marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

search-with-proof: split compressed verifier archives, isolated pip installs, verifier module paths

Browse Source 
Archives are gzipped and uploaded in parts of at most 90 MB with per-part
digests (edge request limit); pip installs ignore the task venv so transitive
dependencies land in products; the verifier sets NODE_PATH and the Java
classpath from products when starting the app.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-06 11:15:09 +02:00
co-authored by Claude Fable 5.1
parent da804472b9
commit 0d3e6df31c
13 changed files with 437 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/steering/kube-ax.md
+4 -2
View File
@@ -18,8 +18,10 @@ Verified by the operator on 2026-10-05. These constraints apply across all workl
quota or a replacement for the worker memory limit.
- `ousast-engine-search-verify-*` tasks have no egress. The requested exception for
`files.because-security.com:443` is **pending**, not operationally verified. They
receive one presigned archive containing `checkout/`, `products/`, and `spec.json`,
built/exported by an executor. Only `VERIFY_INPUT_URL` and `RESULT_URL` cross the
receive a presigned manifest for a gzip level-6 archive containing `checkout/`,
`products/`, and `spec.json`, built/exported by an executor. Compressed archives
retain the 1 GiB cap and travel in parts of at most 90 MB, each digest-checked
before assembly and extraction under `/workspace`. Only `VERIFY_INPUT_URL` and `RESULT_URL` cross the
verifier boundary. Verifiers reject build recipes and do not install dependencies
or fetch repositories. Executors finish and release their slots before verifier
repetitions start. Both task types must be provisioned without model credentials.