Blobfish AI
Open builder

Task Lab · grounded iteration 02

From random walk to real work

A tool graph can tell us what may connect. It cannot tell us what a colleague would actually ask, which policy must come first, or what documents would be on their desk. This lab starts with a known real-world workflow, admits graph variations only when research supports them, then mutates correlated public records into one internally consistent mock input packet.

Paper baselineDAG → random walk → prompt

Executable, but the sequence and inputs can feel assembled.

Grounded variationWorkflow → evidence DAG → constrained mutation

Every added step changes the prompt, documents, or verifier for a reason.

9 primary receipts3 real records mutated6 guarded mutations4 correlated input documents
01Researchsoftware supply-chain security

Observe a real remediation before generating one

The workflow comes from official GitHub guidance and a public advisory change. OSV and SPDX establish the input contracts; captured GitHub and OSV MCP surfaces establish what the world can execute; a real advisory, pull request, timeline, and fix commit provide values and ordering evidence.

World · software supply-chain security

Remediate a vulnerable application release through review

A production asset-management application is on a release affected by an authorization flaw. The engineer must verify the advisory, trace the upstream fix, prepare a reviewable patch with regression coverage, and merge only after the required checks and review pass.

Platform security engineer

Evidence ledger

paper methodGraph-Based Task Synthesis

The paper constructs weighted tool-dependency graphs, performs random walks to obtain tool-call sequences, and asks an LLM to draft task descriptions and answers.

Agent-World · baseline to improveworkflow guidanceGitHub Flow

A repository change proceeds through a branch, commits, a pull request linked to the issue, checks and review, merge, and branch deletion.

GitHub · workflow spinepublic data contractIssue timeline REST API

The public timeline endpoint exposes ordered pull-request events including commits, comments, merge, closure, and branch deletion.

GitHub · observed workflow eventsopen source datasetGitHub Advisory Database

The open advisory repository stores reviewed security advisories as machine-readable OSV JSON and accepts community corrections through pull requests.

GitHub · advisory document contractpublic data contractOSV API

The API supports package and batch queries plus full vulnerability retrieval with affected ranges, aliases, references, and fixed versions.

Open Source Vulnerabilities · vulnerability query and advisory fieldsdataset provenanceOSV data sources

OSV identifies the GitHub Advisory Database as a source and records its CC-BY-4.0 license.

Open Source Vulnerabilities · license and origin receiptcaptured tool contractGitHub MCP tool inventory

The captured verified surface exposes issue reading, file retrieval, branch creation, multi-file pushes, pull-request creation and inspection, review, and merge operations.

GitHub / Smithery · repository execution contractopen source tool surfaceOSV Advisory MCP Server

The upstream open-source server documents the package, batch, ecosystem, and full-advisory reads backed by OSV that appear in the captured four-tool contract.

cyanheads / GitHub · advisory execution contractofficial document contractSPDX Specifications

SPDX defines interoperable software bill-of-materials fields for packages, versions, identifiers, relationships, and provenance.

SPDX · dependency inventory shape
osv advisory9 real fields · captured 2026-08-22advisory pull request8 real fields · captured 2026-08-22upstream fix7 real fields · captured 2026-08-22
Captured benchmark and MCP inventory0 packs · 2 relevant servers
SourceReceiptCoverage
osv-advisory-mcp-servercyanheads-osv-advisory-mcp-server
sha256:20629309e5fda… · smithery-registry		4 operations · 4 reads · 0 writes
GitHubgithub
sha256:58502f2b8af85… · smithery-registry		86 operations · 55 reads · 31 writes