inspequte-oss-fp-hunt

name	inspequte-oss-fp-hunt
description	Run inspequte false-positive hunting against small OSS libraries (Kotlin and Java+Guava), enable inspequte-gradle-plugin in cloned fixtures, capture Jaeger trace screenshots via the shared `scripts/capture-jaeger-trace-screenshot.mjs` helper, and triage SARIF findings one by one.

inspequte OSS FP hunt

Inputs

• Repository root of this project (contains gradle-plugin/ and target/debug/inspequte).
• Docker available for Jaeger.
• Java 21 available and set via JAVA_HOME.
• Network access to clone OSS fixtures from GitHub.
• Node.js + npm available for screenshot capture.

Outputs

• Fixture clones and temporary patches under target/oss-fp/workdir/.
• SARIF reports under target/oss-fp/<fixture>/inspequte/.
• Triage ledgers under target/oss-fp/triage/.
• Run summary in target/oss-fp/report.md.
• Jaeger screenshot and trace analysis under target/oss-fp/jaeger/.

Fixture policy

Default fixture set:

• Kotlin fixture: plasmoapp/plasmo-config
• Java+Guava fixture: launchdarkly/okhttp-eventsource

If one fixture is not buildable, replace it with another thin OSS fixture of the same category and record the reason in target/oss-fp/report.md.

Workflow

1. Execute .codex/skills/inspequte-oss-fp-hunt/scripts/run-once.sh from repository root.
2. The script clones fixtures, enables io.github.kengotoda.inspequte with local includeBuild, runs analysis tasks, exports SARIF, and writes triage ledgers with first-pass // classification plus reason and reference.