Seeded corpus
Known-bad code with known-good code beside it. It is how Redline answers whether the reviewer still works, rather than assuming it does.
A review system has two ways to fail and only one of them is loud. It can stop catching things, which no amount of ordinary telemetry distinguishes from a quiet week — or it can start flagging everything, which looks like diligence. 220 deliberate defects across 18 stacks measure the first; seeded/clean measures the second, with a pass condition of zero comments.
Nothing here is ever merged. It is opened as a throwaway pull request on a pilot repository, scored, and closed — by hand for a one-off, or weekly by seed-canary.yml.
clean →
Pass condition: zero comments. Correct code carrying no defects. Measures precision: the pass condition is zero comments, and a reviewer that flags anything here fails.
javascript →
9 defects, 7 of them BLOCKER. Seeded JavaScript defects — prototype pollution, dynamic code execution, floating promises.
react →
9 defects, 8 of them BLOCKER. Seeded React defects — hook discipline, state mutation, render-cycle bugs.
react-native →
8 defects, 6 of them BLOCKER. Seeded React Native defects — list performance and the JS/UI thread boundary.
angular →
15 defects, 9 of them BLOCKER. Seeded Angular defects — a disabled sanitiser, dead subscriptions, an open redirect, work in a template binding.
vue →
15 defects, 7 of them BLOCKER. Seeded Vue defects — reactivity lost on destructure, v-html, module-scope state shared across SSR requests.
svelte →
25 defects, 11 of them BLOCKER. Seeded Svelte and SvelteKit defects — {@html}, private env in shared code, secrets in a universal load.
dom →
15 defects, 8 of them BLOCKER. Seeded browser defects — innerHTML sinks, postMessage with no origin check, listeners that outlive the widget.
nodejs →
10 defects, 8 of them BLOCKER. Seeded NestJS defects — unvalidated DTOs, request state on singletons, a blocked event loop.
microservices →
9 defects, 5 of them BLOCKER. Seeded cross-cutting service defects — missing timeouts, non-idempotent consumers, PII in traces.
java →
9 defects, 8 of them BLOCKER. Seeded Spring Boot defects — entities out of controllers, N+1 queries, self-invoked @Transactional.
go →
10 defects, 8 of them BLOCKER. Seeded Go defects — ignored errors, leaked goroutines, missing context propagation.
python →
11 defects, 9 of them BLOCKER. Seeded Python defects — mutable defaults, bare excepts, string-interpolated SQL.
csharp →
10 defects, 7 of them BLOCKER. Seeded .NET defects — async void, sync-over-async deadlocks, per-request HttpClient.
kotlin →
11 defects, 9 of them BLOCKER. Seeded Kotlin defects — GlobalScope launches, swallowed CancellationException, leaked Context.
swift →
11 defects, 10 of them BLOCKER. Seeded Swift defects — UI off the main actor, uncancelled Tasks, retain cycles, force unwraps.
terraform →
9 defects, 5 of them BLOCKER. Seeded Terraform defects — committed secrets, public exposure, a rename with no moved block.