System and experiment architecture

Data flow

Paired vulnerable/fixed C/C++ functions are normalized, deduplicated and frozen into random, chronological and repository-disjoint split manifests. Vulnerable-side patch statements (L1), expanded context (L2), and bounded backward def-use traces form annotation targets. Teacher-generated structured outputs are filtered and converted into Contract v2 for SFT. SFT failure diagnostics led to a label-only learnability control; no further SFT variants followed the failed v3 gate.

The RL policy is Qwen3-4B base plus one live LoRA adapter. GRPO reward components R1–R5 evaluate generated rollouts against frozen cached targets; tools are not rerun per rollout. Production reward and balanced-reward E4b are separate registered experiments. Their behavior and discrimination endpoints are reported separately.

Evaluation uses threshold-free row scores and pair-cluster confidence intervals on chronological VALID. Classical reconstruction is fit on TRAIN and checked on VALID. The final one-pass TEST evaluation covered only the registered four systems and is closed. Human audit cards and the completed LLM-judge audit are separate evidence streams.

Architecture diagram

See the figure source index for all captions and source paths.

Critical boundaries

TEST is consumed and sealed; this archive performs no additional TEST read or inference.
Step 399 is inference-only; no step-400 checkpoint or VALID evaluation exists.
E3's registered early stop limited it to seed 42; seeds 43/44 and ablations are unavailable.
Oracle slicing is a ground-truth-location upper bound, not an inference-time system.
R3 on TEST is unavailable because no vulnerable TEST row has an eligible cached graph; it is N/A, not zero.