DataFlowBench v0.6.1

DataFlowBench v0.6.1

A patch release, and a narrow one on purpose. It exists because a Bifrost fix
cycle closed against findings this benchmark published, so it re-pins Bifrost
from v0.10.7 to v0.10.8 and re-runs that analyzer's twenty slices. Nothing
else in the field moved: the fixture revision is unchanged, the other sixty-two
reports carry over byte-identical, and every other analyzer's numbers are
identical to v0.6.0's.

Three things in it are worth a reader's time, and only one of them is good
news. The fix cycle lands: four false positives corrected and eight declined
assertions newly decided. A regression comes with it, published rather than
held for. And a disagreement this project blamed on the engine for three
releases turns out to have been a bug in our own adapter.

Freeze identity

• Freeze ID (manifest SHA-256):
  65638eafb36478120d268290479815114f244baa57994c47e19fac6b759e50ae
• Manifest: reports/freeze.json
• Benchmark revision: a8cde57 (tag v0.6.1)
• Fixture revision:
  sha256:9df209ed3d7723a3ee33f2b289cf2afe34a3add781bdf2a2ac445de42b8d0151
• Case schema v2, normalized result schema v1
• 852 frozen cases, 82 bound reports, 3480 scored case results
• Score tiers: calibration, core, language-extension, modeling
• Model profiles: benchmark-controlled, tool-native
• Claim exclusions: none

The fixture revision is unchanged from v0.6.0 — and from v0.5.0 before it.
The benchmark did not grow in this release, and no case was edited: this is the
same exam, re-sat by one candidate.

What re-ran

Of the 82 bound reports, 20 were re-executed — every Bifrost slice: the
thirteen kernels, the three modeling reports, the three tool-native reports,
and the breadth smoke population. The remaining 62 are byte-identical to
the reports already in the tree, re-bound and re-digested into the new manifest
without being re-run. Of those 62, 54 were bound by v0.6.0 itself and 8 are the
modeling and tool-native rows produced by the amendment work that landed after
v0.6.0 was published (below).

The re-run was taken in a single settle-gated quiet window: twenty cold slices
between 03:07:00 and 03:09:35 local time on 2 September 2026, on the
Mac16,1 / 10-core arm64 machine whose stamp is retained at
reports/raw/bifrost/run-environment.json. The window's load gate (1.8–2.0) is
recorded in the run's commit record rather than in a raw artifact — the Bifrost
correctness slices retain a per-case phase-timing sidecar and a per-run
environment stamp, but no load sample. That is stated here rather than implied,
because this release note is not entitled to a number the evidence does not
carry.

The second pin-currency review (#92)

The full table is in docs/adapters.md.
In summary:

Analyzer	Pin at v0.6.0	Outcome
Bifrost	0.10.7	Bumped to 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249
Joern	4.0.614	Held, with a dated reason: upstream daily 4.0.615 is one day newer, and the release's delta is deliberately scoped to the Bifrost fix cycle
CodeQL CLI	2.26.4	Evaluated — current
Semgrep CE	1.175.0	Evaluated — current
OpenTaint	analyzer/2026.08.27.17eb0fe	Evaluated — current (digest-pinned)
Infer	v1.3.0	Evaluated — current (digest-pinned)
FlowDroid	2.15.1	Evaluated — current (digest-pinned)
Pysa	pyre-check 0.10.0 + Pyrefly 1.2.0	Evaluated — current (digest-pinned)

The Joern hold is the one to read twice. Holding a pin one day behind upstream
is a choice, and it is recorded as a choice with its reason and its date, so
that the next review inherits an obligation rather than a silence. A pin held
without a stated reason is indistinguishable from a pin nobody looked at.

The Bifrost v0.10.8 fix cycle

Everything in this section is one analyzer column. Read it that way.

• Four false positives are fixed. The path-feasibility and loop-kill
  negatives filed as BrokkAi/bifrost-dev#2731 —
  dfb-taint-csharp-infeasible-branch-negative,
  dfb-taint-csharp-loop-carried-negative,
  dfb-taint-go-loop-carried-negative, and
  dfb-taint-ruby-infeasible-branch-negative — all now read not-reached.
  Those four were published against Bifrost in v0.5.0 and again in v0.6.0.
• Bifrost now has no decisive mistake anywhere in this freeze. Not one
  false positive and not one false negative, across all 3480 case results, on
  every tier and under both model profiles. No other analyzer in the freeze can
  say that, and the reason Bifrost can is not free — see the inconclusive count
  below.
• Eight assertions are newly decided, and decided correctly. The
  element-object pairs in java, javascript, and typescript, and Rust's
  recursive-carry pair, move from inconclusive to a correct decision. These
  bite into the declined families tracked as bifrost-dev#2839, which is
  narrowed rather than closed: the remaining declines in those families are
  still declines.
• Decisive-correct on the thirteen kernels: 435 → 446. Bifrost now produces
  446 decisive outcomes on the 738-assertion core population, of which all
  446 are correct (v0.6.0: 440 decisive, 435 correct). Language by language:
  csharp 32 → 34, java 37 → 40, javascript 36 → 38, ruby 21 → 22, rust 36 → 38,
  typescript 34 → 36, and go 35 → 34. C, C++, Kotlin, PHP, Python, and
  Scala are unchanged.
• Core inconclusive: 298 → 292, and still concentrated where it was:
  Ruby 36 of 58, Kotlin 30, PHP and C++ 26 each, C# and Go 24 each; lightest is
  C at 8 of 48. Declines, not misses — but on a page where seven other
  analyzers decide these same cases definitively, that column's shape is the
  price of the zero-mistake row above, and both belong in the same sentence.
• Smoke: 117 of 118, unchanged. The single non-decision remains the
  dfb-taint-java-modeled-external calibration case, which takes unsupported
  and is not scored.

Honest negatives

A regression, taken rather than held for

Go's array-element pair — dfb-taint-go-array-element-positive and
dfb-taint-go-array-element-negative — was decided correctly under v0.10.7
and is inconclusive under v0.10.8. The retained raw evidence carries the
reason verbatim:

taint discovery is incomplete: procedure value-flow snapshot for
array_element_positive.go:array_element_positive.go.run is unsupported
(index_memory)

It is filed upstream as BrokkAi/bifrost-dev#2831.

The pin was taken with this loss visible. Holding v0.10.7 to keep one pair
decided would have suppressed a net improvement — four false positives fixed
and eight cells newly decided — and would have hidden the regression instead of
publishing it. It is the only cell in this release that moved backwards, it is
on the vendor's own engine, and it is on the templates page, the evidence page,
and here.

