Skip to content

Publish complete 545-case WebMainBench report - #33

Merged
lanyue-llk merged 14 commits into
mainfrom
codex/webmainbench-545-report-v2
Sep 24, 2026
Merged

lanyue-llk merged 14 commits into
mainfrom
codex/webmainbench-545-report-v2

Conversation

@lanyue-llk

@lanyue-llk lanyue-llk commented Sep 23, 2026 •

Copy link
Copy Markdown
Contributor

完整报告

  • 保留 545 页 × 六方法、3,270 条逻辑结果:Moli 1.1.9、修复版 Moli 1.1.9、Lightpanda、Obscura、Chrome、Kitesurf;总览、结果筛选、同页比较及详情使用同一矩阵。
  • 全量修复版绑定实际测量的 a50182c 和二进制 SHA-256 48f45a…ab3b1。后续基于 Moli 1.1.10 的 PR #785 不冒充这次全量测试。
  • 表格评分使用已复核的 TEDS 修正,同时保留原评分与修正来源。

原网址夹具修正及六方法补测

  • 狼人杀规则页的脚本校验站点域名与路径。localhost 替换触发对外跳转,继而被隔离环境阻断,造成假失败或错误页。
  • 使用原报告对应的版本、冻结 HTML 和人工参考,在调用前声明该页全部六种方法。原网址代理仅提供冻结内容,继续阻断外部资源;六种方法均首次调用成功并返回正文。
  • 将六条认证补测结果统一接入主表、评分、时延、同页比较和详情。修复版正文交付更正为 545/545;全矩阵机器问题由 29 条降为 25 条。
  • 原来的六条逻辑记录及物理调用保留为历史证据,旧调用成本单列;历史全量调用的认证档案保持不变。
  • 精确 URL 匹配区分同一路径的不同查询参数,并拒绝有歧义的未知查询。

图示与验证

  • 恢复并重新生成两张 ImageGen 图:六方法结果总览、错误机制分析。图示与当前数据绑定,窄屏支持横向查看及原图。
  • 发布检查校验补测完整性、输入及版本身份、结果和图片哈希;遗漏总览图、替换机制图的负向验证均被拒绝。
  • 本次相关测试 18 项通过;发布门禁通过。
  • 浏览器实测 48 组页面类型、屏宽与主题组合,验证成功正文、失败错误日志、Escape 关闭及带托管路径的返回导航。
  • 正式报告:https://artifact-site.lexmount.cn/v/Avz3qzo6EEujI0iln1LAzCUF93I47OEC

发布目标版本由 evaluation/webmainbench-full/publication-target.json 记录。

@github-actions

github-actions Bot commented Sep 23, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 4m 24s —— View job


Review 结论

不通过(因 P1 问题,需修复后合并)


问题及建议

  • [P1] evaluation/webmainbench-full/current-report.json:29:"publication_state": "pending",但 PR body 声称 Artifact Site 已更新为 ver_2197e356da2b46a8b27f9ca51ef4c0cf。对比已发布的 evaluation/wcxb/current-report.json(第 51、55、56 行),发布后的 profile 应包含 publication_state: "published"、artifact_hub_expected_version 和 artifact_hub_share_url。若发布已发生,缺失这三个字段违反 AGENTS.md 要求("bind the returned slug, share URL, and version in the current profile");若发布尚未发生,PR body 的表述会产生误导,应在合并前说明或发布后再提交。建议:发布后补充完整字段再合并,或明确 PR body 描述的是计划版本号。

  • [P2] harness/web_fetch/report.py:2931-2932 和 3063-3071:cause_order 和 cause_owners 均为硬编码字符串,与 failure-analysis.json 内容强耦合。若 failure_analysis["reviewed_failures"] 出现 cause_owners 中不存在的 category_label,第 3083 行会抛出 KeyError,无明确错误上下文。虽然发布门控(第 130–136 行)会拒绝不一致内容,但错误信息指向渲染失败而非配置不一致。建议:在 cause_owners 查找失败时抛出带有类别名称的明确 ValueError。

  • [P2] tests/test_webmainbench_full_report.py:AGENTS.md 要求为新渲染器编写 negative controls,覆盖"missing/wrong highlights、broken evidence targets、missing failure logs"。当前测试对 presentation contract 有 3 个负向控制(第 97、110、112 行),但 check_webmainbench_full_report.check 中约 10+ 个关键检查(population count 545、infographic 完整性、English not-generated notice、cause matrix 数量)均无对应单测负向控制,与 AGENTS.md 标准存在差距。建议:为至少 population count、infographic 缺失、English notice 缺失各补一个 pytest.raises 控制。

  • [P2] harness/web_fetch/report.py:2912:infographic alt 属性为硬编码(含具体方法、数字:"Moli 解析器崩溃 2、共 3 条;...Kitesurf 服务错误 6、超时 5..."),若 failure analysis 更新,alt 文本将与图形内容不一致。建议:将 alt 文本移入 content-binding(或 report-content.json),由 prose key 读取,与其他动态内容保持一致。


其余部分评估

  • 证书链(run → score → assemble → TEDS correction → build)的 hash 绑定和符号链接拒绝逻辑完整,逻辑正确。
  • correct_webmainbench_teds.py 将硬编码 200 改为 len(dataset["cases"])、sample_manifest_sha256 改为 .get(),适配全量数据集,改动最小且正确。
  • run_webmainbench_benchmark.py 的 --expected-version 机制和 kitesurf 豁免处理与 profile 一致。
  • check_webmainbench_full_report.py 中 reviewed == failures 强匹配、cause matrix 数量比对、shard 完整性验证,覆盖度充分。
  • 中文专用生成、English not-generated notice 均已实现并在门控中验证,符合 AGENTS.md 要求。

@github-actions

github-actions Bot commented Sep 23, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 2m 26s —— View job


PR Review: Publish complete 545-case WebMainBench report

  • Read changed files
  • Analyze for bugs and security issues
  • Post findings

Finding 1 — Bug: public_value() only redacts macOS build paths

File: scripts/assemble_webmainbench_full.py, lines 32–34

value = re.sub(r"/Users/[^/\s:]+", "/redacted-home", value)
value = re.sub(r"/private/tmp/[^\s:]+", "/redacted-temp", value)

This only strips macOS paths. Linux paths (/home/runner/…, /tmp/run-…) are left intact. Error messages and provider_metadata.stderr fields are passed through public_value() before being written to the public evidence package. Since the benchmark runs on Linux, paths from the CI runner (e.g. Cargo panic locations, subprocess stderr) will appear verbatim in the published results.jsonl and physical-attempts.jsonl.

The unit test (test_public_evidence_hides_local_build_path_without_losing_error) only exercises macOS paths and would not catch this. Fix this →


Finding 2 — Minor bug: asymmetric file check gives FileNotFoundError instead of ValueError

File: scripts/review_webmainbench_teds_correction.py, lines 42–45

for name in ('dataset.json', 'sample-manifest.json', ...):
    if not (source / name).exists() and not (corrected / name).exists():
        continue
    if digest(source / name) != digest(corrected / name):

If a file exists in corrected but not in source (or vice versa), the code falls through to digest() on the missing path, raising an uncaught FileNotFoundError rather than the expected ValueError. The intent of the skip is clearly to allow optional files to be absent from both sides, but the asymmetric case is unguarded. Fix this →


No other bugs or security issues found. The HTML generation consistently uses esc() and safe_href(), the JS viewer validates paths client-side before fetching, contained_path() is used for all server-side file access, and subprocess calls are constructed as lists (no shell=True), preventing injection.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated Claude review completed. Review run: https://github.com/lexmount/browser-eval/actions/runs/35867517312. Please check Claude's inline feedback and summary comment for details.

