feat: scaffold 4 DOE rebalance tasks — SDLC 146 → 150 (Neyman-optimal)

Add 3 ccb_feature tasks (C/Rust/TypeScript) and 1 ccb_fix task (Java)
to complete the Neyman-optimal allocation targets:
- postgres-copy-csv-header-feat-001 (C, postgres/postgres)
- servo-css-container-query-feat-001 (Rust, servo/servo)
- vscode-custom-fold-region-feat-001 (TypeScript, microsoft/vscode)
- flink-window-late-data-fix-001 (Java, apache/flink)

Final SDLC counts: fix=26 feature=23 test=18 debug=18 refactor=16
design=14 document=13 secure=12 understand=10 (total=150).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: sjarmak

benchmarks/ccb_feature/postgres-copy-csv-header-feat-001/CLAUDE.md

@@ -0,0 +1,18 @@
+# postgres-copy-csv-header-feat-001: COPY FROM WITH HEADER MATCH
+
+## Task Type: Feature Implementation (SQL Command Extension)
+
+Implement HEADER MATCH option for PostgreSQL COPY FROM CSV.
+
+## Key Reference Files
+- `src/backend/parser/gram.y` — SQL grammar (search for `copy_opt_list`, `HEADER`)
+- `src/backend/commands/copy.c` — COPY entry point and option processing
+- `src/backend/commands/copyfrom.c` — COPY FROM reader implementation
+- `src/include/commands/copy.h` — CopyHeaderChoice enum, CopyFormatOptions struct
+- `src/test/regress/sql/copy.sql` — existing regression tests
+
+## Search Strategy
+- Search for `CopyHeaderChoice` to find the enum defining header behavior
+- Search for `header_line` in copyfrom.c to find where the header row is read/skipped
+- Search for `copy_opt_list` in gram.y to find the grammar rule for COPY options
+- Search for `attname` or `NameStr` in copyfrom.c for column name access patterns

benchmarks/ccb_feature/postgres-copy-csv-header-feat-001/environment/Dockerfile

@@ -0,0 +1,31 @@
+FROM gcc:14-bookworm
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    curl \
+    python3 \
+    python3-pip \
+    bison \
+    flex \
+    libreadline-dev \
+    zlib1g-dev \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN (adduser --disabled-password --gecos '' claude 2>/dev/null || true)
+
+RUN mkdir -p /workspace && chown claude:claude /workspace
+
+USER claude
+WORKDIR /workspace
+RUN git clone --depth 1 https://github.com/sg-evals/postgres--5a461dc4.git . && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+USER root
+
+RUN mkdir -p /logs/agent /logs/verifier && \
+    chown -R claude:claude /logs
+
+ENTRYPOINT []

benchmarks/ccb_feature/postgres-copy-csv-header-feat-001/environment/Dockerfile.sg_only

@@ -0,0 +1,30 @@
+# postgres-copy-csv-header-feat-001 — sg_only_env variant (v2: clone-at-verify)
+# Verifier clones mirror at verification time via clone manifest.
+
+FROM gcc:14-bookworm
+
+ENV SOURCEGRAPH_REPO_NAME=sg-evals/postgres--5a461dc4
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git ca-certificates python3 curl \
+    bison flex libreadline-dev zlib1g-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace
+
+RUN git init && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
+
+RUN mkdir -p /logs/agent /logs/verifier
+
+# Clone manifest for verifier (clone-at-verify strategy)
+RUN echo '{"workdir":"/workspace","repos":[{"mirror":"sg-evals/postgres--5a461dc4","target_dir":"."}]}' > /tmp/.sg_only_clone_manifest.json
+
+RUN touch /tmp/.sg_only_mode
+
+RUN (adduser --disabled-password --gecos '' claude 2>/dev/null || true) && \
+    for d in /workspace /logs; do [ -d "$d" ] && chown -R claude:claude "$d"; done || true
+
+ENTRYPOINT []

