Issues

The bare-name cross-package fabrication is ungated on the direct method-call paths (resolveMethodCall's fallback fires for b.view() and f := b.view; f() on a func-typed FIELD — filed from #746's review)

knostic/OpenAnt#781 · opened

on Oct 11, 2026

resolveSimpleCall's unqualified-name first-match-wins over map iteration flips //go:build-tagged edges (the #747 sibling class — filed from the #747 cycle's corpus control)

knostic/OpenAnt#777 · opened

on Oct 11, 2026

PHP and Ruby parsers consume call-graph edge lists unsorted — the #754 class (filed from #754's review; the sibling defect has no tracker)

knostic/OpenAnt#775 · opened

on Oct 10, 2026

Since the #716 retry rework, a Google 5xx reaches analyze's retry check as a dict with no status — the string path retried it, the dict path does not

knostic/OpenAnt#770 · opened

on Oct 8, 2026

The keep-all reachability-filter record diverges per producing path: warning and seed-class fields on the core Python path, a bare five-field record on five per-language pipelines, and no record at all on rust and zig

knostic/OpenAnt#768 · opened

on Oct 8, 2026

PR #672's body promised a composed-path regression test for init --pr; the PR shipped cmd/init.go only — the guard and the stamped-SHA fix are regression-unpinned

knostic/OpenAnt#767 · opened

on Oct 8, 2026

A stray pytest run log (runA-388b.log) is committed at the repo root — a deferred git-rm candidate named in PR #671's thread and never actioned

knostic/OpenAnt#766 · opened

on Oct 8, 2026

experiment.py crashes before saving results when print_summary reads the missing 'model' key

knostic/OpenAnt#761 · opened

on Oct 6, 2026

C parser: the call-graph edge lists are consumed unsorted, so inlined-dependency order varies with PYTHONHASHSEED and defeats the LR resume gate (17.8-21.4% of units re-run per resume) — the ordering repair split out of #724

knostic/OpenAnt#754 · opened

on Sep 27, 2026

Enhance resume accounting counts raw checkpoint-dir ids (dataset membership never checked) and never retires the errors it seeds — Done: 1825/1819, phase=done errors: 528 with zero errored checkpoints on disk

knostic/OpenAnt#748 · opened

on Sep 25, 2026

resolvePackageCall matches cross-package calls on the import's directory basename over a map-ordered candidate list — wrong-package edges, different across parses of the identical tree (21 edge flips; 107 units inlined a different callee body)

knostic/OpenAnt#747 · opened

on Sep 25, 2026

The Go call graph records no edge for method values held in struct-literal fields or named-func-type containers — the OpenBao handler idiom: 254 of 318 Callback handlers pruned with no caller in one scan (the AppRole login handler among them)

knostic/OpenAnt#746 · opened

on Sep 25, 2026

A delegation-dismissed SAFE row names its sink-owner only in prose — no consumer surface carries the edge, and when the sink-owner was pruned the finding evaporates (one executed chain; Stage 2 wrote 'a separate sink, not the target function' and nothing chased it)

knostic/OpenAnt#745 · opened

on Sep 25, 2026

The Stage-1 verdict vocabulary has no definitions in the prompt and INCONCLUSIVE's disposition contradicts itself across surfaces — manual-review-recommended (docs, HTML legend, remediation) while disclosure-dropped and never Stage-2-verified; a semantics ruling

knostic/OpenAnt#744 · opened

on Sep 25, 2026

1

A SAFE rationale can rest on a factually false claim about the code — the cassandra username template 'strips CQL-special chars' but no transform strips the quote character — and Stage 2 never re-examines SAFE rows

knostic/OpenAnt#743 · opened

on Sep 25, 2026

1

An all-incomplete enhancement phase still rolls up as status success — incomplete_count never derives a step status

knostic/OpenAnt#742 · opened

on Sep 25, 2026

The orphan-rate advisory divides by pruned units — in library mode it makes coverage look worse the better it works

knostic/OpenAnt#741 · opened

on Sep 25, 2026

Enhance exception-path spend never reaches AgentResult.cost_usd — per-unit costs under-count ~8-10% and the tracker and the report disagree

knostic/OpenAnt#740 · opened

on Sep 25, 2026

--limit N selects units by file-walk order, not analysis priority — a limited run silently measures the least interesting code

knostic/OpenAnt#739 · opened

on Sep 25, 2026

--library-mode is not auto-applied (or suggested) when app-context classifies the target as a library — the classification arrives after the filter already pruned the public API

knostic/OpenAnt#738 · opened

on Sep 25, 2026

Stage-1 confidence is a free 0-1 field with no rubric and no decision consumer, yet it ships to the report and CSV as stage1_confidence — across 213 Stage-2-verified findings it barely separates agreed from refuted (AUC 0.57) — define it, consume it, or drop it

knostic/OpenAnt#736 · opened

on Sep 25, 2026

(likely cosmetic) The UNSUPPORTED remedy says 'create a manual OPENANT.md override file' but not what it must contain — and seven near-miss override shapes are skipped silently (only a missing key inside a parsed fence warns)