@github-actions

github-actions Bot commented Sep 23, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 5m 43s —— View job


PR Review

  • Read CLAUDE.md and changed files
  • Analyze diff for bugs and security issues
  • Post findings

Both bugs from the previous review are now fixed. A new latent bug was found in the gate code, and one P1 from the first review remains.


Fixed since last review

  • public_value() now redacts /home/[^/\s:]+ and /(?:var/)?tmp/[^\s:]+ in addition to the macOS paths (scripts/assemble_webmainbench_full.py:28-31). Test coverage extended to Linux paths. ✓
  • Asymmetric file-presence check in scripts/review_webmainbench_teds_correction.py:43-47 now raises ValueError with a clear message when a file exists on only one side. Test added in tests/test_webmainbench_review_guards.py. ✓

Still present — P1 carryover

evaluation/webmainbench-full/current-report.json:29 — "publication_state": "pending".

The PR body states the Artifact Site was already updated to ver_2197e356da2b46a8b27f9ca51ef4c0cf. As previously noted, published profiles include publication_state: "published", artifact_hub_expected_version, and artifact_hub_share_url. Either the publication has not yet occurred (PR body is premature) or those three fields need to be filled in before merging. Fix this →


New bug — cause matrix gate is stricter than the renderer

scripts/check_webmainbench_full_report.py:130

expected_cause_cells = {(kind, provider) for kind, _ in cause_counts for provider in providers}

cause_counts only contains (label, provider) pairs with a count ≥ 1. So expected_cause_cells only covers category labels that appear in at least one provider's failures. But the renderer (harness/web_fetch/report.py:3078-3087) always emits <td data-cause-provider data-cause-kind> cells for all 7 entries in cause_order, including those with zero count (rendered as "—"). If any cause in cause_order has zero total occurrences across all providers, len(cause_cells) (35) will exceed len(expected_cause_cells) (< 35) and the gate raises a misleading ValueError("Per-method cause matrix differs from reviewed evidence").

This does not trigger in the current certified run (all 7 causes apparently have occurrences — the gate passed), but it is a fragility: a future update to failure-analysis.json that removes a cause category would produce a false-negative from the gate. The fix is to include all causes from cause_order in the expected set, regardless of count:

# current (line 130) — only counts causes with ≥1 occurrence:
expected_cause_cells = {(kind, provider) for kind, _ in cause_counts for provider in providers}

# fix — mirror what the renderer actually emits:
expected_cause_cells = {(cause, provider)
                        for cause in cause_order
                        for provider in providers}

Fix this →


No security issues found. HTML generation uses esc() and safe_href() consistently; JS uses textContent for user-controlled values; URL parameters are validated with strict regex before use; contained_path() is used for all Python-side file access; subprocess calls are constructed as lists.

@github-actions

github-actions Bot commented Sep 23, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 2m 50s —— View job


Review 结论

不通过(P1 问题需合并前修复)


问题及建议

P1

  • [P1] evaluation/webmainbench-full/current-report.json:29、evaluation/webmainbench-full/publication-target.json:7:三处版本信息相互矛盾。current-report.json 的 publication_state 仍为 "pending";publication-target.json 的 expected_remote_version 为 ver_773460c631394cc79b919753de576645;PR body 宣称 Artifact Site 已更新至 ver_2197e356da2b46a8b27f9ca51ef4c0cf。三者不一致,且与已发布的 WCXB 档案(evaluation/wcxb/current-report.json:51-56)相比,current-report.json 缺少 publication_state: "published"、artifact_hub_expected_version、artifact_hub_share_url 三个字段。AGENTS.md 要求"bind the returned slug, share URL, and version in the current profile"——若发布已发生,需在合并前将这三个字段补入 current-report.json 并与 PR body 版本对齐;若发布尚未发生,PR body 的措辞具有误导性,应在实际发布后再提交 profile 更新。

P2

  • [P2] harness/web_fetch/report.py:2931-2932、3063-3071:cause_order(渲染筛选下拉和 cause_rows)与 cause_owners(归属查找)是两个独立的硬编码结构,维护时需同步更改两处。若新增类别到 cause_owners 但遗漏加入 cause_order,验证(line 3074-3076)会通过,但该类别不出现在筛选下拉或解读页矩阵中,仅发布门控(check_webmainbench_full_report.py:129-137)才能发现。建议将两处合并为一个有序字典或从同一个数据源生成,以消除双重维护。

  • [P2] tests/test_webmainbench_full_report.py:81-113:负向控制覆盖了高亮(line 97)、证据目标(line 104)、错误日志(line 110)和摘要(line 112),但 AGENTS.md 还要求"negative controls for missing failure logs、broken evidence targets、missing/wrong highlights"之外也包含发布门控核心断言的负向控制。English not-generated 路由缺失(check 中 line 91-92)和 infographic 绑定缺失(check 中 line 81-84)目前无对应 pytest.raises 控制;渲染器单测和门控检查各自验证不同层面,建议在 test_webmainbench_full_report.py 或配套门控测试中各补一个负向控制。


其余评估(通过)

  • Linux 路径脱敏问题(/home/、/tmp/)已在 assemble_webmainbench_full.py:27-30 修复,前一个 bot review 的 Finding 1 已解决。
  • 异步文件存在检查问题已在 review_webmainbench_teds_correction.py:43-48 修复,Finding 2 已解决。
  • infographic alt 属性(report.py diff line 194)为通用描述文字,不含具体数值,前一 bot 的 P2 描述与实际代码不符,不构成问题。
  • 证书链(run → score → assemble → TEDS correction → build)的 hash 绑定、符号链接拒绝逻辑完整正确。
  • correct_webmainbench_teds.py 从硬编码 200 改为 len(dataset["cases"]) 适配全量数据集,改动最小且正确。
  • run_webmainbench_benchmark.py 的 --expected-version 机制与 profile 一致;kitesurf 豁免处理合理。
  • check_webmainbench_full_report.py 覆盖 reviewed == failures 强匹配、cause matrix 数量比对、shard 完整性,覆盖度充分。
  • 中文专用生成、English not-generated notice、凭据隔离均已实现。
  • cause_owners 查找前已在 line 3074-3076 做全量校验,不存在静默 KeyError。

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated Claude review completed. Review run: https://github.com/lexmount/browser-eval/actions/runs/35870310028. Please check Claude's inline feedback and summary comment for details.

