{
  "schemaVersion": 1,
  "slug": "end-to-end-fix-review-workflows",
  "title": "A Fix Is Not a Verdict: How Apex Verifies Security Patches",
  "snapshotDate": "2026-07-31",
  "lastMethodologyAuditDate": "2026-08-27",
  "implementationAudit": {
    "kernelRevision": "12c12279645ef5c72f498fc37a5677f0b55fe941",
    "scope": "Fix-recommendation requirements and pull-request Fix Review workflows",
    "repositoryAccess": "The implementation repository is private. The revision is recorded for internal reproducibility, not presented as independently accessible public evidence."
  },
  "cohort": {
    "startsAt": "2026-04-28T00:00:00Z",
    "endsAt": "2026-07-29T00:00:00Z",
    "endExclusive": true,
    "scope": "Production Fix Review attempts for client organizations",
    "exclusions": [
      "Cantina's internal Apex tenant",
      "Customer-identifying fields and raw finding text"
    ],
    "privacyNote": "Only disclosure-safe aggregates are published. Raw records contain client repository, pull-request, and finding metadata."
  },
  "definitions": {
    "review": "One initiated Fix Review attempt against either linked pull-request code or the current repository branch.",
    "substantiveReview": "A review that proceeded past the no-change preflight and produced a Fix confirmed or Fix Incorrect verdict.",
    "originalBugStillReachable": "A surfaced issue classified as the original finding remaining reachable after the submitted change.",
    "newProblemIntroduced": "A surfaced issue classified as introduced by the submitted change.",
    "reviewPass": "A Fix Review attempt associated with a finding before that finding reached a confirmed fix; a pass is not necessarily a failed patch attempt."
  },
  "currentWorkflow": {
    "auditedAt": "2026-08-27",
    "stages": [
      {
        "key": "setup",
        "label": "Setup",
        "description": "Check out the selected PR or branch and load the evidence packet."
      },
      {
        "key": "scope",
        "label": "Scope",
        "description": "Map the original exploit and every required safety property into the checkout."
      },
      {
        "key": "hunt",
        "label": "Hunt",
        "description": "Exercise negative cases, adjacent paths, ordering, supported flows, and deployment assumptions."
      },
      {
        "key": "validate",
        "label": "Validate",
        "description": "Reject unsupported candidates and preserve missing evidence as uncertainty."
      },
      {
        "key": "synthesize",
        "label": "Synthesize",
        "description": "Return Fix confirmed, Fix Incorrect, or insufficient context with evidence."
      }
    ],
    "failureModes": [
      {
        "key": "partial_coverage",
        "label": "Partial coverage",
        "patchShape": "The reported input is blocked, but an equivalent encoding or sibling caller remains reachable.",
        "proof": "Probe alternate representations and every caller that shares the vulnerable operation."
      },
      {
        "key": "late_validation",
        "label": "Late validation",
        "patchShape": "The right check runs after the mutation, commit, or external side effect.",
        "proof": "Establish the invariant before the first irreversible operation."
      },
      {
        "key": "supported_flow_regression",
        "label": "Supported-flow regression",
        "patchShape": "The exploit disappears because a legitimate retry, recovery, or success path also disappears.",
        "proof": "Exercise the named supported flows as well as negative cases."
      },
      {
        "key": "new_attack_surface",
        "label": "New attack surface",
        "patchShape": "The change adds attacker-controlled state, fallback behavior, or a new trust transition.",
        "proof": "Trace the changed dataflow beyond the path in the original report."
      }
    ],
    "cleanVerdictRule": "Every first-class safety requirement must have evidence. Missing evidence produces insufficient context, not a clean pass."
  },
  "figures": {
    "scale": {
      "reviews": 1258,
      "findings": 644,
      "repositoriesWithRecordedIdentity": 51,
      "organizations": 10,
      "pullRequestTargetedReviews": 460,
      "repositoryCurrentReviews": 798,
      "repositoryCountIsFloor": true
    },
    "patchIssues": {
      "pullRequestsWithDurableVerdict": 193,
      "pullRequestsWithIssues": 62,
      "totalIssues": 97,
      "categories": [
        {
          "key": "original_bug_still_reachable",
          "label": "Original bug still reachable",
          "count": 63,
          "affectedFindings": 62
        },
        {
          "key": "new_problem_introduced",
          "label": "New problem the patch introduced",
          "count": 34,
          "affectedFindings": 30
        }
      ],
      "note": "Category counts describe issues observed in the submitted fix pull requests. They are counts, not an estimate of an industry-wide failure rate."
    },
    "reviewPasses": {
      "confirmedFindings": 399,
      "buckets": [
        {
          "key": "one",
          "label": "1 pass",
          "count": 254
        },
        {
          "key": "two",
          "label": "2 passes",
          "count": 99
        },
        {
          "key": "three_or_more",
          "label": "3 or more",
          "count": 46
        }
      ],
      "maximumObservedPasses": 12,
      "selectionNote": "Includes only findings that reached a confirmed fix in the cohort; it is not a success-rate denominator."
    }
  },
  "supplementaryAggregates": {
    "noChangePreflight": {
      "reviews": 154,
      "maximumSeconds": 2.2
    },
    "substantiveReviewLatencyMinutes": {
      "reviews": 1003,
      "median": 37,
      "quartile1": 27,
      "quartile3": 51
    },
    "distinctIssueWriteups": {
      "issuesAfterCrossCategoryDeduplication": 93,
      "withAnalysis": 93,
      "withSpecificFileAndLine": 70,
      "withSuggestedNextFix": 66,
      "storedAnalysisCharacterCap": 6000
    }
  },
  "interpretationLimits": [
    "Review volume was concentrated in a small number of organizations.",
    "The figures report observed counts and do not estimate a general security-patch failure rate.",
    "The pass figure is conditioned on eventual confirmation and must not be divided by the 644 findings in the scale figure.",
    "The snapshot is historical; the workflow description was separately audited against the product on 2026-08-27."
  ]
}