fix: harden review challenges and unify findings consistency

- 007: replace version-dependent finding with deterministic blockers
- 013: add ClosedPoolError hierarchy evidence to source excerpt
- 017: remove answer-revealing hints from background and comments
- 019: unify empty dual_coef_ shape contract across files
- refresh metadata analysis/scoringHints across all 20 challenges
- add challenge coverage matrix doc

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: study8677

challenges/review/001-sympy-point2d-ai-patch/metadata.json

@@ -42,8 +42,8 @@
   },
   "reviewTarget": {
     "file": "ai-pr.diff",
-    "kind": "adapted-ai-plausible-patch",
-    "note": "The reviewed patch is an AgentCode adapted patch for review training. It is not the upstream maintainer patch unless explicitly stated."
+    "kind": "adapted-for-review",
+    "note": "Adapted from a real upstream issue for review training. Whether this change should be merged is the question — reach your own conclusion before opening the source links."
   },
   "pr": {
     "title": "Fix Point raising 'Imaginary coordinates are not permitted' with evaluate(False)",

challenges/review/002-next-middleware-header-bypass/metadata.json

@@ -44,8 +44,8 @@
   },
   "reviewTarget": {
     "file": "ai-pr.diff",
-    "kind": "adapted-ai-plausible-patch",
-    "note": "The reviewed patch is an AgentCode adapted plausible-but-incorrect patch for review training. It is not the upstream maintainer patch unless explicitly stated."
+    "kind": "adapted-for-review",
+    "note": "Adapted from a real upstream issue for review training. Whether this change should be merged is the question — reach your own conclusion before opening the source links."
   },
   "pr": {
     "title": "Skip auth middleware for internal framework subrequests to prevent redundant re-execution",

challenges/review/003-next-server-actions-ssrf/metadata.json

@@ -44,8 +44,8 @@
   },
   "reviewTarget": {
     "file": "ai-pr.diff",
-    "kind": "adapted-ai-plausible-patch",
-    "note": "The reviewed patch is an AgentCode adapted plausible-but-incorrect patch for review training. It is not the upstream maintainer patch unless explicitly stated."
+    "kind": "adapted-for-review",
+    "note": "Adapted from a real upstream issue for review training. Whether this change should be merged is the question — reach your own conclusion before opening the source links."
   },
   "pr": {
     "title": "Support relative post-login redirects instead of only the configured origin",

challenges/review/004-axios-baseurl-absolute-url/README.en.md

@@ -1,4 +1,4 @@
-# Review 004: Axios — harden the internal API client against protocol-relative URL bypass
+# Review 004: Axios — add request URL validation to the internal API client
 
 You are a reviewer on this repository. An AI agent submitted the PR below. CI is green and the decision is yours.
 

challenges/review/004-axios-baseurl-absolute-url/README.zh.md

@@ -1,4 +1,4 @@
-# Review 004：Axios：加固内部 API client，拦截 protocol-relative URL 绕过 baseURL
+# Review 004：Axios：给内部 API client 增加请求 URL 校验
 
