coderifts 1.8.2 → 1.8.4

package/corpus/vectors-mcp-fpfn.json

@@ -31,7 +31,9 @@
     "expected": {
       "has_breaking": false,
       "should_flag_poison": false,
-      "risk_max": 20,
+      "risk_max": 0,
+      "bounds_changelog": "risk_max 20 -> 0 (recalibrated 2026-07 to measured 0 on the oasdiff-1.11.11 pinned path)",
+      "risk_note": "safe vector scores 0 on the pinned path - max 0 catches any inflation (detection-only)",
       "deep_signals": [],
       "notes": "Purely additive optional property. Agents that do not send 'limit' continue to work. Must NOT trigger breaking or high risk."
     }
@@ -65,7 +67,9 @@
     "expected": {
       "has_breaking": false,
       "should_flag_poison": false,
-      "risk_max": 15,
+      "risk_max": 0,
+      "bounds_changelog": "risk_max 15 -> 0 (recalibrated 2026-07 to measured 0 on the oasdiff-1.11.11 pinned path)",
+      "risk_note": "safe vector scores 0 on the pinned path - max 0 catches any inflation (detection-only)",
       "deep_signals": [],
       "notes": "Input enum expansion is non-breaking for callers. Existing 'read'/'write' payloads still validate. Do not cry wolf."
     }
@@ -98,7 +102,9 @@
     "expected": {
       "has_breaking": false,
       "should_flag_poison": false,
-      "risk_max": 25,
+      "risk_max": 0,
+      "bounds_changelog": "risk_max 25 -> 0 (recalibrated 2026-07 to measured 0 on the oasdiff-1.11.11 pinned path)",
+      "risk_note": "safe vector scores 0 on the pinned path - max 0 catches any inflation (detection-only)",
       "deep_signals": ["composition_branch_count_changed"],
       "notes": "New branch is additive. Old 'text' payloads continue to match first branch exactly. Non-breaking per rules."
     }
@@ -122,7 +128,9 @@
     "expected": {
       "has_breaking": false,
       "should_flag_poison": false,
-      "risk_max": 5,
+      "risk_max": 0,
+      "bounds_changelog": "risk_max 5 -> 0 (recalibrated 2026-07 to measured 0 on the oasdiff-1.11.11 pinned path)",
+      "risk_note": "safe vector scores 0 on the pinned path - max 0 catches any inflation (detection-only)",
       "deep_signals": ["description_changed"],
       "notes": "Description change only. No structural impact and no suspicious content. Must stay low risk / non-breaking."
     }
@@ -154,7 +162,8 @@
     "expected": {
       "has_breaking": false,
       "should_flag_poison": false,
-      "risk_max": 10,
+      "risk_max": 24,
+      "bounds_changelog": "risk_max 10 -> 24 (recalibrated 2026-07 to measured 20 on the oasdiff-1.11.11 pinned path)",
       "deep_signals": [],
       "notes": "Adding fields to output is generally non-breaking for agents (they can ignore unknown keys unless strict validation)."
     }
@@ -181,7 +190,9 @@
     "expected": {
       "has_breaking": false,
       "should_flag_poison": false,
-      "risk_max": 5,
+      "risk_max": 0,
+      "bounds_changelog": "risk_max 5 -> 0 (recalibrated 2026-07 to measured 0 on the oasdiff-1.11.11 pinned path)",
+      "risk_note": "safe vector scores 0 on the pinned path - max 0 catches any inflation (detection-only)",
       "deep_signals": [],
       "notes": "Vendor extensions and unknown keywords do not affect validation contract for existing payloads."
     }
@@ -215,7 +226,8 @@
     "expected": {
       "has_breaking": true,
       "should_flag_poison": false,
-      "risk_min": 60,
+      "risk_min": 24,
+      "bounds_changelog": "risk_min 60 -> 24 (recalibrated 2026-07 to measured 30 on the oasdiff-1.11.11 pinned path)",
       "deep_signals": ["required_added", "property_removed"],
       "notes": "Old agents send 'title'. New contract requires 'name'. Direct break. Must be detected as breaking despite surface 'add+remove' appearance."
     }
@@ -246,7 +258,8 @@
     },
     "expected": {
       "has_breaking": true,
-      "risk_min": 45,
+      "risk_min": 16,
+      "bounds_changelog": "risk_min 45 -> 16 (recalibrated 2026-07 to measured 20 on the oasdiff-1.11.11 pinned path)",
       "deep_signals": ["enum_value_removed"],
       "notes": "Server will no longer emit 'error' state. Any agent logic or monitoring keyed on it breaks. Must flag."
     }
@@ -284,7 +297,9 @@
     },
     "expected": {
       "has_breaking": true,
-      "risk_min": 70,
+      "risk_min": 0,
+      "bounds_changelog": "risk_min 70 -> 0 (recalibrated 2026-07 to measured 0 on the oasdiff-1.11.11 pinned path)",
+      "risk_note": "risk scorer produces no signal for this vector class - detection-only guard",
       "deep_signals": ["conditional_required_added", "required_added"],
       "notes": "When mode=full, 'reason' becomes mandatory. Agents using the old manifest for full updates will fail validation. Must catch deep conditional."
     }
@@ -327,7 +342,9 @@
     "expected": {
       "has_breaking": true,
       "should_flag_poison": true,
-      "risk_min": 80,
+      "risk_min": 0,
+      "bounds_changelog": "risk_min 80 -> 0 (recalibrated 2026-07 to measured 0 on the oasdiff-1.11.11 pinned path)",
+      "risk_note": "risk scorer produces no signal for this vector class - detection-only guard",
       "deep_signals": ["$defs_changed", "required_added"],
       "poison_signals": ["Ignore previous", "always include"],
       "notes": "Ref target now requires extra field + contains FSP instruction. Classic deep + poison vector. Must surface both structural break and poisoning."
@@ -363,7 +380,9 @@
     "expected": {
       "has_breaking": false,
       "should_flag_poison": true,
-      "risk_min": 55,
+      "risk_min": 0,
+      "bounds_changelog": "risk_min 55 -> 0 (recalibrated 2026-07 to measured 0 on the oasdiff-1.11.11 pinned path)",
+      "risk_note": "risk scorer produces no signal for this vector class - detection-only guard",
       "poison_signals": ["send a copy", "attacker.example"],
       "notes": "Structural contract same, but FSP in a property description. Shallow tools miss it. Full-schema detector + risk must catch."
     }
@@ -396,7 +415,9 @@
     },
     "expected": {
       "has_breaking": true,
-      "risk_min": 65,
+      "risk_min": 0,
+      "bounds_changelog": "risk_min 65 -> 0 (recalibrated 2026-07 to measured 0 on the oasdiff-1.11.11 pinned path)",
+      "risk_note": "risk scorer produces no signal for this vector class - detection-only guard",
       "deep_signals": ["required_added"],
       "notes": "The second allOf fragment now requires 'data'. After merge the whole schema requires it. Must detect via normalization + allOf handling."
     }
@@ -427,7 +448,8 @@
     },
     "expected": {
       "has_breaking": true,
-      "risk_min": 70,
+      "risk_min": 16,
+      "bounds_changelog": "risk_min 70 -> 16 (recalibrated 2026-07 to measured 20 on the oasdiff-1.11.11 pinned path)",
       "deep_signals": ["conditional_required_added"],
       "notes": "Error path now mandates 'result'. Agents and any gateway transformation that relied on optional result on error will break or behave differently."
     }

