glamsterdam-compat-lab 0.3.1 → 0.3.3

package/CONTRIBUTING.md

@@ -22,9 +22,9 @@ pnpm test:update
 
 Releases are published from semver tags. After CI is green on `main`, create the GitHub release tag, then run the manual `Publish npm` workflow from `main` with the release tag as `release_tag`.
 
-Start with `dry_run=true` for a new, unpublished release version. Real publishes use npm Trusted Publishing for `glamsterdam-compat-lab` with repository `CruzMolina/glamsterdam-compat-lab`, workflow file `npm-publish.yml`, and environment `npm-publish`. Do not configure `NPM_TOKEN` for the normal release path; use a short-lived token only as an emergency fallback, remove the GitHub secret immediately afterward, and revoke the npm token.
+Start with `dry_run=true` for a new, unpublished release version. Real publishes use npm Trusted Publishing for `glamsterdam-compat-lab` with repository `CruzMolina/glamsterdam-compat-lab`, workflow file `npm-publish.yml`, and environment `npm-publish`. Do not configure `NPM_TOKEN`; the release workflow is intentionally tokenless and grants OIDC only to the isolated publish job.
 
-The workflow checks out the requested semver tag, verifies that `package.json` matches the tag, installs dependencies, runs tests, builds, and then runs `npm publish --provenance`.
+The workflow checks out the requested semver tag in a read-only preflight job, verifies that `package.json` matches the tag, installs dependencies, runs tests, builds, packs the npm tarball, and uploads that tarball for the publish job. The publish job downloads the tarball and runs `npm publish --provenance` without dependency install, tests, or build steps.
 
 See `docs/release.md` for the full release checklist and npm troubleshooting notes.
 

package/README.md

@@ -36,14 +36,14 @@ pnpm glamsterdam scan-bytecode fixtures/bytecode/storage-heavy.hex
 Install the published CLI from npm:
 
 ```sh
-npm install -g glamsterdam-compat-lab@0.3.1
+npm install -g glamsterdam-compat-lab@0.3.3
 glamsterdam eips
 ```
 
-The v0.3.1 GitHub release tarball remains available as a reproducible release artifact:
+The v0.3.3 GitHub release tarball remains available as a reproducible release artifact:
 
 ```sh
-npm install -g https://github.com/CruzMolina/glamsterdam-compat-lab/releases/download/v0.3.1/glamsterdam-compat-lab-0.3.1.tgz
+npm install -g https://github.com/CruzMolina/glamsterdam-compat-lab/releases/download/v0.3.3/glamsterdam-compat-lab-0.3.3.tgz
 ```
 
 See [docs/release.md](docs/release.md) for maintainer release checks and npm publishing notes.
@@ -72,7 +72,9 @@ Each scanner accepts `--registry <path>` and `--thresholds <path>` so EIP metada
 
 ## Public dataset seed
 
-Fixture provenance lives in [fixtures/provenance.json](fixtures/provenance.json). The first deterministic dataset seed lives in [datasets/public-seed](datasets/public-seed) and includes generated JSON reports plus default-vs-research threshold comparisons for bytecode and trace fixtures.
+Fixture provenance lives in [fixtures/provenance.json](fixtures/provenance.json). The first deterministic dataset seed lives in [datasets/public-seed](datasets/public-seed) and includes generated JSON reports, default-vs-research threshold comparisons for bytecode and trace fixtures, a `summary.json` file with aggregate counts, and CSV exports (`reports.csv`, `findings.csv`, `summary.csv`) for spreadsheet and warehouse import.
+
+See [docs/dataset.md](docs/dataset.md) for the dataset file contract and [examples/public-seed-analysis.md](examples/public-seed-analysis.md) for lightweight analysis snippets.
 