knostic/OpenAnt#735 · opened

on Sep 25, 2026

Vendored and generated inputs in scan scope: .yarn is absent from all three directory skip lists and no parser recognises generated-code headers — one bundled Yarn binary became 2,410 LR units and 249 Stage-1 units on one run; SwiftPM manifests are a second exhibit (a cost/policy ruling, not a wrong output)

knostic/OpenAnt#734 · opened

on Sep 25, 2026

1

LR's 'unknown unit_id' skip label and counter describe out-of-batch ids as unknown — 113 of 210 campaign skips were real dataset units (likely cosmetic: no promotion was lost; 18/18 promotable skips were already reachable)

knostic/OpenAnt#733 · opened

on Sep 25, 2026

Dynamic-test single-container timeout kills the docker run client and leaves the container running — no --name/--cidfile, no docker kill; cleanup removes only image and network (the compose path tears down correctly)

knostic/OpenAnt#732 · opened

on Sep 25, 2026

1

Navigation Menu

Repository navigation

Issues

The bare-name cross-package fabrication is ungated on the direct method-call paths (resolveMethodCall's fallback fires for b.view() and f := b.view; f() on a func-typed FIELD — filed from #746's review)

resolveSimpleCall's unqualified-name first-match-wins over map iteration flips //go:build-tagged edges (the #747 sibling class — filed from the #747 cycle's corpus control)

PHP and Ruby parsers consume call-graph edge lists unsorted — the #754 class (filed from #754's review; the sibling defect has no tracker)

Since the #716 retry rework, a Google 5xx reaches analyze's retry check as a dict with no status — the string path retried it, the dict path does not

The keep-all reachability-filter record diverges per producing path: warning and seed-class fields on the core Python path, a bare five-field record on five per-language pipelines, and no record at all on rust and zig

PR #672's body promised a composed-path regression test for init --pr; the PR shipped cmd/init.go only — the guard and the stamped-SHA fix are regression-unpinned

A stray pytest run log (runA-388b.log) is committed at the repo root — a deferred git-rm candidate named in PR #671's thread and never actioned

experiment.py crashes before saving results when print_summary reads the missing 'model' key

C parser: the call-graph edge lists are consumed unsorted, so inlined-dependency order varies with PYTHONHASHSEED and defeats the LR resume gate (17.8-21.4% of units re-run per resume) — the ordering repair split out of #724

Enhance resume accounting counts raw checkpoint-dir ids (dataset membership never checked) and never retires the errors it seeds — Done: 1825/1819, phase=done errors: 528 with zero errored checkpoints on disk

resolvePackageCall matches cross-package calls on the import's directory basename over a map-ordered candidate list — wrong-package edges, different across parses of the identical tree (21 edge flips; 107 units inlined a different callee body)

The Go call graph records no edge for method values held in struct-literal fields or named-func-type containers — the OpenBao handler idiom: 254 of 318 Callback handlers pruned with no caller in one scan (the AppRole login handler among them)

A delegation-dismissed SAFE row names its sink-owner only in prose — no consumer surface carries the edge, and when the sink-owner was pruned the finding evaporates (one executed chain; Stage 2 wrote 'a separate sink, not the target function' and nothing chased it)

The Stage-1 verdict vocabulary has no definitions in the prompt and INCONCLUSIVE's disposition contradicts itself across surfaces — manual-review-recommended (docs, HTML legend, remediation) while disclosure-dropped and never Stage-2-verified; a semantics ruling

A SAFE rationale can rest on a factually false claim about the code — the cassandra username template 'strips CQL-special chars' but no transform strips the quote character — and Stage 2 never re-examines SAFE rows

An all-incomplete enhancement phase still rolls up as status success — incomplete_count never derives a step status

The orphan-rate advisory divides by pruned units — in library mode it makes coverage look worse the better it works

Enhance exception-path spend never reaches AgentResult.cost_usd — per-unit costs under-count ~8-10% and the tracker and the report disagree

--limit N selects units by file-walk order, not analysis priority — a limited run silently measures the least interesting code

--library-mode is not auto-applied (or suggested) when app-context classifies the target as a library — the classification arrives after the filter already pruned the public API

Stage-1 confidence is a free 0-1 field with no rubric and no decision consumer, yet it ships to the report and CSV as stage1_confidence — across 213 Stage-2-verified findings it barely separates agreed from refuted (AUC 0.57) — define it, consume it, or drop it

(likely cosmetic) The UNSUPPORTED remedy says 'create a manual OPENANT.md override file' but not what it must contain — and seven near-miss override shapes are skipped silently (only a missing key inside a parsed fence warns)

LR's 'unknown unit_id' skip label and counter describe out-of-batch ids as unknown — 113 of 210 campaign skips were real dataset units (likely cosmetic: no promotion was lost; 18/18 promotable skips were already reachable)

Dynamic-test single-container timeout kills the docker run client and leaves the container running — no --name/--cidfile, no docker kill; cleanup removes only image and network (the compose path tears down correctly)