{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:BKPS3Z4GWJEOIH5HRAWJVC56YY","short_pith_number":"pith:BKPS3Z4G","canonical_record":{"source":{"id":"2607.13439","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-15T04:49:05Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"5985c978a772bddcc2d54686752a15e81b89e6444b168c1571cebfdb060fec14","abstract_canon_sha256":"4dc94c586f2a65096bc7918e548ed72d55333cf0597d699b7b8846a4dd77653c"},"schema_version":"1.0"},"canonical_sha256":"0a9f2de786b248e41fa7882c9a8bbec614acf2abdd50bd99a175ccdc22849be9","source":{"kind":"arxiv","id":"2607.13439","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.13439","created_at":"2026-07-16T01:22:12Z"},{"alias_kind":"arxiv_version","alias_value":"2607.13439v1","created_at":"2026-07-16T01:22:12Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.13439","created_at":"2026-07-16T01:22:12Z"},{"alias_kind":"pith_short_12","alias_value":"BKPS3Z4GWJEO","created_at":"2026-07-16T01:22:12Z"},{"alias_kind":"pith_short_16","alias_value":"BKPS3Z4GWJEOIH5H","created_at":"2026-07-16T01:22:12Z"},{"alias_kind":"pith_short_8","alias_value":"BKPS3Z4G","created_at":"2026-07-16T01:22:12Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:BKPS3Z4GWJEOIH5HRAWJVC56YY","target":"record","payload":{"canonical_record":{"source":{"id":"2607.13439","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-15T04:49:05Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"5985c978a772bddcc2d54686752a15e81b89e6444b168c1571cebfdb060fec14","abstract_canon_sha256":"4dc94c586f2a65096bc7918e548ed72d55333cf0597d699b7b8846a4dd77653c"},"schema_version":"1.0"},"canonical_sha256":"0a9f2de786b248e41fa7882c9a8bbec614acf2abdd50bd99a175ccdc22849be9","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-16T01:22:12.816293Z","signature_b64":"uwx1nQ2EvEYeBaql7Wh0CmPtUyczVfB1r4qA9wGA780NuM7XzTciWvsRPLXjsJSfYuzupLNFYGrFpGkfReqgBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"0a9f2de786b248e41fa7882c9a8bbec614acf2abdd50bd99a175ccdc22849be9","last_reissued_at":"2026-07-16T01:22:12.815378Z","signature_status":"signed_v1","first_computed_at":"2026-07-16T01:22:12.815378Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2607.13439","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-16T01:22:12Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jslx/VI2yksRNjjEExMjuqTWGmKluC7lJtjhdC9GBQQR9rvhtn3/tpdyAaajxyj3xtLuCNs65cpcp/20N3rmAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T20:01:06.231712Z"},"content_sha256":"9dfff96460e641c3060ad0442486deca375f6aec4e597db3132f9bc9c222da6e","schema_version":"1.0","event_id":"sha256:9dfff96460e641c3060ad0442486deca375f6aec4e597db3132f9bc9c222da6e"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:BKPS3Z4GWJEOIH5HRAWJVC56YY","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"DREA: Decoupled Reasoning and Exploration Agents for Repository-Level Vulnerability Detection","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Guozhu Meng, Mingyang Sun","submitted_at":"2026-07-15T04:49:05Z","abstract_excerpt":"Large language models (LLMs) are increasingly applied to vulnerability detection due to their strong code comprehension capabilities, but most existing approaches rely on isolated functions or context extracted by fixed program-analysis rules. These methods cannot adaptively explore repository-level dependencies to gather sufficient context when vulnerabilities span multiple functions or files, compromising detection reliability. We present DREA (Decoupled Reasoning and Exploration Agents), a hypothesis-driven framework for repository-level vulnerability detection. DREA decouples reasoning fro"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.13439","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2607.13439/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-16T01:22:12Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"5tKmEG+/YVKxiMWN184oeCsaSPK2+JaEFVwiaF3N2xnaMHEryzdKB5guEJVi6GaJ0oA7wEHXTd9Ty5ql5jhmBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T20:01:06.232287Z"},"content_sha256":"ebbd0a199c60ece42ddb419b3789076c81ccf5b61714423a7c1647f5e64694ee","schema_version":"1.0","event_id":"sha256:ebbd0a199c60ece42ddb419b3789076c81ccf5b61714423a7c1647f5e64694ee"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/BKPS3Z4GWJEOIH5HRAWJVC56YY/bundle.json","state_url":"https://pith.science/pith/BKPS3Z4GWJEOIH5HRAWJVC56YY/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/BKPS3Z4GWJEOIH5HRAWJVC56YY/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-04T20:01:06Z","links":{"resolver":"https://pith.science/pith/BKPS3Z4GWJEOIH5HRAWJVC56YY","bundle":"https://pith.science/pith/BKPS3Z4GWJEOIH5HRAWJVC56YY/bundle.json","state":"https://pith.science/pith/BKPS3Z4GWJEOIH5HRAWJVC56YY/state.json","well_known_bundle":"https://pith.science/.well-known/pith/BKPS3Z4GWJEOIH5HRAWJVC56YY/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:BKPS3Z4GWJEOIH5HRAWJVC56YY","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"4dc94c586f2a65096bc7918e548ed72d55333cf0597d699b7b8846a4dd77653c","cross_cats_sorted":["cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-15T04:49:05Z","title_canon_sha256":"5985c978a772bddcc2d54686752a15e81b89e6444b168c1571cebfdb060fec14"},"schema_version":"1.0","source":{"id":"2607.13439","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.13439","created_at":"2026-07-16T01:22:12Z"},{"alias_kind":"arxiv_version","alias_value":"2607.13439v1","created_at":"2026-07-16T01:22:12Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.13439","created_at":"2026-07-16T01:22:12Z"},{"alias_kind":"pith_short_12","alias_value":"BKPS3Z4GWJEO","created_at":"2026-07-16T01:22:12Z"},{"alias_kind":"pith_short_16","alias_value":"BKPS3Z4GWJEOIH5H","created_at":"2026-07-16T01:22:12Z"},{"alias_kind":"pith_short_8","alias_value":"BKPS3Z4G","created_at":"2026-07-16T01:22:12Z"}],"graph_snapshots":[{"event_id":"sha256:ebbd0a199c60ece42ddb419b3789076c81ccf5b61714423a7c1647f5e64694ee","target":"graph","created_at":"2026-07-16T01:22:12Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2607.13439/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Large language models (LLMs) are increasingly applied to vulnerability detection due to their strong code comprehension capabilities, but most existing approaches rely on isolated functions or context extracted by fixed program-analysis rules. These methods cannot adaptively explore repository-level dependencies to gather sufficient context when vulnerabilities span multiple functions or files, compromising detection reliability. We present DREA (Decoupled Reasoning and Exploration Agents), a hypothesis-driven framework for repository-level vulnerability detection. DREA decouples reasoning fro","authors_text":"Guozhu Meng, Mingyang Sun","cross_cats":["cs.SE"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-15T04:49:05Z","title":"DREA: Decoupled Reasoning and Exploration Agents for Repository-Level Vulnerability Detection"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.13439","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:9dfff96460e641c3060ad0442486deca375f6aec4e597db3132f9bc9c222da6e","target":"record","created_at":"2026-07-16T01:22:12Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"4dc94c586f2a65096bc7918e548ed72d55333cf0597d699b7b8846a4dd77653c","cross_cats_sorted":["cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-15T04:49:05Z","title_canon_sha256":"5985c978a772bddcc2d54686752a15e81b89e6444b168c1571cebfdb060fec14"},"schema_version":"1.0","source":{"id":"2607.13439","kind":"arxiv","version":1}},"canonical_sha256":"0a9f2de786b248e41fa7882c9a8bbec614acf2abdd50bd99a175ccdc22849be9","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"0a9f2de786b248e41fa7882c9a8bbec614acf2abdd50bd99a175ccdc22849be9","first_computed_at":"2026-07-16T01:22:12.815378Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-16T01:22:12.815378Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"uwx1nQ2EvEYeBaql7Wh0CmPtUyczVfB1r4qA9wGA780NuM7XzTciWvsRPLXjsJSfYuzupLNFYGrFpGkfReqgBA==","signature_status":"signed_v1","signed_at":"2026-07-16T01:22:12.816293Z","signed_message":"canonical_sha256_bytes"},"source_id":"2607.13439","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:9dfff96460e641c3060ad0442486deca375f6aec4e597db3132f9bc9c222da6e","sha256:ebbd0a199c60ece42ddb419b3789076c81ccf5b61714423a7c1647f5e64694ee"],"state_sha256":"c25418d65f9621708e8bdba8f41e73788d948347f3cfee7e3aa9d1bdf9d89033"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"IBv7reLLyGnN09VYvLL+7rcHpg8hTw8tXzOjqTQEAttW85/FDalr51yqSVGR4deWIq6WZbdMEp6a/PHJJRr3DA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-04T20:01:06.238077Z","bundle_sha256":"05f3111af7c753ba2dea03c97f95ec6d17b651136a2e1db39d2a8bbc087e58bc"}}