (HashSet/unordered_set/HashMap/etc.)
- Slug-to-patch filtering prevents cross-contamination in multi-entry dirs
- Additive patches (guard insertion) treated as WARN not FAIL
- Status: 454 PASS / 441 WARN / 12 FAIL / 300 NO_PATCH / 51 PENDING
- 74.2% structural coverage of clonable entries
check_coverage.py: CI gate — fails when new registry entries lack patch files.
- Any NO_PATCH entry (dir exists but no patch) causes exit code 1
- Designed to run on every commit to catch regressions early
- Quality (WARN/PASS) delegated to scan_verify.py
Makefile targets added:
make scan-verify — verbose structural verification (all 1258 entries)
make scan-verify-report — same + writes tests/SCAN-VERIFY-REPORT.md
make scan-verify-strict -- also fail on WARN
make coverage-check — CI gate for patch presence
Completes the three-tier coverage system:
unit/integration/functional Java tests (MOADs 0001-0011)
+ structural patch verification (1258+ UNDF indicators)
+ coverage CI gate (enforces no indicator left without a patch)
2026-04-12 16:15:01 -04:00
4888153e40
feat: add unit, integration, and functional test coverage for all 9 MOADs
...
Each MOAD now has a synthetic defective specimen and fixed specimen
proven from first principles across three test tiers:
Unit (tests/unit/Moad000X*.java):
- Correctness: defective and fixed produce identical functional output
- Defect behavior: defective specimen exhibits the defect (measurable)
- Fix behavior: fixed specimen eliminates the defect
Integration (tests/integration/AllMoadsIntegrationTest.java):
- All 9 MOADs proven at medium scale (N=500-2000)
- MOAD-0001: O(N^2) vs O(N) list scan at N=1000
- MOAD-0002: 500 sessions trample each other (defective) vs coexist (fixed)
- MOAD-0003: 250 anonymous requests leak auth identity (defective) vs zero (fixed)
- MOAD-0004: 3000 credential exposures across 1000 requests (defective) vs zero (fixed)
- MOAD-0005: 500 computes for 500 concurrent misses vs exactly 1
- MOAD-0006: all 500 passwords extractable from DB (defective) vs unextractable (fixed)
- MOAD-0007: N=2000 spatial objects, defective visits all 2000 vs O(log N + k)
- MOAD-0009: 990 wasted firings for 1000 ticks / 10 events vs zero waste
- MOAD-0011: 10240 NFA steps vs 13 steps on N=12 adversarial input (788x)
Functional (tests/functional/AllMoadsFunctionalTest.java):
- MOAD-0005: real-thread contention proves herd (defective >1 compute, fixed exactly 1)
- MOAD-0007: N=50000 spatial objects, 50M defective probes vs 516K fixed (97x speedup)
- MOAD-0009: 10000 ticks / 10 events, 9990 wasted firings vs zero (1000x ratio)
- MOAD-0011: N=16 adversarial, 163840 defective steps vs 17 fixed (9638x ratio)
Support algorithms (tests/support/Moad000X*.java):
- Moad0002Algorithm: shared mutable global state (DefectiveAudioSystem / FixedAudioSystem + Context)
- Moad0003Algorithm: ThreadLocal not cleared (handleDefective / handleFixed with finally)
- Moad0004Algorithm: HTTP headers logged verbatim (logDefective / logFixed with CREDENTIAL_HEADERS denylist)
- Moad0005Algorithm: get+null+compute+put (DefectiveCache HashMap / FixedCache ConcurrentHashMap.computeIfAbsent)
- Moad0006Algorithm: Base64 password storage (DefectiveCredentialStore / FixedCredentialStore SHA-256+salt)
- Moad0007Algorithm: linear spatial scan (queryDefective list / queryFixed sorted array + binary search)
- Moad0009Algorithm: timer-driven polling (runDefectiveScheduler / runFixedEventDriven)
- Moad0011Algorithm: PCRE nested quantifiers (matchDefective backtracking NFA / matchFixed linear NFA)
Makefile: added unit-moad-0002 through unit-moad-0011 targets,
integration-all-moads, functional-all-moads. integration and functional
targets now depend on all-MOADs variants.
2026-04-12 15:43:19 -04:00
1f88aa0374
chore: update blast-radius docs, remove merged linux tickets, patch update
2026-04-10 12:47:28 -04:00
bace89cebc
fix: remove 'The' from fixed system harmony sentence
2026-04-10 12:40:37 -04:00
5b06ab06c9
fix: source Truth & Light attribution to timehexon.com/theology
2026-04-10 12:33:52 -04:00
0bafd694ac
redot-0005: replace partial patch with full indexed heap implementation
2026-04-07 19:58:20 -04:00
716ef7cb2d
undf: register UNDF-1250..1258 (DragonFly BSD + NetBSD CWE-407)
2026-04-05 19:46:54 -04:00
6050e1b741
hurd: all 5 defects patched, hurd-0004 closed as clean scan, add hurd-0005 patch
2026-04-05 15:57:48 -04:00
80a81910cf
hurd: refresh patches — fix IDVEC_INIT, clean commit split
2026-04-04 20:31:23 -04:00
360b7abb54
hurd: add patches for hurd-0001/0006 (auth) and hurd-0002/0003 (notify htable)
2026-04-04 20:29:35 -04:00
e94a4b17b3
hurd: 6 CWE-407 defects confirmed — auth, libports, proc, idvec
2026-04-04 16:19:59 -04:00
