From 00d1c26f5f7d6daca625f330a41419cd2bc48e89 Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Wed, 7 Oct 2026 10:29:40 +0200 Subject: [PATCH] search-with-proof: require the path demo to serve ${served_root} (via arg/env/config) Path searches authored and verified many demos but all came back with no differential: the demo never pointed the app's served directory at ${served_root}, so the observable (which lives relative to ${served_root}) was outside the served tree and unreachable. The agent had set an app env var to a value of its own; the guide only showed the --dir form. ORACLE_GUIDE now states the agent MUST set the app's served/root to the ${served_root} placeholder via whichever mechanism the app exposes (command-line argument, environment variable, or config written to start.files), not only --dir, and that serving elsewhere makes the observable unreachable. Verify-time-only clarification, observable names, and all prohibitions are kept. Prompt strings only. Tests: tests/test_search_worker.py 37 passed; ruff clean. Co-Authored-By: Claude Opus 4.8 --- src/openultrasast/search/worker.py | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/src/openultrasast/search/worker.py b/src/openultrasast/search/worker.py index b14ec9c..3b32c45 100644 --- a/src/openultrasast/search/worker.py +++ b/src/openultrasast/search/worker.py @@ -98,12 +98,13 @@ DEMO_GUIDE = ( "point environment values at .demo/name. Allowed: .pem .key .json .yaml .yml .txt .env .ini .toml .db .sqlite .crt." ) ORACLE_GUIDE = ( - "The verifier injects the oracle fixture/observable at VERIFY time only, never during exploration. " - "Do not seek it in the explore checkout: absence never means unreachable or justifies ending the search. " - "Confirm the mechanism with explore tools using app code and, where useful, your own sandbox test data: " - "sink reachability and access to data the app should not expose, without the verifier observable. " - "Target its known verifier-time location below in the demo; only differential verification on both revisions proves it. " - "Path observes a private nonce file named canary in the parent of ${served_root} in app output. " + "Verifier observables exist at VERIFY time only: never seek them in exploration or stop for absence. " + "Explore reachability/disclosure using app code/own sandbox data; demos target below. " + "Only differential verification across revisions proves it. " + "Path observes app output for private nonce file canary in ${served_root}'s parent. " + "MUST set the app's served/root to exactly the ${served_root} placeholder via its command-line argument " + "(e.g. --dir ${served_root}), environment variable or config in start.files. " + "It lives relative to ${served_root}; serving elsewhere makes it unreachable: the search cannot succeed. " "SQL observes secret rows in ${database_path} (${database_url} is its SQLite URL). " "Command observes marker creation at marker location ${marker_dir}/marker. " "SSRF observes the nonce URL at its loopback listener ${callback_url}. "