Skip to content

DataFlowBench v0.6.1

Latest

Choose a tag to compare

@DavidBakerEffendi DavidBakerEffendi released this 02 Sep 01:35
· 34 commits to main since this release
a8cde57

DataFlowBench v0.6.1

A patch release, and a narrow one on purpose. It exists because a Bifrost fix
cycle closed against findings this benchmark published, so it re-pins Bifrost
from v0.10.7 to v0.10.8 and re-runs that analyzer's twenty slices. Nothing
else in the field moved: the fixture revision is unchanged, the other sixty-two
reports carry over byte-identical, and every other analyzer's numbers are
identical to v0.6.0's.

Three things in it are worth a reader's time, and only one of them is good
news. The fix cycle lands: four false positives corrected and eight declined
assertions newly decided. A regression comes with it, published rather than
held for. And a disagreement this project blamed on the engine for three
releases turns out to have been a bug in our own adapter.

Freeze identity

  • Freeze ID (manifest SHA-256):
    65638eafb36478120d268290479815114f244baa57994c47e19fac6b759e50ae
  • Manifest: reports/freeze.json
  • Benchmark revision: a8cde57 (tag v0.6.1)
  • Fixture revision:
    sha256:9df209ed3d7723a3ee33f2b289cf2afe34a3add781bdf2a2ac445de42b8d0151
  • Case schema v2, normalized result schema v1
  • 852 frozen cases, 82 bound reports, 3480 scored case results
  • Score tiers: calibration, core, language-extension, modeling
  • Model profiles: benchmark-controlled, tool-native
  • Claim exclusions: none

The fixture revision is unchanged from v0.6.0 — and from v0.5.0 before it.
The benchmark did not grow in this release, and no case was edited: this is the
same exam, re-sat by one candidate.

What re-ran

Of the 82 bound reports, 20 were re-executed — every Bifrost slice: the
thirteen kernels, the three modeling reports, the three tool-native reports,
and the breadth smoke population. The remaining 62 are byte-identical to
the reports already in the tree, re-bound and re-digested into the new manifest
without being re-run. Of those 62, 54 were bound by v0.6.0 itself and 8 are the
modeling and tool-native rows produced by the amendment work that landed after
v0.6.0 was published (below).

The re-run was taken in a single settle-gated quiet window: twenty cold slices
between 03:07:00 and 03:09:35 local time on 2 September 2026, on the
Mac16,1 / 10-core arm64 machine whose stamp is retained at
reports/raw/bifrost/run-environment.json. The window's load gate (1.8–2.0) is
recorded in the run's commit record rather than in a raw artifact — the Bifrost
correctness slices retain a per-case phase-timing sidecar and a per-run
environment stamp, but no load sample. That is stated here rather than implied,
because this release note is not entitled to a number the evidence does not
carry.

The second pin-currency review (#92)

The full table is in docs/adapters.md.
In summary:

Analyzer Pin at v0.6.0 Outcome
Bifrost 0.10.7 Bumped to 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249
Joern 4.0.614 Held, with a dated reason: upstream daily 4.0.615 is one day newer, and the release's delta is deliberately scoped to the Bifrost fix cycle
CodeQL CLI 2.26.4 Evaluated — current
Semgrep CE 1.175.0 Evaluated — current
OpenTaint analyzer/2026.08.27.17eb0fe Evaluated — current (digest-pinned)
Infer v1.3.0 Evaluated — current (digest-pinned)
FlowDroid 2.15.1 Evaluated — current (digest-pinned)
Pysa pyre-check 0.10.0 + Pyrefly 1.2.0 Evaluated — current (digest-pinned)

The Joern hold is the one to read twice. Holding a pin one day behind upstream
is a choice, and it is recorded as a choice with its reason and its date, so
that the next review inherits an obligation rather than a silence. A pin held
without a stated reason is indistinguishable from a pin nobody looked at.

The Bifrost v0.10.8 fix cycle

Everything in this section is one analyzer column. Read it that way.

