Every selected case names the engineering change, links the underlying evidence, and says what the evidence does not prove.
01UPSTREAM / NATIVE BROWSER
Give browser semantics a real contract
Lightpanda / Merged upstream · 4 PRs
Contributed Unix-domain CDP transport, ARIA checked/expanded semantics, agent-facing accessibility-tree output, and standards-aligned handling of an existing WebDriver window.
EngineeringIncludes role-aware ARIA token resolution, focusability regression fixtures, and explicit single-window scope instead of fabricating multi-window support.
EvidencePR #4129 reports a 1,969/1,969 local Zig test suite with seven skipped, at a specified commit; the final reviewed head was not the same as every earlier test run.
Scope limitNot a claim of WCAG or screen-reader conformance, nor an official WPT pass.
02UPSTREAM / TRUST BOUNDARY
Close the gaps between browser automation and authority
Chrome DevTools MCP / Merged upstream · 6 PRs
Hardened URL allow/block policy across HTTP redirects, moved fallback daemon sockets behind private runtime-directory access controls, and prevented credentials in WebSocket and daemon logs.
EngineeringOther accepted patches improved dynamically attached iframe handling, opt-in visible-text waits, and daemon argument serialization.
EvidenceThe redirect-policy PR includes a loopback-only before/after proof of a forbidden redirect hop; regression tests travel with the fixes.
Scope limitThese are focused remediations, not a comprehensive security audit.
03UPSTREAM / BUILD SYSTEMS
Make the Maven reactor do what it says
Apache Maven / Merged upstream · 3 PRs
Repaired reactor dependency edges for imported BOMs under -am, stopped read-only dependency-result APIs from exposing mutable nested lists, and normalized deferred StAX parser failures to the expected exception contract.
EngineeringThe patches preserve existing behavior outside the affected contracts and add targeted regression coverage.
EvidenceThe StAX PR documents a 53-byte reproducer, 175 model tests, a successful 38-module fuzz build, and 3,114,628 local post-fix fuzz executions.
Scope limitLocal test and fuzz figures are recorded in the PR; they are not continuous-production guarantees.
04UPSTREAM / SUPPLY CHAIN
Move assurance into the release boundary
FireCrab · libavif · CycloneDX / Merged upstream · selected changes
Added release compliance artifacts and fail-closed packaging in FireCrab, SPDX evidence for OCI imports, build provenance attestations for libavif release ZIPs, and per-module lifecycle correctness in CycloneDX Maven tooling.
EngineeringThe FireCrab work distinguishes required release evidence from optional OCI-import SBOM best efforts; those failure policies are intentionally different.
EvidenceFireCrab #190 records release-build verification and corresponding-source packaging checks; libavif #3371 verifies workflow linting, not a subsequent independently observed signed release.
Scope limitA merged attestation workflow does not mean every published artifact has been independently verified.
05OWNED / SIMULATION-FIRST
Separate a signal from proof that a person received it
6lowStick / Public research prototype · merged project PRs
An OpenThread POSIX simulated-radio lab exercises low-power signaling, authorized relay, application receipts, duplicate rejection, and modeled Thread-to-LoRa fallback.
Engineering6lowFlare uses a three-node simulated IPv6/UDP path with opt-in receiver/relay behavior and a separate synthetic output-evidence journal.
EvidenceMerged PR #29 reports 130/130 local tests plus two consecutive POSIX simulator runs, each recording two modeled authenticated application receipts and a duplicate rejection.
Scope limitNo real RF, physical actuator, LoRa modem, independent human receipt, or operational warning service has been demonstrated.
06OWNED / NATIVE EXPERIMENTS
Test native systems without pretending a crash is a finding
Rizzer · TRONIX / Public experimental repositories
Rizzer is a Clang-instrumented Linux native fuzzer with ASan/UBSan, bounded mutation campaigns, retained crash bytes, and repeatable evidence. TRONIX is a Celix-based experimental runtime with native services, bounded MessagePack IPC, agent scheduling, and optional supervised workers.
EngineeringThe two projects deliberately keep runtime authority, isolation assumptions, and machine-readable evidence explicit.
EvidenceRizzer README records 37/37 local synthetic acceptance tests. TRONIX README documents smoke tests of an isolated development-host native runtime.
Scope limitNeither system claims production sandbox guarantees; Rizzer candidates are not confirmed vulnerabilities and TRONIX is not deployed as a production service.
07OWNED / PORTABLE ASSURANCE
Make missing evidence impossible to call PASS
WindAnvil Assurance Record / Public standalone package
A dependency-free package canonicalizes JSON for stable SHA-256 evidence digests, evaluates required assertions with PASS/FAIL/BLOCKED semantics, and seals portable records with a verifiable self-digest.
EngineeringThe evaluator returns BLOCKED on missing required assertions; a successful self-digest proves record consistency, not the trustworthiness of its producer.
EvidencePublic README documents package tests and pack checks; this portfolio does not present unverified latest test results.
Scope limitThe library does not run builds, select policy, or replace independent verification of the producing system.
08UPSTREAM / HTTP SERVER CORE
Make empty header values safe at the C boundary
Apache HTTP Server / Landed in trunk · maintainer-adapted
Found undefined behavior in repeated trailing-whitespace trimming paths: an empty string could cause code to form a pointer before the start of the buffer. Proposed the shared ap_cstr_stripws() helper and focused regression coverage. Joe Orton adapted the patch and committed it to httpd trunk.
EngineeringCentralized end-pointer-safe trimming across core, proxy, and related response-header paths instead of fixing one isolated call site.
EvidenceTrunk commit 246ae27 credits Robert McConnell, closes PR #749, and includes unit and HTTP proxy/uWSGI regression tests. The PR documents a successful local build, 60/60 unit tests, and 6/6 proxy tests.
Scope limitPR #749 was closed without a GitHub merge; a maintainer committed an adapted fix directly. This is undefined-behavior hardening, not a demonstrated exploitable vulnerability or a claim that a release shipped.