The java-direct disagreement was ours, not the engine's

This is the part of the release that is a correction to DataFlowBench.

For three releases — v0.4.0, v0.5.0, v0.6.0 — this project published an
unreconciled disagreement: dfb-taint-java-direct-positive was reached (true
positive) in reports/bifrost-smoke.json and not-reached (false negative) in
reports/bifrost-java-kernel.json, at the same build and the same fixture
revision. Each release described it as an observed instability of the engine,
retained both artifacts, and declined to re-run either to agreement.
bifrost-dev#2832 was filed upstream against the engine.

It was not an engine defect. The Java kernel adapter was force-selecting
core-java-kernel.rqlp in place of each selected case's own validated declared
policy. That kernel policy's dfb_source/dfb_sink selectors bind zero
endpoints in this legacy fixture, so the kernel run asked a question the
fixture could not answer and correctly reported not-reached. The smoke run,
which used the case's declared direct-positive.rqlp, was right the whole
time. The adapter now uses each case's declared policy while keeping the
configuration hash over every policy invoked; the fix is PR #118, with a
smoke/kernel policy-parity regression test beside it. bifrost-dev#2832 is
being closed as benchmark-side.

Under this freeze both populations reach it. Java's kernel goes 37/58 to 40/58,
and the classic-32 partition inside it goes 31/32 to 32/32, matching the
smoke population case for case.

Two things follow, and neither is comfortable. First: a benchmark published by
the vendor of one of the engines it measures spent three releases attributing
its own bug to that engine's competitor-facing column — which is to say, the
error ran against Bifrost, not for it, and it still should not have run. The
direction of a mistake is not what makes it acceptable. Second: the reason it
survived three releases is that the disagreement was documented rather than
investigated. Publishing an anomaly honestly is not the same as chasing it
down, and the freeze contract's refusal to re-run evidence to agreement — which
is the right rule — is not a reason to leave the discrepancy unexplained. The
policy-parity regression test added in #118 is what should have existed in
v0.4.0.

The v0.6.0 snapshot pages and release note are not rewritten. They stay as
published, bound to their own evidence commit, with an archived banner pointing
here. That is what an immutable snapshot means, and it is also what makes this
correction legible: both versions of the story remain readable side by side.

Everything else, unchanged

• The other seven analyzers. CodeQL, Joern, Semgrep CE, OpenTaint, Infer,
  FlowDroid, and Pysa report exactly the numbers v0.6.0 published, from exactly
  the same report bytes. On the kernels: CodeQL 506 decisive-correct, Joern
  270, Semgrep CE 132, OpenTaint 99, Infer 140, FlowDroid 98, Pysa 47.
• **The modeling and tool-n...

DataFlowBench v0.6.0

DataFlowBench v0.6.0

Sixth immutable release snapshot, and three things at once: the release in
which the benchmark doubles its analyzer count from four to eight — adding
OpenTaint, Infer v1.3.0, FlowDroid 2.15.1, and Pysa — the first
pin-currency review (#92), in which three reference tools are bumped and
nothing moves, and the first publication of the latency-characterization
tier. All eight analyzers are bound at one fixture revision under the
freeze/v1 contract with claim scope release.

Freeze identity

• Freeze ID (manifest SHA-256):
  3228af686d09f8666989368483bef375bb28b94025b55e31eaa7a0bdd29506ee
• Manifest: reports/freeze.json
• Benchmark revision: 8b70fd3 (tag v0.6.0)
• Fixture revision:
  sha256:9df209ed3d7723a3ee33f2b289cf2afe34a3add781bdf2a2ac445de42b8d0151
• Case schema v2, normalized result schema v1
• 852 frozen cases, 74 bound reports, 3336 scored case results
• Score tiers: calibration, core, language-extension, modeling
• Model profiles: benchmark-controlled, tool-native
• Claim exclusions: none

The fixture revision is unchanged from v0.5.0. The benchmark did not grow
in this release; its analyzer coverage did.

The eight analyzers

Analyzer	Version	Status this cycle
Bifrost	0.10.7	Held. v0.10.8 is dated but unreleased — see the pin-currency review below
CodeQL	2.26.4	Bumped from 2.26.3
Joern	4.0.614	Bumped from 4.0.610
Semgrep CE	1.175.0	Bumped from 1.174.0
OpenTaint	analyzer/2026.08.27.17eb0fe	New (#96), Java and Kotlin, amended by A11
Infer	v1.3.0	New (#97), C, C++, and Java
FlowDroid	2.15.1	New (#99), Java and Kotlin
Pysa	0.10.0 (pyre-check) with Pyrefly 1.2.0	New (#100), Python

Every row's build identity is witnessed from the binary actually invoked and
digest-recorded in the manifest, including on the runs that decide nothing.

The four new adapters enter whole expanded cores. None of them fences a
partition: their pinned distributions declare interprocedural taint analysis
and document nothing this benchmark exercises as out of scope, so every
incapacity they show below is a measured mismatch, not a declared decline.
That is a harsher setting than Semgrep CE's, whose bounded intraprocedural
partition is preregistered, and the two must not be read against each other on
a raw n/58.

Their language footprints also change what some kernels can be read as. Infer
joins Bifrost, CodeQL, and Semgrep CE on the c and cpp cores — the third
analyzer there to enter the whole core rather than a declared partition, and
the first that is neither this project's own engine nor CodeQL. Pysa makes
python a five-analyzer kernel. Java goes from four analyzers to seven.

Results

Generated pages live in results/ and derive exclusively from the frozen
manifest; see results/index.md. Incomplete outcomes (inconclusive,
unsupported, runner-error) are capability and execution coverage and are
never counted as clean negatives.

The kernels

Correct decisions (true positives plus true negatives) on each kernel's core
tier, with incomplete outcomes shown beside them. Each language is its own
population with its own denominator, and each analyzer column is read
independently: DataFlowBench publishes no combined leaderboard, and cores of
different sizes are never pooled. n/a means the analyzer has no report for
that kernel in this freeze — no extractor, no frontend, or no adapter — which
is coverage, not a score.