benchmarks/ccb_feature/postgres-copy-csv-header-feat-001/instruction.md

@@ -0,0 +1,41 @@
+# Task: Implement COPY FROM CSV WITH HEADER MATCH for PostgreSQL
+
+## Objective
+Add a `HEADER MATCH` option to PostgreSQL's `COPY FROM` command that validates the CSV file's header row column names match the target table's column names (in order and spelling). Currently `COPY ... WITH (HEADER)` simply skips the first row; `HEADER MATCH` should verify it matches.
+
+## Requirements
+
+1. **Extend the COPY grammar** (`src/backend/parser/gram.y`):
+   - Add `MATCH` as a valid keyword after `HEADER` in COPY options
+   - The option should be: `HEADER MATCH` (two tokens) as an alternative to `HEADER` / `HEADER TRUE`
+   - Store the distinction in the CopyStmt or DefElem representation
+
+2. **Update COPY option processing** (`src/backend/commands/copy.c` or `src/backend/commands/copyfrom.c`):
+   - Parse the `HEADER MATCH` option and set a flag (e.g., `header_line` enum: OFF, ON, MATCH)
+   - Only valid for CSV format with COPY FROM (not COPY TO)
+   - Raise an error if HEADER MATCH is used with non-CSV format or COPY TO
+
+3. **Implement header validation** in the COPY FROM reader:
+   - After reading the first line of the CSV file, compare each column name to the corresponding column in the target table's column list
+   - Column comparison should be case-insensitive
+   - If extra/missing/mismatched columns are found, raise an ERROR with a descriptive message listing the mismatched column names
+
+4. **Add a regression test** in `src/test/regress/sql/copy.sql` (or a new file):
+   - Test HEADER MATCH with matching headers (should succeed)
+   - Test HEADER MATCH with mismatched headers (should fail with appropriate error)
+   - Test HEADER MATCH with wrong column count (should fail)
+
+## Key Reference Files
+- `src/backend/parser/gram.y` — SQL grammar (search for `copy_opt_list` and `HEADER`)
+- `src/backend/commands/copy.c` — COPY command entry point, option processing
+- `src/backend/commands/copyfrom.c` — COPY FROM implementation
+- `src/include/commands/copy.h` — CopyHeaderChoice enum and CopyFormatOptions
+- `src/include/parser/kwlist.h` — keyword list (MATCH may need adding)
+- `src/test/regress/sql/copy.sql` — existing COPY regression tests
+
+## Success Criteria
+- HEADER MATCH syntax accepted in SQL grammar
+- CopyHeaderChoice enum or equivalent extended with MATCH value
+- Header validation logic reads CSV header and compares to table columns
+- Appropriate error raised on mismatch
+- Regression test file exists with match/mismatch test cases

benchmarks/ccb_feature/postgres-copy-csv-header-feat-001/task.toml

@@ -0,0 +1,34 @@
+version = "1.0"
+
+[metadata]
+name = "postgres-copy-csv-header-feat-001"
+description = "Implement COPY FROM CSV WITH HEADER MATCH option that validates column headers match target table columns"
+license = "PostgreSQL"
+author_name = "CodeContextBench"
+author_email = "ccb@example.com"
+
+[task]
+id = "postgres-copy-csv-header-feat-001"
+repo = "postgres/postgres"
+category = "feature_implementation"
+language = "c"
+difficulty = "expert"
+time_limit_sec = 1800
+
+[verification]
+type = "test"
+command = "bash /tests/test.sh"
+reward_type = "checklist"
+description = "Checks feature implementation: grammar changes, COPY option parsing, header validation, error handling, regression test"
+
+[environment]
+build_timeout_sec = 900.0
+cpus = 4
+memory = "8G"
+storage = "20G"
+
+[environment.setup_scripts]
+mcp_config = '''
+#!/bin/bash
+echo "Sourcegraph MCP available for code search"
+'''

benchmarks/ccb_feature/postgres-copy-csv-header-feat-001/tests/sgonly_verifier_wrapper.sh

