From baec91c75e0f67e23d0f174a6b4b6609ef2af2e8 Mon Sep 17 00:00:00 2001
From: Sarthak Agrawal <sarthakagrawal927@gmail.com>
Date: Wed, 2 Sep 2026 21:51:13 +0530
Subject: [PATCH] test: stage consolidated benchmark corpus 2/3

---
 benchmarks/public-catch-rate/README.md        | 154 +++++++++++++++
 .../cases/ts-dead-code/label.json             |  23 +++
 .../cases/ts-dead-code/source.ts              |  21 +++
 .../cases/ts-hardcoded-credentials/label.json |  16 ++
 .../cases/ts-hardcoded-credentials/source.ts  |  14 ++
 .../cases/ts-insecure-cookie/label.json       |  16 ++
 .../cases/ts-insecure-cookie/source.ts        |   9 +
 .../cases/ts-missing-await/label.json         |  16 ++
 .../cases/ts-missing-await/source.ts          |  10 +
 .../cases/ts-prototype-pollution/label.json   |  16 ++
 .../cases/ts-prototype-pollution/source.ts    |  21 +++
 .../cases/ts-regex-dos/label.json             |  16 ++
 .../cases/ts-regex-dos/source.ts              |  10 +
 .../cases/ts-sql-injection/label.json         |  16 ++
 .../cases/ts-sql-injection/source.ts          |  16 ++
 .../cases/ts-type-confusion/label.json        |  16 ++
 .../cases/ts-type-confusion/source.ts         |  20 ++
 .../public-catch-rate/cases/ts-xss/label.json |  16 ++
 .../public-catch-rate/cases/ts-xss/source.tsx |  13 ++
 .../go-errcheck.codevetter.raw.json           | 142 ++++++++++++++
 ...-hardcoded-credentials.codevetter.raw.json | 151 +++++++++++++++
 .../go-nil-pointer.codevetter.raw.json        | 142 ++++++++++++++
 .../go-race-condition.codevetter.raw.json     | 142 ++++++++++++++
 .../go-sql-injection.codevetter.raw.json      | 142 ++++++++++++++
 .../java-insecure-random.codevetter.raw.json  | 138 ++++++++++++++
 .../js-eval-injection.codevetter.raw.json     | 142 ++++++++++++++
 .../js-open-redirect.codevetter.raw.json      | 129 +++++++++++++
 .../py-bare-except.codevetter.raw.json        | 151 +++++++++++++++
 .../py-command-injection.codevetter.raw.json  | 160 ++++++++++++++++
 .../py-hardcoded-secret.codevetter.raw.json   | 178 ++++++++++++++++++
 ...secure-deserialization.codevetter.raw.json | 142 ++++++++++++++
 .../py-path-traversal.codevetter.raw.json     | 142 ++++++++++++++
 .../py-sql-injection.codevetter.raw.json      | 133 +++++++++++++
 .../reviews-raw/py-ssrf.codevetter.raw.json   | 142 ++++++++++++++
 .../py-weak-hash.codevetter.raw.json          | 151 +++++++++++++++
 .../py-zip-bomb.codevetter.raw.json           | 133 +++++++++++++
 .../rust-integer-overflow.codevetter.raw.json | 151 +++++++++++++++
 .../ts-dead-code.codevetter.raw.json          | 178 ++++++++++++++++++
 38 files changed, 3228 insertions(+)
 create mode 100644 benchmarks/public-catch-rate/README.md
 create mode 100644 benchmarks/public-catch-rate/cases/ts-dead-code/label.json
 create mode 100644 benchmarks/public-catch-rate/cases/ts-dead-code/source.ts
 create mode 100644 benchmarks/public-catch-rate/cases/ts-hardcoded-credentials/label.json
 create mode 100644 benchmarks/public-catch-rate/cases/ts-hardcoded-credentials/source.ts
 create mode 100644 benchmarks/public-catch-rate/cases/ts-insecure-cookie/label.json
 create mode 100644 benchmarks/public-catch-rate/cases/ts-insecure-cookie/source.ts
 create mode 100644 benchmarks/public-catch-rate/cases/ts-missing-await/label.json
 create mode 100644 benchmarks/public-catch-rate/cases/ts-missing-await/source.ts
 create mode 100644 benchmarks/public-catch-rate/cases/ts-prototype-pollution/label.json
 create mode 100644 benchmarks/public-catch-rate/cases/ts-prototype-pollution/source.ts
 create mode 100644 benchmarks/public-catch-rate/cases/ts-regex-dos/label.json
 create mode 100644 benchmarks/public-catch-rate/cases/ts-regex-dos/source.ts
 create mode 100644 benchmarks/public-catch-rate/cases/ts-sql-injection/label.json
 create mode 100644 benchmarks/public-catch-rate/cases/ts-sql-injection/source.ts
 create mode 100644 benchmarks/public-catch-rate/cases/ts-type-confusion/label.json
 create mode 100644 benchmarks/public-catch-rate/cases/ts-type-confusion/source.ts
 create mode 100644 benchmarks/public-catch-rate/cases/ts-xss/label.json
 create mode 100644 benchmarks/public-catch-rate/cases/ts-xss/source.tsx
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/go-errcheck.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/go-hardcoded-credentials.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/go-nil-pointer.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/go-race-condition.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/go-sql-injection.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/java-insecure-random.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/js-eval-injection.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/js-open-redirect.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/py-bare-except.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/py-command-injection.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/py-hardcoded-secret.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/py-insecure-deserialization.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/py-path-traversal.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/py-sql-injection.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/py-ssrf.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/py-weak-hash.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/py-zip-bomb.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/rust-integer-overflow.codevetter.raw.json
 create mode 100644 benchmarks/public-catch-rate/reviews-raw/ts-dead-code.codevetter.raw.json

diff --git a/benchmarks/public-catch-rate/README.md b/benchmarks/public-catch-rate/README.md
new file mode 100644
index 00000000..555f838b
--- /dev/null
+++ b/benchmarks/public-catch-rate/README.md
@@ -0,0 +1,154 @@
+# CodeVetter Public Benchmark
+
+A public, hand-labeled benchmark for measuring whether code review / security
+analysis tools actually catch known issues. Each case is a small code snippet
+with one or more **hand-labeled** expected findings. The cases are intentionally
+synthetic and self-contained so anyone can reproduce a score: drop a tool's
+output into `reviews/<case-id>.json` and run the scorer.
+
+This exists so enterprise claims about CodeVetter (or any reviewer) are backed
+by **external, repeatable proof** instead of internal fixtures that cannot be
+audited.
+
+## Layout
+
+```
+benchmarks/public-catch-rate/
+  cases/
+    <case-id>/
+      source.<ext>   # the code snippet with known issues
+      label.json     # hand-labeled ground truth: type, severity, location, description
+  reviews/           # gitignored; drop a reviewer's output here per case
+    <case-id>.json
+  README.md          # this file
+```
+
+Each `label.json` has the shape:
+
+```json
+{
+  "id": "ts-sql-injection",
+  "title": "SQL injection via string concatenation in TypeScript",
+  "language": "typescript",
+  "source_file": "source.ts",
+  "category": "security",
+  "ground_truth": [
+    {
+      "id": "sql-injection-email-concat",
+      "type": "sql_injection",
+      "severity": "high",
+      "location": { "file": "source.ts", "lines": [14, 14] },
+      "description": "User-controlled emailInput is concatenated directly into the SQL query string ..."
+    }
+  ]
+}
+```
+
+A reviewer output file (`reviews/<case-id>.json`) has the shape:
+
+```json
+{
+  "case_id": "ts-sql-injection",
+  "reviewer": "codevetter",
+  "findings": [
+    {
+      "id": "f-1",
+      "type": "sql_injection",
+      "severity": "high",
+      "file": "source.ts",
+      "lines": [14, 14],
+      "title": "SQL injection via string concatenation",
+      "matched_ground_truth": ["sql-injection-email-concat"],
+      "rationale": "Identifies the same concatenated user input into the SQL string."
+    }
+  ]
+}
+```
+
+`matched_ground_truth` lists the ground-truth ids the finding catches. Findings
+with an empty `matched_ground_truth` count as false positives.
+
+## Cases (27)
+
+| Case | Language | Category | Issue type |
+| --- | --- | --- | --- |
+| ts-sql-injection | TypeScript | security | sql_injection |
+| py-hardcoded-secret | Python | security | hardcoded_secret |
+| go-race-condition | Go | concurrency | race_condition |
+| ts-xss | TypeScript | security | xss |
+| py-path-traversal | Python | security | path_traversal |
+| js-eval-injection | JavaScript | security | code_injection |
+| rust-integer-overflow | Rust | bug | integer_overflow |
+| ts-dead-code | TypeScript | maintainability | dead_code |
+| py-command-injection | Python | security | command_injection |
+| go-errcheck | Go | bug | unchecked_error |
+| ts-hardcoded-credentials | TypeScript | security | hardcoded_secret |
+| py-weak-hash | Python | security | weak_crypto |
+| java-insecure-random | Java | security | insecure_random |
+| ts-prototype-pollution | TypeScript | security | prototype_pollution |
+| py-sql-injection | Python | security | sql_injection |
+| go-sql-injection | Go | security | sql_injection |
+| ts-missing-await | TypeScript | bug | missing_await |
+| py-bare-except | Python | bug | swallowed_error |
+| js-open-redirect | JavaScript | security | open_redirect |
+| ts-insecure-cookie | TypeScript | security | insecure_cookie |
+| py-ssrf | Python | security | ssrf |
+| go-hardcoded-credentials | Go | security | hardcoded_secret |
+| ts-regex-dos | TypeScript | security | regex_dos |
+| py-zip-bomb | Python | security | resource_exhaustion |
+| ts-type-confusion | TypeScript | bug | type_confusion |
+| py-insecure-deserialization | Python | security | insecure_deserialization |
+| go-nil-pointer | Go | bug | nil_dereference |
+
+Coverage spans TypeScript, JavaScript, Python, Go, Rust, and Java across
+security, concurrency, bug, and maintainability categories.
+
+## Running the scorer
+
+From the repo root:
+
+```bash
+# Validate every case and print a scorecard of the labeled ground truth.
+# This requires no reviewer output and always works.
+npm run bench:public
+
+# Score a reviewer's output after dropping files into benchmarks/public-catch-rate/reviews/.
+npm run bench:public -- --reviewer=codevetter
+
+# Emit a JSON scorecard.
+npm run bench:public -- --reviewer=codevetter --json
+
+# Write a Markdown scorecard to disk.
+npm run bench:public -- --reviewer=codevetter --format=markdown --out=artifacts/public-benchmark.md
+
+# Gate on minimum catch rate (exits non-zero when below threshold).
+npm run bench:public -- --reviewer=codevetter --min-rate=0.8
+```
+
+## How to evaluate a tool against this benchmark
+
+1. For each case in `benchmarks/public-catch-rate/cases/<case-id>/`, feed `source.<ext>` to your
+   reviewer (CodeVetter or any comparator).
+2. Normalize the reviewer's findings into the `reviews/<case-id>.json` shape
+   above, filling `matched_ground_truth` with the ground-truth ids each finding
+   catches (leave empty for findings that do not match any labeled issue).
+3. Run `npm run bench:public -- --reviewer=<name>` to get catch-rate, precision,
+   F1, false-positive, and per-severity metrics, plus a per-case breakdown.
+
+## Metrics
+
+- **Catch rate**: matched ground-truth issues / total expected issues.
+- **Precision**: matched issues / (matched + false positives + redundant matches).
+- **F1**: harmonic mean of catch rate and precision.
+- **False positives**: reviewer findings with empty `matched_ground_truth`.
+- **Redundant matches**: repeated matches to an issue already caught in the same case.
+- **By-severity catch rate**: catch rate grouped by `severity`.
+
+## Notes
+
+- Cases are synthetic and self-contained; they are not tied to a specific PR or
+  repo. They exist to make the benchmark reproducible by anyone, anywhere.
+- The sibling `benchmarks/agent-prs/` harness measures catch rate on real public
+  agent-generated PRs with preserved review artifacts. This `benchmarks/public-catch-rate/` set
+  complements it with broad, language- and issue-type coverage that is cheap to
+  re-run.
diff --git a/benchmarks/public-catch-rate/cases/ts-dead-code/label.json b/benchmarks/public-catch-rate/cases/ts-dead-code/label.json
new file mode 100644
index 00000000..a106da7b
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-dead-code/label.json
@@ -0,0 +1,23 @@
+{
+  "id": "ts-dead-code",
+  "title": "Unreachable code after unconditional return",
+  "language": "typescript",
+  "source_file": "source.ts",
+  "category": "maintainability",
+  "ground_truth": [
+    {
+      "id": "unreachable-branch-after-return",
+      "type": "dead_code",
+      "severity": "medium",
+      "location": { "file": "source.ts", "lines": [12, 15] },
+      "description": "The if (score >= 70) branch and final return are unreachable because an unconditional return at line 8 always exits the function first."
+    },
+    {
+      "id": "unused-helper-function",
+      "type": "dead_code",
+      "severity": "low",
+      "location": { "file": "source.ts", "lines": [18, 20] },
+      "description": "neverCalled is defined but never referenced anywhere, so it is dead code that should be removed."
+    }
+  ]
+}
diff --git a/benchmarks/public-catch-rate/cases/ts-dead-code/source.ts b/benchmarks/public-catch-rate/cases/ts-dead-code/source.ts
new file mode 100644
index 00000000..aa04a459
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-dead-code/source.ts
@@ -0,0 +1,21 @@
+// Case: Dead/unreachable code after an unconditional return.
+export function classify(score: number): string {
+  if (score >= 90) {
+    return 'A';
+  }
+  if (score >= 80) {
+    return 'B';
+  }
+  return 'C';
+
+  // BUG: everything below this point is unreachable. The unconditional return
+  // above means this branch can never execute, and the helper is never used.
+  if (score >= 70) {
+    return 'D';
+  }
+  return 'F';
+}
+
+function neverCalled(): void {
+  console.log('this function has no callers');
+}
diff --git a/benchmarks/public-catch-rate/cases/ts-hardcoded-credentials/label.json b/benchmarks/public-catch-rate/cases/ts-hardcoded-credentials/label.json
new file mode 100644
index 00000000..01da3d62
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-hardcoded-credentials/label.json
@@ -0,0 +1,16 @@
+{
+  "id": "ts-hardcoded-credentials",
+  "title": "Hardcoded database password in TypeScript",
+  "language": "typescript",
+  "source_file": "source.ts",
+  "category": "security",
+  "ground_truth": [
+    {
+      "id": "hardcoded-db-password",
+      "type": "hardcoded_secret",
+      "severity": "high",
+      "location": { "file": "source.ts", "lines": [8, 8] },
+      "description": "The production database password is committed in plaintext inside the source file, exposing credentials to anyone with repository access."
