v0.7.0 freeze-prep: re-pin Semgrep CE 1.176.0, Joern 4.0.617, OpenTaint analyzer/2026.09.03 and re-run all 33 slices - #150
Merged
Conversation
…yzer/2026.09.03.9752bd2 The three remaining gapped rows of the 2026-09-03 survey, each bumped because no hold reason was on record. Every declaration moves; the pin-currency review entry records the bases, holds the vendored Semgrep rules snapshot, and records the OpenTaint CLI switch as owed: the hidden `--entry-points` flag (seqra/opentaint#395) is on main but not in any released CLI. Retained-evidence descriptions keep naming the build they were measured on. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… pins All thirty-three populations at the unchanged fixture revision: Joern 4.0.617, Semgrep CE 1.176.0, OpenTaint analyzer/2026.09.03.9752bd2 (jar db3a6163…, models 8746b959…). No outcome moves. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…elopment scope Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…elopment scope Bound to main's tip, the revision this branch's squash commit will have as its parent, so the recorded revision survives the merge (docs/freeze.md); the manifest digests bind the regenerated evidence. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
DavidBakerEffendi
added a commit
that referenced
this pull request
Sep 4, 2026
#150 re-pinned Semgrep CE to 1.176.0, Joern to 4.0.617 and the OpenTaint analyzer to analyzer/2026.09.03.9752bd2, and re-ran all 33 slices. The pin strings it edited in `src/main.rs` now live in five modules, so each is re-applied where it belongs: `pinned_identity` in `src/adapters/mod.rs`, the two release-asset digests and the release tag in `src/adapters/opentaint.rs`, the Scala coverage note in `src/adapters/bifrost.rs`, and the partition and amendment rows in `src/modeling.rs` and `src/native.rs` — including the four `semgrep-ce--11760---oss-only` anchor slugs that moved with the version. `cargo test` runs the same 222 tests by the same names as `origin/main`, `cargo clippy --all-targets` reports the same warnings, and `validate`, `validate-reports` and `generate-results --check` all pass. Refs #130 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follows #146 (rebased onto it after its merge). Takes the three remaining bump-or-hold decisions of the v0.7.0 freeze-prep against the 2026-09-03 survey: Semgrep CE 1.175.0 → 1.176.0, Joern 4.0.614 → 4.0.617, OpenTaint
analyzer/2026.08.27.17eb0fe→analyzer/2026.09.03.9752bd2, each re-run across every slice at the unchanged fixture revision. With #146 every gapped pin in the survey is current.Refs #138 (closed by #146); refs #144.
Commits, in freeze-prep order
docs/adapters.mdrecords the witnessed bases (Semgrep--version; Joern console banner from the SHA-512-verifiedv4.0.617macOS distribution; OpenTaint jardb3a6163…and models8746b959…, matching the release API's digests and re-witnessed by the runner before every case). The vendored Semgrep rules snapshot is held per policy. The Semgrep modeling-matrix anchor moves with the heading in the rule comment and the three native provenance files, as the v0.6.0 review did.mainwas merged in and the manifest recut bound tomain's tip (9dba9a72), the commit this PR's squash commit will have as its parent — the shape Re-bind the development freeze to a surviving revision, and refuse to freeze one the squash merge discards #149 requires so the recorded revision survives the merge. The digests bind the regenerated evidence;validate-freezeandgenerate-results --checkpass on the branch.results/—generate-results --checkpasses; no staleness caveat anywhere.OpenTaint: still driven through the jar, CLI switch recorded as owed
The hidden
--entry-pointsflag onopentaint scanmerged in seqra/opentaint#395 on 2026-09-03 (closing #390), but it has not shipped: the CLI's latest release is v0.4.5 (2026-07-10) and the datedanalyzer/*releases carry only the jar and models. A CLI built frommainwould have no release identity to witness, so the invocation is unchanged here and the review entry dates the switch as owed on the first CLI release that includes #395.Outcome deltas
None. All 33 populations reproduce every committed outcome:
Kernel configuration hashes are all byte-identical to the superseded reports (the #141 guard confirming no query/rule/semantics file moved); the seven native hashes move with the witnessed identity by construction, plus the Semgrep JavaScript modeling hash and native provenance files via the anchor edit. The only textual change in retained evidence is in the tool-native decline rationales: the re-run embeds today's partition constants, so Joern's category-S cells now carry the A26 scan-bundle grounds and Semgrep's Java/JavaScript cells the A27-confirmed wording, where the v0.6.0-era reports carried the earlier text — the amendment convention's re-witness-never-patch rule.
Machine cleanup (per request)
Removed the superseded Joern 4.0.610/4.0.614 distributions, the 4.0.432 system install under
/opt/joernand its/usr/local/bin/joernsymlink, the 2026-08-27 OpenTaint assets, a stale pyre-check 0.9.25 venv, and the redundant Infer archive.scripts/probe-joern-scan-native.shkeeps namingjoern-v4.0.614as the distribution A26 probed; that is a record, not a live path.Verification
cargo fmt --check·cargo test(217 passed) ·cargo run -- validate(852 cases) ·cargo run -- validate-reports(82 reports, 66 hashes checked, 0 known-stale) ·validate-freeze reports/freeze.json·generate-results … --check(current).🤖 Generated with Claude Code