security-fix-oraclelisted

# Security-Fix Oracle — mining git history into a labeled vuln dataset A reproducible pipeline + runnable **harness** for converting a project's commit history into a quality-tiered, leakage-aware dataset of security fixes, enriched with **CVSS 3.1** scores and **SZZ vulnerability-introducer attribution**. Built and validated on `gitlab-org/gitlab` (189k commits → 18,202 security-relevant → 1,018 diff-verified gold + 204 non-Ruby confirmed; CVSS over 18,060 rows; SZZ over 13,643 diffed rows). The methodology is repo-agnostic; the harness constants point at the GitLab build and are meant to be re-pointed. ## What it produces A single Parquet (one row per commit SHA) with: - **labels**: `category` (vuln-class taxonomy term), `cwe[]`, `quality_tier` (gold/weak) - **features**: `subject`, `body`, `diff` (the fix patch), `sink`, `tainted_input`, `language` - **enrichment**: `cvss_score`/`cvss_vector`/`cvss_severity`, `vuln_class_cwe[]` - **attribution** (optional sidecar column, PII): `szz_introducers`, `szz_primary_introducer`, … - **quality signals**: `is_security_fix_regate`, `label_disagreement`, `near_dup_subject_hash` …plus a **data dictionary** documenting every column and the read-before-modeling caveats (train on gold, never use model-generated text as features, avoid random splits because of backports). ## Pipeline (7 phases) | # | Phase | Harness | Model? | Output | |---|-------|---------|--------|--------| | 1 | **Mine & triage** — classify every commit's securit