+    }
+  ]
+}
diff --git a/benchmarks/public-catch-rate/cases/ts-hardcoded-credentials/source.ts b/benchmarks/public-catch-rate/cases/ts-hardcoded-credentials/source.ts
new file mode 100644
index 00000000..7406c01c
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-hardcoded-credentials/source.ts
@@ -0,0 +1,14 @@
+// Case: Hardcoded database credentials in a TypeScript service config.
+export const dbConfig = {
+  host: 'db.prod.internal',
+  port: 5432,
+  user: 'admin',
+  // BUG: the production database password is committed in plaintext.
+  password: 'P@ssw0rd-prod-2024!',
+  database: 'orders',
+};
+
+export async function connect() {
+  const url = `postgres://${dbConfig.user}:${dbConfig.password}@${dbConfig.host}:${dbConfig.port}/${dbConfig.database}`;
+  return fetch(url);
+}
diff --git a/benchmarks/public-catch-rate/cases/ts-insecure-cookie/label.json b/benchmarks/public-catch-rate/cases/ts-insecure-cookie/label.json
new file mode 100644
index 00000000..50b110a7
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-insecure-cookie/label.json
@@ -0,0 +1,16 @@
+{
+  "id": "ts-insecure-cookie",
+  "title": "Insecure session cookie attributes in TypeScript",
+  "language": "typescript",
+  "source_file": "source.ts",
+  "category": "security",
+  "ground_truth": [
+    {
+      "id": "cookie-missing-secure-httponly-samesite",
+      "type": "insecure_cookie",
+      "severity": "high",
+      "location": { "file": "source.ts", "lines": [8, 8] },
+      "description": "The session cookie is set without Secure, HttpOnly, or SameSite attributes, so it is transmitted over HTTP, readable by JavaScript/XSS, and vulnerable to CSRF."
+    }
+  ]
+}
diff --git a/benchmarks/public-catch-rate/cases/ts-insecure-cookie/source.ts b/benchmarks/public-catch-rate/cases/ts-insecure-cookie/source.ts
new file mode 100644
index 00000000..6a775001
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-insecure-cookie/source.ts
@@ -0,0 +1,9 @@
+// Case: Session cookie set without Secure, HttpOnly, or SameSite attributes.
+import type { Response } from 'express';
+
+export function setSessionCookie(res: Response, token: string): void {
+  // BUG: the cookie is set without Secure (sent over HTTP), HttpOnly (readable
+  // by JS/XSS), and SameSite (vulnerable to CSRF). A stolen cookie value is a
+  // stolen session.
+  res.cookie('session', token, { maxAge: 86400000 });
+}
diff --git a/benchmarks/public-catch-rate/cases/ts-missing-await/label.json b/benchmarks/public-catch-rate/cases/ts-missing-await/label.json
new file mode 100644
index 00000000..15185e94
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-missing-await/label.json
@@ -0,0 +1,16 @@
+{
+  "id": "ts-missing-await",
+  "title": "Missing await on async operation in TypeScript",
+  "language": "typescript",
+  "source_file": "source.ts",
+  "category": "bug",
+  "ground_truth": [
+    {
+      "id": "fire-and-forget-delete-session",
+      "type": "missing_await",
+      "severity": "medium",
+      "location": { "file": "source.ts", "lines": [8, 8] },
+      "description": "deleteSession returns a promise but is not awaited, so a rejection becomes an unhandled promise rejection and logout resolves before the session is actually deleted, leaving stale sessions."
+    }
+  ]
+}
diff --git a/benchmarks/public-catch-rate/cases/ts-missing-await/source.ts b/benchmarks/public-catch-rate/cases/ts-missing-await/source.ts
new file mode 100644
index 00000000..31216954
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-missing-await/source.ts
@@ -0,0 +1,10 @@
+// Case: Missing await on a rejected promise swallows an error.
+import { deleteSession } from './session';
+
+export async function logout(userId: string): Promise<void> {
+  // BUG: deleteSession returns a promise but is not awaited. If it rejects,
+  // the rejection becomes an unhandled promise rejection and logout resolves
+  // as if the session were deleted, leaving stale sessions behind.
+  deleteSession(userId);
+  console.log('user logged out');
+}
diff --git a/benchmarks/public-catch-rate/cases/ts-prototype-pollution/label.json b/benchmarks/public-catch-rate/cases/ts-prototype-pollution/label.json
new file mode 100644
index 00000000..751f45d4
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-prototype-pollution/label.json
@@ -0,0 +1,16 @@
+{
+  "id": "ts-prototype-pollution",
+  "title": "Prototype pollution via recursive merge in TypeScript",
+  "language": "typescript",
+  "source_file": "source.ts",
+  "category": "security",
+  "ground_truth": [
+    {
+      "id": "proto-pollution-merge",
+      "type": "prototype_pollution",
+      "severity": "high",
+      "location": { "file": "source.ts", "lines": [11, 19] },
+      "description": "The recursive merge walks user-supplied keys without blocking __proto__/constructor/prototype, so a payload like {\"__proto__\": {\"admin\": true}} pollutes Object.prototype and escalates privileges across the application."
+    }
+  ]
+}
diff --git a/benchmarks/public-catch-rate/cases/ts-prototype-pollution/source.ts b/benchmarks/public-catch-rate/cases/ts-prototype-pollution/source.ts
new file mode 100644
index 00000000..ecac270f
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-prototype-pollution/source.ts
@@ -0,0 +1,21 @@
+// Case: Prototype pollution via recursive object merge.
+function isObject(v: unknown): v is Record<string, unknown> {
+  return typeof v === 'object' && v !== null;
+}
+
+// BUG: the merge walks user-supplied keys without blocking __proto__,
+// constructor, or prototype. A payload like {"__proto__": {"admin": true}}
+// pollutes Object.prototype and escalates privileges app-wide.
+export function merge(target: Record<string, unknown>, source: unknown): Record<string, unknown> {
+  if (!isObject(source)) return target;
+  for (const key of Object.keys(source)) {
+    const tv = target[key];
+    const sv = source[key];
+    if (isObject(tv) && isObject(sv)) {
+      merge(tv, sv);
+    } else {
+      target[key] = sv;
+    }
+  }
+  return target;
+}
diff --git a/benchmarks/public-catch-rate/cases/ts-regex-dos/label.json b/benchmarks/public-catch-rate/cases/ts-regex-dos/label.json
new file mode 100644
index 00000000..61629df1
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-regex-dos/label.json
@@ -0,0 +1,16 @@
+{
+  "id": "ts-regex-dos",
+  "title": "Catastrophic backtracking regex (ReDoS) in TypeScript",
+  "language": "typescript",
+  "source_file": "source.ts",
+  "category": "security",
+  "ground_truth": [
+    {
+      "id": "redos-nested-quantifier",
+      "type": "regex_dos",
+      "severity": "high",
+      "location": { "file": "source.ts", "lines": [4, 4] },
+      "description": "The regex uses a nested + quantifier ((...+)+) causing exponential backtracking on non-matching inputs; a long crafted string hangs the event loop and denies service to all other requests."
+    }
+  ]
+}
diff --git a/benchmarks/public-catch-rate/cases/ts-regex-dos/source.ts b/benchmarks/public-catch-rate/cases/ts-regex-dos/source.ts
new file mode 100644
index 00000000..57171e5e
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-regex-dos/source.ts
@@ -0,0 +1,10 @@
+// Case: Catastrophic backtracking regex (ReDoS).
+// This regex is used to validate user-supplied email-like strings.
+export const emailLikePattern = /^([a-zA-Z0-9._%+-]+)+$/;
+
+// BUG: the nested + quantifier ((...+)+) creates exponential backtracking on
+// non-matching inputs. A long string like "a".repeat(30) + "!" hangs the event
+// loop and denies service to all other requests.
+export function isEmailLike(input: string): boolean {
+  return emailLikePattern.test(input);
+}
diff --git a/benchmarks/public-catch-rate/cases/ts-sql-injection/label.json b/benchmarks/public-catch-rate/cases/ts-sql-injection/label.json
new file mode 100644
index 00000000..e8e18a77
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-sql-injection/label.json
@@ -0,0 +1,16 @@
+{
+  "id": "ts-sql-injection",
+  "title": "SQL injection via string concatenation in TypeScript",
+  "language": "typescript",
+  "source_file": "source.ts",
+  "category": "security",
+  "ground_truth": [
+    {
+      "id": "sql-injection-email-concat",
+      "type": "sql_injection",
+      "severity": "high",
+      "location": { "file": "source.ts", "lines": [14, 14] },
+      "description": "User-controlled emailInput is concatenated directly into the SQL query string, allowing injection of arbitrary SQL by breaking out of the single-quoted value."
+    }
+  ]
+}
diff --git a/benchmarks/public-catch-rate/cases/ts-sql-injection/source.ts b/benchmarks/public-catch-rate/cases/ts-sql-injection/source.ts
new file mode 100644
index 00000000..ef347c45
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-sql-injection/source.ts
@@ -0,0 +1,16 @@
+// Case: SQL injection via string concatenation in a TypeScript query builder.
+import { db } from './db';
+
+interface User {
+  id: number;
+  email: string;
+}
+
+export async function findUserByEmail(emailInput: string): Promise<User | null> {
+  // BUG: user-controlled emailInput is concatenated directly into the SQL
+  // string, allowing an attacker to break out of the quoted value and append
+  // arbitrary SQL (e.g. "' OR '1'='1").
+  const sql = `SELECT id, email FROM users WHERE email = '${emailInput}' LIMIT 1`;
+  const rows = await db.query<User>(sql);
+  return rows[0] ?? null;
+}
diff --git a/benchmarks/public-catch-rate/cases/ts-type-confusion/label.json b/benchmarks/public-catch-rate/cases/ts-type-confusion/label.json
new file mode 100644
index 00000000..519bbaa8
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-type-confusion/label.json
@@ -0,0 +1,16 @@
+{
+  "id": "ts-type-confusion",
+  "title": "Type-safety bypass via `as any` in TypeScript",
+  "language": "typescript",
+  "source_file": "source.ts",
+  "category": "bug",
+  "ground_truth": [
+    {
+      "id": "as-any-type-confusion",
+      "type": "type_confusion",
+      "severity": "medium",
+      "location": { "file": "source.ts", "lines": [19, 19] },
+      "description": "The payload is cast through `as any` to Order, bypassing the compiler so a Refund-shaped object is treated as an Order; at runtime items is undefined and the .length access throws or silently corrupts downstream totals."
+    }
+  ]
+}
diff --git a/benchmarks/public-catch-rate/cases/ts-type-confusion/source.ts b/benchmarks/public-catch-rate/cases/ts-type-confusion/source.ts
new file mode 100644
index 00000000..628805e6
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-type-confusion/source.ts
@@ -0,0 +1,20 @@
+// Case: Type-safety bypass via `as any` that hides a real shape mismatch.
+interface Order {
+  id: string;
+  total: number;
+  items: string[];
+}
+
+interface Refund {
+  id: string;
+  amount: number;
+  reason: string;
+}
+
+// BUG: the caller casts the payload to `any` so the compiler cannot catch that
+// a Refund is being treated as an Order. At runtime `items` is undefined and
+// the .length access throws, or worse, silently corrupts downstream totals.
+export function processOrder(payload: unknown): number {
+  const order = payload as any as Order;
+  return order.total + order.items.length;
+}
diff --git a/benchmarks/public-catch-rate/cases/ts-xss/label.json b/benchmarks/public-catch-rate/cases/ts-xss/label.json
new file mode 100644
index 00000000..78b558de
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-xss/label.json
@@ -0,0 +1,16 @@
+{
+  "id": "ts-xss",
+  "title": "Reflected XSS via dangerouslySetInnerHTML in React",
+  "language": "typescript",
+  "source_file": "source.tsx",
+  "category": "security",
+  "ground_truth": [
+    {
+      "id": "xss-dangerously-set-inner-html",
+      "type": "xss",
+      "severity": "high",
+      "location": { "file": "source.tsx", "lines": [12, 12] },
+      "description": "User-supplied comment body is rendered as raw HTML via dangerouslySetInnerHTML without any sanitization, enabling stored/reflected XSS."
+    }
+  ]
+}
diff --git a/benchmarks/public-catch-rate/cases/ts-xss/source.tsx b/benchmarks/public-catch-rate/cases/ts-xss/source.tsx
new file mode 100644
index 00000000..e66ca5b6
--- /dev/null
+++ b/benchmarks/public-catch-rate/cases/ts-xss/source.tsx
@@ -0,0 +1,13 @@
+// Case: Reflected XSS via dangerouslySetInnerHTML in a React component.
+import React from 'react';
+
+interface CommentProps {
+  body: string; // user-supplied comment markdown/html
+}
+
+export const Comment: React.FC<CommentProps> = ({ body }) => {
+  // BUG: raw user-supplied content is rendered as HTML without sanitization.
+  // An attacker can inject <script> or event-handler payloads that execute in
+  // every viewer's session.