 你是这个仓库的 reviewer。一个 AI agent 提交了下面这个 PR，CI 全绿，等待你的结论。
 

challenges/review/004-axios-baseurl-absolute-url/metadata.json

@@ -6,19 +6,18 @@
   "difficulty": "senior",
   "status": "ready",
   "title": {
-    "zh": "Axios：加固内部 API client，拦截 protocol-relative URL 绕过 baseURL",
-    "en": "Axios: harden the internal API client against protocol-relative URL bypass"
+    "zh": "Axios：给内部 API client 增加请求 URL 校验",
+    "en": "Axios: add request URL validation to the internal API client"
   },
   "summary": {
-    "zh": "审查一个安全加固补丁：作者给带 Authorization 的 internal API client 增加校验，拒绝以 // 开头的 protocol-relative URL，防止它们绕过 baseURL。",
-    "en": "Review a security hardening patch that rejects protocol-relative (//) URLs on an Authorization-bearing internal API client so they cannot bypass baseURL."
+    "zh": "审查一个给带 Authorization 的 internal API client 增加 URL 校验的补丁：作者拒绝以 // 开头的 protocol-relative URL。",
+    "en": "Review a patch that adds URL validation to an internal API client carrying an Authorization header: it rejects protocol-relative URLs starting with //."
   },
   "language": "TypeScript / Axios",
   "tags": [
     "axios",
     "security",
-    "ssrf",
-    "credential-leak",
+    "http-client",
     "url-parsing"
   ],
   "source": {
@@ -45,8 +44,8 @@
   },
   "reviewTarget": {
     "file": "ai-pr.diff",
-    "kind": "adapted-ai-plausible-patch",
-    "note": "The reviewed patch is an AgentCode adapted plausible-but-incorrect patch for review training. It is not the upstream maintainer patch unless explicitly stated."
+    "kind": "adapted-for-review",
+    "note": "Adapted from a real upstream issue for review training. Whether this change should be merged is the question — reach your own conclusion before opening the source links."
   },
   "pr": {
     "title": "Reject protocol-relative URLs on internalApi to prevent baseURL bypass",

challenges/review/005-path-to-regexp-redos/metadata.json

@@ -45,8 +45,8 @@
   },
   "reviewTarget": {
     "file": "ai-pr.diff",
-    "kind": "adapted-ai-plausible-patch",
-    "note": "The reviewed patch is an AgentCode adapted patch for review training. It is not the upstream maintainer patch unless explicitly stated."
+    "kind": "adapted-for-review",
+    "note": "Adapted from a real upstream issue for review training. Whether this change should be merged is the question — reach your own conclusion before opening the source links."
   },
   "pr": {
     "title": "Fix ReDoS in route compilation for adjacent parameters (GHSA-9wv6-86v2-598j)",

challenges/review/006-tough-cookie-prototype-pollution/metadata.json

@@ -45,8 +45,8 @@
   },
   "reviewTarget": {
     "file": "ai-pr.diff",
-    "kind": "adapted-ai-plausible-patch",
-    "note": "The reviewed patch is an AgentCode adapted patch for review training. It is not the upstream maintainer patch unless explicitly stated."
+    "kind": "adapted-for-review",
+    "note": "Adapted from a real upstream issue for review training. Whether this change should be merged is the question — reach your own conclusion before opening the source links."
   },
   "pr": {
     "title": "Reject __proto__ cookie domain to fix prototype pollution (GHSA-72xf-g2v4-qvf3)",

challenges/review/007-jsonwebtoken-algorithm-pinning/README.en.md

@@ -37,7 +37,7 @@ Testing:
 ## Background
 
 - verifySession is the server-side entry point for validating session Bearer tokens: it takes a JWT, hands it to jsonwebtoken's jwt.verify to check the signature and issuer/audience, and returns the payload on success.
-- The production signing key, public-key path, and related settings come from environment configuration read at process startup.
+- The production signing key, public-key path, accepted algorithms, and related settings come from environment configuration read at process startup. Missing required auth configuration should fail closed before request handling.
 
 ## Answers and analysis
 

challenges/review/007-jsonwebtoken-algorithm-pinning/README.zh.md

@@ -37,7 +37,7 @@ Testing:
 ## 背景
 
 - verifySession 是服务端校验会话 Bearer 令牌的入口：拿到 JWT，交给 jsonwebtoken 的 jwt.verify 校验签名和 issuer/audience，通过后返回 payload。
-- 生产环境的签名密钥、公钥路径等都来自环境配置，在进程启动时读取。
+- 生产环境的签名密钥、公钥路径、允许算法等都来自环境配置，在进程启动时读取。认证必需配置缺失时应在请求处理前 fail closed。
 
 ## 答案与解析