Kernel core	Bifrost 0.10.7	CodeQL 2.26.4	Joern 4.0.614	Semgrep CE 1.175.0	OpenTaint	Infer v1.3.0	FlowDroid 2.15.1	Pysa 0.10.0
Java (29 templates, 58 assertions)	37/58 (20 inc)	48/58	47/58	12/58 (44 uns)	49/58	50/58	49/58	n/a
JavaScript (29 templates, 58 assertions)	36/58 (22 inc)	48/58	44/58	12/58 (44 uns)	n/a	n/a	n/a	n/a
TypeScript (29 templates, 58 assertions)	34/58 (24 inc)	48/58	n/a	12/58 (44 uns)	n/a	n/a	n/a	n/a
Python (29 templates, 58 assertions)	36/58 (22 inc)	48/58	48/58	12/58 (44 uns)	n/a	n/a	n/a	47/58
Kotlin (29 templates, 58 assertions)	28/58 (30 inc)	46/58	n/a	12/58 (44 uns)	50/58	n/a	49/58	n/a
Scala (29 templates, 58 assertions)	38/58 (20 inc)	n/a	n/a	n/a	n/a	n/a	n/a	n/a
C# (29 templates, 58 assertions)	32/58 (24 inc)	47/58	n/a	n/a	n/a	n/a	n/a	n/a
Go (29 templates, 58 assertions)	35/58 (22 inc)	45/58	n/a	12/58 (44 uns)	n/a	n/a	n/a	n/a
PHP (29 templates, 58 assertions)	32/58 (26 inc)	n/a	48/58	12/58 (44 uns)	n/a	n/a	n/a	n/a
Ruby (29 templates, 58 assertions)	21/58 (36 inc)	49/58	40/58	12/58 (44 uns)	n/a	n/a	n/a	n/a
C++ (28 templates, 56 assertions)	30/56 (26 inc)	42/56	n/a	12/56 (42 uns)	n/a	47/56	n/a	n/a
C (24 templates, 48 assertions)	40/48 (8 inc)	41/48	n/a	12/48 (34 uns)	n/a	43/48	n/a	n/a
Rust (27 templates, 54 assertions)	36/54 (18 inc)	44/54	43/54	12/54 (40 uns)	n/a	n/a	n/a	n/a

The saturation the preregistration set out to end is still gone. No analyzer
answers a whole expanded core correctly in any of the thirteen languages,
and no column above reaches its own denominator — including the four new ones,
whose best rows are Infer's 50/58 on Java and OpenTaint's 50/58 on Kotlin,
tied, and both eight short.

The challenge templates stay individually visible as a stratum. The same
populations, restricted to the challenge templates only:

Kernel core	Bifrost 0.10.7	CodeQL 2.26.4	Joern 4.0.614	Semgrep CE 1.175.0	OpenTaint	Infer v1.3.0	FlowDroid 2.15.1	Pysa 0.10.0
Java (13 templates, 26 assertions)	6/26 (20 inc)	21/26	19/26	0/26 (26 uns)	20/26	20/26	19/26	n/a
JavaScript (13 templates, 26 assertions)	4/26 (22 inc)	19/26	18/26	0/26 (26 uns)	n/a	n/a	n/a	n/a
TypeScript (13 templates, 26 assertions)	4/26 (22 inc)	19/26	n/a	0/26 (26 uns)	n/a	n/a	n/a	n/a
Python (13 templates, 26 assertions)	4/26 (22 inc)	20/26	20/26	0/26 (26 uns)	n/a	n/a	n/a	18/26
Kotlin (13 templates, 26 assertions)	6/26 (20 inc)	19/26	n/a	0/26 (26 uns)	21/26	n/a	19/26	n/a
Scala (13 templates, 26 assertions)	6/26 (20 inc)	n/a	n/a	n/a	n/a	n/a	n/a	n/a
C# (13 templates, 26 assertions)	4/26 (22 inc)	20/26	n/a	n/a	n/a	n/a	n/a	n/a
Go (13 templates, 26 assertions)	6/26 (20 inc)	19/26	n/a	0/26 (26 uns)	n/a	n/a	n/a	n/a
PHP (13 templates, 26 assertions)	6/26 (20 inc)	n/a	20/26	0/26 (26 uns)	n/a	n/a	n/a	n/a
Ruby (13 templates, 26 assertions)	4/26 (22 inc)	20/26	14/26	0/26 (26 uns)	n/a	n/a	n/a	n/a
C++ (12 templates, 24 assertions)	0/24 (24 inc)	14/24	n/a	0/24 (24 uns)	n/a	18/24	n/a	n/a
C (9 templates, 18 assertions)	10/18 (8 inc)	14/18	n/a	0/18 (18 uns)	n/a	15/18	n/a	n/a
Rust (12 templates, 24 assertions)	6/24 (18 inc)	16/24	16/24	0/24 (24 uns)	n/a	n/a	n/a	n/a

The four new analyzers, and their misses

Published as-is. Each of the four decides every assertion in its cores
definitively — zero inconclusive, zero unsupported, zero runner-error
across all eight of their kernel reports — so every mismatch below is a
measurement of the template's semantic dimension.

OpenTaint (Java, Kotlin) — and the A11 amendment

• Java 49/58, Kotlin 50/58. Java: 25 true positives, 24 true negatives,
  five false positives, four false negatives. Kotlin: 27 / 23 / six / two.
• The superseded row, restated rather than removed. The first OpenTaint
  runs read Java 29/58 with 0 reached — every one of the 29 positives
  missed — and Kotlin 38/58 with 17 reached. Those numbers were
  published in the adapter notes and both kernel contracts as a property of
  the pinned engine: a value-kind boundary dropping taint on numeric values,
  isolated by a retained probe.
• Upstream said that framing was wrong, and it was. Reported as
  seqra/opentaint#388, the
  maintainers identified the boundary as a default rule configuration —
  primitive tracking is off unless a rule opts in with
  options: primitive-tracking: true, which the shipped ruleset itself does.
  The claim was verified on the digest-identical jar by a second retained
  probe: with the option absent the original result reproduces exactly, with
  it enabled all four value kinds carry, and the probe's added clean and
  overwrite negatives stay clean.
• Amendment A11 enables the option in both committed kernel templates.
  That changes the templates' configuration_hash, which invalidated both
  retained reports, and both populations were re-run in full. Java's 29
  positives stop being 29 repetitions of one configuration artifact and become
  29 measurements. The old row is superseded, not hidden: it stands in
  docs/adapters.md's A11 entry, in docs/java-kernel.md, and in
  docs/kotlin-kernel.md, with the probe evidence for both the default and
  the amended configuration retained.
• What A11 does not do. It moves no case between partitions — the whole
  58-assertion core was scored before and after — and it invalidates no
  published freeze, because neither OpenTaint report had ever been frozen.
• Where it still misses. Java's four false negatives are exception-catch,
  chal-callback-registration, chal-map-iteration, and
  chal-reflective-invocation; its five false positives are the
  dynamic-heap-location family (array-element-separation,
  chal-computed-property, chal-dispatch-table, chal-element-object) plu...