  • Four false positives are fixed. The path-feasibility and loop-kill
    negatives filed as BrokkAi/bifrost-dev#2731
    dfb-taint-csharp-infeasible-branch-negative,
    dfb-taint-csharp-loop-carried-negative,
    dfb-taint-go-loop-carried-negative, and
    dfb-taint-ruby-infeasible-branch-negative — all now read not-reached.
    Those four were published against Bifrost in v0.5.0 and again in v0.6.0.
  • Bifrost now has no decisive mistake anywhere in this freeze. Not one
    false positive and not one false negative, across all 3480 case results, on
    every tier and under both model profiles. No other analyzer in the freeze can
    say that, and the reason Bifrost can is not free — see the inconclusive count
    below.
  • Eight assertions are newly decided, and decided correctly. The
    element-object pairs in java, javascript, and typescript, and Rust's
    recursive-carry pair, move from inconclusive to a correct decision. These
    bite into the declined families tracked as bifrost-dev#2839, which is
    narrowed rather than closed: the remaining declines in those families are
    still declines.
  • Decisive-correct on the thirteen kernels: 435 → 446. Bifrost now produces
    446 decisive outcomes on the 738-assertion core population, of which all
    446 are correct
    (v0.6.0: 440 decisive, 435 correct). Language by language:
    csharp 32 → 34, java 37 → 40, javascript 36 → 38, ruby 21 → 22, rust 36 → 38,
    typescript 34 → 36, and go 35 → 34. C, C++, Kotlin, PHP, Python, and
    Scala are unchanged.
  • Core inconclusive: 298 → 292, and still concentrated where it was:
    Ruby 36 of 58, Kotlin 30, PHP and C++ 26 each, C# and Go 24 each; lightest is
    C at 8 of 48. Declines, not misses — but on a page where seven other
    analyzers decide these same cases definitively, that column's shape is the
    price of the zero-mistake row above, and both belong in the same sentence.
  • Smoke: 117 of 118, unchanged. The single non-decision remains the
    dfb-taint-java-modeled-external calibration case, which takes unsupported
    and is not scored.

Honest negatives

A regression, taken rather than held for

Go's array-element pair — dfb-taint-go-array-element-positive and
dfb-taint-go-array-element-negative — was decided correctly under v0.10.7
and is inconclusive under v0.10.8. The retained raw evidence carries the
reason verbatim:

taint discovery is incomplete: procedure value-flow snapshot for
array_element_positive.go:array_element_positive.go.run is unsupported
(index_memory)

It is filed upstream as BrokkAi/bifrost-dev#2831.

The pin was taken with this loss visible. Holding v0.10.7 to keep one pair
decided would have suppressed a net improvement — four false positives fixed
and eight cells newly decided — and would have hidden the regression instead of
publishing it. It is the only cell in this release that moved backwards, it is
on the vendor's own engine, and it is on the templates page, the evidence page,
and here.

The java-direct disagreement was ours, not the engine's

This is the part of the release that is a correction to DataFlowBench.

For three releases — v0.4.0, v0.5.0, v0.6.0 — this project published an
unreconciled disagreement: dfb-taint-java-direct-positive was reached (true
positive) in reports/bifrost-smoke.json and not-reached (false negative) in
reports/bifrost-java-kernel.json, at the same build and the same fixture
revision. Each release described it as an observed instability of the engine,
retained both artifacts, and declined to re-run either to agreement.
bifrost-dev#2832 was filed upstream against the engine.

It was not an engine defect. The Java kernel adapter was force-selecting
core-java-kernel.rqlp in place of each selected case's own validated declared
policy. That kernel policy's dfb_source/dfb_sink selectors bind zero
endpoints
in this legacy fixture, so the kernel run asked a question the
fixture could not answer and correctly reported not-reached. The smoke run,
which used the case's declared direct-positive.rqlp, was right the whole
time. The adapter now uses each case's declared policy while keeping the
configuration hash over every policy invoked; the fix is PR #118, with a
smoke/kernel policy-parity regression test beside it. bifrost-dev#2832 is
being closed as benchmark-side.

Under this freeze both populations reach it. Java's kernel goes 37/58 to 40/58,
and the classic-32 partition inside it goes 31/32 to 32/32, matching the
smoke population case for case.

Two things follow, and neither is comfortable. First: a benchmark published by
the vendor of one of the engines it measures spent three releases attributing
its own bug to that engine's competitor-facing column — which is to say, the
error ran against Bifrost, not for it, and it still should not have run. The
direction of a mistake is not what makes it acceptable. Second: the reason it
survived three releases is that the disagreement was documented rather than
investigated. Publishing an anomaly honestly is not the same as chasing it
down, and the freeze contract's refusal to re-run evidence to agreement — which
is the right rule — is not a reason to leave the discrepancy unexplained. The
policy-parity regression test added in #118 is what should have existed in
v0.4.0.

The v0.6.0 snapshot pages and release note are not rewritten. They stay as
published, bound to their own evidence commit, with an archived banner pointing
here. That is what an immutable snapshot means, and it is also what makes this
correction legible: both versions of the story remain readable side by side.