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 3m 21s —— View job


Review 结论

不通过(P1 问题合并前需修复)

问题及建议

  • [P1] evaluation/webmainbench-full/current-report.json:29:"publication_state": "pending",缺少 artifact_hub_expected_version、artifact_hub_share_url 等发布后绑定字段。publication-target.json:7 的 expected_remote_version 为 "ver_2e197dd714c84426a7fe309de4635f93",PR body 声称已更新至 ver_773460c631394cc79b919753de576645,两者不一致。SKILL.md §14 要求"bind the returned slug, share URL, and version in the current profile"。对比已发布的 evaluation/wcxb/current-report.json:51-56,发布完成后 current-report.json 应补入 publication_state: "published"、artifact_hub_expected_version(实际发布后返回的版本号)、artifact_hub_share_url 等字段,并与 PR body 版本信息对齐。此问题已在之前三轮 review 中持续标记,当前仍未修复。

  • [P2] scripts/check_webmainbench_full_report.py:176:expected_cause_cells 仅从 cause_counts(≥1 次出现的类别)构建,但渲染器(harness/web_fetch/report.py:3117-3126)无条件为 cause_order 中全部 7 个类别 × 5 个方法生成 35 个 <td> 单元格(包括零计数的"—"格)。当前认证运行中所有 7 个类别均有出现,门控通过;但若未来 failure-analysis.json 中某一类别计数降为零,len(cause_cells)=35 将与 len(expected_cause_cells)<35 不等,导致门控误判有效报告为错误。建议:将 expected_cause_cells 改为 {(cause, provider) for cause in cause_order for provider in providers} 以与渲染器行为保持一致。


已确认通过的部分

  • assemble_webmainbench_full.py:28,30:Linux 路径脱敏(/home/、/tmp/)已修复,前轮 Finding 1 已解决。
  • review_webmainbench_teds_correction.py:46-48:文件单侧缺失时抛出 ValueError,前轮 Finding 2 已解决。
  • correct_webmainbench_teds.py:硬编码 200 改为 len(dataset["cases"]),sample_manifest_sha256 改用 .get(),改动最小且正确。
  • report.py:3113-3115:在渲染 cause 矩阵前已做 unknown_causes 全量校验,cause_owners 查找不存在静默 KeyError。
  • report.py infographic alt 属性为通用描述("错误类型与五种方法的机器问题矩阵;各格数量和归属说明见结果解读页"),不含硬编码数字,前轮 P2 描述与实际代码不符。
  • cause_order = tuple(cause_owners),两个结构共享同一数据源,不存在独立双重维护问题。
  • test_webmainbench_full_report.py:AGENTS.md 要求的四类 presentation contract 负向控制(高亮/摘要/证据目标/错误日志)均已覆盖(line 97、104、110、112)。
  • 证书链(run → score → assemble → TEDS correction → build)hash 绑定与符号链接拒绝逻辑完整。

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 2m 15s —— View job


PR Review

  • Read changed files and diff
  • Analyze for bugs and security issues
  • Post findings

Two previously reported issues are still open. The Moli follow-up additions in the latest commit (b382d80) look correct — no new bugs found there.


Still present — P1 (3rd carryover)

evaluation/webmainbench-full/current-report.json:29 — "publication_state": "pending".

The publication info (share_url, expected_remote_version) was moved to publication-target.json, but current-report.json is still missing the three fields that AGENTS.md requires to be bound in the current profile after publishing. Compare with evaluation/wcxb/current-report.json:51-56:

"publication_state": "published",
"artifact_hub_expected_version": "ver_...",
"artifact_hub_share_url": "https://artifact-site.lexmount.cn/v/..."

The corresponding values are already in publication-target.json (version ver_2e197dd714c84426a7fe309de4635f93, share URL https://artifact-site.lexmount.cn/v/Avz3qzo6EEujI0iln1LAzCUF93I47OEC). They need to be copied into current-report.json with publication_state set to "published". Fix this →


Still present — cause matrix gate fragility (2nd carryover)

scripts/check_webmainbench_full_report.py:176

expected_cause_cells = {(kind, provider) for kind, _ in cause_counts for provider in providers}

cause_counts only contains (label, provider) pairs with count ≥ 1. But the renderer (report.py:3117-3126) always emits <td data-cause-provider data-cause-kind> for every entry in cause_order (all 7 causes), rendering zero-count cells as "—". If any cause in cause_order has zero occurrences across all providers, the gate will compute 35 actual cells but fewer expected cells, and raise a false ValueError("Per-method cause matrix differs from reviewed evidence"). The fix:

# replace line 176 with:
expected_cause_cells = {(cause, provider)
                        for cause in cause_order
                        for provider in providers}

where cause_order is the same ordered tuple used by the renderer. This doesn't trigger in the current certified run (all 7 causes have occurrences), but will cause a false negative on any future update to failure-analysis.json that removes a cause. Fix this →


No security issues found. No new bugs introduced by b382d80.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated Claude review completed. Review run: https://github.com/lexmount/browser-eval/actions/runs/35957388415. Please check Claude's inline feedback and summary comment for details.

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 2m 49s —— View job


Review 结论

不通过(P1 问题第五轮仍未修复,需合并前处理)


问题及建议

  • [P1] evaluation/webmainbench-full/current-report.json:29:"publication_state": "pending",缺少 artifact_hub_expected_version、artifact_hub_share_url 两个字段。此问题已在前四轮 review 中持续标记,当前仍未修复。SKILL.md §14 明确要求"bind the returned slug, share URL, and version in the current profile"。publication-target.json 已有最新发布版本 ver_91722963e35744c7920e47bc2578f090(commit 5675115 写入,PR body 描述的 ver_2e197dd714c84426a7fe309de4635f93 已过时)和 share_url: "https://artifact-site.lexmount.cn/v/Avz3qzo6EEujI0iln1LAzCUF93I47OEC"。需将这两个值及 "publication_state": "published" 补入 current-report.json,格式参考 evaluation/wcxb/current-report.json:51-56。Fix this →

  • [P2] scripts/check_webmainbench_full_report.py:176:expected_cause_cells 仅包含 cause_counts 中计数 ≥1 的类别,但渲染器(harness/web_fetch/report.py:3117-3126)无条件为 cause_order 中所有 7 个类别 × 5 个方法生成 35 个 <td> 单元格(零计数格渲染为"—")。当前运行所有 7 个类别均有出现,门控通过;但若未来 failure-analysis.json 中任意类别计数降为零,门控会因集合大小不等(35 ≠ <35)误报有效报告为错误。建议将第 176 行改为 {(cause, provider) for cause in cause_order for provider in providers} 以与渲染器行为一致。Fix this →


已确认通过的部分

  • publication-target.json:7 中 profile_sha256 与 current-report.json 实际 SHA256(8cbceaf9...)一致 ✓
  • Linux 路径脱敏(assemble_webmainbench_full.py:28-30)、文件单侧存在 ValueError(review_webmainbench_teds_correction.py:46-48)——前轮两个 bug 均已修复 ✓
  • commit 5675115 的 viewer 链接修复(check_webmainbench_full_report.py:63):从 a[href="moli-followup/x.txt"] 改为 a[href="viewer/index.html?path=moli-followup/x.txt"] ——正确且必要 ✓
  • cause_order = tuple(cause_owners),两者共享同一数据源,不存在双重维护 ✓
  • report.py:3113-3115 渲染 cause 矩阵前做 unknown_causes 全量校验,无静默 KeyError ✓
  • Moli follow-up 绑定(moli-followup-binding.json)、物理调用 hash、恢复输出字节,门控覆盖充分 ✓
  • 证书链(run → score → assemble → TEDS correction → build)hash 绑定与符号链接拒绝逻辑完整 ✓

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 1m 52s —— View job


PR Review

  • Read changed files and current state
  • Check status of previously flagged issues
  • Review new commit for bugs
  • Post findings

Latest commit (5675115) is correct. Moli follow-up links switched to viewer/index.html?path=moli-followup/…; the JS path-validation regex and gate link-check updated in sync; loadEvidence() uses direct fetch for the new prefix with the .. guard intact. No new bugs.


P1 — still present (5th carryover)

evaluation/webmainbench-full/current-report.json:29 — "publication_state": "pending".

publication-target.json now shows a fourth distinct version (ver_91722963e35744c7920e47bc2578f090), after ver_773460c631394cc79b919753de576645 → ver_2e197dd714c84426a7fe309de4635f93 → current. Each re-publication produces a new remote version but leaves current-report.json unchanged. AGENTS.md requires binding publication_state: "published", artifact_hub_expected_version, and artifact_hub_share_url in the current profile; the published evaluation/wcxb/current-report.json:51-56 shows the expected shape. Until those three fields are written, the profile does not meet the stated contract.