@@ -0,0 +1,194 @@
+#!/bin/bash
+# SG-only verifier wrapper: restore full repo + overlay agent changes
+#
+# Source this at the TOP of test.sh for build-requiring tasks that use
+# sg_only_env mode. It detects /tmp/.sg_only_mode and:
+#
+# PRIMARY PATH (clone manifest):
+#   1. Reads clone manifest from /tmp/.sg_only_clone_manifest.json
+#   2. Backs up agent-written files (non-empty, non-git, non-test)
+#   3. Clones each mirror repo with --depth 1
+#   4. Re-runs inject_defects.sh if specified in manifest
+#   5. Overlays agent changes on top
+#
+# LEGACY FALLBACK (pre-v2 images):
+#   If manifest is missing but /repo_full/ exists, restores from /repo_full/
+#   as before. This ensures unregenerated images still work during rollout.
+#
+# For non-sg_only runs, this script is a no-op.
+#
+# Usage in test.sh:
+#   #!/bin/bash
+#   # Source the sg_only wrapper (no-op if not in sg_only mode)
+#   if [ -f /tests/sgonly_verifier_wrapper.sh ]; then
+#       source /tests/sgonly_verifier_wrapper.sh
+#   fi
+#   # ... rest of test.sh as normal ...
+
+if [ ! -f /tmp/.sg_only_mode ]; then
+    # Not in sg_only mode — nothing to do
+    return 0 2>/dev/null || exit 0
+fi
+
+# Idempotency guard: skip if already sourced (avoids double-clone when
+# test.sh sources this wrapper and then eval.sh sources it again)
+if [ -n "${_SG_ONLY_RESTORED:-}" ]; then
+    return 0 2>/dev/null || exit 0
+fi
+export _SG_ONLY_RESTORED=1
+
+echo "[sg_only_verifier] Detected sg_only mode, restoring full repo..."
+
+# ---------------------------------------------------------------------------
+# Helper: back up agent-written files from a directory
+# ---------------------------------------------------------------------------
+backup_agent_files() {
+    local srcdir="$1"
+    if [ ! -d "$srcdir" ]; then
+        return
+    fi
+    cd "$srcdir"
+    mkdir -p /tmp/agent_work
+    find . -type f -size +0 \
+        ! -path './.git/*' \
+        ! -path './tests/*' \
+        ! -path './.claude/*' \
+        -print0 | while IFS= read -r -d '' f; do
+        mkdir -p "/tmp/agent_work/$(dirname "$f")"
+        cp "$f" "/tmp/agent_work/$f"
+    done
+    echo "[sg_only_verifier] Backed up agent-written files from $srcdir"
+}
+
+# ---------------------------------------------------------------------------
+# Helper: overlay agent-written files back onto a directory
+# ---------------------------------------------------------------------------
+overlay_agent_files() {
+    local targetdir="$1"
+    if [ ! -d /tmp/agent_work ]; then
+        return
+    fi
+    cd /tmp/agent_work
+    find . -type f -print0 | while IFS= read -r -d '' f; do
+        local target="${targetdir}/${f#./}"
+        mkdir -p "$(dirname "$target")"
+        cp "$f" "$target"
+    done
+    echo "[sg_only_verifier] Overlaid agent changes onto $targetdir"
+}
+
+# ---------------------------------------------------------------------------
+# PRIMARY PATH: clone manifest
+# ---------------------------------------------------------------------------
+MANIFEST="/tmp/.sg_only_clone_manifest.json"
+
+if [ -f "$MANIFEST" ]; then
+    echo "[sg_only_verifier] Found clone manifest, using clone-at-verify strategy"
+
+    # Parse manifest with python3 (always available in our images)
+    WORKDIR=$(python3 -c "import json; m=json.load(open('$MANIFEST')); print(m.get('workdir', '/workspace'))")
+    echo "[sg_only_verifier] Working directory: $WORKDIR"
+
+    # 1. Back up agent-written files
+    backup_agent_files "$WORKDIR"
+
+    # 2. Clone each mirror repo
+    REPO_COUNT=$(python3 -c "import json; m=json.load(open('$MANIFEST')); print(len(m.get('repos', [])))")
+    for i in $(seq 0 $((REPO_COUNT - 1))); do
+        MIRROR=$(python3 -c "import json; m=json.load(open('$MANIFEST')); print(m['repos'][$i]['mirror'])")
+        TARGET_DIR=$(python3 -c "import json; m=json.load(open('$MANIFEST')); print(m['repos'][$i].get('target_dir', '.'))")
+        CLONE_URL="https://github.com/${MIRROR}.git"