Everything else, unchanged

  • The other seven analyzers. CodeQL, Joern, Semgrep CE, OpenTaint, Infer,
    FlowDroid, and Pysa report exactly the numbers v0.6.0 published, from exactly
    the same report bytes. On the kernels: CodeQL 506 decisive-correct, Joern
    270, Semgrep CE 132, OpenTaint 99, Infer 140, FlowDroid 98, Pysa 47.
  • The modeling and tool-native tiers are unchanged except for Bifrost's six
    rows, which are re-run and land on the same cells.
  • The core population stays at 738 assertions over 13 kernels in 13
    languages, with the same case identifiers.
  • The latency tier was not re-measured. It is frozen at v0.6.0 and its
    Bifrost rows keep naming v0.10.7, because that is the build they were
    measured on. Re-labelling them to v0.10.8 would assert a measurement nobody
    performed. The consequence is stated on both the latency page and the
    analyzer-profiles page: in this snapshot Bifrost's radar mixes v0.10.8
    correctness axes with a v0.10.7 latency axis, and that is called out rather
    than smoothed over.

Amendments first bound by a freeze here

Amendments A13 through A24 were all dated 2026-09-01 and landed on main
after v0.6.0 was published. This is the first freeze to bind the evidence they
govern, which is why this manifest carries 82 reports where v0.6.0's carried
74:

  • A13/A14 — Infer joins the modeling matrix (field-evaluated partition) and
    the tool-native profile (declining on a measured silence).
  • A16/A17 — Pysa joins the modeling matrix and the tool-native profile.
  • A18/A19/A20 — FlowDroid joins both, with three declared subprocess phases
    on its modeling population.
  • A22/A23 — OpenTaint joins both; its shipped models archive is ruled
    shipped product.
  • A15/A21 — the warm marginal cost, published as a range over retained
    repeats.
  • A24 — per-invocation overhead, estimated for every adapter from a trivial
    no-flow fixture and labelled an estimate everywhere it appears.

Amendments A1 through A12 remain in force and are unaffected. None of these
amendments moved a Bifrost cell, and none of them is the reason any number in
the fix-cycle section changed.

Bound evidence

Each report's build identity is the witnessed identity of the binary actually
invoked, including on the rows that decide nothing. The Status column
distinguishes the twenty reports this release produced from the sixty-two it
inherited; a carried-over report's digest is identical to the one v0.6.0 or the
amendment work bound, which is the check that it was not quietly re-run.