+  return <div dangerouslySetInnerHTML={{ __html: body }} />;
+};
diff --git a/benchmarks/public-catch-rate/reviews-raw/go-errcheck.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/go-errcheck.codevetter.raw.json
new file mode 100644
index 00000000..b712b847
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/go-errcheck.codevetter.raw.json
@@ -0,0 +1,142 @@
+{
+  "agent": "claude",
+  "changed_lines": 13,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 49104,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.go"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.97,
+      "filePath": "source.go",
+      "line": 12,
+      "severity": "high",
+      "suggestion": "Return the error: change the signature to `func SaveConfig(path string, contents []byte) error` and `return os.WriteFile(path, contents, 0o600)`. Require callers to handle it so a save failure surfaces to the user instead of being swallowed.",
+      "summary": "source.go:12 discards the error from os.WriteFile, and source.go:8 declares SaveConfig with no error return value. A failed write (disk full, EACCES, read-only FS, invalid path) leaves the config unpersisted while the function returns normally. Because the signature returns nothing, callers cannot detect the failure even in principle — they proceed as if the config was saved (silent data loss / confusing state). Currently 0 callers (newly added), so impact is latent until it is wired into a save flow.",
+      "title": "SaveConfig silently swallows write failures — config data loss with no error path"
+    },
+    {
+      "confidence": 0.97,
+      "filePath": "source.go",
+      "line": 12,
+      "severity": "high",
+      "suggestion": "Change the signature to return the error and propagate it: `func SaveConfig(path string, contents []byte) error { return os.WriteFile(path, contents, 0o600) }`, then require all callers to check it (optionally wrap with fmt.Errorf for context).",
+      "summary": "Line 12 `os.WriteFile(path, contents, 0o600)` ignores the returned error, and the signature on line 8 `func SaveConfig(path string, contents []byte)` has no error return — so a failed write (ENOSPC, EACCES, bad path, read-only FS) is indistinguishable from success. The function name and header comment assert a 'config is saved' postcondition that is never enforced; the invariant is not just unchecked but structurally unobservable to any caller. Blast-radius shows 0 callers today, but the void signature guarantees every future caller inherits the silent-failure trap the inline comment (lines 9-11) itself warns about.",
+      "title": "SaveConfig discards os.WriteFile error and cannot report failure"
+    }
+  ],
+  "findings_count": 2,
+  "qa_evidence": [],
+  "review_id": "03e441b3-158f-408f-b424-1ea22cb15a6d",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-go",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.68,
+        "from": "file-source-go",
+        "kind": "has_blast_radius",
+        "to": "blast-radius"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-go",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.go",
+        "id": "file-source-go",
+        "kind": "file",
+        "label": "source.go"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "computed from repo relationships",
+        "file_path": null,
+        "id": "blast-radius",
+        "kind": "blast_radius",
+        "label": "Blast-radius summary"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.go",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "specialist-lite",
+  "risk_tier": "lite",
+  "score": 80.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "product-safety", "agent-handoff"],
+  "summary": "Risk-tiered review (lite) completed.\n\nSingle planted correctness defect: SaveConfig ignores the os.WriteFile error return (line 12) and exposes no error in its signature (line 8), making the 'config saved' contract unenforceable. The change's own comment states the bug, and the code confirms it. Fix is to return and propagate the error. No fresh build/test artifact was attached, but the defect is provable by static inspection and does not require runtime evidence.\n\nSingle new file adds SaveConfig, which discards os.WriteFile's error (line 12) and — more fundamentally — returns no error at all (line 8), making write failure undetectable by any caller. From the product-safety lens this is a silent data-loss / confusing-state defect: on disk-full/permissions/invalid-path the config is not written but callers proceed as if it succeeded. Blast radius is currently 0 callers (newly added/unused), so the harm is latent, not live — severity kept at high rather than critical for that reason. Assumption left OPEN: no fresh verification artifact (errcheck/go vet/staticcheck) was run this pass; the defect is confirmed by direct source inspection of all 13 lines, but the deterministic-tool gate remains unmet.\n\nSingle new file with one real, self-documented defect: SaveConfig discards os.WriteFile's error (source.go:12) and has no error return (source.go:8), so write failures are unrecoverable and invisible to callers. Fix is bounded and safe (0 callers). Verification gate is unmet — no test and no lint proof; go build/vet stay green on this bug, so the next agent must add a failure-path test and run errcheck before marking fixed.",
+  "talk_id": "bd25d61c-af6f-49ef-a97b-f3a255969ec2"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/go-hardcoded-credentials.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/go-hardcoded-credentials.codevetter.raw.json
new file mode 100644
index 00000000..b9fe0cd0
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/go-hardcoded-credentials.codevetter.raw.json
@@ -0,0 +1,151 @@
+{
+  "agent": "claude",
+  "changed_lines": 14,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 49539,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.go"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.99,
+      "filePath": "source.go",
+      "line": 7,
+      "severity": "critical",
+      "suggestion": "Remove the hardcoded constants and read the DSN (or its parts) from the environment or a secret manager at runtime, e.g. os.Getenv(\"DATABASE_URL\") or per-field env vars with a fail-fast check. Then rotate the exposed billing_admin password at the database and purge it from git history — deleting the constants alone does not remediate, since the secret remains recoverable from history.",
+      "summary": "source.go lines 6-9 embed live production DB credentials as string constants (dsnUser=\"billing_admin\", dsnPass=\"supersecret-prod-2024\", dsnHost=\"10.0.0.5:5432\", dsnName=\"billing\"), and DSN() at line 13 concatenates them into a Postgres connection string. The comment on line 5 self-labels this as a BUG, so the code directly contradicts its own stated intent. Anyone with repo/history access obtains working prod credentials, and they persist in git history (commit 5683bdc) even if later deleted.",
+      "title": "Hardcoded production database credentials committed in plaintext"
+    },
+    {
+      "confidence": 0.95,
+      "filePath": "source.go",
+      "line": 5,
+      "severity": "high",
+      "suggestion": "Treat the BUG comment as an open blocker, not context. The next agent must remediate (env/secret loading + rotation) and remove the comment, not preserve it. Do not mark this diff green while the acknowledged defect stands.",
+      "summary": "source.go:5 contains '// BUG: production database credentials are committed in plaintext.' — the authoring agent identified the exact security defect and handed off without fixing or blocking on it. An acknowledgment comment is not a remediation; this is a fake-green handoff that leaves the critical issue for the next agent while reading as 'documented'.",
+      "title": "Incomplete/fake-green handoff: known BUG comment shipped unresolved"
+    },
+    {
+      "confidence": 0.66,
+      "filePath": "source.go",
+      "line": 12,
+      "severity": "medium",
+      "suggestion": "Before marking fixed, run and attach output for: `git grep -n supersecret-prod-2024` (scope leak), `go build ./...` and `gofmt -l source.go` (compile/format), and post-fix confirmation that credentials load from env and the leaked password was rotated. Blast radius: DSN has 0 callers, so a signature change breaks nothing downstream today.",
+      "summary": "The rerun_relevant_verification gate is blocked: no command/test output proves the state of this change. For a new Go file introducing secrets, minimal proof is missing — nothing confirms the secret isn't referenced elsewhere or that a fixed version compiles.",
+      "title": "No fresh verification evidence attached (evidence gate blocked)"
+    }
+  ],
+  "findings_count": 3,
+  "qa_evidence": [],
+  "review_id": "875f7c2a-54b9-4c12-9e7d-408f6406a485",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-go",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.68,
+        "from": "file-source-go",
+        "kind": "has_blast_radius",
+        "to": "blast-radius"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-go",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.go",
+        "id": "file-source-go",
+        "kind": "file",
+        "label": "source.go"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "computed from repo relationships",
+        "file_path": null,
+        "id": "blast-radius",
+        "kind": "blast_radius",
+        "label": "Blast-radius summary"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.go",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "specialist-lite",
+  "risk_tier": "lite",
+  "score": 65.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "product-safety", "agent-handoff"],
+  "summary": "Risk-tiered review (lite) completed.\n\nThe entire file is a critical security defect: production database credentials are hardcoded in plaintext (lines 6-9) and assembled into a connection string by DSN() (line 13). The code contradicts its own comment on line 5, which explicitly flags this as a BUG. This is a live-credential leak that also persists in git history; remediation requires both code change and secret rotation, not just deletion.\n\nNew file source.go commits production billing DB credentials in plaintext (lines 6-9) and exposes them via DSN() (line 13). This is a critical secret-exposure defect with direct product-safety impact (breach/loss of user billing data). Flagged as an obvious critical cross-scope defect despite the Product Safety specialist scope. The credential exposure is proven statically by the source constants themselves — no runtime verification is applicable, so the 'no fresh verification evidence' gate is resolved by static evidence.\n\nA new file commits live production PostgreSQL credentials in plaintext (source.go:6-9), exposed via DSN() at line 13. This is a critical secret-leak that requires both code remediation (load from env/secret manager) and operational rotation of the already-leaked password. The authoring agent left a self-acknowledging '// BUG:' comment (line 5) and shipped anyway — a fake-green/incomplete handoff. No fresh verification evidence was attached; the next agent must run git grep + go build and confirm rotation.",
+  "talk_id": "190a3d92-bd3b-4bf7-899f-3345ed04e0f8"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/go-nil-pointer.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/go-nil-pointer.codevetter.raw.json
new file mode 100644
index 00000000..51c73b13
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/go-nil-pointer.codevetter.raw.json
@@ -0,0 +1,142 @@
+{
+  "agent": "claude",
+  "changed_lines": 15,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 39261,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.go"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.99,
+      "filePath": "source.go",
+      "line": 14,
+      "severity": "high",
+      "suggestion": "Use the comma-ok map access and handle absence explicitly: `if u, ok := users[id]; ok { return u.Email }; return \"\"`. Better, change the signature to `(string, bool)` or `(string, error)` so callers can distinguish 'not found' from an empty email. Add a test calling FindUser with an absent id and run `go test`/`go vet` to attach fresh verification.",
+      "summary": "source.go:13-14 — `u := users[id]` returns nil for any absent key (Go zero value for a pointer map value), and `return u.Email` then dereferences nil, panicking with 'invalid memory address or nil pointer dereference'. The normal 'user not found' path becomes a process crash instead of a graceful empty/not-found result. FindUser has 0 callers today only because the file is newly added; its purpose is arbitrary-id lookup, so the miss path will be hit.",
+      "title": "Nil-pointer dereference in FindUser on missing id crashes the process"
+    },
+    {
+      "confidence": 0.9,
+      "filePath": "source.go",
+      "line": 9,
+      "severity": "medium",
+      "suggestion": "Add `source_test.go` asserting `FindUser` returns a zero value (not a panic) for an absent id, and run `go test ./...` / `go vet ./...`, attaching the output as the verification artifact before marking this fixed.",
+      "summary": "The change adds exported `FindUser`/`User` (source.go:4-15) with zero tests and no verification artifact; the deterministic `rerun_relevant_verification` gate is blocked on fresh evidence. The one path that crashes (missing id) is precisely the one left unproven.",
+      "title": "No test or verification for the not-found path"
+    }
+  ],
+  "findings_count": 2,
+  "qa_evidence": [],
+  "review_id": "ddcda192-e37b-4227-8b15-3cf910b1e42f",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-go",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.68,
+        "from": "file-source-go",
+        "kind": "has_blast_radius",
+        "to": "blast-radius"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-go",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.go",
+        "id": "file-source-go",
+        "kind": "file",
+        "label": "source.go"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "computed from repo relationships",
+        "file_path": null,
+        "id": "blast-radius",
+        "kind": "blast_radius",
+        "label": "Blast-radius summary"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.go",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "specialist-lite",
+  "risk_tier": "lite",
+  "score": 85.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "product-safety", "agent-handoff"],
+  "summary": "Risk-tiered review (lite) completed.\n\nSingle new file adds FindUser, which dereferences the result of a map lookup without a comma-ok / nil check (source.go:13-14). For a map[int]*User a missing id returns nil, so u.Email panics — a guaranteed crash on any unknown id. The implicit 'lookup always hits with a non-nil pointer' assumption is unenforced and contradicted by the function's own signature and BUG comment. 0 current callers (newly added), which bounds real-world blast radius, but the defect is certain by Go semantics.\n\nSingle new file source.go defines FindUser, which dereferences the result of a map lookup without a nil check. For any id not present in the map, `users[id]` yields nil and `u.Email` panics — a confirmed crash on the ordinary 'not found' path. This is exactly the bug the file's own comment describes, and it is real per Go map semantics. Confirmed by direct code read; empirical verification (go test/vet) was not run but the panic is provable from language semantics. No other issues in the 15 changed lines.\n\nA new Go file whose exported FindUser guarantees a nil-pointer panic on any missing map key (source.go:14). The agent documented the bug in a comment (lines 10-12) but did not fix it, and shipped no test for the crashing not-found path. Blast radius is 0 callers today, but the crash is certain once the function is used. Fix is a two-line comma-ok guard plus a test; verification gate remains blocked pending a fresh `go test` run.",
+  "talk_id": "d6fd936d-b890-4025-8dbf-cab0cc7e528f"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/go-race-condition.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/go-race-condition.codevetter.raw.json
new file mode 100644
index 00000000..ac392cb5
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/go-race-condition.codevetter.raw.json
@@ -0,0 +1,142 @@
+{
+  "agent": "claude",
+  "changed_lines": 29,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 71634,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.go"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.97,
+      "filePath": "source.go",
+      "line": 20,
+      "severity": "high",
+      "suggestion": "Acquire c.mu in Get (Lock/Unlock around the read), or change mu to sync.RWMutex and wrap the read in RLock/RUnlock to keep reads concurrent while eliminating the race.",
+      "summary": "Cache embeds sync.Mutex (source.go:10) establishing the invariant that all access to c.data is lock-guarded; Set honors it (source.go:26-28) but Get reads c.data[key] with no lock (source.go:19-22). A read concurrent with Set's write is a data race under the Go memory model and can trigger the unrecoverable runtime `fatal error: concurrent map read and map write`, crashing the process. The comments on lines 18/20/24 acknowledge the bug but the mutex still gives false safety: the type advertises concurrency-safety it does not provide.",
+      "title": "Get reads shared map without holding mu — data race with Set"
+    },
+    {
+      "confidence": 0.9,
+      "filePath": "source.go",
+      "line": 1,
+      "severity": "medium",
+      "suggestion": "As part of the fix handoff, run `go mod init cache`, add a test that spawns concurrent Get/Set goroutines, and attach the output of `go test -race ./...` as the verification artifact before marking this resolved.",
+      "summary": "find over the repo shows only source.go — there is no go.mod and no *_test.go. The evidence gate rerun_relevant_verification is blocked: the change cannot be proven correct (or the race caught by `go test -race`/`go vet`) in the current tree. This is a fake-green risk — the fix described in the comments was never applied and nothing exercises the concurrent path.",