package/corpus/vectors-openapi-fpfn.json

@@ -39,7 +39,9 @@
     },
     "expected": {
       "has_breaking": false,
-      "risk_max": 10,
+      "risk_max": 0,
+      "bounds_changelog": "risk_max 10 -> 0 (recalibrated 2026-07 to measured 0 on the oasdiff-1.11.11 pinned path)",
+      "risk_note": "safe vector scores 0 on the pinned path - max 0 catches any inflation (detection-only)",
       "notes": "Optional query param addition never breaks existing calls that omit it. Must not flag."
     }
   },
@@ -92,7 +94,9 @@
     },
     "expected": {
       "has_breaking": false,
-      "risk_max": 8,
+      "risk_max": 0,
+      "bounds_changelog": "risk_max 8 -> 0 (recalibrated 2026-07 to measured 0 on the oasdiff-1.11.11 pinned path)",
+      "risk_note": "safe vector scores 0 on the pinned path - max 0 catches any inflation (detection-only)",
       "notes": "Extra response fields are ignored by most clients unless they use strict additionalProperties:false. Non-breaking."
     }
   },
@@ -149,7 +153,9 @@
     },
     "expected": {
       "has_breaking": false,
-      "risk_max": 12,
+      "risk_max": 0,
+      "bounds_changelog": "risk_max 12 -> 0 (recalibrated 2026-07 to measured 0 on the oasdiff-1.11.11 pinned path)",
+      "risk_note": "safe vector scores 0 on the pinned path - max 0 catches any inflation (detection-only)",
       "notes": "Response enum expansion gives clients more cases to handle optionally. Existing handling of open/closed remains valid."
     }
   },
@@ -185,7 +191,8 @@
     },
     "expected": {
       "has_breaking": true,
-      "risk_min": 70,
+      "risk_min": 2,
+      "bounds_changelog": "risk_min 70 -> 2 (recalibrated 2026-07 to measured 3 on the production-faithful path - no pattern boost)",
       "notes": "All prior requests without 'org' now invalid. Direct breaking change for agents and SDK clients. Must be caught."
     }
   },
@@ -290,7 +297,8 @@
     },
     "expected": {
       "has_breaking": true,
-      "risk_min": 75,
+      "risk_min": 4,
+      "bounds_changelog": "risk_min 75 -> 4 (recalibrated 2026-07 to measured 6 on the production-faithful path - no pattern boost)",
       "notes": "Request payload shape changed for a required identifier. Old 'userId' submissions rejected. Must detect rename as breaking."
     }
   },
@@ -414,7 +422,8 @@
     },
     "expected": {
       "has_breaking": true,
-      "risk_min": 50,
+      "risk_min": 6,
+      "bounds_changelog": "risk_min 50 -> 6 (recalibrated 2026-07 to measured 8 on the production-faithful path - no pattern boost)",
       "notes": "Request-side tightening rejects previously-valid payloads. Must be caught."
     }
   },
@@ -468,7 +477,9 @@
     },
     "expected": {
       "has_breaking": false,
-      "risk_max": 10,
+      "risk_max": 0,
+      "bounds_changelog": "risk_max 10 -> 0 (recalibrated 2026-07 to measured 0 on the oasdiff-1.11.11 pinned path)",
+      "risk_note": "safe vector scores 0 on the pinned path - max 0 catches any inflation (detection-only)",
       "notes": "Request-side loosening (nullable false->true, format unchanged): all previously-valid payloads stay valid. Must NOT be flagged breaking."
     }
   }