Skip to content

FINDINGS.md

Latest commit

 

History

History
94 lines (69 loc) · 4.4 KB

FINDINGS.md

File metadata and controls

94 lines (69 loc) · 4.4 KB
Raw

LTF — Bug Hunt Findings

Audit trail documenting all bugs found across 3 rounds of parallel agent audits + manual review.

Summary

Round Agents Total Found Critical/High Medium Low Fixed
Round 1 (Pass 1-2) 4 parallel 53 6 14 33 11
Round 2 (Pass 3-4) 4 parallel 15 1 8 6 15
Round 3 (targeted) manual 2 0 2 0 2
Total 70 7 24 39 28

All high/critical and all medium findings are FIXED. Remaining low-severity items are documented as acceptable (cosmetic, docs, or by-design).

Round 1 — Initial Parallel Audit

HIGH — Fixed

# Component File Description Status
1 TypeScript write.ts:40 phase parameter silently overridden by ...data spread FIXED
2 TypeScript parse.ts:15 Unsafe cast of non-object JSON (numbers, arrays, null) to LTFRecord FIXED
3 Adapter ltf-hook.sh:101 Path traversal via unsanitized session_id in state file path FIXED
4 Adapter ltf-hook.sh:256 started_at always set to current time, not actual session start FIXED
5 Python write.py:216 _dict_to_event drops agent, action, context, verification fields FIXED
6 Spec SPEC.md:195 iterations_to_first_success definition ambiguous vs multi-agent example FIXED

MEDIUM — Fixed

# Component File Description Status
7 TypeScript otel.ts:12 Token attributes dropped when value is 0 (truthiness check) FIXED
8 TypeScript write.ts:122 summary() overrides can corrupt loop_id/ltf_version FIXED
9 Spec SPEC.md:141 Iteration boundary definition inconsistent between §4.1 and §9.3 FIXED
10 Spec SPEC.md:14 "4 required fields" imprecise (summaries require 7) FIXED
11 Python metrics.py:54 files_changed sorted in Python but not TypeScript ACCEPTED (by-design)

LOW — Accepted

Items 12-53: test coverage gaps, documentation improvements, loose types, driftScore stub. None affect correctness. Full details in git history.

Round 2 — Deep File-by-File Audit

HIGH — Fixed

# Component File Description Status
54 Python parse.py:160 BOM-prefixed files silently drop first record FIXED

MEDIUM — Fixed

# Component File Description Status
55 TypeScript write.ts:148 emitEvent allows ltf_version override (inconsistent with LTFWriter) FIXED
56 TypeScript metrics.ts:82 convergenceRate returns unrounded float (parity issue) FIXED
57 TypeScript metrics.ts:97 falseCompletionRate returns unrounded float (parity issue) FIXED
58 Python metrics.py:99 convergence_rate returns unrounded float (parity with TS) FIXED
59 Python metrics.py:114 false_completion_rate returns unrounded float (parity with TS) FIXED
60 Python write.py:174 summary() allows overrides to clobber identity fields FIXED
61 Python _schema.py:8 Schema path resolution fails on pip install FIXED
62 Go validator.go:143 Missing type validation for non-numeric cost_usd/duration_ms FIXED
63 Go validator.go:317 Warnings on error-records silently dropped from count FIXED
64 Go validator.go:265 requireNonEmptyString masked by prior validation errors FIXED
65 Go stats.go:187 VerifyPassRate not falling back to events when summary lacks convergence FIXED

Round 3 — Targeted Fixes

MEDIUM — Fixed

# Component File Description Status
66 Adapter ltf-hook.sh files_changed not populated for Read events (only set for Edit/Write) FIXED
67 Go stats.go stats command panics when loop_summary lacks convergence object — no fallback to event-based computation FIXED

Verification

All fixes verified by:

  • 77 TypeScript tests (vitest)
  • 71 Python tests (pytest)
  • ~20 Go tests with race detector
  • 34 adapter tests (bash, test-hook.sh)
  • 18 E2E cross-language tests (demo/test_e2e.sh)
  • 21.9M fuzz inputs (0 panics)
  • govulncheck: 0 code vulnerabilities
  • CI green on Go 1.23+1.24, Node 22, Python 3.12