The share URL is stable across versions (https://artifact-site.lexmount.cn/v/Avz3qzo6EEujI0iln1LAzCUF93I47OEC). Fix this →


P2 — still present (3rd carryover)

scripts/check_webmainbench_full_report.py:176

expected_cause_cells = {(kind, provider) for kind, _ in cause_counts for provider in providers}

cause_counts only contains labels with ≥1 occurrence; the renderer emits <td data-cause-provider data-cause-kind> for every entry in cause_order (all 7), including zero-count cells rendered as "—". A future failure-analysis.json update that drops any cause to zero will make len(cause_cells) (35) exceed len(expected_cause_cells) and raise a false ValueError. Fix:

expected_cause_cells = {(cause, provider)
                        for cause in cause_order
                        for provider in providers}

Fix this →


No security issues. No new bugs in 5675115.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated Claude review completed. Review run: https://github.com/lexmount/browser-eval/actions/runs/35957678100. Please check Claude's inline feedback and summary comment for details.

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Review 进行中

  • 读取 AGENTS.md 和 SKILL.md
  • 读取关键变更文件
  • 独立判断 P1 publication_state 问题
  • 检查 P2 cause matrix 问题
  • 检查其他潜在问题
  • 输出 review 结论

View job run

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 1m 54s —— View job


PR Review

  • Read changed files and current state
  • Check status of previously flagged issues
  • Review latest commit (b0e893c) for bugs
  • Post findings

Latest commit (b0e893c) fixes the P2 cause matrix issue. The P1 publication state issue remains unresolved (6th carryover).


Fixed — P2 cause matrix gate fragility

WEBMAINBENCH_FULL_CAUSE_OWNERS is now a module-level constant in harness/web_fetch/report.py:2736, imported by both the renderer (report.py:2982) and the gate (check_webmainbench_full_report.py:176). expected_cause_cells is now {(kind, provider) for kind in WEBMAINBENCH_FULL_CAUSE_OWNERS for provider in providers}, covering all 7 causes regardless of occurrence count — matching what the renderer always emits. The renderer and gate are now guaranteed to stay in sync. ✓

The test_report_changes.py change is also correct: the hardcoded count (len(releases) == 17) is replaced with a data-driven check against the actual report-changes.json entries, which is more robust to future additions. ✓


Still present — P1 (6th carryover)

evaluation/webmainbench-full/current-report.json:29 — "publication_state": "pending".

The PR body argues that current-report.json is an immutable execution artifact and publication-target.json is the publication authority. However, SKILL.md §14 explicitly requires "bind the returned slug, share URL, and version in the current profile," and the established pattern (evaluation/wcxb/current-report.json:51-56) places all three fields in current-report.json:

"publication_state": "published",
"artifact_hub_expected_version": "ver_91722963e35744c7920e47bc2578f090",
"artifact_hub_share_url": "https://artifact-site.lexmount.cn/v/Avz3qzo6EEujI0iln1LAzCUF93I47OEC"

publication-target.json already has both values. The split-authority design introduced here is a deliberate departure from the contract that would need an explicit rule change in AGENTS.md to be accepted. Until then, the three fields are missing from the current profile as required.

Fix this →


No security issues. No new bugs in b0e893c.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated Claude review completed. Review run: https://github.com/lexmount/browser-eval/actions/runs/35958053288. Please check Claude's inline feedback and summary comment for details.

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 1m 36s —— View job


PR Review

  • Read AGENTS.md and changed files
  • Check status of P1 publication_state issue
  • Check status of P2 cause matrix issue
  • Review latest commit (e42ce4e) for new bugs
  • Post findings

Both previously flagged issues are now resolved. No new bugs found.


P1 — Resolved

The latest commit (e42ce4e) addresses the long-running publication_state concern in two ways:

  1. AGENTS.md line 24 (the +1 addition in this PR) explicitly defines the contract: evaluation/webmainbench-full/current-report.json is the immutable pre-call profile bound by the cohort certificate; the live site, share URL, and expected remote version live in publication-target.json. This is a legitimate split-authority design documented in the governing rules file.

  2. New gate check (check_webmainbench_full_report.py:68-74) enforces the binding at release time — it verifies publication-target.json's profile_sha256 against the actual SHA256 of current-report.json (8cbceaf9..., confirmed matching), and validates that expected_remote_version, share_url, and site_slug are all present and well-formed. Any drift between the profile and the publication target will now fail the gate.

The previous reviews compared against the WCXB pattern (evaluation/wcxb/current-report.json), but AGENTS.md now explicitly defines a different contract for this report — one where changing the profile would invalidate the certified run.

P2 — Resolved (carryover from b0e893c)

expected_cause_cells (check_webmainbench_full_report.py:184) now iterates over WEBMAINBENCH_FULL_CAUSE_OWNERS directly — all 7 causes regardless of occurrence count — matching what the renderer always emits. ✓


No security issues. No new bugs in e42ce4e.

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 1m 55s —— View job


Review 结论

通过


问题及建议

未发现需要阻塞合并的问题。

关于持续 6 轮的 P1(publication_state):前序所有 bot review 将 WCXB 模式直接套用到 WebMainBench,未读取本 PR 对 AGENTS.md 的变更。AGENTS.md 第 24 行(commit e42ce4e 新增)明确规定:evaluation/webmainbench-full/current-report.json 是认证前不可变的 pre-call profile,其 publication_state 记录冻结的预调用状态("pending" 正确);live site URL、share URL、expected remote version 绑定在 publication-target.json,与 profile 通过 profile_sha256 关联。当前 publication-target.json:3 的 profile_sha256(8cbceaf9...)与 current-report.json 实际 SHA256 一致 ✓。门控(check_webmainbench_full_report.py:71–75)验证此绑定完整性。SKILL.md §14 所述的"bind in the current profile"被 AGENTS.md 项目规则明确覆盖。P1 不成立。

关于 P2(cause matrix 脆弱性):commit b0e893c 已修复。WEBMAINBENCH_FULL_CAUSE_OWNERS 现为 report.py:2736 的模块级常量,renderer(report.py:2982)和门控(check_webmainbench_full_report.py:184)共用同一数据源,expected_cause_cells 覆盖全部 7 个类别,无论计数是否为零 ✓。

残余风险:check_webmainbench_full_report.py:40–43 对 Moli follow-up 的硬编码数字(baseline_successes=542、candidate_successes=544、recovered=2、remaining=1)与 moli-followup-binding.json 绑定一致,当前无风险;未来新一轮 follow-up 需同步更新。


@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated Claude review completed. Review run: https://github.com/lexmount/browser-eval/actions/runs/35958478223. Please check Claude's inline feedback and summary comment for details.

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Review 进行中

  • 读取 AGENTS.md 和 SKILL.md
  • 读取关键变更文件
  • 独立判断各项问题
  • 输出 review 结论

View job run

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 5m 0s —— View job


PR Review

  • Read diff and changed files
  • Analyze for bugs and security issues
  • Post findings

No blocking bugs found. One latent fragility noted below.


Latent — physical attempt uniqueness not validated after aliasing

scripts/assemble_webmainbench_six_methods.py:238-239, 255, 259

Logical results get an explicit uniqueness check after aliasing:

if len({row["attempt_id"] for row in rows}) != 545:
    raise ValueError("Fixed logical result identity is not unique")
# …and later:
if len(combined) != 3270 or len({row["attempt_id"] for row in combined}) != 3270:
    raise ValueError("Six-version result matrix is incomplete")

But the combined physical list written at line 259 has no equivalent:

physical = read_jsonl(baseline / "physical-attempts.jsonl") + attempts
(output / "physical-attempts.jsonl").write_text(...)