 Regenerate it with:
 
@@ -121,7 +123,7 @@ Use `--trace-out <path>` to save the fetched JSON-RPC trace response while also
 
 `scan-indexer` parses JSON and YAML, including `subgraph.yaml`-style configs. It flags event-only indexing assumptions, missing fork/EIP compatibility metadata, missing replay or testnet plans, missing BAL review metadata, and native ETH transfer log readiness as heuristic findings.
 
-`scan-validator` parses JSON and YAML operator configs. It checks for execution, consensus, validator, builder/API, monitoring, and testnet/devnet metadata. It compares client names and versions against `data/client-compat/clients.example.json` or a user-provided matrix, but it does not guess compatibility.
+`scan-validator` parses JSON and YAML operator configs. It checks for execution, consensus, validator, builder/API, monitoring, and testnet/devnet metadata. It compares client names and versions against `data/client-compat/clients.example.json` or a user-provided matrix, but it does not guess compatibility. See [docs/client-compat.md](docs/client-compat.md) for the sourced matrix format.
 
 `compare-reports` accepts two saved JSON compatibility reports and emits deterministic JSON or Markdown deltas. It compares findings by stable finding ID, reports findings added, removed, changed, and unchanged, and highlights severity and confidence changes. It does not invent exact gas deltas; those must come from explicit input data or future client outputs.
 
@@ -131,7 +133,7 @@ Each scanner returns a `CompatibilityReport`:
 
 ```json
 {
-  "toolVersion": "0.3.1",
+  "toolVersion": "0.3.3",
   "fork": "glamsterdam",
   "target": {
     "kind": "bytecode",
@@ -219,7 +221,7 @@ Release publishing notes live in [docs/release.md](docs/release.md).
 
 ## Roadmap
 
-See [ROADMAP.md](ROADMAP.md) for planned phases. Phase 0 is released as `v0.1.0`; `v0.2.0` starts Phase 1 with RPC transaction trace ingestion and broader trace fixture coverage; `v0.3.0` adds baseline comparison reports; `v0.3.1` expands public-safe fixture and dataset coverage.
+See [ROADMAP.md](ROADMAP.md) for planned phases. Phase 0 is released as `v0.1.0`; `v0.2.0` starts Phase 1 with RPC transaction trace ingestion and broader trace fixture coverage; `v0.3.0` adds baseline comparison reports; `v0.3.1` expands public-safe fixture and dataset coverage; `v0.3.2` adds packaged CSV dataset exports; `v0.3.3` adds additional public Geth and Reth trace fixture coverage.
 
 ## Disclaimer
 

package/ROADMAP.md

@@ -52,7 +52,7 @@ Goal: compare compatibility reports across profiles and, later, across current-c
 
 ## Phase 2: Public Dataset
 
-Status: seeded after `v0.3.0`; expanded with public-safe trace, indexer, and validator fixture coverage in `v0.3.1`.
+Status: seeded after `v0.3.0`; expanded with public-safe trace, indexer, and validator fixture coverage in `v0.3.1`; packaged CSV exports added in `v0.3.2`; additional public Geth and Reth trace fixtures added in `v0.3.3`.
 
 Goal: publish reproducible compatibility research.
 

package/data/client-compat/clients.example.json

@@ -1,8 +1,38 @@
 {
   "fork": "glamsterdam",
-  "lastUpdated": "2026-05-08",
+  "lastUpdated": "2026-05-12",
   "sources": [
-    "Replace with client release notes, devnet pages, or operator-maintained compatibility sources."
+    {
+      "type": "public-interop-recap",
+      "url": "https://blog.ethereum.org/2026/05/02/soldogn-interop-recap",
+      "sourceDate": "2026-05-02",
+      "retrievedAt": "2026-05-12",
+      "claim": "The Ethereum Foundation Soldogn recap says the week ended with a stable multi-client Glamsterdam devnet running the latest ePBS, repricing, and block access list specs, and that nearly all clients were running together on glamsterdam-devnet-2 with the external builders pipeline tested end-to-end.",
+      "notes": "This source supports devnet/interoperability context, not production release compatibility."
+    },
+    {
+      "type": "public-devnet-spec",
+      "url": "https://notes.ethereum.org/@ethpandaops/glamsterdam-devnet-2",
+      "retrievedAt": "2026-05-12",
+      "claim": "The EthPandaOps glamsterdam-devnet-2 spec lists a Kurtosis participants matrix with geth as the execution client image and prysm, lodestar, lighthouse, teku, nimbus, and grandine as consensus client images.",
+      "notes": "This source supports devnet participant examples. It does not claim mainnet-ready client releases."
+    },
+    {
+      "type": "public-spec-release",
+      "url": "https://github.com/ethereum/consensus-specs/releases/tag/v1.7.0-alpha.7",
+      "sourceDate": "2026-04-29",
+      "retrievedAt": "2026-05-12",
+      "claim": "The consensus-specs v1.7.0-alpha.7 release is a pre-release containing Gloas changes used by the glamsterdam-devnet-2 spec.",
+      "notes": "Spec release metadata is useful provenance for devnet test entries, but is not a client release."
+    },
+    {
+      "type": "public-spec-release",
+      "url": "https://github.com/ethereum/execution-spec-tests/releases/tag/bal%40v5.6.1",
+      "sourceDate": "2026-04-02",
+      "retrievedAt": "2026-05-12",
+      "claim": "The execution-spec-tests bal@v5.6.1 pre-release is labeled for bal-devnet-3 v7 and includes BAL/state-gas test updates referenced by the glamsterdam-devnet-2 spec.",
+      "notes": "Spec-test release metadata is useful provenance for devnet test entries, but is not a client release."
+    }
   ],
   "clients": [
     {
@@ -12,12 +42,46 @@
         {
           "version": "0.0.0-example",
           "status": "unknown",
+          "source": {
+            "type": "synthetic-example",
+            "url": "https://github.com/CruzMolina/glamsterdam-compat-lab/blob/main/data/client-compat/clients.example.json",
+            "retrievedAt": "2026-05-12",
+            "claim": "Synthetic unknown status used to exercise matrix behavior when no sourced compatibility statement exists."
+          },
           "notes": "Placeholder only. Replace with a sourced compatibility statement before relying on this matrix."
         },
         {
           "version": "1.0.0-compatible",
           "status": "compatible",
+          "source": {
+            "type": "synthetic-example",
+            "url": "https://github.com/CruzMolina/glamsterdam-compat-lab/blob/main/data/client-compat/clients.example.json",
+            "retrievedAt": "2026-05-12",
+            "claim": "Synthetic compatible status used by safe fixture variants to exercise clean scanner paths."
+          },
           "notes": "Synthetic compatible status used by safe fixture variants; do not treat as a real client release."
+        },
+        {
+          "version": "1.1.0-partial",
+          "status": "partial",
+          "source": {
+            "type": "synthetic-example",
+            "url": "https://github.com/CruzMolina/glamsterdam-compat-lab/blob/main/data/client-compat/clients.example.json",
+            "retrievedAt": "2026-05-12",
+            "claim": "Synthetic partial status used to exercise scanner behavior for incomplete readiness."
+          },
+          "notes": "Synthetic partial status for tests and examples only."
+        },
+        {
+          "version": "2.0.0-incompatible",
+          "status": "incompatible",
+          "source": {
+            "type": "synthetic-example",
+            "url": "https://github.com/CruzMolina/glamsterdam-compat-lab/blob/main/data/client-compat/clients.example.json",
+            "retrievedAt": "2026-05-12",
+            "claim": "Synthetic incompatible status used to exercise scanner behavior for blocking readiness findings."
+          },
+          "notes": "Synthetic incompatible status for tests and examples only."
         }
       ]
     },
@@ -28,12 +92,46 @@
         {
           "version": "0.0.0-example",
           "status": "unknown",
+          "source": {
+            "type": "synthetic-example",
+            "url": "https://github.com/CruzMolina/glamsterdam-compat-lab/blob/main/data/client-compat/clients.example.json",
+            "retrievedAt": "2026-05-12",
+            "claim": "Synthetic unknown status used to exercise matrix behavior when no sourced compatibility statement exists."
+          },
           "notes": "Placeholder only. Replace with a sourced compatibility statement before relying on this matrix."
         },
         {
           "version": "1.0.0-compatible",
           "status": "compatible",
+          "source": {
+            "type": "synthetic-example",
+            "url": "https://github.com/CruzMolina/glamsterdam-compat-lab/blob/main/data/client-compat/clients.example.json",
+            "retrievedAt": "2026-05-12",
+            "claim": "Synthetic compatible status used by safe fixture variants to exercise clean scanner paths."
+          },
           "notes": "Synthetic compatible status used by safe fixture variants; do not treat as a real client release."
+        },
+        {
+          "version": "1.1.0-partial",
+          "status": "partial",
+          "source": {
+            "type": "synthetic-example",
+            "url": "https://github.com/CruzMolina/glamsterdam-compat-lab/blob/main/data/client-compat/clients.example.json",
+            "retrievedAt": "2026-05-12",
+            "claim": "Synthetic partial status used to exercise scanner behavior for incomplete readiness."
+          },
+          "notes": "Synthetic partial status for tests and examples only."
+        },
+        {
+          "version": "2.0.0-incompatible",
+          "status": "incompatible",
+          "source": {
+            "type": "synthetic-example",
+            "url": "https://github.com/CruzMolina/glamsterdam-compat-lab/blob/main/data/client-compat/clients.example.json",
+            "retrievedAt": "2026-05-12",
+            "claim": "Synthetic incompatible status used to exercise scanner behavior for blocking readiness findings."
+          },
+          "notes": "Synthetic incompatible status for tests and examples only."
         }
       ]
     },
@@ -44,14 +142,201 @@
         {
           "version": "0.0.0-example",
           "status": "unknown",
+          "source": {
+            "type": "synthetic-example",
+            "url": "https://github.com/CruzMolina/glamsterdam-compat-lab/blob/main/data/client-compat/clients.example.json",
+            "retrievedAt": "2026-05-12",
+            "claim": "Synthetic unknown status used to exercise matrix behavior when no sourced compatibility statement exists."
+          },
           "notes": "Placeholder only. Replace with a sourced compatibility statement before relying on this matrix."
         },
         {
           "version": "1.0.0-compatible",
           "status": "compatible",
+          "source": {
+            "type": "synthetic-example",
+            "url": "https://github.com/CruzMolina/glamsterdam-compat-lab/blob/main/data/client-compat/clients.example.json",
+            "retrievedAt": "2026-05-12",
+            "claim": "Synthetic compatible status used by safe fixture variants to exercise clean scanner paths."
+          },
           "notes": "Synthetic compatible status used by safe fixture variants; do not treat as a real client release."
+        },
+        {
+          "version": "1.1.0-partial",
+          "status": "partial",
+          "source": {
+            "type": "synthetic-example",
+            "url": "https://github.com/CruzMolina/glamsterdam-compat-lab/blob/main/data/client-compat/clients.example.json",
+            "retrievedAt": "2026-05-12",
+            "claim": "Synthetic partial status used to exercise scanner behavior for incomplete readiness."
+          },
+          "notes": "Synthetic partial status for tests and examples only."
+        },
+        {
+          "version": "2.0.0-incompatible",
+          "status": "incompatible",
+          "source": {
+            "type": "synthetic-example",
+            "url": "https://github.com/CruzMolina/glamsterdam-compat-lab/blob/main/data/client-compat/clients.example.json",
+            "retrievedAt": "2026-05-12",
+            "claim": "Synthetic incompatible status used to exercise scanner behavior for blocking readiness findings."
+          },
+          "notes": "Synthetic incompatible status for tests and examples only."
+        }
+      ]
+    },
+    {
+      "name": "geth",
+      "role": "execution",
+      "versions": [
+        {
+          "version": "ethpandaops/geth:bal-devnet-6",
+          "status": "partial",
+          "source": {
+            "type": "public-devnet-spec",
+            "url": "https://notes.ethereum.org/@ethpandaops/glamsterdam-devnet-2",
+            "retrievedAt": "2026-05-12",
+            "claim": "The glamsterdam-devnet-2 Kurtosis example lists geth with image ethpandaops/geth:bal-devnet-6 as the execution-layer participant."
+          },
+          "notes": "Devnet image only. This is not a production Geth release compatibility claim."
+        }
+      ]
+    },
+    {
+      "name": "lighthouse",
+      "role": "consensus",
+      "versions": [
+        {
+          "version": "ethpandaops/lighthouse:glamsterdam-devnet-3",
+          "status": "partial",
+          "source": {
+            "type": "public-devnet-spec",
+            "url": "https://notes.ethereum.org/@ethpandaops/glamsterdam-devnet-2",
+            "retrievedAt": "2026-05-12",
+            "claim": "The glamsterdam-devnet-2 Kurtosis example lists lighthouse with image ethpandaops/lighthouse:glamsterdam-devnet-3 as a consensus-layer participant."
+          },
+          "notes": "Devnet image only. This is not a production Lighthouse release compatibility claim."
+        }
+      ]
+    },
+    {
+      "name": "teku",
+      "role": "consensus",
+      "versions": [
+        {
+          "version": "ethpandaops/teku:glamsterdam-devnet-2",
+          "status": "partial",
+          "source": {
+            "type": "public-devnet-spec",
+            "url": "https://notes.ethereum.org/@ethpandaops/glamsterdam-devnet-2",
+            "retrievedAt": "2026-05-12",
+            "claim": "The glamsterdam-devnet-2 Kurtosis example lists teku with image ethpandaops/teku:glamsterdam-devnet-2 as a consensus-layer participant."
+          },
+          "notes": "Devnet image only. This is not a production Teku release compatibility claim."
         }
       ]
     }
+  ],
+  "devnets": [
+    {
+      "name": "glamsterdam-devnet-2",
+      "status": "partial",
+      "source": {
+        "type": "public-devnet-spec",
+        "url": "https://notes.ethereum.org/@ethpandaops/glamsterdam-devnet-2",
+        "retrievedAt": "2026-05-12",
+        "claim": "The glamsterdam-devnet-2 spec targets launch on 2026-04-30 and includes a Kurtosis participants matrix with specific EL and CL devnet images."
+      },
+      "participants": [
+        {
+          "role": "execution",
+          "name": "geth",
+          "image": "ethpandaops/geth:bal-devnet-6",
+          "status": "partial",
+          "notes": "Listed as the execution-layer participant image in the public devnet spec."
+        },
+        {
+          "role": "consensus",
+          "name": "prysm",
+          "image": "ethpandaops/prysm-beacon-chain:glamsterdam-devnet-3-minimal",
+          "status": "partial",
+          "notes": "Listed as a consensus-layer participant image in the public devnet spec."
+        },
+        {
+          "role": "consensus",
+          "name": "lodestar",
+          "image": "ethpandaops/lodestar:glamsterdam-devnet-2",
+          "status": "partial",
+          "notes": "Listed as a consensus-layer participant image in the public devnet spec."
+        },
+        {
+          "role": "consensus",
+          "name": "lighthouse",
+          "image": "ethpandaops/lighthouse:glamsterdam-devnet-3",
+          "status": "partial",
+          "notes": "Listed as a consensus-layer participant image in the public devnet spec."
+        },
+        {
+          "role": "consensus",
+          "name": "teku",
+          "image": "ethpandaops/teku:glamsterdam-devnet-2",
+          "status": "partial",
+          "notes": "Listed as a consensus-layer participant image in the public devnet spec."
+        },
+        {
+          "role": "consensus",
+          "name": "nimbus",
+          "image": "ethpandaops/nimbus-eth2:glamsterdam-devnet-2-minimal",
+          "status": "partial",
+          "notes": "Listed as a consensus-layer participant image in the public devnet spec."
+        },
+        {
+          "role": "consensus",
+          "name": "grandine",
+          "image": "ethpandaops/grandine:glamsterdam-devnet-2-minimal",
+          "status": "partial",
+          "notes": "Listed as a consensus-layer participant image in the public devnet spec."
+        }
+      ],
+      "specVersions": [
+        {
+          "name": "consensus-specs",
+          "version": "v1.7.0-alpha.7",
+          "source": {
+            "type": "public-spec-release",
+            "url": "https://github.com/ethereum/consensus-specs/releases/tag/v1.7.0-alpha.7",
+            "sourceDate": "2026-04-29",
+            "retrievedAt": "2026-05-12",
+            "claim": "The consensus-specs v1.7.0-alpha.7 release is a pre-release containing Gloas changes used by the glamsterdam-devnet-2 spec."
+          }
+        },
+        {
+          "name": "execution-spec-tests",
+          "version": "bal@v5.6.1",
+          "source": {
+            "type": "public-spec-release",
+            "url": "https://github.com/ethereum/execution-spec-tests/releases/tag/bal%40v5.6.1",
+            "sourceDate": "2026-04-02",
+            "retrievedAt": "2026-05-12",
+            "claim": "The execution-spec-tests bal@v5.6.1 pre-release is labeled for bal-devnet-3 v7 and includes BAL/state-gas test updates referenced by the glamsterdam-devnet-2 spec."
+          }
+        }
+      ],
+      "notes": "Devnet participation is tracked as partial readiness. Production release compatibility must come from client release notes or other explicit public statements."
+    },
+    {
+      "name": "soldogn-interop",
+      "status": "stable-multi-client-devnet-reported",
+      "source": {
+        "type": "public-interop-recap",
+        "url": "https://blog.ethereum.org/2026/05/02/soldogn-interop-recap",
+        "sourceDate": "2026-05-02",
+        "retrievedAt": "2026-05-12",
+        "claim": "The Ethereum Foundation Soldogn recap reports a stable multi-client Glamsterdam devnet running the latest ePBS, repricing, and block access list specs, with nearly all clients running together on glamsterdam-devnet-2 by Friday."
+      },
+      "participants": [],
+      "specVersions": [],
+      "notes": "Interop recap is useful context for the matrix, but this entry intentionally avoids per-client production compatibility claims."
+    }
   ]
 }

package/datasets/public-seed/README.md

@@ -7,6 +7,10 @@ The seed is intentionally small. It is meant to prove the dataset workflow, not
 ## Contents
 
 - `manifest.json`: index of generated reports, comparisons, source fixtures, threshold profiles, and limitations.
+- `summary.json`: aggregate counts by fixture kind, source type, report risk, threshold profile, and finding ID.
+- `reports.csv`: flat index of generated reports for spreadsheet and warehouse import.
+- `findings.csv`: one row per generated report finding, including severity, confidence, domains, and related EIPs.
+- `summary.csv`: flattened aggregate totals and counts from `summary.json`.
 - `reports/`: JSON compatibility reports generated from source fixtures.
 - `comparisons/`: JSON comparison reports for default-vs-research threshold profiles on bytecode and trace fixtures.
 

package/datasets/public-seed/comparisons/bytecode-ens-registry-mainnet-runtime--default-vs-research.json

@@ -0,0 +1,136 @@
+{
+  "toolVersion": "0.3.3",
+  "fork": "glamsterdam",
+  "comparison": {
+    "baseline": {
+      "toolVersion": "0.3.3",
+      "fork": "glamsterdam",
+      "target": {
+        "kind": "bytecode",
+        "name": "fixtures/bytecode/ens-registry-mainnet-runtime.hex"
+      },
+      "summary": {
+        "risk": "medium",
+        "findingCount": 4,
+        "highCount": 0,
+        "mediumCount": 2,
+        "lowCount": 1,
+        "unknownCount": 1
+      }
+    },
+    "candidate": {
+      "toolVersion": "0.3.3",
+      "fork": "glamsterdam",
+      "target": {
+        "kind": "bytecode",
+        "name": "fixtures/bytecode/ens-registry-mainnet-runtime.hex"
+      },
+      "summary": {
+        "risk": "medium",
+        "findingCount": 4,
+        "highCount": 0,
+        "mediumCount": 2,
+        "lowCount": 1,
+        "unknownCount": 1
+      }
+    }
+  },
+  "summary": {
+    "riskChange": {
+      "from": "medium",
+      "to": "medium",
+      "direction": "unchanged"
+    },
+    "findingCount": {
+      "baseline": 4,
+      "candidate": 4,
+      "delta": 0
+    },
+    "addedCount": 0,
+    "removedCount": 0,
+    "changedCount": 0,
+    "unchangedCount": 4,
+    "severityIncreasedCount": 0,
+    "severityDecreasedCount": 0,
+    "severityChangedCount": 0,
+    "confidenceIncreasedCount": 0,
+    "confidenceDecreasedCount": 0,
+    "confidenceChangedCount": 0
+  },
+  "changes": {
+    "added": [],
+    "removed": [],
+    "changed": [],
+    "unchanged": [
+      {
+        "key": "bytecode.log-opcodes-present",
+        "id": "bytecode.log-opcodes-present",
+        "title": "Log opcodes are present",
+        "severity": "low",
+        "confidence": "medium",
+        "domain": [
+          "contracts",
+          "indexer",
+          "monitoring"
+        ],
+        "relatedEips": [
+          "EIP-7708"
+        ]
+      },
+      {
+        "key": "bytecode.manual-review-required",
+        "id": "bytecode.manual-review-required",
+        "title": "Manual review is still required for runtime behavior",
+        "severity": "unknown",
+        "confidence": "low",
+        "domain": [
+          "contracts",
+          "execution"
+        ],
+        "relatedEips": [
+          "GAS-REPRICING"
+        ]
+      },
+      {
+        "key": "bytecode.state-account-opcode-exposure",
+        "id": "bytecode.state-account-opcode-exposure",
+        "title": "State and account access opcodes are prominent in bytecode",
+        "severity": "medium",
+        "confidence": "medium",
+        "domain": [
+          "contracts",
+          "execution"
+        ],
+        "relatedEips": [
+          "GAS-REPRICING",
+          "EIP-7904",
+          "EIP-8038",
+          "EIP-7976"
+        ]
+      },
+      {
+        "key": "bytecode.storage-heavy-pattern",
+        "id": "bytecode.storage-heavy-pattern",
+        "title": "Storage-related opcodes appear frequently",
+        "severity": "medium",
+        "confidence": "medium",
+        "domain": [
+          "contracts",
+          "execution"
+        ],
+        "relatedEips": [
+          "GAS-REPRICING",
+          "EIP-8038"
+        ]
+      }
+    ]
+  },
+  "assumptions": [
+    "Reports were compared by finding id. Repeated finding ids are disambiguated with deterministic occurrence suffixes.",
+    "Severity and confidence changes are structural report changes, not protocol gas estimates."
+  ],
+  "limitations": [
+    "The comparison does not infer exact gas deltas, final Glamsterdam parameters, or current-vs-Glamsterdam client behavior unless those values are already present in the input reports.",
+    "Added and removed findings can reflect threshold profile differences, fixture coverage changes, registry updates, or detector changes; review the source reports before treating a diff as a protocol risk change."
+  ]
+}