DataFlowBench v0.5.0

DataFlowBench v0.5.0

Fifth immutable release snapshot. It is two things at once: the Bifrost
v0.10.7 fix cycle, in which every runner error in the previous freeze is
gone and Bifrost's decisive-correct count on the thirteen kernels roughly
doubles, and the first release to publish the modeling tier (#15) and the
tool-native tier (#16) alongside the benchmark-controlled kernels. Four
analyzers — Bifrost v0.10.7, CodeQL 2.26.3, Joern 4.0.610, and Semgrep CE
1.174.0 — are bound at one fixture revision under the freeze/v1 contract
with claim scope release.

Freeze identity

• Freeze ID (manifest SHA-256):
  43a34341ca3f818f55878bb23562da03b8fc4b1fc0c83f47b954eb22ec3f41e4
• Manifest: reports/freeze.json
• Benchmark revision: 7d688c6 (tag v0.5.0)
• Fixture revision:
  sha256:9df209ed3d7723a3ee33f2b289cf2afe34a3add781bdf2a2ac445de42b8d0151
• Case schema v2, normalized result schema v1
• 852 frozen cases, 66 bound reports, 2884 scored case results
• Score tiers: calibration, core, language-extension, modeling
• Model profiles: benchmark-controlled, tool-native

Three populations, never pooled

This release publishes results under two model profiles and four score tiers.
They are separate populations and the separation is structural, not
presentational:

• Benchmark-controlled kernels (core, calibration,
  language-extension): the thirteen expanded kernels of v0.4.0, unchanged in
  population. Each analyzer is configured by DataFlowBench to the benchmark's
  own source/sink contract.
• Benchmark-controlled modeling (modeling tier, 12 templates in six
  balanced categories × three languages × four adapters): the same profile,
  measuring whether a tool's model declaration surface is load-bearing. A
  tool that cannot express a category takes unsupported for it, decided
  before the tool is invoked.
• Tool-native (tool-native profile, 6 templates × three languages × four
  adapters): what each tool ships and decides on its own, with no
  DataFlowBench-supplied model.

benchmark-controlled and tool-native are never pooled and never compared
number-to-number, on any page. A modeling row and a native row that both say
"6 templates" are not the same six templates and not the same question.

Bound evidence

Normalized report	SHA-256	Analyzer	Cases
reports/bifrost-c-kernel.json	db4a8415f86f75c680aa52cd8e91896c70d67b6b88bab2a07f85fa0ef198a75d	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57	50
reports/bifrost-cpp-kernel.json	1398c72370cd7c3d9c39fabde6c3c7230af6a376fd7c3f3571041062082abb82	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57	56
reports/bifrost-csharp-kernel.json	2fe19dbf7e5a61baeb15b9d33a2c861639f9d836dd867cce609c8d68917ceb94	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57	58
reports/bifrost-go-kernel.json	919e62b265d16b69a8288c39d5be0eff12ab7d878df3d42e116895403c4f7382	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57	58
reports/bifrost-java-kernel.json	ff99ba2ee4f486ba6da1046e779581513b0a726bd0c038c9b95552c555530915	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57	58
reports/bifrost-java-modeling.json	2e6e38e4cfd5436598081866e27bbaf98c01da8c50090a513b8f53d71b483eed	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57	24
reports/bifrost-java-native.json	5add3826fa45f30c92ff890e52c246843ec157761525309a34d71af24692df41	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57 — bifrost 0.10.7 built-in policy packs	12
reports/bifrost-javascript-kernel.json	58675cdd313b41add0294691d34bbafcf8c9872d60a28ddef71f44ab519b9b62	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57	58
reports/bifrost-javascript-modeling.json	751d5ae5412e87dd984de6ee687c3e8a8d3e98374de203eeceacc9987269fbfc	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57	24
reports/bifrost-javascript-native.json	0a2ca366a08c571fa1d769e4f974ede005e19be2d1e4512f6bd9552aeaa3ec77	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57 — bifrost 0.10.7 built-in policy packs	12
reports/bifrost-kotlin-kernel.json	db5e0633a1313a18cb248961a7a6ae5ea2bba2e31bd0a00c17b66601337705c1	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57	58
reports/bifrost-php-kernel.json	ad17e035ecfabb508bf9dc9f92776cf4c6593c115cc8712380fc76c743d08d1b	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57	58
reports/bifrost-python-kernel.json	d0c713ed0b7f7bf24adb432443336562b53c57d9be995c26f77e9c2ae14f2419	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57	58
reports/bifrost-python-modeling.json	ce470da597805006288114cd36de500bfdeeccc03a19f9569e230beb0eea840d	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57	24
reports/bifrost-python-native.json	ae24e34efe49f7307d571e9b3c42de1d5f829fb6d965cfe455ead4010bbaba56	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57 — bifrost 0.10.7 built-in policy packs	12
reports/bifrost-ruby-kernel.json	afab27546ffb827a0244a05d6bfeb882cadf2eae26fd74f6c75051687ddcff97	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57	58
reports/bifrost-rust-kernel.json	340d6104d3ecdfba2de9429cfdfc4380bbcb30e708180644dacef588b060ca02	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57	56
reports/bifrost-scala-kernel.json	67fe1b3d9a7cfa1cd6dbed6596527f60bb25e4c1d3c467274ea57e0d5ced5bdc	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57	58
reports/bifrost-smoke.json	c78ed974f229ada333b621a9a325ebeca7f6aa774000482205b218e26190529c	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57	118
reports/bifrost-typescript-kernel.json	c4bca856809db333de1f81f8e1c5522e26a8e7577ea129c410f8abc2b1a9ed61	Bifrost 0.10.7, build 44d9a5be416432bf8ed414afd3ea0031245ebb57	58
reports/codeql-c-kernel.json	9ed3846bd073c4078f81a8702fe6d71010d9dc2a6dadf4338765daf804fb5651	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	50
reports/codeql-cpp-kernel.json	4053f81a192b22db1c7e013af9b96e728aad6c4863ec44952f1fe02bd2d9303e	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	56
reports/codeql-csharp-kernel.json	69c0f67040a59a172858f2e29c29a8653ed0348fee81f8c11e554a4e59a0a359	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	58
reports/codeql-go-kernel.json	715946c2e0183a20b60cf09fac97d48855e95d0eac2aaa392edf911b94d91afc	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	58
reports/codeql-java-kernel.json	f13a11290939e21db527db660bf76408ec73315a3f2f1f7a9d84fd53b82c19f3	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	58
reports/codeql-java-modeling.json	c76aac2e4bf8ab05c0fa9068903c5eafb4b7407bf991031fac5e05662f992cbd	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	24
reports/codeql-java-native.json	16e2ca2ea4e7dcef4e5f4f444a33767e44c78e2ffa051e1749f3de9222037459	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7 — 2.26.3 shipped suite codeql/java-queries@1.11.9:codeql-suites/java-security-extended.qls	12
reports/codeql-javascript-kernel.json	48c18bb0c559dea6311dc34af5138e6bd0dce824581977790fc14fce5a38793f	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	58
reports/codeql-javascript-modeling.json	a3e6f90dd6f068b723ebcd6e9e73c3300452eb1d9ccbf76d617f82af1c5f5525	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	24
reports/codeql-javascript-native.json	a9889691d7da7837e6edbc23b894492fe237a5dcd62d4bdd73b5b598eb4a2d9e	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7 — 2.26.3 shipped suite codeql/javascript-queries@2.4.4:codeql-suites/javascript-security-extended.qls	12
reports/codeql-kotlin-kernel.json	170d5b9c7b8cd843a9deaafe291e510e483eaddb237967c2c96fb50ff42f6617	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	58
reports/codeql-python-kernel.json	20291cc4a6a50824ca72f42f664bd580e0aff0fff769cf7c63efb8a889037717	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	58
reports/codeql-python-modeling.json	b9a3c13de153d28604d97fac51366f811a3a98dab740395a6eb0efca6811a9e2	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	24
reports/codeql-python-native.json	21a2e4136756bb640d0f68ba6850d8315230df3f7a6622d538d858f83116ece3	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7 — 2.26.3 shipped suite codeql/python-queries@1.8.9:codeql-suites/python-security-extended.qls	12
reports/codeql-ruby-kernel.json	7aab3f0f9fe51869c73f21073b7c7c4a202c5a8e5a2e1b7c42a5059407fcf282	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	58
reports/codeql-rust-kernel.json	02625bfd21b8609cb7800e4a55e43f57c33718b2dd8b3c07e8415404224b9066	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	56
reports/codeql-typescript-kernel.json	f702e16cc3cf3cc0e08eb038e70dda3d2e0898b66a97873d8517df704e79f5dc	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	58
reports/joern-java-kernel.json	e9b98b262970b7cfa547e270b61357f5d04f6f04879a0575c39801d1eb857370	Joern 4.0.610, build joern-cli:4.0.610	58
reports/joern-java-modeling.json	062de7777d607da2225e5dfc0c76bfd71ed2c5d265a290f2d4d0a5be5b89ed1e	Joern 4.0.610, build joern-cli:4.0.610	24
`reports/joern-ja...

