DataFlowBench v0.3.0

DataFlowBench v0.3.0

Third immutable release snapshot: the cross-language direct-flow breadth
baseline plus propagation kernels in ten languages — Java, JavaScript,
TypeScript, Python, Kotlin, C#, Go, C, C++, and Rust — with CodeQL evidence
for all ten, frozen under the freeze/v1 contract with claim scope
release.

Freeze identity

• Freeze ID (manifest SHA-256):
  61d0025957ba5f8a8d3ffa6cd2b46ba058bd67fcf2128568a96ff0eb5a1546e4
• Manifest: reports/freeze.json
• Benchmark revision: b7269a5 (tag v0.3.0)
• Fixture revision:
  sha256:1b1b8d5cd90dc4bbdb0675a5a6b6b58315d2328b157e9074f8db13e17736b816
• Case schema v2, normalized result schema v1
• 328 frozen cases, 19 bound reports, 694 scored case results

Bound evidence

Normalized report	SHA-256	Analyzer	Cases
reports/bifrost-c-kernel.json	a3f0b31859ec2a935b0b9a3fa31f3a50004af6dae7e1f721deef0bdb3aab9423	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	32
reports/bifrost-cpp-kernel.json	ab5d332588a9a3b7e5ab26ab09b87de2551f60fef164cc3b2c8f834845def169	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	32
reports/bifrost-csharp-kernel.json	49ba511fc4405220f716bfad3b57d81d0c9cd724ecba703b94f117994b9e2b8a	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	32
reports/bifrost-go-kernel.json	4fe33adedb0d863a2287921e963fa0c27d9b7144aa344a0c46a1136a739f970c	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	32
reports/bifrost-kotlin-kernel.json	29eab6134dbd0676e36db4656daa588fd6bf2be3b4dc42548f9711ab00b117df	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	32
reports/bifrost-python-kernel.json	f6f9cdf50de119e72df81c2cc960e6020b7821df6fbdb3d5a725f7e5b05cf83f	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	32
reports/bifrost-rust-kernel.json	c702764b78c0edb14a90a7ccc54c3247d85a9f41a1e84e564442b7507b4b7def	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	32
reports/bifrost-smoke.json	a4dad79b4e2e47580ebd1a53801aecd4ccf09de1cbb8552951a1c2f6ef25d040	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	118
reports/bifrost-typescript-kernel.json	c294408bdc3c9aedfddf5217144147c9250d0b036f541475e3d748cd0df2eaba	Bifrost 0.10.5, build 728ac69ab93224151c6c951b23d2f5bc681d8558	32
reports/codeql-c-kernel.json	5d4d3f23c90402e214dd9a71ffebbb3ca49190b97a47202d41dce4d6358be6c6	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-cpp-kernel.json	d4f5b18b707b7cbc70d38f3de573caa94958adec0bd983c9c2f2938be9f47354	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-csharp-kernel.json	61146506ca07d1e1bb1025b3c341574da1f64fc0cbd63e15fc46e13d3e371d46	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-go-kernel.json	e90acd0b0e2d40c702df2c0d70f5f3118434951b85376008b7d0e7b1dae4516a	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-java-kernel.json	7fbfe3942890a4d84e12968d160d5ad1fc675291bbe699f228af76f15cec7665	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-javascript-kernel.json	7ce08b4ed5b67bd711d3f6cb06184f7f80fd74c51d89c554cde8def997ce7f95	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-kotlin-kernel.json	779b945d3435b7c8144d932117bb5483f16520b0c7b285ba477910faf489ac3f	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-python-kernel.json	fb2a40617b05170daf9a5f9d786bd961c298fdd759c8596fd3f990d33a4f4e4f	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-rust-kernel.json	bfb4af7974972cabf6367bf960bd9f74203ff65cb5fdcceadfb83d0d456ce20b	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32
reports/codeql-typescript-kernel.json	848162f40204dbdce0a25dd25014e9d82f32cc5b74551d58dd24745e2cf4a95b	CodeQL 2.26.3, build codeql-cli:7d097a43199effe04ecd9c6bd3ad9bb02a45b3d7	32

The Bifrost smoke population covers all 118 cases of the breadth baseline
together with the Java and JavaScript kernels; every other report is a
single-language kernel population. The C and Rust kernel reports each carry
30 core cases plus 2 language-extension cases, which stay on their own
tier and are never folded into the core denominator. All reports use the
benchmark-controlled model profile on the taint track and remain separate
scorecards. Raw evidence for every result is retained under reports/raw/
and digest-bound in the manifest.

