marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-11-13 01:48:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(access-control-prover): locate family contract boundary

Browse Source
This commit is contained in:
Marius Ciepluch
2026-11-01 14:58:53 +01:00
parent 8991f44ee3
commit 30df6b36ba
3 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/access-control-prover/design.md
+2
View File
@@ -127,6 +127,7 @@ src/openultrasast/
│ ├── cst.py # receiver, arity and signature capture │ ├── cst.py # receiver, arity and signature capture
│ └── obligations/ │ └── obligations/
│ ├── abstract_domain.py # relations, completeness, resources, authorities, judgments │ ├── abstract_domain.py # relations, completeness, resources, authorities, judgments
│ ├── core_contract.py # production access-control FamilyContract
│ ├── resolution.py # SymbolId, symbol index and CallTargetSet │ ├── resolution.py # SymbolId, symbol index and CallTargetSet
│ ├── summaries.py # monotone FunctionSummary computation over call components │ ├── summaries.py # monotone FunctionSummary computation over call components
│ ├── paths.py # concrete evidence paths and cutoff records │ ├── paths.py # concrete evidence paths and cutoff records
@@ -153,6 +154,7 @@ benchmarks/valid/
└── prover_admission.py # frozen-manifest admission orchestration └── prover_admission.py # frozen-manifest admission orchestration
tests/ tests/
├── test_obligation_abstract_domain.py ├── test_obligation_abstract_domain.py
├── test_obligation_core_contract.py
├── test_obligation_resolution.py ├── test_obligation_resolution.py
├── test_obligation_summaries.py ├── test_obligation_summaries.py
├── test_obligation_judgment.py ├── test_obligation_judgment.py
.kiro/specs/access-control-prover/spec.json
+1 -1
View File
@@ -1,7 +1,7 @@
{ {
"feature_name": "access-control-prover", "feature_name": "access-control-prover",
"created_at": "2026-10-14T13:48:18Z", "created_at": "2026-10-14T13:48:18Z",
"updated_at": "2026-11-01T13:57:54Z", "updated_at": "2026-11-01T14:01:30Z",
"language": "en", "language": "en",
"phase": "tasks-generated", "phase": "tasks-generated",
"approvals": { "approvals": {
.kiro/specs/access-control-prover/tasks.md
+1 -1
View File
@@ -333,7 +333,7 @@ its final resolution, dominance, fact-acquisition and measurement semantics with
- [ ] 14. Reviewed detection-core fact adapter - [ ] 14. Reviewed detection-core fact adapter
- [ ] 14.1 Define the production access-control family contract - [ ] 14.1 Define the production access-control family contract
- Encode the versioned access-control security object, roles, three decision rules, residual question and closed incompleteness reasons through public detection-core types. - Encode the versioned access-control security object, roles, three decision rules, residual question and closed incompleteness reasons through public detection-core types.
- Keep target names outside the contract while pinning every digest-affecting field, status, origin policy and ecosystem declared by the design. - Keep target names confined to the reviewed ecosystem declaration while pinning every digest-affecting field, status, origin policy and decision semantic declared by the design.
- Done when the canonical production contract validates, round-trips deterministically, and rejects every altered or undeclared role, decision, field and reason fixture. - Done when the canonical production contract validates, round-trips deterministically, and rejects every altered or undeclared role, decision, field and reason fixture.
- _Requirements: 13.1_ - _Requirements: 13.1_
- _Boundary: Access-Control Family Contract_ - _Boundary: Access-Control Family Contract_