mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-11-14 10:18:17 +00:00
36 lines
1.5 KiB
Markdown
36 lines
1.5 KiB
Markdown
|
# Measured budget derivation (detection-core task 2.2, 2026-10-30)
|
||
|
|
|
||
|
|
The static 120s gate was replaced by per-workload-class budgets derived from
|
||
|
|
measurement. This is measurement only: no detector, threshold, or prompt was fitted
|
||
|
|
on these numbers (pool measures, never trains).
|
||
|
|
|
||
|
|
## Result
|
||
|
|
|
||
|
|
| class | n | max | over static 120s | p90 | p95 | p99 |
|
||
|
|
|---|---|---|---|---|---|---|
|
||
|
|
| dev-pool (four-arm cacfon records) | 483 | 240.0s | 20 | 61.4s | **88.7s** | 210.0s |
|
||
|
|
| admission-pilot (264 records) | 264 | 7.7s | 0 | 2.6s | **3.2s** | 3.8s |
|
||
|
|
|
||
|
|
(derivation.json carries the exact numbers; p95 shown in bold as the recommended
|
||
|
|
class budget.)
|
||
|
|
|
||
|
|
## Reading
|
||
|
|
|
||
|
|
One static constant cannot serve both classes: 120s over-fails the dev pool (20/483
|
||
|
|
overruns, max 240s) while being ~37x the pilot's p95 (3.2s). Per-class measured budgets
|
||
|
|
fix both directions. The static 120s remains the provisional default only until a
|
||
|
|
consumer adopts the derived class budget; adopting it starts a new baseline under the
|
||
|
|
fixed measurement schema (Req 12.2).
|
||
|
|
|
||
|
|
## Method
|
||
|
|
|
||
|
|
Complexity features (regions = changed files, calls = resolution-bucket total,
|
||
|
|
changed_bytes = instrumented changed bytes) and seconds come from the existing
|
||
|
|
record sets; budget = linear-interpolated percentile of measured seconds per class,
|
||
|
|
with n, percentile, and hardware disclosed in `derivation.json`. Hardware:
|
||
|
|
local dev host, records of 2026-10-30.
|
||
|
|
|
||
|
|
Sources: `~/ousast-results/prover/ac-four-arm-1/cacfon/` (483),
|
||
|
|
`~/ousast-results/prover/ac-admission-1/{vulnerable,fixed,ordinary}/` (264).
|
||
|
|
Script: `/tmp/opencode/derive_budget_2.py`.
|