From 04f888019b4549853efb949c26adc7b0a24aadab Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Mon, 14 Sep 2026 08:13:26 +0200 Subject: [PATCH] release: prepare v1.2.0-alpha.1 and record rollout blockers --- .github/workflows/release.yml | 3 ++ .kiro/specs/contributor-scan/spec.json | 9 +++- .kiro/specs/pre-push-safety-net/spec.json | 9 +++- .kiro/specs/pre-push-safety-net/status.md | 64 +++++++++++++++++++++++ README.md | 5 ++ RELEASE_NOTES.md | 26 +++++++++ pyproject.toml | 2 +- src/openultrasast/__init__.py | 2 +- uv.lock | 2 +- 9 files changed, 117 insertions(+), 5 deletions(-) create mode 100644 .kiro/specs/pre-push-safety-net/status.md create mode 100644 RELEASE_NOTES.md diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7dacff7..bdb49c9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -30,4 +30,7 @@ jobs: files: | dist/*.whl dist/*.tar.gz + body_path: RELEASE_NOTES.md generate_release_notes: true + prerelease: ${{ contains(github.ref_name, '-') }} + make_latest: ${{ !contains(github.ref_name, '-') }} diff --git a/.kiro/specs/contributor-scan/spec.json b/.kiro/specs/contributor-scan/spec.json index d1cb395..5fdd963 100644 --- a/.kiro/specs/contributor-scan/spec.json +++ b/.kiro/specs/contributor-scan/spec.json @@ -1,7 +1,7 @@ { "feature_name": "contributor-scan", "created_at": "2026-09-08T20:00:00Z", - "updated_at": "2026-09-14T06:06:32.633059+00:00", + "updated_at": "2026-09-14T06:10:56.975614+00:00", "language": "en", "phase": "implementation", "approvals": { @@ -65,5 +65,12 @@ "independent": false, "record": "census-repair-verification.md" } + }, + "release": { + "tag": "v1.2.0-alpha.1", + "package_version": "1.2.0a1", + "channel": "alpha", + "rollout_decision": "NO-GO", + "status_record": "census-repair-verification.md" } } diff --git a/.kiro/specs/pre-push-safety-net/spec.json b/.kiro/specs/pre-push-safety-net/spec.json index 168b5a7..07b4492 100644 --- a/.kiro/specs/pre-push-safety-net/spec.json +++ b/.kiro/specs/pre-push-safety-net/spec.json @@ -1,7 +1,7 @@ { "feature_name": "pre-push-safety-net", "created_at": "2026-09-12T15:35:00Z", - "updated_at": "2026-09-14T06:06:32.633405+00:00", + "updated_at": "2026-09-14T06:10:56.975614+00:00", "language": "en", "phase": "implementation", "approvals": { @@ -150,5 +150,12 @@ "record": "../contributor-scan/census-repair-verification.md", "effect": "Node 44/44 input census restored; partial/missing census remains explicitly unresolved. Existing eligibility stale; runtime/context/independent qualification remain NO-GO." } + }, + "release": { + "tag": "v1.2.0-alpha.1", + "package_version": "1.2.0a1", + "channel": "alpha", + "rollout_decision": "NO-GO", + "status_record": "status.md" } } diff --git a/.kiro/specs/pre-push-safety-net/status.md b/.kiro/specs/pre-push-safety-net/status.md new file mode 100644 index 0000000..976c989 --- /dev/null +++ b/.kiro/specs/pre-push-safety-net/status.md @@ -0,0 +1,64 @@ +# Pre-push safety net status — v1.2.0-alpha.1 + +Updated 2026-09-14. Phase: **implementation**. Requirements, design and tasks are +approved. **26/27 executable tasks complete; task 8.3 remains blocked.** +Rollout: **NO-GO**. The alpha tag publishes experimental implementation and evidence; +it does not approve normal hook capabilities or production enforcement. + +## Verified + +Immutable pushed snapshots, shared multi-ref deadlines, ranker-owned scope, physical +vendor exclusion, compatible immutable graph/result reuse, actionability admission, +compact truthful reporting and non-destructive hook integration are implemented. +Advisory and blocking share the same evidence bar; optional model output cannot bypass it. + +Contributor-scan task 2.19 is verified: the pinned frontend now retains the original +Gruntfile, bringing the real NodeGoat census from 43/44 to 44/44 files. Partial, absent +and malformed census no longer masquerade as a complete result or a falsely empty graph. +The final code verification recorded 1321 passed tests, nine skipped, passing canonical +gates and a packaged native PHP/JavaScript partition smoke. See +[owner verification](../contributor-scan/census-repair-verification.md). + +## Rollout blockers + +1. **Useful checks within the deadline are unproven.** The last full representative + runtime profile timed out on all 21 Node transactions, completing 0/24 declared target + checks. Cancellation/reporting stayed below the two-second allowance. The subsequent + census repair is verified, but the full changed-code runtime/coverage profile has not + passed under its new identities. Amortize engine startup/loading work and rerun the + frozen seven-class profile; require warm p95 <=30s and >=95% completed supported checks. +2. **Target and change-context evidence remains incomplete.** VAmPI preserves raw findings + at all three known sites, but the exact SQLI function question/transitive witness and + supported authorization context are unresolved. Raw findings or rank positions cannot + establish an actionable new regression. Repair this in the shared scan boundary and + verify the actual associated query/path evidence. +3. **Independent quality qualification is missing.