Reproit Lab

Reproit Lab runs bounded Reproit campaigns against pinned open-source applications. It builds disposable worktrees, scans and fuzzes local targets, replays findings, and records the complete recall funnel.

The planted-defect corpus tests known expectations. The lab tests real applications, so every finding remains a candidate until affected and fixed revisions, controls, and evidence are reviewed.

Run

Build Reproit, then run the enabled campaign:

cd ../reproit-cli
cargo build -p reproit
cd ../reproit-lab

npm run list
npm run lab -- prepare
npm run lab -- run

Limit execution by target, tag, or phase:

npm run lab -- run --targets actual-budget-web
npm run lab -- run --targets lazygit-tui --phase fuzz
npm run lab -- run --tag web --phase scan

Set REPROIT_BIN to test another local binary. Use npm run lab -- clean to remove disposable work, or add --all to remove mirrors and artifacts too.

Outputs:

• reports/latest.json: canonical report and recall funnel;
• reports/latest.md: review summary;
• artifacts/<target>/: raw command, replay, lifecycle, and evidence logs;
• .work/: disposable worktrees and isolated homes;
• .cache/git/: reusable bare mirrors.

Safety

• Targets are allowlisted GitHub repositories pinned to full commits.
• Web targets must bind to loopback.
• Child processes receive a reduced environment and disposable HOME.
• Commands, output, readiness, retries, and process groups are bounded.
• Credentials, personal browser profiles, and SSH agents are not inherited.
• Stateful stacks use isolated Compose projects and remove owned volumes.
• Native runners record reset, device, application, architecture, and cleanup evidence.
• A target stays disabled until its setup and non-destructive action policy are reviewed.

Never add real credentials, personal data, or a production endpoint.

Targets and lifecycle

targets.json owns immutable source, license, setup, platform, and safety metadata. serviceStack describes disposable multi-service applications. nativeRunner describes reset, start, readiness, preparation, work, and cleanup for Android, iOS, Windows, and Linux workers.

The default campaign uses at least three discovery seeds and three replay attempts. Manifest validation rejects lower values.

Results and promotion

Execution distinguishes setup failure, target failure, tool failure, incomplete coverage, and application findings. A zero exit code without structured Reproit output is not success.

Evidence uses VIOLATION, SATISFIED, or ABSTAIN. Reproduction uses reproduced, not_reproduced, stale, or flaky.

A candidate is promotion-ready only after:

• an authoritative violation;
• three clean affected runs with the exact identity;
• three clean fixed runs reaching the same observation without that identity;
• verified minimization and neighboring behavior;
• distinct affected and fixed campaign identities;
• full affected, fixed, and current-main commits;
• exact native reset and cleanup evidence where required; and
• confirmed manual review.

The cumulative report measures observed, captured, eligible, executed, exact, minimized, fixed, and guarded. Missing evidence stays visible as a blocker. Finding IDs are not comparison identities; use stable oracle, invariant, and trigger fingerprints.