DataFlowBench v0.4.0

DataFlowBench v0.4.0

Fourth immutable release snapshot, and the first expanded-breadth release:
all thirteen core kernels now carry the preregistered challenge-tier templates
of the challenge-tier document, and four analyzers —
Bifrost v0.10.6, CodeQL 2.26.3, Joern 4.0.610, and Semgrep CE 1.174.0 — are
bound at one fixture revision under the freeze/v1 contract with claim scope
release.

Freeze identity

• Freeze ID (manifest SHA-256):
  91b0008a546e6b782c1b790f174a71ce44e60039239797674eb49ebc6ac6c366
• Manifest: reports/freeze.json
• Benchmark revision: 306211a (tag v0.4.0)
• Fixture revision:
  sha256:13a11ff48f26dba889f76aeb9ef60213a129abe5ebcfcb966da3a2418c12807e
• Case schema v2, normalized result schema v1
• 744 frozen cases, 42 bound reports, 2452 scored case results

What "expanded breadth" means here

The thirteen challenge templates were preregistered before any challenge
fixture existed, and the preregistration fixed the population decision in
advance: they carry score_tier: "core" and fold into each language's core
kernel, with no new score tier. Each language's core denominator is therefore
its sixteen-template core (fifteen for C and Rust) plus its applicable
challenge templates: 29 templates / 58 assertions for ten languages, 28 / 56
for C++, 27 / 54 for Rust, and 24 / 48 for C.

The canonical construction of dfb-template-chal-context-pair-depth2 follows
Amendment A1 (2026-08-25) of the preregistration: helper returns its
argument and the caller sinks the result of the selected two-deep path. The
amendment was recorded before any analyzer ran against either implementing
fixture and invalidates no published freeze.

The v0.3.0 sixteen-template core and this expanded core are different
populations of the same name. No number in this document is compared with a
v0.3.0-era number, and the frozen v0.3.0 evidence remains valid and unamended.

