[aviggiano]

Summary

• pin the immutable Web3 vulnerability database v0.0.2 commit (74c2a5114b7adbd208eb49e47c137daa49b4a395)
• retain schema-v1 Markdown compatibility while validating schema-v3 YAML records, capability replacements, protocol types, and typed detection steps
• preserve exact selected YAML snapshots while mapping detection.strategy into planner guidance
• forward-sync current main fixes into release/v0.1.0 only; this does not merge the release branch into main

Validation

• pnpm validate:release (overall_status: pass; all 11 commands passed)
• Node runtime: 588 tests accounted for, 572 passed and 16 expected skips
• Bun generated adapters: 14 passed
• real v0.0.2 checkout and fresh anonymous materialization passed
• git diff --check

Closes #440

Greptile Summary

The PR updates the pinned Web3 vulnerability database to its immutable v0.0.2 commit and extends the reference pipeline to validate and preserve the newer YAML records. It also strengthens artifact provenance, workspace-patch handoffs, eval ground-truth handling, Modal execution, runtime gates, prompts, schemas, tests, and related documentation.

• Adds schema-v3 vulnerability-record, capability, protocol-type, and typed detection-step support while retaining schema-v1 Markdown compatibility.
• Tightens finding, property-campaign, backend-deduplication, report-provenance, and workspace-patch contracts.
• Expands runtime verification and safe workspace handoff behavior, with corresponding generated-workflow and artifact-gate tests.
• Updates eval and Modal lineage/ground-truth behavior and documents the resulting reference and invariant workflows.

Confidence Score: 5/5

The PR appears safe to merge; no concrete blocking or independently actionable changed-code issue was identified.

The updated reference parser, artifact contracts, provenance gates, workspace handoff logic, eval integration, and Modal execution remain coordinated across their producers, consumers, prompts, schemas, and focused tests.

Important Files Changed

Filename	Overview
packages/references/src/vulnerability-database.ts	Extends vulnerability database parsing and catalog generation for schema-v3 YAML records, capability replacements, protocol types, typed detection steps, and exact source snapshots; no actionable defect was established.
packages/runtime/src/artifact-gates.ts	Adds extensive cross-artifact validation for property implementation, backend failure deduplication, provenance, and final reports, supported by broad focused tests.
packages/runtime/src/workspace-handoff.ts	Strengthens workspace patch capture, size handling, path validation, tree verification, and apply behavior; investigated edge cases did not establish a reachable changed-code failure.
packages/artifacts/src/property-provenance.ts	Introduces stricter implemented-property and campaign provenance validation aligned with the updated prompts and runtime gates.
packages/artifacts/src/findings-schema.ts	Adds normalized severity, strategy provenance, backend provenance, and deduplication fields to the canonical findings contract.
packages/evals/src/ground-truth.ts	Adds centralized ground-truth checkout and path validation behavior used by local and Modal eval paths.
packages/modal/src/worker.ts	Updates remote worker setup and execution to use the revised ground-truth and durable-run behavior without an identified correctness regression.
packages/runtime/src/templates/smithers/workflows/workflow.tsx	Integrates verified workspace-patch preparation, replay, restoration, and artifact capture into generated workflows.
.ultrafuzz/references.yml	Pins the Web3 vulnerability database to immutable commit 74c2a5114b7adbd208eb49e47c137daa49b4a395.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A["Pinned vulnerability DB v0.0.2"] --> B["Reference sync and digest verification"]
  B --> C["Schema-v1 Markdown / schema-v3 YAML parsing"]
  C --> D["Planner catalog and exact selected snapshots"]
  D --> E["Runtime artifact gates"]
  E --> F["Campaign findings and provenance"]
  F --> G["Final report and eval scoring"]

Loading

_{Reviews (1): Last reviewed commit: "fix(references): support vulnerability d..." | Re-trigger Greptile}

Context used (5)

• Knowledge Base — Artifacts
• Knowledge Base — References
• Knowledge Base — Runtime: Run Orchestration Lifecycle
• Knowledge Base — Evals
• Knowledge Base — Modal remote benchmark execution