DataFlowBench v0.1.0

First immutable release snapshot: the cross-language direct-flow breadth baseline and the 16-template Java propagation kernel, frozen under the freeze/v1 contract with claim scope release.

Freeze identity

• Freeze ID (manifest SHA-256): c9429463e39aa4d4c868295a2025b4d192cb8d5add5bc9e36265eedc5e1838cf
• Manifest: reports/freeze.json (merged at d8dda05)
• Benchmark revision: a0d19c1 (this tag)
• Fixture revision: sha256:b68d393719bb8eb1ecdf252fbf115f9f596093ae7c2fc358a99f3239acef5e98

Bound evidence

Normalized report	SHA-256	Analyzer
reports/bifrost-smoke.json	aaad007cd17bce497c4f0eba63e2ccb0a96ecde6f861198fed2834ac9090b579	Bifrost 0.10.2, build c2116609f5fc1be318c8fb76fb83763cf326bab6
reports/codeql-java-kernel.json	04324829ae3a39fd11a8f7de499af30e365a5fd4380eb55c0249d88c2aee6b6c	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7

The Bifrost population covers all 118 frozen cases, including the 26-assertion direct-flow breadth baseline and the 32-assertion Java core; the CodeQL population is the 32-assertion Java core. Both use the benchmark-controlled model profile on the taint track and remain separate scorecards. Raw evidence for every result is retained under reports/raw/ and digest-bound in the manifest.

Reproduction

git checkout d8dda057ea9d0c126480709d1a91df29e298433a
cargo run -- validate-freeze reports/freeze.json
cargo run -- generate-results --manifest reports/freeze.json --output-directory results --check

Immutability

This snapshot is immutable. Corrected evidence creates a new freeze with a new release name and digests; this manifest and its evidence remain available for audit. This release has no DOI and no external review claim.