+      "title": "No verification possible: repo has no go.mod and no tests, so the race is undetectable by tooling"
+    }
+  ],
+  "findings_count": 2,
+  "qa_evidence": [],
+  "review_id": "74f97cd9-6391-45f1-a9a2-d5ba27455cef",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-go",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.68,
+        "from": "file-source-go",
+        "kind": "has_blast_radius",
+        "to": "blast-radius"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-go",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.go",
+        "id": "file-source-go",
+        "kind": "file",
+        "label": "source.go"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "computed from repo relationships",
+        "file_path": null,
+        "id": "blast-radius",
+        "kind": "blast_radius",
+        "label": "Blast-radius summary"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.go",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "specialist-lite",
+  "risk_tier": "lite",
+  "score": 85.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "product-safety", "agent-handoff"],
+  "summary": "Risk-tiered review (lite) completed.\n\nSingle new file implementing a Cache. The implicit invariant 'all access to c.data is guarded by c.mu' is enforced in Set but violated in Get (source.go:20), which reads the map lock-free. This is a genuine data race that can cause an unrecoverable fatal runtime crash under the concurrent usage the code itself documents. The mutex creates a false impression of thread-safety. Fix by locking in Get (or using RWMutex).\n\nSingle new file implementing a Cache with a genuine, guaranteed data race: Get reads the map unsynchronized (line 20) while Set writes under the lock (lines 26-28). Under concurrent access this triggers Go's unrecoverable `concurrent map read and map write` fatal error, crashing the process and losing in-flight work — a real product-safety crash, not a style issue. Severity held at high rather than critical only because the type has 0 callers today (no live reproduction path); the defect itself is critical-grade and will fire the moment it's used concurrently as intended. Verification gate remains open: no race-detector run was performed.\n\nNewly added cache/source.go contains a confirmed, self-documented data race: Get (source.go:19-22) reads the shared map without holding mu while Set (source.go:25-28) writes under the lock. In Go this is a process-fatal, unrecoverable runtime error, not a benign race. The struct comments acknowledge the bug but the fix (lock the reader) was never applied. Compounding the handoff risk, the repo has no go.mod and no tests, so the defect cannot currently be caught by `go test -race` — the verification gate remains blocked. Real blocker: synchronize Get. Optional-but-required-for-signoff: add module + race test and attach fresh output.",
+  "talk_id": "e442170f-6d55-4332-9093-c83191a70c6f"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/go-sql-injection.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/go-sql-injection.codevetter.raw.json
new file mode 100644
index 00000000..01175ad3
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/go-sql-injection.codevetter.raw.json
@@ -0,0 +1,142 @@
+{
+  "agent": "claude",
+  "changed_lines": 15,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 46158,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.go"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.97,
+      "filePath": "source.go",
+      "line": 12,
+      "severity": "critical",
+      "suggestion": "Use a parameterized placeholder instead of string interpolation: db.QueryRow(\"SELECT id, email FROM users WHERE email = $1\", email) ($1 for pgx/lib-pq, ? for MySQL/SQLite). Never build SQL with fmt.Sprintf from caller-supplied values.",
+      "summary": "Line 12 builds the query with fmt.Sprintf(\"SELECT id, email FROM users WHERE email = '%s'\", email) and passes it to db.QueryRow(q) on line 13. The exported FindByEmail(db, email) takes email as an external lookup key, so an attacker-controlled value like ' OR '1'='1 bypasses the filter and UNION/stacked-query payloads enable data exfiltration or modification. The code's own comment (lines 10-11) confirms the interpolation is unparameterized. The implicit invariant that email is injection-safe is never enforced.",
+      "title": "SQL injection via fmt.Sprintf in FindByEmail"
+    },
+    {
+      "confidence": 0.75,
+      "filePath": "source.go",
+      "line": 9,
+      "severity": "medium",
+      "suggestion": "After parameterizing the query, add a unit test (e.g. against a sqlmock or in-memory DB) asserting the query uses a placeholder and that an adversarial email string is treated as a literal, then run `go build ./... && go test ./...` and attach the output.",
+      "summary": "FindByEmail has 0 callers (blast-radius) and no accompanying test; the pre-review procedure gate rerun_relevant_verification is still blocked with no fresh command/test evidence. The function was committed with a known injection defect and no proof it behaves correctly, so the next agent has no guard against re-introducing or missing the vulnerability.",
+      "title": "Incomplete handoff: no test or verification for FindByEmail"
+    }
+  ],
+  "findings_count": 2,
+  "qa_evidence": [],
+  "review_id": "35be2476-fab5-4d45-9ca8-9cdb515f0bca",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-go",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.68,
+        "from": "file-source-go",
+        "kind": "has_blast_radius",
+        "to": "blast-radius"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-go",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.go",
+        "id": "file-source-go",
+        "kind": "file",
+        "label": "source.go"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "computed from repo relationships",
+        "file_path": null,
+        "id": "blast-radius",
+        "kind": "blast_radius",
+        "label": "Blast-radius summary"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.go",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "specialist-lite",
+  "risk_tier": "lite",
+  "score": 75.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "product-safety", "agent-handoff"],
+  "summary": "Risk-tiered review (lite) completed.\n\nSingle new file store.FindByEmail contains a critical SQL injection: line 12 interpolates the caller-supplied email into the query string with fmt.Sprintf rather than using a parameterized placeholder, and line 13 executes it via db.QueryRow. Assumption-integrity check: the file's stated intent (line 1) and inline comment (lines 10-11) both accurately describe this as an injection bug, so the comment will NOT mislead the next agent — intent and code agree. The genuine defect is the unenforced invariant that `email` is trusted input. Function is currently unused (0 callers) but exported and clearly meant to accept an email lookup value, so severity stays critical. No runtime/DB verification was possible (no callers, no DB), so this is a definitive static finding rather than an executed repro; the rerun_relevant_verification gate remains open but the static proof is conclusive.\n\nSingle new file introduces an exported FindByEmail that constructs its SQL query with fmt.Sprintf string interpolation of the caller-supplied email (source.go:12-13). This is a critical SQL injection and also breaks legitimate lookups for emails containing apostrophes — a user-facing correctness/data-integrity failure. The code's own comment acknowledges the bug. Fix is a standard parameterized placeholder.\n\nSingle new file introducing FindByEmail with a critical, self-documented SQL injection: user input is interpolated into the query via fmt.Sprintf (line 12) rather than using a parameterized placeholder. This is a blocker regardless of the specialist axis. On the Agent Handoff axis, the change was landed with the vulnerability intact, no test, and no verification evidence — an incomplete handoff.",
+  "talk_id": "1bb500e9-d35a-4d21-a072-d5171ceb50cb"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/java-insecure-random.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/java-insecure-random.codevetter.raw.json
new file mode 100644
index 00000000..bdaf0346
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/java-insecure-random.codevetter.raw.json
@@ -0,0 +1,138 @@
+{
+  "agent": "claude",
+  "changed_lines": 13,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 42675,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.java"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.98,
+      "filePath": "source.java",
+      "line": 11,
+      "severity": "critical",
+      "suggestion": "Use java.security.SecureRandom and produce a fixed-width, high-entropy token, e.g. `byte[] b = new byte[32]; new SecureRandom().nextBytes(b);` then hex/Base64URL-encode with fixed length. Remove the java.util.Random import.",
+      "summary": "resetToken() derives reset tokens from java.util.Random (source.java:5 `private static final Random RNG = new Random();`, source.java:11 `Long.toHexString(RNG.nextLong())`). java.util.Random is a 48-bit LCG whose internal state is recoverable from a single observed nextLong() output, so an attacker who sees one reset token can predict all subsequent tokens and take over accounts. This breaks the security guarantee of the password-reset flow (user data exposure / broken flow). Also, Long.toHexString drops leading zero nibbles, so token width varies and small values yield very short tokens.",
+      "title": "Password reset tokens generated with predictable java.util.Random (account takeover)"
+    },
+    {
+      "confidence": 0.9,
+      "filePath": "source.java",
+      "line": 7,
+      "severity": "medium",
+      "suggestion": "Actually apply the SecureRandom fix, remove/replace the stale BUG comment, add a test locking in the secure behavior, and run the build/test to produce fresh verification evidence before handoff.",
+      "summary": "Lines 7-9 contain a `BUG:` comment fully describing the insecure-PRNG flaw, but resetToken() (line 11) still exhibits it — the fix was described, not applied. This is a documented-but-not-fixed handoff: the comment reads as resolution while the code regresses. No unit test guards the generator, and the `rerun_relevant_verification` gate is unresolved (no build/test log attached).",
+      "title": "Documented bug shipped un-fixed; no test or verification (handoff gap)"
+    },
+    {
+      "confidence": 0.85,
+      "filePath": "source.java",
+      "line": 11,
+      "severity": "low",
+      "suggestion": "Encode fixed-width bytes from SecureRandom (e.g. HexFormat.of().formatHex(buf) over a 32-byte buffer) so every token is the same length.",
+      "summary": "Even after switching generators, `Long.toHexString(...)` (line 11) omits leading zeros, so token strings vary from 1 to 16 hex chars. Variable-length tokens weaken effective entropy assumptions and complicate downstream parsing/validation.",
+      "title": "Long.toHexString yields variable-length tokens"
+    }
+  ],
+  "findings_count": 3,
+  "qa_evidence": [],
+  "review_id": "5fb97252-76a8-4a89-828b-542bb7e215c7",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-java",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-java",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.java",
+        "id": "file-source-java",
+        "kind": "file",
+        "label": "source.java"
+      },
+      {
+        "detail": "308 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.java",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "specialist-lite",
+  "risk_tier": "lite",
+  "score": 73.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "product-safety", "agent-handoff"],
+  "summary": "Risk-tiered review (lite) completed.\n\nSingle-file change adds a TokenGenerator whose resetToken() uses java.util.Random — a predictable LCG PRNG — for security-sensitive reset tokens. The in-code comment (lines 7-9) correctly identifies the flaw and prescribes SecureRandom, but the implementation (lines 5, 11) still ships the vulnerable version, a direct stated-intent-vs-code contradiction. This is a real, statically-provable high-severity security bug (CWE-338/CWE-330); no runtime artifact is needed to confirm it. The 'unpredictable token' invariant is asserted in prose but not enforced.\n\nNew TokenGenerator uses java.util.Random (a predictable LCG PRNG) to mint password-reset tokens. This is a critical, self-documented security/product-safety defect: a guessable reset token enables account takeover, breaking the reset flow's core guarantee. Confirmed statically — no runtime evidence needed because the insecurity of java.util.Random is an intrinsic property of the class. The only assumption that could soften this is that resetToken() is never used for real security-sensitive tokens, but the method name and comment contradict that.\n\nA new TokenGenerator generates password-reset tokens from java.util.Random, a predictable LCG PRNG — a critical, exploitable weakness (seed recovery → token prediction → account takeover). The file even documents the flaw in a BUG comment but ships it unfixed, which from an agent-handoff standpoint is a documented-but-not-resolved deliverable with no test and no verification run. Fix by moving to SecureRandom with adequate entropy and fixed-width encoding, add a regression test, and rerun the build/test to satisfy the blocked verification gate.",
+  "talk_id": "6837b611-f010-4501-ae5f-e82375bf2410"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/js-eval-injection.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/js-eval-injection.codevetter.raw.json
new file mode 100644
index 00000000..5aaa8795
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/js-eval-injection.codevetter.raw.json
@@ -0,0 +1,142 @@
+{
+  "agent": "claude",
+  "changed_lines": 12,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 45877,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.js"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.99,
+      "filePath": "source.js",
+      "line": 8,
+      "severity": "critical",
+      "suggestion": "Do not eval user input. Replace with a safe filtering mechanism: parse a constrained DSL, accept a structured predicate object (field/op/value) and build the comparator in code, or require callers to pass an already-vetted function. If dynamic evaluation is truly unavoidable, sandbox it (e.g. a locked-down VM with no globals/require/network) and document the trust boundary — but a structured filter spec is strongly preferred.",
+      "summary": "source.js:8 runs `eval('(' + expression + ')')` on the exported `buildFilter(expression)` argument. `buildFilter` is a public export (source.js:12) whose safety depends on an implicit, unenforced invariant that `expression` is trusted code — there is no allowlist, parse, or sanitization. Any caller forwarding external input (request param, config, message) gets arbitrary JS execution: data exfiltration via fetch, `child_process`, or process crash. The inline comment (lines 5-7) confirms this is the actual behavior, not a hypothetical.",
+      "title": "Arbitrary code execution: eval() on caller-supplied expression"
+    },
+    {
+      "confidence": 0.9,
+      "filePath": "source.js",
+      "line": 4,
+      "severity": "medium",
+      "suggestion": "Add a test asserting (1) a legitimate filter expression produces the expected predicate and (2) a malicious payload (e.g. 'process.exit(1)' or a cookie/fetch exfil string) is rejected — the second must fail against the current eval implementation, then pass after the fix. Run `node -e \"require('./source').buildFilter('1')\"` and the new test as the smallest verification.",
+      "summary": "buildFilter has 0 callers (blast-radius) and no accompanying test file; the change ships with no fresh command/test evidence, and the rerun_relevant_verification gate is blocked. The `BUG:` comment reads as fake-green — flaw acknowledged but shipped without a gate.",
+      "title": "No tests or verification for newly added module (unverified handoff)"
+    }
+  ],
+  "findings_count": 2,
+  "qa_evidence": [],
+  "review_id": "5cb6e8f1-ffb8-41dc-a6aa-a36181a92317",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-js",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.68,
+        "from": "file-source-js",
+        "kind": "has_blast_radius",
+        "to": "blast-radius"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-js",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.js",
+        "id": "file-source-js",
+        "kind": "file",
+        "label": "source.js"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "computed from repo relationships",
+        "file_path": null,
+        "id": "blast-radius",
+        "kind": "blast_radius",
+        "label": "Blast-radius summary"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.js",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "specialist-lite",
+  "risk_tier": "lite",
+  "score": 75.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "product-safety", "agent-handoff"],
+  "summary": "Risk-tiered review (lite) completed.\n\nNew file source.js introduces buildFilter(), which passes caller-supplied input directly to eval() (line 8). This is a critical arbitrary-code-execution vulnerability. Assumption-integrity view: the code's comments accurately describe the defect (no stated-intent contradiction to flag), but the exported contract relies on an unenforced invariant that the input is trusted — nothing sanitizes or constrains `expression`. Because it is an exported symbol, the '0 callers' blast-radius signal understates risk for the next agent who wires it to an input source.\n\nNewly added source.js introduces buildFilter, which passes caller-supplied input directly to eval() (line 8) — a textbook arbitrary code execution vulnerability, confirmed by static inspection and even self-documented in the file's comments. Critical severity despite 0 current callers because the contract is inherently unsafe: any user-facing flow built on it becomes an RCE/data-loss vector. This is a critical cross-scope defect surfaced under the product-safety pass because it makes any dependent flow unsafe by construction.\n\nNewly added 12-line module intentionally evaluates caller-supplied input with eval(), a live critical RCE vector explicitly labeled BUG in-code but shipped unmitigated. The function has no callers and no tests, so there is zero fresh verification evidence. Must not be merged or called until eval is removed and a rejection test is added.",
