mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-19 21:19:28 +00:00
46 lines
2.5 KiB
Markdown
46 lines
2.5 KiB
Markdown
|
# Frontend retention verification
|
||
|
|
|
||
|
|
Date: 2026-09-13. Task: contributor-scan 2.18. Status: VERIFIED (TASK), independent review APPROVED.
|
||
|
|
|
||
|
|
The maintainer approved the frontend-retention prerequisite after real graph
|
||
|
|
inspection showed that supplied JavaScript tests were missing. Verification must
|
||
|
|
establish retained source paths and method nodes, vendor exclusion, unchanged
|
||
|
|
ordinary engine behavior and explicit adaptation identity.
|
||
|
|
|
||
|
|
The approved implementation adapts the two pinned upstream filters, preserving
|
||
|
|
original source bytes and paths. The existing ranker still marks tests unshipped;
|
||
|
|
the frontend inclusion policy does not select or admit findings. The installed
|
||
|
|
manifest distinguishes this adaptation from stock Joern 4.0.625 for future graph
|
||
|
|
compatibility checks.
|
||
|
|
|
||
|
|
Completion requires independent review and a passing packaged census, including
|
||
|
|
the test-directory fixture and four filename suffixes. A test-disabled control
|
||
|
|
must reproduce the former omission. Native PHP/JavaScript graph and change-context
|
||
|
|
regressions must pass before downstream task 3.4 resumes.
|
||
|
|
|
||
|
|
## Evidence
|
||
|
|
|
||
|
|
`benchmarks/measurements/2026-09-13-frontend-retention-smoke.json` retains the
|
||
|
|
installed manifest, source/output integrity checks and complete runtime results.
|
||
|
|
The graph includes all six JavaScript files (255 source bytes) and two PHP files
|
||
|
|
(97 bytes), with exact test method witnesses and no vendor nodes. Disabling the
|
||
|
|
policy reproduces the original test omission with exit 1. The mixed scan uses
|
||
|
|
one selected question across both supported frontends and names unsupported Go.
|
||
|
|
|
||
|
|
The PHP and JavaScript cross-file change-context regressions both complete with
|
||
|
|
one finding at the unchanged helper. The shared lab allowance is 900 seconds;
|
||
|
|
the mixed runtime took 260.93 seconds while concurrent checks were running. These
|
||
|
|
are controlled runtime checks, not hook latency measurements.
|
||
|
|
|
||
|
|
The independent full suite passed 1,141 tests with nine skipped in 125.68 seconds.
|
||
|
|
Ruff, formatting (229 files), mypy (109 files) and diff checks passed. Independent
|
||
|
|
installer checks verified an offline idempotent skip and corruption rejection.
|
||
|
|
The original-backend RED reproduction is retained and explicitly distinguished
|
||
|
|
from the implementer's initial reported failing run.
|
||
|
|
|
||
|
|
One backend comment changed after packaging; same-parser Python AST equality
|
||
|
|
proves no executable difference. Remaining listed modules match byte-for-byte;
|
||
|
|
installed dependency hashes match the manifest.
|
||
|
|
|
||
|
|
Task 2.18 is complete. Pre-push task 3.4 requires its own final review and verification.
|