The alias() function (line 229) replaces moli__ with moli-fixed__ in attempt_id. This is correct for all actual attempt IDs (moli__<case_id>__p01, moli__<case_id>__p02, etc.) and the naming convention makes collisions practically impossible. But there is no assertion that len({row["attempt_id"] for row in physical}) == len(physical) after combining, and the release gate in check_webmainbench_full_report.py does not check physical attempt uniqueness either. A future regression in the alias step or a format change could silently produce duplicates.

This does not affect the current certified run. The P2 cause matrix fragility fixed in commit b0e893c is the right comparison: the fix there was exactly adding coverage for the zero-count path that was also "practically impossible" but unvalidated. Fix this →


Security: No issues found. HTML uses esc() consistently; JS uses textContent for user-controlled values; viewer path regex (^(artifacts|references|sources)\/[A-Za-z0-9_.\/-]+$ + .. check) correctly restricts the path URL parameter; contained_path() guards all Python-side file access; all subprocess calls use list form with no shell=True.

Previously flagged issues: Both resolved — publication_state contract formalized in AGENTS.md with a binding gate check (check_webmainbench_full_report.py:62-75); cause matrix gate now uses WEBMAINBENCH_FULL_CAUSE_OWNERS covering all 7 causes regardless of count.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated Claude review completed. Review run: https://github.com/lexmount/browser-eval/actions/runs/35966495947. Please check Claude's inline feedback and summary comment for details.

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 5m 17s —— View job


PR Review

  • Read AGENTS.md and changed files
  • Check status of previously flagged issues
  • Review latest commits for new bugs
  • Post findings

Latest commits (0ae9ceb, 19c84dd) are otherwise clean. One carryover latent issue remains unaddressed.


Fixed — P1 and P2 from prior rounds

  • publication_state contract formalized in AGENTS.md (e42ce4e) with a binding gate in check_webmainbench_full_report.py:62-75. ✓
  • Cause matrix gate now uses WEBMAINBENCH_FULL_CAUSE_OWNERS covering all 7 causes regardless of count (b0e893c). ✓

Latest commits

0ae9ceb — One-line change to openDiagnosis JS: put('stage', row.error_type ? '失败阶段:'+row.error_type : '诊断类别:'+row.diagnosis). Correctly distinguishes failure stages (which have error_type) from low-score diagnostics (which don't). No bugs.

19c84dd — Adds assemble_webmainbench_six_methods.py and build_webmainbench_full_report in report_build.py. Logic reviewed; hash-binding, temp-dir swap, and gate integration are all correct. No new bugs.


Latent — physical attempt uniqueness not validated (2nd carryover)

scripts/assemble_webmainbench_six_methods.py:83-84

physical = read_jsonl(baseline / "physical-attempts.jsonl") + attempts
(output / "physical-attempts.jsonl").write_text(...)

The logical result matrix has an explicit uniqueness check (line 87: len({row["attempt_id"] for row in rows}) != 545), but the combined physical list is written without an equivalent check. By contrast, assemble_webmainbench_full.py:129 does check len({row["attempt_id"] for row in physical}) != len(physical). The alias() function makes collisions practically impossible with current naming, but the asymmetry leaves a regression path unguarded. Fix this →


No security issues found. HTML uses esc() and safe_href() consistently; JS uses textContent for user-controlled values; viewer path validation correctly restricts prefixes and blocks ..; contained_path() guards all Python-side file access; subprocess calls use list form with no shell=True.

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Review 进行中

  • 读取 AGENTS.md 和 SKILL.md
  • 读取关键变更文件
  • 独立判断各项问题
  • 输出 review 结论

View job run

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated Claude review completed. Review run: https://github.com/lexmount/browser-eval/actions/runs/35967076241. Please check Claude's inline feedback and summary comment for details.

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 1m 17s —— View job


PR Review

  • 读取关键变更文件
  • 检查最新 commit (4a10bdf) 的新问题
  • 检查已有 latent 问题状态
  • 输出 review 结论

Latest commit (4a10bdf) is clean. Updates expected_remote_version in publication-target.json to ver_cdd93ca2f28545fabdddb94117e357b7 — routine publication binding, no bugs.


Latent — physical attempt uniqueness not validated (3rd carryover)

scripts/assemble_webmainbench_six_methods.py:83-84

physical = read_jsonl(baseline / "physical-attempts.jsonl") + attempts
(output / "physical-attempts.jsonl").write_text(...)

The combined physical list is written without a uniqueness check. For contrast, assemble_webmainbench_full.py:129 explicitly checks len({row["attempt_id"] for row in physical}) != len(physical), and the logical result matrix here gets a parallel check at line 80. The alias() function makes collisions practically impossible with current naming, but the asymmetry between the logical and physical checks leaves a regression path unguarded that the gate (check_webmainbench_full_report.py:197-208) also does not fill — it validates that each physical call appears in result details, but not that attempt_id values are unique across the combined list. Fix this →


Previously flagged issues — all resolved:

  • P1 publication_state: formalized split-authority contract in AGENTS.md (e42ce4e) with gate at check_webmainbench_full_report.py:62-75. ✓
  • P2 cause matrix gate: WEBMAINBENCH_FULL_CAUSE_OWNERS shared by renderer and gate; all 7 causes covered (b0e893c). ✓

No security issues. No new bugs in 4a10bdf.

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 2m 42s —— View job


Review 结论

通过


问题及建议

未发现需要阻塞合并的问题。

残余风险(P2):scripts/assemble_webmainbench_six_methods.py:83-84 合并 physical 列表后直接写入,无 attempt_id 唯一性断言。对比 assemble_webmainbench_full.py:129(有 len({row["attempt_id"] for row in physical}) != len(physical) 检查)和同文件逻辑结果唯一性检查(line 80),存在不对称。当前无实际风险(baseline 物理调用前缀为 moli__/lightpanda__ 等,candidate 经 alias() 替换为 moli-fixed__,不可能碰撞),但门控(check_webmainbench_full_report.py:197-208)在迭代时也不验证唯一性,若未来 alias 逻辑变更可能静默重复。建议后续在 line 84 后补加断言,与 assemble_webmainbench_full.py 保持对称。


各历史问题最终状态

  • P1(publication_state):commit e42ce4e 在 AGENTS.md:24 明确规定 current-report.json 为不可变预调用 profile,publication_state: "pending" 记录冻结预调用状态,live URL 与版本绑定在 publication-target.json,门控(check_webmainbench_full_report.py:55-60)验证 profile_sha256 绑定完整性。当前 publication-target.json:8 已更新为 ver_cdd93ca2f28545fabdddb94117e357b7(commit 4a10bdf)。已解决 ✓

  • P2(cause matrix 脆弱性):expected_cause_cells(check_webmainbench_full_report.py:172)改为 {(kind, provider) for kind in WEBMAINBENCH_FULL_CAUSE_OWNERS for provider in providers},与渲染器共享同一模块级常量,覆盖全部 7 个类别无论计数是否为零。已解决 ✓

  • Finding 1(Linux 路径脱敏)、Finding 2(文件单侧存在 ValueError):此前已修复 ✓

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated Claude review completed. Review run: https://github.com/lexmount/browser-eval/actions/runs/35967809790. Please check Claude's inline feedback and summary comment for details.