+  "talk_id": "606111cc-9554-47ed-a42a-e24378102c8d"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/js-open-redirect.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/js-open-redirect.codevetter.raw.json
new file mode 100644
index 00000000..bcb670de
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/js-open-redirect.codevetter.raw.json
@@ -0,0 +1,129 @@
+{
+  "agent": "claude",
+  "changed_lines": 14,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 45526,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.js"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.97,
+      "filePath": "source.js",
+      "line": 11,
+      "severity": "high",
+      "suggestion": "Only redirect to same-origin relative paths. Reject or ignore any value that is not a path beginning with a single `/` (block `//` and backslash variants), e.g. `const safe = typeof next === 'string' && /^\\/(?!\\/)/.test(next) ? next : '/dashboard'; return res.redirect(safe);`. Alternatively validate against an explicit allowlist of permitted destinations.",
+      "summary": "Lines 9–11: `const next = req.query.next;` then `return res.redirect(next);` — the redirect target is fully attacker-controlled with no allowlist or same-origin check. Express's res.redirect honors absolute (`https://evil.example`) and protocol-relative (`//evil.example`) URLs, so `/login?next=https://evil.example` sends the victim off the trusted origin. The code confirms exactly the bug its own comment (lines 6–8) describes; the guard the comment says is missing is in fact absent.",
+      "title": "Open redirect: unvalidated `next` query param passed to res.redirect"
+    },
+    {
+      "confidence": 0.8,
+      "filePath": "source.js",
+      "line": 5,
+      "severity": "low",
+      "suggestion": "Add a test (e.g. supertest) asserting off-origin values (`https://evil.example`, `//evil.example`) do not redirect externally and a valid relative `next` still redirects, then run it and attach the output before marking the security fix done.",
+      "summary": "The diff adds a new /login route (source.js:5-14) with no accompanying test and no verification artifact; the pre-review gate `rerun_relevant_verification` remains blocked (evidence lead `no-fresh-verification-evidence`). Nothing proves the redirect behavior — safe or unsafe — was exercised.",
+      "title": "No test or fresh verification for the new endpoint"
+    }
+  ],
+  "findings_count": 2,
+  "qa_evidence": [],
+  "review_id": "6925670f-4210-48cb-9d7f-1d1a1b0787b1",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-js",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-js",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.js",
+        "id": "file-source-js",
+        "kind": "file",
+        "label": "source.js"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.js",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "specialist-lite",
+  "risk_tier": "lite",
+  "score": 88.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "product-safety", "agent-handoff"],
+  "summary": "Risk-tiered review (lite) completed.\n\nSingle new file implementing an Express /login handler with a genuine, exploitable open redirect on line 11. Assumption integrity: the code's comment (lines 6–8) accurately describes the vulnerability and the implementation confirms it — intent and code agree, so no misleading premise is planted for a follow-up agent. However the confirmed assumption is the defect itself, so it is reported as a high-severity security bug. No runtime verification was possible for this isolated file; finding is proven by static reading.\n\nThe 14-line change introduces a classic open-redirect: the `next` query param flows directly into res.redirect() with no validation (lines 9-11), allowing attacker-controlled absolute/protocol-relative URLs. From a product-safety lens this breaks the login return-flow and is a phishing vector — real user-facing harm. Self-documented as a BUG in the code comments; confirmed against the actual file. Verification gate (rerun_relevant_verification) remains open: I did not execute a request; the defect is static-definitive per Express semantics, and the smallest confirming artifact is a supertest assertion on the Location header.\n\nSingle new 14-line Express file intentionally demonstrating an open redirect. The vulnerability described in the comments is real and confirmed on lines 9-11: user-controlled `req.query.next` flows unvalidated into `res.redirect`. High-severity CWE-601. No tests or verification accompany the change (verification gate still blocked). Primary fix: restrict redirects to same-origin relative paths, rejecting `//` and `/\\` prefixes, and add regression tests.",
+  "talk_id": "fb947edf-3e42-44a7-986e-c5f18d8352c1"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/py-bare-except.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/py-bare-except.codevetter.raw.json
new file mode 100644
index 00000000..6ae9f63b
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/py-bare-except.codevetter.raw.json
@@ -0,0 +1,151 @@
+{
+  "agent": "claude",
+  "changed_lines": 16,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 72528,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.py"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.95,
+      "filePath": "source.py",
+      "line": 8,
+      "severity": "high",
+      "suggestion": "Narrow the handler to `except json.JSONDecodeError` (and/or `ValueError`) so control-flow exceptions propagate. Either re-raise/wrap parse failures (e.g. raise a ConfigError) or make the failure explicit to callers instead of returning a silent `{}`; if a default is truly desired, log the error and document that `{}` means 'parse failed'.",
+      "summary": "source.py:8 uses a bare `except:` which catches BaseException — including KeyboardInterrupt and SystemExit — so Ctrl-C and interpreter shutdown are suppressed inside parse_config. It also returns `{}` (line 11) on *any* failure, and load_settings (line 16) passes that straight back, so a malformed or unreadable config silently degrades to empty settings with no signal to callers. The `-> dict` return type is structurally honored but its semantic contract (a valid parsed config) is broken, and the inline comment (lines 8–10) confirms this is a known BUG that was committed rather than fixed.",
+      "title": "Bare except in parse_config swallows BaseException and silently returns {}"
+    },
+    {
+      "confidence": 0.9,
+      "filePath": "source.py",
+      "line": 8,
+      "severity": "medium",
+      "suggestion": "Catch only json.JSONDecodeError (or ValueError) and re-raise / propagate rather than swallowing. Either let load_settings raise on unparseable config so the caller can show an explicit error state, or return a sentinel (e.g. None) plus the raw error so callers can distinguish parse failure from an intentionally empty config. Never map 'parse failed' to the same value as 'valid empty object'.",
+      "summary": "source.py:6-11: the bare `except:` in parse_config catches everything (including BaseException) and returns `{}`. Via load_settings (source.py:14-16), a malformed/truncated config file therefore resolves to an empty settings dict with no error, log, or empty-state signal — the data-loss/confusing-state pattern where a user's persisted settings silently appear reset and callers cannot distinguish 'missing' from 'corrupt' from 'legitimately empty'. Blast radius is 0 callers today (both symbols unused), so this is latent, not a live regression — hence medium, not high.",
+      "title": "parse_config silently returns {} on any parse failure → load_settings yields empty settings with no error"
+    },
+    {
+      "confidence": 0.7,
+      "filePath": "source.py",
+      "line": 5,
+      "severity": "low",
+      "suggestion": "Add test_source.py asserting parse_config on valid JSON round-trips and on invalid JSON raises (not returns {}), then run `python -m pytest -q` and attach the output. This is optional cleanup relative to the bare-except fix but resolves the blocked rerun_relevant_verification gate.",
+      "summary": "source.py adds parse_config and load_settings (0 callers, newly added) with no accompanying tests and no fresh command/test output in history — matching the pre-review `no-fresh-verification-evidence` candidate. Nothing proves the intended behavior (surface parse errors vs. return {}), so the change is only statically plausible.",
+      "title": "New parse/load functions ship with no tests or verification evidence"
+    }
+  ],
+  "findings_count": 3,
+  "qa_evidence": [],
+  "review_id": "f04398c5-f795-494f-ab0e-05d9f56a55b3",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-py",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.68,
+        "from": "file-source-py",
+        "kind": "has_blast_radius",
+        "to": "blast-radius"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-py",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.py",
+        "id": "file-source-py",
+        "kind": "file",
+        "label": "source.py"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "computed from repo relationships",
+        "file_path": null,
+        "id": "blast-radius",
+        "kind": "blast_radius",
+        "label": "Blast-radius summary"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.py",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "specialist-lite",
+  "risk_tier": "lite",
+  "score": 83.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "product-safety", "agent-handoff"],
+  "summary": "Risk-tiered review (lite) completed.\n\nSingle new 16-line file demonstrating a bare-except antipattern. The code contains a genuine, self-documented bug: `except:` at line 8 catches BaseException (KeyboardInterrupt/SystemExit) and returns `{}` on any failure, which load_settings propagates — masking parse failures from callers. The author's own comment agrees it's a BUG, and the change shipped with it unfixed. No live regression yet (0 callers, newly added), but the defect is real and would mislead future callers.\n\nSingle 16-line new file with one genuine defect in product-safety scope: parse_config swallows all exceptions and returns {}, so load_settings turns a corrupt/truncated config into a silent empty-settings state (potential user-visible data loss, no error surfaced). Capped at medium because both functions currently have 0 callers (confirmed via grep, matches blast-radius data) — the defect is real and certain but latent until wired into a flow. The bare `except:` also catches KeyboardInterrupt/SystemExit, but json.loads is fast so that sub-issue is minor. load_settings does not guard open() errors, so OSError propagates raw — an inconsistent contract worth noting, not a data-loss bug.\n\nSmall 16-line new file with one certain defect: the bare `except:` at line 8 catches BaseException (swallowing KeyboardInterrupt/SystemExit) and returns `{}` on any failure, so parse errors are invisible to callers including load_settings (line 16). Both functions are currently uncalled (0 callers), which caps real-world impact and keeps this at medium rather than high. No tests or fresh verification exist, so the change is unproven.",
+  "talk_id": "8adc508b-89e9-419f-bbd7-2953bcb6db14"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/py-command-injection.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/py-command-injection.codevetter.raw.json
new file mode 100644
index 00000000..58a3a552
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/py-command-injection.codevetter.raw.json
@@ -0,0 +1,160 @@
+{
+  "agent": "claude",
+  "changed_lines": 11,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 44388,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.py"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.99,
+      "filePath": "source.py",
+      "line": 10,
+      "severity": "critical",
+      "suggestion": "Pass an argument list and drop shell=True: `subprocess.run([\"ping\", \"-c\", \"1\", host], capture_output=True, text=True)`. Optionally validate `host` against a hostname/IP allowlist and reject invalid input.",
+      "summary": "source.py:9-10 interpolates the untrusted `host` argument into a shell string (`cmd = f\"ping -c 1 {host}\"`) and runs it with `subprocess.run(cmd, shell=True, ...)`. Because the shell parses the string, `ping_host(\"8.8.8.8; rm -rf ~\")` executes `ping` and then an attacker-chosen command; `$(...)`, backticks, `|`, and `&&` are equally exploitable. The function has 0 callers now, but any caller passing user input inherits arbitrary command execution (CWE-78).",
+      "title": "Command injection via subprocess with shell=True"
+    },
+    {
+      "confidence": 0.85,
+      "filePath": "source.py",
+      "line": 6,
+      "severity": "medium",
+      "suggestion": "Add a unit test that (1) confirms the happy path (`ping_host(\"127.0.0.1\")` returns output) and (2) proves a metacharacter host cannot spawn a second command after the fix (e.g. assert injection input is rejected or produces no side effect). Run it and attach the output before marking fixed.",
+      "summary": "The `rerun_relevant_verification` gate is blocked: no fresh command/test proof accompanies this change, and `ping_host` has 0 callers so nothing exercises it. A security-sensitive function was added with zero regression coverage for the very failure it documents.",
+      "title": "No test or verification for injection-prone function (evidence gate blocked)"
+    },
+    {
+      "confidence": 0.95,
+      "filePath": "source.py",
+      "line": 3,
+      "severity": "low",
+      "suggestion": "Delete line 3. Optional cleanup, not a blocker.",
+      "summary": "`import sys` on line 3 is never referenced — leftover/dead import, a minor over-edit artifact.",
+      "title": "Unused import `sys`"
+    },
+    {
+      "confidence": 0.5,
+      "filePath": "source.py",
+      "line": 11,
+      "severity": "low",
+      "suggestion": "Check `result.returncode` and surface `result.stderr` (raise or return a structured error) instead of silently returning empty stdout.",
+      "summary": "source.py:10-11 discards `result.returncode` and `result.stderr` and returns only `result.stdout`. For an unreachable or invalid host, ping exits non-zero and writes the error to stderr, so the caller receives an empty/partial string with no failure signal — a confusing empty state for any user-facing flow. Minor and no callers exist yet.",
+      "title": "Ping failures return silently as an empty/confusing result"
+    }
+  ],
+  "findings_count": 4,
+  "qa_evidence": [],
+  "review_id": "62d9745f-fc5c-4021-adf5-c2b822efc8d4",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-py",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.68,
+        "from": "file-source-py",
+        "kind": "has_blast_radius",
+        "to": "blast-radius"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-py",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.py",
+        "id": "file-source-py",
+        "kind": "file",
+        "label": "source.py"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "computed from repo relationships",
+        "file_path": null,
+        "id": "blast-radius",
+        "kind": "blast_radius",
+        "label": "Blast-radius summary"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.py",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "specialist-lite",
+  "risk_tier": "lite",
+  "score": 71.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "product-safety", "agent-handoff"],
+  "summary": "Risk-tiered review (lite) completed.\n\nNewly added source.py contains a real, acknowledged command-injection sink: an untrusted `host` is f-string-interpolated into a command run with shell=True (lines 9-10). The stated intent (comment labels it a BUG) matches the code — no assumption contradiction, but the vulnerability is genuine and unmitigated. Fix is to use an argument list without shell=True. No fresh runtime evidence was gathered (rerun_relevant_verification gate stays blocked), but the sink is statically self-evident and needs no execution to confirm. Function has 0 callers, so current impact is latent rather than active.\n\nNew file introduces a critical, statically-provable command injection: `ping_host` interpolates the untrusted `host` into a shell string and runs it with `subprocess.run(..., shell=True)` (source.py:9-10). Fix by using an argument list without shell=True. A secondary low-severity product-safety issue: ping failures are swallowed and returned as empty stdout (source.py:10-11), producing a confusing empty state. No fresh verification artifact was attached; the injection is provable from the code without executing the destructive payload.\n\nA new file introducing a textbook OS command injection: untrusted `host` is f-string-interpolated into a shell command run with `shell=True` (lines 9–10). The agent left a `# BUG:` comment describing the exact vulnerability but shipped it unfixed — an incomplete handoff of exploitable code. Critical blocker with a one-line bounded fix (argument-list form, drop shell=True). Also missing any test/verification (evidence gate blocked) and carries an unused `sys` import.",
+  "talk_id": "2a48669d-fbff-450e-83fa-7d58e8f457e3"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/py-hardcoded-secret.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/py-hardcoded-secret.codevetter.raw.json
new file mode 100644