Bound evidence

Normalized report	SHA-256	Analyzer	Cases
reports/bifrost-c-kernel.json	e334de9b8752daf1b0ed67bc8403232449c10805c4817be3975b2ca62643ba03	Bifrost 0.10.6, build 18d09c57d1e5044dec49acac7635d3255ea8e89c	50
reports/bifrost-cpp-kernel.json	12353998cacf0bf7c3e74574961d0eaec9204da633a6cdf87d2c36526bd71e27	Bifrost 0.10.6, build 18d09c57d1e5044dec49acac7635d3255ea8e89c	56
reports/bifrost-csharp-kernel.json	a004277d218cf4793afed987394c0d6285ecd190622e23558368f2ba0ec2eeb2	Bifrost 0.10.6, build 18d09c57d1e5044dec49acac7635d3255ea8e89c	58
reports/bifrost-go-kernel.json	a3597db4e3ccdb2489b720eca08173100cb3220ee5db31743bf0d7a64708c46d	Bifrost 0.10.6, build 18d09c57d1e5044dec49acac7635d3255ea8e89c	58
reports/bifrost-java-kernel.json	d8ad10a3cdca6d0be1e207dcbdf2b276dd46caeeb2f98d43352f003082113b0d	Bifrost 0.10.6, build 18d09c57d1e5044dec49acac7635d3255ea8e89c	58
reports/bifrost-javascript-kernel.json	9a4f3c8c5a319dff7e5d5dd5f159329c2580997d742ae8f75c86176a99a1096f	Bifrost 0.10.6, build 18d09c57d1e5044dec49acac7635d3255ea8e89c	58
reports/bifrost-kotlin-kernel.json	dad5d772414d41644b3d8892fd3495f86974054b90a8c678d4e63364b17678f0	Bifrost 0.10.6, build 18d09c57d1e5044dec49acac7635d3255ea8e89c	58
reports/bifrost-php-kernel.json	5881b8e17f332d344f1539b79d6f1833abc1dde245302fd9ebdacb84cc14169a	Bifrost 0.10.6, build 18d09c57d1e5044dec49acac7635d3255ea8e89c	58
reports/bifrost-python-kernel.json	87f9a195df465554734796412867f5b32721200ee74863fc9d1ff3b13d6ca3fe	Bifrost 0.10.6, build 18d09c57d1e5044dec49acac7635d3255ea8e89c	58
reports/bifrost-ruby-kernel.json	7af673389c1146294684f2154fb8ec13c39a587a21e8b381d46119f51eb49aa1	Bifrost 0.10.6, build 18d09c57d1e5044dec49acac7635d3255ea8e89c	58
reports/bifrost-rust-kernel.json	2ad1e552b00c7c6370b26d948e2e5e850f38adeff27a87b6b1f72aefa15f4119	Bifrost 0.10.6, build 18d09c57d1e5044dec49acac7635d3255ea8e89c	56
reports/bifrost-scala-kernel.json	11c7c6462f6d7cae9d9042540014294d66909c9566d02d68c7cc2513ab5298dc	Bifrost 0.10.6, build 18d09c57d1e5044dec49acac7635d3255ea8e89c	58
reports/bifrost-smoke.json	bfbd71c8ea921f71eacae6983ac45361edb0264be0ef4ded17cb17449dc880f9	Bifrost 0.10.6, build 18d09c57d1e5044dec49acac7635d3255ea8e89c	118
reports/bifrost-typescript-kernel.json	6d1ec2fce985b22def1de1d32ae49049ea5be0fb6b52a8ae024adbdac9110e1c	Bifrost 0.10.6, build 18d09c57d1e5044dec49acac7635d3255ea8e89c	58
reports/codeql-c-kernel.json	0b6c59ac6e4435e049a45972d297d665b55eba07fefae98535930a01543b7f0c	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	50
reports/codeql-cpp-kernel.json	6e772fe6740133ee4a0b20a9683d145b832f3ede088c535936ecdaf2f6a802ff	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	56
reports/codeql-csharp-kernel.json	3436137a9aa293bbf0efb62e263a90b4c16e47ede83cb45602cf7c229fb31fed	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	58
reports/codeql-go-kernel.json	7812a935ee53a26fab3a7f3b1d74c169e5ae98a4c3d1e0c6b02a09496612aa93	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	58
reports/codeql-java-kernel.json	bad0469701d0f3c45825cc4ee8d0448bdbec40e9006cf78935112e09e77e08db	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	58
reports/codeql-javascript-kernel.json	98d8064493ddfbbee98e63f855cba6c6dc3eb7ae85ee6405ad0e0ab0167fc045	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	58
reports/codeql-kotlin-kernel.json	bada2d8ddf781ff12b569fd240f4b94014f647d71f5fb1d653308d5a5995858f	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	58
reports/codeql-python-kernel.json	8cad62ca0ae9206f172ab9cdbdbe95a8dc72d5af62d9624a97e7afb491eafea7	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	58
reports/codeql-ruby-kernel.json	09358d58fb97df1bc2024545ec56438d23989ad4c3a2c13a4a0e7c407a450858	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	58
reports/codeql-rust-kernel.json	30882a1c1aab9919ff484a89166f10ded6050e9b3ffef37f1568c6cce605195f	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	56
reports/codeql-typescript-kernel.json	ffe51480b9c3ab103e67484e5a86e4ba1c35c15d2ffaca6ff11831d7694a501e	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	58
reports/joern-java-kernel.json	7e3c4cb6adbe7325bb5f9f12a62f0d0176faacd5825ce5c9f32c7f67a03c1e85	Joern 4.0.610, build joern-cli:4.0.610	58
reports/joern-javascript-kernel.json	d794fbb8d72cb5d836ffe45d8caf421113931b9bc376424c62b57f753b820dfb	Joern 4.0.610, build joern-cli:4.0.610	58
reports/joern-php-kernel.json	1638b81a764de42658700e1f3deeeebf808055b2582db4e21c65c8ed0b7ddab5	Joern 4.0.610, build joern-cli:4.0.610	58
reports/joern-python-kernel.json	0facb3aa7e4e2855f04c356c103beb9f1a84b4879c41f7b826747d7d25c637f4	Joern 4.0.610, build joern-cli:4.0.610	58
reports/joern-ruby-kernel.json	0d1bd231bae8ffec048e0cd7cbe83d128e7cf3c0cb49a3a1faafea3a10960b3c	Joern 4.0.610, build joern-cli:4.0.610	58
reports/joern-rust-kernel.json	cf346a6c0bda2dc3b6cd6af1f24bc2c4b895fdea0cce7c85f4b2c7998ff54351	Joern 4.0.610, build joern-cli:4.0.610	54
reports/semgrep-c-kernel.json	a75b5f37004166d20de264ee95ba7c6f4905ab0cc9e82c47aeed69ee35f4e4c5	Semgrep CE 1.174.0, build semgrep-oss:1.174.0	48
reports/semgrep-cpp-kernel.json	ef9b23c9a1fa0764ffbe0db62e80c9bd5986374a24ecf7db702b221661d5445d	Semgrep CE 1.174.0, build semgrep-oss:1.174.0	56
reports/semgrep-go-kernel.json	bab1bcdeef91fc8fbaece22857db61efac141793573046d13a06ee9921889426	Semgrep CE 1.174.0, build semgrep-oss:1.174.0	58
reports/semgrep-java-kernel.json	60ccdc90635606d8eaa150d0823c626ea5b3cf69963f6575f324fb020287e2bb	Semgrep CE 1.174.0, build semgrep-oss:1.174.0	58
reports/semgrep-javascript-kernel.json	df957a71497cec253003f0c0a1941d9bc13a8424d0d9bb9058e079f11259d0c9	Semgrep CE 1.174.0, build semgrep-oss:1.174.0	58
reports/semgrep-kotlin-kernel.json	e1e23bfcf109af1e7345649be232de413e7f1e655513947ecb0224d9bbaefba6	Semgrep CE 1.174.0, build semgrep-oss:1.174.0	58
reports/semgrep-php-kernel.json	22bc4cf3c0d3192edf1391eef4e2c9e0e4b3e69fbe9769737df397dd8c58e695	Semgrep CE 1.174.0, build semgrep-oss:1.174.0	58
reports/semgrep-python-kernel.json	9eb2778656f6f46c95181fca43832e0c1f8ed03ce7e85b3e7ded51a80bc45137	Semgrep CE 1.174.0, build semgrep-oss:1.174.0	58
reports/semgrep-ruby-kernel.json	6f3b58ae53d16816b90076d449361e75728b20af8f9866c0e1f37ce12874b279	Semgrep CE 1.174.0, build semgrep-oss:1.174.0	58
reports/semgrep-rust-kernel.json	1739e7212692082488ac9ef6f3661a46dce3f9536f708b41113cb0b7574a3e89	Semgrep CE 1.174.0, build semgrep-oss:1.174.0	54
reports/semgrep-typescript-kernel.json	50a0635d83a7d24c6ae71b12b1e0d066ff1262b35d1934d5bc3827d8af97fba3	Semgrep CE 1.174.0, build semgrep-oss:1.174.0	58

Every report uses the benchmark-controlled model profile on the taint track
and remains its own scorecard. The Bifrost smoke population is the pinned
118-case breadth slice — challenge templates are excluded from the smoke
selection outright, so the smoke population did not grow — and every other
report is a single-language kernel population. The C and Rust kernel reports
each carry two language-extension cases in addition to their core tier;
those stay on their own tier and are never folded into a core denominator.
Raw evidence for every result is retained under reports/raw/ and
dige...