Normalized report SHA-256 Analyzer Cases Status
reports/bifrost-c-kernel.json 4397ed7534c2ec040cb0f2c375a517c63a78989b8567781bb98ec6448a9b60cb Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 50 re-run on v0.10.8
reports/bifrost-cpp-kernel.json 6c9dfadd67b3b44cc2fa20fc9e57a2232f5243a8397bbf1d75ce35d3f0d7ec7e Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 56 re-run on v0.10.8
reports/bifrost-csharp-kernel.json 25166701816d4fb5ddf6b1d6fe7767df78b8fa21b64dc2f3ebf76bd98a0967c5 Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 58 re-run on v0.10.8
reports/bifrost-go-kernel.json 57dcaa2fef4f989c6da2f781aca6e016e9243801603edd0079d1f23d7697f4b2 Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 58 re-run on v0.10.8
reports/bifrost-java-kernel.json c8ca6fea344dc9de8062e737cadf21e9c009b7afa4950f86a8c326be9ba5100f Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 58 re-run on v0.10.8
reports/bifrost-java-modeling.json 89afaf65626a9d486e53bf10c6ad2d87337c0ca31a6d0a4a30491d67417d4c7f Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 24 re-run on v0.10.8
reports/bifrost-java-native.json 280bc95ddf679abc57c89d439f0b74d183a633f4862d6d97fd1651651ad3112e Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 — bifrost 0.10.8 built-in policy packs 12 re-run on v0.10.8
reports/bifrost-javascript-kernel.json 290ea5c4f2f07d1a98e9b4f12fd0755a13bccfd04fa97f1316cd5c3337aef469 Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 58 re-run on v0.10.8
reports/bifrost-javascript-modeling.json 703d20a6b566378ff0a2292fc03a5e69c8bebff21e0490e9e732fb0e3c104167 Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 24 re-run on v0.10.8
reports/bifrost-javascript-native.json 152cab4c6e22a73bd65537afb90b542cf6d179c683457d873996ffdcfcf3f3ad Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 — bifrost 0.10.8 built-in policy packs 12 re-run on v0.10.8
reports/bifrost-kotlin-kernel.json 30670477836bf8764b35bbd786e7623efd89338b26cda027a17aeed8de947d3a Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 58 re-run on v0.10.8
reports/bifrost-php-kernel.json fec821ef21624001d318292625a3a95f5ce16ea1c547a01fe8178b6edf3bd436 Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 58 re-run on v0.10.8
reports/bifrost-python-kernel.json 8308b9d380f348aac268a34a0612742759e220acf85a7fbc6fd30074fa3290a9 Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 58 re-run on v0.10.8
reports/bifrost-python-modeling.json d3c95e9fe03f148c92aae60a3ad0dbc974ab8509a799fa75432faff1773c3702 Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 24 re-run on v0.10.8
reports/bifrost-python-native.json 90f3d26984ca4757ca3b8aaf1548ec46974c5ad2b0c3b3718f586a905fcac153 Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 — bifrost 0.10.8 built-in policy packs 12 re-run on v0.10.8
reports/bifrost-ruby-kernel.json d269c7948b5e865233563b410035c624e86c486940c6660ad28573701f942817 Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 58 re-run on v0.10.8
reports/bifrost-rust-kernel.json 286f53ef2d69a9661904156064312bd54d58ec2f18b5a7bef170379515bf1587 Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 56 re-run on v0.10.8
reports/bifrost-scala-kernel.json 821860e4937f78dbd3e367e64900561034ab29e7df4f4e4d2bfd632e8e35500c Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 58 re-run on v0.10.8
reports/bifrost-smoke.json 65bdb4c1e0c3849feb085f445092e5ffe4103085e7cde0e737dc2bc182a8f82b Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 118 re-run on v0.10.8
reports/bifrost-typescript-kernel.json 1613533181608941d60b2c77b0bf7af3f07d1524620f603c03852c72fec04b49 Bifrost 0.10.8, build 419395c8066b9eddfba06aa69c8a151ef4968249 58 re-run on v0.10.8
reports/codeql-c-kernel.json 0bbf4766f6a5fe4a60cbc1fdf6667b942a01456df9c0828485db8d43b201fd4d CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 50 carried over
