Commits

Merge pull request #628 from jgravelle/security/code-scanning-triage

jgravelle

authored

cf4e96a

security: triage, the close tag admits what a browser admits, whitespace or junk attributes between `</script` and `>` (CodeQL named the attribute form on the PR after a fix that admitted whitespac…

jgravelle

and

claude

committed

e35385f

Merge remote-tracking branch 'origin/main' into security/code-scanning-triage

jgravelle

committed

6780b72

Merge pull request #627 from jgravelle/competitive/aider-pins-not-a-manifest

jgravelle

authored

72de867

Merge remote-tracking branch 'origin/main' into competitive/aider-pins-not-a-manifest

jgravelle

committed

ebc4821

Merge pull request #626 from jgravelle/ci/codeql-security-extended

jgravelle

authored

5570ca2

security: triage review round 2: C-16 counts what the alert file holds, seven fixed and eleven dismissed (two overly-permissive-file fixtures, not one)

jgravelle

and

claude

committed

f737b98

security: triage review round 1: the action scan matches the property (any spacing, any caller-controlled context); the leaderboard autoescape flag is asserted at its source on every gate leg and t…

jgravelle

and

claude

committed

9ad4b10

security: the code-scanning triage (C-16): a `</script >` ends the Razor and Astro block it closes; the process-lock file is 0o600; the munch-bench leaderboard escapes what it renders; the speedrev…

jgravelle

and

claude

committed

3e32d54

competitive: lockfile review round 1: the code_review_graph pin header names its real input and output; the `.in` claim is an expectation with its post-merge check; CF-64 records the misattribution…

jgravelle

and

claude

committed

d94eaca

competitive: the aider lockfile is aider.pins, not a requirements.txt: GitHub read a competitor's sandbox-only lockfile as one of our manifests and filed its whole dependency tree's advisories as…

jgravelle

and

claude

committed

08a4823

ci: C-11 review round 1: the status cell names the query, not a count

jgravelle

and

claude

committed

c392603

ci: CodeQL runs the security-extended query set; the quality queries are ruff's job and filled the security page with lint (C-11)

jgravelle

and

claude

committed

9ce7460

Merge pull request #623 from jgravelle/competitive/cf54-variant-rows

jgravelle

authored

abc5bc9

competitive: CF-54 review round 2: the FINDINGS headline reads as fixed, like its status column

jgravelle

and

claude

committed

a255b3e

competitive: CF-54 review round 1: ours() exempts jcodemunch's variants only (a competitor's variant is drafted like any other, tested); trend.movement skips our variant rows so none is labelled ou…

jgravelle

and

claude

committed

c2f2ee2

competitive: the `counter` surface as a labelled variant row of our own (jcodemunch_counter: the same adapter with one environment variable for the worker), and findings.py never drafts from our ow…

jgravelle

and

claude

committed

fb72eb2

competitive: CF-51 review round 1: an import-graph file already cited by a content line is not cited twice (the worker's own duplicate, disclosed in the note); DESIGN s1.4 names check_references fo…

jgravelle

and

claude

committed

c8126df

competitive: our P2 row asks check_references at its shipped defaults, not the import-graph tool (CF-51); the mapping argued in docs/competitive/fairness/jcodemunch.md; the product-doc half recorde…

jgravelle

and

claude

committed

4e56fd5

Navigation Menu

Commits on Sep 7, 2026

Merge pull request #628 from jgravelle/security/code-scanning-triage

security: triage, the close tag admits what a browser admits, whitespace or junk attributes between `</script` and `>` (CodeQL named the attribute form on the PR after a fix that admitted whitespac…

Merge remote-tracking branch 'origin/main' into security/code-scanning-triage

Merge pull request #627 from jgravelle/competitive/aider-pins-not-a-manifest

Merge remote-tracking branch 'origin/main' into competitive/aider-pins-not-a-manifest