DataFlowBench v0.3.0

DataFlowBench v0.3.0

Third immutable release snapshot: the cross-language direct-flow breadth
baseline plus propagation kernels in ten languages — Java, JavaScript,
TypeScript, Python, Kotlin, C#, Go, C, C++, and Rust — with CodeQL evidence
for all ten, frozen under the freeze/v1 contract with claim scope
release.

Freeze identity

• Freeze ID (manifest SHA-256):
  61d0025957ba5f8a8d3ffa6cd2b46ba058bd67fcf2128568a96ff0eb5a1546e4
• Manifest: reports/freeze.json
• Benchmark revision: b7269a5 (tag v0.3.0)
• Fixture revision:
  sha256:1b1b8d5cd90dc4bbdb0675a5a6b6b58315d2328b157e9074f8db13e17736b816
• Case schema v2, normalized result schema v1
• 328 frozen cases, 19 bound reports, 694 scored case results

Bound evidence

Normalized report	SHA-256	Analyzer	Cases
reports/bifrost-c-kernel.json	a3f0b31859ec2a935b0b9a3fa31f3a50004af6dae7e1f721deef0bdb3aab9423	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	32
reports/bifrost-cpp-kernel.json	ab5d332588a9a3b7e5ab26ab09b87de2551f60fef164cc3b2c8f834845def169	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	32
reports/bifrost-csharp-kernel.json	49ba511fc4405220f716bfad3b57d81d0c9cd724ecba703b94f117994b9e2b8a	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	32
reports/bifrost-go-kernel.json	4fe33adedb0d863a2287921e963fa0c27d9b7144aa344a0c46a1136a739f970c	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	32
reports/bifrost-kotlin-kernel.json	29eab6134dbd0676e36db4656daa588fd6bf2be3b4dc42548f9711ab00b117df	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	32
reports/bifrost-python-kernel.json	f6f9cdf50de119e72df81c2cc960e6020b7821df6fbdb3d5a725f7e5b05cf83f	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	32
reports/bifrost-rust-kernel.json	c702764b78c0edb14a90a7ccc54c3247d85a9f41a1e84e564442b7507b4b7def	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	32
reports/bifrost-smoke.json	a4dad79b4e2e47580ebd1a53801aecd4ccf09de1cbb8552951a1c2f6ef25d040	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	118
reports/bifrost-typescript-kernel.json	c294408bdc3c9aedfddf5217144147c9250d0b036f541475e3d748cd0df2eaba	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	32
reports/codeql-c-kernel.json	5d4d3f23c90402e214dd9a71ffebbb3ca49190b97a47202d41dce4d6358be6c6	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-cpp-kernel.json	d4f5b18b707b7cbc70d38f3de573caa94958adec0bd983c9c2f2938be9f47354	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-csharp-kernel.json	61146506ca07d1e1bb1025b3c341574da1f64fc0cbd63e15fc46e13d3e371d46	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-go-kernel.json	e90acd0b0e2d40c702df2c0d70f5f3118434951b85376008b7d0e7b1dae4516a	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-java-kernel.json	7fbfe3942890a4d84e12968d160d5ad1fc675291bbe699f228af76f15cec7665	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-javascript-kernel.json	7ce08b4ed5b67bd711d3f6cb06184f7f80fd74c51d89c554cde8def997ce7f95	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-kotlin-kernel.json	779b945d3435b7c8144d932117bb5483f16520b0c7b285ba477910faf489ac3f	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-python-kernel.json	fb2a40617b05170daf9a5f9d786bd961c298fdd759c8596fd3f990d33a4f4e4f	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-rust-kernel.json	bfb4af7974972cabf6367bf960bd9f74203ff65cb5fdcceadfb83d0d456ce20b	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-typescript-kernel.json	848162f40204dbdce0a25dd25014e9d82f32cc5b74551d58dd24745e2cf4a95b	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32

The Bifrost smoke population covers all 118 cases of the breadth baseline
together with the Java and JavaScript kernels; every other report is a
single-language kernel population. The C and Rust kernel reports each carry
30 core cases plus 2 language-extension cases, which stay on their own
tier and are never folded into the core denominator. All reports use the
benchmark-controlled model profile on the taint track and remain separate
scorecards. Raw evidence for every result is retained under reports/raw/
and digest-bound in the manifest.

Results

Generated pages live in results/ and derive exclusively from the frozen
manifest; see results/index.md. Incomplete outcomes (inconclusive,
unsupported, runner-error) are capability and execution coverage and are
never counted as clean negatives.

Correct decisions (true positives plus true negatives) on each kernel's
core tier. Each language is its own population with its own denominator:
C and Rust have 15-template / 30-assertion cores because their
exception-catch cell has no semantics-preserving native construct; the other
eight have 16-template / 32-assertion cores. These columns are read
independently — DataFlowBench publishes no combined leaderboard, and the
15-template and 16-template cores are never pooled.

Kernel core	Bifrost 0.10.5	Incomplete (Bifrost)	CodeQL 2.26.3	Incomplete (CodeQL)
Java (16 templates, 32 assertions)	32/32	0	27/32	0
JavaScript (16, 32)	32/32	0	29/32	0
Python (16, 32)	32/32	0	28/32	0
TypeScript (16, 32)	30/32	2 inconclusive	29/32	0
Kotlin (16, 32)	19/32	10 inconclusive	27/32	0
Go (16, 32)	10/32	22 inconclusive	26/32	0
C# (16, 32)	2/32	30 inconclusive	27/32	0
C++ (16, 32)	2/32	30 inconclusive	28/32	0
C (15 templates, 30 assertions)	2/30	28 inconclusive	27/30	0
Rust (15, 30)	2/30	20 inconclusive, 8 runner-error	28/30	0

Reading the two populations:

