History

We built the wrong thing first

trace did not start as trace. It started as Vulnpatch, a dashboard built on a specific bet about where CVE remediation gets stuck. The bet was wrong, and abandoning it shaped this project as much as anything it produces now.

What Vulnpatch was

Vulnpatch pulls CVE intelligence from MITRE, NVD, OSV, GHSA, EPSS and KEV, plus the nixpkgs security tracker. It ranks each CVE by whether attackers are exploiting it and hands a maintainer the context that matters. The bet underneath it was that the maintainer is the bottleneck, so a faster workflow gets packages patched faster. The free public data layer from that work still runs at cve.vulnpatch.dev, and trace's own discovery role reads from it today. Vulnpatch itself is being rebuilt on a different approach, separately from trace.

The assumption that didn't work

The real bottleneck is verification. Every claim that reaches a maintainer has to be checked by hand: which package is affected, which upstream commit fixes it, whether the package still builds, whether the tests still pass. Nothing that arrives carries proof. A faster workflow leaves that untouched and delivers unverified work sooner. Frontier models were also getting good enough to write a plausible patch on their own. Automating the dashboard would soon mean automating the wrong half of the problem.

Thirty-five minutes

Vulnpatch was already built with frontier models in the loop, and the plan from there was to fine-tune a cheaper open model to do the remediation itself at scale once enough examples existed. A new frontier model's release (Mythos) landed mid-build, and the plan no longer made sense: a dashboard to help a maintainer dispatch the work, or a cheaper model trained to attempt it, was solving the wrong problem next to a model that, set up correctly, could already attempt the patch itself. Vulnpatch's git history shows steady feature work through the morning of 23 April 2026, then a hard stop. The last commit in that stretch lands at 12:22. trace's first commit lands at 12:57 the same day, thirty-five minutes later. Nobody pushed the earlier work aside; the reasoning came first, and the timestamps in the two repositories mark the moment the work moved. Vulnpatch's data layer kept running with light maintenance, and the engineering moved to trace.

What this means

The thesis was not invented after the fact to explain the pivot. Proof matters more than generation, and that is why the pivot happened. The failures this pipeline has caught in itself and in its own models are the evidence that the thesis was worth building around.