chore: commit latest analysis, rehost tooling, and run artifacts

Author: sjarmak

benchmarks/csb_org_compliance/ccx-compliance-051/tests/ground_truth_meta.json

@@ -1,18 +1,18 @@
 {
-  "has_ground_truth": false,
-  "has_chunk_ground_truth": false,
+  "has_ground_truth": true,
+  "has_chunk_ground_truth": true,
   "ground_truth_source": "curator_agent",
-  "ground_truth_confidence": "low",
+  "ground_truth_confidence": "high",
   "task_name": "ccx-compliance-051",
   "curator_agent_version": "2.0",
   "model": "claude-opus-4-6",
   "backend": "local",
-  "timestamp": "2026-03-03T13:46:53.708588+00:00",
-  "files_count": 0,
-  "edit_files_count": 0,
-  "chunks_count": 0,
-  "symbols_count": 0,
-  "cost_usd": 0.0,
-  "elapsed_sec": 960.1,
-  "exploration_notes": "CLI timeout"
+  "timestamp": "2026-03-03T14:31:30.524944+00:00",
+  "files_count": 36,
+  "edit_files_count": 36,
+  "chunks_count": 45,
+  "symbols_count": 13,
+  "cost_usd": 0.9028,
+  "elapsed_sec": 165.8,
+  "exploration_notes": "Systematic audit of TLS configuration across prometheus/prometheus. Found 36 Go source files across 5 subsystems: (1) config/config.go defines all TLS-bearing config structs (ScrapeConfig, RemoteWriteConfig, RemoteReadConfig, AlertmanagerConfig, TracingConfig); (2) web/web.go + cmd/prometheus/main.go handle web server TLS via toolkit_web WebConfigFile; (3) tracing/tracing.go applies TLS to OTLP gRPC/HTTP exporters; (4) scrape/scrape.go and storage/remote/client.go create TLS-enabled HTTP clients"
 }