reports/codeql-cpp-kernel.json f314c4185eae8ef7f33feeee76b7c124cc4aef8684c923197bacb19e5190a9a8 CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 56 carried over
reports/codeql-csharp-kernel.json 313b44a93327652b642893d58ad55283d1cababbf5c92e147e1281bf93ce5d66 CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 58 carried over
reports/codeql-go-kernel.json 99dc5a3c7c17b27471028afd359830f8ee7fb51f1875c8fee1981d95826fa33d CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 58 carried over
reports/codeql-java-kernel.json 50418965ee291047161e4fe06d5c765f2f0fad492d6288c585be047276677ddc CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 58 carried over
reports/codeql-java-modeling.json 14c991ee939e1d4aef3e2850551166cfc3d5de606919aa186a577e4938100975 CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 24 carried over
reports/codeql-java-native.json 5d7d7b152c9366525b8362438cc83a8c0cf6008b519a9c84f200eca711acee31 CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 — 2.26.4 shipped suite codeql/java-queries@1.11.9:codeql-suites/java-security-extended.qls 12 carried over
reports/codeql-javascript-kernel.json 78ad35bbf7886d47461940128a622540ea4de94001406ba2f0431de48c7763c9 CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 58 carried over
reports/codeql-javascript-modeling.json 3a908bdc80fb84d2be7c47c75edce0950b688a71342137b8f70b98aa0359311f CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 24 carried over
reports/codeql-javascript-native.json bd5fe87f32f7fc30ea5deb365de613d2d49b5db3db57dbe724fc8625007d6db6 CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 — 2.26.4 shipped suite codeql/javascript-queries@2.4.4:codeql-suites/javascript-security-extended.qls 12 carried over
reports/codeql-kotlin-kernel.json ee7720f6d318834d2f01ecbdeab946cd5ae089cb70a1ffb3f39207259d442fa7 CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 58 carried over
reports/codeql-python-kernel.json cd304f94b4d9af5050a8228ff96c4b530fadef1af294b7e59a2855c47b6bab6c CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 58 carried over
reports/codeql-python-modeling.json 60ff9613a8e5deedd2c1b3f787911ce6fdb94430c3caaa34eb724695b82bcd4e CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 24 carried over
reports/codeql-python-native.json 2958f4e44c4075463079503bd7c222860076fc159475f76532a258f1aa0bf49e CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 — 2.26.4 shipped suite codeql/python-queries@1.8.9:codeql-suites/python-security-extended.qls 12 carried over
reports/codeql-ruby-kernel.json 10fb9cc1a8d2bfdd7405f7828045217cac00be4951d1e22a3c75e35e46eebcab CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 58 carried over
reports/codeql-rust-kernel.json b98733c392bcbca66953bb6fa779232676174c4e07c5fdaadaf3bcd94173082f CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 56 carried over
reports/codeql-typescript-kernel.json 49eaacb9cf7e5bdb6e49a4b8527885c2ca94c40bffe6df7d4c70f8e1187d4017 CodeQL 2.26.4, build codeql-cli:6b1e4dee94adb20f90a671f3fc9e04be32eecf65 58 carried over
reports/flowdroid-java-kernel.json df7fbd5263d3d27d95ce4da36688c8d5050dd3844a6096ee258d67f4c3f3ba83 FlowDroid 2.15.1, build soot-infoflow-cmd-2.15.1-jar-with-dependencies.jar sha256:51dadead47a173c494c2fa4855b1e8bd3b54e702a2c4b5ed58e60153009ae218; android-34 platform android.jar sha256:6cea1df3efb77103ac3e2beb9bf4718964b0e0869ab16d39d29d5cbae1c147ad; dexed by D8 8.5.35 (build 2c176ec131a9edb97721fb8578b7fbb462376632 from go/r8bot (luci-r8-custom-ci-archive-0-gths)); r8 jar sha256:4733945987ee0a840fafc34080b135259e01678412e07212b23f706334290294 58 carried over
reports/flowdroid-java-modeling.json b54c7a9827d2a8b45bd3952e42fd516ca2e7a9011d932aa240232d43d6100b83 FlowDroid 2.15.1, build soot-infoflow-cmd-2.15.1-jar-with-dependencies.jar sha256:51dadead47a173c494c2fa4855b1e8bd3b54e702a2c4b5ed58e60153009ae218; android-34 platform android.jar sha256:6cea1df3efb77103ac3e2beb9bf4718964b0e0869ab16d39d29d5cbae1c147ad; dexed by D8 8.5.35 (build 2c176ec131a9edb97721fb8578b7fbb462376632 from go/r8bot (luci-r8-custom-ci-archive-0-gths)); r8 jar sha256:4733945987ee0a840fafc34080b135259e01678412e07212b23f706334290294 24 new since v0.6.0