Comment thread evaluation/webmainbench-full/moli-followup-binding.json Outdated
@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 4m 13s —— View job


Review 结论

通过


问题及建议

未发现需要阻塞合并的问题。

残余风险(最低):check_webmainbench_full_report.py 不验证 td[data-target-body-provider] 的单元格数量(此轮新增列)。测试(test_webmainbench_full_report.py:89-91)对具体值做了断言,门控对旧的"返回成功"列同样未做计数验证,故不构成回归。


本轮关键变更(a59f05f)独立核查

Physical attempt 唯一性检查(历史 P2 latent)——已解决
assemble_webmainbench_six_methods.py:21-24 新增 require_unique_attempt_ids 函数,并在三处调用:固定版逻辑结果(line 71)、六版本逻辑结果(line 89)、六版本物理调用(line 92)。与 assemble_webmainbench_full.py:129 的对称检查一致。test_webmainbench_six_methods.py 对重复 ID 和缺失 ID 各有 negative control ✓

"目标正文"列替换"返回成功"
report.py:2794-2799:target_body 基于诊断类别(排除请求失败/空输出/错误页),不依赖 row["ok"],语义更准确。条件延迟分布(successful_by_provider)同步切换 ✓。"Moli 修复前后"对比表同步更改(report.py:3087-3091)✓。test_webmainbench_full_report.py:89-91 验证 chromium=0 和 moli-fixed=1 两个边界值 ✓

preserve_original_origin 代理模式
run_webmainbench_benchmark.py:代理服务器仅在 127.0.0.1 监听;CONNECT 隧道目标硬编码为 127.0.0.1:<server_port>,无 SSRF 风险;ambiguous_paths 机制对同 host+path 多 query 的情况正确返回 404;TLS SAN 覆盖所有原始 hostname ✓。test_webmainbench_fixture.py 补充了三个测试(默认路由、精确 query 匹配、歧义路径 404)✓

headless.py/headless_worker.py:http_proxy 参数正确区分各引擎标志(moli/lightpanda → --http-proxy,obscura → --proxy,Playwright → launch['proxy'])✓


回答内联问题(moli-followup-binding.json)

evaluation/webmainbench-full/ 像这些json,到底是用来干什么的,是做报告的记录吗?不需要啊?为什么要有这个设计?

这些文件是设计所要求的,来源于 AGENTS.md 的两条规则:

  1. "Commit compact path/hash bindings instead"(AGENTS.md line 1)——报告的大型内容文件(prose、failure-analysis、follow-up 数据)存放在 Git 外(~/.browser-eval/),Git 中只保留 hash 绑定文件,以便在不提交大文件的前提下锁定内容完整性。

  2. AGENTS.md line 24(本 PR 新增)——明确规定 evaluation/webmainbench-full/ 下各文件的职责:current-report.json 是不可变的预调用 profile;moli-fixed-report.json 是修复版的独立 profile;publication-target.json 绑定发布版本和 URL;其余三个是对应外部文件的 hash 绑定。

每个文件的具体作用:

  • current-report.json:五方法认证运行的不可变输入 profile(内含数据集 ID、scorer commit、超时等)
  • moli-fixed-report.json:第六方法(修复版 Moli)的独立 profile(含 binary_sha256、source_commit)
  • publication-target.json:Artifact Site 发布目标(profile_sha256 + share_url + expected_remote_version)
  • content-binding.json:锁定外部 report-content.json(报告文案)的 SHA256
  • failure-analysis-binding.json:锁定外部 failure-analysis.json(机器问题审查)的 SHA256
  • moli-followup-binding.json:锁定外部 moli-followup.json(跟进分析)的 SHA256

门控(check_webmainbench_full_report.py:55-60, 79-87)在发布前校验上述所有 hash 绑定,任何外部文件被替换均会导致门控失败。这是保证"可复现的认证链"的关键设计。


各历史问题最终状态

问题 状态
P1 publication_state ✓ AGENTS.md line 24 明确了 split-authority 设计;gate 在 check_webmainbench_full_report.py:55-60 验证绑定完整性
P2 cause matrix 脆弱性 ✓ WEBMAINBENCH_FULL_CAUSE_OWNERS 为共享模块级常量,renderer 与 gate 同源
P2 physical attempt 唯一性 ✓ 本轮 commit a59f05f 新增 require_unique_attempt_ids 并补测试
Finding 1 Linux 路径脱敏 ✓ 早前已修复
Finding 2 文件单侧存在 ValueError ✓ 早前已修复

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 1m 1s —— View job


关于 evaluation/webmainbench-full/ 中这些 JSON 文件的用途

  • 读取 AGENTS.md 和相关 JSON 文件
  • 理解这些 JSON 文件的设计目的
  • 回答问题

这些 JSON 文件分两类,设计目的不同:

1. 大数据绑定(*-binding.json)

content-binding.json、failure-analysis-binding.json、moli-followup-binding.json 都是"紧凑绑定"文件。它们本身很小,只记录路径和 SHA256 哈希:

{
  "relative_path": "failure-analysis.json",
  "sha256": "4186a37..."
}

实际的大数据文件(failure-analysis.json、report-content.json、moli-followup.json)存放在 git 仓库之外(~/.browser-eval/ 目录),不提交到 git。这是 AGENTS.md 第一段的要求:

"Keep report-specific prose, illustrations and review payloads outside Git, alongside frozen evidence. Commit compact path/hash bindings instead."

门控脚本(check_webmainbench_full_report.py)在发布前会验证这些 SHA256,确保本地数据文件与 git 中绑定的版本一致。

2. 报告配置 / 证书文件

  • current-report.json:冻结的五方法基准运行预调用配置(dataset 版本、provider 版本、scorer commit 等)。AGENTS.md 第24行明确要求这个文件是不可变的——一旦认证运行完成就不能修改,否则会使证书失效。
  • moli-fixed-report.json:第六方法(修复版 Moli)的独立预调用配置和证书。
  • publication-target.json:发布目标绑定(两个 profile 的 SHA256、Artifact Site 的 URL 和版本号)。发布后只更新这个文件,不碰 current-report.json,以保证历史调用记录不被篡改。

总结:这套设计是 AGENTS.md 规定的"仓库只存小型绑定/配置,大数据存外部"模式,门控脚本通过 SHA256 保证完整性。这些文件是必须有的,是认证链的一部分。

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated Claude review completed. Review run: https://github.com/lexmount/browser-eval/actions/runs/35976698968. Please check Claude's inline feedback and summary comment for details.