benchmarks/csb_org_compliance/ccx-compliance-051/tests/oracle_answer_agent.json

@@ -1,22 +1,281 @@
 {
-  "files": [],
-  "text": "CLI timeout",
+  "files": [
+    {
+      "repo": "",
+      "path": "config/config.go"
+    },
+    {
+      "repo": "",
+      "path": "cmd/prometheus/main.go"
+    },
+    {
+      "repo": "",
+      "path": "cmd/promtool/main.go"
+    },
+    {
+      "repo": "",
+      "path": "web/web.go"
+    },
+    {
+      "repo": "",
+      "path": "tracing/tracing.go"
+    },
+    {
+      "repo": "",
+      "path": "scrape/scrape.go"
+    },
+    {
+      "repo": "",
+      "path": "storage/remote/client.go"
+    },
+    {
+      "repo": "",
+      "path": "storage/remote/storage.go"
+    },
+    {
+      "repo": "",
+      "path": "notifier/alertmanagerset.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/triton/triton.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/openstack/openstack.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/consul/consul.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/kubernetes/kubernetes.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/http/http.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/azure/azure.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/hetzner/hetzner.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/digitalocean/digitalocean.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/scaleway/scaleway.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/vultr/vultr.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/eureka/eureka.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/puppetdb/puppetdb.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/marathon/marathon.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/moby/docker.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/moby/dockerswarm.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/nomad/nomad.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/linode/linode.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/ionos/ionos.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/uyuni/uyuni.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/xds/xds.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/stackit/stackit.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/aws/ec2.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/aws/lightsail.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/aws/ecs.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/aws/msk.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/aws/elasticache.go"
+    },
+    {
+      "repo": "",
+      "path": "discovery/aws/aws.go"
+    }
+  ],
+  "symbols": [
+    {
+      "repo": "prometheus/prometheus",
+      "path": "config/config.go",
+      "symbol": "TracingConfig.TLSConfig"
+    },
+    {
+      "repo": "prometheus/prometheus",
+      "path": "config/config.go",
+      "symbol": "TracingConfig.SetDirectory"
+    },
+    {
+      "repo": "prometheus/prometheus",
+      "path": "config/config.go",
+      "symbol": "ScrapeConfig.HTTPClientConfig"
+    },
+    {
+      "repo": "prometheus/prometheus",
+      "path": "config/config.go",
+      "symbol": "RemoteWriteConfig.HTTPClientConfig"
+    },
+    {
+      "repo": "prometheus/prometheus",
+      "path": "config/config.go",
+      "symbol": "RemoteReadConfig.HTTPClientConfig"
+    },
+    {
+      "repo": "prometheus/prometheus",
+      "path": "config/config.go",
+      "symbol": "AlertmanagerConfig.HTTPClientConfig"
+    },
+    {
+      "repo": "prometheus/prometheus",
+      "path": "cmd/promtool/main.go",
+      "symbol": "checkTLSConfig"
+    },
+    {
+      "repo": "prometheus/prometheus",
+      "path": "tracing/tracing.go",
+      "symbol": "Manager.ApplyConfig"
+    },
+    {
+      "repo": "prometheus/prometheus",
+      "path": "scrape/scrape.go",
+      "symbol": "newScrapeClient"
+    },
+    {
+      "repo": "prometheus/prometheus",
+      "path": "storage/remote/client.go",
+      "symbol": "ClientConfig.HTTPClientConfig"
+    },
+    {
+      "repo": "prometheus/prometheus",
+      "path": "storage/remote/client.go",
+      "symbol": "NewReadClient"
+    },
+    {
+      "repo": "prometheus/prometheus",
+      "path": "web/web.go",
+      "symbol": "Handler.Run"
+    },
+    {
+      "repo": "prometheus/prometheus",
+      "path": "notifier/alertmanagerset.go",
+      "symbol": "newAlertmanagerSet"
+    }
+  ],
+  "chain": [
+    {
+      "repo": "",
+      "path": "config/config.go",
+      "symbol": ""
+    },
+    {
+      "repo": "",
+      "path": "scrape/scrape.go",
+      "symbol": ""
+    },
+    {
+      "repo": "",
+      "path": "storage/remote/client.go",
+      "symbol": ""
+    },
+    {
+      "repo": "",
+      "path": "storage/remote/storage.go",
+      "symbol": ""
+    },
+    {
+      "repo": "",
+      "path": "tracing/tracing.go",
+      "symbol": ""
+    },
+    {
+      "repo": "",
+      "path": "web/web.go",
+      "symbol": ""
+    },
+    {
+      "repo": "",
+      "path": "cmd/prometheus/main.go",
+      "symbol": ""
+    },
+    {
+      "repo": "",
+      "path": "cmd/promtool/main.go",
+      "symbol": ""
+    },
+    {
+      "repo": "",
+      "path": "notifier/alertmanagerset.go",
+      "symbol": ""
+    }
+  ],
+  "text": "Systematic audit of TLS configuration across prometheus/prometheus. Found 36 Go source files across 5 subsystems: (1) config/config.go defines all TLS-bearing config structs (ScrapeConfig, RemoteWriteConfig, RemoteReadConfig, AlertmanagerConfig, TracingConfig); (2) web/web.go + cmd/prometheus/main.go handle web server TLS via toolkit_web WebConfigFile; (3) tracing/tracing.go applies TLS to OTLP gRPC/HTTP exporters; (4) scrape/scrape.go and storage/remote/client.go create TLS-enabled HTTP clients for scraping and remote write/read; (5) 27 service discovery plugins each define config structs with HTTPClientConfig (embedding TLSConfig) or direct TLSConfig fields (triton, openstack). cmd/promtool/main.go provides checkTLSConfig validation. notifier/alertmanagerset.go creates a TLS-enabled client for alertmanager communication.",
   "_metadata": {
     "generator": "context_retrieval_agent_cli",
     "model": "claude-opus-4-6",
     "backend": "local",
-    "input_tokens": 0,
-    "output_tokens": 0,
-    "tool_calls": 0,
-    "elapsed_sec": 960.1,
-    "cost_usd": 0.0,
-    "timestamp": "2026-03-03T13:46:53.708588+00:00",
+    "input_tokens": 690019,
+    "output_tokens": 10826,
+    "tool_calls": 28,
+    "elapsed_sec": 165.8,
+    "cost_usd": 0.9028,
+    "num_turns": 29,
+    "timestamp": "2026-03-03T14:31:30.524944+00:00",
     "cli_mode": true,
-    "error": true,
     "dual_verification": {
-      "n_total": 0,
+      "n_total": 36,
       "n_dual_verified": 0,
-      "n_local_only": 0,
+      "n_local_only": 36,
       "n_sg_only": 0,
       "n_unverified": 0
     }

benchmarks/csb_org_crossrepo_tracing/ccx-config-trace-003/tests/ground_truth_meta.json

@@ -1,18 +1,18 @@
 {
-  "has_ground_truth": false,
-  "has_chunk_ground_truth": false,
+  "has_ground_truth": true,
+  "has_chunk_ground_truth": true,
   "ground_truth_source": "curator_agent",
-  "ground_truth_confidence": "low",
+  "ground_truth_confidence": "high",
   "task_name": "ccx-config-trace-003",
   "curator_agent_version": "2.0",
   "model": "claude-opus-4-6",
   "backend": "local",
-  "timestamp": "2026-03-03T13:46:59.209926+00:00",
-  "files_count": 0,
-  "edit_files_count": 0,
-  "chunks_count": 0,
-  "symbols_count": 0,
-  "cost_usd": 0.0,
-  "elapsed_sec": 960.1,
-  "exploration_notes": "CLI timeout"
+  "timestamp": "2026-03-03T14:32:54.897689+00:00",
+  "files_count": 5,
+  "edit_files_count": 4,
+  "chunks_count": 11,
+  "symbols_count": 7,
+  "cost_usd": 0.5485,
+  "elapsed_sec": 83.8,
+  "exploration_notes": "Traced the HttpConnectionManager proto config across 3 repos. The proto is defined in data-plane-api (v3 active at envoy/extensions/.../v3/http_connection_manager.proto, v2 frozen at envoy/config/filter/.../v2/http_connection_manager.proto). The envoy C++ implementation in source/extensions/filters/network/http_connection_manager/ includes the generated .pb.h header and defines: HttpConnectionManagerFilterConfigFactory (network filter factory, createFilterFactoryFromProtoTyped entry point), Http"
 }