Methodology

One Red-Blue duel turn: Red implements a feature with an embedded defect and submits a PR; Blue must repair it without removing the feature. Blue never sees the bug test suite that verifies the existence of the embedded bug. If all three checks pass (bug fixed, feature retained, no regression), Blue wins; if any fails, Red wins.
One turn of the Red-Blue duel. Red implements a feature with an embedded defect and submits a PR; Blue must repair it without removing the feature. Blue never sees the bug test suite that verifies the existence of the embedded bug. If all three checks pass (bug fixed, feature retained, no regression), Blue wins; if any fails, Red wins.

Methodology

Target repositories

15 real open-source repositories across 5 language families, each cloned at a pinned commit and baked into its own offline Docker image. Red tasks and Blue repairs are made against exactly these snapshots.

RepositoryLanguageSourcePinned commit
flaskPythonpallets/flask ↗7fff56f5172c3.1.1
jinjaPythonpallets/jinja ↗15206881c0063.1.6
sqlalchemyPythonsqlalchemy/sqlalchemy ↗5237d923ddb0rel_2_1_0b2
helmetTypeScripthelmetjs/helmet ↗638e43becc81v8.2.0
expressjsJavaScriptexpressjs/express ↗dbac741a49a5v5.2.1
node-jsonwebtokenJavaScriptauth0/node-jsonwebtoken ↗ed59e76ea37av9.0.3
chiGogo-chi/chi ↗3b171578ca44v5.3.0
csrfGogorilla/csrf ↗9dd6af1f6d30v1.7.3
jwtGogolang-jwt/jwt ↗7ceae619e739v5.3.1
java-html-sanitizerJavaowasp/java-html-sanitizer ↗4e186b8a8c84release-20260313.1
java-jwtJavaauth0/java-jwt ↗695fd2bea64b4.5.2
jjwtJavajwtk/jjwt ↗0df975627c2c0.12.6
cjsonCdavegamble/cjson ↗c859b25da029v1.7.19
libexpatClibexpat/libexpat ↗c61098da494eR_2_8_2
simdjsonC++simdjson/simdjson ↗1bcf71bd8505v4.6.4