Results

Generated pages live in results/ and derive exclusively from the frozen
manifest; see results/index.md. Incomplete outcomes (inconclusive,
unsupported, runner-error) are capability and execution coverage and are
never counted as clean negatives.

Correct decisions (true positives plus true negatives) on each kernel's
core tier. Each language is its own population with its own denominator:
C and Rust have 15-template / 30-assertion cores because their
exception-catch cell has no semantics-preserving native construct; the other
eight have 16-template / 32-assertion cores. These columns are read
independently — DataFlowBench publishes no combined leaderboard, and the
15-template and 16-template cores are never pooled.

Kernel core	Bifrost 0.10.5	Incomplete (Bifrost)	CodeQL 2.26.3	Incomplete (CodeQL)
Java (16 templates, 32 assertions)	32/32	0	27/32	0
JavaScript (16, 32)	32/32	0	29/32	0
Python (16, 32)	32/32	0	28/32	0
TypeScript (16, 32)	30/32	2 inconclusive	29/32	0
Kotlin (16, 32)	19/32	10 inconclusive	27/32	0
Go (16, 32)	10/32	22 inconclusive	26/32	0
C# (16, 32)	2/32	30 inconclusive	27/32	0
C++ (16, 32)	2/32	30 inconclusive	28/32	0
C (15 templates, 30 assertions)	2/30	28 inconclusive	27/30	0
Rust (15, 30)	2/30	20 inconclusive, 8 runner-error	28/30	0

Reading the two populations:

• Bifrost 0.10.5 now decides every assertion of the Java, JavaScript and
  Python kernels correctly — 32/32 each, with no incomplete outcomes. Under
  v0.10.2 (release v0.2.0) the same kernels stood at 17/32, 19/32 and 16/32.
  TypeScript is at 30/32 with 2 inconclusive and no wrong answers. Kotlin
  (19/32, 1 false negative and 2 false positives) and Go (10/32) are
  partially wired up. On C, C++, C# and Rust the deep semantics remain
  direct-only: the direct-propagation pair is decided correctly and the rest
  of each kernel reports incomplete analysis. Rust additionally has an
  explicit runner failure covering its whole heap stratum — 8 cases reported
  as runner-error with the internal_invariant diagnostic — which is
  execution coverage, not a wrong answer.
• CodeQL 2.26.3 produces a definitive outcome for all 32 (or 30) cases in
  every kernel, with no incomplete outcomes anywhere, and between 2 and 6
  incorrect decisions per kernel. Rust runs through the pre-1.0 preview Rust
  extractor and scores 28/30 on the core tier with zero false negatives (2
  false positives).
• On the direct-flow breadth baseline, Bifrost answers both assertions
  correctly in 12 of 13 languages. Ruby remains inconclusive: it is reported
  as capability coverage, not as a wrong answer, so Ruby breadth stays
  undetermined in this snapshot.
• The language-extension tiers stay separate from every core denominator.
  On C's two cases CodeQL is 2/2 and Bifrost is inconclusive on both; on
  Rust's Result/? pair CodeQL is 1/2 (one false negative) and Bifrost is
  inconclusive on both.

Neither analyzer is declared a winner: the populations, model profiles, and
denominators differ per language, and incomplete outcomes are coverage
evidence rather than incorrect answers.

Reproduction

git checkout v0.3.0                # frozen benchmark revision (evidence commit)
# then check out the merge commit carrying reports/freeze.json for this release
cargo run -- validate-freeze reports/freeze.json
cargo run -- generate-results --manifest reports/freeze.json --output-directory results --check

Adapter re-execution (produces new evidence, therefore a new freeze):

cargo run -- run-bifrost-smoke --bifrost <bifrost-binary>
for kernel in python typescript kotlin csharp go c cpp rust; do
  cargo run -- run-bifrost-$kernel-kernel --bifrost <bifrost-binary>
done

codeql pack install adapters/codeql
for pack in javascript typescript python kotlin csharp go cpp rust; do
  codeql pack install adapters/codeql/$pack
done
for kernel in java javascript typescript python kotlin csharp go c cpp rust; do
  cargo run -- run-codeql-$kernel-kernel --codeql <codeql-binary>
done

The Kotlin and Go CodeQL runners trace a real compile, so kotlinc and the
Go toolchain must be available; the Rust runner uses the CLI's public
preview Rust extractor.

Immutability

This snapshot is immutable. Corrected evidence creates a new freeze with a
new release name and digests; the v0.1.0 and v0.2.0 manifests and evidence
remain available at their release commits for audit. This release has no DOI
and no external review claim.