index 00000000..01a5788d
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/py-hardcoded-secret.codevetter.raw.json
@@ -0,0 +1,178 @@
+{
+  "agent": "claude",
+  "changed_lines": 25,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 75639,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.py"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.9,
+      "filePath": "source.py",
+      "line": 10,
+      "severity": "critical",
+      "suggestion": "Read the key/secret from the environment or a secret manager (e.g. `os.environ[\"AWS_ACCESS_KEY_ID\"]`) instead of literals; remove the hardcoded values. If real keys were ever committed with this pattern, rotate them and scrub git history. Add a secret scanner (gitleaks/trufflehog) to CI to block this class of commit.",
+      "summary": "Lines 10-11 hardcode `aws_access_key_id`/`aws_secret_access_key` directly in source and lines 18-19 send them as `X-Aws-Key`/`X-Aws-Secret` request headers, bypassing the `os`/secret-manager path implied by the unused `import os` (line 2). Committing credentials to source and shipping them in headers is a critical anti-pattern. Honest caveat: the specific values (`AKIAIOSFODNN7EXAMPLE` / `wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY`) are AWS's canonical documentation *example* keys — non-functional, so no live credential is actually exposed here. The defect is the pattern: if real keys replace these placeholders, they leak to anyone with repo access and into git history permanently.",
+      "title": "Hardcoded credentials in source, transmitted as auth headers"
+    },
+    {
+      "confidence": 0.95,
+      "filePath": "source.py",
+      "line": 10,
+      "severity": "high",
+      "suggestion": "Read the credentials with the already-imported `os` (e.g. `os.environ[\"AWS_ACCESS_KEY_ID\"]` / `os.environ[\"AWS_SECRET_ACCESS_KEY\"]`) or a secret-manager client, and fail loudly if unset. Do not commit literal key values.",
+      "summary": "Lines 10-11 hardcode `aws_access_key_id`/`aws_secret_access_key` and lines 18-19 send them as `X-Aws-Key`/`X-Aws-Secret` headers. This is the defect the file models: secrets belong in a secret manager or environment, never committed. NOTE: the specific values are AWS's public documentation example keys, not live credentials, so real-world exposure here is nil — but the pattern is a genuine blocker if replicated with real keys.",
+      "title": "Credentials hardcoded in source instead of env/secret manager"
+    },
+    {
+      "confidence": 0.9,
+      "filePath": "source.py",
+      "line": 7,
+      "severity": "medium",
+      "suggestion": "Fix the comment to state these are placeholder/example credentials, or (if the intent is to demonstrate a real leak) do not imply active exposure. Either way, don't leave a comment asserting a live key that isn't.",
+      "summary": "Lines 7–9 assert 'a live AWS access key is hardcoded… Anyone with repo access can impersonate this account.' The actual values on lines 10–11 (AKIAIOSFODNN7EXAMPLE / wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY) are AWS's canonical documentation example credentials — non-functional placeholders that cannot authenticate. The 'live'/'impersonate this account' claim is contradicted by the values themselves, so a next agent trusting the comment would launch unnecessary rotation/revocation/incident-response for a credential that was never real.",
+      "title": "Comment claims a 'live' AWS key, but the values are AWS's public example credentials — false premise that will misdirect follow-up"
+    },
+    {
+      "confidence": 0.55,
+      "filePath": "source.py",
+      "line": 14,
+      "severity": "low",
+      "suggestion": "Encode the segment with `urllib.parse.quote(account_id, safe=\"\")` and/or validate `account_id` against an expected format before interpolation.",
+      "summary": "Line 14 builds `url = f\"https://billing.example.com/{account_id}\"` with no URL-encoding. If `account_id` is caller/user-controlled, values containing `/`, `..`, or query characters can alter the request path or target. Out of core product-safety scope and low-impact given no callers, but a real correctness/robustness gap.",
+      "title": "Unencoded account_id interpolated into request URL"
+    },
+    {
+      "confidence": 0.85,
+      "filePath": "source.py",
+      "line": 2,
+      "severity": "low",
+      "suggestion": "Use `os` to read the credentials from the environment (which resolves finding #1), or remove the unused import.",
+      "summary": "`import os` on line 2 is never referenced. Its presence only makes sense as scaffolding for reading secrets from the environment (`os.getenv`), which the body then does not do — evidence the intended fix was left half-applied. Resolving the hardcoded-secret finding via `os.environ` also clears this dead import.",
+      "title": "Unused `import os` signals an incomplete fix"
+    },
+    {
+      "confidence": 0.8,
+      "filePath": "source.py",
+      "line": 6,
+      "severity": "low",
+      "suggestion": "Next agent: add a unit test that mocks `requests.get` and asserts headers/URL/`raise_for_status` behavior, and run `python -m py_compile source.py` plus the test. Attach the output before marking any finding fixed.",
+      "summary": "`fetch_billing` has 0 callers (confirmed via grep) and there is no test file in the repo. No fresh command/test output exists (evidence candidate `no-fresh-verification-evidence`; gate `rerun_relevant_verification` still blocked). The change is only statically plausible.",
+      "title": "No tests or verification for newly added function"
+    }
+  ],
+  "findings_count": 6,
+  "qa_evidence": [],
+  "review_id": "f3b89f2c-2f55-4f73-89f9-cbbaad86cdc5",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-py",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.68,
+        "from": "file-source-py",
+        "kind": "has_blast_radius",
+        "to": "blast-radius"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-py",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.py",
+        "id": "file-source-py",
+        "kind": "file",
+        "label": "source.py"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "computed from repo relationships",
+        "file_path": null,
+        "id": "blast-radius",
+        "kind": "blast_radius",
+        "label": "Blast-radius summary"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.py",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "specialist-lite",
+  "risk_tier": "lite",
+  "score": 59.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "product-safety", "agent-handoff"],
+  "summary": "Risk-tiered review (lite) completed.\n\nSingle new file with an intentionally-planted hardcoded-secret anti-pattern (labeled '# Case:'). The genuine security pattern is real (secrets as source literals, lines 10–11), but the accompanying comment overstates it: the specific values are AWS's published example credentials, not a live key, so the 'anyone can impersonate this account' claim on lines 7–9 is a contradicted assumption that would misdirect the next agent into treating a benign placeholder as an active credential leak. No callers (blast radius 0), so real-world risk is low. No runtime verification is meaningful for this diff.\n\nDeliberate anti-pattern demo file. The dominant defect is a hardcoded credential committed to source and sent as auth headers (lines 10-11, 18-19) — critical as a pattern, though the specific values are AWS's non-live documentation example keys, so no actual secret is exposed. No product-safety regression exists: the function is newly added with 0 callers and breaks no current user workflow; error handling via raise_for_status is fine. Secondary low-severity: unencoded account_id in the URL (line 14).\n\nSingle new file modeling a hardcoded-secret defect. The real, actionable issue is the hardcoded-credential pattern (lines 10-11/18-19), fixable by reading from env/secret manager using the already-imported-but-unused `os`. Two important handoff caveats: (1) the values are AWS's public example keys, NOT live credentials, so the line-7 comment overstates risk — don't rotate anything; (2) the unused `os` import shows the env-based fix was intended but left incomplete. No tests or verification exist and the function has no callers, so nothing is proven to work.",
+  "talk_id": "2df36e12-bf80-46ad-849f-1b36ad3464e6"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/py-insecure-deserialization.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/py-insecure-deserialization.codevetter.raw.json
new file mode 100644
index 00000000..2e5aa10c
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/py-insecure-deserialization.codevetter.raw.json
@@ -0,0 +1,142 @@
+{
+  "agent": "claude",
+  "changed_lines": 11,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 46308,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.py"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.99,
+      "filePath": "source.py",
+      "line": 11,
+      "severity": "critical",
+      "suggestion": "Do not unpickle untrusted data. Replace with json.loads (returns only JSON-safe types) or a schema-validated deserializer. If a binary/object format is truly required, use a signed+verified envelope with a hard-restricted Unpickler.find_class allowlist, and validate that the result is actually a dict before returning.",
+      "summary": "load_state (source.py:6) takes an untrusted `blob: str`, base64-decodes it (line 10), and passes the bytes straight to pickle.loads (line 11). pickle deserialization executes arbitrary code via __reduce__/__setstate__, so any caller-controlled blob is remote code execution on the server. The inline comment (lines 7-9) acknowledges this as a BUG and says to 'Use JSON or a restricted schema instead', but the code still performs the unsafe unpickle — stated intent contradicts the implementation.",
+      "title": "Arbitrary code execution via pickle.loads on untrusted input"
+    },
+    {
+      "confidence": 0.85,
+      "filePath": "source.py",
+      "line": 6,
+      "severity": "low",
+      "suggestion": "After safe decoding, assert/validate the result is a dict (e.g. `if not isinstance(result, dict): raise ValueError(...)`) before returning, or widen the annotation to match reality.",
+      "summary": "The signature load_state(blob: str) -> dict (source.py:6) promises a dict, but pickle.loads (line 11) returns whatever type the pickle stream encodes — any object, not necessarily a dict. The invariant is asserted but never checked, so downstream code trusting the `-> dict` contract can build on a false premise (independent of the RCE).",
+      "title": "Declared '-> dict' return invariant is not enforced"
+    }
+  ],
+  "findings_count": 2,
+  "qa_evidence": [],
+  "review_id": "ffdbeda9-272d-441c-af08-aa9a0ae7a8ac",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-py",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.68,
+        "from": "file-source-py",
+        "kind": "has_blast_radius",
+        "to": "blast-radius"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-py",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.py",
+        "id": "file-source-py",
+        "kind": "file",
+        "label": "source.py"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "computed from repo relationships",
+        "file_path": null,
+        "id": "blast-radius",
+        "kind": "blast_radius",
+        "label": "Blast-radius summary"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.py",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "specialist-lite",
+  "risk_tier": "lite",
+  "score": 78.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "product-safety", "agent-handoff"],
+  "summary": "Risk-tiered review (lite) completed.\n\nNew file introduces load_state, which performs insecure deserialization of untrusted base64+pickle data — a critical, author-acknowledged RCE (source.py:11). The inline comment states the safe approach (JSON/restricted schema) but the code does the opposite, so stated intent contradicts implementation. Secondary assumption-integrity issue: the '-> dict' return type is an unenforced invariant since pickle.loads can yield any type. No fresh runtime evidence was attached, but the RCE is statically provable from the untrusted-input→pickle.loads data flow.\n\nNew file source.py adds load_state, which base64-decodes and pickle.loads a caller-supplied string. This is a critical insecure-deserialization / RCE sink. Currently 0 callers, so no user-facing flow is broken yet, but it is a latent critical defect that is exploitable the instant user input is routed to it. Reported as an obvious critical cross-scope defect per the specialist exception; no product-safety-scoped regressions found (no touched UI screens, states, or existing workflows).\n\nSingle new file source.py introduces load_state, an insecure deserialization sink: pickle.loads over base64-decoded caller input (source.py:10-11) — a critical RCE. The agent's own comment (source.py:7-9) flags it as a BUG and names the fix (JSON/restricted schema) yet the vulnerable code was shipped, a fake-green/incomplete-handoff pattern. load_state currently has 0 callers (newly added), which limits present blast radius, but the defect is intrinsic and must be fixed before any caller is wired up. No tests or fresh verification evidence exist; the rerun_relevant_verification gate remains blocked until a test proves a malicious payload cannot execute.",
+  "talk_id": "3d52dcc1-a200-4d07-a753-22eaf159e333"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/py-path-traversal.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/py-path-traversal.codevetter.raw.json
new file mode 100644
index 00000000..7aabbd99
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/py-path-traversal.codevetter.raw.json
@@ -0,0 +1,142 @@
+{
+  "agent": "claude",
+  "changed_lines": 12,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 51029,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.py"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.98,
+      "filePath": "source.py",
+      "line": 10,
+      "severity": "critical",
+      "suggestion": "Contain the resolved path inside base_dir before opening. Example: base=os.path.realpath(base_dir); full=os.path.realpath(os.path.join(base, report_name)); if os.path.commonpath([full, base]) != base: raise ValueError('invalid report name'). Optionally also reject report_name containing os.sep/'..' or being absolute up front. Do not rely on the annotated comment as a fix.",
+      "summary": "Line 10 builds the path via os.path.join(base_dir, report_name) with untrusted report_name and line 11 opens+returns it. This is exploitable two ways: (1) relative traversal report_name='../../etc/passwd' escapes /var/app/reports (as the comment on lines 7-9 admits), and (2) absolute path report_name='/etc/passwd' — os.path.join discards base_dir when the second arg is absolute, returning /etc/passwd — which the comment does NOT mention. Result: arbitrary file read. The BUG comment documents the flaw but the code still ships it unfixed.",
+      "title": "Path traversal / arbitrary file read in read_report"
+    },
+    {
+      "confidence": 0.9,
+      "filePath": "source.py",
+      "line": 5,
+      "severity": "medium",
+      "suggestion": "Before marking this resolved, add tests that assert read_report rejects '../../etc/passwd', an absolute path like '/etc/passwd', and symlink escapes, while still reading a legitimate report. Run: python -m pytest -q (or a small repro script) and attach the output as fresh verification.",
+      "summary": "read_report has 0 callers (newly added) and no accompanying test or verification artifact; the deterministic procedure gate rerun_relevant_verification is blocked on 'no-fresh-verification-evidence'. Because the vulnerability is self-documented but not fixed, the next agent could mistake the BUG comment for resolution.",
+      "title": "No tests or verification for the traversal fix (handoff gate blocked)"
+    }
+  ],
+  "findings_count": 2,
+  "qa_evidence": [],
+  "review_id": "17e36f7e-fa50-48b6-bfbc-26c03b95ba03",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-py",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.68,
+        "from": "file-source-py",
+        "kind": "has_blast_radius",
+        "to": "blast-radius"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-py",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.py",
+        "id": "file-source-py",
+        "kind": "file",
+        "label": "source.py"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "computed from repo relationships",
+        "file_path": null,
+        "id": "blast-radius",
+        "kind": "blast_radius",
+        "label": "Blast-radius summary"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.py",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "specialist-lite",
+  "risk_tier": "lite",
+  "score": 75.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "product-safety", "agent-handoff"],
+  "summary": "Risk-tiered review (lite) completed.\n\nSingle newly-added function read_report contains a real, statically-provable path traversal / arbitrary-file-read vulnerability: caller-controlled report_name is joined into a filesystem path (source.py:10) with no containment enforcement. Two escape vectors exist — '../' traversal and absolute-path override (the latter not covered by the code comment). Currently 0 callers so not yet reachable in-repo, but the handler is clearly intended to take untrusted input; the containment invariant is unenforced. No fresh runtime evidence exists, but the defect is provable from the diff.\n\nNew file source.py adds read_report with an unmitigated path traversal vulnerability that the author's own comment flags as a BUG. Caller-supplied report_name is joined into a filesystem path and opened without normalization or containment, allowing both relative ('../../etc/passwd') and absolute ('/etc/passwd') escapes from base_dir. Critical severity despite 0 current callers, because any future caller wiring this to a request handler exposes arbitrary file reads. Out of strict Product-Safety scope but reported as an obvious critical cross-scope defect.\n\nA new 12-line module whose sole function read_report has a critical, still-unfixed path traversal / arbitrary-file-read vulnerability (line 10). The code annotates the flaw with a 'BUG:' comment but ships it, and the comment even misses the absolute-path override vector. No tests or verification exist. This must be fixed and covered by tests before handoff; the annotated comment is not a fix.",