• Bifrost 0.10.5 now decides every assertion of the Java, JavaScript and
  Python kernels correctly — 32/32 each, with no incomplete outcomes. Under
  v0.10.2 (release v0.2.0) the same kernels stood at 17/32, 19/32 and 16/32.
  TypeScript is at 30/32 with 2 inconclusive and no wrong answers. Kotlin
  (19/32, 1 false negative and 2 false positives) and Go (10/32) are
  partially wired up. On C, C++, C# and Rust the deep semantics remain
  direct-only: the direct-propagation pair is decided correctly and the rest
  of each kernel reports incomplete analysis. Rust additionally has an
  explicit runner failure covering its whole heap stratum — 8 cases reported
  as runner-error with the internal_invariant diagnostic — which is
  execution coverage, not a wrong answer.
• CodeQL 2.26.3 produces a definitive outcome for all 32 (or 30) cases in
  every kernel, with no incomplete outcomes anywhere, and between 2 and 6
  incorrect decisions per kernel. Rust runs through the pre-1.0 preview Rust
  extractor and scores 28/30 on the core tier with zero false negatives (2
  false positives).
• On the direct-flow breadth baseline, Bifrost answers both assertions
  correctly in 12 of 13 languages. Ruby remains inconclusive: it is reported
  as capability coverage, not as a wrong answer, so Ruby breadth stays
  undetermined in this snapshot.
• The language-extension tiers stay separate from every core denominator.
  On C's two cases CodeQL is 2/2 and Bifrost is inconclusive on both; on
  Rust's Result/? pair CodeQL is 1/2 (one false negative) and Bifrost is
  inconclusive on both.

Neither analyzer is declared a winner: the populations, model profiles, and
denominators differ per language, and incomplete outcomes are coverage
evidence rather than incorrect answers.

Reproduction

git checkout v0.3.0                # frozen benchmark revision (evidence commit)
# then check out the merge commit carrying reports/freeze.json for this release
cargo run -- validate-freeze reports/freeze.json
cargo run -- generate-results --manifest reports/freeze.json --output-directory results --check

Adapter re-execution (produces new evidence, therefore a new freeze):

cargo run -- run-bifrost-smoke --bifrost <bifrost-binary>
for kernel in python typescript kotlin csharp go c cpp rust; do
  cargo run -- run-bifrost-$kernel-kernel --bifrost <bifrost-binary>
done

codeql pack install adapters/codeql
for pack in javascript typescript python kotlin csharp go cpp rust; do
  codeql pack install adapters/codeql/$pack
done
for kernel in java javascript typescript python kotlin csharp go c cpp rust; do
  cargo run -- run-codeql-$kernel-kernel --codeql <codeql-binary>
done

The Kotlin and Go CodeQL runners trace a real compile, so kotlinc and the
Go toolchain must be available; the Rust runner uses the CLI's public
preview Rust extractor.

Immutability

This snapshot is immutable. Corrected evidence creates a new freeze with a
new release name and digests; the v0.1.0 and v0.2.0 manifests and evidence
remain available at their release commits for audit. This release has no DOI
and no external review claim.

DataFlowBench v0.2.0

Second immutable release snapshot: the cross-language direct-flow breadth baseline plus the 16-template Java, JavaScript, and Python propagation kernels — now with CodeQL evidence for all three kernel languages — frozen under the freeze/v1 contract with claim scope release.

Freeze identity

• Freeze ID (manifest SHA-256): c8ba343f2db9a8c1cac5570a414bf497c85bbe11d29730639575c9ba3bb70912
• Manifest: reports/freeze.json (merged at 16d0014)
• Benchmark revision: 56673b6 (this tag)
• Fixture revision: sha256:b68d393719bb8eb1ecdf252fbf115f9f596093ae7c2fc358a99f3239acef5e98

Bound evidence

Normalized report	SHA-256	Analyzer
reports/bifrost-smoke.json	aaad007cd17bce497c4f0eba63e2ccb0a96ecde6f861198fed2834ac9090b579	Bifrost 0.10.2
reports/bifrost-python-kernel.json	1d86fd4c245c4f86722bfa584556609954e46c4e51c73dd83e2942e9124fddba	Bifrost 0.10.2
reports/codeql-java-kernel.json	04324829ae3a39fd11a8f7de499af30e365a5fd4380eb55c0249d88c2aee6b6c	CodeQL 2.26.3
reports/codeql-javascript-kernel.json	89eb5141248eb7c3d68feae5c6a1616819a26d5051d43f38b16bbc90cca42d8e	CodeQL 2.26.3
reports/codeql-python-kernel.json	a34862d20f12280b39a4be2f0910b2f7c86ac4a2b17ef52e4ac9146a566072cd	CodeQL 2.26.3

Full analyzer build identities, reproduction commands, and the immutability rules are in docs/releases/v0.2.0.md. The v0.1.0 snapshot remains available at its own release and on the site as an archived snapshot.

Reproduction

git checkout 16d0014
cargo run -- validate-freeze reports/freeze.json
cargo run -- generate-results --manifest reports/freeze.json --output-directory results --check

This release has no DOI and no external review claim.

DataFlowBench v0.1.0

First immutable release snapshot: the cross-language direct-flow breadth baseline and the 16-template Java propagation kernel, frozen under the freeze/v1 contract with claim scope release.

Freeze identity

• Freeze ID (manifest SHA-256): c9429463e39aa4d4c868295a2025b4d192cb8d5add5bc9e36265eedc5e1838cf
• Manifest: reports/freeze.json (merged at d8dda05)
• Benchmark revision: a0d19c1 (this tag)
• Fixture revision: sha256:b68d393719bb8eb1ecdf252fbf115f9f596093ae7c2fc358a99f3239acef5e98

Bound evidence

Normalized report	SHA-256	Analyzer
reports/bifrost-smoke.json	aaad007cd17bce497c4f0eba63e2ccb0a96ecde6f861198fed2834ac9090b579	Bifrost 0.10.2, build c2116609f5fc1be318c8fb76fb83763cf326bab6
reports/codeql-java-kernel.json	04324829ae3a39fd11a8f7de499af30e365a5fd4380eb55c0249d88c2aee6b6c	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7

The Bifrost population covers all 118 frozen cases, including the 26-assertion direct-flow breadth baseline and the 32-assertion Java core; the CodeQL population is the 32-assertion Java core. Both use the benchmark-controlled model profile on the taint track and remain separate scorecards. Raw evidence for every result is retained under reports/raw/ and digest-bound in the manifest.

Reproduction

git checkout d8dda057ea9d0c126480709d1a91df29e298433a
cargo run -- validate-freeze reports/freeze.json
cargo run -- generate-results --manifest reports/freeze.json --output-directory results --check

Immutability

This snapshot is immutable. Corrected evidence creates a new freeze with a new release name and digests; this manifest and its evidence remain available for audit. This release has no DOI and no external review claim.