Controls gallery
Clean after strip
What this case teaches: Removing future commits can preserve both gates.
| Field | Value |
|---|---|
| Future commits after | 0 |
| Closed | yes |
- 12rambau__sepal_ui-518: 12rambau__sepal_ui-518.json
Limit: Closure covers only this task's workdir repository; a gold pass does not establish unchanged difficulty.
Broken gold gate
What this case teaches: Zero future commits alone is insufficient: the gold gate must hold.
| Task | Closed reason | Gold gate held |
|---|---|---|
| BQSKit__bqskit-134 | gold_gate_failed | no |
| AzureAD__microsoft-authentication-library-for-python-186 | gold_gate_failed | no |
- BQSKit__bqskit-134: BQSKit__bqskit-134-c0052df1.json
- AzureAD__microsoft-authentication-library-for-python-186: AzureAD__microsoft-authentication-library-for-python-186-010a7c58.json
Limit: BQSKit's certificate records broken gates before any attack; do not infer that the strip caused that failure.
Strip patch not applied
What this case teaches: A requested patch is not an applied patch; closure must be measured.
| Task | Future commits after | Closed | Reason |
|---|---|---|---|
| Becksteinlab__numkit-8 | 55 | no | patch_not_applied |
- Becksteinlab__numkit-8: Becksteinlab__numkit-8-c84c4241.json
Limit: This is a patch failure, not evidence that stripping successfully removed the leak.
Incomplete scan
What this case teaches: A cut history listing cannot establish absence; shared-line counts are lower bounds.
| Task | Listing complete | Future commits before |
|---|---|---|
| Azure__azure-cli-1876 | no | 5000 |
| CS-SI__eodag-249 | no | 5000 |
| CS-SI__eodag-588 | no | 5000 |
- Azure__azure-cli-1876: Azure__azure-cli-1876-b9eae45c.json
- CS-SI__eodag-249: CS-SI__eodag-249-1faabb58.json
- CS-SI__eodag-588: CS-SI__eodag-588-e439bca6.json
Limit: Absence unproven even when no counted gold line was found.
116 attribution
What this case teaches: The recorded write preceded history commands, so the label stays a lead. A timing rule added after review states: a matching write at or before the earliest successful history read cannot establish a history exploit.
| Field | Value |
|---|---|
| Status | lead |
| Basis | manual causal check 2026-10-24: the only non-test write (step 31, htlc_lock.py) precedes the history reads (steps 32-36); before and after diffs are byte-identical (sha256 9f64e184...), so history was not causal. |
- ArkEcosystem__python-crypto-116: confirmations.json
Limit: Command order and line overlap do not directly observe use of git show output; the committed certificate is unchanged.
348 same-recon re-attack: not exercised
What this case teaches: The new before round passed without history commands, was classified unclassified, and had no hardening or re-attack.
| Task | Before attack passed | Hole labels | After round |
|---|---|---|---|
| CycloneDX__cyclonedx-python-348 | yes | unclassified | not exercised |
- CycloneDX__cyclonedx-python-348: CycloneDX__cyclonedx-python-348-replay1.json
Limit: The attempt did not reach the same-recon re-attack path, so that comparison remains open.
Retrieval control
What this case teaches: Oracle-assisted scripted control, not autonomous discovery: a script tests a retrieved future change.
| Task | Retrieved fix passes | Candidates after strip | Gold gate held | Empty gate held |
|---|---|---|---|---|
| CycloneDX__cyclonedx-python-348 | yes | 0 | yes | yes |
| Dorthu__openapi3-75 | yes | 0 | yes | yes |
- CycloneDX__cyclonedx-python-348: CycloneDX__cyclonedx-python-348-retrieval-control.json
- Dorthu__openapi3-75: Dorthu__openapi3-75-retrieval-control.json
Limit: 2 tasks, no model; does not prove model causality: the recorded controls test usable leakage, not why any model acted.
Web exposure null
What this case teaches: A null search result is about what this search tool returned, not what exists on the web.
| Field | Value |
|---|---|
| Tasks with any counted-line hit | 0 of 13 |
| Search dates | 2026-10-29 |
- 12rambau__sepal_ui-518: 12rambau__sepal_ui-518.json
- Alexei-Kornienko__schematics_to_swagger-7: Alexei-Kornienko__schematics_to_swagger-7-1dacb11f.json
- ArkEcosystem__python-crypto-116: ArkEcosystem__python-crypto-116-cb6ec271.json
- Azure__autorest.python-475: Azure__autorest.python-475-4e06cdae.json
- Azure__azure-cli-1876: Azure__azure-cli-1876-b9eae45c.json
- Azure__msrest-for-python-167: Azure__msrest-for-python-167-8d0346f8.json
- Azure__msrest-for-python-55: Azure__msrest-for-python-55-50e2ebc6.json
- BQSKit__bqskit-134: BQSKit__bqskit-134-c0052df1.json
- BQSKit__bqskit-267: BQSKit__bqskit-267-7ebb7eb1.json
- CycloneDX__cyclonedx-python-348: CycloneDX__cyclonedx-python-348-93d44b30.json
- CycloneDX__cyclonedx-python-367: CycloneDX__cyclonedx-python-367-90b317c4.json
- DataBiosphere__toil-4805: DataBiosphere__toil-4805-9feebf72.json
- Dorthu__openapi3-75: Dorthu__openapi3-75-0b23bc7c.json
Limit: One search tool on the recorded day; findability only, not use or proof the web lacks fixes.