+
+        if [ "$TARGET_DIR" = "." ]; then
+            CLONE_TARGET="$WORKDIR"
+        else
+            CLONE_TARGET="${WORKDIR}/${TARGET_DIR}"
+        fi
+
+        echo "[sg_only_verifier] Cloning $MIRROR -> $CLONE_TARGET"
+
+        # Remove existing directory contents (truncated files) but preserve .git
+        # for target_dir="." we need to be careful with the working directory
+        if [ "$TARGET_DIR" = "." ]; then
+            # For root workspace: remove everything except .git, then clone into temp and move
+            TMPCLONE=$(mktemp -d)
+            if git clone --depth 1 "$CLONE_URL" "$TMPCLONE" 2>/dev/null; then
+                # Remove old files (except .git and tests)
+                find "$CLONE_TARGET" -mindepth 1 -maxdepth 1 \
+                    ! -name '.git' ! -name 'tests' ! -name '.claude' \
+                    -exec rm -rf {} + 2>/dev/null || true
+                # Copy cloned files (except .git)
+                cd "$TMPCLONE"
+                find . -mindepth 1 -maxdepth 1 ! -name '.git' -exec cp -a {} "$CLONE_TARGET/" \;
+                # If workspace has no HEAD (bare git init), use mirror .git
+                # so that git diff HEAD works for diff-based verifiers.
+                if ! git -C "$CLONE_TARGET" rev-parse HEAD >/dev/null 2>&1; then
+                    rm -rf "$CLONE_TARGET/.git"
+                    cp -a "$TMPCLONE/.git" "$CLONE_TARGET/.git"
+                    echo "[sg_only_verifier] Replaced empty .git with mirror .git for diff baseline"
+                fi
+                cd /
+                rm -rf "$TMPCLONE"
+                echo "[sg_only_verifier] Restored $MIRROR to $CLONE_TARGET"
+            else
+                echo "[sg_only_verifier] WARNING: Failed to clone $CLONE_URL"
+                rm -rf "$TMPCLONE"
+            fi
+        else
+            # For subdirectory: remove and re-clone
+            rm -rf "$CLONE_TARGET"
+            if git clone --depth 1 "$CLONE_URL" "$CLONE_TARGET" 2>/dev/null; then
+                echo "[sg_only_verifier] Restored $MIRROR to $CLONE_TARGET"
+            else
+                echo "[sg_only_verifier] WARNING: Failed to clone $CLONE_URL"
+            fi
+        fi
+    done
+
+    # 3. Re-run inject_defects if specified
+    INJECT_SCRIPT=$(python3 -c "import json; m=json.load(open('$MANIFEST')); print(m.get('inject_defects', ''))")
+    if [ -n "$INJECT_SCRIPT" ] && [ -f "$INJECT_SCRIPT" ]; then
+        echo "[sg_only_verifier] Running defect injection: $INJECT_SCRIPT"
+        cd "$WORKDIR"
+        chmod +x "$INJECT_SCRIPT"
+        bash "$INJECT_SCRIPT"
+        echo "[sg_only_verifier] Defect injection complete"
+    fi
+
+    # 4. Overlay agent changes
+    overlay_agent_files "$WORKDIR"
+
+    # Return to working directory
+    cd "$WORKDIR"
+    echo "[sg_only_verifier] Clone-at-verify restore complete, proceeding with tests"
+
+    return 0 2>/dev/null || exit 0
+fi
+
+# ---------------------------------------------------------------------------
+# LEGACY FALLBACK: /repo_full/ restore (for pre-v2 images)
+# ---------------------------------------------------------------------------
+echo "[sg_only_verifier] No clone manifest found, trying legacy /repo_full/ restore..."
+
+# Read the working directory
+WORKDIR="$(cat /tmp/.sg_only_workdir 2>/dev/null || echo '/app')"
+echo "[sg_only_verifier] Working directory: $WORKDIR"
+
+if [ ! -d /repo_full ]; then
+    echo "[sg_only_verifier] WARNING: /repo_full not found, cannot restore"
+    return 0 2>/dev/null || exit 0
+fi
+
+# 1. Find files the agent wrote (non-empty, non-git, non-test files)
+backup_agent_files "$WORKDIR"
+
+# 2. Restore full repo from backup
+rsync -a --delete /repo_full/ "$WORKDIR/"
+echo "[sg_only_verifier] Restored full repo from /repo_full/"
+
+# 3. Overlay agent's changes
+overlay_agent_files "$WORKDIR"
+
+# Return to working directory
+cd "$WORKDIR"
+echo "[sg_only_verifier] Legacy restore complete, proceeding with tests"