reports/flowdroid-java-native.json 6671f301cdcf1a28f4b5c125d9088b2ca8a056c1eeb4a4a52ca1f28366192f99 FlowDroid 2.15.1, build soot-infoflow-cmd-2.15.1-jar-with-dependencies.jar sha256:51dadead47a173c494c2fa4855b1e8bd3b54e702a2c4b5ed58e60153009ae218; android-34 platform android.jar sha256:6cea1df3efb77103ac3e2beb9bf4718964b0e0869ab16d39d29d5cbae1c147ad — FlowDroid 2.15.1 shipped SourcesAndSinks.txt catalog (extracted verbatim from the pinned soot-infoflow-cmd jar) and default summariesManual taint wrapper 12 new since v0.6.0
reports/flowdroid-kotlin-kernel.json 44bb26f4541c5d42b3be8cab06d47a7f29775bf273998f038166639489e66634 FlowDroid 2.15.1, build soot-infoflow-cmd-2.15.1-jar-with-dependencies.jar sha256:51dadead47a173c494c2fa4855b1e8bd3b54e702a2c4b5ed58e60153009ae218; android-34 platform android.jar sha256:6cea1df3efb77103ac3e2beb9bf4718964b0e0869ab16d39d29d5cbae1c147ad; dexed by D8 8.5.35 (build 2c176ec131a9edb97721fb8578b7fbb462376632 from go/r8bot (luci-r8-custom-ci-archive-0-gths)); r8 jar sha256:4733945987ee0a840fafc34080b135259e01678412e07212b23f706334290294 58 carried over
reports/infer-c-kernel.json 35a5f9de818f815fb4b682643a3f0f512784043ac0962c4c6e30e05abe19110c Infer v1.3.0, build infer:v1.3.0 bin-sha256:17ed4818dadda60124e083a1e82124f104092e70c5e6d764551581a375eabf62 48 carried over
reports/infer-cpp-kernel.json fc3b5fd70a89dbe9bd400c3a1f7d8eaf44f461fd02a1f3cf19264ec67cd98199 Infer v1.3.0, build infer:v1.3.0 bin-sha256:17ed4818dadda60124e083a1e82124f104092e70c5e6d764551581a375eabf62 56 carried over
reports/infer-java-kernel.json 9eb9d7ce745f88bf2e6eed406de14201ccc4db8e592a1c501f7294cca590bdf4 Infer v1.3.0, build infer:v1.3.0 bin-sha256:17ed4818dadda60124e083a1e82124f104092e70c5e6d764551581a375eabf62 58 carried over
reports/infer-java-modeling.json 8045827d04ddda46dd17d261468099f56e48471fe9ba7cd589d577913c1c4ec7 Infer v1.3.0, build infer:v1.3.0 bin-sha256:17ed4818dadda60124e083a1e82124f104092e70c5e6d764551581a375eabf62 24 new since v0.6.0
reports/infer-java-native.json ad6461b1b1fa5573f127fa1fb169e7ded76c4a0c30cf19aafc297e269a457ce2 Infer v1.3.0, build infer:v1.3.0 bin-sha256:17ed4818dadda60124e083a1e82124f104092e70c5e6d764551581a375eabf62 — v1.3.0 shipped Pulse checker, no taint configuration 12 new since v0.6.0
reports/joern-java-kernel.json 8f74bb4d958ba21cfc236a9382b4b67a09fc5ebfd16d71b7e8bc3a112f7b722e Joern 4.0.614, build joern-cli:4.0.614 58 carried over
reports/joern-java-modeling.json 21fb1d444a2db6dd5dbd8c1aba56abd2d728a1aa616f049a417ebc73e3fee7d8 Joern 4.0.614, build joern-cli:4.0.614 24 carried over
reports/joern-java-native.json a438c1ecdc09f23db4cdb14dea45fc99ba6658af4d9d887c9d7852e5d2ac2aa8 Joern 4.0.614, build joern-cli:4.0.614 — 4.0.614 DefaultSemantics only 12 carried over
reports/joern-javascript-kernel.json 9f54af854f6b0cdc864b8017c2ccd3ad9f3b2cf952e2376b4c988c60e90e9462 Joern 4.0.614, build joern-cli:4.0.614 58 carried over
reports/joern-javascript-modeling.json cd6372a8fc9b462a51a460e23d344103bae384fe92cbe4e37ce641686c265d36 Joern 4.0.614, build joern-cli:4.0.614 24 carried over
reports/joern-javascript-native.json b8f493cdb3761d9ee676bfac80ba0b83377750ef970d2d845a06107d4987ee44 Joern 4.0.614, build joern-cli:4.0.614 — 4.0.614 DefaultSemantics only 12 carried over
reports/joern-php-kernel.json 153d0fb50e2cbe7241aaf7eb6d1a5a5b092fb11c39bf9d0bdfc54838608bb4ed Joern 4.0.614, build joern-cli:4.0.614 58 carried over
reports/joern-python-kernel.json 811b6d11d5f9ecde11d4c1c35bef55efb62799984dce9ecc08a46317fd0ff50a Joern 4.0.614, build joern-cli:4.0.614 58 carried over