Merge pull request #626 from jgravelle/ci/codeql-security-extended

security: triage review round 2: C-16 counts what the alert file holds, seven fixed and eleven dismissed (two overly-permissive-file fixtures, not one)

security: triage review round 1: the action scan matches the property (any spacing, any caller-controlled context); the leaderboard autoescape flag is asserted at its source on every gate leg and t…

security: the code-scanning triage (C-16): a `</script >` ends the Razor and Astro block it closes; the process-lock file is 0o600; the munch-bench leaderboard escapes what it renders; the speedrev…

competitive: lockfile review round 1: the code_review_graph pin header names its real input and output; the `.in` claim is an expectation with its post-merge check; CF-64 records the misattribution…

competitive: the aider lockfile is aider.pins, not a requirements.txt: GitHub read a competitor's sandbox-only lockfile as one of our manifests and filed its whole dependency tree's advisories as…

ci: C-11 review round 1: the status cell names the query, not a count

ci: CodeQL runs the security-extended query set; the quality queries are ruff's job and filled the security page with lint (C-11)

Merge pull request #623 from jgravelle/competitive/cf54-variant-rows

competitive: CF-54 review round 2: the FINDINGS headline reads as fixed, like its status column

competitive: CF-54 review round 1: ours() exempts jcodemunch's variants only (a competitor's variant is drafted like any other, tested); trend.movement skips our variant rows so none is labelled ou…

competitive: the `counter` surface as a labelled variant row of our own (jcodemunch_counter: the same adapter with one environment variable for the worker), and findings.py never drafts from our ow…

competitive: CF-51 review round 1: an import-graph file already cited by a content line is not cited twice (the worker's own duplicate, disclosed in the note); DESIGN s1.4 names check_references fo…

competitive: our P2 row asks check_references at its shipped defaults, not the import-graph tool (CF-51); the mapping argued in docs/competitive/fairness/jcodemunch.md; the product-doc half recorde…

Commits on Sep 6, 2026

workflows: W-39 review round 1: the trigger is every file a Floor's Method reads (FLOOR_INPUTS: CLAUDE.md and the frozen benchmark artifacts), a ratchet reads harness/main.py's path literals an…

workflows: a commit that stages CLAUDE.md runs the fast tier, because its size is a Floor (W-39: a docs-only PR reached the reviewer with a stamp two commits stale while the one Floor it moved went…

competitive: Phase 5 review round 1: RUNBOOK section 10 names the ledger path the workflow writes, where the runner name lives, what the kill switch stops mid-run, how approval is guaranteed, the g…

competitive: Phase 5, the instructions: CLAUDE.md gains the Competitive section, RUNBOOK section 10 is what a human does (the second variable, the four labels, the first dispatched run, approving a…

competitive: Phase 4 review round 1: VERIFICATION.md s2 says which adapters carry a fairness note and cites the test files that exist; DESIGN s10 names the note file, not a field (CF-62); the recor…

competitive: Phase 4, docs/competitive/VERIFICATION.md: each Phase 4 line mapped to its test or flag with the recorded run's rows behind it, and the skeptical-competitor review per axis; CF-61 (two…

competitive: FINDINGS CF-60, the no-ref `--findings-row` renders UNKNOWN provenance as a mismatch (PR 3e review round 2 note; follow-up)

competitive: PR 3e review round 1: compare_ref.py prints each side's scorer sha256 and interpreter and says when they differ; `--findings-row` renders the FINDINGS row (CF-59 regenerated); counts i…

competitive: `/competitive-compare [tool] [ref]`, the tier's interactive form, with compare_ref.py writing the side-by-side page so the command types no number (Phase 3 item 7; CF-59)

competitive: PR 3d review round 1: POLICY 4.4 names the labels the post job applies; the run's roster is adapter.REGISTRY (`--adapters all`); ledger_merge.py keeps the dated heading; the feed re-ru…

inbound: the prompt files re-rendered after POLICY section 7 gained the competitive rows (the policy sha they embed moved)

competitive: the scheduled jobs (item 6): competitive-run, competitive-feed and competitive-post workflows in the inbound shape, the release feed and the post script, budget rows, POLICY section 7 …

competitive: PR 3c review round 2: the end-to-end test asserts the header's code_files (the field findings.py reads, spelled outside its consumer's fixture)

competitive: PR 3c review round 1: index_missing_files reads what the producer writes (axes.files_indexed against the header's new code_files); the never-posts guard walks the AST; green.txt names …

competitive: findings to issue drafts (item 5): gap, watch and standard-proposal drafts in a scratch directory, de-duplicated by fingerprint, nothing posted (CF-56)

competitive: PR 3b review notes: the D4 assertion reads the produced summary and history line, not the fixture; W-37 (the checklist's base ref on a stacked branch)

Branch selector

User selector

Datepicker

Commit history

Commits on Sep 7, 2026

Commits on Sep 6, 2026