** Freeze and review untouched Node API + vulnerable/fixed/benign cases, including middleware/module/async context. Ghost remains + reserved with missing reviewed inputs. PHP and Python need their own independent + language/framework/family populations; Node results cannot qualify them. Require >=95% + observed actionable precision with counts/intervals, >=90% supported recall, nonzero + reviewed emitted alerts/positive controls and zero known fixed/benign false alerts. +4. **No current capability is eligible.** The earlier registry is NO-GO and becomes stale + under the repaired runtime/core identities. Loading it enables zero capabilities. + After the preceding evidence passes together, regenerate exact-semantic eligibility + and rerun packaged acceptance validation. Do not relabel old measurements as current. + +C/libpng arithmetic and bounds remain explicitly unsupported; this is not a C/C++ +detection qualification. Advisory rollout cannot be justified by silence from an +unqualified registry. + +## Ownership and revalidation + +Engine lifecycle, source/census and context/witness normalization belong to +`contributor-scan`. The hook consumes those contracts; no second engine, source IR, +ranker priority exceptions or differential graph mutation is introduced here. Graph +mutation would need a separate cold-equivalence experiment. + +After owner fixes, refreeze identities and rerun ordinary scan gates, Python regressions, +PHP-to-Node transfer, the representative cache/deadline profile, independent per-capability +quality evaluation and packaged hook validation. Keep task 8.3 unchecked and the feature +in implementation until those mandatory results are established. + +Evidence: [group 8 validation](validation-group-8.md), +[runtime scorecard](../../../benchmarks/measurements/2026-09-13-nodegoat-feasibility.json), +[census repair](../../../benchmarks/measurements/2026-09-14-node-census-repair.json). diff --git a/README.md b/README.md index 1b7a5ae..3ecc7d7 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,10 @@ # OpenUltraSAST +**v1.2.0-alpha.1:** experimental pre-push safety net. Integration and census repairs are +verified; useful hook coverage, latency and independent capability qualification remain +**NO-GO**. No real hook capability is enabled. See [release notes](RELEASE_NOTES.md) and +[spec status](.kiro/specs/pre-push-safety-net/status.md). + OpenUltraSAST is a command-line security analysis harness built around one goal: eliminating false positives by turning a suspicion into an evidence-backed finding, and learning from the claims that were rejected. A diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md new file mode 100644 index 0000000..934bac7 --- /dev/null +++ b/RELEASE_NOTES.md @@ -0,0 +1,26 @@ +# v1.2.0-alpha.1 + +Experimental pre-push security safety net for AI-accelerated development. Python package +version: `1.2.0a1`. This alpha is **not a rollout GO**; no real hook capability is enabled. + +- Analyze immutable pushed commits across refs without changing the working tree or + replacing existing hooks. Share one deadline across preparation, analysis and reporting. +- Keep the existing ranker responsible for scope and physically exclude vendor code from + graph inputs. Reuse only compatible, complete immutable graph and answer artifacts. +- Gate advisory and blocking alerts on the same actionable change/witness/repair evidence. + Preserve explicit incomplete coverage; optional model assistance cannot create evidence. +- Add frozen runtime and PHP/Node/Python evaluation records with honest populations, + missing-target accounting and versioned eligibility that rejects stale evidence. +- Repair the pinned JavaScript frontend's Gruntfile omission and incomplete-census handling. + The real NodeGoat input now retains 44/44 files; native PHP/JavaScript smoke passes. + +Implementation verification: 1321 tests passed, nine skipped; detector/map/local-pair +gates and packaged partition smoke passed. These checks verify implementation contracts, +not useful hook precision, recall or latency. + +Rollout remains blocked by representative changed-code latency/completion, VAmPI +query/context/transitive evidence and independent reviewed per-capability populations. +The earlier eligibility artifact is stale under the repaired identities and enables +nothing. See [current spec status](https://github.com/norandom/OpenUltraSAST/blob/v1.2.0-alpha.1/.kiro/specs/pre-push-safety-net/status.md) for the +owners, unchanged thresholds and required revalidation. Pre-push implementation stands +at 26/27 tasks; task 8.3 remains blocked. C arithmetic/bounds detection is unsupported. diff --git a/pyproject.toml b/pyproject.toml index cba7a91..d101920 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "uv_build" [project] name = "openultrasast" -version = "1.1.0" +version = "1.2.0a1" description = "OpenCode-oriented SAST harness for evidence-gated security analysis" readme = "README.md" requires-python = ">=3.11" diff --git a/src/openultrasast/__init__.py b/src/openultrasast/__init__.py index 00742e8..a514765 100644 --- a/src/openultrasast/__init__.py +++ b/src/openultrasast/__init__.py @@ -2,4 +2,4 @@ __all__ = ["__version__"] -__version__ = "1.1.0" +__version__ = "1.2.0a1" diff --git a/uv.lock b/uv.lock index 5a57a9e..b8880b1 100644 --- a/uv.lock +++ b/uv.lock @@ -2138,7 +2138,7 @@ wheels = [ [[package]] name = "openultrasast" -version = "1.1.0" +version = "1.2.0a1" source = { editable = "." } [package.optional-dependencies]