Repository navigation
hub: vuln-fix-commits live (graded G7 4/5, curated rebuild 328,891 records) - #1266
Merged
Merged
Conversation
… job) Acceptance of PR #1255 (merged as fc8f86d), the first external-contributor pack (chunxiaoxx / Nautilus, demand anchored to #1138, wishlist slot #1210): - recipe builds clean from the committed tree: 70 envelopes -> 70 records, 16 shards, single source nautilus-ops (CC-BY-4.0), recipe sha256 344fef9a.. matches the emitted manifest - README claims verified against the source JSONL: 70 lines / 147,368 bytes, topic counts eval-judging 46 / infra-diagnosis 13 / ledger-audit 6 / ops-misc 5 — all exact - pack-stats.json records the measured build (220,857 records bytes) - ed25519 keypair generated; .pub committed, seed set as the PACK_SIGNING_SEED_AST Actions secret, .key deleted locally - pack-publish.yml grows the agent-session-trajectories job: same chain of custody as rust-vulns (build -> sign -> consumer-path verify against the committed .pub -> dated immutable release) NOTE: scheduled workflows fire from the default branch only, so the same files land on main in a mirroring PR; the backlog slot flip (planned -> live) follows only after the first published release verifies from its public URL.
…lot live) validate_hub.py enforces recipe-exists <=> status live, so the #1255 merge left corpus-hub red (run 37817938270: 'recipe exists but backlog status is planned'). Flip the slot the way the rust-vulns pack row is shaped: sources[0] points at the recipe file, refresh daily (the pack-publish cron this branch wires), note carries the demand provenance (#1138) and the measured acceptance (70 envelopes -> 70 records, topic counts exact). Backlog now 104 live. Local validate_hub.py: OK (102 manifests, 3 recipes, 141 rows).
…cords) The curated rebuild completed against :19295 with the #1259 batched finalize-verify (all 97 terms-filter windows verified; the memory breaker during the index phase drained after a background merge reclaimed ~5GB and the payload materialization completed). Blind-graded against the pre-registered suite (backlog/ g7-vuln-fix-commits-2026-10-08.json, authoring committed before any retrieval in #1249): 4 of 5 needles in top-5 — three at rank 1, one at rank 3 — pass at the >=4 bar (same shape as the cisa pass). The one miss is the 2020-era sleuthkit yaffsfs_istat needle, unranked: it lost to newer buffer-overflow payloads on generic terms (buffer/string/ small); the four 2026-era needles with distinctive function or verdict prose all ranked. Median 4.0. Graded evidence committed as backlog/g7-vuln-fix-commits-2026-10-08-graded.json. - hub/vuln-fix-commits.json: the reviewed manifest (Apache-2.0, adapt-with-attribution; quarantine + corpus.json exclusion list recorded in the review block) - backlog: candidate -> live, note carries the measured numb 8000 ers - validate_hub.py: 103 manifests, 3 recipes, 141 rows, 105 live
thomas-villani
pushed a commit
to thomas-villani/xerj
that referenced
this pull request
Oct 9, 2026
Window since v1.0.0-rc.92: xerj-org#1259 (batched finalize-verify, the xerj-org#1183 count lane), xerj-org#1262 (closes xerj-org#1260: columnar exists + delete-aware fast-agg admission, 3.4s -> 2.7ms warm on the live crawl node, plus the test-race serialization caught by CI run 37816544794), xerj-org#1263 (chunxiaoxx CLA signature), xerj-org#1265 (agent-session-trajectories pack wiring on main), xerj-org#1268 (pack publish tag-burn fix, cited ahead of its merge). Corpus-hub side in prose: xerj-org#1255/xerj-org#1264 (recipe, stats, key, workflow, backlog flip) and xerj-org#1266 (vuln-fix-commits live, G7 blind-graded 4/5, 328,891 records). ROADMAP roll, shortlist live-verified at cut: twelve open — the ten carried from rc.92 (xerj-org#1094 xerj-org#1100 xerj-org#1122 xerj-org#1170 xerj-org#1173 xerj-org#1108 xerj-org#1110 xerj-org#1183 xerj-org#1212 xerj-org#1226) plus xerj-org#1250 and xerj-org#1267 (filed this window: the finalize read-back walk + doc-lane verify residual). Two corrections recorded: xerj-org#1254 was auto-closed by the rc.92 window's own xerj-org#1258 merge at 655ea93, 42 minutes BEFORE the rc.92 tag — the rc.92 roll's 'stays open' note predates the close, so it is de-linked from the shortlist and recorded in the closed list; xerj-org#1183's count lane is no longer 'the remaining half' (xerj-org#1259 + xerj-org#1262 landed it, first live proof the vuln-fix-commits rebuild completing 97 batched windows). Version 1.0.0-rc.92 -> rc.93 (workspace + lockfile via cargo update --workspace --offline), landing data-latest-tag stamped, sitemap regenerated (byte-identical, no new pages). release-notes-gate.sh PASSes locally: 13 shortlist issues open-checked, xerj-org#1260 closed-cited, window PRs all cited.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes the vuln-fix-commits leg of the cyber-exploits group (#99, #1244 round 2).
The curated rebuild finished (328,891 searchable records; #1259 batched finalize-verify passed all 97 windows). Blind-graded against the pre-registered suite from #1249: 4/5 needles in top-5, median 4.0, verdict pass (≥4 bar, same as the cisa pass). Three needles at rank 1, one at rank 3; the miss is the 2020-era sleuthkit needle, unranked, losing on generic buffer-overflow terms — noted honestly in the graded file.
backlog/g7-vuln-fix-commits-2026-10-08-graded.jsoncandidate → live; local validate_hub.py: 103 manifests, 105 live rows#1244 stays open pending the cve-records G7 re-run (its crawler is still in finalize-catalog on :19285).