reports/joern-python-modeling.json 3e05499c361b7cf797281ab94cb5cc655d5ce306430a95b396f99c7b0f851e75 Joern 4.0.614, build joern-cli:4.0.614 24 carried over
reports/joern-python-native.json d7015cc6c9b14ee41ba7c05f547909c8b67a48df076d76c00758401ae4fb296e Joern 4.0.614, build joern-cli:4.0.614 — 4.0.614 DefaultSemantics only 12 carried over
reports/joern-ruby-kernel.json 9f2b18c4d168a3bf1b1c8c2adf885ac7416e247081a366980f144a683a27ea3b Joern 4.0.614, build joern-cli:4.0.614 58 carried over
reports/joern-rust-kernel.json 465269d73a072957b318fdac73768d5e4fb538ff9f3e31c007f88f6c96bcf055 Joern 4.0.614, build joern-cli:4.0.614 54 carried over
reports/opentaint-java-kernel.json de32158291e6ddb9e10f728aba7b2d2a3a39806fb4fa4870f8c27d9f97fbf7db OpenTaint analyzer/2026.08.27.17eb0fe, build opentaint-project-analyzer.jar sha256:811bdb22786e539c9aabdce5bef91f0c6521cc099adbe2720e6a840c09badf54; opentaint-models.tar.gz sha256:c2a8fb0bbc3b6d59ed6db0c62732ff9a6f0f491d515cc2247932f2dd78cbb9f5 58 carried over
reports/opentaint-java-modeling.json c5710db993b1557f8d1e96a1bd459cb6404a0d2ae74554bd83e2a945bd537805 OpenTaint analyzer/2026.08.27.17eb0fe, build opentaint-project-analyzer.jar sha256:811bdb22786e539c9aabdce5bef91f0c6521cc099adbe2720e6a840c09badf54; opentaint-models.tar.gz sha256:c2a8fb0bbc3b6d59ed6db0c62732ff9a6f0f491d515cc2247932f2dd78cbb9f5 24 new since v0.6.0
reports/opentaint-java-native.json 70525abc5a69f7dbb7354e393d864d0e0bf388be1888cc506670bf30ed345647 OpenTaint analyzer/2026.08.27.17eb0fe, build opentaint-project-analyzer.jar sha256:811bdb22786e539c9aabdce5bef91f0c6521cc099adbe2720e6a840c09badf54; opentaint-models.tar.gz sha256:c2a8fb0bbc3b6d59ed6db0c62732ff9a6f0f491d515cc2247932f2dd78cbb9f5 — analyzer/2026.08.27.17eb0fe shipped models archive only — no rule set 12 new since v0.6.0
reports/opentaint-kotlin-kernel.json 1fb872fea820eff6854141f77d883ef1312e1d498b0c4e850cbbe4788ce616ea OpenTaint analyzer/2026.08.27.17eb0fe, build opentaint-project-analyzer.jar sha256:811bdb22786e539c9aabdce5bef91f0c6521cc099adbe2720e6a840c09badf54; opentaint-models.tar.gz sha256:c2a8fb0bbc3b6d59ed6db0c62732ff9a6f0f491d515cc2247932f2dd78cbb9f5 58 carried over
reports/pysa-python-kernel.json 125faf9d9127b71b9b0d2b0d55229bdd26136c0e151fc2c2f555abcf500d609a Pysa 0.10.0, build pyre-check:0.10.0 pyre.bin-sha256:035a206349193dafdac70ec4020a992add5d88e60dee76163cf39ffb0b8fe8a3 pyrefly:1.2.0 pyrefly-sha256:6b460273720d857142be562d2c0c607e8ed8e5e752ab575b5c00ea3f735d8caa 58 carried over
reports/pysa-python-modeling.json 32155b8d129bc2bd34f5ddb52f72ffdb9a88c23425fca9994d154194f37e2dbb Pysa 0.10.0, build pyre-check:0.10.0 pyre.bin-sha256:035a206349193dafdac70ec4020a992add5d88e60dee76163cf39ffb0b8fe8a3 pyrefly:1.2.0 pyrefly-sha256:6b460273720d857142be562d2c0c607e8ed8e5e752ab575b5c00ea3f735d8caa 24 new since v0.6.0
reports/pysa-python-native.json c3ad2ee142ea248c4ecfd111dda9efc98b2c83972f68d4570d889d0946e4fbc2 Pysa 0.10.0, build pyre-check:0.10.0 pyre.bin-sha256:035a206349193dafdac70ec4020a992add5d88e60dee76163cf39ffb0b8fe8a3 pyrefly:1.2.0 pyrefly-sha256:6b460273720d857142be562d2c0c607e8ed8e5e752ab575b5c00ea3f735d8caa — Pysa (pyre-check 0.10.0 + Pyrefly 1.2.0) shipped taint model suite lib/pyre_check/taint with --no-verify (suite-sha256:1c2e41c525178d9f332e0b749ecedc5e4293fb570d0a0ab1708c41da7e49594c) 12 new since v0.6.0
reports/semgrep-c-kernel.json 5192f0b66650605bdbba4e1ec3e4d0e2da232490bdaca08a14434737dfb9bdc4 Semgrep CE 1.175.0, build semgrep-oss:1.175.0 48 carried over
reports/semgrep-cpp-kernel.json 40de77a28a692227d8081c113ef6b39a6c237da73aff74c7daee77a3b6f0544b Semgrep CE 1.175.0, build semgrep-oss:1.175.0 56 carried over
reports/semgrep-go-kernel.json 77d87ca7eee69d7b1384f0d09a32d82c7d5823023875d651c46338275906e961 Semgrep CE 1.175.0, build semgrep-oss:1.175.0 58 carried over
reports/semgrep-java-kernel.json 05ab32127cb788dd2b6d844015c00852a0c32cb50db6b8d5587a59cfbaa67189 Semgrep CE 1.175.0, build semgrep-oss:1.175.0 58 carried over