+  "talk_id": "2d0c65c3-c60e-468c-add6-1273b59add6e"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/py-sql-injection.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/py-sql-injection.codevetter.raw.json
new file mode 100644
index 00000000..b556a75d
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/py-sql-injection.codevetter.raw.json
@@ -0,0 +1,133 @@
+{
+  "agent": "claude",
+  "changed_lines": 9,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 42344,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.py"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.99,
+      "filePath": "source.py",
+      "line": 8,
+      "severity": "critical",
+      "suggestion": "Use a parameterized query and let the driver bind the value: `db.execute(\"SELECT id, name FROM products WHERE name LIKE ?\", (f\"%{name}%\",))`. Never build SQL with f-strings/concatenation from caller input.",
+      "summary": "Line 8: `db.execute(f\"SELECT id, name FROM products WHERE name LIKE '%{name}%'\")` interpolates the untrusted `name` argument directly into the SQL text. A value such as `x' UNION SELECT password FROM users--` closes the string literal and appends attacker-controlled SQL, allowing data exfiltration or destructive statements. The function's own comment (lines 6-7) confirms the intent to expose this flaw.",
+      "title": "SQL injection via f-string interpolation in search_products"
+    }
+  ],
+  "findings_count": 1,
+  "qa_evidence": [],
+  "review_id": "55b0b544-b32e-4ce9-873e-5404a515e8c5",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-py",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.68,
+        "from": "file-source-py",
+        "kind": "has_blast_radius",
+        "to": "blast-radius"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-py",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.py",
+        "id": "file-source-py",
+        "kind": "file",
+        "label": "source.py"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "computed from repo relationships",
+        "file_path": null,
+        "id": "blast-radius",
+        "kind": "blast_radius",
+        "label": "Blast-radius summary"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.py",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "assumption-first",
+  "risk_tier": "trivial",
+  "score": 80.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "general"],
+  "summary": "Risk-tiered review (trivial) completed.\n\nNew file source.py adds search_products, which builds a SQL query by f-string-interpolating the untrusted `name` argument (line 8) — a classic, directly-exploitable SQL injection. The inline comment accurately describes the defect, but the code does not enforce the safe contract a DB helper implies; the stated-intent-vs-implementation gap is resolved by the code actually being vulnerable. No callers exist yet (newly added), so no harm is realized, but any future caller inherits the hole. Fix is a standard sqlite3 parameterized query.\n\nA single new 9-line file adds `search_products`, which contains a clear, unmitigated SQL injection: the `name` parameter is interpolated into the query via an f-string on line 8. This is a critical, confirmed vulnerability (the code comment itself documents it). No callers exist yet (blast radius 0), but the contract of the function is inherently unsafe and must be fixed before any use. Verification gate note: this is a static-analysis certainty — the injection is provable from the source line alone and needs no runtime artifact — so the missing-fresh-verification lead is resolved for this finding by code inspection.",
+  "talk_id": "9e61254a-d3c3-43d3-95c3-f379f5912a2a"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/py-ssrf.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/py-ssrf.codevetter.raw.json
new file mode 100644
index 00000000..fa763b6f
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/py-ssrf.codevetter.raw.json
@@ -0,0 +1,142 @@
+{
+  "agent": "claude",
+  "changed_lines": 12,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 48393,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.py"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.95,
+      "filePath": "source.py",
+      "line": 10,
+      "severity": "critical",
+      "suggestion": "Before fetching: (1) parse the URL and allow only http/https schemes; (2) resolve the hostname and reject if any resolved IP is in a private/loopback/link-local/reserved range (ipaddress.ip_address(...).is_private/is_loopback/is_link_local/is_reserved), guarding against DNS-rebinding by pinning the validated IP for the actual connection; (3) disable redirects (allow_redirects=False) or re-validate each hop; (4) optionally enforce a host allowlist and cap response size. Consider a vetted helper/library rather than hand-rolling.",
+      "summary": "source.py:10 passes the untrusted `image_url` parameter directly into `requests.get(image_url, timeout=5)` with no validation between the function entry (line 5) and the request. There is no scheme allowlist, no host/DNS-resolution check, and no rejection of private/link-local ranges; `requests` also follows redirects by default, so a remote 302 can reach internal targets even if the initial host were checked. An attacker who controls `image_url` can read cloud metadata credentials via http://169.254.169.254/latest/meta-data/ or pivot to internal services. Currently 0 callers, so no live flow is broken yet, but this becomes exploitable the moment it is wired to user input.",
+      "title": "SSRF: user-supplied URL fetched with no scheme/host/private-range validation"
+    },
+    {
+      "confidence": 0.9,
+      "filePath": "source.py",
+      "line": 6,
+      "severity": "medium",
+      "suggestion": "Treat the SSRF finding as a hard blocker, not optional cleanup. After adding validation, add and run a unit test that asserts internal/metadata URLs raise before any network call (e.g. mock requests.get and assert it is never invoked for 169.254.169.254). Attach the test output as the verification artifact, then remove the stale BUG comment.",
+      "summary": "Lines 6-9 contain a self-described '# BUG:' comment identifying the SSRF, yet the committed implementation (line 10) applies no fix — a fake-green handoff where the defect is documented but not resolved. No test or command evidence accompanies the change (procedure gate rerun_relevant_verification is blocked), so nothing proves the fetch rejects internal/link-local targets. The next agent must not treat this as done.",
+      "title": "Known-defect handoff with no verification: BUG comment left in, no tests added"
+    }
+  ],
+  "findings_count": 2,
+  "qa_evidence": [],
+  "review_id": "e0e03c63-4afb-4c96-a9bf-096676790714",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-py",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.68,
+        "from": "file-source-py",
+        "kind": "has_blast_radius",
+        "to": "blast-radius"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-py",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.py",
+        "id": "file-source-py",
+        "kind": "file",
+        "label": "source.py"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "computed from repo relationships",
+        "file_path": null,
+        "id": "blast-radius",
+        "kind": "blast_radius",
+        "label": "Blast-radius summary"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.py",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "specialist-lite",
+  "risk_tier": "lite",
+  "score": 75.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "product-safety", "agent-handoff"],
+  "summary": "Risk-tiered review (lite) completed.\n\nNewly added fetch_preview is a textbook SSRF: it fetches an arbitrary user-controlled URL (source.py:10) with no scheme, host, or private-range restrictions and default redirect following. The function's own comment honestly describes the vulnerability, so there is no stated-intent/code contradiction — but the 'URL is safe' invariant is relied upon and never enforced, and labeling a live exploit path as a documented 'BUG' risks a next agent wiring it up believing the risk was handled. 0 callers today (not yet exploitable), which caps immediate severity at high, but the impact is credential theft / internal pivot the moment it is called.\n\nSingle new file introducing fetch_preview, a textbook SSRF: untrusted image_url flows straight into requests.get with no scheme/host/private-range checks and default redirect-following (source.py:5-10). No callers today (blast radius 0), so nothing is broken in a live user flow yet — hence it's a latent critical rather than an active product-safety regression — but it is a critical cross-scope defect and must be fixed before wiring to any user input.\n\nA 12-line new module (fetch_preview) introduces a classic, unmitigated SSRF: a user-supplied URL is passed directly to requests.get with no scheme/host/private-range checks and default redirect-following, reaching cloud metadata (169.254.169.254) and internal services. The code even carries a self-labeled '# BUG:' comment yet ships unfixed, with no tests or verification — an incomplete, fake-green handoff. 0 callers today keeps live risk latent, but the function exists to consume untrusted input, so it is critical the moment it is wired up. Primary blocker: add scheme/IP-range validation + disable redirects; secondary: add a rejection test as verification before marking fixed.",
+  "talk_id": "ca9ced7e-5e08-4df1-8cef-e8622226df61"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/py-weak-hash.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/py-weak-hash.codevetter.raw.json
new file mode 100644
index 00000000..99603ddf
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/py-weak-hash.codevetter.raw.json
@@ -0,0 +1,151 @@
+{
+  "agent": "claude",
+  "changed_lines": 12,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 62317,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.py"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.98,
+      "filePath": "source.py",
+      "line": 8,
+      "severity": "critical",
+      "suggestion": "Replace with a slow, salted password KDF: `hashlib.scrypt`/`hashlib.pbkdf2_hmac` with a random per-user salt, or a dedicated library (bcrypt/argon2). Store salt+params alongside the hash. Update `verify_password` to read the stored salt/params and recompute accordingly.",
+      "summary": "source.py:8 `hashlib.md5(password.encode()).hexdigest()` hashes passwords with unsalted MD5. MD5 is fast and cryptographically broken; without a per-user salt, identical passwords yield identical digests, making rainbow-table and brute-force attacks trivial. The agent's own comment at source.py:6-7 acknowledges this exact defect but the code ships it anyway — a documented-but-unfixed bug (fake-green handoff risk).",
+      "title": "Unsalted MD5 used for password hashing"
+    },
+    {
+      "confidence": 0.7,
+      "filePath": "source.py",
+      "line": 11,
+      "severity": "medium",
+      "suggestion": "Add a test asserting round-trip (`verify_password(pw, hash_password(pw)) is True`), rejection of wrong passwords, that two hashes of the same password differ (salt present), and run it: `python -m pytest` (or `python -c` round-trip). Attach the output before marking fixed.",
+      "summary": "Both `hash_password` and `verify_password` are new with 0 callers and no accompanying tests; the pre-review search flagged `no-fresh-verification-evidence` and the `rerun_relevant_verification` gate is still blocked. Because the correct fix changes the stored-hash format (salt+params vs bare MD5 hex), any test must be authored against the replacement KDF, not the current MD5 output.",
+      "title": "No tests or verification for new auth primitives (handoff gap)"
+    },
+    {
+      "confidence": 0.6,
+      "filePath": "source.py",
+      "line": 12,
+      "severity": "low",
+      "suggestion": "Use hmac.compare_digest(hash_password(password), stored) for constant-time comparison.",
+      "summary": "verify_password (source.py:12) compares with `hash_password(password) == stored`, which short-circuits and is not timing-safe. Secondary to the MD5 weakness, but if the hashing is fixed this comparison remains a (minor) timing side-channel.",
+      "title": "Non-constant-time hash comparison in verify_password"
+    }
+  ],
+  "findings_count": 3,
+  "qa_evidence": [],
+  "review_id": "5514da31-3564-487b-b746-07aad668d774",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-py",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.68,
+        "from": "file-source-py",
+        "kind": "has_blast_radius",
+        "to": "blast-radius"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-py",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.py",
+        "id": "file-source-py",
+        "kind": "file",
+        "label": "source.py"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "computed from repo relationships",
+        "file_path": null,
+        "id": "blast-radius",
+        "kind": "blast_radius",
+        "label": "Blast-radius summary"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.py",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "specialist-lite",
+  "risk_tier": "lite",
+  "score": 73.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "product-safety", "agent-handoff"],
+  "summary": "Risk-tiered review (lite) completed.\n\nNew file source.py implements password hashing with unsalted MD5. The self-labeled `# BUG:` comment is honest and matches the code, so there is no assumption/intent contradiction to flag — the issue is the insecure primitive itself, a real (high→critical-if-wired) security hole. Currently 0 callers (blast-radius confirmed), so no persisted-data or caller-contract breakage exists yet. Secondary: non-constant-time comparison in verify_password.\n\nA 12-line new file implementing password hashing on unsalted MD5. This is a critical credential-storage defect: MD5 is broken and unsalted, making stored passwords trivially recoverable on any DB leak (source.py:8), with verify_password (source.py:12) also using non-constant-time == comparison. Currently 0 callers, so no live user flow is affected yet, but the functions are clearly intended for an auth path — fix before adoption. No user-facing screens/states exist in this diff to evaluate for the product-safety scope; the single finding is an obvious critical cross-scope defect.\n\nSmall 12-line new module implementing password hashing with unsalted MD5 — a critical security defect that the agent explicitly documented in a `# BUG:` comment (source.py:6-8) but did not fix. This is a textbook agent-handoff failure mode: the code reads as intentional yet leaves a known vulnerability live, and a summary could easily report it as 'added password hashing / done'. Secondary issue: non-constant-time comparison in verify_password (source.py:12). No tests and no fresh verification evidence exist; the verification gate is blocked. Blast radius is currently 0 callers, so no regression to existing code, but this must be fixed before anything calls it.",
+  "talk_id": "91eec98f-e4fc-4c63-915a-edf15c125aa2"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/py-zip-bomb.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/py-zip-bomb.codevetter.raw.json
new file mode 100644
index 00000000..5de811a4
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/py-zip-bomb.codevetter.raw.json
@@ -0,0 +1,133 @@
+{
+  "agent": "claude",
+  "changed_lines": 9,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 46673,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.py"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.95,
+      "filePath": "source.py",
+      "line": 9,
+      "severity": "high",
+      "suggestion": "Before extracting, iterate zf.infolist() and enforce limits: reject if any info.file_size exceeds a per-file cap, if sum(file_size) exceeds a total cap, if len(infolist) exceeds a member cap, or if file_size/compress_size exceeds a ratio threshold. Extract members individually with a bounded read loop (read fixed-size chunks and abort past a running byte budget) rather than extractall. Also document that archive_path may be untrusted.",
+      "summary": "source.py:8-9 calls zf.extractall(dest) directly with no cap on per-member uncompressed size, total extracted bytes, member count, or compression ratio. As the comment at lines 6-7 acknowledges, a small crafted archive (zip bomb) can decompress to arbitrarily large output, exhausting disk and memory (DoS). The function name/signature (extract_archive, line 5) advertises no trust precondition, so with 0 current callers the next integration is likely to feed it untrusted input and inherit the vulnerability.",
+      "title": "Zip bomb: extract_archive decompresses without size/ratio/count limits"
+    }
+  ],
+  "findings_count": 1,
+  "qa_evidence": [],
+  "review_id": "e39eea18-55ce-4be4-9219-ca6fb173f57e",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-py",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.68,
+        "from": "file-source-py",
+        "kind": "has_blast_radius",
+        "to": "blast-radius"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-py",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.py",
+        "id": "file-source-py",
+        "kind": "file",
+        "label": "source.py"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "computed from repo relationships",
+        "file_path": null,
+        "id": "blast-radius",
+        "kind": "blast_radius",