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 11m 57s —— View job


Review 结论

通过


问题及建议

未发现需要阻塞合并的问题。

残余风险(P2):evaluation/webmainbench-full/moli-followup-binding.json 提交到 git 中,绑定了外部 moli-followup.json 的 SHA256,但该文件未在任何构建或发布门控中加载验证(check_webmainbench_full_report.py、report_build.py 均无引用),渲染器(generate_webmainbench_full)也不使用其数据。"Moli 修复前后"章节直接来自六方法合并的 score summaries,与该绑定无关。由于绑定内容不影响报告正确性,当前不阻塞合并;若后续计划将 moli-followup 数据纳入报告,应将其 SHA256 校验加入门控。


各历史问题最终状态(独立核实)

问题 状态 位置
P1 publication_state: "pending" ✓ 已解决 AGENTS.md line 24 明确 split-authority 设计;check_webmainbench_full_report.py:55-59 验证 publication-target.json 中双 profile SHA256、expected_remote_version、share_url、site_slug 绑定完整性
P2 cause matrix 脆弱性 ✓ 已解决 WEBMAINBENCH_FULL_CAUSE_OWNERS 为 report.py:2736 模块级常量;renderer(line 2961)与 gate(check_webmainbench_full_report.py:172)共用同一数据源,覆盖全部 7 个类别
P2 physical attempt 唯一性 ✓ 已解决 assemble_webmainbench_six_methods.py:21-24 定义 require_unique_attempt_ids,在 line 71、89、92 三处调用;test_webmainbench_six_methods.py 有负向控制
Finding 1 Linux 路径脱敏 ✓ 已解决 assemble_webmainbench_full.py:28-30 覆盖 /home/[^/\s:]+ 和 /(?:var/)?tmp/[^\s:]+
Finding 2 文件单侧存在 ValueError ✓ 已解决 review_webmainbench_teds_correction.py:46-48

其他关键设计独立核实

  • six_binding['results_sha256'] vs original-results.jsonl:正确。assemble_webmainbench_six_methods.py 将合并前(pre-TEDS)6 方法 results.jsonl 的 hash 写入 binding;correct_webmainbench_teds.py:162 在纠正时将同一文件复制为 original-results.jsonl,report_build.py:590 和 check_webmainbench_full_report.py:67 均比对此值。逻辑一致 ✓
  • 门控 reviewed != {item for item in failures if item[0] != 'moli-fixed'} 正确排除 moli-fixed 失败不要求基线审查 ✓
  • English not-generated 路由:check_webmainbench_full_report.py:131 验证 en/index.html 存在且含"返回中文报告" ✓
  • test_webmainbench_full_report.py 负向控制覆盖诊断对话框(line 104-109)、高亮(line 112-113)、证据目标(line 119-120)、精确错误日志(line 128-129)、唯一摘要(line 130-131)✓

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 4m 44s —— View job


PR Review

  • Read diff and changed files
  • Review for bugs and security issues
  • Post findings

One latent bug found in the new assembly script.


Bug — six-method-binding.json stores the wrong results_sha256

scripts/assemble_webmainbench_six_methods.py (line ~95)

(output / "results.jsonl").write_text(...)   # overwrites with 6-method combined
...
binding = {
    ...
    "results_sha256": digest(output / "results.jsonl"),   # ← hashes the 6-method combined
    ...
}

digest(output / "results.jsonl") is computed after results.jsonl has already been overwritten with the 6-method combined data (5 methods × 545 + fixed Moli × 545 = 3 270 rows). Both the release gate and the build function compare results_sha256 against original-results.jsonl — the pre-six-method file preserved by correct_webmainbench_teds.py:162:

# check_webmainbench_full_report.py:67
six_binding.get('results_sha256') != hashlib.sha256((root / 'original-results.jsonl').read_bytes()).hexdigest()

# report_build.py:590
or six_binding.get('results_sha256') != digest(source / 'original-results.jsonl')

A binding produced by this script will always fail both checks. The fix is to capture the hash before overwriting, or to hash original-results.jsonl directly:

# replace:
"results_sha256": digest(output / "results.jsonl"),
# with:
"results_sha256": digest(output / "original-results.jsonl"),

Fix this →


No security issues found. The do_CONNECT handler correctly hardcodes 127.0.0.1 as the upstream, preventing SSRF. The SAN construction passes hosts as a CLI argument list (not via shell), so hostile hostnames in frozen records cannot cause injection. HTML uses esc() and safe_href() consistently; JS uses textContent for user-controlled values; viewer path validation blocks .. and restricts prefixes; contained_path() guards all Python-side file access; subprocess calls are constructed as lists throughout.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated Claude review completed. Review run: https://github.com/lexmount/browser-eval/actions/runs/35977918901. Please check Claude's inline feedback and summary comment for details.

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 4m 38s —— View job


Review 结论

通过


问题及建议

未发现需要阻塞合并的问题。

残余风险(P2):evaluation/webmainbench-full/moli-followup-binding.json 在 gate(check_webmainbench_full_report.py)和构建脚本(report_build.py)中均无验证引用,渲染器也不使用该绑定内容。当前不影响报告正确性,若后续纳入报告内容,需将其 SHA256 校验加入门控。


本轮独立核查重点

最新 bot review 的"latent bug"——判定为误报

最近一轮英文 bot review 指出 scripts/assemble_webmainbench_six_methods.py:119 存在 bug:

"results_sha256": digest(output / "results.jsonl"),

认为此处 results.jsonl 已被覆写为六方法合并版,而门控和构建验证的是 original-results.jsonl("pre-six-method file")。

此结论不正确。 实际执行链如下:

  1. assemble_webmainbench_six_methods.py:写入 output/results.jsonl(5+1 = 六方法合并)→ 记录 six_binding["results_sha256"] = SHA256(output/results.jsonl)
  2. correct_webmainbench_teds.py:162:shutil.copy2(source / 'results.jsonl', args.output / 'original-results.jsonl') — 此处 source 是六方法合并目录,original-results.jsonl 是六方法合并版的副本(TEDS 纠正前)
  3. 门控(check_webmainbench_full_report.py:67)和构建(report_build.py:590)均验证:six_binding.results_sha256 == SHA256(original-results.jsonl)

两者均为六方法合并版的 SHA256,完全相同 ✓。bot 将 original-results.jsonl 误识为"五方法预合并版",实为 TEDS 纠正前的六方法合并版。无 bug。

publication-target.json:3 中 profile_sha256 = 8cbceaf9... 与 current-report.json 实际 SHA256(8cbceaf9...)一致 ✓

最新 commit a9c23dc 案例纠正机制

  • certify_webmainbench_case_correction.py:在 plan['parent_results_sha256'] = digest(source/results.jsonl) 锚定 TEDS 纠正后的状态,certify 后 preflight == postflight 保证无重新执行
  • webmainbench_correction.py:validate():核查 parent_results_sha256、输出完整性、六方法全覆盖、物理调用唯一性
  • 门控(check_webmainbench_full_report.py:111)验证 receipt['preflight']['parent_results_sha256'] == teds['output_results_sha256'],确保纠正链接在 TEDS 纠正之后
  • test_webmainbench_case_correction.py 覆盖不完整方法、输入变更、输出变更三种负向控制 ✓

各历史问题最终状态

问题 状态
P1 publication_state: "pending" ✓ AGENTS.md:24 明确 split-authority 设计;gate 在 check_webmainbench_full_report.py:55-59 验证双 profile SHA256、expected_remote_version、share_url、site_slug 绑定完整性
P2 cause matrix 脆弱性 ✓ WEBMAINBENCH_FULL_CAUSE_OWNERS 为模块级常量,renderer 与 gate 共用同一数据源
P2 physical attempt 唯一性 ✓ require_unique_attempt_ids 在三处调用,含六方法物理调用
Finding 1 Linux 路径脱敏 ✓ assemble_webmainbench_full.py:28-30
Finding 2 文件单侧存在 ValueError ✓ review_webmainbench_teds_correction.py:46-48
"latent bug" results_sha256 误报,无需修复(见上方分析)

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 3m 19s —— View job


PR Review

  • Read diff and changed files
  • Check status of previously flagged results_sha256 bug
  • Review latest commit (a9c23dc) for new bugs
  • Post findings

Latest commit (a9c23dc) is otherwise clean. The results_sha256 bug flagged in the previous review is still unresolved.