reports/semgrep-java-modeling.json 94a5eda43ab2aab5ab47b44e80907ab18dd4796a2f2a364bbac621d45cd19c63 Semgrep CE 1.175.0, build semgrep-oss:1.175.0 24 carried over
reports/semgrep-java-native.json f20ab62be7d8d3e4a6678ac07041d691b36d53ea66d8bb1c44fce4182dbb71d0 Semgrep CE 1.175.0, build semgrep-oss:1.175.0 — 1.175.0 over the pinned snapshot vendored from https://github.com/semgrep/semgrep-rules into adapters/semgrep/native/java 12 carried over
reports/semgrep-javascript-kernel.json ae4527e7a74c5d8f51d9549db95bd271b12f672a6d39f86adb71d4f9353f21f3 Semgrep CE 1.175.0, build semgrep-oss:1.175.0 58 carried over
reports/semgrep-javascript-modeling.json 5745951d82b9dacfb339ecc9aeb44af4975bf1162428b3a3d76cfb3e096739a7 Semgrep CE 1.175.0, build semgrep-oss:1.175.0 24 carried over
reports/semgrep-javascript-native.json 249bd7e020955ab8f181a04ce1b257fb4a72ed93ac7d4eabaec0b572331db0ac Semgrep CE 1.175.0, build semgrep-oss:1.175.0 — 1.175.0 over the pinned snapshot vendored from https://github.com/semgrep/semgrep-rules into adapters/semgrep/native/javascript 12 carried over
reports/semgrep-kotlin-kernel.json 3fd452bdb1b7ad0f2d310952bf04f64a1245e70cfef2e4f49c735d1798fd114e Semgrep CE 1.175.0, build semgrep-oss:1.175.0 58 carried over
reports/semgrep-php-kernel.json b04ee7111c66f3cab105ae0bf992495f59e86faf7153f08890a16650f712923e Semgrep CE 1.175.0, build semgrep-oss:1.175.0 58 carried over
reports/semgrep-python-kernel.json 6341e3f6321e2fa53b352f1a9afe39665ae4284190f2ab7257c709a23e952648 Semgrep CE 1.175.0, build semgrep-oss:1.175.0 58 carried over
reports/semgrep-python-modeling.json a269705d853a642979a357b9a03fd698cf2bc3e853c9afff1513e9c4b0001086 Semgrep CE 1.175.0, build semgrep-oss:1.175.0 24 carried over
reports/semgrep-python-native.json a0187f8a2fb1212c516ddf3095ee347f47e82eeaeb9c9a98dad1c58e513c8216 Semgrep CE 1.175.0, build semgrep-oss:1.175.0 — 1.175.0 over the pinned snapshot vendored from https://github.com/semgrep/semgrep-rules into adapters/semgrep/native/python 12 carried over
reports/semgrep-ruby-kernel.json deae3cd4a04bc9dbf9f5fb1d6e2d0c8dbdefd0e2b9c561a9f7544ce130097529 Semgrep CE 1.175.0, build semgrep-oss:1.175.0 58 carried over
reports/semgrep-rust-kernel.json 7b93011a586b390a0a212af70653b0c52a20dc1c535b5d9c1c78ac3ff14b36e7 Semgrep CE 1.175.0, build semgrep-oss:1.175.0 54 carried over
reports/semgrep-typescript-kernel.json 691658e531af76e919e418700e60067501e6a494f4057af36520b0d04b6a5ee6 Semgrep CE 1.175.0, build semgrep-oss:1.175.0 58 carried over

Reproduction

git checkout v0.6.1                # frozen benchmark revision (evidence commit)
# then check out the merge commit carrying reports/freeze.json for this release
cargo run -- validate-freeze reports/freeze.json
cargo run -- generate-results --manifest reports/freeze.json --output-directory results --check

Re-executing the Bifrost slices — which produces new evidence, and therefore a
new freeze, not this one:

for kernel in c cpp csharp go java javascript kotlin php python ruby rust scala typescript; do
  cargo run -- run-bifrost-$kernel-kernel --bifrost <bifrost-binary>
done
cargo run -- run-bifrost-smoke --bifrost <bifrost-binary>
for language in java javascript python; do
  cargo run -- run-bifrost-$language-modeling --bifrost <bifrost-binary>
  cargo run -- run-bifrost-$language-native --bifrost <bifrost-binary>
done

The other seven adapters' re-execution is unchanged from v0.6.0's; see
docs/releases/v0.6.0.md.

Immutability

This snapshot is immutable. Corrected evidence creates a new freeze with a new
release name and digests; the v0.1.0 through v0.6.0 manifests and evidence
remain available at their release commits for audit, including v0.6.0's
account of the java-direct disagreement that this release corrects. This
release has no DOI and no external review claim.