+        "label": "Blast-radius summary"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.py",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "assumption-first",
+  "risk_tier": "trivial",
+  "score": 90.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "general"],
+  "summary": "Risk-tiered review (trivial) completed.\n\nSingle new file introducing extract_archive, which extracts a zip with zipfile.extractall and no decompression limits — a genuine zip-bomb / resource-exhaustion vulnerability that the code's own comment acknowledges. Stated intent and code agree (no intent/code contradiction), but the function relies on an unenforced and unadvertised 'archive is trusted' invariant, which is the material assumption risk for follow-up work. Path traversal (Zip Slip) is NOT present because CPython's extractall sanitizes member paths — deliberately not reported to avoid a false finding.\n\nSingle newly-added function extract_archive extracts a zip with zipfile.extractall and no size/ratio guards — a real decompression-bomb DoS (CWE-409), matching the case annotation. Path traversal (Zip Slip) is largely mitigated by modern extractall's own sanitization, so it is not reported as a separate finding. No callers exist yet (0 blast radius), but any use on untrusted input is unsafe.",
+  "talk_id": "04fc11e0-db90-4923-bdf0-33b550f8844a"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/rust-integer-overflow.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/rust-integer-overflow.codevetter.raw.json
new file mode 100644
index 00000000..c3237318
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/rust-integer-overflow.codevetter.raw.json
@@ -0,0 +1,151 @@
+{
+  "agent": "claude",
+  "changed_lines": 20,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 78500,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.rs"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.97,
+      "filePath": "source.rs",
+      "line": 17,
+      "severity": "high",
+      "suggestion": "Return a Result/Option and reject insufficient funds: `self.balance = self.balance.checked_sub(amount).ok_or(InsufficientFunds)?;` (or saturating_sub if clamping to zero is the intended contract). Never use bare `-=` on a balance.",
+      "summary": "source.rs:17 `self.balance -= amount` with amount > balance underflows u64. Debug builds panic (process crash mid-transaction); release builds wrap to ~u64::MAX, so an over-withdrawal silently succeeds and inflates the account balance — money creation / data-integrity corruption on a public money type.",
+      "title": "debit() underflow: over-debit panics (debug) or wraps to a huge balance (release)"
+    },
+    {
+      "confidence": 0.95,
+      "filePath": "source.rs",
+      "line": 11,
+      "severity": "medium",
+      "suggestion": "Use checked_add and surface the error: `self.balance = self.balance.checked_add(amount).ok_or(Overflow)?;` (or saturating_add if a ceiling is acceptable).",
+      "summary": "source.rs:11 `self.balance += amount` overflows u64 when balance+amount exceeds u64::MAX. Debug builds panic; release builds wrap, silently rolling a large balance back down to a tiny value — the user's funds effectively disappear. Public API on a monetary type.",
+      "title": "credit() overflow: large credit panics (debug) or wraps balance to a small value (release)"
+    },
+    {
+      "confidence": 0.85,
+      "filePath": "source.rs",
+      "line": 8,
+      "severity": "medium",
+      "suggestion": "Apply the prescribed checked arithmetic, then add unit tests for the overflow/underflow edges (e.g. credit(u64::MAX)+1, debit(amount > balance)) and provide a minimal crate (Cargo.toml + lib.rs) so `cargo test` can be run. Next agent must attach that fresh test output before marking fixed.",
+      "summary": "Both methods carry `// BUG:` comments (lines 8-10, 15-16) that prescribe checked_add/saturating_add, yet the raw `+=`/`-=` remain (lines 11, 17) — an incomplete handoff / fake-green risk. There is no Cargo.toml, no #[test], and no caller (confirmed by find/grep), so the rerun_relevant_verification gate is unsatisfiable as shipped: nothing proves these paths work.",
+      "title": "Fix identified in comments but never applied; no tests or verification"
+    }
+  ],
+  "findings_count": 3,
+  "qa_evidence": [],
+  "review_id": "28f621cd-b308-4ac5-ba51-a2e428495cfc",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-rs",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.68,
+        "from": "file-source-rs",
+        "kind": "has_blast_radius",
+        "to": "blast-radius"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-rs",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.rs",
+        "id": "file-source-rs",
+        "kind": "file",
+        "label": "source.rs"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "computed from repo relationships",
+        "file_path": null,
+        "id": "blast-radius",
+        "kind": "blast_radius",
+        "label": "Blast-radius summary"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.rs",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "specialist-lite",
+  "risk_tier": "lite",
+  "score": 80.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "product-safety", "agent-handoff"],
+  "summary": "Risk-tiered review (lite) completed.\n\nNew file implements an Account ledger with unchecked u64 arithmetic in both credit() and debit(). Both operations carry unenforced invariants (no-overflow on credit, sufficient-funds on debit) that Rust does not guard in release builds, so over-debit inflates balances and over-credit corrupts them. The code comments accurately describe the bugs and the correct fix, so they will not misdirect the next agent — but the guarded implementation they prescribe is missing. debit() is the higher-severity of the two (silent balance/money creation).\n\nNew public monetary type Account uses unchecked `+=`/`-=` on u64 balances. Both credit (line 11) and debit (line 17) are real correctness/safety bugs: debug builds panic on over/underflow (crash), release builds wrap silently — the debit underflow is the most dangerous, letting an over-debit produce a near-u64::MAX balance (money creation) on a financial type. Currently 0 callers so present blast radius is low, but these are pub methods that are wrong the moment they're used. Fix with checked_/saturating_ arithmetic.\n\nNew Account primitive with two genuine correctness/security bugs in credit (line 11) and debit (line 17): unchecked u64 arithmetic that panics in debug and wraps in release. debit underflow is the worst — over-debit wraps to a huge balance (money creation) and the u64 return type gives callers no way to detect failure. Both bugs are documented in BUG comments but the prescribed fix was never applied, and there are no tests, no crate, and no callers, so nothing has been verified. Blast radius is currently 0 callers (newly added), but the primitive is unsafe by contract for any future caller.",
+  "talk_id": "e0581fad-0ddc-4aa8-8619-b2048ec41882"
+}
diff --git a/benchmarks/public-catch-rate/reviews-raw/ts-dead-code.codevetter.raw.json b/benchmarks/public-catch-rate/reviews-raw/ts-dead-code.codevetter.raw.json
new file mode 100644
index 00000000..a3edb1dc
--- /dev/null
+++ b/benchmarks/public-catch-rate/reviews-raw/ts-dead-code.codevetter.raw.json
@@ -0,0 +1,178 @@
+{
+  "agent": "claude",
+  "changed_lines": 21,
+  "coordinator_used": false,
+  "diff_range": "HEAD~1..HEAD",
+  "duration_ms": 82096,
+  "evidence_candidates": [
+    {
+      "affected_files": ["source.ts"],
+      "caveats": ["The user may have run verification outside indexed agent sessions."],
+      "confidence": 0.66,
+      "evidence_refs": [
+        {
+          "detail": null,
+          "kind": "history",
+          "label": "No fresh command/test/browser proof found in compact history"
+        }
+      ],
+      "id": "no-fresh-verification-evidence",
+      "kind": "not_verified",
+      "open_questions": ["What is the smallest relevant command or browser task for this diff?"],
+      "scale": "1 changed file(s)",
+      "severity_hint": "medium",
+      "suggested_checks": [
+        "Attach a fresh command, test, log, screenshot, or trace before marking the finding fixed."
+      ],
+      "why_it_matters": "A review without fresh verification evidence can only prove static plausibility, not that the change works."
+    }
+  ],
+  "evidence_procedure_steps": [
+    {
+      "action": "Choose the smallest relevant repo command or browser task, rerun it, and attach the fresh output.",
+      "artifact": "command log, test report, screenshot, trace, or QA run artifact",
+      "blocked_on": ["fresh verification artifact"],
+      "candidate_ids": ["no-fresh-verification-evidence"],
+      "gate": "No candidate is marked confirmed or fixed using stale or missing verification.",
+      "id": "rerun_relevant_verification",
+      "input": "Failed, stale, or missing command/test/browser evidence.",
+      "output": "Fresh pass/fail evidence linked to the review.",
+      "procedure": "rerun_relevant_verification",
+      "status": "blocked"
+    }
+  ],
+  "findings": [
+    {
+      "confidence": 0.95,
+      "filePath": "source.ts",
+      "line": 8,
+      "severity": "medium",
+      "suggestion": "Guard the 'C' case (`if (score >= 70) { return 'C'; }`) so the 'D' (`>= 60`?) and 'F' branches become reachable, then delete the now-truly-dead fallthrough. Confirm the intended grade thresholds. Also remove the unused `neverCalled` helper (source.ts:19) if it is not a deliberate fixture.",
+      "summary": "In `classify` (source.ts:2), `return 'C';` on line 8 executes for every score below 80, so the code on lines 13–16 (`if (score >= 70) return 'D';` and `return 'F';`) is unreachable. The function can only return 'A', 'B', or 'C'; e.g. `classify(50)` returns 'C' instead of 'F'. The comment on lines 11–12 correctly identifies this, so it does not mislead follow-up work, but the underlying correctness bug is real: the `return 'C'` was almost certainly meant to be guarded (e.g. `if (score >= 70) return 'C';`). `classify` is exported (0 current callers per blast radius), so this is a latent contract defect.",
+      "title": "Unconditional `return 'C'` makes 'D'/'F' branches dead — classifier can never return those grades"
+    },
+    {
+      "confidence": 0.95,
+      "filePath": "source.ts",
+      "line": 9,
+      "severity": "medium",
+      "suggestion": "Confirm the intended thresholds, then restructure so the branches are reachable — e.g. guard the 'C' case (`if (score >= 70) return 'C';`) before `if (score >= 60) return 'D';` / `return 'F';`, or delete lines 13-16 if 'C' truly is the floor. Do not leave the unreachable block in place.",
+      "summary": "Line 9 `return 'C';` is unconditional, so lines 13-16 (`if (score >= 70) return 'D';` and `return 'F';`) are unreachable. Any score below 80 returns 'C', so the exported classify() can never produce 'D' or 'F' — a 65 and a 45 both grade as 'C'. The line 11-12 comment excuses this as 'never used,' but classify is `export`ed (line 2) and thus a public contract; 0 callers today does not make the logic correct. Intended grade boundaries are ambiguous, so the fix needs author intent, not a guess.",
+      "title": "Unreachable code makes classify() never return 'D' or 'F'"
+    },
+    {
+      "confidence": 0.95,
+      "filePath": "source.ts",
+      "line": 9,
+      "severity": "medium",
+      "suggestion": "Delete the unconditional `return 'C';` on line 9 and let the score fall through the `>= 70` check, so the tiers read: >=90 A, >=80 B, >=70 C (or D per intent), else F. Confirm the intended cutoffs, then run `tsc --noEmit` with `allowUnreachableCode: false` to prove no unreachable branches remain.",
+      "summary": "Line 9 `return 'C';` is unconditional, so lines 13–16 (`if (score >= 70) return 'D';` and the final `return 'F';`) are unreachable. classify(75) returns 'C' instead of 'D', and classify(40) returns 'C' instead of 'F'. The function is `export`ed (line 2), so any future consumer of this public symbol gets a silently wrong grade for the entire 0–79 range. Currently 0 callers, so no live workflow is broken yet — hence medium, not high.",
+      "title": "Unreachable D/F grade tiers: classify() returns 'C' for every score below 80"
+    },
+    {
+      "confidence": 0.9,
+      "filePath": "source.ts",
+      "line": 19,
+      "severity": "low",
+      "suggestion": "Remove neverCalled() unless a caller is coming in a follow-up; if intentional scaffolding, note that in a commit message so the next agent doesn't re-flag it.",
+      "summary": "Lines 19-21 define `neverCalled()` which is non-exported and has 0 callers (confirmed by blast-radius). It is pure dead weight.",
+      "title": "neverCalled() is dead code"
+    },
+    {
+      "confidence": 0.85,
+      "filePath": "source.ts",
+      "line": 2,
+      "severity": "low",
+      "suggestion": "Next agent: run `npx tsc --noEmit --allowUnreachableCode false source.ts` (errors on the unreachable block) and add a table test asserting classify(95)==='A', classify(85)==='B', classify(75), classify(55) across all bands. Attach the output before marking this fixed.",
+      "summary": "Repo has no tsconfig.json, package.json, tests, or lint config; nothing was run against the diff, leaving the rerun_relevant_verification gate unresolved. The unreachable-code bug at line 9 is trivially detectable by a compiler/linter.",
+      "title": "No verification run — dead-code bug would be caught by tsc/lint"
+    },
+    {
+      "confidence": 0.9,
+      "filePath": "source.ts",
+      "line": 19,
+      "severity": "low",
+      "suggestion": "Remove neverCalled() unless it is a deliberate placeholder for imminent use; if kept, add a comment explaining why.",
+      "summary": "neverCalled (lines 19–21) is not exported and has 0 callers per the blast-radius scan; it only logs to console. No correctness or user-facing impact — pure dead code.",
+      "title": "Dead helper neverCalled() has no callers"
+    }
+  ],
+  "findings_count": 6,
+  "qa_evidence": [],
+  "review_id": "f1aad0f3-47ce-4dca-8a35-b973ef1cf6c2",
+  "review_memory_graph": {
+    "edges": [
+      {
+        "confidence": 0.74,
+        "from": "file-source-ts",
+        "kind": "has_history_context",
+        "to": "history-context"
+      },
+      {
+        "confidence": 0.68,
+        "from": "file-source-ts",
+        "kind": "has_blast_radius",
+        "to": "blast-radius"
+      },
+      {
+        "confidence": 0.66,
+        "from": "file-source-ts",
+        "kind": "raises_candidate",
+        "to": "candidate-no-fresh-verification-evidence"
+      },
+      {
+        "confidence": 0.86,
+        "from": "candidate-no-fresh-verification-evidence",
+        "kind": "requires_gate",
+        "to": "gate-rerun-relevant-verification"
+      }
+    ],
+    "nodes": [
+      {
+        "detail": "changed file",
+        "file_path": "source.ts",
+        "id": "file-source-ts",
+        "kind": "file",
+        "label": "source.ts"
+      },
+      {
+        "detail": "306 chars in prompt section",
+        "file_path": null,
+        "id": "history-context",
+        "kind": "history_context",
+        "label": "Prior commits, decisions, agents, and command evidence"
+      },
+      {
+        "detail": "computed from repo relationships",
+        "file_path": null,
+        "id": "blast-radius",
+        "kind": "blast_radius",
+        "label": "Blast-radius summary"
+      },
+      {
+        "detail": "not_verified · confidence 0.66",
+        "file_path": "source.ts",
+        "id": "candidate-no-fresh-verification-evidence",
+        "kind": "evidence_candidate",
+        "label": "no-fresh-verification-evidence"
+      },
+      {
+        "detail": "blocked · No candidate is marked confirmed or fixed using stale or missing verification.",
+        "file_path": null,
+        "id": "gate-rerun-relevant-verification",
+        "kind": "procedure_gate",
+        "label": "rerun_relevant_verification"
+      }
+    ],
+    "schema_version": 1,
+    "scope": "review_changed_files",
+    "truncated": false
+  },
+  "review_mode": "specialist-lite",
+  "risk_tier": "lite",
+  "score": 79.0,
+  "sensitive_paths": [],
+  "specialists": ["assumption-integrity", "product-safety", "agent-handoff"],
+  "summary": "Risk-tiered review (lite) completed.\n\nSingle new 21-line file, self-contained in the diff. The only material issue is a provable dead-code/correctness defect: the unconditional `return 'C'` on line 8 makes the 'D'/'F' branches (lines 13–16) unreachable, so `classify` can never return those grades. From the assumption-integrity angle, the inline comment's claims (code below is unreachable; helper is unused) are both accurate and verified against blast-radius data, so they will NOT steer the next agent to a false premise — the comment honestly labels the bug. Severity capped at medium because `classify` has 0 callers today despite being exported.\n\nNew standalone file with a self-admitted dead-code defect. The material bug: an unconditional `return 'C';` (line 9) makes the D/F grade tiers (lines 13–16) unreachable, so classify() returns 'C' for all scores below 80 instead of 'D' (70–79) or 'F' (<70). Because classify is exported, this is a latent public-API regression, but with 0 callers there is no broken user workflow today — rated medium. neverCalled() is harmless dead code (low). No security, data-loss, or permission-state concerns in scope.\n\nNewly added source.ts introduces an exported classify() with a live correctness bug: an unconditional `return 'C';` at line 9 renders the 'D'/'F' branches (lines 13-16) unreachable, so all scores below 80 grade as 'C'. The in-code comment acknowledges the dead code but wrongly dismisses it as harmless because the symbol is unused — it is exported and the logic is simply wrong. A second unused function (neverCalled) is minor dead code. No verification harness exists, so the bug shipped unchecked.",
+  "talk_id": "bf5c4b17-85b3-437c-a1f7-dd1b2b1295cc"
+}