There was a while there where they were trying to test this out on the cvs codebase, IIRC. It's a good candidate: upstream doesn't exactly move quickly, but is very much a real-world codebase, still in use.
It shows up in this document of contracts: https://www.esd.whs.mil/Portals/54/Documents/FOID/Reading%20...
* Contract Number: FA875015C0124 * Performer Name: GALOIS, INC. * Agent Name: AFRL, Information Directorate MR * Program Name: Cyber Fault-tolerant Attack Recovery (CFAR) * Office: I2O * Fiscal Year: 2015 * Obligated ($): 2,099,878
There was a while there where they were trying to test this out on the cvs codebase, IIRC. It's a good candidate: upstream doesn't exactly move quickly, but is very much a real-world codebase, still in use.