Still present — results_sha256 stores the wrong hash (2nd carryover)

scripts/assemble_webmainbench_six_methods.py:119

"results_sha256": digest(output / "results.jsonl"),

By line 119, output / "results.jsonl" has already been overwritten at line 90 with the 6-method combined data (3 270 rows). But both verifiers compare results_sha256 against original-results.jsonl — the 5-method pre-six-method file that arrives from the baseline via copytree:

# check_webmainbench_full_report.py:67
six_binding.get('results_sha256') != hashlib.sha256((root / 'original-results.jsonl').read_bytes()).hexdigest()

# report_build.py (added in a9c23dc diff, ~line 590)
six_binding.get('results_sha256') != digest(source / 'original-results.jsonl')

A binding produced by this script will always fail both checks. The fix is to hash the file that the verifiers actually check:

# replace line 119 with:
"results_sha256": digest(output / "original-results.jsonl"),

Fix this →


New code in a9c23dc — no new bugs

harness/web_fetch/webmainbench_correction.py — validate() correctly checks supersedes_attempt_id, frozen input hashes, physical call counts, and physical artifact digests; apply() correctly applies replacements and writes case-correction.json with consistent hashes.

scripts/certify_webmainbench_case_correction.py — binary digest check runs before and after execution; parent_results_sha256 is bound at preflight and verified at postflight; supersedes_attempt_id is set correctly.

Gate additions in check_webmainbench_full_report.py — certificate reconstruction (original_certificate extracts the 5 canonical keys, then JSON-encodes them in the same format as write()) matches the binding correctly. The replacement_bytes hash check iterates in providers order, consistent with how certify_webmainbench_case_correction.py builds corrected.

report_build.py — corrected_keys is subtracted from failures before apply_case_correction is called; corrected cases are excluded from machine-issue accounting before replacement rows are inserted. Illustration copy correctly checks digest(asset_source) != asset['sha256'] before copying.

No security issues found.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated Claude review completed. Review run: https://github.com/lexmount/browser-eval/actions/runs/35985531040. Please check Claude's inline feedback and summary comment for details.

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 2m 31s —— View job


Review 结论

通过


问题及建议

未发现需要阻塞合并的问题。


本轮独立核查:results_sha256 争议终裁

最近两轮英文 bot review 将 scripts/assemble_webmainbench_six_methods.py:122 标为 P1 bug(持续 2 轮),上一轮中文 review 判定为误报。本次独立核查如下:

执行链:

  1. assemble_webmainbench_six_methods.py:90:将 3270 行六方法合并结果写入 output/results.jsonl
  2. assemble_webmainbench_six_methods.py:122:"results_sha256": digest(output / "results.jsonl") → 此时 output/results.jsonl 正是六方法合并版,hash 正确反映其内容
  3. correct_webmainbench_teds.py:162:shutil.copy2(source / 'results.jsonl', args.output / 'original-results.jsonl') → 此处 source 是六方法合并目录,因此 original-results.jsonl 是六方法合并版的精确字节副本
  4. 门控(check_webmainbench_full_report.py:67)和构建(report_build.py:590)均验证 six_binding.results_sha256 == SHA256(original-results.jsonl) → 两者均为六方法合并版,hash 恒等

结论:无 bug。 英文 bot 将 original-results.jsonl 误认为五方法预合并版,实为 TEDS 纠正前的六方法合并副本。assemble_webmainbench_six_methods.py:119-122 中新增的注释已明确说明此语义。


最新 commit df3d7a8 核查

  • 删除 evaluation/webmainbench-full/moli-followup-binding.json:该绑定在门控(check_webmainbench_full_report.py)和构建脚本中均无引用,删除正确,消除了上一轮 review 标注的残余风险 ✓
  • research/report-changes.json:为两条 WebMainBench 条目补充了空 changes 列表的英文内容,修复 CI 历史验证 ✓
  • assemble_webmainbench_six_methods.py:新增注释,无逻辑变更 ✓

各历史问题最终状态

问题 状态
P1 publication_state: "pending" ✓ AGENTS.md:24 明确 split-authority 设计;check_webmainbench_full_report.py:55-59 验证双 profile SHA256、版本、URL 绑定完整性
P2 cause matrix 脆弱性 ✓ WEBMAINBENCH_FULL_CAUSE_OWNERS 为 report.py 模块级常量,renderer 与 gate 共用同一数据源
P2 physical attempt 唯一性 ✓ require_unique_attempt_ids 在三处调用(含六方法物理调用)
Finding 1 Linux 路径脱敏 ✓ assemble_webmainbench_full.py:28-30
Finding 2 文件单侧存在 ValueError ✓ review_webmainbench_teds_correction.py:46-48
results_sha256 "bug" 误报,original-results.jsonl 是六方法合并版的副本,hash 恒等,无需修复
未使用的 moli-followup-binding.json ✓ 本轮 df3d7a8 已删除

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @lanyue-llk's task in 1m 50s —— View job


PR Review

  • 读取关键变更文件
  • 核实 results_sha256 争议(两轮 bot review 结论相反)
  • 检查最新 commit (df3d7a8) 的新问题
  • 输出 review 结论

通过。未发现阻塞合并的问题。


results_sha256 争议终结

英文 bot review(两轮)持续标记 assemble_webmainbench_six_methods.py:122 为 bug:

digest(output / "results.jsonl") 在 results.jsonl 已被覆写为六方法合并版后才执行,但 gate 验证的是 original-results.jsonl。

此结论错误。 追踪实际执行链:

  1. assemble_webmainbench_six_methods.py line 90:写入 output/results.jsonl(六方法合并,3270 行)
  2. line 122:results_sha256 = digest(output / "results.jsonl") → 六方法合并版的 SHA256 ✓
  3. correct_webmainbench_teds.py line 162:copy2(source / 'results.jsonl', args.output / 'original-results.jsonl') — 此处 source 是第 1 步的 assembled 目录,所以 original-results.jsonl 是六方法合并版的副本(TEDS 纠正前)
  4. Gate(check_webmainbench_full_report.py:67)验证:six_binding['results_sha256'] == SHA256(original-results.jsonl)

两者均是六方法合并版(TEDS 纠正前)的 SHA256,完全一致。英文 bot 将 original-results.jsonl 误认为"五方法预合并版",实为六方法合并版的 TEDS 纠正前副本。无 bug。

最新 commit df3d7a8 在 lines 119–121 补入了说明注释,直接消除了这一歧义。


最新 commit (df3d7a8) 核查

  • 删除 evaluation/webmainbench-full/moli-followup-binding.json:该文件在 gate 和构建脚本中均无验证引用,删除合理。
  • assemble_webmainbench_six_methods.py:新增注释说明 results_sha256 语义,无逻辑变更。
  • research/report-changes.json:补全最新发布条目的 changes 内容,格式正确。

各历史问题最终状态

问题 状态
P1 publication_state: "pending" ✓ AGENTS.md line 24 明确 split-authority 设计;gate 验证 publication-target.json 双 profile SHA256 和发布字段
P2 cause matrix 脆弱性 ✓ WEBMAINBENCH_FULL_CAUSE_OWNERS 为模块级常量,renderer 与 gate 共用同一数据源
P2 physical attempt 唯一性 ✓ require_unique_attempt_ids 在三处调用,含六方法物理调用
results_sha256 "bug" 误报,无需修复;df3d7a8 已补注释消除歧义
Finding 1 Linux 路径脱敏 ✓ 早前已修复
Finding 2 文件单侧存在 ValueError ✓ 早前已修复

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated Claude review completed. Review run: https://github.com/lexmount/browser-eval/actions/runs/35987454867. Please check Claude's inline feedback and summary comment for details.

@lanyue-llk
lanyue-llk merged commit 57f0b87 into main Sep 24, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant