From ac20cf3a3df0eccc914b8dfa93be9c408b2d3b8b Mon Sep 17 00:00:00 2001 From: Victor Kuznetsov Date: Mon, 20 Jul 2026 11:10:12 -0700 Subject: [PATCH] Record open defects, unrun verification tiers and the stale torch triage Co-Authored-By: Claude Opus 4.8 --- docs/release-and-distribution.md | 2 +- docs/verification-plan.md | 40 ++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 1 deletion(-) diff --git a/docs/release-and-distribution.md b/docs/release-and-distribution.md index d8c4423..ba98c9f 100644 --- a/docs/release-and-distribution.md +++ b/docs/release-and-distribution.md @@ -35,4 +35,4 @@ The standing `uv-secure` gate in `maintain.sh` is clean; this is the changelog o - **idna** bumped 3.11 -> 3.16, fixing GHSA-65pc-fj4g-8rjx. - **aiohttp** bumped 3.13.5 -> 3.14.0 via `uv lock --upgrade-package aiohttp`, fixing GHSA-hg6j-4rv6-33pg + GHSA-jg22-mg44-37j8. - **basicsr** Dependabot alert GHSA-86w8-vhw6-q9qq is resolved by removal: the experimental `restore` extra was retired and basicsr is no longer anywhere in the dependency tree. -- **torch** Dependabot alert **GHSA-rrmf-rvhw-rf47** (`torch.jit.script` memory corruption, vulnerable `<= 2.12.0`) is **dismissed as `not_used`** (2026-06-10): torch is a transitive dep of the optional `gpu` extra only, the codebase never calls `torch.jit` (grep-verified), and **no patched torch version exists** (`first_patched_version` is null), so it cannot be closed by an upgrade — do not re-triage it. +- **torch** Dependabot alert **GHSA-rrmf-rvhw-rf47** (`torch.jit.script` memory corruption, vulnerable `<= 2.12.0`) is **dismissed as `not_used`** (2026-06-10): torch is a transitive dep of the optional `gpu` extra only, the codebase never calls `torch.jit` (grep-verified), and **no patched torch version exists** (`first_patched_version` is null), so at the time it could not be closed by an upgrade. **Superseded 2026-07-20:** a patched **torch 2.13.0** now exists and the alert range moved to `<= 2.12.1`, so the "no patched version" half of that reasoning is gone -- the alert is open again and needs either a bump or a re-dismissal on the `not_used` grounds alone. See the open-items table in `docs/verification-plan.md`. diff --git a/docs/verification-plan.md b/docs/verification-plan.md index acab963..1baafe3 100644 --- a/docs/verification-plan.md +++ b/docs/verification-plan.md @@ -488,6 +488,46 @@ bug (`scale_basis`) directly. This section records what the measurements imply technically. Prioritization is tracked separately, outside this repo. +## Open items (as of 2026-07-20) + +Everything below is known, measured, and deliberately not done yet. Each line says what it +would take, so none of it has to be rediscovered. + +### Defects + +| # | Defect | Measured impact | What the fix takes | +|---|---|---|---| +| 1 | 16-bit PNGs are downconverted to 8-bit by a metadata strip | 42 of 27,018 corpus PNGs (0.16%); one went 9.2 MB -> 2.5 MB | a byte-level PNG chunk stripper, so the PIL re-save is skipped entirely | +| 2 | Exit code 2 means three different things (no visible mark / no invisible signal / Click usage error) | any wrapper must parse stderr to tell them apart | split the codes; **breaking for existing wrappers**, so it needs a deliberate call | +| 3 | `visible_removal_audit.py` measures the UNGATED per-mark path | reports the pill at 32% where the product runs at 100% precision | teach it the product path (`remove_auto_marks`) for gated marks, or at minimum say so loudly in its docstring | + +### Dependency alert + +`GHSA-rrmf-rvhw-rf47` (torch, `torch.jit.script` memory corruption) is open again and +**the reason it was dismissed no longer holds**. It was dismissed `not_used` on 2026-06-10 +partly because no patched version existed; a patched **torch 2.13.0** now does, and the +current alert range is `<= 2.12.1`. `docs/release-and-distribution.md` still says "no +patched torch version exists -- do not re-triage it", which is now stale. Either bump torch +(it is transitive from the optional `gpu` extra) or re-dismiss on the remaining grounds +(the codebase never calls `torch.jit`, grep-verified) and correct that note. + +### Verification tiers not run + +- **B2 detector response curves** -- recall as a function of size, contrast and background + texture on stamped marks. No labelling needed. +- **B4 resource ceilings** -- peak RSS and wall time per backend x input size to 25 MP. +- **E robustness** -- truncated, corrupt, absurd dimensions, decompression bombs, unicode + and RTL filenames, read-only output dirs, concurrent runs on one file. +- **C recall expansion** -- gated by labelling appetite. + +### Recommended next step + +**B2, before any detector work.** Jimeng recall rests on n=14 and the pill's on n=6; +improving what six samples measure means not knowing whether it improved. B2 is also the +instrument that catches the geometry class of bug that has now surfaced twice -- the +`scale_basis` landscape miss, and the detect/mask front-end mismatch that made ~8% of +Doubao detections unremovable. + ## Standing gap None of this is in `maintain.sh`, and it should not all be -- the sweeps take hours. But